diff -uriN linux-2.6.32.43/arch/alpha/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/include/asm/elf.h
--- linux-2.6.32.43/arch/alpha/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -91,6 +91,13 @@
 
 #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x1000000)
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(current->personality & ADDR_LIMIT_32BIT ? 0x10000 : 0x120000000UL)
+
+#define PAX_DELTA_MMAP_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 28)
+#define PAX_DELTA_STACK_LEN	(current->personality & ADDR_LIMIT_32BIT ? 14 : 19)
+#endif
+
 /* $0 is set by ld.so to a pointer to a function which might be 
    registered using atexit.  This provides a mean for the dynamic
    linker to call DT_FINI functions for shared libraries that have
diff -uriN linux-2.6.32.43/arch/alpha/include/asm/pgtable.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/include/asm/pgtable.h
--- linux-2.6.32.43/arch/alpha/include/asm/pgtable.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/include/asm/pgtable.h	2011-07-15 05:51:11.000000000 -0500
@@ -101,6 +101,17 @@
 #define PAGE_SHARED	__pgprot(_PAGE_VALID | __ACCESS_BITS)
 #define PAGE_COPY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
 #define PAGE_READONLY	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW)
+
+#ifdef CONFIG_PAX_PAGEEXEC
+# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOE)
+# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
+# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_VALID | __ACCESS_BITS | _PAGE_FOW | _PAGE_FOE)
+#else
+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
+# define PAGE_COPY_NOEXEC	PAGE_COPY
+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
+#endif
+
 #define PAGE_KERNEL	__pgprot(_PAGE_VALID | _PAGE_ASM | _PAGE_KRE | _PAGE_KWE)
 
 #define _PAGE_NORMAL(x) __pgprot(_PAGE_VALID | __ACCESS_BITS | (x))
diff -uriN linux-2.6.32.43/arch/alpha/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/Kconfig
--- linux-2.6.32.43/arch/alpha/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -674,6 +674,8 @@
 	depends on VGA_HOSE
 	default y
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/alpha/kernel/entry.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/entry.S
--- linux-2.6.32.43/arch/alpha/kernel/entry.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/entry.S	2011-07-15 05:50:11.000000000 -0500
@@ -874,24 +874,15 @@
 	.globl	sys_getxpid
 	.ent	sys_getxpid
 sys_getxpid:
+	lda	$sp, -16($sp)
+	stq	$26, 0($sp)
 	.prologue 0
-	ldq	$2, TI_TASK($8)
 
-	/* See linux/kernel/timer.c sys_getppid for discussion
-	   about this loop.  */
-	ldq	$3, TASK_GROUP_LEADER($2)
-	ldq	$4, TASK_REAL_PARENT($3)
-	ldl	$0, TASK_TGID($2)
-1:	ldl	$1, TASK_TGID($4)
-#ifdef CONFIG_SMP
-	mov	$4, $5
-	mb
-	ldq	$3, TASK_GROUP_LEADER($2)
-	ldq	$4, TASK_REAL_PARENT($3)
-	cmpeq	$4, $5, $5
-	beq	$5, 1b
-#endif
-	stq	$1, 80($sp)
+	lda	$16, 96($sp)
+	jsr	$26, do_getxpid
+	ldq	$26, 0($sp)
+
+	lda	$sp, 16($sp)
 	ret
 .end sys_getxpid
 
diff -uriN linux-2.6.32.43/arch/alpha/kernel/module.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/module.c
--- linux-2.6.32.43/arch/alpha/kernel/module.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/module.c	2011-07-15 05:51:11.000000000 -0500
@@ -182,7 +182,7 @@
 
 	/* The small sections were sorted to the end of the segment.
 	   The following should definitely cover them.  */
-	gp = (u64)me->module_core + me->core_size - 0x8000;
+	gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
 	got = sechdrs[me->arch.gotsecindex].sh_addr;
 
 	for (i = 0; i < n; i++) {
diff -uriN linux-2.6.32.43/arch/alpha/kernel/osf_sys.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/osf_sys.c
--- linux-2.6.32.43/arch/alpha/kernel/osf_sys.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/osf_sys.c	2011-07-15 05:51:11.000000000 -0500
@@ -431,7 +431,7 @@
 		return -EFAULT;
 
 	len = namelen;
-	if (namelen > 32)
+	if (len > 32)
 		len = 32;
 
 	down_read(&uts_sem);
@@ -618,7 +618,7 @@
 	down_read(&uts_sem);
 	res = sysinfo_table[offset];
 	len = strlen(res)+1;
-	if (len > count)
+	if ((unsigned long)len > (unsigned long)count)
 		len = count;
 	if (copy_to_user(buf, res, len))
 		err = -EFAULT;
@@ -673,7 +673,7 @@
 		return 1;
 
 	case GSI_GET_HWRPB:
-		if (nbytes < sizeof(*hwrpb))
+		if (nbytes > sizeof(*hwrpb))
 			return -EINVAL;
 		if (copy_to_user(buffer, hwrpb, nbytes) != 0)
 			return -EFAULT;
@@ -865,7 +865,7 @@
 {
 	if (tv) {
 		struct timeval ktv;
-		do_gettimeofday(&ktv);
+		vx_gettimeofday(&ktv);
 		if (put_tv32(tv, &ktv))
 			return -EFAULT;
 	}
@@ -1035,6 +1035,7 @@
 {
 	struct rusage r;
 	long ret, err;
+	unsigned int status = 0;
 	mm_segment_t old_fs;
 
 	if (!ur)
@@ -1043,13 +1044,15 @@
 	old_fs = get_fs();
 		
 	set_fs (KERNEL_DS);
-	ret = sys_wait4(pid, ustatus, options, (struct rusage __user *) &r);
+	ret = sys_wait4(pid, (unsigned int __user *) &status, options,
+			(struct rusage __user *) &r);
 	set_fs (old_fs);
 
 	if (!access_ok(VERIFY_WRITE, ur, sizeof(*ur)))
 		return -EFAULT;
 
 	err = 0;
+	err |= put_user(status, ustatus);
 	err |= __put_user(r.ru_utime.tv_sec, &ur->ru_utime.tv_sec);
 	err |= __put_user(r.ru_utime.tv_usec, &ur->ru_utime.tv_usec);
 	err |= __put_user(r.ru_stime.tv_sec, &ur->ru_stime.tv_sec);
@@ -1169,7 +1172,7 @@
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (limit - len < addr)
 			return -ENOMEM;
-		if (!vma || addr + len <= vma->vm_start)
+		if (check_heap_stack_gap(vma, addr, len))
 			return addr;
 		addr = vma->vm_end;
 		vma = vma->vm_next;
@@ -1205,6 +1208,10 @@
 	   merely specific addresses, but regions of memory -- perhaps
 	   this feature should be incorporated into all ports?  */
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
 	if (addr) {
 		addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
 		if (addr != (unsigned long) -ENOMEM)
@@ -1212,8 +1219,8 @@
 	}
 
 	/* Next, try allocating at TASK_UNMAPPED_BASE.  */
-	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
-					 len, limit);
+	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
+
 	if (addr != (unsigned long) -ENOMEM)
 		return addr;
 
diff -uriN linux-2.6.32.43/arch/alpha/kernel/ptrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/ptrace.c
--- linux-2.6.32.43/arch/alpha/kernel/ptrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/ptrace.c	2011-07-15 05:50:11.000000000 -0500
@@ -14,6 +14,7 @@
 #include <linux/slab.h>
 #include <linux/security.h>
 #include <linux/signal.h>
+#include <linux/vs_base.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
diff -uriN linux-2.6.32.43/arch/alpha/kernel/systbls.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/systbls.S
--- linux-2.6.32.43/arch/alpha/kernel/systbls.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/systbls.S	2011-07-15 05:50:11.000000000 -0500
@@ -446,7 +446,7 @@
 	.quad sys_stat64			/* 425 */
 	.quad sys_lstat64
 	.quad sys_fstat64
-	.quad sys_ni_syscall			/* sys_vserver */
+	.quad sys_vserver			/* sys_vserver */
 	.quad sys_ni_syscall			/* sys_mbind */
 	.quad sys_ni_syscall			/* sys_get_mempolicy */
 	.quad sys_ni_syscall			/* sys_set_mempolicy */
diff -uriN linux-2.6.32.43/arch/alpha/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/traps.c
--- linux-2.6.32.43/arch/alpha/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/kernel/traps.c	2011-07-15 05:50:11.000000000 -0500
@@ -183,7 +183,8 @@
 #ifdef CONFIG_SMP
 	printk("CPU %d ", hard_smp_processor_id());
 #endif
-	printk("%s(%d): %s %ld\n", current->comm, task_pid_nr(current), str, err);
+	printk("%s(%d[#%u]): %s %ld\n", current->comm,
+		task_pid_nr(current), current->xid, str, err);
 	dik_show_regs(regs, r9_15);
 	add_taint(TAINT_DIE);
 	dik_show_trace((unsigned long *)(regs+1));
diff -uriN linux-2.6.32.43/arch/alpha/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/mm/fault.c
--- linux-2.6.32.43/arch/alpha/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/alpha/mm/fault.c	2011-07-15 05:51:11.000000000 -0500
@@ -54,6 +54,124 @@
 	__reload_thread(pcb);
 }
 
+#ifdef CONFIG_PAX_PAGEEXEC
+/*
+ * PaX: decide what to do with offenders (regs->pc = fault address)
+ *
+ * returns 1 when task should be killed
+ *         2 when patched PLT trampoline was detected
+ *         3 when unpatched PLT trampoline was detected
+ */
+static int pax_handle_fetch_fault(struct pt_regs *regs)
+{
+
+#ifdef CONFIG_PAX_EMUPLT
+	int err;
+
+	do { /* PaX: patched PLT emulation #1 */
+		unsigned int ldah, ldq, jmp;
+
+		err = get_user(ldah, (unsigned int *)regs->pc);
+		err |= get_user(ldq, (unsigned int *)(regs->pc+4));
+		err |= get_user(jmp, (unsigned int *)(regs->pc+8));
+
+		if (err)
+			break;
+
+		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
+		    (ldq & 0xFFFF0000U) == 0xA77B0000U &&
+		    jmp == 0x6BFB0000U)
+		{
+			unsigned long r27, addr;
+			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
+			unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
+
+			addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
+			err = get_user(r27, (unsigned long *)addr);
+			if (err)
+				break;
+
+			regs->r27 = r27;
+			regs->pc = r27;
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: patched PLT emulation #2 */
+		unsigned int ldah, lda, br;
+
+		err = get_user(ldah, (unsigned int *)regs->pc);
+		err |= get_user(lda, (unsigned int *)(regs->pc+4));
+		err |= get_user(br, (unsigned int *)(regs->pc+8));
+
+		if (err)
+			break;
+
+		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
+		    (lda & 0xFFFF0000U) == 0xA77B0000U &&
+		    (br & 0xFFE00000U) == 0xC3E00000U)
+		{
+			unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
+			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
+			unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
+
+			regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
+			regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: unpatched PLT emulation */
+		unsigned int br;
+
+		err = get_user(br, (unsigned int *)regs->pc);
+
+		if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
+			unsigned int br2, ldq, nop, jmp;
+			unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
+
+			addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
+			err = get_user(br2, (unsigned int *)addr);
+			err |= get_user(ldq, (unsigned int *)(addr+4));
+			err |= get_user(nop, (unsigned int *)(addr+8));
+			err |= get_user(jmp, (unsigned int *)(addr+12));
+			err |= get_user(resolver, (unsigned long *)(addr+16));
+
+			if (err)
+				break;
+
+			if (br2 == 0xC3600000U &&
+			    ldq == 0xA77B000CU &&
+			    nop == 0x47FF041FU &&
+			    jmp == 0x6B7B0000U)
+			{
+				regs->r28 = regs->pc+4;
+				regs->r27 = addr+16;
+				regs->pc = resolver;
+				return 3;
+			}
+		}
+	} while (0);
+#endif
+
+	return 1;
+}
+
+void pax_report_insns(void *pc, void *sp)
+{
+	unsigned long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 5; i++) {
+		unsigned int c;
+		if (get_user(c, (unsigned int *)pc+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%08x ", c);
+	}
+	printk("\n");
+}
+#endif
 
 /*
  * This routine handles page faults.  It determines the address,
@@ -131,8 +249,29 @@
  good_area:
 	si_code = SEGV_ACCERR;
 	if (cause < 0) {
-		if (!(vma->vm_flags & VM_EXEC))
+		if (!(vma->vm_flags & VM_EXEC)) {
+
+#ifdef CONFIG_PAX_PAGEEXEC
+			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
+				goto bad_area;
+
+			up_read(&mm->mmap_sem);
+			switch (pax_handle_fetch_fault(regs)) {
+
+#ifdef CONFIG_PAX_EMUPLT
+			case 2:
+			case 3:
+				return;
+#endif
+
+			}
+			pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
+			do_group_exit(SIGKILL);
+#else
 			goto bad_area;
+#endif
+
+		}
 	} else if (!cause) {
 		/* Allow reads even for write-only mappings */
 		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
@@ -193,8 +332,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk(KERN_ALERT "VM: killing process %s(%d)\n",
-	       current->comm, task_pid_nr(current));
+	printk(KERN_ALERT "VM: killing process %s(%d:#%u)\n",
+	       current->comm, task_pid_nr(current), current->xid);
 	if (!user_mode(regs))
 		goto no_context;
 	do_group_exit(SIGKILL);
diff -uriN linux-2.6.32.43/arch/arm/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/include/asm/elf.h
--- linux-2.6.32.43/arch/arm/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -109,7 +109,14 @@
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
-#define ELF_ET_DYN_BASE	(2 * TASK_SIZE / 3)
+#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
+
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	0x00008000UL
+
+#define PAX_DELTA_MMAP_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
+#define PAX_DELTA_STACK_LEN	((current->personality == PER_LINUX_32BIT) ? 16 : 10)
+#endif
 
 /* When the program starts, a1 contains a pointer to a function to be 
    registered with atexit, as per the SVR4 ABI.  A value of 0 means we 
diff -uriN linux-2.6.32.43/arch/arm/include/asm/kmap_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/include/asm/kmap_types.h
--- linux-2.6.32.43/arch/arm/include/asm/kmap_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/include/asm/kmap_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -19,6 +19,7 @@
 	KM_SOFTIRQ0,
 	KM_SOFTIRQ1,
 	KM_L2_CACHE,
+	KM_CLEARPAGE,
 	KM_TYPE_NR
 };
 
diff -uriN linux-2.6.32.43/arch/arm/include/asm/tlb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/include/asm/tlb.h
--- linux-2.6.32.43/arch/arm/include/asm/tlb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/include/asm/tlb.h	2011-07-15 05:50:11.000000000 -0500
@@ -27,6 +27,7 @@
 
 #else /* !CONFIG_MMU */
 
+#include <linux/vs_memory.h>
 #include <asm/pgalloc.h>
 
 /*
diff -uriN linux-2.6.32.43/arch/arm/include/asm/uaccess.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/include/asm/uaccess.h
--- linux-2.6.32.43/arch/arm/include/asm/uaccess.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/include/asm/uaccess.h	2011-07-15 05:51:11.000000000 -0500
@@ -22,6 +22,8 @@
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
 
+extern void check_object_size(const void *ptr, unsigned long n, bool to);
+
 /*
  * The exception table consists of pairs of addresses: the first is the
  * address of an instruction that is allowed to fault, and the second is
@@ -387,8 +389,23 @@
 
 
 #ifdef CONFIG_MMU
-extern unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n);
-extern unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n);
+extern unsigned long __must_check ___copy_from_user(void *to, const void __user *from, unsigned long n);
+extern unsigned long __must_check ___copy_to_user(void __user *to, const void *from, unsigned long n);
+
+static inline unsigned long __must_check __copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+	if (!__builtin_constant_p(n))
+		check_object_size(to, n, false);
+	return ___copy_from_user(to, from, n);
+}
+
+static inline unsigned long __must_check __copy_to_user(void __user *to, const void *from, unsigned long n)
+{
+	if (!__builtin_constant_p(n))
+		check_object_size(from, n, true);
+	return ___copy_to_user(to, from, n);
+}
+
 extern unsigned long __must_check __copy_to_user_std(void __user *to, const void *from, unsigned long n);
 extern unsigned long __must_check __clear_user(void __user *addr, unsigned long n);
 extern unsigned long __must_check __clear_user_std(void __user *addr, unsigned long n);
@@ -403,6 +420,9 @@
 
 static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+	if ((long)n < 0)
+		return n;
+
 	if (access_ok(VERIFY_READ, from, n))
 		n = __copy_from_user(to, from, n);
 	else /* security hole - plug it */
@@ -412,6 +432,9 @@
 
 static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+	if ((long)n < 0)
+		return n;
+
 	if (access_ok(VERIFY_WRITE, to, n))
 		n = __copy_to_user(to, from, n);
 	return n;
diff -uriN linux-2.6.32.43/arch/arm/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/Kconfig
--- linux-2.6.32.43/arch/arm/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -1524,6 +1524,8 @@
 
 source "arch/arm/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/arm/kernel/armksyms.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/armksyms.c
--- linux-2.6.32.43/arch/arm/kernel/armksyms.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/armksyms.c	2011-07-15 05:51:11.000000000 -0500
@@ -118,8 +118,8 @@
 #ifdef CONFIG_MMU
 EXPORT_SYMBOL(copy_page);
 
-EXPORT_SYMBOL(__copy_from_user);
-EXPORT_SYMBOL(__copy_to_user);
+EXPORT_SYMBOL(___copy_from_user);
+EXPORT_SYMBOL(___copy_to_user);
 EXPORT_SYMBOL(__clear_user);
 
 EXPORT_SYMBOL(__get_user_1);
diff -uriN linux-2.6.32.43/arch/arm/kernel/calls.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/calls.S
--- linux-2.6.32.43/arch/arm/kernel/calls.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/calls.S	2011-07-15 05:50:11.000000000 -0500
@@ -322,7 +322,7 @@
 /* 310 */	CALL(sys_request_key)
 		CALL(sys_keyctl)
 		CALL(ABI(sys_semtimedop, sys_oabi_semtimedop))
-/* vserver */	CALL(sys_ni_syscall)
+		CALL(sys_vserver)
 		CALL(sys_ioprio_set)
 /* 315 */	CALL(sys_ioprio_get)
 		CALL(sys_inotify_init)
diff -uriN linux-2.6.32.43/arch/arm/kernel/kgdb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/kgdb.c
--- linux-2.6.32.43/arch/arm/kernel/kgdb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/kgdb.c	2011-07-15 05:51:11.000000000 -0500
@@ -190,7 +190,7 @@
  * and we handle the normal undef case within the do_undefinstr
  * handler.
  */
-struct kgdb_arch arch_kgdb_ops = {
+const struct kgdb_arch arch_kgdb_ops = {
 #ifndef __ARMEB__
 	.gdb_bpt_instr		= {0xfe, 0xde, 0xff, 0xe7}
 #else /* ! __ARMEB__ */
diff -uriN linux-2.6.32.43/arch/arm/kernel/process.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/process.c
--- linux-2.6.32.43/arch/arm/kernel/process.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/process.c	2011-07-15 05:50:11.000000000 -0500
@@ -269,7 +269,8 @@
 void show_regs(struct pt_regs * regs)
 {
 	printk("\n");
-	printk("Pid: %d, comm: %20s\n", task_pid_nr(current), current->comm);
+	printk("Pid: %d[#%u], comm: %20s\n",
+		task_pid_nr(current), current->xid, current->comm);
 	__show_regs(regs);
 	__backtrace();
 }
diff -uriN linux-2.6.32.43/arch/arm/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/traps.c
--- linux-2.6.32.43/arch/arm/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/kernel/traps.c	2011-07-15 05:51:11.000000000 -0500
@@ -234,8 +234,8 @@
 	sysfs_printk_last_file();
 	print_modules();
 	__show_regs(regs);
-	printk(KERN_EMERG "Process %.*s (pid: %d, stack limit = 0x%p)\n",
-		TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), thread + 1);
+	printk(KERN_EMERG "Process %.*s (pid: %d:#%u, stack limit = 0x%p)\n",
+		TASK_COMM_LEN, tsk->comm, task_pid_nr(tsk), tsk->xid, thread + 1);
 
 	if (!user_mode(regs) || in_interrupt()) {
 		dump_mem(KERN_EMERG, "Stack: ", regs->ARM_sp,
@@ -247,6 +247,8 @@
 
 DEFINE_SPINLOCK(die_lock);
 
+extern void gr_handle_kernel_exploit(void);
+
 /*
  * This function is protected against re-entrancy.
  */
@@ -271,6 +273,8 @@
 	if (panic_on_oops)
 		panic("Fatal exception");
 
+	gr_handle_kernel_exploit();
+
 	do_exit(SIGSEGV);
 }
 
diff -uriN linux-2.6.32.43/arch/arm/lib/copy_from_user.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/lib/copy_from_user.S
--- linux-2.6.32.43/arch/arm/lib/copy_from_user.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/lib/copy_from_user.S	2011-07-15 05:51:11.000000000 -0500
@@ -16,7 +16,7 @@
 /*
  * Prototype:
  *
- *	size_t __copy_from_user(void *to, const void *from, size_t n)
+ *	size_t ___copy_from_user(void *to, const void *from, size_t n)
  *
  * Purpose:
  *
@@ -84,11 +84,11 @@
 
 	.text
 
-ENTRY(__copy_from_user)
+ENTRY(___copy_from_user)
 
 #include "copy_template.S"
 
-ENDPROC(__copy_from_user)
+ENDPROC(___copy_from_user)
 
 	.section .fixup,"ax"
 	.align 0
diff -uriN linux-2.6.32.43/arch/arm/lib/copy_to_user.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/lib/copy_to_user.S
--- linux-2.6.32.43/arch/arm/lib/copy_to_user.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/lib/copy_to_user.S	2011-07-15 05:51:11.000000000 -0500
@@ -16,7 +16,7 @@
 /*
  * Prototype:
  *
- *	size_t __copy_to_user(void *to, const void *from, size_t n)
+ *	size_t ___copy_to_user(void *to, const void *from, size_t n)
  *
  * Purpose:
  *
@@ -88,11 +88,11 @@
 	.text
 
 ENTRY(__copy_to_user_std)
-WEAK(__copy_to_user)
+WEAK(___copy_to_user)
 
 #include "copy_template.S"
 
-ENDPROC(__copy_to_user)
+ENDPROC(___copy_to_user)
 
 	.section .fixup,"ax"
 	.align 0
diff -uriN linux-2.6.32.43/arch/arm/lib/uaccess.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/lib/uaccess.S
--- linux-2.6.32.43/arch/arm/lib/uaccess.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/lib/uaccess.S	2011-07-15 05:51:11.000000000 -0500
@@ -19,7 +19,7 @@
 
 #define PAGE_SHIFT 12
 
-/* Prototype: int __copy_to_user(void *to, const char *from, size_t n)
+/* Prototype: int ___copy_to_user(void *to, const char *from, size_t n)
  * Purpose  : copy a block to user memory from kernel memory
  * Params   : to   - user memory
  *          : from - kernel memory
@@ -39,7 +39,7 @@
 		sub	r2, r2, ip
 		b	.Lc2u_dest_aligned
 
-ENTRY(__copy_to_user)
+ENTRY(___copy_to_user)
 		stmfd	sp!, {r2, r4 - r7, lr}
 		cmp	r2, #4
 		blt	.Lc2u_not_enough
@@ -277,14 +277,14 @@
 		ldrgtb	r3, [r1], #0
 USER(		strgtbt	r3, [r0], #1)			@ May fault
 		b	.Lc2u_finished
-ENDPROC(__copy_to_user)
+ENDPROC(___copy_to_user)
 
 		.section .fixup,"ax"
 		.align	0
 9001:		ldmfd	sp!, {r0, r4 - r7, pc}
 		.previous
 
-/* Prototype: unsigned long __copy_from_user(void *to,const void *from,unsigned long n);
+/* Prototype: unsigned long ___copy_from_user(void *to,const void *from,unsigned long n);
  * Purpose  : copy a block from user memory to kernel memory
  * Params   : to   - kernel memory
  *          : from - user memory
@@ -303,7 +303,7 @@
 		sub	r2, r2, ip
 		b	.Lcfu_dest_aligned
 
-ENTRY(__copy_from_user)
+ENTRY(___copy_from_user)
 		stmfd	sp!, {r0, r2, r4 - r7, lr}
 		cmp	r2, #4
 		blt	.Lcfu_not_enough
@@ -543,7 +543,7 @@
 USER(		ldrgtbt	r3, [r1], #1)			@ May fault
 		strgtb	r3, [r0], #1
 		b	.Lcfu_finished
-ENDPROC(__copy_from_user)
+ENDPROC(___copy_from_user)
 
 		.section .fixup,"ax"
 		.align	0
diff -uriN linux-2.6.32.43/arch/arm/lib/uaccess_with_memcpy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/lib/uaccess_with_memcpy.c
--- linux-2.6.32.43/arch/arm/lib/uaccess_with_memcpy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/lib/uaccess_with_memcpy.c	2011-07-15 05:51:11.000000000 -0500
@@ -97,7 +97,7 @@
 }
 
 unsigned long
-__copy_to_user(void __user *to, const void *from, unsigned long n)
+___copy_to_user(void __user *to, const void *from, unsigned long n)
 {
 	/*
 	 * This test is stubbed out of the main function above to keep
diff -uriN linux-2.6.32.43/arch/arm/mach-at91/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-at91/pm.c
--- linux-2.6.32.43/arch/arm/mach-at91/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-at91/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -348,7 +348,7 @@
 }
 
 
-static struct platform_suspend_ops at91_pm_ops ={
+static const struct platform_suspend_ops at91_pm_ops ={
 	.valid	= at91_pm_valid_state,
 	.begin	= at91_pm_begin,
 	.enter	= at91_pm_enter,
diff -uriN linux-2.6.32.43/arch/arm/mach-omap1/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-omap1/pm.c
--- linux-2.6.32.43/arch/arm/mach-omap1/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-omap1/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -647,7 +647,7 @@
 
 
 
-static struct platform_suspend_ops omap_pm_ops ={
+static const struct platform_suspend_ops omap_pm_ops ={
 	.prepare	= omap_pm_prepare,
 	.enter		= omap_pm_enter,
 	.finish		= omap_pm_finish,
diff -uriN linux-2.6.32.43/arch/arm/mach-omap2/pm24xx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-omap2/pm24xx.c
--- linux-2.6.32.43/arch/arm/mach-omap2/pm24xx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-omap2/pm24xx.c	2011-07-15 05:51:11.000000000 -0500
@@ -326,7 +326,7 @@
 	enable_hlt();
 }
 
-static struct platform_suspend_ops omap_pm_ops = {
+static const struct platform_suspend_ops omap_pm_ops = {
 	.prepare	= omap2_pm_prepare,
 	.enter		= omap2_pm_enter,
 	.finish		= omap2_pm_finish,
diff -uriN linux-2.6.32.43/arch/arm/mach-omap2/pm34xx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-omap2/pm34xx.c
--- linux-2.6.32.43/arch/arm/mach-omap2/pm34xx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-omap2/pm34xx.c	2011-07-15 05:51:11.000000000 -0500
@@ -401,7 +401,7 @@
 	return;
 }
 
-static struct platform_suspend_ops omap_pm_ops = {
+static const struct platform_suspend_ops omap_pm_ops = {
 	.begin		= omap3_pm_begin,
 	.end		= omap3_pm_end,
 	.prepare	= omap3_pm_prepare,
diff -uriN linux-2.6.32.43/arch/arm/mach-pnx4008/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-pnx4008/pm.c
--- linux-2.6.32.43/arch/arm/mach-pnx4008/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-pnx4008/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -116,7 +116,7 @@
 	       (state == PM_SUSPEND_MEM);
 }
 
-static struct platform_suspend_ops pnx4008_pm_ops = {
+static const struct platform_suspend_ops pnx4008_pm_ops = {
 	.enter = pnx4008_pm_enter,
 	.valid = pnx4008_pm_valid,
 };
diff -uriN linux-2.6.32.43/arch/arm/mach-pxa/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-pxa/pm.c
--- linux-2.6.32.43/arch/arm/mach-pxa/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-pxa/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -95,7 +95,7 @@
 		pxa_cpu_pm_fns->finish();
 }
 
-static struct platform_suspend_ops pxa_pm_ops = {
+static const struct platform_suspend_ops pxa_pm_ops = {
 	.valid		= pxa_pm_valid,
 	.enter		= pxa_pm_enter,
 	.prepare	= pxa_pm_prepare,
diff -uriN linux-2.6.32.43/arch/arm/mach-pxa/sharpsl_pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-pxa/sharpsl_pm.c
--- linux-2.6.32.43/arch/arm/mach-pxa/sharpsl_pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-pxa/sharpsl_pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -891,7 +891,7 @@
 }
 
 #ifdef CONFIG_PM
-static struct platform_suspend_ops sharpsl_pm_ops = {
+static const struct platform_suspend_ops sharpsl_pm_ops = {
 	.prepare	= pxa_pm_prepare,
 	.finish		= pxa_pm_finish,
 	.enter		= corgi_pxa_pm_enter,
diff -uriN linux-2.6.32.43/arch/arm/mach-sa1100/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-sa1100/pm.c
--- linux-2.6.32.43/arch/arm/mach-sa1100/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mach-sa1100/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -120,7 +120,7 @@
 	return virt_to_phys(sp);
 }
 
-static struct platform_suspend_ops sa11x0_pm_ops = {
+static const struct platform_suspend_ops sa11x0_pm_ops = {
 	.enter		= sa11x0_pm_enter,
 	.valid		= suspend_valid_only_mem,
 };
diff -uriN linux-2.6.32.43/arch/arm/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mm/fault.c
--- linux-2.6.32.43/arch/arm/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mm/fault.c	2011-07-15 05:51:11.000000000 -0500
@@ -166,6 +166,13 @@
 	}
 #endif
 
+#ifdef CONFIG_PAX_PAGEEXEC
+	if (fsr & FSR_LNX_PF) {
+		pax_report_fault(regs, (void *)regs->ARM_pc, (void *)regs->ARM_sp);
+		do_group_exit(SIGKILL);
+	}
+#endif
+
 	tsk->thread.address = addr;
 	tsk->thread.error_code = fsr;
 	tsk->thread.trap_no = 14;
@@ -357,6 +364,33 @@
 }
 #endif					/* CONFIG_MMU */
 
+#ifdef CONFIG_PAX_PAGEEXEC
+void pax_report_insns(void *pc, void *sp)
+{
+	long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 20; i++) {
+		unsigned char c;
+		if (get_user(c, (__force unsigned char __user *)pc+i))
+			printk(KERN_CONT "?? ");
+		else
+			printk(KERN_CONT "%02x ", c);
+	}
+	printk("\n");
+
+	printk(KERN_ERR "PAX: bytes at SP-4: ");
+	for (i = -1; i < 20; i++) {
+		unsigned long c;
+		if (get_user(c, (__force unsigned long __user *)sp+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%08lx ", c);
+	}
+	printk("\n");
+}
+#endif
+
 /*
  * First Level Translation Fault Handler
  *
diff -uriN linux-2.6.32.43/arch/arm/mm/mmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mm/mmap.c
--- linux-2.6.32.43/arch/arm/mm/mmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/mm/mmap.c	2011-07-15 05:51:11.000000000 -0500
@@ -63,6 +63,10 @@
 	if (len > TASK_SIZE)
 		return -ENOMEM;
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
 	if (addr) {
 		if (do_align)
 			addr = COLOUR_ALIGN(addr, pgoff);
@@ -70,15 +74,14 @@
 			addr = PAGE_ALIGN(addr);
 
 		vma = find_vma(mm, addr);
-		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
 			return addr;
 	}
 	if (len > mm->cached_hole_size) {
-	        start_addr = addr = mm->free_area_cache;
+		start_addr = addr = mm->free_area_cache;
 	} else {
-	        start_addr = addr = TASK_UNMAPPED_BASE;
-	        mm->cached_hole_size = 0;
+		start_addr = addr = mm->mmap_base;
+		mm->cached_hole_size = 0;
 	}
 
 full_search:
@@ -94,14 +97,14 @@
 			 * Start a new search - just in case we missed
 			 * some holes.
 			 */
-			if (start_addr != TASK_UNMAPPED_BASE) {
-				start_addr = addr = TASK_UNMAPPED_BASE;
+			if (start_addr != mm->mmap_base) {
+				start_addr = addr = mm->mmap_base;
 				mm->cached_hole_size = 0;
 				goto full_search;
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (check_heap_stack_gap(vma, addr, len)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
diff -uriN linux-2.6.32.43/arch/arm/plat-s3c/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/plat-s3c/pm.c
--- linux-2.6.32.43/arch/arm/plat-s3c/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/arm/plat-s3c/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -355,7 +355,7 @@
 	s3c_pm_check_cleanup();
 }
 
-static struct platform_suspend_ops s3c_pm_ops = {
+static const struct platform_suspend_ops s3c_pm_ops = {
 	.enter		= s3c_pm_enter,
 	.prepare	= s3c_pm_prepare,
 	.finish		= s3c_pm_finish,
diff -uriN linux-2.6.32.43/arch/avr32/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/avr32/include/asm/elf.h
--- linux-2.6.32.43/arch/avr32/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/avr32/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -85,8 +85,14 @@
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
-#define ELF_ET_DYN_BASE         (2 * TASK_SIZE / 3)
+#define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	0x00001000UL
+
+#define PAX_DELTA_MMAP_LEN	15
+#define PAX_DELTA_STACK_LEN	15
+#endif
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
diff -uriN linux-2.6.32.43/arch/avr32/include/asm/kmap_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/avr32/include/asm/kmap_types.h
--- linux-2.6.32.43/arch/avr32/include/asm/kmap_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/avr32/include/asm/kmap_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -22,7 +22,8 @@
 D(11)	KM_IRQ1,
 D(12)	KM_SOFTIRQ0,
 D(13)	KM_SOFTIRQ1,
-D(14)	KM_TYPE_NR
+D(14)	KM_CLEARPAGE,
+D(15)	KM_TYPE_NR
 };
 
 #undef D
diff -uriN linux-2.6.32.43/arch/avr32/mach-at32ap/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/avr32/mach-at32ap/pm.c
--- linux-2.6.32.43/arch/avr32/mach-at32ap/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/avr32/mach-at32ap/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -176,7 +176,7 @@
 	return 0;
 }
 
-static struct platform_suspend_ops avr32_pm_ops = {
+static const struct platform_suspend_ops avr32_pm_ops = {
 	.valid	= avr32_pm_valid_state,
 	.enter	= avr32_pm_enter,
 };
diff -uriN linux-2.6.32.43/arch/avr32/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/avr32/mm/fault.c
--- linux-2.6.32.43/arch/avr32/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/avr32/mm/fault.c	2011-07-15 05:51:11.000000000 -0500
@@ -41,6 +41,23 @@
 
 int exception_trace = 1;
 
+#ifdef CONFIG_PAX_PAGEEXEC
+void pax_report_insns(void *pc, void *sp)
+{
+	unsigned long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 20; i++) {
+		unsigned char c;
+		if (get_user(c, (unsigned char *)pc+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%02x ", c);
+	}
+	printk("\n");
+}
+#endif
+
 /*
  * This routine handles page faults. It determines the address and the
  * problem, and then passes it off to one of the appropriate routines.
@@ -157,6 +174,16 @@
 	up_read(&mm->mmap_sem);
 
 	if (user_mode(regs)) {
+
+#ifdef CONFIG_PAX_PAGEEXEC
+		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
+			if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
+				pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
+				do_group_exit(SIGKILL);
+			}
+		}
+#endif
+
 		if (exception_trace && printk_ratelimit())
 			printk("%s%s[%d]: segfault at %08lx pc %08lx "
 			       "sp %08lx ecr %lu\n",
@@ -216,7 +243,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk("VM: Killing process %s\n", tsk->comm);
+	printk("VM: Killing process %s(%d:#%u)\n",
+		tsk->comm, task_pid_nr(tsk), tsk->xid);
 	if (user_mode(regs))
 		do_group_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/blackfin/kernel/kgdb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/blackfin/kernel/kgdb.c
--- linux-2.6.32.43/arch/blackfin/kernel/kgdb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/blackfin/kernel/kgdb.c	2011-07-15 05:51:11.000000000 -0500
@@ -428,7 +428,7 @@
 	return -1;		/* this means that we do not want to exit from the handler */
 }
 
-struct kgdb_arch arch_kgdb_ops = {
+const struct kgdb_arch arch_kgdb_ops = {
 	.gdb_bpt_instr = {0xa1},
 #ifdef CONFIG_SMP
 	.flags = KGDB_HW_BREAKPOINT|KGDB_THR_PROC_SWAP,
diff -uriN linux-2.6.32.43/arch/blackfin/mach-common/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/blackfin/mach-common/pm.c
--- linux-2.6.32.43/arch/blackfin/mach-common/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/blackfin/mach-common/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -255,7 +255,7 @@
 	return 0;
 }
 
-struct platform_suspend_ops bfin_pm_ops = {
+const struct platform_suspend_ops bfin_pm_ops = {
 	.enter = bfin_pm_enter,
 	.valid	= bfin_pm_valid,
 };
diff -uriN linux-2.6.32.43/arch/cris/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/cris/Kconfig
--- linux-2.6.32.43/arch/cris/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/cris/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -685,6 +685,8 @@
 
 source "arch/cris/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/cris/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/cris/mm/fault.c
--- linux-2.6.32.43/arch/cris/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/cris/mm/fault.c	2011-07-15 05:50:11.000000000 -0500
@@ -245,7 +245,8 @@
 
  out_of_memory:
 	up_read(&mm->mmap_sem);
-	printk("VM: killing process %s\n", tsk->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		tsk->comm, task_pid_nr(tsk), tsk->xid);
 	if (user_mode(regs))
 		do_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/frv/include/asm/kmap_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/frv/include/asm/kmap_types.h
--- linux-2.6.32.43/arch/frv/include/asm/kmap_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/frv/include/asm/kmap_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -23,6 +23,7 @@
 	KM_IRQ1,
 	KM_SOFTIRQ0,
 	KM_SOFTIRQ1,
+	KM_CLEARPAGE,
 	KM_TYPE_NR
 };
 
diff -uriN linux-2.6.32.43/arch/frv/kernel/kernel_thread.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/frv/kernel/kernel_thread.S
--- linux-2.6.32.43/arch/frv/kernel/kernel_thread.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/frv/kernel/kernel_thread.S	2011-07-15 05:50:11.000000000 -0500
@@ -37,7 +37,7 @@
 
 	# start by forking the current process, but with shared VM
 	setlos.p	#__NR_clone,gr7		; syscall number
-	ori		gr10,#CLONE_VM,gr8	; first syscall arg	[clone_flags]
+	ori		gr10,#CLONE_KT,gr8	; first syscall arg	[clone_flags]
 	sethi.p		#0xe4e4,gr9		; second syscall arg	[newsp]
 	setlo		#0xe4e4,gr9
 	setlos.p	#0,gr10			; third syscall arg	[parent_tidptr]
diff -uriN linux-2.6.32.43/arch/frv/mm/elf-fdpic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/frv/mm/elf-fdpic.c
--- linux-2.6.32.43/arch/frv/mm/elf-fdpic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/frv/mm/elf-fdpic.c	2011-07-15 05:51:11.000000000 -0500
@@ -73,8 +73,7 @@
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(current->mm, addr);
-		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
 			goto success;
 	}
 
@@ -89,7 +88,7 @@
 			for (; vma; vma = vma->vm_next) {
 				if (addr > limit)
 					break;
-				if (addr + len <= vma->vm_start)
+				if (check_heap_stack_gap(vma, addr, len))
 					goto success;
 				addr = vma->vm_end;
 			}
@@ -104,7 +103,7 @@
 		for (; vma; vma = vma->vm_next) {
 			if (addr > limit)
 				break;
-			if (addr + len <= vma->vm_start)
+			if (check_heap_stack_gap(vma, addr, len))
 				goto success;
 			addr = vma->vm_end;
 		}
diff -uriN linux-2.6.32.43/arch/frv/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/frv/mm/fault.c
--- linux-2.6.32.43/arch/frv/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/frv/mm/fault.c	2011-07-15 05:50:11.000000000 -0500
@@ -257,7 +257,8 @@
  */
  out_of_memory:
 	up_read(&mm->mmap_sem);
-	printk("VM: killing process %s\n", current->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		current->comm, task_pid_nr(current), current->xid);
 	if (user_mode(__frame))
 		do_group_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/h8300/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/h8300/Kconfig
--- linux-2.6.32.43/arch/h8300/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/h8300/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -226,6 +226,8 @@
 
 source "arch/h8300/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/ia64/hp/common/hwsw_iommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/hp/common/hwsw_iommu.c
--- linux-2.6.32.43/arch/ia64/hp/common/hwsw_iommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/hp/common/hwsw_iommu.c	2011-07-15 05:51:11.000000000 -0500
@@ -17,7 +17,7 @@
 #include <linux/swiotlb.h>
 #include <asm/machvec.h>
 
-extern struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
+extern const struct dma_map_ops sba_dma_ops, swiotlb_dma_ops;
 
 /* swiotlb declarations & definitions: */
 extern int swiotlb_late_init_with_default_size (size_t size);
@@ -33,7 +33,7 @@
 		!sba_dma_ops.dma_supported(dev, *dev->dma_mask);
 }
 
-struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
+const struct dma_map_ops *hwsw_dma_get_ops(struct device *dev)
 {
 	if (use_swiotlb(dev))
 		return &swiotlb_dma_ops;
diff -uriN linux-2.6.32.43/arch/ia64/hp/common/sba_iommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/hp/common/sba_iommu.c
--- linux-2.6.32.43/arch/ia64/hp/common/sba_iommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/hp/common/sba_iommu.c	2011-07-15 05:51:11.000000000 -0500
@@ -2097,7 +2097,7 @@
 	},
 };
 
-extern struct dma_map_ops swiotlb_dma_ops;
+extern const struct dma_map_ops swiotlb_dma_ops;
 
 static int __init
 sba_init(void)
@@ -2211,7 +2211,7 @@
 
 __setup("sbapagesize=",sba_page_override);
 
-struct dma_map_ops sba_dma_ops = {
+const struct dma_map_ops sba_dma_ops = {
 	.alloc_coherent		= sba_alloc_coherent,
 	.free_coherent		= sba_free_coherent,
 	.map_page		= sba_map_page,
diff -uriN linux-2.6.32.43/arch/ia64/ia32/binfmt_elf32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/ia32/binfmt_elf32.c
--- linux-2.6.32.43/arch/ia64/ia32/binfmt_elf32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/ia32/binfmt_elf32.c	2011-07-15 05:51:11.000000000 -0500
@@ -45,6 +45,13 @@
 
 #define elf_read_implies_exec(ex, have_pt_gnu_stack)	(!(have_pt_gnu_stack))
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
+
+#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
+#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
+#endif
+
 /* Ugly but avoids duplication */
 #include "../../../fs/binfmt_elf.c"
 
diff -uriN linux-2.6.32.43/arch/ia64/ia32/ia32_entry.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/ia32/ia32_entry.S
--- linux-2.6.32.43/arch/ia64/ia32/ia32_entry.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/ia32/ia32_entry.S	2011-07-15 05:50:11.000000000 -0500
@@ -451,7 +451,7 @@
  	data8 sys_tgkill	/* 270 */
  	data8 compat_sys_utimes
  	data8 sys32_fadvise64_64
- 	data8 sys_ni_syscall
+	data8 sys32_vserver
   	data8 sys_ni_syscall
  	data8 sys_ni_syscall	/* 275 */
   	data8 sys_ni_syscall
diff -uriN linux-2.6.32.43/arch/ia64/ia32/ia32priv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/ia32/ia32priv.h
--- linux-2.6.32.43/arch/ia64/ia32/ia32priv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/ia32/ia32priv.h	2011-07-15 05:51:11.000000000 -0500
@@ -296,7 +296,14 @@
 #define ELF_DATA	ELFDATA2LSB
 #define ELF_ARCH	EM_386
 
-#define IA32_STACK_TOP		IA32_PAGE_OFFSET
+#ifdef CONFIG_PAX_RANDUSTACK
+#define __IA32_DELTA_STACK	(current->mm->delta_stack)
+#else
+#define __IA32_DELTA_STACK	0UL
+#endif
+
+#define IA32_STACK_TOP		(IA32_PAGE_OFFSET - __IA32_DELTA_STACK)
+
 #define IA32_GATE_OFFSET	IA32_PAGE_OFFSET
 #define IA32_GATE_END		IA32_PAGE_OFFSET + PAGE_SIZE
 
diff -uriN linux-2.6.32.43/arch/ia64/include/asm/dma-mapping.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/dma-mapping.h
--- linux-2.6.32.43/arch/ia64/include/asm/dma-mapping.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/dma-mapping.h	2011-07-15 05:51:11.000000000 -0500
@@ -12,7 +12,7 @@
 
 #define ARCH_HAS_DMA_GET_REQUIRED_MASK
 
-extern struct dma_map_ops *dma_ops;
+extern const struct dma_map_ops *dma_ops;
 extern struct ia64_machine_vector ia64_mv;
 extern void set_iommu_machvec(void);
 
@@ -24,7 +24,7 @@
 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
 				       dma_addr_t *daddr, gfp_t gfp)
 {
-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
 	void *caddr;
 
 	caddr = ops->alloc_coherent(dev, size, daddr, gfp);
@@ -35,7 +35,7 @@
 static inline void dma_free_coherent(struct device *dev, size_t size,
 				     void *caddr, dma_addr_t daddr)
 {
-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
 	debug_dma_free_coherent(dev, size, caddr, daddr);
 	ops->free_coherent(dev, size, caddr, daddr);
 }
@@ -49,13 +49,13 @@
 
 static inline int dma_mapping_error(struct device *dev, dma_addr_t daddr)
 {
-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
 	return ops->mapping_error(dev, daddr);
 }
 
 static inline int dma_supported(struct device *dev, u64 mask)
 {
-	struct dma_map_ops *ops = platform_dma_get_ops(dev);
+	const struct dma_map_ops *ops = platform_dma_get_ops(dev);
 	return ops->dma_supported(dev, mask);
 }
 
diff -uriN linux-2.6.32.43/arch/ia64/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/elf.h
--- linux-2.6.32.43/arch/ia64/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -43,6 +43,13 @@
  */
 #define ELF_ET_DYN_BASE		(TASK_UNMAPPED_BASE + 0x800000000UL)
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(current->personality == PER_LINUX32 ? 0x08048000UL : 0x4000000000000000UL)
+
+#define PAX_DELTA_MMAP_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
+#define PAX_DELTA_STACK_LEN	(current->personality == PER_LINUX32 ? 16 : 3*PAGE_SHIFT - 13)
+#endif
+
 #define PT_IA_64_UNWIND		0x70000001
 
 /* IA-64 relocations: */
diff -uriN linux-2.6.32.43/arch/ia64/include/asm/machvec.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/machvec.h
--- linux-2.6.32.43/arch/ia64/include/asm/machvec.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/machvec.h	2011-07-15 05:51:11.000000000 -0500
@@ -45,7 +45,7 @@
 /* DMA-mapping interface: */
 typedef void ia64_mv_dma_init (void);
 typedef u64 ia64_mv_dma_get_required_mask (struct device *);
-typedef struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
+typedef const struct dma_map_ops *ia64_mv_dma_get_ops(struct device *);
 
 /*
  * WARNING: The legacy I/O space is _architected_.  Platforms are
@@ -251,7 +251,7 @@
 # endif /* CONFIG_IA64_GENERIC */
 
 extern void swiotlb_dma_init(void);
-extern struct dma_map_ops *dma_get_ops(struct device *);
+extern const struct dma_map_ops *dma_get_ops(struct device *);
 
 /*
  * Define default versions so we can extend machvec for new platforms without having
diff -uriN linux-2.6.32.43/arch/ia64/include/asm/pgtable.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/pgtable.h
--- linux-2.6.32.43/arch/ia64/include/asm/pgtable.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/pgtable.h	2011-07-15 05:51:11.000000000 -0500
@@ -12,7 +12,7 @@
  *	David Mosberger-Tang <davidm@hpl.hp.com>
  */
 
-
+#include <linux/const.h>
 #include <asm/mman.h>
 #include <asm/page.h>
 #include <asm/processor.h>
@@ -143,6 +143,17 @@
 #define PAGE_READONLY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
 #define PAGE_COPY	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
 #define PAGE_COPY_EXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RX)
+
+#ifdef CONFIG_PAX_PAGEEXEC
+# define PAGE_SHARED_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_RW)
+# define PAGE_READONLY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
+# define PAGE_COPY_NOEXEC	__pgprot(__ACCESS_BITS | _PAGE_PL_3 | _PAGE_AR_R)
+#else
+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
+# define PAGE_COPY_NOEXEC	PAGE_COPY
+#endif
+
 #define PAGE_GATE	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_X_RX)
 #define PAGE_KERNEL	__pgprot(__DIRTY_BITS  | _PAGE_PL_0 | _PAGE_AR_RWX)
 #define PAGE_KERNELRX	__pgprot(__ACCESS_BITS | _PAGE_PL_0 | _PAGE_AR_RX)
diff -uriN linux-2.6.32.43/arch/ia64/include/asm/spinlock.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/spinlock.h
--- linux-2.6.32.43/arch/ia64/include/asm/spinlock.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/spinlock.h	2011-07-15 05:51:11.000000000 -0500
@@ -72,7 +72,7 @@
 	unsigned short	*p = (unsigned short *)&lock->lock + 1, tmp;
 
 	asm volatile ("ld2.bias %0=[%1]" : "=r"(tmp) : "r"(p));
-	ACCESS_ONCE(*p) = (tmp + 2) & ~1;
+	ACCESS_ONCE_RW(*p) = (tmp + 2) & ~1;
 }
 
 static __always_inline void __ticket_spin_unlock_wait(raw_spinlock_t *lock)
diff -uriN linux-2.6.32.43/arch/ia64/include/asm/tlb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/tlb.h
--- linux-2.6.32.43/arch/ia64/include/asm/tlb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/tlb.h	2011-07-15 05:50:11.000000000 -0500
@@ -40,6 +40,7 @@
 #include <linux/mm.h>
 #include <linux/pagemap.h>
 #include <linux/swap.h>
+#include <linux/vs_memory.h>
 
 #include <asm/pgalloc.h>
 #include <asm/processor.h>
diff -uriN linux-2.6.32.43/arch/ia64/include/asm/uaccess.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/uaccess.h
--- linux-2.6.32.43/arch/ia64/include/asm/uaccess.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/include/asm/uaccess.h	2011-07-15 06:54:09.000000000 -0500
@@ -257,7 +257,7 @@
 	const void *__cu_from = (from);							\
 	long __cu_len = (n);								\
 											\
-	if (__access_ok(__cu_to, __cu_len, get_fs()))					\
+	if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_to, __cu_len, get_fs()))			\
 		__cu_len = __copy_user(__cu_to, (__force void __user *) __cu_from, __cu_len);	\
 	__cu_len;									\
 })
@@ -269,7 +269,7 @@
 	long __cu_len = (n);								\
 											\
 	__chk_user_ptr(__cu_from);							\
-	if (__access_ok(__cu_from, __cu_len, get_fs()))					\
+	if (__cu_len > 0 && __cu_len <= INT_MAX && __access_ok(__cu_from, __cu_len, get_fs()))			\
 		__cu_len = __copy_user((__force void __user *) __cu_to, __cu_from, __cu_len);	\
 	__cu_len;									\
 })
diff -uriN linux-2.6.32.43/arch/ia64/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/Kconfig
--- linux-2.6.32.43/arch/ia64/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -685,6 +685,8 @@
 
 source "arch/ia64/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/ia64/kernel/dma-mapping.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/dma-mapping.c
--- linux-2.6.32.43/arch/ia64/kernel/dma-mapping.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/dma-mapping.c	2011-07-15 05:51:11.000000000 -0500
@@ -3,7 +3,7 @@
 /* Set this to 1 if there is a HW IOMMU in the system */
 int iommu_detected __read_mostly;
 
-struct dma_map_ops *dma_ops;
+const struct dma_map_ops *dma_ops;
 EXPORT_SYMBOL(dma_ops);
 
 #define PREALLOC_DMA_DEBUG_ENTRIES (1 << 16)
@@ -16,7 +16,7 @@
 }
 fs_initcall(dma_init);
 
-struct dma_map_ops *dma_get_ops(struct device *dev)
+const struct dma_map_ops *dma_get_ops(struct device *dev)
 {
 	return dma_ops;
 }
diff -uriN linux-2.6.32.43/arch/ia64/kernel/entry.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/entry.S
--- linux-2.6.32.43/arch/ia64/kernel/entry.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/entry.S	2011-07-15 05:50:11.000000000 -0500
@@ -1753,7 +1753,7 @@
 	data8 sys_mq_notify
 	data8 sys_mq_getsetattr
 	data8 sys_kexec_load
-	data8 sys_ni_syscall			// reserved for vserver
+	data8 sys_vserver
 	data8 sys_waitid			// 1270
 	data8 sys_add_key
 	data8 sys_request_key
diff -uriN linux-2.6.32.43/arch/ia64/kernel/module.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/module.c
--- linux-2.6.32.43/arch/ia64/kernel/module.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/module.c	2011-07-15 05:51:11.000000000 -0500
@@ -315,8 +315,7 @@
 void
 module_free (struct module *mod, void *module_region)
 {
-	if (mod && mod->arch.init_unw_table &&
-	    module_region == mod->module_init) {
+	if (mod && mod->arch.init_unw_table && module_region == mod->module_init_rx) {
 		unw_remove_unwind_table(mod->arch.init_unw_table);
 		mod->arch.init_unw_table = NULL;
 	}
@@ -502,15 +501,39 @@
 }
 
 static inline int
+in_init_rx (const struct module *mod, uint64_t addr)
+{
+	return addr - (uint64_t) mod->module_init_rx < mod->init_size_rx;
+}
+
+static inline int
+in_init_rw (const struct module *mod, uint64_t addr)
+{
+	return addr - (uint64_t) mod->module_init_rw < mod->init_size_rw;
+}
+
+static inline int
 in_init (const struct module *mod, uint64_t addr)
 {
-	return addr - (uint64_t) mod->module_init < mod->init_size;
+	return in_init_rx(mod, addr) || in_init_rw(mod, addr);
+}
+
+static inline int
+in_core_rx (const struct module *mod, uint64_t addr)
+{
+	return addr - (uint64_t) mod->module_core_rx < mod->core_size_rx;
+}
+
+static inline int
+in_core_rw (const struct module *mod, uint64_t addr)
+{
+	return addr - (uint64_t) mod->module_core_rw < mod->core_size_rw;
 }
 
 static inline int
 in_core (const struct module *mod, uint64_t addr)
 {
-	return addr - (uint64_t) mod->module_core < mod->core_size;
+	return in_core_rx(mod, addr) || in_core_rw(mod, addr);
 }
 
 static inline int
@@ -693,7 +716,14 @@
 		break;
 
 	      case RV_BDREL:
-		val -= (uint64_t) (in_init(mod, val) ? mod->module_init : mod->module_core);
+		if (in_init_rx(mod, val))
+			val -= (uint64_t) mod->module_init_rx;
+		else if (in_init_rw(mod, val))
+			val -= (uint64_t) mod->module_init_rw;
+		else if (in_core_rx(mod, val))
+			val -= (uint64_t) mod->module_core_rx;
+		else if (in_core_rw(mod, val))
+			val -= (uint64_t) mod->module_core_rw;
 		break;
 
 	      case RV_LTV:
@@ -828,15 +858,15 @@
 		 *     addresses have been selected...
 		 */
 		uint64_t gp;
-		if (mod->core_size > MAX_LTOFF)
+		if (mod->core_size_rx + mod->core_size_rw > MAX_LTOFF)
 			/*
 			 * This takes advantage of fact that SHF_ARCH_SMALL gets allocated
 			 * at the end of the module.
 			 */
-			gp = mod->core_size - MAX_LTOFF / 2;
+			gp = mod->core_size_rx + mod->core_size_rw - MAX_LTOFF / 2;
 		else
-			gp = mod->core_size / 2;
-		gp = (uint64_t) mod->module_core + ((gp + 7) & -8);
+			gp = (mod->core_size_rx + mod->core_size_rw) / 2;
+		gp = (uint64_t) mod->module_core_rx + ((gp + 7) & -8);
 		mod->arch.gp = gp;
 		DEBUGP("%s: placing gp at 0x%lx\n", __func__, gp);
 	}
diff -uriN linux-2.6.32.43/arch/ia64/kernel/pci-dma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/pci-dma.c
--- linux-2.6.32.43/arch/ia64/kernel/pci-dma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/pci-dma.c	2011-07-15 05:51:11.000000000 -0500
@@ -43,7 +43,7 @@
 	.dma_mask = &fallback_dev.coherent_dma_mask,
 };
 
-extern struct dma_map_ops intel_dma_ops;
+extern const struct dma_map_ops intel_dma_ops;
 
 static int __init pci_iommu_init(void)
 {
@@ -96,15 +96,34 @@
 }
 EXPORT_SYMBOL(iommu_dma_supported);
 
+extern void *intel_alloc_coherent(struct device *hwdev, size_t size, dma_addr_t *dma_handle, gfp_t flags);
+extern void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr, dma_addr_t dma_handle);
+extern int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
+extern void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist, int nelems, enum dma_data_direction dir, struct dma_attrs *attrs);
+extern dma_addr_t intel_map_page(struct device *dev, struct page *page, unsigned long offset, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
+extern void intel_unmap_page(struct device *dev, dma_addr_t dev_addr, size_t size, enum dma_data_direction dir, struct dma_attrs *attrs);
+extern int intel_mapping_error(struct device *dev, dma_addr_t dma_addr);
+
+static const struct dma_map_ops intel_iommu_dma_ops = {
+	/* from drivers/pci/intel-iommu.c:intel_dma_ops */
+	.alloc_coherent = intel_alloc_coherent,
+	.free_coherent = intel_free_coherent,
+	.map_sg = intel_map_sg,
+	.unmap_sg = intel_unmap_sg,
+	.map_page = intel_map_page,
+	.unmap_page = intel_unmap_page,
+	.mapping_error = intel_mapping_error,
+
+	.sync_single_for_cpu = machvec_dma_sync_single,
+	.sync_sg_for_cpu = machvec_dma_sync_sg,
+	.sync_single_for_device = machvec_dma_sync_single,
+	.sync_sg_for_device = machvec_dma_sync_sg,
+	.dma_supported = iommu_dma_supported,
+};
+
 void __init pci_iommu_alloc(void)
 {
-	dma_ops = &intel_dma_ops;
-
-	dma_ops->sync_single_for_cpu = machvec_dma_sync_single;
-	dma_ops->sync_sg_for_cpu = machvec_dma_sync_sg;
-	dma_ops->sync_single_for_device = machvec_dma_sync_single;
-	dma_ops->sync_sg_for_device = machvec_dma_sync_sg;
-	dma_ops->dma_supported = iommu_dma_supported;
+	dma_ops = &intel_iommu_dma_ops;
 
 	/*
 	 * The order of these functions is important for
diff -uriN linux-2.6.32.43/arch/ia64/kernel/pci-swiotlb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/pci-swiotlb.c
--- linux-2.6.32.43/arch/ia64/kernel/pci-swiotlb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/pci-swiotlb.c	2011-07-15 05:51:11.000000000 -0500
@@ -21,7 +21,7 @@
 	return swiotlb_alloc_coherent(dev, size, dma_handle, gfp);
 }
 
-struct dma_map_ops swiotlb_dma_ops = {
+const struct dma_map_ops swiotlb_dma_ops = {
 	.alloc_coherent = ia64_swiotlb_alloc_coherent,
 	.free_coherent = swiotlb_free_coherent,
 	.map_page = swiotlb_map_page,
diff -uriN linux-2.6.32.43/arch/ia64/kernel/perfmon.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/perfmon.c
--- linux-2.6.32.43/arch/ia64/kernel/perfmon.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/perfmon.c	2011-07-15 05:50:11.000000000 -0500
@@ -41,6 +41,7 @@
 #include <linux/rcupdate.h>
 #include <linux/completion.h>
 #include <linux/tracehook.h>
+#include <linux/vs_memory.h>
 
 #include <asm/errno.h>
 #include <asm/intrinsics.h>
@@ -2372,7 +2373,7 @@
 	 */
 	insert_vm_struct(mm, vma);
 
-	mm->total_vm  += size >> PAGE_SHIFT;
+	vx_vmpages_add(mm, size >> PAGE_SHIFT);
 	vm_stat_account(vma->vm_mm, vma->vm_flags, vma->vm_file,
 							vma_pages(vma));
 	up_write(&task->mm->mmap_sem);
diff -uriN linux-2.6.32.43/arch/ia64/kernel/process.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/process.c
--- linux-2.6.32.43/arch/ia64/kernel/process.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/process.c	2011-07-15 05:50:11.000000000 -0500
@@ -110,8 +110,8 @@
 	unsigned long ip = regs->cr_iip + ia64_psr(regs)->ri;
 
 	print_modules();
-	printk("\nPid: %d, CPU %d, comm: %20s\n", task_pid_nr(current),
-			smp_processor_id(), current->comm);
+	printk("\nPid: %d[#%u], CPU %d, comm: %20s\n", task_pid_nr(current),
+			current->xid, smp_processor_id(), current->comm);
 	printk("psr : %016lx ifs : %016lx ip  : [<%016lx>]    %s (%s)\n",
 	       regs->cr_ipsr, regs->cr_ifs, ip, print_tainted(),
 	       init_utsname()->release);
diff -uriN linux-2.6.32.43/arch/ia64/kernel/ptrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/ptrace.c
--- linux-2.6.32.43/arch/ia64/kernel/ptrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/ptrace.c	2011-07-15 05:50:11.000000000 -0500
@@ -22,6 +22,7 @@
 #include <linux/regset.h>
 #include <linux/elf.h>
 #include <linux/tracehook.h>
+#include <linux/vs_base.h>
 
 #include <asm/pgtable.h>
 #include <asm/processor.h>
diff -uriN linux-2.6.32.43/arch/ia64/kernel/sys_ia64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/sys_ia64.c
--- linux-2.6.32.43/arch/ia64/kernel/sys_ia64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/sys_ia64.c	2011-07-15 05:51:11.000000000 -0500
@@ -43,6 +43,13 @@
 	if (REGION_NUMBER(addr) == RGN_HPAGE)
 		addr = 0;
 #endif
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (mm->pax_flags & MF_PAX_RANDMMAP)
+		addr = mm->free_area_cache;
+	else
+#endif
+
 	if (!addr)
 		addr = mm->free_area_cache;
 
@@ -61,14 +68,14 @@
 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr || RGN_MAP_LIMIT - len < REGION_OFFSET(addr)) {
-			if (start_addr != TASK_UNMAPPED_BASE) {
+			if (start_addr != mm->mmap_base) {
 				/* Start a new search --- just in case we missed some holes.  */
-				addr = TASK_UNMAPPED_BASE;
+				addr = mm->mmap_base;
 				goto full_search;
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (check_heap_stack_gap(vma, addr, len)) {
 			/* Remember the address where we stopped this search:  */
 			mm->free_area_cache = addr + len;
 			return addr;
diff -uriN linux-2.6.32.43/arch/ia64/kernel/topology.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/topology.c
--- linux-2.6.32.43/arch/ia64/kernel/topology.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/topology.c	2011-07-15 05:51:11.000000000 -0500
@@ -282,7 +282,7 @@
 	return ret;
 }
 
-static struct sysfs_ops cache_sysfs_ops = {
+static const struct sysfs_ops cache_sysfs_ops = {
 	.show   = cache_show
 };
 
diff -uriN linux-2.6.32.43/arch/ia64/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/traps.c
--- linux-2.6.32.43/arch/ia64/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/traps.c	2011-07-15 05:50:11.000000000 -0500
@@ -60,8 +60,9 @@
 	put_cpu();
 
 	if (++die.lock_owner_depth < 3) {
-		printk("%s[%d]: %s %ld [%d]\n",
-		current->comm, task_pid_nr(current), str, err, ++die_counter);
+		printk("%s[%d[#%u]]: %s %ld [%d]\n",
+			current->comm, task_pid_nr(current), current->xid,
+			str, err, ++die_counter);
 		if (notify_die(DIE_OOPS, str, regs, err, 255, SIGSEGV)
 	            != NOTIFY_STOP)
 			show_regs(regs);
@@ -324,8 +325,9 @@
 			if ((last.count & 15) < 5 && (ia64_fetchadd(1, &last.count, acq) & 15) < 5) {
 				last.time = current_jiffies + 5 * HZ;
 				printk(KERN_WARNING
-		       			"%s(%d): floating-point assist fault at ip %016lx, isr %016lx\n",
-		       			current->comm, task_pid_nr(current), regs->cr_iip + ia64_psr(regs)->ri, isr);
+					"%s(%d[#%u]): floating-point assist fault at ip %016lx, isr %016lx\n",
+					current->comm, task_pid_nr(current), current->xid,
+					regs->cr_iip + ia64_psr(regs)->ri, isr);
 			}
 		}
 	}
diff -uriN linux-2.6.32.43/arch/ia64/kernel/vmlinux.lds.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/vmlinux.lds.S
--- linux-2.6.32.43/arch/ia64/kernel/vmlinux.lds.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/kernel/vmlinux.lds.S	2011-07-15 05:51:11.000000000 -0500
@@ -190,7 +190,7 @@
   /* Per-cpu data: */
   . = ALIGN(PERCPU_PAGE_SIZE);
   PERCPU_VADDR(PERCPU_ADDR, :percpu)
-  __phys_per_cpu_start = __per_cpu_load;
+  __phys_per_cpu_start = per_cpu_load;
   . = __phys_per_cpu_start + PERCPU_PAGE_SIZE;	/* ensure percpu data fits
   						 * into percpu page size
 						 */
diff -uriN linux-2.6.32.43/arch/ia64/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/mm/fault.c
--- linux-2.6.32.43/arch/ia64/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/mm/fault.c	2011-07-15 05:51:11.000000000 -0500
@@ -10,6 +10,7 @@
 #include <linux/interrupt.h>
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
+#include <linux/vs_memory.h>
 
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -72,6 +73,23 @@
 	return pte_present(pte);
 }
 
+#ifdef CONFIG_PAX_PAGEEXEC
+void pax_report_insns(void *pc, void *sp)
+{
+	unsigned long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 8; i++) {
+		unsigned int c;
+		if (get_user(c, (unsigned int *)pc+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%08x ", c);
+	}
+	printk("\n");
+}
+#endif
+
 void __kprobes
 ia64_do_page_fault (unsigned long address, unsigned long isr, struct pt_regs *regs)
 {
@@ -145,9 +163,23 @@
 	mask = (  (((isr >> IA64_ISR_X_BIT) & 1UL) << VM_EXEC_BIT)
 		| (((isr >> IA64_ISR_W_BIT) & 1UL) << VM_WRITE_BIT));
 
-	if ((vma->vm_flags & mask) != mask)
+	if ((vma->vm_flags & mask) != mask) {
+
+#ifdef CONFIG_PAX_PAGEEXEC
+		if (!(vma->vm_flags & VM_EXEC) && (mask & VM_EXEC)) {
+			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->cr_iip)
+				goto bad_area;
+
+			up_read(&mm->mmap_sem);
+			pax_report_fault(regs, (void *)regs->cr_iip, (void *)regs->r12);
+			do_group_exit(SIGKILL);
+		}
+#endif
+
 		goto bad_area;
 
+	}
+
   survive:
 	/*
 	 * If for any reason at all we couldn't handle the fault, make
@@ -281,7 +313,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk(KERN_CRIT "VM: killing process %s\n", current->comm);
+	printk(KERN_CRIT "VM: killing process %s(%d:#%u)\n",
+		current->comm, task_pid_nr(current), current->xid);
 	if (user_mode(regs))
 		do_group_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/ia64/mm/hugetlbpage.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/mm/hugetlbpage.c
--- linux-2.6.32.43/arch/ia64/mm/hugetlbpage.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/mm/hugetlbpage.c	2011-07-15 05:51:11.000000000 -0500
@@ -172,7 +172,7 @@
 		/* At this point:  (!vmm || addr < vmm->vm_end). */
 		if (REGION_OFFSET(addr) + len > RGN_MAP_LIMIT)
 			return -ENOMEM;
-		if (!vmm || (addr + len) <= vmm->vm_start)
+		if (check_heap_stack_gap(vmm, addr, len))
 			return addr;
 		addr = ALIGN(vmm->vm_end, HPAGE_SIZE);
 	}
diff -uriN linux-2.6.32.43/arch/ia64/mm/init.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/mm/init.c
--- linux-2.6.32.43/arch/ia64/mm/init.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/mm/init.c	2011-07-15 05:51:11.000000000 -0500
@@ -122,6 +122,19 @@
 		vma->vm_start = current->thread.rbs_bot & PAGE_MASK;
 		vma->vm_end = vma->vm_start + PAGE_SIZE;
 		vma->vm_flags = VM_DATA_DEFAULT_FLAGS|VM_GROWSUP|VM_ACCOUNT;
+
+#ifdef CONFIG_PAX_PAGEEXEC
+		if (current->mm->pax_flags & MF_PAX_PAGEEXEC) {
+			vma->vm_flags &= ~VM_EXEC;
+
+#ifdef CONFIG_PAX_MPROTECT
+			if (current->mm->pax_flags & MF_PAX_MPROTECT)
+				vma->vm_flags &= ~VM_MAYEXEC;
+#endif
+
+		}
+#endif
+
 		vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
 		down_write(&current->mm->mmap_sem);
 		if (insert_vm_struct(current->mm, vma)) {
diff -uriN linux-2.6.32.43/arch/ia64/sn/pci/pci_dma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/sn/pci/pci_dma.c
--- linux-2.6.32.43/arch/ia64/sn/pci/pci_dma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/ia64/sn/pci/pci_dma.c	2011-07-15 05:51:11.000000000 -0500
@@ -464,7 +464,7 @@
 	return ret;
 }
 
-static struct dma_map_ops sn_dma_ops = {
+static const struct dma_map_ops sn_dma_ops = {
 	.alloc_coherent		= sn_dma_alloc_coherent,
 	.free_coherent		= sn_dma_free_coherent,
 	.map_page		= sn_dma_map_page,
diff -uriN linux-2.6.32.43/arch/m32r/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m32r/kernel/traps.c
--- linux-2.6.32.43/arch/m32r/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m32r/kernel/traps.c	2011-07-15 05:50:11.000000000 -0500
@@ -196,8 +196,9 @@
 	} else {
 		printk("SPI: %08lx\n", sp);
 	}
-	printk("Process %s (pid: %d, process nr: %d, stackpage=%08lx)",
-		current->comm, task_pid_nr(current), 0xffff & i, 4096+(unsigned long)current);
+	printk("Process %s (pid: %d[#%u], process nr: %d, stackpage=%08lx)",
+		current->comm, task_pid_nr(current), current->xid,
+		0xffff & i, 4096+(unsigned long)current);
 
 	/*
 	 * When in-kernel, we also print out the stack and code at the
diff -uriN linux-2.6.32.43/arch/m32r/lib/usercopy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m32r/lib/usercopy.c
--- linux-2.6.32.43/arch/m32r/lib/usercopy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m32r/lib/usercopy.c	2011-07-15 05:51:11.000000000 -0500
@@ -14,6 +14,9 @@
 unsigned long
 __generic_copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+	if ((long)n < 0)
+		return n;
+
 	prefetch(from);
 	if (access_ok(VERIFY_WRITE, to, n))
 		__copy_user(to,from,n);
@@ -23,6 +26,9 @@
 unsigned long
 __generic_copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+	if ((long)n < 0)
+		return n;
+
 	prefetchw(to);
 	if (access_ok(VERIFY_READ, from, n))
 		__copy_user_zeroing(to,from,n);
diff -uriN linux-2.6.32.43/arch/m32r/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m32r/mm/fault.c
--- linux-2.6.32.43/arch/m32r/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m32r/mm/fault.c	2011-07-15 05:50:11.000000000 -0500
@@ -276,7 +276,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk("VM: killing process %s\n", tsk->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		tsk->comm, task_pid_nr(tsk), tsk->xid);
 	if (error_code & ACE_USERMODE)
 		do_group_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/m68k/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68k/Kconfig
--- linux-2.6.32.43/arch/m68k/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68k/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -622,6 +622,8 @@
 
 source "arch/m68k/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/m68k/kernel/ptrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68k/kernel/ptrace.c
--- linux-2.6.32.43/arch/m68k/kernel/ptrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68k/kernel/ptrace.c	2011-07-15 05:50:11.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/ptrace.h>
 #include <linux/user.h>
 #include <linux/signal.h>
+#include <linux/vs_base.h>
 
 #include <asm/uaccess.h>
 #include <asm/page.h>
@@ -269,6 +270,8 @@
 		ret = ptrace_request(child, request, addr, data);
 		break;
 	}
+	if (!vx_check(vx_task_xid(child), VS_WATCH_P | VS_IDENT))
+		goto out_tsk;
 
 	return ret;
 out_eio:
diff -uriN linux-2.6.32.43/arch/m68k/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68k/kernel/traps.c
--- linux-2.6.32.43/arch/m68k/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68k/kernel/traps.c	2011-07-15 05:50:11.000000000 -0500
@@ -906,8 +906,8 @@
 	printk("d4: %08lx    d5: %08lx    a0: %08lx    a1: %08lx\n",
 	       regs->d4, regs->d5, regs->a0, regs->a1);
 
-	printk("Process %s (pid: %d, task=%p)\n",
-		current->comm, task_pid_nr(current), current);
+	printk("Process %s (pid: %d[#%u], task=%p)\n",
+		current->comm, task_pid_nr(current), current->xid, current);
 	addr = (unsigned long)&fp->un;
 	printk("Frame format=%X ", regs->format);
 	switch (regs->format) {
diff -uriN linux-2.6.32.43/arch/m68k/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68k/mm/fault.c
--- linux-2.6.32.43/arch/m68k/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68k/mm/fault.c	2011-07-15 05:50:11.000000000 -0500
@@ -186,7 +186,8 @@
 		goto survive;
 	}
 
-	printk("VM: killing process %s\n", current->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		current->comm, task_pid_nr(current), current->xid);
 	if (user_mode(regs))
 		do_group_exit(SIGKILL);
 
diff -uriN linux-2.6.32.43/arch/m68knommu/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68knommu/Kconfig
--- linux-2.6.32.43/arch/m68knommu/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68knommu/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -727,6 +727,8 @@
 
 source "arch/m68knommu/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/m68knommu/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68knommu/kernel/traps.c
--- linux-2.6.32.43/arch/m68knommu/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/m68knommu/kernel/traps.c	2011-07-15 05:50:11.000000000 -0500
@@ -78,8 +78,9 @@
 	printk(KERN_EMERG "d4: %08lx    d5: %08lx    a0: %08lx    a1: %08lx\n",
 	       fp->d4, fp->d5, fp->a0, fp->a1);
 
-	printk(KERN_EMERG "Process %s (pid: %d, stackpage=%08lx)\n",
-		current->comm, current->pid, PAGE_SIZE+(unsigned long)current);
+	printk(KERN_EMERG "Process %s (pid: %d[#%u], stackpage=%08lx)\n",
+		current->comm, task_pid_nr(current), current->xid,
+		PAGE_SIZE+(unsigned long)current);
 	show_stack(NULL, (unsigned long *)(fp + 1));
 	add_taint(TAINT_DIE);
 	do_exit(SIGSEGV);
diff -uriN linux-2.6.32.43/arch/microblaze/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/microblaze/mm/fault.c
--- linux-2.6.32.43/arch/microblaze/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/microblaze/mm/fault.c	2011-07-15 05:50:11.000000000 -0500
@@ -279,7 +279,8 @@
 		goto survive;
 	}
 	up_read(&mm->mmap_sem);
-	printk(KERN_WARNING "VM: killing process %s\n", current->comm);
+	printk(KERN_WARNING "VM: killing process %s(%d:#%u)\n",
+		current->comm, task_pid_nr(current), current->xid);
 	if (user_mode(regs))
 		do_exit(SIGKILL);
 	bad_page_fault(regs, address, SIGKILL);
diff -uriN linux-2.6.32.43/arch/mips/alchemy/devboards/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/alchemy/devboards/pm.c
--- linux-2.6.32.43/arch/mips/alchemy/devboards/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/alchemy/devboards/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -78,7 +78,7 @@
 
 }
 
-static struct platform_suspend_ops db1x_pm_ops = {
+static const struct platform_suspend_ops db1x_pm_ops = {
 	.valid		= suspend_valid_only_mem,
 	.begin		= db1x_pm_begin,
 	.enter		= db1x_pm_enter,
diff -uriN linux-2.6.32.43/arch/mips/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/include/asm/elf.h
--- linux-2.6.32.43/arch/mips/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -368,4 +368,11 @@
 #define ELF_ET_DYN_BASE         (TASK_SIZE / 3 * 2)
 #endif
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
+
+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
+#endif
+
 #endif /* _ASM_ELF_H */
diff -uriN linux-2.6.32.43/arch/mips/include/asm/page.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/include/asm/page.h
--- linux-2.6.32.43/arch/mips/include/asm/page.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/include/asm/page.h	2011-07-15 05:51:11.000000000 -0500
@@ -93,7 +93,7 @@
   #ifdef CONFIG_CPU_MIPS32
     typedef struct { unsigned long pte_low, pte_high; } pte_t;
     #define pte_val(x)    ((x).pte_low | ((unsigned long long)(x).pte_high << 32))
-    #define __pte(x)      ({ pte_t __pte = {(x), ((unsigned long long)(x)) >> 32}; __pte; })
+    #define __pte(x)      ({ pte_t __pte = {(x), (x) >> 32}; __pte; })
   #else
      typedef struct { unsigned long long pte; } pte_t;
      #define pte_val(x)	((x).pte)
diff -uriN linux-2.6.32.43/arch/mips/include/asm/system.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/include/asm/system.h
--- linux-2.6.32.43/arch/mips/include/asm/system.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/include/asm/system.h	2011-07-15 05:51:11.000000000 -0500
@@ -230,6 +230,6 @@
  */
 #define __ARCH_WANT_UNLOCKED_CTXSW
 
-extern unsigned long arch_align_stack(unsigned long sp);
+#define arch_align_stack(x) ((x) & ~0xfUL)
 
 #endif /* _ASM_SYSTEM_H */
diff -uriN linux-2.6.32.43/arch/mips/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/Kconfig
--- linux-2.6.32.43/arch/mips/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -2188,6 +2188,8 @@
 
 source "arch/mips/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/mips/kernel/binfmt_elfn32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/binfmt_elfn32.c
--- linux-2.6.32.43/arch/mips/kernel/binfmt_elfn32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/binfmt_elfn32.c	2011-07-15 05:51:11.000000000 -0500
@@ -50,6 +50,13 @@
 #undef ELF_ET_DYN_BASE
 #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
+
+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
+#endif
+
 #include <asm/processor.h>
 #include <linux/module.h>
 #include <linux/elfcore.h>
diff -uriN linux-2.6.32.43/arch/mips/kernel/binfmt_elfo32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/binfmt_elfo32.c
--- linux-2.6.32.43/arch/mips/kernel/binfmt_elfo32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/binfmt_elfo32.c	2011-07-15 05:51:11.000000000 -0500
@@ -52,6 +52,13 @@
 #undef ELF_ET_DYN_BASE
 #define ELF_ET_DYN_BASE         (TASK32_SIZE / 3 * 2)
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT_ADDR) ? 0x00400000UL : 0x00400000UL)
+
+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT_ADDR) ? 27-PAGE_SHIFT : 36-PAGE_SHIFT)
+#endif
+
 #include <asm/processor.h>
 
 /*
diff -uriN linux-2.6.32.43/arch/mips/kernel/kgdb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/kgdb.c
--- linux-2.6.32.43/arch/mips/kernel/kgdb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/kgdb.c	2011-07-15 05:51:11.000000000 -0500
@@ -245,6 +245,7 @@
 	return -1;
 }
 
+/* cannot be const */
 struct kgdb_arch arch_kgdb_ops;
 
 /*
diff -uriN linux-2.6.32.43/arch/mips/kernel/process.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/process.c
--- linux-2.6.32.43/arch/mips/kernel/process.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/process.c	2011-07-15 05:51:11.000000000 -0500
@@ -470,15 +470,3 @@
 out:
 	return pc;
 }
-
-/*
- * Don't forget that the stack pointer must be aligned on a 8 bytes
- * boundary for 32-bits ABI and 16 bytes for 64-bits ABI.
- */
-unsigned long arch_align_stack(unsigned long sp)
-{
-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-		sp -= get_random_int() & ~PAGE_MASK;
-
-	return sp & ALMASK;
-}
diff -uriN linux-2.6.32.43/arch/mips/kernel/ptrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/ptrace.c
--- linux-2.6.32.43/arch/mips/kernel/ptrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/ptrace.c	2011-07-15 05:50:11.000000000 -0500
@@ -25,6 +25,7 @@
 #include <linux/security.h>
 #include <linux/audit.h>
 #include <linux/seccomp.h>
+#include <linux/vs_base.h>
 
 #include <asm/byteorder.h>
 #include <asm/cpu.h>
@@ -259,6 +260,9 @@
 {
 	int ret;
 
+	if (!vx_check(vx_task_xid(child), VS_WATCH_P | VS_IDENT))
+		goto out;
+
 	switch (request) {
 	/* when I and D space are separate, these will need to be fixed. */
 	case PTRACE_PEEKTEXT: /* read word at location addr. */
diff -uriN linux-2.6.32.43/arch/mips/kernel/scall32-o32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/scall32-o32.S
--- linux-2.6.32.43/arch/mips/kernel/scall32-o32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/scall32-o32.S	2011-07-15 05:50:11.000000000 -0500
@@ -525,7 +525,7 @@
 	sys	sys_mq_timedreceive	5
 	sys	sys_mq_notify		2	/* 4275 */
 	sys	sys_mq_getsetattr	3
-	sys	sys_ni_syscall		0	/* sys_vserver */
+	sys	sys_vserver		3
 	sys	sys_waitid		5
 	sys	sys_ni_syscall		0	/* available, was setaltroot */
 	sys	sys_add_key		5	/* 4280 */
diff -uriN linux-2.6.32.43/arch/mips/kernel/scall64-64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/scall64-64.S
--- linux-2.6.32.43/arch/mips/kernel/scall64-64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/scall64-64.S	2011-07-15 05:50:11.000000000 -0500
@@ -362,7 +362,7 @@
 	PTR	sys_mq_timedreceive
 	PTR	sys_mq_notify
 	PTR	sys_mq_getsetattr		/* 5235 */
-	PTR	sys_ni_syscall			/* sys_vserver */
+	PTR	sys_vserver
 	PTR	sys_waitid
 	PTR	sys_ni_syscall			/* available, was setaltroot */
 	PTR	sys_add_key
diff -uriN linux-2.6.32.43/arch/mips/kernel/scall64-n32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/scall64-n32.S
--- linux-2.6.32.43/arch/mips/kernel/scall64-n32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/scall64-n32.S	2011-07-15 05:50:11.000000000 -0500
@@ -360,7 +360,7 @@
 	PTR	compat_sys_mq_timedreceive
 	PTR	compat_sys_mq_notify
 	PTR	compat_sys_mq_getsetattr
-	PTR	sys_ni_syscall			/* 6240, sys_vserver */
+	PTR	sys32_vserver			/* 6240 */
 	PTR	compat_sys_waitid
 	PTR	sys_ni_syscall			/* available, was setaltroot */
 	PTR	sys_add_key
diff -uriN linux-2.6.32.43/arch/mips/kernel/scall64-o32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/scall64-o32.S
--- linux-2.6.32.43/arch/mips/kernel/scall64-o32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/scall64-o32.S	2011-07-15 05:50:11.000000000 -0500
@@ -480,7 +480,7 @@
 	PTR	compat_sys_mq_timedreceive
 	PTR	compat_sys_mq_notify		/* 4275 */
 	PTR	compat_sys_mq_getsetattr
-	PTR	sys_ni_syscall			/* sys_vserver */
+	PTR	sys32_vserver
 	PTR	sys_32_waitid
 	PTR	sys_ni_syscall			/* available, was setaltroot */
 	PTR	sys_add_key			/* 4280 */
diff -uriN linux-2.6.32.43/arch/mips/kernel/syscall.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/syscall.c
--- linux-2.6.32.43/arch/mips/kernel/syscall.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/syscall.c	2011-07-15 05:51:11.000000000 -0500
@@ -102,17 +102,21 @@
 	do_color_align = 0;
 	if (filp || (flags & MAP_SHARED))
 		do_color_align = 1;
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
 	if (addr) {
 		if (do_color_align)
 			addr = COLOUR_ALIGN(addr, pgoff);
 		else
 			addr = PAGE_ALIGN(addr);
 		vmm = find_vma(current->mm, addr);
-		if (task_size - len >= addr &&
-		    (!vmm || addr + len <= vmm->vm_start))
+		if (task_size - len >= addr && check_heap_stack_gap(vmm, addr, len))
 			return addr;
 	}
-	addr = TASK_UNMAPPED_BASE;
+	addr = current->mm->mmap_base;
 	if (do_color_align)
 		addr = COLOUR_ALIGN(addr, pgoff);
 	else
@@ -122,7 +126,7 @@
 		/* At this point:  (!vmm || addr < vmm->vm_end). */
 		if (task_size - len < addr)
 			return -ENOMEM;
-		if (!vmm || addr + len <= vmm->vm_start)
+		if (check_heap_stack_gap(vmm, addr, len))
 			return addr;
 		addr = vmm->vm_end;
 		if (do_color_align)
diff -uriN linux-2.6.32.43/arch/mips/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/traps.c
--- linux-2.6.32.43/arch/mips/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/kernel/traps.c	2011-07-15 05:50:11.000000000 -0500
@@ -335,9 +335,10 @@
 
 	__show_regs(regs);
 	print_modules();
-	printk("Process %s (pid: %d, threadinfo=%p, task=%p, tls=%0*lx)\n",
-	       current->comm, current->pid, current_thread_info(), current,
-	      field, current_thread_info()->tp_value);
+	printk("Process %s (pid: %d:#%u, threadinfo=%p, task=%p, tls=%0*lx)\n",
+		current->comm, task_pid_nr(current), current->xid,
+		current_thread_info(), current,
+		field, current_thread_info()->tp_value);
 	if (cpu_has_userlocal) {
 		unsigned long tls;
 
diff -uriN linux-2.6.32.43/arch/mips/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/mm/fault.c
--- linux-2.6.32.43/arch/mips/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mips/mm/fault.c	2011-07-15 05:51:11.000000000 -0500
@@ -26,6 +26,23 @@
 #include <asm/ptrace.h>
 #include <asm/highmem.h>		/* For VMALLOC_END */
 
+#ifdef CONFIG_PAX_PAGEEXEC
+void pax_report_insns(void *pc, void *sp)
+{
+	unsigned long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 5; i++) {
+		unsigned int c;
+		if (get_user(c, (unsigned int *)pc+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%08x ", c);
+	}
+	printk("\n");
+}
+#endif
+
 /*
  * This routine handles page faults.  It determines the address,
  * and the problem, and then passes it off to one of the appropriate
diff -uriN linux-2.6.32.43/arch/mn10300/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mn10300/mm/fault.c
--- linux-2.6.32.43/arch/mn10300/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/mn10300/mm/fault.c	2011-07-15 05:50:11.000000000 -0500
@@ -339,7 +339,8 @@
 out_of_memory:
 	up_read(&mm->mmap_sem);
 	monitor_signal(regs);
-	printk(KERN_ALERT "VM: killing process %s\n", tsk->comm);
+	printk(KERN_ALERT "VM: killing process %s(%d:#%u)\n",
+		tsk->comm, task_pid_nr(tsk), tsk->xid);
 	if ((fault_code & MMUFCR_xFC_ACCESS) == MMUFCR_xFC_ACCESS_USR)
 		do_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/parisc/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/include/asm/elf.h
--- linux-2.6.32.43/arch/parisc/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -343,6 +343,13 @@
 
 #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE + 0x01000000)
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	0x10000UL
+
+#define PAX_DELTA_MMAP_LEN	16
+#define PAX_DELTA_STACK_LEN	16
+#endif
+
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
    but it's not easy, and we've already done it here.  */
diff -uriN linux-2.6.32.43/arch/parisc/include/asm/pgtable.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/include/asm/pgtable.h
--- linux-2.6.32.43/arch/parisc/include/asm/pgtable.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/include/asm/pgtable.h	2011-07-15 05:51:11.000000000 -0500
@@ -207,6 +207,17 @@
 #define PAGE_EXECREAD   __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_EXEC |_PAGE_ACCESSED)
 #define PAGE_COPY       PAGE_EXECREAD
 #define PAGE_RWX        __pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_EXEC |_PAGE_ACCESSED)
+
+#ifdef CONFIG_PAX_PAGEEXEC
+# define PAGE_SHARED_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_WRITE | _PAGE_ACCESSED)
+# define PAGE_COPY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
+# define PAGE_READONLY_NOEXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER | _PAGE_READ | _PAGE_ACCESSED)
+#else
+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
+# define PAGE_COPY_NOEXEC	PAGE_COPY
+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
+#endif
+
 #define PAGE_KERNEL	__pgprot(_PAGE_KERNEL)
 #define PAGE_KERNEL_RO	__pgprot(_PAGE_KERNEL & ~_PAGE_WRITE)
 #define PAGE_KERNEL_UNC	__pgprot(_PAGE_KERNEL | _PAGE_NO_CACHE)
diff -uriN linux-2.6.32.43/arch/parisc/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/Kconfig
--- linux-2.6.32.43/arch/parisc/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -294,6 +294,8 @@
 
 source "arch/parisc/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/parisc/kernel/module.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/kernel/module.c
--- linux-2.6.32.43/arch/parisc/kernel/module.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/kernel/module.c	2011-07-15 05:51:11.000000000 -0500
@@ -95,16 +95,38 @@
 
 /* three functions to determine where in the module core
  * or init pieces the location is */
+static inline int in_init_rx(struct module *me, void *loc)
+{
+	return (loc >= me->module_init_rx &&
+		loc < (me->module_init_rx + me->init_size_rx));
+}
+
+static inline int in_init_rw(struct module *me, void *loc)
+{
+	return (loc >= me->module_init_rw &&
+		loc < (me->module_init_rw + me->init_size_rw));
+}
+
 static inline int in_init(struct module *me, void *loc)
 {
-	return (loc >= me->module_init &&
-		loc <= (me->module_init + me->init_size));
+	return in_init_rx(me, loc) || in_init_rw(me, loc);
+}
+
+static inline int in_core_rx(struct module *me, void *loc)
+{
+	return (loc >= me->module_core_rx &&
+		loc < (me->module_core_rx + me->core_size_rx));
+}
+
+static inline int in_core_rw(struct module *me, void *loc)
+{
+	return (loc >= me->module_core_rw &&
+		loc < (me->module_core_rw + me->core_size_rw));
 }
 
 static inline int in_core(struct module *me, void *loc)
 {
-	return (loc >= me->module_core &&
-		loc <= (me->module_core + me->core_size));
+	return in_core_rx(me, loc) || in_core_rw(me, loc);
 }
 
 static inline int in_local(struct module *me, void *loc)
@@ -364,13 +386,13 @@
 	}
 
 	/* align things a bit */
-	me->core_size = ALIGN(me->core_size, 16);
-	me->arch.got_offset = me->core_size;
-	me->core_size += gots * sizeof(struct got_entry);
-
-	me->core_size = ALIGN(me->core_size, 16);
-	me->arch.fdesc_offset = me->core_size;
-	me->core_size += fdescs * sizeof(Elf_Fdesc);
+	me->core_size_rw = ALIGN(me->core_size_rw, 16);
+	me->arch.got_offset = me->core_size_rw;
+	me->core_size_rw += gots * sizeof(struct got_entry);
+
+	me->core_size_rw = ALIGN(me->core_size_rw, 16);
+	me->arch.fdesc_offset = me->core_size_rw;
+	me->core_size_rw += fdescs * sizeof(Elf_Fdesc);
 
 	me->arch.got_max = gots;
 	me->arch.fdesc_max = fdescs;
@@ -388,7 +410,7 @@
 
 	BUG_ON(value == 0);
 
-	got = me->module_core + me->arch.got_offset;
+	got = me->module_core_rw + me->arch.got_offset;
 	for (i = 0; got[i].addr; i++)
 		if (got[i].addr == value)
 			goto out;
@@ -406,7 +428,7 @@
 #ifdef CONFIG_64BIT
 static Elf_Addr get_fdesc(struct module *me, unsigned long value)
 {
-	Elf_Fdesc *fdesc = me->module_core + me->arch.fdesc_offset;
+	Elf_Fdesc *fdesc = me->module_core_rw + me->arch.fdesc_offset;
 
 	if (!value) {
 		printk(KERN_ERR "%s: zero OPD requested!\n", me->name);
@@ -424,7 +446,7 @@
 
 	/* Create new one */
 	fdesc->addr = value;
-	fdesc->gp = (Elf_Addr)me->module_core + me->arch.got_offset;
+	fdesc->gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
 	return (Elf_Addr)fdesc;
 }
 #endif /* CONFIG_64BIT */
@@ -848,7 +870,7 @@
 
 	table = (unsigned char *)sechdrs[me->arch.unwind_section].sh_addr;
 	end = table + sechdrs[me->arch.unwind_section].sh_size;
-	gp = (Elf_Addr)me->module_core + me->arch.got_offset;
+	gp = (Elf_Addr)me->module_core_rw + me->arch.got_offset;
 
 	DEBUGP("register_unwind_table(), sect = %d at 0x%p - 0x%p (gp=0x%lx)\n",
 	       me->arch.unwind_section, table, end, gp);
diff -uriN linux-2.6.32.43/arch/parisc/kernel/syscall_table.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/kernel/syscall_table.S
--- linux-2.6.32.43/arch/parisc/kernel/syscall_table.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/kernel/syscall_table.S	2011-07-15 05:50:11.000000000 -0500
@@ -361,7 +361,7 @@
 	ENTRY_COMP(mbind)		/* 260 */
 	ENTRY_COMP(get_mempolicy)
 	ENTRY_COMP(set_mempolicy)
-	ENTRY_SAME(ni_syscall)	/* 263: reserved for vserver */
+	ENTRY_DIFF(vserver)
 	ENTRY_SAME(add_key)
 	ENTRY_SAME(request_key)		/* 265 */
 	ENTRY_SAME(keyctl)
diff -uriN linux-2.6.32.43/arch/parisc/kernel/sys_parisc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/kernel/sys_parisc.c
--- linux-2.6.32.43/arch/parisc/kernel/sys_parisc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/kernel/sys_parisc.c	2011-07-15 05:51:11.000000000 -0500
@@ -43,7 +43,7 @@
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vma || addr + len <= vma->vm_start)
+		if (check_heap_stack_gap(vma, addr, len))
 			return addr;
 		addr = vma->vm_end;
 	}
@@ -79,7 +79,7 @@
 		/* At this point:  (!vma || addr < vma->vm_end). */
 		if (TASK_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vma || addr + len <= vma->vm_start)
+		if (check_heap_stack_gap(vma, addr, len))
 			return addr;
 		addr = DCACHE_ALIGN(vma->vm_end - offset) + offset;
 		if (addr < vma->vm_end) /* handle wraparound */
@@ -98,7 +98,7 @@
 	if (flags & MAP_FIXED)
 		return addr;
 	if (!addr)
-		addr = TASK_UNMAPPED_BASE;
+		addr = current->mm->mmap_base;
 
 	if (filp) {
 		addr = get_shared_area(filp->f_mapping, addr, len, pgoff);
diff -uriN linux-2.6.32.43/arch/parisc/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/kernel/traps.c
--- linux-2.6.32.43/arch/parisc/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/kernel/traps.c	2011-07-15 05:51:11.000000000 -0500
@@ -236,8 +236,9 @@
 		if (err == 0)
 			return; /* STFU */
 
-		printk(KERN_CRIT "%s (pid %d): %s (code %ld) at " RFMT "\n",
-			current->comm, task_pid_nr(current), str, err, regs->iaoq[0]);
+		printk(KERN_CRIT "%s (pid %d:#%u): %s (code %ld) at " RFMT "\n",
+			current->comm, task_pid_nr(current), current->xid,
+			str, err, regs->iaoq[0]);
 #ifdef PRINT_USER_FAULTS
 		/* XXX for debugging only */
 		show_regs(regs);
@@ -270,8 +271,8 @@
 		pdc_console_restart();
 	
 	if (err)
-		printk(KERN_CRIT "%s (pid %d): %s (code %ld)\n",
-			current->comm, task_pid_nr(current), str, err);
+		printk(KERN_CRIT "%s (pid %d:#%u): %s (code %ld)\n",
+			current->comm, task_pid_nr(current), current->xid, str, err);
 
 	/* Wot's wrong wif bein' racy? */
 	if (current->thread.flags & PARISC_KERNEL_DEATH) {
@@ -733,9 +734,7 @@
 
 			down_read(&current->mm->mmap_sem);
 			vma = find_vma(current->mm,regs->iaoq[0]);
-			if (vma && (regs->iaoq[0] >= vma->vm_start)
-				&& (vma->vm_flags & VM_EXEC)) {
-
+			if (vma && (regs->iaoq[0] >= vma->vm_start)) {
 				fault_address = regs->iaoq[0];
 				fault_space = regs->iasq[0];
 
diff -uriN linux-2.6.32.43/arch/parisc/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/mm/fault.c
--- linux-2.6.32.43/arch/parisc/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/parisc/mm/fault.c	2011-07-15 05:51:11.000000000 -0500
@@ -15,6 +15,7 @@
 #include <linux/sched.h>
 #include <linux/interrupt.h>
 #include <linux/module.h>
+#include <linux/unistd.h>
 
 #include <asm/uaccess.h>
 #include <asm/traps.h>
@@ -52,7 +53,7 @@
 static unsigned long
 parisc_acctyp(unsigned long code, unsigned int inst)
 {
-	if (code == 6 || code == 16)
+	if (code == 6 || code == 7 || code == 16)
 	    return VM_EXEC;
 
 	switch (inst & 0xf0000000) {
@@ -138,6 +139,116 @@
 			}
 #endif
 
+#ifdef CONFIG_PAX_PAGEEXEC
+/*
+ * PaX: decide what to do with offenders (instruction_pointer(regs) = fault address)
+ *
+ * returns 1 when task should be killed
+ *         2 when rt_sigreturn trampoline was detected
+ *         3 when unpatched PLT trampoline was detected
+ */
+static int pax_handle_fetch_fault(struct pt_regs *regs)
+{
+
+#ifdef CONFIG_PAX_EMUPLT
+	int err;
+
+	do { /* PaX: unpatched PLT emulation */
+		unsigned int bl, depwi;
+
+		err = get_user(bl, (unsigned int *)instruction_pointer(regs));
+		err |= get_user(depwi, (unsigned int *)(instruction_pointer(regs)+4));
+
+		if (err)
+			break;
+
+		if (bl == 0xEA9F1FDDU && depwi == 0xD6801C1EU) {
+			unsigned int ldw, bv, ldw2, addr = instruction_pointer(regs)-12;
+
+			err = get_user(ldw, (unsigned int *)addr);
+			err |= get_user(bv, (unsigned int *)(addr+4));
+			err |= get_user(ldw2, (unsigned int *)(addr+8));
+
+			if (err)
+				break;
+
+			if (ldw == 0x0E801096U &&
+			    bv == 0xEAC0C000U &&
+			    ldw2 == 0x0E881095U)
+			{
+				unsigned int resolver, map;
+
+				err = get_user(resolver, (unsigned int *)(instruction_pointer(regs)+8));
+				err |= get_user(map, (unsigned int *)(instruction_pointer(regs)+12));
+				if (err)
+					break;
+
+				regs->gr[20] = instruction_pointer(regs)+8;
+				regs->gr[21] = map;
+				regs->gr[22] = resolver;
+				regs->iaoq[0] = resolver | 3UL;
+				regs->iaoq[1] = regs->iaoq[0] + 4;
+				return 3;
+			}
+		}
+	} while (0);
+#endif
+
+#ifdef CONFIG_PAX_EMUTRAMP
+
+#ifndef CONFIG_PAX_EMUSIGRT
+	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
+		return 1;
+#endif
+
+	do { /* PaX: rt_sigreturn emulation */
+		unsigned int ldi1, ldi2, bel, nop;
+
+		err = get_user(ldi1, (unsigned int *)instruction_pointer(regs));
+		err |= get_user(ldi2, (unsigned int *)(instruction_pointer(regs)+4));
+		err |= get_user(bel, (unsigned int *)(instruction_pointer(regs)+8));
+		err |= get_user(nop, (unsigned int *)(instruction_pointer(regs)+12));
+
+		if (err)
+			break;
+
+		if ((ldi1 == 0x34190000U || ldi1 == 0x34190002U) &&
+		    ldi2 == 0x3414015AU &&
+		    bel == 0xE4008200U &&
+		    nop == 0x08000240U)
+		{
+			regs->gr[25] = (ldi1 & 2) >> 1;
+			regs->gr[20] = __NR_rt_sigreturn;
+			regs->gr[31] = regs->iaoq[1] + 16;
+			regs->sr[0] = regs->iasq[1];
+			regs->iaoq[0] = 0x100UL;
+			regs->iaoq[1] = regs->iaoq[0] + 4;
+			regs->iasq[0] = regs->sr[2];
+			regs->iasq[1] = regs->sr[2];
+			return 2;
+		}
+	} while (0);
+#endif
+
+	return 1;
+}
+
+void pax_report_insns(void *pc, void *sp)
+{
+	unsigned long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 5; i++) {
+		unsigned int c;
+		if (get_user(c, (unsigned int *)pc+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%08x ", c);
+	}
+	printk("\n");
+}
+#endif
+
 int fixup_exception(struct pt_regs *regs)
 {
 	const struct exception_table_entry *fix;
@@ -192,8 +303,33 @@
 
 	acc_type = parisc_acctyp(code,regs->iir);
 
-	if ((vma->vm_flags & acc_type) != acc_type)
+	if ((vma->vm_flags & acc_type) != acc_type) {
+
+#ifdef CONFIG_PAX_PAGEEXEC
+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && (acc_type & VM_EXEC) &&
+		    (address & ~3UL) == instruction_pointer(regs))
+		{
+			up_read(&mm->mmap_sem);
+			switch (pax_handle_fetch_fault(regs)) {
+
+#ifdef CONFIG_PAX_EMUPLT
+			case 3:
+				return;
+#endif
+
+#ifdef CONFIG_PAX_EMUTRAMP
+			case 2:
+				return;
+#endif
+
+			}
+			pax_report_fault(regs, (void *)instruction_pointer(regs), (void *)regs->gr[30]);
+			do_group_exit(SIGKILL);
+		}
+#endif
+
 		goto bad_area;
+	}
 
 	/*
 	 * If for any reason at all we couldn't handle the fault, make
@@ -237,8 +373,9 @@
 
 #ifdef PRINT_USER_FAULTS
 		printk(KERN_DEBUG "\n");
-		printk(KERN_DEBUG "do_page_fault() pid=%d command='%s' type=%lu address=0x%08lx\n",
-		    task_pid_nr(tsk), tsk->comm, code, address);
+		printk(KERN_DEBUG "do_page_fault() pid=%d:#%u "
+		    "command='%s' type=%lu address=0x%08lx\n",
+		    task_pid_nr(tsk), tsk->xid, tsk->comm, code, address);
 		if (vma) {
 			printk(KERN_DEBUG "vm_start = 0x%08lx, vm_end = 0x%08lx\n",
 					vma->vm_start, vma->vm_end);
@@ -264,7 +401,8 @@
 
   out_of_memory:
 	up_read(&mm->mmap_sem);
-	printk(KERN_CRIT "VM: killing process %s\n", current->comm);
+	printk(KERN_CRIT "VM: killing process %s(%d:#%u)\n",
+		current->comm, current->pid, current->xid);
 	if (user_mode(regs))
 		do_group_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/device.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/device.h
--- linux-2.6.32.43/arch/powerpc/include/asm/device.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/device.h	2011-07-15 05:51:11.000000000 -0500
@@ -14,7 +14,7 @@
 	struct device_node	*of_node;
 
 	/* DMA operations on that device */
-	struct dma_map_ops	*dma_ops;
+	const struct dma_map_ops	*dma_ops;
 
 	/*
 	 * When an iommu is in use, dma_data is used as a ptr to the base of the
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/dma-mapping.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/dma-mapping.h
--- linux-2.6.32.43/arch/powerpc/include/asm/dma-mapping.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/dma-mapping.h	2011-07-15 05:51:11.000000000 -0500
@@ -69,9 +69,9 @@
 #ifdef CONFIG_PPC64
 extern struct dma_map_ops dma_iommu_ops;
 #endif
-extern struct dma_map_ops dma_direct_ops;
+extern const struct dma_map_ops dma_direct_ops;
 
-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
 {
 	/* We don't handle the NULL dev case for ISA for now. We could
 	 * do it via an out of line call but it is not needed for now. The
@@ -84,7 +84,7 @@
 	return dev->archdata.dma_ops;
 }
 
-static inline void set_dma_ops(struct device *dev, struct dma_map_ops *ops)
+static inline void set_dma_ops(struct device *dev, const struct dma_map_ops *ops)
 {
 	dev->archdata.dma_ops = ops;
 }
@@ -118,7 +118,7 @@
 
 static inline int dma_supported(struct device *dev, u64 mask)
 {
-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
 
 	if (unlikely(dma_ops == NULL))
 		return 0;
@@ -132,7 +132,7 @@
 
 static inline int dma_set_mask(struct device *dev, u64 dma_mask)
 {
-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
 
 	if (unlikely(dma_ops == NULL))
 		return -EIO;
@@ -147,7 +147,7 @@
 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
 				       dma_addr_t *dma_handle, gfp_t flag)
 {
-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
 	void *cpu_addr;
 
 	BUG_ON(!dma_ops);
@@ -162,7 +162,7 @@
 static inline void dma_free_coherent(struct device *dev, size_t size,
 				     void *cpu_addr, dma_addr_t dma_handle)
 {
-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
 
 	BUG_ON(!dma_ops);
 
