main/linux-grsec: upgrade to grsecurity-2.2.0-2.6.32.23-201009272133

(cherry picked from commit 9743ede01facb6eb5bbebae1c40bbed39a49aa12)

2 files changed, 116 insertions, 152 deletions

diff --git a/main/linux-grsec/APKBUILD b/main/linux-grsec/APKBUILD
index 457ff6c64f..7395160ae6 100644
--- a/main/linux-grsec/APKBUILD
+++ b/main/linux-grsec/APKBUILD
@@ -4,7 +4,7 @@ _flavor=grsec
 pkgname=linux-${_flavor}
 pkgver=2.6.32.23
 _kernver=2.6.32
-pkgrel=0
+pkgrel=1
 pkgdesc="Linux kernel with grsecurity"
 url=http://grsecurity.net
 depends="mkinitfs linux-firmware"
@@ -14,7 +14,7 @@ _config=${config:-kernelconfig.${CARCH:-x86}}
 install=
 source="ftp://ftp.kernel.org/pub/linux/kernel/v2.6/linux-$_kernver.tar.bz2
         ftp://ftp.kernel.org/pub/linux/kernel/v2.6/patch-$pkgver.bz2
-        grsecurity-2.2.0-2.6.32.23-201009262116.patch
+        grsecurity-2.2.0-2.6.32.23-201009272133.patch
         0001-grsec-revert-conflicting-flow-cache-changes.patch
         0002-gre-fix-hard-header-destination-address-checking.patch
         0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
@@ -150,7 +150,7 @@ firmware() {
 
 md5sums="260551284ac224c3a43c4adac7df4879  linux-2.6.32.tar.bz2
 6eac9aebbf9e74546b7c44c0fb9348a7  patch-2.6.32.23.bz2
-f70ef30c2d2c60ffe11560201fe61d50  grsecurity-2.2.0-2.6.32.23-201009262116.patch
+1c9943454ee525a584543090486bd63f  grsecurity-2.2.0-2.6.32.23-201009272133.patch
 1d247140abec49b96250aec9aa59b324  0001-grsec-revert-conflicting-flow-cache-changes.patch
 437317f88ec13ace8d39c31983a41696  0002-gre-fix-hard-header-destination-address-checking.patch
 151b29a161178ed39d62a08f21f3484d  0003-ip_gre-include-route-header_len-in-max_headroom-calc.patch
diff --git a/main/linux-grsec/grsecurity-2.2.0-2.6.32.23-201009262116.patch b/main/linux-grsec/grsecurity-2.2.0-2.6.32.23-201009272133.patch
index 4bebe8c85a..b87c317d86 100644
--- a/main/linux-grsec/grsecurity-2.2.0-2.6.32.23-201009262116.patch
+++ b/main/linux-grsec/grsecurity-2.2.0-2.6.32.23-201009272133.patch
@@ -5940,7 +5940,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/apm.h linux-2.6.32.23/arch/x86/i
                 "popl %%edi\n\t"
 diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch/x86/include/asm/atomic_32.h
 --- linux-2.6.32.23/arch/x86/include/asm/atomic_32.h    2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/arch/x86/include/asm/atomic_32.h    2010-09-15 02:35:26.000000000 -0400
++++ linux-2.6.32.23/arch/x86/include/asm/atomic_32.h    2010-09-26 22:16:58.000000000 -0400
 @@ -25,6 +25,17 @@ static inline int atomic_read(const atom
  }
  
@@ -6229,7 +6229,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch
         asm volatile(LOCK_PREFIX "xaddl %0, %1"
                      : "+r" (i), "+m" (v->counter)
                      : : "memory");
-@@ -227,22 +422,37 @@ static inline int atomic_xchg(atomic_t *
+@@ -227,22 +422,39 @@ static inline int atomic_xchg(atomic_t *
   */
  static inline int atomic_add_unless(atomic_t *v, int a, int u)
  {
@@ -6245,6 +6245,8 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch
 +               asm volatile("addl %2,%0\n"
 +
 +#ifdef CONFIG_PAX_REFCOUNT
++                            "jno 0f\n"
++                            "subl %2,%0\n"
 +                            "into\n0:\n"
 +                            _ASM_EXTABLE(0b, 0b)
 +#endif
@@ -6271,7 +6273,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch
  #define atomic_dec_return(v)  (atomic_sub_return(1, v))
  