@@ -173,7 +173,7 @@
 
 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 {
-	struct dma_map_ops *dma_ops = get_dma_ops(dev);
+	const struct dma_map_ops *dma_ops = get_dma_ops(dev);
 
 	if (dma_ops->mapping_error)
 		return dma_ops->mapping_error(dev, dma_addr);
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/elf.h
--- linux-2.6.32.43/arch/powerpc/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -179,8 +179,19 @@
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
-extern unsigned long randomize_et_dyn(unsigned long base);
-#define ELF_ET_DYN_BASE		(randomize_et_dyn(0x20000000))
+#define ELF_ET_DYN_BASE		(0x20000000)
+
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(0x10000000UL)
+
+#ifdef __powerpc64__
+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 16 : 28)
+#else
+#define PAX_DELTA_MMAP_LEN	15
+#define PAX_DELTA_STACK_LEN	15
+#endif
+#endif
 
 /*
  * Our registers are always unsigned longs, whether we're a 32 bit
@@ -275,9 +286,6 @@
 	(0x7ff >> (PAGE_SHIFT - 12)) : \
 	(0x3ffff >> (PAGE_SHIFT - 12)))
 
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
 #endif /* __KERNEL__ */
 
 /*
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/iommu.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/iommu.h
--- linux-2.6.32.43/arch/powerpc/include/asm/iommu.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/iommu.h	2011-07-15 05:51:11.000000000 -0500
@@ -116,6 +116,9 @@
 extern void iommu_init_early_dart(void);
 extern void iommu_init_early_pasemi(void);
 
+/* dma-iommu.c */
+extern int dma_iommu_dma_supported(struct device *dev, u64 mask);
+
 #ifdef CONFIG_PCI
 extern void pci_iommu_init(void);
 extern void pci_direct_iommu_init(void);
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/kmap_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/kmap_types.h
--- linux-2.6.32.43/arch/powerpc/include/asm/kmap_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/kmap_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -26,6 +26,7 @@
 	KM_SOFTIRQ1,
 	KM_PPC_SYNC_PAGE,
 	KM_PPC_SYNC_ICACHE,
+	KM_CLEARPAGE,
 	KM_TYPE_NR
 };
 
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/page_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/page_64.h
--- linux-2.6.32.43/arch/powerpc/include/asm/page_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/page_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -180,15 +180,18 @@
  * stack by default, so in the absense of a PT_GNU_STACK program header
  * we turn execute permission off.
  */
-#define VM_STACK_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
-					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+#define VM_STACK_DEFAULT_FLAGS32 \
+	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
+	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
 #define VM_STACK_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
 					 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
+#ifndef CONFIG_PAX_PAGEEXEC
 #define VM_STACK_DEFAULT_FLAGS \
 	(test_thread_flag(TIF_32BIT) ? \
 	 VM_STACK_DEFAULT_FLAGS32 : VM_STACK_DEFAULT_FLAGS64)
+#endif
 
 #include <asm-generic/getorder.h>
 
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/page.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/page.h
--- linux-2.6.32.43/arch/powerpc/include/asm/page.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/page.h	2011-07-15 05:51:11.000000000 -0500
@@ -116,8 +116,9 @@
  * and needs to be executable.  This means the whole heap ends
  * up being executable.
  */
-#define VM_DATA_DEFAULT_FLAGS32	(VM_READ | VM_WRITE | VM_EXEC | \
-				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
+#define VM_DATA_DEFAULT_FLAGS32 \
+	(((current->personality & READ_IMPLIES_EXEC) ? VM_EXEC : 0) | \
+	 VM_READ | VM_WRITE | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
 
 #define VM_DATA_DEFAULT_FLAGS64	(VM_READ | VM_WRITE | \
 				 VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC)
@@ -145,6 +146,9 @@
 #define is_kernel_addr(x)	((x) >= PAGE_OFFSET)
 #endif
 
+#define ktla_ktva(addr)		(addr)
+#define ktva_ktla(addr)		(addr)
+
 #ifndef __ASSEMBLY__
 
 #undef STRICT_MM_TYPECHECKS
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/pci.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/pci.h
--- linux-2.6.32.43/arch/powerpc/include/asm/pci.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/pci.h	2011-07-15 05:51:11.000000000 -0500
@@ -65,8 +65,8 @@
 }
 
 #ifdef CONFIG_PCI
-extern void set_pci_dma_ops(struct dma_map_ops *dma_ops);
-extern struct dma_map_ops *get_pci_dma_ops(void);
+extern void set_pci_dma_ops(const struct dma_map_ops *dma_ops);
+extern const struct dma_map_ops *get_pci_dma_ops(void);
 #else	/* CONFIG_PCI */
 #define set_pci_dma_ops(d)
 #define get_pci_dma_ops()	NULL
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/pgtable.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/pgtable.h
--- linux-2.6.32.43/arch/powerpc/include/asm/pgtable.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/pgtable.h	2011-07-15 05:51:11.000000000 -0500
@@ -2,6 +2,7 @@
 #define _ASM_POWERPC_PGTABLE_H
 #ifdef __KERNEL__
 
+#include <linux/const.h>
 #ifndef __ASSEMBLY__
 #include <asm/processor.h>		/* For TASK_SIZE */
 #include <asm/mmu.h>
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/pte-hash32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/pte-hash32.h
--- linux-2.6.32.43/arch/powerpc/include/asm/pte-hash32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/pte-hash32.h	2011-07-15 05:51:11.000000000 -0500
@@ -21,6 +21,7 @@
 #define _PAGE_FILE	0x004	/* when !present: nonlinear file mapping */
 #define _PAGE_USER	0x004	/* usermode access allowed */
 #define _PAGE_GUARDED	0x008	/* G: prohibit speculative access */
+#define _PAGE_EXEC	_PAGE_GUARDED
 #define _PAGE_COHERENT	0x010	/* M: enforce memory coherence (SMP systems) */
 #define _PAGE_NO_CACHE	0x020	/* I: cache inhibit */
 #define _PAGE_WRITETHRU	0x040	/* W: cache write-through */
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/reg.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/reg.h
--- linux-2.6.32.43/arch/powerpc/include/asm/reg.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/reg.h	2011-07-15 05:51:11.000000000 -0500
@@ -191,6 +191,7 @@
 #define SPRN_DBCR	0x136	/* e300 Data Breakpoint Control Reg */
 #define SPRN_DSISR	0x012	/* Data Storage Interrupt Status Register */
 #define   DSISR_NOHPTE		0x40000000	/* no translation found */
+#define   DSISR_GUARDED		0x10000000	/* fetch from guarded storage */
 #define   DSISR_PROTFAULT	0x08000000	/* protection fault */
 #define   DSISR_ISSTORE		0x02000000	/* access was a store */
 #define   DSISR_DABRMATCH	0x00400000	/* hit data breakpoint */
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/swiotlb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/swiotlb.h
--- linux-2.6.32.43/arch/powerpc/include/asm/swiotlb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/swiotlb.h	2011-07-15 05:51:11.000000000 -0500
@@ -13,7 +13,7 @@
 
 #include <linux/swiotlb.h>
 
-extern struct dma_map_ops swiotlb_dma_ops;
+extern const struct dma_map_ops swiotlb_dma_ops;
 
 static inline void dma_mark_clean(void *addr, size_t size) {}
 
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/system.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/system.h
--- linux-2.6.32.43/arch/powerpc/include/asm/system.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/system.h	2011-07-15 05:51:11.000000000 -0500
@@ -531,7 +531,7 @@
 #define cmpxchg64_local(ptr, o, n) __cmpxchg64_local_generic((ptr), (o), (n))
 #endif
 
-extern unsigned long arch_align_stack(unsigned long sp);
+#define arch_align_stack(x) ((x) & ~0xfUL)
 
 /* Used in very early kernel initialization. */
 extern unsigned long reloc_offset(void);
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/uaccess.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/uaccess.h
--- linux-2.6.32.43/arch/powerpc/include/asm/uaccess.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/uaccess.h	2011-07-15 05:51:11.000000000 -0500
@@ -13,6 +13,8 @@
 #define VERIFY_READ	0
 #define VERIFY_WRITE	1
 
+extern void check_object_size(const void *ptr, unsigned long n, bool to);
+
 /*
  * The fs value determines whether argument validity checking should be
  * performed or not.  If get_fs() == USER_DS, checking is performed, with
@@ -327,52 +329,6 @@
 extern unsigned long __copy_tofrom_user(void __user *to,
 		const void __user *from, unsigned long size);
 
-#ifndef __powerpc64__
-
-static inline unsigned long copy_from_user(void *to,
-		const void __user *from, unsigned long n)
-{
-	unsigned long over;
-
-	if (access_ok(VERIFY_READ, from, n))
-		return __copy_tofrom_user((__force void __user *)to, from, n);
-	if ((unsigned long)from < TASK_SIZE) {
-		over = (unsigned long)from + n - TASK_SIZE;
-		return __copy_tofrom_user((__force void __user *)to, from,
-				n - over) + over;
-	}
-	return n;
-}
-
-static inline unsigned long copy_to_user(void __user *to,
-		const void *from, unsigned long n)
-{
-	unsigned long over;
-
-	if (access_ok(VERIFY_WRITE, to, n))
-		return __copy_tofrom_user(to, (__force void __user *)from, n);
-	if ((unsigned long)to < TASK_SIZE) {
-		over = (unsigned long)to + n - TASK_SIZE;
-		return __copy_tofrom_user(to, (__force void __user *)from,
-				n - over) + over;
-	}
-	return n;
-}
-
-#else /* __powerpc64__ */
-
-#define __copy_in_user(to, from, size) \
-	__copy_tofrom_user((to), (from), (size))
-
-extern unsigned long copy_from_user(void *to, const void __user *from,
-				    unsigned long n);
-extern unsigned long copy_to_user(void __user *to, const void *from,
-				  unsigned long n);
-extern unsigned long copy_in_user(void __user *to, const void __user *from,
-				  unsigned long n);
-
-#endif /* __powerpc64__ */
-
 static inline unsigned long __copy_from_user_inatomic(void *to,
 		const void __user *from, unsigned long n)
 {
@@ -396,6 +352,10 @@
 		if (ret == 0)
 			return 0;
 	}
+
+	if (!__builtin_constant_p(n))
+		check_object_size(to, n, false);
+
 	return __copy_tofrom_user((__force void __user *)to, from, n);
 }
 
@@ -422,6 +382,10 @@
 		if (ret == 0)
 			return 0;
 	}
+
+	if (!__builtin_constant_p(n))
+		check_object_size(from, n, true);
+
 	return __copy_tofrom_user(to, (__force const void __user *)from, n);
 }
 
@@ -439,6 +403,92 @@
 	return __copy_to_user_inatomic(to, from, size);
 }
 
+#ifndef __powerpc64__
+
+static inline unsigned long __must_check copy_from_user(void *to,
+		const void __user *from, unsigned long n)
+{
+	unsigned long over;
+
+	if ((long)n < 0)
+		return n;
+
+	if (access_ok(VERIFY_READ, from, n)) {
+		if (!__builtin_constant_p(n))
+			check_object_size(to, n, false);
+		return __copy_tofrom_user((__force void __user *)to, from, n);
+	}
+	if ((unsigned long)from < TASK_SIZE) {
+		over = (unsigned long)from + n - TASK_SIZE;
+		if (!__builtin_constant_p(n - over))
+			check_object_size(to, n - over, false);
+		return __copy_tofrom_user((__force void __user *)to, from,
+				n - over) + over;
+	}
+	return n;
+}
+
+static inline unsigned long __must_check copy_to_user(void __user *to,
+		const void *from, unsigned long n)
+{
+	unsigned long over;
+
+	if ((long)n < 0)
+		return n;
+
+	if (access_ok(VERIFY_WRITE, to, n)) {
+		if (!__builtin_constant_p(n))
+			check_object_size(from, n, true);
+		return __copy_tofrom_user(to, (__force void __user *)from, n);
+	}
+	if ((unsigned long)to < TASK_SIZE) {
+		over = (unsigned long)to + n - TASK_SIZE;
+		if (!__builtin_constant_p(n))
+			check_object_size(from, n - over, true);
+		return __copy_tofrom_user(to, (__force void __user *)from,
+				n - over) + over;
+	}
+	return n;
+}
+
+#else /* __powerpc64__ */
+
+#define __copy_in_user(to, from, size) \
+	__copy_tofrom_user((to), (from), (size))
+
+static inline unsigned long __must_check copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+	if ((long)n < 0 || n > INT_MAX)
+		return n;
+
+	if (!__builtin_constant_p(n))
+		check_object_size(to, n, false);
+
+	if (likely(access_ok(VERIFY_READ, from, n)))
+		n = __copy_from_user(to, from, n);
+	else
+		memset(to, 0, n);
+	return n;
+}
+
+static inline unsigned long __must_check copy_to_user(void __user *to, const void *from, unsigned long n)
+{
+	if ((long)n < 0 || n > INT_MAX)
+		return n;
+
+	if (likely(access_ok(VERIFY_WRITE, to, n))) {
+		if (!__builtin_constant_p(n))
+			check_object_size(from, n, true);
+		n = __copy_to_user(to, from, n);
+	}
+	return n;
+}
+
+extern unsigned long copy_in_user(void __user *to, const void __user *from,
+				  unsigned long n);
+
+#endif /* __powerpc64__ */
+
 extern unsigned long __clear_user(void __user *addr, unsigned long size);
 
 static inline unsigned long clear_user(void __user *addr, unsigned long size)
diff -uriN linux-2.6.32.43/arch/powerpc/include/asm/unistd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/unistd.h
--- linux-2.6.32.43/arch/powerpc/include/asm/unistd.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/include/asm/unistd.h	2011-07-15 05:50:11.000000000 -0500
@@ -275,7 +275,7 @@
 #endif
 #define __NR_rtas		255
 #define __NR_sys_debug_setcontext 256
-/* Number 257 is reserved for vserver */
+#define __NR_vserver		257
 #define __NR_migrate_pages	258
 #define __NR_mbind		259
 #define __NR_get_mempolicy	260
diff -uriN linux-2.6.32.43/arch/powerpc/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/Kconfig
--- linux-2.6.32.43/arch/powerpc/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -943,6 +943,8 @@
 
 source "arch/powerpc/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 config KEYS_COMPAT
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/cacheinfo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/cacheinfo.c
--- linux-2.6.32.43/arch/powerpc/kernel/cacheinfo.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/cacheinfo.c	2011-07-15 05:51:11.000000000 -0500
@@ -642,7 +642,7 @@
 	&cache_assoc_attr,
 };
 
-static struct sysfs_ops cache_index_ops = {
+static const struct sysfs_ops cache_index_ops = {
 	.show = cache_index_show,
 };
 
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/dma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/dma.c
--- linux-2.6.32.43/arch/powerpc/kernel/dma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/dma.c	2011-07-15 05:51:11.000000000 -0500
@@ -134,7 +134,7 @@
 }
 #endif
 
-struct dma_map_ops dma_direct_ops = {
+const struct dma_map_ops dma_direct_ops = {
 	.alloc_coherent	= dma_direct_alloc_coherent,
 	.free_coherent	= dma_direct_free_coherent,
 	.map_sg		= dma_direct_map_sg,
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/dma-iommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/dma-iommu.c
--- linux-2.6.32.43/arch/powerpc/kernel/dma-iommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/dma-iommu.c	2011-07-15 05:51:11.000000000 -0500
@@ -70,7 +70,7 @@
 }
 
 /* We support DMA to/from any memory page via the iommu */
-static int dma_iommu_dma_supported(struct device *dev, u64 mask)
+int dma_iommu_dma_supported(struct device *dev, u64 mask)
 {
 	struct iommu_table *tbl = get_iommu_table_base(dev);
 
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/dma-swiotlb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/dma-swiotlb.c
--- linux-2.6.32.43/arch/powerpc/kernel/dma-swiotlb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/dma-swiotlb.c	2011-07-15 05:51:11.000000000 -0500
@@ -31,7 +31,7 @@
  * map_page, and unmap_page on highmem, use normal dma_ops
  * for everything else.
  */
-struct dma_map_ops swiotlb_dma_ops = {
+const struct dma_map_ops swiotlb_dma_ops = {
 	.alloc_coherent = dma_direct_alloc_coherent,
 	.free_coherent = dma_direct_free_coherent,
 	.map_sg = swiotlb_map_sg_attrs,
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/exceptions-64e.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/exceptions-64e.S
--- linux-2.6.32.43/arch/powerpc/kernel/exceptions-64e.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/exceptions-64e.S	2011-07-15 05:51:11.000000000 -0500
@@ -455,6 +455,7 @@
 	std	r14,_DAR(r1)
 	std	r15,_DSISR(r1)
 	addi	r3,r1,STACK_FRAME_OVERHEAD
+	bl	.save_nvgprs
 	mr	r4,r14
 	mr	r5,r15
 	ld	r14,PACA_EXGEN+EX_R14(r13)
@@ -464,8 +465,7 @@
 	cmpdi	r3,0
 	bne-	1f
 	b	.ret_from_except_lite
-1:	bl	.save_nvgprs
-	mr	r5,r3
+1:	mr	r5,r3
 	addi	r3,r1,STACK_FRAME_OVERHEAD
 	ld	r4,_DAR(r1)
 	bl	.bad_page_fault
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/exceptions-64s.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/exceptions-64s.S
--- linux-2.6.32.43/arch/powerpc/kernel/exceptions-64s.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/exceptions-64s.S	2011-07-15 05:51:11.000000000 -0500
@@ -818,10 +818,10 @@
 11:	ld	r4,_DAR(r1)
 	ld	r5,_DSISR(r1)
 	addi	r3,r1,STACK_FRAME_OVERHEAD
+	bl	.save_nvgprs
 	bl	.do_page_fault
 	cmpdi	r3,0
 	beq+	13f
-	bl	.save_nvgprs
 	mr	r5,r3
 	addi	r3,r1,STACK_FRAME_OVERHEAD
 	lwz	r4,_DAR(r1)
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/ibmebus.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/ibmebus.c
--- linux-2.6.32.43/arch/powerpc/kernel/ibmebus.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/ibmebus.c	2011-07-15 05:51:11.000000000 -0500
@@ -127,7 +127,7 @@
 	return 1;
 }
 
-static struct dma_map_ops ibmebus_dma_ops = {
+static const struct dma_map_ops ibmebus_dma_ops = {
 	.alloc_coherent = ibmebus_alloc_coherent,
 	.free_coherent  = ibmebus_free_coherent,
 	.map_sg         = ibmebus_map_sg,
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/kgdb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/kgdb.c
--- linux-2.6.32.43/arch/powerpc/kernel/kgdb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/kgdb.c	2011-07-15 05:51:11.000000000 -0500
@@ -126,7 +126,7 @@
 	if (kgdb_handle_exception(0, SIGTRAP, 0, regs) != 0)
 		return 0;
 
-	if (*(u32 *) (regs->nip) == *(u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
+	if (*(u32 *) (regs->nip) == *(const u32 *) (&arch_kgdb_ops.gdb_bpt_instr))
 		regs->nip += 4;
 
 	return 1;
@@ -353,7 +353,7 @@
 /*
  * Global data
  */
-struct kgdb_arch arch_kgdb_ops = {
+const struct kgdb_arch arch_kgdb_ops = {
 	.gdb_bpt_instr = {0x7d, 0x82, 0x10, 0x08},
 };
 
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/module_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/module_32.c
--- linux-2.6.32.43/arch/powerpc/kernel/module_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/module_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -162,7 +162,7 @@
 			me->arch.core_plt_section = i;
 	}
 	if (!me->arch.core_plt_section || !me->arch.init_plt_section) {
-		printk("Module doesn't contain .plt or .init.plt sections.\n");
+		printk("Module %s doesn't contain .plt or .init.plt sections.\n", me->name);
 		return -ENOEXEC;
 	}
 
@@ -203,11 +203,16 @@
 
 	DEBUGP("Doing plt for call to 0x%x at 0x%x\n", val, (unsigned int)location);
 	/* Init, or core PLT? */
-	if (location >= mod->module_core
-	    && location < mod->module_core + mod->core_size)
+	if ((location >= mod->module_core_rx && location < mod->module_core_rx + mod->core_size_rx) ||
+	    (location >= mod->module_core_rw && location < mod->module_core_rw + mod->core_size_rw))
 		entry = (void *)sechdrs[mod->arch.core_plt_section].sh_addr;
-	else
+	else if ((location >= mod->module_init_rx && location < mod->module_init_rx + mod->init_size_rx) ||
+		 (location >= mod->module_init_rw && location < mod->module_init_rw + mod->init_size_rw))
 		entry = (void *)sechdrs[mod->arch.init_plt_section].sh_addr;
+	else {
+		printk(KERN_ERR "%s: invalid R_PPC_REL24 entry found\n", mod->name);
+		return ~0UL;
+	}
 
 	/* Find this entry, or if that fails, the next avail. entry */
 	while (entry->jump[0]) {
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/module.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/module.c
--- linux-2.6.32.43/arch/powerpc/kernel/module.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/module.c	2011-07-15 05:51:11.000000000 -0500
@@ -31,11 +31,24 @@
 
 LIST_HEAD(module_bug_list);
 
+#ifdef CONFIG_PAX_KERNEXEC
 void *module_alloc(unsigned long size)
 {
 	if (size == 0)
 		return NULL;
 
+	return vmalloc(size);
+}
+
+void *module_alloc_exec(unsigned long size)
+#else
+void *module_alloc(unsigned long size)
+#endif
+
+{
+	if (size == 0)
+		return NULL;
+
 	return vmalloc_exec(size);
 }
 
@@ -45,6 +58,13 @@
 	vfree(module_region);
 }
 
+#ifdef CONFIG_PAX_KERNEXEC
+void module_free_exec(struct module *mod, void *module_region)
+{
+	module_free(mod, module_region);
+}
+#endif
+
 static const Elf_Shdr *find_section(const Elf_Ehdr *hdr,
 				    const Elf_Shdr *sechdrs,
 				    const char *name)
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/pci-common.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/pci-common.c
--- linux-2.6.32.43/arch/powerpc/kernel/pci-common.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/pci-common.c	2011-07-15 05:51:11.000000000 -0500
@@ -50,14 +50,14 @@
 unsigned int ppc_pci_flags = 0;
 
 
-static struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
+static const struct dma_map_ops *pci_dma_ops = &dma_direct_ops;
 
-void set_pci_dma_ops(struct dma_map_ops *dma_ops)
+void set_pci_dma_ops(const struct dma_map_ops *dma_ops)
 {
 	pci_dma_ops = dma_ops;
 }
 
-struct dma_map_ops *get_pci_dma_ops(void)
+const struct dma_map_ops *get_pci_dma_ops(void)
 {
 	return pci_dma_ops;
 }
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/process.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/process.c
--- linux-2.6.32.43/arch/powerpc/kernel/process.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/process.c	2011-07-15 05:51:11.000000000 -0500
@@ -519,8 +519,9 @@
 #else
 		printk("DAR: "REG", DSISR: "REG"\n", regs->dar, regs->dsisr);
 #endif
-	printk("TASK = %p[%d] '%s' THREAD: %p",
-	       current, task_pid_nr(current), current->comm, task_thread_info(current));
+	printk("TASK = %p[%d,#%u] '%s' THREAD: %p",
+	       current, task_pid_nr(current), current->xid,
+	       current->comm, task_thread_info(current));
 
 #ifdef CONFIG_SMP
 	printk(" CPU: %d", raw_smp_processor_id());
@@ -539,8 +540,8 @@
 	 * Lookup NIP late so we have the best change of getting the
 	 * above info out without failing
 	 */
-	printk("NIP ["REG"] %pS\n", regs->nip, (void *)regs->nip);
-	printk("LR ["REG"] %pS\n", regs->link, (void *)regs->link);
+	printk("NIP ["REG"] %pA\n", regs->nip, (void *)regs->nip);
+	printk("LR ["REG"] %pA\n", regs->link, (void *)regs->link);
 #endif
 	show_stack(current, (unsigned long *) regs->gpr[1]);
 	if (!user_mode(regs))
@@ -1034,10 +1035,10 @@
 		newsp = stack[0];
 		ip = stack[STACK_FRAME_LR_SAVE];
 		if (!firstframe || ip != lr) {
-			printk("["REG"] ["REG"] %pS", sp, ip, (void *)ip);
+			printk("["REG"] ["REG"] %pA", sp, ip, (void *)ip);
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 			if ((ip == rth || ip == mrth) && curr_frame >= 0) {
-				printk(" (%pS)",
+				printk(" (%pA)",
 				       (void *)current->ret_stack[curr_frame].ret);
 				curr_frame--;
 			}
@@ -1057,7 +1058,7 @@
 			struct pt_regs *regs = (struct pt_regs *)
 				(sp + STACK_FRAME_OVERHEAD);
 			lr = regs->link;
-			printk("--- Exception: %lx at %pS\n    LR = %pS\n",
+			printk("--- Exception: %lx at %pA\n    LR = %pA\n",
 			       regs->trap, (void *)regs->nip, (void *)lr);
 			firstframe = 1;
 		}
@@ -1134,58 +1135,3 @@
 }
 
 #endif /* THREAD_SHIFT < PAGE_SHIFT */
-
-unsigned long arch_align_stack(unsigned long sp)
-{
-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-		sp -= get_random_int() & ~PAGE_MASK;
-	return sp & ~0xf;
-}
-
-static inline unsigned long brk_rnd(void)
-{
-        unsigned long rnd = 0;
-
-	/* 8MB for 32bit, 1GB for 64bit */
-	if (is_32bit_task())
-		rnd = (long)(get_random_int() % (1<<(23-PAGE_SHIFT)));
-	else
-		rnd = (long)(get_random_int() % (1<<(30-PAGE_SHIFT)));
-
-	return rnd << PAGE_SHIFT;
-}
-
-unsigned long arch_randomize_brk(struct mm_struct *mm)
-{
-	unsigned long base = mm->brk;
-	unsigned long ret;
-
-#ifdef CONFIG_PPC_STD_MMU_64
-	/*
-	 * If we are using 1TB segments and we are allowed to randomise
-	 * the heap, we can put it above 1TB so it is backed by a 1TB
-	 * segment. Otherwise the heap will be in the bottom 1TB
-	 * which always uses 256MB segments and this may result in a
-	 * performance penalty.
-	 */
-	if (!is_32bit_task() && (mmu_highuser_ssize == MMU_SEGSIZE_1T))
-		base = max_t(unsigned long, mm->brk, 1UL << SID_SHIFT_1T);
-#endif
-
-	ret = PAGE_ALIGN(base + brk_rnd());
-
-	if (ret < mm->brk)
-		return mm->brk;
-
-	return ret;
-}
-
-unsigned long randomize_et_dyn(unsigned long base)
-{
-	unsigned long ret = PAGE_ALIGN(base + brk_rnd());
-
-	if (ret < base)
-		return base;
-
-	return ret;
-}
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/signal_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/signal_32.c
--- linux-2.6.32.43/arch/powerpc/kernel/signal_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/signal_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -857,7 +857,7 @@
 	/* Save user registers on the stack */
 	frame = &rt_sf->uc.uc_mcontext;
 	addr = frame;
-	if (vdso32_rt_sigtramp && current->mm->context.vdso_base) {
+	if (vdso32_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
 		if (save_user_regs(regs, frame, 0, 1))
 			goto badframe;
 		regs->link = current->mm->context.vdso_base + vdso32_rt_sigtramp;
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/signal_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/signal_64.c
--- linux-2.6.32.43/arch/powerpc/kernel/signal_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/signal_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -429,7 +429,7 @@
 	current->thread.fpscr.val = 0;
 
 	/* Set up to return from userspace. */
-	if (vdso64_rt_sigtramp && current->mm->context.vdso_base) {
+	if (vdso64_rt_sigtramp && current->mm->context.vdso_base != ~0UL) {
 		regs->link = current->mm->context.vdso_base + vdso64_rt_sigtramp;
 	} else {
 		err |= setup_trampoline(__NR_rt_sigreturn, &frame->tramp[0]);
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/sys_ppc32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/sys_ppc32.c
--- linux-2.6.32.43/arch/powerpc/kernel/sys_ppc32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/sys_ppc32.c	2011-07-15 05:51:11.000000000 -0500
@@ -563,10 +563,10 @@
 	if (oldlenp) {
 		if (!error) {
 			if (get_user(oldlen, oldlenp) ||
-			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)))
+			    put_user(oldlen, (compat_size_t __user *)compat_ptr(tmp.oldlenp)) ||
+			    copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused)))
 				error = -EFAULT;
 		}
-		copy_to_user(args->__unused, tmp.__unused, sizeof(tmp.__unused));
 	}
 	return error;
 }
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/traps.c
--- linux-2.6.32.43/arch/powerpc/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/traps.c	2011-07-15 05:51:11.000000000 -0500
@@ -99,6 +99,8 @@
 static inline void pmac_backlight_unblank(void) { }
 #endif
 
+extern void gr_handle_kernel_exploit(void);
+
 int die(const char *str, struct pt_regs *regs, long err)
 {
 	static struct {
@@ -168,6 +170,8 @@
 	if (panic_on_oops)
 		panic("Fatal exception");
 
+	gr_handle_kernel_exploit();
+
 	oops_exit();
 	do_exit(err);
 
@@ -931,8 +935,9 @@
 
 void trace_syscall(struct pt_regs *regs)
 {
-	printk("Task: %p(%d), PC: %08lX/%08lX, Syscall: %3ld, Result: %s%ld    %s\n",
-	       current, task_pid_nr(current), regs->nip, regs->link, regs->gpr[0],
+	printk("Task: %p(%d[#%u]), PC: %08lX/%08lX, Syscall: %3ld, Result: %s%ld    %s\n",
+	       current, task_pid_nr(current), current->xid,
+	       regs->nip, regs->link, regs->gpr[0],
 	       regs->ccr&0x10000000?"Error=":"", regs->gpr[3], print_tainted());
 }
 
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/vdso.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/vdso.c
--- linux-2.6.32.43/arch/powerpc/kernel/vdso.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/vdso.c	2011-07-15 05:51:11.000000000 -0500
@@ -23,6 +23,7 @@
 #include <linux/security.h>
 #include <linux/bootmem.h>
 #include <linux/lmb.h>
+#include <linux/vs_memory.h>
 
 #include <asm/pgtable.h>
 #include <asm/system.h>
@@ -36,6 +37,7 @@
 #include <asm/firmware.h>
 #include <asm/vdso.h>
 #include <asm/vdso_datapage.h>
+#include <asm/mman.h>
 
 #include "setup.h"
 
@@ -220,7 +222,7 @@
 	vdso_base = VDSO32_MBASE;
 #endif
 
-	current->mm->context.vdso_base = 0;
+	current->mm->context.vdso_base = ~0UL;
 
 	/* vDSO has a problem and was disabled, just don't "enable" it for the
 	 * process
@@ -240,7 +242,7 @@
 	vdso_base = get_unmapped_area(NULL, vdso_base,
 				      (vdso_pages << PAGE_SHIFT) +
 				      ((VDSO_ALIGNMENT - 1) & PAGE_MASK),
-				      0, 0);
+				      0, MAP_PRIVATE | MAP_EXECUTABLE);
 	if (IS_ERR_VALUE(vdso_base)) {
 		rc = vdso_base;
 		goto fail_mmapsem;
diff -uriN linux-2.6.32.43/arch/powerpc/kernel/vio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/vio.c
--- linux-2.6.32.43/arch/powerpc/kernel/vio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/kernel/vio.c	2011-07-15 05:51:11.000000000 -0500
@@ -601,11 +601,12 @@
 	vio_cmo_dealloc(viodev, alloc_size);
 }
 
-struct dma_map_ops vio_dma_mapping_ops = {
+static const struct dma_map_ops vio_dma_mapping_ops = {
 	.alloc_coherent = vio_dma_iommu_alloc_coherent,
 	.free_coherent  = vio_dma_iommu_free_coherent,
 	.map_sg         = vio_dma_iommu_map_sg,
 	.unmap_sg       = vio_dma_iommu_unmap_sg,
+	.dma_supported  = dma_iommu_dma_supported,
 	.map_page       = vio_dma_iommu_map_page,
 	.unmap_page     = vio_dma_iommu_unmap_page,
 
@@ -857,7 +858,6 @@
 
 static void vio_cmo_set_dma_ops(struct vio_dev *viodev)
 {
-	vio_dma_mapping_ops.dma_supported = dma_iommu_ops.dma_supported;
 	viodev->dev.archdata.dma_ops = &vio_dma_mapping_ops;
 }
 
diff -uriN linux-2.6.32.43/arch/powerpc/lib/usercopy_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/lib/usercopy_64.c
--- linux-2.6.32.43/arch/powerpc/lib/usercopy_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/lib/usercopy_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -9,22 +9,6 @@
 #include <linux/module.h>
 #include <asm/uaccess.h>
 
-unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
-{
-	if (likely(access_ok(VERIFY_READ, from, n)))
-		n = __copy_from_user(to, from, n);
-	else
-		memset(to, 0, n);
-	return n;
-}
-
-unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
-{
-	if (likely(access_ok(VERIFY_WRITE, to, n)))
-		n = __copy_to_user(to, from, n);
-	return n;
-}
-
 unsigned long copy_in_user(void __user *to, const void __user *from,
 			   unsigned long n)
 {
@@ -35,7 +19,5 @@
 	return n;
 }
 
-EXPORT_SYMBOL(copy_from_user);
-EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(copy_in_user);
 
diff -uriN linux-2.6.32.43/arch/powerpc/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/mm/fault.c
--- linux-2.6.32.43/arch/powerpc/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/mm/fault.c	2011-07-15 05:51:11.000000000 -0500
@@ -30,6 +30,10 @@
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
 #include <linux/perf_event.h>
+#include <linux/slab.h>
+#include <linux/pagemap.h>
+#include <linux/compiler.h>
+#include <linux/unistd.h>
 
 #include <asm/firmware.h>
 #include <asm/page.h>
@@ -40,6 +44,7 @@
 #include <asm/uaccess.h>
 #include <asm/tlbflush.h>
 #include <asm/siginfo.h>
+#include <asm/ptrace.h>
 
 
 #ifdef CONFIG_KPROBES
@@ -64,6 +69,33 @@
 }
 #endif
 
+#ifdef CONFIG_PAX_PAGEEXEC
+/*
+ * PaX: decide what to do with offenders (regs->nip = fault address)
+ *
+ * returns 1 when task should be killed
+ */
+static int pax_handle_fetch_fault(struct pt_regs *regs)
+{
+	return 1;
+}
+
+void pax_report_insns(void *pc, void *sp)
+{
+	unsigned long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 5; i++) {
+		unsigned int c;
+		if (get_user(c, (unsigned int __user *)pc+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%08x ", c);
+	}
+	printk("\n");
+}
+#endif
+
 /*
  * Check whether the instruction at regs->nip is a store using
  * an update addressing form which will update r1.
@@ -134,7 +166,7 @@
 	 * indicate errors in DSISR but can validly be set in SRR1.
 	 */
 	if (trap == 0x400)
-		error_code &= 0x48200000;
+		error_code &= 0x58200000;
 	else
 		is_write = error_code & DSISR_ISSTORE;
 #else
@@ -250,7 +282,7 @@
          * "undefined".  Of those that can be set, this is the only
          * one which seems bad.
          */
-	if (error_code & 0x10000000)
+	if (error_code & DSISR_GUARDED)
                 /* Guarded storage error. */
 		goto bad_area;
 #endif /* CONFIG_8xx */
@@ -265,7 +297,7 @@
 		 * processors use the same I/D cache coherency mechanism
 		 * as embedded.
 		 */
-		if (error_code & DSISR_PROTFAULT)
+		if (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))
 			goto bad_area;
 #endif /* CONFIG_PPC_STD_MMU */
 
@@ -335,6 +367,23 @@
 bad_area_nosemaphore:
 	/* User mode accesses cause a SIGSEGV */
 	if (user_mode(regs)) {
+
+#ifdef CONFIG_PAX_PAGEEXEC
+		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
+#ifdef CONFIG_PPC_STD_MMU
+			if (is_exec && (error_code & (DSISR_PROTFAULT | DSISR_GUARDED))) {
+#else
+			if (is_exec && regs->nip == address) {
+#endif
+				switch (pax_handle_fetch_fault(regs)) {
+				}
+
+				pax_report_fault(regs, (void *)regs->nip, (void *)regs->gpr[PT_R1]);
+				do_group_exit(SIGKILL);
+			}
+		}
+#endif
+
 		_exception(SIGSEGV, regs, code, address);
 		return 0;
 	}
@@ -358,7 +407,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk("VM: killing process %s\n", current->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		current->comm, current->pid, current->xid);
 	if (user_mode(regs))
 		do_group_exit(SIGKILL);
 	return SIGKILL;
diff -uriN linux-2.6.32.43/arch/powerpc/mm/mmap_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/mm/mmap_64.c
--- linux-2.6.32.43/arch/powerpc/mm/mmap_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/mm/mmap_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -99,10 +99,22 @@
 	 */
 	if (mmap_is_legacy()) {
 		mm->mmap_base = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base += mm->delta_mmap;
+#endif
+
 		mm->get_unmapped_area = arch_get_unmapped_area;
 		mm->unmap_area = arch_unmap_area;
 	} else {
 		mm->mmap_base = mmap_base();
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
+#endif
+
 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
 		mm->unmap_area = arch_unmap_area_topdown;
 	}
diff -uriN linux-2.6.32.43/arch/powerpc/mm/slice.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/mm/slice.c
--- linux-2.6.32.43/arch/powerpc/mm/slice.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/mm/slice.c	2011-07-15 05:51:11.000000000 -0500
@@ -98,7 +98,7 @@
 	if ((mm->task_size - len) < addr)
 		return 0;
 	vma = find_vma(mm, addr);
-	return (!vma || (addr + len) <= vma->vm_start);
+	return check_heap_stack_gap(vma, addr, len);
 }
 
 static int slice_low_has_vma(struct mm_struct *mm, unsigned long slice)
@@ -256,7 +256,7 @@
 				addr = _ALIGN_UP(addr + 1,  1ul << SLICE_HIGH_SHIFT);
 			continue;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (check_heap_stack_gap(vma, addr, len)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
@@ -313,10 +313,14 @@
 		}
 	}
 
-	addr = mm->mmap_base;
-	while (addr > len) {
+	if (mm->mmap_base < len)
+		addr = -ENOMEM;
+	else
+		addr = mm->mmap_base - len;
+
+	while (!IS_ERR_VALUE(addr)) {
 		/* Go down by chunk size */
-		addr = _ALIGN_DOWN(addr - len, 1ul << pshift);
+		addr = _ALIGN_DOWN(addr, 1ul << pshift);
 
 		/* Check for hit with different page size */
 		mask = slice_range_to_mask(addr, len);
@@ -336,7 +340,7 @@
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || (addr + len) <= vma->vm_start) {
+		if (check_heap_stack_gap(vma, addr, len)) {
 			/* remember the address as a hint for next time */
 			if (use_cache)
 				mm->free_area_cache = addr;
@@ -348,7 +352,7 @@
 		        mm->cached_hole_size = vma->vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start;
+		addr = skip_heap_stack_gap(vma, len);
 	}
 
 	/*
@@ -426,6 +430,11 @@
 	if (fixed && addr > (mm->task_size - len))
 		return -EINVAL;
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!fixed && (mm->pax_flags & MF_PAX_RANDMMAP))
+		addr = 0;
+#endif
+
 	/* If hint, make sure it matches our alignment restrictions */
 	if (!fixed && addr) {
 		addr = _ALIGN_UP(addr, 1ul << pshift);
diff -uriN linux-2.6.32.43/arch/powerpc/platforms/52xx/lite5200_pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/52xx/lite5200_pm.c
--- linux-2.6.32.43/arch/powerpc/platforms/52xx/lite5200_pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/52xx/lite5200_pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -235,7 +235,7 @@
 	lite5200_pm_target_state = PM_SUSPEND_ON;
 }
 
-static struct platform_suspend_ops lite5200_pm_ops = {
+static const struct platform_suspend_ops lite5200_pm_ops = {
 	.valid		= lite5200_pm_valid,
 	.begin		= lite5200_pm_begin,
 	.prepare	= lite5200_pm_prepare,
diff -uriN linux-2.6.32.43/arch/powerpc/platforms/52xx/mpc52xx_pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/52xx/mpc52xx_pm.c
--- linux-2.6.32.43/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/52xx/mpc52xx_pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -180,7 +180,7 @@
 	iounmap(mbar);
 }
 
-static struct platform_suspend_ops mpc52xx_pm_ops = {
+static const struct platform_suspend_ops mpc52xx_pm_ops = {
 	.valid		= mpc52xx_pm_valid,
 	.prepare	= mpc52xx_pm_prepare,
 	.enter		= mpc52xx_pm_enter,
diff -uriN linux-2.6.32.43/arch/powerpc/platforms/83xx/suspend.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/83xx/suspend.c
--- linux-2.6.32.43/arch/powerpc/platforms/83xx/suspend.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/83xx/suspend.c	2011-07-15 05:51:11.000000000 -0500
@@ -273,7 +273,7 @@
 	return ret;
 }
 
-static struct platform_suspend_ops mpc83xx_suspend_ops = {
+static const struct platform_suspend_ops mpc83xx_suspend_ops = {
 	.valid = mpc83xx_suspend_valid,
 	.begin = mpc83xx_suspend_begin,
 	.enter = mpc83xx_suspend_enter,
diff -uriN linux-2.6.32.43/arch/powerpc/platforms/cell/iommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/cell/iommu.c
--- linux-2.6.32.43/arch/powerpc/platforms/cell/iommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/cell/iommu.c	2011-07-15 05:51:11.000000000 -0500
@@ -642,7 +642,7 @@
 
 static int dma_set_mask_and_switch(struct device *dev, u64 dma_mask);
 
-struct dma_map_ops dma_iommu_fixed_ops = {
+const struct dma_map_ops dma_iommu_fixed_ops = {
 	.alloc_coherent = dma_fixed_alloc_coherent,
 	.free_coherent  = dma_fixed_free_coherent,
 	.map_sg         = dma_fixed_map_sg,
diff -uriN linux-2.6.32.43/arch/powerpc/platforms/ps3/system-bus.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/ps3/system-bus.c
--- linux-2.6.32.43/arch/powerpc/platforms/ps3/system-bus.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/ps3/system-bus.c	2011-07-15 05:51:11.000000000 -0500
@@ -694,7 +694,7 @@
 	return mask >= DMA_BIT_MASK(32);
 }
 
-static struct dma_map_ops ps3_sb_dma_ops = {
+static const struct dma_map_ops ps3_sb_dma_ops = {
 	.alloc_coherent = ps3_alloc_coherent,
 	.free_coherent = ps3_free_coherent,
 	.map_sg = ps3_sb_map_sg,
@@ -704,7 +704,7 @@
 	.unmap_page = ps3_unmap_page,
 };
 
-static struct dma_map_ops ps3_ioc0_dma_ops = {
+static const struct dma_map_ops ps3_ioc0_dma_ops = {
 	.alloc_coherent = ps3_alloc_coherent,
 	.free_coherent = ps3_free_coherent,
 	.map_sg = ps3_ioc0_map_sg,
diff -uriN linux-2.6.32.43/arch/powerpc/platforms/pseries/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/pseries/Kconfig
--- linux-2.6.32.43/arch/powerpc/platforms/pseries/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/powerpc/platforms/pseries/Kconfig	2011-07-15 05:51:11.000000000 -0500
@@ -2,6 +2,8 @@
 	depends on PPC64 && PPC_BOOK3S
 	bool "IBM pSeries & new (POWER5-based) iSeries"
 	select MPIC
+	select PCI_MSI
+	select XICS
 	select PPC_I8259
 	select PPC_RTAS
 	select RTAS_ERROR_LOGGING
diff -uriN linux-2.6.32.43/arch/s390/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/elf.h
--- linux-2.6.32.43/arch/s390/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -164,6 +164,13 @@
    that it will "exec", and that there is sufficient room for the brk.  */
 #define ELF_ET_DYN_BASE		(STACK_TOP / 3 * 2)
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_31BIT) ? 0x10000UL : 0x80000000UL)
+
+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_31BIT) ? 15 : 26 )
+#endif
+
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports. */
 
diff -uriN linux-2.6.32.43/arch/s390/include/asm/setup.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/setup.h
--- linux-2.6.32.43/arch/s390/include/asm/setup.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/setup.h	2011-07-15 05:51:11.000000000 -0500
@@ -50,13 +50,13 @@
 void detect_memory_layout(struct mem_chunk chunk[]);
 
 #ifdef CONFIG_S390_SWITCH_AMODE
-extern unsigned int switch_amode;
+#define switch_amode	(1)
 #else
 #define switch_amode	(0)
 #endif
 
 #ifdef CONFIG_S390_EXEC_PROTECT
-extern unsigned int s390_noexec;
+#define s390_noexec	(1)
 #else
 #define s390_noexec	(0)
 #endif
diff -uriN linux-2.6.32.43/arch/s390/include/asm/tlb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/tlb.h
--- linux-2.6.32.43/arch/s390/include/asm/tlb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/tlb.h	2011-07-15 05:50:11.000000000 -0500
@@ -23,6 +23,8 @@
 
 #include <linux/mm.h>
 #include <linux/swap.h>
+#include <linux/vs_memory.h>
+
 #include <asm/processor.h>
 #include <asm/pgalloc.h>
 #include <asm/smp.h>
diff -uriN linux-2.6.32.43/arch/s390/include/asm/uaccess.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/uaccess.h
--- linux-2.6.32.43/arch/s390/include/asm/uaccess.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/uaccess.h	2011-07-15 05:51:11.000000000 -0500
@@ -232,6 +232,10 @@
 copy_to_user(void __user *to, const void *from, unsigned long n)
 {
 	might_fault();
+
+	if ((long)n < 0)
+		return n;
+
 	if (access_ok(VERIFY_WRITE, to, n))
 		n = __copy_to_user(to, from, n);
 	return n;
@@ -257,6 +261,9 @@
 static inline unsigned long __must_check
 __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+	if ((long)n < 0)
+		return n;
+
 	if (__builtin_constant_p(n) && (n <= 256))
 		return uaccess.copy_from_user_small(n, from, to);
 	else
@@ -283,6 +290,10 @@
 copy_from_user(void *to, const void __user *from, unsigned long n)
 {
 	might_fault();
+
+	if ((long)n < 0)
+		return n;
+
 	if (access_ok(VERIFY_READ, from, n))
 		n = __copy_from_user(to, from, n);
 	else
diff -uriN linux-2.6.32.43/arch/s390/include/asm/unistd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/unistd.h
--- linux-2.6.32.43/arch/s390/include/asm/unistd.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/include/asm/unistd.h	2011-07-15 05:50:11.000000000 -0500
@@ -202,7 +202,7 @@
 #define __NR_clock_gettime	(__NR_timer_create+6)
 #define __NR_clock_getres	(__NR_timer_create+7)
 #define __NR_clock_nanosleep	(__NR_timer_create+8)
-/* Number 263 is reserved for vserver */
+#define __NR_vserver		263
 #define __NR_statfs64		265
 #define __NR_fstatfs64		266
 #define __NR_remap_file_pages	267
diff -uriN linux-2.6.32.43/arch/s390/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/Kconfig
--- linux-2.6.32.43/arch/s390/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/Kconfig	2011-07-15 05:51:11.000000000 -0500
@@ -194,28 +194,26 @@
 
 config S390_SWITCH_AMODE
 	bool "Switch kernel/user addressing modes"
+	default y
 	help
 	  This option allows to switch the addressing modes of kernel and user
-	  space. The kernel parameter switch_amode=on will enable this feature,
-	  default is disabled. Enabling this (via kernel parameter) on machines
-	  earlier than IBM System z9-109 EC/BC will reduce system performance.
+	  space.  Enabling this on machines earlier than IBM System z9-109 EC/BC
+	  will reduce system performance.
 
 	  Note that this option will also be selected by selecting the execute
-	  protection option below. Enabling the execute protection via the
-	  noexec kernel parameter will also switch the addressing modes,
-	  independent of the switch_amode kernel parameter.
+	  protection option below. Enabling the execute protection will also
+	  switch the addressing modes, independent of this option.
 
 
 config S390_EXEC_PROTECT
 	bool "Data execute protection"
+	default y
 	select S390_SWITCH_AMODE
 	help
 	  This option allows to enable a buffer overflow protection for user
 	  space programs and it also selects the addressing mode option above.
-	  The kernel parameter noexec=on will enable this feature and also
-	  switch the addressing modes, default is disabled. Enabling this (via
-	  kernel parameter) on machines earlier than IBM System z9-109 EC/BC
-	  will reduce system performance.
+	  Enabling this on machines earlier than IBM System z9-109 EC/BC will
+	  reduce system performance.
 
 comment "Code generation options"
 
@@ -616,6 +614,8 @@
 
 source "arch/s390/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/s390/kernel/module.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/kernel/module.c
--- linux-2.6.32.43/arch/s390/kernel/module.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/kernel/module.c	2011-07-15 05:51:11.000000000 -0500
@@ -166,11 +166,11 @@
 
 	/* Increase core size by size of got & plt and set start
 	   offsets for got and plt. */
-	me->core_size = ALIGN(me->core_size, 4);
-	me->arch.got_offset = me->core_size;
-	me->core_size += me->arch.got_size;
-	me->arch.plt_offset = me->core_size;
-	me->core_size += me->arch.plt_size;
+	me->core_size_rw = ALIGN(me->core_size_rw, 4);
+	me->arch.got_offset = me->core_size_rw;
+	me->core_size_rw += me->arch.got_size;
+	me->arch.plt_offset = me->core_size_rx;
+	me->core_size_rx += me->arch.plt_size;
 	return 0;
 }
 
@@ -256,7 +256,7 @@
 		if (info->got_initialized == 0) {
 			Elf_Addr *gotent;
 
-			gotent = me->module_core + me->arch.got_offset +
+			gotent = me->module_core_rw + me->arch.got_offset +
 				info->got_offset;
 			*gotent = val;
 			info->got_initialized = 1;
@@ -280,7 +280,7 @@
 		else if (r_type == R_390_GOTENT ||
 			 r_type == R_390_GOTPLTENT)
 			*(unsigned int *) loc =
-				(val + (Elf_Addr) me->module_core - loc) >> 1;
+				(val + (Elf_Addr) me->module_core_rw - loc) >> 1;
 		else if (r_type == R_390_GOT64 ||
 			 r_type == R_390_GOTPLT64)
 			*(unsigned long *) loc = val;
@@ -294,7 +294,7 @@
 	case R_390_PLTOFF64:	/* 16 bit offset from GOT to PLT. */
 		if (info->plt_initialized == 0) {
 			unsigned int *ip;
-			ip = me->module_core + me->arch.plt_offset +
+			ip = me->module_core_rx + me->arch.plt_offset +
 				info->plt_offset;
 #ifndef CONFIG_64BIT
 			ip[0] = 0x0d105810; /* basr 1,0; l 1,6(1); br 1 */
@@ -319,7 +319,7 @@
 			       val - loc + 0xffffUL < 0x1ffffeUL) ||
 			      (r_type == R_390_PLT32DBL &&
 			       val - loc + 0xffffffffULL < 0x1fffffffeULL)))
-				val = (Elf_Addr) me->module_core +
+				val = (Elf_Addr) me->module_core_rx +
 					me->arch.plt_offset +
 					info->plt_offset;
 			val += rela->r_addend - loc;
@@ -341,7 +341,7 @@
 	case R_390_GOTOFF32:	/* 32 bit offset to GOT.  */
 	case R_390_GOTOFF64:	/* 64 bit offset to GOT. */
 		val = val + rela->r_addend -
-			((Elf_Addr) me->module_core + me->arch.got_offset);
+			((Elf_Addr) me->module_core_rw + me->arch.got_offset);
 		if (r_type == R_390_GOTOFF16)
 			*(unsigned short *) loc = val;
 		else if (r_type == R_390_GOTOFF32)
@@ -351,7 +351,7 @@
 		break;
 	case R_390_GOTPC:	/* 32 bit PC relative offset to GOT. */
 	case R_390_GOTPCDBL:	/* 32 bit PC rel. off. to GOT shifted by 1. */
-		val = (Elf_Addr) me->module_core + me->arch.got_offset +
+		val = (Elf_Addr) me->module_core_rw + me->arch.got_offset +
 			rela->r_addend - loc;
 		if (r_type == R_390_GOTPC)
 			*(unsigned int *) loc = val;
diff -uriN linux-2.6.32.43/arch/s390/kernel/ptrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/kernel/ptrace.c
--- linux-2.6.32.43/arch/s390/kernel/ptrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/kernel/ptrace.c	2011-07-15 05:50:11.000000000 -0500
@@ -36,6 +36,7 @@
 #include <linux/regset.h>
 #include <linux/tracehook.h>
 #include <linux/seccomp.h>
+#include <linux/vs_base.h>
 #include <trace/syscall.h>
 #include <asm/compat.h>
 #include <asm/segment.h>
diff -uriN linux-2.6.32.43/arch/s390/kernel/setup.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/kernel/setup.c
--- linux-2.6.32.43/arch/s390/kernel/setup.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/kernel/setup.c	2011-07-15 05:51:11.000000000 -0500
@@ -306,9 +306,6 @@
 early_param("mem", early_parse_mem);
 
 #ifdef CONFIG_S390_SWITCH_AMODE
-unsigned int switch_amode = 0;
-EXPORT_SYMBOL_GPL(switch_amode);
-
 static int set_amode_and_uaccess(unsigned long user_amode,
 				 unsigned long user32_amode)
 {
@@ -334,17 +331,6 @@
 		return 0;
 	}
 }
-
-/*
- * Switch kernel/user addressing modes?
- */
-static int __init early_parse_switch_amode(char *p)
-{
-	switch_amode = 1;
-	return 0;
-}
-early_param("switch_amode", early_parse_switch_amode);
-
 #else /* CONFIG_S390_SWITCH_AMODE */
 static inline int set_amode_and_uaccess(unsigned long user_amode,
 					unsigned long user32_amode)
@@ -353,24 +339,6 @@
 }
 #endif /* CONFIG_S390_SWITCH_AMODE */
 
-#ifdef CONFIG_S390_EXEC_PROTECT
-unsigned int s390_noexec = 0;
-EXPORT_SYMBOL_GPL(s390_noexec);
-
-/*
- * Enable execute protection?
- */
-static int __init early_parse_noexec(char *p)
-{
-	if (!strncmp(p, "off", 3))
-		return 0;
-	switch_amode = 1;
-	s390_noexec = 1;
-	return 0;
-}
-early_param("noexec", early_parse_noexec);
-#endif /* CONFIG_S390_EXEC_PROTECT */
-
 static void setup_addressing_mode(void)
 {
 	if (s390_noexec) {
diff -uriN linux-2.6.32.43/arch/s390/kernel/syscalls.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/kernel/syscalls.S
--- linux-2.6.32.43/arch/s390/kernel/syscalls.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/kernel/syscalls.S	2011-07-15 05:50:11.000000000 -0500
@@ -271,7 +271,7 @@
 SYSCALL(sys_clock_gettime,sys_clock_gettime,sys32_clock_gettime_wrapper)	/* 260 */
 SYSCALL(sys_clock_getres,sys_clock_getres,sys32_clock_getres_wrapper)
 SYSCALL(sys_clock_nanosleep,sys_clock_nanosleep,sys32_clock_nanosleep_wrapper)
-NI_SYSCALL							/* reserved for vserver */
+SYSCALL(sys_vserver,sys_vserver,sys32_vserver)
 SYSCALL(sys_s390_fadvise64_64,sys_ni_syscall,sys32_fadvise64_64_wrapper)
 SYSCALL(sys_statfs64,sys_statfs64,compat_sys_statfs64_wrapper)
 SYSCALL(sys_fstatfs64,sys_fstatfs64,compat_sys_fstatfs64_wrapper)
diff -uriN linux-2.6.32.43/arch/s390/lib/uaccess_pt.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/lib/uaccess_pt.c
--- linux-2.6.32.43/arch/s390/lib/uaccess_pt.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/lib/uaccess_pt.c	2011-07-15 05:50:11.000000000 -0500
@@ -90,7 +90,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk("VM: killing process %s\n", current->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		current->comm, task_pid_nr(current), current->xid);
 	return ret;
 
 out_sigbus:
diff -uriN linux-2.6.32.43/arch/s390/mm/mmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/mm/mmap.c
--- linux-2.6.32.43/arch/s390/mm/mmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/s390/mm/mmap.c	2011-07-15 05:51:11.000000000 -0500
@@ -78,10 +78,22 @@
 	 */
 	if (mmap_is_legacy()) {
 		mm->mmap_base = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base += mm->delta_mmap;
+#endif
+
 		mm->get_unmapped_area = arch_get_unmapped_area;
 		mm->unmap_area = arch_unmap_area;
 	} else {
 		mm->mmap_base = mmap_base();
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
+#endif
+
 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
 		mm->unmap_area = arch_unmap_area_topdown;
 	}
@@ -153,10 +165,22 @@
 	 */
 	if (mmap_is_legacy()) {
 		mm->mmap_base = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base += mm->delta_mmap;
+#endif
+
 		mm->get_unmapped_area = s390_get_unmapped_area;
 		mm->unmap_area = arch_unmap_area;
 	} else {
 		mm->mmap_base = mmap_base();
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
+#endif
+
 		mm->get_unmapped_area = s390_get_unmapped_area_topdown;
 		mm->unmap_area = arch_unmap_area_topdown;
 	}
diff -uriN linux-2.6.32.43/arch/score/include/asm/system.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/score/include/asm/system.h
--- linux-2.6.32.43/arch/score/include/asm/system.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/score/include/asm/system.h	2011-07-15 05:51:11.000000000 -0500
@@ -17,7 +17,7 @@
 #define finish_arch_switch(prev)	do {} while (0)
 
 typedef void (*vi_handler_t)(void);
-extern unsigned long arch_align_stack(unsigned long sp);
+#define arch_align_stack(x) (x)
 
 #define mb()		barrier()
 #define rmb()		barrier()
diff -uriN linux-2.6.32.43/arch/score/kernel/process.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/score/kernel/process.c
--- linux-2.6.32.43/arch/score/kernel/process.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/score/kernel/process.c	2011-07-15 05:51:11.000000000 -0500
@@ -161,8 +161,3 @@
 
 	return task_pt_regs(task)->cp0_epc;
 }
-
-unsigned long arch_align_stack(unsigned long sp)
-{
-	return sp;
-}
diff -uriN linux-2.6.32.43/arch/sh/boards/mach-hp6xx/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/boards/mach-hp6xx/pm.c
--- linux-2.6.32.43/arch/sh/boards/mach-hp6xx/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/boards/mach-hp6xx/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -143,7 +143,7 @@
 	return 0;
 }
 
-static struct platform_suspend_ops hp6x0_pm_ops = {
+static const struct platform_suspend_ops hp6x0_pm_ops = {
 	.enter		= hp6x0_pm_enter,
 	.valid		= suspend_valid_only_mem,
 };
diff -uriN linux-2.6.32.43/arch/sh/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/Kconfig
--- linux-2.6.32.43/arch/sh/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -853,6 +853,8 @@
 
 source "arch/sh/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/sh/kernel/cpu/sh4/sq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/cpu/sh4/sq.c
--- linux-2.6.32.43/arch/sh/kernel/cpu/sh4/sq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/cpu/sh4/sq.c	2011-07-15 05:51:11.000000000 -0500
@@ -327,7 +327,7 @@
 	NULL,
 };
 
-static struct sysfs_ops sq_sysfs_ops = {
+static const struct sysfs_ops sq_sysfs_ops = {
 	.show	= sq_sysfs_show,
 	.store	= sq_sysfs_store,
 };
diff -uriN linux-2.6.32.43/arch/sh/kernel/cpu/shmobile/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/cpu/shmobile/pm.c
--- linux-2.6.32.43/arch/sh/kernel/cpu/shmobile/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/cpu/shmobile/pm.c	2011-07-15 05:51:11.000000000 -0500
@@ -58,7 +58,7 @@
 	return 0;
 }
 
-static struct platform_suspend_ops sh_pm_ops = {
+static const struct platform_suspend_ops sh_pm_ops = {
 	.enter          = sh_pm_enter,
 	.valid          = suspend_valid_only_mem,
 };
diff -uriN linux-2.6.32.43/arch/sh/kernel/irq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/irq.c
--- linux-2.6.32.43/arch/sh/kernel/irq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/irq.c	2011-07-15 05:50:11.000000000 -0500
@@ -12,6 +12,7 @@
 #include <linux/kernel_stat.h>
 #include <linux/seq_file.h>
 #include <linux/ftrace.h>
+// #include <linux/vs_context.h>
 #include <asm/processor.h>
 #include <asm/machvec.h>
 #include <asm/uaccess.h>
diff -uriN linux-2.6.32.43/arch/sh/kernel/kgdb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/kgdb.c
--- linux-2.6.32.43/arch/sh/kernel/kgdb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/kgdb.c	2011-07-15 05:51:11.000000000 -0500
@@ -271,7 +271,7 @@
 {
 }
 
-struct kgdb_arch arch_kgdb_ops = {
+const struct kgdb_arch arch_kgdb_ops = {
 	/* Breakpoint instruction: trapa #0x3c */
 #ifdef CONFIG_CPU_LITTLE_ENDIAN
 	.gdb_bpt_instr		= { 0x3c, 0xc3 },
diff -uriN linux-2.6.32.43/arch/sh/kernel/vsyscall/vsyscall.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/vsyscall/vsyscall.c
--- linux-2.6.32.43/arch/sh/kernel/vsyscall/vsyscall.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/kernel/vsyscall/vsyscall.c	2011-07-15 05:50:11.000000000 -0500
@@ -19,6 +19,7 @@
 #include <linux/elf.h>
 #include <linux/sched.h>
 #include <linux/err.h>
+#include <linux/vs_memory.h>
 
 /*
  * Should the kernel map a VDSO page into processes and pass its
diff -uriN linux-2.6.32.43/arch/sh/mm/fault_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/mm/fault_32.c
--- linux-2.6.32.43/arch/sh/mm/fault_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/mm/fault_32.c	2011-07-15 05:50:11.000000000 -0500
@@ -292,7 +292,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk("VM: killing process %s\n", tsk->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		tsk->comm, task_pid_nr(tsk), tsk->xid);
 	if (user_mode(regs))
 		do_group_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/sh/mm/mmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/mm/mmap.c
--- linux-2.6.32.43/arch/sh/mm/mmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/mm/mmap.c	2011-07-15 05:51:11.000000000 -0500
@@ -74,8 +74,7 @@
 			addr = PAGE_ALIGN(addr);
 
 		vma = find_vma(mm, addr);
-		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
 			return addr;
 	}
 
@@ -106,7 +105,7 @@
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (likely(check_heap_stack_gap(vma, addr, len))) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
@@ -157,8 +156,7 @@
 			addr = PAGE_ALIGN(addr);
 
 		vma = find_vma(mm, addr);
-		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (TASK_SIZE - len >= addr && check_heap_stack_gap(vma, addr, len))
 			return addr;
 	}
 
@@ -179,7 +177,7 @@
 	/* make sure it can fit in the remaining address space */
 	if (likely(addr > len)) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start) {
+		if (check_heap_stack_gap(vma, addr - len, len)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 		}
@@ -188,18 +186,18 @@
 	if (unlikely(mm->mmap_base < len))
 		goto bottomup;
 
-	addr = mm->mmap_base-len;
-	if (do_colour_align)
-		addr = COLOUR_ALIGN_DOWN(addr, pgoff);
+	addr = mm->mmap_base - len;
 
 	do {
+		if (do_colour_align)
+			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
 		/*
 		 * Lookup failure means no vma is above this address,
 		 * else if new region fits below vma->vm_start,
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (likely(!vma || addr+len <= vma->vm_start)) {
+		if (likely(check_heap_stack_gap(vma, addr, len))) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 		}
@@ -209,10 +207,8 @@
 		        mm->cached_hole_size = vma->vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
-		if (do_colour_align)
-			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-	} while (likely(len < vma->vm_start));
+		addr = skip_heap_stack_gap(vma, len);
+	} while (!IS_ERR_VALUE(addr));
 
 bottomup:
 	/*
diff -uriN linux-2.6.32.43/arch/sh/mm/tlbflush_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/mm/tlbflush_64.c
--- linux-2.6.32.43/arch/sh/mm/tlbflush_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sh/mm/tlbflush_64.c	2011-07-15 05:50:11.000000000 -0500
@@ -306,7 +306,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk("VM: killing process %s\n", tsk->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		tsk->comm, task_pid_nr(tsk), tsk->xid);
 	if (user_mode(regs))
 		do_group_exit(SIGKILL);
 	goto no_context;
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/atomic_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/atomic_64.h
--- linux-2.6.32.43/arch/sparc/include/asm/atomic_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/atomic_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -14,18 +14,40 @@
 #define ATOMIC64_INIT(i)	{ (i) }
 
 #define atomic_read(v)		((v)->counter)
+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
+{
+	return v->counter;
+}
 #define atomic64_read(v)	((v)->counter)
+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
+{
+	return v->counter;
+}
 
 #define atomic_set(v, i)	(((v)->counter) = i)
+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
+{
+	v->counter = i;
+}
 #define atomic64_set(v, i)	(((v)->counter) = i)
+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
+{
+	v->counter = i;
+}
 
 extern void atomic_add(int, atomic_t *);
+extern void atomic_add_unchecked(int, atomic_unchecked_t *);
 extern void atomic64_add(long, atomic64_t *);
+extern void atomic64_add_unchecked(long, atomic64_unchecked_t *);
 extern void atomic_sub(int, atomic_t *);
+extern void atomic_sub_unchecked(int, atomic_unchecked_t *);
 extern void atomic64_sub(long, atomic64_t *);
+extern void atomic64_sub_unchecked(long, atomic64_unchecked_t *);
 
 extern int atomic_add_ret(int, atomic_t *);
+extern int atomic_add_ret_unchecked(int, atomic_unchecked_t *);
 extern long atomic64_add_ret(long, atomic64_t *);
+extern long atomic64_add_ret_unchecked(long, atomic64_unchecked_t *);
 extern int atomic_sub_ret(int, atomic_t *);
 extern long atomic64_sub_ret(long, atomic64_t *);
 
@@ -33,13 +55,29 @@
 #define atomic64_dec_return(v) atomic64_sub_ret(1, v)
 
 #define atomic_inc_return(v) atomic_add_ret(1, v)
+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
+{
+	return atomic_add_ret_unchecked(1, v);
+}
 #define atomic64_inc_return(v) atomic64_add_ret(1, v)
+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
+{
+	return atomic64_add_ret_unchecked(1, v);
+}
 
 #define atomic_sub_return(i, v) atomic_sub_ret(i, v)
 #define atomic64_sub_return(i, v) atomic64_sub_ret(i, v)
 
 #define atomic_add_return(i, v) atomic_add_ret(i, v)
+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
+{
+	return atomic_add_ret_unchecked(i, v);
+}
 #define atomic64_add_return(i, v) atomic64_add_ret(i, v)
+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
+{
+	return atomic64_add_ret_unchecked(i, v);
+}
 
 /*
  * atomic_inc_and_test - increment and test
@@ -50,6 +88,7 @@
  * other cases.
  */
 #define atomic_inc_and_test(v) (atomic_inc_return(v) == 0)
+#define atomic_inc_and_test_unchecked(v) (atomic_inc_return_unchecked(v) == 0)
 #define atomic64_inc_and_test(v) (atomic64_inc_return(v) == 0)
 
 #define atomic_sub_and_test(i, v) (atomic_sub_ret(i, v) == 0)
@@ -59,30 +98,59 @@
 #define atomic64_dec_and_test(v) (atomic64_sub_ret(1, v) == 0)
 
 #define atomic_inc(v) atomic_add(1, v)
+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
+{
+	atomic_add_unchecked(1, v);
+}
 #define atomic64_inc(v) atomic64_add(1, v)
+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
+{
+	atomic64_add_unchecked(1, v);
+}
 
 #define atomic_dec(v) atomic_sub(1, v)
+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
+{
+	atomic_sub_unchecked(1, v);
+}
 #define atomic64_dec(v) atomic64_sub(1, v)
+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
+{
+	atomic64_sub_unchecked(1, v);
+}
 
 #define atomic_add_negative(i, v) (atomic_add_ret(i, v) < 0)
 #define atomic64_add_negative(i, v) (atomic64_add_ret(i, v) < 0)
 
 #define atomic_cmpxchg(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
+#define atomic_cmpxchg_unchecked(v, o, n) (cmpxchg(&((v)->counter), (o), (n)))
 #define atomic_xchg(v, new) (xchg(&((v)->counter), new))
+#define atomic_xchg_unchecked(v, new) (xchg(&((v)->counter), new))
 
 static inline int atomic_add_unless(atomic_t *v, int a, int u)
 {
-	int c, old;
+	int c, old, new;
 	c = atomic_read(v);
 	for (;;) {
-		if (unlikely(c == (u)))
+		if (unlikely(c == u))
 			break;
-		old = atomic_cmpxchg((v), c, c + (a));
+
+		asm volatile("addcc %2, %0, %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+			     "tvs %%icc, 6\n"
+#endif
+
+			     : "=r" (new)
+			     : "0" (c), "ir" (a)
+			     : "cc");
+
+		old = atomic_cmpxchg(v, c, new);
 		if (likely(old == c))
 			break;
 		c = old;
 	}
-	return c != (u);
+	return c != u;
 }
 
 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
@@ -93,17 +161,28 @@
 
 static inline long atomic64_add_unless(atomic64_t *v, long a, long u)
 {
-	long c, old;
+	long c, old, new;
 	c = atomic64_read(v);
 	for (;;) {
-		if (unlikely(c == (u)))
+		if (unlikely(c == u))
 			break;
-		old = atomic64_cmpxchg((v), c, c + (a));
+
+		asm volatile("addcc %2, %0, %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+			     "tvs %%xcc, 6\n"
+#endif
+
+			     : "=r" (new)
+			     : "0" (c), "ir" (a)
+			     : "cc");
+
+		old = atomic64_cmpxchg(v, c, new);
 		if (likely(old == c))
 			break;
 		c = old;
 	}
-	return c != (u);
+	return c != u;
 }
 
 #define atomic64_inc_not_zero(v) atomic64_add_unless((v), 1, 0)
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/cache.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/cache.h
--- linux-2.6.32.43/arch/sparc/include/asm/cache.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/cache.h	2011-07-15 05:51:11.000000000 -0500
@@ -8,7 +8,7 @@
 #define _SPARC_CACHE_H
 
 #define L1_CACHE_SHIFT 5
-#define L1_CACHE_BYTES 32
+#define L1_CACHE_BYTES 32UL
 #define L1_CACHE_ALIGN(x) ((((x)+(L1_CACHE_BYTES-1))&~(L1_CACHE_BYTES-1)))
 
 #ifdef CONFIG_SPARC32
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/dma-mapping.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/dma-mapping.h
--- linux-2.6.32.43/arch/sparc/include/asm/dma-mapping.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/dma-mapping.h	2011-07-15 05:51:11.000000000 -0500
@@ -14,10 +14,10 @@
 #define dma_free_noncoherent(d, s, v, h) dma_free_coherent(d, s, v, h)
 #define dma_is_consistent(d, h)	(1)
 
-extern struct dma_map_ops *dma_ops, pci32_dma_ops;
+extern const struct dma_map_ops *dma_ops, pci32_dma_ops;
 extern struct bus_type pci_bus_type;
 
-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
 {
 #if defined(CONFIG_SPARC32) && defined(CONFIG_PCI)
 	if (dev->bus == &pci_bus_type)
@@ -31,7 +31,7 @@
 static inline void *dma_alloc_coherent(struct device *dev, size_t size,
 				       dma_addr_t *dma_handle, gfp_t flag)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 	void *cpu_addr;
 
 	cpu_addr = ops->alloc_coherent(dev, size, dma_handle, flag);
@@ -42,7 +42,7 @@
 static inline void dma_free_coherent(struct device *dev, size_t size,
 				     void *cpu_addr, dma_addr_t dma_handle)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	debug_dma_free_coherent(dev, size, cpu_addr, dma_handle);
 	ops->free_coherent(dev, size, cpu_addr, dma_handle);
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/elf_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/elf_32.h
--- linux-2.6.32.43/arch/sparc/include/asm/elf_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/elf_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -116,6 +116,13 @@
 
 #define ELF_ET_DYN_BASE         (TASK_UNMAPPED_BASE)
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	0x10000UL
+
+#define PAX_DELTA_MMAP_LEN	16
+#define PAX_DELTA_STACK_LEN	16
+#endif
+
 /* This yields a mask that user programs can use to figure out what
    instruction set this cpu supports.  This can NOT be done in userspace
    on Sparc.  */
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/elf_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/elf_64.h
--- linux-2.6.32.43/arch/sparc/include/asm/elf_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/elf_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -163,6 +163,12 @@
 #define ELF_ET_DYN_BASE		0x0000010000000000UL
 #define COMPAT_ELF_ET_DYN_BASE	0x0000000070000000UL
 
+#ifdef CONFIG_PAX_ASLR
+#define PAX_ELF_ET_DYN_BASE	(test_thread_flag(TIF_32BIT) ? 0x10000UL : 0x100000UL)
+
+#define PAX_DELTA_MMAP_LEN	(test_thread_flag(TIF_32BIT) ? 14 : 28)
+#define PAX_DELTA_STACK_LEN	(test_thread_flag(TIF_32BIT) ? 15 : 29)
+#endif
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this cpu supports.  */
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/pgtable_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/pgtable_32.h
--- linux-2.6.32.43/arch/sparc/include/asm/pgtable_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/pgtable_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -43,6 +43,13 @@
 BTFIXUPDEF_INT(page_none)
 BTFIXUPDEF_INT(page_copy)
 BTFIXUPDEF_INT(page_readonly)
+
+#ifdef CONFIG_PAX_PAGEEXEC
+BTFIXUPDEF_INT(page_shared_noexec)
+BTFIXUPDEF_INT(page_copy_noexec)
+BTFIXUPDEF_INT(page_readonly_noexec)
+#endif
+
 BTFIXUPDEF_INT(page_kernel)
 
 #define PMD_SHIFT		SUN4C_PMD_SHIFT
@@ -64,6 +71,16 @@
 #define PAGE_COPY      __pgprot(BTFIXUP_INT(page_copy))
 #define PAGE_READONLY  __pgprot(BTFIXUP_INT(page_readonly))
 
+#ifdef CONFIG_PAX_PAGEEXEC
+extern pgprot_t PAGE_SHARED_NOEXEC;
+# define PAGE_COPY_NOEXEC	__pgprot(BTFIXUP_INT(page_copy_noexec))
+# define PAGE_READONLY_NOEXEC	__pgprot(BTFIXUP_INT(page_readonly_noexec))
+#else
+# define PAGE_SHARED_NOEXEC	PAGE_SHARED
+# define PAGE_COPY_NOEXEC	PAGE_COPY
+# define PAGE_READONLY_NOEXEC	PAGE_READONLY
+#endif
+
 extern unsigned long page_kernel;
 
 #ifdef MODULE
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/pgtsrmmu.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/pgtsrmmu.h
--- linux-2.6.32.43/arch/sparc/include/asm/pgtsrmmu.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/pgtsrmmu.h	2011-07-15 05:51:11.000000000 -0500
@@ -115,6 +115,13 @@
 				    SRMMU_EXEC | SRMMU_REF)
 #define SRMMU_PAGE_RDONLY  __pgprot(SRMMU_VALID | SRMMU_CACHE | \
 				    SRMMU_EXEC | SRMMU_REF)
+
+#ifdef CONFIG_PAX_PAGEEXEC
+#define SRMMU_PAGE_SHARED_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_WRITE | SRMMU_REF)
+#define SRMMU_PAGE_COPY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
+#define SRMMU_PAGE_RDONLY_NOEXEC	__pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_REF)
+#endif
+
 #define SRMMU_PAGE_KERNEL  __pgprot(SRMMU_VALID | SRMMU_CACHE | SRMMU_PRIV | \
 				    SRMMU_DIRTY | SRMMU_REF)
 
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/spinlock_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/spinlock_64.h
--- linux-2.6.32.43/arch/sparc/include/asm/spinlock_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/spinlock_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -92,14 +92,19 @@
 
 /* Multi-reader locks, these are much saner than the 32-bit Sparc ones... */
 
-static void inline arch_read_lock(raw_rwlock_t *lock)
+static inline void arch_read_lock(raw_rwlock_t *lock)
 {
 	unsigned long tmp1, tmp2;
 
 	__asm__ __volatile__ (
 "1:	ldsw		[%2], %0\n"
 "	brlz,pn		%0, 2f\n"
-"4:	 add		%0, 1, %1\n"
+"4:	 addcc		%0, 1, %1\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+"	tvs		%%icc, 6\n"
+#endif
+
 "	cas		[%2], %0, %1\n"
 "	cmp		%0, %1\n"
 "	bne,pn		%%icc, 1b\n"
@@ -112,7 +117,7 @@
 "	.previous"
 	: "=&r" (tmp1), "=&r" (tmp2)
 	: "r" (lock)
-	: "memory");
+	: "memory", "cc");
 }
 
 static int inline arch_read_trylock(raw_rwlock_t *lock)
@@ -123,7 +128,12 @@
 "1:	ldsw		[%2], %0\n"
 "	brlz,a,pn	%0, 2f\n"
 "	 mov		0, %0\n"
-"	add		%0, 1, %1\n"
+"	addcc		%0, 1, %1\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+"	tvs		%%icc, 6\n"
+#endif
+
 "	cas		[%2], %0, %1\n"
 "	cmp		%0, %1\n"
 "	bne,pn		%%icc, 1b\n"
@@ -136,13 +146,18 @@
 	return tmp1;
 }
 
-static void inline arch_read_unlock(raw_rwlock_t *lock)
+static inline void arch_read_unlock(raw_rwlock_t *lock)
 {
 	unsigned long tmp1, tmp2;
 
 	__asm__ __volatile__(
 "1:	lduw	[%2], %0\n"
-"	sub	%0, 1, %1\n"
+"	subcc	%0, 1, %1\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+"	tvs	%%icc, 6\n"
+#endif
+
 "	cas	[%2], %0, %1\n"
 "	cmp	%0, %1\n"
 "	bne,pn	%%xcc, 1b\n"
@@ -152,7 +167,7 @@
 	: "memory");
 }
 
-static void inline arch_write_lock(raw_rwlock_t *lock)
+static inline void arch_write_lock(raw_rwlock_t *lock)
 {
 	unsigned long mask, tmp1, tmp2;
 
@@ -177,7 +192,7 @@
 	: "memory");
 }
 
-static void inline arch_write_unlock(raw_rwlock_t *lock)
+static inline void arch_write_unlock(raw_rwlock_t *lock)
 {
 	__asm__ __volatile__(
 "	stw		%%g0, [%0]"
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/thread_info_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/thread_info_32.h
--- linux-2.6.32.43/arch/sparc/include/asm/thread_info_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/thread_info_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -50,6 +50,8 @@
 	unsigned long		w_saved;
 
 	struct restart_block	restart_block;
+
+	unsigned long		lowest_stack;
 };
 
 /*
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/thread_info_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/thread_info_64.h
--- linux-2.6.32.43/arch/sparc/include/asm/thread_info_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/thread_info_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -68,6 +68,8 @@
 	struct pt_regs		*kern_una_regs;
 	unsigned int		kern_una_insn;
 
+	unsigned long		lowest_stack;
+
 	unsigned long		fpregs[0] __attribute__ ((aligned(64)));
 };
 
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/tlb_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/tlb_64.h
--- linux-2.6.32.43/arch/sparc/include/asm/tlb_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/tlb_64.h	2011-07-15 05:50:11.000000000 -0500
@@ -3,6 +3,7 @@
 
 #include <linux/swap.h>
 #include <linux/pagemap.h>
+#include <linux/vs_memory.h>
 #include <asm/pgalloc.h>
 #include <asm/tlbflush.h>
 #include <asm/mmu_context.h>
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/uaccess_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/uaccess_32.h
--- linux-2.6.32.43/arch/sparc/include/asm/uaccess_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/uaccess_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -249,27 +249,46 @@
 
 static inline unsigned long copy_to_user(void __user *to, const void *from, unsigned long n)
 {
-	if (n && __access_ok((unsigned long) to, n))
+	if ((long)n < 0)
+		return n;
+
+	if (n && __access_ok((unsigned long) to, n)) {
+		if (!__builtin_constant_p(n))
+			check_object_size(from, n, true);
 		return __copy_user(to, (__force void __user *) from, n);
-	else
+	} else
 		return n;
 }
 
 static inline unsigned long __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
+	if ((long)n < 0)
+		return n;
+
+	if (!__builtin_constant_p(n))
+		check_object_size(from, n, true);
+
 	return __copy_user(to, (__force void __user *) from, n);
 }
 
 static inline unsigned long copy_from_user(void *to, const void __user *from, unsigned long n)
 {
-	if (n && __access_ok((unsigned long) from, n))
+	if ((long)n < 0)
+		return n;
+
+	if (n && __access_ok((unsigned long) from, n)) {
+		if (!__builtin_constant_p(n))
+			check_object_size(to, n, false);
 		return __copy_user((__force void __user *) to, from, n);
-	else
+	} else
 		return n;
 }
 
 static inline unsigned long __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
+	if ((long)n < 0)
+		return n;
+
 	return __copy_user((__force void __user *) to, from, n);
 }
 
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/uaccess_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/uaccess_64.h
--- linux-2.6.32.43/arch/sparc/include/asm/uaccess_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/uaccess_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -9,6 +9,7 @@
 #include <linux/compiler.h>
 #include <linux/string.h>
 #include <linux/thread_info.h>
+#include <linux/kernel.h>
 #include <asm/asi.h>
 #include <asm/system.h>
 #include <asm/spitfire.h>
@@ -212,8 +213,15 @@
 static inline unsigned long __must_check
 copy_from_user(void *to, const void __user *from, unsigned long size)
 {
-	unsigned long ret = ___copy_from_user(to, from, size);
+	unsigned long ret;
 
+	if ((long)size < 0 || size > INT_MAX)
+		return size;
+
+	if (!__builtin_constant_p(size))
+		check_object_size(to, size, false);
+
+	ret = ___copy_from_user(to, from, size);
 	if (unlikely(ret))
 		ret = copy_from_user_fixup(to, from, size);
 	return ret;
@@ -228,8 +236,15 @@
 static inline unsigned long __must_check
 copy_to_user(void __user *to, const void *from, unsigned long size)
 {
-	unsigned long ret = ___copy_to_user(to, from, size);
+	unsigned long ret;
+
+	if ((long)size < 0 || size > INT_MAX)
+		return size;
+
+	if (!__builtin_constant_p(size))
+		check_object_size(from, size, true);
 
+	ret = ___copy_to_user(to, from, size);
 	if (unlikely(ret))
 		ret = copy_to_user_fixup(to, from, size);
 	return ret;
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/uaccess.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/uaccess.h
--- linux-2.6.32.43/arch/sparc/include/asm/uaccess.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/uaccess.h	2011-07-15 05:51:11.000000000 -0500
@@ -1,5 +1,13 @@
 #ifndef ___ASM_SPARC_UACCESS_H
 #define ___ASM_SPARC_UACCESS_H
+
+#ifdef __KERNEL__
+#ifndef __ASSEMBLY__
+#include <linux/types.h>
+extern void check_object_size(const void *ptr, unsigned long n, bool to);
+#endif
+#endif
+
 #if defined(__sparc__) && defined(__arch64__)
 #include <asm/uaccess_64.h>
 #else
diff -uriN linux-2.6.32.43/arch/sparc/include/asm/unistd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/unistd.h
--- linux-2.6.32.43/arch/sparc/include/asm/unistd.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/include/asm/unistd.h	2011-07-15 05:50:11.000000000 -0500
@@ -335,7 +335,7 @@
 #define __NR_timer_getoverrun	264
 #define __NR_timer_delete	265
 #define __NR_timer_create	266
-/* #define __NR_vserver		267 Reserved for VSERVER */
+#define __NR_vserver		267
 #define __NR_io_setup		268
 #define __NR_io_destroy		269
 #define __NR_io_submit		270
diff -uriN linux-2.6.32.43/arch/sparc/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/Kconfig
--- linux-2.6.32.43/arch/sparc/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -550,6 +550,8 @@
 
 source "arch/sparc/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/sparc/kernel/iommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/iommu.c
--- linux-2.6.32.43/arch/sparc/kernel/iommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/iommu.c	2011-07-15 05:51:11.000000000 -0500
@@ -826,7 +826,7 @@
 	spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
-static struct dma_map_ops sun4u_dma_ops = {
+static const struct dma_map_ops sun4u_dma_ops = {
 	.alloc_coherent		= dma_4u_alloc_coherent,
 	.free_coherent		= dma_4u_free_coherent,
 	.map_page		= dma_4u_map_page,
@@ -837,7 +837,7 @@
 	.sync_sg_for_cpu	= dma_4u_sync_sg_for_cpu,
 };
 
-struct dma_map_ops *dma_ops = &sun4u_dma_ops;
+const struct dma_map_ops *dma_ops = &sun4u_dma_ops;
 EXPORT_SYMBOL(dma_ops);
 
 extern int pci64_dma_supported(struct pci_dev *pdev, u64 device_mask);
diff -uriN linux-2.6.32.43/arch/sparc/kernel/ioport.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/ioport.c
--- linux-2.6.32.43/arch/sparc/kernel/ioport.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/ioport.c	2011-07-15 05:51:11.000000000 -0500
@@ -392,7 +392,7 @@
 	BUG();
 }
 
-struct dma_map_ops sbus_dma_ops = {
+const struct dma_map_ops sbus_dma_ops = {
 	.alloc_coherent		= sbus_alloc_coherent,
 	.free_coherent		= sbus_free_coherent,
 	.map_page		= sbus_map_page,
@@ -403,7 +403,7 @@
 	.sync_sg_for_device	= sbus_sync_sg_for_device,
 };
 
-struct dma_map_ops *dma_ops = &sbus_dma_ops;
+const struct dma_map_ops *dma_ops = &sbus_dma_ops;
 EXPORT_SYMBOL(dma_ops);
 
 static int __init sparc_register_ioport(void)
@@ -640,7 +640,7 @@
 	}
 }
 
-struct dma_map_ops pci32_dma_ops = {
+const struct dma_map_ops pci32_dma_ops = {
 	.alloc_coherent		= pci32_alloc_coherent,
 	.free_coherent		= pci32_free_coherent,
 	.map_page		= pci32_map_page,
diff -uriN linux-2.6.32.43/arch/sparc/kernel/kgdb_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/kgdb_32.c
--- linux-2.6.32.43/arch/sparc/kernel/kgdb_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/kgdb_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -158,7 +158,7 @@
 {
 }
 
-struct kgdb_arch arch_kgdb_ops = {
+const struct kgdb_arch arch_kgdb_ops = {
 	/* Breakpoint instruction: ta 0x7d */
 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x7d },
 };
diff -uriN linux-2.6.32.43/arch/sparc/kernel/kgdb_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/kgdb_64.c
--- linux-2.6.32.43/arch/sparc/kernel/kgdb_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/kgdb_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -180,7 +180,7 @@
 {
 }
 
-struct kgdb_arch arch_kgdb_ops = {
+const struct kgdb_arch arch_kgdb_ops = {
 	/* Breakpoint instruction: ta 0x72 */
 	.gdb_bpt_instr		= { 0x91, 0xd0, 0x20, 0x72 },
 };
diff -uriN linux-2.6.32.43/arch/sparc/kernel/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/Makefile
--- linux-2.6.32.43/arch/sparc/kernel/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/Makefile	2011-07-15 05:51:11.000000000 -0500
@@ -3,7 +3,7 @@
 #
 
 asflags-y := -ansi
-ccflags-y := -Werror
+#ccflags-y := -Werror
 
 extra-y     := head_$(BITS).o
 extra-y     += init_task.o
diff -uriN linux-2.6.32.43/arch/sparc/kernel/pci_sun4v.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/pci_sun4v.c
--- linux-2.6.32.43/arch/sparc/kernel/pci_sun4v.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/pci_sun4v.c	2011-07-15 05:51:11.000000000 -0500
@@ -525,7 +525,7 @@
 	spin_unlock_irqrestore(&iommu->lock, flags);
 }
 
-static struct dma_map_ops sun4v_dma_ops = {
+static const struct dma_map_ops sun4v_dma_ops = {
 	.alloc_coherent			= dma_4v_alloc_coherent,
 	.free_coherent			= dma_4v_free_coherent,
 	.map_page			= dma_4v_map_page,
diff -uriN linux-2.6.32.43/arch/sparc/kernel/process_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/process_32.c
--- linux-2.6.32.43/arch/sparc/kernel/process_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/process_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -196,7 +196,7 @@
 		       rw->ins[4], rw->ins[5],
 		       rw->ins[6],
 		       rw->ins[7]);
-		printk("%pS\n", (void *) rw->ins[7]);
+		printk("%pA\n", (void *) rw->ins[7]);
 		rw = (struct reg_window32 *) rw->ins[6];
 	}
 	spin_unlock_irqrestore(&sparc_backtrace_lock, flags);
@@ -263,14 +263,14 @@
 
         printk("PSR: %08lx PC: %08lx NPC: %08lx Y: %08lx    %s\n",
 	       r->psr, r->pc, r->npc, r->y, print_tainted());
-	printk("PC: <%pS>\n", (void *) r->pc);
+	printk("PC: <%pA>\n", (void *) r->pc);
 	printk("%%G: %08lx %08lx  %08lx %08lx  %08lx %08lx  %08lx %08lx\n",
 	       r->u_regs[0], r->u_regs[1], r->u_regs[2], r->u_regs[3],
 	       r->u_regs[4], r->u_regs[5], r->u_regs[6], r->u_regs[7]);
 	printk("%%O: %08lx %08lx  %08lx %08lx  %08lx %08lx  %08lx %08lx\n",
 	       r->u_regs[8], r->u_regs[9], r->u_regs[10], r->u_regs[11],
 	       r->u_regs[12], r->u_regs[13], r->u_regs[14], r->u_regs[15]);
-	printk("RPC: <%pS>\n", (void *) r->u_regs[15]);
+	printk("RPC: <%pA>\n", (void *) r->u_regs[15]);
 
 	printk("%%L: %08lx %08lx  %08lx %08lx  %08lx %08lx  %08lx %08lx\n",
 	       rw->locals[0], rw->locals[1], rw->locals[2], rw->locals[3],
@@ -305,7 +305,7 @@
 		rw = (struct reg_window32 *) fp;
 		pc = rw->ins[7];
 		printk("[%08lx : ", pc);
-		printk("%pS ] ", (void *) pc);
+		printk("%pA ] ", (void *) pc);
 		fp = rw->ins[6];
 	} while (++count < 16);
 	printk("\n");
diff -uriN linux-2.6.32.43/arch/sparc/kernel/process_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/process_64.c
--- linux-2.6.32.43/arch/sparc/kernel/process_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/process_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -180,14 +180,14 @@
 	printk("i4: %016lx i5: %016lx i6: %016lx i7: %016lx\n",
 	       rwk->ins[4], rwk->ins[5], rwk->ins[6], rwk->ins[7]);
 	if (regs->tstate & TSTATE_PRIV)
-		printk("I7: <%pS>\n", (void *) rwk->ins[7]);
+		printk("I7: <%pA>\n", (void *) rwk->ins[7]);
 }
 
 void show_regs(struct pt_regs *regs)
 {
 	printk("TSTATE: %016lx TPC: %016lx TNPC: %016lx Y: %08x    %s\n", regs->tstate,
 	       regs->tpc, regs->tnpc, regs->y, print_tainted());
-	printk("TPC: <%pS>\n", (void *) regs->tpc);
+	printk("TPC: <%pA>\n", (void *) regs->tpc);
 	printk("g0: %016lx g1: %016lx g2: %016lx g3: %016lx\n",
 	       regs->u_regs[0], regs->u_regs[1], regs->u_regs[2],
 	       regs->u_regs[3]);
@@ -200,7 +200,7 @@
 	printk("o4: %016lx o5: %016lx sp: %016lx ret_pc: %016lx\n",
 	       regs->u_regs[12], regs->u_regs[13], regs->u_regs[14],
 	       regs->u_regs[15]);
-	printk("RPC: <%pS>\n", (void *) regs->u_regs[15]);
+	printk("RPC: <%pA>\n", (void *) regs->u_regs[15]);
 	show_regwindow(regs);
 }
 
@@ -284,7 +284,7 @@
 		       ((tp && tp->task) ? tp->task->pid : -1));
 
 		if (gp->tstate & TSTATE_PRIV) {
-			printk("             TPC[%pS] O7[%pS] I7[%pS] RPC[%pS]\n",
+			printk("             TPC[%pA] O7[%pA] I7[%pA] RPC[%pA]\n",
 			       (void *) gp->tpc,
 			       (void *) gp->o7,
 			       (void *) gp->i7,
diff -uriN linux-2.6.32.43/arch/sparc/kernel/sys_sparc_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/sys_sparc_32.c
--- linux-2.6.32.43/arch/sparc/kernel/sys_sparc_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/sys_sparc_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -57,7 +57,7 @@
 	if (ARCH_SUN4C && len > 0x20000000)
 		return -ENOMEM;
 	if (!addr)
-		addr = TASK_UNMAPPED_BASE;
+		addr = current->mm->mmap_base;
 
 	if (flags & MAP_SHARED)
 		addr = COLOUR_ALIGN(addr);
@@ -72,7 +72,7 @@
 		}
 		if (TASK_SIZE - PAGE_SIZE - len < addr)
 			return -ENOMEM;
-		if (!vmm || addr + len <= vmm->vm_start)
+		if (check_heap_stack_gap(vmm, addr, len))
 			return addr;
 		addr = vmm->vm_end;
 		if (flags & MAP_SHARED)
diff -uriN linux-2.6.32.43/arch/sparc/kernel/sys_sparc_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/sys_sparc_64.c
--- linux-2.6.32.43/arch/sparc/kernel/sys_sparc_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/sys_sparc_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -125,7 +125,7 @@
 		/* We do not accept a shared mapping if it would violate
 		 * cache aliasing constraints.
 		 */
-		if ((flags & MAP_SHARED) &&
+		if ((filp || (flags & MAP_SHARED)) &&
 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
 			return -EINVAL;
 		return addr;
@@ -140,6 +140,10 @@
 	if (filp || (flags & MAP_SHARED))
 		do_color_align = 1;
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
 	if (addr) {
 		if (do_color_align)
 			addr = COLOUR_ALIGN(addr, pgoff);
@@ -147,15 +151,14 @@
 			addr = PAGE_ALIGN(addr);
 
 		vma = find_vma(mm, addr);
-		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
 			return addr;
 	}
 
 	if (len > mm->cached_hole_size) {
-	        start_addr = addr = mm->free_area_cache;
+		start_addr = addr = mm->free_area_cache;
 	} else {
-	        start_addr = addr = TASK_UNMAPPED_BASE;
+		start_addr = addr = mm->mmap_base;
 	        mm->cached_hole_size = 0;
 	}
 
@@ -175,14 +178,14 @@
 			vma = find_vma(mm, VA_EXCLUDE_END);
 		}
 		if (unlikely(task_size < addr)) {
-			if (start_addr != TASK_UNMAPPED_BASE) {
-				start_addr = addr = TASK_UNMAPPED_BASE;
+			if (start_addr != mm->mmap_base) {
+				start_addr = addr = mm->mmap_base;
 				mm->cached_hole_size = 0;
 				goto full_search;
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (likely(check_heap_stack_gap(vma, addr, len))) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
@@ -216,7 +219,7 @@
 		/* We do not accept a shared mapping if it would violate
 		 * cache aliasing constraints.
 		 */
-		if ((flags & MAP_SHARED) &&
+		if ((filp || (flags & MAP_SHARED)) &&
 		    ((addr - (pgoff << PAGE_SHIFT)) & (SHMLBA - 1)))
 			return -EINVAL;
 		return addr;
@@ -237,8 +240,7 @@
 			addr = PAGE_ALIGN(addr);
 
 		vma = find_vma(mm, addr);
-		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
 			return addr;
 	}
 
@@ -259,7 +261,7 @@
 	/* make sure it can fit in the remaining address space */
 	if (likely(addr > len)) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start) {
+		if (check_heap_stack_gap(vma, addr - len, len)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 		}
@@ -268,18 +270,18 @@
 	if (unlikely(mm->mmap_base < len))
 		goto bottomup;
 
-	addr = mm->mmap_base-len;
-	if (do_color_align)
-		addr = COLOUR_ALIGN_DOWN(addr, pgoff);
+	addr = mm->mmap_base - len;
 
 	do {
+		if (do_color_align)
+			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
 		/*
 		 * Lookup failure means no vma is above this address,
 		 * else if new region fits below vma->vm_start,
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (likely(!vma || addr+len <= vma->vm_start)) {
+		if (likely(check_heap_stack_gap(vma, addr, len))) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 		}
@@ -289,10 +291,8 @@
  		        mm->cached_hole_size = vma->vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
-		if (do_color_align)
-			addr = COLOUR_ALIGN_DOWN(addr, pgoff);
-	} while (likely(len < vma->vm_start));
+		addr = skip_heap_stack_gap(vma, len);
+	} while (!IS_ERR_VALUE(addr));
 
 bottomup:
 	/*
@@ -384,6 +384,12 @@
 	    current->signal->rlim[RLIMIT_STACK].rlim_cur == RLIM_INFINITY ||
 	    sysctl_legacy_va_layout) {
 		mm->mmap_base = TASK_UNMAPPED_BASE + random_factor;
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base += mm->delta_mmap;
+#endif
+
 		mm->get_unmapped_area = arch_get_unmapped_area;
 		mm->unmap_area = arch_unmap_area;
 	} else {
@@ -398,6 +404,12 @@
 			gap = (task_size / 6 * 5);
 
 		mm->mmap_base = PAGE_ALIGN(task_size - gap - random_factor);
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
+#endif
+
 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
 		mm->unmap_area = arch_unmap_area_topdown;
 	}
diff -uriN linux-2.6.32.43/arch/sparc/kernel/systbls_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/systbls_32.S
--- linux-2.6.32.43/arch/sparc/kernel/systbls_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/systbls_32.S	2011-07-15 05:50:11.000000000 -0500
@@ -70,7 +70,7 @@
 /*250*/	.long sys_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
 /*255*/	.long sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/	.long sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
-/*265*/	.long sys_timer_delete, sys_timer_create, sys_nis_syscall, sys_io_setup, sys_io_destroy
+/*265*/	.long sys_timer_delete, sys_timer_create, sys_vserver, sys_io_setup, sys_io_destroy
 /*270*/	.long sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink
 /*275*/	.long sys_mq_timedsend, sys_mq_timedreceive, sys_mq_notify, sys_mq_getsetattr, sys_waitid
 /*280*/	.long sys_tee, sys_add_key, sys_request_key, sys_keyctl, sys_openat
diff -uriN linux-2.6.32.43/arch/sparc/kernel/systbls_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/systbls_64.S
--- linux-2.6.32.43/arch/sparc/kernel/systbls_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/systbls_64.S	2011-07-15 05:50:11.000000000 -0500
@@ -71,7 +71,7 @@
 /*250*/	.word sys32_mremap, sys32_sysctl, sys32_getsid, sys_fdatasync, sys32_nfsservctl
 	.word sys32_sync_file_range, compat_sys_clock_settime, compat_sys_clock_gettime, compat_sys_clock_getres, sys32_clock_nanosleep
 /*260*/	.word compat_sys_sched_getaffinity, compat_sys_sched_setaffinity, sys32_timer_settime, compat_sys_timer_gettime, sys_timer_getoverrun
-	.word sys_timer_delete, compat_sys_timer_create, sys_ni_syscall, compat_sys_io_setup, sys_io_destroy
+	.word sys_timer_delete, compat_sys_timer_create, sys32_vserver, compat_sys_io_setup, sys_io_destroy
 /*270*/	.word sys32_io_submit, sys_io_cancel, compat_sys_io_getevents, sys32_mq_open, sys_mq_unlink
 	.word compat_sys_mq_timedsend, compat_sys_mq_timedreceive, compat_sys_mq_notify, compat_sys_mq_getsetattr, compat_sys_waitid
 /*280*/	.word sys32_tee, sys_add_key, sys_request_key, sys_keyctl, compat_sys_openat
@@ -146,7 +146,7 @@
 /*250*/	.word sys_64_mremap, sys_sysctl, sys_getsid, sys_fdatasync, sys_nfsservctl
 	.word sys_sync_file_range, sys_clock_settime, sys_clock_gettime, sys_clock_getres, sys_clock_nanosleep
 /*260*/	.word sys_sched_getaffinity, sys_sched_setaffinity, sys_timer_settime, sys_timer_gettime, sys_timer_getoverrun
-	.word sys_timer_delete, sys_timer_create, sys_ni_syscall, sys_io_setup, sys_io_destroy
+	.word sys_timer_delete, sys_timer_create, sys_vserver, sys_io_setup, sys_io_destroy
 /*270*/	.word sys_io_submit, sys_io_cancel, sys_io_getevents, sys_mq_open, sys_mq_unlink
 	.word sys_mq_timedsend, sys_mq_timedreceive, sys_mq_notify, sys_mq_getsetattr, sys_waitid
 /*280*/	.word sys_tee, sys_add_key, sys_request_key, sys_keyctl, sys_openat
diff -uriN linux-2.6.32.43/arch/sparc/kernel/traps_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/traps_32.c
--- linux-2.6.32.43/arch/sparc/kernel/traps_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/traps_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -44,6 +44,8 @@
 #define __SAVE __asm__ __volatile__("save %sp, -0x40, %sp\n\t")
 #define __RESTORE __asm__ __volatile__("restore %g0, %g0, %g0\n\t")
 
+extern void gr_handle_kernel_exploit(void);
+
 void die_if_kernel(char *str, struct pt_regs *regs)
 {
 	static int die_counter;
@@ -76,15 +78,17 @@
 		      count++ < 30				&&
                       (((unsigned long) rw) >= PAGE_OFFSET)	&&
 		      !(((unsigned long) rw) & 0x7)) {
-			printk("Caller[%08lx]: %pS\n", rw->ins[7],
+			printk("Caller[%08lx]: %pA\n", rw->ins[7],
 			       (void *) rw->ins[7]);
 			rw = (struct reg_window32 *)rw->ins[6];
 		}
 	}
 	printk("Instruction DUMP:");
 	instruction_dump ((unsigned long *) regs->pc);
-	if(regs->psr & PSR_PS)
+	if(regs->psr & PSR_PS) {
+		gr_handle_kernel_exploit();
 		do_exit(SIGKILL);
+	}
 	do_exit(SIGSEGV);
 }
 
diff -uriN linux-2.6.32.43/arch/sparc/kernel/traps_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/traps_64.c
--- linux-2.6.32.43/arch/sparc/kernel/traps_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/traps_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -73,7 +73,7 @@
 		       i + 1,
 		       p->trapstack[i].tstate, p->trapstack[i].tpc,
 		       p->trapstack[i].tnpc, p->trapstack[i].tt);
-		printk("TRAPLOG: TPC<%pS>\n", (void *) p->trapstack[i].tpc);
+		printk("TRAPLOG: TPC<%pA>\n", (void *) p->trapstack[i].tpc);
 	}
 }
 
@@ -93,6 +93,12 @@
 
 	lvl -= 0x100;
 	if (regs->tstate & TSTATE_PRIV) {
+
+#ifdef CONFIG_PAX_REFCOUNT
+		if (lvl == 6)
+			pax_report_refcount_overflow(regs);
+#endif
+
 		sprintf(buffer, "Kernel bad sw trap %lx", lvl);
 		die_if_kernel(buffer, regs);
 	}
@@ -111,11 +117,16 @@
 void bad_trap_tl1(struct pt_regs *regs, long lvl)
 {
 	char buffer[32];
-	
+
 	if (notify_die(DIE_TRAP_TL1, "bad trap tl1", regs,
 		       0, lvl, SIGTRAP) == NOTIFY_STOP)
 		return;
 
+#ifdef CONFIG_PAX_REFCOUNT
+	if (lvl == 6)
+		pax_report_refcount_overflow(regs);
+#endif
+
 	dump_tl1_traplog((struct tl1_traplog *)(regs + 1));
 
 	sprintf (buffer, "Bad trap %lx at tl>0", lvl);
@@ -1139,7 +1150,7 @@
 	       regs->tpc, regs->tnpc, regs->u_regs[UREG_I7], regs->tstate);
 	printk("%s" "ERROR(%d): ",
 	       (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id());
-	printk("TPC<%pS>\n", (void *) regs->tpc);
+	printk("TPC<%pA>\n", (void *) regs->tpc);
 	printk("%s" "ERROR(%d): M_SYND(%lx),  E_SYND(%lx)%s%s\n",
 	       (recoverable ? KERN_WARNING : KERN_CRIT), smp_processor_id(),
 	       (afsr & CHAFSR_M_SYNDROME) >> CHAFSR_M_SYNDROME_SHIFT,
@@ -1746,7 +1757,7 @@
 		       smp_processor_id(),
 		       (type & 0x1) ? 'I' : 'D',
 		       regs->tpc);
-		printk(KERN_EMERG "TPC<%pS>\n", (void *) regs->tpc);
+		printk(KERN_EMERG "TPC<%pA>\n", (void *) regs->tpc);
 		panic("Irrecoverable Cheetah+ parity error.");
 	}
 
@@ -1754,7 +1765,7 @@
 	       smp_processor_id(),
 	       (type & 0x1) ? 'I' : 'D',
 	       regs->tpc);
-	printk(KERN_WARNING "TPC<%pS>\n", (void *) regs->tpc);
+	printk(KERN_WARNING "TPC<%pA>\n", (void *) regs->tpc);
 }
 
 struct sun4v_error_entry {
@@ -1961,9 +1972,9 @@
 
 	printk(KERN_EMERG "SUN4V-ITLB: Error at TPC[%lx], tl %d\n",
 	       regs->tpc, tl);
-	printk(KERN_EMERG "SUN4V-ITLB: TPC<%pS>\n", (void *) regs->tpc);
+	printk(KERN_EMERG "SUN4V-ITLB: TPC<%pA>\n", (void *) regs->tpc);
 	printk(KERN_EMERG "SUN4V-ITLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
-	printk(KERN_EMERG "SUN4V-ITLB: O7<%pS>\n",
+	printk(KERN_EMERG "SUN4V-ITLB: O7<%pA>\n",
 	       (void *) regs->u_regs[UREG_I7]);
 	printk(KERN_EMERG "SUN4V-ITLB: vaddr[%lx] ctx[%lx] "
 	       "pte[%lx] error[%lx]\n",
@@ -1985,9 +1996,9 @@
 
 	printk(KERN_EMERG "SUN4V-DTLB: Error at TPC[%lx], tl %d\n",
 	       regs->tpc, tl);
-	printk(KERN_EMERG "SUN4V-DTLB: TPC<%pS>\n", (void *) regs->tpc);
+	printk(KERN_EMERG "SUN4V-DTLB: TPC<%pA>\n", (void *) regs->tpc);
 	printk(KERN_EMERG "SUN4V-DTLB: O7[%lx]\n", regs->u_regs[UREG_I7]);
-	printk(KERN_EMERG "SUN4V-DTLB: O7<%pS>\n",
+	printk(KERN_EMERG "SUN4V-DTLB: O7<%pA>\n",
 	       (void *) regs->u_regs[UREG_I7]);
 	printk(KERN_EMERG "SUN4V-DTLB: vaddr[%lx] ctx[%lx] "
 	       "pte[%lx] error[%lx]\n",
@@ -2191,7 +2202,7 @@
 			fp = (unsigned long)sf->fp + STACK_BIAS;
 		}
 
-		printk(" [%016lx] %pS\n", pc, (void *) pc);
+		printk(" [%016lx] %pA\n", pc, (void *) pc);
 	} while (++count < 16);
 }
 
@@ -2233,6 +2244,8 @@
 	return (struct reg_window *) (fp + STACK_BIAS);
 }
 
+extern void gr_handle_kernel_exploit(void);
+
 void die_if_kernel(char *str, struct pt_regs *regs)
 {
 	static int die_counter;
@@ -2260,7 +2273,7 @@
 		while (rw &&
 		       count++ < 30&&
 		       is_kernel_stack(current, rw)) {
-			printk("Caller[%016lx]: %pS\n", rw->ins[7],
+			printk("Caller[%016lx]: %pA\n", rw->ins[7],
 			       (void *) rw->ins[7]);
 
 			rw = kernel_stack_up(rw);
@@ -2273,8 +2286,11 @@
 		}
 		user_instruction_dump ((unsigned int __user *) regs->tpc);
 	}
-	if (regs->tstate & TSTATE_PRIV)
+	if (regs->tstate & TSTATE_PRIV) {
+		gr_handle_kernel_exploit();		
 		do_exit(SIGKILL);
+	}
+
 	do_exit(SIGSEGV);
 }
 EXPORT_SYMBOL(die_if_kernel);
diff -uriN linux-2.6.32.43/arch/sparc/kernel/una_asm_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/una_asm_64.S
--- linux-2.6.32.43/arch/sparc/kernel/una_asm_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/una_asm_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -127,7 +127,7 @@
 	wr	%o5, 0x0, %asi
 	retl
 	 mov	0, %o0
-	.size	__do_int_load, .-__do_int_load
+	.size	do_int_load, .-do_int_load
 
 	.section	__ex_table,"a"
 	.word		4b, __retl_efault
diff -uriN linux-2.6.32.43/arch/sparc/kernel/unaligned_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/unaligned_64.c
--- linux-2.6.32.43/arch/sparc/kernel/unaligned_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/kernel/unaligned_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -288,7 +288,7 @@
 	if (count < 5) {
 		last_time = jiffies;
 		count++;
-		printk("Kernel unaligned access at TPC[%lx] %pS\n",
+		printk("Kernel unaligned access at TPC[%lx] %pA\n",
 		       regs->tpc, (void *) regs->tpc);
 	}
 }
diff -uriN linux-2.6.32.43/arch/sparc/lib/atomic_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/lib/atomic_64.S
--- linux-2.6.32.43/arch/sparc/lib/atomic_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/lib/atomic_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -18,7 +18,12 @@
 atomic_add: /* %o0 = increment, %o1 = atomic_ptr */
 	BACKOFF_SETUP(%o2)
 1:	lduw	[%o1], %g1
-	add	%g1, %o0, %g7
+	addcc	%g1, %o0, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas	[%o1], %g1, %g7
 	cmp	%g1, %g7
 	bne,pn	%icc, 2f
@@ -28,12 +33,32 @@
 2:	BACKOFF_SPIN(%o2, %o3, 1b)
 	.size	atomic_add, .-atomic_add
 
+	.globl	atomic_add_unchecked
+	.type	atomic_add_unchecked,#function
+atomic_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
+	BACKOFF_SETUP(%o2)
+1:	lduw	[%o1], %g1
+	add	%g1, %o0, %g7
+	cas	[%o1], %g1, %g7
+	cmp	%g1, %g7
+	bne,pn	%icc, 2f
+	 nop
+	retl
+	 nop
+2:	BACKOFF_SPIN(%o2, %o3, 1b)
+	.size	atomic_add_unchecked, .-atomic_add_unchecked
+
 	.globl	atomic_sub
 	.type	atomic_sub,#function
 atomic_sub: /* %o0 = decrement, %o1 = atomic_ptr */
 	BACKOFF_SETUP(%o2)
 1:	lduw	[%o1], %g1
-	sub	%g1, %o0, %g7
+	subcc	%g1, %o0, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas	[%o1], %g1, %g7
 	cmp	%g1, %g7
 	bne,pn	%icc, 2f
@@ -43,12 +68,32 @@
 2:	BACKOFF_SPIN(%o2, %o3, 1b)
 	.size	atomic_sub, .-atomic_sub
 
+	.globl	atomic_sub_unchecked
+	.type	atomic_sub_unchecked,#function
+atomic_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
+	BACKOFF_SETUP(%o2)
+1:	lduw	[%o1], %g1
+	sub	%g1, %o0, %g7
+	cas	[%o1], %g1, %g7
+	cmp	%g1, %g7
+	bne,pn	%icc, 2f
+	 nop
+	retl
+	 nop
+2:	BACKOFF_SPIN(%o2, %o3, 1b)
+	.size	atomic_sub_unchecked, .-atomic_sub_unchecked
+
 	.globl	atomic_add_ret
 	.type	atomic_add_ret,#function
 atomic_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
 	BACKOFF_SETUP(%o2)
 1:	lduw	[%o1], %g1
-	add	%g1, %o0, %g7
+	addcc	%g1, %o0, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas	[%o1], %g1, %g7
 	cmp	%g1, %g7
 	bne,pn	%icc, 2f
@@ -59,12 +104,33 @@
 2:	BACKOFF_SPIN(%o2, %o3, 1b)
 	.size	atomic_add_ret, .-atomic_add_ret
 
+	.globl	atomic_add_ret_unchecked
+	.type	atomic_add_ret_unchecked,#function
+atomic_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
+	BACKOFF_SETUP(%o2)
+1:	lduw	[%o1], %g1
+	addcc	%g1, %o0, %g7
+	cas	[%o1], %g1, %g7
+	cmp	%g1, %g7
+	bne,pn	%icc, 2f
+	 add	%g7, %o0, %g7
+	sra	%g7, 0, %o0
+	retl
+	 nop
+2:	BACKOFF_SPIN(%o2, %o3, 1b)
+	.size	atomic_add_ret_unchecked, .-atomic_add_ret_unchecked
+
 	.globl	atomic_sub_ret
 	.type	atomic_sub_ret,#function
 atomic_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
 	BACKOFF_SETUP(%o2)
 1:	lduw	[%o1], %g1
-	sub	%g1, %o0, %g7
+	subcc	%g1, %o0, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas	[%o1], %g1, %g7
 	cmp	%g1, %g7
 	bne,pn	%icc, 2f
@@ -80,7 +146,12 @@
 atomic64_add: /* %o0 = increment, %o1 = atomic_ptr */
 	BACKOFF_SETUP(%o2)
 1:	ldx	[%o1], %g1
-	add	%g1, %o0, %g7
+	addcc	%g1, %o0, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%xcc, 6
+#endif
+
 	casx	[%o1], %g1, %g7
 	cmp	%g1, %g7
 	bne,pn	%xcc, 2f
@@ -90,12 +161,32 @@
 2:	BACKOFF_SPIN(%o2, %o3, 1b)
 	.size	atomic64_add, .-atomic64_add
 
+	.globl	atomic64_add_unchecked
+	.type	atomic64_add_unchecked,#function
+atomic64_add_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
+	BACKOFF_SETUP(%o2)
+1:	ldx	[%o1], %g1
+	addcc	%g1, %o0, %g7
+	casx	[%o1], %g1, %g7
+	cmp	%g1, %g7
+	bne,pn	%xcc, 2f
+	 nop
+	retl
+	 nop
+2:	BACKOFF_SPIN(%o2, %o3, 1b)
+	.size	atomic64_add_unchecked, .-atomic64_add_unchecked
+
 	.globl	atomic64_sub
 	.type	atomic64_sub,#function
 atomic64_sub: /* %o0 = decrement, %o1 = atomic_ptr */
 	BACKOFF_SETUP(%o2)
 1:	ldx	[%o1], %g1
-	sub	%g1, %o0, %g7
+	subcc	%g1, %o0, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%xcc, 6
+#endif
+
 	casx	[%o1], %g1, %g7
 	cmp	%g1, %g7
 	bne,pn	%xcc, 2f
@@ -105,12 +196,32 @@
 2:	BACKOFF_SPIN(%o2, %o3, 1b)
 	.size	atomic64_sub, .-atomic64_sub
 
+	.globl	atomic64_sub_unchecked
+	.type	atomic64_sub_unchecked,#function
+atomic64_sub_unchecked: /* %o0 = decrement, %o1 = atomic_ptr */
+	BACKOFF_SETUP(%o2)
+1:	ldx	[%o1], %g1
+	subcc	%g1, %o0, %g7
+	casx	[%o1], %g1, %g7
+	cmp	%g1, %g7
+	bne,pn	%xcc, 2f
+	 nop
+	retl
+	 nop
+2:	BACKOFF_SPIN(%o2, %o3, 1b)
+	.size	atomic64_sub_unchecked, .-atomic64_sub_unchecked
+
 	.globl	atomic64_add_ret
 	.type	atomic64_add_ret,#function
 atomic64_add_ret: /* %o0 = increment, %o1 = atomic_ptr */
 	BACKOFF_SETUP(%o2)
 1:	ldx	[%o1], %g1
-	add	%g1, %o0, %g7
+	addcc	%g1, %o0, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%xcc, 6
+#endif
+
 	casx	[%o1], %g1, %g7
 	cmp	%g1, %g7
 	bne,pn	%xcc, 2f
@@ -121,12 +232,33 @@
 2:	BACKOFF_SPIN(%o2, %o3, 1b)
 	.size	atomic64_add_ret, .-atomic64_add_ret
 
+	.globl	atomic64_add_ret_unchecked
+	.type	atomic64_add_ret_unchecked,#function
+atomic64_add_ret_unchecked: /* %o0 = increment, %o1 = atomic_ptr */
+	BACKOFF_SETUP(%o2)
+1:	ldx	[%o1], %g1
+	addcc	%g1, %o0, %g7
+	casx	[%o1], %g1, %g7
+	cmp	%g1, %g7
+	bne,pn	%xcc, 2f
+	 add	%g7, %o0, %g7
+	mov	%g7, %o0
+	retl
+	 nop
+2:	BACKOFF_SPIN(%o2, %o3, 1b)
+	.size	atomic64_add_ret_unchecked, .-atomic64_add_ret_unchecked
+
 	.globl	atomic64_sub_ret
 	.type	atomic64_sub_ret,#function
 atomic64_sub_ret: /* %o0 = decrement, %o1 = atomic_ptr */
 	BACKOFF_SETUP(%o2)
 1:	ldx	[%o1], %g1
-	sub	%g1, %o0, %g7
+	subcc	%g1, %o0, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%xcc, 6
+#endif
+
 	casx	[%o1], %g1, %g7
 	cmp	%g1, %g7
 	bne,pn	%xcc, 2f
diff -uriN linux-2.6.32.43/arch/sparc/lib/ksyms.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/lib/ksyms.c
--- linux-2.6.32.43/arch/sparc/lib/ksyms.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/lib/ksyms.c	2011-07-15 05:51:11.000000000 -0500
@@ -144,12 +144,17 @@
 
 /* Atomic counter implementation. */
 EXPORT_SYMBOL(atomic_add);
+EXPORT_SYMBOL(atomic_add_unchecked);
 EXPORT_SYMBOL(atomic_add_ret);
 EXPORT_SYMBOL(atomic_sub);
+EXPORT_SYMBOL(atomic_sub_unchecked);
 EXPORT_SYMBOL(atomic_sub_ret);
 EXPORT_SYMBOL(atomic64_add);
+EXPORT_SYMBOL(atomic64_add_unchecked);
 EXPORT_SYMBOL(atomic64_add_ret);
+EXPORT_SYMBOL(atomic64_add_ret_unchecked);
 EXPORT_SYMBOL(atomic64_sub);
+EXPORT_SYMBOL(atomic64_sub_unchecked);
 EXPORT_SYMBOL(atomic64_sub_ret);
 
 /* Atomic bit operations. */
diff -uriN linux-2.6.32.43/arch/sparc/lib/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/lib/Makefile
--- linux-2.6.32.43/arch/sparc/lib/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/lib/Makefile	2011-07-15 05:51:11.000000000 -0500
@@ -2,7 +2,7 @@
 #
 
 asflags-y := -ansi -DST_DIV0=0x02
-ccflags-y := -Werror
+#ccflags-y := -Werror
 
 lib-$(CONFIG_SPARC32) += mul.o rem.o sdiv.o udiv.o umul.o urem.o ashrdi3.o
 lib-$(CONFIG_SPARC32) += memcpy.o memset.o
diff -uriN linux-2.6.32.43/arch/sparc/lib/rwsem_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/lib/rwsem_64.S
--- linux-2.6.32.43/arch/sparc/lib/rwsem_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/lib/rwsem_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -11,7 +11,12 @@
 	.globl		__down_read
 __down_read:
 1:	lduw		[%o0], %g1
-	add		%g1, 1, %g7
+	addcc		%g1, 1, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas		[%o0], %g1, %g7
 	cmp		%g1, %g7
 	bne,pn		%icc, 1b
@@ -33,7 +38,12 @@
 	.globl		__down_read_trylock
 __down_read_trylock:
 1:	lduw		[%o0], %g1
-	add		%g1, 1, %g7
+	addcc		%g1, 1, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cmp		%g7, 0
 	bl,pn		%icc, 2f
 	 mov		0, %o1
@@ -51,7 +61,12 @@
 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
 1:
 	lduw		[%o0], %g3
-	add		%g3, %g1, %g7
+	addcc		%g3, %g1, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas		[%o0], %g3, %g7
 	cmp		%g3, %g7
 	bne,pn		%icc, 1b
@@ -77,7 +92,12 @@
 	cmp		%g3, 0
 	bne,pn		%icc, 2f
 	 mov		0, %o1
-	add		%g3, %g1, %g7
+	addcc		%g3, %g1, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas		[%o0], %g3, %g7
 	cmp		%g3, %g7
 	bne,pn		%icc, 1b
@@ -90,7 +110,12 @@
 __up_read:
 1:
 	lduw		[%o0], %g1
-	sub		%g1, 1, %g7
+	subcc		%g1, 1, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas		[%o0], %g1, %g7
 	cmp		%g1, %g7
 	bne,pn		%icc, 1b
@@ -118,7 +143,12 @@
 	or		%g1, %lo(RWSEM_ACTIVE_WRITE_BIAS), %g1
 1:
 	lduw		[%o0], %g3
-	sub		%g3, %g1, %g7
+	subcc		%g3, %g1, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas		[%o0], %g3, %g7
 	cmp		%g3, %g7
 	bne,pn		%icc, 1b
@@ -143,7 +173,12 @@
 	or		%g1, %lo(RWSEM_WAITING_BIAS), %g1
 1:
 	lduw		[%o0], %g3
-	sub		%g3, %g1, %g7
+	subcc		%g3, %g1, %g7
+
+#ifdef CONFIG_PAX_REFCOUNT
+	tvs	%icc, 6
+#endif
+
 	cas		[%o0], %g3, %g7
 	cmp		%g3, %g7
 	bne,pn		%icc, 1b
diff -uriN linux-2.6.32.43/arch/sparc/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/Makefile
--- linux-2.6.32.43/arch/sparc/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/Makefile	2011-07-15 05:51:11.000000000 -0500
@@ -75,7 +75,7 @@
 # Export what is needed by arch/sparc/boot/Makefile
 export VMLINUX_INIT VMLINUX_MAIN
 VMLINUX_INIT := $(head-y) $(init-y)
-VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/
+VMLINUX_MAIN := $(core-y) kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
 VMLINUX_MAIN += $(patsubst %/, %/lib.a, $(libs-y)) $(libs-y)
 VMLINUX_MAIN += $(drivers-y) $(net-y)
 
diff -uriN linux-2.6.32.43/arch/sparc/mm/fault_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/fault_32.c
--- linux-2.6.32.43/arch/sparc/mm/fault_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/fault_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -21,6 +21,9 @@
 #include <linux/interrupt.h>
 #include <linux/module.h>
 #include <linux/kdebug.h>
+#include <linux/slab.h>
+#include <linux/pagemap.h>
+#include <linux/compiler.h>
 
 #include <asm/system.h>
 #include <asm/page.h>
@@ -167,6 +170,267 @@
 	return safe_compute_effective_address(regs, insn);
 }
 
+#ifdef CONFIG_PAX_PAGEEXEC
+#ifdef CONFIG_PAX_DLRESOLVE
+static void pax_emuplt_close(struct vm_area_struct *vma)
+{
+	vma->vm_mm->call_dl_resolve = 0UL;
+}
+
+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+	unsigned int *kaddr;
+
+	vmf->page = alloc_page(GFP_HIGHUSER);
+	if (!vmf->page)
+		return VM_FAULT_OOM;
+
+	kaddr = kmap(vmf->page);
+	memset(kaddr, 0, PAGE_SIZE);
+	kaddr[0] = 0x9DE3BFA8U; /* save */
+	flush_dcache_page(vmf->page);
+	kunmap(vmf->page);
+	return VM_FAULT_MAJOR;
+}
+
+static const struct vm_operations_struct pax_vm_ops = {
+	.close = pax_emuplt_close,
+	.fault = pax_emuplt_fault
+};
+
+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
+{
+	int ret;
+
+	vma->vm_mm = current->mm;
+	vma->vm_start = addr;
+	vma->vm_end = addr + PAGE_SIZE;
+	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+	vma->vm_ops = &pax_vm_ops;
+
+	ret = insert_vm_struct(current->mm, vma);
+	if (ret)
+		return ret;
+
+	++current->mm->total_vm;
+	return 0;
+}
+#endif
+
+/*
+ * PaX: decide what to do with offenders (regs->pc = fault address)
+ *
+ * returns 1 when task should be killed
+ *         2 when patched PLT trampoline was detected
+ *         3 when unpatched PLT trampoline was detected
+ */
+static int pax_handle_fetch_fault(struct pt_regs *regs)
+{
+
+#ifdef CONFIG_PAX_EMUPLT
+	int err;
+
+	do { /* PaX: patched PLT emulation #1 */
+		unsigned int sethi1, sethi2, jmpl;
+
+		err = get_user(sethi1, (unsigned int *)regs->pc);
+		err |= get_user(sethi2, (unsigned int *)(regs->pc+4));
+		err |= get_user(jmpl, (unsigned int *)(regs->pc+8));
+
+		if (err)
+			break;
+
+		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
+		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
+		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
+		{
+			unsigned int addr;
+
+			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
+			addr = regs->u_regs[UREG_G1];
+			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
+			regs->pc = addr;
+			regs->npc = addr+4;
+			return 2;
+		}
+	} while (0);
+
+	{ /* PaX: patched PLT emulation #2 */
+		unsigned int ba;
+
+		err = get_user(ba, (unsigned int *)regs->pc);
+
+		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
+			unsigned int addr;
+
+			addr = regs->pc + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
+			regs->pc = addr;
+			regs->npc = addr+4;
+			return 2;
+		}
+	}
+
+	do { /* PaX: patched PLT emulation #3 */
+		unsigned int sethi, jmpl, nop;
+
+		err = get_user(sethi, (unsigned int *)regs->pc);
+		err |= get_user(jmpl, (unsigned int *)(regs->pc+4));
+		err |= get_user(nop, (unsigned int *)(regs->pc+8));
+
+		if (err)
+			break;
+
+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
+		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
+		    nop == 0x01000000U)
+		{
+			unsigned int addr;
+
+			addr = (sethi & 0x003FFFFFU) << 10;
+			regs->u_regs[UREG_G1] = addr;
+			addr += (((jmpl | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
+			regs->pc = addr;
+			regs->npc = addr+4;
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: unpatched PLT emulation step 1 */
+		unsigned int sethi, ba, nop;
+
+		err = get_user(sethi, (unsigned int *)regs->pc);
+		err |= get_user(ba, (unsigned int *)(regs->pc+4));
+		err |= get_user(nop, (unsigned int *)(regs->pc+8));
+
+		if (err)
+			break;
+
+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
+		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
+		    nop == 0x01000000U)
+		{
+			unsigned int addr, save, call;
+
+			if ((ba & 0xFFC00000U) == 0x30800000U)
+				addr = regs->pc + 4 + ((((ba | 0xFFC00000U) ^ 0x00200000U) + 0x00200000U) << 2);
+			else
+				addr = regs->pc + 4 + ((((ba | 0xFFF80000U) ^ 0x00040000U) + 0x00040000U) << 2);
+
+			err = get_user(save, (unsigned int *)addr);
+			err |= get_user(call, (unsigned int *)(addr+4));
+			err |= get_user(nop, (unsigned int *)(addr+8));
+			if (err)
+				break;
+
+#ifdef CONFIG_PAX_DLRESOLVE
+			if (save == 0x9DE3BFA8U &&
+			    (call & 0xC0000000U) == 0x40000000U &&
+			    nop == 0x01000000U)
+			{
+				struct vm_area_struct *vma;
+				unsigned long call_dl_resolve;
+
+				down_read(&current->mm->mmap_sem);
+				call_dl_resolve = current->mm->call_dl_resolve;
+				up_read(&current->mm->mmap_sem);
+				if (likely(call_dl_resolve))
+					goto emulate;
+
+				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+
+				down_write(&current->mm->mmap_sem);
+				if (current->mm->call_dl_resolve) {
+					call_dl_resolve = current->mm->call_dl_resolve;
+					up_write(&current->mm->mmap_sem);
+					if (vma)
+						kmem_cache_free(vm_area_cachep, vma);
+					goto emulate;
+				}
+
+				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
+				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
+					up_write(&current->mm->mmap_sem);
+					if (vma)
+						kmem_cache_free(vm_area_cachep, vma);
+					return 1;
+				}
+
+				if (pax_insert_vma(vma, call_dl_resolve)) {
+					up_write(&current->mm->mmap_sem);
+					kmem_cache_free(vm_area_cachep, vma);
+					return 1;
+				}
+
+				current->mm->call_dl_resolve = call_dl_resolve;
+				up_write(&current->mm->mmap_sem);
+
+emulate:
+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
+				regs->pc = call_dl_resolve;
+				regs->npc = addr+4;
+				return 3;
+			}
+#endif
+
+			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
+			if ((save & 0xFFC00000U) == 0x05000000U &&
+			    (call & 0xFFFFE000U) == 0x85C0A000U &&
+			    nop == 0x01000000U)
+			{
+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
+				regs->u_regs[UREG_G2] = addr + 4;
+				addr = (save & 0x003FFFFFU) << 10;
+				addr += (((call | 0xFFFFE000U) ^ 0x00001000U) + 0x00001000U);
+				regs->pc = addr;
+				regs->npc = addr+4;
+				return 3;
+			}
+		}
+	} while (0);
+
+	do { /* PaX: unpatched PLT emulation step 2 */
+		unsigned int save, call, nop;
+
+		err = get_user(save, (unsigned int *)(regs->pc-4));
+		err |= get_user(call, (unsigned int *)regs->pc);
+		err |= get_user(nop, (unsigned int *)(regs->pc+4));
+		if (err)
+			break;
+
+		if (save == 0x9DE3BFA8U &&
+		    (call & 0xC0000000U) == 0x40000000U &&
+		    nop == 0x01000000U)
+		{
+			unsigned int dl_resolve = regs->pc + ((((call | 0xC0000000U) ^ 0x20000000U) + 0x20000000U) << 2);
+
+			regs->u_regs[UREG_RETPC] = regs->pc;
+			regs->pc = dl_resolve;
+			regs->npc = dl_resolve+4;
+			return 3;
+		}
+	} while (0);
+#endif
+
+	return 1;
+}
+
+void pax_report_insns(void *pc, void *sp)
+{
+	unsigned long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 8; i++) {
+		unsigned int c;
+		if (get_user(c, (unsigned int *)pc+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%08x ", c);
+	}
+	printk("\n");
+}
+#endif
+
 asmlinkage void do_sparc_fault(struct pt_regs *regs, int text_fault, int write,
 			       unsigned long address)
 {
@@ -231,6 +495,24 @@
 		if(!(vma->vm_flags & VM_WRITE))
 			goto bad_area;
 	} else {
+
+#ifdef CONFIG_PAX_PAGEEXEC
+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && text_fault && !(vma->vm_flags & VM_EXEC)) {
+			up_read(&mm->mmap_sem);
+			switch (pax_handle_fetch_fault(regs)) {
+
+#ifdef CONFIG_PAX_EMUPLT
+			case 2:
+			case 3:
+				return;
+#endif
+
+			}
+			pax_report_fault(regs, (void *)regs->pc, (void *)regs->u_regs[UREG_FP]);
+			do_group_exit(SIGKILL);
+		}
+#endif
+
 		/* Allow reads even for write-only mappings */
 		if(!(vma->vm_flags & (VM_READ | VM_EXEC)))
 			goto bad_area;
diff -uriN linux-2.6.32.43/arch/sparc/mm/fault_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/fault_64.c
--- linux-2.6.32.43/arch/sparc/mm/fault_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/fault_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -20,6 +20,9 @@
 #include <linux/kprobes.h>
 #include <linux/kdebug.h>
 #include <linux/percpu.h>
+#include <linux/slab.h>
+#include <linux/pagemap.h>
+#include <linux/compiler.h>
 
 #include <asm/page.h>
 #include <asm/pgtable.h>
@@ -78,7 +81,7 @@
 	printk(KERN_CRIT "OOPS: Bogus kernel PC [%016lx] in fault handler\n",
 	       regs->tpc);
 	printk(KERN_CRIT "OOPS: RPC [%016lx]\n", regs->u_regs[15]);
-	printk("OOPS: RPC <%pS>\n", (void *) regs->u_regs[15]);
+	printk("OOPS: RPC <%pA>\n", (void *) regs->u_regs[15]);
 	printk(KERN_CRIT "OOPS: Fault was to vaddr[%lx]\n", vaddr);
 	dump_stack();
 	unhandled_fault(regs->tpc, current, regs);
@@ -249,6 +252,456 @@
 	show_regs(regs);
 }
 
+#ifdef CONFIG_PAX_PAGEEXEC
+#ifdef CONFIG_PAX_DLRESOLVE
+static void pax_emuplt_close(struct vm_area_struct *vma)
+{
+	vma->vm_mm->call_dl_resolve = 0UL;
+}
+
+static int pax_emuplt_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
+{
+	unsigned int *kaddr;
+
+	vmf->page = alloc_page(GFP_HIGHUSER);
+	if (!vmf->page)
+		return VM_FAULT_OOM;
+
+	kaddr = kmap(vmf->page);
+	memset(kaddr, 0, PAGE_SIZE);
+	kaddr[0] = 0x9DE3BFA8U; /* save */
+	flush_dcache_page(vmf->page);
+	kunmap(vmf->page);
+	return VM_FAULT_MAJOR;
+}
+
+static const struct vm_operations_struct pax_vm_ops = {
+	.close = pax_emuplt_close,
+	.fault = pax_emuplt_fault
+};
+
+static int pax_insert_vma(struct vm_area_struct *vma, unsigned long addr)
+{
+	int ret;
+
+	vma->vm_mm = current->mm;
+	vma->vm_start = addr;
+	vma->vm_end = addr + PAGE_SIZE;
+	vma->vm_flags = VM_READ | VM_EXEC | VM_MAYREAD | VM_MAYEXEC;
+	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+	vma->vm_ops = &pax_vm_ops;
+
+	ret = insert_vm_struct(current->mm, vma);
+	if (ret)
+		return ret;
+
+	++current->mm->total_vm;
+	return 0;
+}
+#endif
+
+/*
+ * PaX: decide what to do with offenders (regs->tpc = fault address)
+ *
+ * returns 1 when task should be killed
+ *         2 when patched PLT trampoline was detected
+ *         3 when unpatched PLT trampoline was detected
+ */
+static int pax_handle_fetch_fault(struct pt_regs *regs)
+{
+
+#ifdef CONFIG_PAX_EMUPLT
+	int err;
+
+	do { /* PaX: patched PLT emulation #1 */
+		unsigned int sethi1, sethi2, jmpl;
+
+		err = get_user(sethi1, (unsigned int *)regs->tpc);
+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+4));
+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+8));
+
+		if (err)
+			break;
+
+		if ((sethi1 & 0xFFC00000U) == 0x03000000U &&
+		    (sethi2 & 0xFFC00000U) == 0x03000000U &&
+		    (jmpl & 0xFFFFE000U) == 0x81C06000U)
+		{
+			unsigned long addr;
+
+			regs->u_regs[UREG_G1] = (sethi2 & 0x003FFFFFU) << 10;
+			addr = regs->u_regs[UREG_G1];
+			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
+
+			if (test_thread_flag(TIF_32BIT))
+				addr &= 0xFFFFFFFFUL;
+
+			regs->tpc = addr;
+			regs->tnpc = addr+4;
+			return 2;
+		}
+	} while (0);
+
+	{ /* PaX: patched PLT emulation #2 */
+		unsigned int ba;
+
+		err = get_user(ba, (unsigned int *)regs->tpc);
+
+		if (!err && (ba & 0xFFC00000U) == 0x30800000U) {
+			unsigned long addr;
+
+			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
+
+			if (test_thread_flag(TIF_32BIT))
+				addr &= 0xFFFFFFFFUL;
+
+			regs->tpc = addr;
+			regs->tnpc = addr+4;
+			return 2;
+		}
+	}
+
+	do { /* PaX: patched PLT emulation #3 */
+		unsigned int sethi, jmpl, nop;
+
+		err = get_user(sethi, (unsigned int *)regs->tpc);
+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+4));
+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
+
+		if (err)
+			break;
+
+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
+		    (jmpl & 0xFFFFE000U) == 0x81C06000U &&
+		    nop == 0x01000000U)
+		{
+			unsigned long addr;
+
+			addr = (sethi & 0x003FFFFFU) << 10;
+			regs->u_regs[UREG_G1] = addr;
+			addr += (((jmpl | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
+
+			if (test_thread_flag(TIF_32BIT))
+				addr &= 0xFFFFFFFFUL;
+
+			regs->tpc = addr;
+			regs->tnpc = addr+4;
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: patched PLT emulation #4 */
+		unsigned int sethi, mov1, call, mov2;
+
+		err = get_user(sethi, (unsigned int *)regs->tpc);
+		err |= get_user(mov1, (unsigned int *)(regs->tpc+4));
+		err |= get_user(call, (unsigned int *)(regs->tpc+8));
+		err |= get_user(mov2, (unsigned int *)(regs->tpc+12));
+
+		if (err)
+			break;
+
+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
+		    mov1 == 0x8210000FU &&
+		    (call & 0xC0000000U) == 0x40000000U &&
+		    mov2 == 0x9E100001U)
+		{
+			unsigned long addr;
+
+			regs->u_regs[UREG_G1] = regs->u_regs[UREG_RETPC];
+			addr = regs->tpc + 4 + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
+
+			if (test_thread_flag(TIF_32BIT))
+				addr &= 0xFFFFFFFFUL;
+
+			regs->tpc = addr;
+			regs->tnpc = addr+4;
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: patched PLT emulation #5 */
+		unsigned int sethi, sethi1, sethi2, or1, or2, sllx, jmpl, nop;
+
+		err = get_user(sethi, (unsigned int *)regs->tpc);
+		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
+		err |= get_user(or1, (unsigned int *)(regs->tpc+12));
+		err |= get_user(or2, (unsigned int *)(regs->tpc+16));
+		err |= get_user(sllx, (unsigned int *)(regs->tpc+20));
+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+24));
+		err |= get_user(nop, (unsigned int *)(regs->tpc+28));
+
+		if (err)
+			break;
+
+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
+		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
+		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
+		    (or1 & 0xFFFFE000U) == 0x82106000U &&
+		    (or2 & 0xFFFFE000U) == 0x8A116000U &&
+		    sllx == 0x83287020U &&
+		    jmpl == 0x81C04005U &&
+		    nop == 0x01000000U)
+		{
+			unsigned long addr;
+
+			regs->u_regs[UREG_G1] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
+			regs->u_regs[UREG_G1] <<= 32;
+			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
+			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
+			regs->tpc = addr;
+			regs->tnpc = addr+4;
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: patched PLT emulation #6 */
+		unsigned int sethi, sethi1, sethi2, sllx, or,  jmpl, nop;
+
+		err = get_user(sethi, (unsigned int *)regs->tpc);
+		err |= get_user(sethi1, (unsigned int *)(regs->tpc+4));
+		err |= get_user(sethi2, (unsigned int *)(regs->tpc+8));
+		err |= get_user(sllx, (unsigned int *)(regs->tpc+12));
+		err |= get_user(or, (unsigned int *)(regs->tpc+16));
+		err |= get_user(jmpl, (unsigned int *)(regs->tpc+20));
+		err |= get_user(nop, (unsigned int *)(regs->tpc+24));
+
+		if (err)
+			break;
+
+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
+		    (sethi1 & 0xFFC00000U) == 0x03000000U &&
+		    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
+		    sllx == 0x83287020U &&
+		    (or & 0xFFFFE000U) == 0x8A116000U &&
+		    jmpl == 0x81C04005U &&
+		    nop == 0x01000000U)
+		{
+			unsigned long addr;
+
+			regs->u_regs[UREG_G1] = (sethi1 & 0x003FFFFFU) << 10;
+			regs->u_regs[UREG_G1] <<= 32;
+			regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or & 0x3FFU);
+			addr = regs->u_regs[UREG_G1] + regs->u_regs[UREG_G5];
+			regs->tpc = addr;
+			regs->tnpc = addr+4;
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: unpatched PLT emulation step 1 */
+		unsigned int sethi, ba, nop;
+
+		err = get_user(sethi, (unsigned int *)regs->tpc);
+		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
+
+		if (err)
+			break;
+
+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
+		    ((ba & 0xFFC00000U) == 0x30800000U || (ba & 0xFFF80000U) == 0x30680000U) &&
+		    nop == 0x01000000U)
+		{
+			unsigned long addr;
+			unsigned int save, call;
+			unsigned int sethi1, sethi2, or1, or2, sllx, add, jmpl;
+
+			if ((ba & 0xFFC00000U) == 0x30800000U)
+				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFC00000UL) ^ 0x00200000UL) + 0x00200000UL) << 2);
+			else
+				addr = regs->tpc + 4 + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
+
+			if (test_thread_flag(TIF_32BIT))
+				addr &= 0xFFFFFFFFUL;
+
+			err = get_user(save, (unsigned int *)addr);
+			err |= get_user(call, (unsigned int *)(addr+4));
+			err |= get_user(nop, (unsigned int *)(addr+8));
+			if (err)
+				break;
+
+#ifdef CONFIG_PAX_DLRESOLVE
+			if (save == 0x9DE3BFA8U &&
+			    (call & 0xC0000000U) == 0x40000000U &&
+			    nop == 0x01000000U)
+			{
+				struct vm_area_struct *vma;
+				unsigned long call_dl_resolve;
+
+				down_read(&current->mm->mmap_sem);
+				call_dl_resolve = current->mm->call_dl_resolve;
+				up_read(&current->mm->mmap_sem);
+				if (likely(call_dl_resolve))
+					goto emulate;
+
+				vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+
+				down_write(&current->mm->mmap_sem);
+				if (current->mm->call_dl_resolve) {
+					call_dl_resolve = current->mm->call_dl_resolve;
+					up_write(&current->mm->mmap_sem);
+					if (vma)
+						kmem_cache_free(vm_area_cachep, vma);
+					goto emulate;
+				}
+
+				call_dl_resolve = get_unmapped_area(NULL, 0UL, PAGE_SIZE, 0UL, MAP_PRIVATE);
+				if (!vma || (call_dl_resolve & ~PAGE_MASK)) {
+					up_write(&current->mm->mmap_sem);
+					if (vma)
+						kmem_cache_free(vm_area_cachep, vma);
+					return 1;
+				}
+
+				if (pax_insert_vma(vma, call_dl_resolve)) {
+					up_write(&current->mm->mmap_sem);
+					kmem_cache_free(vm_area_cachep, vma);
+					return 1;
+				}
+
+				current->mm->call_dl_resolve = call_dl_resolve;
+				up_write(&current->mm->mmap_sem);
+
+emulate:
+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
+				regs->tpc = call_dl_resolve;
+				regs->tnpc = addr+4;
+				return 3;
+			}
+#endif
+
+			/* PaX: glibc 2.4+ generates sethi/jmpl instead of save/call */
+			if ((save & 0xFFC00000U) == 0x05000000U &&
+			    (call & 0xFFFFE000U) == 0x85C0A000U &&
+			    nop == 0x01000000U)
+			{
+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
+				regs->u_regs[UREG_G2] = addr + 4;
+				addr = (save & 0x003FFFFFU) << 10;
+				addr += (((call | 0xFFFFFFFFFFFFE000UL) ^ 0x00001000UL) + 0x00001000UL);
+
+				if (test_thread_flag(TIF_32BIT))
+					addr &= 0xFFFFFFFFUL;
+
+				regs->tpc = addr;
+				regs->tnpc = addr+4;
+				return 3;
+			}
+
+			/* PaX: 64-bit PLT stub */
+			err = get_user(sethi1, (unsigned int *)addr);
+			err |= get_user(sethi2, (unsigned int *)(addr+4));
+			err |= get_user(or1, (unsigned int *)(addr+8));
+			err |= get_user(or2, (unsigned int *)(addr+12));
+			err |= get_user(sllx, (unsigned int *)(addr+16));
+			err |= get_user(add, (unsigned int *)(addr+20));
+			err |= get_user(jmpl, (unsigned int *)(addr+24));
+			err |= get_user(nop, (unsigned int *)(addr+28));
+			if (err)
+				break;
+
+			if ((sethi1 & 0xFFC00000U) == 0x09000000U &&
+			    (sethi2 & 0xFFC00000U) == 0x0B000000U &&
+			    (or1 & 0xFFFFE000U) == 0x88112000U &&
+			    (or2 & 0xFFFFE000U) == 0x8A116000U &&
+			    sllx == 0x89293020U &&
+			    add == 0x8A010005U &&
+			    jmpl == 0x89C14000U &&
+			    nop == 0x01000000U)
+			{
+				regs->u_regs[UREG_G1] = (sethi & 0x003FFFFFU) << 10;
+				regs->u_regs[UREG_G4] = ((sethi1 & 0x003FFFFFU) << 10) | (or1 & 0x000003FFU);
+				regs->u_regs[UREG_G4] <<= 32;
+				regs->u_regs[UREG_G5] = ((sethi2 & 0x003FFFFFU) << 10) | (or2 & 0x000003FFU);
+				regs->u_regs[UREG_G5] += regs->u_regs[UREG_G4];
+				regs->u_regs[UREG_G4] = addr + 24;
+				addr = regs->u_regs[UREG_G5];
+				regs->tpc = addr;
+				regs->tnpc = addr+4;
+				return 3;
+			}
+		}
+	} while (0);
+
+#ifdef CONFIG_PAX_DLRESOLVE
+	do { /* PaX: unpatched PLT emulation step 2 */
+		unsigned int save, call, nop;
+
+		err = get_user(save, (unsigned int *)(regs->tpc-4));
+		err |= get_user(call, (unsigned int *)regs->tpc);
+		err |= get_user(nop, (unsigned int *)(regs->tpc+4));
+		if (err)
+			break;
+
+		if (save == 0x9DE3BFA8U &&
+		    (call & 0xC0000000U) == 0x40000000U &&
+		    nop == 0x01000000U)
+		{
+			unsigned long dl_resolve = regs->tpc + ((((call | 0xFFFFFFFFC0000000UL) ^ 0x20000000UL) + 0x20000000UL) << 2);
+
+			if (test_thread_flag(TIF_32BIT))
+				dl_resolve &= 0xFFFFFFFFUL;
+
+			regs->u_regs[UREG_RETPC] = regs->tpc;
+			regs->tpc = dl_resolve;
+			regs->tnpc = dl_resolve+4;
+			return 3;
+		}
+	} while (0);
+#endif
+
+	do { /* PaX: patched PLT emulation #7, must be AFTER the unpatched PLT emulation */
+		unsigned int sethi, ba, nop;
+
+		err = get_user(sethi, (unsigned int *)regs->tpc);
+		err |= get_user(ba, (unsigned int *)(regs->tpc+4));
+		err |= get_user(nop, (unsigned int *)(regs->tpc+8));
+
+		if (err)
+			break;
+
+		if ((sethi & 0xFFC00000U) == 0x03000000U &&
+		    (ba & 0xFFF00000U) == 0x30600000U &&
+		    nop == 0x01000000U)
+		{
+			unsigned long addr;
+
+			addr = (sethi & 0x003FFFFFU) << 10;
+			regs->u_regs[UREG_G1] = addr;
+			addr = regs->tpc + ((((ba | 0xFFFFFFFFFFF80000UL) ^ 0x00040000UL) + 0x00040000UL) << 2);
+
+			if (test_thread_flag(TIF_32BIT))
+				addr &= 0xFFFFFFFFUL;
+
+			regs->tpc = addr;
+			regs->tnpc = addr+4;
+			return 2;
+		}
+	} while (0);
+
+#endif
+
+	return 1;
+}
+
+void pax_report_insns(void *pc, void *sp)
+{
+	unsigned long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 8; i++) {
+		unsigned int c;
+		if (get_user(c, (unsigned int *)pc+i))
+			printk(KERN_CONT "???????? ");
+		else
+			printk(KERN_CONT "%08x ", c);
+	}
+	printk("\n");
+}
+#endif
+
 asmlinkage void __kprobes do_sparc64_fault(struct pt_regs *regs)
 {
 	struct mm_struct *mm = current->mm;
@@ -315,6 +768,29 @@
 	if (!vma)
 		goto bad_area;
 
+#ifdef CONFIG_PAX_PAGEEXEC
+	/* PaX: detect ITLB misses on non-exec pages */
+	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && vma->vm_start <= address &&
+	    !(vma->vm_flags & VM_EXEC) && (fault_code & FAULT_CODE_ITLB))
+	{
+		if (address != regs->tpc)
+			goto good_area;
+
+		up_read(&mm->mmap_sem);
+		switch (pax_handle_fetch_fault(regs)) {
+
+#ifdef CONFIG_PAX_EMUPLT
+		case 2:
+		case 3:
+			return;
+#endif
+
+		}
+		pax_report_fault(regs, (void *)regs->tpc, (void *)(regs->u_regs[UREG_FP] + STACK_BIAS));
+		do_group_exit(SIGKILL);
+	}
+#endif
+
 	/* Pure DTLB misses do not tell us whether the fault causing
 	 * load/store/atomic was a write or not, it only says that there
 	 * was no match.  So in such a case we (carefully) read the
diff -uriN linux-2.6.32.43/arch/sparc/mm/hugetlbpage.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/hugetlbpage.c
--- linux-2.6.32.43/arch/sparc/mm/hugetlbpage.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/hugetlbpage.c	2011-07-15 05:51:11.000000000 -0500
@@ -69,7 +69,7 @@
 			}
 			return -ENOMEM;
 		}
-		if (likely(!vma || addr + len <= vma->vm_start)) {
+		if (likely(check_heap_stack_gap(vma, addr, len))) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
@@ -108,7 +108,7 @@
 	/* make sure it can fit in the remaining address space */
 	if (likely(addr > len)) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start) {
+		if (check_heap_stack_gap(vma, addr - len, len)) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 		}
@@ -117,16 +117,17 @@
 	if (unlikely(mm->mmap_base < len))
 		goto bottomup;
 
-	addr = (mm->mmap_base-len) & HPAGE_MASK;
+	addr = mm->mmap_base - len;
 
 	do {
+		addr &= HPAGE_MASK;
 		/*
 		 * Lookup failure means no vma is above this address,
 		 * else if new region fits below vma->vm_start,
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (likely(!vma || addr+len <= vma->vm_start)) {
+		if (likely(check_heap_stack_gap(vma, addr, len))) {
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 		}
@@ -136,8 +137,8 @@
  		        mm->cached_hole_size = vma->vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = (vma->vm_start-len) & HPAGE_MASK;
-	} while (likely(len < vma->vm_start));
+		addr = skip_heap_stack_gap(vma, len);
+	} while (!IS_ERR_VALUE(addr));
 
 bottomup:
 	/*
@@ -183,8 +184,7 @@
 	if (addr) {
 		addr = ALIGN(addr, HPAGE_SIZE);
 		vma = find_vma(mm, addr);
-		if (task_size - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
 			return addr;
 	}
 	if (mm->get_unmapped_area == arch_get_unmapped_area)
diff -uriN linux-2.6.32.43/arch/sparc/mm/init_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/init_32.c
--- linux-2.6.32.43/arch/sparc/mm/init_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/init_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -317,6 +317,9 @@
 pgprot_t PAGE_SHARED __read_mostly;
 EXPORT_SYMBOL(PAGE_SHARED);
 
+pgprot_t PAGE_SHARED_NOEXEC __read_mostly;
+EXPORT_SYMBOL(PAGE_SHARED_NOEXEC);
+
 void __init paging_init(void)
 {
 	switch(sparc_cpu_model) {
@@ -345,17 +348,17 @@
 
 	/* Initialize the protection map with non-constant, MMU dependent values. */
 	protection_map[0] = PAGE_NONE;
-	protection_map[1] = PAGE_READONLY;
-	protection_map[2] = PAGE_COPY;
-	protection_map[3] = PAGE_COPY;
+	protection_map[1] = PAGE_READONLY_NOEXEC;
+	protection_map[2] = PAGE_COPY_NOEXEC;
+	protection_map[3] = PAGE_COPY_NOEXEC;
 	protection_map[4] = PAGE_READONLY;
 	protection_map[5] = PAGE_READONLY;
 	protection_map[6] = PAGE_COPY;
 	protection_map[7] = PAGE_COPY;
 	protection_map[8] = PAGE_NONE;
-	protection_map[9] = PAGE_READONLY;
-	protection_map[10] = PAGE_SHARED;
-	protection_map[11] = PAGE_SHARED;
+	protection_map[9] = PAGE_READONLY_NOEXEC;
+	protection_map[10] = PAGE_SHARED_NOEXEC;
+	protection_map[11] = PAGE_SHARED_NOEXEC;
 	protection_map[12] = PAGE_READONLY;
 	protection_map[13] = PAGE_READONLY;
 	protection_map[14] = PAGE_SHARED;
diff -uriN linux-2.6.32.43/arch/sparc/mm/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/Makefile
--- linux-2.6.32.43/arch/sparc/mm/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/Makefile	2011-07-15 05:51:11.000000000 -0500
@@ -2,7 +2,7 @@
 #
 
 asflags-y := -ansi
-ccflags-y := -Werror
+#ccflags-y := -Werror
 
 obj-$(CONFIG_SPARC64)   += ultra.o tlb.o tsb.o
 obj-y                   += fault_$(BITS).o
diff -uriN linux-2.6.32.43/arch/sparc/mm/srmmu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/srmmu.c
--- linux-2.6.32.43/arch/sparc/mm/srmmu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/sparc/mm/srmmu.c	2011-07-15 05:51:11.000000000 -0500
@@ -2200,6 +2200,13 @@
 	PAGE_SHARED = pgprot_val(SRMMU_PAGE_SHARED);
 	BTFIXUPSET_INT(page_copy, pgprot_val(SRMMU_PAGE_COPY));
 	BTFIXUPSET_INT(page_readonly, pgprot_val(SRMMU_PAGE_RDONLY));
+
+#ifdef CONFIG_PAX_PAGEEXEC
+	PAGE_SHARED_NOEXEC = pgprot_val(SRMMU_PAGE_SHARED_NOEXEC);
+	BTFIXUPSET_INT(page_copy_noexec, pgprot_val(SRMMU_PAGE_COPY_NOEXEC));
+	BTFIXUPSET_INT(page_readonly_noexec, pgprot_val(SRMMU_PAGE_RDONLY_NOEXEC));
+#endif
+
 	BTFIXUPSET_INT(page_kernel, pgprot_val(SRMMU_PAGE_KERNEL));
 	page_kernel = pgprot_val(SRMMU_PAGE_KERNEL);
 
diff -uriN linux-2.6.32.43/arch/um/include/asm/kmap_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/include/asm/kmap_types.h
--- linux-2.6.32.43/arch/um/include/asm/kmap_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/include/asm/kmap_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -23,6 +23,7 @@
 	KM_IRQ1,
 	KM_SOFTIRQ0,
 	KM_SOFTIRQ1,
+	KM_CLEARPAGE,
 	KM_TYPE_NR
 };
 
diff -uriN linux-2.6.32.43/arch/um/include/asm/page.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/include/asm/page.h
--- linux-2.6.32.43/arch/um/include/asm/page.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/include/asm/page.h	2011-07-15 05:51:11.000000000 -0500
@@ -14,6 +14,9 @@
 #define PAGE_SIZE	(_AC(1, UL) << PAGE_SHIFT)
 #define PAGE_MASK	(~(PAGE_SIZE-1))
 
+#define ktla_ktva(addr)			(addr)
+#define ktva_ktla(addr)			(addr)
+
 #ifndef __ASSEMBLY__
 
 struct page;
diff -uriN linux-2.6.32.43/arch/um/include/asm/tlb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/include/asm/tlb.h
--- linux-2.6.32.43/arch/um/include/asm/tlb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/include/asm/tlb.h	2011-07-15 05:50:11.000000000 -0500
@@ -3,6 +3,7 @@
 
 #include <linux/pagemap.h>
 #include <linux/swap.h>
+#include <linux/vs_memory.h>
 #include <asm/percpu.h>
 #include <asm/pgalloc.h>
 #include <asm/tlbflush.h>
diff -uriN linux-2.6.32.43/arch/um/Kconfig.rest linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/Kconfig.rest
--- linux-2.6.32.43/arch/um/Kconfig.rest	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/Kconfig.rest	2011-07-15 05:50:11.000000000 -0500
@@ -18,6 +18,8 @@
 
 source "fs/Kconfig"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/um/kernel/process.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/kernel/process.c
--- linux-2.6.32.43/arch/um/kernel/process.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/kernel/process.c	2011-07-15 05:51:11.000000000 -0500
@@ -393,22 +393,6 @@
 	return 2;
 }
 
-/*
- * Only x86 and x86_64 have an arch_align_stack().
- * All other arches have "#define arch_align_stack(x) (x)"
- * in their asm/system.h
- * As this is included in UML from asm-um/system-generic.h,
- * we can use it to behave as the subarch does.
- */
-#ifndef arch_align_stack
-unsigned long arch_align_stack(unsigned long sp)
-{
-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-		sp -= get_random_int() % 8192;
-	return sp & ~0xf;
-}
-#endif
-
 unsigned long get_wchan(struct task_struct *p)
 {
 	unsigned long stack_page, sp, ip;
diff -uriN linux-2.6.32.43/arch/um/sys-i386/syscalls.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/sys-i386/syscalls.c
--- linux-2.6.32.43/arch/um/sys-i386/syscalls.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/um/sys-i386/syscalls.c	2011-07-15 05:51:11.000000000 -0500
@@ -11,6 +11,21 @@
 #include "asm/uaccess.h"
 #include "asm/unistd.h"
 
+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
+{
+	unsigned long pax_task_size = TASK_SIZE;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
+	if (len > pax_task_size || addr > pax_task_size - len)
+		return -EINVAL;
+
+	return 0;
+}
+
 /*
  * Perform the select(nd, in, out, ex, tv) and mmap() system
  * calls. Linux/i386 didn't use to be able to handle more than
diff -uriN linux-2.6.32.43/arch/x86/boot/bitops.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/bitops.h
--- linux-2.6.32.43/arch/x86/boot/bitops.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/bitops.h	2011-07-15 05:51:11.000000000 -0500
@@ -26,7 +26,7 @@
 	u8 v;
 	const u32 *p = (const u32 *)addr;
 
-	asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
+	asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
 	return v;
 }
 
@@ -37,7 +37,7 @@
 
 static inline void set_bit(int nr, void *addr)
 {
-	asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
+	asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
 }
 
 #endif /* BOOT_BITOPS_H */
diff -uriN linux-2.6.32.43/arch/x86/boot/boot.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/boot.h
--- linux-2.6.32.43/arch/x86/boot/boot.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/boot.h	2011-07-15 05:51:11.000000000 -0500
@@ -82,7 +82,7 @@
 static inline u16 ds(void)
 {
 	u16 seg;
-	asm("movw %%ds,%0" : "=rm" (seg));
+	asm volatile("movw %%ds,%0" : "=rm" (seg));
 	return seg;
 }
 
@@ -178,7 +178,7 @@
 static inline int memcmp(const void *s1, const void *s2, size_t len)
 {
 	u8 diff;
-	asm("repe; cmpsb; setnz %0"
+	asm volatile("repe; cmpsb; setnz %0"
 	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
 	return diff;
 }
diff -uriN linux-2.6.32.43/arch/x86/boot/compressed/head_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/head_32.S
--- linux-2.6.32.43/arch/x86/boot/compressed/head_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/head_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -76,7 +76,7 @@
 	notl	%eax
 	andl    %eax, %ebx
 #else
-	movl	$LOAD_PHYSICAL_ADDR, %ebx
+	movl	$____LOAD_PHYSICAL_ADDR, %ebx
 #endif
 
 	/* Target address to relocate to for decompression */
@@ -149,7 +149,7 @@
  * and where it was actually loaded.
  */
 	movl	%ebp, %ebx
-	subl	$LOAD_PHYSICAL_ADDR, %ebx
+	subl	$____LOAD_PHYSICAL_ADDR, %ebx
 	jz	2f	/* Nothing to be done if loaded at compiled addr. */
 /*
  * Process relocations.
@@ -157,8 +157,7 @@
 
 1:	subl	$4, %edi
 	movl	(%edi), %ecx
-	testl	%ecx, %ecx
-	jz	2f
+	jecxz	2f
 	addl	%ebx, -__PAGE_OFFSET(%ebx, %ecx)
 	jmp	1b
 2:
diff -uriN linux-2.6.32.43/arch/x86/boot/compressed/head_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/head_64.S
--- linux-2.6.32.43/arch/x86/boot/compressed/head_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/head_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -91,7 +91,7 @@
 	notl	%eax
 	andl	%eax, %ebx
 #else
-	movl	$LOAD_PHYSICAL_ADDR, %ebx
+	movl	$____LOAD_PHYSICAL_ADDR, %ebx
 #endif
 
 	/* Target address to relocate to for decompression */
@@ -183,7 +183,7 @@
 	hlt
 	jmp     1b
 
-#include "../../kernel/verify_cpu_64.S"
+#include "../../kernel/verify_cpu.S"
 
 	/*
 	 * Be careful here startup_64 needs to be at a predictable
@@ -234,7 +234,7 @@
 	notq	%rax
 	andq	%rax, %rbp
 #else
-	movq	$LOAD_PHYSICAL_ADDR, %rbp
+	movq	$____LOAD_PHYSICAL_ADDR, %rbp
 #endif
 
 	/* Target address to relocate to for decompression */
diff -uriN linux-2.6.32.43/arch/x86/boot/compressed/misc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/misc.c
--- linux-2.6.32.43/arch/x86/boot/compressed/misc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/misc.c	2011-07-15 05:51:11.000000000 -0500
@@ -288,7 +288,7 @@
 		case PT_LOAD:
 #ifdef CONFIG_RELOCATABLE
 			dest = output;
-			dest += (phdr->p_paddr - LOAD_PHYSICAL_ADDR);
+			dest += (phdr->p_paddr - ____LOAD_PHYSICAL_ADDR);
 #else
 			dest = (void *)(phdr->p_paddr);
 #endif
@@ -335,7 +335,7 @@
 		error("Destination address too large");
 #endif
 #ifndef CONFIG_RELOCATABLE
-	if ((unsigned long)output != LOAD_PHYSICAL_ADDR)
+	if ((unsigned long)output != ____LOAD_PHYSICAL_ADDR)
 		error("Wrong destination address");
 #endif
 
diff -uriN linux-2.6.32.43/arch/x86/boot/compressed/mkpiggy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/mkpiggy.c
--- linux-2.6.32.43/arch/x86/boot/compressed/mkpiggy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/mkpiggy.c	2011-07-15 05:51:11.000000000 -0500
@@ -74,7 +74,7 @@
 
 	offs = (olen > ilen) ? olen - ilen : 0;
 	offs += olen >> 12;	/* Add 8 bytes for each 32K block */
-	offs += 32*1024 + 18;	/* Add 32K + 18 bytes slack */
+	offs += 64*1024;	/* Add 64K bytes slack */
 	offs = (offs+4095) & ~4095; /* Round to a 4K boundary */
 
 	printf(".section \".rodata.compressed\",\"a\",@progbits\n");
diff -uriN linux-2.6.32.43/arch/x86/boot/compressed/relocs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/relocs.c
--- linux-2.6.32.43/arch/x86/boot/compressed/relocs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/compressed/relocs.c	2011-07-15 05:51:11.000000000 -0500
@@ -10,8 +10,11 @@
 #define USE_BSD
 #include <endian.h>
 
+#include "../../../../include/linux/autoconf.h"
+
 #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
 static Elf32_Ehdr ehdr;
+static Elf32_Phdr *phdr;
 static unsigned long reloc_count, reloc_idx;
 static unsigned long *relocs;
 
@@ -37,7 +40,7 @@
 
 static int is_safe_abs_reloc(const char* sym_name)
 {
-	int i;
+	unsigned int i;
 
 	for (i = 0; i < ARRAY_SIZE(safe_abs_relocs); i++) {
 		if (!strcmp(sym_name, safe_abs_relocs[i]))
@@ -245,9 +248,39 @@
 	}
 }
 
+static void read_phdrs(FILE *fp)
+{
+	unsigned int i;
+
+	phdr = calloc(ehdr.e_phnum, sizeof(Elf32_Phdr));
+	if (!phdr) {
+		die("Unable to allocate %d program headers\n",
+		    ehdr.e_phnum);
+	}
+	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
+		die("Seek to %d failed: %s\n",
+			ehdr.e_phoff, strerror(errno));
+	}
+	if (fread(phdr, sizeof(*phdr), ehdr.e_phnum, fp) != ehdr.e_phnum) {
+		die("Cannot read ELF program headers: %s\n",
+			strerror(errno));
+	}
+	for(i = 0; i < ehdr.e_phnum; i++) {
+		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
+		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
+		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
+		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
+		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
+		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
+		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
+		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
+	}
+
+}
+
 static void read_shdrs(FILE *fp)
 {
-	int i;
+	unsigned int i;
 	Elf32_Shdr shdr;
 
 	secs = calloc(ehdr.e_shnum, sizeof(struct section));
@@ -282,7 +315,7 @@
 
 static void read_strtabs(FILE *fp)
 {
-	int i;
+	unsigned int i;
 	for (i = 0; i < ehdr.e_shnum; i++) {
 		struct section *sec = &secs[i];
 		if (sec->shdr.sh_type != SHT_STRTAB) {
@@ -307,7 +340,7 @@
 
 static void read_symtabs(FILE *fp)
 {
-	int i,j;
+	unsigned int i,j;
 	for (i = 0; i < ehdr.e_shnum; i++) {
 		struct section *sec = &secs[i];
 		if (sec->shdr.sh_type != SHT_SYMTAB) {
@@ -340,7 +373,9 @@
 
 static void read_relocs(FILE *fp)
 {
-	int i,j;
+	unsigned int i,j;
+	uint32_t base;
+
 	for (i = 0; i < ehdr.e_shnum; i++) {
 		struct section *sec = &secs[i];
 		if (sec->shdr.sh_type != SHT_REL) {
@@ -360,9 +395,18 @@
 			die("Cannot read symbol table: %s\n",
 				strerror(errno));
 		}
+		base = 0;
+		for (j = 0; j < ehdr.e_phnum; j++) {
+			if (phdr[j].p_type != PT_LOAD )
+				continue;
+			if (secs[sec->shdr.sh_info].shdr.sh_offset < phdr[j].p_offset || secs[sec->shdr.sh_info].shdr.sh_offset >= phdr[j].p_offset + phdr[j].p_filesz)
+				continue;
+			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
+			break;
+		}
 		for (j = 0; j < sec->shdr.sh_size/sizeof(Elf32_Rel); j++) {
 			Elf32_Rel *rel = &sec->reltab[j];
-			rel->r_offset = elf32_to_cpu(rel->r_offset);
+			rel->r_offset = elf32_to_cpu(rel->r_offset) + base;
 			rel->r_info   = elf32_to_cpu(rel->r_info);
 		}
 	}
@@ -371,14 +415,14 @@
 
 static void print_absolute_symbols(void)
 {
-	int i;
+	unsigned int i;
 	printf("Absolute symbols\n");
 	printf(" Num:    Value Size  Type       Bind        Visibility  Name\n");
 	for (i = 0; i < ehdr.e_shnum; i++) {
 		struct section *sec = &secs[i];
 		char *sym_strtab;
 		Elf32_Sym *sh_symtab;
-		int j;
+		unsigned int j;
 
 		if (sec->shdr.sh_type != SHT_SYMTAB) {
 			continue;
@@ -406,14 +450,14 @@
 
 static void print_absolute_relocs(void)
 {
-	int i, printed = 0;
+	unsigned int i, printed = 0;
 
 	for (i = 0; i < ehdr.e_shnum; i++) {
 		struct section *sec = &secs[i];
 		struct section *sec_applies, *sec_symtab;
 		char *sym_strtab;
 		Elf32_Sym *sh_symtab;
-		int j;
+		unsigned int j;
 		if (sec->shdr.sh_type != SHT_REL) {
 			continue;
 		}
@@ -474,13 +518,13 @@
 
 static void walk_relocs(void (*visit)(Elf32_Rel *rel, Elf32_Sym *sym))
 {
-	int i;
+	unsigned int i;
 	/* Walk through the relocations */
 	for (i = 0; i < ehdr.e_shnum; i++) {
 		char *sym_strtab;
 		Elf32_Sym *sh_symtab;
 		struct section *sec_applies, *sec_symtab;
-		int j;
+		unsigned int j;
 		struct section *sec = &secs[i];
 
 		if (sec->shdr.sh_type != SHT_REL) {
@@ -504,6 +548,21 @@
 			if (sym->st_shndx == SHN_ABS) {
 				continue;
 			}
+			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
+			if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strcmp(sym_name(sym_strtab, sym), "__per_cpu_load"))
+				continue;
+
+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_X86_32)
+			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
+			if (!strcmp(sec_name(sym->st_shndx), ".module.text") && !strcmp(sym_name(sym_strtab, sym), "_etext"))
+				continue;
+			if (!strcmp(sec_name(sym->st_shndx), ".init.text"))
+				continue;
+			if (!strcmp(sec_name(sym->st_shndx), ".exit.text"))
+				continue;
+			if (!strcmp(sec_name(sym->st_shndx), ".text") && strcmp(sym_name(sym_strtab, sym), "__LOAD_PHYSICAL_ADDR"))
+				continue;
+#endif
 			if (r_type == R_386_NONE || r_type == R_386_PC32) {
 				/*
 				 * NONE can be ignored and and PC relative
@@ -541,7 +600,7 @@
 
 static void emit_relocs(int as_text)
 {
-	int i;
+	unsigned int i;
 	/* Count how many relocations I have and allocate space for them. */
 	reloc_count = 0;
 	walk_relocs(count_reloc);
@@ -634,6 +693,7 @@
 			fname, strerror(errno));
 	}
 	read_ehdr(fp);
+	read_phdrs(fp);
 	read_shdrs(fp);
 	read_strtabs(fp);
 	read_symtabs(fp);
diff -uriN linux-2.6.32.43/arch/x86/boot/cpucheck.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/cpucheck.c
--- linux-2.6.32.43/arch/x86/boot/cpucheck.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/cpucheck.c	2011-07-15 05:51:11.000000000 -0500
@@ -74,7 +74,7 @@
 	u16 fcw = -1, fsw = -1;
 	u32 cr0;
 
-	asm("movl %%cr0,%0" : "=r" (cr0));
+	asm volatile("movl %%cr0,%0" : "=r" (cr0));
 	if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
 		cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
 		asm volatile("movl %0,%%cr0" : : "r" (cr0));
@@ -90,7 +90,7 @@
 {
 	u32 f0, f1;
 
-	asm("pushfl ; "
+	asm volatile("pushfl ; "
 	    "pushfl ; "
 	    "popl %0 ; "
 	    "movl %0,%1 ; "
@@ -115,7 +115,7 @@
 		set_bit(X86_FEATURE_FPU, cpu.flags);
 
 	if (has_eflag(X86_EFLAGS_ID)) {
-		asm("cpuid"
+		asm volatile("cpuid"
 		    : "=a" (max_intel_level),
 		      "=b" (cpu_vendor[0]),
 		      "=d" (cpu_vendor[1]),
@@ -124,7 +124,7 @@
 
 		if (max_intel_level >= 0x00000001 &&
 		    max_intel_level <= 0x0000ffff) {
-			asm("cpuid"
+			asm volatile("cpuid"
 			    : "=a" (tfms),
 			      "=c" (cpu.flags[4]),
 			      "=d" (cpu.flags[0])
@@ -136,7 +136,7 @@
 				cpu.model += ((tfms >> 16) & 0xf) << 4;
 		}
 
-		asm("cpuid"
+		asm volatile("cpuid"
 		    : "=a" (max_amd_level)
 		    : "a" (0x80000000)
 		    : "ebx", "ecx", "edx");
@@ -144,7 +144,7 @@
 		if (max_amd_level >= 0x80000001 &&
 		    max_amd_level <= 0x8000ffff) {
 			u32 eax = 0x80000001;
-			asm("cpuid"
+			asm volatile("cpuid"
 			    : "+a" (eax),
 			      "=c" (cpu.flags[6]),
 			      "=d" (cpu.flags[1])
@@ -203,9 +203,9 @@
 		u32 ecx = MSR_K7_HWCR;
 		u32 eax, edx;
 
-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
 		eax &= ~(1 << 15);
-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
 
 		get_flags();	/* Make sure it really did something */
 		err = check_flags();
@@ -218,9 +218,9 @@
 		u32 ecx = MSR_VIA_FCR;
 		u32 eax, edx;
 
-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
 		eax |= (1<<1)|(1<<7);
-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
 
 		set_bit(X86_FEATURE_CX8, cpu.flags);
 		err = check_flags();
@@ -231,12 +231,12 @@
 		u32 eax, edx;
 		u32 level = 1;
 
-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
-		asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
-		asm("cpuid"
+		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+		asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
+		asm volatile("cpuid"
 		    : "+a" (level), "=d" (cpu.flags[0])
 		    : : "ecx", "ebx");
-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
 
 		err = check_flags();
 	}
diff -uriN linux-2.6.32.43/arch/x86/boot/header.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/header.S
--- linux-2.6.32.43/arch/x86/boot/header.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/header.S	2011-07-15 05:51:11.000000000 -0500
@@ -224,7 +224,7 @@
 						# single linked list of
 						# struct setup_data
 
-pref_address:		.quad LOAD_PHYSICAL_ADDR	# preferred load addr
+pref_address:		.quad ____LOAD_PHYSICAL_ADDR	# preferred load addr
 
 #define ZO_INIT_SIZE	(ZO__end - ZO_startup_32 + ZO_z_extract_offset)
 #define VO_INIT_SIZE	(VO__end - VO__text)
diff -uriN linux-2.6.32.43/arch/x86/boot/memory.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/memory.c
--- linux-2.6.32.43/arch/x86/boot/memory.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/memory.c	2011-07-15 05:51:11.000000000 -0500
@@ -19,7 +19,7 @@
 
 static int detect_memory_e820(void)
 {
-	int count = 0;
+	unsigned int count = 0;
 	struct biosregs ireg, oreg;
 	struct e820entry *desc = boot_params.e820_map;
 	static struct e820entry buf; /* static so it is zeroed */
diff -uriN linux-2.6.32.43/arch/x86/boot/video.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/video.c
--- linux-2.6.32.43/arch/x86/boot/video.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/video.c	2011-07-15 05:51:11.000000000 -0500
@@ -90,7 +90,7 @@
 static unsigned int get_entry(void)
 {
 	char entry_buf[4];
-	int i, len = 0;
+	unsigned int i, len = 0;
 	int key;
 	unsigned int v;
 
diff -uriN linux-2.6.32.43/arch/x86/boot/video-vesa.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/video-vesa.c
--- linux-2.6.32.43/arch/x86/boot/video-vesa.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/boot/video-vesa.c	2011-07-15 05:51:11.000000000 -0500
@@ -200,6 +200,7 @@
 
 	boot_params.screen_info.vesapm_seg = oreg.es;
 	boot_params.screen_info.vesapm_off = oreg.di;
+	boot_params.screen_info.vesapm_size = oreg.cx;
 }
 
 /*
diff -uriN linux-2.6.32.43/arch/x86/ia32/ia32_aout.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/ia32/ia32_aout.c
--- linux-2.6.32.43/arch/x86/ia32/ia32_aout.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/ia32/ia32_aout.c	2011-07-15 05:51:11.000000000 -0500
@@ -169,6 +169,8 @@
 	unsigned long dump_start, dump_size;
 	struct user32 dump;
 
+	memset(&dump, 0, sizeof(dump));
+
 	fs = get_fs();
 	set_fs(KERNEL_DS);
 	has_dumped = 1;
@@ -218,12 +220,6 @@
 		dump_size = dump.u_ssize << PAGE_SHIFT;
 		DUMP_WRITE(dump_start, dump_size);
 	}
-	/*
-	 * Finally dump the task struct.  Not be used by gdb, but
-	 * could be useful
-	 */
-	set_fs(KERNEL_DS);
-	DUMP_WRITE(current, sizeof(*current));
 end_coredump:
 	set_fs(fs);
 	return has_dumped;
diff -uriN linux-2.6.32.43/arch/x86/ia32/ia32entry.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/ia32/ia32entry.S
--- linux-2.6.32.43/arch/x86/ia32/ia32entry.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/ia32/ia32entry.S	2011-07-15 05:51:11.000000000 -0500
@@ -13,6 +13,7 @@
 #include <asm/thread_info.h>	
 #include <asm/segment.h>
 #include <asm/irqflags.h>
+#include <asm/pgtable.h>
 #include <linux/linkage.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
@@ -93,6 +94,30 @@
 ENDPROC(native_irq_enable_sysexit)
 #endif
 
+	.macro pax_enter_kernel_user
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	call pax_enter_kernel_user
+#endif
+	.endm
+
+	.macro pax_exit_kernel_user
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	call pax_exit_kernel_user
+#endif
+#ifdef CONFIG_PAX_RANDKSTACK
+	pushq %rax
+	call pax_randomize_kstack
+	popq %rax
+#endif
+	pax_erase_kstack
+	.endm
+
+.macro pax_erase_kstack
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+	call pax_erase_kstack
+#endif
+.endm
+
 /*
  * 32bit SYSENTER instruction entry.
  *
@@ -119,7 +144,7 @@
 	CFI_REGISTER	rsp,rbp
 	SWAPGS_UNSAFE_STACK
 	movq	PER_CPU_VAR(kernel_stack), %rsp
-	addq	$(KERNEL_STACK_OFFSET),%rsp
+	pax_enter_kernel_user
 	/*
 	 * No need to follow this irqs on/off section: the syscall
 	 * disabled irqs, here we enable it straight after entry:
@@ -135,7 +160,8 @@
 	pushfq
 	CFI_ADJUST_CFA_OFFSET 8
 	/*CFI_REL_OFFSET rflags,0*/
-	movl	8*3-THREAD_SIZE+TI_sysenter_return(%rsp), %r10d
+	GET_THREAD_INFO(%r10)
+	movl	TI_sysenter_return(%r10), %r10d
 	CFI_REGISTER rip,r10
 	pushq	$__USER32_CS
 	CFI_ADJUST_CFA_OFFSET 8
@@ -150,6 +176,12 @@
 	SAVE_ARGS 0,0,1
  	/* no need to do an access_ok check here because rbp has been
  	   32bit zero extended */ 
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	mov $PAX_USER_SHADOW_BASE,%r10
+	add %r10,%rbp
+#endif
+
 1:	movl	(%rbp),%ebp
  	.section __ex_table,"a"
  	.quad 1b,ia32_badarg
@@ -172,6 +204,7 @@
 	testl	$_TIF_ALLWORK_MASK,TI_flags(%r10)
 	jnz	sysexit_audit
 sysexit_from_sys_call:
+	pax_exit_kernel_user
 	andl    $~TS_COMPAT,TI_status(%r10)
 	/* clear IF, that popfq doesn't enable interrupts early */
 	andl  $~0x200,EFLAGS-R11(%rsp) 
@@ -200,6 +233,9 @@
 	movl %eax,%esi			/* 2nd arg: syscall number */
 	movl $AUDIT_ARCH_I386,%edi	/* 1st arg: audit arch */
 	call audit_syscall_entry
+
+	pax_erase_kstack
+
 	movl RAX-ARGOFFSET(%rsp),%eax	/* reload syscall number */
 	cmpq $(IA32_NR_syscalls-1),%rax
 	ja ia32_badsys
@@ -252,6 +288,9 @@
 	movq	$-ENOSYS,RAX(%rsp)/* ptrace can change this for a bad syscall */
 	movq	%rsp,%rdi        /* &pt_regs -> arg1 */
 	call	syscall_trace_enter
+
+	pax_erase_kstack
+
 	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
 	RESTORE_REST
 	cmpq	$(IA32_NR_syscalls-1),%rax
@@ -283,19 +322,24 @@
 ENTRY(ia32_cstar_target)
 	CFI_STARTPROC32	simple
 	CFI_SIGNAL_FRAME
-	CFI_DEF_CFA	rsp,KERNEL_STACK_OFFSET
+	CFI_DEF_CFA	rsp,0
 	CFI_REGISTER	rip,rcx
 	/*CFI_REGISTER	rflags,r11*/
 	SWAPGS_UNSAFE_STACK
 	movl	%esp,%r8d
 	CFI_REGISTER	rsp,r8
 	movq	PER_CPU_VAR(kernel_stack),%rsp
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pax_enter_kernel_user
+#endif
+
 	/*
 	 * No need to follow this irqs on/off section: the syscall
 	 * disabled irqs and here we enable it straight after entry:
 	 */
 	ENABLE_INTERRUPTS(CLBR_NONE)
-	SAVE_ARGS 8,1,1
+	SAVE_ARGS 8*6,1,1
 	movl 	%eax,%eax	/* zero extension */
 	movq	%rax,ORIG_RAX-ARGOFFSET(%rsp)
 	movq	%rcx,RIP-ARGOFFSET(%rsp)
@@ -311,6 +355,12 @@
 	/* no need to do an access_ok check here because r8 has been
 	   32bit zero extended */ 
 	/* hardware stack frame is complete now */	
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	mov $PAX_USER_SHADOW_BASE,%r10
+	add %r10,%r8
+#endif
+
 1:	movl	(%r8),%r9d
 	.section __ex_table,"a"
 	.quad 1b,ia32_badarg
@@ -333,6 +383,7 @@
 	testl $_TIF_ALLWORK_MASK,TI_flags(%r10)
 	jnz sysretl_audit
 sysretl_from_sys_call:
+	pax_exit_kernel_user
 	andl $~TS_COMPAT,TI_status(%r10)
 	RESTORE_ARGS 1,-ARG_SKIP,1,1,1
 	movl RIP-ARGOFFSET(%rsp),%ecx
@@ -370,6 +421,9 @@
 	movq $-ENOSYS,RAX(%rsp)	/* ptrace can change this for a bad syscall */
 	movq %rsp,%rdi        /* &pt_regs -> arg1 */
 	call syscall_trace_enter
+
+	pax_erase_kstack
+
 	LOAD_ARGS32 ARGOFFSET, 1  /* reload args from stack in case ptrace changed it */
 	RESTORE_REST
 	xchgl %ebp,%r9d
@@ -415,6 +469,7 @@
 	CFI_REL_OFFSET	rip,RIP-RIP
 	PARAVIRT_ADJUST_EXCEPTION_FRAME
 	SWAPGS
+	pax_enter_kernel_user
 	/*
 	 * No need to follow this irqs on/off section: the syscall
 	 * disabled irqs and here we enable it straight after entry:
@@ -448,6 +503,9 @@
 	movq $-ENOSYS,RAX(%rsp)	/* ptrace can change this for a bad syscall */
 	movq %rsp,%rdi        /* &pt_regs -> arg1 */
 	call syscall_trace_enter
+
+	pax_erase_kstack
+
 	LOAD_ARGS32 ARGOFFSET  /* reload args from stack in case ptrace changed it */
 	RESTORE_REST
 	cmpq $(IA32_NR_syscalls-1),%rax
@@ -783,7 +841,7 @@
 	.quad sys_tgkill		/* 270 */
 	.quad compat_sys_utimes
 	.quad sys32_fadvise64_64
-	.quad quiet_ni_syscall	/* sys_vserver */
+	.quad sys32_vserver
 	.quad sys_mbind
 	.quad compat_sys_get_mempolicy	/* 275 */
 	.quad sys_set_mempolicy
diff -uriN linux-2.6.32.43/arch/x86/ia32/ia32_signal.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/ia32/ia32_signal.c
--- linux-2.6.32.43/arch/x86/ia32/ia32_signal.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/ia32/ia32_signal.c	2011-07-15 05:51:11.000000000 -0500
@@ -403,7 +403,7 @@
 	sp -= frame_size;
 	/* Align the stack pointer according to the i386 ABI,
 	 * i.e. so that on function entry ((sp + 4) & 15) == 0. */
-	sp = ((sp + 4) & -16ul) - 4;
+	sp = ((sp - 12) & -16ul) - 4;
 	return (void __user *) sp;
 }
 
@@ -461,7 +461,7 @@
 		 * These are actually not used anymore, but left because some
 		 * gdb versions depend on them as a marker.
 		 */
-		put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
+		put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
 	} put_user_catch(err);
 
 	if (err)
@@ -503,7 +503,7 @@
 		0xb8,
 		__NR_ia32_rt_sigreturn,
 		0x80cd,
-		0,
+		0
 	};
 
 	frame = get_sigframe(ka, regs, sizeof(*frame), &fpstate);
@@ -533,16 +533,18 @@
 
 		if (ka->sa.sa_flags & SA_RESTORER)
 			restorer = ka->sa.sa_restorer;
+		else if (current->mm->context.vdso)
+			/* Return stub is in 32bit vsyscall page */
+			restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
 		else
-			restorer = VDSO32_SYMBOL(current->mm->context.vdso,
-						 rt_sigreturn);
+			restorer = &frame->retcode;
 		put_user_ex(ptr_to_compat(restorer), &frame->pretcode);
 
 		/*
 		 * Not actually used anymore, but left because some gdb
 		 * versions need it.
 		 */
-		put_user_ex(*((u64 *)&code), (u64 *)frame->retcode);
+		put_user_ex(*((const u64 *)&code), (u64 *)frame->retcode);
 	} put_user_catch(err);
 
 	if (err)
diff -uriN linux-2.6.32.43/arch/x86/include/asm/alternative.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/alternative.h
--- linux-2.6.32.43/arch/x86/include/asm/alternative.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/alternative.h	2011-07-15 05:51:11.000000000 -0500
@@ -85,7 +85,7 @@
       "	 .byte 662b-661b\n"			/* sourcelen       */	\
       "	 .byte 664f-663f\n"			/* replacementlen  */	\
       ".previous\n"							\
-      ".section .altinstr_replacement, \"ax\"\n"			\
+      ".section .altinstr_replacement, \"a\"\n"			\
       "663:\n\t" newinstr "\n664:\n"		/* replacement     */	\
       ".previous"
 
diff -uriN linux-2.6.32.43/arch/x86/include/asm/apm.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/apm.h
--- linux-2.6.32.43/arch/x86/include/asm/apm.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/apm.h	2011-07-15 05:51:11.000000000 -0500
@@ -34,7 +34,7 @@
 	__asm__ __volatile__(APM_DO_ZERO_SEGS
 		"pushl %%edi\n\t"
 		"pushl %%ebp\n\t"
-		"lcall *%%cs:apm_bios_entry\n\t"
+		"lcall *%%ss:apm_bios_entry\n\t"
 		"setc %%al\n\t"
 		"popl %%ebp\n\t"
 		"popl %%edi\n\t"
@@ -58,7 +58,7 @@
 	__asm__ __volatile__(APM_DO_ZERO_SEGS
 		"pushl %%edi\n\t"
 		"pushl %%ebp\n\t"
-		"lcall *%%cs:apm_bios_entry\n\t"
+		"lcall *%%ss:apm_bios_entry\n\t"
 		"setc %%bl\n\t"
 		"popl %%ebp\n\t"
 		"popl %%edi\n\t"
diff -uriN linux-2.6.32.43/arch/x86/include/asm/atomic_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/atomic_32.h
--- linux-2.6.32.43/arch/x86/include/asm/atomic_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/atomic_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -25,6 +25,17 @@
 }
 
 /**
+ * atomic_read_unchecked - read atomic variable
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically reads the value of @v.
+ */
+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
+{
+	return v->counter;
+}
+
+/**
  * atomic_set - set atomic variable
  * @v: pointer of type atomic_t
  * @i: required value
@@ -37,6 +48,18 @@
 }
 
 /**
+ * atomic_set_unchecked - set atomic variable
+ * @v: pointer of type atomic_unchecked_t
+ * @i: required value
+ *
+ * Atomically sets the value of @v to @i.
+ */
+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
+{
+	v->counter = i;
+}
+
+/**
  * atomic_add - add integer to atomic variable
  * @i: integer value to add
  * @v: pointer of type atomic_t
@@ -45,7 +68,29 @@
  */
 static inline void atomic_add(int i, atomic_t *v)
 {
-	asm volatile(LOCK_PREFIX "addl %1,%0"
+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "subl %1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "+m" (v->counter)
+		     : "ir" (i));
+}
+
+/**
+ * atomic_add_unchecked - add integer to atomic variable
+ * @i: integer value to add
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically adds @i to @v.
+ */
+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
 		     : "+m" (v->counter)
 		     : "ir" (i));
 }
@@ -59,7 +104,29 @@
  */
 static inline void atomic_sub(int i, atomic_t *v)
 {
-	asm volatile(LOCK_PREFIX "subl %1,%0"
+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "addl %1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "+m" (v->counter)
+		     : "ir" (i));
+}
+
+/**
+ * atomic_sub_unchecked - subtract integer from atomic variable
+ * @i: integer value to subtract
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically subtracts @i from @v.
+ */
+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
 		     : "+m" (v->counter)
 		     : "ir" (i));
 }
@@ -77,7 +144,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
+	asm volatile(LOCK_PREFIX "subl %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "addl %2,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "+m" (v->counter), "=qm" (c)
 		     : "ir" (i) : "memory");
 	return c;
@@ -91,7 +167,27 @@
  */
 static inline void atomic_inc(atomic_t *v)
 {
-	asm volatile(LOCK_PREFIX "incl %0"
+	asm volatile(LOCK_PREFIX "incl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "decl %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "+m" (v->counter));
+}
+
+/**
+ * atomic_inc_unchecked - increment atomic variable
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically increments @v by 1.
+ */
+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "incl %0\n"
 		     : "+m" (v->counter));
 }
 
@@ -103,7 +199,27 @@
  */
 static inline void atomic_dec(atomic_t *v)
 {
-	asm volatile(LOCK_PREFIX "decl %0"
+	asm volatile(LOCK_PREFIX "decl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "incl %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "+m" (v->counter));
+}
+
+/**
+ * atomic_dec_unchecked - decrement atomic variable
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically decrements @v by 1.
+ */
+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "decl %0\n"
 		     : "+m" (v->counter));
 }
 
@@ -119,7 +235,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "decl %0; sete %1"
+	asm volatile(LOCK_PREFIX "decl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "incl %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "+m" (v->counter), "=qm" (c)
 		     : : "memory");
 	return c != 0;
@@ -137,7 +262,35 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "incl %0; sete %1"
+	asm volatile(LOCK_PREFIX "incl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "decl %0\n"
+		     "into\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
+		     : "+m" (v->counter), "=qm" (c)
+		     : : "memory");
+	return c != 0;
+}
+
+/**
+ * atomic_inc_and_test_unchecked - increment and test
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically increments @v by 1
+ * and returns true if the result is zero, or false for all
+ * other cases.
+ */
+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
+{
+	unsigned char c;
+
+	asm volatile(LOCK_PREFIX "incl %0\n"
+		     "sete %1\n"
 		     : "+m" (v->counter), "=qm" (c)
 		     : : "memory");
 	return c != 0;
@@ -156,7 +309,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
+	asm volatile(LOCK_PREFIX "addl %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "subl %2,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sets %1\n"
 		     : "+m" (v->counter), "=qm" (c)
 		     : "ir" (i) : "memory");
 	return c;
@@ -179,6 +341,46 @@
 #endif
 	/* Modern 486+ processor */
 	__i = i;
+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     "movl %0, %1\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "+r" (i), "+m" (v->counter)
+		     : : "memory");
+	return i + __i;
+
+#ifdef CONFIG_M386
+no_xadd: /* Legacy 386 processor */
+	local_irq_save(flags);
+	__i = atomic_read(v);
+	atomic_set(v, i + __i);
+	local_irq_restore(flags);
+	return i + __i;
+#endif
+}
+
+/**
+ * atomic_add_return_unchecked - add integer and return
+ * @v: pointer of type atomic_unchecked_t
+ * @i: integer value to add
+ *
+ * Atomically adds @i to @v and returns @i + @v
+ */
+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
+{
+	int __i;
+#ifdef CONFIG_M386
+	unsigned long flags;
+	if (unlikely(boot_cpu_data.x86 <= 3))
+		goto no_xadd;
+#endif
+	/* Modern 486+ processor */
+	__i = i;
 	asm volatile(LOCK_PREFIX "xaddl %0, %1"
 		     : "+r" (i), "+m" (v->counter)
 		     : : "memory");
@@ -211,11 +413,21 @@
 	return cmpxchg(&v->counter, old, new);
 }
 
+static inline int atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
+{
+	return cmpxchg(&v->counter, old, new);
+}
+
 static inline int atomic_xchg(atomic_t *v, int new)
 {
 	return xchg(&v->counter, new);
 }
 
+static inline int atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
+{
+	return xchg(&v->counter, new);
+}
+
 /**
  * atomic_add_unless - add unless the number is already a given value
  * @v: pointer of type atomic_t
@@ -227,22 +439,39 @@
  */
 static inline int atomic_add_unless(atomic_t *v, int a, int u)
 {
-	int c, old;
+	int c, old, new;
 	c = atomic_read(v);
 	for (;;) {
-		if (unlikely(c == (u)))
+		if (unlikely(c == u))
 			break;
-		old = atomic_cmpxchg((v), c, c + (a));
+
+		asm volatile("addl %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+			     "jno 0f\n"
+			     "subl %2,%0\n"
+			     "int $4\n0:\n"
+			     _ASM_EXTABLE(0b, 0b)
+#endif
+
+			     : "=r" (new)
+			     : "0" (c), "ir" (a));
+
+		old = atomic_cmpxchg(v, c, new);
 		if (likely(old == c))
 			break;
 		c = old;
 	}
-	return c != (u);
+	return c != u;
 }
 
 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
 
 #define atomic_inc_return(v)  (atomic_add_return(1, v))
+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
+{
+	return atomic_add_return_unchecked(1, v);
+}
 #define atomic_dec_return(v)  (atomic_sub_return(1, v))
 
 /* These are x86-specific, used by some header files */
@@ -266,9 +495,18 @@
 	u64 __aligned(8) counter;
 } atomic64_t;
 
+#ifdef CONFIG_PAX_REFCOUNT
+typedef struct {
+	u64 __aligned(8) counter;
+} atomic64_unchecked_t;
+#else
+typedef atomic64_t atomic64_unchecked_t;
+#endif
+
 #define ATOMIC64_INIT(val)	{ (val) }
 
 extern u64 atomic64_cmpxchg(atomic64_t *ptr, u64 old_val, u64 new_val);
+extern u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val);
 
 /**
  * atomic64_xchg - xchg atomic64 variable
@@ -279,6 +517,7 @@
  * the old value.
  */
 extern u64 atomic64_xchg(atomic64_t *ptr, u64 new_val);
+extern u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
 
 /**
  * atomic64_set - set atomic64 variable
@@ -290,6 +529,15 @@
 extern void atomic64_set(atomic64_t *ptr, u64 new_val);
 
 /**
+ * atomic64_unchecked_set - set atomic64 variable
+ * @ptr:      pointer to type atomic64_unchecked_t
+ * @new_val:  value to assign
+ *
+ * Atomically sets the value of @ptr to @new_val.
+ */
+extern void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val);
+
+/**
  * atomic64_read - read atomic64 variable
  * @ptr:      pointer to type atomic64_t
  *
@@ -317,7 +565,33 @@
 	return res;
 }
 
-extern u64 atomic64_read(atomic64_t *ptr);
+/**
+ * atomic64_read_unchecked - read atomic64 variable
+ * @ptr:      pointer to type atomic64_unchecked_t
+ *
+ * Atomically reads the value of @ptr and returns it.
+ */
+static inline u64 atomic64_read_unchecked(atomic64_unchecked_t *ptr)
+{
+	u64 res;
+
+	/*
+	 * Note, we inline this atomic64_unchecked_t primitive because
+	 * it only clobbers EAX/EDX and leaves the others
+	 * untouched. We also (somewhat subtly) rely on the
+	 * fact that cmpxchg8b returns the current 64-bit value
+	 * of the memory location we are touching:
+	 */
+	asm volatile(
+		"mov %%ebx, %%eax\n\t"
+		"mov %%ecx, %%edx\n\t"
+		LOCK_PREFIX "cmpxchg8b %1\n"
+			: "=&A" (res)
+			: "m" (*ptr)
+		);
+
+	return res;
+}
 
 /**
  * atomic64_add_return - add and return
@@ -332,8 +606,11 @@
  * Other variants with different arithmetic operators:
  */
 extern u64 atomic64_sub_return(u64 delta, atomic64_t *ptr);
+extern u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr);
 extern u64 atomic64_inc_return(atomic64_t *ptr);
+extern u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr);
 extern u64 atomic64_dec_return(atomic64_t *ptr);
+extern u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr);
 
 /**
  * atomic64_add - add integer to atomic64 variable
@@ -345,6 +622,15 @@
 extern void atomic64_add(u64 delta, atomic64_t *ptr);
 
 /**
+ * atomic64_add_unchecked - add integer to atomic64 variable
+ * @delta: integer value to add
+ * @ptr:   pointer to type atomic64_unchecked_t
+ *
+ * Atomically adds @delta to @ptr.
+ */
+extern void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr);
+
+/**
  * atomic64_sub - subtract the atomic64 variable
  * @delta: integer value to subtract
  * @ptr:   pointer to type atomic64_t
@@ -354,6 +640,15 @@
 extern void atomic64_sub(u64 delta, atomic64_t *ptr);
 
 /**
+ * atomic64_sub_unchecked - subtract the atomic64 variable
+ * @delta: integer value to subtract
+ * @ptr:   pointer to type atomic64_unchecked_t
+ *
+ * Atomically subtracts @delta from @ptr.
+ */
+extern void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr);
+
+/**
  * atomic64_sub_and_test - subtract value from variable and test result
  * @delta: integer value to subtract
  * @ptr:   pointer to type atomic64_t
@@ -373,6 +668,14 @@
 extern void atomic64_inc(atomic64_t *ptr);
 
 /**
+ * atomic64_inc_unchecked - increment atomic64 variable
+ * @ptr: pointer to type atomic64_unchecked_t
+ *
+ * Atomically increments @ptr by 1.
+ */
+extern void atomic64_inc_unchecked(atomic64_unchecked_t *ptr);
+
+/**
  * atomic64_dec - decrement atomic64 variable
  * @ptr: pointer to type atomic64_t
  *
@@ -381,6 +684,14 @@
 extern void atomic64_dec(atomic64_t *ptr);
 
 /**
+ * atomic64_dec_unchecked - decrement atomic64 variable
+ * @ptr: pointer to type atomic64_unchecked_t
+ *
+ * Atomically decrements @ptr by 1.
+ */
+extern void atomic64_dec_unchecked(atomic64_unchecked_t *ptr);
+
+/**
  * atomic64_dec_and_test - decrement and test
  * @ptr: pointer to type atomic64_t
  *
diff -uriN linux-2.6.32.43/arch/x86/include/asm/atomic_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/atomic_64.h
--- linux-2.6.32.43/arch/x86/include/asm/atomic_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/atomic_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -24,6 +24,17 @@
 }
 
 /**
+ * atomic_read_unchecked - read atomic variable
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically reads the value of @v.
+ */
+static inline int atomic_read_unchecked(const atomic_unchecked_t *v)
+{
+	return v->counter;
+}
+
+/**
  * atomic_set - set atomic variable
  * @v: pointer of type atomic_t
  * @i: required value
@@ -36,6 +47,18 @@
 }
 
 /**
+ * atomic_set_unchecked - set atomic variable
+ * @v: pointer of type atomic_unchecked_t
+ * @i: required value
+ *
+ * Atomically sets the value of @v to @i.
+ */
+static inline void atomic_set_unchecked(atomic_unchecked_t *v, int i)
+{
+	v->counter = i;
+}
+
+/**
  * atomic_add - add integer to atomic variable
  * @i: integer value to add
  * @v: pointer of type atomic_t
@@ -44,7 +67,29 @@
  */
 static inline void atomic_add(int i, atomic_t *v)
 {
-	asm volatile(LOCK_PREFIX "addl %1,%0"
+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "subl %1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "=m" (v->counter)
+		     : "ir" (i), "m" (v->counter));
+}
+
+/**
+ * atomic_add_unchecked - add integer to atomic variable
+ * @i: integer value to add
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically adds @i to @v.
+ */
+static inline void atomic_add_unchecked(int i, atomic_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "addl %1,%0\n"
 		     : "=m" (v->counter)
 		     : "ir" (i), "m" (v->counter));
 }
@@ -58,7 +103,29 @@
  */
 static inline void atomic_sub(int i, atomic_t *v)
 {
-	asm volatile(LOCK_PREFIX "subl %1,%0"
+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "addl %1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "=m" (v->counter)
+		     : "ir" (i), "m" (v->counter));
+}
+
+/**
+ * atomic_sub_unchecked - subtract the atomic variable
+ * @i: integer value to subtract
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically subtracts @i from @v.
+ */
+static inline void atomic_sub_unchecked(int i, atomic_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "subl %1,%0\n"
 		     : "=m" (v->counter)
 		     : "ir" (i), "m" (v->counter));
 }
@@ -76,7 +143,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "subl %2,%0; sete %1"
+	asm volatile(LOCK_PREFIX "subl %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "addl %2,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "=m" (v->counter), "=qm" (c)
 		     : "ir" (i), "m" (v->counter) : "memory");
 	return c;
@@ -90,7 +166,28 @@
  */
 static inline void atomic_inc(atomic_t *v)
 {
-	asm volatile(LOCK_PREFIX "incl %0"
+	asm volatile(LOCK_PREFIX "incl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "decl %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "=m" (v->counter)
+		     : "m" (v->counter));
+}
+
+/**
+ * atomic_inc_unchecked - increment atomic variable
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically increments @v by 1.
+ */
+static inline void atomic_inc_unchecked(atomic_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "incl %0\n"
 		     : "=m" (v->counter)
 		     : "m" (v->counter));
 }
@@ -103,7 +200,28 @@
  */
 static inline void atomic_dec(atomic_t *v)
 {
-	asm volatile(LOCK_PREFIX "decl %0"
+	asm volatile(LOCK_PREFIX "decl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "incl %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "=m" (v->counter)
+		     : "m" (v->counter));
+}
+
+/**
+ * atomic_dec_unchecked - decrement atomic variable
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically decrements @v by 1.
+ */
+static inline void atomic_dec_unchecked(atomic_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "decl %0\n"
 		     : "=m" (v->counter)
 		     : "m" (v->counter));
 }
@@ -120,7 +238,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "decl %0; sete %1"
+	asm volatile(LOCK_PREFIX "decl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "incl %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "=m" (v->counter), "=qm" (c)
 		     : "m" (v->counter) : "memory");
 	return c != 0;
@@ -138,7 +265,35 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "incl %0; sete %1"
+	asm volatile(LOCK_PREFIX "incl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "decl %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
+		     : "=m" (v->counter), "=qm" (c)
+		     : "m" (v->counter) : "memory");
+	return c != 0;
+}
+
+/**
+ * atomic_inc_and_test_unchecked - increment and test
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically increments @v by 1
+ * and returns true if the result is zero, or false for all
+ * other cases.
+ */
+static inline int atomic_inc_and_test_unchecked(atomic_unchecked_t *v)
+{
+	unsigned char c;
+
+	asm volatile(LOCK_PREFIX "incl %0\n"
+		     "sete %1\n"
 		     : "=m" (v->counter), "=qm" (c)
 		     : "m" (v->counter) : "memory");
 	return c != 0;
@@ -157,7 +312,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "addl %2,%0; sets %1"
+	asm volatile(LOCK_PREFIX "addl %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "subl %2,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sets %1\n"
 		     : "=m" (v->counter), "=qm" (c)
 		     : "ir" (i), "m" (v->counter) : "memory");
 	return c;
@@ -173,7 +337,31 @@
 static inline int atomic_add_return(int i, atomic_t *v)
 {
 	int __i = i;
-	asm volatile(LOCK_PREFIX "xaddl %0, %1"
+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     "movl %0, %1\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "+r" (i), "+m" (v->counter)
+		     : : "memory");
+	return i + __i;
+}
+
+/**
+ * atomic_add_return_unchecked - add and return
+ * @i: integer value to add
+ * @v: pointer of type atomic_unchecked_t
+ *
+ * Atomically adds @i to @v and returns @i + @v
+ */
+static inline int atomic_add_return_unchecked(int i, atomic_unchecked_t *v)
+{
+	int __i = i;
+	asm volatile(LOCK_PREFIX "xaddl %0, %1\n"
 		     : "+r" (i), "+m" (v->counter)
 		     : : "memory");
 	return i + __i;
@@ -185,6 +373,10 @@
 }
 
 #define atomic_inc_return(v)  (atomic_add_return(1, v))
+static inline int atomic_inc_return_unchecked(atomic_unchecked_t *v)
+{
+	return atomic_add_return_unchecked(1, v);
+}
 #define atomic_dec_return(v)  (atomic_sub_return(1, v))
 
 /* The 64-bit atomic type */
@@ -204,6 +396,18 @@
 }
 
 /**
+ * atomic64_read_unchecked - read atomic64 variable
+ * @v: pointer of type atomic64_unchecked_t
+ *
+ * Atomically reads the value of @v.
+ * Doesn't imply a read memory barrier.
+ */
+static inline long atomic64_read_unchecked(const atomic64_unchecked_t *v)
+{
+	return v->counter;
+}
+
+/**
  * atomic64_set - set atomic64 variable
  * @v: pointer to type atomic64_t
  * @i: required value
@@ -216,6 +420,18 @@
 }
 
 /**
+ * atomic64_set_unchecked - set atomic64 variable
+ * @v: pointer to type atomic64_unchecked_t
+ * @i: required value
+ *
+ * Atomically sets the value of @v to @i.
+ */
+static inline void atomic64_set_unchecked(atomic64_unchecked_t *v, long i)
+{
+	v->counter = i;
+}
+
+/**
  * atomic64_add - add integer to atomic64 variable
  * @i: integer value to add
  * @v: pointer to type atomic64_t
@@ -224,6 +440,28 @@
  */
 static inline void atomic64_add(long i, atomic64_t *v)
 {
+	asm volatile(LOCK_PREFIX "addq %1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "subq %1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "=m" (v->counter)
+		     : "er" (i), "m" (v->counter));
+}
+
+/**
+ * atomic64_add_unchecked - add integer to atomic64 variable
+ * @i: integer value to add
+ * @v: pointer to type atomic64_unchecked_t
+ *
+ * Atomically adds @i to @v.
+ */
+static inline void atomic64_add_unchecked(long i, atomic64_unchecked_t *v)
+{
 	asm volatile(LOCK_PREFIX "addq %1,%0"
 		     : "=m" (v->counter)
 		     : "er" (i), "m" (v->counter));
@@ -238,7 +476,15 @@
  */
 static inline void atomic64_sub(long i, atomic64_t *v)
 {
-	asm volatile(LOCK_PREFIX "subq %1,%0"
+	asm volatile(LOCK_PREFIX "subq %1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "addq %1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "=m" (v->counter)
 		     : "er" (i), "m" (v->counter));
 }
@@ -256,7 +502,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "subq %2,%0; sete %1"
+	asm volatile(LOCK_PREFIX "subq %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "addq %2,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "=m" (v->counter), "=qm" (c)
 		     : "er" (i), "m" (v->counter) : "memory");
 	return c;
@@ -270,6 +525,27 @@
  */
 static inline void atomic64_inc(atomic64_t *v)
 {
+	asm volatile(LOCK_PREFIX "incq %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "decq %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "=m" (v->counter)
+		     : "m" (v->counter));
+}
+
+/**
+ * atomic64_inc_unchecked - increment atomic64 variable
+ * @v: pointer to type atomic64_unchecked_t
+ *
+ * Atomically increments @v by 1.
+ */
+static inline void atomic64_inc_unchecked(atomic64_unchecked_t *v)
+{
 	asm volatile(LOCK_PREFIX "incq %0"
 		     : "=m" (v->counter)
 		     : "m" (v->counter));
@@ -283,7 +559,28 @@
  */
 static inline void atomic64_dec(atomic64_t *v)
 {
-	asm volatile(LOCK_PREFIX "decq %0"
+	asm volatile(LOCK_PREFIX "decq %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "incq %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "=m" (v->counter)
+		     : "m" (v->counter));
+}
+
+/**
+ * atomic64_dec_unchecked - decrement atomic64 variable
+ * @v: pointer to type atomic64_t
+ *
+ * Atomically decrements @v by 1.
+ */
+static inline void atomic64_dec_unchecked(atomic64_unchecked_t *v)
+{
+	asm volatile(LOCK_PREFIX "decq %0\n"
 		     : "=m" (v->counter)
 		     : "m" (v->counter));
 }
@@ -300,7 +597,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "decq %0; sete %1"
+	asm volatile(LOCK_PREFIX "decq %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "incq %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "=m" (v->counter), "=qm" (c)
 		     : "m" (v->counter) : "memory");
 	return c != 0;
@@ -318,7 +624,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "incq %0; sete %1"
+	asm volatile(LOCK_PREFIX "incq %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "decq %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "=m" (v->counter), "=qm" (c)
 		     : "m" (v->counter) : "memory");
 	return c != 0;
@@ -337,7 +652,16 @@
 {
 	unsigned char c;
 
-	asm volatile(LOCK_PREFIX "addq %2,%0; sets %1"
+	asm volatile(LOCK_PREFIX "addq %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "subq %2,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sets %1\n"
 		     : "=m" (v->counter), "=qm" (c)
 		     : "er" (i), "m" (v->counter) : "memory");
 	return c;
@@ -353,7 +677,31 @@
 static inline long atomic64_add_return(long i, atomic64_t *v)
 {
 	long __i = i;
-	asm volatile(LOCK_PREFIX "xaddq %0, %1;"
+	asm volatile(LOCK_PREFIX "xaddq %0, %1\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     "movq %0, %1\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     : "+r" (i), "+m" (v->counter)
+		     : : "memory");
+	return i + __i;
+}
+
+/**
+ * atomic64_add_return_unchecked - add and return
+ * @i: integer value to add
+ * @v: pointer to type atomic64_unchecked_t
+ *
+ * Atomically adds @i to @v and returns @i + @v
+ */
+static inline long atomic64_add_return_unchecked(long i, atomic64_unchecked_t *v)
+{
+	long __i = i;
+	asm volatile(LOCK_PREFIX "xaddq %0, %1"
 		     : "+r" (i), "+m" (v->counter)
 		     : : "memory");
 	return i + __i;
@@ -365,6 +713,10 @@
 }
 
 #define atomic64_inc_return(v)  (atomic64_add_return(1, (v)))
+static inline long atomic64_inc_return_unchecked(atomic64_unchecked_t *v)
+{
+	return atomic64_add_return_unchecked(1, v);
+}
 #define atomic64_dec_return(v)  (atomic64_sub_return(1, (v)))
 
 static inline long atomic64_cmpxchg(atomic64_t *v, long old, long new)
@@ -372,21 +724,41 @@
 	return cmpxchg(&v->counter, old, new);
 }
 
+static inline long atomic64_cmpxchg_unchecked(atomic64_unchecked_t *v, long old, long new)
+{
+	return cmpxchg(&v->counter, old, new);
+}
+
 static inline long atomic64_xchg(atomic64_t *v, long new)
 {
 	return xchg(&v->counter, new);
 }
 
+static inline long atomic64_xchg_unchecked(atomic64_unchecked_t *v, long new)
+{
+	return xchg(&v->counter, new);
+}
+
 static inline long atomic_cmpxchg(atomic_t *v, int old, int new)
 {
 	return cmpxchg(&v->counter, old, new);
 }
 
+static inline long atomic_cmpxchg_unchecked(atomic_unchecked_t *v, int old, int new)
+{
+	return cmpxchg(&v->counter, old, new);
+}
+
 static inline long atomic_xchg(atomic_t *v, int new)
 {
 	return xchg(&v->counter, new);
 }
 
+static inline long atomic_xchg_unchecked(atomic_unchecked_t *v, int new)
+{
+	return xchg(&v->counter, new);
+}
+
 /**
  * atomic_add_unless - add unless the number is a given value
  * @v: pointer of type atomic_t
@@ -398,17 +770,30 @@
  */
 static inline int atomic_add_unless(atomic_t *v, int a, int u)
 {
-	int c, old;
+	int c, old, new;
 	c = atomic_read(v);
 	for (;;) {
-		if (unlikely(c == (u)))
+		if (unlikely(c == u))
 			break;
-		old = atomic_cmpxchg((v), c, c + (a));
+
+		asm volatile("addl %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+			     "jno 0f\n"
+			     "subl %2,%0\n"
+			     "int $4\n0:\n"
+			     _ASM_EXTABLE(0b, 0b)
+#endif
+
+			     : "=r" (new)
+			     : "0" (c), "ir" (a));
+
+		old = atomic_cmpxchg(v, c, new);
 		if (likely(old == c))
 			break;
 		c = old;
 	}
-	return c != (u);
+	return c != u;
 }
 