  /* These are x86-specific, used by some header files */
-@@ -266,6 +476,14 @@ typedef struct {
+@@ -266,6 +478,14 @@ typedef struct {
         u64 __aligned(8) counter;
  } atomic64_t;
  
@@ -6288,7 +6290,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_32.h linux-2.6.32.23/arch
  extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
 diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch/x86/include/asm/atomic_64.h
 --- linux-2.6.32.23/arch/x86/include/asm/atomic_64.h    2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/arch/x86/include/asm/atomic_64.h    2010-09-21 20:46:18.000000000 -0400
++++ linux-2.6.32.23/arch/x86/include/asm/atomic_64.h    2010-09-26 22:30:45.000000000 -0400
 @@ -24,6 +24,17 @@ static inline int atomic_read(const atom
  }
  
@@ -6406,7 +6408,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "=m" (v->counter), "=qm" (c)
                      : "ir" (i), "m" (v->counter) : "memory");
         return c;
-@@ -90,7 +166,32 @@ static inline int atomic_sub_and_test(in
+@@ -90,7 +166,28 @@ static inline int atomic_sub_and_test(in
   */
  static inline void atomic_inc(atomic_t *v)
  {
@@ -6415,13 +6417,9 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                    "jno 0f\n"
-+                    "int $4\n0:\n"
-+                    ".pushsection .fixup,\"ax\"\n"
-+                    "1:\n"
 +                    LOCK_PREFIX "decl %0\n"
-+                    "jmp 0b\n"
-+                    ".popsection\n"
-+                    _ASM_EXTABLE(0b, 1b)
++                    "int $4\n0:\n"
++                    _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +                    : "=m" (v->counter)
@@ -6440,7 +6438,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "=m" (v->counter)
                      : "m" (v->counter));
  }
-@@ -103,7 +204,32 @@ static inline void atomic_inc(atomic_t *
+@@ -103,7 +200,28 @@ static inline void atomic_inc(atomic_t *
   */
  static inline void atomic_dec(atomic_t *v)
  {
@@ -6449,13 +6447,9 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                    "jno 0f\n"
-+                    "int $4\n0:\n"
-+                    ".pushsection .fixup,\"ax\"\n"
-+                    "1: \n"
 +                    LOCK_PREFIX "incl %0\n"
-+                    "jmp 0b\n"
-+                    ".popsection\n"
-+                    _ASM_EXTABLE(0b, 1b)
++                    "int $4\n0:\n"
++                    _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +                    : "=m" (v->counter)
@@ -6474,7 +6468,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "=m" (v->counter)
                      : "m" (v->counter));
  }
-@@ -120,7 +246,20 @@ static inline int atomic_dec_and_test(at
+@@ -120,7 +238,16 @@ static inline int atomic_dec_and_test(at
  {
         unsigned char c;
  
@@ -6483,20 +6477,16 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                    "jno 0f\n"
-+                    "int $4\n0:\n"
-+                    ".pushsection .fixup,\"ax\"\n"
-+                    "1: \n"
 +                    LOCK_PREFIX "incl %0\n"
-+                    "jmp 0b\n"
-+                    ".popsection\n"
-+                    _ASM_EXTABLE(0b, 1b)
++                    "int $4\n0:\n"
++                    _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +                    "sete %1\n"
                      : "=m" (v->counter), "=qm" (c)
                      : "m" (v->counter) : "memory");
         return c != 0;
-@@ -138,7 +277,20 @@ static inline int atomic_inc_and_test(at
+@@ -138,7 +265,16 @@ static inline int atomic_inc_and_test(at
  {
         unsigned char c;
  
@@ -6505,20 +6495,16 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                    "jno 0f\n"
-+                    "int $4\n0:\n"
-+                    ".pushsection .fixup,\"ax\"\n"
-+                    "1: \n"
 +                    LOCK_PREFIX "decl %0\n"
-+                    "jmp 0b\n"
-+                    ".popsection\n"
-+                    _ASM_EXTABLE(0b, 1b)
++                    "int $4\n0:\n"
++                    _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +                    "sete %1\n"
                      : "=m" (v->counter), "=qm" (c)
                      : "m" (v->counter) : "memory");
         return c != 0;
-@@ -157,7 +309,16 @@ static inline int atomic_add_negative(in
+@@ -157,7 +293,16 @@ static inline int atomic_add_negative(in
  {
         unsigned char c;
  