 #define atomic_inc_not_zero(v) atomic_add_unless((v), 1, 0)
@@ -424,17 +809,30 @@
  */
 static inline int atomic64_add_unless(atomic64_t *v, long a, long u)
 {
-	long c, old;
+	long c, old, new;
 	c = atomic64_read(v);
 	for (;;) {
-		if (unlikely(c == (u)))
+		if (unlikely(c == u))
 			break;
-		old = atomic64_cmpxchg((v), c, c + (a));
+
+		asm volatile("addq %2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+			     "jno 0f\n"
+			     "subq %2,%0\n"
+			     "int $4\n0:\n"
+			     _ASM_EXTABLE(0b, 0b)
+#endif
+
+			     : "=r" (new)
+			     : "0" (c), "er" (a));
+
+		old = atomic64_cmpxchg(v, c, new);
 		if (likely(old == c))
 			break;
 		c = old;
 	}
-	return c != (u);
+	return c != u;
 }
 
 /**
diff -uriN linux-2.6.32.43/arch/x86/include/asm/bitops.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/bitops.h
--- linux-2.6.32.43/arch/x86/include/asm/bitops.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/bitops.h	2011-07-15 05:51:11.000000000 -0500
@@ -38,7 +38,7 @@
  * a mask operation on a byte.
  */
 #define IS_IMMEDIATE(nr)		(__builtin_constant_p(nr))
-#define CONST_MASK_ADDR(nr, addr)	BITOP_ADDR((void *)(addr) + ((nr)>>3))
+#define CONST_MASK_ADDR(nr, addr)	BITOP_ADDR((volatile void *)(addr) + ((nr)>>3))
 #define CONST_MASK(nr)			(1 << ((nr) & 7))
 
 /**
diff -uriN linux-2.6.32.43/arch/x86/include/asm/boot.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/boot.h
--- linux-2.6.32.43/arch/x86/include/asm/boot.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/boot.h	2011-07-15 05:51:11.000000000 -0500
@@ -11,10 +11,15 @@
 #include <asm/pgtable_types.h>
 
 /* Physical address where kernel should be loaded. */
-#define LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
+#define ____LOAD_PHYSICAL_ADDR ((CONFIG_PHYSICAL_START \
 				+ (CONFIG_PHYSICAL_ALIGN - 1)) \
 				& ~(CONFIG_PHYSICAL_ALIGN - 1))
 
+#ifndef __ASSEMBLY__
+extern unsigned char __LOAD_PHYSICAL_ADDR[];
+#define LOAD_PHYSICAL_ADDR ((unsigned long)__LOAD_PHYSICAL_ADDR)
+#endif
+
 /* Minimum kernel alignment, as a power of two */
 #ifdef CONFIG_X86_64
 #define MIN_KERNEL_ALIGN_LG2	PMD_SHIFT
diff -uriN linux-2.6.32.43/arch/x86/include/asm/cacheflush.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/cacheflush.h
--- linux-2.6.32.43/arch/x86/include/asm/cacheflush.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/cacheflush.h	2011-07-15 05:51:11.000000000 -0500
@@ -60,7 +60,7 @@
 static inline unsigned long get_page_memtype(struct page *pg)
 {
 	if (!PageUncached(pg) && !PageWC(pg))
-		return -1;
+		return ~0UL;
 	else if (!PageUncached(pg) && PageWC(pg))
 		return _PAGE_CACHE_WC;
 	else if (PageUncached(pg) && !PageWC(pg))
@@ -85,7 +85,7 @@
 		SetPageWC(pg);
 		break;
 	default:
-	case -1:
+	case ~0UL:
 		ClearPageUncached(pg);
 		ClearPageWC(pg);
 		break;
diff -uriN linux-2.6.32.43/arch/x86/include/asm/cache.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/cache.h
--- linux-2.6.32.43/arch/x86/include/asm/cache.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/cache.h	2011-07-15 05:51:11.000000000 -0500
@@ -5,9 +5,10 @@
 
 /* L1 cache line size */
 #define L1_CACHE_SHIFT	(CONFIG_X86_L1_CACHE_SHIFT)
-#define L1_CACHE_BYTES	(1 << L1_CACHE_SHIFT)
+#define L1_CACHE_BYTES	(_AC(1,UL) << L1_CACHE_SHIFT)
 
 #define __read_mostly __attribute__((__section__(".data.read_mostly")))
+#define __read_only __attribute__((__section__(".data.read_only")))
 
 #ifdef CONFIG_X86_VSMP
 /* vSMP Internode cacheline shift */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/checksum_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/checksum_32.h
--- linux-2.6.32.43/arch/x86/include/asm/checksum_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/checksum_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -31,6 +31,14 @@
 					    int len, __wsum sum,
 					    int *src_err_ptr, int *dst_err_ptr);
 
+asmlinkage __wsum csum_partial_copy_generic_to_user(const void *src, void *dst,
+						  int len, __wsum sum,
+						  int *src_err_ptr, int *dst_err_ptr);
+
+asmlinkage __wsum csum_partial_copy_generic_from_user(const void *src, void *dst,
+						  int len, __wsum sum,
+						  int *src_err_ptr, int *dst_err_ptr);
+
 /*
  *	Note: when you get a NULL pointer exception here this means someone
  *	passed in an incorrect kernel address to one of these functions.
@@ -50,7 +58,7 @@
 						 int *err_ptr)
 {
 	might_sleep();
-	return csum_partial_copy_generic((__force void *)src, dst,
+	return csum_partial_copy_generic_from_user((__force void *)src, dst,
 					 len, sum, err_ptr, NULL);
 }
 
@@ -178,7 +186,7 @@
 {
 	might_sleep();
 	if (access_ok(VERIFY_WRITE, dst, len))
-		return csum_partial_copy_generic(src, (__force void *)dst,
+		return csum_partial_copy_generic_to_user(src, (__force void *)dst,
 						 len, sum, NULL, err_ptr);
 
 	if (len)
diff -uriN linux-2.6.32.43/arch/x86/include/asm/desc_defs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/desc_defs.h
--- linux-2.6.32.43/arch/x86/include/asm/desc_defs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/desc_defs.h	2011-07-15 05:51:11.000000000 -0500
@@ -31,6 +31,12 @@
 			unsigned base1: 8, type: 4, s: 1, dpl: 2, p: 1;
 			unsigned limit: 4, avl: 1, l: 1, d: 1, g: 1, base2: 8;
 		};
+		struct {
+			u16 offset_low;
+			u16 seg;
+			unsigned reserved: 8, type: 4, s: 1, dpl: 2, p: 1;
+			unsigned offset_high: 16;
+		} gate;
 	};
 } __attribute__((packed));
 
diff -uriN linux-2.6.32.43/arch/x86/include/asm/desc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/desc.h
--- linux-2.6.32.43/arch/x86/include/asm/desc.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/desc.h	2011-07-15 05:51:11.000000000 -0500
@@ -4,6 +4,7 @@
 #include <asm/desc_defs.h>
 #include <asm/ldt.h>
 #include <asm/mmu.h>
+#include <asm/pgtable.h>
 #include <linux/smp.h>
 
 static inline void fill_ldt(struct desc_struct *desc,
@@ -15,6 +16,7 @@
 	desc->base1 = (info->base_addr & 0x00ff0000) >> 16;
 	desc->type = (info->read_exec_only ^ 1) << 1;
 	desc->type |= info->contents << 2;
+	desc->type |= info->seg_not_present ^ 1;
 	desc->s = 1;
 	desc->dpl = 0x3;
 	desc->p = info->seg_not_present ^ 1;
@@ -31,16 +33,12 @@
 }
 
 extern struct desc_ptr idt_descr;
-extern gate_desc idt_table[];
-
-struct gdt_page {
-	struct desc_struct gdt[GDT_ENTRIES];
-} __attribute__((aligned(PAGE_SIZE)));
-DECLARE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page);
+extern gate_desc idt_table[256];
 
+extern struct desc_struct cpu_gdt_table[NR_CPUS][PAGE_SIZE / sizeof(struct desc_struct)];
 static inline struct desc_struct *get_cpu_gdt_table(unsigned int cpu)
 {
-	return per_cpu(gdt_page, cpu).gdt;
+	return cpu_gdt_table[cpu];
 }
 
 #ifdef CONFIG_X86_64
@@ -65,9 +63,14 @@
 			     unsigned long base, unsigned dpl, unsigned flags,
 			     unsigned short seg)
 {
-	gate->a = (seg << 16) | (base & 0xffff);
-	gate->b = (base & 0xffff0000) |
-		  (((0x80 | type | (dpl << 5)) & 0xff) << 8);
+	gate->gate.offset_low = base;
+	gate->gate.seg = seg;
+	gate->gate.reserved = 0;
+	gate->gate.type = type;
+	gate->gate.s = 0;
+	gate->gate.dpl = dpl;
+	gate->gate.p = 1;
+	gate->gate.offset_high = base >> 16;
 }
 
 #endif
@@ -115,13 +118,17 @@
 static inline void native_write_idt_entry(gate_desc *idt, int entry,
 					  const gate_desc *gate)
 {
+	pax_open_kernel();
 	memcpy(&idt[entry], gate, sizeof(*gate));
+	pax_close_kernel();
 }
 
 static inline void native_write_ldt_entry(struct desc_struct *ldt, int entry,
 					  const void *desc)
 {
+	pax_open_kernel();
 	memcpy(&ldt[entry], desc, 8);
+	pax_close_kernel();
 }
 
 static inline void native_write_gdt_entry(struct desc_struct *gdt, int entry,
@@ -139,7 +146,10 @@
 		size = sizeof(struct desc_struct);
 		break;
 	}
+
+	pax_open_kernel();
 	memcpy(&gdt[entry], desc, size);
+	pax_close_kernel();
 }
 
 static inline void pack_descriptor(struct desc_struct *desc, unsigned long base,
@@ -211,7 +221,9 @@
 
 static inline void native_load_tr_desc(void)
 {
+	pax_open_kernel();
 	asm volatile("ltr %w0"::"q" (GDT_ENTRY_TSS*8));
+	pax_close_kernel();
 }
 
 static inline void native_load_gdt(const struct desc_ptr *dtr)
@@ -246,8 +258,10 @@
 	unsigned int i;
 	struct desc_struct *gdt = get_cpu_gdt_table(cpu);
 
+	pax_open_kernel();
 	for (i = 0; i < GDT_ENTRY_TLS_ENTRIES; i++)
 		gdt[GDT_ENTRY_TLS_MIN + i] = t->tls_array[i];
+	pax_close_kernel();
 }
 
 #define _LDT_empty(info)				\
@@ -309,7 +323,7 @@
 	desc->limit = (limit >> 16) & 0xf;
 }
 
-static inline void _set_gate(int gate, unsigned type, void *addr,
+static inline void _set_gate(int gate, unsigned type, const void *addr,
 			     unsigned dpl, unsigned ist, unsigned seg)
 {
 	gate_desc s;
@@ -327,7 +341,7 @@
  * Pentium F0 0F bugfix can have resulted in the mapped
  * IDT being write-protected.
  */
-static inline void set_intr_gate(unsigned int n, void *addr)
+static inline void set_intr_gate(unsigned int n, const void *addr)
 {
 	BUG_ON((unsigned)n > 0xFF);
 	_set_gate(n, GATE_INTERRUPT, addr, 0, 0, __KERNEL_CS);
@@ -356,19 +370,19 @@
 /*
  * This routine sets up an interrupt gate at directory privilege level 3.
  */
-static inline void set_system_intr_gate(unsigned int n, void *addr)
+static inline void set_system_intr_gate(unsigned int n, const void *addr)
 {
 	BUG_ON((unsigned)n > 0xFF);
 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, 0, __KERNEL_CS);
 }
 
-static inline void set_system_trap_gate(unsigned int n, void *addr)
+static inline void set_system_trap_gate(unsigned int n, const void *addr)
 {
 	BUG_ON((unsigned)n > 0xFF);
 	_set_gate(n, GATE_TRAP, addr, 0x3, 0, __KERNEL_CS);
 }
 
-static inline void set_trap_gate(unsigned int n, void *addr)
+static inline void set_trap_gate(unsigned int n, const void *addr)
 {
 	BUG_ON((unsigned)n > 0xFF);
 	_set_gate(n, GATE_TRAP, addr, 0, 0, __KERNEL_CS);
@@ -377,19 +391,31 @@
 static inline void set_task_gate(unsigned int n, unsigned int gdt_entry)
 {
 	BUG_ON((unsigned)n > 0xFF);
-	_set_gate(n, GATE_TASK, (void *)0, 0, 0, (gdt_entry<<3));
+	_set_gate(n, GATE_TASK, (const void *)0, 0, 0, (gdt_entry<<3));
 }
 
-static inline void set_intr_gate_ist(int n, void *addr, unsigned ist)
+static inline void set_intr_gate_ist(int n, const void *addr, unsigned ist)
 {
 	BUG_ON((unsigned)n > 0xFF);
 	_set_gate(n, GATE_INTERRUPT, addr, 0, ist, __KERNEL_CS);
 }
 
-static inline void set_system_intr_gate_ist(int n, void *addr, unsigned ist)
+static inline void set_system_intr_gate_ist(int n, const void *addr, unsigned ist)
 {
 	BUG_ON((unsigned)n > 0xFF);
 	_set_gate(n, GATE_INTERRUPT, addr, 0x3, ist, __KERNEL_CS);
 }
 
+#ifdef CONFIG_X86_32
+static inline void set_user_cs(unsigned long base, unsigned long limit, int cpu)
+{
+	struct desc_struct d;
+
+	if (likely(limit))
+		limit = (limit - 1UL) >> PAGE_SHIFT;
+	pack_descriptor(&d, base, limit, 0xFB, 0xC);
+	write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_DEFAULT_USER_CS, &d, DESCTYPE_S);
+}
+#endif
+
 #endif /* _ASM_X86_DESC_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/device.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/device.h
--- linux-2.6.32.43/arch/x86/include/asm/device.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/device.h	2011-07-15 05:51:11.000000000 -0500
@@ -6,7 +6,7 @@
 	void	*acpi_handle;
 #endif
 #ifdef CONFIG_X86_64
-struct dma_map_ops *dma_ops;
+	const struct dma_map_ops *dma_ops;
 #endif
 #ifdef CONFIG_DMAR
 	void *iommu; /* hook for IOMMU specific extension */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/dma-mapping.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/dma-mapping.h
--- linux-2.6.32.43/arch/x86/include/asm/dma-mapping.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/dma-mapping.h	2011-07-15 05:51:11.000000000 -0500
@@ -25,9 +25,9 @@
 extern struct device x86_dma_fallback_dev;
 extern int panic_on_overflow;
 
-extern struct dma_map_ops *dma_ops;
+extern const struct dma_map_ops *dma_ops;
 
-static inline struct dma_map_ops *get_dma_ops(struct device *dev)
+static inline const struct dma_map_ops *get_dma_ops(struct device *dev)
 {
 #ifdef CONFIG_X86_32
 	return dma_ops;
@@ -44,7 +44,7 @@
 /* Make sure we keep the same behaviour */
 static inline int dma_mapping_error(struct device *dev, dma_addr_t dma_addr)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 	if (ops->mapping_error)
 		return ops->mapping_error(dev, dma_addr);
 
@@ -122,7 +122,7 @@
 dma_alloc_coherent(struct device *dev, size_t size, dma_addr_t *dma_handle,
 		gfp_t gfp)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 	void *memory;
 
 	gfp &= ~(__GFP_DMA | __GFP_HIGHMEM | __GFP_DMA32);
@@ -149,7 +149,7 @@
 static inline void dma_free_coherent(struct device *dev, size_t size,
 				     void *vaddr, dma_addr_t bus)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	WARN_ON(irqs_disabled());       /* for portability */
 
diff -uriN linux-2.6.32.43/arch/x86/include/asm/e820.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/e820.h
--- linux-2.6.32.43/arch/x86/include/asm/e820.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/e820.h	2011-07-15 05:51:11.000000000 -0500
@@ -133,7 +133,7 @@
 #define ISA_END_ADDRESS		0x100000
 #define is_ISA_range(s, e) ((s) >= ISA_START_ADDRESS && (e) < ISA_END_ADDRESS)
 
-#define BIOS_BEGIN		0x000a0000
+#define BIOS_BEGIN		0x000c0000
 #define BIOS_END		0x00100000
 
 #ifdef __KERNEL__
diff -uriN linux-2.6.32.43/arch/x86/include/asm/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/elf.h
--- linux-2.6.32.43/arch/x86/include/asm/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/elf.h	2011-07-15 05:51:11.000000000 -0500
@@ -257,7 +257,25 @@
    the loader.  We need to make sure that it is out of the way of the program
    that it will "exec", and that there is sufficient room for the brk.  */
 
+#ifdef CONFIG_PAX_SEGMEXEC
+#define ELF_ET_DYN_BASE		((current->mm->pax_flags & MF_PAX_SEGMEXEC) ? SEGMEXEC_TASK_SIZE/3*2 : TASK_SIZE/3*2)
+#else
 #define ELF_ET_DYN_BASE		(TASK_SIZE / 3 * 2)
+#endif
+
+#ifdef CONFIG_PAX_ASLR
+#ifdef CONFIG_X86_32
+#define PAX_ELF_ET_DYN_BASE	0x10000000UL
+
+#define PAX_DELTA_MMAP_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
+#define PAX_DELTA_STACK_LEN	(current->mm->pax_flags & MF_PAX_SEGMEXEC ? 15 : 16)
+#else
+#define PAX_ELF_ET_DYN_BASE	0x400000UL
+
+#define PAX_DELTA_MMAP_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
+#define PAX_DELTA_STACK_LEN	((test_thread_flag(TIF_IA32)) ? 16 : TASK_SIZE_MAX_SHIFT - PAGE_SHIFT - 3)
+#endif
+#endif
 
 /* This yields a mask that user programs can use to figure out what
    instruction set this CPU supports.  This could be done in user space,
@@ -311,8 +329,7 @@
 #define ARCH_DLINFO							\
 do {									\
 	if (vdso_enabled)						\
-		NEW_AUX_ENT(AT_SYSINFO_EHDR,				\
-			    (unsigned long)current->mm->context.vdso);	\
+		NEW_AUX_ENT(AT_SYSINFO_EHDR, current->mm->context.vdso);\
 } while (0)
 
 #define AT_SYSINFO		32
@@ -323,7 +340,7 @@
 
 #endif /* !CONFIG_X86_32 */
 
-#define VDSO_CURRENT_BASE	((unsigned long)current->mm->context.vdso)
+#define VDSO_CURRENT_BASE	(current->mm->context.vdso)
 
 #define VDSO_ENTRY							\
 	((unsigned long)VDSO32_SYMBOL(VDSO_CURRENT_BASE, vsyscall))
@@ -337,7 +354,4 @@
 extern int syscall32_setup_pages(struct linux_binprm *, int exstack);
 #define compat_arch_setup_additional_pages	syscall32_setup_pages
 
-extern unsigned long arch_randomize_brk(struct mm_struct *mm);
-#define arch_randomize_brk arch_randomize_brk
-
 #endif /* _ASM_X86_ELF_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/emergency-restart.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/emergency-restart.h
--- linux-2.6.32.43/arch/x86/include/asm/emergency-restart.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/emergency-restart.h	2011-07-15 05:51:11.000000000 -0500
@@ -15,6 +15,6 @@
 
 extern enum reboot_type reboot_type;
 
-extern void machine_emergency_restart(void);
+extern void machine_emergency_restart(void) __noreturn;
 
 #endif /* _ASM_X86_EMERGENCY_RESTART_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/futex.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/futex.h
--- linux-2.6.32.43/arch/x86/include/asm/futex.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/futex.h	2011-07-15 05:51:11.000000000 -0500
@@ -12,16 +12,18 @@
 #include <asm/system.h>
 
 #define __futex_atomic_op1(insn, ret, oldval, uaddr, oparg)	\
+	typecheck(u32 *, uaddr);				\
 	asm volatile("1:\t" insn "\n"				\
 		     "2:\t.section .fixup,\"ax\"\n"		\
 		     "3:\tmov\t%3, %1\n"			\
 		     "\tjmp\t2b\n"				\
 		     "\t.previous\n"				\
 		     _ASM_EXTABLE(1b, 3b)			\
-		     : "=r" (oldval), "=r" (ret), "+m" (*uaddr)	\
+		     : "=r" (oldval), "=r" (ret), "+m" (*(u32 *)____m(uaddr))\
 		     : "i" (-EFAULT), "0" (oparg), "1" (0))
 
 #define __futex_atomic_op2(insn, ret, oldval, uaddr, oparg)	\
+	typecheck(u32 *, uaddr);				\
 	asm volatile("1:\tmovl	%2, %0\n"			\
 		     "\tmovl\t%0, %3\n"				\
 		     "\t" insn "\n"				\
@@ -34,10 +36,10 @@
 		     _ASM_EXTABLE(1b, 4b)			\
 		     _ASM_EXTABLE(2b, 4b)			\
 		     : "=&a" (oldval), "=&r" (ret),		\
-		       "+m" (*uaddr), "=&r" (tem)		\
+		       "+m" (*(u32 *)____m(uaddr)), "=&r" (tem)	\
 		     : "r" (oparg), "i" (-EFAULT), "1" (0))
 
-static inline int futex_atomic_op_inuser(int encoded_op, int __user *uaddr)
+static inline int futex_atomic_op_inuser(int encoded_op, u32 __user *uaddr)
 {
 	int op = (encoded_op >> 28) & 7;
 	int cmp = (encoded_op >> 24) & 15;
@@ -61,10 +63,10 @@
 
 	switch (op) {
 	case FUTEX_OP_SET:
-		__futex_atomic_op1("xchgl %0, %2", ret, oldval, uaddr, oparg);
+		__futex_atomic_op1(__copyuser_seg"xchgl %0, %2", ret, oldval, uaddr, oparg);
 		break;
 	case FUTEX_OP_ADD:
-		__futex_atomic_op1(LOCK_PREFIX "xaddl %0, %2", ret, oldval,
+		__futex_atomic_op1(LOCK_PREFIX __copyuser_seg"xaddl %0, %2", ret, oldval,
 				   uaddr, oparg);
 		break;
 	case FUTEX_OP_OR:
@@ -109,7 +111,7 @@
 	return ret;
 }
 
-static inline int futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval,
+static inline int futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval,
 						int newval)
 {
 
@@ -119,16 +121,16 @@
 		return -ENOSYS;
 #endif
 
-	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(int)))
+	if (!access_ok(VERIFY_WRITE, uaddr, sizeof(u32)))
 		return -EFAULT;
 
-	asm volatile("1:\t" LOCK_PREFIX "cmpxchgl %3, %1\n"
+	asm volatile("1:\t" LOCK_PREFIX __copyuser_seg"cmpxchgl %3, %1\n"
 		     "2:\t.section .fixup, \"ax\"\n"
 		     "3:\tmov     %2, %0\n"
 		     "\tjmp     2b\n"
 		     "\t.previous\n"
 		     _ASM_EXTABLE(1b, 3b)
-		     : "=a" (oldval), "+m" (*uaddr)
+		     : "=a" (oldval), "+m" (*(u32 *)____m(uaddr))
 		     : "i" (-EFAULT), "r" (newval), "0" (oldval)
 		     : "memory"
 	);
diff -uriN linux-2.6.32.43/arch/x86/include/asm/hw_irq.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/hw_irq.h
--- linux-2.6.32.43/arch/x86/include/asm/hw_irq.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/hw_irq.h	2011-07-15 05:51:11.000000000 -0500
@@ -92,8 +92,8 @@
 extern void enable_IO_APIC(void);
 
 /* Statistics */
-extern atomic_t irq_err_count;
-extern atomic_t irq_mis_count;
+extern atomic_unchecked_t irq_err_count;
+extern atomic_unchecked_t irq_mis_count;
 
 /* EISA */
 extern void eisa_set_level_irq(unsigned int irq);
diff -uriN linux-2.6.32.43/arch/x86/include/asm/i387.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/i387.h
--- linux-2.6.32.43/arch/x86/include/asm/i387.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/i387.h	2011-07-15 05:51:11.000000000 -0500
@@ -60,6 +60,11 @@
 {
 	int err;
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
+		fx = (struct i387_fxsave_struct *)((void *)fx + PAX_USER_SHADOW_BASE);
+#endif
+
 	asm volatile("1:  rex64/fxrstor (%[fx])\n\t"
 		     "2:\n"
 		     ".section .fixup,\"ax\"\n"
@@ -105,6 +110,11 @@
 {
 	int err;
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	if ((unsigned long)fx < PAX_USER_SHADOW_BASE)
+		fx = (struct i387_fxsave_struct __user *)((void __user *)fx + PAX_USER_SHADOW_BASE);
+#endif
+
 	asm volatile("1:  rex64/fxsave (%[fx])\n\t"
 		     "2:\n"
 		     ".section .fixup,\"ax\"\n"
@@ -195,13 +205,8 @@
 }
 
 /* We need a safe address that is cheap to find and that is already
-   in L1 during context switch. The best choices are unfortunately
-   different for UP and SMP */
-#ifdef CONFIG_SMP
-#define safe_address (__per_cpu_offset[0])
-#else
-#define safe_address (kstat_cpu(0).cpustat.user)
-#endif
+   in L1 during context switch. */
+#define safe_address (init_tss[smp_processor_id()].x86_tss.sp0)
 
 /*
  * These must be called with preempt disabled
@@ -291,7 +296,7 @@
 	struct thread_info *me = current_thread_info();
 	preempt_disable();
 	if (me->status & TS_USEDFPU)
-		__save_init_fpu(me->task);
+		__save_init_fpu(current);
 	else
 		clts();
 }
diff -uriN linux-2.6.32.43/arch/x86/include/asm/io_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/io_32.h
--- linux-2.6.32.43/arch/x86/include/asm/io_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/io_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -3,6 +3,7 @@
 
 #include <linux/string.h>
 #include <linux/compiler.h>
+#include <asm/processor.h>
 
 /*
  * This file contains the definitions for the x86 IO instructions
@@ -42,6 +43,17 @@
 
 #ifdef __KERNEL__
 
+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
+{
+	return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
+}
+
+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
+{
+	return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
+}
+
 #include <asm-generic/iomap.h>
 
 #include <linux/vmalloc.h>
diff -uriN linux-2.6.32.43/arch/x86/include/asm/io_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/io_64.h
--- linux-2.6.32.43/arch/x86/include/asm/io_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/io_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -140,6 +140,17 @@
 
 #include <linux/vmalloc.h>
 
+#define ARCH_HAS_VALID_PHYS_ADDR_RANGE
+static inline int valid_phys_addr_range(unsigned long addr, size_t count)
+{
+	return ((addr + count + PAGE_SIZE - 1) >> PAGE_SHIFT) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
+}
+
+static inline int valid_mmap_phys_addr_range(unsigned long pfn, size_t count)
+{
+	return (pfn + (count >> PAGE_SHIFT)) < (1ULL << (boot_cpu_data.x86_phys_bits - PAGE_SHIFT)) ? 1 : 0;
+}
+
 #include <asm-generic/iomap.h>
 
 void __memcpy_fromio(void *, unsigned long, unsigned);
diff -uriN linux-2.6.32.43/arch/x86/include/asm/iommu.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/iommu.h
--- linux-2.6.32.43/arch/x86/include/asm/iommu.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/iommu.h	2011-07-15 05:51:11.000000000 -0500
@@ -3,7 +3,7 @@
 
 extern void pci_iommu_shutdown(void);
 extern void no_iommu_init(void);
-extern struct dma_map_ops nommu_dma_ops;
+extern const struct dma_map_ops nommu_dma_ops;
 extern int force_iommu, no_iommu;
 extern int iommu_detected;
 extern int iommu_pass_through;
diff -uriN linux-2.6.32.43/arch/x86/include/asm/irqflags.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/irqflags.h
--- linux-2.6.32.43/arch/x86/include/asm/irqflags.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/irqflags.h	2011-07-15 05:51:11.000000000 -0500
@@ -142,6 +142,11 @@
 	sti;					\
 	sysexit
 
+#define GET_CR0_INTO_RDI		mov %cr0, %rdi
+#define SET_RDI_INTO_CR0		mov %rdi, %cr0
+#define GET_CR3_INTO_RDI		mov %cr3, %rdi
+#define SET_RDI_INTO_CR3		mov %rdi, %cr3
+
 #else
 #define INTERRUPT_RETURN		iret
 #define ENABLE_INTERRUPTS_SYSEXIT	sti; sysexit
diff -uriN linux-2.6.32.43/arch/x86/include/asm/kprobes.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/kprobes.h
--- linux-2.6.32.43/arch/x86/include/asm/kprobes.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/kprobes.h	2011-07-15 05:51:11.000000000 -0500
@@ -34,13 +34,8 @@
 #define BREAKPOINT_INSTRUCTION	0xcc
 #define RELATIVEJUMP_INSTRUCTION 0xe9
 #define MAX_INSN_SIZE 16
-#define MAX_STACK_SIZE 64
-#define MIN_STACK_SIZE(ADDR)					       \
-	(((MAX_STACK_SIZE) < (((unsigned long)current_thread_info()) + \
-			      THREAD_SIZE - (unsigned long)(ADDR)))    \
-	 ? (MAX_STACK_SIZE)					       \
-	 : (((unsigned long)current_thread_info()) +		       \
-	    THREAD_SIZE - (unsigned long)(ADDR)))
+#define MAX_STACK_SIZE 64UL
+#define MIN_STACK_SIZE(ADDR)	min(MAX_STACK_SIZE, current->thread.sp0 - (unsigned long)(ADDR))
 
 #define flush_insn_slot(p)	do { } while (0)
 
diff -uriN linux-2.6.32.43/arch/x86/include/asm/kvm_host.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/kvm_host.h
--- linux-2.6.32.43/arch/x86/include/asm/kvm_host.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/kvm_host.h	2011-07-15 05:51:11.000000000 -0500
@@ -536,7 +536,7 @@
 	const struct trace_print_flags *exit_reasons_str;
 };
 
-extern struct kvm_x86_ops *kvm_x86_ops;
+extern const struct kvm_x86_ops *kvm_x86_ops;
 
 int kvm_mmu_module_init(void);
 void kvm_mmu_module_exit(void);
diff -uriN linux-2.6.32.43/arch/x86/include/asm/local.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/local.h
--- linux-2.6.32.43/arch/x86/include/asm/local.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/local.h	2011-07-15 05:51:11.000000000 -0500
@@ -18,26 +18,58 @@
 
 static inline void local_inc(local_t *l)
 {
-	asm volatile(_ASM_INC "%0"
+	asm volatile(_ASM_INC "%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_DEC "%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "+m" (l->a.counter));
 }
 
 static inline void local_dec(local_t *l)
 {
-	asm volatile(_ASM_DEC "%0"
+	asm volatile(_ASM_DEC "%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_INC "%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "+m" (l->a.counter));
 }
 
 static inline void local_add(long i, local_t *l)
 {
-	asm volatile(_ASM_ADD "%1,%0"
+	asm volatile(_ASM_ADD "%1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_SUB "%1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "+m" (l->a.counter)
 		     : "ir" (i));
 }
 
 static inline void local_sub(long i, local_t *l)
 {
-	asm volatile(_ASM_SUB "%1,%0"
+	asm volatile(_ASM_SUB "%1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_ADD "%1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "+m" (l->a.counter)
 		     : "ir" (i));
 }
@@ -55,7 +87,16 @@
 {
 	unsigned char c;
 
-	asm volatile(_ASM_SUB "%2,%0; sete %1"
+	asm volatile(_ASM_SUB "%2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_ADD "%2,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "+m" (l->a.counter), "=qm" (c)
 		     : "ir" (i) : "memory");
 	return c;
@@ -73,7 +114,16 @@
 {
 	unsigned char c;
 
-	asm volatile(_ASM_DEC "%0; sete %1"
+	asm volatile(_ASM_DEC "%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_INC "%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "+m" (l->a.counter), "=qm" (c)
 		     : : "memory");
 	return c != 0;
@@ -91,7 +141,16 @@
 {
 	unsigned char c;
 
-	asm volatile(_ASM_INC "%0; sete %1"
+	asm volatile(_ASM_INC "%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_DEC "%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sete %1\n"
 		     : "+m" (l->a.counter), "=qm" (c)
 		     : : "memory");
 	return c != 0;
@@ -110,7 +169,16 @@
 {
 	unsigned char c;
 
-	asm volatile(_ASM_ADD "%2,%0; sets %1"
+	asm volatile(_ASM_ADD "%2,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_SUB "%2,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     "sets %1\n"
 		     : "+m" (l->a.counter), "=qm" (c)
 		     : "ir" (i) : "memory");
 	return c;
@@ -133,7 +201,15 @@
 #endif
 	/* Modern 486+ processor */
 	__i = i;
-	asm volatile(_ASM_XADD "%0, %1;"
+	asm volatile(_ASM_XADD "%0, %1\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     _ASM_MOV "%0,%1\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "+r" (i), "+m" (l->a.counter)
 		     : : "memory");
 	return i + __i;
diff -uriN linux-2.6.32.43/arch/x86/include/asm/microcode.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/microcode.h
--- linux-2.6.32.43/arch/x86/include/asm/microcode.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/microcode.h	2011-07-15 05:51:11.000000000 -0500
@@ -12,13 +12,13 @@
 enum ucode_state { UCODE_ERROR, UCODE_OK, UCODE_NFOUND };
 
 struct microcode_ops {
-	enum ucode_state (*request_microcode_user) (int cpu,
+	enum ucode_state (* const request_microcode_user) (int cpu,
 				const void __user *buf, size_t size);
 
-	enum ucode_state (*request_microcode_fw) (int cpu,
+	enum ucode_state (* const request_microcode_fw) (int cpu,
 				struct device *device);
 
-	void (*microcode_fini_cpu) (int cpu);
+	void (* const microcode_fini_cpu) (int cpu);
 
 	/*
 	 * The generic 'microcode_core' part guarantees that
@@ -38,18 +38,18 @@
 extern struct ucode_cpu_info ucode_cpu_info[];
 
 #ifdef CONFIG_MICROCODE_INTEL
-extern struct microcode_ops * __init init_intel_microcode(void);
+extern const struct microcode_ops * __init init_intel_microcode(void);
 #else
-static inline struct microcode_ops * __init init_intel_microcode(void)
+static inline const struct microcode_ops * __init init_intel_microcode(void)
 {
 	return NULL;
 }
 #endif /* CONFIG_MICROCODE_INTEL */
 
 #ifdef CONFIG_MICROCODE_AMD
-extern struct microcode_ops * __init init_amd_microcode(void);
+extern const struct microcode_ops * __init init_amd_microcode(void);
 #else
-static inline struct microcode_ops * __init init_amd_microcode(void)
+static inline const struct microcode_ops * __init init_amd_microcode(void)
 {
 	return NULL;
 }
diff -uriN linux-2.6.32.43/arch/x86/include/asm/mman.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/mman.h
--- linux-2.6.32.43/arch/x86/include/asm/mman.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/mman.h	2011-07-15 05:51:11.000000000 -0500
@@ -5,4 +5,14 @@
 
 #include <asm-generic/mman.h>
 
+#ifdef __KERNEL__
+#ifndef __ASSEMBLY__
+#ifdef CONFIG_X86_32
+#define arch_mmap_check	i386_mmap_check
+int i386_mmap_check(unsigned long addr, unsigned long len,
+		unsigned long flags);
+#endif
+#endif
+#endif
+
 #endif /* _ASM_X86_MMAN_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/mmu_context.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/mmu_context.h
--- linux-2.6.32.43/arch/x86/include/asm/mmu_context.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/mmu_context.h	2011-07-15 05:51:11.000000000 -0500
@@ -24,6 +24,21 @@
 
 static inline void enter_lazy_tlb(struct mm_struct *mm, struct task_struct *tsk)
 {
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	unsigned int i;
+	pgd_t *pgd;
+
+	pax_open_kernel();
+	pgd = get_cpu_pgd(smp_processor_id());
+	for (i = USER_PGD_PTRS; i < 2 * USER_PGD_PTRS; ++i)
+		if (paravirt_enabled())
+			set_pgd(pgd+i, native_make_pgd(0));
+		else
+			pgd[i] = native_make_pgd(0);
+	pax_close_kernel();
+#endif
+
 #ifdef CONFIG_SMP
 	if (percpu_read(cpu_tlbstate.state) == TLBSTATE_OK)
 		percpu_write(cpu_tlbstate.state, TLBSTATE_LAZY);
@@ -34,16 +49,30 @@
 			     struct task_struct *tsk)
 {
 	unsigned cpu = smp_processor_id();
+#if defined(CONFIG_X86_32) && defined(CONFIG_SMP)
+	int tlbstate = TLBSTATE_OK;
+#endif
 
 	if (likely(prev != next)) {
 #ifdef CONFIG_SMP
+#ifdef CONFIG_X86_32
+		tlbstate = percpu_read(cpu_tlbstate.state);
+#endif
 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
 		percpu_write(cpu_tlbstate.active_mm, next);
 #endif
 		cpumask_set_cpu(cpu, mm_cpumask(next));
 
 		/* Re-load page tables */
+#ifdef CONFIG_PAX_PER_CPU_PGD
+		pax_open_kernel();
+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
+		pax_close_kernel();
+		load_cr3(get_cpu_pgd(cpu));
+#else
 		load_cr3(next->pgd);
+#endif
 
 		/* stop flush ipis for the previous mm */
 		cpumask_clear_cpu(cpu, mm_cpumask(prev));
@@ -53,9 +82,38 @@
 		 */
 		if (unlikely(prev->context.ldt != next->context.ldt))
 			load_LDT_nolock(&next->context);
-	}
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
+		if (!nx_enabled) {
+			smp_mb__before_clear_bit();
+			cpu_clear(cpu, prev->context.cpu_user_cs_mask);
+			smp_mb__after_clear_bit();
+			cpu_set(cpu, next->context.cpu_user_cs_mask);
+		}
+#endif
+
+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
+		if (unlikely(prev->context.user_cs_base != next->context.user_cs_base ||
+			     prev->context.user_cs_limit != next->context.user_cs_limit))
+			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
 #ifdef CONFIG_SMP
+		else if (unlikely(tlbstate != TLBSTATE_OK))
+			set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
+#endif
+#endif
+
+	}
 	else {
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+		pax_open_kernel();
+		__clone_user_pgds(get_cpu_pgd(cpu), next->pgd, USER_PGD_PTRS);
+		__shadow_user_pgds(get_cpu_pgd(cpu) + USER_PGD_PTRS, next->pgd, USER_PGD_PTRS);
+		pax_close_kernel();
+		load_cr3(get_cpu_pgd(cpu));
+#endif
+
+#ifdef CONFIG_SMP
 		percpu_write(cpu_tlbstate.state, TLBSTATE_OK);
 		BUG_ON(percpu_read(cpu_tlbstate.active_mm) != next);
 
@@ -64,11 +122,28 @@
 			 * tlb flush IPI delivery. We must reload CR3
 			 * to make sure to use no freed page tables.
 			 */
+
+#ifndef CONFIG_PAX_PER_CPU_PGD
 			load_cr3(next->pgd);
+#endif
+
 			load_LDT_nolock(&next->context);
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
+			if (!nx_enabled)
+				cpu_set(cpu, next->context.cpu_user_cs_mask);
+#endif
+
+#if defined(CONFIG_X86_32) && (defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC))
+#ifdef CONFIG_PAX_PAGEEXEC
+			if (!((next->pax_flags & MF_PAX_PAGEEXEC) && nx_enabled))
+#endif
+				set_user_cs(next->context.user_cs_base, next->context.user_cs_limit, cpu);
+#endif
+
 		}
-	}
 #endif
+	}
 }
 
 #define activate_mm(prev, next)			\
diff -uriN linux-2.6.32.43/arch/x86/include/asm/mmu.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/mmu.h
--- linux-2.6.32.43/arch/x86/include/asm/mmu.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/mmu.h	2011-07-15 05:51:11.000000000 -0500
@@ -9,10 +9,23 @@
  * we put the segment information here.
  */
 typedef struct {
-	void *ldt;
+	struct desc_struct *ldt;
 	int size;
 	struct mutex lock;
-	void *vdso;
+	unsigned long vdso;
+
+#ifdef CONFIG_X86_32
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+	unsigned long user_cs_base;
+	unsigned long user_cs_limit;
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
+	cpumask_t cpu_user_cs_mask;
+#endif
+
+#endif
+#endif
+
 } mm_context_t;
 
 #ifdef CONFIG_SMP
diff -uriN linux-2.6.32.43/arch/x86/include/asm/module.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/module.h
--- linux-2.6.32.43/arch/x86/include/asm/module.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/module.h	2011-07-15 05:51:11.000000000 -0500
@@ -5,6 +5,7 @@
 
 #ifdef CONFIG_X86_64
 /* X86_64 does not define MODULE_PROC_FAMILY */
+#define MODULE_PROC_FAMILY ""
 #elif defined CONFIG_M386
 #define MODULE_PROC_FAMILY "386 "
 #elif defined CONFIG_M486
@@ -59,13 +60,36 @@
 #error unknown processor family
 #endif
 
-#ifdef CONFIG_X86_32
-# ifdef CONFIG_4KSTACKS
-#  define MODULE_STACKSIZE "4KSTACKS "
-# else
-#  define MODULE_STACKSIZE ""
-# endif
-# define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+#define MODULE_PAX_UDEREF "UDEREF "
+#else
+#define MODULE_PAX_UDEREF ""
+#endif
+
+#ifdef CONFIG_PAX_KERNEXEC
+#define MODULE_PAX_KERNEXEC "KERNEXEC "
+#else
+#define MODULE_PAX_KERNEXEC ""
+#endif
+
+#ifdef CONFIG_PAX_REFCOUNT
+#define MODULE_PAX_REFCOUNT "REFCOUNT "
+#else
+#define MODULE_PAX_REFCOUNT ""
 #endif
 
+#if defined(CONFIG_X86_32) && defined(CONFIG_4KSTACKS)
+#define MODULE_STACKSIZE "4KSTACKS "
+#else
+#define MODULE_STACKSIZE ""
+#endif
+
+#ifdef CONFIG_GRKERNSEC
+#define MODULE_GRSEC "GRSECURITY "
+#else
+#define MODULE_GRSEC ""
+#endif
+
+#define MODULE_ARCH_VERMAGIC MODULE_PROC_FAMILY MODULE_STACKSIZE MODULE_GRSEC MODULE_PAX_KERNEXEC MODULE_PAX_UDEREF MODULE_PAX_REFCOUNT
+
 #endif /* _ASM_X86_MODULE_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/page_64_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/page_64_types.h
--- linux-2.6.32.43/arch/x86/include/asm/page_64_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/page_64_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -56,7 +56,7 @@
 
 /* duplicated to the one in bootmem.h */
 extern unsigned long max_pfn;
-extern unsigned long phys_base;
+extern const unsigned long phys_base;
 
 extern unsigned long __phys_addr(unsigned long);
 #define __phys_reloc_hide(x)	(x)
diff -uriN linux-2.6.32.43/arch/x86/include/asm/paravirt.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/paravirt.h
--- linux-2.6.32.43/arch/x86/include/asm/paravirt.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/paravirt.h	2011-07-15 05:51:11.000000000 -0500
@@ -729,6 +729,21 @@
 	pv_mmu_ops.set_fixmap(idx, phys, flags);
 }
 
+#ifdef CONFIG_PAX_KERNEXEC
+static inline unsigned long pax_open_kernel(void)
+{
+	return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_open_kernel);
+}
+
+static inline unsigned long pax_close_kernel(void)
+{
+	return PVOP_CALL0(unsigned long, pv_mmu_ops.pax_close_kernel);
+}
+#else
+static inline unsigned long pax_open_kernel(void) { return 0; }
+static inline unsigned long pax_close_kernel(void) { return 0; }
+#endif
+
 #if defined(CONFIG_SMP) && defined(CONFIG_PARAVIRT_SPINLOCKS)
 
 static inline int __raw_spin_is_locked(struct raw_spinlock *lock)
@@ -945,7 +960,7 @@
 
 #define PARA_PATCH(struct, off)        ((PARAVIRT_PATCH_##struct + (off)) / 4)
 #define PARA_SITE(ptype, clobbers, ops) _PVSITE(ptype, clobbers, ops, .long, 4)
-#define PARA_INDIRECT(addr)	*%cs:addr
+#define PARA_INDIRECT(addr)	*%ss:addr
 #endif
 
 #define INTERRUPT_RETURN						\
@@ -1022,6 +1037,21 @@
 	PARA_SITE(PARA_PATCH(pv_cpu_ops, PV_CPU_irq_enable_sysexit),	\
 		  CLBR_NONE,						\
 		  jmp PARA_INDIRECT(pv_cpu_ops+PV_CPU_irq_enable_sysexit))
+
+#define GET_CR0_INTO_RDI				\
+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);	\
+	mov %rax,%rdi
+
+#define SET_RDI_INTO_CR0				\
+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
+
+#define GET_CR3_INTO_RDI				\
+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_read_cr3);	\
+	mov %rax,%rdi
+
+#define SET_RDI_INTO_CR3				\
+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_write_cr3)
+
 #endif	/* CONFIG_X86_32 */
 
 #endif /* __ASSEMBLY__ */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/paravirt_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/paravirt_types.h
--- linux-2.6.32.43/arch/x86/include/asm/paravirt_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/paravirt_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -316,6 +316,12 @@
 	   an mfn.  We can tell which is which from the index. */
 	void (*set_fixmap)(unsigned /* enum fixed_addresses */ idx,
 			   phys_addr_t phys, pgprot_t flags);
+
+#ifdef CONFIG_PAX_KERNEXEC
+	unsigned long (*pax_open_kernel)(void);
+	unsigned long (*pax_close_kernel)(void);
+#endif
+
 };
 
 struct raw_spinlock;
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pci_x86.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pci_x86.h
--- linux-2.6.32.43/arch/x86/include/asm/pci_x86.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pci_x86.h	2011-07-15 05:51:11.000000000 -0500
@@ -89,16 +89,16 @@
 extern void (*pcibios_disable_irq)(struct pci_dev *dev);
 
 struct pci_raw_ops {
-	int (*read)(unsigned int domain, unsigned int bus, unsigned int devfn,
+	int (* const read)(unsigned int domain, unsigned int bus, unsigned int devfn,
 						int reg, int len, u32 *val);
-	int (*write)(unsigned int domain, unsigned int bus, unsigned int devfn,
+	int (* const write)(unsigned int domain, unsigned int bus, unsigned int devfn,
 						int reg, int len, u32 val);
 };
 
-extern struct pci_raw_ops *raw_pci_ops;
-extern struct pci_raw_ops *raw_pci_ext_ops;
+extern const struct pci_raw_ops *raw_pci_ops;
+extern const struct pci_raw_ops *raw_pci_ext_ops;
 
-extern struct pci_raw_ops pci_direct_conf1;
+extern const struct pci_raw_ops pci_direct_conf1;
 extern bool port_cf9_safe;
 
 /* arch_initcall level */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgalloc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgalloc.h
--- linux-2.6.32.43/arch/x86/include/asm/pgalloc.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgalloc.h	2011-07-15 05:51:11.000000000 -0500
@@ -63,6 +63,13 @@
 				       pmd_t *pmd, pte_t *pte)
 {
 	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
+	set_pmd(pmd, __pmd(__pa(pte) | _KERNPG_TABLE));
+}
+
+static inline void pmd_populate_user(struct mm_struct *mm,
+				       pmd_t *pmd, pte_t *pte)
+{
+	paravirt_alloc_pte(mm, __pa(pte) >> PAGE_SHIFT);
 	set_pmd(pmd, __pmd(__pa(pte) | _PAGE_TABLE));
 }
 
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgtable-2level.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable-2level.h
--- linux-2.6.32.43/arch/x86/include/asm/pgtable-2level.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable-2level.h	2011-07-15 05:51:11.000000000 -0500
@@ -18,7 +18,9 @@
 
 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
+	pax_open_kernel();
 	*pmdp = pmd;
+	pax_close_kernel();
 }
 
 static inline void native_set_pte_atomic(pte_t *ptep, pte_t pte)
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgtable_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_32.h
--- linux-2.6.32.43/arch/x86/include/asm/pgtable_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -26,9 +26,6 @@
 struct mm_struct;
 struct vm_area_struct;
 
-extern pgd_t swapper_pg_dir[1024];
-extern pgd_t trampoline_pg_dir[1024];
-
 static inline void pgtable_cache_init(void) { }
 static inline void check_pgt_cache(void) { }
 void paging_init(void);
@@ -49,6 +46,12 @@
 # include <asm/pgtable-2level.h>
 #endif
 
+extern pgd_t swapper_pg_dir[PTRS_PER_PGD];
+extern pgd_t trampoline_pg_dir[PTRS_PER_PGD];
+#ifdef CONFIG_X86_PAE
+extern pmd_t swapper_pm_dir[PTRS_PER_PGD][PTRS_PER_PMD];
+#endif
+
 #if defined(CONFIG_HIGHPTE)
 #define __KM_PTE			\
 	(in_nmi() ? KM_NMI_PTE : 	\
@@ -73,7 +76,9 @@
 /* Clear a kernel PTE and flush it from the TLB */
 #define kpte_clear_flush(ptep, vaddr)		\
 do {						\
+	pax_open_kernel();			\
 	pte_clear(&init_mm, (vaddr), (ptep));	\
+	pax_close_kernel();			\
 	__flush_tlb_one((vaddr));		\
 } while (0)
 
@@ -85,6 +90,9 @@
 
 #endif /* !__ASSEMBLY__ */
 
+#define HAVE_ARCH_UNMAPPED_AREA
+#define HAVE_ARCH_UNMAPPED_AREA_TOPDOWN
+
 /*
  * kern_addr_valid() is (1) for FLATMEM and (0) for
  * SPARSEMEM and DISCONTIGMEM
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgtable_32_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_32_types.h
--- linux-2.6.32.43/arch/x86/include/asm/pgtable_32_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_32_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -8,7 +8,7 @@
  */
 #ifdef CONFIG_X86_PAE
 # include <asm/pgtable-3level_types.h>
-# define PMD_SIZE	(1UL << PMD_SHIFT)
+# define PMD_SIZE	(_AC(1, UL) << PMD_SHIFT)
 # define PMD_MASK	(~(PMD_SIZE - 1))
 #else
 # include <asm/pgtable-2level_types.h>
@@ -46,6 +46,19 @@
 # define VMALLOC_END	(FIXADDR_START - 2 * PAGE_SIZE)
 #endif
 
+#ifdef CONFIG_PAX_KERNEXEC
+#ifndef __ASSEMBLY__
+extern unsigned char MODULES_EXEC_VADDR[];
+extern unsigned char MODULES_EXEC_END[];
+#endif
+#include <asm/boot.h>
+#define ktla_ktva(addr)		(addr + LOAD_PHYSICAL_ADDR + PAGE_OFFSET)
+#define ktva_ktla(addr)		(addr - LOAD_PHYSICAL_ADDR - PAGE_OFFSET)
+#else
+#define ktla_ktva(addr)		(addr)
+#define ktva_ktla(addr)		(addr)
+#endif
+
 #define MODULES_VADDR	VMALLOC_START
 #define MODULES_END	VMALLOC_END
 #define MODULES_LEN	(MODULES_VADDR - MODULES_END)
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgtable-3level.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable-3level.h
--- linux-2.6.32.43/arch/x86/include/asm/pgtable-3level.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable-3level.h	2011-07-15 05:51:11.000000000 -0500
@@ -38,12 +38,16 @@
 
 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
+	pax_open_kernel();
 	set_64bit((unsigned long long *)(pmdp), native_pmd_val(pmd));
+	pax_close_kernel();
 }
 
 static inline void native_set_pud(pud_t *pudp, pud_t pud)
 {
+	pax_open_kernel();
 	set_64bit((unsigned long long *)(pudp), native_pud_val(pud));
+	pax_close_kernel();
 }
 
 /*
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgtable_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_64.h
--- linux-2.6.32.43/arch/x86/include/asm/pgtable_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -16,10 +16,13 @@
 
 extern pud_t level3_kernel_pgt[512];
 extern pud_t level3_ident_pgt[512];
+extern pud_t level3_vmalloc_pgt[512];
+extern pud_t level3_vmemmap_pgt[512];
+extern pud_t level2_vmemmap_pgt[512];
 extern pmd_t level2_kernel_pgt[512];
 extern pmd_t level2_fixmap_pgt[512];
-extern pmd_t level2_ident_pgt[512];
-extern pgd_t init_level4_pgt[];
+extern pmd_t level2_ident_pgt[512*2];
+extern pgd_t init_level4_pgt[512];
 
 #define swapper_pg_dir init_level4_pgt
 
@@ -74,7 +77,9 @@
 
 static inline void native_set_pmd(pmd_t *pmdp, pmd_t pmd)
 {
+	pax_open_kernel();
 	*pmdp = pmd;
+	pax_close_kernel();
 }
 
 static inline void native_pmd_clear(pmd_t *pmd)
@@ -94,7 +99,9 @@
 
 static inline void native_set_pgd(pgd_t *pgdp, pgd_t pgd)
 {
+	pax_open_kernel();
 	*pgdp = pgd;
+	pax_close_kernel();
 }
 
 static inline void native_pgd_clear(pgd_t *pgd)
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgtable_64_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_64_types.h
--- linux-2.6.32.43/arch/x86/include/asm/pgtable_64_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_64_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -59,5 +59,10 @@
 #define MODULES_VADDR    _AC(0xffffffffa0000000, UL)
 #define MODULES_END      _AC(0xffffffffff000000, UL)
 #define MODULES_LEN   (MODULES_END - MODULES_VADDR)
+#define MODULES_EXEC_VADDR MODULES_VADDR
+#define MODULES_EXEC_END MODULES_END
+
+#define ktla_ktva(addr)		(addr)
+#define ktva_ktla(addr)		(addr)
 
 #endif /* _ASM_X86_PGTABLE_64_DEFS_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgtable.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable.h
--- linux-2.6.32.43/arch/x86/include/asm/pgtable.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable.h	2011-07-15 05:51:11.000000000 -0500
@@ -74,12 +74,51 @@
 
 #define arch_end_context_switch(prev)	do {} while(0)
 
+#define pax_open_kernel()	native_pax_open_kernel()
+#define pax_close_kernel()	native_pax_close_kernel()
 #endif	/* CONFIG_PARAVIRT */
 
+#define  __HAVE_ARCH_PAX_OPEN_KERNEL
+#define  __HAVE_ARCH_PAX_CLOSE_KERNEL
+
+#ifdef CONFIG_PAX_KERNEXEC
+static inline unsigned long native_pax_open_kernel(void)
+{
+	unsigned long cr0;
+
+	preempt_disable();
+	barrier();
+	cr0 = read_cr0() ^ X86_CR0_WP;
+	BUG_ON(unlikely(cr0 & X86_CR0_WP));
+	write_cr0(cr0);
+	return cr0 ^ X86_CR0_WP;
+}
+
+static inline unsigned long native_pax_close_kernel(void)
+{
+	unsigned long cr0;
+
+	cr0 = read_cr0() ^ X86_CR0_WP;
+	BUG_ON(unlikely(!(cr0 & X86_CR0_WP)));
+	write_cr0(cr0);
+	barrier();
+	preempt_enable_no_resched();
+	return cr0 ^ X86_CR0_WP;
+}
+#else
+static inline unsigned long native_pax_open_kernel(void) { return 0; }
+static inline unsigned long native_pax_close_kernel(void) { return 0; }
+#endif
+
 /*
  * The following only work if pte_present() is true.
  * Undefined behaviour if not..
  */
+static inline int pte_user(pte_t pte)
+{
+	return pte_val(pte) & _PAGE_USER;
+}
+
 static inline int pte_dirty(pte_t pte)
 {
 	return pte_flags(pte) & _PAGE_DIRTY;
@@ -167,9 +206,29 @@
 	return pte_clear_flags(pte, _PAGE_RW);
 }
 
+static inline pte_t pte_mkread(pte_t pte)
+{
+	return __pte(pte_val(pte) | _PAGE_USER);
+}
+
 static inline pte_t pte_mkexec(pte_t pte)
 {
-	return pte_clear_flags(pte, _PAGE_NX);
+#ifdef CONFIG_X86_PAE
+	if (__supported_pte_mask & _PAGE_NX)
+		return pte_clear_flags(pte, _PAGE_NX);
+	else
+#endif
+		return pte_set_flags(pte, _PAGE_USER);
+}
+
+static inline pte_t pte_exprotect(pte_t pte)
+{
+#ifdef CONFIG_X86_PAE
+	if (__supported_pte_mask & _PAGE_NX)
+		return pte_set_flags(pte, _PAGE_NX);
+	else
+#endif
+		return pte_clear_flags(pte, _PAGE_USER);
 }
 
 static inline pte_t pte_mkdirty(pte_t pte)
@@ -302,6 +361,15 @@
 #endif
 
 #ifndef __ASSEMBLY__
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+extern pgd_t cpu_pgd[NR_CPUS][PTRS_PER_PGD];
+static inline pgd_t *get_cpu_pgd(unsigned int cpu)
+{
+	return cpu_pgd[cpu];
+}
+#endif
+
 #include <linux/mm_types.h>
 
 static inline int pte_none(pte_t pte)
@@ -472,7 +540,7 @@
 
 static inline int pgd_bad(pgd_t pgd)
 {
-	return (pgd_flags(pgd) & ~_PAGE_USER) != _KERNPG_TABLE;
+	return (pgd_flags(pgd) & ~(_PAGE_USER | _PAGE_NX)) != _KERNPG_TABLE;
 }
 
 static inline int pgd_none(pgd_t pgd)
@@ -495,7 +563,12 @@
  * pgd_offset() returns a (pgd_t *)
  * pgd_index() is used get the offset into the pgd page's array of pgd_t's;
  */
-#define pgd_offset(mm, address) ((mm)->pgd + pgd_index((address)))
+#define pgd_offset(mm, address) ((mm)->pgd + pgd_index(address))
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+#define pgd_offset_cpu(cpu, address) (get_cpu_pgd(cpu) + pgd_index(address))
+#endif
+
 /*
  * a shortcut which implies the use of the kernel's pgd, instead
  * of a process's
@@ -506,6 +579,20 @@
 #define KERNEL_PGD_BOUNDARY	pgd_index(PAGE_OFFSET)
 #define KERNEL_PGD_PTRS		(PTRS_PER_PGD - KERNEL_PGD_BOUNDARY)
 
+#ifdef CONFIG_X86_32
+#define USER_PGD_PTRS		KERNEL_PGD_BOUNDARY
+#else
+#define TASK_SIZE_MAX_SHIFT CONFIG_TASK_SIZE_MAX_SHIFT
+#define USER_PGD_PTRS		(_AC(1,UL) << (TASK_SIZE_MAX_SHIFT - PGDIR_SHIFT))
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+#define PAX_USER_SHADOW_BASE	(_AC(1,UL) << TASK_SIZE_MAX_SHIFT)
+#else
+#define PAX_USER_SHADOW_BASE	(_AC(0,UL))
+#endif
+
+#endif
+
 #ifndef __ASSEMBLY__
 
 extern int direct_gbpages;
@@ -611,11 +698,23 @@
  * dst and src can be on the same page, but the range must not overlap,
  * and must not cross a page boundary.
  */
-static inline void clone_pgd_range(pgd_t *dst, pgd_t *src, int count)
+static inline void clone_pgd_range(pgd_t *dst, const pgd_t *src, int count)
 {
-       memcpy(dst, src, count * sizeof(pgd_t));
+	pax_open_kernel();
+	while (count--)
+		*dst++ = *src++;
+	pax_close_kernel();
 }
 
+#ifdef CONFIG_PAX_PER_CPU_PGD
+extern void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count);
+#endif
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+extern void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count);
+#else
+static inline void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count) {}
+#endif
 
 #include <asm-generic/pgtable.h>
 #endif	/* __ASSEMBLY__ */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/pgtable_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_types.h
--- linux-2.6.32.43/arch/x86/include/asm/pgtable_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/pgtable_types.h	2011-07-15 05:51:11.000000000 -0500
@@ -16,12 +16,11 @@
 #define _PAGE_BIT_PSE		7	/* 4 MB (or 2MB) page */
 #define _PAGE_BIT_PAT		7	/* on 4KB pages */
 #define _PAGE_BIT_GLOBAL	8	/* Global TLB entry PPro+ */
-#define _PAGE_BIT_UNUSED1	9	/* available for programmer */
+#define _PAGE_BIT_SPECIAL	9	/* special mappings, no associated struct page */
 #define _PAGE_BIT_IOMAP		10	/* flag used to indicate IO mapping */
 #define _PAGE_BIT_HIDDEN	11	/* hidden by kmemcheck */
 #define _PAGE_BIT_PAT_LARGE	12	/* On 2MB or 1GB pages */
-#define _PAGE_BIT_SPECIAL	_PAGE_BIT_UNUSED1
-#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_UNUSED1
+#define _PAGE_BIT_CPA_TEST	_PAGE_BIT_SPECIAL
 #define _PAGE_BIT_NX           63       /* No execute: only valid after cpuid check */
 
 /* If _PAGE_BIT_PRESENT is clear, we use these: */
@@ -39,7 +38,6 @@
 #define _PAGE_DIRTY	(_AT(pteval_t, 1) << _PAGE_BIT_DIRTY)
 #define _PAGE_PSE	(_AT(pteval_t, 1) << _PAGE_BIT_PSE)
 #define _PAGE_GLOBAL	(_AT(pteval_t, 1) << _PAGE_BIT_GLOBAL)
-#define _PAGE_UNUSED1	(_AT(pteval_t, 1) << _PAGE_BIT_UNUSED1)
 #define _PAGE_IOMAP	(_AT(pteval_t, 1) << _PAGE_BIT_IOMAP)
 #define _PAGE_PAT	(_AT(pteval_t, 1) << _PAGE_BIT_PAT)
 #define _PAGE_PAT_LARGE (_AT(pteval_t, 1) << _PAGE_BIT_PAT_LARGE)
@@ -55,8 +53,10 @@
 
 #if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
 #define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_NX)
-#else
+#elif defined(CONFIG_KMEMCHECK)
 #define _PAGE_NX	(_AT(pteval_t, 0))
+#else
+#define _PAGE_NX	(_AT(pteval_t, 1) << _PAGE_BIT_HIDDEN)
 #endif
 
 #define _PAGE_FILE	(_AT(pteval_t, 1) << _PAGE_BIT_FILE)
@@ -93,6 +93,9 @@
 #define PAGE_READONLY_EXEC	__pgprot(_PAGE_PRESENT | _PAGE_USER |	\
 					 _PAGE_ACCESSED)
 
+#define PAGE_READONLY_NOEXEC PAGE_READONLY
+#define PAGE_SHARED_NOEXEC PAGE_SHARED
+
 #define __PAGE_KERNEL_EXEC						\
 	(_PAGE_PRESENT | _PAGE_RW | _PAGE_DIRTY | _PAGE_ACCESSED | _PAGE_GLOBAL)
 #define __PAGE_KERNEL		(__PAGE_KERNEL_EXEC | _PAGE_NX)
@@ -103,8 +106,8 @@
 #define __PAGE_KERNEL_WC		(__PAGE_KERNEL | _PAGE_CACHE_WC)
 #define __PAGE_KERNEL_NOCACHE		(__PAGE_KERNEL | _PAGE_PCD | _PAGE_PWT)
 #define __PAGE_KERNEL_UC_MINUS		(__PAGE_KERNEL | _PAGE_PCD)
-#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RX | _PAGE_USER)
-#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_VSYSCALL | _PAGE_PCD | _PAGE_PWT)
+#define __PAGE_KERNEL_VSYSCALL		(__PAGE_KERNEL_RO | _PAGE_USER)
+#define __PAGE_KERNEL_VSYSCALL_NOCACHE	(__PAGE_KERNEL_RO | _PAGE_PCD | _PAGE_PWT | _PAGE_USER)
 #define __PAGE_KERNEL_LARGE		(__PAGE_KERNEL | _PAGE_PSE)
 #define __PAGE_KERNEL_LARGE_NOCACHE	(__PAGE_KERNEL | _PAGE_CACHE_UC | _PAGE_PSE)
 #define __PAGE_KERNEL_LARGE_EXEC	(__PAGE_KERNEL_EXEC | _PAGE_PSE)
@@ -163,8 +166,8 @@
  * bits are combined, this will alow user to access the high address mapped
  * VDSO in the presence of CONFIG_COMPAT_VDSO
  */
-#define PTE_IDENT_ATTR	 0x003		/* PRESENT+RW */
-#define PDE_IDENT_ATTR	 0x067		/* PRESENT+RW+USER+DIRTY+ACCESSED */
+#define PTE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
+#define PDE_IDENT_ATTR	 0x063		/* PRESENT+RW+DIRTY+ACCESSED */
 #define PGD_IDENT_ATTR	 0x001		/* PRESENT (no other attributes) */
 #endif
 
@@ -202,7 +205,17 @@
 {
 	return native_pgd_val(pgd) & PTE_FLAGS_MASK;
 }
+#endif
 
+#if PAGETABLE_LEVELS == 3
+#include <asm-generic/pgtable-nopud.h>
+#endif
+
+#if PAGETABLE_LEVELS == 2
+#include <asm-generic/pgtable-nopmd.h>
+#endif
+
+#ifndef __ASSEMBLY__
 #if PAGETABLE_LEVELS > 3
 typedef struct { pudval_t pud; } pud_t;
 
@@ -216,8 +229,6 @@
 	return pud.pud;
 }
 #else
-#include <asm-generic/pgtable-nopud.h>
-
 static inline pudval_t native_pud_val(pud_t pud)
 {
 	return native_pgd_val(pud.pgd);
@@ -237,8 +248,6 @@
 	return pmd.pmd;
 }
 #else
-#include <asm-generic/pgtable-nopmd.h>
-
 static inline pmdval_t native_pmd_val(pmd_t pmd)
 {
 	return native_pgd_val(pmd.pud.pgd);
@@ -278,7 +287,16 @@
 
 extern pteval_t __supported_pte_mask;
 extern void set_nx(void);
+
+#ifdef CONFIG_X86_32
+#ifdef CONFIG_X86_PAE
 extern int nx_enabled;
+#else
+#define nx_enabled (0)
+#endif
+#else
+#define nx_enabled (1)
+#endif
 
 #define pgprot_writecombine	pgprot_writecombine
 extern pgprot_t pgprot_writecombine(pgprot_t prot);
diff -uriN linux-2.6.32.43/arch/x86/include/asm/processor.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/processor.h
--- linux-2.6.32.43/arch/x86/include/asm/processor.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/processor.h	2011-07-15 05:51:11.000000000 -0500
@@ -272,7 +272,7 @@
 
 } ____cacheline_aligned;
 
-DECLARE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss);
+extern struct tss_struct init_tss[NR_CPUS];
 
 /*
  * Save the original ist values for checking stack pointers during debugging
@@ -888,11 +888,18 @@
  */
 #define TASK_SIZE		PAGE_OFFSET
 #define TASK_SIZE_MAX		TASK_SIZE
+
+#ifdef CONFIG_PAX_SEGMEXEC
+#define SEGMEXEC_TASK_SIZE	(TASK_SIZE / 2)
+#define STACK_TOP		((current->mm->pax_flags & MF_PAX_SEGMEXEC)?SEGMEXEC_TASK_SIZE:TASK_SIZE)
+#else
 #define STACK_TOP		TASK_SIZE
-#define STACK_TOP_MAX		STACK_TOP
+#endif
+
+#define STACK_TOP_MAX		TASK_SIZE
 
 #define INIT_THREAD  {							  \
-	.sp0			= sizeof(init_stack) + (long)&init_stack, \
+	.sp0			= sizeof(init_stack) + (long)&init_stack - 8, \
 	.vm86_info		= NULL,					  \
 	.sysenter_cs		= __KERNEL_CS,				  \
 	.io_bitmap_ptr		= NULL,					  \
@@ -906,7 +913,7 @@
  */
 #define INIT_TSS  {							  \
 	.x86_tss = {							  \
-		.sp0		= sizeof(init_stack) + (long)&init_stack, \
+		.sp0		= sizeof(init_stack) + (long)&init_stack - 8, \
 		.ss0		= __KERNEL_DS,				  \
 		.ss1		= __KERNEL_CS,				  \
 		.io_bitmap_base	= INVALID_IO_BITMAP_OFFSET,		  \
@@ -917,11 +924,7 @@
 extern unsigned long thread_saved_pc(struct task_struct *tsk);
 
 #define THREAD_SIZE_LONGS      (THREAD_SIZE/sizeof(unsigned long))
-#define KSTK_TOP(info)                                                 \
-({                                                                     \
-       unsigned long *__ptr = (unsigned long *)(info);                 \
-       (unsigned long)(&__ptr[THREAD_SIZE_LONGS]);                     \
-})
+#define KSTK_TOP(info)         ((container_of(info, struct task_struct, tinfo))->thread.sp0)
 
 /*
  * The below -8 is to reserve 8 bytes on top of the ring0 stack.
@@ -936,7 +939,7 @@
 #define task_pt_regs(task)                                             \
 ({                                                                     \
        struct pt_regs *__regs__;                                       \
-       __regs__ = (struct pt_regs *)(KSTK_TOP(task_stack_page(task))-8); \
+       __regs__ = (struct pt_regs *)((task)->thread.sp0);              \
        __regs__ - 1;                                                   \
 })
 
@@ -946,13 +949,13 @@
 /*
  * User space process size. 47bits minus one guard page.
  */
-#define TASK_SIZE_MAX	((1UL << 47) - PAGE_SIZE)
+#define TASK_SIZE_MAX	((1UL << TASK_SIZE_MAX_SHIFT) - PAGE_SIZE)
 
 /* This decides where the kernel will search for a free chunk of vm
  * space during mmap's.
  */
 #define IA32_PAGE_OFFSET	((current->personality & ADDR_LIMIT_3GB) ? \
-					0xc0000000 : 0xFFFFe000)
+					0xc0000000 : 0xFFFFf000)
 
 #define TASK_SIZE		(test_thread_flag(TIF_IA32) ? \
 					IA32_PAGE_OFFSET : TASK_SIZE_MAX)
@@ -963,11 +966,11 @@
 #define STACK_TOP_MAX		TASK_SIZE_MAX
 
 #define INIT_THREAD  { \
-	.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
+	.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
 }
 
 #define INIT_TSS  { \
-	.x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) \
+	.x86_tss.sp0 = (unsigned long)&init_stack + sizeof(init_stack) - 16 \
 }
 
 /*
@@ -989,6 +992,10 @@
  */
 #define TASK_UNMAPPED_BASE	(PAGE_ALIGN(TASK_SIZE / 3))
 
+#ifdef CONFIG_PAX_SEGMEXEC
+#define SEGMEXEC_TASK_UNMAPPED_BASE	(PAGE_ALIGN(SEGMEXEC_TASK_SIZE / 3))
+#endif
+
 #define KSTK_EIP(task)		(task_pt_regs(task)->ip)
 
 /* Get/set a process' ability to use the timestamp counter instruction */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/ptrace.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/ptrace.h
--- linux-2.6.32.43/arch/x86/include/asm/ptrace.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/ptrace.h	2011-07-15 05:51:11.000000000 -0500
@@ -151,28 +151,29 @@
 }
 
 /*
- * user_mode_vm(regs) determines whether a register set came from user mode.
+ * user_mode(regs) determines whether a register set came from user mode.
  * This is true if V8086 mode was enabled OR if the register set was from
  * protected mode with RPL-3 CS value.  This tricky test checks that with
  * one comparison.  Many places in the kernel can bypass this full check
- * if they have already ruled out V8086 mode, so user_mode(regs) can be used.
+ * if they have already ruled out V8086 mode, so user_mode_novm(regs) can
+ * be used.
  */
-static inline int user_mode(struct pt_regs *regs)
+static inline int user_mode_novm(struct pt_regs *regs)
 {
 #ifdef CONFIG_X86_32
 	return (regs->cs & SEGMENT_RPL_MASK) == USER_RPL;
 #else
-	return !!(regs->cs & 3);
+	return !!(regs->cs & SEGMENT_RPL_MASK);
 #endif
 }
 
-static inline int user_mode_vm(struct pt_regs *regs)
+static inline int user_mode(struct pt_regs *regs)
 {
 #ifdef CONFIG_X86_32
 	return ((regs->cs & SEGMENT_RPL_MASK) | (regs->flags & X86_VM_MASK)) >=
 		USER_RPL;
 #else
-	return user_mode(regs);
+	return user_mode_novm(regs);
 #endif
 }
 
diff -uriN linux-2.6.32.43/arch/x86/include/asm/reboot.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/reboot.h
--- linux-2.6.32.43/arch/x86/include/asm/reboot.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/reboot.h	2011-07-15 05:51:11.000000000 -0500
@@ -6,19 +6,19 @@
 struct pt_regs;
 
 struct machine_ops {
-	void (*restart)(char *cmd);
-	void (*halt)(void);
-	void (*power_off)(void);
+	void (* __noreturn restart)(char *cmd);
+	void (* __noreturn halt)(void);
+	void (* __noreturn power_off)(void);
 	void (*shutdown)(void);
 	void (*crash_shutdown)(struct pt_regs *);
-	void (*emergency_restart)(void);
+	void (* __noreturn emergency_restart)(void);
 };
 
 extern struct machine_ops machine_ops;
 
 void native_machine_crash_shutdown(struct pt_regs *regs);
 void native_machine_shutdown(void);
-void machine_real_restart(const unsigned char *code, int length);
+void machine_real_restart(const unsigned char *code, unsigned int length) __noreturn;
 
 typedef void (*nmi_shootdown_cb)(int, struct die_args*);
 void nmi_shootdown_cpus(nmi_shootdown_cb callback);
diff -uriN linux-2.6.32.43/arch/x86/include/asm/rwsem.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/rwsem.h
--- linux-2.6.32.43/arch/x86/include/asm/rwsem.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/rwsem.h	2011-07-15 05:51:11.000000000 -0500
@@ -118,6 +118,14 @@
 {
 	asm volatile("# beginning down_read\n\t"
 		     LOCK_PREFIX _ASM_INC "(%1)\n\t"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX _ASM_DEC "(%1)\n\t"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     /* adds 0x00000001, returns the old value */
 		     "  jns        1f\n"
 		     "  call call_rwsem_down_read_failed\n"
@@ -139,6 +147,14 @@
 		     "1:\n\t"
 		     "  mov          %1,%2\n\t"
 		     "  add          %3,%2\n\t"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     "sub %3,%2\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     "  jle	     2f\n\t"
 		     LOCK_PREFIX "  cmpxchg  %2,%0\n\t"
 		     "  jnz	     1b\n\t"
@@ -160,6 +176,14 @@
 	tmp = RWSEM_ACTIVE_WRITE_BIAS;
 	asm volatile("# beginning down_write\n\t"
 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     "mov %1,(%2)\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     /* subtract 0x0000ffff, returns the old value */
 		     "  test      %1,%1\n\t"
 		     /* was the count 0 before? */
@@ -198,6 +222,14 @@
 	rwsem_count_t tmp = -RWSEM_ACTIVE_READ_BIAS;
 	asm volatile("# beginning __up_read\n\t"
 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     "mov %1,(%2)\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     /* subtracts 1, returns the old value */
 		     "  jns        1f\n\t"
 		     "  call call_rwsem_wake\n"
@@ -216,6 +248,14 @@
 	rwsem_count_t tmp;
 	asm volatile("# beginning __up_write\n\t"
 		     LOCK_PREFIX "  xadd      %1,(%2)\n\t"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     "mov %1,(%2)\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     /* tries to transition
 			0xffff0001 -> 0x00000000 */
 		     "  jz       1f\n"
@@ -234,6 +274,14 @@
 {
 	asm volatile("# beginning __downgrade_write\n\t"
 		     LOCK_PREFIX _ASM_ADD "%2,(%1)\n\t"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX _ASM_SUB "%2,(%1)\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     /*
 		      * transitions 0xZZZZ0001 -> 0xYYYY0001 (i386)
 		      *     0xZZZZZZZZ00000001 -> 0xYYYYYYYY00000001 (x86_64)
@@ -253,7 +301,15 @@
 static inline void rwsem_atomic_add(rwsem_count_t delta,
 				    struct rw_semaphore *sem)
 {
-	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0"
+	asm volatile(LOCK_PREFIX _ASM_ADD "%1,%0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX _ASM_SUB "%1,%0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "+m" (sem->count)
 		     : "er" (delta));
 }
@@ -266,7 +322,15 @@
 {
 	rwsem_count_t tmp = delta;
 
-	asm volatile(LOCK_PREFIX "xadd %0,%1"
+	asm volatile(LOCK_PREFIX "xadd %0,%1\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     "mov %0,%1\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "+r" (tmp), "+m" (sem->count)
 		     : : "memory");
 
diff -uriN linux-2.6.32.43/arch/x86/include/asm/segment.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/segment.h
--- linux-2.6.32.43/arch/x86/include/asm/segment.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/segment.h	2011-07-15 05:51:11.000000000 -0500
@@ -62,8 +62,8 @@
  *  26 - ESPFIX small SS
  *  27 - per-cpu			[ offset to per-cpu data area ]
  *  28 - stack_canary-20		[ for stack protector ]
- *  29 - unused
- *  30 - unused
+ *  29 - PCI BIOS CS
+ *  30 - PCI BIOS DS
  *  31 - TSS for double fault handler
  */
 #define GDT_ENTRY_TLS_MIN	6
@@ -77,6 +77,8 @@
 
 #define GDT_ENTRY_KERNEL_CS		(GDT_ENTRY_KERNEL_BASE + 0)
 
+#define GDT_ENTRY_KERNEXEC_KERNEL_CS	(4)
+
 #define GDT_ENTRY_KERNEL_DS		(GDT_ENTRY_KERNEL_BASE + 1)
 
 #define GDT_ENTRY_TSS			(GDT_ENTRY_KERNEL_BASE + 4)
@@ -88,7 +90,7 @@
 #define GDT_ENTRY_ESPFIX_SS		(GDT_ENTRY_KERNEL_BASE + 14)
 #define __ESPFIX_SS (GDT_ENTRY_ESPFIX_SS * 8)
 
-#define GDT_ENTRY_PERCPU			(GDT_ENTRY_KERNEL_BASE + 15)
+#define GDT_ENTRY_PERCPU		(GDT_ENTRY_KERNEL_BASE + 15)
 #ifdef CONFIG_SMP
 #define __KERNEL_PERCPU (GDT_ENTRY_PERCPU * 8)
 #else
@@ -102,6 +104,12 @@
 #define __KERNEL_STACK_CANARY		0
 #endif
 
+#define GDT_ENTRY_PCIBIOS_CS		(GDT_ENTRY_KERNEL_BASE + 17)
+#define __PCIBIOS_CS (GDT_ENTRY_PCIBIOS_CS * 8)
+
+#define GDT_ENTRY_PCIBIOS_DS		(GDT_ENTRY_KERNEL_BASE + 18)
+#define __PCIBIOS_DS (GDT_ENTRY_PCIBIOS_DS * 8)
+
 #define GDT_ENTRY_DOUBLEFAULT_TSS	31
 
 /*
@@ -139,7 +147,7 @@
  */
 
 /* Matches PNP_CS32 and PNP_CS16 (they must be consecutive) */
-#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xf4) == GDT_ENTRY_PNPBIOS_BASE * 8)
+#define SEGMENT_IS_PNP_CODE(x)   (((x) & 0xFFFCU) == PNP_CS32 || ((x) & 0xFFFCU) == PNP_CS16)
 
 
 #else
@@ -163,6 +171,8 @@
 #define __USER32_CS   (GDT_ENTRY_DEFAULT_USER32_CS * 8 + 3)
 #define __USER32_DS	__USER_DS
 
+#define GDT_ENTRY_KERNEXEC_KERNEL_CS 7
+
 #define GDT_ENTRY_TSS 8	/* needs two entries */
 #define GDT_ENTRY_LDT 10 /* needs two entries */
 #define GDT_ENTRY_TLS_MIN 12
@@ -183,6 +193,7 @@
 #endif
 
 #define __KERNEL_CS	(GDT_ENTRY_KERNEL_CS * 8)
+#define __KERNEXEC_KERNEL_CS	(GDT_ENTRY_KERNEXEC_KERNEL_CS * 8)
 #define __KERNEL_DS	(GDT_ENTRY_KERNEL_DS * 8)
 #define __USER_DS     (GDT_ENTRY_DEFAULT_USER_DS* 8 + 3)
 #define __USER_CS     (GDT_ENTRY_DEFAULT_USER_CS* 8 + 3)
diff -uriN linux-2.6.32.43/arch/x86/include/asm/smp.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/smp.h
--- linux-2.6.32.43/arch/x86/include/asm/smp.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/smp.h	2011-07-15 05:51:11.000000000 -0500
@@ -24,7 +24,7 @@
 DECLARE_PER_CPU(cpumask_var_t, cpu_sibling_map);
 DECLARE_PER_CPU(cpumask_var_t, cpu_core_map);
 DECLARE_PER_CPU(u16, cpu_llc_id);
-DECLARE_PER_CPU(int, cpu_number);
+DECLARE_PER_CPU(unsigned int, cpu_number);
 
 static inline struct cpumask *cpu_sibling_mask(int cpu)
 {
@@ -40,10 +40,7 @@
 DECLARE_EARLY_PER_CPU(u16, x86_bios_cpu_apicid);
 
 /* Static state in head.S used to set up a CPU */
-extern struct {
-	void *sp;
-	unsigned short ss;
-} stack_start;
+extern unsigned long stack_start; /* Initial stack pointer address */
 
 struct smp_ops {
 	void (*smp_prepare_boot_cpu)(void);
@@ -175,14 +172,8 @@
 extern int safe_smp_processor_id(void);
 
 #elif defined(CONFIG_X86_64_SMP)
-#define raw_smp_processor_id() (percpu_read(cpu_number))
-
-#define stack_smp_processor_id()					\
-({								\
-	struct thread_info *ti;						\
-	__asm__("andq %%rsp,%0; ":"=r" (ti) : "0" (CURRENT_MASK));	\
-	ti->cpu;							\
-})
+#define raw_smp_processor_id()		(percpu_read(cpu_number))
+#define stack_smp_processor_id()	raw_smp_processor_id()
 #define safe_smp_processor_id()		smp_processor_id()
 
 #endif
diff -uriN linux-2.6.32.43/arch/x86/include/asm/spinlock.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/spinlock.h
--- linux-2.6.32.43/arch/x86/include/asm/spinlock.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/spinlock.h	2011-07-15 05:51:11.000000000 -0500
@@ -249,6 +249,14 @@
 static inline void __raw_read_lock(raw_rwlock_t *rw)
 {
 	asm volatile(LOCK_PREFIX " subl $1,(%0)\n\t"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX " addl $1,(%0)\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     "jns 1f\n"
 		     "call __read_lock_failed\n\t"
 		     "1:\n"
@@ -258,6 +266,14 @@
 static inline void __raw_write_lock(raw_rwlock_t *rw)
 {
 	asm volatile(LOCK_PREFIX " subl %1,(%0)\n\t"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX " addl %1,(%0)\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     "jz 1f\n"
 		     "call __write_lock_failed\n\t"
 		     "1:\n"
@@ -286,12 +302,29 @@
 
 static inline void __raw_read_unlock(raw_rwlock_t *rw)
 {
-	asm volatile(LOCK_PREFIX "incl %0" :"+m" (rw->lock) : : "memory");
+	asm volatile(LOCK_PREFIX "incl %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "decl %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
+		     :"+m" (rw->lock) : : "memory");
 }
 
 static inline void __raw_write_unlock(raw_rwlock_t *rw)
 {
-	asm volatile(LOCK_PREFIX "addl %1, %0"
+	asm volatile(LOCK_PREFIX "addl %1, %0\n"
+
+#ifdef CONFIG_PAX_REFCOUNT
+		     "jno 0f\n"
+		     LOCK_PREFIX "subl %1, %0\n"
+		     "int $4\n0:\n"
+		     _ASM_EXTABLE(0b, 0b)
+#endif
+
 		     : "+m" (rw->lock) : "i" (RW_LOCK_BIAS) : "memory");
 }
 
diff -uriN linux-2.6.32.43/arch/x86/include/asm/stackprotector.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/stackprotector.h
--- linux-2.6.32.43/arch/x86/include/asm/stackprotector.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/stackprotector.h	2011-07-15 05:51:11.000000000 -0500
@@ -48,7 +48,7 @@
  * head_32 for boot CPU and setup_per_cpu_areas() for others.
  */
 #define GDT_STACK_CANARY_INIT						\
-	[GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x18),
+	[GDT_ENTRY_STACK_CANARY] = GDT_ENTRY_INIT(0x4090, 0, 0x17),
 
 /*
  * Initialize the stackprotector canary value.
@@ -113,7 +113,7 @@
 
 static inline void load_stack_canary_segment(void)
 {
-#ifdef CONFIG_X86_32
+#if defined(CONFIG_X86_32) && !defined(CONFIG_PAX_MEMORY_UDEREF)
 	asm volatile ("mov %0, %%gs" : : "r" (0));
 #endif
 }
diff -uriN linux-2.6.32.43/arch/x86/include/asm/system.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/system.h
--- linux-2.6.32.43/arch/x86/include/asm/system.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/system.h	2011-07-15 05:51:11.000000000 -0500
@@ -132,7 +132,7 @@
 	     "thread_return:\n\t"					  \
 	     "movq "__percpu_arg([current_task])",%%rsi\n\t"		  \
 	     __switch_canary						  \
-	     "movq %P[thread_info](%%rsi),%%r8\n\t"			  \
+	     "movq "__percpu_arg([thread_info])",%%r8\n\t"		  \
 	     "movq %%rax,%%rdi\n\t" 					  \
 	     "testl  %[_tif_fork],%P[ti_flags](%%r8)\n\t"	  \
 	     "jnz   ret_from_fork\n\t"					  \
@@ -143,7 +143,7 @@
 	       [threadrsp] "i" (offsetof(struct task_struct, thread.sp)), \
 	       [ti_flags] "i" (offsetof(struct thread_info, flags)),	  \
 	       [_tif_fork] "i" (_TIF_FORK),			  	  \
-	       [thread_info] "i" (offsetof(struct task_struct, stack)),   \
+	       [thread_info] "m" (per_cpu_var(current_tinfo)),		  \
 	       [current_task] "m" (per_cpu_var(current_task))		  \
 	       __switch_canary_iparam					  \
 	     : "memory", "cc" __EXTRA_CLOBBER)
@@ -200,7 +200,7 @@
 {
 	unsigned long __limit;
 	asm("lsll %1,%0" : "=r" (__limit) : "r" (segment));
-	return __limit + 1;
+	return __limit;
 }
 
 static inline void native_clts(void)
@@ -340,12 +340,12 @@
 
 void cpu_idle_wait(void);
 
-extern unsigned long arch_align_stack(unsigned long sp);
+#define arch_align_stack(x) ((x) & ~0xfUL)
 extern void free_init_pages(char *what, unsigned long begin, unsigned long end);
 
 void default_idle(void);
 
-void stop_this_cpu(void *dummy);
+void stop_this_cpu(void *dummy) __noreturn;
 
 /*
  * Force strict CPU ordering.
diff -uriN linux-2.6.32.43/arch/x86/include/asm/thread_info.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/thread_info.h
--- linux-2.6.32.43/arch/x86/include/asm/thread_info.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/thread_info.h	2011-07-15 05:51:11.000000000 -0500
@@ -10,6 +10,7 @@
 #include <linux/compiler.h>
 #include <asm/page.h>
 #include <asm/types.h>
+#include <asm/percpu.h>
 
 /*
  * low level task data that entry.S needs immediate access to
@@ -24,7 +25,6 @@
 #include <asm/atomic.h>
 
 struct thread_info {
-	struct task_struct	*task;		/* main task structure */
 	struct exec_domain	*exec_domain;	/* execution domain */
 	__u32			flags;		/* low level flags */
 	__u32			status;		/* thread synchronous flags */
@@ -34,18 +34,12 @@
 	mm_segment_t		addr_limit;
 	struct restart_block    restart_block;
 	void __user		*sysenter_return;
-#ifdef CONFIG_X86_32
-	unsigned long           previous_esp;   /* ESP of the previous stack in
-						   case of nested (IRQ) stacks
-						*/
-	__u8			supervisor_stack[0];
-#endif
+	unsigned long		lowest_stack;
 	int			uaccess_err;
 };
 
-#define INIT_THREAD_INFO(tsk)			\
+#define INIT_THREAD_INFO			\
 {						\
-	.task		= &tsk,			\
 	.exec_domain	= &default_exec_domain,	\
 	.flags		= 0,			\
 	.cpu		= 0,			\
@@ -56,7 +50,7 @@
 	},					\
 }
 
-#define init_thread_info	(init_thread_union.thread_info)
+#define init_thread_info	(init_thread_union.stack)
 #define init_stack		(init_thread_union.stack)
 
 #else /* !__ASSEMBLY__ */
@@ -163,6 +157,23 @@
 #define alloc_thread_info(tsk)						\
 	((struct thread_info *)__get_free_pages(THREAD_FLAGS, THREAD_ORDER))
 
+#ifdef __ASSEMBLY__
+/* how to get the thread information struct from ASM */
+#define GET_THREAD_INFO(reg)	 \
+	mov PER_CPU_VAR(current_tinfo), reg
+
+/* use this one if reg already contains %esp */
+#define GET_THREAD_INFO_WITH_ESP(reg) GET_THREAD_INFO(reg)
+#else
+/* how to get the thread information struct from C */
+DECLARE_PER_CPU(struct thread_info *, current_tinfo);
+
+static __always_inline struct thread_info *current_thread_info(void)
+{
+	return percpu_read_stable(current_tinfo);
+}
+#endif
+
 #ifdef CONFIG_X86_32
 
 #define STACK_WARN	(THREAD_SIZE/8)
@@ -173,35 +184,13 @@
  */
 #ifndef __ASSEMBLY__
 
-
 /* how to get the current stack pointer from C */
 register unsigned long current_stack_pointer asm("esp") __used;
 
-/* how to get the thread information struct from C */
-static inline struct thread_info *current_thread_info(void)
-{
-	return (struct thread_info *)
-		(current_stack_pointer & ~(THREAD_SIZE - 1));
-}
-
-#else /* !__ASSEMBLY__ */
-
-/* how to get the thread information struct from ASM */
-#define GET_THREAD_INFO(reg)	 \
-	movl $-THREAD_SIZE, reg; \
-	andl %esp, reg
-
-/* use this one if reg already contains %esp */
-#define GET_THREAD_INFO_WITH_ESP(reg) \
-	andl $-THREAD_SIZE, reg
-
 #endif
 
 #else /* X86_32 */
 
-#include <asm/percpu.h>
-#define KERNEL_STACK_OFFSET (5*8)
-
 /*
  * macros/functions for gaining access to the thread information structure
  * preempt_count needs to be 1 initially, until the scheduler is functional.
@@ -209,21 +198,8 @@
 #ifndef __ASSEMBLY__
 DECLARE_PER_CPU(unsigned long, kernel_stack);
 
-static inline struct thread_info *current_thread_info(void)
-{
-	struct thread_info *ti;
-	ti = (void *)(percpu_read_stable(kernel_stack) +
-		      KERNEL_STACK_OFFSET - THREAD_SIZE);
-	return ti;
-}
-
-#else /* !__ASSEMBLY__ */
-
-/* how to get the thread information struct from ASM */
-#define GET_THREAD_INFO(reg) \
-	movq PER_CPU_VAR(kernel_stack),reg ; \
-	subq $(THREAD_SIZE-KERNEL_STACK_OFFSET),reg
-
+/* how to get the current stack pointer from C */
+register unsigned long current_stack_pointer asm("rsp") __used;
 #endif
 
 #endif /* !X86_32 */
@@ -260,5 +236,16 @@
 extern void free_thread_info(struct thread_info *ti);
 extern int arch_dup_task_struct(struct task_struct *dst, struct task_struct *src);
 #define arch_task_cache_init arch_task_cache_init
+
+#define __HAVE_THREAD_FUNCTIONS
+#define task_thread_info(task)	(&(task)->tinfo)
+#define task_stack_page(task)	((task)->stack)
+#define setup_thread_stack(p, org) do {} while (0)
+#define end_of_stack(p) ((unsigned long *)task_stack_page(p) + 1)
+
+#define __HAVE_ARCH_TASK_STRUCT_ALLOCATOR
+extern struct task_struct *alloc_task_struct(void);
+extern void free_task_struct(struct task_struct *);
+
 #endif
 #endif /* _ASM_X86_THREAD_INFO_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/uaccess_32.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/uaccess_32.h
--- linux-2.6.32.43/arch/x86/include/asm/uaccess_32.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/uaccess_32.h	2011-07-15 05:51:11.000000000 -0500
@@ -44,6 +44,11 @@
 static __always_inline unsigned long __must_check
 __copy_to_user_inatomic(void __user *to, const void *from, unsigned long n)
 {
+	pax_track_stack();
+
+	if ((long)n < 0)
+		return n;
+
 	if (__builtin_constant_p(n)) {
 		unsigned long ret;
 
@@ -62,6 +67,8 @@
 			return ret;
 		}
 	}
+	if (!__builtin_constant_p(n))
+		check_object_size(from, n, true);
 	return __copy_to_user_ll(to, from, n);
 }
 
@@ -83,12 +90,16 @@
 __copy_to_user(void __user *to, const void *from, unsigned long n)
 {
 	might_fault();
+
 	return __copy_to_user_inatomic(to, from, n);
 }
 
 static __always_inline unsigned long
 __copy_from_user_inatomic(void *to, const void __user *from, unsigned long n)
 {
+	if ((long)n < 0)
+		return n;
+
 	/* Avoid zeroing the tail if the copy fails..
 	 * If 'n' is constant and 1, 2, or 4, we do still zero on a failure,
 	 * but as the zeroing behaviour is only significant when n is not
@@ -138,6 +149,12 @@
 __copy_from_user(void *to, const void __user *from, unsigned long n)
 {
 	might_fault();
+
+	pax_track_stack();
+
+	if ((long)n < 0)
+		return n;
+
 	if (__builtin_constant_p(n)) {
 		unsigned long ret;
 
@@ -153,6 +170,8 @@
 			return ret;
 		}
 	}
+	if (!__builtin_constant_p(n))
+		check_object_size(to, n, false);
 	return __copy_from_user_ll(to, from, n);
 }
 
@@ -160,6 +179,10 @@
 				const void __user *from, unsigned long n)
 {
 	might_fault();
+
+	if ((long)n < 0)
+		return n;
+
 	if (__builtin_constant_p(n)) {
 		unsigned long ret;
 
@@ -182,14 +205,62 @@
 __copy_from_user_inatomic_nocache(void *to, const void __user *from,
 				  unsigned long n)
 {
-       return __copy_from_user_ll_nocache_nozero(to, from, n);
+	if ((long)n < 0)
+		return n;
+
+	return __copy_from_user_ll_nocache_nozero(to, from, n);
+}
+
+/**
+ * copy_to_user: - Copy a block of data into user space.
+ * @to:   Destination address, in user space.
+ * @from: Source address, in kernel space.
+ * @n:    Number of bytes to copy.
+ *
+ * Context: User context only.  This function may sleep.
+ *
+ * Copy data from kernel space to user space.
+ *
+ * Returns number of bytes that could not be copied.
+ * On success, this will be zero.
+ */
+static __always_inline unsigned long __must_check
+copy_to_user(void __user *to, const void *from, unsigned long n)
+{
+	if (access_ok(VERIFY_WRITE, to, n))
+		n = __copy_to_user(to, from, n);
+	return n;
+}
+
+/**
+ * copy_from_user: - Copy a block of data from user space.
+ * @to:   Destination address, in kernel space.
+ * @from: Source address, in user space.
+ * @n:    Number of bytes to copy.
+ *
+ * Context: User context only.  This function may sleep.
+ *
+ * Copy data from user space to kernel space.
+ *
+ * Returns number of bytes that could not be copied.
+ * On success, this will be zero.
+ *
+ * If some data could not be copied, this function will pad the copied
+ * data to the requested size using zero bytes.
+ */
+static __always_inline unsigned long __must_check
+copy_from_user(void *to, const void __user *from, unsigned long n)
+{
+	if (access_ok(VERIFY_READ, from, n))
+		n = __copy_from_user(to, from, n);
+	else if ((long)n > 0) {
+		if (!__builtin_constant_p(n))
+			check_object_size(to, n, false);
+		memset(to, 0, n);
+	}
+	return n;
 }
 
-unsigned long __must_check copy_to_user(void __user *to,
-					const void *from, unsigned long n);
-unsigned long __must_check copy_from_user(void *to,
-					  const void __user *from,
-					  unsigned long n);
 long __must_check strncpy_from_user(char *dst, const char __user *src,
 				    long count);
 long __must_check __strncpy_from_user(char *dst,
diff -uriN linux-2.6.32.43/arch/x86/include/asm/uaccess_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/uaccess_64.h
--- linux-2.6.32.43/arch/x86/include/asm/uaccess_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/uaccess_64.h	2011-07-15 05:51:11.000000000 -0500
@@ -9,6 +9,9 @@
 #include <linux/prefetch.h>
 #include <linux/lockdep.h>
 #include <asm/page.h>
+#include <asm/pgtable.h>
+
+#define set_fs(x)	(current_thread_info()->addr_limit = (x))
 
 /*
  * Copy To/From Userspace
@@ -19,113 +22,203 @@
 copy_user_generic(void *to, const void *from, unsigned len);
 
 __must_check unsigned long
-copy_to_user(void __user *to, const void *from, unsigned len);
-__must_check unsigned long
-copy_from_user(void *to, const void __user *from, unsigned len);
-__must_check unsigned long
 copy_in_user(void __user *to, const void __user *from, unsigned len);
 
 static __always_inline __must_check
-int __copy_from_user(void *dst, const void __user *src, unsigned size)
+unsigned long __copy_from_user(void *dst, const void __user *src, unsigned size)
 {
-	int ret = 0;
+	unsigned ret = 0;
 
 	might_fault();
-	if (!__builtin_constant_p(size))
-		return copy_user_generic(dst, (__force void *)src, size);
+
+	if ((int)size < 0)
+		return size;
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if (!__access_ok(VERIFY_READ, src, size))
+		return size;
+#endif
+
+	if (!__builtin_constant_p(size)) {
+		check_object_size(dst, size, false);
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
+			src += PAX_USER_SHADOW_BASE;
+#endif
+
+		return copy_user_generic(dst, (__force const void *)src, size);
+	}
 	switch (size) {
-	case 1:__get_user_asm(*(u8 *)dst, (u8 __user *)src,
+	case 1:__get_user_asm(*(u8 *)dst, (const u8 __user *)src,
 			      ret, "b", "b", "=q", 1);
 		return ret;
-	case 2:__get_user_asm(*(u16 *)dst, (u16 __user *)src,
+	case 2:__get_user_asm(*(u16 *)dst, (const u16 __user *)src,
 			      ret, "w", "w", "=r", 2);
 		return ret;
-	case 4:__get_user_asm(*(u32 *)dst, (u32 __user *)src,
+	case 4:__get_user_asm(*(u32 *)dst, (const u32 __user *)src,
 			      ret, "l", "k", "=r", 4);
 		return ret;
-	case 8:__get_user_asm(*(u64 *)dst, (u64 __user *)src,
+	case 8:__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
 			      ret, "q", "", "=r", 8);
 		return ret;
 	case 10:
-		__get_user_asm(*(u64 *)dst, (u64 __user *)src,
+		__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
 			       ret, "q", "", "=r", 10);
 		if (unlikely(ret))
 			return ret;
 		__get_user_asm(*(u16 *)(8 + (char *)dst),
-			       (u16 __user *)(8 + (char __user *)src),
+			       (const u16 __user *)(8 + (const char __user *)src),
 			       ret, "w", "w", "=r", 2);
 		return ret;
 	case 16:
-		__get_user_asm(*(u64 *)dst, (u64 __user *)src,
+		__get_user_asm(*(u64 *)dst, (const u64 __user *)src,
 			       ret, "q", "", "=r", 16);
 		if (unlikely(ret))
 			return ret;
 		__get_user_asm(*(u64 *)(8 + (char *)dst),
-			       (u64 __user *)(8 + (char __user *)src),
+			       (const u64 __user *)(8 + (const char __user *)src),
 			       ret, "q", "", "=r", 8);
 		return ret;
 	default:
-		return copy_user_generic(dst, (__force void *)src, size);
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
+			src += PAX_USER_SHADOW_BASE;
+#endif
+
+		return copy_user_generic(dst, (__force const void *)src, size);
 	}
 }
 
 static __always_inline __must_check
-int __copy_to_user(void __user *dst, const void *src, unsigned size)
+unsigned long __copy_to_user(void __user *dst, const void *src, unsigned size)
 {
-	int ret = 0;
+	unsigned ret = 0;
 
 	might_fault();
-	if (!__builtin_constant_p(size))
+
+	pax_track_stack();
+
+	if ((int)size < 0)
+		return size;
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if (!__access_ok(VERIFY_WRITE, dst, size))
+		return size;
+#endif
+
+	if (!__builtin_constant_p(size)) {
+		check_object_size(src, size, true);
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
+			dst += PAX_USER_SHADOW_BASE;
+#endif
+
 		return copy_user_generic((__force void *)dst, src, size);
+	}
 	switch (size) {
-	case 1:__put_user_asm(*(u8 *)src, (u8 __user *)dst,
+	case 1:__put_user_asm(*(const u8 *)src, (u8 __user *)dst,
 			      ret, "b", "b", "iq", 1);
 		return ret;
-	case 2:__put_user_asm(*(u16 *)src, (u16 __user *)dst,
+	case 2:__put_user_asm(*(const u16 *)src, (u16 __user *)dst,
 			      ret, "w", "w", "ir", 2);
 		return ret;
-	case 4:__put_user_asm(*(u32 *)src, (u32 __user *)dst,
+	case 4:__put_user_asm(*(const u32 *)src, (u32 __user *)dst,
 			      ret, "l", "k", "ir", 4);
 		return ret;
-	case 8:__put_user_asm(*(u64 *)src, (u64 __user *)dst,
+	case 8:__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
 			      ret, "q", "", "er", 8);
 		return ret;
 	case 10:
-		__put_user_asm(*(u64 *)src, (u64 __user *)dst,
+		__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
 			       ret, "q", "", "er", 10);
 		if (unlikely(ret))
 			return ret;
 		asm("":::"memory");
-		__put_user_asm(4[(u16 *)src], 4 + (u16 __user *)dst,
+		__put_user_asm(4[(const u16 *)src], 4 + (u16 __user *)dst,
 			       ret, "w", "w", "ir", 2);
 		return ret;
 	case 16:
-		__put_user_asm(*(u64 *)src, (u64 __user *)dst,
+		__put_user_asm(*(const u64 *)src, (u64 __user *)dst,
 			       ret, "q", "", "er", 16);
 		if (unlikely(ret))
 			return ret;
 		asm("":::"memory");
-		__put_user_asm(1[(u64 *)src], 1 + (u64 __user *)dst,
+		__put_user_asm(1[(const u64 *)src], 1 + (u64 __user *)dst,
 			       ret, "q", "", "er", 8);
 		return ret;
 	default:
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
+			dst += PAX_USER_SHADOW_BASE;
+#endif
+
 		return copy_user_generic((__force void *)dst, src, size);
 	}
 }
 
 static __always_inline __must_check
-int __copy_in_user(void __user *dst, const void __user *src, unsigned size)
+unsigned long copy_to_user(void __user *to, const void *from, unsigned len)
+{
+	if (access_ok(VERIFY_WRITE, to, len))
+		len = __copy_to_user(to, from, len);
+	return len;
+}
+
+static __always_inline __must_check
+unsigned long copy_from_user(void *to, const void __user *from, unsigned len)
+{
+	if ((int)len < 0)
+		return len;
+
+	if (access_ok(VERIFY_READ, from, len))
+		len = __copy_from_user(to, from, len);
+	else if ((int)len > 0) {
+		if (!__builtin_constant_p(len))
+			check_object_size(to, len, false);
+		memset(to, 0, len);
+	}
+	return len;
+}
+
+static __always_inline __must_check
+unsigned long __copy_in_user(void __user *dst, const void __user *src, unsigned size)
 {
-	int ret = 0;
+	unsigned ret = 0;
 
 	might_fault();
-	if (!__builtin_constant_p(size))
+
+	pax_track_stack();
+
+	if ((int)size < 0)
+		return size;
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if (!__access_ok(VERIFY_READ, src, size))
+		return size;
+	if (!__access_ok(VERIFY_WRITE, dst, size))
+		return size;
+#endif
+
+	if (!__builtin_constant_p(size)) {
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
+			src += PAX_USER_SHADOW_BASE;
+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
+			dst += PAX_USER_SHADOW_BASE;
+#endif
+
 		return copy_user_generic((__force void *)dst,
-					 (__force void *)src, size);
+					 (__force const void *)src, size);
+	}
 	switch (size) {
 	case 1: {
 		u8 tmp;
-		__get_user_asm(tmp, (u8 __user *)src,
+		__get_user_asm(tmp, (const u8 __user *)src,
 			       ret, "b", "b", "=q", 1);
 		if (likely(!ret))
 			__put_user_asm(tmp, (u8 __user *)dst,
@@ -134,7 +227,7 @@
 	}
 	case 2: {
 		u16 tmp;
-		__get_user_asm(tmp, (u16 __user *)src,
+		__get_user_asm(tmp, (const u16 __user *)src,
 			       ret, "w", "w", "=r", 2);
 		if (likely(!ret))
 			__put_user_asm(tmp, (u16 __user *)dst,
@@ -144,7 +237,7 @@
 
 	case 4: {
 		u32 tmp;
-		__get_user_asm(tmp, (u32 __user *)src,
+		__get_user_asm(tmp, (const u32 __user *)src,
 			       ret, "l", "k", "=r", 4);
 		if (likely(!ret))
 			__put_user_asm(tmp, (u32 __user *)dst,
@@ -153,7 +246,7 @@
 	}
 	case 8: {
 		u64 tmp;
-		__get_user_asm(tmp, (u64 __user *)src,
+		__get_user_asm(tmp, (const u64 __user *)src,
 			       ret, "q", "", "=r", 8);
 		if (likely(!ret))
 			__put_user_asm(tmp, (u64 __user *)dst,
@@ -161,8 +254,16 @@
 		return ret;
 	}
 	default:
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		if ((unsigned long)src < PAX_USER_SHADOW_BASE)
+			src += PAX_USER_SHADOW_BASE;
+		if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
+			dst += PAX_USER_SHADOW_BASE;
+#endif
+
 		return copy_user_generic((__force void *)dst,
-					 (__force void *)src, size);
+					 (__force const void *)src, size);
 	}
 }
 