@@ -6536,7 +6522,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "=m" (v->counter), "=qm" (c)
                      : "ir" (i), "m" (v->counter) : "memory");
         return c;
-@@ -173,7 +334,31 @@ static inline int atomic_add_negative(in
+@@ -173,7 +318,31 @@ static inline int atomic_add_negative(in
  static inline int atomic_add_return(int i, atomic_t *v)
  {
         int __i = i;
@@ -6569,7 +6555,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "+r" (i), "+m" (v->counter)
                      : : "memory");
         return i + __i;
-@@ -185,6 +370,10 @@ static inline int atomic_sub_return(int 
+@@ -185,6 +354,10 @@ static inline int atomic_sub_return(int 
  }
  
  #define atomic_inc_return(v)  (atomic_add_return(1, v))
@@ -6580,7 +6566,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  #define atomic_dec_return(v)  (atomic_sub_return(1, v))
  
  /* The 64-bit atomic type */
-@@ -204,6 +393,18 @@ static inline long atomic64_read(const a
+@@ -204,6 +377,18 @@ static inline long atomic64_read(const a
  }
  
  /**
@@ -6599,7 +6585,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
   * atomic64_set - set atomic64 variable
   * @v: pointer to type atomic64_t
   * @i: required value
-@@ -216,6 +417,18 @@ static inline void atomic64_set(atomic64
+@@ -216,6 +401,18 @@ static inline void atomic64_set(atomic64
  }
  
  /**
@@ -6618,7 +6604,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
   * atomic64_add - add integer to atomic64 variable
   * @i: integer value to add
   * @v: pointer to type atomic64_t
-@@ -224,6 +437,28 @@ static inline void atomic64_set(atomic64
+@@ -224,6 +421,28 @@ static inline void atomic64_set(atomic64
   */
  static inline void atomic64_add(long i, atomic64_t *v)
  {
@@ -6647,7 +6633,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
         asm volatile(LOCK_PREFIX "addq %1,%0"
                      : "=m" (v->counter)
                      : "er" (i), "m" (v->counter));
-@@ -238,7 +473,15 @@ static inline void atomic64_add(long i, 
+@@ -238,7 +457,15 @@ static inline void atomic64_add(long i, 
   */
  static inline void atomic64_sub(long i, atomic64_t *v)
  {
@@ -6664,7 +6650,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "=m" (v->counter)
                      : "er" (i), "m" (v->counter));
  }
-@@ -256,7 +499,16 @@ static inline int atomic64_sub_and_test(
+@@ -256,7 +483,16 @@ static inline int atomic64_sub_and_test(
  {
         unsigned char c;
  
@@ -6682,7 +6668,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "=m" (v->counter), "=qm" (c)
                      : "er" (i), "m" (v->counter) : "memory");
         return c;
-@@ -270,6 +522,31 @@ static inline int atomic64_sub_and_test(
+@@ -270,6 +506,27 @@ static inline int atomic64_sub_and_test(
   */
  static inline void atomic64_inc(atomic64_t *v)
  {
@@ -6690,13 +6676,9 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                    "jno 0f\n"
-+                    "int $4\n0:\n"
-+                    ".pushsection .fixup,\"ax\"\n"
-+                    "1:\n"
 +                    LOCK_PREFIX "decq %0\n"
-+                    "jmp 0b\n"
-+                    ".popsection\n"
-+                    _ASM_EXTABLE(0b, 1b)
++                    "int $4\n0:\n"
++                    _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +                    : "=m" (v->counter)
@@ -6714,7 +6696,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
         asm volatile(LOCK_PREFIX "incq %0"
                      : "=m" (v->counter)
                      : "m" (v->counter));
-@@ -283,7 +560,32 @@ static inline void atomic64_inc(atomic64
+@@ -283,7 +540,28 @@ static inline void atomic64_inc(atomic64
   */
  static inline void atomic64_dec(atomic64_t *v)
  {
@@ -6723,13 +6705,9 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                    "jno 0f\n"
-+                    "int $4\n0:\n"
-+                    ".pushsection .fixup,\"ax\"\n"
-+                    "1: \n"
 +                    LOCK_PREFIX "incq %0\n"
-+                    "jmp 0b\n"
-+                    ".popsection\n"
-+                    _ASM_EXTABLE(0b, 1b)
++                    "int $4\n0:\n"
++                    _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +                    : "=m" (v->counter)
@@ -6748,7 +6726,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "=m" (v->counter)
                      : "m" (v->counter));
  }
-@@ -300,7 +602,20 @@ static inline int atomic64_dec_and_test(
+@@ -300,7 +578,16 @@ static inline int atomic64_dec_and_test(
  {
         unsigned char c;
  
@@ -6757,20 +6735,16 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                    "jno 0f\n"
-+                    "int $4\n0:\n"
-+                    ".pushsection .fixup,\"ax\"\n"
-+                    "1: \n"
 +                    LOCK_PREFIX "incq %0\n"
-+                    "jmp 0b\n"
-+                    ".popsection\n"
-+                    _ASM_EXTABLE(0b, 1b)
++                    "int $4\n0:\n"
++                    _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +                    "sete %1\n"
                      : "=m" (v->counter), "=qm" (c)
                      : "m" (v->counter) : "memory");
         return c != 0;
-@@ -318,7 +633,20 @@ static inline int atomic64_inc_and_test(
+@@ -318,7 +605,16 @@ static inline int atomic64_inc_and_test(
  {
         unsigned char c;
  
@@ -6779,20 +6753,16 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                    "jno 0f\n"
-+                    "int $4\n0:\n"
-+                    ".pushsection .fixup,\"ax\"\n"
-+                    "1: \n"
 +                    LOCK_PREFIX "decq %0\n"
-+                    "jmp 0b\n"
-+                    ".popsection\n"
-+                    _ASM_EXTABLE(0b, 1b)
++                    "int $4\n0:\n"
++                    _ASM_EXTABLE(0b, 0b)
 +#endif
 +
 +                    "sete %1\n"
                      : "=m" (v->counter), "=qm" (c)
                      : "m" (v->counter) : "memory");
         return c != 0;
-@@ -337,7 +665,16 @@ static inline int atomic64_add_negative(
+@@ -337,7 +633,16 @@ static inline int atomic64_add_negative(
  {
         unsigned char c;
  
@@ -6810,7 +6780,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "=m" (v->counter), "=qm" (c)
                      : "er" (i), "m" (v->counter) : "memory");
         return c;
-@@ -353,7 +690,31 @@ static inline int atomic64_add_negative(
+@@ -353,7 +658,31 @@ static inline int atomic64_add_negative(
  static inline long atomic64_add_return(long i, atomic64_t *v)
  {
         long __i = i;
@@ -6843,7 +6813,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
                      : "+r" (i), "+m" (v->counter)
                      : : "memory");
         return i + __i;
-@@ -365,6 +726,10 @@ static inline long atomic64_sub_return(l
+@@ -365,6 +694,10 @@ static inline long atomic64_sub_return(l
  }
  
  #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
@@ -6854,7 +6824,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
  
  static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
-@@ -398,17 +763,29 @@ static inline long atomic_xchg(atomic_t 
+@@ -398,17 +731,30 @@ static inline long atomic_xchg(atomic_t 
   */
  static inline int atomic_add_unless(atomic_t *v, int a, int u)
  {
@@ -6871,6 +6841,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                            "jno 0f\n"
++                            "subl %2,%0\n"
 +                            "int $4\n0:\n"
 +                            _ASM_EXTABLE(0b, 0b)
 +#endif
@@ -6888,7 +6859,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
  }
  
  #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
-@@ -424,17 +801,29 @@ static inline int atomic_add_unless(atom
+@@ -424,17 +770,30 @@ static inline int atomic_add_unless(atom
   */
  static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
  {
@@ -6905,6 +6876,7 @@ diff -urNp linux-2.6.32.23/arch/x86/include/asm/atomic_64.h linux-2.6.32.23/arch
 +
 +#ifdef CONFIG_PAX_REFCOUNT
 +                            "jno 0f\n"
++                            "subq %2,%0\n"
 +                            "int $4\n0:\n"
 +                            _ASM_EXTABLE(0b, 0b)
 +#endif
@@ -13932,7 +13904,7 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/syscall_table_32.S linux-2.6.32.23/ar
         .long sys_exit
 diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c
 --- linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c       2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c       2010-09-17 18:34:04.000000000 -0400
++++ linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c       2010-09-26 22:08:46.000000000 -0400
 @@ -24,6 +24,21 @@
  