@@ -176,33 +277,75 @@
 __must_check unsigned long clear_user(void __user *mem, unsigned long len);
 __must_check unsigned long __clear_user(void __user *mem, unsigned long len);
 
-__must_check long __copy_from_user_inatomic(void *dst, const void __user *src,
-					    unsigned size);
+static __must_check __always_inline unsigned long
+__copy_from_user_inatomic(void *dst, const void __user *src, unsigned size)
+{
+	pax_track_stack();
+
+	if ((int)size < 0)
+		return size;
 
-static __must_check __always_inline int
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if (!__access_ok(VERIFY_READ, src, size))
+		return size;
+
+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
+		src += PAX_USER_SHADOW_BASE;
+#endif
+
+	return copy_user_generic(dst, (__force const void *)src, size);
+}
+
+static __must_check __always_inline unsigned long
 __copy_to_user_inatomic(void __user *dst, const void *src, unsigned size)
 {
+	if ((int)size < 0)
+		return size;
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if (!__access_ok(VERIFY_WRITE, dst, size))
+		return size;
+
+	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
+		dst += PAX_USER_SHADOW_BASE;
+#endif
+
 	return copy_user_generic((__force void *)dst, src, size);
 }
 
-extern long __copy_user_nocache(void *dst, const void __user *src,
+extern unsigned long __copy_user_nocache(void *dst, const void __user *src,
 				unsigned size, int zerorest);
 
-static inline int
-__copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
+static inline unsigned long __copy_from_user_nocache(void *dst, const void __user *src, unsigned size)
 {
 	might_sleep();
+
+	if ((int)size < 0)
+		return size;
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if (!__access_ok(VERIFY_READ, src, size))
+		return size;
+#endif
+
 	return __copy_user_nocache(dst, src, size, 1);
 }
 
-static inline int
-__copy_from_user_inatomic_nocache(void *dst, const void __user *src,
+static inline unsigned long __copy_from_user_inatomic_nocache(void *dst, const void __user *src,
 				  unsigned size)
 {
+	if ((int)size < 0)
+		return size;
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if (!__access_ok(VERIFY_READ, src, size))
+		return size;
+#endif
+
 	return __copy_user_nocache(dst, src, size, 0);
 }
 
-unsigned long
+extern unsigned long
 copy_user_handle_tail(char *to, char *from, unsigned len, unsigned zerorest);
 
 #endif /* _ASM_X86_UACCESS_64_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/uaccess.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/uaccess.h
--- linux-2.6.32.43/arch/x86/include/asm/uaccess.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/uaccess.h	2011-07-15 05:51:11.000000000 -0500
@@ -8,12 +8,15 @@
 #include <linux/thread_info.h>
 #include <linux/prefetch.h>
 #include <linux/string.h>
+#include <linux/sched.h>
 #include <asm/asm.h>
 #include <asm/page.h>
 
 #define VERIFY_READ 0
 #define VERIFY_WRITE 1
 
+extern void check_object_size(const void *ptr, unsigned long n, bool to);
+
 /*
  * The fs value determines whether argument validity checking should be
  * performed or not.  If get_fs() == USER_DS, checking is performed, with
@@ -29,7 +32,12 @@
 
 #define get_ds()	(KERNEL_DS)
 #define get_fs()	(current_thread_info()->addr_limit)
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
+void __set_fs(mm_segment_t x);
+void set_fs(mm_segment_t x);
+#else
 #define set_fs(x)	(current_thread_info()->addr_limit = (x))
+#endif
 
 #define segment_eq(a, b)	((a).seg == (b).seg)
 
@@ -77,7 +85,33 @@
  * checks that the pointer is in the user space range - after calling
  * this function, memory access functions may still return -EFAULT.
  */
-#define access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
+#define __access_ok(type, addr, size) (likely(__range_not_ok(addr, size) == 0))
+#define access_ok(type, addr, size)					\
+({									\
+	long __size = size;						\
+	unsigned long __addr = (unsigned long)addr;			\
+	unsigned long __addr_ao = __addr & PAGE_MASK;			\
+	unsigned long __end_ao = __addr + __size - 1;			\
+	bool __ret_ao = __range_not_ok(__addr, __size) == 0;		\
+	if (__ret_ao && unlikely((__end_ao ^ __addr_ao) & PAGE_MASK)) {	\
+		while(__addr_ao <= __end_ao) {				\
+			char __c_ao;					\
+			__addr_ao += PAGE_SIZE;				\
+			if (__size > PAGE_SIZE)				\
+				cond_resched();				\
+			if (__get_user(__c_ao, (char __user *)__addr))	\
+				break;					\
+			if (type != VERIFY_WRITE) {			\
+				__addr = __addr_ao;			\
+				continue;				\
+			}						\
+			if (__put_user(__c_ao, (char __user *)__addr))	\
+				break;					\
+			__addr = __addr_ao;				\
+		}							\
+	}								\
+	__ret_ao;							\
+})
 
 /*
  * The exception table consists of pairs of addresses: the first is the
@@ -183,12 +217,20 @@
 	asm volatile("call __put_user_" #size : "=a" (__ret_pu)	\
 		     : "0" ((typeof(*(ptr)))(x)), "c" (ptr) : "ebx")
 
-
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
+#define __copyuser_seg "gs;"
+#define __COPYUSER_SET_ES "pushl %%gs; popl %%es\n"
+#define __COPYUSER_RESTORE_ES "pushl %%ss; popl %%es\n"
+#else
+#define __copyuser_seg
+#define __COPYUSER_SET_ES
+#define __COPYUSER_RESTORE_ES
+#endif
 
 #ifdef CONFIG_X86_32
 #define __put_user_asm_u64(x, addr, err, errret)			\
-	asm volatile("1:	movl %%eax,0(%2)\n"			\
-		     "2:	movl %%edx,4(%2)\n"			\
+	asm volatile("1:	"__copyuser_seg"movl %%eax,0(%2)\n"	\
+		     "2:	"__copyuser_seg"movl %%edx,4(%2)\n"	\
 		     "3:\n"						\
 		     ".section .fixup,\"ax\"\n"				\
 		     "4:	movl %3,%0\n"				\
@@ -200,8 +242,8 @@
 		     : "A" (x), "r" (addr), "i" (errret), "0" (err))
 
 #define __put_user_asm_ex_u64(x, addr)					\
-	asm volatile("1:	movl %%eax,0(%1)\n"			\
-		     "2:	movl %%edx,4(%1)\n"			\
+	asm volatile("1:	"__copyuser_seg"movl %%eax,0(%1)\n"	\
+		     "2:	"__copyuser_seg"movl %%edx,4(%1)\n"	\
 		     "3:\n"						\
 		     _ASM_EXTABLE(1b, 2b - 1b)				\
 		     _ASM_EXTABLE(2b, 3b - 2b)				\
@@ -374,7 +416,7 @@
 } while (0)
 
 #define __get_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
-	asm volatile("1:	mov"itype" %2,%"rtype"1\n"		\
+	asm volatile("1:	"__copyuser_seg"mov"itype" %2,%"rtype"1\n"\
 		     "2:\n"						\
 		     ".section .fixup,\"ax\"\n"				\
 		     "3:	mov %3,%0\n"				\
@@ -382,7 +424,7 @@
 		     "	jmp 2b\n"					\
 		     ".previous\n"					\
 		     _ASM_EXTABLE(1b, 3b)				\
-		     : "=r" (err), ltype(x)				\
+		     : "=r" (err), ltype (x)				\
 		     : "m" (__m(addr)), "i" (errret), "0" (err))
 
 #define __get_user_size_ex(x, ptr, size)				\
@@ -407,7 +449,7 @@
 } while (0)
 
 #define __get_user_asm_ex(x, addr, itype, rtype, ltype)			\
-	asm volatile("1:	mov"itype" %1,%"rtype"0\n"		\
+	asm volatile("1:	"__copyuser_seg"mov"itype" %1,%"rtype"0\n"\
 		     "2:\n"						\
 		     _ASM_EXTABLE(1b, 2b - 1b)				\
 		     : ltype(x) : "m" (__m(addr)))
@@ -424,13 +466,24 @@
 	int __gu_err;							\
 	unsigned long __gu_val;						\
 	__get_user_size(__gu_val, (ptr), (size), __gu_err, -EFAULT);	\
-	(x) = (__force __typeof__(*(ptr)))__gu_val;			\
+	(x) = (__typeof__(*(ptr)))__gu_val;				\
 	__gu_err;							\
 })
 
 /* FIXME: this hack is definitely wrong -AK */
 struct __large_struct { unsigned long buf[100]; };
-#define __m(x) (*(struct __large_struct __user *)(x))
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+#define ____m(x)					\
+({							\
+	unsigned long ____x = (unsigned long)(x);	\
+	if (____x < PAX_USER_SHADOW_BASE)		\
+		____x += PAX_USER_SHADOW_BASE;		\
+	(void __user *)____x;				\
+})
+#else
+#define ____m(x) (x)
+#endif
+#define __m(x) (*(struct __large_struct __user *)____m(x))
 
 /*
  * Tell gcc we read from memory instead of writing: this is because
@@ -438,7 +491,7 @@
  * aliasing issues.
  */
 #define __put_user_asm(x, addr, err, itype, rtype, ltype, errret)	\
-	asm volatile("1:	mov"itype" %"rtype"1,%2\n"		\
+	asm volatile("1:	"__copyuser_seg"mov"itype" %"rtype"1,%2\n"\
 		     "2:\n"						\
 		     ".section .fixup,\"ax\"\n"				\
 		     "3:	mov %3,%0\n"				\
@@ -446,10 +499,10 @@
 		     ".previous\n"					\
 		     _ASM_EXTABLE(1b, 3b)				\
 		     : "=r"(err)					\
-		     : ltype(x), "m" (__m(addr)), "i" (errret), "0" (err))
+		     : ltype (x), "m" (__m(addr)), "i" (errret), "0" (err))
 
 #define __put_user_asm_ex(x, addr, itype, rtype, ltype)			\
-	asm volatile("1:	mov"itype" %"rtype"0,%1\n"		\
+	asm volatile("1:	"__copyuser_seg"mov"itype" %"rtype"0,%1\n"\
 		     "2:\n"						\
 		     _ASM_EXTABLE(1b, 2b - 1b)				\
 		     : : ltype(x), "m" (__m(addr)))
@@ -488,8 +541,12 @@
  * On error, the variable @x is set to zero.
  */
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+#define __get_user(x, ptr)	get_user((x), (ptr))
+#else
 #define __get_user(x, ptr)						\
 	__get_user_nocheck((x), (ptr), sizeof(*(ptr)))
+#endif
 
 /**
  * __put_user: - Write a simple value into user space, with less checking.
@@ -511,8 +568,12 @@
  * Returns zero on success, or -EFAULT on error.
  */
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+#define __put_user(x, ptr)	put_user((x), (ptr))
+#else
 #define __put_user(x, ptr)						\
 	__put_user_nocheck((__typeof__(*(ptr)))(x), (ptr), sizeof(*(ptr)))
+#endif
 
 #define __get_user_unaligned __get_user
 #define __put_user_unaligned __put_user
@@ -530,7 +591,7 @@
 #define get_user_ex(x, ptr)	do {					\
 	unsigned long __gue_val;					\
 	__get_user_size_ex((__gue_val), (ptr), (sizeof(*(ptr))));	\
-	(x) = (__force __typeof__(*(ptr)))__gue_val;			\
+	(x) = (__typeof__(*(ptr)))__gue_val;				\
 } while (0)
 
 #ifdef CONFIG_X86_WP_WORKS_OK
@@ -567,6 +628,7 @@
 
 #define ARCH_HAS_NOCACHE_UACCESS 1
 
+#define ARCH_HAS_SORT_EXTABLE
 #ifdef CONFIG_X86_32
 # include "uaccess_32.h"
 #else
diff -uriN linux-2.6.32.43/arch/x86/include/asm/unistd_64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/unistd_64.h
--- linux-2.6.32.43/arch/x86/include/asm/unistd_64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/unistd_64.h	2011-07-15 05:50:11.000000000 -0500
@@ -535,7 +535,7 @@
 #define __NR_utimes				235
 __SYSCALL(__NR_utimes, sys_utimes)
 #define __NR_vserver				236
-__SYSCALL(__NR_vserver, sys_ni_syscall)
+__SYSCALL(__NR_vserver, sys_vserver)
 #define __NR_mbind				237
 __SYSCALL(__NR_mbind, sys_mbind)
 #define __NR_set_mempolicy			238
diff -uriN linux-2.6.32.43/arch/x86/include/asm/vgtod.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/vgtod.h
--- linux-2.6.32.43/arch/x86/include/asm/vgtod.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/vgtod.h	2011-07-15 05:51:11.000000000 -0500
@@ -14,6 +14,7 @@
 	int		sysctl_enabled;
 	struct timezone sys_tz;
 	struct { /* extract of a clocksource struct */
+		char	name[8];
 		cycle_t (*vread)(void);
 		cycle_t	cycle_last;
 		cycle_t	mask;
diff -uriN linux-2.6.32.43/arch/x86/include/asm/vmi.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/vmi.h
--- linux-2.6.32.43/arch/x86/include/asm/vmi.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/vmi.h	2011-07-15 05:51:11.000000000 -0500
@@ -191,6 +191,7 @@
 	u8      reserved[96];   /* Reserved for headers */
 	char    vmi_init[8];    /* VMI_Init jump point */
 	char    get_reloc[8];   /* VMI_GetRelocationInfo jump point */
+	char    rom_data[8048];	/* rest of the option ROM */
 } __attribute__((packed));
 
 struct pnp_header {
diff -uriN linux-2.6.32.43/arch/x86/include/asm/vsyscall.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/vsyscall.h
--- linux-2.6.32.43/arch/x86/include/asm/vsyscall.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/vsyscall.h	2011-07-15 05:51:11.000000000 -0500
@@ -15,9 +15,10 @@
 
 #ifdef __KERNEL__
 #include <linux/seqlock.h>
+#include <linux/getcpu.h>
+#include <linux/time.h>
 
 #define __section_vgetcpu_mode __attribute__ ((unused, __section__ (".vgetcpu_mode"), aligned(16)))
-#define __section_jiffies __attribute__ ((unused, __section__ (".jiffies"), aligned(16)))
 
 /* Definitions for CONFIG_GENERIC_TIME definitions */
 #define __section_vsyscall_gtod_data __attribute__ \
@@ -31,7 +32,6 @@
 #define VGETCPU_LSL	2
 
 extern int __vgetcpu_mode;
-extern volatile unsigned long __jiffies;
 
 /* kernel space (writeable) */
 extern int vgetcpu_mode;
@@ -39,6 +39,9 @@
 
 extern void map_vsyscall(void);
 
+extern int vgettimeofday(struct timeval * tv, struct timezone * tz);
+extern time_t vtime(time_t *t);
+extern long vgetcpu(unsigned *cpu, unsigned *node, struct getcpu_cache *tcache);
 #endif /* __KERNEL__ */
 
 #endif /* _ASM_X86_VSYSCALL_H */
diff -uriN linux-2.6.32.43/arch/x86/include/asm/xsave.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/xsave.h
--- linux-2.6.32.43/arch/x86/include/asm/xsave.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/include/asm/xsave.h	2011-07-15 05:51:11.000000000 -0500
@@ -56,6 +56,12 @@
 static inline int xsave_user(struct xsave_struct __user *buf)
 {
 	int err;
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	if ((unsigned long)buf < PAX_USER_SHADOW_BASE)
+		buf = (struct xsave_struct __user *)((void __user*)buf + PAX_USER_SHADOW_BASE);
+#endif
+
 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x27\n"
 			     "2:\n"
 			     ".section .fixup,\"ax\"\n"
@@ -82,6 +88,11 @@
 	u32 lmask = mask;
 	u32 hmask = mask >> 32;
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	if ((unsigned long)xstate < PAX_USER_SHADOW_BASE)
+		xstate = (struct xsave_struct *)((void *)xstate + PAX_USER_SHADOW_BASE);
+#endif
+
 	__asm__ __volatile__("1: .byte " REX_PREFIX "0x0f,0xae,0x2f\n"
 			     "2:\n"
 			     ".section .fixup,\"ax\"\n"
diff -uriN linux-2.6.32.43/arch/x86/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/Kconfig
--- linux-2.6.32.43/arch/x86/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/Kconfig	2011-07-15 05:51:11.000000000 -0500
@@ -223,7 +223,7 @@
 
 config X86_32_LAZY_GS
 	def_bool y
-	depends on X86_32 && !CC_STACKPROTECTOR
+	depends on X86_32 && !CC_STACKPROTECTOR && !PAX_MEMORY_UDEREF
 
 config KTIME_SCALAR
 	def_bool X86_32
@@ -1008,7 +1008,7 @@
 
 config NOHIGHMEM
 	bool "off"
-	depends on !X86_NUMAQ
+	depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
 	---help---
 	  Linux can use up to 64 Gigabytes of physical memory on x86 systems.
 	  However, the address space of 32-bit x86 processors is only 4
@@ -1045,7 +1045,7 @@
 
 config HIGHMEM4G
 	bool "4GB"
-	depends on !X86_NUMAQ
+	depends on !X86_NUMAQ && !(PAX_PAGEEXEC && PAX_ENABLE_PAE)
 	---help---
 	  Select this if you have a 32-bit processor and between 1 and 4
 	  gigabytes of physical RAM.
@@ -1099,7 +1099,7 @@
 	hex
 	default 0xB0000000 if VMSPLIT_3G_OPT
 	default 0x80000000 if VMSPLIT_2G
-	default 0x78000000 if VMSPLIT_2G_OPT
+	default 0x70000000 if VMSPLIT_2G_OPT
 	default 0x40000000 if VMSPLIT_1G
 	default 0xC0000000
 	depends on X86_32
@@ -1430,7 +1430,7 @@
 
 config EFI
 	bool "EFI runtime service support"
-	depends on ACPI
+	depends on ACPI && !PAX_KERNEXEC
 	---help---
 	  This enables the kernel to use EFI runtime services that are
 	  available (such as the EFI variable services).
@@ -1460,6 +1460,7 @@
 
 config CC_STACKPROTECTOR
 	bool "Enable -fstack-protector buffer overflow detection (EXPERIMENTAL)"
+	depends on X86_64 || !PAX_MEMORY_UDEREF
 	---help---
 	  This option turns on the -fstack-protector GCC feature. This
 	  feature puts, at the beginning of functions, a canary value on
@@ -1517,6 +1518,7 @@
 config PHYSICAL_START
 	hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
 	default "0x1000000"
+	range 0x400000 0x40000000
 	---help---
 	  This gives the physical address where the kernel is loaded.
 
@@ -1581,6 +1583,7 @@
 	hex
 	prompt "Alignment value to which kernel should be aligned" if X86_32
 	default "0x1000000"
+	range 0x400000 0x1000000 if PAX_KERNEXEC
 	range 0x2000 0x1000000
 	---help---
 	  This value puts the alignment restrictions on physical address
@@ -1612,9 +1615,10 @@
 	  Say N if you want to disable CPU hotplug.
 
 config COMPAT_VDSO
-	def_bool y
+	def_bool n
 	prompt "Compat VDSO support"
 	depends on X86_32 || IA32_EMULATION
+	depends on !PAX_NOEXEC && !PAX_MEMORY_UDEREF
 	---help---
 	  Map the 32-bit VDSO to the predictable old-style address too.
 	---help---
@@ -2100,6 +2104,8 @@
 
 source "arch/x86/Kconfig.debug"
 
+source "kernel/vserver/Kconfig"
+
 source "security/Kconfig"
 
 source "crypto/Kconfig"
diff -uriN linux-2.6.32.43/arch/x86/Kconfig.cpu linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/Kconfig.cpu
--- linux-2.6.32.43/arch/x86/Kconfig.cpu	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/Kconfig.cpu	2011-07-15 05:51:11.000000000 -0500
@@ -340,7 +340,7 @@
 
 config X86_F00F_BUG
 	def_bool y
-	depends on M586MMX || M586TSC || M586 || M486 || M386
+	depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
 
 config X86_WP_WORKS_OK
 	def_bool y
@@ -360,7 +360,7 @@
 
 config X86_ALIGNMENT_16
 	def_bool y
-	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
+	depends on MWINCHIP3D || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MCORE2 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
 
 config X86_INTEL_USERCOPY
 	def_bool y
@@ -406,7 +406,7 @@
 # generates cmov.
 config X86_CMOV
 	def_bool y
-	depends on (MK8 || MK7 || MCORE2 || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
+	depends on (MK8 || MK7 || MCORE2 || MPSC || MPENTIUM4 || MPENTIUMM || MPENTIUMIII || MPENTIUMII || M686 || MVIAC3_2 || MVIAC7 || MCRUSOE || MEFFICEON || X86_64 || MATOM)
 
 config X86_MINIMUM_CPU_FAMILY
 	int
diff -uriN linux-2.6.32.43/arch/x86/Kconfig.debug linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/Kconfig.debug
--- linux-2.6.32.43/arch/x86/Kconfig.debug	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/Kconfig.debug	2011-07-15 05:51:11.000000000 -0500
@@ -99,7 +99,7 @@
 config DEBUG_RODATA
 	bool "Write protect kernel read-only data structures"
 	default y
-	depends on DEBUG_KERNEL
+	depends on DEBUG_KERNEL && BROKEN
 	---help---
 	  Mark the kernel read-only data as write-protected in the pagetables,
 	  in order to catch accidental (and incorrect) writes to such const
diff -uriN linux-2.6.32.43/arch/x86/kernel/acpi/realmode/wakeup.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/acpi/realmode/wakeup.S
--- linux-2.6.32.43/arch/x86/kernel/acpi/realmode/wakeup.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/acpi/realmode/wakeup.S	2011-07-15 05:51:11.000000000 -0500
@@ -91,6 +91,9 @@
 	/* Do any other stuff... */
 
 #ifndef CONFIG_64BIT
+	/* Recheck NX bit overrides (64bit path does this in trampoline) */
+	call	verify_cpu
+
 	/* This could also be done in C code... */
 	movl	pmode_cr3, %eax
 	movl	%eax, %cr3
@@ -104,7 +107,7 @@
 	movl	%eax, %ecx
 	orl	%edx, %ecx
 	jz	1f
-	movl	$0xc0000080, %ecx
+	mov	$MSR_EFER, %ecx
 	wrmsr
 1:
 
@@ -114,6 +117,7 @@
 	movl	pmode_cr0, %eax
 	movl	%eax, %cr0
 	jmp	pmode_return
+# include "../../verify_cpu.S"
 #else
 	pushw	$0
 	pushw	trampoline_segment
diff -uriN linux-2.6.32.43/arch/x86/kernel/acpi/sleep.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/acpi/sleep.c
--- linux-2.6.32.43/arch/x86/kernel/acpi/sleep.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/acpi/sleep.c	2011-07-15 05:51:11.000000000 -0500
@@ -11,11 +11,12 @@
 #include <linux/cpumask.h>
 #include <asm/segment.h>
 #include <asm/desc.h>
+#include <asm/e820.h>
 
 #include "realmode/wakeup.h"
 #include "sleep.h"
 
-unsigned long acpi_wakeup_address;
+unsigned long acpi_wakeup_address = 0x2000;
 unsigned long acpi_realmode_flags;
 
 /* address in low memory of the wakeup routine. */
@@ -98,9 +99,13 @@
 #else /* CONFIG_64BIT */
 	header->trampoline_segment = setup_trampoline() >> 4;
 #ifdef CONFIG_SMP
-	stack_start.sp = temp_stack + sizeof(temp_stack);
+	stack_start = (unsigned long)temp_stack + sizeof(temp_stack);
+
+	pax_open_kernel();
 	early_gdt_descr.address =
 			(unsigned long)get_cpu_gdt_table(smp_processor_id());
+	pax_close_kernel();
+
 	initial_gs = per_cpu_offset(smp_processor_id());
 #endif
 	initial_code = (unsigned long)wakeup_long64;
@@ -134,14 +139,8 @@
 		return;
 	}
 
-	acpi_realmode = (unsigned long)alloc_bootmem_low(WAKEUP_SIZE);
-
-	if (!acpi_realmode) {
-		printk(KERN_ERR "ACPI: Cannot allocate lowmem, S3 disabled.\n");
-		return;
-	}
-
-	acpi_wakeup_address = virt_to_phys((void *)acpi_realmode);
+	reserve_early(acpi_wakeup_address, acpi_wakeup_address + WAKEUP_SIZE, "ACPI Wakeup Code");
+	acpi_realmode = (unsigned long)__va(acpi_wakeup_address);;
 }
 
 
diff -uriN linux-2.6.32.43/arch/x86/kernel/acpi/wakeup_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/acpi/wakeup_32.S
--- linux-2.6.32.43/arch/x86/kernel/acpi/wakeup_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/acpi/wakeup_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -30,13 +30,11 @@
 	# and restore the stack ... but you need gdt for this to work
 	movl	saved_context_esp, %esp
 
-	movl	%cs:saved_magic, %eax
-	cmpl	$0x12345678, %eax
+	cmpl	$0x12345678, saved_magic
 	jne	bogus_magic
 
 	# jump to place where we left off
-	movl	saved_eip, %eax
-	jmp	*%eax
+	jmp	*(saved_eip)
 
 bogus_magic:
 	jmp	bogus_magic
diff -uriN linux-2.6.32.43/arch/x86/kernel/alternative.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/alternative.c
--- linux-2.6.32.43/arch/x86/kernel/alternative.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/alternative.c	2011-07-15 05:51:11.000000000 -0500
@@ -407,7 +407,7 @@
 
 		BUG_ON(p->len > MAX_PATCH_LEN);
 		/* prep the buffer with the original instructions */
-		memcpy(insnbuf, p->instr, p->len);
+		memcpy(insnbuf, ktla_ktva(p->instr), p->len);
 		used = pv_init_ops.patch(p->instrtype, p->clobbers, insnbuf,
 					 (unsigned long)p->instr, p->len);
 
@@ -475,7 +475,7 @@
 	if (smp_alt_once)
 		free_init_pages("SMP alternatives",
 				(unsigned long)__smp_locks,
-				(unsigned long)__smp_locks_end);
+				PAGE_ALIGN((unsigned long)__smp_locks_end));
 
 	restart_nmi();
 }
@@ -492,13 +492,17 @@
  * instructions. And on the local CPU you need to be protected again NMI or MCE
  * handlers seeing an inconsistent instruction while you patch.
  */
-static void *__init_or_module text_poke_early(void *addr, const void *opcode,
+static void *__kprobes text_poke_early(void *addr, const void *opcode,
 					      size_t len)
 {
 	unsigned long flags;
 	local_irq_save(flags);
-	memcpy(addr, opcode, len);
+
+	pax_open_kernel();
+	memcpy(ktla_ktva(addr), opcode, len);
 	sync_core();
+	pax_close_kernel();
+
 	local_irq_restore(flags);
 	/* Could also do a CLFLUSH here to speed up CPU recovery; but
 	   that causes hangs on some VIA CPUs. */
@@ -520,35 +524,21 @@
  */
 void *__kprobes text_poke(void *addr, const void *opcode, size_t len)
 {
-	unsigned long flags;
-	char *vaddr;
+	unsigned char *vaddr = ktla_ktva(addr);
 	struct page *pages[2];
-	int i;
+	size_t i;
 
 	if (!core_kernel_text((unsigned long)addr)) {
-		pages[0] = vmalloc_to_page(addr);
-		pages[1] = vmalloc_to_page(addr + PAGE_SIZE);
+		pages[0] = vmalloc_to_page(vaddr);
+		pages[1] = vmalloc_to_page(vaddr + PAGE_SIZE);
 	} else {
-		pages[0] = virt_to_page(addr);
+		pages[0] = virt_to_page(vaddr);
 		WARN_ON(!PageReserved(pages[0]));
-		pages[1] = virt_to_page(addr + PAGE_SIZE);
+		pages[1] = virt_to_page(vaddr + PAGE_SIZE);
 	}
 	BUG_ON(!pages[0]);
-	local_irq_save(flags);
-	set_fixmap(FIX_TEXT_POKE0, page_to_phys(pages[0]));
-	if (pages[1])
-		set_fixmap(FIX_TEXT_POKE1, page_to_phys(pages[1]));
-	vaddr = (char *)fix_to_virt(FIX_TEXT_POKE0);
-	memcpy(&vaddr[(unsigned long)addr & ~PAGE_MASK], opcode, len);
-	clear_fixmap(FIX_TEXT_POKE0);
-	if (pages[1])
-		clear_fixmap(FIX_TEXT_POKE1);
-	local_flush_tlb();
-	sync_core();
-	/* Could also do a CLFLUSH here to speed up CPU recovery; but
-	   that causes hangs on some VIA CPUs. */
+	text_poke_early(addr, opcode, len);
 	for (i = 0; i < len; i++)
-		BUG_ON(((char *)addr)[i] != ((char *)opcode)[i]);
-	local_irq_restore(flags);
+		BUG_ON((vaddr)[i] != ((const unsigned char *)opcode)[i]);
 	return addr;
 }
diff -uriN linux-2.6.32.43/arch/x86/kernel/amd_iommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/amd_iommu.c
--- linux-2.6.32.43/arch/x86/kernel/amd_iommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/amd_iommu.c	2011-07-15 05:51:11.000000000 -0500
@@ -2076,7 +2076,7 @@
 	}
 }
 
-static struct dma_map_ops amd_iommu_dma_ops = {
+static const struct dma_map_ops amd_iommu_dma_ops = {
 	.alloc_coherent = alloc_coherent,
 	.free_coherent = free_coherent,
 	.map_page = map_page,
diff -uriN linux-2.6.32.43/arch/x86/kernel/apic/apic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/apic/apic.c
--- linux-2.6.32.43/arch/x86/kernel/apic/apic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/apic/apic.c	2011-07-15 05:51:11.000000000 -0500
@@ -1794,7 +1794,7 @@
 	apic_write(APIC_ESR, 0);
 	v1 = apic_read(APIC_ESR);
 	ack_APIC_irq();
-	atomic_inc(&irq_err_count);
+	atomic_inc_unchecked(&irq_err_count);
 
 	/*
 	 * Here is what the APIC error bits mean:
@@ -2184,6 +2184,8 @@
 	u16 *bios_cpu_apicid;
 	DECLARE_BITMAP(clustermap, NUM_APIC_CLUSTERS);
 
+	pax_track_stack();
+
 	bios_cpu_apicid = early_per_cpu_ptr(x86_bios_cpu_apicid);
 	bitmap_zero(clustermap, NUM_APIC_CLUSTERS);
 
diff -uriN linux-2.6.32.43/arch/x86/kernel/apic/io_apic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/apic/io_apic.c
--- linux-2.6.32.43/arch/x86/kernel/apic/io_apic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/apic/io_apic.c	2011-07-15 05:51:11.000000000 -0500
@@ -716,7 +716,7 @@
 	ioapic_entries = kzalloc(sizeof(*ioapic_entries) * nr_ioapics,
 				GFP_ATOMIC);
 	if (!ioapic_entries)
-		return 0;
+		return NULL;
 
 	for (apic = 0; apic < nr_ioapics; apic++) {
 		ioapic_entries[apic] =
@@ -733,7 +733,7 @@
 		kfree(ioapic_entries[apic]);
 	kfree(ioapic_entries);
 
-	return 0;
+	return NULL;
 }
 
 /*
@@ -1150,7 +1150,7 @@
 }
 EXPORT_SYMBOL(IO_APIC_get_PCI_irq_vector);
 
-void lock_vector_lock(void)
+void lock_vector_lock(void) __acquires(vector_lock)
 {
 	/* Used to the online set of cpus does not change
 	 * during assign_irq_vector.
@@ -1158,7 +1158,7 @@
 	spin_lock(&vector_lock);
 }
 
-void unlock_vector_lock(void)
+void unlock_vector_lock(void) __releases(vector_lock)
 {
 	spin_unlock(&vector_lock);
 }
@@ -2542,7 +2542,7 @@
 	ack_APIC_irq();
 }
 
-atomic_t irq_mis_count;
+atomic_unchecked_t irq_mis_count;
 
 static void ack_apic_level(unsigned int irq)
 {
@@ -2626,7 +2626,7 @@
 
 	/* Tail end of version 0x11 I/O APIC bug workaround */
 	if (!(v & (1 << (i & 0x1f)))) {
-		atomic_inc(&irq_mis_count);
+		atomic_inc_unchecked(&irq_mis_count);
 		spin_lock(&ioapic_lock);
 		__mask_and_edge_IO_APIC_irq(cfg);
 		__unmask_and_level_IO_APIC_irq(cfg);
diff -uriN linux-2.6.32.43/arch/x86/kernel/apm_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/apm_32.c
--- linux-2.6.32.43/arch/x86/kernel/apm_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/apm_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -410,7 +410,7 @@
  * This is for buggy BIOS's that refer to (real mode) segment 0x40
  * even though they are called in protected mode.
  */
-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
 
 static const char driver_version[] = "1.16ac";	/* no spaces */
@@ -588,7 +588,10 @@
 	BUG_ON(cpu != 0);
 	gdt = get_cpu_gdt_table(cpu);
 	save_desc_40 = gdt[0x40 / 8];
+
+	pax_open_kernel();
 	gdt[0x40 / 8] = bad_bios_desc;
+	pax_close_kernel();
 
 	apm_irq_save(flags);
 	APM_DO_SAVE_SEGS;
@@ -597,7 +600,11 @@
 			  &call->esi);
 	APM_DO_RESTORE_SEGS;
 	apm_irq_restore(flags);
+
+	pax_open_kernel();
 	gdt[0x40 / 8] = save_desc_40;
+	pax_close_kernel();
+
 	put_cpu();
 
 	return call->eax & 0xff;
@@ -664,7 +671,10 @@
 	BUG_ON(cpu != 0);
 	gdt = get_cpu_gdt_table(cpu);
 	save_desc_40 = gdt[0x40 / 8];
+
+	pax_open_kernel();
 	gdt[0x40 / 8] = bad_bios_desc;
+	pax_close_kernel();
 
 	apm_irq_save(flags);
 	APM_DO_SAVE_SEGS;
@@ -672,7 +682,11 @@
 					 &call->eax);
 	APM_DO_RESTORE_SEGS;
 	apm_irq_restore(flags);
+
+	pax_open_kernel();
 	gdt[0x40 / 8] = save_desc_40;
+	pax_close_kernel();
+
 	put_cpu();
 	return error;
 }
@@ -975,7 +989,7 @@
 
 static void apm_power_off(void)
 {
-	unsigned char po_bios_call[] = {
+	const unsigned char po_bios_call[] = {
 		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
 		0x8e, 0xd0,		/* movw  ax,ss       */
 		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
@@ -2357,12 +2371,15 @@
 	 * code to that CPU.
 	 */
 	gdt = get_cpu_gdt_table(0);
+
+	pax_open_kernel();
 	set_desc_base(&gdt[APM_CS >> 3],
 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg << 4));
 	set_desc_base(&gdt[APM_CS_16 >> 3],
 		 (unsigned long)__va((unsigned long)apm_info.bios.cseg_16 << 4));
 	set_desc_base(&gdt[APM_DS >> 3],
 		 (unsigned long)__va((unsigned long)apm_info.bios.dseg << 4));
+	pax_close_kernel();
 
 	proc_create("apm", 0, NULL, &apm_file_ops);
 
diff -uriN linux-2.6.32.43/arch/x86/kernel/asm-offsets_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/asm-offsets_32.c
--- linux-2.6.32.43/arch/x86/kernel/asm-offsets_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/asm-offsets_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -51,7 +51,6 @@
 	OFFSET(CPUINFO_x86_vendor_id, cpuinfo_x86, x86_vendor_id);
 	BLANK();
 
-	OFFSET(TI_task, thread_info, task);
 	OFFSET(TI_exec_domain, thread_info, exec_domain);
 	OFFSET(TI_flags, thread_info, flags);
 	OFFSET(TI_status, thread_info, status);
@@ -60,6 +59,8 @@
 	OFFSET(TI_restart_block, thread_info, restart_block);
 	OFFSET(TI_sysenter_return, thread_info, sysenter_return);
 	OFFSET(TI_cpu, thread_info, cpu);
+	OFFSET(TI_lowest_stack, thread_info, lowest_stack);
+	DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
 	BLANK();
 
 	OFFSET(GDS_size, desc_ptr, size);
@@ -99,6 +100,7 @@
 
 	DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
 	DEFINE(PAGE_SHIFT_asm, PAGE_SHIFT);
+	DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
 	DEFINE(PTRS_PER_PTE, PTRS_PER_PTE);
 	DEFINE(PTRS_PER_PMD, PTRS_PER_PMD);
 	DEFINE(PTRS_PER_PGD, PTRS_PER_PGD);
@@ -115,6 +117,11 @@
 	OFFSET(PV_CPU_iret, pv_cpu_ops, iret);
 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
 	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
+
+#ifdef CONFIG_PAX_KERNEXEC
+	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
+#endif
+
 #endif
 
 #ifdef CONFIG_XEN
diff -uriN linux-2.6.32.43/arch/x86/kernel/asm-offsets_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/asm-offsets_64.c
--- linux-2.6.32.43/arch/x86/kernel/asm-offsets_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/asm-offsets_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -44,6 +44,8 @@
 	ENTRY(addr_limit);
 	ENTRY(preempt_count);
 	ENTRY(status);
+	ENTRY(lowest_stack);
+	DEFINE(TI_task_thread_sp0, offsetof(struct task_struct, thread.sp0) - offsetof(struct task_struct, tinfo));
 #ifdef CONFIG_IA32_EMULATION
 	ENTRY(sysenter_return);
 #endif
@@ -63,6 +65,18 @@
 	OFFSET(PV_CPU_irq_enable_sysexit, pv_cpu_ops, irq_enable_sysexit);
 	OFFSET(PV_CPU_swapgs, pv_cpu_ops, swapgs);
 	OFFSET(PV_MMU_read_cr2, pv_mmu_ops, read_cr2);
+
+#ifdef CONFIG_PAX_KERNEXEC
+	OFFSET(PV_CPU_read_cr0, pv_cpu_ops, read_cr0);
+	OFFSET(PV_CPU_write_cr0, pv_cpu_ops, write_cr0);
+#endif
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	OFFSET(PV_MMU_read_cr3, pv_mmu_ops, read_cr3);
+	OFFSET(PV_MMU_write_cr3, pv_mmu_ops, write_cr3);
+	OFFSET(PV_MMU_set_pgd, pv_mmu_ops, set_pgd);
+#endif
+
 #endif
 
 
@@ -115,6 +129,7 @@
 	ENTRY(cr8);
 	BLANK();
 #undef ENTRY
+	DEFINE(TSS_size, sizeof(struct tss_struct));
 	DEFINE(TSS_ist, offsetof(struct tss_struct, x86_tss.ist));
 	BLANK();
 	DEFINE(crypto_tfm_ctx_offset, offsetof(struct crypto_tfm, __crt_ctx));
@@ -130,6 +145,7 @@
 
 	BLANK();
 	DEFINE(PAGE_SIZE_asm, PAGE_SIZE);
+	DEFINE(THREAD_SIZE_asm, THREAD_SIZE);
 #ifdef CONFIG_XEN
 	BLANK();
 	OFFSET(XEN_vcpu_info_mask, vcpu_info, evtchn_upcall_mask);
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/amd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/amd.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/amd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/amd.c	2011-07-15 05:51:11.000000000 -0500
@@ -602,7 +602,7 @@
 							unsigned int size)
 {
 	/* AMD errata T13 (order #21922) */
-	if ((c->x86 == 6)) {
+	if (c->x86 == 6) {
 		/* Duron Rev A0 */
 		if (c->x86_model == 3 && c->x86_mask == 0)
 			size = 64;
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/common.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/common.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/common.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/common.c	2011-07-15 05:51:11.000000000 -0500
@@ -83,60 +83,6 @@
 
 static const struct cpu_dev *this_cpu __cpuinitdata = &default_cpu;
 
-DEFINE_PER_CPU_PAGE_ALIGNED(struct gdt_page, gdt_page) = { .gdt = {
-#ifdef CONFIG_X86_64
-	/*
-	 * We need valid kernel segments for data and code in long mode too
-	 * IRET will check the segment types  kkeil 2000/10/28
-	 * Also sysret mandates a special GDT layout
-	 *
-	 * TLS descriptors are currently at a different place compared to i386.
-	 * Hopefully nobody expects them at a fixed place (Wine?)
-	 */
-	[GDT_ENTRY_KERNEL32_CS]		= GDT_ENTRY_INIT(0xc09b, 0, 0xfffff),
-	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xa09b, 0, 0xfffff),
-	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc093, 0, 0xfffff),
-	[GDT_ENTRY_DEFAULT_USER32_CS]	= GDT_ENTRY_INIT(0xc0fb, 0, 0xfffff),
-	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f3, 0, 0xfffff),
-	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xa0fb, 0, 0xfffff),
-#else
-	[GDT_ENTRY_KERNEL_CS]		= GDT_ENTRY_INIT(0xc09a, 0, 0xfffff),
-	[GDT_ENTRY_KERNEL_DS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-	[GDT_ENTRY_DEFAULT_USER_CS]	= GDT_ENTRY_INIT(0xc0fa, 0, 0xfffff),
-	[GDT_ENTRY_DEFAULT_USER_DS]	= GDT_ENTRY_INIT(0xc0f2, 0, 0xfffff),
-	/*
-	 * Segments used for calling PnP BIOS have byte granularity.
-	 * They code segments and data segments have fixed 64k limits,
-	 * the transfer segment sizes are set at run time.
-	 */
-	/* 32-bit code */
-	[GDT_ENTRY_PNPBIOS_CS32]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
-	/* 16-bit code */
-	[GDT_ENTRY_PNPBIOS_CS16]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
-	/* 16-bit data */
-	[GDT_ENTRY_PNPBIOS_DS]		= GDT_ENTRY_INIT(0x0092, 0, 0xffff),
-	/* 16-bit data */
-	[GDT_ENTRY_PNPBIOS_TS1]		= GDT_ENTRY_INIT(0x0092, 0, 0),
-	/* 16-bit data */
-	[GDT_ENTRY_PNPBIOS_TS2]		= GDT_ENTRY_INIT(0x0092, 0, 0),
-	/*
-	 * The APM segments have byte granularity and their bases
-	 * are set at run time.  All have 64k limits.
-	 */
-	/* 32-bit code */
-	[GDT_ENTRY_APMBIOS_BASE]	= GDT_ENTRY_INIT(0x409a, 0, 0xffff),
-	/* 16-bit code */
-	[GDT_ENTRY_APMBIOS_BASE+1]	= GDT_ENTRY_INIT(0x009a, 0, 0xffff),
-	/* data */
-	[GDT_ENTRY_APMBIOS_BASE+2]	= GDT_ENTRY_INIT(0x4092, 0, 0xffff),
-
-	[GDT_ENTRY_ESPFIX_SS]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-	[GDT_ENTRY_PERCPU]		= GDT_ENTRY_INIT(0xc092, 0, 0xfffff),
-	GDT_STACK_CANARY_INIT
-#endif
-} };
-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
-
 static int __init x86_xsave_setup(char *s)
 {
 	setup_clear_cpu_cap(X86_FEATURE_XSAVE);
@@ -344,7 +290,7 @@
 {
 	struct desc_ptr gdt_descr;
 
-	gdt_descr.address = (long)get_cpu_gdt_table(cpu);
+	gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
 	gdt_descr.size = GDT_SIZE - 1;
 	load_gdt(&gdt_descr);
 	/* Reload the per-cpu base */
@@ -798,6 +744,10 @@
 	/* Filter out anything that depends on CPUID levels we don't have */
 	filter_cpuid_features(c, true);
 
+#if defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || (defined(CONFIG_PAX_MEMORY_UDEREF) && defined(CONFIG_X86_32))
+	setup_clear_cpu_cap(X86_FEATURE_SEP);
+#endif
+
 	/* If the model name is still unset, do table lookup. */
 	if (!c->x86_model_id[0]) {
 		const char *p;
@@ -980,6 +930,9 @@
 }
 __setup("clearcpuid=", setup_disablecpuid);
 
+DEFINE_PER_CPU(struct thread_info *, current_tinfo) = &init_task.tinfo;
+EXPORT_PER_CPU_SYMBOL(current_tinfo);
+
 #ifdef CONFIG_X86_64
 struct desc_ptr idt_descr = { NR_VECTORS * 16 - 1, (unsigned long) idt_table };
 
@@ -995,7 +948,7 @@
 EXPORT_PER_CPU_SYMBOL(current_task);
 
 DEFINE_PER_CPU(unsigned long, kernel_stack) =
-	(unsigned long)&init_thread_union - KERNEL_STACK_OFFSET + THREAD_SIZE;
+	(unsigned long)&init_thread_union - 16 + THREAD_SIZE;
 EXPORT_PER_CPU_SYMBOL(kernel_stack);
 
 DEFINE_PER_CPU(char *, irq_stack_ptr) =
@@ -1060,7 +1013,7 @@
 {
 	memset(regs, 0, sizeof(struct pt_regs));
 	regs->fs = __KERNEL_PERCPU;
-	regs->gs = __KERNEL_STACK_CANARY;
+	savesegment(gs, regs->gs);
 
 	return regs;
 }
@@ -1101,7 +1054,7 @@
 	int i;
 
 	cpu = stack_smp_processor_id();
-	t = &per_cpu(init_tss, cpu);
+	t = init_tss + cpu;
 	orig_ist = &per_cpu(orig_ist, cpu);
 
 #ifdef CONFIG_NUMA
@@ -1127,7 +1080,7 @@
 	switch_to_new_gdt(cpu);
 	loadsegment(fs, 0);
 
-	load_idt((const struct desc_ptr *)&idt_descr);
+	load_idt(&idt_descr);
 
 	memset(me->thread.tls_array, 0, GDT_ENTRY_TLS_ENTRIES * 8);
 	syscall_init();
@@ -1136,7 +1089,6 @@
 	wrmsrl(MSR_KERNEL_GS_BASE, 0);
 	barrier();
 
-	check_efer();
 	if (cpu != 0)
 		enable_x2apic();
 
@@ -1199,7 +1151,7 @@
 {
 	int cpu = smp_processor_id();
 	struct task_struct *curr = current;
-	struct tss_struct *t = &per_cpu(init_tss, cpu);
+	struct tss_struct *t = init_tss + cpu;
 	struct thread_struct *thread = &curr->thread;
 
 	if (cpumask_test_and_set_cpu(cpu, cpu_initialized_mask)) {
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/intel.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/intel.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/intel.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/intel.c	2011-07-15 05:51:11.000000000 -0500
@@ -162,7 +162,7 @@
 	 * Update the IDT descriptor and reload the IDT so that
 	 * it uses the read-only mapped virtual address.
 	 */
-	idt_descr.address = fix_to_virt(FIX_F00F_IDT);
+	idt_descr.address = (struct desc_struct *)fix_to_virt(FIX_F00F_IDT);
 	load_idt(&idt_descr);
 }
 #endif
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/intel_cacheinfo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/intel_cacheinfo.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/intel_cacheinfo.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/intel_cacheinfo.c	2011-07-15 05:51:11.000000000 -0500
@@ -921,7 +921,7 @@
 	return ret;
 }
 
-static struct sysfs_ops sysfs_ops = {
+static const struct sysfs_ops sysfs_ops = {
 	.show   = show,
 	.store  = store,
 };
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/Makefile
--- linux-2.6.32.43/arch/x86/kernel/cpu/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/Makefile	2011-07-15 05:51:11.000000000 -0500
@@ -7,10 +7,6 @@
 CFLAGS_REMOVE_common.o = -pg
 endif
 
-# Make sure load_percpu_segment has no stackprotector
-nostackp := $(call cc-option, -fno-stack-protector)
-CFLAGS_common.o		:= $(nostackp)
-
 obj-y			:= intel_cacheinfo.o addon_cpuid_features.o
 obj-y			+= proc.o capflags.o powerflags.o common.o
 obj-y			+= vmware.o hypervisor.o sched.o
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce_amd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mcheck/mce_amd.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce_amd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mcheck/mce_amd.c	2011-07-15 05:51:11.000000000 -0500
@@ -385,7 +385,7 @@
 	return ret;
 }
 
-static struct sysfs_ops threshold_ops = {
+static const struct sysfs_ops threshold_ops = {
 	.show			= show,
 	.store			= store,
 };
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mcheck/mce.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/mcheck/mce.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mcheck/mce.c	2011-07-15 05:51:11.000000000 -0500
@@ -43,6 +43,7 @@
 #include <asm/ipi.h>
 #include <asm/mce.h>
 #include <asm/msr.h>
+#include <asm/local.h>
 
 #include "mce-internal.h"
 
@@ -187,7 +188,7 @@
 			!(m->mcgstatus & MCG_STATUS_EIPV) ? " !INEXACT!" : "",
 				m->cs, m->ip);
 
-		if (m->cs == __KERNEL_CS)
+		if (m->cs == __KERNEL_CS || m->cs == __KERNEXEC_KERNEL_CS)
 			print_symbol("{%s}", m->ip);
 		pr_cont("\n");
 	}
@@ -221,10 +222,10 @@
 
 #define PANIC_TIMEOUT 5 /* 5 seconds */
 
-static atomic_t mce_paniced;
+static atomic_unchecked_t mce_paniced;
 
 static int fake_panic;
-static atomic_t mce_fake_paniced;
+static atomic_unchecked_t mce_fake_paniced;
 
 /* Panic in progress. Enable interrupts and wait for final IPI */
 static void wait_for_panic(void)
@@ -248,7 +249,7 @@
 		/*
 		 * Make sure only one CPU runs in machine check panic
 		 */
-		if (atomic_inc_return(&mce_paniced) > 1)
+		if (atomic_inc_return_unchecked(&mce_paniced) > 1)
 			wait_for_panic();
 		barrier();
 
@@ -256,7 +257,7 @@
 		console_verbose();
 	} else {
 		/* Don't log too much for fake panic */
-		if (atomic_inc_return(&mce_fake_paniced) > 1)
+		if (atomic_inc_return_unchecked(&mce_fake_paniced) > 1)
 			return;
 	}
 	print_mce_head();
@@ -616,7 +617,7 @@
 	 * might have been modified by someone else.
 	 */
 	rmb();
-	if (atomic_read(&mce_paniced))
+	if (atomic_read_unchecked(&mce_paniced))
 		wait_for_panic();
 	if (!monarch_timeout)
 		goto out;
@@ -1429,14 +1430,14 @@
  */
 
 static DEFINE_SPINLOCK(mce_state_lock);
-static int		open_count;		/* #times opened */
+static local_t		open_count;		/* #times opened */
 static int		open_exclu;		/* already open exclusive? */
 
 static int mce_open(struct inode *inode, struct file *file)
 {
 	spin_lock(&mce_state_lock);
 
-	if (open_exclu || (open_count && (file->f_flags & O_EXCL))) {
+	if (open_exclu || (local_read(&open_count) && (file->f_flags & O_EXCL))) {
 		spin_unlock(&mce_state_lock);
 
 		return -EBUSY;
@@ -1444,7 +1445,7 @@
 
 	if (file->f_flags & O_EXCL)
 		open_exclu = 1;
-	open_count++;
+	local_inc(&open_count);
 
 	spin_unlock(&mce_state_lock);
 
@@ -1455,7 +1456,7 @@
 {
 	spin_lock(&mce_state_lock);
 
-	open_count--;
+	local_dec(&open_count);
 	open_exclu = 0;
 
 	spin_unlock(&mce_state_lock);
@@ -2082,7 +2083,7 @@
 static void mce_reset(void)
 {
 	cpu_missing = 0;
-	atomic_set(&mce_fake_paniced, 0);
+	atomic_set_unchecked(&mce_fake_paniced, 0);
 	atomic_set(&mce_executing, 0);
 	atomic_set(&mce_callin, 0);
 	atomic_set(&global_nwo, 0);
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/amd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/amd.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/amd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/amd.c	2011-07-15 05:51:11.000000000 -0500
@@ -108,7 +108,7 @@
 	return 0;
 }
 
-static struct mtrr_ops amd_mtrr_ops = {
+static const struct mtrr_ops amd_mtrr_ops = {
 	.vendor            = X86_VENDOR_AMD,
 	.set               = amd_set_mtrr,
 	.get               = amd_get_mtrr,
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/centaur.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/centaur.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/centaur.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/centaur.c	2011-07-15 05:51:11.000000000 -0500
@@ -110,7 +110,7 @@
 	return 0;
 }
 
-static struct mtrr_ops centaur_mtrr_ops = {
+static const struct mtrr_ops centaur_mtrr_ops = {
 	.vendor            = X86_VENDOR_CENTAUR,
 	.set               = centaur_set_mcr,
 	.get               = centaur_get_mcr,
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/cyrix.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/cyrix.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/cyrix.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/cyrix.c	2011-07-15 05:51:11.000000000 -0500
@@ -265,7 +265,7 @@
 	post_set();
 }
 
-static struct mtrr_ops cyrix_mtrr_ops = {
+static const struct mtrr_ops cyrix_mtrr_ops = {
 	.vendor            = X86_VENDOR_CYRIX,
 	.set_all	   = cyrix_set_all,
 	.set               = cyrix_set_arr,
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/generic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/generic.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/generic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/generic.c	2011-07-15 05:51:11.000000000 -0500
@@ -752,7 +752,7 @@
 /*
  * Generic structure...
  */
-struct mtrr_ops generic_mtrr_ops = {
+const struct mtrr_ops generic_mtrr_ops = {
 	.use_intel_if		= 1,
 	.set_all		= generic_set_all,
 	.get			= generic_get_mtrr,
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/main.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/main.c	2011-07-15 05:51:11.000000000 -0500
@@ -60,14 +60,14 @@
 u64 size_or_mask, size_and_mask;
 static bool mtrr_aps_delayed_init;
 
-static struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM];
+static const struct mtrr_ops *mtrr_ops[X86_VENDOR_NUM] __read_only;
 
-struct mtrr_ops *mtrr_if;
+const struct mtrr_ops *mtrr_if;
 
 static void set_mtrr(unsigned int reg, unsigned long base,
 		     unsigned long size, mtrr_type type);
 
-void set_mtrr_ops(struct mtrr_ops *ops)
+void set_mtrr_ops(const struct mtrr_ops *ops)
 {
 	if (ops->vendor && ops->vendor < X86_VENDOR_NUM)
 		mtrr_ops[ops->vendor] = ops;
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/mtrr.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/mtrr.h
--- linux-2.6.32.43/arch/x86/kernel/cpu/mtrr/mtrr.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/mtrr/mtrr.h	2011-07-15 05:51:11.000000000 -0500
@@ -12,19 +12,19 @@
 extern unsigned int mtrr_usage_table[MTRR_MAX_VAR_RANGES];
 
 struct mtrr_ops {
-	u32	vendor;
-	u32	use_intel_if;
-	void	(*set)(unsigned int reg, unsigned long base,
+	const u32	vendor;
+	const u32	use_intel_if;
+	void	(* const set)(unsigned int reg, unsigned long base,
 		       unsigned long size, mtrr_type type);
-	void	(*set_all)(void);
+	void	(* const set_all)(void);
 
-	void	(*get)(unsigned int reg, unsigned long *base,
+	void	(* const get)(unsigned int reg, unsigned long *base,
 		       unsigned long *size, mtrr_type *type);
-	int	(*get_free_region)(unsigned long base, unsigned long size,
+	int	(* const get_free_region)(unsigned long base, unsigned long size,
 				   int replace_reg);
-	int	(*validate_add_page)(unsigned long base, unsigned long size,
+	int	(* const validate_add_page)(unsigned long base, unsigned long size,
 				     unsigned int type);
-	int	(*have_wrcomb)(void);
+	int	(* const have_wrcomb)(void);
 };
 
 extern int generic_get_free_region(unsigned long base, unsigned long size,
@@ -32,7 +32,7 @@
 extern int generic_validate_add_page(unsigned long base, unsigned long size,
 				     unsigned int type);
 
-extern struct mtrr_ops generic_mtrr_ops;
+extern const struct mtrr_ops generic_mtrr_ops;
 
 extern int positive_have_wrcomb(void);
 
@@ -53,10 +53,10 @@
 		u32 base_lo, u32 base_hi, u32 mask_lo, u32 mask_hi);
 void get_mtrr_state(void);
 
-extern void set_mtrr_ops(struct mtrr_ops *ops);
+extern void set_mtrr_ops(const struct mtrr_ops *ops);
 
 extern u64 size_or_mask, size_and_mask;
-extern struct mtrr_ops *mtrr_if;
+extern const struct mtrr_ops *mtrr_if;
 
 #define is_cpu(vnd)	(mtrr_if && mtrr_if->vendor == X86_VENDOR_##vnd)
 #define use_intel()	(mtrr_if && mtrr_if->use_intel_if == 1)
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/perfctr-watchdog.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/perfctr-watchdog.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/perfctr-watchdog.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/perfctr-watchdog.c	2011-07-15 05:51:11.000000000 -0500
@@ -30,11 +30,11 @@
 
 /* Interface defining a CPU specific perfctr watchdog */
 struct wd_ops {
-	int (*reserve)(void);
-	void (*unreserve)(void);
-	int (*setup)(unsigned nmi_hz);
-	void (*rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
-	void (*stop)(void);
+	int (* const reserve)(void);
+	void (* const unreserve)(void);
+	int (* const setup)(unsigned nmi_hz);
+	void (* const rearm)(struct nmi_watchdog_ctlblk *wd, unsigned nmi_hz);
+	void (* const stop)(void);
 	unsigned perfctr;
 	unsigned evntsel;
 	u64 checkbit;
@@ -645,6 +645,7 @@
 #define ARCH_PERFMON_NMI_EVENT_SEL	ARCH_PERFMON_UNHALTED_CORE_CYCLES_SEL
 #define ARCH_PERFMON_NMI_EVENT_UMASK	ARCH_PERFMON_UNHALTED_CORE_CYCLES_UMASK
 
+/* cannot be const */
 static struct wd_ops intel_arch_wd_ops;
 
 static int setup_intel_arch_watchdog(unsigned nmi_hz)
@@ -697,6 +698,7 @@
 	return 1;
 }
 
+/* cannot be const */
 static struct wd_ops intel_arch_wd_ops __read_mostly = {
 	.reserve	= single_msr_reserve,
 	.unreserve	= single_msr_unreserve,
diff -uriN linux-2.6.32.43/arch/x86/kernel/cpu/perf_event.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/perf_event.c
--- linux-2.6.32.43/arch/x86/kernel/cpu/perf_event.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/cpu/perf_event.c	2011-07-15 05:51:11.000000000 -0500
@@ -723,10 +723,10 @@
 	 * count to the generic event atomically:
 	 */
 again:
-	prev_raw_count = atomic64_read(&hwc->prev_count);
+	prev_raw_count = atomic64_read_unchecked(&hwc->prev_count);
 	rdmsrl(hwc->event_base + idx, new_raw_count);
 
-	if (atomic64_cmpxchg(&hwc->prev_count, prev_raw_count,
+	if (atomic64_cmpxchg_unchecked(&hwc->prev_count, prev_raw_count,
 					new_raw_count) != prev_raw_count)
 		goto again;
 
@@ -741,7 +741,7 @@
 	delta = (new_raw_count << shift) - (prev_raw_count << shift);
 	delta >>= shift;
 
-	atomic64_add(delta, &event->count);
+	atomic64_add_unchecked(delta, &event->count);
 	atomic64_sub(delta, &hwc->period_left);
 
 	return new_raw_count;
@@ -1353,7 +1353,7 @@
 	 * The hw event starts counting from this event offset,
 	 * mark it to be able to extra future deltas:
 	 */
-	atomic64_set(&hwc->prev_count, (u64)-left);
+	atomic64_set_unchecked(&hwc->prev_count, (u64)-left);
 
 	err = checking_wrmsrl(hwc->event_base + idx,
 			     (u64)(-left) & x86_pmu.event_mask);
@@ -2357,7 +2357,7 @@
 			break;
 
 		callchain_store(entry, frame.return_address);
-		fp = frame.next_frame;
+		fp = (__force const void __user *)frame.next_frame;
 	}
 }
 
diff -uriN linux-2.6.32.43/arch/x86/kernel/crash.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/crash.c
--- linux-2.6.32.43/arch/x86/kernel/crash.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/crash.c	2011-07-15 05:51:11.000000000 -0500
@@ -41,7 +41,7 @@
 	regs = args->regs;
 
 #ifdef CONFIG_X86_32
-	if (!user_mode_vm(regs)) {
+	if (!user_mode(regs)) {
 		crash_fixup_ss_esp(&fixed_regs, regs);
 		regs = &fixed_regs;
 	}
diff -uriN linux-2.6.32.43/arch/x86/kernel/doublefault_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/doublefault_32.c
--- linux-2.6.32.43/arch/x86/kernel/doublefault_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/doublefault_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -11,7 +11,7 @@
 
 #define DOUBLEFAULT_STACKSIZE (1024)
 static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
+#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
 
 #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
 
@@ -21,7 +21,7 @@
 	unsigned long gdt, tss;
 
 	store_gdt(&gdt_desc);
-	gdt = gdt_desc.address;
+	gdt = (unsigned long)gdt_desc.address;
 
 	printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
 
@@ -58,10 +58,10 @@
 		/* 0x2 bit is always set */
 		.flags		= X86_EFLAGS_SF | 0x2,
 		.sp		= STACK_START,
-		.es		= __USER_DS,
+		.es		= __KERNEL_DS,
 		.cs		= __KERNEL_CS,
 		.ss		= __KERNEL_DS,
-		.ds		= __USER_DS,
+		.ds		= __KERNEL_DS,
 		.fs		= __KERNEL_PERCPU,
 
 		.__cr3		= __pa_nodebug(swapper_pg_dir),
diff -uriN linux-2.6.32.43/arch/x86/kernel/dumpstack_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/dumpstack_32.c
--- linux-2.6.32.43/arch/x86/kernel/dumpstack_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/dumpstack_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -53,16 +53,12 @@
 #endif
 
 	for (;;) {
-		struct thread_info *context;
+		void *stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
+		bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
 
-		context = (struct thread_info *)
-			((unsigned long)stack & (~(THREAD_SIZE - 1)));
-		bp = print_context_stack(context, stack, bp, ops,
-					 data, NULL, &graph);
-
-		stack = (unsigned long *)context->previous_esp;
-		if (!stack)
+		if (stack_start == task_stack_page(task))
 			break;
+		stack = *(unsigned long **)stack_start;
 		if (ops->stack(data, "IRQ") < 0)
 			break;
 		touch_nmi_watchdog();
@@ -112,11 +108,12 @@
 	 * When in-kernel, we also print out the stack and code at the
 	 * time of the fault..
 	 */
-	if (!user_mode_vm(regs)) {
+	if (!user_mode(regs)) {
 		unsigned int code_prologue = code_bytes * 43 / 64;
 		unsigned int code_len = code_bytes;
 		unsigned char c;
 		u8 *ip;
+		unsigned long cs_base = get_desc_base(&get_cpu_gdt_table(smp_processor_id())[(0xffff & regs->cs) >> 3]);
 
 		printk(KERN_EMERG "Stack:\n");
 		show_stack_log_lvl(NULL, regs, &regs->sp,
@@ -124,10 +121,10 @@
 
 		printk(KERN_EMERG "Code: ");
 
-		ip = (u8 *)regs->ip - code_prologue;
+		ip = (u8 *)regs->ip - code_prologue + cs_base;
 		if (ip < (u8 *)PAGE_OFFSET || probe_kernel_address(ip, c)) {
 			/* try starting at IP */
-			ip = (u8 *)regs->ip;
+			ip = (u8 *)regs->ip + cs_base;
 			code_len = code_len - code_prologue + 1;
 		}
 		for (i = 0; i < code_len; i++, ip++) {
@@ -136,7 +133,7 @@
 				printk(" Bad EIP value.");
 				break;
 			}
-			if (ip == (u8 *)regs->ip)
+			if (ip == (u8 *)regs->ip + cs_base)
 				printk("<%02x> ", c);
 			else
 				printk("%02x ", c);
@@ -149,6 +146,7 @@
 {
 	unsigned short ud2;
 
+	ip = ktla_ktva(ip);
 	if (ip < PAGE_OFFSET)
 		return 0;
 	if (probe_kernel_address((unsigned short *)ip, ud2))
diff -uriN linux-2.6.32.43/arch/x86/kernel/dumpstack_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/dumpstack_64.c
--- linux-2.6.32.43/arch/x86/kernel/dumpstack_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/dumpstack_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -116,8 +116,8 @@
 	unsigned long *irq_stack_end =
 		(unsigned long *)per_cpu(irq_stack_ptr, cpu);
 	unsigned used = 0;
-	struct thread_info *tinfo;
 	int graph = 0;
+	void *stack_start;
 
 	if (!task)
 		task = current;
@@ -146,10 +146,10 @@
 	 * current stack address. If the stacks consist of nested
 	 * exceptions
 	 */
-	tinfo = task_thread_info(task);
 	for (;;) {
 		char *id;
 		unsigned long *estack_end;
+
 		estack_end = in_exception_stack(cpu, (unsigned long)stack,
 						&used, &id);
 
@@ -157,7 +157,7 @@
 			if (ops->stack(data, id) < 0)
 				break;
 
-			bp = print_context_stack(tinfo, stack, bp, ops,
+			bp = print_context_stack(task, estack_end - EXCEPTION_STKSZ, stack, bp, ops,
 						 data, estack_end, &graph);
 			ops->stack(data, "<EOE>");
 			/*
@@ -176,7 +176,7 @@
 			if (stack >= irq_stack && stack < irq_stack_end) {
 				if (ops->stack(data, "IRQ") < 0)
 					break;
-				bp = print_context_stack(tinfo, stack, bp,
+				bp = print_context_stack(task, irq_stack, stack, bp,
 					ops, data, irq_stack_end, &graph);
 				/*
 				 * We link to the next stack (which would be
@@ -195,7 +195,8 @@
 	/*
 	 * This handles the process stack:
 	 */
-	bp = print_context_stack(tinfo, stack, bp, ops, data, NULL, &graph);
+	stack_start = (void *)((unsigned long)stack & ~(THREAD_SIZE-1));
+	bp = print_context_stack(task, stack_start, stack, bp, ops, data, NULL, &graph);
 	put_cpu();
 }
 EXPORT_SYMBOL(dump_trace);
diff -uriN linux-2.6.32.43/arch/x86/kernel/dumpstack.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/dumpstack.c
--- linux-2.6.32.43/arch/x86/kernel/dumpstack.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/dumpstack.c	2011-07-15 05:51:11.000000000 -0500
@@ -2,6 +2,9 @@
  *  Copyright (C) 1991, 1992  Linus Torvalds
  *  Copyright (C) 2000, 2001, 2002 Andi Kleen, SuSE Labs
  */
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+#define __INCLUDED_BY_HIDESYM 1
+#endif
 #include <linux/kallsyms.h>
 #include <linux/kprobes.h>
 #include <linux/uaccess.h>
@@ -28,7 +31,7 @@
 
 void printk_address(unsigned long address, int reliable)
 {
-	printk(" [<%p>] %s%pS\n", (void *) address,
+	printk(" [<%p>] %s%pA\n", (void *) address,
 			reliable ? "" : "? ", (void *) address);
 }
 
@@ -36,9 +39,8 @@
 static void
 print_ftrace_graph_addr(unsigned long addr, void *data,
 			const struct stacktrace_ops *ops,
-			struct thread_info *tinfo, int *graph)
+			struct task_struct *task, int *graph)
 {
-	struct task_struct *task = tinfo->task;
 	unsigned long ret_addr;
 	int index = task->curr_ret_stack;
 
@@ -59,7 +61,7 @@
 static inline void
 print_ftrace_graph_addr(unsigned long addr, void *data,
 			const struct stacktrace_ops *ops,
-			struct thread_info *tinfo, int *graph)
+			struct task_struct *task, int *graph)
 { }
 #endif
 
@@ -70,10 +72,8 @@
  * severe exception (double fault, nmi, stack fault, debug, mce) hardware stack
  */
 
-static inline int valid_stack_ptr(struct thread_info *tinfo,
-			void *p, unsigned int size, void *end)
+static inline int valid_stack_ptr(void *t, void *p, unsigned int size, void *end)
 {
-	void *t = tinfo;
 	if (end) {
 		if (p < end && p >= (end-THREAD_SIZE))
 			return 1;
@@ -84,14 +84,14 @@
 }
 
 unsigned long
-print_context_stack(struct thread_info *tinfo,
+print_context_stack(struct task_struct *task, void *stack_start,
 		unsigned long *stack, unsigned long bp,
 		const struct stacktrace_ops *ops, void *data,
 		unsigned long *end, int *graph)
 {
 	struct stack_frame *frame = (struct stack_frame *)bp;
 
-	while (valid_stack_ptr(tinfo, stack, sizeof(*stack), end)) {
+	while (valid_stack_ptr(stack_start, stack, sizeof(*stack), end)) {
 		unsigned long addr;
 
 		addr = *stack;
@@ -103,7 +103,7 @@
 			} else {
 				ops->address(data, addr, 0);
 			}
-			print_ftrace_graph_addr(addr, data, ops, tinfo, graph);
+			print_ftrace_graph_addr(addr, data, ops, task, graph);
 		}
 		stack++;
 	}
@@ -180,7 +180,7 @@
 #endif
 
 	printk("Pid: %d, comm: %.20s %s %s %.*s\n",
-		current->pid, current->comm, print_tainted(),
+		task_pid_nr(current), current->comm, print_tainted(),
 		init_utsname()->release,
 		(int)strcspn(init_utsname()->version, " "),
 		init_utsname()->version);
@@ -220,6 +220,8 @@
 	return flags;
 }
 
+extern void gr_handle_kernel_exploit(void);
+
 void __kprobes oops_end(unsigned long flags, struct pt_regs *regs, int signr)
 {
 	if (regs && kexec_should_crash(current))
@@ -241,7 +243,10 @@
 		panic("Fatal exception in interrupt");
 	if (panic_on_oops)
 		panic("Fatal exception");
-	do_exit(signr);
+
+	gr_handle_kernel_exploit();
+
+	do_group_exit(signr);
 }
 
 int __kprobes __die(const char *str, struct pt_regs *regs, long err)
@@ -295,7 +300,7 @@
 	unsigned long flags = oops_begin();
 	int sig = SIGSEGV;
 
-	if (!user_mode_vm(regs))
+	if (!user_mode(regs))
 		report_bug(regs->ip, regs);
 
 	if (__die(str, regs, err))
diff -uriN linux-2.6.32.43/arch/x86/kernel/dumpstack.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/dumpstack.h
--- linux-2.6.32.43/arch/x86/kernel/dumpstack.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/dumpstack.h	2011-07-15 05:51:11.000000000 -0500
@@ -15,7 +15,7 @@
 #endif
 
 extern unsigned long
-print_context_stack(struct thread_info *tinfo,
+print_context_stack(struct task_struct *task, void *stack_start,
 		unsigned long *stack, unsigned long bp,
 		const struct stacktrace_ops *ops, void *data,
 		unsigned long *end, int *graph);
diff -uriN linux-2.6.32.43/arch/x86/kernel/e820.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/e820.c
--- linux-2.6.32.43/arch/x86/kernel/e820.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/e820.c	2011-07-15 05:51:11.000000000 -0500
@@ -733,7 +733,7 @@
 };
 static struct early_res early_res[MAX_EARLY_RES] __initdata = {
 	{ 0, PAGE_SIZE, "BIOS data page" },	/* BIOS data page */
-	{}
+	{ 0, 0, {0}, 0 }
 };
 
 static int __init find_overlapped_early(u64 start, u64 end)
diff -uriN linux-2.6.32.43/arch/x86/kernel/early_printk.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/early_printk.c
--- linux-2.6.32.43/arch/x86/kernel/early_printk.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/early_printk.c	2011-07-15 05:51:11.000000000 -0500
@@ -7,6 +7,7 @@
 #include <linux/pci_regs.h>
 #include <linux/pci_ids.h>
 #include <linux/errno.h>
+#include <linux/sched.h>
 #include <asm/io.h>
 #include <asm/processor.h>
 #include <asm/fcntl.h>
@@ -170,6 +171,8 @@
 	int n;
 	va_list ap;
 
+	pax_track_stack();
+
 	va_start(ap, fmt);
 	n = vscnprintf(buf, sizeof(buf), fmt, ap);
 	early_console->write(early_console, buf, n);
diff -uriN linux-2.6.32.43/arch/x86/kernel/efi_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/efi_32.c
--- linux-2.6.32.43/arch/x86/kernel/efi_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/efi_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -38,70 +38,38 @@
  */
 
 static unsigned long efi_rt_eflags;
-static pgd_t efi_bak_pg_dir_pointer[2];
+static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS];
 
-void efi_call_phys_prelog(void)
+void __init efi_call_phys_prelog(void)
 {
-	unsigned long cr4;
-	unsigned long temp;
 	struct desc_ptr gdt_descr;
 
 	local_irq_save(efi_rt_eflags);
 
-	/*
-	 * If I don't have PAE, I should just duplicate two entries in page
-	 * directory. If I have PAE, I just need to duplicate one entry in
-	 * page directory.
-	 */
-	cr4 = read_cr4_safe();
 
-	if (cr4 & X86_CR4_PAE) {
-		efi_bak_pg_dir_pointer[0].pgd =
-		    swapper_pg_dir[pgd_index(0)].pgd;
-		swapper_pg_dir[0].pgd =
-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
-	} else {
-		efi_bak_pg_dir_pointer[0].pgd =
-		    swapper_pg_dir[pgd_index(0)].pgd;
-		efi_bak_pg_dir_pointer[1].pgd =
-		    swapper_pg_dir[pgd_index(0x400000)].pgd;
-		swapper_pg_dir[pgd_index(0)].pgd =
-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
-		temp = PAGE_OFFSET + 0x400000;
-		swapper_pg_dir[pgd_index(0x400000)].pgd =
-		    swapper_pg_dir[pgd_index(temp)].pgd;
-	}
+	clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
+	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
 
 	/*
 	 * After the lock is released, the original page table is restored.
 	 */
 	__flush_tlb_all();
 
-	gdt_descr.address = __pa(get_cpu_gdt_table(0));
+	gdt_descr.address = (struct desc_struct *)__pa(get_cpu_gdt_table(0));
 	gdt_descr.size = GDT_SIZE - 1;
 	load_gdt(&gdt_descr);
 }
 
-void efi_call_phys_epilog(void)
+void __init efi_call_phys_epilog(void)
 {
-	unsigned long cr4;
 	struct desc_ptr gdt_descr;
 
-	gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
+	gdt_descr.address = get_cpu_gdt_table(0);
 	gdt_descr.size = GDT_SIZE - 1;
 	load_gdt(&gdt_descr);
 
-	cr4 = read_cr4_safe();
-
-	if (cr4 & X86_CR4_PAE) {
-		swapper_pg_dir[pgd_index(0)].pgd =
-		    efi_bak_pg_dir_pointer[0].pgd;
-	} else {
-		swapper_pg_dir[pgd_index(0)].pgd =
-		    efi_bak_pg_dir_pointer[0].pgd;
-		swapper_pg_dir[pgd_index(0x400000)].pgd =
-		    efi_bak_pg_dir_pointer[1].pgd;
-	}
+	clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
 
 	/*
 	 * After the lock is released, the original page table is restored.
diff -uriN linux-2.6.32.43/arch/x86/kernel/efi_stub_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/efi_stub_32.S
--- linux-2.6.32.43/arch/x86/kernel/efi_stub_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/efi_stub_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -6,6 +6,7 @@
  */
 
 #include <linux/linkage.h>
+#include <linux/init.h>
 #include <asm/page_types.h>
 
 /*
@@ -20,7 +21,7 @@
  * service functions will comply with gcc calling convention, too.
  */
 
-.text
+__INIT
 ENTRY(efi_call_phys)
 	/*
 	 * 0. The function can only be called in Linux kernel. So CS has been
@@ -36,9 +37,7 @@
 	 * The mapping of lower virtual memory has been created in prelog and
 	 * epilog.
 	 */
-	movl	$1f, %edx
-	subl	$__PAGE_OFFSET, %edx
-	jmp	*%edx
+	jmp	1f-__PAGE_OFFSET
 1:
 
 	/*
@@ -47,14 +46,8 @@
 	 * parameter 2, ..., param n. To make things easy, we save the return
 	 * address of efi_call_phys in a global variable.
 	 */
-	popl	%edx
-	movl	%edx, saved_return_addr
-	/* get the function pointer into ECX*/
-	popl	%ecx
-	movl	%ecx, efi_rt_function_ptr
-	movl	$2f, %edx
-	subl	$__PAGE_OFFSET, %edx
-	pushl	%edx
+	popl	(saved_return_addr)
+	popl	(efi_rt_function_ptr)
 
 	/*
 	 * 3. Clear PG bit in %CR0.
@@ -73,9 +66,8 @@
 	/*
 	 * 5. Call the physical function.
 	 */
-	jmp	*%ecx
+	call	*(efi_rt_function_ptr-__PAGE_OFFSET)
 
-2:
 	/*
 	 * 6. After EFI runtime service returns, control will return to
 	 * following instruction. We'd better readjust stack pointer first.
@@ -88,35 +80,28 @@
 	movl	%cr0, %edx
 	orl	$0x80000000, %edx
 	movl	%edx, %cr0
-	jmp	1f
-1:
+
 	/*
 	 * 8. Now restore the virtual mode from flat mode by
 	 * adding EIP with PAGE_OFFSET.
 	 */
-	movl	$1f, %edx
-	jmp	*%edx
+	jmp	1f+__PAGE_OFFSET
 1:
 
 	/*
 	 * 9. Balance the stack. And because EAX contain the return value,
 	 * we'd better not clobber it.
 	 */
-	leal	efi_rt_function_ptr, %edx
-	movl	(%edx), %ecx
-	pushl	%ecx
+	pushl	(efi_rt_function_ptr)
 
 	/*
-	 * 10. Push the saved return address onto the stack and return.
+	 * 10. Return to the saved return address.
 	 */
-	leal	saved_return_addr, %edx
-	movl	(%edx), %ecx
-	pushl	%ecx
-	ret
+	jmpl	*(saved_return_addr)
 ENDPROC(efi_call_phys)
 .previous
 
-.data
+__INITDATA
 saved_return_addr:
 	.long 0
 efi_rt_function_ptr:
diff -uriN linux-2.6.32.43/arch/x86/kernel/entry_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/entry_32.S
--- linux-2.6.32.43/arch/x86/kernel/entry_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/entry_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -185,13 +185,146 @@
 	/*CFI_REL_OFFSET gs, PT_GS*/
 .endm
 .macro SET_KERNEL_GS reg
+
+#ifdef CONFIG_CC_STACKPROTECTOR
 	movl $(__KERNEL_STACK_CANARY), \reg
+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
+	movl $(__USER_DS), \reg
+#else
+	xorl \reg, \reg
+#endif
+
 	movl \reg, %gs
 .endm
 
 #endif	/* CONFIG_X86_32_LAZY_GS */
 
-.macro SAVE_ALL
+.macro pax_enter_kernel
+#ifdef CONFIG_PAX_KERNEXEC
+	call pax_enter_kernel
+#endif
+.endm
+
+.macro pax_exit_kernel
+#ifdef CONFIG_PAX_KERNEXEC
+	call pax_exit_kernel
+#endif
+.endm
+
+#ifdef CONFIG_PAX_KERNEXEC
+ENTRY(pax_enter_kernel)
+#ifdef CONFIG_PARAVIRT
+	pushl %eax
+	pushl %ecx
+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0)
+	mov %eax, %esi
+#else
+	mov %cr0, %esi
+#endif
+	bts $16, %esi
+	jnc 1f
+	mov %cs, %esi
+	cmp $__KERNEL_CS, %esi
+	jz 3f
+	ljmp $__KERNEL_CS, $3f
+1:	ljmp $__KERNEXEC_KERNEL_CS, $2f
+2:
+#ifdef CONFIG_PARAVIRT
+	mov %esi, %eax
+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0)
+#else
+	mov %esi, %cr0
+#endif
+3:
+#ifdef CONFIG_PARAVIRT
+	popl %ecx
+	popl %eax
+#endif
+	ret
+ENDPROC(pax_enter_kernel)
+
+ENTRY(pax_exit_kernel)
+#ifdef CONFIG_PARAVIRT
+	pushl %eax
+	pushl %ecx
+#endif
+	mov %cs, %esi
+	cmp $__KERNEXEC_KERNEL_CS, %esi
+	jnz 2f
+#ifdef CONFIG_PARAVIRT
+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_read_cr0);
+	mov %eax, %esi
+#else
+	mov %cr0, %esi
+#endif
+	btr $16, %esi
+	ljmp $__KERNEL_CS, $1f
+1:
+#ifdef CONFIG_PARAVIRT
+	mov %esi, %eax
+	call PARA_INDIRECT(pv_cpu_ops+PV_CPU_write_cr0);
+#else
+	mov %esi, %cr0
+#endif
+2:
+#ifdef CONFIG_PARAVIRT
+	popl %ecx
+	popl %eax
+#endif
+	ret
+ENDPROC(pax_exit_kernel)
+#endif
+
+.macro pax_erase_kstack
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+	call pax_erase_kstack
+#endif
+.endm
+
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+/*
+ * ebp: thread_info
+ * ecx, edx: can be clobbered
+ */
+ENTRY(pax_erase_kstack)
+	pushl %edi
+	pushl %eax
+
+	mov TI_lowest_stack(%ebp), %edi
+	mov $-0xBEEF, %eax
+	std
+
+1:	mov %edi, %ecx
+	and $THREAD_SIZE_asm - 1, %ecx
+	shr $2, %ecx
+	repne scasl
+	jecxz 2f
+
+	cmp $2*16, %ecx
+	jc 2f
+
+	mov $2*16, %ecx
+	repe scasl
+	jecxz 2f
+	jne 1b
+
+2:	cld
+	mov %esp, %ecx
+	sub %edi, %ecx
+	shr $2, %ecx
+	rep stosl
+
+	mov TI_task_thread_sp0(%ebp), %edi
+	sub $128, %edi
+	mov %edi, TI_lowest_stack(%ebp)
+
+	popl %eax
+	popl %edi
+	ret
+ENDPROC(pax_erase_kstack)
+#endif
+
+.macro __SAVE_ALL _DS
 	cld
 	PUSH_GS
 	pushl %fs
@@ -224,7 +357,7 @@
 	pushl %ebx
 	CFI_ADJUST_CFA_OFFSET 4
 	CFI_REL_OFFSET ebx, 0
-	movl $(__USER_DS), %edx
+	movl $\_DS, %edx
 	movl %edx, %ds
 	movl %edx, %es
 	movl $(__KERNEL_PERCPU), %edx
@@ -232,6 +365,15 @@
 	SET_KERNEL_GS %edx
 .endm
 
+.macro SAVE_ALL
+#if defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
+	__SAVE_ALL __KERNEL_DS
+	pax_enter_kernel
+#else
+	__SAVE_ALL __USER_DS
+#endif
+.endm
+
 .macro RESTORE_INT_REGS
 	popl %ebx
 	CFI_ADJUST_CFA_OFFSET -4
@@ -352,7 +494,15 @@
 	movb PT_CS(%esp), %al
 	andl $(X86_EFLAGS_VM | SEGMENT_RPL_MASK), %eax
 	cmpl $USER_RPL, %eax
+
+#ifdef CONFIG_PAX_KERNEXEC
+	jae resume_userspace
+
+	PAX_EXIT_KERNEL
+	jmp resume_kernel
+#else
 	jb resume_kernel		# not returning to v8086 or userspace
+#endif
 
 ENTRY(resume_userspace)
 	LOCKDEP_SYS_EXIT
@@ -364,7 +514,7 @@
 	andl $_TIF_WORK_MASK, %ecx	# is there any work to be done on
 					# int/exception return?
 	jne work_pending
-	jmp restore_all
+	jmp restore_all_pax
 END(ret_from_exception)
 
 #ifdef CONFIG_PREEMPT
@@ -414,25 +564,36 @@
 	/*CFI_REL_OFFSET cs, 0*/
 	/*
 	 * Push current_thread_info()->sysenter_return to the stack.
-	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
-	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
 	 */
-	pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
+	pushl $0
 	CFI_ADJUST_CFA_OFFSET 4
 	CFI_REL_OFFSET eip, 0
 
 	pushl %eax
 	CFI_ADJUST_CFA_OFFSET 4
 	SAVE_ALL
+	GET_THREAD_INFO(%ebp)
+	movl TI_sysenter_return(%ebp),%ebp
+	movl %ebp,PT_EIP(%esp)
 	ENABLE_INTERRUPTS(CLBR_NONE)
 
 /*
  * Load the potential sixth argument from user stack.
  * Careful about security.
  */
+	movl PT_OLDESP(%esp),%ebp
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	mov PT_OLDSS(%esp),%ds
+1:	movl %ds:(%ebp),%ebp
+	push %ss
+	pop %ds
+#else
 	cmpl $__PAGE_OFFSET-3,%ebp
 	jae syscall_fault
 1:	movl (%ebp),%ebp
+#endif
+
 	movl %ebp,PT_EBP(%esp)
 .section __ex_table,"a"
 	.align 4
@@ -455,12 +616,23 @@
 	testl $_TIF_ALLWORK_MASK, %ecx
 	jne sysexit_audit
 sysenter_exit:
+
+#ifdef CONFIG_PAX_RANDKSTACK
+	pushl_cfi %eax
+	call pax_randomize_kstack
+	popl_cfi %eax
+#endif
+
+	pax_erase_kstack
+
 /* if something modifies registers it must also disable sysexit */
 	movl PT_EIP(%esp), %edx
 	movl PT_OLDESP(%esp), %ecx
 	xorl %ebp,%ebp
 	TRACE_IRQS_ON
 1:	mov  PT_FS(%esp), %fs
+2:	mov  PT_DS(%esp), %ds
+3:	mov  PT_ES(%esp), %es
 	PTGS_TO_GS
 	ENABLE_INTERRUPTS_SYSEXIT
 
@@ -477,6 +649,9 @@
 	movl %eax,%edx			/* 2nd arg: syscall number */
 	movl $AUDIT_ARCH_I386,%eax	/* 1st arg: audit arch */
 	call audit_syscall_entry
+
+	pax_erase_kstack
+
 	pushl %ebx
 	CFI_ADJUST_CFA_OFFSET 4
 	movl PT_EAX(%esp),%eax		/* reload syscall number */
@@ -504,11 +679,17 @@
 
 	CFI_ENDPROC
 .pushsection .fixup,"ax"
-2:	movl $0,PT_FS(%esp)
+4:	movl $0,PT_FS(%esp)
+	jmp 1b
+5:	movl $0,PT_DS(%esp)
+	jmp 1b
+6:	movl $0,PT_ES(%esp)
 	jmp 1b
 .section __ex_table,"a"
 	.align 4
-	.long 1b,2b
+	.long 1b,4b
+	.long 2b,5b
+	.long 3b,6b
 .popsection
 	PTGS_TO_GS_EX
 ENDPROC(ia32_sysenter_target)
@@ -538,6 +719,14 @@
 	testl $_TIF_ALLWORK_MASK, %ecx	# current->work
 	jne syscall_exit_work
 
+restore_all_pax:
+
+#ifdef CONFIG_PAX_RANDKSTACK
+	call pax_randomize_kstack
+#endif
+
+	pax_erase_kstack
+
 restore_all:
 	TRACE_IRQS_IRET
 restore_all_notrace:
@@ -602,7 +791,13 @@
 	mov PT_OLDESP(%esp), %eax	/* load userspace esp */
 	mov %dx, %ax			/* eax: new kernel esp */
 	sub %eax, %edx			/* offset (low word is 0) */
-	PER_CPU(gdt_page, %ebx)
+#ifdef CONFIG_SMP
+	movl PER_CPU_VAR(cpu_number), %ebx
+	shll $PAGE_SHIFT_asm, %ebx
+	addl $cpu_gdt_table, %ebx
+#else
+	movl $cpu_gdt_table, %ebx
+#endif
 	shr $16, %edx
 	mov %dl, GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx) /* bits 16..23 */
 	mov %dh, GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx) /* bits 24..31 */
@@ -636,31 +831,25 @@
 	movl TI_flags(%ebp), %ecx
 	andl $_TIF_WORK_MASK, %ecx	# is there any work to be done other
 					# than syscall tracing?
-	jz restore_all
+	jz restore_all_pax
 	testb $_TIF_NEED_RESCHED, %cl
 	jnz work_resched
 
 work_notifysig:				# deal with pending signals and
 					# notify-resume requests
+	movl %esp, %eax
 #ifdef CONFIG_VM86
 	testl $X86_EFLAGS_VM, PT_EFLAGS(%esp)
-	movl %esp, %eax
-	jne work_notifysig_v86		# returning to kernel-space or
+	jz 1f				# returning to kernel-space or
 					# vm86-space
-	xorl %edx, %edx
-	call do_notify_resume
-	jmp resume_userspace_sig
 
-	ALIGN
-work_notifysig_v86:
 	pushl %ecx			# save ti_flags for do_notify_resume
 	CFI_ADJUST_CFA_OFFSET 4
 	call save_v86_state		# %eax contains pt_regs pointer
 	popl %ecx
 	CFI_ADJUST_CFA_OFFSET -4
 	movl %eax, %esp
-#else
-	movl %esp, %eax
+1:
 #endif
 	xorl %edx, %edx
 	call do_notify_resume
@@ -673,6 +862,9 @@
 	movl $-ENOSYS,PT_EAX(%esp)
 	movl %esp, %eax
 	call syscall_trace_enter
+
+	pax_erase_kstack
+
 	/* What it returned is what we'll actually use.  */
 	cmpl $(nr_syscalls), %eax
 	jnae syscall_call
@@ -695,6 +887,10 @@
 
 	RING0_INT_FRAME			# can't unwind into user space anyway
 syscall_fault:
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	push %ss
+	pop %ds
+#endif
 	GET_THREAD_INFO(%ebp)
 	movl $-EFAULT,PT_EAX(%esp)
 	jmp resume_userspace
@@ -726,6 +922,33 @@
 PTREGSCALL(vm86)
 PTREGSCALL(vm86old)
 
+	ALIGN;
+ENTRY(kernel_execve)
+	push %ebp
+	sub $PT_OLDSS+4,%esp
+	push %edi
+	push %ecx
+	push %eax
+	lea 3*4(%esp),%edi
+	mov $PT_OLDSS/4+1,%ecx
+	xorl %eax,%eax
+	rep stosl
+	pop %eax
+	pop %ecx
+	pop %edi
+	movl $X86_EFLAGS_IF,PT_EFLAGS(%esp)
+	mov %eax,PT_EBX(%esp)
+	mov %edx,PT_ECX(%esp)
+	mov %ecx,PT_EDX(%esp)
+	mov %esp,%eax
+	call sys_execve
+	GET_THREAD_INFO(%ebp)
+	test %eax,%eax
+	jz syscall_exit
+	add $PT_OLDSS+4,%esp
+	pop %ebp
+	ret
+
 .macro FIXUP_ESPFIX_STACK
 /*
  * Switch back for ESPFIX stack to the normal zerobased stack
@@ -735,7 +958,13 @@
  * normal stack and adjusts ESP with the matching offset.
  */
 	/* fixup the stack */
-	PER_CPU(gdt_page, %ebx)
+#ifdef CONFIG_SMP
+	movl PER_CPU_VAR(cpu_number), %ebx
+	shll $PAGE_SHIFT_asm, %ebx
+	addl $cpu_gdt_table, %ebx
+#else
+	movl $cpu_gdt_table, %ebx
+#endif
 	mov GDT_ENTRY_ESPFIX_SS * 8 + 4(%ebx), %al /* bits 16..23 */
 	mov GDT_ENTRY_ESPFIX_SS * 8 + 7(%ebx), %ah /* bits 24..31 */
 	shl $16, %eax
@@ -1198,7 +1427,6 @@
 	ret
 #endif
 
-.section .rodata,"a"
 #include "syscall_table_32.S"
 
 syscall_table_size=(.-sys_call_table)
@@ -1255,9 +1483,12 @@
 	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
 	REG_TO_PTGS %ecx
 	SET_KERNEL_GS %ecx
-	movl $(__USER_DS), %ecx
+	movl $(__KERNEL_DS), %ecx
 	movl %ecx, %ds
 	movl %ecx, %es
+
+	pax_enter_kernel
+
 	TRACE_IRQS_OFF
 	movl %esp,%eax			# pt_regs pointer
 	call *%edi
@@ -1351,6 +1582,9 @@
 	xorl %edx,%edx		# zero error code
 	movl %esp,%eax		# pt_regs pointer
 	call do_nmi
+
+	pax_exit_kernel
+
 	jmp restore_all_notrace
 	CFI_ENDPROC
 
@@ -1391,6 +1625,9 @@
 	FIXUP_ESPFIX_STACK		# %eax == %esp
 	xorl %edx,%edx			# zero error code
 	call do_nmi
+
+	pax_exit_kernel
+
 	RESTORE_REGS
 	lss 12+4(%esp), %esp		# back to espfix stack
 	CFI_ADJUST_CFA_OFFSET -24
diff -uriN linux-2.6.32.43/arch/x86/kernel/entry_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/entry_64.S
--- linux-2.6.32.43/arch/x86/kernel/entry_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/entry_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -53,6 +53,7 @@
 #include <asm/paravirt.h>
 #include <asm/ftrace.h>
 #include <asm/percpu.h>
+#include <asm/pgtable.h>
 
 /* Avoid __ASSEMBLER__'ifying <linux/audit.h> just for this.  */
 #include <linux/elf-em.h>
@@ -174,6 +175,257 @@
 ENDPROC(native_usergs_sysret64)
 #endif /* CONFIG_PARAVIRT */
 
+	.macro ljmpq sel, off
+#if defined(CONFIG_MPSC) || defined(CONFIG_MCORE2) || defined (CONFIG_MATOM)
+	.byte 0x48; ljmp *1234f(%rip)
+	.pushsection .rodata
+	.align 16
+	1234: .quad \off; .word \sel
+	.popsection
+#else
+	pushq $\sel
+	pushq $\off
+	lretq
+#endif
+	.endm
+
+	.macro pax_enter_kernel
+#ifdef CONFIG_PAX_KERNEXEC
+	call pax_enter_kernel
+#endif
+	.endm
+
+	.macro pax_exit_kernel
+#ifdef CONFIG_PAX_KERNEXEC
+	call pax_exit_kernel
+#endif
+	.endm
+
+#ifdef CONFIG_PAX_KERNEXEC
+ENTRY(pax_enter_kernel)
+	pushq %rdi
+
+#ifdef CONFIG_PARAVIRT
+	PV_SAVE_REGS(CLBR_RDI)
+#endif
+
+	GET_CR0_INTO_RDI
+	bts $16,%rdi
+	jnc 1f
+	mov %cs,%edi
+	cmp $__KERNEL_CS,%edi
+	jz 3f
+	ljmpq __KERNEL_CS,3f
+1:	ljmpq __KERNEXEC_KERNEL_CS,2f
+2:	SET_RDI_INTO_CR0
+3:
+
+#ifdef CONFIG_PARAVIRT
+	PV_RESTORE_REGS(CLBR_RDI)
+#endif
+
+	popq %rdi
+	retq
+ENDPROC(pax_enter_kernel)
+
+ENTRY(pax_exit_kernel)
+	pushq %rdi
+
+#ifdef CONFIG_PARAVIRT
+	PV_SAVE_REGS(CLBR_RDI)
+#endif
+
+	mov %cs,%rdi
+	cmp $__KERNEXEC_KERNEL_CS,%edi
+	jnz 2f
+	GET_CR0_INTO_RDI
+	btr $16,%rdi
+	ljmpq __KERNEL_CS,1f
+1:	SET_RDI_INTO_CR0
+2:
+
+#ifdef CONFIG_PARAVIRT
+	PV_RESTORE_REGS(CLBR_RDI);
+#endif
+
+	popq %rdi
+	retq
+ENDPROC(pax_exit_kernel)
+#endif
+
+	.macro pax_enter_kernel_user
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	call pax_enter_kernel_user
+#endif
+	.endm
+
+	.macro pax_exit_kernel_user
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	call pax_exit_kernel_user
+#endif
+#ifdef CONFIG_PAX_RANDKSTACK
+	push %rax
+	call pax_randomize_kstack
+	pop %rax
+#endif
+	pax_erase_kstack
+	.endm
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+ENTRY(pax_enter_kernel_user)
+	pushq %rdi
+	pushq %rbx
+
+#ifdef CONFIG_PARAVIRT
+	PV_SAVE_REGS(CLBR_RDI)
+#endif
+
+	GET_CR3_INTO_RDI
+	mov %rdi,%rbx
+	add $__START_KERNEL_map,%rbx
+	sub phys_base(%rip),%rbx
+
+#ifdef CONFIG_PARAVIRT
+	pushq %rdi
+	cmpl $0, pv_info+PARAVIRT_enabled
+	jz 1f
+	i = 0
+	.rept USER_PGD_PTRS
+	mov i*8(%rbx),%rsi
+	mov $0,%sil
+	lea i*8(%rbx),%rdi
+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
+	i = i + 1
+	.endr
+	jmp 2f
+1:
+#endif
+
+	i = 0
+	.rept USER_PGD_PTRS
+	movb $0,i*8(%rbx)
+	i = i + 1
+	.endr
+
+#ifdef CONFIG_PARAVIRT
+2:	popq %rdi
+#endif
+	SET_RDI_INTO_CR3
+
+#ifdef CONFIG_PAX_KERNEXEC
+	GET_CR0_INTO_RDI
+	bts $16,%rdi
+	SET_RDI_INTO_CR0
+#endif
+
+#ifdef CONFIG_PARAVIRT
+	PV_RESTORE_REGS(CLBR_RDI)
+#endif
+
+	popq %rbx
+	popq %rdi
+	retq
+ENDPROC(pax_enter_kernel_user)
+
+ENTRY(pax_exit_kernel_user)
+	push %rdi
+
+#ifdef CONFIG_PARAVIRT
+	pushq %rbx
+	PV_SAVE_REGS(CLBR_RDI)
+#endif
+
+#ifdef CONFIG_PAX_KERNEXEC
+	GET_CR0_INTO_RDI
+	btr $16,%rdi
+	SET_RDI_INTO_CR0
+#endif
+
+	GET_CR3_INTO_RDI
+	add $__START_KERNEL_map,%rdi
+	sub phys_base(%rip),%rdi
+
+#ifdef CONFIG_PARAVIRT
+	cmpl $0, pv_info+PARAVIRT_enabled
+	jz 1f
+	mov %rdi,%rbx
+	i = 0
+	.rept USER_PGD_PTRS
+	mov i*8(%rbx),%rsi
+	mov $0x67,%sil
+	lea i*8(%rbx),%rdi
+	call PARA_INDIRECT(pv_mmu_ops+PV_MMU_set_pgd)
+	i = i + 1
+	.endr
+	jmp 2f
+1:
+#endif
+
+	i = 0
+	.rept USER_PGD_PTRS
+	movb $0x67,i*8(%rdi)
+	i = i + 1
+	.endr
+
+#ifdef CONFIG_PARAVIRT
+2:	PV_RESTORE_REGS(CLBR_RDI)
+	popq %rbx
+#endif
+
+	popq %rdi
+	retq
+ENDPROC(pax_exit_kernel_user)
+#endif
+
+.macro pax_erase_kstack
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+	call pax_erase_kstack
+#endif
+.endm
+
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+/*
+ * r10: thread_info
+ * rcx, rdx: can be clobbered
+ */
+ENTRY(pax_erase_kstack)
+	pushq %rdi
+	pushq %rax
+
+	GET_THREAD_INFO(%r10)
+	mov TI_lowest_stack(%r10), %rdi
+	mov $-0xBEEF, %rax
+	std
+
+1:	mov %edi, %ecx
+	and $THREAD_SIZE_asm - 1, %ecx
+	shr $3, %ecx
+	repne scasq
+	jecxz 2f
+
+	cmp $2*8, %ecx
+	jc 2f
+
+	mov $2*8, %ecx
+	repe scasq
+	jecxz 2f
+	jne 1b
+
+2:	cld
+	mov %esp, %ecx
+	sub %edi, %ecx
+	shr $3, %ecx
+	rep stosq
+
+	mov TI_task_thread_sp0(%r10), %rdi
+	sub $256, %rdi
+	mov %rdi, TI_lowest_stack(%r10)
+
+	popq %rax
+	popq %rdi
+	ret
+ENDPROC(pax_erase_kstack)
+#endif
 
 .macro TRACE_IRQS_IRETQ offset=ARGOFFSET
 #ifdef CONFIG_TRACE_IRQFLAGS
@@ -317,7 +569,7 @@
 	leaq -ARGOFFSET+16(%rsp),%rdi	/* arg1 for handler */
 	movq_cfi rbp, 8		/* push %rbp */
 	leaq 8(%rsp), %rbp		/* mov %rsp, %ebp */
-	testl $3, CS(%rdi)
+	testb $3, CS(%rdi)
 	je 1f
 	SWAPGS
 	/*
@@ -409,7 +661,7 @@
 
 	RESTORE_REST
 
-	testl $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
+	testb $3, CS-ARGOFFSET(%rsp)		# from kernel_thread?
 	je   int_ret_from_sys_call
 
 	testl $_TIF_IA32, TI_flags(%rcx)	# 32-bit compat task needs IRET
@@ -455,7 +707,7 @@
 ENTRY(system_call)
 	CFI_STARTPROC	simple
 	CFI_SIGNAL_FRAME
-	CFI_DEF_CFA	rsp,KERNEL_STACK_OFFSET
+	CFI_DEF_CFA	rsp,0
 	CFI_REGISTER	rip,rcx
 	/*CFI_REGISTER	rflags,r11*/
 	SWAPGS_UNSAFE_STACK
@@ -468,12 +720,13 @@
 
 	movq	%rsp,PER_CPU_VAR(old_rsp)
 	movq	PER_CPU_VAR(kernel_stack),%rsp
+	pax_enter_kernel_user
 	/*
 	 * No need to follow this irqs off/on section - it's straight
 	 * and short:
 	 */
 	ENABLE_INTERRUPTS(CLBR_NONE)
-	SAVE_ARGS 8,1
+	SAVE_ARGS 8*6,1
 	movq  %rax,ORIG_RAX-ARGOFFSET(%rsp)
 	movq  %rcx,RIP-ARGOFFSET(%rsp)
 	CFI_REL_OFFSET rip,RIP-ARGOFFSET
@@ -502,6 +755,7 @@
 	andl %edi,%edx
 	jnz  sysret_careful
 	CFI_REMEMBER_STATE
+	pax_exit_kernel_user
 	/*
 	 * sysretq will re-enable interrupts:
 	 */
@@ -562,6 +816,9 @@
 	movq %rax,%rsi			/* 2nd arg: syscall number */
 	movl $AUDIT_ARCH_X86_64,%edi	/* 1st arg: audit arch */
 	call audit_syscall_entry
+
+	pax_erase_kstack
+
 	LOAD_ARGS 0		/* reload call-clobbered registers */
 	jmp system_call_fastpath
 
@@ -592,6 +849,9 @@
 	FIXUP_TOP_OF_STACK %rdi
 	movq %rsp,%rdi
 	call syscall_trace_enter
+
+	pax_erase_kstack
+
 	/*
 	 * Reload arg registers from stack in case ptrace changed them.
 	 * We don't reload %rax because syscall_trace_enter() returned
@@ -613,7 +873,7 @@
 GLOBAL(int_ret_from_sys_call)
 	DISABLE_INTERRUPTS(CLBR_NONE)
 	TRACE_IRQS_OFF
-	testl $3,CS-ARGOFFSET(%rsp)
+	testb $3,CS-ARGOFFSET(%rsp)
 	je retint_restore_args
 	movl $_TIF_ALLWORK_MASK,%edi
 	/* edi:	mask to check */
@@ -800,6 +1060,16 @@
 	CFI_ADJUST_CFA_OFFSET 10*8
 	call save_args
 	PARTIAL_FRAME 0
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	testb $3, CS(%rdi)
+	jnz 1f
+	pax_enter_kernel
+	jmp 2f
+1:	pax_enter_kernel_user
+2:
+#else
+	pax_enter_kernel
+#endif
 	call \func
 	.endm
 
@@ -822,7 +1092,7 @@
 	CFI_ADJUST_CFA_OFFSET	-8
 exit_intr:
 	GET_THREAD_INFO(%rcx)
-	testl $3,CS-ARGOFFSET(%rsp)
+	testb $3,CS-ARGOFFSET(%rsp)
 	je retint_kernel
 
 	/* Interrupt came from user space */
@@ -844,12 +1114,14 @@
 	 * The iretq could re-enable interrupts:
 	 */
 	DISABLE_INTERRUPTS(CLBR_ANY)
+	pax_exit_kernel_user
 	TRACE_IRQS_IRETQ
 	SWAPGS
 	jmp restore_args
 
 retint_restore_args:	/* return to kernel space */
 	DISABLE_INTERRUPTS(CLBR_ANY)
+	pax_exit_kernel
 	/*
 	 * The iretq could re-enable interrupts:
 	 */
@@ -1032,6 +1304,16 @@
 	CFI_ADJUST_CFA_OFFSET 15*8
 	call error_entry
 	DEFAULT_FRAME 0
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	testb $3, CS(%rsp)
+	jnz 1f
+	pax_enter_kernel
+	jmp 2f
+1:	pax_enter_kernel_user
+2:
+#else
+	pax_enter_kernel
+#endif
 	movq %rsp,%rdi		/* pt_regs pointer */
 	xorl %esi,%esi		/* no error code */
 	call \do_sym
@@ -1049,6 +1331,16 @@
 	subq $15*8, %rsp
 	call save_paranoid
 	TRACE_IRQS_OFF
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	testb $3, CS(%rsp)
+	jnz 1f
+	pax_enter_kernel
+	jmp 2f
+1:	pax_enter_kernel_user
+2:
+#else
+	pax_enter_kernel
+#endif
 	movq %rsp,%rdi		/* pt_regs pointer */
 	xorl %esi,%esi		/* no error code */
 	call \do_sym
@@ -1066,9 +1358,24 @@
 	subq $15*8, %rsp
 	call save_paranoid
 	TRACE_IRQS_OFF
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	testb $3, CS(%rsp)
+	jnz 1f
+	pax_enter_kernel
+	jmp 2f
+1:	pax_enter_kernel_user
+2:
+#else
+	pax_enter_kernel
+#endif
 	movq %rsp,%rdi		/* pt_regs pointer */
 	xorl %esi,%esi		/* no error code */
-	PER_CPU(init_tss, %rbp)
+#ifdef CONFIG_SMP
+	imul $TSS_size, PER_CPU_VAR(cpu_number), %ebp
+	lea init_tss(%rbp), %rbp
+#else
+	lea init_tss(%rip), %rbp
+#endif
 	subq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
 	call \do_sym
 	addq $EXCEPTION_STKSZ, TSS_ist + (\ist - 1) * 8(%rbp)
@@ -1085,6 +1392,16 @@
 	CFI_ADJUST_CFA_OFFSET 15*8
 	call error_entry
 	DEFAULT_FRAME 0
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	testb $3, CS(%rsp)
+	jnz 1f
+	pax_enter_kernel
+	jmp 2f
+1:	pax_enter_kernel_user
+2:
+#else
+	pax_enter_kernel
+#endif
 	movq %rsp,%rdi			/* pt_regs pointer */
 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
@@ -1104,6 +1421,16 @@
 	call save_paranoid
 	DEFAULT_FRAME 0
 	TRACE_IRQS_OFF
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	testb $3, CS(%rsp)
+	jnz 1f
+	pax_enter_kernel
+	jmp 2f
+1:	pax_enter_kernel_user
+2:
+#else
+	pax_enter_kernel
+#endif
 	movq %rsp,%rdi			/* pt_regs pointer */
 	movq ORIG_RAX(%rsp),%rsi	/* get error code */
 	movq $-1,ORIG_RAX(%rsp)		/* no syscall to restart */
@@ -1405,14 +1732,27 @@
 	TRACE_IRQS_OFF
 	testl %ebx,%ebx				/* swapgs needed? */
 	jnz paranoid_restore
-	testl $3,CS(%rsp)
+	testb $3,CS(%rsp)
 	jnz   paranoid_userspace
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pax_exit_kernel
+	TRACE_IRQS_IRETQ 0
+	SWAPGS_UNSAFE_STACK
+	RESTORE_ALL 8
+	jmp irq_return
+#endif
 paranoid_swapgs:
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pax_exit_kernel_user
+#else
+	pax_exit_kernel
+#endif
 	TRACE_IRQS_IRETQ 0
 	SWAPGS_UNSAFE_STACK
 	RESTORE_ALL 8
 	jmp irq_return
 paranoid_restore:
+	pax_exit_kernel
 	TRACE_IRQS_IRETQ 0
 	RESTORE_ALL 8
 	jmp irq_return
@@ -1470,7 +1810,7 @@
 	movq_cfi r14, R14+8
 	movq_cfi r15, R15+8
 	xorl %ebx,%ebx
-	testl $3,CS+8(%rsp)
+	testb $3,CS+8(%rsp)
 	je error_kernelspace
 error_swapgs:
 	SWAPGS
@@ -1529,6 +1869,16 @@
 	CFI_ADJUST_CFA_OFFSET 15*8
 	call save_paranoid
 	DEFAULT_FRAME 0
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	testb $3, CS(%rsp)
+	jnz 1f
+	pax_enter_kernel
+	jmp 2f
+1:	pax_enter_kernel_user
+2:
+#else
+	pax_enter_kernel
+#endif
 	/* paranoidentry do_nmi, 0; without TRACE_IRQS_OFF */
 	movq %rsp,%rdi
 	movq $-1,%rsi
@@ -1539,11 +1889,25 @@
 	DISABLE_INTERRUPTS(CLBR_NONE)
 	testl %ebx,%ebx				/* swapgs needed? */
 	jnz nmi_restore
-	testl $3,CS(%rsp)
+	testb $3,CS(%rsp)
 	jnz nmi_userspace
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pax_exit_kernel
+	SWAPGS_UNSAFE_STACK
+	RESTORE_ALL 8
+	jmp irq_return
+#endif
 nmi_swapgs:
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pax_exit_kernel_user
+#else
+	pax_exit_kernel
+#endif
 	SWAPGS_UNSAFE_STACK
+	RESTORE_ALL 8
+	jmp irq_return
 nmi_restore:
+	pax_exit_kernel
 	RESTORE_ALL 8
 	jmp irq_return
 nmi_userspace:
diff -uriN linux-2.6.32.43/arch/x86/kernel/ftrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/ftrace.c
--- linux-2.6.32.43/arch/x86/kernel/ftrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/ftrace.c	2011-07-15 05:51:11.000000000 -0500
@@ -103,7 +103,7 @@
 static void *mod_code_newcode;		/* holds the text to write to the IP */
 
 static unsigned nmi_wait_count;
-static atomic_t nmi_update_count = ATOMIC_INIT(0);
+static atomic_unchecked_t nmi_update_count = ATOMIC_INIT(0);
 
 int ftrace_arch_read_dyn_info(char *buf, int size)
 {
@@ -111,7 +111,7 @@
 
 	r = snprintf(buf, size, "%u %u",
 		     nmi_wait_count,
-		     atomic_read(&nmi_update_count));
+		     atomic_read_unchecked(&nmi_update_count));
 	return r;
 }
 
@@ -149,8 +149,10 @@
 {
 	if (atomic_inc_return(&nmi_running) & MOD_CODE_WRITE_FLAG) {
 		smp_rmb();
+		pax_open_kernel();
 		ftrace_mod_code();
-		atomic_inc(&nmi_update_count);
+		pax_close_kernel();
+		atomic_inc_unchecked(&nmi_update_count);
 	}
 	/* Must have previous changes seen before executions */
 	smp_mb();
@@ -215,7 +217,7 @@
 
 
 
-static unsigned char ftrace_nop[MCOUNT_INSN_SIZE];
+static unsigned char ftrace_nop[MCOUNT_INSN_SIZE] __read_only;
 
 static unsigned char *ftrace_nop_replace(void)
 {
@@ -228,6 +230,8 @@
 {
 	unsigned char replaced[MCOUNT_INSN_SIZE];
 
+	ip = ktla_ktva(ip);
+
 	/*
 	 * Note: Due to modules and __init, code can
 	 *  disappear and change, we need to protect against faulting
@@ -284,7 +288,7 @@
 	unsigned char old[MCOUNT_INSN_SIZE], *new;
 	int ret;
 
-	memcpy(old, &ftrace_call, MCOUNT_INSN_SIZE);
+	memcpy(old, (void *)ktla_ktva((unsigned long)ftrace_call), MCOUNT_INSN_SIZE);
 	new = ftrace_call_replace(ip, (unsigned long)func);
 	ret = ftrace_modify_code(ip, old, new);
 
@@ -337,15 +341,15 @@
 	switch (faulted) {
 	case 0:
 		pr_info("ftrace: converting mcount calls to 0f 1f 44 00 00\n");
-		memcpy(ftrace_nop, ftrace_test_p6nop, MCOUNT_INSN_SIZE);
+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_p6nop), MCOUNT_INSN_SIZE);
 		break;
 	case 1:
 		pr_info("ftrace: converting mcount calls to 66 66 66 66 90\n");
-		memcpy(ftrace_nop, ftrace_test_nop5, MCOUNT_INSN_SIZE);
+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_nop5), MCOUNT_INSN_SIZE);
 		break;
 	case 2:
 		pr_info("ftrace: converting mcount calls to jmp . + 5\n");
-		memcpy(ftrace_nop, ftrace_test_jmp, MCOUNT_INSN_SIZE);
+		memcpy(ftrace_nop, ktla_ktva(ftrace_test_jmp), MCOUNT_INSN_SIZE);
 		break;
 	}
 
@@ -366,6 +370,8 @@
 {
 	unsigned char code[MCOUNT_INSN_SIZE];
 
+	ip = ktla_ktva(ip);
+
 	if (probe_kernel_read(code, (void *)ip, MCOUNT_INSN_SIZE))
 		return -EFAULT;
 
diff -uriN linux-2.6.32.43/arch/x86/kernel/head32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/head32.c
--- linux-2.6.32.43/arch/x86/kernel/head32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/head32.c	2011-07-15 05:51:11.000000000 -0500
@@ -16,6 +16,7 @@
 #include <asm/apic.h>
 #include <asm/io_apic.h>
 #include <asm/bios_ebda.h>
+#include <asm/boot.h>
 
 static void __init i386_default_early_setup(void)
 {
@@ -31,7 +32,7 @@
 {
 	reserve_trampoline_memory();
 
-	reserve_early(__pa_symbol(&_text), __pa_symbol(&__bss_stop), "TEXT DATA BSS");
+	reserve_early(LOAD_PHYSICAL_ADDR, __pa_symbol(&__bss_stop), "TEXT DATA BSS");
 
 #ifdef CONFIG_BLK_DEV_INITRD
 	/* Reserve INITRD */
diff -uriN linux-2.6.32.43/arch/x86/kernel/head_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/head_32.S
--- linux-2.6.32.43/arch/x86/kernel/head_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/head_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -19,10 +19,17 @@
 #include <asm/setup.h>
 #include <asm/processor-flags.h>
 #include <asm/percpu.h>
+#include <asm/msr-index.h>
 
 /* Physical address */
 #define pa(X) ((X) - __PAGE_OFFSET)
 
+#ifdef CONFIG_PAX_KERNEXEC
+#define ta(X) (X)
+#else
+#define ta(X) ((X) - __PAGE_OFFSET)
+#endif
+
 /*
  * References to members of the new_cpu_data structure.
  */
@@ -52,11 +59,7 @@
  * and small than max_low_pfn, otherwise will waste some page table entries
  */
 
-#if PTRS_PER_PMD > 1
-#define PAGE_TABLE_SIZE(pages) (((pages) / PTRS_PER_PMD) + PTRS_PER_PGD)
-#else
-#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PGD)
-#endif
+#define PAGE_TABLE_SIZE(pages) ((pages) / PTRS_PER_PTE)
 
 /* Enough space to fit pagetables for the low memory linear map */
 MAPPING_BEYOND_END = \
@@ -73,6 +76,12 @@
 RESERVE_BRK(pagetables, INIT_MAP_SIZE)
 
 /*
+ * Real beginning of normal "text" segment
+ */
+ENTRY(stext)
+ENTRY(_stext)
+
+/*
  * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
  * %esi points to the real-mode code as a 32-bit pointer.
  * CS and DS must be 4 GB flat segments, but we don't depend on
@@ -80,7 +89,16 @@
  * can.
  */
 __HEAD
+
+#ifdef CONFIG_PAX_KERNEXEC
+	jmp startup_32
+/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
+.fill PAGE_SIZE-5,1,0xcc
+#endif
+
 ENTRY(startup_32)
+	movl pa(stack_start),%ecx
+
 	/* test KEEP_SEGMENTS flag to see if the bootloader is asking
 		us to not reload segments */
 	testb $(1<<6), BP_loadflags(%esi)
@@ -95,7 +113,60 @@
 	movl %eax,%es
 	movl %eax,%fs
 	movl %eax,%gs
+	movl %eax,%ss
 2:
+	leal -__PAGE_OFFSET(%ecx),%esp
+
+#ifdef CONFIG_SMP
+	movl $pa(cpu_gdt_table),%edi
+	movl $__per_cpu_load,%eax
+	movw %ax,__KERNEL_PERCPU + 2(%edi)
+	rorl $16,%eax
+	movb %al,__KERNEL_PERCPU + 4(%edi)
+	movb %ah,__KERNEL_PERCPU + 7(%edi)
+	movl $__per_cpu_end - 1,%eax
+	subl $__per_cpu_start,%eax
+	movw %ax,__KERNEL_PERCPU + 0(%edi)
+#endif
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	movl $NR_CPUS,%ecx
+	movl $pa(cpu_gdt_table),%edi
+1:
+	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),GDT_ENTRY_KERNEL_DS * 8 + 4(%edi)
+	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0fb00),GDT_ENTRY_DEFAULT_USER_CS * 8 + 4(%edi)
+	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c0f300),GDT_ENTRY_DEFAULT_USER_DS * 8 + 4(%edi)
+	addl $PAGE_SIZE_asm,%edi
+	loop 1b
+#endif
+
+#ifdef CONFIG_PAX_KERNEXEC
+	movl $pa(boot_gdt),%edi
+	movl $__LOAD_PHYSICAL_ADDR,%eax
+	movw %ax,__BOOT_CS + 2(%edi)
+	rorl $16,%eax
+	movb %al,__BOOT_CS + 4(%edi)
+	movb %ah,__BOOT_CS + 7(%edi)
+	rorl $16,%eax
+
+	ljmp $(__BOOT_CS),$1f
+1:
+
+	movl $NR_CPUS,%ecx
+	movl $pa(cpu_gdt_table),%edi
+	addl $__PAGE_OFFSET,%eax
+1:
+	movw %ax,__KERNEL_CS + 2(%edi)
+	movw %ax,__KERNEXEC_KERNEL_CS + 2(%edi)
+	rorl $16,%eax
+	movb %al,__KERNEL_CS + 4(%edi)
+	movb %al,__KERNEXEC_KERNEL_CS + 4(%edi)
+	movb %ah,__KERNEL_CS + 7(%edi)
+	movb %ah,__KERNEXEC_KERNEL_CS + 7(%edi)
+	rorl $16,%eax
+	addl $PAGE_SIZE_asm,%edi
+	loop 1b
+#endif
 
 /*
  * Clear BSS first so that there are no surprises...
@@ -140,9 +211,7 @@
 	cmpl $num_subarch_entries, %eax
 	jae bad_subarch
 
-	movl pa(subarch_entries)(,%eax,4), %eax
-	subl $__PAGE_OFFSET, %eax
-	jmp *%eax
+	jmp *pa(subarch_entries)(,%eax,4)
 
 bad_subarch:
 WEAK(lguest_entry)
@@ -154,10 +223,10 @@
 	__INITDATA
 
 subarch_entries:
-	.long default_entry		/* normal x86/PC */
-	.long lguest_entry		/* lguest hypervisor */
-	.long xen_entry			/* Xen hypervisor */
-	.long default_entry		/* Moorestown MID */
+	.long ta(default_entry)		/* normal x86/PC */
+	.long ta(lguest_entry)		/* lguest hypervisor */
+	.long ta(xen_entry)		/* Xen hypervisor */
+	.long ta(default_entry)		/* Moorestown MID */
 num_subarch_entries = (. - subarch_entries) / 4
 .previous
 #endif /* CONFIG_PARAVIRT */
@@ -218,8 +287,11 @@
 	movl %eax, pa(max_pfn_mapped)
 
 	/* Do early initialization of the fixmap area */
-	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
-	movl %eax,pa(swapper_pg_pmd+0x1000*KPMDS-8)
+#ifdef CONFIG_COMPAT_VDSO
+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_pmd+0x1000*KPMDS-8)
+#else
+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_pmd+0x1000*KPMDS-8)
+#endif
 #else	/* Not PAE */
 
 page_pde_offset = (__PAGE_OFFSET >> 20);
@@ -249,8 +321,11 @@
 	movl %eax, pa(max_pfn_mapped)
 
 	/* Do early initialization of the fixmap area */
-	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,%eax
-	movl %eax,pa(swapper_pg_dir+0xffc)
+#ifdef CONFIG_COMPAT_VDSO
+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR+_PAGE_USER,pa(swapper_pg_dir+0xffc)
+#else
+	movl $pa(swapper_pg_fixmap)+PDE_IDENT_ATTR,pa(swapper_pg_dir+0xffc)
+#endif
 #endif
 	jmp 3f
 /*
@@ -272,6 +347,9 @@
 	movl %eax,%es
 	movl %eax,%fs
 	movl %eax,%gs
+	movl pa(stack_start),%ecx
+	movl %eax,%ss
+	leal -__PAGE_OFFSET(%ecx),%esp
 #endif /* CONFIG_SMP */
 3:
 
@@ -297,6 +375,7 @@
 	orl %edx,%eax
 	movl %eax,%cr4
 
+#ifdef CONFIG_X86_PAE
 	btl $5, %eax		# check if PAE is enabled
 	jnc 6f
 
@@ -305,6 +384,10 @@
 	cpuid
 	cmpl $0x80000000, %eax
 	jbe 6f
+
+	/* Clear bogus XD_DISABLE bits */
+	call verify_cpu
+
 	mov $0x80000001, %eax
 	cpuid
 	/* Execute Disable bit supported? */
@@ -312,13 +395,17 @@
 	jnc 6f
 
 	/* Setup EFER (Extended Feature Enable Register) */
-	movl $0xc0000080, %ecx
+	movl $MSR_EFER, %ecx
 	rdmsr
 
 	btsl $11, %eax
 	/* Make changes effective */
 	wrmsr
 
+	btsl $_PAGE_BIT_NX-32,pa(__supported_pte_mask+4)
+	movl $1,pa(nx_enabled)
+#endif
+
 6:
 
 /*
@@ -331,8 +418,8 @@
 	movl %eax,%cr0		/* ..and set paging (PG) bit */
 	ljmp $__BOOT_CS,$1f	/* Clear prefetch and normalize %eip */
 1:
-	/* Set up the stack pointer */
-	lss stack_start,%esp
+	/* Shift the stack pointer to a virtual address */
+	addl $__PAGE_OFFSET, %esp
 
 /*
  * Initialize eflags.  Some BIOS's leave bits like NT set.  This would
@@ -344,9 +431,7 @@
 
 #ifdef CONFIG_SMP
 	cmpb $0, ready
-	jz  1f				/* Initial CPU cleans BSS */
-	jmp checkCPUtype
-1:
+	jnz checkCPUtype
 #endif /* CONFIG_SMP */
 
 /*
@@ -424,7 +509,7 @@
 1:	movl $(__KERNEL_DS),%eax	# reload all the segment registers
 	movl %eax,%ss			# after changing gdt.
 
-	movl $(__USER_DS),%eax		# DS/ES contains default USER segment
+#	movl $(__KERNEL_DS),%eax	# DS/ES contains default KERNEL segment
 	movl %eax,%ds
 	movl %eax,%es
 
@@ -438,15 +523,22 @@
 	 */
 	cmpb $0,ready
 	jne 1f
-	movl $per_cpu__gdt_page,%eax
+	movl $cpu_gdt_table,%eax
 	movl $per_cpu__stack_canary,%ecx
+#ifdef CONFIG_SMP
+	addl $__per_cpu_load,%ecx
+#endif
 	movw %cx, 8 * GDT_ENTRY_STACK_CANARY + 2(%eax)
 	shrl $16, %ecx
 	movb %cl, 8 * GDT_ENTRY_STACK_CANARY + 4(%eax)
 	movb %ch, 8 * GDT_ENTRY_STACK_CANARY + 7(%eax)
 1:
-#endif
 	movl $(__KERNEL_STACK_CANARY),%eax
+#elif defined(CONFIG_PAX_MEMORY_UDEREF)
+	movl $(__USER_DS),%eax
+#else
+	xorl %eax,%eax
+#endif
 	movl %eax,%gs
 
 	xorl %eax,%eax			# Clear LDT
@@ -454,14 +546,7 @@
 
 	cld			# gcc2 wants the direction flag cleared at all times
 	pushl $0		# fake return address for unwinder
-#ifdef CONFIG_SMP
-	movb ready, %cl
 	movb $1, ready
-	cmpb $0,%cl		# the first CPU calls start_kernel
-	je   1f
-	movl (stack_start), %esp
-1:
-#endif /* CONFIG_SMP */
 	jmp *(initial_code)
 
 /*
@@ -546,22 +631,22 @@
 	jmp early_fault
 
 early_fault:
-	cld
 #ifdef CONFIG_PRINTK
+	cmpl $1,%ss:early_recursion_flag
+	je hlt_loop
+	incl %ss:early_recursion_flag
+	cld
 	pusha
 	movl $(__KERNEL_DS),%eax
 	movl %eax,%ds
 	movl %eax,%es
-	cmpl $2,early_recursion_flag
-	je hlt_loop
-	incl early_recursion_flag
 	movl %cr2,%eax
 	pushl %eax
 	pushl %edx		/* trapno */
 	pushl $fault_msg
 	call printk
+;	call dump_stack
 #endif
-	call dump_stack
 hlt_loop:
 	hlt
 	jmp hlt_loop
@@ -569,8 +654,11 @@
 /* This is the default interrupt "handler" :-) */
 	ALIGN
 ignore_int:
-	cld
 #ifdef CONFIG_PRINTK
+	cmpl $2,%ss:early_recursion_flag
+	je hlt_loop
+	incl %ss:early_recursion_flag
+	cld
 	pushl %eax
 	pushl %ecx
 	pushl %edx
@@ -579,9 +667,6 @@
 	movl $(__KERNEL_DS),%eax
 	movl %eax,%ds
 	movl %eax,%es
-	cmpl $2,early_recursion_flag
-	je hlt_loop
-	incl early_recursion_flag
 	pushl 16(%esp)
 	pushl 24(%esp)
 	pushl 32(%esp)
@@ -600,6 +685,8 @@
 #endif
 	iret
 
+#include "verify_cpu.S"
+
 	__REFDATA
 .align 4
 ENTRY(initial_code)
@@ -610,31 +697,47 @@
 /*
  * BSS section
  */
-__PAGE_ALIGNED_BSS
-	.align PAGE_SIZE_asm
 #ifdef CONFIG_X86_PAE
+.section .swapper_pg_pmd,"a",@progbits
 swapper_pg_pmd:
 	.fill 1024*KPMDS,4,0
 #else
+.section .swapper_pg_dir,"a",@progbits
 ENTRY(swapper_pg_dir)
 	.fill 1024,4,0
 #endif
+.section .swapper_pg_fixmap,"a",@progbits
 swapper_pg_fixmap:
 	.fill 1024,4,0
 #ifdef CONFIG_X86_TRAMPOLINE
+.section .trampoline_pg_dir,"a",@progbits
 ENTRY(trampoline_pg_dir)
+#ifdef CONFIG_X86_PAE
+	.fill 4,8,0
+#else
 	.fill 1024,4,0
 #endif
+#endif
+
+.section .empty_zero_page,"a",@progbits
 ENTRY(empty_zero_page)
 	.fill 4096,1,0
 
 /*
+ * The IDT has to be page-aligned to simplify the Pentium
+ * F0 0F bug workaround.. We have a special link segment
+ * for this.
+ */
+.section .idt,"a",@progbits
+ENTRY(idt_table)
+	.fill 256,8,0
+
+/*
  * This starts the data section.
  */
 #ifdef CONFIG_X86_PAE
-__PAGE_ALIGNED_DATA
-	/* Page-aligned for the benefit of paravirt? */
-	.align PAGE_SIZE_asm
+.section .swapper_pg_dir,"a",@progbits
+
 ENTRY(swapper_pg_dir)
 	.long	pa(swapper_pg_pmd+PGD_IDENT_ATTR),0	/* low identity map */
 # if KPMDS == 3
@@ -653,15 +756,24 @@
 #  error "Kernel PMDs should be 1, 2 or 3"
 # endif
 	.align PAGE_SIZE_asm		/* needs to be page-sized too */
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+ENTRY(cpu_pgd)
+	.rept NR_CPUS
+	.fill	4,8,0
+	.endr
+#endif
+
 #endif
 
 .data
+.balign 4
 ENTRY(stack_start)
-	.long init_thread_union+THREAD_SIZE
-	.long __BOOT_DS
+	.long init_thread_union+THREAD_SIZE-8
 
 ready:	.byte 0
 
+.section .rodata,"a",@progbits
 early_recursion_flag:
 	.long 0
 
@@ -697,7 +809,7 @@
 	.word 0				# 32 bit align gdt_desc.address
 boot_gdt_descr:
 	.word __BOOT_DS+7
-	.long boot_gdt - __PAGE_OFFSET
+	.long pa(boot_gdt)
 
 	.word 0				# 32-bit align idt_desc.address
 idt_descr:
@@ -708,7 +820,7 @@
 	.word 0				# 32 bit align gdt_desc.address
 ENTRY(early_gdt_descr)
 	.word GDT_ENTRIES*8-1
-	.long per_cpu__gdt_page		/* Overwritten for secondary CPUs */
+	.long cpu_gdt_table		/* Overwritten for secondary CPUs */
 
 /*
  * The boot_gdt must mirror the equivalent in setup.S and is
@@ -717,5 +829,65 @@
 	.align L1_CACHE_BYTES
 ENTRY(boot_gdt)
 	.fill GDT_ENTRY_BOOT_CS,8,0
-	.quad 0x00cf9a000000ffff	/* kernel 4GB code at 0x00000000 */
-	.quad 0x00cf92000000ffff	/* kernel 4GB data at 0x00000000 */
+	.quad 0x00cf9b000000ffff	/* kernel 4GB code at 0x00000000 */
+	.quad 0x00cf93000000ffff	/* kernel 4GB data at 0x00000000 */
+
+	.align PAGE_SIZE_asm
+ENTRY(cpu_gdt_table)
+	.rept NR_CPUS
+	.quad 0x0000000000000000	/* NULL descriptor */
+	.quad 0x0000000000000000	/* 0x0b reserved */
+	.quad 0x0000000000000000	/* 0x13 reserved */
+	.quad 0x0000000000000000	/* 0x1b reserved */
+
+#ifdef CONFIG_PAX_KERNEXEC
+	.quad 0x00cf9b000000ffff	/* 0x20 alternate kernel 4GB code at 0x00000000 */
+#else
+	.quad 0x0000000000000000	/* 0x20 unused */
+#endif
+
+	.quad 0x0000000000000000	/* 0x28 unused */
+	.quad 0x0000000000000000	/* 0x33 TLS entry 1 */
+	.quad 0x0000000000000000	/* 0x3b TLS entry 2 */
+	.quad 0x0000000000000000	/* 0x43 TLS entry 3 */
+	.quad 0x0000000000000000	/* 0x4b reserved */
+	.quad 0x0000000000000000	/* 0x53 reserved */
+	.quad 0x0000000000000000	/* 0x5b reserved */
+
+	.quad 0x00cf9b000000ffff	/* 0x60 kernel 4GB code at 0x00000000 */
+	.quad 0x00cf93000000ffff	/* 0x68 kernel 4GB data at 0x00000000 */
+	.quad 0x00cffb000000ffff	/* 0x73 user 4GB code at 0x00000000 */
+	.quad 0x00cff3000000ffff	/* 0x7b user 4GB data at 0x00000000 */
+
+	.quad 0x0000000000000000	/* 0x80 TSS descriptor */
+	.quad 0x0000000000000000	/* 0x88 LDT descriptor */
+
+	/*
+	 * Segments used for calling PnP BIOS have byte granularity.
+	 * The code segments and data segments have fixed 64k limits,
+	 * the transfer segment sizes are set at run time.
+	 */
+	.quad 0x00409b000000ffff	/* 0x90 32-bit code */
+	.quad 0x00009b000000ffff	/* 0x98 16-bit code */
+	.quad 0x000093000000ffff	/* 0xa0 16-bit data */
+	.quad 0x0000930000000000	/* 0xa8 16-bit data */
+	.quad 0x0000930000000000	/* 0xb0 16-bit data */
+
+	/*
+	 * The APM segments have byte granularity and their bases
+	 * are set at run time.  All have 64k limits.
+	 */
+	.quad 0x00409b000000ffff	/* 0xb8 APM CS    code */
+	.quad 0x00009b000000ffff	/* 0xc0 APM CS 16 code (16 bit) */
+	.quad 0x004093000000ffff	/* 0xc8 APM DS    data */
+
+	.quad 0x00c0930000000000	/* 0xd0 - ESPFIX SS */
+	.quad 0x0040930000000000	/* 0xd8 - PERCPU */
+	.quad 0x0040910000000017	/* 0xe0 - STACK_CANARY */
+	.quad 0x0000000000000000	/* 0xe8 - PCIBIOS_CS */
+	.quad 0x0000000000000000	/* 0xf0 - PCIBIOS_DS */
+	.quad 0x0000000000000000	/* 0xf8 - GDT entry 31: double-fault TSS */
+
+	/* Be sure this is zeroed to avoid false validations in Xen */
+	.fill PAGE_SIZE_asm - GDT_SIZE,1,0
+	.endr
diff -uriN linux-2.6.32.43/arch/x86/kernel/head_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/head_64.S
--- linux-2.6.32.43/arch/x86/kernel/head_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/head_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -19,6 +19,7 @@
 #include <asm/cache.h>
 #include <asm/processor-flags.h>
 #include <asm/percpu.h>
+#include <asm/cpufeature.h>
 
 #ifdef CONFIG_PARAVIRT
 #include <asm/asm-offsets.h>
@@ -38,6 +39,10 @@
 L3_PAGE_OFFSET = pud_index(__PAGE_OFFSET)
 L4_START_KERNEL = pgd_index(__START_KERNEL_map)
 L3_START_KERNEL = pud_index(__START_KERNEL_map)
+L4_VMALLOC_START = pgd_index(VMALLOC_START)
+L3_VMALLOC_START = pud_index(VMALLOC_START)
+L4_VMEMMAP_START = pgd_index(VMEMMAP_START)
+L3_VMEMMAP_START = pud_index(VMEMMAP_START)
 
 	.text
 	__HEAD
@@ -85,35 +90,22 @@
 	 */
 	addq	%rbp, init_level4_pgt + 0(%rip)
 	addq	%rbp, init_level4_pgt + (L4_PAGE_OFFSET*8)(%rip)
+	addq	%rbp, init_level4_pgt + (L4_VMALLOC_START*8)(%rip)
+	addq	%rbp, init_level4_pgt + (L4_VMEMMAP_START*8)(%rip)
 	addq	%rbp, init_level4_pgt + (L4_START_KERNEL*8)(%rip)
 
 	addq	%rbp, level3_ident_pgt + 0(%rip)
+#ifndef CONFIG_XEN
+	addq	%rbp, level3_ident_pgt + 8(%rip)
+#endif
 
-	addq	%rbp, level3_kernel_pgt + (510*8)(%rip)
-	addq	%rbp, level3_kernel_pgt + (511*8)(%rip)
+	addq	%rbp, level3_vmemmap_pgt + (L3_VMEMMAP_START*8)(%rip)
 
-	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
+	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8)(%rip)
+	addq	%rbp, level3_kernel_pgt + (L3_START_KERNEL*8+8)(%rip)
 
-	/* Add an Identity mapping if I am above 1G */
-	leaq	_text(%rip), %rdi
-	andq	$PMD_PAGE_MASK, %rdi
-
-	movq	%rdi, %rax
-	shrq	$PUD_SHIFT, %rax
-	andq	$(PTRS_PER_PUD - 1), %rax
-	jz	ident_complete
-
-	leaq	(level2_spare_pgt - __START_KERNEL_map + _KERNPG_TABLE)(%rbp), %rdx
-	leaq	level3_ident_pgt(%rip), %rbx
-	movq	%rdx, 0(%rbx, %rax, 8)
-
-	movq	%rdi, %rax
-	shrq	$PMD_SHIFT, %rax
-	andq	$(PTRS_PER_PMD - 1), %rax
-	leaq	__PAGE_KERNEL_IDENT_LARGE_EXEC(%rdi), %rdx
-	leaq	level2_spare_pgt(%rip), %rbx
-	movq	%rdx, 0(%rbx, %rax, 8)
-ident_complete:
+	addq	%rbp, level2_fixmap_pgt + (506*8)(%rip)
+	addq	%rbp, level2_fixmap_pgt + (507*8)(%rip)
 
 	/*
 	 * Fixup the kernel text+data virtual addresses. Note that
@@ -161,8 +153,8 @@
 	 * after the boot processor executes this code.
 	 */
 
-	/* Enable PAE mode and PGE */
-	movl	$(X86_CR4_PAE | X86_CR4_PGE), %eax
+	/* Enable PAE mode and PSE/PGE */
+	movl	$(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
 	movq	%rax, %cr4
 
 	/* Setup early boot stage 4 level pagetables. */
@@ -184,9 +176,13 @@
 	movl	$MSR_EFER, %ecx
 	rdmsr
 	btsl	$_EFER_SCE, %eax	/* Enable System Call */
-	btl	$20,%edi		/* No Execute supported? */
+	btl	$(X86_FEATURE_NX & 31),%edi	/* No Execute supported? */
 	jnc     1f
 	btsl	$_EFER_NX, %eax
+	leaq	init_level4_pgt(%rip), %rdi
+	btsq	$_PAGE_BIT_NX, 8*L4_PAGE_OFFSET(%rdi)
+	btsq	$_PAGE_BIT_NX, 8*L4_VMALLOC_START(%rdi)
+	btsq	$_PAGE_BIT_NX, 8*L4_VMEMMAP_START(%rdi)
 1:	wrmsr				/* Make changes effective */
 
 	/* Setup cr0 */
@@ -262,16 +258,16 @@
 	.quad	x86_64_start_kernel
 	ENTRY(initial_gs)
 	.quad	INIT_PER_CPU_VAR(irq_stack_union)
-	__FINITDATA
 
 	ENTRY(stack_start)
 	.quad  init_thread_union+THREAD_SIZE-8
 	.word  0
+	__FINITDATA
 
 bad_address:
 	jmp bad_address
 
-	.section ".init.text","ax"
+	__INIT
 #ifdef CONFIG_EARLY_PRINTK
 	.globl early_idt_handlers
 early_idt_handlers:
@@ -316,18 +312,23 @@
 #endif /* EARLY_PRINTK */
 1:	hlt
 	jmp 1b
+	.previous
 
 #ifdef CONFIG_EARLY_PRINTK
+	__INITDATA
 early_recursion_flag:
 	.long 0
+	.previous
 
+	.section .rodata,"a",@progbits
 early_idt_msg:
 	.asciz "PANIC: early exception %02lx rip %lx:%lx error %lx cr2 %lx\n"
 early_idt_ripmsg:
 	.asciz "RIP %s\n"
-#endif /* CONFIG_EARLY_PRINTK */
 	.previous
+#endif /* CONFIG_EARLY_PRINTK */
 
+	.section .rodata,"a",@progbits
 #define NEXT_PAGE(name) \
 	.balign	PAGE_SIZE; \
 ENTRY(name)
@@ -350,13 +351,36 @@
 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
 	.org	init_level4_pgt + L4_PAGE_OFFSET*8, 0
 	.quad	level3_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
+	.org	init_level4_pgt + L4_VMALLOC_START*8, 0
+	.quad	level3_vmalloc_pgt - __START_KERNEL_map + _KERNPG_TABLE
+	.org	init_level4_pgt + L4_VMEMMAP_START*8, 0
+	.quad	level3_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
 	.org	init_level4_pgt + L4_START_KERNEL*8, 0
 	/* (2^48-(2*1024*1024*1024))/(2^39) = 511 */
 	.quad	level3_kernel_pgt - __START_KERNEL_map + _PAGE_TABLE
 
+#ifdef CONFIG_PAX_PER_CPU_PGD
+NEXT_PAGE(cpu_pgd)
+	.rept NR_CPUS
+	.fill	512,8,0
+	.endr
+#endif
+
 NEXT_PAGE(level3_ident_pgt)
 	.quad	level2_ident_pgt - __START_KERNEL_map + _KERNPG_TABLE
+#ifdef CONFIG_XEN
 	.fill	511,8,0
+#else
+	.quad	level2_ident_pgt + PAGE_SIZE - __START_KERNEL_map + _KERNPG_TABLE
+	.fill	510,8,0
+#endif
+
+NEXT_PAGE(level3_vmalloc_pgt)
+	.fill	512,8,0
+
+NEXT_PAGE(level3_vmemmap_pgt)
+	.fill	L3_VMEMMAP_START,8,0
+	.quad	level2_vmemmap_pgt - __START_KERNEL_map + _KERNPG_TABLE
 
 NEXT_PAGE(level3_kernel_pgt)
 	.fill	L3_START_KERNEL,8,0
@@ -364,20 +388,23 @@
 	.quad	level2_kernel_pgt - __START_KERNEL_map + _KERNPG_TABLE
 	.quad	level2_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
 
+NEXT_PAGE(level2_vmemmap_pgt)
+	.fill	512,8,0
+
 NEXT_PAGE(level2_fixmap_pgt)
-	.fill	506,8,0
-	.quad	level1_fixmap_pgt - __START_KERNEL_map + _PAGE_TABLE
-	/* 8MB reserved for vsyscalls + a 2MB hole = 4 + 1 entries */
-	.fill	5,8,0
+	.fill	507,8,0
+	.quad	level1_vsyscall_pgt - __START_KERNEL_map + _PAGE_TABLE
+	/* 6MB reserved for vsyscalls + a 2MB hole = 3 + 1 entries */
+	.fill	4,8,0
 
-NEXT_PAGE(level1_fixmap_pgt)
+NEXT_PAGE(level1_vsyscall_pgt)
 	.fill	512,8,0
 
-NEXT_PAGE(level2_ident_pgt)
-	/* Since I easily can, map the first 1G.
+	/* Since I easily can, map the first 2G.
 	 * Don't set NX because code runs from these pages.
 	 */
-	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, PTRS_PER_PMD)
+NEXT_PAGE(level2_ident_pgt)
+	PMDS(0, __PAGE_KERNEL_IDENT_LARGE_EXEC, 2*PTRS_PER_PMD)
 
 NEXT_PAGE(level2_kernel_pgt)
 	/*
@@ -390,33 +417,55 @@
 	 *  If you want to increase this then increase MODULES_VADDR
 	 *  too.)
 	 */
-	PMDS(0, __PAGE_KERNEL_LARGE_EXEC,
-		KERNEL_IMAGE_SIZE/PMD_SIZE)
-
-NEXT_PAGE(level2_spare_pgt)
-	.fill   512, 8, 0
+	PMDS(0, __PAGE_KERNEL_LARGE_EXEC, KERNEL_IMAGE_SIZE/PMD_SIZE)
 
 #undef PMDS
 #undef NEXT_PAGE
 
-	.data
+	.align PAGE_SIZE
+ENTRY(cpu_gdt_table)
+	.rept NR_CPUS
+	.quad	0x0000000000000000	/* NULL descriptor */
+	.quad	0x00cf9b000000ffff	/* __KERNEL32_CS */
+	.quad	0x00af9b000000ffff	/* __KERNEL_CS */
+	.quad	0x00cf93000000ffff	/* __KERNEL_DS */
+	.quad	0x00cffb000000ffff	/* __USER32_CS */
+	.quad	0x00cff3000000ffff	/* __USER_DS, __USER32_DS  */
+	.quad	0x00affb000000ffff	/* __USER_CS */
+
+#ifdef CONFIG_PAX_KERNEXEC
+	.quad	0x00af9b000000ffff	/* __KERNEXEC_KERNEL_CS */
+#else
+	.quad	0x0			/* unused */
+#endif
+
+	.quad	0,0			/* TSS */
+	.quad	0,0			/* LDT */
+	.quad	0,0,0			/* three TLS descriptors */
+	.quad	0x0000f40000000000	/* node/CPU stored in limit */
+	/* asm/segment.h:GDT_ENTRIES must match this */
+
+	/* zero the remaining page */
+	.fill PAGE_SIZE / 8 - GDT_ENTRIES,8,0
+	.endr
+
 	.align 16
 	.globl early_gdt_descr
 early_gdt_descr:
 	.word	GDT_ENTRIES*8-1
 early_gdt_descr_base:
-	.quad	INIT_PER_CPU_VAR(gdt_page)
+	.quad	cpu_gdt_table
 
 ENTRY(phys_base)
 	/* This must match the first entry in level2_kernel_pgt */
 	.quad   0x0000000000000000
 
 #include "../../x86/xen/xen-head.S"
-	
-	.section .bss, "aw", @nobits
+
+	.section .rodata,"a",@progbits
 	.align L1_CACHE_BYTES
 ENTRY(idt_table)
-	.skip IDT_ENTRIES * 16
+	.fill 512,8,0
 
 	__PAGE_ALIGNED_BSS
 	.align PAGE_SIZE
diff -uriN linux-2.6.32.43/arch/x86/kernel/i386_ksyms_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/i386_ksyms_32.c
--- linux-2.6.32.43/arch/x86/kernel/i386_ksyms_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/i386_ksyms_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -20,8 +20,12 @@
 EXPORT_SYMBOL(cmpxchg8b_emu);
 #endif
 
+EXPORT_SYMBOL_GPL(cpu_gdt_table);
+
 /* Networking helper routines. */
 EXPORT_SYMBOL(csum_partial_copy_generic);
+EXPORT_SYMBOL(csum_partial_copy_generic_to_user);
+EXPORT_SYMBOL(csum_partial_copy_generic_from_user);
 
 EXPORT_SYMBOL(__get_user_1);
 EXPORT_SYMBOL(__get_user_2);
@@ -36,3 +40,7 @@
 
 EXPORT_SYMBOL(csum_partial);
 EXPORT_SYMBOL(empty_zero_page);
+
+#ifdef CONFIG_PAX_KERNEXEC
+EXPORT_SYMBOL(__LOAD_PHYSICAL_ADDR);
+#endif
diff -uriN linux-2.6.32.43/arch/x86/kernel/i8259.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/i8259.c
--- linux-2.6.32.43/arch/x86/kernel/i8259.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/i8259.c	2011-07-15 05:51:11.000000000 -0500
@@ -208,7 +208,7 @@
 			       "spurious 8259A interrupt: IRQ%d.\n", irq);
 			spurious_irq_mask |= irqmask;
 		}
-		atomic_inc(&irq_err_count);
+		atomic_inc_unchecked(&irq_err_count);
 		/*
 		 * Theoretically we do not have to handle this IRQ,
 		 * but in Linux this does not cause problems and is
diff -uriN linux-2.6.32.43/arch/x86/kernel/init_task.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/init_task.c
--- linux-2.6.32.43/arch/x86/kernel/init_task.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/init_task.c	2011-07-15 05:51:11.000000000 -0500
@@ -20,8 +20,7 @@
  * way process stacks are handled. This is done by having a special
  * "init_task" linker map entry..
  */
-union thread_union init_thread_union __init_task_data =
-	{ INIT_THREAD_INFO(init_task) };
+union thread_union init_thread_union __init_task_data;
 
 /*
  * Initial task structure.
@@ -38,5 +37,5 @@
  * section. Since TSS's are completely CPU-local, we want them
  * on exact cacheline boundaries, to eliminate cacheline ping-pong.
  */
-DEFINE_PER_CPU_SHARED_ALIGNED(struct tss_struct, init_tss) = INIT_TSS;
-
+struct tss_struct init_tss[NR_CPUS] ____cacheline_internodealigned_in_smp = { [0 ... NR_CPUS-1] = INIT_TSS };
+EXPORT_SYMBOL(init_tss);
diff -uriN linux-2.6.32.43/arch/x86/kernel/ioport.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/ioport.c
--- linux-2.6.32.43/arch/x86/kernel/ioport.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/ioport.c	2011-07-15 05:51:11.000000000 -0500
@@ -6,6 +6,7 @@
 #include <linux/sched.h>
 #include <linux/kernel.h>
 #include <linux/capability.h>
+#include <linux/security.h>
 #include <linux/errno.h>
 #include <linux/types.h>
 #include <linux/ioport.h>
@@ -41,6 +42,12 @@
 
 	if ((from + num <= from) || (from + num > IO_BITMAP_BITS))
 		return -EINVAL;
+#ifdef CONFIG_GRKERNSEC_IO
+	if (turn_on && grsec_disable_privio) {
+		gr_handle_ioperm();
+		return -EPERM;
+	}
+#endif
 	if (turn_on && !capable(CAP_SYS_RAWIO))
 		return -EPERM;
 
@@ -67,7 +74,7 @@
 	 * because the ->io_bitmap_max value must match the bitmap
 	 * contents:
 	 */
-	tss = &per_cpu(init_tss, get_cpu());
+	tss = init_tss + get_cpu();
 
 	set_bitmap(t->io_bitmap_ptr, from, num, !turn_on);
 
@@ -111,6 +118,12 @@
 		return -EINVAL;
 	/* Trying to gain more privileges? */
 	if (level > old) {
+#ifdef CONFIG_GRKERNSEC_IO
+		if (grsec_disable_privio) {
+			gr_handle_iopl();
+			return -EPERM;
+		}
+#endif
 		if (!capable(CAP_SYS_RAWIO))
 			return -EPERM;
 	}
diff -uriN linux-2.6.32.43/arch/x86/kernel/irq_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/irq_32.c
--- linux-2.6.32.43/arch/x86/kernel/irq_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/irq_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -35,7 +35,7 @@
 	__asm__ __volatile__("andl %%esp,%0" :
 			     "=r" (sp) : "0" (THREAD_SIZE - 1));
 
-	return sp < (sizeof(struct thread_info) + STACK_WARN);
+	return sp < STACK_WARN;
 }
 
 static void print_stack_overflow(void)
@@ -54,9 +54,9 @@
  * per-CPU IRQ handling contexts (thread information and stack)
  */
 union irq_ctx {
-	struct thread_info      tinfo;
-	u32                     stack[THREAD_SIZE/sizeof(u32)];
-} __attribute__((aligned(PAGE_SIZE)));
+	unsigned long		previous_esp;
+	u32			stack[THREAD_SIZE/sizeof(u32)];
+} __attribute__((aligned(THREAD_SIZE)));
 
 static DEFINE_PER_CPU(union irq_ctx *, hardirq_ctx);
 static DEFINE_PER_CPU(union irq_ctx *, softirq_ctx);
@@ -78,10 +78,9 @@
 static inline int
 execute_on_irq_stack(int overflow, struct irq_desc *desc, int irq)
 {
-	union irq_ctx *curctx, *irqctx;
+	union irq_ctx *irqctx;
 	u32 *isp, arg1, arg2;
 
-	curctx = (union irq_ctx *) current_thread_info();
 	irqctx = __get_cpu_var(hardirq_ctx);
 
 	/*
@@ -90,21 +89,16 @@
 	 * handler) we can't do that and just have to keep using the
 	 * current stack (which is the irq stack already after all)
 	 */
-	if (unlikely(curctx == irqctx))
+	if (unlikely((void *)current_stack_pointer - (void *)irqctx < THREAD_SIZE))
 		return 0;
 
 	/* build the stack frame on the IRQ stack */
-	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
-	irqctx->tinfo.task = curctx->tinfo.task;
-	irqctx->tinfo.previous_esp = current_stack_pointer;
+	isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
+	irqctx->previous_esp = current_stack_pointer;
 
-	/*
-	 * Copy the softirq bits in preempt_count so that the
-	 * softirq checks work in the hardirq context.
-	 */
-	irqctx->tinfo.preempt_count =
-		(irqctx->tinfo.preempt_count & ~SOFTIRQ_MASK) |
-		(curctx->tinfo.preempt_count & SOFTIRQ_MASK);
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	__set_fs(MAKE_MM_SEG(0));
+#endif
 
 	if (unlikely(overflow))
 		call_on_stack(print_stack_overflow, isp);
@@ -116,6 +110,11 @@
 		     :  "0" (irq),   "1" (desc),  "2" (isp),
 			"D" (desc->handle_irq)
 		     : "memory", "cc", "ecx");
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	__set_fs(current_thread_info()->addr_limit);
+#endif
+
 	return 1;
 }
 
@@ -124,28 +123,11 @@
  */
 void __cpuinit irq_ctx_init(int cpu)
 {
-	union irq_ctx *irqctx;
-
 	if (per_cpu(hardirq_ctx, cpu))
 		return;
 
-	irqctx = &per_cpu(hardirq_stack, cpu);
-	irqctx->tinfo.task		= NULL;
-	irqctx->tinfo.exec_domain	= NULL;
-	irqctx->tinfo.cpu		= cpu;
-	irqctx->tinfo.preempt_count	= HARDIRQ_OFFSET;
-	irqctx->tinfo.addr_limit	= MAKE_MM_SEG(0);
-
-	per_cpu(hardirq_ctx, cpu) = irqctx;
-
-	irqctx = &per_cpu(softirq_stack, cpu);
-	irqctx->tinfo.task		= NULL;
-	irqctx->tinfo.exec_domain	= NULL;
-	irqctx->tinfo.cpu		= cpu;
-	irqctx->tinfo.preempt_count	= 0;
-	irqctx->tinfo.addr_limit	= MAKE_MM_SEG(0);
-
-	per_cpu(softirq_ctx, cpu) = irqctx;
+	per_cpu(hardirq_ctx, cpu) = &per_cpu(hardirq_stack, cpu);
+	per_cpu(softirq_ctx, cpu) = &per_cpu(softirq_stack, cpu);
 
 	printk(KERN_DEBUG "CPU %u irqstacks, hard=%p soft=%p\n",
 	       cpu, per_cpu(hardirq_ctx, cpu),  per_cpu(softirq_ctx, cpu));
@@ -159,7 +141,6 @@
 asmlinkage void do_softirq(void)
 {
 	unsigned long flags;
-	struct thread_info *curctx;
 	union irq_ctx *irqctx;
 	u32 *isp;
 
@@ -169,15 +150,22 @@
 	local_irq_save(flags);
 
 	if (local_softirq_pending()) {
-		curctx = current_thread_info();
 		irqctx = __get_cpu_var(softirq_ctx);
-		irqctx->tinfo.task = curctx->task;
-		irqctx->tinfo.previous_esp = current_stack_pointer;
+		irqctx->previous_esp = current_stack_pointer;
 
 		/* build the stack frame on the softirq stack */
-		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx));
+		isp = (u32 *) ((char *)irqctx + sizeof(*irqctx) - 8);
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		__set_fs(MAKE_MM_SEG(0));
+#endif
 
 		call_on_stack(__do_softirq, isp);
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		__set_fs(current_thread_info()->addr_limit);
+#endif
+
 		/*
 		 * Shouldnt happen, we returned above if in_interrupt():
 		 */
diff -uriN linux-2.6.32.43/arch/x86/kernel/irq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/irq.c
--- linux-2.6.32.43/arch/x86/kernel/irq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/irq.c	2011-07-15 05:51:11.000000000 -0500
@@ -15,7 +15,7 @@
 #include <asm/mce.h>
 #include <asm/hw_irq.h>
 
-atomic_t irq_err_count;
+atomic_unchecked_t irq_err_count;
 
 /* Function pointer for generic interrupt vector handling */
 void (*generic_interrupt_extension)(void) = NULL;
@@ -114,9 +114,9 @@
 		seq_printf(p, "%10u ", per_cpu(mce_poll_count, j));
 	seq_printf(p, "  Machine check polls\n");
 #endif
-	seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read(&irq_err_count));
+	seq_printf(p, "%*s: %10u\n", prec, "ERR", atomic_read_unchecked(&irq_err_count));
 #if defined(CONFIG_X86_IO_APIC)
-	seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read(&irq_mis_count));
+	seq_printf(p, "%*s: %10u\n", prec, "MIS", atomic_read_unchecked(&irq_mis_count));
 #endif
 	return 0;
 }
@@ -209,10 +209,10 @@
 
 u64 arch_irq_stat(void)
 {
-	u64 sum = atomic_read(&irq_err_count);
+	u64 sum = atomic_read_unchecked(&irq_err_count);
 
 #ifdef CONFIG_X86_IO_APIC
-	sum += atomic_read(&irq_mis_count);
+	sum += atomic_read_unchecked(&irq_mis_count);
 #endif
 	return sum;
 }
diff -uriN linux-2.6.32.43/arch/x86/kernel/kgdb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/kgdb.c
--- linux-2.6.32.43/arch/x86/kernel/kgdb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/kgdb.c	2011-07-15 05:51:11.000000000 -0500
@@ -390,13 +390,13 @@
 
 		/* clear the trace bit */
 		linux_regs->flags &= ~X86_EFLAGS_TF;
-		atomic_set(&kgdb_cpu_doing_single_step, -1);
+		atomic_set_unchecked(&kgdb_cpu_doing_single_step, -1);
 
 		/* set the trace bit if we're stepping */
 		if (remcomInBuffer[0] == 's') {
 			linux_regs->flags |= X86_EFLAGS_TF;
 			kgdb_single_step = 1;
-			atomic_set(&kgdb_cpu_doing_single_step,
+			atomic_set_unchecked(&kgdb_cpu_doing_single_step,
 				   raw_smp_processor_id());
 		}
 
@@ -476,7 +476,7 @@
 		break;
 
 	case DIE_DEBUG:
-		if (atomic_read(&kgdb_cpu_doing_single_step) ==
+		if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) ==
 		    raw_smp_processor_id()) {
 			if (user_mode(regs))
 				return single_step_cont(regs, args);
@@ -573,7 +573,7 @@
 	return instruction_pointer(regs);
 }
 
-struct kgdb_arch arch_kgdb_ops = {
+const struct kgdb_arch arch_kgdb_ops = {
 	/* Breakpoint instruction: */
 	.gdb_bpt_instr		= { 0xcc },
 	.flags			= KGDB_HW_BREAKPOINT,
diff -uriN linux-2.6.32.43/arch/x86/kernel/kprobes.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/kprobes.c
--- linux-2.6.32.43/arch/x86/kernel/kprobes.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/kprobes.c	2011-07-15 05:51:11.000000000 -0500
@@ -166,9 +166,13 @@
 		char op;
 		s32 raddr;
 	} __attribute__((packed)) * jop;
-	jop = (struct __arch_jmp_op *)from;
+
+	jop = (struct __arch_jmp_op *)(ktla_ktva(from));
+
+	pax_open_kernel();
 	jop->raddr = (s32)((long)(to) - ((long)(from) + 5));
 	jop->op = RELATIVEJUMP_INSTRUCTION;
+	pax_close_kernel();
 }
 
 /*
@@ -193,7 +197,7 @@
 	kprobe_opcode_t opcode;
 	kprobe_opcode_t *orig_opcodes = opcodes;
 
-	if (search_exception_tables((unsigned long)opcodes))
+	if (search_exception_tables(ktva_ktla((unsigned long)opcodes)))
 		return 0;	/* Page fault may occur on this address. */
 
 retry:
@@ -337,7 +341,9 @@
 			disp = (u8 *) p->addr + *((s32 *) insn) -
 			       (u8 *) p->ainsn.insn;
 			BUG_ON((s64) (s32) disp != disp); /* Sanity check.  */
+			pax_open_kernel();
 			*(s32 *)insn = (s32) disp;
+			pax_close_kernel();
 		}
 	}
 #endif
@@ -345,16 +351,18 @@
 
 static void __kprobes arch_copy_kprobe(struct kprobe *p)
 {
-	memcpy(p->ainsn.insn, p->addr, MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
+	pax_open_kernel();
+	memcpy(p->ainsn.insn, ktla_ktva(p->addr), MAX_INSN_SIZE * sizeof(kprobe_opcode_t));
+	pax_close_kernel();
 
 	fix_riprel(p);
 
-	if (can_boost(p->addr))
+	if (can_boost(ktla_ktva(p->addr)))
 		p->ainsn.boostable = 0;
 	else
 		p->ainsn.boostable = -1;
 
-	p->opcode = *p->addr;
+	p->opcode = *(ktla_ktva(p->addr));
 }
 
 int __kprobes arch_prepare_kprobe(struct kprobe *p)
@@ -432,7 +440,7 @@
 	if (p->opcode == BREAKPOINT_INSTRUCTION)
 		regs->ip = (unsigned long)p->addr;
 	else
-		regs->ip = (unsigned long)p->ainsn.insn;
+		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
 }
 
 void __kprobes arch_prepare_kretprobe(struct kretprobe_instance *ri,
@@ -453,7 +461,7 @@
 	if (p->ainsn.boostable == 1 && !p->post_handler) {
 		/* Boost up -- we can execute copied instructions directly */
 		reset_current_kprobe();
-		regs->ip = (unsigned long)p->ainsn.insn;
+		regs->ip = ktva_ktla((unsigned long)p->ainsn.insn);
 		preempt_enable_no_resched();
 		return;
 	}
@@ -523,7 +531,7 @@
 	struct kprobe_ctlblk *kcb;
 
 	addr = (kprobe_opcode_t *)(regs->ip - sizeof(kprobe_opcode_t));
-	if (*addr != BREAKPOINT_INSTRUCTION) {
+	if (*(kprobe_opcode_t *)ktla_ktva((unsigned long)addr) != BREAKPOINT_INSTRUCTION) {
 		/*
 		 * The breakpoint instruction was removed right
 		 * after we hit it.  Another cpu has removed
@@ -775,7 +783,7 @@
 		struct pt_regs *regs, struct kprobe_ctlblk *kcb)
 {
 	unsigned long *tos = stack_addr(regs);
-	unsigned long copy_ip = (unsigned long)p->ainsn.insn;
+	unsigned long copy_ip = ktva_ktla((unsigned long)p->ainsn.insn);
 	unsigned long orig_ip = (unsigned long)p->addr;
 	kprobe_opcode_t *insn = p->ainsn.insn;
 
@@ -958,7 +966,7 @@
 	struct die_args *args = data;
 	int ret = NOTIFY_DONE;
 
-	if (args->regs && user_mode_vm(args->regs))
+	if (args->regs && user_mode(args->regs))
 		return ret;
 
 	switch (val) {
diff -uriN linux-2.6.32.43/arch/x86/kernel/ldt.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/ldt.c
--- linux-2.6.32.43/arch/x86/kernel/ldt.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/ldt.c	2011-07-15 05:51:11.000000000 -0500
@@ -66,13 +66,13 @@
 	if (reload) {
 #ifdef CONFIG_SMP
 		preempt_disable();
-		load_LDT(pc);
+		load_LDT_nolock(pc);
 		if (!cpumask_equal(mm_cpumask(current->mm),
 				   cpumask_of(smp_processor_id())))
 			smp_call_function(flush_ldt, current->mm, 1);
 		preempt_enable();
 #else
-		load_LDT(pc);
+		load_LDT_nolock(pc);
 #endif
 	}
 	if (oldsize) {
@@ -94,7 +94,7 @@
 		return err;
 
 	for (i = 0; i < old->size; i++)
-		write_ldt_entry(new->ldt, i, old->ldt + i * LDT_ENTRY_SIZE);
+		write_ldt_entry(new->ldt, i, old->ldt + i);
 	return 0;
 }
 
@@ -115,6 +115,24 @@
 		retval = copy_ldt(&mm->context, &old_mm->context);
 		mutex_unlock(&old_mm->context.lock);
 	}
+
+	if (tsk == current) {
+		mm->context.vdso = 0;
+
+#ifdef CONFIG_X86_32
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+		mm->context.user_cs_base = 0UL;
+		mm->context.user_cs_limit = ~0UL;
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_SMP)
+		cpus_clear(mm->context.cpu_user_cs_mask);
+#endif
+
+#endif
+#endif
+
+	}
+
 	return retval;
 }
 
@@ -229,6 +247,13 @@
 		}
 	}
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (ldt_info.contents & MODIFY_LDT_CONTENTS_CODE)) {
+		error = -EINVAL;
+		goto out_unlock;
+	}
+#endif
+
 	fill_ldt(&ldt, &ldt_info);
 	if (oldmode)
 		ldt.avl = 0;
diff -uriN linux-2.6.32.43/arch/x86/kernel/machine_kexec_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/machine_kexec_32.c
--- linux-2.6.32.43/arch/x86/kernel/machine_kexec_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/machine_kexec_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -26,7 +26,7 @@
 #include <asm/system.h>
 #include <asm/cacheflush.h>
 
-static void set_idt(void *newidt, __u16 limit)
+static void set_idt(struct desc_struct *newidt, __u16 limit)
 {
 	struct desc_ptr curidt;
 
@@ -38,7 +38,7 @@
 }
 
 
-static void set_gdt(void *newgdt, __u16 limit)
+static void set_gdt(struct desc_struct *newgdt, __u16 limit)
 {
 	struct desc_ptr curgdt;
 
@@ -217,7 +217,7 @@
 	}
 
 	control_page = page_address(image->control_code_page);
-	memcpy(control_page, relocate_kernel, KEXEC_CONTROL_CODE_MAX_SIZE);
+	memcpy(control_page, (void *)ktla_ktva((unsigned long)relocate_kernel), KEXEC_CONTROL_CODE_MAX_SIZE);
 
 	relocate_kernel_ptr = control_page;
 	page_list[PA_CONTROL_PAGE] = __pa(control_page);
diff -uriN linux-2.6.32.43/arch/x86/kernel/microcode_amd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/microcode_amd.c
--- linux-2.6.32.43/arch/x86/kernel/microcode_amd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/microcode_amd.c	2011-07-15 05:51:11.000000000 -0500
@@ -364,7 +364,7 @@
 	uci->mc = NULL;
 }
 
-static struct microcode_ops microcode_amd_ops = {
+static const struct microcode_ops microcode_amd_ops = {
 	.request_microcode_user           = request_microcode_user,
 	.request_microcode_fw             = request_microcode_fw,
 	.collect_cpu_info                 = collect_cpu_info_amd,
@@ -372,7 +372,7 @@
 	.microcode_fini_cpu               = microcode_fini_cpu_amd,
 };
 
-struct microcode_ops * __init init_amd_microcode(void)
+const struct microcode_ops * __init init_amd_microcode(void)
 {
 	return &microcode_amd_ops;
 }
diff -uriN linux-2.6.32.43/arch/x86/kernel/microcode_core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/microcode_core.c
--- linux-2.6.32.43/arch/x86/kernel/microcode_core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/microcode_core.c	2011-07-15 05:51:11.000000000 -0500
@@ -90,7 +90,7 @@
 
 #define MICROCODE_VERSION	"2.00"
 
-static struct microcode_ops	*microcode_ops;
+static const struct microcode_ops	*microcode_ops;
 
 /*
  * Synchronization.
diff -uriN linux-2.6.32.43/arch/x86/kernel/microcode_intel.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/microcode_intel.c
--- linux-2.6.32.43/arch/x86/kernel/microcode_intel.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/microcode_intel.c	2011-07-15 05:51:11.000000000 -0500
@@ -443,13 +443,13 @@
 
 static int get_ucode_user(void *to, const void *from, size_t n)
 {
-	return copy_from_user(to, from, n);
+	return copy_from_user(to, (__force const void __user *)from, n);
 }
 
 static enum ucode_state
 request_microcode_user(int cpu, const void __user *buf, size_t size)
 {
-	return generic_load_microcode(cpu, (void *)buf, size, &get_ucode_user);
+	return generic_load_microcode(cpu, (__force void *)buf, size, &get_ucode_user);
 }
 
 static void microcode_fini_cpu(int cpu)
@@ -460,7 +460,7 @@
 	uci->mc = NULL;
 }
 
-static struct microcode_ops microcode_intel_ops = {
+static const struct microcode_ops microcode_intel_ops = {
 	.request_microcode_user		  = request_microcode_user,
 	.request_microcode_fw             = request_microcode_fw,
 	.collect_cpu_info                 = collect_cpu_info,
@@ -468,7 +468,7 @@
 	.microcode_fini_cpu               = microcode_fini_cpu,
 };
 
-struct microcode_ops * __init init_intel_microcode(void)
+const struct microcode_ops * __init init_intel_microcode(void)
 {
 	return &microcode_intel_ops;
 }
diff -uriN linux-2.6.32.43/arch/x86/kernel/module.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/module.c
--- linux-2.6.32.43/arch/x86/kernel/module.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/module.c	2011-07-15 05:51:11.000000000 -0500
@@ -34,7 +34,7 @@
 #define DEBUGP(fmt...)
 #endif
 
-void *module_alloc(unsigned long size)
+static void *__module_alloc(unsigned long size, pgprot_t prot)
 {
 	struct vm_struct *area;
 
@@ -48,8 +48,18 @@
 	if (!area)
 		return NULL;
 
-	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM,
-					PAGE_KERNEL_EXEC);
+	return __vmalloc_area(area, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, prot);
+}
+
+void *module_alloc(unsigned long size)
+{
+
+#ifdef CONFIG_PAX_KERNEXEC
+	return __module_alloc(size, PAGE_KERNEL);
+#else
+	return __module_alloc(size, PAGE_KERNEL_EXEC);
+#endif
+
 }
 
 /* Free memory returned from module_alloc */
@@ -58,6 +68,40 @@
 	vfree(module_region);
 }
 
+#ifdef CONFIG_PAX_KERNEXEC
+#ifdef CONFIG_X86_32
+void *module_alloc_exec(unsigned long size)
+{
+	struct vm_struct *area;
+
+	if (size == 0)
+		return NULL;
+
+	area = __get_vm_area(size, VM_ALLOC, (unsigned long)&MODULES_EXEC_VADDR, (unsigned long)&MODULES_EXEC_END);
+	return area ? area->addr : NULL;
+}
+EXPORT_SYMBOL(module_alloc_exec);
+
+void module_free_exec(struct module *mod, void *module_region)
+{
+	vunmap(module_region);
+}
+EXPORT_SYMBOL(module_free_exec);
+#else
+void module_free_exec(struct module *mod, void *module_region)
+{
+	module_free(mod, module_region);
+}
+EXPORT_SYMBOL(module_free_exec);
+
+void *module_alloc_exec(unsigned long size)
+{
+	return __module_alloc(size, PAGE_KERNEL_RX);
+}
+EXPORT_SYMBOL(module_alloc_exec);
+#endif
+#endif
+
 /* We don't need anything special. */
 int module_frob_arch_sections(Elf_Ehdr *hdr,
 			      Elf_Shdr *sechdrs,
@@ -77,14 +121,16 @@
 	unsigned int i;
 	Elf32_Rel *rel = (void *)sechdrs[relsec].sh_addr;
 	Elf32_Sym *sym;
-	uint32_t *location;
+	uint32_t *plocation, location;
 
 	DEBUGP("Applying relocate section %u to %u\n", relsec,
 	       sechdrs[relsec].sh_info);
 	for (i = 0; i < sechdrs[relsec].sh_size / sizeof(*rel); i++) {
 		/* This is where to make the change */
-		location = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr
-			+ rel[i].r_offset;
+		plocation = (void *)sechdrs[sechdrs[relsec].sh_info].sh_addr + rel[i].r_offset;
+		location = (uint32_t)plocation;
+		if (sechdrs[sechdrs[relsec].sh_info].sh_flags & SHF_EXECINSTR)
+			plocation = ktla_ktva((void *)plocation);
 		/* This is the symbol it is referring to.  Note that all
 		   undefined symbols have been resolved.  */
 		sym = (Elf32_Sym *)sechdrs[symindex].sh_addr
@@ -93,11 +139,15 @@
 		switch (ELF32_R_TYPE(rel[i].r_info)) {
 		case R_386_32:
 			/* We add the value into the location given */
-			*location += sym->st_value;
+			pax_open_kernel();
+			*plocation += sym->st_value;
+			pax_close_kernel();
 			break;
 		case R_386_PC32:
 			/* Add the value, subtract its postition */
-			*location += sym->st_value - (uint32_t)location;
+			pax_open_kernel();
+			*plocation += sym->st_value - location;
+			pax_close_kernel();
 			break;
 		default:
 			printk(KERN_ERR "module %s: Unknown relocation: %u\n",
@@ -153,21 +203,30 @@
 		case R_X86_64_NONE:
 			break;
 		case R_X86_64_64:
+			pax_open_kernel();
 			*(u64 *)loc = val;
+			pax_close_kernel();
 			break;
 		case R_X86_64_32:
+			pax_open_kernel();
 			*(u32 *)loc = val;
+			pax_close_kernel();
 			if (val != *(u32 *)loc)
 				goto overflow;
 			break;
 		case R_X86_64_32S:
+			pax_open_kernel();
 			*(s32 *)loc = val;
+			pax_close_kernel();
 			if ((s64)val != *(s32 *)loc)
 				goto overflow;
 			break;
 		case R_X86_64_PC32:
 			val -= (u64)loc;
+			pax_open_kernel();
 			*(u32 *)loc = val;
+			pax_close_kernel();
+
 #if 0
 			if ((s64)val != *(s32 *)loc)
 				goto overflow;
diff -uriN linux-2.6.32.43/arch/x86/kernel/paravirt.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/paravirt.c
--- linux-2.6.32.43/arch/x86/kernel/paravirt.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/paravirt.c	2011-07-15 05:51:11.000000000 -0500
@@ -122,7 +122,7 @@
  * corresponding structure. */
 static void *get_call_destination(u8 type)
 {
-	struct paravirt_patch_template tmpl = {
+	const struct paravirt_patch_template tmpl = {
 		.pv_init_ops = pv_init_ops,
 		.pv_time_ops = pv_time_ops,
 		.pv_cpu_ops = pv_cpu_ops,
@@ -133,6 +133,9 @@
 		.pv_lock_ops = pv_lock_ops,
 #endif
 	};
+
+	pax_track_stack();
+
 	return *((void **)&tmpl + type);
 }
 
@@ -145,14 +148,14 @@
 	if (opfunc == NULL)
 		/* If there's no function, patch it with a ud2a (BUG) */
 		ret = paravirt_patch_insns(insnbuf, len, ud2a, ud2a+sizeof(ud2a));
-	else if (opfunc == _paravirt_nop)
+	else if (opfunc == (void *)_paravirt_nop)
 		/* If the operation is a nop, then nop the callsite */
 		ret = paravirt_patch_nop();
 
 	/* identity functions just return their single argument */
-	else if (opfunc == _paravirt_ident_32)
+	else if (opfunc == (void *)_paravirt_ident_32)
 		ret = paravirt_patch_ident_32(insnbuf, len);
-	else if (opfunc == _paravirt_ident_64)
+	else if (opfunc == (void *)_paravirt_ident_64)
 		ret = paravirt_patch_ident_64(insnbuf, len);
 
 	else if (type == PARAVIRT_PATCH(pv_cpu_ops.iret) ||
@@ -178,7 +181,7 @@
 	if (insn_len > len || start == NULL)
 		insn_len = len;
 	else
-		memcpy(insnbuf, start, insn_len);
+		memcpy(insnbuf, ktla_ktva(start), insn_len);
 
 	return insn_len;
 }
@@ -294,22 +297,22 @@
 	preempt_enable();
 }
 
-struct pv_info pv_info = {
+struct pv_info pv_info __read_only = {
 	.name = "bare hardware",
 	.paravirt_enabled = 0,
 	.kernel_rpl = 0,
 	.shared_kernel_pmd = 1,	/* Only used when CONFIG_X86_PAE is set */
 };
 
-struct pv_init_ops pv_init_ops = {
+struct pv_init_ops pv_init_ops __read_only = {
 	.patch = native_patch,
 };
 
-struct pv_time_ops pv_time_ops = {
+struct pv_time_ops pv_time_ops __read_only = {
 	.sched_clock = native_sched_clock,
 };
 
-struct pv_irq_ops pv_irq_ops = {
+struct pv_irq_ops pv_irq_ops __read_only = {
 	.save_fl = __PV_IS_CALLEE_SAVE(native_save_fl),
 	.restore_fl = __PV_IS_CALLEE_SAVE(native_restore_fl),
 	.irq_disable = __PV_IS_CALLEE_SAVE(native_irq_disable),
@@ -321,7 +324,7 @@
 #endif
 };
 
-struct pv_cpu_ops pv_cpu_ops = {
+struct pv_cpu_ops pv_cpu_ops __read_only = {
 	.cpuid = native_cpuid,
 	.get_debugreg = native_get_debugreg,
 	.set_debugreg = native_set_debugreg,
@@ -382,7 +385,7 @@
 	.end_context_switch = paravirt_nop,
 };
 
-struct pv_apic_ops pv_apic_ops = {
+struct pv_apic_ops pv_apic_ops __read_only = {
 #ifdef CONFIG_X86_LOCAL_APIC
 	.startup_ipi_hook = paravirt_nop,
 #endif
@@ -396,7 +399,7 @@
 #define PTE_IDENT	__PV_IS_CALLEE_SAVE(_paravirt_ident_64)
 #endif
 
-struct pv_mmu_ops pv_mmu_ops = {
+struct pv_mmu_ops pv_mmu_ops __read_only = {
 
 	.read_cr2 = native_read_cr2,
 	.write_cr2 = native_write_cr2,
@@ -467,6 +470,12 @@
 	},
 
 	.set_fixmap = native_set_fixmap,
+
+#ifdef CONFIG_PAX_KERNEXEC
+	.pax_open_kernel = native_pax_open_kernel,
+	.pax_close_kernel = native_pax_close_kernel,
+#endif
+
 };
 
 EXPORT_SYMBOL_GPL(pv_time_ops);
diff -uriN linux-2.6.32.43/arch/x86/kernel/paravirt-spinlocks.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/paravirt-spinlocks.c
--- linux-2.6.32.43/arch/x86/kernel/paravirt-spinlocks.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/paravirt-spinlocks.c	2011-07-15 05:51:11.000000000 -0500
@@ -13,7 +13,7 @@
 	__raw_spin_lock(lock);
 }
 
-struct pv_lock_ops pv_lock_ops = {
+struct pv_lock_ops pv_lock_ops __read_only = {
 #ifdef CONFIG_SMP
 	.spin_is_locked = __ticket_spin_is_locked,
 	.spin_is_contended = __ticket_spin_is_contended,
diff -uriN linux-2.6.32.43/arch/x86/kernel/pci-calgary_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-calgary_64.c
--- linux-2.6.32.43/arch/x86/kernel/pci-calgary_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-calgary_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -477,7 +477,7 @@
 	free_pages((unsigned long)vaddr, get_order(size));
 }
 
-static struct dma_map_ops calgary_dma_ops = {
+static const struct dma_map_ops calgary_dma_ops = {
 	.alloc_coherent = calgary_alloc_coherent,
 	.free_coherent = calgary_free_coherent,
 	.map_sg = calgary_map_sg,
diff -uriN linux-2.6.32.43/arch/x86/kernel/pci-dma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-dma.c
--- linux-2.6.32.43/arch/x86/kernel/pci-dma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-dma.c	2011-07-15 05:51:11.000000000 -0500
@@ -14,7 +14,7 @@
 
 static int forbid_dac __read_mostly;
 
-struct dma_map_ops *dma_ops;
+const struct dma_map_ops *dma_ops;
 EXPORT_SYMBOL(dma_ops);
 
 static int iommu_sac_force __read_mostly;
@@ -243,7 +243,7 @@
 
 int dma_supported(struct device *dev, u64 mask)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 #ifdef CONFIG_PCI
 	if (mask > 0xffffffff && forbid_dac > 0) {
diff -uriN linux-2.6.32.43/arch/x86/kernel/pci-gart_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-gart_64.c
--- linux-2.6.32.43/arch/x86/kernel/pci-gart_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-gart_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -682,7 +682,7 @@
 	return -1;
 }
 
-static struct dma_map_ops gart_dma_ops = {
+static const struct dma_map_ops gart_dma_ops = {
 	.map_sg				= gart_map_sg,
 	.unmap_sg			= gart_unmap_sg,
 	.map_page			= gart_map_page,
diff -uriN linux-2.6.32.43/arch/x86/kernel/pci-nommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-nommu.c
--- linux-2.6.32.43/arch/x86/kernel/pci-nommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-nommu.c	2011-07-15 05:51:11.000000000 -0500
@@ -94,7 +94,7 @@
 	flush_write_buffers();
 }
 
-struct dma_map_ops nommu_dma_ops = {
+const struct dma_map_ops nommu_dma_ops = {
 	.alloc_coherent		= dma_generic_alloc_coherent,
 	.free_coherent		= nommu_free_coherent,
 	.map_sg			= nommu_map_sg,
diff -uriN linux-2.6.32.43/arch/x86/kernel/pci-swiotlb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-swiotlb.c
--- linux-2.6.32.43/arch/x86/kernel/pci-swiotlb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/pci-swiotlb.c	2011-07-15 05:51:11.000000000 -0500
@@ -25,7 +25,7 @@
 	return swiotlb_alloc_coherent(hwdev, size, dma_handle, flags);
 }
 
-static struct dma_map_ops swiotlb_dma_ops = {
+static const struct dma_map_ops swiotlb_dma_ops = {
 	.mapping_error = swiotlb_dma_mapping_error,
 	.alloc_coherent = x86_swiotlb_alloc_coherent,
 	.free_coherent = swiotlb_free_coherent,
diff -uriN linux-2.6.32.43/arch/x86/kernel/process_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/process_32.c
--- linux-2.6.32.43/arch/x86/kernel/process_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/process_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -67,6 +67,7 @@
 unsigned long thread_saved_pc(struct task_struct *tsk)
 {
 	return ((unsigned long *)tsk->thread.sp)[3];
+//XXX	return tsk->thread.eip;
 }
 
 #ifndef CONFIG_SMP
@@ -129,15 +130,14 @@
 	unsigned short ss, gs;
 	const char *board;
 
-	if (user_mode_vm(regs)) {
+	if (user_mode(regs)) {
 		sp = regs->sp;
 		ss = regs->ss & 0xffff;
-		gs = get_user_gs(regs);
 	} else {
 		sp = (unsigned long) (&regs->sp);
 		savesegment(ss, ss);
-		savesegment(gs, gs);
 	}
+	gs = get_user_gs(regs);
 
 	printk("\n");
 
@@ -210,10 +210,10 @@
 	regs.bx = (unsigned long) fn;
 	regs.dx = (unsigned long) arg;
 
-	regs.ds = __USER_DS;
-	regs.es = __USER_DS;
+	regs.ds = __KERNEL_DS;
+	regs.es = __KERNEL_DS;
 	regs.fs = __KERNEL_PERCPU;
-	regs.gs = __KERNEL_STACK_CANARY;
+	savesegment(gs, regs.gs);
 	regs.orig_ax = -1;
 	regs.ip = (unsigned long) kernel_thread_helper;
 	regs.cs = __KERNEL_CS | get_kernel_rpl();
@@ -247,13 +247,14 @@
 	struct task_struct *tsk;
 	int err;
 
-	childregs = task_pt_regs(p);
+	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 8;
 	*childregs = *regs;
 	childregs->ax = 0;
 	childregs->sp = sp;
 
 	p->thread.sp = (unsigned long) childregs;
 	p->thread.sp0 = (unsigned long) (childregs+1);
+	p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
 
 	p->thread.ip = (unsigned long) ret_from_fork;
 
@@ -345,7 +346,7 @@
 	struct thread_struct *prev = &prev_p->thread,
 				 *next = &next_p->thread;
 	int cpu = smp_processor_id();
-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
+	struct tss_struct *tss = init_tss + cpu;
 	bool preload_fpu;
 
 	/* never put a printk in __switch_to... printk() calls wake_up*() indirectly */
@@ -380,6 +381,10 @@
 	 */
 	lazy_save_gs(prev->gs);
 
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	__set_fs(task_thread_info(next_p)->addr_limit);
+#endif
+
 	/*
 	 * Load the per-thread Thread-Local Storage descriptor.
 	 */
@@ -415,6 +420,9 @@
 	 */
 	arch_end_context_switch(next_p);
 
+	percpu_write(current_task, next_p);
+	percpu_write(current_tinfo, &next_p->tinfo);
+
 	if (preload_fpu)
 		__math_state_restore();
 
@@ -424,8 +432,6 @@
 	if (prev->gs | next->gs)
 		lazy_load_gs(next->gs);
 
-	percpu_write(current_task, next_p);
-
 	return prev_p;
 }
 
@@ -495,4 +501,3 @@
 	} while (count++ < 16);
 	return 0;
 }
-
diff -uriN linux-2.6.32.43/arch/x86/kernel/process_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/process_64.c
--- linux-2.6.32.43/arch/x86/kernel/process_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/process_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -91,7 +91,7 @@
 void exit_idle(void)
 {
 	/* idle loop has pid 0 */
-	if (current->pid)
+	if (task_pid_nr(current))
 		return;
 	__exit_idle();
 }
@@ -170,7 +170,7 @@
 	if (!board)
 		board = "";
 	printk(KERN_INFO "Pid: %d, comm: %.20s %s %s %.*s %s\n",
-		current->pid, current->comm, print_tainted(),
+		task_pid_nr(current), current->comm, print_tainted(),
 		init_utsname()->release,
 		(int)strcspn(init_utsname()->version, " "),
 		init_utsname()->version, board);
@@ -280,8 +280,7 @@
 	struct pt_regs *childregs;
 	struct task_struct *me = current;
 
-	childregs = ((struct pt_regs *)
-			(THREAD_SIZE + task_stack_page(p))) - 1;
+	childregs = task_stack_page(p) + THREAD_SIZE - sizeof(struct pt_regs) - 16;
 	*childregs = *regs;
 
 	childregs->ax = 0;
@@ -292,6 +291,7 @@
 	p->thread.sp = (unsigned long) childregs;
 	p->thread.sp0 = (unsigned long) (childregs+1);
 	p->thread.usersp = me->thread.usersp;
+	p->tinfo.lowest_stack = (unsigned long)task_stack_page(p);
 
 	set_tsk_thread_flag(p, TIF_FORK);
 
@@ -379,7 +379,7 @@
 	struct thread_struct *prev = &prev_p->thread;
 	struct thread_struct *next = &next_p->thread;
 	int cpu = smp_processor_id();
-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
+	struct tss_struct *tss = init_tss + cpu;
 	unsigned fsindex, gsindex;
 	bool preload_fpu;
 
@@ -475,10 +475,9 @@
 	prev->usersp = percpu_read(old_rsp);
 	percpu_write(old_rsp, next->usersp);
 	percpu_write(current_task, next_p);
+	percpu_write(current_tinfo, &next_p->tinfo);
 
-	percpu_write(kernel_stack,
-		  (unsigned long)task_stack_page(next_p) +
-		  THREAD_SIZE - KERNEL_STACK_OFFSET);
+	percpu_write(kernel_stack, next->sp0);
 
 	/*
 	 * Now maybe reload the debug registers and handle I/O bitmaps
@@ -559,12 +558,11 @@
 	if (!p || p == current || p->state == TASK_RUNNING)
 		return 0;
 	stack = (unsigned long)task_stack_page(p);
-	if (p->thread.sp < stack || p->thread.sp >= stack+THREAD_SIZE)
+	if (p->thread.sp < stack || p->thread.sp > stack+THREAD_SIZE-16-sizeof(u64))
 		return 0;
 	fp = *(u64 *)(p->thread.sp);
 	do {
-		if (fp < (unsigned long)stack ||
-		    fp >= (unsigned long)stack+THREAD_SIZE)
+		if (fp < stack || fp > stack+THREAD_SIZE-16-sizeof(u64))
 			return 0;
 		ip = *(u64 *)(fp+8);
 		if (!in_sched_functions(ip))
diff -uriN linux-2.6.32.43/arch/x86/kernel/process.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/process.c
--- linux-2.6.32.43/arch/x86/kernel/process.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/process.c	2011-07-15 05:51:11.000000000 -0500
@@ -51,16 +51,33 @@
 
 void free_thread_info(struct thread_info *ti)
 {
-	free_thread_xstate(ti->task);
 	free_pages((unsigned long)ti, get_order(THREAD_SIZE));
 }
 
+static struct kmem_cache *task_struct_cachep;
+
 void arch_task_cache_init(void)
 {
-        task_xstate_cachep =
-        	kmem_cache_create("task_xstate", xstate_size,
+	/* create a slab on which task_structs can be allocated */
+	task_struct_cachep =
+		kmem_cache_create("task_struct", sizeof(struct task_struct),
+			ARCH_MIN_TASKALIGN, SLAB_PANIC | SLAB_NOTRACK, NULL);
+
+	task_xstate_cachep =
+		kmem_cache_create("task_xstate", xstate_size,
 				  __alignof__(union thread_xstate),
-				  SLAB_PANIC | SLAB_NOTRACK, NULL);
+				  SLAB_PANIC | SLAB_NOTRACK | SLAB_USERCOPY, NULL);
+}
+
+struct task_struct *alloc_task_struct(void)
+{
+	return kmem_cache_alloc(task_struct_cachep, GFP_KERNEL);
+}
+
+void free_task_struct(struct task_struct *task)
+{
+	free_thread_xstate(task);
+	kmem_cache_free(task_struct_cachep, task);
 }
 
 /*
@@ -73,7 +90,7 @@
 	unsigned long *bp = t->io_bitmap_ptr;
 
 	if (bp) {
-		struct tss_struct *tss = &per_cpu(init_tss, get_cpu());
+		struct tss_struct *tss = init_tss + get_cpu();
 
 		t->io_bitmap_ptr = NULL;
 		clear_thread_flag(TIF_IO_BITMAP);
@@ -93,6 +110,9 @@
 
 	clear_tsk_thread_flag(tsk, TIF_DEBUG);
 
+#if defined(CONFIG_X86_32) && !defined(CONFIG_CC_STACKPROTECTOR) && !defined(CONFIG_PAX_MEMORY_UDEREF)
+	loadsegment(gs, 0);
+#endif
 	tsk->thread.debugreg0 = 0;
 	tsk->thread.debugreg1 = 0;
 	tsk->thread.debugreg2 = 0;
@@ -307,7 +327,7 @@
 EXPORT_SYMBOL(default_idle);
 #endif
 
-void stop_this_cpu(void *dummy)
+__noreturn void stop_this_cpu(void *dummy)
 {
 	local_irq_disable();
 	/*
@@ -568,16 +588,35 @@
 }
 early_param("idle", idle_setup);
 
-unsigned long arch_align_stack(unsigned long sp)
+#ifdef CONFIG_PAX_RANDKSTACK
+asmlinkage void pax_randomize_kstack(void)
 {
-	if (!(current->personality & ADDR_NO_RANDOMIZE) && randomize_va_space)
-		sp -= get_random_int() % 8192;
-	return sp & ~0xf;
-}
+	struct thread_struct *thread = &current->thread;
+	unsigned long time;
 
-unsigned long arch_randomize_brk(struct mm_struct *mm)
-{
-	unsigned long range_end = mm->brk + 0x02000000;
-	return randomize_range(mm->brk, range_end, 0) ? : mm->brk;
+	if (!randomize_va_space)
+		return;
+
+	rdtscl(time);
+
+	/* P4 seems to return a 0 LSB, ignore it */
+#ifdef CONFIG_MPENTIUM4
+	time &= 0x3EUL;
+	time <<= 2;
+#elif defined(CONFIG_X86_64)
+	time &= 0xFUL;
+	time <<= 4;
+#else
+	time &= 0x1FUL;
+	time <<= 3;
+#endif
+
+	thread->sp0 ^= time;
+	load_sp0(init_tss + smp_processor_id(), thread);
+
+#ifdef CONFIG_X86_64
+	percpu_write(kernel_stack, thread->sp0);
+#endif
 }
+#endif
 
diff -uriN linux-2.6.32.43/arch/x86/kernel/ptrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/ptrace.c
--- linux-2.6.32.43/arch/x86/kernel/ptrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/ptrace.c	2011-07-15 05:51:11.000000000 -0500
@@ -925,7 +925,7 @@
 long arch_ptrace(struct task_struct *child, long request, long addr, long data)
 {
 	int ret;
-	unsigned long __user *datap = (unsigned long __user *)data;
+	unsigned long __user *datap = (__force unsigned long __user *)data;
 
 	switch (request) {
 	/* read the word at location addr in the USER area. */
@@ -1012,14 +1012,14 @@
 		if (addr < 0)
 			return -EIO;
 		ret = do_get_thread_area(child, addr,
-					 (struct user_desc __user *) data);
+					 (__force struct user_desc __user *) data);
 		break;
 
 	case PTRACE_SET_THREAD_AREA:
 		if (addr < 0)
 			return -EIO;
 		ret = do_set_thread_area(child, addr,
-					 (struct user_desc __user *) data, 0);
+					 (__force struct user_desc __user *) data, 0);
 		break;
 #endif
 
@@ -1038,12 +1038,12 @@
 #ifdef CONFIG_X86_PTRACE_BTS
 	case PTRACE_BTS_CONFIG:
 		ret = ptrace_bts_config
-			(child, data, (struct ptrace_bts_config __user *)addr);
+			(child, data, (__force struct ptrace_bts_config __user *)addr);
 		break;
 
 	case PTRACE_BTS_STATUS:
 		ret = ptrace_bts_status
-			(child, data, (struct ptrace_bts_config __user *)addr);
+			(child, data, (__force struct ptrace_bts_config __user *)addr);
 		break;
 
 	case PTRACE_BTS_SIZE:
@@ -1052,7 +1052,7 @@
 
 	case PTRACE_BTS_GET:
 		ret = ptrace_bts_read_record
-			(child, data, (struct bts_struct __user *) addr);
+			(child, data, (__force struct bts_struct __user *) addr);
 		break;
 
 	case PTRACE_BTS_CLEAR:
@@ -1061,7 +1061,7 @@
 
 	case PTRACE_BTS_DRAIN:
 		ret = ptrace_bts_drain
-			(child, data, (struct bts_struct __user *) addr);
+			(child, data, (__force struct bts_struct __user *) addr);
 		break;
 #endif /* CONFIG_X86_PTRACE_BTS */
 
@@ -1450,7 +1450,7 @@
 	info.si_code = si_code;
 
 	/* User-mode ip? */
-	info.si_addr = user_mode_vm(regs) ? (void __user *) regs->ip : NULL;
+	info.si_addr = user_mode(regs) ? (__force void __user *) regs->ip : NULL;
 
 	/* Send us the fake SIGTRAP */
 	force_sig_info(SIGTRAP, &info, tsk);
@@ -1469,7 +1469,7 @@
  * We must return the syscall number to actually look up in the table.
  * This can be -1L to skip running any syscall at all.
  */
-asmregparm long syscall_trace_enter(struct pt_regs *regs)
+long syscall_trace_enter(struct pt_regs *regs)
 {
 	long ret = 0;
 
@@ -1514,7 +1514,7 @@
 	return ret ?: regs->orig_ax;
 }
 
-asmregparm void syscall_trace_leave(struct pt_regs *regs)
+void syscall_trace_leave(struct pt_regs *regs)
 {
 	if (unlikely(current->audit_context))
 		audit_syscall_exit(AUDITSC_RESULT(regs->ax), regs->ax);
diff -uriN linux-2.6.32.43/arch/x86/kernel/reboot.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/reboot.c
--- linux-2.6.32.43/arch/x86/kernel/reboot.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/reboot.c	2011-07-15 05:51:11.000000000 -0500
@@ -33,7 +33,7 @@
 EXPORT_SYMBOL(pm_power_off);
 
 static const struct desc_ptr no_idt = {};
-static int reboot_mode;
+static unsigned short reboot_mode;
 enum reboot_type reboot_type = BOOT_KBD;
 int reboot_force;
 
@@ -292,12 +292,12 @@
    controller to pulse the CPU reset line, which is more thorough, but
    doesn't work with at least one type of 486 motherboard.  It is easy
    to stop this code working; hence the copious comments. */
-static const unsigned long long
-real_mode_gdt_entries [3] =
+static struct desc_struct
+real_mode_gdt_entries [3] __read_only =
 {
-	0x0000000000000000ULL,	/* Null descriptor */
-	0x00009b000000ffffULL,	/* 16-bit real-mode 64k code at 0x00000000 */
-	0x000093000100ffffULL	/* 16-bit real-mode 64k data at 0x00000100 */
+	GDT_ENTRY_INIT(0, 0, 0),		/* Null descriptor */
+	GDT_ENTRY_INIT(0x9b, 0, 0xffff),	/* 16-bit real-mode 64k code at 0x00000000 */
+	GDT_ENTRY_INIT(0x93, 0x100, 0xffff)	/* 16-bit real-mode 64k data at 0x00000100 */
 };
 
 static const struct desc_ptr
@@ -346,7 +346,7 @@
  * specified by the code and length parameters.
  * We assume that length will aways be less that 100!
  */
-void machine_real_restart(const unsigned char *code, int length)
+__noreturn void machine_real_restart(const unsigned char *code, unsigned int length)
 {
 	local_irq_disable();
 
@@ -366,8 +366,8 @@
 	/* Remap the kernel at virtual address zero, as well as offset zero
 	   from the kernel segment.  This assumes the kernel segment starts at
 	   virtual address PAGE_OFFSET. */
-	memcpy(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
-		sizeof(swapper_pg_dir [0]) * KERNEL_PGD_PTRS);
+	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+			min_t(unsigned long, KERNEL_PGD_PTRS, KERNEL_PGD_BOUNDARY));
 
 	/*
 	 * Use `swapper_pg_dir' as our page directory.
@@ -379,16 +379,15 @@
 	   boot)".  This seems like a fairly standard thing that gets set by
 	   REBOOT.COM programs, and the previous reset routine did this
 	   too. */
-	*((unsigned short *)0x472) = reboot_mode;
+	*(unsigned short *)(__va(0x472)) = reboot_mode;
 
 	/* For the switch to real mode, copy some code to low memory.  It has
 	   to be in the first 64k because it is running in 16-bit mode, and it
 	   has to have the same physical and virtual address, because it turns
 	   off paging.  Copy it near the end of the first page, out of the way
 	   of BIOS variables. */
-	memcpy((void *)(0x1000 - sizeof(real_mode_switch) - 100),
-		real_mode_switch, sizeof (real_mode_switch));
-	memcpy((void *)(0x1000 - 100), code, length);
+	memcpy(__va(0x1000 - sizeof (real_mode_switch) - 100), real_mode_switch, sizeof (real_mode_switch));
+	memcpy(__va(0x1000 - 100), code, length);
 
 	/* Set up the IDT for real mode. */
 	load_idt(&real_mode_idt);
@@ -416,6 +415,7 @@
 	__asm__ __volatile__ ("ljmp $0x0008,%0"
 				:
 				: "i" ((void *)(0x1000 - sizeof (real_mode_switch) - 100)));
+	do { } while (1);
 }
 #ifdef CONFIG_APM_MODULE
 EXPORT_SYMBOL(machine_real_restart);
@@ -536,7 +536,7 @@
 {
 }
 
-static void native_machine_emergency_restart(void)
+__noreturn static void native_machine_emergency_restart(void)
 {
 	int i;
 
@@ -651,13 +651,13 @@
 #endif
 }
 
-static void __machine_emergency_restart(int emergency)
+static __noreturn void __machine_emergency_restart(int emergency)
 {
 	reboot_emergency = emergency;
 	machine_ops.emergency_restart();
 }
 
-static void native_machine_restart(char *__unused)
+static __noreturn void native_machine_restart(char *__unused)
 {
 	printk("machine restart\n");
 
@@ -666,7 +666,7 @@
 	__machine_emergency_restart(0);
 }
 
-static void native_machine_halt(void)
+static __noreturn void native_machine_halt(void)
 {
 	/* stop other cpus and apics */
 	machine_shutdown();
@@ -677,7 +677,7 @@
 	stop_this_cpu(NULL);
 }
 
-static void native_machine_power_off(void)
+__noreturn static void native_machine_power_off(void)
 {
 	if (pm_power_off) {
 		if (!reboot_force)
@@ -686,6 +686,7 @@
 	}
 	/* a fallback in case there is no PM info available */
 	tboot_shutdown(TB_SHUTDOWN_HALT);
+	do { } while (1);
 }
 
 struct machine_ops machine_ops = {
diff -uriN linux-2.6.32.43/arch/x86/kernel/setup.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/setup.c
--- linux-2.6.32.43/arch/x86/kernel/setup.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/setup.c	2011-07-15 05:51:11.000000000 -0500
@@ -783,14 +783,14 @@
 
 	if (!boot_params.hdr.root_flags)
 		root_mountflags &= ~MS_RDONLY;
-	init_mm.start_code = (unsigned long) _text;
-	init_mm.end_code = (unsigned long) _etext;
+	init_mm.start_code = ktla_ktva((unsigned long) _text);
+	init_mm.end_code = ktla_ktva((unsigned long) _etext);
 	init_mm.end_data = (unsigned long) _edata;
 	init_mm.brk = _brk_end;
 
-	code_resource.start = virt_to_phys(_text);
-	code_resource.end = virt_to_phys(_etext)-1;
-	data_resource.start = virt_to_phys(_etext);
+	code_resource.start = virt_to_phys(ktla_ktva(_text));
+	code_resource.end = virt_to_phys(ktla_ktva(_etext))-1;
+	data_resource.start = virt_to_phys(_sdata);
 	data_resource.end = virt_to_phys(_edata)-1;
 	bss_resource.start = virt_to_phys(&__bss_start);
 	bss_resource.end = virt_to_phys(&__bss_stop)-1;
diff -uriN linux-2.6.32.43/arch/x86/kernel/setup_percpu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/setup_percpu.c
--- linux-2.6.32.43/arch/x86/kernel/setup_percpu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/setup_percpu.c	2011-07-15 05:51:11.000000000 -0500
@@ -25,19 +25,17 @@
 # define DBG(x...)
 #endif
 
-DEFINE_PER_CPU(int, cpu_number);
+#ifdef CONFIG_SMP
+DEFINE_PER_CPU(unsigned int, cpu_number);
 EXPORT_PER_CPU_SYMBOL(cpu_number);
+#endif
 
-#ifdef CONFIG_X86_64
 #define BOOT_PERCPU_OFFSET ((unsigned long)__per_cpu_load)
-#else
-#define BOOT_PERCPU_OFFSET 0
-#endif
 
 DEFINE_PER_CPU(unsigned long, this_cpu_off) = BOOT_PERCPU_OFFSET;
 EXPORT_PER_CPU_SYMBOL(this_cpu_off);
 
-unsigned long __per_cpu_offset[NR_CPUS] __read_mostly = {
+unsigned long __per_cpu_offset[NR_CPUS] __read_only = {
 	[0 ... NR_CPUS-1] = BOOT_PERCPU_OFFSET,
 };
 EXPORT_SYMBOL(__per_cpu_offset);
@@ -159,10 +157,10 @@
 {
 #ifdef CONFIG_X86_32
 	struct desc_struct gdt;
+	unsigned long base = per_cpu_offset(cpu);
 
-	pack_descriptor(&gdt, per_cpu_offset(cpu), 0xFFFFF,
-			0x2 | DESCTYPE_S, 0x8);
-	gdt.s = 1;
+	pack_descriptor(&gdt, base, (VMALLOC_END - base - 1) >> PAGE_SHIFT,
+			0x83 | DESCTYPE_S, 0xC);
 	write_gdt_entry(get_cpu_gdt_table(cpu),
 			GDT_ENTRY_PERCPU, &gdt, DESCTYPE_S);
 #endif
@@ -212,6 +210,11 @@
 	/* alrighty, percpu areas up and running */
 	delta = (unsigned long)pcpu_base_addr - (unsigned long)__per_cpu_start;
 	for_each_possible_cpu(cpu) {
+#ifdef CONFIG_CC_STACKPROTECTOR
+#ifdef CONFIG_X86_32
+		unsigned long canary = per_cpu(stack_canary.canary, cpu);
+#endif
+#endif
 		per_cpu_offset(cpu) = delta + pcpu_unit_offsets[cpu];
 		per_cpu(this_cpu_off, cpu) = per_cpu_offset(cpu);
 		per_cpu(cpu_number, cpu) = cpu;
@@ -239,6 +242,12 @@
 			early_per_cpu_map(x86_cpu_to_node_map, cpu);
 #endif
 #endif
+#ifdef CONFIG_CC_STACKPROTECTOR
+#ifdef CONFIG_X86_32
+		if (!cpu)
+			per_cpu(stack_canary.canary, cpu) = canary;
+#endif
+#endif
 		/*
 		 * Up to this point, the boot CPU has been using .data.init
 		 * area.  Reload any changed state for the boot CPU.
diff -uriN linux-2.6.32.43/arch/x86/kernel/signal.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/signal.c
--- linux-2.6.32.43/arch/x86/kernel/signal.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/signal.c	2011-07-15 05:51:11.000000000 -0500
@@ -197,7 +197,7 @@
 	 * Align the stack pointer according to the i386 ABI,
 	 * i.e. so that on function entry ((sp + 4) & 15) == 0.
 	 */
-	sp = ((sp + 4) & -16ul) - 4;
+	sp = ((sp - 12) & -16ul) - 4;
 #else /* !CONFIG_X86_32 */
 	sp = round_down(sp, 16) - 8;
 #endif
@@ -248,11 +248,11 @@
 	 * Return an always-bogus address instead so we will die with SIGSEGV.
 	 */
 	if (onsigstack && !likely(on_sig_stack(sp)))
-		return (void __user *)-1L;
+		return (__force void __user *)-1L;
 
 	/* save i387 state */
 	if (used_math() && save_i387_xstate(*fpstate) < 0)
-		return (void __user *)-1L;
+		return (__force void __user *)-1L;
 
 	return (void __user *)sp;
 }
@@ -307,9 +307,9 @@
 	}
 
 	if (current->mm->context.vdso)
-		restorer = VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
+		restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, sigreturn);
 	else
-		restorer = &frame->retcode;
+		restorer = (void __user *)&frame->retcode;
 	if (ka->sa.sa_flags & SA_RESTORER)
 		restorer = ka->sa.sa_restorer;
 
@@ -323,7 +323,7 @@
 	 * reasons and because gdb uses it as a signature to notice
 	 * signal handler stack frames.
 	 */
-	err |= __put_user(*((u64 *)&retcode), (u64 *)frame->retcode);
+	err |= __put_user(*((u64 *)&retcode), (u64 __user *)frame->retcode);
 
 	if (err)
 		return -EFAULT;
@@ -377,7 +377,10 @@
 		err |= __copy_to_user(&frame->uc.uc_sigmask, set, sizeof(*set));
 
 		/* Set up to return from userspace.  */
-		restorer = VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+		if (current->mm->context.vdso)
+			restorer = (__force void __user *)VDSO32_SYMBOL(current->mm->context.vdso, rt_sigreturn);
+		else
+			restorer = (void __user *)&frame->retcode;
 		if (ka->sa.sa_flags & SA_RESTORER)
 			restorer = ka->sa.sa_restorer;
 		put_user_ex(restorer, &frame->pretcode);
@@ -389,7 +392,7 @@
 		 * reasons and because gdb uses it as a signature to notice
 		 * signal handler stack frames.
 		 */
-		put_user_ex(*((u64 *)&rt_retcode), (u64 *)frame->retcode);
+		put_user_ex(*((u64 *)&rt_retcode), (u64 __user *)frame->retcode);
 	} put_user_catch(err);
 
 	if (err)
@@ -782,6 +785,8 @@
 	int signr;
 	sigset_t *oldset;
 
+	pax_track_stack();
+
 	/*
 	 * We want the common case to go fast, which is why we may in certain
 	 * cases get here from kernel mode. Just return without doing anything
@@ -789,7 +794,7 @@
 	 * X86_32: vm86 regs switched out by assembly code before reaching
 	 * here, so testing against kernel CS suffices.
 	 */
-	if (!user_mode(regs))
+	if (!user_mode_novm(regs))
 		return;
 
 	if (current_thread_info()->status & TS_RESTORE_SIGMASK)
diff -uriN linux-2.6.32.43/arch/x86/kernel/smpboot.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/smpboot.c
--- linux-2.6.32.43/arch/x86/kernel/smpboot.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/smpboot.c	2011-07-15 05:51:11.000000000 -0500
@@ -94,14 +94,14 @@
  */
 static DEFINE_MUTEX(x86_cpu_hotplug_driver_mutex);
 
-void cpu_hotplug_driver_lock()
+void cpu_hotplug_driver_lock(void)
 {
-        mutex_lock(&x86_cpu_hotplug_driver_mutex);
+	mutex_lock(&x86_cpu_hotplug_driver_mutex);
 }
 
-void cpu_hotplug_driver_unlock()
+void cpu_hotplug_driver_unlock(void)
 {
-        mutex_unlock(&x86_cpu_hotplug_driver_mutex);
+	mutex_unlock(&x86_cpu_hotplug_driver_mutex);
 }
 
 ssize_t arch_cpu_probe(const char *buf, size_t count) { return -1; }
@@ -625,7 +625,7 @@
 	 * target processor state.
 	 */
 	startup_ipi_hook(phys_apicid, (unsigned long) start_secondary,
-			 (unsigned long)stack_start.sp);
+			 stack_start);
 
 	/*
 	 * Run STARTUP IPI loop.
@@ -743,6 +743,7 @@
 	set_idle_for_cpu(cpu, c_idle.idle);
 do_rest:
 	per_cpu(current_task, cpu) = c_idle.idle;
+	per_cpu(current_tinfo, cpu) = &c_idle.idle->tinfo;
 #ifdef CONFIG_X86_32
 	/* Stack for startup_32 can be just as for start_secondary onwards */
 	irq_ctx_init(cpu);
@@ -750,13 +751,15 @@
 #else
 	clear_tsk_thread_flag(c_idle.idle, TIF_FORK);
 	initial_gs = per_cpu_offset(cpu);
-	per_cpu(kernel_stack, cpu) =
-		(unsigned long)task_stack_page(c_idle.idle) -
-		KERNEL_STACK_OFFSET + THREAD_SIZE;
+	per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(c_idle.idle) - 16 + THREAD_SIZE;
 #endif
+
+	pax_open_kernel();
 	early_gdt_descr.address = (unsigned long)get_cpu_gdt_table(cpu);
+	pax_close_kernel();
+
 	initial_code = (unsigned long)start_secondary;
-	stack_start.sp = (void *) c_idle.idle->thread.sp;
+	stack_start = c_idle.idle->thread.sp;
 
 	/* start_ip had better be page-aligned! */
 	start_ip = setup_trampoline();
@@ -891,6 +894,12 @@
 
 	per_cpu(cpu_state, cpu) = CPU_UP_PREPARE;
 
+#ifdef CONFIG_PAX_PER_CPU_PGD
+	clone_pgd_range(get_cpu_pgd(cpu) + KERNEL_PGD_BOUNDARY,
+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+			KERNEL_PGD_PTRS);
+#endif
+
 	err = do_boot_cpu(apicid, cpu);
 
 	if (err) {
diff -uriN linux-2.6.32.43/arch/x86/kernel/step.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/step.c
--- linux-2.6.32.43/arch/x86/kernel/step.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/step.c	2011-07-15 05:51:11.000000000 -0500
@@ -27,10 +27,10 @@
 		struct desc_struct *desc;
 		unsigned long base;
 
-		seg &= ~7UL;
+		seg >>= 3;
 
 		mutex_lock(&child->mm->context.lock);
-		if (unlikely((seg >> 3) >= child->mm->context.size))
+		if (unlikely(seg >= child->mm->context.size))
 			addr = -1L; /* bogus selector, access would fault */
 		else {
 			desc = child->mm->context.ldt + seg;
@@ -42,7 +42,8 @@
 			addr += base;
 		}
 		mutex_unlock(&child->mm->context.lock);
-	}
+	} else if (seg == __KERNEL_CS || seg == __KERNEXEC_KERNEL_CS)
+		addr = ktla_ktva(addr);
 
 	return addr;
 }
@@ -53,6 +54,9 @@
 	unsigned char opcode[15];
 	unsigned long addr = convert_ip_to_linear(child, regs);
 