  #include <asm/syscalls.h>
@@ -13955,7 +13927,7 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
  /*
   * Perform the select(nd, in, out, ex, tv) and mmap() system
   * calls. Linux/i386 didn't use to be able to handle more than
-@@ -58,6 +73,208 @@ out:
+@@ -58,6 +73,212 @@ out:
         return err;
  }
  
@@ -13972,6 +13944,8 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
 +               pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++       pax_task_size -= PAGE_SIZE;
++
 +       if (len > pax_task_size)
 +               return -ENOMEM;
 +
@@ -14061,6 +14035,8 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
 +               pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++       pax_task_size -= PAGE_SIZE;
++
 +       /* requested length too big for entire address space */
 +       if (len > pax_task_size)
 +               return -ENOMEM;
@@ -14164,7 +14140,7 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
  
  struct sel_arg_struct {
         unsigned long n;
-@@ -93,7 +310,7 @@ asmlinkage int sys_ipc(uint call, int fi
+@@ -93,7 +314,7 @@ asmlinkage int sys_ipc(uint call, int fi
                 return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
         case SEMTIMEDOP:
                 return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
@@ -14173,7 +14149,7 @@ diff -urNp linux-2.6.32.23/arch/x86/kernel/sys_i386_32.c linux-2.6.32.23/arch/x8
  
         case SEMGET:
                 return sys_semget(first, second, third);
-@@ -140,7 +357,7 @@ asmlinkage int sys_ipc(uint call, int fi
+@@ -140,7 +361,7 @@ asmlinkage int sys_ipc(uint call, int fi
                         ret = do_shmat(first, (char __user *) ptr, second, &raddr);
                         if (ret)
                                 return ret;
@@ -18270,8 +18246,8 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/highmem_32.c linux-2.6.32.23/arch/x86/mm/
  }
 diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm/hugetlbpage.c
 --- linux-2.6.32.23/arch/x86/mm/hugetlbpage.c   2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/arch/x86/mm/hugetlbpage.c   2010-09-17 18:34:04.000000000 -0400
-@@ -267,13 +267,18 @@ static unsigned long hugetlb_get_unmappe
++++ linux-2.6.32.23/arch/x86/mm/hugetlbpage.c   2010-09-26 22:08:46.000000000 -0400
+@@ -267,13 +267,20 @@ static unsigned long hugetlb_get_unmappe
         struct hstate *h = hstate_file(file);
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
@@ -18282,6 +18258,8 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
 +       if (mm->pax_flags & MF_PAX_SEGMEXEC)
 +               pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
++
++       pax_task_size -= PAGE_SIZE;
  
         if (len > mm->cached_hole_size) {
 -               start_addr = mm->free_area_cache;
@@ -18294,7 +18272,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
         }
  
  full_search:
-@@ -281,26 +286,27 @@ full_search:
+@@ -281,26 +288,27 @@ full_search:
  
         for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
                 /* At this point:  (!vma || addr < vma->vm_end). */
@@ -18329,7 +18307,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  }
  
  static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
-@@ -309,10 +315,9 @@ static unsigned long hugetlb_get_unmappe
+@@ -309,10 +317,9 @@ static unsigned long hugetlb_get_unmappe
  {
         struct hstate *h = hstate_file(file);
         struct mm_struct *mm = current->mm;
@@ -18342,7 +18320,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  
         /* don't allow allocations above current base */
         if (mm->free_area_cache > base)
-@@ -322,7 +327,7 @@ static unsigned long hugetlb_get_unmappe
+@@ -322,7 +329,7 @@ static unsigned long hugetlb_get_unmappe
                 largest_hole = 0;
                 mm->free_area_cache  = base;
         }
@@ -18351,7 +18329,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
         /* make sure it can fit in the remaining address space */
         if (mm->free_area_cache < len)
                 goto fail;
-@@ -330,33 +335,27 @@ try_again:
+@@ -330,33 +337,27 @@ try_again:
         /* either no address requested or cant fit in requested address hole */
         addr = (mm->free_area_cache - len) & huge_page_mask(h);
         do {
@@ -18395,7 +18373,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
  
                 /* try just below the current vma->vm_start */
                 addr = (vma->vm_start - len) & huge_page_mask(h);
-@@ -364,22 +363,26 @@ try_again:
+@@ -364,22 +365,26 @@ try_again:
  
  fail:
         /*
@@ -18433,7 +18411,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
         mm->cached_hole_size = ~0UL;
         addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
                         len, pgoff, flags);
-@@ -387,6 +390,7 @@ fail:
+@@ -387,6 +392,7 @@ fail:
         /*
          * Restore the topdown base:
          */
@@ -18441,7 +18419,7 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
         mm->free_area_cache = base;
         mm->cached_hole_size = ~0UL;
  
-@@ -400,10 +404,17 @@ hugetlb_get_unmapped_area(struct file *f
+@@ -400,10 +406,19 @@ hugetlb_get_unmapped_area(struct file *f
         struct hstate *h = hstate_file(file);
         struct mm_struct *mm = current->mm;
         struct vm_area_struct *vma;
@@ -18456,11 +18434,13 @@ diff -urNp linux-2.6.32.23/arch/x86/mm/hugetlbpage.c linux-2.6.32.23/arch/x86/mm
 +               pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++       pax_task_size -= PAGE_SIZE;
++
 +       if (len > pax_task_size)
                 return -ENOMEM;
  
         if (flags & MAP_FIXED) {
-@@ -415,8 +426,7 @@ hugetlb_get_unmapped_area(struct file *f
+@@ -415,8 +430,7 @@ hugetlb_get_unmapped_area(struct file *f
         if (addr) {
                 addr = ALIGN(addr, huge_page_size(h));
                 vma = find_vma(mm, addr);
@@ -23722,7 +23702,7 @@ diff -urNp linux-2.6.32.23/drivers/base/sys.c linux-2.6.32.23/drivers/base/sys.c
  };
 diff -urNp linux-2.6.32.23/drivers/block/pktcdvd.c linux-2.6.32.23/drivers/block/pktcdvd.c
 --- linux-2.6.32.23/drivers/block/pktcdvd.c     2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/drivers/block/pktcdvd.c     2010-09-04 15:54:52.000000000 -0400
++++ linux-2.6.32.23/drivers/block/pktcdvd.c     2010-09-27 18:49:22.000000000 -0400
 @@ -284,7 +284,7 @@ static ssize_t kobj_pkt_store(struct kob
         return len;
  }
@@ -23732,6 +23712,15 @@ diff -urNp linux-2.6.32.23/drivers/block/pktcdvd.c linux-2.6.32.23/drivers/block
         .show = kobj_pkt_show,
         .store = kobj_pkt_store
  };
+@@ -2408,7 +2408,7 @@ static void pkt_release_dev(struct pktcd
+        pkt_shrink_pktlist(pd);
+ }
+ 
+-static struct pktcdvd_device *pkt_find_dev_from_minor(int dev_minor)
++static struct pktcdvd_device *pkt_find_dev_from_minor(unsigned int dev_minor)
+ {
+        if (dev_minor >= MAX_WRITERS)
+                return NULL;
 diff -urNp linux-2.6.32.23/drivers/char/agp/frontend.c linux-2.6.32.23/drivers/char/agp/frontend.c
 --- linux-2.6.32.23/drivers/char/agp/frontend.c 2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.23/drivers/char/agp/frontend.c 2010-09-04 15:54:52.000000000 -0400
@@ -30133,63 +30122,16 @@ diff -urNp linux-2.6.32.23/drivers/video/vesafb.c linux-2.6.32.23/drivers/video/
         framebuffer_release(info);
 diff -urNp linux-2.6.32.23/drivers/xen/events.c linux-2.6.32.23/drivers/xen/events.c
 --- linux-2.6.32.23/drivers/xen/events.c        2010-09-20 17:26:42.000000000 -0400
-+++ linux-2.6.32.23/drivers/xen/events.c        2010-09-21 21:18:38.000000000 -0400
-@@ -106,7 +106,6 @@ static inline unsigned long *cpu_evtchn_
- #define VALID_EVTCHN(chn)      ((chn) != 0)
- 
- static struct irq_chip xen_dynamic_chip;
--static struct irq_chip xen_percpu_chip;
- 
- /* Constructor for packed IRQ information. */
- static struct irq_info mk_unbound_info(void)
-@@ -363,7 +362,7 @@ int bind_evtchn_to_irq(unsigned int evtc
-                irq = find_unbound_irq();
- 
-                set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
--                                             handle_edge_irq, "event");
-+                                             handle_level_irq, "event");
- 
-                evtchn_to_irq[evtchn] = irq;
-                irq_info[irq] = mk_evtchn_info(evtchn);
-@@ -389,8 +388,8 @@ static int bind_ipi_to_irq(unsigned int 
-                if (irq < 0)
-                        goto out;
- 
--               set_irq_chip_and_handler_name(irq, &xen_percpu_chip,
--                                             handle_percpu_irq, "ipi");
-+               set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
-+                                             handle_level_irq, "ipi");
- 
-                bind_ipi.vcpu = cpu;
-                if (HYPERVISOR_event_channel_op(EVTCHNOP_bind_ipi,
-@@ -430,8 +429,8 @@ static int bind_virq_to_irq(unsigned int
- 
-                irq = find_unbound_irq();
- 
--               set_irq_chip_and_handler_name(irq, &xen_percpu_chip,
--                                             handle_percpu_irq, "virq");
-+               set_irq_chip_and_handler_name(irq, &xen_dynamic_chip,
-+                                             handle_level_irq, "virq");
- 
-                evtchn_to_irq[evtchn] = irq;
-                irq_info[irq] = mk_virq_info(evtchn, virq);
-@@ -930,16 +929,6 @@ static struct irq_chip xen_dynamic_chip 
++++ linux-2.6.32.23/drivers/xen/events.c        2010-09-26 21:25:12.000000000 -0400
+@@ -930,7 +930,7 @@ static struct irq_chip xen_dynamic_chip 
         .retrigger      = retrigger_dynirq,
  };
  