+	if (addr == -EINVAL)
+		return 0;
+
 	copied = access_process_vm(child, addr, opcode, sizeof(opcode), 0);
 	for (i = 0; i < copied; i++) {
 		switch (opcode[i]) {
@@ -74,7 +78,7 @@
 
 #ifdef CONFIG_X86_64
 		case 0x40 ... 0x4f:
-			if (regs->cs != __USER_CS)
+			if ((regs->cs & 0xffff) != __USER_CS)
 				/* 32-bit mode: register increment */
 				return 0;
 			/* 64-bit mode: REX prefix */
diff -uriN linux-2.6.32.43/arch/x86/kernel/syscall_table_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/syscall_table_32.S
--- linux-2.6.32.43/arch/x86/kernel/syscall_table_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/syscall_table_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -1,3 +1,4 @@
+.section .rodata,"a",@progbits
 ENTRY(sys_call_table)
 	.long sys_restart_syscall	/* 0 - old "setup()" system call, used for restarting */
 	.long sys_exit
@@ -272,7 +273,7 @@
 	.long sys_tgkill	/* 270 */
 	.long sys_utimes
  	.long sys_fadvise64_64
-	.long sys_ni_syscall	/* sys_vserver */
+	.long sys_vserver
 	.long sys_mbind
 	.long sys_get_mempolicy
 	.long sys_set_mempolicy
diff -uriN linux-2.6.32.43/arch/x86/kernel/sys_i386_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/sys_i386_32.c
--- linux-2.6.32.43/arch/x86/kernel/sys_i386_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/sys_i386_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -24,6 +24,21 @@
 
 #include <asm/syscalls.h>
 
+int i386_mmap_check(unsigned long addr, unsigned long len, unsigned long flags)
+{
+	unsigned long pax_task_size = TASK_SIZE;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
+	if (len > pax_task_size || addr > pax_task_size - len)
+		return -EINVAL;
+
+	return 0;
+}
+
 /*
  * Perform the select(nd, in, out, ex, tv) and mmap() system
  * calls. Linux/i386 didn't use to be able to handle more than
@@ -58,6 +73,212 @@
 	return err;
 }
 
+unsigned long
+arch_get_unmapped_area(struct file *filp, unsigned long addr,
+		unsigned long len, unsigned long pgoff, unsigned long flags)
+{
+	struct mm_struct *mm = current->mm;
+	struct vm_area_struct *vma;
+	unsigned long start_addr, pax_task_size = TASK_SIZE;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
+	pax_task_size -= PAGE_SIZE;
+
+	if (len > pax_task_size)
+		return -ENOMEM;
+
+	if (flags & MAP_FIXED)
+		return addr;
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
+	if (addr) {
+		addr = PAGE_ALIGN(addr);
+		if (pax_task_size - len >= addr) {
+			vma = find_vma(mm, addr);
+			if (check_heap_stack_gap(vma, addr, len))
+				return addr;
+		}
+	}
+	if (len > mm->cached_hole_size) {
+		start_addr = addr = mm->free_area_cache;
+	} else {
+		start_addr = addr = mm->mmap_base;
+		mm->cached_hole_size = 0;
+	}
+
+#ifdef CONFIG_PAX_PAGEEXEC
+	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE) && start_addr >= mm->mmap_base) {
+		start_addr = 0x00110000UL;
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			start_addr += mm->delta_mmap & 0x03FFF000UL;
+#endif
+
+		if (mm->start_brk <= start_addr && start_addr < mm->mmap_base)
+			start_addr = addr = mm->mmap_base;
+		else
+			addr = start_addr;
+	}
+#endif
+
+full_search:
+	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
+		/* At this point:  (!vma || addr < vma->vm_end). */
+		if (pax_task_size - len < addr) {
+			/*
+			 * Start a new search - just in case we missed
+			 * some holes.
+			 */
+			if (start_addr != mm->mmap_base) {
+				start_addr = addr = mm->mmap_base;
+				mm->cached_hole_size = 0;
+				goto full_search;
+			}
+			return -ENOMEM;
+		}
+		if (check_heap_stack_gap(vma, addr, len))
+			break;
+		if (addr + mm->cached_hole_size < vma->vm_start)
+			mm->cached_hole_size = vma->vm_start - addr;
+		addr = vma->vm_end;
+		if (mm->start_brk <= addr && addr < mm->mmap_base) {
+			start_addr = addr = mm->mmap_base;
+			mm->cached_hole_size = 0;
+			goto full_search;
+		}
+	}
+
+	/*
+	 * Remember the place where we stopped the search:
+	 */
+	mm->free_area_cache = addr + len;
+	return addr;
+}
+
+unsigned long
+arch_get_unmapped_area_topdown(struct file *filp, const unsigned long addr0,
+			  const unsigned long len, const unsigned long pgoff,
+			  const unsigned long flags)
+{
+	struct vm_area_struct *vma;
+	struct mm_struct *mm = current->mm;
+	unsigned long base = mm->mmap_base, addr = addr0, pax_task_size = TASK_SIZE;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
+	pax_task_size -= PAGE_SIZE;
+
+	/* requested length too big for entire address space */
+	if (len > pax_task_size)
+		return -ENOMEM;
+
+	if (flags & MAP_FIXED)
+		return addr;
+
+#ifdef CONFIG_PAX_PAGEEXEC
+	if (!nx_enabled && (mm->pax_flags & MF_PAX_PAGEEXEC) && (flags & MAP_EXECUTABLE))
+		goto bottomup;
+#endif
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
+	/* requesting a specific address */
+	if (addr) {
+		addr = PAGE_ALIGN(addr);
+		if (pax_task_size - len >= addr) {
+			vma = find_vma(mm, addr);
+			if (check_heap_stack_gap(vma, addr, len))
+				return addr;
+		}
+	}
+
+	/* check if free_area_cache is useful for us */
+	if (len <= mm->cached_hole_size) {
+		mm->cached_hole_size = 0;
+		mm->free_area_cache = mm->mmap_base;
+	}
+
+	/* either no address requested or can't fit in requested address hole */
+	addr = mm->free_area_cache;
+
+	/* make sure it can fit in the remaining address space */
+	if (addr > len) {
+		vma = find_vma(mm, addr-len);
+		if (check_heap_stack_gap(vma, addr - len, len))
+			/* remember the address as a hint for next time */
+			return (mm->free_area_cache = addr-len);
+	}
+
+	if (mm->mmap_base < len)
+		goto bottomup;
+
+	addr = mm->mmap_base-len;
+
+	do {
+		/*
+		 * Lookup failure means no vma is above this address,
+		 * else if new region fits below vma->vm_start,
+		 * return with success:
+		 */
+		vma = find_vma(mm, addr);
+		if (check_heap_stack_gap(vma, addr, len))
+			/* remember the address as a hint for next time */
+			return (mm->free_area_cache = addr);
+
+		/* remember the largest hole we saw so far */
+		if (addr + mm->cached_hole_size < vma->vm_start)
+			mm->cached_hole_size = vma->vm_start - addr;
+
+		/* try just below the current vma->vm_start */
+		addr = skip_heap_stack_gap(vma, len);
+	} while (!IS_ERR_VALUE(addr));
+
+bottomup:
+	/*
+	 * A failed mmap() very likely causes application failure,
+	 * so fall back to the bottom-up function here. This scenario
+	 * can happen with large stack limits and large mmap()
+	 * allocations.
+	 */
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
+	else
+#endif
+
+	mm->mmap_base = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (mm->pax_flags & MF_PAX_RANDMMAP)
+		mm->mmap_base += mm->delta_mmap;
+#endif
+
+	mm->free_area_cache = mm->mmap_base;
+	mm->cached_hole_size = ~0UL;
+	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
+	/*
+	 * Restore the topdown base:
+	 */
+	mm->mmap_base = base;
+	mm->free_area_cache = base;
+	mm->cached_hole_size = ~0UL;
+
+	return addr;
+}
 
 struct sel_arg_struct {
 	unsigned long n;
@@ -93,7 +314,7 @@
 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second, NULL);
 	case SEMTIMEDOP:
 		return sys_semtimedop(first, (struct sembuf __user *)ptr, second,
-					(const struct timespec __user *)fifth);
+					(__force const struct timespec __user *)fifth);
 
 	case SEMGET:
 		return sys_semget(first, second, third);
@@ -140,7 +361,7 @@
 			ret = do_shmat(first, (char __user *) ptr, second, &raddr);
 			if (ret)
 				return ret;
-			return put_user(raddr, (ulong __user *) third);
+			return put_user(raddr, (__force ulong __user *) third);
 		}
 		case 1:	/* iBCS2 emulator entry point */
 			if (!segment_eq(get_fs(), get_ds()))
@@ -207,17 +428,3 @@
 
 	return error;
 }
-
-
-/*
- * Do a system call from kernel instead of calling sys_execve so we
- * end up with proper pt_regs.
- */
-int kernel_execve(const char *filename, char *const argv[], char *const envp[])
-{
-	long __res;
-	asm volatile ("push %%ebx ; movl %2,%%ebx ; int $0x80 ; pop %%ebx"
-	: "=a" (__res)
-	: "0" (__NR_execve), "ri" (filename), "c" (argv), "d" (envp) : "memory");
-	return __res;
-}
diff -uriN linux-2.6.32.43/arch/x86/kernel/sys_x86_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/sys_x86_64.c
--- linux-2.6.32.43/arch/x86/kernel/sys_x86_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/sys_x86_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -32,8 +32,8 @@
 	return error;
 }
 
-static void find_start_end(unsigned long flags, unsigned long *begin,
-			   unsigned long *end)
+static void find_start_end(struct mm_struct *mm, unsigned long flags,
+			   unsigned long *begin, unsigned long *end)
 {
 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT)) {
 		unsigned long new_begin;
@@ -52,7 +52,7 @@
 				*begin = new_begin;
 		}
 	} else {
-		*begin = TASK_UNMAPPED_BASE;
+		*begin = mm->mmap_base;
 		*end = TASK_SIZE;
 	}
 }
@@ -69,16 +69,19 @@
 	if (flags & MAP_FIXED)
 		return addr;
 
-	find_start_end(flags, &begin, &end);
+	find_start_end(mm, flags, &begin, &end);
 
 	if (len > end)
 		return -ENOMEM;
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
 		vma = find_vma(mm, addr);
-		if (end - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (end - len >= addr && check_heap_stack_gap(vma, addr, len))
 			return addr;
 	}
 	if (((flags & MAP_32BIT) || test_thread_flag(TIF_IA32))
@@ -106,7 +109,7 @@
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
+		if (check_heap_stack_gap(vma, addr, len)) {
 			/*
 			 * Remember the place where we stopped the search:
 			 */
@@ -128,7 +131,7 @@
 {
 	struct vm_area_struct *vma;
 	struct mm_struct *mm = current->mm;
-	unsigned long addr = addr0;
+	unsigned long base = mm->mmap_base, addr = addr0;
 
 	/* requested length too big for entire address space */
 	if (len > TASK_SIZE)
@@ -141,13 +144,18 @@
 	if (!test_thread_flag(TIF_IA32) && (flags & MAP_32BIT))
 		goto bottomup;
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
 	/* requesting a specific address */
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
-		if (TASK_SIZE - len >= addr &&
-				(!vma || addr + len <= vma->vm_start))
-			return addr;
+		if (TASK_SIZE - len >= addr) {
+			vma = find_vma(mm, addr);
+			if (check_heap_stack_gap(vma, addr, len))
+				return addr;
+		}
 	}
 
 	/* check if free_area_cache is useful for us */
@@ -162,7 +170,7 @@
 	/* make sure it can fit in the remaining address space */
 	if (addr > len) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start)
+		if (check_heap_stack_gap(vma, addr - len, len))
 			/* remember the address as a hint for next time */
 			return mm->free_area_cache = addr-len;
 	}
@@ -179,7 +187,7 @@
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || addr+len <= vma->vm_start)
+		if (check_heap_stack_gap(vma, addr, len))
 			/* remember the address as a hint for next time */
 			return mm->free_area_cache = addr;
 
@@ -188,8 +196,8 @@
 			mm->cached_hole_size = vma->vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
-	} while (len < vma->vm_start);
+		addr = skip_heap_stack_gap(vma, len);
+	} while (!IS_ERR_VALUE(addr));
 
 bottomup:
 	/*
@@ -198,13 +206,21 @@
 	 * can happen with large stack limits and large mmap()
 	 * allocations.
 	 */
+	mm->mmap_base = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (mm->pax_flags & MF_PAX_RANDMMAP)
+		mm->mmap_base += mm->delta_mmap;
+#endif
+
+	mm->free_area_cache = mm->mmap_base;
 	mm->cached_hole_size = ~0UL;
-	mm->free_area_cache = TASK_UNMAPPED_BASE;
 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
 	/*
 	 * Restore the topdown base:
 	 */
-	mm->free_area_cache = mm->mmap_base;
+	mm->mmap_base = base;
+	mm->free_area_cache = base;
 	mm->cached_hole_size = ~0UL;
 
 	return addr;
diff -uriN linux-2.6.32.43/arch/x86/kernel/tboot.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/tboot.c
--- linux-2.6.32.43/arch/x86/kernel/tboot.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/tboot.c	2011-07-15 05:51:11.000000000 -0500
@@ -216,7 +216,7 @@
 
 void tboot_shutdown(u32 shutdown_type)
 {
-	void (*shutdown)(void);
+	void (* __noreturn shutdown)(void);
 
 	if (!tboot_enabled())
 		return;
@@ -238,7 +238,7 @@
 
 	switch_to_tboot_pt();
 
-	shutdown = (void(*)(void))(unsigned long)tboot->shutdown_entry;
+	shutdown = (void *)tboot->shutdown_entry;
 	shutdown();
 
 	/* should not reach here */
@@ -295,7 +295,7 @@
 	tboot_shutdown(acpi_shutdown_map[sleep_state]);
 }
 
-static atomic_t ap_wfs_count;
+static atomic_unchecked_t ap_wfs_count;
 
 static int tboot_wait_for_aps(int num_aps)
 {
@@ -319,9 +319,9 @@
 {
 	switch (action) {
 	case CPU_DYING:
-		atomic_inc(&ap_wfs_count);
+		atomic_inc_unchecked(&ap_wfs_count);
 		if (num_online_cpus() == 1)
-			if (tboot_wait_for_aps(atomic_read(&ap_wfs_count)))
+			if (tboot_wait_for_aps(atomic_read_unchecked(&ap_wfs_count)))
 				return NOTIFY_BAD;
 		break;
 	}
@@ -340,7 +340,7 @@
 
 	tboot_create_trampoline();
 
-	atomic_set(&ap_wfs_count, 0);
+	atomic_set_unchecked(&ap_wfs_count, 0);
 	register_hotcpu_notifier(&tboot_cpu_notifier);
 	return 0;
 }
diff -uriN linux-2.6.32.43/arch/x86/kernel/time.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/time.c
--- linux-2.6.32.43/arch/x86/kernel/time.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/time.c	2011-07-15 05:51:11.000000000 -0500
@@ -26,17 +26,13 @@
 int timer_ack;
 #endif
 
-#ifdef CONFIG_X86_64
-volatile unsigned long __jiffies __section_jiffies = INITIAL_JIFFIES;
-#endif
-
 unsigned long profile_pc(struct pt_regs *regs)
 {
 	unsigned long pc = instruction_pointer(regs);
 
-	if (!user_mode_vm(regs) && in_lock_functions(pc)) {
+	if (!user_mode(regs) && in_lock_functions(pc)) {
 #ifdef CONFIG_FRAME_POINTER
-		return *(unsigned long *)(regs->bp + sizeof(long));
+		return ktla_ktva(*(unsigned long *)(regs->bp + sizeof(long)));
 #else
 		unsigned long *sp =
 			(unsigned long *)kernel_stack_pointer(regs);
@@ -45,11 +41,17 @@
 		 * or above a saved flags. Eflags has bits 22-31 zero,
 		 * kernel addresses don't.
 		 */
+
+#ifdef CONFIG_PAX_KERNEXEC
+		return ktla_ktva(sp[0]);
+#else
 		if (sp[0] >> 22)
 			return sp[0];
 		if (sp[1] >> 22)
 			return sp[1];
 #endif
+
+#endif
 	}
 	return pc;
 }
diff -uriN linux-2.6.32.43/arch/x86/kernel/tls.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/tls.c
--- linux-2.6.32.43/arch/x86/kernel/tls.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/tls.c	2011-07-15 05:51:11.000000000 -0500
@@ -85,6 +85,11 @@
 	if (idx < GDT_ENTRY_TLS_MIN || idx > GDT_ENTRY_TLS_MAX)
 		return -EINVAL;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((p->mm->pax_flags & MF_PAX_SEGMEXEC) && (info.contents & MODIFY_LDT_CONTENTS_CODE))
+		return -EINVAL;
+#endif
+
 	set_tls_desc(p, idx, &info, 1);
 
 	return 0;
diff -uriN linux-2.6.32.43/arch/x86/kernel/trampoline_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/trampoline_32.S
--- linux-2.6.32.43/arch/x86/kernel/trampoline_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/trampoline_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -32,6 +32,12 @@
 #include <asm/segment.h>
 #include <asm/page_types.h>
 
+#ifdef CONFIG_PAX_KERNEXEC
+#define ta(X) (X)
+#else
+#define ta(X) ((X) - __PAGE_OFFSET)
+#endif
+
 /* We can free up trampoline after bootup if cpu hotplug is not supported. */
 __CPUINITRODATA
 .code16
@@ -60,7 +66,7 @@
 	inc	%ax		# protected mode (PE) bit
 	lmsw	%ax		# into protected mode
 	# flush prefetch and jump to startup_32_smp in arch/i386/kernel/head.S
-	ljmpl	$__BOOT_CS, $(startup_32_smp-__PAGE_OFFSET)
+	ljmpl	$__BOOT_CS, $ta(startup_32_smp)
 
 	# These need to be in the same 64K segment as the above;
 	# hence we don't use the boot_gdt_descr defined in head.S
diff -uriN linux-2.6.32.43/arch/x86/kernel/trampoline_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/trampoline_64.S
--- linux-2.6.32.43/arch/x86/kernel/trampoline_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/trampoline_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -91,7 +91,7 @@
 	movl	$__KERNEL_DS, %eax	# Initialize the %ds segment register
 	movl	%eax, %ds
 
-	movl	$X86_CR4_PAE, %eax
+	movl	$(X86_CR4_PSE | X86_CR4_PAE | X86_CR4_PGE), %eax
 	movl	%eax, %cr4		# Enable PAE mode
 
 					# Setup trampoline 4 level pagetables
@@ -127,7 +127,7 @@
 no_longmode:
 	hlt
 	jmp no_longmode
-#include "verify_cpu_64.S"
+#include "verify_cpu.S"
 
 	# Careful these need to be in the same 64K segment as the above;
 tidt:
@@ -138,7 +138,7 @@
 	# so the kernel can live anywhere
 	.balign 4
 tgdt:
-	.short	tgdt_end - tgdt		# gdt limit
+	.short	tgdt_end - tgdt - 1	# gdt limit
 	.long	tgdt - r_base
 	.short 0
 	.quad	0x00cf9b000000ffff	# __KERNEL32_CS
diff -uriN linux-2.6.32.43/arch/x86/kernel/traps.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/traps.c
--- linux-2.6.32.43/arch/x86/kernel/traps.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/traps.c	2011-07-15 05:51:11.000000000 -0500
@@ -69,12 +69,6 @@
 
 /* Do we ignore FPU interrupts ? */
 char ignore_fpu_irq;
-
-/*
- * The IDT has to be page-aligned to simplify the Pentium
- * F0 0F bug workaround.
- */
-gate_desc idt_table[NR_VECTORS] __page_aligned_data = { { { { 0, 0 } } }, };
 #endif
 
 DECLARE_BITMAP(used_vectors, NR_VECTORS);
@@ -112,19 +106,19 @@
 static inline void
 die_if_kernel(const char *str, struct pt_regs *regs, long err)
 {
-	if (!user_mode_vm(regs))
+	if (!user_mode(regs))
 		die(str, regs, err);
 }
 #endif
 
 static void __kprobes
-do_trap(int trapnr, int signr, char *str, struct pt_regs *regs,
+do_trap(int trapnr, int signr, const char *str, struct pt_regs *regs,
 	long error_code, siginfo_t *info)
 {
 	struct task_struct *tsk = current;
 
 #ifdef CONFIG_X86_32
-	if (regs->flags & X86_VM_MASK) {
+	if (v8086_mode(regs)) {
 		/*
 		 * traps 0, 1, 3, 4, and 5 should be forwarded to vm86.
 		 * On nmi (interrupt 2), do_trap should not be called.
@@ -135,7 +129,7 @@
 	}
 #endif
 
-	if (!user_mode(regs))
+	if (!user_mode_novm(regs))
 		goto kernel_trap;
 
 #ifdef CONFIG_X86_32
@@ -158,7 +152,7 @@
 	    printk_ratelimit()) {
 		printk(KERN_INFO
 		       "%s[%d] trap %s ip:%lx sp:%lx error:%lx",
-		       tsk->comm, tsk->pid, str,
+		       tsk->comm, task_pid_nr(tsk), str,
 		       regs->ip, regs->sp, error_code);
 		print_vma_addr(" in ", regs->ip);
 		printk("\n");
@@ -175,8 +169,20 @@
 	if (!fixup_exception(regs)) {
 		tsk->thread.error_code = error_code;
 		tsk->thread.trap_no = trapnr;
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+		if (trapnr == 12 && ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS))
+			str = "PAX: suspicious stack segment fault";
+#endif
+
 		die(str, regs, error_code);
 	}
+
+#ifdef CONFIG_PAX_REFCOUNT
+	if (trapnr == 4)
+		pax_report_refcount_overflow(regs);
+#endif
+
 	return;
 
 #ifdef CONFIG_X86_32
@@ -265,14 +271,30 @@
 	conditional_sti(regs);
 
 #ifdef CONFIG_X86_32
-	if (regs->flags & X86_VM_MASK)
+	if (v8086_mode(regs))
 		goto gp_in_vm86;
 #endif
 
 	tsk = current;
-	if (!user_mode(regs))
+	if (!user_mode_novm(regs))
 		goto gp_in_kernel;
 
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
+	if (!nx_enabled && tsk->mm && (tsk->mm->pax_flags & MF_PAX_PAGEEXEC)) {
+		struct mm_struct *mm = tsk->mm;
+		unsigned long limit;
+
+		down_write(&mm->mmap_sem);
+		limit = mm->context.user_cs_limit;
+		if (limit < TASK_SIZE) {
+			track_exec_limit(mm, limit, TASK_SIZE, VM_EXEC);
+			up_write(&mm->mmap_sem);
+			return;
+		}
+		up_write(&mm->mmap_sem);
+	}
+#endif
+
 	tsk->thread.error_code = error_code;
 	tsk->thread.trap_no = 13;
 
@@ -305,6 +327,13 @@
 	if (notify_die(DIE_GPF, "general protection fault", regs,
 				error_code, 13, SIGSEGV) == NOTIFY_STOP)
 		return;
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+	if ((regs->cs & 0xFFFF) == __KERNEL_CS || (regs->cs & 0xFFFF) == __KERNEXEC_KERNEL_CS)
+		die("PAX: suspicious general protection fault", regs, error_code);
+	else
+#endif
+
 	die("general protection fault", regs, error_code);
 }
 
@@ -435,6 +464,17 @@
 dotraplinkage notrace __kprobes void
 do_nmi(struct pt_regs *regs, long error_code)
 {
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+	if (!user_mode(regs)) {
+		unsigned long cs = regs->cs & 0xFFFF;
+		unsigned long ip = ktva_ktla(regs->ip);
+
+		if ((cs == __KERNEL_CS || cs == __KERNEXEC_KERNEL_CS) && ip <= (unsigned long)_etext)
+			regs->ip = ip;
+	}
+#endif
+
 	nmi_enter();
 
 	inc_irq_stat(__nmi_count);
@@ -558,7 +598,7 @@
 	}
 
 #ifdef CONFIG_X86_32
-	if (regs->flags & X86_VM_MASK)
+	if (v8086_mode(regs))
 		goto debug_vm86;
 #endif
 
@@ -570,7 +610,7 @@
 	 * kernel space (but re-enable TF when returning to user mode).
 	 */
 	if (condition & DR_STEP) {
-		if (!user_mode(regs))
+		if (!user_mode_novm(regs))
 			goto clear_TF_reenable;
 	}
 
@@ -757,7 +797,7 @@
 	 * Handle strange cache flush from user space exception
 	 * in all other cases.  This is undocumented behaviour.
 	 */
-	if (regs->flags & X86_VM_MASK) {
+	if (v8086_mode(regs)) {
 		handle_vm86_fault((struct kernel_vm86_regs *)regs, error_code);
 		return;
 	}
@@ -798,7 +838,7 @@
 void __math_state_restore(void)
 {
 	struct thread_info *thread = current_thread_info();
-	struct task_struct *tsk = thread->task;
+	struct task_struct *tsk = current;
 
 	/*
 	 * Paranoid restore. send a SIGSEGV if we fail to restore the state.
@@ -825,8 +865,7 @@
  */
 asmlinkage void math_state_restore(void)
 {
-	struct thread_info *thread = current_thread_info();
-	struct task_struct *tsk = thread->task;
+	struct task_struct *tsk = current;
 
 	if (!tsk_used_math(tsk)) {
 		local_irq_enable();
diff -uriN linux-2.6.32.43/arch/x86/kernel/verify_cpu_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/verify_cpu_64.S
--- linux-2.6.32.43/arch/x86/kernel/verify_cpu_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/verify_cpu_64.S	1969-12-31 18:00:00.000000000 -0600
@@ -1,105 +0,0 @@
-/*
- *
- *	verify_cpu.S - Code for cpu long mode and SSE verification. This
- *	code has been borrowed from boot/setup.S and was introduced by
- * 	Andi Kleen.
- *
- *	Copyright (c) 2007  Andi Kleen (ak@suse.de)
- *	Copyright (c) 2007  Eric Biederman (ebiederm@xmission.com)
- *	Copyright (c) 2007  Vivek Goyal (vgoyal@in.ibm.com)
- *
- * 	This source code is licensed under the GNU General Public License,
- * 	Version 2.  See the file COPYING for more details.
- *
- *	This is a common code for verification whether CPU supports
- * 	long mode and SSE or not. It is not called directly instead this
- *	file is included at various places and compiled in that context.
- * 	Following are the current usage.
- *
- * 	This file is included by both 16bit and 32bit code.
- *
- *	arch/x86_64/boot/setup.S : Boot cpu verification (16bit)
- *	arch/x86_64/boot/compressed/head.S: Boot cpu verification (32bit)
- *	arch/x86_64/kernel/trampoline.S: secondary processor verfication (16bit)
- *	arch/x86_64/kernel/acpi/wakeup.S:Verfication at resume (16bit)
- *
- *	verify_cpu, returns the status of cpu check in register %eax.
- *		0: Success    1: Failure
- *
- * 	The caller needs to check for the error code and take the action
- * 	appropriately. Either display a message or halt.
- */
-
-#include <asm/cpufeature.h>
-
-verify_cpu:
-	pushfl				# Save caller passed flags
-	pushl	$0			# Kill any dangerous flags
-	popfl
-
-	pushfl				# standard way to check for cpuid
-	popl	%eax
-	movl	%eax,%ebx
-	xorl	$0x200000,%eax
-	pushl	%eax
-	popfl
-	pushfl
-	popl	%eax
-	cmpl	%eax,%ebx
-	jz	verify_cpu_no_longmode	# cpu has no cpuid
-
-	movl	$0x0,%eax		# See if cpuid 1 is implemented
-	cpuid
-	cmpl	$0x1,%eax
-	jb	verify_cpu_no_longmode	# no cpuid 1
-
-	xor	%di,%di
-	cmpl	$0x68747541,%ebx	# AuthenticAMD
-	jnz	verify_cpu_noamd
-	cmpl	$0x69746e65,%edx
-	jnz	verify_cpu_noamd
-	cmpl	$0x444d4163,%ecx
-	jnz	verify_cpu_noamd
-	mov	$1,%di			# cpu is from AMD
-
-verify_cpu_noamd:
-	movl    $0x1,%eax		# Does the cpu have what it takes
-	cpuid
-	andl	$REQUIRED_MASK0,%edx
-	xorl	$REQUIRED_MASK0,%edx
-	jnz	verify_cpu_no_longmode
-
-	movl    $0x80000000,%eax	# See if extended cpuid is implemented
-	cpuid
-	cmpl    $0x80000001,%eax
-	jb      verify_cpu_no_longmode	# no extended cpuid
-
-	movl    $0x80000001,%eax	# Does the cpu have what it takes
-	cpuid
-	andl    $REQUIRED_MASK1,%edx
-	xorl    $REQUIRED_MASK1,%edx
-	jnz     verify_cpu_no_longmode
-
-verify_cpu_sse_test:
-	movl	$1,%eax
-	cpuid
-	andl	$SSE_MASK,%edx
-	cmpl	$SSE_MASK,%edx
-	je	verify_cpu_sse_ok
-	test	%di,%di
-	jz	verify_cpu_no_longmode	# only try to force SSE on AMD
-	movl	$0xc0010015,%ecx	# HWCR
-	rdmsr
-	btr	$15,%eax		# enable SSE
-	wrmsr
-	xor	%di,%di			# don't loop
-	jmp	verify_cpu_sse_test	# try again
-
-verify_cpu_no_longmode:
-	popfl				# Restore caller passed flags
-	movl $1,%eax
-	ret
-verify_cpu_sse_ok:
-	popfl				# Restore caller passed flags
-	xorl %eax, %eax
-	ret
diff -uriN linux-2.6.32.43/arch/x86/kernel/verify_cpu.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/verify_cpu.S
--- linux-2.6.32.43/arch/x86/kernel/verify_cpu.S	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/verify_cpu.S	2011-07-15 05:51:11.000000000 -0500
@@ -0,0 +1,140 @@
+/*
+ *
+ *	verify_cpu.S - Code for cpu long mode and SSE verification. This
+ *	code has been borrowed from boot/setup.S and was introduced by
+ * 	Andi Kleen.
+ *
+ *	Copyright (c) 2007  Andi Kleen (ak@suse.de)
+ *	Copyright (c) 2007  Eric Biederman (ebiederm@xmission.com)
+ *	Copyright (c) 2007  Vivek Goyal (vgoyal@in.ibm.com)
+ *	Copyright (c) 2010  Kees Cook (kees.cook@canonical.com)
+ *
+ * 	This source code is licensed under the GNU General Public License,
+ * 	Version 2.  See the file COPYING for more details.
+ *
+ *	This is a common code for verification whether CPU supports
+ * 	long mode and SSE or not. It is not called directly instead this
+ *	file is included at various places and compiled in that context.
+ *	This file is expected to run in 32bit code.  Currently:
+ *
+ *	arch/x86/boot/compressed/head_64.S: Boot cpu verification
+ *	arch/x86/kernel/trampoline_64.S: secondary processor verification
+ *	arch/x86/kernel/head_32.S: processor startup
+ *	arch/x86/kernel/acpi/realmode/wakeup.S: 32bit processor resume
+ *
+ *	verify_cpu, returns the status of longmode and SSE in register %eax.
+ *		0: Success    1: Failure
+ *
+ *	On Intel, the XD_DISABLE flag will be cleared as a side-effect.
+ *
+ * 	The caller needs to check for the error code and take the action
+ * 	appropriately. Either display a message or halt.
+ */
+
+#include <asm/cpufeature.h>
+#include <asm/msr-index.h>
+
+verify_cpu:
+	pushfl				# Save caller passed flags
+	pushl	$0			# Kill any dangerous flags
+	popfl
+
+	pushfl				# standard way to check for cpuid
+	popl	%eax
+	movl	%eax,%ebx
+	xorl	$0x200000,%eax
+	pushl	%eax
+	popfl
+	pushfl
+	popl	%eax
+	cmpl	%eax,%ebx
+	jz	verify_cpu_no_longmode	# cpu has no cpuid
+
+	movl	$0x0,%eax		# See if cpuid 1 is implemented
+	cpuid
+	cmpl	$0x1,%eax
+	jb	verify_cpu_no_longmode	# no cpuid 1
+
+	xor	%di,%di
+	cmpl	$0x68747541,%ebx	# AuthenticAMD
+	jnz	verify_cpu_noamd
+	cmpl	$0x69746e65,%edx
+	jnz	verify_cpu_noamd
+	cmpl	$0x444d4163,%ecx
+	jnz	verify_cpu_noamd
+	mov	$1,%di			# cpu is from AMD
+	jmp	verify_cpu_check
+
+verify_cpu_noamd:
+	cmpl	$0x756e6547,%ebx        # GenuineIntel?
+	jnz	verify_cpu_check
+	cmpl	$0x49656e69,%edx
+	jnz	verify_cpu_check
+	cmpl	$0x6c65746e,%ecx
+	jnz	verify_cpu_check
+
+	# only call IA32_MISC_ENABLE when:
+	# family > 6 || (family == 6 && model >= 0xd)
+	movl	$0x1, %eax		# check CPU family and model
+	cpuid
+	movl	%eax, %ecx
+
+	andl	$0x0ff00f00, %eax	# mask family and extended family
+	shrl	$8, %eax
+	cmpl	$6, %eax
+	ja	verify_cpu_clear_xd	# family > 6, ok
+	jb	verify_cpu_check	# family < 6, skip
+
+	andl	$0x000f00f0, %ecx	# mask model and extended model
+	shrl	$4, %ecx
+	cmpl	$0xd, %ecx
+	jb	verify_cpu_check	# family == 6, model < 0xd, skip
+
+verify_cpu_clear_xd:
+	movl	$MSR_IA32_MISC_ENABLE, %ecx
+	rdmsr
+	btrl	$2, %edx		# clear MSR_IA32_MISC_ENABLE_XD_DISABLE
+	jnc	verify_cpu_check	# only write MSR if bit was changed
+	wrmsr
+
+verify_cpu_check:
+	movl    $0x1,%eax		# Does the cpu have what it takes
+	cpuid
+	andl	$REQUIRED_MASK0,%edx
+	xorl	$REQUIRED_MASK0,%edx
+	jnz	verify_cpu_no_longmode
+
+	movl    $0x80000000,%eax	# See if extended cpuid is implemented
+	cpuid
+	cmpl    $0x80000001,%eax
+	jb      verify_cpu_no_longmode	# no extended cpuid
+
+	movl    $0x80000001,%eax	# Does the cpu have what it takes
+	cpuid
+	andl    $REQUIRED_MASK1,%edx
+	xorl    $REQUIRED_MASK1,%edx
+	jnz     verify_cpu_no_longmode
+
+verify_cpu_sse_test:
+	movl	$1,%eax
+	cpuid
+	andl	$SSE_MASK,%edx
+	cmpl	$SSE_MASK,%edx
+	je	verify_cpu_sse_ok
+	test	%di,%di
+	jz	verify_cpu_no_longmode	# only try to force SSE on AMD
+	movl	$MSR_K7_HWCR,%ecx
+	rdmsr
+	btr	$15,%eax		# enable SSE
+	wrmsr
+	xor	%di,%di			# don't loop
+	jmp	verify_cpu_sse_test	# try again
+
+verify_cpu_no_longmode:
+	popfl				# Restore caller passed flags
+	movl $1,%eax
+	ret
+verify_cpu_sse_ok:
+	popfl				# Restore caller passed flags
+	xorl %eax, %eax
+	ret
diff -uriN linux-2.6.32.43/arch/x86/kernel/vm86_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/vm86_32.c
--- linux-2.6.32.43/arch/x86/kernel/vm86_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/vm86_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -41,6 +41,7 @@
 #include <linux/ptrace.h>
 #include <linux/audit.h>
 #include <linux/stddef.h>
+#include <linux/grsecurity.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -148,7 +149,7 @@
 		do_exit(SIGSEGV);
 	}
 
-	tss = &per_cpu(init_tss, get_cpu());
+	tss = init_tss + get_cpu();
 	current->thread.sp0 = current->thread.saved_sp0;
 	current->thread.sysenter_cs = __KERNEL_CS;
 	load_sp0(tss, &current->thread);
@@ -208,6 +209,13 @@
 	struct task_struct *tsk;
 	int tmp, ret = -EPERM;
 
+#ifdef CONFIG_GRKERNSEC_VM86
+	if (!capable(CAP_SYS_RAWIO)) {
+		gr_handle_vm86();
+		goto out;
+	}
+#endif
+
 	tsk = current;
 	if (tsk->thread.saved_sp0)
 		goto out;
@@ -238,6 +246,14 @@
 	int tmp, ret;
 	struct vm86plus_struct __user *v86;
 
+#ifdef CONFIG_GRKERNSEC_VM86
+	if (!capable(CAP_SYS_RAWIO)) {
+		gr_handle_vm86();
+		ret = -EPERM;
+		goto out;
+	}
+#endif
+
 	tsk = current;
 	switch (regs->bx) {
 	case VM86_REQUEST_IRQ:
@@ -324,7 +340,7 @@
 	tsk->thread.saved_fs = info->regs32->fs;
 	tsk->thread.saved_gs = get_user_gs(info->regs32);
 
-	tss = &per_cpu(init_tss, get_cpu());
+	tss = init_tss + get_cpu();
 	tsk->thread.sp0 = (unsigned long) &info->VM86_TSS_ESP0;
 	if (cpu_has_sep)
 		tsk->thread.sysenter_cs = 0;
@@ -529,7 +545,7 @@
 		goto cannot_handle;
 	if (i == 0x21 && is_revectored(AH(regs), &KVM86->int21_revectored))
 		goto cannot_handle;
-	intr_ptr = (unsigned long __user *) (i << 2);
+	intr_ptr = (__force unsigned long __user *) (i << 2);
 	if (get_user(segoffs, intr_ptr))
 		goto cannot_handle;
 	if ((segoffs >> 16) == BIOSSEG)
diff -uriN linux-2.6.32.43/arch/x86/kernel/vmi_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/vmi_32.c
--- linux-2.6.32.43/arch/x86/kernel/vmi_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/vmi_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -44,12 +44,17 @@
 typedef u64 __attribute__((regparm(2))) (VROMLONGFUNC)(int);
 
 #define call_vrom_func(rom,func) \
-   (((VROMFUNC *)(rom->func))())
+   (((VROMFUNC *)(ktva_ktla(rom.func)))())
 
 #define call_vrom_long_func(rom,func,arg) \
-   (((VROMLONGFUNC *)(rom->func)) (arg))
+({\
+	u64 __reloc = ((VROMLONGFUNC *)(ktva_ktla(rom.func))) (arg);\
+	struct vmi_relocation_info *const __rel = (struct vmi_relocation_info *)&__reloc;\
+	__rel->eip = (unsigned char *)ktva_ktla((unsigned long)__rel->eip);\
+	__reloc;\
+})
 
-static struct vrom_header *vmi_rom;
+static struct vrom_header vmi_rom __attribute((__section__(".vmi.rom"), __aligned__(PAGE_SIZE)));
 static int disable_pge;
 static int disable_pse;
 static int disable_sep;
@@ -76,10 +81,10 @@
 	void (*set_initial_ap_state)(int, int);
 	void (*halt)(void);
   	void (*set_lazy_mode)(int mode);
-} vmi_ops;
+} vmi_ops __read_only;
 
 /* Cached VMI operations */
-struct vmi_timer_ops vmi_timer_ops;
+struct vmi_timer_ops vmi_timer_ops __read_only;
 
 /*
  * VMI patching routines.
@@ -94,7 +99,7 @@
 static inline void patch_offset(void *insnbuf,
 				unsigned long ip, unsigned long dest)
 {
-        *(unsigned long *)(insnbuf+1) = dest-ip-5;
+	*(unsigned long *)(insnbuf+1) = dest-ip-5;
 }
 
 static unsigned patch_internal(int call, unsigned len, void *insnbuf,
@@ -102,6 +107,7 @@
 {
 	u64 reloc;
 	struct vmi_relocation_info *const rel = (struct vmi_relocation_info *)&reloc;
+
 	reloc = call_vrom_long_func(vmi_rom, get_reloc,	call);
 	switch(rel->type) {
 		case VMI_RELOCATION_CALL_REL:
@@ -404,13 +410,13 @@
 
 static void vmi_pte_clear(struct mm_struct *mm, unsigned long addr, pte_t *ptep)
 {
-	const pte_t pte = { .pte = 0 };
+	const pte_t pte = __pte(0ULL);
 	vmi_ops.set_pte(pte, ptep, vmi_flags_addr(mm, addr, VMI_PAGE_PT, 0));
 }
 
 static void vmi_pmd_clear(pmd_t *pmd)
 {
-	const pte_t pte = { .pte = 0 };
+	const pte_t pte = __pte(0ULL);
 	vmi_ops.set_pte(pte, (pte_t *)pmd, VMI_PAGE_PD);
 }
 #endif
@@ -438,10 +444,10 @@
 	ap.ss = __KERNEL_DS;
 	ap.esp = (unsigned long) start_esp;
 
-	ap.ds = __USER_DS;
-	ap.es = __USER_DS;
+	ap.ds = __KERNEL_DS;
+	ap.es = __KERNEL_DS;
 	ap.fs = __KERNEL_PERCPU;
-	ap.gs = __KERNEL_STACK_CANARY;
+	savesegment(gs, ap.gs);
 
 	ap.eflags = 0;
 
@@ -486,6 +492,18 @@
 	paravirt_leave_lazy_mmu();
 }
 
+#ifdef CONFIG_PAX_KERNEXEC
+static unsigned long vmi_pax_open_kernel(void)
+{
+	return 0;
+}
+
+static unsigned long vmi_pax_close_kernel(void)
+{
+	return 0;
+}
+#endif
+
 static inline int __init check_vmi_rom(struct vrom_header *rom)
 {
 	struct pci_header *pci;
@@ -498,6 +516,10 @@
 		return 0;
 	if (rom->vrom_signature != VMI_SIGNATURE)
 		return 0;
+	if (rom->rom_length * 512 > sizeof(*rom)) {
+		printk(KERN_WARNING "PAX: VMI: ROM size too big: %x\n", rom->rom_length * 512);
+		return 0;
+	}
 	if (rom->api_version_maj != VMI_API_REV_MAJOR ||
 	    rom->api_version_min+1 < VMI_API_REV_MINOR+1) {
 		printk(KERN_WARNING "VMI: Found mismatched rom version %d.%d\n",
@@ -562,7 +584,7 @@
 		struct vrom_header *romstart;
 		romstart = (struct vrom_header *)isa_bus_to_virt(base);
 		if (check_vmi_rom(romstart)) {
-			vmi_rom = romstart;
+			vmi_rom = *romstart;
 			return 1;
 		}
 	}
@@ -836,6 +858,11 @@
 
 	para_fill(pv_irq_ops.safe_halt, Halt);
 
+#ifdef CONFIG_PAX_KERNEXEC
+	pv_mmu_ops.pax_open_kernel = vmi_pax_open_kernel;
+	pv_mmu_ops.pax_close_kernel = vmi_pax_close_kernel;
+#endif
+
 	/*
 	 * Alternative instruction rewriting doesn't happen soon enough
 	 * to convert VMI_IRET to a call instead of a jump; so we have
@@ -853,16 +880,16 @@
 
 void __init vmi_init(void)
 {
-	if (!vmi_rom)
+	if (!vmi_rom.rom_signature)
 		probe_vmi_rom();
 	else
-		check_vmi_rom(vmi_rom);
+		check_vmi_rom(&vmi_rom);
 
 	/* In case probing for or validating the ROM failed, basil */
-	if (!vmi_rom)
+	if (!vmi_rom.rom_signature)
 		return;
 
-	reserve_top_address(-vmi_rom->virtual_top);
+	reserve_top_address(-vmi_rom.virtual_top);
 
 #ifdef CONFIG_X86_IO_APIC
 	/* This is virtual hardware; timer routing is wired correctly */
@@ -874,7 +901,7 @@
 {
 	unsigned long flags;
 
-	if (!vmi_rom)
+	if (!vmi_rom.rom_signature)
 		return;
 
 	local_irq_save(flags);
diff -uriN linux-2.6.32.43/arch/x86/kernel/vmlinux.lds.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/vmlinux.lds.S
--- linux-2.6.32.43/arch/x86/kernel/vmlinux.lds.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/vmlinux.lds.S	2011-07-15 05:51:11.000000000 -0500
@@ -26,6 +26,13 @@
 #include <asm/page_types.h>
 #include <asm/cache.h>
 #include <asm/boot.h>
+#include <asm/segment.h>
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+#define __KERNEL_TEXT_OFFSET	(LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR)
+#else
+#define __KERNEL_TEXT_OFFSET	0
+#endif
 
 #undef i386     /* in case the preprocessor is a 32bit one */
 
@@ -34,40 +41,53 @@
 #ifdef CONFIG_X86_32
 OUTPUT_ARCH(i386)
 ENTRY(phys_startup_32)
-jiffies = jiffies_64;
 #else
 OUTPUT_ARCH(i386:x86-64)
 ENTRY(phys_startup_64)
-jiffies_64 = jiffies;
 #endif
 
 PHDRS {
 	text PT_LOAD FLAGS(5);          /* R_E */
-	data PT_LOAD FLAGS(7);          /* RWE */
+#ifdef CONFIG_X86_32
+	module PT_LOAD FLAGS(5);        /* R_E */
+#endif
+#ifdef CONFIG_XEN
+	rodata PT_LOAD FLAGS(5);        /* R_E */
+#else
+	rodata PT_LOAD FLAGS(4);        /* R__ */
+#endif
+	data PT_LOAD FLAGS(6);          /* RW_ */
 #ifdef CONFIG_X86_64
 	user PT_LOAD FLAGS(5);          /* R_E */
+#endif
+	init.begin PT_LOAD FLAGS(6);    /* RW_ */
 #ifdef CONFIG_SMP
 	percpu PT_LOAD FLAGS(6);        /* RW_ */
 #endif
+	text.init PT_LOAD FLAGS(5);     /* R_E */
+	text.exit PT_LOAD FLAGS(5);     /* R_E */
 	init PT_LOAD FLAGS(7);          /* RWE */
-#endif
 	note PT_NOTE FLAGS(0);          /* ___ */
 }
 
 SECTIONS
 {
 #ifdef CONFIG_X86_32
-        . = LOAD_OFFSET + LOAD_PHYSICAL_ADDR;
-        phys_startup_32 = startup_32 - LOAD_OFFSET;
+	. = LOAD_OFFSET + ____LOAD_PHYSICAL_ADDR;
 #else
-        . = __START_KERNEL;
-        phys_startup_64 = startup_64 - LOAD_OFFSET;
+	. = __START_KERNEL;
 #endif
 
 	/* Text and read-only data */
-	.text :  AT(ADDR(.text) - LOAD_OFFSET) {
-		_text = .;
+	.text (. - __KERNEL_TEXT_OFFSET): AT(ADDR(.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
 		/* bootstrapping code */
+#ifdef CONFIG_X86_32
+		phys_startup_32 = startup_32 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
+#else
+		phys_startup_64 = startup_64 - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
+#endif
+		__LOAD_PHYSICAL_ADDR = . - LOAD_OFFSET + __KERNEL_TEXT_OFFSET;
+		_text = .;
 		HEAD_TEXT
 #ifdef CONFIG_X86_32
 		. = ALIGN(PAGE_SIZE);
@@ -82,28 +102,71 @@
 		IRQENTRY_TEXT
 		*(.fixup)
 		*(.gnu.warning)
-		/* End of text section */
-		_etext = .;
 	} :text = 0x9090
 
-	NOTES :text :note
+	. += __KERNEL_TEXT_OFFSET;
+
+#ifdef CONFIG_X86_32
+	. = ALIGN(PAGE_SIZE);
+	.vmi.rom : AT(ADDR(.vmi.rom) - LOAD_OFFSET) {
+		*(.vmi.rom)
+	} :module
+
+	. = ALIGN(PAGE_SIZE);
+	.module.text : AT(ADDR(.module.text) - LOAD_OFFSET) {
+
+#if defined(CONFIG_PAX_KERNEXEC) && defined(CONFIG_MODULES)
+		MODULES_EXEC_VADDR = .;
+		BYTE(0)
+		. += (CONFIG_PAX_KERNEXEC_MODULE_TEXT * 1024 * 1024);
+		. = ALIGN(HPAGE_SIZE);
+		MODULES_EXEC_END = . - 1;
+#endif
+
+	} :module
+#endif
 
-	EXCEPTION_TABLE(16) :text = 0x9090
+	.text.end : AT(ADDR(.text.end) - LOAD_OFFSET) {
+		/* End of text section */
+		_etext = . - __KERNEL_TEXT_OFFSET;
+	}
+
+#ifdef CONFIG_X86_32
+	. = ALIGN(PAGE_SIZE);
+	.rodata.page_aligned : AT(ADDR(.rodata.page_aligned) - LOAD_OFFSET) {
+		*(.idt)
+		. = ALIGN(PAGE_SIZE);
+		*(.empty_zero_page)
+		*(.swapper_pg_fixmap)
+		*(.swapper_pg_pmd)
+		*(.swapper_pg_dir)
+		*(.trampoline_pg_dir)
+	} :rodata
+#endif
+
+	. = ALIGN(PAGE_SIZE);
+	NOTES :rodata :note
+
+	EXCEPTION_TABLE(16) :rodata
 
 	RO_DATA(PAGE_SIZE)
 
 	/* Data */
 	.data : AT(ADDR(.data) - LOAD_OFFSET) {
+
+#ifdef CONFIG_PAX_KERNEXEC
+		. = ALIGN(HPAGE_SIZE);
+#else
+		. = ALIGN(PAGE_SIZE);
+#endif
+
 		/* Start of data section */
 		_sdata = .;
 
 		/* init_task */
 		INIT_TASK_DATA(THREAD_SIZE)
 
-#ifdef CONFIG_X86_32
-		/* 32 bit has nosave before _edata */
 		NOSAVE_DATA
-#endif
 
 		PAGE_ALIGNED_DATA(PAGE_SIZE)
 
@@ -112,6 +175,8 @@
 		DATA_DATA
 		CONSTRUCTORS
 
+		jiffies = jiffies_64;
+
 		/* rarely changed data like cpu maps */
 		READ_MOSTLY_DATA(CONFIG_X86_INTERNODE_CACHE_BYTES)
 
@@ -166,12 +231,6 @@
 	}
 	vgetcpu_mode = VVIRT(.vgetcpu_mode);
 
-	. = ALIGN(CONFIG_X86_L1_CACHE_BYTES);
-	.jiffies : AT(VLOAD(.jiffies)) {
-		*(.jiffies)
-	}
-	jiffies = VVIRT(.jiffies);
-
 	.vsyscall_3 ADDR(.vsyscall_0) + 3072: AT(VLOAD(.vsyscall_3)) {
 		*(.vsyscall_3)
 	}
@@ -187,12 +246,19 @@
 #endif /* CONFIG_X86_64 */
 
 	/* Init code and data - will be freed after init */
-	. = ALIGN(PAGE_SIZE);
 	.init.begin : AT(ADDR(.init.begin) - LOAD_OFFSET) {
+		BYTE(0)
+
+#ifdef CONFIG_PAX_KERNEXEC
+		. = ALIGN(HPAGE_SIZE);
+#else
+		. = ALIGN(PAGE_SIZE);
+#endif
+
 		__init_begin = .; /* paired with __init_end */
-	}
+	} :init.begin
 
-#if defined(CONFIG_X86_64) && defined(CONFIG_SMP)
+#ifdef CONFIG_SMP
 	/*
 	 * percpu offsets are zero-based on SMP.  PERCPU_VADDR() changes the
 	 * output PHDR, so the next output section - .init.text - should
@@ -201,12 +267,27 @@
 	PERCPU_VADDR(0, :percpu)
 #endif
 
-	INIT_TEXT_SECTION(PAGE_SIZE)
-#ifdef CONFIG_X86_64
-	:init
-#endif
+	. = ALIGN(PAGE_SIZE);
+	init_begin = .;
+	.init.text (. - __KERNEL_TEXT_OFFSET): AT(init_begin - LOAD_OFFSET) {
+		VMLINUX_SYMBOL(_sinittext) = .;
+		INIT_TEXT
+		VMLINUX_SYMBOL(_einittext) = .;
+		. = ALIGN(PAGE_SIZE);
+	} :text.init
 
-	INIT_DATA_SECTION(16)
+	/*
+	 * .exit.text is discard at runtime, not link time, to deal with
+	 *  references from .altinstructions and .eh_frame
+	 */
+	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET + __KERNEL_TEXT_OFFSET) {
+		EXIT_TEXT
+		. = ALIGN(16);
+	} :text.exit
+	. = init_begin + SIZEOF(.init.text) + SIZEOF(.exit.text);
+
+	. = ALIGN(PAGE_SIZE);
+	INIT_DATA_SECTION(16) :init
 
 	.x86_cpu_dev.init : AT(ADDR(.x86_cpu_dev.init) - LOAD_OFFSET) {
 		__x86_cpu_dev_start = .;
@@ -232,19 +313,11 @@
 		*(.altinstr_replacement)
 	}
 
-	/*
-	 * .exit.text is discard at runtime, not link time, to deal with
-	 *  references from .altinstructions and .eh_frame
-	 */
-	.exit.text : AT(ADDR(.exit.text) - LOAD_OFFSET) {
-		EXIT_TEXT
-	}
-
 	.exit.data : AT(ADDR(.exit.data) - LOAD_OFFSET) {
 		EXIT_DATA
 	}
 
-#if !defined(CONFIG_X86_64) || !defined(CONFIG_SMP)
+#ifndef CONFIG_SMP
 	PERCPU(PAGE_SIZE)
 #endif
 
@@ -267,12 +340,6 @@
 		. = ALIGN(PAGE_SIZE);
 	}
 
-#ifdef CONFIG_X86_64
-	.data_nosave : AT(ADDR(.data_nosave) - LOAD_OFFSET) {
-		NOSAVE_DATA
-	}
-#endif
-
 	/* BSS */
 	. = ALIGN(PAGE_SIZE);
 	.bss : AT(ADDR(.bss) - LOAD_OFFSET) {
@@ -288,6 +355,7 @@
 		__brk_base = .;
 		. += 64 * 1024;		/* 64k alignment slop space */
 		*(.brk_reservation)	/* areas brk users have reserved */
+		. = ALIGN(HPAGE_SIZE);
 		__brk_limit = .;
 	}
 
@@ -316,13 +384,12 @@
  * for the boot processor.
  */
 #define INIT_PER_CPU(x) init_per_cpu__##x = per_cpu__##x + __per_cpu_load
-INIT_PER_CPU(gdt_page);
 INIT_PER_CPU(irq_stack_union);
 
 /*
  * Build-time check on the image size:
  */
-. = ASSERT((_end - _text <= KERNEL_IMAGE_SIZE),
+. = ASSERT((_end - _text - __KERNEL_TEXT_OFFSET <= KERNEL_IMAGE_SIZE),
 	   "kernel image bigger than KERNEL_IMAGE_SIZE");
 
 #ifdef CONFIG_SMP
diff -uriN linux-2.6.32.43/arch/x86/kernel/vsyscall_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/vsyscall_64.c
--- linux-2.6.32.43/arch/x86/kernel/vsyscall_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/vsyscall_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -80,6 +80,7 @@
 
 	write_seqlock_irqsave(&vsyscall_gtod_data.lock, flags);
 	/* copy vsyscall data */
+	strlcpy(vsyscall_gtod_data.clock.name, clock->name, sizeof vsyscall_gtod_data.clock.name);
 	vsyscall_gtod_data.clock.vread = clock->vread;
 	vsyscall_gtod_data.clock.cycle_last = clock->cycle_last;
 	vsyscall_gtod_data.clock.mask = clock->mask;
@@ -203,7 +204,7 @@
 	   We do this here because otherwise user space would do it on
 	   its own in a likely inferior way (no access to jiffies).
 	   If you don't like it pass NULL. */
-	if (tcache && tcache->blob[0] == (j = __jiffies)) {
+	if (tcache && tcache->blob[0] == (j = jiffies)) {
 		p = tcache->blob[1];
 	} else if (__vgetcpu_mode == VGETCPU_RDTSCP) {
 		/* Load per CPU data from RDTSCP */
diff -uriN linux-2.6.32.43/arch/x86/kernel/x8664_ksyms_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/x8664_ksyms_64.c
--- linux-2.6.32.43/arch/x86/kernel/x8664_ksyms_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/x8664_ksyms_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -30,8 +30,6 @@
 
 EXPORT_SYMBOL(copy_user_generic);
 EXPORT_SYMBOL(__copy_user_nocache);
-EXPORT_SYMBOL(copy_from_user);
-EXPORT_SYMBOL(copy_to_user);
 EXPORT_SYMBOL(__copy_from_user_inatomic);
 
 EXPORT_SYMBOL(copy_page);
diff -uriN linux-2.6.32.43/arch/x86/kernel/xsave.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/xsave.c
--- linux-2.6.32.43/arch/x86/kernel/xsave.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kernel/xsave.c	2011-07-15 05:51:11.000000000 -0500
@@ -54,7 +54,7 @@
 	    fx_sw_user->xstate_size > fx_sw_user->extended_size)
 		return -1;
 
-	err = __get_user(magic2, (__u32 *) (((void *)fpstate) +
+	err = __get_user(magic2, (__u32 __user *) (((void __user *)fpstate) +
 					    fx_sw_user->extended_size -
 					    FP_XSTATE_MAGIC2_SIZE));
 	/*
@@ -196,7 +196,7 @@
 	 * the other extended state.
 	 */
 	xrstor_state(init_xstate_buf, pcntxt_mask & ~XSTATE_FPSSE);
-	return fxrstor_checking((__force struct i387_fxsave_struct *)buf);
+	return fxrstor_checking((struct i387_fxsave_struct __user *)buf);
 }
 
 /*
@@ -228,7 +228,7 @@
 	if (task_thread_info(tsk)->status & TS_XSAVE)
 		err = restore_user_xstate(buf);
 	else
-		err = fxrstor_checking((__force struct i387_fxsave_struct *)
+		err = fxrstor_checking((struct i387_fxsave_struct __user *)
 				       buf);
 	if (unlikely(err)) {
 		/*
diff -uriN linux-2.6.32.43/arch/x86/kvm/emulate.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/emulate.c
--- linux-2.6.32.43/arch/x86/kvm/emulate.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/emulate.c	2011-07-15 05:51:11.000000000 -0500
@@ -81,8 +81,8 @@
 #define Src2CL      (1<<29)
 #define Src2ImmByte (2<<29)
 #define Src2One     (3<<29)
-#define Src2Imm16   (4<<29)
-#define Src2Mask    (7<<29)
+#define Src2Imm16   (4U<<29)
+#define Src2Mask    (7U<<29)
 
 enum {
 	Group1_80, Group1_81, Group1_82, Group1_83,
@@ -411,6 +411,7 @@
 
 #define ____emulate_2op(_op, _src, _dst, _eflags, _x, _y, _suffix)	\
 	do {								\
+		unsigned long _tmp;					\
 		__asm__ __volatile__ (					\
 			_PRE_EFLAGS("0", "4", "2")			\
 			_op _suffix " %"_x"3,%1; "			\
@@ -424,8 +425,6 @@
 /* Raw emulation: instruction has two explicit operands. */
 #define __emulate_2op_nobyte(_op,_src,_dst,_eflags,_wx,_wy,_lx,_ly,_qx,_qy) \
 	do {								\
-		unsigned long _tmp;					\
-									\
 		switch ((_dst).bytes) {					\
 		case 2:							\
 			____emulate_2op(_op,_src,_dst,_eflags,_wx,_wy,"w"); \
@@ -441,7 +440,6 @@
 
 #define __emulate_2op(_op,_src,_dst,_eflags,_bx,_by,_wx,_wy,_lx,_ly,_qx,_qy) \
 	do {								     \
-		unsigned long _tmp;					     \
 		switch ((_dst).bytes) {				             \
 		case 1:							     \
 			____emulate_2op(_op,_src,_dst,_eflags,_bx,_by,"b");  \
diff -uriN linux-2.6.32.43/arch/x86/kvm/lapic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/lapic.c
--- linux-2.6.32.43/arch/x86/kvm/lapic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/lapic.c	2011-07-15 05:51:11.000000000 -0500
@@ -52,7 +52,7 @@
 #define APIC_BUS_CYCLE_NS 1
 
 /* #define apic_debug(fmt,arg...) printk(KERN_WARNING fmt,##arg) */
-#define apic_debug(fmt, arg...)
+#define apic_debug(fmt, arg...) do {} while (0)
 
 #define APIC_LVT_NUM			6
 /* 14 is the version for Xeon and Pentium 8.4.8*/
diff -uriN linux-2.6.32.43/arch/x86/kvm/paging_tmpl.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/paging_tmpl.h
--- linux-2.6.32.43/arch/x86/kvm/paging_tmpl.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/paging_tmpl.h	2011-07-15 05:51:11.000000000 -0500
@@ -416,6 +416,8 @@
 	int level = PT_PAGE_TABLE_LEVEL;
 	unsigned long mmu_seq;
 
+	pax_track_stack();
+
 	pgprintk("%s: addr %lx err %x\n", __func__, addr, error_code);
 	kvm_mmu_audit(vcpu, "pre page fault");
 
diff -uriN linux-2.6.32.43/arch/x86/kvm/svm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/svm.c
--- linux-2.6.32.43/arch/x86/kvm/svm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/svm.c	2011-07-15 05:51:11.000000000 -0500
@@ -2483,9 +2483,12 @@
 static void reload_tss(struct kvm_vcpu *vcpu)
 {
 	int cpu = raw_smp_processor_id();
-
 	struct svm_cpu_data *svm_data = per_cpu(svm_data, cpu);
+
+	pax_open_kernel();
 	svm_data->tss_desc->type = 9; /* available 32/64-bit TSS */
+	pax_close_kernel();
+
 	load_TR_desc();
 }
 
@@ -2946,7 +2949,7 @@
 	return true;
 }
 
-static struct kvm_x86_ops svm_x86_ops = {
+static const struct kvm_x86_ops svm_x86_ops = {
 	.cpu_has_kvm_support = has_svm,
 	.disabled_by_bios = is_disabled,
 	.hardware_setup = svm_hardware_setup,
diff -uriN linux-2.6.32.43/arch/x86/kvm/vmx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/vmx.c
--- linux-2.6.32.43/arch/x86/kvm/vmx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/vmx.c	2011-07-15 05:51:11.000000000 -0500
@@ -570,7 +570,11 @@
 
 	kvm_get_gdt(&gdt);
 	descs = (void *)gdt.base;
+
+	pax_open_kernel();
 	descs[GDT_ENTRY_TSS].type = 9; /* available TSS */
+	pax_close_kernel();
+
 	load_TR_desc();
 }
 
@@ -1409,8 +1413,11 @@
 	if (!cpu_has_vmx_flexpriority())
 		flexpriority_enabled = 0;
 
-	if (!cpu_has_vmx_tpr_shadow())
-		kvm_x86_ops->update_cr8_intercept = NULL;
+	if (!cpu_has_vmx_tpr_shadow()) {
+		pax_open_kernel();
+		*(void **)&kvm_x86_ops->update_cr8_intercept = NULL;
+		pax_close_kernel();
+	}
 
 	if (enable_ept && !cpu_has_vmx_ept_2m_page())
 		kvm_disable_largepages();
@@ -2361,7 +2368,7 @@
 	vmcs_writel(HOST_IDTR_BASE, dt.base);   /* 22.2.4 */
 
 	asm("mov $.Lkvm_vmx_return, %0" : "=r"(kvm_vmx_return));
-	vmcs_writel(HOST_RIP, kvm_vmx_return); /* 22.2.5 */
+	vmcs_writel(HOST_RIP, ktla_ktva(kvm_vmx_return)); /* 22.2.5 */
 	vmcs_write32(VM_EXIT_MSR_STORE_COUNT, 0);
 	vmcs_write32(VM_EXIT_MSR_LOAD_COUNT, 0);
 	vmcs_write32(VM_ENTRY_MSR_LOAD_COUNT, 0);
@@ -3717,6 +3724,12 @@
 		"jmp .Lkvm_vmx_return \n\t"
 		".Llaunched: " __ex(ASM_VMX_VMRESUME) "\n\t"
 		".Lkvm_vmx_return: "
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+		"ljmp %[cs],$.Lkvm_vmx_return2\n\t"
+		".Lkvm_vmx_return2: "
+#endif
+
 		/* Save guest registers, load host registers, keep flags */
 		"xchg %0,     (%%"R"sp) \n\t"
 		"mov %%"R"ax, %c[rax](%0) \n\t"
@@ -3763,8 +3776,13 @@
 		[r15]"i"(offsetof(struct vcpu_vmx, vcpu.arch.regs[VCPU_REGS_R15])),
 #endif
 		[cr2]"i"(offsetof(struct vcpu_vmx, vcpu.arch.cr2))
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+		,[cs]"i"(__KERNEL_CS)
+#endif
+
 	      : "cc", "memory"
-		, R"bx", R"di", R"si"
+		, R"ax", R"bx", R"di", R"si"
 #ifdef CONFIG_X86_64
 		, "r8", "r9", "r10", "r11", "r12", "r13", "r14", "r15"
 #endif
@@ -3781,7 +3799,16 @@
 	if (vmx->rmode.irq.pending)
 		fixup_rmode_irq(vmx);
 
-	asm("mov %0, %%ds; mov %0, %%es" : : "r"(__USER_DS));
+	asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r"(__KERNEL_DS));
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+	loadsegment(fs, __KERNEL_PERCPU);
+#endif
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	__set_fs(current_thread_info()->addr_limit);
+#endif
+
 	vmx->launched = 1;
 
 	vmx_complete_interrupts(vmx);
@@ -3956,7 +3983,7 @@
 	return false;
 }
 
-static struct kvm_x86_ops vmx_x86_ops = {
+static const struct kvm_x86_ops vmx_x86_ops = {
 	.cpu_has_kvm_support = cpu_has_kvm_support,
 	.disabled_by_bios = vmx_disabled_by_bios,
 	.hardware_setup = hardware_setup,
diff -uriN linux-2.6.32.43/arch/x86/kvm/x86.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/x86.c
--- linux-2.6.32.43/arch/x86/kvm/x86.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/kvm/x86.c	2011-07-15 05:51:11.000000000 -0500
@@ -82,7 +82,7 @@
 static int kvm_dev_ioctl_get_supported_cpuid(struct kvm_cpuid2 *cpuid,
 				    struct kvm_cpuid_entry2 __user *entries);
 
-struct kvm_x86_ops *kvm_x86_ops;
+const struct kvm_x86_ops *kvm_x86_ops;
 EXPORT_SYMBOL_GPL(kvm_x86_ops);
 
 int ignore_msrs = 0;
@@ -1430,15 +1430,20 @@
 				     struct kvm_cpuid2 *cpuid,
 				     struct kvm_cpuid_entry2 __user *entries)
 {
-	int r;
+	int r, i;
 
 	r = -E2BIG;
 	if (cpuid->nent > KVM_MAX_CPUID_ENTRIES)
 		goto out;
 	r = -EFAULT;
-	if (copy_from_user(&vcpu->arch.cpuid_entries, entries,
-			   cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
+	if (!access_ok(VERIFY_READ, entries, cpuid->nent * sizeof(struct kvm_cpuid_entry2)))
 		goto out;
+	for (i = 0; i < cpuid->nent; ++i) {
+		struct kvm_cpuid_entry2 cpuid_entry;
+		if (__copy_from_user(&cpuid_entry, entries + i, sizeof(cpuid_entry)))
+			goto out;
+		vcpu->arch.cpuid_entries[i] = cpuid_entry;
+	}
 	vcpu->arch.cpuid_nent = cpuid->nent;
 	kvm_apic_set_version(vcpu);
 	return 0;
@@ -1451,16 +1456,20 @@
 				     struct kvm_cpuid2 *cpuid,
 				     struct kvm_cpuid_entry2 __user *entries)
 {
-	int r;
+	int r, i;
 
 	vcpu_load(vcpu);
 	r = -E2BIG;
 	if (cpuid->nent < vcpu->arch.cpuid_nent)
 		goto out;
 	r = -EFAULT;
-	if (copy_to_user(entries, &vcpu->arch.cpuid_entries,
-			 vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
+	if (!access_ok(VERIFY_WRITE, entries, vcpu->arch.cpuid_nent * sizeof(struct kvm_cpuid_entry2)))
 		goto out;
+	for (i = 0; i < vcpu->arch.cpuid_nent; ++i) {
+		struct kvm_cpuid_entry2 cpuid_entry = vcpu->arch.cpuid_entries[i];
+		if (__copy_to_user(entries + i, &cpuid_entry, sizeof(cpuid_entry)))
+			goto out;
+	}
 	return 0;
 
 out:
@@ -1678,7 +1687,7 @@
 static int kvm_vcpu_ioctl_interrupt(struct kvm_vcpu *vcpu,
 				    struct kvm_interrupt *irq)
 {
-	if (irq->irq < 0 || irq->irq >= 256)
+	if (irq->irq >= 256)
 		return -EINVAL;
 	if (irqchip_in_kernel(vcpu->kvm))
 		return -ENXIO;
@@ -3260,10 +3269,10 @@
         .notifier_call  = kvmclock_cpufreq_notifier
 };
 
-int kvm_arch_init(void *opaque)
+int kvm_arch_init(const void *opaque)
 {
 	int r, cpu;
-	struct kvm_x86_ops *ops = (struct kvm_x86_ops *)opaque;
+	const struct kvm_x86_ops *ops = (const struct kvm_x86_ops *)opaque;
 
 	if (kvm_x86_ops) {
 		printk(KERN_ERR "kvm: already loaded the other module\n");
diff -uriN linux-2.6.32.43/arch/x86/lib/atomic64_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/atomic64_32.c
--- linux-2.6.32.43/arch/x86/lib/atomic64_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/atomic64_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -25,6 +25,12 @@
 }
 EXPORT_SYMBOL(atomic64_cmpxchg);
 
+u64 atomic64_cmpxchg_unchecked(atomic64_unchecked_t *ptr, u64 old_val, u64 new_val)
+{
+	return cmpxchg8b(&ptr->counter, old_val, new_val);
+}
+EXPORT_SYMBOL(atomic64_cmpxchg_unchecked);
+
 /**
  * atomic64_xchg - xchg atomic64 variable
  * @ptr:      pointer to type atomic64_t
@@ -56,6 +62,36 @@
 EXPORT_SYMBOL(atomic64_xchg);
 
 /**
+ * atomic64_xchg_unchecked - xchg atomic64 variable
+ * @ptr:      pointer to type atomic64_unchecked_t
+ * @new_val:  value to assign
+ *
+ * Atomically xchgs the value of @ptr to @new_val and returns
+ * the old value.
+ */
+u64 atomic64_xchg_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
+{
+	/*
+	 * Try first with a (possibly incorrect) assumption about
+	 * what we have there. We'll do two loops most likely,
+	 * but we'll get an ownership MESI transaction straight away
+	 * instead of a read transaction followed by a
+	 * flush-for-ownership transaction:
+	 */
+	u64 old_val, real_val = 0;
+
+	do {
+		old_val = real_val;
+
+		real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
+
+	} while (real_val != old_val);
+
+	return old_val;
+}
+EXPORT_SYMBOL(atomic64_xchg_unchecked);
+
+/**
  * atomic64_set - set atomic64 variable
  * @ptr:      pointer to type atomic64_t
  * @new_val:  value to assign
@@ -69,7 +105,19 @@
 EXPORT_SYMBOL(atomic64_set);
 
 /**
-EXPORT_SYMBOL(atomic64_read);
+ * atomic64_unchecked_set - set atomic64 variable
+ * @ptr:      pointer to type atomic64_unchecked_t
+ * @new_val:  value to assign
+ *
+ * Atomically sets the value of @ptr to @new_val.
+ */
+void atomic64_set_unchecked(atomic64_unchecked_t *ptr, u64 new_val)
+{
+	atomic64_xchg_unchecked(ptr, new_val);
+}
+EXPORT_SYMBOL(atomic64_set_unchecked);
+
+/**
  * atomic64_add_return - add and return
  * @delta: integer value to add
  * @ptr:   pointer to type atomic64_t
@@ -99,24 +147,72 @@
 }
 EXPORT_SYMBOL(atomic64_add_return);
 
+/**
+ * atomic64_add_return_unchecked - add and return
+ * @delta: integer value to add
+ * @ptr:   pointer to type atomic64_unchecked_t
+ *
+ * Atomically adds @delta to @ptr and returns @delta + *@ptr
+ */
+noinline u64 atomic64_add_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
+{
+	/*
+	 * Try first with a (possibly incorrect) assumption about
+	 * what we have there. We'll do two loops most likely,
+	 * but we'll get an ownership MESI transaction straight away
+	 * instead of a read transaction followed by a
+	 * flush-for-ownership transaction:
+	 */
+	u64 old_val, new_val, real_val = 0;
+
+	do {
+		old_val = real_val;
+		new_val = old_val + delta;
+
+		real_val = atomic64_cmpxchg_unchecked(ptr, old_val, new_val);
+
+	} while (real_val != old_val);
+
+	return new_val;
+}
+EXPORT_SYMBOL(atomic64_add_return_unchecked);
+
 u64 atomic64_sub_return(u64 delta, atomic64_t *ptr)
 {
 	return atomic64_add_return(-delta, ptr);
 }
 EXPORT_SYMBOL(atomic64_sub_return);
 
+u64 atomic64_sub_return_unchecked(u64 delta, atomic64_unchecked_t *ptr)
+{
+	return atomic64_add_return_unchecked(-delta, ptr);
+}
+EXPORT_SYMBOL(atomic64_sub_return_unchecked);
+
 u64 atomic64_inc_return(atomic64_t *ptr)
 {
 	return atomic64_add_return(1, ptr);
 }
 EXPORT_SYMBOL(atomic64_inc_return);
 
+u64 atomic64_inc_return_unchecked(atomic64_unchecked_t *ptr)
+{
+	return atomic64_add_return_unchecked(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_inc_return_unchecked);
+
 u64 atomic64_dec_return(atomic64_t *ptr)
 {
 	return atomic64_sub_return(1, ptr);
 }
 EXPORT_SYMBOL(atomic64_dec_return);
 
+u64 atomic64_dec_return_unchecked(atomic64_unchecked_t *ptr)
+{
+	return atomic64_sub_return_unchecked(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_dec_return_unchecked);
+
 /**
  * atomic64_add - add integer to atomic64 variable
  * @delta: integer value to add
@@ -131,6 +227,19 @@
 EXPORT_SYMBOL(atomic64_add);
 
 /**
+ * atomic64_add_unchecked - add integer to atomic64 variable
+ * @delta: integer value to add
+ * @ptr:   pointer to type atomic64_unchecked_t
+ *
+ * Atomically adds @delta to @ptr.
+ */
+void atomic64_add_unchecked(u64 delta, atomic64_unchecked_t *ptr)
+{
+	atomic64_add_return_unchecked(delta, ptr);
+}
+EXPORT_SYMBOL(atomic64_add_unchecked);
+
+/**
  * atomic64_sub - subtract the atomic64 variable
  * @delta: integer value to subtract
  * @ptr:   pointer to type atomic64_t
@@ -144,6 +253,19 @@
 EXPORT_SYMBOL(atomic64_sub);
 
 /**
+ * atomic64_sub_unchecked - subtract the atomic64 variable
+ * @delta: integer value to subtract
+ * @ptr:   pointer to type atomic64_unchecked_t
+ *
+ * Atomically subtracts @delta from @ptr.
+ */
+void atomic64_sub_unchecked(u64 delta, atomic64_unchecked_t *ptr)
+{
+	atomic64_add_unchecked(-delta, ptr);
+}
+EXPORT_SYMBOL(atomic64_sub_unchecked);
+
+/**
  * atomic64_sub_and_test - subtract value from variable and test result
  * @delta: integer value to subtract
  * @ptr:   pointer to type atomic64_t
@@ -173,6 +295,18 @@
 EXPORT_SYMBOL(atomic64_inc);
 
 /**
+ * atomic64_inc_unchecked - increment atomic64 variable
+ * @ptr: pointer to type atomic64_unchecked_t
+ *
+ * Atomically increments @ptr by 1.
+ */
+void atomic64_inc_unchecked(atomic64_unchecked_t *ptr)
+{
+	atomic64_add_unchecked(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_inc_unchecked);
+
+/**
  * atomic64_dec - decrement atomic64 variable
  * @ptr: pointer to type atomic64_t
  *
@@ -185,6 +319,18 @@
 EXPORT_SYMBOL(atomic64_dec);
 
 /**
+ * atomic64_dec_unchecked - decrement atomic64 variable
+ * @ptr: pointer to type atomic64_unchecked_t
+ *
+ * Atomically decrements @ptr by 1.
+ */
+void atomic64_dec_unchecked(atomic64_unchecked_t *ptr)
+{
+	atomic64_sub_unchecked(1, ptr);
+}
+EXPORT_SYMBOL(atomic64_dec_unchecked);
+
+/**
  * atomic64_dec_and_test - decrement and test
  * @ptr: pointer to type atomic64_t
  *
diff -uriN linux-2.6.32.43/arch/x86/lib/checksum_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/checksum_32.S
--- linux-2.6.32.43/arch/x86/lib/checksum_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/checksum_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -28,7 +28,8 @@
 #include <linux/linkage.h>
 #include <asm/dwarf2.h>
 #include <asm/errno.h>
-				
+#include <asm/segment.h>
+
 /*
  * computes a partial checksum, e.g. for TCP/UDP fragments
  */
@@ -304,9 +305,28 @@
 
 #define ARGBASE 16		
 #define FP		12
-		
-ENTRY(csum_partial_copy_generic)
+
+ENTRY(csum_partial_copy_generic_to_user)
 	CFI_STARTPROC
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pushl %gs
+	CFI_ADJUST_CFA_OFFSET 4
+	popl %es
+	CFI_ADJUST_CFA_OFFSET -4
+	jmp csum_partial_copy_generic
+#endif
+
+ENTRY(csum_partial_copy_generic_from_user)
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pushl %gs
+	CFI_ADJUST_CFA_OFFSET 4
+	popl %ds
+	CFI_ADJUST_CFA_OFFSET -4
+#endif
+
+ENTRY(csum_partial_copy_generic)
 	subl  $4,%esp	
 	CFI_ADJUST_CFA_OFFSET 4
 	pushl %edi
@@ -331,7 +351,7 @@
 	jmp 4f
 SRC(1:	movw (%esi), %bx	)
 	addl $2, %esi
-DST(	movw %bx, (%edi)	)
+DST(	movw %bx, %es:(%edi)	)
 	addl $2, %edi
 	addw %bx, %ax	
 	adcl $0, %eax
@@ -343,30 +363,30 @@
 SRC(1:	movl (%esi), %ebx	)
 SRC(	movl 4(%esi), %edx	)
 	adcl %ebx, %eax
-DST(	movl %ebx, (%edi)	)
+DST(	movl %ebx, %es:(%edi)	)
 	adcl %edx, %eax
-DST(	movl %edx, 4(%edi)	)
+DST(	movl %edx, %es:4(%edi)	)
 
 SRC(	movl 8(%esi), %ebx	)
 SRC(	movl 12(%esi), %edx	)
 	adcl %ebx, %eax
-DST(	movl %ebx, 8(%edi)	)
+DST(	movl %ebx, %es:8(%edi)	)
 	adcl %edx, %eax
-DST(	movl %edx, 12(%edi)	)
+DST(	movl %edx, %es:12(%edi)	)
 
 SRC(	movl 16(%esi), %ebx 	)
 SRC(	movl 20(%esi), %edx	)
 	adcl %ebx, %eax
-DST(	movl %ebx, 16(%edi)	)
+DST(	movl %ebx, %es:16(%edi)	)
 	adcl %edx, %eax
-DST(	movl %edx, 20(%edi)	)
+DST(	movl %edx, %es:20(%edi)	)
 
 SRC(	movl 24(%esi), %ebx	)
 SRC(	movl 28(%esi), %edx	)
 	adcl %ebx, %eax
-DST(	movl %ebx, 24(%edi)	)
+DST(	movl %ebx, %es:24(%edi)	)
 	adcl %edx, %eax
-DST(	movl %edx, 28(%edi)	)
+DST(	movl %edx, %es:28(%edi)	)
 
 	lea 32(%esi), %esi
 	lea 32(%edi), %edi
@@ -380,7 +400,7 @@
 	shrl $2, %edx			# This clears CF
 SRC(3:	movl (%esi), %ebx	)
 	adcl %ebx, %eax
-DST(	movl %ebx, (%edi)	)
+DST(	movl %ebx, %es:(%edi)	)
 	lea 4(%esi), %esi
 	lea 4(%edi), %edi
 	dec %edx
@@ -392,12 +412,12 @@
 	jb 5f
 SRC(	movw (%esi), %cx	)
 	leal 2(%esi), %esi
-DST(	movw %cx, (%edi)	)
+DST(	movw %cx, %es:(%edi)	)
 	leal 2(%edi), %edi
 	je 6f
 	shll $16,%ecx
 SRC(5:	movb (%esi), %cl	)
-DST(	movb %cl, (%edi)	)
+DST(	movb %cl, %es:(%edi)	)
 6:	addl %ecx, %eax
 	adcl $0, %eax
 7:
@@ -408,7 +428,7 @@
 
 6001:
 	movl ARGBASE+20(%esp), %ebx	# src_err_ptr
-	movl $-EFAULT, (%ebx)
+	movl $-EFAULT, %ss:(%ebx)
 
 	# zero the complete destination - computing the rest
 	# is too much work 
@@ -421,11 +441,19 @@
 
 6002:
 	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
-	movl $-EFAULT,(%ebx)
+	movl $-EFAULT,%ss:(%ebx)
 	jmp 5000b
 
 .previous
 
+	pushl %ss
+	CFI_ADJUST_CFA_OFFSET 4
+	popl %ds
+	CFI_ADJUST_CFA_OFFSET -4
+	pushl %ss
+	CFI_ADJUST_CFA_OFFSET 4
+	popl %es
+	CFI_ADJUST_CFA_OFFSET -4
 	popl %ebx
 	CFI_ADJUST_CFA_OFFSET -4
 	CFI_RESTORE ebx
@@ -439,26 +467,47 @@
 	CFI_ADJUST_CFA_OFFSET -4
 	ret	
 	CFI_ENDPROC
-ENDPROC(csum_partial_copy_generic)
+ENDPROC(csum_partial_copy_generic_to_user)
 
 #else
 
 /* Version for PentiumII/PPro */
 
 #define ROUND1(x) \
+	nop; nop; nop;				\
 	SRC(movl x(%esi), %ebx	)	;	\
 	addl %ebx, %eax			;	\
-	DST(movl %ebx, x(%edi)	)	; 
+	DST(movl %ebx, %es:x(%edi))	;
 
 #define ROUND(x) \
+	nop; nop; nop;				\
 	SRC(movl x(%esi), %ebx	)	;	\
 	adcl %ebx, %eax			;	\
-	DST(movl %ebx, x(%edi)	)	;
+	DST(movl %ebx, %es:x(%edi))	;
 
 #define ARGBASE 12
-		
-ENTRY(csum_partial_copy_generic)
+
+ENTRY(csum_partial_copy_generic_to_user)
 	CFI_STARTPROC
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pushl %gs
+	CFI_ADJUST_CFA_OFFSET 4
+	popl %es
+	CFI_ADJUST_CFA_OFFSET -4
+	jmp csum_partial_copy_generic
+#endif
+
+ENTRY(csum_partial_copy_generic_from_user)
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pushl %gs
+	CFI_ADJUST_CFA_OFFSET 4
+	popl %ds
+	CFI_ADJUST_CFA_OFFSET -4
+#endif
+
+ENTRY(csum_partial_copy_generic)
 	pushl %ebx
 	CFI_ADJUST_CFA_OFFSET 4
 	CFI_REL_OFFSET ebx, 0
@@ -482,7 +531,7 @@
 	subl %ebx, %edi  
 	lea  -1(%esi),%edx
 	andl $-32,%edx
-	lea 3f(%ebx,%ebx), %ebx
+	lea 3f(%ebx,%ebx,2), %ebx
 	testl %esi, %esi 
 	jmp *%ebx
 1:	addl $64,%esi
@@ -503,19 +552,19 @@
 	jb 5f
 SRC(	movw (%esi), %dx         )
 	leal 2(%esi), %esi
-DST(	movw %dx, (%edi)         )
+DST(	movw %dx, %es:(%edi)     )
 	leal 2(%edi), %edi
 	je 6f
 	shll $16,%edx
 5:
 SRC(	movb (%esi), %dl         )
-DST(	movb %dl, (%edi)         )
+DST(	movb %dl, %es:(%edi)     )
 6:	addl %edx, %eax
 	adcl $0, %eax
 7:
 .section .fixup, "ax"
 6001:	movl	ARGBASE+20(%esp), %ebx	# src_err_ptr	
-	movl $-EFAULT, (%ebx)
+	movl $-EFAULT, %ss:(%ebx)
 	# zero the complete destination (computing the rest is too much work)
 	movl ARGBASE+8(%esp),%edi	# dst
 	movl ARGBASE+12(%esp),%ecx	# len
@@ -523,10 +572,21 @@
 	rep; stosb
 	jmp 7b
 6002:	movl ARGBASE+24(%esp), %ebx	# dst_err_ptr
-	movl $-EFAULT, (%ebx)
+	movl $-EFAULT, %ss:(%ebx)
 	jmp  7b			
 .previous				
 
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	pushl %ss
+	CFI_ADJUST_CFA_OFFSET 4
+	popl %ds
+	CFI_ADJUST_CFA_OFFSET -4
+	pushl %ss
+	CFI_ADJUST_CFA_OFFSET 4
+	popl %es
+	CFI_ADJUST_CFA_OFFSET -4
+#endif
+
 	popl %esi
 	CFI_ADJUST_CFA_OFFSET -4
 	CFI_RESTORE esi
@@ -538,7 +598,7 @@
 	CFI_RESTORE ebx
 	ret
 	CFI_ENDPROC
-ENDPROC(csum_partial_copy_generic)
+ENDPROC(csum_partial_copy_generic_to_user)
 				
 #undef ROUND
 #undef ROUND1		
diff -uriN linux-2.6.32.43/arch/x86/lib/clear_page_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/clear_page_64.S
--- linux-2.6.32.43/arch/x86/lib/clear_page_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/clear_page_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -43,7 +43,7 @@
 
 #include <asm/cpufeature.h>
 
-	.section .altinstr_replacement,"ax"
+	.section .altinstr_replacement,"a"
 1:	.byte 0xeb					/* jmp <disp8> */
 	.byte (clear_page_c - clear_page) - (2f - 1b)	/* offset */
 2:
diff -uriN linux-2.6.32.43/arch/x86/lib/copy_page_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/copy_page_64.S
--- linux-2.6.32.43/arch/x86/lib/copy_page_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/copy_page_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -104,7 +104,7 @@
 
 #include <asm/cpufeature.h>
 
-	.section .altinstr_replacement,"ax"
+	.section .altinstr_replacement,"a"
 1:	.byte 0xeb					/* jmp <disp8> */
 	.byte (copy_page_c - copy_page) - (2f - 1b)	/* offset */
 2:
diff -uriN linux-2.6.32.43/arch/x86/lib/copy_user_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/copy_user_64.S
--- linux-2.6.32.43/arch/x86/lib/copy_user_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/copy_user_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -15,13 +15,14 @@
 #include <asm/asm-offsets.h>
 #include <asm/thread_info.h>
 #include <asm/cpufeature.h>
+#include <asm/pgtable.h>
 
 	.macro ALTERNATIVE_JUMP feature,orig,alt
 0:
 	.byte 0xe9	/* 32bit jump */
 	.long \orig-1f	/* by default jump to orig */
 1:
-	.section .altinstr_replacement,"ax"
+	.section .altinstr_replacement,"a"
 2:	.byte 0xe9			/* near jump with 32bit immediate */
 	.long \alt-1b /* offset */   /* or alternatively to alt */
 	.previous
@@ -64,49 +65,19 @@
 #endif
 	.endm
 
-/* Standard copy_to_user with segment limit checking */
-ENTRY(copy_to_user)
-	CFI_STARTPROC
-	GET_THREAD_INFO(%rax)
-	movq %rdi,%rcx
-	addq %rdx,%rcx
-	jc bad_to_user
-	cmpq TI_addr_limit(%rax),%rcx
-	ja bad_to_user
-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-	CFI_ENDPROC
-ENDPROC(copy_to_user)
-
-/* Standard copy_from_user with segment limit checking */
-ENTRY(copy_from_user)
-	CFI_STARTPROC
-	GET_THREAD_INFO(%rax)
-	movq %rsi,%rcx
-	addq %rdx,%rcx
-	jc bad_from_user
-	cmpq TI_addr_limit(%rax),%rcx
-	ja bad_from_user
-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-	CFI_ENDPROC
-ENDPROC(copy_from_user)
-
 ENTRY(copy_user_generic)
 	CFI_STARTPROC
 	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
 	CFI_ENDPROC
 ENDPROC(copy_user_generic)
 
-ENTRY(__copy_from_user_inatomic)
-	CFI_STARTPROC
-	ALTERNATIVE_JUMP X86_FEATURE_REP_GOOD,copy_user_generic_unrolled,copy_user_generic_string
-	CFI_ENDPROC
-ENDPROC(__copy_from_user_inatomic)
-
 	.section .fixup,"ax"
 	/* must zero dest */
 ENTRY(bad_from_user)
 bad_from_user:
 	CFI_STARTPROC
+	testl %edx,%edx
+	js bad_to_user
 	movl %edx,%ecx
 	xorl %eax,%eax
 	rep
diff -uriN linux-2.6.32.43/arch/x86/lib/copy_user_nocache_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/copy_user_nocache_64.S
--- linux-2.6.32.43/arch/x86/lib/copy_user_nocache_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/copy_user_nocache_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -14,6 +14,7 @@
 #include <asm/current.h>
 #include <asm/asm-offsets.h>
 #include <asm/thread_info.h>
+#include <asm/pgtable.h>
 
 	.macro ALIGN_DESTINATION
 #ifdef FIX_ALIGNMENT
@@ -50,6 +51,15 @@
  */
 ENTRY(__copy_user_nocache)
 	CFI_STARTPROC
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	mov $PAX_USER_SHADOW_BASE,%rcx
+	cmp %rcx,%rsi
+	jae 1f
+	add %rcx,%rsi
+1:
+#endif
+
 	cmpl $8,%edx
 	jb 20f		/* less then 8 bytes, go to byte copy loop */
 	ALIGN_DESTINATION
diff -uriN linux-2.6.32.43/arch/x86/lib/csum-wrappers_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/csum-wrappers_64.c
--- linux-2.6.32.43/arch/x86/lib/csum-wrappers_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/csum-wrappers_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -52,6 +52,12 @@
 			len -= 2;
 		}
 	}
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
+		src += PAX_USER_SHADOW_BASE;
+#endif
+
 	isum = csum_partial_copy_generic((__force const void *)src,
 				dst, len, isum, errp, NULL);
 	if (unlikely(*errp))
@@ -105,6 +111,12 @@
 	}
 
 	*errp = 0;
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if ((unsigned long)dst < PAX_USER_SHADOW_BASE)
+		dst += PAX_USER_SHADOW_BASE;
+#endif
+
 	return csum_partial_copy_generic(src, (void __force *)dst,
 					 len, isum, NULL, errp);
 }
diff -uriN linux-2.6.32.43/arch/x86/lib/getuser.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/getuser.S
--- linux-2.6.32.43/arch/x86/lib/getuser.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/getuser.S	2011-07-15 05:51:11.000000000 -0500
@@ -33,14 +33,35 @@
 #include <asm/asm-offsets.h>
 #include <asm/thread_info.h>
 #include <asm/asm.h>
+#include <asm/segment.h>
+#include <asm/pgtable.h>
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
+#define __copyuser_seg gs;
+#else
+#define __copyuser_seg
+#endif
 
 	.text
 ENTRY(__get_user_1)
 	CFI_STARTPROC
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
 	GET_THREAD_INFO(%_ASM_DX)
 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
 	jae bad_get_user
-1:	movzb (%_ASM_AX),%edx
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
+	cmp %_ASM_DX,%_ASM_AX
+	jae 1234f
+	add %_ASM_DX,%_ASM_AX
+1234:
+#endif
+
+#endif
+
+1:	__copyuser_seg movzb (%_ASM_AX),%edx
 	xor %eax,%eax
 	ret
 	CFI_ENDPROC
@@ -49,11 +70,24 @@
 ENTRY(__get_user_2)
 	CFI_STARTPROC
 	add $1,%_ASM_AX
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
 	jc bad_get_user
 	GET_THREAD_INFO(%_ASM_DX)
 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
 	jae bad_get_user
-2:	movzwl -1(%_ASM_AX),%edx
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
+	cmp %_ASM_DX,%_ASM_AX
+	jae 1234f
+	add %_ASM_DX,%_ASM_AX
+1234:
+#endif
+
+#endif
+
+2:	__copyuser_seg movzwl -1(%_ASM_AX),%edx
 	xor %eax,%eax
 	ret
 	CFI_ENDPROC
@@ -62,11 +96,24 @@
 ENTRY(__get_user_4)
 	CFI_STARTPROC
 	add $3,%_ASM_AX
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
 	jc bad_get_user
 	GET_THREAD_INFO(%_ASM_DX)
 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
 	jae bad_get_user
-3:	mov -3(%_ASM_AX),%edx
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
+	cmp %_ASM_DX,%_ASM_AX
+	jae 1234f
+	add %_ASM_DX,%_ASM_AX
+1234:
+#endif
+
+#endif
+
+3:	__copyuser_seg mov -3(%_ASM_AX),%edx
 	xor %eax,%eax
 	ret
 	CFI_ENDPROC
@@ -80,6 +127,15 @@
 	GET_THREAD_INFO(%_ASM_DX)
 	cmp TI_addr_limit(%_ASM_DX),%_ASM_AX
 	jae	bad_get_user
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	mov $PAX_USER_SHADOW_BASE,%_ASM_DX
+	cmp %_ASM_DX,%_ASM_AX
+	jae 1234f
+	add %_ASM_DX,%_ASM_AX
+1234:
+#endif
+
 4:	movq -7(%_ASM_AX),%_ASM_DX
 	xor %eax,%eax
 	ret
diff -uriN linux-2.6.32.43/arch/x86/lib/memcpy_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/memcpy_64.S
--- linux-2.6.32.43/arch/x86/lib/memcpy_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/memcpy_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -128,7 +128,7 @@
 	 * It is also a lot simpler. Use this when possible:
 	 */
 
-	.section .altinstr_replacement, "ax"
+	.section .altinstr_replacement, "a"
 1:	.byte 0xeb				/* jmp <disp8> */
 	.byte (memcpy_c - memcpy) - (2f - 1b)	/* offset */
 2:
diff -uriN linux-2.6.32.43/arch/x86/lib/memset_64.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/memset_64.S
--- linux-2.6.32.43/arch/x86/lib/memset_64.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/memset_64.S	2011-07-15 05:51:11.000000000 -0500
@@ -118,7 +118,7 @@
 
 #include <asm/cpufeature.h>
 
-	.section .altinstr_replacement,"ax"
+	.section .altinstr_replacement,"a"
 1:	.byte 0xeb				/* jmp <disp8> */
 	.byte (memset_c - memset) - (2f - 1b)	/* offset */
 2:
diff -uriN linux-2.6.32.43/arch/x86/lib/mmx_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/mmx_32.c
--- linux-2.6.32.43/arch/x86/lib/mmx_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/mmx_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -29,6 +29,7 @@
 {
 	void *p;
 	int i;
+	unsigned long cr0;
 
 	if (unlikely(in_interrupt()))
 		return __memcpy(to, from, len);
@@ -39,44 +40,72 @@
 	kernel_fpu_begin();
 
 	__asm__ __volatile__ (
-		"1: prefetch (%0)\n"		/* This set is 28 bytes */
-		"   prefetch 64(%0)\n"
-		"   prefetch 128(%0)\n"
-		"   prefetch 192(%0)\n"
-		"   prefetch 256(%0)\n"
+		"1: prefetch (%1)\n"		/* This set is 28 bytes */
+		"   prefetch 64(%1)\n"
+		"   prefetch 128(%1)\n"
+		"   prefetch 192(%1)\n"
+		"   prefetch 256(%1)\n"
 		"2:  \n"
 		".section .fixup, \"ax\"\n"
-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
+		"3:  \n"
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %%cr0, %0\n"
+		"   movl %0, %%eax\n"
+		"   andl $0xFFFEFFFF, %%eax\n"
+		"   movl %%eax, %%cr0\n"
+#endif
+
+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %0, %%cr0\n"
+#endif
+
 		"   jmp 2b\n"
 		".previous\n"
 			_ASM_EXTABLE(1b, 3b)
-			: : "r" (from));
+			: "=&r" (cr0) : "r" (from) : "ax");
 
 	for ( ; i > 5; i--) {
 		__asm__ __volatile__ (
-		"1:  prefetch 320(%0)\n"
-		"2:  movq (%0), %%mm0\n"
-		"  movq 8(%0), %%mm1\n"
-		"  movq 16(%0), %%mm2\n"
-		"  movq 24(%0), %%mm3\n"
-		"  movq %%mm0, (%1)\n"
-		"  movq %%mm1, 8(%1)\n"
-		"  movq %%mm2, 16(%1)\n"
-		"  movq %%mm3, 24(%1)\n"
-		"  movq 32(%0), %%mm0\n"
-		"  movq 40(%0), %%mm1\n"
-		"  movq 48(%0), %%mm2\n"
-		"  movq 56(%0), %%mm3\n"
-		"  movq %%mm0, 32(%1)\n"
-		"  movq %%mm1, 40(%1)\n"
-		"  movq %%mm2, 48(%1)\n"
-		"  movq %%mm3, 56(%1)\n"
+		"1:  prefetch 320(%1)\n"
+		"2:  movq (%1), %%mm0\n"
+		"  movq 8(%1), %%mm1\n"
+		"  movq 16(%1), %%mm2\n"
+		"  movq 24(%1), %%mm3\n"
+		"  movq %%mm0, (%2)\n"
+		"  movq %%mm1, 8(%2)\n"
+		"  movq %%mm2, 16(%2)\n"
+		"  movq %%mm3, 24(%2)\n"
+		"  movq 32(%1), %%mm0\n"
+		"  movq 40(%1), %%mm1\n"
+		"  movq 48(%1), %%mm2\n"
+		"  movq 56(%1), %%mm3\n"
+		"  movq %%mm0, 32(%2)\n"
+		"  movq %%mm1, 40(%2)\n"
+		"  movq %%mm2, 48(%2)\n"
+		"  movq %%mm3, 56(%2)\n"
 		".section .fixup, \"ax\"\n"
-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
+		"3:\n"
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %%cr0, %0\n"
+		"   movl %0, %%eax\n"
+		"   andl $0xFFFEFFFF, %%eax\n"
+		"   movl %%eax, %%cr0\n"
+#endif
+
+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %0, %%cr0\n"
+#endif
+
 		"   jmp 2b\n"
 		".previous\n"
 			_ASM_EXTABLE(1b, 3b)
-			: : "r" (from), "r" (to) : "memory");
+			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
 
 		from += 64;
 		to += 64;
@@ -158,6 +187,7 @@
 static void fast_copy_page(void *to, void *from)
 {
 	int i;
+	unsigned long cr0;
 
 	kernel_fpu_begin();
 
@@ -166,42 +196,70 @@
 	 * but that is for later. -AV
 	 */
 	__asm__ __volatile__(
-		"1: prefetch (%0)\n"
-		"   prefetch 64(%0)\n"
-		"   prefetch 128(%0)\n"
-		"   prefetch 192(%0)\n"
-		"   prefetch 256(%0)\n"
+		"1: prefetch (%1)\n"
+		"   prefetch 64(%1)\n"
+		"   prefetch 128(%1)\n"
+		"   prefetch 192(%1)\n"
+		"   prefetch 256(%1)\n"
 		"2:  \n"
 		".section .fixup, \"ax\"\n"
-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
+		"3:  \n"
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %%cr0, %0\n"
+		"   movl %0, %%eax\n"
+		"   andl $0xFFFEFFFF, %%eax\n"
+		"   movl %%eax, %%cr0\n"
+#endif
+
+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %0, %%cr0\n"
+#endif
+
 		"   jmp 2b\n"
 		".previous\n"
-			_ASM_EXTABLE(1b, 3b) : : "r" (from));
+			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
 
 	for (i = 0; i < (4096-320)/64; i++) {
 		__asm__ __volatile__ (
-		"1: prefetch 320(%0)\n"
-		"2: movq (%0), %%mm0\n"
-		"   movntq %%mm0, (%1)\n"
-		"   movq 8(%0), %%mm1\n"
-		"   movntq %%mm1, 8(%1)\n"
-		"   movq 16(%0), %%mm2\n"
-		"   movntq %%mm2, 16(%1)\n"
-		"   movq 24(%0), %%mm3\n"
-		"   movntq %%mm3, 24(%1)\n"
-		"   movq 32(%0), %%mm4\n"
-		"   movntq %%mm4, 32(%1)\n"
-		"   movq 40(%0), %%mm5\n"
-		"   movntq %%mm5, 40(%1)\n"
-		"   movq 48(%0), %%mm6\n"
-		"   movntq %%mm6, 48(%1)\n"
-		"   movq 56(%0), %%mm7\n"
-		"   movntq %%mm7, 56(%1)\n"
+		"1: prefetch 320(%1)\n"
+		"2: movq (%1), %%mm0\n"
+		"   movntq %%mm0, (%2)\n"
+		"   movq 8(%1), %%mm1\n"
+		"   movntq %%mm1, 8(%2)\n"
+		"   movq 16(%1), %%mm2\n"
+		"   movntq %%mm2, 16(%2)\n"
+		"   movq 24(%1), %%mm3\n"
+		"   movntq %%mm3, 24(%2)\n"
+		"   movq 32(%1), %%mm4\n"
+		"   movntq %%mm4, 32(%2)\n"
+		"   movq 40(%1), %%mm5\n"
+		"   movntq %%mm5, 40(%2)\n"
+		"   movq 48(%1), %%mm6\n"
+		"   movntq %%mm6, 48(%2)\n"
+		"   movq 56(%1), %%mm7\n"
+		"   movntq %%mm7, 56(%2)\n"
 		".section .fixup, \"ax\"\n"
-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
+		"3:\n"
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %%cr0, %0\n"
+		"   movl %0, %%eax\n"
+		"   andl $0xFFFEFFFF, %%eax\n"
+		"   movl %%eax, %%cr0\n"
+#endif
+
+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %0, %%cr0\n"
+#endif
+
 		"   jmp 2b\n"
 		".previous\n"
-		_ASM_EXTABLE(1b, 3b) : : "r" (from), "r" (to) : "memory");
+		_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
 
 		from += 64;
 		to += 64;
@@ -280,47 +338,76 @@
 static void fast_copy_page(void *to, void *from)
 {
 	int i;
+	unsigned long cr0;
 
 	kernel_fpu_begin();
 
 	__asm__ __volatile__ (
-		"1: prefetch (%0)\n"
-		"   prefetch 64(%0)\n"
-		"   prefetch 128(%0)\n"
-		"   prefetch 192(%0)\n"
-		"   prefetch 256(%0)\n"
+		"1: prefetch (%1)\n"
+		"   prefetch 64(%1)\n"
+		"   prefetch 128(%1)\n"
+		"   prefetch 192(%1)\n"
+		"   prefetch 256(%1)\n"
 		"2:  \n"
 		".section .fixup, \"ax\"\n"
-		"3: movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
+		"3:  \n"
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %%cr0, %0\n"
+		"   movl %0, %%eax\n"
+		"   andl $0xFFFEFFFF, %%eax\n"
+		"   movl %%eax, %%cr0\n"
+#endif
+
+		"   movw $0x1AEB, 1b\n"	/* jmp on 26 bytes */
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %0, %%cr0\n"
+#endif
+
 		"   jmp 2b\n"
 		".previous\n"
-			_ASM_EXTABLE(1b, 3b) : : "r" (from));
+			_ASM_EXTABLE(1b, 3b) : "=&r" (cr0) : "r" (from) : "ax");
 
 	for (i = 0; i < 4096/64; i++) {
 		__asm__ __volatile__ (
-		"1: prefetch 320(%0)\n"
-		"2: movq (%0), %%mm0\n"
-		"   movq 8(%0), %%mm1\n"
-		"   movq 16(%0), %%mm2\n"
-		"   movq 24(%0), %%mm3\n"
-		"   movq %%mm0, (%1)\n"
-		"   movq %%mm1, 8(%1)\n"
-		"   movq %%mm2, 16(%1)\n"
-		"   movq %%mm3, 24(%1)\n"
-		"   movq 32(%0), %%mm0\n"
-		"   movq 40(%0), %%mm1\n"
-		"   movq 48(%0), %%mm2\n"
-		"   movq 56(%0), %%mm3\n"
-		"   movq %%mm0, 32(%1)\n"
-		"   movq %%mm1, 40(%1)\n"
-		"   movq %%mm2, 48(%1)\n"
-		"   movq %%mm3, 56(%1)\n"
+		"1: prefetch 320(%1)\n"
+		"2: movq (%1), %%mm0\n"
+		"   movq 8(%1), %%mm1\n"
+		"   movq 16(%1), %%mm2\n"
+		"   movq 24(%1), %%mm3\n"
+		"   movq %%mm0, (%2)\n"
+		"   movq %%mm1, 8(%2)\n"
+		"   movq %%mm2, 16(%2)\n"
+		"   movq %%mm3, 24(%2)\n"
+		"   movq 32(%1), %%mm0\n"
+		"   movq 40(%1), %%mm1\n"
+		"   movq 48(%1), %%mm2\n"
+		"   movq 56(%1), %%mm3\n"
+		"   movq %%mm0, 32(%2)\n"
+		"   movq %%mm1, 40(%2)\n"
+		"   movq %%mm2, 48(%2)\n"
+		"   movq %%mm3, 56(%2)\n"
 		".section .fixup, \"ax\"\n"
-		"3: movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
+		"3:\n"
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %%cr0, %0\n"
+		"   movl %0, %%eax\n"
+		"   andl $0xFFFEFFFF, %%eax\n"
+		"   movl %%eax, %%cr0\n"
+#endif
+
+		"   movw $0x05EB, 1b\n"	/* jmp on 5 bytes */
+
+#ifdef CONFIG_PAX_KERNEXEC
+		"   movl %0, %%cr0\n"
+#endif
+
 		"   jmp 2b\n"
 		".previous\n"
 			_ASM_EXTABLE(1b, 3b)
-			: : "r" (from), "r" (to) : "memory");
+			: "=&r" (cr0) : "r" (from), "r" (to) : "memory", "ax");
 
 		from += 64;
 		to += 64;
diff -uriN linux-2.6.32.43/arch/x86/lib/putuser.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/putuser.S
--- linux-2.6.32.43/arch/x86/lib/putuser.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/putuser.S	2011-07-15 05:51:11.000000000 -0500
@@ -15,7 +15,8 @@
 #include <asm/thread_info.h>
 #include <asm/errno.h>
 #include <asm/asm.h>
-
+#include <asm/segment.h>
+#include <asm/pgtable.h>
 