 -static struct irq_chip en_percpu_chip __read_mostly = {
--       .name           = "xen-percpu",
--
--       .disable        = disable_dynirq,
--       .mask           = disable_dynirq,
--       .unmask         = enable_dynirq,
--
--       .ack            = ack_dynirq,
--};
--
- void __init xen_init_IRQ(void)
- {
-        int i;
++static struct irq_chip xen_percpu_chip __read_mostly = {
+        .name           = "xen-percpu",
+ 
+        .disable        = disable_dynirq,
 diff -urNp linux-2.6.32.23/drivers/xen/sys-hypervisor.c linux-2.6.32.23/drivers/xen/sys-hypervisor.c
 --- linux-2.6.32.23/drivers/xen/sys-hypervisor.c        2010-08-13 16:24:37.000000000 -0400
 +++ linux-2.6.32.23/drivers/xen/sys-hypervisor.c        2010-09-04 15:54:52.000000000 -0400
@@ -48623,7 +48565,7 @@ diff -urNp linux-2.6.32.23/include/linux/vmalloc.h linux-2.6.32.23/include/linux
  #endif /* _LINUX_VMALLOC_H */
 diff -urNp linux-2.6.32.23/include/linux/vmstat.h linux-2.6.32.23/include/linux/vmstat.h
 --- linux-2.6.32.23/include/linux/vmstat.h      2010-09-26 17:26:05.000000000 -0400
-+++ linux-2.6.32.23/include/linux/vmstat.h      2010-09-26 17:26:57.000000000 -0400
++++ linux-2.6.32.23/include/linux/vmstat.h      2010-09-26 22:01:38.000000000 -0400
 @@ -136,18 +136,18 @@ static inline void vm_events_fold_cpu(in
  /*
   * Zone based page accounting with per cpu differentials.
@@ -48656,6 +48598,15 @@ diff -urNp linux-2.6.32.23/include/linux/vmstat.h linux-2.6.32.23/include/linux/
  #ifdef CONFIG_SMP
         if (x < 0)
                 x = 0;
+@@ -175,7 +175,7 @@ static inline unsigned long zone_page_st
+ static inline unsigned long zone_page_state_snapshot(struct zone *zone,
+                                        enum zone_stat_item item)
+ {
+-       long x = atomic_long_read(&zone->vm_stat[item]);
++       long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
+ 
+ #ifdef CONFIG_SMP
+        int cpu;
 @@ -264,8 +264,8 @@ static inline void __mod_zone_page_state
  
  static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
@@ -54380,7 +54331,7 @@ diff -urNp linux-2.6.32.23/mm/mprotect.c linux-2.6.32.23/mm/mprotect.c
                 if (nstart < prev->vm_end)
 diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
 --- linux-2.6.32.23/mm/mremap.c 2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/mm/mremap.c 2010-09-04 15:54:52.000000000 -0400
++++ linux-2.6.32.23/mm/mremap.c 2010-09-26 22:08:46.000000000 -0400
 @@ -114,6 +114,12 @@ static void move_ptes(struct vm_area_str
                         continue;
                 pte = ptep_clear_flush(vma, old_addr, old_pte);
@@ -54406,7 +54357,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
         /* We can't remap across vm area boundaries */
         if (old_len > vma->vm_end - addr)
                 goto Efault;
-@@ -322,20 +333,23 @@ static unsigned long mremap_to(unsigned 
+@@ -322,20 +333,25 @@ static unsigned long mremap_to(unsigned 
         unsigned long ret = -EINVAL;
         unsigned long charged = 0;
         unsigned long map_flags;
@@ -54421,6 +54372,8 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
 +               pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++       pax_task_size -= PAGE_SIZE;
++
 +       if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
                 goto out;
  
@@ -54435,7 +54388,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
                 goto out;
  
         ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
-@@ -407,6 +421,7 @@ unsigned long do_mremap(unsigned long ad
+@@ -407,6 +423,7 @@ unsigned long do_mremap(unsigned long ad
         struct vm_area_struct *vma;
         unsigned long ret = -EINVAL;
         unsigned long charged = 0;
@@ -54443,7 +54396,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
  
         if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
                 goto out;
-@@ -425,6 +440,15 @@ unsigned long do_mremap(unsigned long ad
+@@ -425,6 +442,17 @@ unsigned long do_mremap(unsigned long ad
         if (!new_len)
                 goto out;
  
@@ -54452,6 +54405,8 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
 +               pax_task_size = SEGMEXEC_TASK_SIZE;
 +#endif
 +
++       pax_task_size -= PAGE_SIZE;
++
 +       if (new_len > pax_task_size || addr > pax_task_size-new_len ||
 +           old_len > pax_task_size || addr > pax_task_size-old_len)
 +               goto out;
@@ -54459,7 +54414,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
         if (flags & MREMAP_FIXED) {
                 if (flags & MREMAP_MAYMOVE)
                         ret = mremap_to(addr, old_len, new_addr, new_len);
-@@ -471,6 +495,7 @@ unsigned long do_mremap(unsigned long ad
+@@ -471,6 +499,7 @@ unsigned long do_mremap(unsigned long ad
                                                    addr + new_len);
                         }
                         ret = addr;
@@ -54467,7 +54422,7 @@ diff -urNp linux-2.6.32.23/mm/mremap.c linux-2.6.32.23/mm/mremap.c
                         goto out;
                 }
         }
-@@ -497,7 +522,13 @@ unsigned long do_mremap(unsigned long ad
+@@ -497,7 +526,13 @@ unsigned long do_mremap(unsigned long ad
                 ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
                 if (ret)
                         goto out;
@@ -58356,7 +58311,7 @@ diff -urNp linux-2.6.32.23/usr/gen_init_cpio.c linux-2.6.32.23/usr/gen_init_cpio
         }
 diff -urNp linux-2.6.32.23/virt/kvm/kvm_main.c linux-2.6.32.23/virt/kvm/kvm_main.c
 --- linux-2.6.32.23/virt/kvm/kvm_main.c 2010-08-13 16:24:37.000000000 -0400
-+++ linux-2.6.32.23/virt/kvm/kvm_main.c 2010-09-04 15:54:52.000000000 -0400
++++ linux-2.6.32.23/virt/kvm/kvm_main.c 2010-09-26 22:08:46.000000000 -0400
 @@ -1748,6 +1748,7 @@ static int kvm_vcpu_release(struct inode
         return 0;
  }
@@ -58391,6 +58346,15 @@ diff -urNp linux-2.6.32.23/virt/kvm/kvm_main.c linux-2.6.32.23/virt/kvm/kvm_main
  };
  
  static void hardware_enable(void *junk)
+@@ -2494,7 +2500,7 @@ asmlinkage void kvm_handle_fault_on_rebo
+        if (kvm_rebooting)
+                /* spin while reset goes on */
+                while (true)
+-                       ;
++                       cpu_relax();
+        /* Fault while not rebooting.  We want the trace. */
+        BUG();
+ }
 @@ -2714,7 +2720,7 @@ static void kvm_sched_out(struct preempt
         kvm_arch_vcpu_put(vcpu);
  }