 /*
  * __put_user_X
@@ -29,52 +30,119 @@
  * as they get called from within inline assembly.
  */
 
-#define ENTER	CFI_STARTPROC ; \
-		GET_THREAD_INFO(%_ASM_BX)
+#define ENTER	CFI_STARTPROC
 #define EXIT	ret ; \
 		CFI_ENDPROC
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+#define _DEST %_ASM_CX,%_ASM_BX
+#else
+#define _DEST %_ASM_CX
+#endif
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_MEMORY_UDEREF)
+#define __copyuser_seg gs;
+#else
+#define __copyuser_seg
+#endif
+
 .text
 ENTRY(__put_user_1)
 	ENTER
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
+	GET_THREAD_INFO(%_ASM_BX)
 	cmp TI_addr_limit(%_ASM_BX),%_ASM_CX
 	jae bad_put_user
-1:	movb %al,(%_ASM_CX)
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
+	cmp %_ASM_BX,%_ASM_CX
+	jb 1234f
+	xor %ebx,%ebx
+1234:
+#endif
+
+#endif
+
+1:	__copyuser_seg movb %al,(_DEST)
 	xor %eax,%eax
 	EXIT
 ENDPROC(__put_user_1)
 
 ENTRY(__put_user_2)
 	ENTER
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
+	GET_THREAD_INFO(%_ASM_BX)
 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
 	sub $1,%_ASM_BX
 	cmp %_ASM_BX,%_ASM_CX
 	jae bad_put_user
-2:	movw %ax,(%_ASM_CX)
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
+	cmp %_ASM_BX,%_ASM_CX
+	jb 1234f
+	xor %ebx,%ebx
+1234:
+#endif
+
+#endif
+
+2:	__copyuser_seg movw %ax,(_DEST)
 	xor %eax,%eax
 	EXIT
 ENDPROC(__put_user_2)
 
 ENTRY(__put_user_4)
 	ENTER
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
+	GET_THREAD_INFO(%_ASM_BX)
 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
 	sub $3,%_ASM_BX
 	cmp %_ASM_BX,%_ASM_CX
 	jae bad_put_user
-3:	movl %eax,(%_ASM_CX)
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
+	cmp %_ASM_BX,%_ASM_CX
+	jb 1234f
+	xor %ebx,%ebx
+1234:
+#endif
+
+#endif
+
+3:	__copyuser_seg movl %eax,(_DEST)
 	xor %eax,%eax
 	EXIT
 ENDPROC(__put_user_4)
 
 ENTRY(__put_user_8)
 	ENTER
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_MEMORY_UDEREF)
+	GET_THREAD_INFO(%_ASM_BX)
 	mov TI_addr_limit(%_ASM_BX),%_ASM_BX
 	sub $7,%_ASM_BX
 	cmp %_ASM_BX,%_ASM_CX
 	jae bad_put_user
-4:	mov %_ASM_AX,(%_ASM_CX)
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	mov $PAX_USER_SHADOW_BASE,%_ASM_BX
+	cmp %_ASM_BX,%_ASM_CX
+	jb 1234f
+	xor %ebx,%ebx
+1234:
+#endif
+
+#endif
+
+4:	__copyuser_seg mov %_ASM_AX,(_DEST)
 #ifdef CONFIG_X86_32
-5:	movl %edx,4(%_ASM_CX)
+5:	__copyuser_seg movl %edx,4(_DEST)
 #endif
 	xor %eax,%eax
 	EXIT
diff -uriN linux-2.6.32.43/arch/x86/lib/usercopy_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/usercopy_32.c
--- linux-2.6.32.43/arch/x86/lib/usercopy_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/usercopy_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -43,7 +43,7 @@
 	__asm__ __volatile__(						   \
 		"	testl %1,%1\n"					   \
 		"	jz 2f\n"					   \
-		"0:	lodsb\n"					   \
+		"0:	"__copyuser_seg"lodsb\n"			   \
 		"	stosb\n"					   \
 		"	testb %%al,%%al\n"				   \
 		"	jz 1f\n"					   \
@@ -128,10 +128,12 @@
 	int __d0;							\
 	might_fault();							\
 	__asm__ __volatile__(						\
+		__COPYUSER_SET_ES					\
 		"0:	rep; stosl\n"					\
 		"	movl %2,%0\n"					\
 		"1:	rep; stosb\n"					\
 		"2:\n"							\
+		__COPYUSER_RESTORE_ES					\
 		".section .fixup,\"ax\"\n"				\
 		"3:	lea 0(%2,%0,4),%0\n"				\
 		"	jmp 2b\n"					\
@@ -200,6 +202,7 @@
 	might_fault();
 
 	__asm__ __volatile__(
+		__COPYUSER_SET_ES
 		"	testl %0, %0\n"
 		"	jz 3f\n"
 		"	andl %0,%%ecx\n"
@@ -208,6 +211,7 @@
 		"	subl %%ecx,%0\n"
 		"	addl %0,%%eax\n"
 		"1:\n"
+		__COPYUSER_RESTORE_ES
 		".section .fixup,\"ax\"\n"
 		"2:	xorl %%eax,%%eax\n"
 		"	jmp 1b\n"
@@ -227,7 +231,7 @@
 
 #ifdef CONFIG_X86_INTEL_USERCOPY
 static unsigned long
-__copy_user_intel(void __user *to, const void *from, unsigned long size)
+__generic_copy_to_user_intel(void __user *to, const void *from, unsigned long size)
 {
 	int d0, d1;
 	__asm__ __volatile__(
@@ -239,36 +243,36 @@
 		       "       .align 2,0x90\n"
 		       "3:     movl 0(%4), %%eax\n"
 		       "4:     movl 4(%4), %%edx\n"
-		       "5:     movl %%eax, 0(%3)\n"
-		       "6:     movl %%edx, 4(%3)\n"
+		       "5:     "__copyuser_seg" movl %%eax, 0(%3)\n"
+		       "6:     "__copyuser_seg" movl %%edx, 4(%3)\n"
 		       "7:     movl 8(%4), %%eax\n"
 		       "8:     movl 12(%4),%%edx\n"
-		       "9:     movl %%eax, 8(%3)\n"
-		       "10:    movl %%edx, 12(%3)\n"
+		       "9:     "__copyuser_seg" movl %%eax, 8(%3)\n"
+		       "10:    "__copyuser_seg" movl %%edx, 12(%3)\n"
 		       "11:    movl 16(%4), %%eax\n"
 		       "12:    movl 20(%4), %%edx\n"
-		       "13:    movl %%eax, 16(%3)\n"
-		       "14:    movl %%edx, 20(%3)\n"
+		       "13:    "__copyuser_seg" movl %%eax, 16(%3)\n"
+		       "14:    "__copyuser_seg" movl %%edx, 20(%3)\n"
 		       "15:    movl 24(%4), %%eax\n"
 		       "16:    movl 28(%4), %%edx\n"
-		       "17:    movl %%eax, 24(%3)\n"
-		       "18:    movl %%edx, 28(%3)\n"
+		       "17:    "__copyuser_seg" movl %%eax, 24(%3)\n"
+		       "18:    "__copyuser_seg" movl %%edx, 28(%3)\n"
 		       "19:    movl 32(%4), %%eax\n"
 		       "20:    movl 36(%4), %%edx\n"
-		       "21:    movl %%eax, 32(%3)\n"
-		       "22:    movl %%edx, 36(%3)\n"
+		       "21:    "__copyuser_seg" movl %%eax, 32(%3)\n"
+		       "22:    "__copyuser_seg" movl %%edx, 36(%3)\n"
 		       "23:    movl 40(%4), %%eax\n"
 		       "24:    movl 44(%4), %%edx\n"
-		       "25:    movl %%eax, 40(%3)\n"
-		       "26:    movl %%edx, 44(%3)\n"
+		       "25:    "__copyuser_seg" movl %%eax, 40(%3)\n"
+		       "26:    "__copyuser_seg" movl %%edx, 44(%3)\n"
 		       "27:    movl 48(%4), %%eax\n"
 		       "28:    movl 52(%4), %%edx\n"
-		       "29:    movl %%eax, 48(%3)\n"
-		       "30:    movl %%edx, 52(%3)\n"
+		       "29:    "__copyuser_seg" movl %%eax, 48(%3)\n"
+		       "30:    "__copyuser_seg" movl %%edx, 52(%3)\n"
 		       "31:    movl 56(%4), %%eax\n"
 		       "32:    movl 60(%4), %%edx\n"
-		       "33:    movl %%eax, 56(%3)\n"
-		       "34:    movl %%edx, 60(%3)\n"
+		       "33:    "__copyuser_seg" movl %%eax, 56(%3)\n"
+		       "34:    "__copyuser_seg" movl %%edx, 60(%3)\n"
 		       "       addl $-64, %0\n"
 		       "       addl $64, %4\n"
 		       "       addl $64, %3\n"
@@ -278,10 +282,119 @@
 		       "       shrl  $2, %0\n"
 		       "       andl  $3, %%eax\n"
 		       "       cld\n"
+		       __COPYUSER_SET_ES
 		       "99:    rep; movsl\n"
 		       "36:    movl %%eax, %0\n"
 		       "37:    rep; movsb\n"
 		       "100:\n"
+		       __COPYUSER_RESTORE_ES
+		       ".section .fixup,\"ax\"\n"
+		       "101:   lea 0(%%eax,%0,4),%0\n"
+		       "       jmp 100b\n"
+		       ".previous\n"
+		       ".section __ex_table,\"a\"\n"
+		       "       .align 4\n"
+		       "       .long 1b,100b\n"
+		       "       .long 2b,100b\n"
+		       "       .long 3b,100b\n"
+		       "       .long 4b,100b\n"
+		       "       .long 5b,100b\n"
+		       "       .long 6b,100b\n"
+		       "       .long 7b,100b\n"
+		       "       .long 8b,100b\n"
+		       "       .long 9b,100b\n"
+		       "       .long 10b,100b\n"
+		       "       .long 11b,100b\n"
+		       "       .long 12b,100b\n"
+		       "       .long 13b,100b\n"
+		       "       .long 14b,100b\n"
+		       "       .long 15b,100b\n"
+		       "       .long 16b,100b\n"
+		       "       .long 17b,100b\n"
+		       "       .long 18b,100b\n"
+		       "       .long 19b,100b\n"
+		       "       .long 20b,100b\n"
+		       "       .long 21b,100b\n"
+		       "       .long 22b,100b\n"
+		       "       .long 23b,100b\n"
+		       "       .long 24b,100b\n"
+		       "       .long 25b,100b\n"
+		       "       .long 26b,100b\n"
+		       "       .long 27b,100b\n"
+		       "       .long 28b,100b\n"
+		       "       .long 29b,100b\n"
+		       "       .long 30b,100b\n"
+		       "       .long 31b,100b\n"
+		       "       .long 32b,100b\n"
+		       "       .long 33b,100b\n"
+		       "       .long 34b,100b\n"
+		       "       .long 35b,100b\n"
+		       "       .long 36b,100b\n"
+		       "       .long 37b,100b\n"
+		       "       .long 99b,101b\n"
+		       ".previous"
+		       : "=&c"(size), "=&D" (d0), "=&S" (d1)
+		       :  "1"(to), "2"(from), "0"(size)
+		       : "eax", "edx", "memory");
+	return size;
+}
+
+static unsigned long
+__generic_copy_from_user_intel(void *to, const void __user *from, unsigned long size)
+{
+	int d0, d1;
+	__asm__ __volatile__(
+		       "       .align 2,0x90\n"
+		       "1:     "__copyuser_seg" movl 32(%4), %%eax\n"
+		       "       cmpl $67, %0\n"
+		       "       jbe 3f\n"
+		       "2:     "__copyuser_seg" movl 64(%4), %%eax\n"
+		       "       .align 2,0x90\n"
+		       "3:     "__copyuser_seg" movl 0(%4), %%eax\n"
+		       "4:     "__copyuser_seg" movl 4(%4), %%edx\n"
+		       "5:     movl %%eax, 0(%3)\n"
+		       "6:     movl %%edx, 4(%3)\n"
+		       "7:     "__copyuser_seg" movl 8(%4), %%eax\n"
+		       "8:     "__copyuser_seg" movl 12(%4),%%edx\n"
+		       "9:     movl %%eax, 8(%3)\n"
+		       "10:    movl %%edx, 12(%3)\n"
+		       "11:    "__copyuser_seg" movl 16(%4), %%eax\n"
+		       "12:    "__copyuser_seg" movl 20(%4), %%edx\n"
+		       "13:    movl %%eax, 16(%3)\n"
+		       "14:    movl %%edx, 20(%3)\n"
+		       "15:    "__copyuser_seg" movl 24(%4), %%eax\n"
+		       "16:    "__copyuser_seg" movl 28(%4), %%edx\n"
+		       "17:    movl %%eax, 24(%3)\n"
+		       "18:    movl %%edx, 28(%3)\n"
+		       "19:    "__copyuser_seg" movl 32(%4), %%eax\n"
+		       "20:    "__copyuser_seg" movl 36(%4), %%edx\n"
+		       "21:    movl %%eax, 32(%3)\n"
+		       "22:    movl %%edx, 36(%3)\n"
+		       "23:    "__copyuser_seg" movl 40(%4), %%eax\n"
+		       "24:    "__copyuser_seg" movl 44(%4), %%edx\n"
+		       "25:    movl %%eax, 40(%3)\n"
+		       "26:    movl %%edx, 44(%3)\n"
+		       "27:    "__copyuser_seg" movl 48(%4), %%eax\n"
+		       "28:    "__copyuser_seg" movl 52(%4), %%edx\n"
+		       "29:    movl %%eax, 48(%3)\n"
+		       "30:    movl %%edx, 52(%3)\n"
+		       "31:    "__copyuser_seg" movl 56(%4), %%eax\n"
+		       "32:    "__copyuser_seg" movl 60(%4), %%edx\n"
+		       "33:    movl %%eax, 56(%3)\n"
+		       "34:    movl %%edx, 60(%3)\n"
+		       "       addl $-64, %0\n"
+		       "       addl $64, %4\n"
+		       "       addl $64, %3\n"
+		       "       cmpl $63, %0\n"
+		       "       ja  1b\n"
+		       "35:    movl  %0, %%eax\n"
+		       "       shrl  $2, %0\n"
+		       "       andl  $3, %%eax\n"
+		       "       cld\n"
+		       "99:    rep; "__copyuser_seg" movsl\n"
+		       "36:    movl %%eax, %0\n"
+		       "37:    rep; "__copyuser_seg" movsb\n"
+		       "100:\n"
 		       ".section .fixup,\"ax\"\n"
 		       "101:   lea 0(%%eax,%0,4),%0\n"
 		       "       jmp 100b\n"
@@ -339,41 +452,41 @@
 	int d0, d1;
 	__asm__ __volatile__(
 		       "        .align 2,0x90\n"
-		       "0:      movl 32(%4), %%eax\n"
+		       "0:      "__copyuser_seg" movl 32(%4), %%eax\n"
 		       "        cmpl $67, %0\n"
 		       "        jbe 2f\n"
-		       "1:      movl 64(%4), %%eax\n"
+		       "1:      "__copyuser_seg" movl 64(%4), %%eax\n"
 		       "        .align 2,0x90\n"
-		       "2:      movl 0(%4), %%eax\n"
-		       "21:     movl 4(%4), %%edx\n"
+		       "2:      "__copyuser_seg" movl 0(%4), %%eax\n"
+		       "21:     "__copyuser_seg" movl 4(%4), %%edx\n"
 		       "        movl %%eax, 0(%3)\n"
 		       "        movl %%edx, 4(%3)\n"
-		       "3:      movl 8(%4), %%eax\n"
-		       "31:     movl 12(%4),%%edx\n"
+		       "3:      "__copyuser_seg" movl 8(%4), %%eax\n"
+		       "31:     "__copyuser_seg" movl 12(%4),%%edx\n"
 		       "        movl %%eax, 8(%3)\n"
 		       "        movl %%edx, 12(%3)\n"
-		       "4:      movl 16(%4), %%eax\n"
-		       "41:     movl 20(%4), %%edx\n"
+		       "4:      "__copyuser_seg" movl 16(%4), %%eax\n"
+		       "41:     "__copyuser_seg" movl 20(%4), %%edx\n"
 		       "        movl %%eax, 16(%3)\n"
 		       "        movl %%edx, 20(%3)\n"
-		       "10:     movl 24(%4), %%eax\n"
-		       "51:     movl 28(%4), %%edx\n"
+		       "10:     "__copyuser_seg" movl 24(%4), %%eax\n"
+		       "51:     "__copyuser_seg" movl 28(%4), %%edx\n"
 		       "        movl %%eax, 24(%3)\n"
 		       "        movl %%edx, 28(%3)\n"
-		       "11:     movl 32(%4), %%eax\n"
-		       "61:     movl 36(%4), %%edx\n"
+		       "11:     "__copyuser_seg" movl 32(%4), %%eax\n"
+		       "61:     "__copyuser_seg" movl 36(%4), %%edx\n"
 		       "        movl %%eax, 32(%3)\n"
 		       "        movl %%edx, 36(%3)\n"
-		       "12:     movl 40(%4), %%eax\n"
-		       "71:     movl 44(%4), %%edx\n"
+		       "12:     "__copyuser_seg" movl 40(%4), %%eax\n"
+		       "71:     "__copyuser_seg" movl 44(%4), %%edx\n"
 		       "        movl %%eax, 40(%3)\n"
 		       "        movl %%edx, 44(%3)\n"
-		       "13:     movl 48(%4), %%eax\n"
-		       "81:     movl 52(%4), %%edx\n"
+		       "13:     "__copyuser_seg" movl 48(%4), %%eax\n"
+		       "81:     "__copyuser_seg" movl 52(%4), %%edx\n"
 		       "        movl %%eax, 48(%3)\n"
 		       "        movl %%edx, 52(%3)\n"
-		       "14:     movl 56(%4), %%eax\n"
-		       "91:     movl 60(%4), %%edx\n"
+		       "14:     "__copyuser_seg" movl 56(%4), %%eax\n"
+		       "91:     "__copyuser_seg" movl 60(%4), %%edx\n"
 		       "        movl %%eax, 56(%3)\n"
 		       "        movl %%edx, 60(%3)\n"
 		       "        addl $-64, %0\n"
@@ -385,9 +498,9 @@
 		       "        shrl  $2, %0\n"
 		       "        andl $3, %%eax\n"
 		       "        cld\n"
-		       "6:      rep; movsl\n"
+		       "6:      rep; "__copyuser_seg" movsl\n"
 		       "        movl %%eax,%0\n"
-		       "7:      rep; movsb\n"
+		       "7:      rep; "__copyuser_seg" movsb\n"
 		       "8:\n"
 		       ".section .fixup,\"ax\"\n"
 		       "9:      lea 0(%%eax,%0,4),%0\n"
@@ -440,41 +553,41 @@
 
 	__asm__ __volatile__(
 	       "        .align 2,0x90\n"
-	       "0:      movl 32(%4), %%eax\n"
+	       "0:      "__copyuser_seg" movl 32(%4), %%eax\n"
 	       "        cmpl $67, %0\n"
 	       "        jbe 2f\n"
-	       "1:      movl 64(%4), %%eax\n"
+	       "1:      "__copyuser_seg" movl 64(%4), %%eax\n"
 	       "        .align 2,0x90\n"
-	       "2:      movl 0(%4), %%eax\n"
-	       "21:     movl 4(%4), %%edx\n"
+	       "2:      "__copyuser_seg" movl 0(%4), %%eax\n"
+	       "21:     "__copyuser_seg" movl 4(%4), %%edx\n"
 	       "        movnti %%eax, 0(%3)\n"
 	       "        movnti %%edx, 4(%3)\n"
-	       "3:      movl 8(%4), %%eax\n"
-	       "31:     movl 12(%4),%%edx\n"
+	       "3:      "__copyuser_seg" movl 8(%4), %%eax\n"
+	       "31:     "__copyuser_seg" movl 12(%4),%%edx\n"
 	       "        movnti %%eax, 8(%3)\n"
 	       "        movnti %%edx, 12(%3)\n"
-	       "4:      movl 16(%4), %%eax\n"
-	       "41:     movl 20(%4), %%edx\n"
+	       "4:      "__copyuser_seg" movl 16(%4), %%eax\n"
+	       "41:     "__copyuser_seg" movl 20(%4), %%edx\n"
 	       "        movnti %%eax, 16(%3)\n"
 	       "        movnti %%edx, 20(%3)\n"
-	       "10:     movl 24(%4), %%eax\n"
-	       "51:     movl 28(%4), %%edx\n"
+	       "10:     "__copyuser_seg" movl 24(%4), %%eax\n"
+	       "51:     "__copyuser_seg" movl 28(%4), %%edx\n"
 	       "        movnti %%eax, 24(%3)\n"
 	       "        movnti %%edx, 28(%3)\n"
-	       "11:     movl 32(%4), %%eax\n"
-	       "61:     movl 36(%4), %%edx\n"
+	       "11:     "__copyuser_seg" movl 32(%4), %%eax\n"
+	       "61:     "__copyuser_seg" movl 36(%4), %%edx\n"
 	       "        movnti %%eax, 32(%3)\n"
 	       "        movnti %%edx, 36(%3)\n"
-	       "12:     movl 40(%4), %%eax\n"
-	       "71:     movl 44(%4), %%edx\n"
+	       "12:     "__copyuser_seg" movl 40(%4), %%eax\n"
+	       "71:     "__copyuser_seg" movl 44(%4), %%edx\n"
 	       "        movnti %%eax, 40(%3)\n"
 	       "        movnti %%edx, 44(%3)\n"
-	       "13:     movl 48(%4), %%eax\n"
-	       "81:     movl 52(%4), %%edx\n"
+	       "13:     "__copyuser_seg" movl 48(%4), %%eax\n"
+	       "81:     "__copyuser_seg" movl 52(%4), %%edx\n"
 	       "        movnti %%eax, 48(%3)\n"
 	       "        movnti %%edx, 52(%3)\n"
-	       "14:     movl 56(%4), %%eax\n"
-	       "91:     movl 60(%4), %%edx\n"
+	       "14:     "__copyuser_seg" movl 56(%4), %%eax\n"
+	       "91:     "__copyuser_seg" movl 60(%4), %%edx\n"
 	       "        movnti %%eax, 56(%3)\n"
 	       "        movnti %%edx, 60(%3)\n"
 	       "        addl $-64, %0\n"
@@ -487,9 +600,9 @@
 	       "        shrl  $2, %0\n"
 	       "        andl $3, %%eax\n"
 	       "        cld\n"
-	       "6:      rep; movsl\n"
+	       "6:      rep; "__copyuser_seg" movsl\n"
 	       "        movl %%eax,%0\n"
-	       "7:      rep; movsb\n"
+	       "7:      rep; "__copyuser_seg" movsb\n"
 	       "8:\n"
 	       ".section .fixup,\"ax\"\n"
 	       "9:      lea 0(%%eax,%0,4),%0\n"
@@ -537,41 +650,41 @@
 
 	__asm__ __volatile__(
 	       "        .align 2,0x90\n"
-	       "0:      movl 32(%4), %%eax\n"
+	       "0:      "__copyuser_seg" movl 32(%4), %%eax\n"
 	       "        cmpl $67, %0\n"
 	       "        jbe 2f\n"
-	       "1:      movl 64(%4), %%eax\n"
+	       "1:      "__copyuser_seg" movl 64(%4), %%eax\n"
 	       "        .align 2,0x90\n"
-	       "2:      movl 0(%4), %%eax\n"
-	       "21:     movl 4(%4), %%edx\n"
+	       "2:      "__copyuser_seg" movl 0(%4), %%eax\n"
+	       "21:     "__copyuser_seg" movl 4(%4), %%edx\n"
 	       "        movnti %%eax, 0(%3)\n"
 	       "        movnti %%edx, 4(%3)\n"
-	       "3:      movl 8(%4), %%eax\n"
-	       "31:     movl 12(%4),%%edx\n"
+	       "3:      "__copyuser_seg" movl 8(%4), %%eax\n"
+	       "31:     "__copyuser_seg" movl 12(%4),%%edx\n"
 	       "        movnti %%eax, 8(%3)\n"
 	       "        movnti %%edx, 12(%3)\n"
-	       "4:      movl 16(%4), %%eax\n"
-	       "41:     movl 20(%4), %%edx\n"
+	       "4:      "__copyuser_seg" movl 16(%4), %%eax\n"
+	       "41:     "__copyuser_seg" movl 20(%4), %%edx\n"
 	       "        movnti %%eax, 16(%3)\n"
 	       "        movnti %%edx, 20(%3)\n"
-	       "10:     movl 24(%4), %%eax\n"
-	       "51:     movl 28(%4), %%edx\n"
+	       "10:     "__copyuser_seg" movl 24(%4), %%eax\n"
+	       "51:     "__copyuser_seg" movl 28(%4), %%edx\n"
 	       "        movnti %%eax, 24(%3)\n"
 	       "        movnti %%edx, 28(%3)\n"
-	       "11:     movl 32(%4), %%eax\n"
-	       "61:     movl 36(%4), %%edx\n"
+	       "11:     "__copyuser_seg" movl 32(%4), %%eax\n"
+	       "61:     "__copyuser_seg" movl 36(%4), %%edx\n"
 	       "        movnti %%eax, 32(%3)\n"
 	       "        movnti %%edx, 36(%3)\n"
-	       "12:     movl 40(%4), %%eax\n"
-	       "71:     movl 44(%4), %%edx\n"
+	       "12:     "__copyuser_seg" movl 40(%4), %%eax\n"
+	       "71:     "__copyuser_seg" movl 44(%4), %%edx\n"
 	       "        movnti %%eax, 40(%3)\n"
 	       "        movnti %%edx, 44(%3)\n"
-	       "13:     movl 48(%4), %%eax\n"
-	       "81:     movl 52(%4), %%edx\n"
+	       "13:     "__copyuser_seg" movl 48(%4), %%eax\n"
+	       "81:     "__copyuser_seg" movl 52(%4), %%edx\n"
 	       "        movnti %%eax, 48(%3)\n"
 	       "        movnti %%edx, 52(%3)\n"
-	       "14:     movl 56(%4), %%eax\n"
-	       "91:     movl 60(%4), %%edx\n"
+	       "14:     "__copyuser_seg" movl 56(%4), %%eax\n"
+	       "91:     "__copyuser_seg" movl 60(%4), %%edx\n"
 	       "        movnti %%eax, 56(%3)\n"
 	       "        movnti %%edx, 60(%3)\n"
 	       "        addl $-64, %0\n"
@@ -584,9 +697,9 @@
 	       "        shrl  $2, %0\n"
 	       "        andl $3, %%eax\n"
 	       "        cld\n"
-	       "6:      rep; movsl\n"
+	       "6:      rep; "__copyuser_seg" movsl\n"
 	       "        movl %%eax,%0\n"
-	       "7:      rep; movsb\n"
+	       "7:      rep; "__copyuser_seg" movsb\n"
 	       "8:\n"
 	       ".section .fixup,\"ax\"\n"
 	       "9:      lea 0(%%eax,%0,4),%0\n"
@@ -629,32 +742,36 @@
  */
 unsigned long __copy_user_zeroing_intel(void *to, const void __user *from,
 					unsigned long size);
-unsigned long __copy_user_intel(void __user *to, const void *from,
+unsigned long __generic_copy_to_user_intel(void __user *to, const void *from,
+					unsigned long size);
+unsigned long __generic_copy_from_user_intel(void *to, const void __user *from,
 					unsigned long size);
 unsigned long __copy_user_zeroing_intel_nocache(void *to,
 				const void __user *from, unsigned long size);
 #endif /* CONFIG_X86_INTEL_USERCOPY */
 
 /* Generic arbitrary sized copy.  */
-#define __copy_user(to, from, size)					\
+#define __copy_user(to, from, size, prefix, set, restore)		\
 do {									\
 	int __d0, __d1, __d2;						\
 	__asm__ __volatile__(						\
+		set							\
 		"	cmp  $7,%0\n"					\
 		"	jbe  1f\n"					\
 		"	movl %1,%0\n"					\
 		"	negl %0\n"					\
 		"	andl $7,%0\n"					\
 		"	subl %0,%3\n"					\
-		"4:	rep; movsb\n"					\
+		"4:	rep; "prefix"movsb\n"				\
 		"	movl %3,%0\n"					\
 		"	shrl $2,%0\n"					\
 		"	andl $3,%3\n"					\
 		"	.align 2,0x90\n"				\
-		"0:	rep; movsl\n"					\
+		"0:	rep; "prefix"movsl\n"				\
 		"	movl %3,%0\n"					\
-		"1:	rep; movsb\n"					\
+		"1:	rep; "prefix"movsb\n"				\
 		"2:\n"							\
+		restore							\
 		".section .fixup,\"ax\"\n"				\
 		"5:	addl %3,%0\n"					\
 		"	jmp 2b\n"					\
@@ -682,14 +799,14 @@
 		"	negl %0\n"					\
 		"	andl $7,%0\n"					\
 		"	subl %0,%3\n"					\
-		"4:	rep; movsb\n"					\
+		"4:	rep; "__copyuser_seg"movsb\n"			\
 		"	movl %3,%0\n"					\
 		"	shrl $2,%0\n"					\
 		"	andl $3,%3\n"					\
 		"	.align 2,0x90\n"				\
-		"0:	rep; movsl\n"					\
+		"0:	rep; "__copyuser_seg"movsl\n"			\
 		"	movl %3,%0\n"					\
-		"1:	rep; movsb\n"					\
+		"1:	rep; "__copyuser_seg"movsb\n"			\
 		"2:\n"							\
 		".section .fixup,\"ax\"\n"				\
 		"5:	addl %3,%0\n"					\
@@ -775,9 +892,9 @@
 	}
 #endif
 	if (movsl_is_ok(to, from, n))
-		__copy_user(to, from, n);
+		__copy_user(to, from, n, "", __COPYUSER_SET_ES, __COPYUSER_RESTORE_ES);
 	else
-		n = __copy_user_intel(to, from, n);
+		n = __generic_copy_to_user_intel(to, from, n);
 	return n;
 }
 EXPORT_SYMBOL(__copy_to_user_ll);
@@ -797,10 +914,9 @@
 					 unsigned long n)
 {
 	if (movsl_is_ok(to, from, n))
-		__copy_user(to, from, n);
+		__copy_user(to, from, n, __copyuser_seg, "", "");
 	else
-		n = __copy_user_intel((void __user *)to,
-				      (const void *)from, n);
+		n = __generic_copy_from_user_intel(to, from, n);
 	return n;
 }
 EXPORT_SYMBOL(__copy_from_user_ll_nozero);
@@ -827,59 +943,38 @@
 	if (n > 64 && cpu_has_xmm2)
 		n = __copy_user_intel_nocache(to, from, n);
 	else
-		__copy_user(to, from, n);
+		__copy_user(to, from, n, __copyuser_seg, "", "");
 #else
-	__copy_user(to, from, n);
+	__copy_user(to, from, n, __copyuser_seg, "", "");
 #endif
 	return n;
 }
 EXPORT_SYMBOL(__copy_from_user_ll_nocache_nozero);
 
-/**
- * copy_to_user: - Copy a block of data into user space.
- * @to:   Destination address, in user space.
- * @from: Source address, in kernel space.
- * @n:    Number of bytes to copy.
- *
- * Context: User context only.  This function may sleep.
- *
- * Copy data from kernel space to user space.
- *
- * Returns number of bytes that could not be copied.
- * On success, this will be zero.
- */
-unsigned long
-copy_to_user(void __user *to, const void *from, unsigned long n)
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+void __set_fs(mm_segment_t x)
 {
-	if (access_ok(VERIFY_WRITE, to, n))
-		n = __copy_to_user(to, from, n);
-	return n;
+	switch (x.seg) {
+	case 0:
+		loadsegment(gs, 0);
+		break;
+	case TASK_SIZE_MAX:
+		loadsegment(gs, __USER_DS);
+		break;
+	case -1UL:
+		loadsegment(gs, __KERNEL_DS);
+		break;
+	default:
+		BUG();
+	}
+	return;
 }
-EXPORT_SYMBOL(copy_to_user);
+EXPORT_SYMBOL(__set_fs);
 
-/**
- * copy_from_user: - Copy a block of data from user space.
- * @to:   Destination address, in kernel space.
- * @from: Source address, in user space.
- * @n:    Number of bytes to copy.
- *
- * Context: User context only.  This function may sleep.
- *
- * Copy data from user space to kernel space.
- *
- * Returns number of bytes that could not be copied.
- * On success, this will be zero.
- *
- * If some data could not be copied, this function will pad the copied
- * data to the requested size using zero bytes.
- */
-unsigned long
-copy_from_user(void *to, const void __user *from, unsigned long n)
+void set_fs(mm_segment_t x)
 {
-	if (access_ok(VERIFY_READ, from, n))
-		n = __copy_from_user(to, from, n);
-	else
-		memset(to, 0, n);
-	return n;
+	current_thread_info()->addr_limit = x;
+	__set_fs(x);
 }
-EXPORT_SYMBOL(copy_from_user);
+EXPORT_SYMBOL(set_fs);
+#endif
diff -uriN linux-2.6.32.43/arch/x86/lib/usercopy_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/usercopy_64.c
--- linux-2.6.32.43/arch/x86/lib/usercopy_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/lib/usercopy_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -42,6 +42,12 @@
 __strncpy_from_user(char *dst, const char __user *src, long count)
 {
 	long res;
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if ((unsigned long)src < PAX_USER_SHADOW_BASE)
+		src += PAX_USER_SHADOW_BASE;
+#endif
+
 	__do_strncpy_from_user(dst, src, count, res);
 	return res;
 }
@@ -65,6 +71,12 @@
 {
 	long __d0;
 	might_fault();
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+	if ((unsigned long)addr < PAX_USER_SHADOW_BASE)
+		addr += PAX_USER_SHADOW_BASE;
+#endif
+
 	/* no memory constraint because it doesn't change any memory gcc knows
 	   about */
 	asm volatile(
@@ -151,10 +163,18 @@
 
 unsigned long copy_in_user(void __user *to, const void __user *from, unsigned len)
 {
-	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) { 
+	if (access_ok(VERIFY_WRITE, to, len) && access_ok(VERIFY_READ, from, len)) {
+
+#ifdef CONFIG_PAX_MEMORY_UDEREF
+		if ((unsigned long)to < PAX_USER_SHADOW_BASE)
+			to += PAX_USER_SHADOW_BASE;
+		if ((unsigned long)from < PAX_USER_SHADOW_BASE)
+			from += PAX_USER_SHADOW_BASE;
+#endif
+
 		return copy_user_generic((__force void *)to, (__force void *)from, len);
-	} 
-	return len;		
+	}
+	return len;
 }
 EXPORT_SYMBOL(copy_in_user);
 
diff -uriN linux-2.6.32.43/arch/x86/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/Makefile
--- linux-2.6.32.43/arch/x86/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/Makefile	2011-07-15 05:51:11.000000000 -0500
@@ -189,3 +189,12 @@
   echo  '                  FDARGS="..."  arguments for the booted kernel'
   echo  '                  FDINITRD=file initrd for the booted kernel'
 endef
+
+define OLD_LD
+
+*** ${VERSION}.${PATCHLEVEL} PaX kernels no longer build correctly with old versions of binutils.
+*** Please upgrade your binutils to 2.18 or newer
+endef
+
+archprepare:
+	$(if $(LDFLAGS_BUILD_ID),,$(error $(OLD_LD)))
diff -uriN linux-2.6.32.43/arch/x86/mm/extable.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/extable.c
--- linux-2.6.32.43/arch/x86/mm/extable.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/extable.c	2011-07-15 05:51:11.000000000 -0500
@@ -1,14 +1,71 @@
 #include <linux/module.h>
 #include <linux/spinlock.h>
+#include <linux/sort.h>
 #include <asm/uaccess.h>
+#include <asm/pgtable.h>
 
+/*
+ * The exception table needs to be sorted so that the binary
+ * search that we use to find entries in it works properly.
+ * This is used both for the kernel exception table and for
+ * the exception tables of modules that get loaded.
+ */
+static int cmp_ex(const void *a, const void *b)
+{
+	const struct exception_table_entry *x = a, *y = b;
+
+	/* avoid overflow */
+	if (x->insn > y->insn)
+		return 1;
+	if (x->insn < y->insn)
+		return -1;
+	return 0;
+}
+
+static void swap_ex(void *a, void *b, int size)
+{
+	struct exception_table_entry t, *x = a, *y = b;
+
+	t = *x;
+
+	pax_open_kernel();
+	*x = *y;
+	*y = t;
+	pax_close_kernel();
+}
+
+void sort_extable(struct exception_table_entry *start,
+		  struct exception_table_entry *finish)
+{
+	sort(start, finish - start, sizeof(struct exception_table_entry),
+	     cmp_ex, swap_ex);
+}
+
+#ifdef CONFIG_MODULES
+/*
+ * If the exception table is sorted, any referring to the module init
+ * will be at the beginning or the end.
+ */
+void trim_init_extable(struct module *m)
+{
+	/*trim the beginning*/
+	while (m->num_exentries && within_module_init(m->extable[0].insn, m)) {
+		m->extable++;
+		m->num_exentries--;
+	}
+	/*trim the end*/
+	while (m->num_exentries &&
+		within_module_init(m->extable[m->num_exentries-1].insn, m))
+		m->num_exentries--;
+}
+#endif /* CONFIG_MODULES */
 
 int fixup_exception(struct pt_regs *regs)
 {
 	const struct exception_table_entry *fixup;
 
 #ifdef CONFIG_PNPBIOS
-	if (unlikely(SEGMENT_IS_PNP_CODE(regs->cs))) {
+	if (unlikely(!v8086_mode(regs) && SEGMENT_IS_PNP_CODE(regs->cs))) {
 		extern u32 pnp_bios_fault_eip, pnp_bios_fault_esp;
 		extern u32 pnp_bios_is_utter_crap;
 		pnp_bios_is_utter_crap = 1;
diff -uriN linux-2.6.32.43/arch/x86/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/fault.c
--- linux-2.6.32.43/arch/x86/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/fault.c	2011-07-15 05:51:11.000000000 -0500
@@ -11,10 +11,19 @@
 #include <linux/kprobes.h>		/* __kprobes, ...		*/
 #include <linux/mmiotrace.h>		/* kmmio_handler, ...		*/
 #include <linux/perf_event.h>		/* perf_sw_event		*/
+#include <linux/unistd.h>
+#include <linux/compiler.h>
 
 #include <asm/traps.h>			/* dotraplinkage, ...		*/
 #include <asm/pgalloc.h>		/* pgd_*(), ...			*/
 #include <asm/kmemcheck.h>		/* kmemcheck_*(), ...		*/
+#include <asm/vsyscall.h>
+#include <asm/tlbflush.h>
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+#include <asm/stacktrace.h>
+#include "../kernel/dumpstack.h"
+#endif
 
 /*
  * Page fault error code bits:
@@ -51,7 +60,7 @@
 	int ret = 0;
 
 	/* kprobe_running() needs smp_processor_id() */
-	if (kprobes_built_in() && !user_mode_vm(regs)) {
+	if (kprobes_built_in() && !user_mode(regs)) {
 		preempt_disable();
 		if (kprobe_running() && kprobe_fault_handler(regs, 14))
 			ret = 1;
@@ -112,7 +121,10 @@
 		return !instr_lo || (instr_lo>>1) == 1;
 	case 0x00:
 		/* Prefetch instruction is 0x0F0D or 0x0F18 */
-		if (probe_kernel_address(instr, opcode))
+		if (user_mode(regs)) {
+			if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
+				return 0;
+		} else if (probe_kernel_address(instr, opcode))
 			return 0;
 
 		*prefetch = (instr_lo == 0xF) &&
@@ -146,7 +158,10 @@
 	while (instr < max_instr) {
 		unsigned char opcode;
 
-		if (probe_kernel_address(instr, opcode))
+		if (user_mode(regs)) {
+			if (__copy_from_user_inatomic(&opcode, (__force unsigned char __user *)(instr), 1))
+				break;
+		} else if (probe_kernel_address(instr, opcode))
 			break;
 
 		instr++;
@@ -172,6 +187,30 @@
 	force_sig_info(si_signo, &info, tsk);
 }
 
+#ifdef CONFIG_PAX_EMUTRAMP
+static int pax_handle_fetch_fault(struct pt_regs *regs);
+#endif
+
+#ifdef CONFIG_PAX_PAGEEXEC
+static inline pmd_t * pax_get_pmd(struct mm_struct *mm, unsigned long address)
+{
+	pgd_t *pgd;
+	pud_t *pud;
+	pmd_t *pmd;
+
+	pgd = pgd_offset(mm, address);
+	if (!pgd_present(*pgd))
+		return NULL;
+	pud = pud_offset(pgd, address);
+	if (!pud_present(*pud))
+		return NULL;
+	pmd = pmd_offset(pud, address);
+	if (!pmd_present(*pmd))
+		return NULL;
+	return pmd;
+}
+#endif
+
 DEFINE_SPINLOCK(pgd_lock);
 LIST_HEAD(pgd_list);
 
@@ -224,11 +263,24 @@
 	     address += PMD_SIZE) {
 
 		unsigned long flags;
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+		unsigned long cpu;
+#else
 		struct page *page;
+#endif
 
 		spin_lock_irqsave(&pgd_lock, flags);
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
+			pgd_t *pgd = get_cpu_pgd(cpu);
+#else
 		list_for_each_entry(page, &pgd_list, lru) {
-			if (!vmalloc_sync_one(page_address(page), address))
+			pgd_t *pgd = page_address(page);
+#endif
+
+			if (!vmalloc_sync_one(pgd, address))
 				break;
 		}
 		spin_unlock_irqrestore(&pgd_lock, flags);
@@ -258,6 +310,11 @@
 	 * an interrupt in the middle of a task switch..
 	 */
 	pgd_paddr = read_cr3();
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (pgd_paddr & PHYSICAL_PAGE_MASK));
+#endif
+
 	pmd_k = vmalloc_sync_one(__va(pgd_paddr), address);
 	if (!pmd_k)
 		return -1;
@@ -332,15 +389,27 @@
 
 		const pgd_t *pgd_ref = pgd_offset_k(address);
 		unsigned long flags;
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+		unsigned long cpu;
+#else
 		struct page *page;
+#endif
 
 		if (pgd_none(*pgd_ref))
 			continue;
 
 		spin_lock_irqsave(&pgd_lock, flags);
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
+			pgd_t *pgd = pgd_offset_cpu(cpu, address);
+#else
 		list_for_each_entry(page, &pgd_list, lru) {
 			pgd_t *pgd;
 			pgd = (pgd_t *)page_address(page) + pgd_index(address);
+#endif
+
 			if (pgd_none(*pgd))
 				set_pgd(pgd, *pgd_ref);
 			else
@@ -373,7 +442,14 @@
 	 * happen within a race in page table update. In the later
 	 * case just flush:
 	 */
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+	BUG_ON(__pa(get_cpu_pgd(smp_processor_id())) != (read_cr3() & PHYSICAL_PAGE_MASK));
+	pgd = pgd_offset_cpu(smp_processor_id(), address);
+#else
 	pgd = pgd_offset(current->active_mm, address);
+#endif
+
 	pgd_ref = pgd_offset_k(address);
 	if (pgd_none(*pgd_ref))
 		return -1;
@@ -535,7 +611,7 @@
 static int is_errata100(struct pt_regs *regs, unsigned long address)
 {
 #ifdef CONFIG_X86_64
-	if ((regs->cs == __USER32_CS || (regs->cs & (1<<2))) && (address >> 32))
+	if ((regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT)) && (address >> 32))
 		return 1;
 #endif
 	return 0;
@@ -562,7 +638,7 @@
 }
 
 static const char nx_warning[] = KERN_CRIT
-"kernel tried to execute NX-protected page - exploit attempt? (uid: %d)\n";
+"kernel tried to execute NX-protected page - exploit attempt? (uid: %d, task: %s, pid: %d)\n";
 
 static void
 show_fault_oops(struct pt_regs *regs, unsigned long error_code,
@@ -571,15 +647,26 @@
 	if (!oops_may_print())
 		return;
 
-	if (error_code & PF_INSTR) {
+	if (nx_enabled && (error_code & PF_INSTR)) {
 		unsigned int level;
 
 		pte_t *pte = lookup_address(address, &level);
 
 		if (pte && pte_present(*pte) && !pte_exec(*pte))
-			printk(nx_warning, current_uid());
+			printk(nx_warning, current_uid(), current->comm, task_pid_nr(current));
 	}
 
+#ifdef CONFIG_PAX_KERNEXEC
+	if (init_mm.start_code <= address && address < init_mm.end_code) {
+		if (current->signal->curr_ip)
+			printk(KERN_ERR "PAX: From %pI4: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
+					 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
+		else
+			printk(KERN_ERR "PAX: %s:%d, uid/euid: %u/%u, attempted to modify kernel code\n",
+					 current->comm, task_pid_nr(current), current_uid(), current_euid());
+	}
+#endif
+
 	printk(KERN_ALERT "BUG: unable to handle kernel ");
 	if (address < PAGE_SIZE)
 		printk(KERN_CONT "NULL pointer dereference");
@@ -704,6 +791,68 @@
 		       unsigned long address, int si_code)
 {
 	struct task_struct *tsk = current;
+	struct mm_struct *mm = tsk->mm;
+
+#ifdef CONFIG_X86_64
+	if (mm && (error_code & PF_INSTR) && mm->context.vdso) {
+		if (regs->ip == (unsigned long)vgettimeofday) {
+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_gettimeofday);
+			return;
+		} else if (regs->ip == (unsigned long)vtime) {
+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, fallback_time);
+			return;
+		} else if (regs->ip == (unsigned long)vgetcpu) {
+			regs->ip = (unsigned long)VDSO64_SYMBOL(mm->context.vdso, getcpu);
+			return;
+		}
+	}
+#endif
+
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+	if (mm && (error_code & PF_USER)) {
+		unsigned long ip = regs->ip;
+
+		if (v8086_mode(regs))
+			ip = ((regs->cs & 0xffff) << 4) + (ip & 0xffff);
+
+		/*
+		 * It's possible to have interrupts off here:
+		 */
+		local_irq_enable();
+
+#ifdef CONFIG_PAX_PAGEEXEC
+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) &&
+		    ((nx_enabled && (error_code & PF_INSTR)) || (!(error_code & (PF_PROT | PF_WRITE)) && ip == address))) {
+
+#ifdef CONFIG_PAX_EMUTRAMP
+			switch (pax_handle_fetch_fault(regs)) {
+			case 2:
+				return;
+			}
+#endif
+
+			pax_report_fault(regs, (void *)ip, (void *)regs->sp);
+			do_group_exit(SIGKILL);
+		}
+#endif
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && !(error_code & (PF_PROT | PF_WRITE)) && (ip + SEGMEXEC_TASK_SIZE == address)) {
+
+#ifdef CONFIG_PAX_EMUTRAMP
+			switch (pax_handle_fetch_fault(regs)) {
+			case 2:
+				return;
+			}
+#endif
+
+			pax_report_fault(regs, (void *)ip, (void *)regs->sp);
+			do_group_exit(SIGKILL);
+		}
+#endif
+
+	}
+#endif
 
 	/* User mode accesses just cause a SIGSEGV */
 	if (error_code & PF_USER) {
@@ -857,6 +1006,99 @@
 	return 1;
 }
 
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
+static int pax_handle_pageexec_fault(struct pt_regs *regs, struct mm_struct *mm, unsigned long address, unsigned long error_code)
+{
+	pte_t *pte;
+	pmd_t *pmd;
+	spinlock_t *ptl;
+	unsigned char pte_mask;
+
+	if (nx_enabled || (error_code & (PF_PROT|PF_USER)) != (PF_PROT|PF_USER) || v8086_mode(regs) ||
+	    !(mm->pax_flags & MF_PAX_PAGEEXEC))
+		return 0;
+
+	/* PaX: it's our fault, let's handle it if we can */
+
+	/* PaX: take a look at read faults before acquiring any locks */
+	if (unlikely(!(error_code & PF_WRITE) && (regs->ip == address))) {
+		/* instruction fetch attempt from a protected page in user mode */
+		up_read(&mm->mmap_sem);
+
+#ifdef CONFIG_PAX_EMUTRAMP
+		switch (pax_handle_fetch_fault(regs)) {
+		case 2:
+			return 1;
+		}
+#endif
+
+		pax_report_fault(regs, (void *)regs->ip, (void *)regs->sp);
+		do_group_exit(SIGKILL);
+	}
+
+	pmd = pax_get_pmd(mm, address);
+	if (unlikely(!pmd))
+		return 0;
+
+	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
+	if (unlikely(!(pte_val(*pte) & _PAGE_PRESENT) || pte_user(*pte))) {
+		pte_unmap_unlock(pte, ptl);
+		return 0;
+	}
+
+	if (unlikely((error_code & PF_WRITE) && !pte_write(*pte))) {
+		/* write attempt to a protected page in user mode */
+		pte_unmap_unlock(pte, ptl);
+		return 0;
+	}
+
+#ifdef CONFIG_SMP
+	if (likely(address > get_limit(regs->cs) && cpu_isset(smp_processor_id(), mm->context.cpu_user_cs_mask)))
+#else
+	if (likely(address > get_limit(regs->cs)))
+#endif
+	{
+		set_pte(pte, pte_mkread(*pte));
+		__flush_tlb_one(address);
+		pte_unmap_unlock(pte, ptl);
+		up_read(&mm->mmap_sem);
+		return 1;
+	}
+
+	pte_mask = _PAGE_ACCESSED | _PAGE_USER | ((error_code & PF_WRITE) << (_PAGE_BIT_DIRTY-1));
+
+	/*
+	 * PaX: fill DTLB with user rights and retry
+	 */
+	__asm__ __volatile__ (
+		"orb %2,(%1)\n"
+#if defined(CONFIG_M586) || defined(CONFIG_M586TSC)
+/*
+ * PaX: let this uncommented 'invlpg' remind us on the behaviour of Intel's
+ * (and AMD's) TLBs. namely, they do not cache PTEs that would raise *any*
+ * page fault when examined during a TLB load attempt. this is true not only
+ * for PTEs holding a non-present entry but also present entries that will
+ * raise a page fault (such as those set up by PaX, or the copy-on-write
+ * mechanism). in effect it means that we do *not* need to flush the TLBs
+ * for our target pages since their PTEs are simply not in the TLBs at all.
+
+ * the best thing in omitting it is that we gain around 15-20% speed in the
+ * fast path of the page fault handler and can get rid of tracing since we
+ * can no longer flush unintended entries.
+ */
+		"invlpg (%0)\n"
+#endif
+		__copyuser_seg"testb $0,(%0)\n"
+		"xorb %3,(%1)\n"
+		:
+		: "r" (address), "r" (pte), "q" (pte_mask), "i" (_PAGE_USER)
+		: "memory", "cc");
+	pte_unmap_unlock(pte, ptl);
+	up_read(&mm->mmap_sem);
+	return 1;
+}
+#endif
+
 /*
  * Handle a spurious fault caused by a stale TLB entry.
  *
@@ -923,6 +1165,9 @@
 static inline int
 access_error(unsigned long error_code, int write, struct vm_area_struct *vma)
 {
+	if (nx_enabled && (error_code & PF_INSTR) && !(vma->vm_flags & VM_EXEC))
+		return 1;
+
 	if (write) {
 		/* write, present and write, not present: */
 		if (unlikely(!(vma->vm_flags & VM_WRITE)))
@@ -956,17 +1201,31 @@
 {
 	struct vm_area_struct *vma;
 	struct task_struct *tsk;
-	unsigned long address;
 	struct mm_struct *mm;
 	int write;
 	int fault;
 
+	/* Get the faulting address: */
+	unsigned long address = read_cr2();
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+	if (!user_mode(regs) && address < 2 * PAX_USER_SHADOW_BASE) {
+		if (!search_exception_tables(regs->ip)) {
+			bad_area_nosemaphore(regs, error_code, address);
+			return;
+		}
+		if (address < PAX_USER_SHADOW_BASE) {
+			printk(KERN_ERR "PAX: please report this to pageexec@freemail.hu\n");
+			printk(KERN_ERR "PAX: faulting IP: %pA\n", (void *)regs->ip);
+			show_trace_log_lvl(NULL, NULL, (void *)regs->sp, regs->bp, KERN_ERR);
+		} else
+			address -= PAX_USER_SHADOW_BASE;
+	}
+#endif
+
 	tsk = current;
 	mm = tsk->mm;
 
-	/* Get the faulting address: */
-	address = read_cr2();
-
 	/*
 	 * Detect and handle instructions that would cause a page fault for
 	 * both a tracked kernel page and a userspace page.
@@ -1026,7 +1285,7 @@
 	 * User-mode registers count as a user access even for any
 	 * potential system fault or CPU buglet:
 	 */
-	if (user_mode_vm(regs)) {
+	if (user_mode(regs)) {
 		local_irq_enable();
 		error_code |= PF_USER;
 	} else {
@@ -1080,6 +1339,11 @@
 		might_sleep();
 	}
 
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_PAGEEXEC)
+	if (pax_handle_pageexec_fault(regs, mm, address, error_code))
+		return;
+#endif
+
 	vma = find_vma(mm, address);
 	if (unlikely(!vma)) {
 		bad_area(regs, error_code, address);
@@ -1091,18 +1355,24 @@
 		bad_area(regs, error_code, address);
 		return;
 	}
-	if (error_code & PF_USER) {
-		/*
-		 * Accessing the stack below %sp is always a bug.
-		 * The large cushion allows instructions like enter
-		 * and pusha to work. ("enter $65535, $31" pushes
-		 * 32 pointers and then decrements %sp by 65535.)
-		 */
-		if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < regs->sp)) {
-			bad_area(regs, error_code, address);
-			return;
-		}
+	/*
+	 * Accessing the stack below %sp is always a bug.
+	 * The large cushion allows instructions like enter
+	 * and pusha to work. ("enter $65535, $31" pushes
+	 * 32 pointers and then decrements %sp by 65535.)
+	 */
+	if (unlikely(address + 65536 + 32 * sizeof(unsigned long) < task_pt_regs(tsk)->sp)) {
+		bad_area(regs, error_code, address);
+		return;
+	}
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (unlikely((mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end - SEGMEXEC_TASK_SIZE - 1 < address - SEGMEXEC_TASK_SIZE - 1)) {
+		bad_area(regs, error_code, address);
+		return;
 	}
+#endif
+
 	if (unlikely(expand_stack(vma, address))) {
 		bad_area(regs, error_code, address);
 		return;
@@ -1146,3 +1416,199 @@
 
 	up_read(&mm->mmap_sem);
 }
+
+#ifdef CONFIG_PAX_EMUTRAMP
+static int pax_handle_fetch_fault_32(struct pt_regs *regs)
+{
+	int err;
+
+	do { /* PaX: gcc trampoline emulation #1 */
+		unsigned char mov1, mov2;
+		unsigned short jmp;
+		unsigned int addr1, addr2;
+
+#ifdef CONFIG_X86_64
+		if ((regs->ip + 11) >> 32)
+			break;
+#endif
+
+		err = get_user(mov1, (unsigned char __user *)regs->ip);
+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
+		err |= get_user(mov2, (unsigned char __user *)(regs->ip + 5));
+		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
+		err |= get_user(jmp, (unsigned short __user *)(regs->ip + 10));
+
+		if (err)
+			break;
+
+		if (mov1 == 0xB9 && mov2 == 0xB8 && jmp == 0xE0FF) {
+			regs->cx = addr1;
+			regs->ax = addr2;
+			regs->ip = addr2;
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: gcc trampoline emulation #2 */
+		unsigned char mov, jmp;
+		unsigned int addr1, addr2;
+
+#ifdef CONFIG_X86_64
+		if ((regs->ip + 9) >> 32)
+			break;
+#endif
+
+		err = get_user(mov, (unsigned char __user *)regs->ip);
+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 1));
+		err |= get_user(jmp, (unsigned char __user *)(regs->ip + 5));
+		err |= get_user(addr2, (unsigned int __user *)(regs->ip + 6));
+
+		if (err)
+			break;
+
+		if (mov == 0xB9 && jmp == 0xE9) {
+			regs->cx = addr1;
+			regs->ip = (unsigned int)(regs->ip + addr2 + 10);
+			return 2;
+		}
+	} while (0);
+
+	return 1; /* PaX in action */
+}
+
+#ifdef CONFIG_X86_64
+static int pax_handle_fetch_fault_64(struct pt_regs *regs)
+{
+	int err;
+
+	do { /* PaX: gcc trampoline emulation #1 */
+		unsigned short mov1, mov2, jmp1;
+		unsigned char jmp2;
+		unsigned int addr1;
+		unsigned long addr2;
+
+		err = get_user(mov1, (unsigned short __user *)regs->ip);
+		err |= get_user(addr1, (unsigned int __user *)(regs->ip + 2));
+		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 6));
+		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 8));
+		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 16));
+		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 18));
+
+		if (err)
+			break;
+
+		if (mov1 == 0xBB41 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
+			regs->r11 = addr1;
+			regs->r10 = addr2;
+			regs->ip = addr1;
+			return 2;
+		}
+	} while (0);
+
+	do { /* PaX: gcc trampoline emulation #2 */
+		unsigned short mov1, mov2, jmp1;
+		unsigned char jmp2;
+		unsigned long addr1, addr2;
+
+		err = get_user(mov1, (unsigned short __user *)regs->ip);
+		err |= get_user(addr1, (unsigned long __user *)(regs->ip + 2));
+		err |= get_user(mov2, (unsigned short __user *)(regs->ip + 10));
+		err |= get_user(addr2, (unsigned long __user *)(regs->ip + 12));
+		err |= get_user(jmp1, (unsigned short __user *)(regs->ip + 20));
+		err |= get_user(jmp2, (unsigned char __user *)(regs->ip + 22));
+
+		if (err)
+			break;
+
+		if (mov1 == 0xBB49 && mov2 == 0xBA49 && jmp1 == 0xFF49 && jmp2 == 0xE3) {
+			regs->r11 = addr1;
+			regs->r10 = addr2;
+			regs->ip = addr1;
+			return 2;
+		}
+	} while (0);
+
+	return 1; /* PaX in action */
+}
+#endif
+
+/*
+ * PaX: decide what to do with offenders (regs->ip = fault address)
+ *
+ * returns 1 when task should be killed
+ *         2 when gcc trampoline was detected
+ */
+static int pax_handle_fetch_fault(struct pt_regs *regs)
+{
+	if (v8086_mode(regs))
+		return 1;
+
+	if (!(current->mm->pax_flags & MF_PAX_EMUTRAMP))
+		return 1;
+
+#ifdef CONFIG_X86_32
+	return pax_handle_fetch_fault_32(regs);
+#else
+	if (regs->cs == __USER32_CS || (regs->cs & SEGMENT_LDT))
+		return pax_handle_fetch_fault_32(regs);
+	else
+		return pax_handle_fetch_fault_64(regs);
+#endif
+}
+#endif
+
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+void pax_report_insns(void *pc, void *sp)
+{
+	long i;
+
+	printk(KERN_ERR "PAX: bytes at PC: ");
+	for (i = 0; i < 20; i++) {
+		unsigned char c;
+		if (get_user(c, (__force unsigned char __user *)pc+i))
+			printk(KERN_CONT "?? ");
+		else
+			printk(KERN_CONT "%02x ", c);
+	}
+	printk("\n");
+
+	printk(KERN_ERR "PAX: bytes at SP-%lu: ", (unsigned long)sizeof(long));
+	for (i = -1; i < 80 / (long)sizeof(long); i++) {
+		unsigned long c;
+		if (get_user(c, (__force unsigned long __user *)sp+i))
+#ifdef CONFIG_X86_32
+			printk(KERN_CONT "???????? ");
+#else
+			printk(KERN_CONT "???????????????? ");
+#endif
+		else
+			printk(KERN_CONT "%0*lx ", 2 * (int)sizeof(long), c);
+	}
+	printk("\n");
+}
+#endif
+
+/**
+ * probe_kernel_write(): safely attempt to write to a location
+ * @dst: address to write to
+ * @src: pointer to the data that shall be written
+ * @size: size of the data chunk
+ *
+ * Safely write to address @dst from the buffer at @src.  If a kernel fault
+ * happens, handle that and return -EFAULT.
+ */
+long notrace probe_kernel_write(void *dst, const void *src, size_t size)
+{
+	long ret;
+	mm_segment_t old_fs = get_fs();
+
+	set_fs(KERNEL_DS);
+	pagefault_disable();
+	pax_open_kernel();
+	ret = __copy_to_user_inatomic((__force void __user *)dst, src, size);
+	pax_close_kernel();
+	pagefault_enable();
+	set_fs(old_fs);
+
+	return ret ? -EFAULT : 0;
+}
diff -uriN linux-2.6.32.43/arch/x86/mm/gup.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/gup.c
--- linux-2.6.32.43/arch/x86/mm/gup.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/gup.c	2011-07-15 05:51:11.000000000 -0500
@@ -237,7 +237,7 @@
 	addr = start;
 	len = (unsigned long) nr_pages << PAGE_SHIFT;
 	end = start + len;
-	if (unlikely(!access_ok(write ? VERIFY_WRITE : VERIFY_READ,
+	if (unlikely(!__access_ok(write ? VERIFY_WRITE : VERIFY_READ,
 					(void __user *)start, len)))
 		return 0;
 
diff -uriN linux-2.6.32.43/arch/x86/mm/highmem_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/highmem_32.c
--- linux-2.6.32.43/arch/x86/mm/highmem_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/highmem_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -43,7 +43,10 @@
 	idx = type + KM_TYPE_NR*smp_processor_id();
 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
 	BUG_ON(!pte_none(*(kmap_pte-idx)));
+
+	pax_open_kernel();
 	set_pte(kmap_pte-idx, mk_pte(page, prot));
+	pax_close_kernel();
 
 	return (void *)vaddr;
 }
diff -uriN linux-2.6.32.43/arch/x86/mm/hugetlbpage.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/hugetlbpage.c
--- linux-2.6.32.43/arch/x86/mm/hugetlbpage.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/hugetlbpage.c	2011-07-15 05:51:11.000000000 -0500
@@ -267,13 +267,20 @@
 	struct hstate *h = hstate_file(file);
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
-	unsigned long start_addr;
+	unsigned long start_addr, pax_task_size = TASK_SIZE;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
+	pax_task_size -= PAGE_SIZE;
 
 	if (len > mm->cached_hole_size) {
-	        start_addr = mm->free_area_cache;
+		start_addr = mm->free_area_cache;
 	} else {
-	        start_addr = TASK_UNMAPPED_BASE;
-	        mm->cached_hole_size = 0;
+		start_addr = mm->mmap_base;
+		mm->cached_hole_size = 0;
 	}
 
 full_search:
@@ -281,26 +288,27 @@
 
 	for (vma = find_vma(mm, addr); ; vma = vma->vm_next) {
 		/* At this point:  (!vma || addr < vma->vm_end). */
-		if (TASK_SIZE - len < addr) {
+		if (pax_task_size - len < addr) {
 			/*
 			 * Start a new search - just in case we missed
 			 * some holes.
 			 */
-			if (start_addr != TASK_UNMAPPED_BASE) {
-				start_addr = TASK_UNMAPPED_BASE;
+			if (start_addr != mm->mmap_base) {
+				start_addr = mm->mmap_base;
 				mm->cached_hole_size = 0;
 				goto full_search;
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
-			mm->free_area_cache = addr + len;
-			return addr;
-		}
+		if (check_heap_stack_gap(vma, addr, len))
+			break;
 		if (addr + mm->cached_hole_size < vma->vm_start)
 		        mm->cached_hole_size = vma->vm_start - addr;
 		addr = ALIGN(vma->vm_end, huge_page_size(h));
 	}
+
+	mm->free_area_cache = addr + len;
+	return addr;
 }
 
 static unsigned long hugetlb_get_unmapped_area_topdown(struct file *file,
@@ -309,10 +317,9 @@
 {
 	struct hstate *h = hstate_file(file);
 	struct mm_struct *mm = current->mm;
-	struct vm_area_struct *vma, *prev_vma;
-	unsigned long base = mm->mmap_base, addr = addr0;
+	struct vm_area_struct *vma;
+	unsigned long base = mm->mmap_base, addr;
 	unsigned long largest_hole = mm->cached_hole_size;
-	int first_time = 1;
 
 	/* don't allow allocations above current base */
 	if (mm->free_area_cache > base)
@@ -322,64 +329,63 @@
 	        largest_hole = 0;
 		mm->free_area_cache  = base;
 	}
-try_again:
+
 	/* make sure it can fit in the remaining address space */
 	if (mm->free_area_cache < len)
 		goto fail;
 
 	/* either no address requested or cant fit in requested address hole */
-	addr = (mm->free_area_cache - len) & huge_page_mask(h);
+	addr = (mm->free_area_cache - len);
 	do {
+		addr &= huge_page_mask(h);
+		vma = find_vma(mm, addr);
 		/*
 		 * Lookup failure means no vma is above this address,
 		 * i.e. return with success:
-		 */
-		if (!(vma = find_vma_prev(mm, addr, &prev_vma)))
-			return addr;
-
-		/*
 		 * new region fits between prev_vma->vm_end and
 		 * vma->vm_start, use it:
 		 */
-		if (addr + len <= vma->vm_start &&
-		            (!prev_vma || (addr >= prev_vma->vm_end))) {
+		if (check_heap_stack_gap(vma, addr, len)) {
 			/* remember the address as a hint for next time */
-		        mm->cached_hole_size = largest_hole;
-		        return (mm->free_area_cache = addr);
-		} else {
-			/* pull free_area_cache down to the first hole */
-		        if (mm->free_area_cache == vma->vm_end) {
-				mm->free_area_cache = vma->vm_start;
-				mm->cached_hole_size = largest_hole;
-			}
+			mm->cached_hole_size = largest_hole;
+			return (mm->free_area_cache = addr);
+		}
+		/* pull free_area_cache down to the first hole */
+		if (mm->free_area_cache == vma->vm_end) {
+			mm->free_area_cache = vma->vm_start;
+			mm->cached_hole_size = largest_hole;
 		}
 
 		/* remember the largest hole we saw so far */
 		if (addr + largest_hole < vma->vm_start)
-		        largest_hole = vma->vm_start - addr;
+			largest_hole = vma->vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = (vma->vm_start - len) & huge_page_mask(h);
-	} while (len <= vma->vm_start);
+		addr = skip_heap_stack_gap(vma, len);
+	} while (!IS_ERR_VALUE(addr));
 
 fail:
 	/*
-	 * if hint left us with no space for the requested
-	 * mapping then try again:
-	 */
-	if (first_time) {
-		mm->free_area_cache = base;
-		largest_hole = 0;
-		first_time = 0;
-		goto try_again;
-	}
-	/*
 	 * A failed mmap() very likely causes application failure,
 	 * so fall back to the bottom-up function here. This scenario
 	 * can happen with large stack limits and large mmap()
 	 * allocations.
 	 */
-	mm->free_area_cache = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		mm->mmap_base = SEGMEXEC_TASK_UNMAPPED_BASE;
+	else
+#endif
+
+	mm->mmap_base = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (mm->pax_flags & MF_PAX_RANDMMAP)
+		mm->mmap_base += mm->delta_mmap;
+#endif
+
+	mm->free_area_cache = mm->mmap_base;
 	mm->cached_hole_size = ~0UL;
 	addr = hugetlb_get_unmapped_area_bottomup(file, addr0,
 			len, pgoff, flags);
@@ -387,6 +393,7 @@
 	/*
 	 * Restore the topdown base:
 	 */
+	mm->mmap_base = base;
 	mm->free_area_cache = base;
 	mm->cached_hole_size = ~0UL;
 
@@ -400,10 +407,19 @@
 	struct hstate *h = hstate_file(file);
 	struct mm_struct *mm = current->mm;
 	struct vm_area_struct *vma;
+	unsigned long pax_task_size = TASK_SIZE;
 
 	if (len & ~huge_page_mask(h))
 		return -EINVAL;
-	if (len > TASK_SIZE)
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
+	pax_task_size -= PAGE_SIZE;
+
+	if (len > pax_task_size)
 		return -ENOMEM;
 
 	if (flags & MAP_FIXED) {
@@ -415,8 +431,7 @@
 	if (addr) {
 		addr = ALIGN(addr, huge_page_size(h));
 		vma = find_vma(mm, addr);
-		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
+		if (pax_task_size - len >= addr && check_heap_stack_gap(vma, addr, len))
 			return addr;
 	}
 	if (mm->get_unmapped_area == arch_get_unmapped_area)
diff -uriN linux-2.6.32.43/arch/x86/mm/init_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/init_32.c
--- linux-2.6.32.43/arch/x86/mm/init_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/init_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -72,36 +72,6 @@
 }
 
 /*
- * Creates a middle page table and puts a pointer to it in the
- * given global directory entry. This only returns the gd entry
- * in non-PAE compilation mode, since the middle layer is folded.
- */
-static pmd_t * __init one_md_table_init(pgd_t *pgd)
-{
-	pud_t *pud;
-	pmd_t *pmd_table;
-
-#ifdef CONFIG_X86_PAE
-	if (!(pgd_val(*pgd) & _PAGE_PRESENT)) {
-		if (after_bootmem)
-			pmd_table = (pmd_t *)alloc_bootmem_pages(PAGE_SIZE);
-		else
-			pmd_table = (pmd_t *)alloc_low_page();
-		paravirt_alloc_pmd(&init_mm, __pa(pmd_table) >> PAGE_SHIFT);
-		set_pgd(pgd, __pgd(__pa(pmd_table) | _PAGE_PRESENT));
-		pud = pud_offset(pgd, 0);
-		BUG_ON(pmd_table != pmd_offset(pud, 0));
-
-		return pmd_table;
-	}
-#endif
-	pud = pud_offset(pgd, 0);
-	pmd_table = pmd_offset(pud, 0);
-
-	return pmd_table;
-}
-
-/*
  * Create a page table and place a pointer to it in a middle page
  * directory entry:
  */
@@ -121,13 +91,28 @@
 			page_table = (pte_t *)alloc_low_page();
 
 		paravirt_alloc_pte(&init_mm, __pa(page_table) >> PAGE_SHIFT);
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+		set_pmd(pmd, __pmd(__pa(page_table) | _KERNPG_TABLE));
+#else
 		set_pmd(pmd, __pmd(__pa(page_table) | _PAGE_TABLE));
+#endif
 		BUG_ON(page_table != pte_offset_kernel(pmd, 0));
 	}
 
 	return pte_offset_kernel(pmd, 0);
 }
 
+static pmd_t * __init one_md_table_init(pgd_t *pgd)
+{
+	pud_t *pud;
+	pmd_t *pmd_table;
+
+	pud = pud_offset(pgd, 0);
+	pmd_table = pmd_offset(pud, 0);
+
+	return pmd_table;
+}
+
 pmd_t * __init populate_extra_pmd(unsigned long vaddr)
 {
 	int pgd_idx = pgd_index(vaddr);
@@ -201,6 +186,7 @@
 	int pgd_idx, pmd_idx;
 	unsigned long vaddr;
 	pgd_t *pgd;
+	pud_t *pud;
 	pmd_t *pmd;
 	pte_t *pte = NULL;
 
@@ -210,8 +196,13 @@
 	pgd = pgd_base + pgd_idx;
 
 	for ( ; (pgd_idx < PTRS_PER_PGD) && (vaddr != end); pgd++, pgd_idx++) {
-		pmd = one_md_table_init(pgd);
-		pmd = pmd + pmd_index(vaddr);
+		pud = pud_offset(pgd, vaddr);
+		pmd = pmd_offset(pud, vaddr);
+
+#ifdef CONFIG_X86_PAE
+		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
+#endif
+
 		for (; (pmd_idx < PTRS_PER_PMD) && (vaddr != end);
 							pmd++, pmd_idx++) {
 			pte = page_table_kmap_check(one_page_table_init(pmd),
@@ -223,11 +214,20 @@
 	}
 }
 
-static inline int is_kernel_text(unsigned long addr)
+static inline int is_kernel_text(unsigned long start, unsigned long end)
 {
-	if (addr >= PAGE_OFFSET && addr <= (unsigned long)__init_end)
-		return 1;
-	return 0;
+	if ((start > ktla_ktva((unsigned long)_etext) ||
+	     end <= ktla_ktva((unsigned long)_stext)) &&
+	    (start > ktla_ktva((unsigned long)_einittext) ||
+	     end <= ktla_ktva((unsigned long)_sinittext)) &&
+
+#ifdef CONFIG_ACPI_SLEEP
+	    (start > (unsigned long)__va(acpi_wakeup_address) + 0x4000 || end <= (unsigned long)__va(acpi_wakeup_address)) &&
+#endif
+
+	    (start > (unsigned long)__va(0xfffff) || end <= (unsigned long)__va(0xc0000)))
+		return 0;
+	return 1;
 }
 
 /*
@@ -243,9 +243,10 @@
 	int use_pse = page_size_mask == (1<<PG_LEVEL_2M);
 	unsigned long start_pfn, end_pfn;
 	pgd_t *pgd_base = swapper_pg_dir;
-	int pgd_idx, pmd_idx, pte_ofs;
+	unsigned int pgd_idx, pmd_idx, pte_ofs;
 	unsigned long pfn;
 	pgd_t *pgd;
+	pud_t *pud;
 	pmd_t *pmd;
 	pte_t *pte;
 	unsigned pages_2m, pages_4k;
@@ -278,8 +279,13 @@
 	pfn = start_pfn;
 	pgd_idx = pgd_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
 	pgd = pgd_base + pgd_idx;
-	for (; pgd_idx < PTRS_PER_PGD; pgd++, pgd_idx++) {
-		pmd = one_md_table_init(pgd);
+	for (; pgd_idx < PTRS_PER_PGD && pfn < max_low_pfn; pgd++, pgd_idx++) {
+		pud = pud_offset(pgd, 0);
+		pmd = pmd_offset(pud, 0);
+
+#ifdef CONFIG_X86_PAE
+		paravirt_alloc_pmd(&init_mm, __pa(pmd) >> PAGE_SHIFT);
+#endif
 
 		if (pfn >= end_pfn)
 			continue;
@@ -291,14 +297,13 @@
 #endif
 		for (; pmd_idx < PTRS_PER_PMD && pfn < end_pfn;
 		     pmd++, pmd_idx++) {
-			unsigned int addr = pfn * PAGE_SIZE + PAGE_OFFSET;
+			unsigned long address = pfn * PAGE_SIZE + PAGE_OFFSET;
 
 			/*
 			 * Map with big pages if possible, otherwise
 			 * create normal page tables:
 			 */
 			if (use_pse) {
-				unsigned int addr2;
 				pgprot_t prot = PAGE_KERNEL_LARGE;
 				/*
 				 * first pass will use the same initial
@@ -308,11 +313,7 @@
 					__pgprot(PTE_IDENT_ATTR |
 						 _PAGE_PSE);
 
-				addr2 = (pfn + PTRS_PER_PTE-1) * PAGE_SIZE +
-					PAGE_OFFSET + PAGE_SIZE-1;
-
-				if (is_kernel_text(addr) ||
-				    is_kernel_text(addr2))
+				if (is_kernel_text(address, address + PMD_SIZE))
 					prot = PAGE_KERNEL_LARGE_EXEC;
 
 				pages_2m++;
@@ -329,7 +330,7 @@
 			pte_ofs = pte_index((pfn<<PAGE_SHIFT) + PAGE_OFFSET);
 			pte += pte_ofs;
 			for (; pte_ofs < PTRS_PER_PTE && pfn < end_pfn;
-			     pte++, pfn++, pte_ofs++, addr += PAGE_SIZE) {
+			     pte++, pfn++, pte_ofs++, address += PAGE_SIZE) {
 				pgprot_t prot = PAGE_KERNEL;
 				/*
 				 * first pass will use the same initial
@@ -337,7 +338,7 @@
 				 */
 				pgprot_t init_prot = __pgprot(PTE_IDENT_ATTR);
 
-				if (is_kernel_text(addr))
+				if (is_kernel_text(address, address + PAGE_SIZE))
 					prot = PAGE_KERNEL_EXEC;
 
 				pages_4k++;
@@ -489,7 +490,7 @@
 
 		pud = pud_offset(pgd, va);
 		pmd = pmd_offset(pud, va);
-		if (!pmd_present(*pmd))
+		if (!pmd_present(*pmd) || pmd_huge(*pmd))
 			break;
 
 		pte = pte_offset_kernel(pmd, va);
@@ -541,9 +542,7 @@
 
 static void __init pagetable_init(void)
 {
-	pgd_t *pgd_base = swapper_pg_dir;
-
-	permanent_kmaps_init(pgd_base);
+	permanent_kmaps_init(swapper_pg_dir);
 }
 
 #ifdef CONFIG_ACPI_SLEEP
@@ -551,12 +550,12 @@
  * ACPI suspend needs this for resume, because things like the intel-agp
  * driver might have split up a kernel 4MB mapping.
  */
-char swsusp_pg_dir[PAGE_SIZE]
+pgd_t swsusp_pg_dir[PTRS_PER_PGD]
 	__attribute__ ((aligned(PAGE_SIZE)));
 
 static inline void save_pg_dir(void)
 {
-	memcpy(swsusp_pg_dir, swapper_pg_dir, PAGE_SIZE);
+	clone_pgd_range(swsusp_pg_dir, swapper_pg_dir, PTRS_PER_PGD);
 }
 #else /* !CONFIG_ACPI_SLEEP */
 static inline void save_pg_dir(void)
@@ -588,7 +587,7 @@
 		flush_tlb_all();
 }
 
-pteval_t __supported_pte_mask __read_mostly = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
+pteval_t __supported_pte_mask __read_only = ~(_PAGE_NX | _PAGE_GLOBAL | _PAGE_IOMAP);
 EXPORT_SYMBOL_GPL(__supported_pte_mask);
 
 /* user-defined highmem size */
@@ -777,7 +776,7 @@
 	 * Initialize the boot-time allocator (with low memory only):
 	 */
 	bootmap_size = bootmem_bootmap_pages(max_low_pfn)<<PAGE_SHIFT;
-	bootmap = find_e820_area(0, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
+	bootmap = find_e820_area(0x100000, max_pfn_mapped<<PAGE_SHIFT, bootmap_size,
 				 PAGE_SIZE);
 	if (bootmap == -1L)
 		panic("Cannot find bootmem map of size %ld\n", bootmap_size);
@@ -864,6 +863,12 @@
 
 	pci_iommu_alloc();
 
+#ifdef CONFIG_PAX_PER_CPU_PGD
+	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+			KERNEL_PGD_PTRS);
+#endif
+
 #ifdef CONFIG_FLATMEM
 	BUG_ON(!mem_map);
 #endif
@@ -881,7 +886,7 @@
 	set_highmem_pages_init();
 
 	codesize =  (unsigned long) &_etext - (unsigned long) &_text;
-	datasize =  (unsigned long) &_edata - (unsigned long) &_etext;
+	datasize =  (unsigned long) &_edata - (unsigned long) &_sdata;
 	initsize =  (unsigned long) &__init_end - (unsigned long) &__init_begin;
 
 	printk(KERN_INFO "Memory: %luk/%luk available (%dk kernel code, "
@@ -923,10 +928,10 @@
 		((unsigned long)&__init_end -
 		 (unsigned long)&__init_begin) >> 10,
 
-		(unsigned long)&_etext, (unsigned long)&_edata,
-		((unsigned long)&_edata - (unsigned long)&_etext) >> 10,
+		(unsigned long)&_sdata, (unsigned long)&_edata,
+		((unsigned long)&_edata - (unsigned long)&_sdata) >> 10,
 
-		(unsigned long)&_text, (unsigned long)&_etext,
+		ktla_ktva((unsigned long)&_text), ktla_ktva((unsigned long)&_etext),
 		((unsigned long)&_etext - (unsigned long)&_text) >> 10);
 
 	/*
@@ -1007,6 +1012,7 @@
 	if (!kernel_set_to_readonly)
 		return;
 
+	start = ktla_ktva(start);
 	pr_debug("Set kernel text: %lx - %lx for read write\n",
 		 start, start+size);
 
@@ -1021,6 +1027,7 @@
 	if (!kernel_set_to_readonly)
 		return;
 
+	start = ktla_ktva(start);
 	pr_debug("Set kernel text: %lx - %lx for read only\n",
 		 start, start+size);
 
@@ -1032,6 +1039,7 @@
 	unsigned long start = PFN_ALIGN(_text);
 	unsigned long size = PFN_ALIGN(_etext) - start;
 
+	start = ktla_ktva(start);
 	set_pages_ro(virt_to_page(start), size >> PAGE_SHIFT);
 	printk(KERN_INFO "Write protecting the kernel text: %luk\n",
 		size >> 10);
diff -uriN linux-2.6.32.43/arch/x86/mm/init_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/init_64.c
--- linux-2.6.32.43/arch/x86/mm/init_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/init_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -164,7 +164,9 @@
 	pmd = fill_pmd(pud, vaddr);
 	pte = fill_pte(pmd, vaddr);
 
+	pax_open_kernel();
 	set_pte(pte, new_pte);
+	pax_close_kernel();
 
 	/*
 	 * It's enough to flush this one mapping.
@@ -223,14 +225,12 @@
 		pgd = pgd_offset_k((unsigned long)__va(phys));
 		if (pgd_none(*pgd)) {
 			pud = (pud_t *) spp_getpage();
-			set_pgd(pgd, __pgd(__pa(pud) | _KERNPG_TABLE |
-						_PAGE_USER));
+			set_pgd(pgd, __pgd(__pa(pud) | _PAGE_TABLE));
 		}
 		pud = pud_offset(pgd, (unsigned long)__va(phys));
 		if (pud_none(*pud)) {
 			pmd = (pmd_t *) spp_getpage();
-			set_pud(pud, __pud(__pa(pmd) | _KERNPG_TABLE |
-						_PAGE_USER));
+			set_pud(pud, __pud(__pa(pmd) | _PAGE_TABLE));
 		}
 		pmd = pmd_offset(pud, phys);
 		BUG_ON(!pmd_none(*pmd));
@@ -675,6 +675,12 @@
 
 	pci_iommu_alloc();
 
+#ifdef CONFIG_PAX_PER_CPU_PGD
+	clone_pgd_range(get_cpu_pgd(0) + KERNEL_PGD_BOUNDARY,
+			swapper_pg_dir + KERNEL_PGD_BOUNDARY,
+			KERNEL_PGD_PTRS);
+#endif
+
 	/* clear_bss() already clear the empty_zero_page */
 
 	reservedpages = 0;
@@ -861,8 +867,8 @@
 static struct vm_area_struct gate_vma = {
 	.vm_start	= VSYSCALL_START,
 	.vm_end		= VSYSCALL_START + (VSYSCALL_MAPPED_PAGES * PAGE_SIZE),
-	.vm_page_prot	= PAGE_READONLY_EXEC,
-	.vm_flags	= VM_READ | VM_EXEC
+	.vm_page_prot	= PAGE_READONLY,
+	.vm_flags	= VM_READ
 };
 
 struct vm_area_struct *get_gate_vma(struct task_struct *tsk)
@@ -896,7 +902,7 @@
 
 const char *arch_vma_name(struct vm_area_struct *vma)
 {
-	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
+	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
 		return "[vdso]";
 	if (vma == &gate_vma)
 		return "[vsyscall]";
diff -uriN linux-2.6.32.43/arch/x86/mm/init.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/init.c
--- linux-2.6.32.43/arch/x86/mm/init.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/init.c	2011-07-15 05:51:11.000000000 -0500
@@ -69,11 +69,7 @@
 	 * cause a hotspot and fill up ZONE_DMA. The page tables
 	 * need roughly 0.5KB per GB.
 	 */
-#ifdef CONFIG_X86_32
-	start = 0x7000;
-#else
-	start = 0x8000;
-#endif
+	start = 0x100000;
 	e820_table_start = find_e820_area(start, max_pfn_mapped<<PAGE_SHIFT,
 					tables, PAGE_SIZE);
 	if (e820_table_start == -1UL)
@@ -147,7 +143,7 @@
 #endif
 
 	set_nx();
-	if (nx_enabled)
+	if (nx_enabled && cpu_has_nx)
 		printk(KERN_INFO "NX (Execute Disable) protection: active\n");
 
 	/* Enable PSE if available */
@@ -329,10 +325,27 @@
  * Access has to be given to non-kernel-ram areas as well, these contain the PCI
  * mmio resources as well as potential bios/acpi data regions.
  */
+
 int devmem_is_allowed(unsigned long pagenr)
 {
+#ifdef CONFIG_GRKERNSEC_KMEM
+	/* allow BDA */
+	if (!pagenr)
+		return 1;
+	/* allow EBDA */
+	if ((0x9f000 >> PAGE_SHIFT) == pagenr)
+		return 1;
+	/* allow ISA/video mem */
+	if ((ISA_START_ADDRESS >> PAGE_SHIFT) <= pagenr && pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
+		return 1;
+	/* throw out everything else below 1MB */
+	if (pagenr <= 256)
+		return 0;
+#else
 	if (pagenr <= 256)
 		return 1;
+#endif
+
 	if (iomem_is_exclusive(pagenr << PAGE_SHIFT))
 		return 0;
 	if (!page_is_ram(pagenr))
@@ -379,6 +392,86 @@
 
 void free_initmem(void)
 {
+
+#ifdef CONFIG_PAX_KERNEXEC
+#ifdef CONFIG_X86_32
+	/* PaX: limit KERNEL_CS to actual size */
+	unsigned long addr, limit;
+	struct desc_struct d;
+	int cpu;
+
+	limit = paravirt_enabled() ? ktva_ktla(0xffffffff) : (unsigned long)&_etext;
+	limit = (limit - 1UL) >> PAGE_SHIFT;
+
+	memset(__LOAD_PHYSICAL_ADDR + PAGE_OFFSET, POISON_FREE_INITMEM, PAGE_SIZE);
+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
+		pack_descriptor(&d, get_desc_base(&get_cpu_gdt_table(cpu)[GDT_ENTRY_KERNEL_CS]), limit, 0x9B, 0xC);
+		write_gdt_entry(get_cpu_gdt_table(cpu), GDT_ENTRY_KERNEL_CS, &d, DESCTYPE_S);
+	}
+
+	/* PaX: make KERNEL_CS read-only */
+	addr = PFN_ALIGN(ktla_ktva((unsigned long)&_text));
+	if (!paravirt_enabled())
+		set_memory_ro(addr, (PFN_ALIGN(_sdata) - addr) >> PAGE_SHIFT);
+/*
+		for (addr = ktla_ktva((unsigned long)&_text); addr < (unsigned long)&_sdata; addr += PMD_SIZE) {
+			pgd = pgd_offset_k(addr);
+			pud = pud_offset(pgd, addr);
+			pmd = pmd_offset(pud, addr);
+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
+		}
+*/
+#ifdef CONFIG_X86_PAE
+	set_memory_nx(PFN_ALIGN(__init_begin), (PFN_ALIGN(__init_end) - PFN_ALIGN(__init_begin)) >> PAGE_SHIFT);
+/*
+	for (addr = (unsigned long)&__init_begin; addr < (unsigned long)&__init_end; addr += PMD_SIZE) {
+		pgd = pgd_offset_k(addr);
+		pud = pud_offset(pgd, addr);
+		pmd = pmd_offset(pud, addr);
+		set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
+	}
+*/
+#endif
+
+#ifdef CONFIG_MODULES
+	set_memory_4k((unsigned long)MODULES_EXEC_VADDR, (MODULES_EXEC_END - MODULES_EXEC_VADDR) >> PAGE_SHIFT);
+#endif
+
+#else
+	pgd_t *pgd;
+	pud_t *pud;
+	pmd_t *pmd;
+	unsigned long addr, end;
+
+	/* PaX: make kernel code/rodata read-only, rest non-executable */
+	for (addr = __START_KERNEL_map; addr < __START_KERNEL_map + KERNEL_IMAGE_SIZE; addr += PMD_SIZE) {
+		pgd = pgd_offset_k(addr);
+		pud = pud_offset(pgd, addr);
+		pmd = pmd_offset(pud, addr);
+		if (!pmd_present(*pmd))
+			continue;
+		if ((unsigned long)_text <= addr && addr < (unsigned long)_sdata)
+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
+		else
+			set_pmd(pmd, __pmd(pmd_val(*pmd) | (_PAGE_NX & __supported_pte_mask)));
+	}
+
+	addr = (unsigned long)__va(__pa(__START_KERNEL_map));
+	end = addr + KERNEL_IMAGE_SIZE;
+	for (; addr < end; addr += PMD_SIZE) {
+		pgd = pgd_offset_k(addr);
+		pud = pud_offset(pgd, addr);
+		pmd = pmd_offset(pud, addr);
+		if (!pmd_present(*pmd))
+			continue;
+		if ((unsigned long)__va(__pa(_text)) <= addr && addr < (unsigned long)__va(__pa(_sdata)))
+			set_pmd(pmd, __pmd(pmd_val(*pmd) & ~_PAGE_RW));
+	}
+#endif
+
+	flush_tlb_all();
+#endif
+
 	free_init_pages("unused kernel memory",
 			(unsigned long)(&__init_begin),
 			(unsigned long)(&__init_end));
diff -uriN linux-2.6.32.43/arch/x86/mm/iomap_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/iomap_32.c
--- linux-2.6.32.43/arch/x86/mm/iomap_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/iomap_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -65,7 +65,11 @@
 	debug_kmap_atomic(type);
 	idx = type + KM_TYPE_NR * smp_processor_id();
 	vaddr = __fix_to_virt(FIX_KMAP_BEGIN + idx);
+
+	pax_open_kernel();
 	set_pte(kmap_pte - idx, pfn_pte(pfn, prot));
+	pax_close_kernel();
+
 	arch_flush_lazy_mmu_mode();
 
 	return (void *)vaddr;
diff -uriN linux-2.6.32.43/arch/x86/mm/ioremap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/ioremap.c
--- linux-2.6.32.43/arch/x86/mm/ioremap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/ioremap.c	2011-07-15 05:51:11.000000000 -0500
@@ -41,8 +41,8 @@
 	 * Second special case: Some BIOSen report the PC BIOS
 	 * area (640->1Mb) as ram even though it is not.
 	 */
-	if (pagenr >= (BIOS_BEGIN >> PAGE_SHIFT) &&
-		    pagenr < (BIOS_END >> PAGE_SHIFT))
+	if (pagenr >= (ISA_START_ADDRESS >> PAGE_SHIFT) &&
+		    pagenr < (ISA_END_ADDRESS >> PAGE_SHIFT))
 		return 0;
 
 	for (i = 0; i < e820.nr_map; i++) {
@@ -137,13 +137,10 @@
 	/*
 	 * Don't allow anybody to remap normal RAM that we're using..
 	 */
-	for (pfn = phys_addr >> PAGE_SHIFT;
-				(pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK);
-				pfn++) {
-
+	for (pfn = phys_addr >> PAGE_SHIFT; ((resource_size_t)pfn << PAGE_SHIFT) < (last_addr & PAGE_MASK); pfn++) {
 		int is_ram = page_is_ram(pfn);
 
-		if (is_ram && pfn_valid(pfn) && !PageReserved(pfn_to_page(pfn)))
+		if (is_ram && pfn_valid(pfn) && (pfn >= 0x100 || !PageReserved(pfn_to_page(pfn))))
 			return NULL;
 		WARN_ON_ONCE(is_ram);
 	}
@@ -407,7 +404,7 @@
 early_param("early_ioremap_debug", early_ioremap_debug_setup);
 
 static __initdata int after_paging_init;
-static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __page_aligned_bss;
+static pte_t bm_pte[PAGE_SIZE/sizeof(pte_t)] __read_only __aligned(PAGE_SIZE);
 
 static inline pmd_t * __init early_ioremap_pmd(unsigned long addr)
 {
@@ -439,8 +436,7 @@
 		slot_virt[i] = __fix_to_virt(FIX_BTMAP_BEGIN - NR_FIX_BTMAPS*i);
 
 	pmd = early_ioremap_pmd(fix_to_virt(FIX_BTMAP_BEGIN));
-	memset(bm_pte, 0, sizeof(bm_pte));
-	pmd_populate_kernel(&init_mm, pmd, bm_pte);
+	pmd_populate_user(&init_mm, pmd, bm_pte);
 
 	/*
 	 * The boot-ioremap range spans multiple pmds, for which
diff -uriN linux-2.6.32.43/arch/x86/mm/kmemcheck/kmemcheck.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/kmemcheck/kmemcheck.c
--- linux-2.6.32.43/arch/x86/mm/kmemcheck/kmemcheck.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/kmemcheck/kmemcheck.c	2011-07-15 05:51:11.000000000 -0500
@@ -622,9 +622,9 @@
 	 * memory (e.g. tracked pages)? For now, we need this to avoid
 	 * invoking kmemcheck for PnP BIOS calls.
 	 */
-	if (regs->flags & X86_VM_MASK)
+	if (v8086_mode(regs))
 		return false;
-	if (regs->cs != __KERNEL_CS)
+	if (regs->cs != __KERNEL_CS && regs->cs != __KERNEXEC_KERNEL_CS)
 		return false;
 
 	pte = kmemcheck_pte_lookup(address);
diff -uriN linux-2.6.32.43/arch/x86/mm/mmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/mmap.c
--- linux-2.6.32.43/arch/x86/mm/mmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/mmap.c	2011-07-15 05:51:11.000000000 -0500
@@ -49,7 +49,7 @@
  * Leave an at least ~128 MB hole with possible stack randomization.
  */
 #define MIN_GAP (128*1024*1024UL + stack_maxrandom_size())
-#define MAX_GAP (TASK_SIZE/6*5)
+#define MAX_GAP (pax_task_size/6*5)
 
 /*
  * True on X86_32 or when emulating IA32 on X86_64
@@ -94,27 +94,40 @@
 	return rnd << PAGE_SHIFT;
 }
 
-static unsigned long mmap_base(void)
+static unsigned long mmap_base(struct mm_struct *mm)
 {
 	unsigned long gap = current->signal->rlim[RLIMIT_STACK].rlim_cur;
+	unsigned long pax_task_size = TASK_SIZE;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
 
 	if (gap < MIN_GAP)
 		gap = MIN_GAP;
 	else if (gap > MAX_GAP)
 		gap = MAX_GAP;
 
-	return PAGE_ALIGN(TASK_SIZE - gap - mmap_rnd());
+	return PAGE_ALIGN(pax_task_size - gap - mmap_rnd());
 }
 
 /*
  * Bottom-up (legacy) layout on X86_32 did not support randomization, X86_64
  * does, but not when emulating X86_32
  */
-static unsigned long mmap_legacy_base(void)
+static unsigned long mmap_legacy_base(struct mm_struct *mm)
 {
-	if (mmap_is_ia32())
+	if (mmap_is_ia32()) {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		if (mm->pax_flags & MF_PAX_SEGMEXEC)
+			return SEGMEXEC_TASK_UNMAPPED_BASE;
+		else
+#endif
+
 		return TASK_UNMAPPED_BASE;
-	else
+	} else
 		return TASK_UNMAPPED_BASE + mmap_rnd();
 }
 
@@ -125,11 +138,23 @@
 void arch_pick_mmap_layout(struct mm_struct *mm)
 {
 	if (mmap_is_legacy()) {
-		mm->mmap_base = mmap_legacy_base();
+		mm->mmap_base = mmap_legacy_base(mm);
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base += mm->delta_mmap;
+#endif
+
 		mm->get_unmapped_area = arch_get_unmapped_area;
 		mm->unmap_area = arch_unmap_area;
 	} else {
-		mm->mmap_base = mmap_base();
+		mm->mmap_base = mmap_base(mm);
+
+#ifdef CONFIG_PAX_RANDMMAP
+		if (mm->pax_flags & MF_PAX_RANDMMAP)
+			mm->mmap_base -= mm->delta_mmap + mm->delta_stack;
+#endif
+
 		mm->get_unmapped_area = arch_get_unmapped_area_topdown;
 		mm->unmap_area = arch_unmap_area_topdown;
 	}
diff -uriN linux-2.6.32.43/arch/x86/mm/mmio-mod.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/mmio-mod.c
--- linux-2.6.32.43/arch/x86/mm/mmio-mod.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/mmio-mod.c	2011-07-15 05:51:11.000000000 -0500
@@ -193,7 +193,7 @@
 		break;
 	default:
 		{
-			unsigned char *ip = (unsigned char *)instptr;
+			unsigned char *ip = (unsigned char *)ktla_ktva(instptr);
 			my_trace->opcode = MMIO_UNKNOWN_OP;
 			my_trace->width = 0;
 			my_trace->value = (*ip) << 16 | *(ip + 1) << 8 |
@@ -233,7 +233,7 @@
 static void ioremap_trace_core(resource_size_t offset, unsigned long size,
 							void __iomem *addr)
 {
-	static atomic_t next_id;
+	static atomic_unchecked_t next_id;
 	struct remap_trace *trace = kmalloc(sizeof(*trace), GFP_KERNEL);
 	/* These are page-unaligned. */
 	struct mmiotrace_map map = {
@@ -257,7 +257,7 @@
 			.private = trace
 		},
 		.phys = offset,
-		.id = atomic_inc_return(&next_id)
+		.id = atomic_inc_return_unchecked(&next_id)
 	};
 	map.map_id = trace->id;
 
diff -uriN linux-2.6.32.43/arch/x86/mm/numa_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/numa_32.c
--- linux-2.6.32.43/arch/x86/mm/numa_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/numa_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -98,7 +98,6 @@
 }
 #endif
 
-extern unsigned long find_max_low_pfn(void);
 extern unsigned long highend_pfn, highstart_pfn;
 
 #define LARGE_PAGE_BYTES (PTRS_PER_PTE * PAGE_SIZE)
diff -uriN linux-2.6.32.43/arch/x86/mm/pageattr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pageattr.c
--- linux-2.6.32.43/arch/x86/mm/pageattr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pageattr.c	2011-07-15 05:51:11.000000000 -0500
@@ -261,16 +261,17 @@
 	 * PCI BIOS based config access (CONFIG_PCI_GOBIOS) support.
 	 */
 	if (within(pfn, BIOS_BEGIN >> PAGE_SHIFT, BIOS_END >> PAGE_SHIFT))
-		pgprot_val(forbidden) |= _PAGE_NX;
+		pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
 
 	/*
 	 * The kernel text needs to be executable for obvious reasons
 	 * Does not cover __inittext since that is gone later on. On
 	 * 64bit we do not enforce !NX on the low mapping
 	 */
-	if (within(address, (unsigned long)_text, (unsigned long)_etext))
-		pgprot_val(forbidden) |= _PAGE_NX;
+	if (within(address, ktla_ktva((unsigned long)_text), ktla_ktva((unsigned long)_etext)))
+		pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
 
+#ifdef CONFIG_DEBUG_RODATA
 	/*
 	 * The .rodata section needs to be read-only. Using the pfn
 	 * catches all aliases.
@@ -278,6 +279,14 @@
 	if (within(pfn, __pa((unsigned long)__start_rodata) >> PAGE_SHIFT,
 		   __pa((unsigned long)__end_rodata) >> PAGE_SHIFT))
 		pgprot_val(forbidden) |= _PAGE_RW;
+#endif
+
+#ifdef CONFIG_PAX_KERNEXEC
+	if (within(pfn, __pa((unsigned long)&_text), __pa((unsigned long)&_sdata))) {
+		pgprot_val(forbidden) |= _PAGE_RW;
+		pgprot_val(forbidden) |= _PAGE_NX & __supported_pte_mask;
+	}
+#endif
 
 	prot = __pgprot(pgprot_val(prot) & ~pgprot_val(forbidden));
 
@@ -331,23 +340,37 @@
 static void __set_pmd_pte(pte_t *kpte, unsigned long address, pte_t pte)
 {
 	/* change init_mm */
+	pax_open_kernel();
 	set_pte_atomic(kpte, pte);
+
 #ifdef CONFIG_X86_32
 	if (!SHARED_KERNEL_PMD) {
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+		unsigned long cpu;
+#else
 		struct page *page;
+#endif
 
+#ifdef CONFIG_PAX_PER_CPU_PGD
+		for (cpu = 0; cpu < NR_CPUS; ++cpu) {
+			pgd_t *pgd = get_cpu_pgd(cpu);
+#else
 		list_for_each_entry(page, &pgd_list, lru) {
-			pgd_t *pgd;
+			pgd_t *pgd = (pgd_t *)page_address(page);
+#endif
+
 			pud_t *pud;
 			pmd_t *pmd;
 
-			pgd = (pgd_t *)page_address(page) + pgd_index(address);
+			pgd += pgd_index(address);
 			pud = pud_offset(pgd, address);
 			pmd = pmd_offset(pud, address);
 			set_pte_atomic((pte_t *)pmd, pte);
 		}
 	}
 #endif
+	pax_close_kernel();
 }
 
 static int
diff -uriN linux-2.6.32.43/arch/x86/mm/pageattr-test.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pageattr-test.c
--- linux-2.6.32.43/arch/x86/mm/pageattr-test.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pageattr-test.c	2011-07-15 05:51:11.000000000 -0500
@@ -36,7 +36,7 @@
 
 static int pte_testbit(pte_t pte)
 {
-	return pte_flags(pte) & _PAGE_UNUSED1;
+	return pte_flags(pte) & _PAGE_CPA_TEST;
 }
 
 struct split_state {
diff -uriN linux-2.6.32.43/arch/x86/mm/pat.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pat.c
--- linux-2.6.32.43/arch/x86/mm/pat.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pat.c	2011-07-15 05:51:11.000000000 -0500
@@ -258,7 +258,7 @@
 
  conflict:
 	printk(KERN_INFO "%s:%d conflicting memory types "
-	       "%Lx-%Lx %s<->%s\n", current->comm, current->pid, new->start,
+	       "%Lx-%Lx %s<->%s\n", current->comm, task_pid_nr(current), new->start,
 	       new->end, cattr_name(new->type), cattr_name(entry->type));
 	return -EBUSY;
 }
@@ -559,7 +559,7 @@
 
 	if (err) {
 		printk(KERN_INFO "%s:%d freeing invalid memtype %Lx-%Lx\n",
-			current->comm, current->pid, start, end);
+			current->comm, task_pid_nr(current), start, end);
 	}
 
 	dprintk("free_memtype request 0x%Lx-0x%Lx\n", start, end);
@@ -689,8 +689,8 @@
 	while (cursor < to) {
 		if (!devmem_is_allowed(pfn)) {
 			printk(KERN_INFO
-		"Program %s tried to access /dev/mem between %Lx->%Lx.\n",
-				current->comm, from, to);
+		"Program %s tried to access /dev/mem between %Lx->%Lx (%Lx).\n",
+				current->comm, from, to, cursor);
 			return 0;
 		}
 		cursor += PAGE_SIZE;
@@ -755,7 +755,7 @@
 		printk(KERN_INFO
 			"%s:%d ioremap_change_attr failed %s "
 			"for %Lx-%Lx\n",
-			current->comm, current->pid,
+			current->comm, task_pid_nr(current),
 			cattr_name(flags),
 			base, (unsigned long long)(base + size));
 		return -EINVAL;
@@ -813,7 +813,7 @@
 			free_memtype(paddr, paddr + size);
 			printk(KERN_ERR "%s:%d map pfn expected mapping type %s"
 				" for %Lx-%Lx, got %s\n",
-				current->comm, current->pid,
+				current->comm, task_pid_nr(current),
 				cattr_name(want_flags),
 				(unsigned long long)paddr,
 				(unsigned long long)(paddr + size),
diff -uriN linux-2.6.32.43/arch/x86/mm/pf_in.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pf_in.c
--- linux-2.6.32.43/arch/x86/mm/pf_in.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pf_in.c	2011-07-15 05:51:11.000000000 -0500
@@ -148,7 +148,7 @@
 	int i;
 	enum reason_type rv = OTHERS;
 
-	p = (unsigned char *)ins_addr;
+	p = (unsigned char *)ktla_ktva(ins_addr);
 	p += skip_prefix(p, &prf);
 	p += get_opcode(p, &opcode);
 
@@ -168,7 +168,7 @@
 	struct prefix_bits prf;
 	int i;
 
-	p = (unsigned char *)ins_addr;
+	p = (unsigned char *)ktla_ktva(ins_addr);
 	p += skip_prefix(p, &prf);
 	p += get_opcode(p, &opcode);
 
@@ -191,7 +191,7 @@
 	struct prefix_bits prf;
 	int i;
 
-	p = (unsigned char *)ins_addr;
+	p = (unsigned char *)ktla_ktva(ins_addr);
 	p += skip_prefix(p, &prf);
 	p += get_opcode(p, &opcode);
 
@@ -417,7 +417,7 @@
 	int i;
 	unsigned long rv;
 
-	p = (unsigned char *)ins_addr;
+	p = (unsigned char *)ktla_ktva(ins_addr);
 	p += skip_prefix(p, &prf);
 	p += get_opcode(p, &opcode);
 	for (i = 0; i < ARRAY_SIZE(reg_rop); i++)
@@ -472,7 +472,7 @@
 	int i;
 	unsigned long rv;
 
-	p = (unsigned char *)ins_addr;
+	p = (unsigned char *)ktla_ktva(ins_addr);
 	p += skip_prefix(p, &prf);
 	p += get_opcode(p, &opcode);
 	for (i = 0; i < ARRAY_SIZE(imm_wop); i++)
diff -uriN linux-2.6.32.43/arch/x86/mm/pgtable_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pgtable_32.c
--- linux-2.6.32.43/arch/x86/mm/pgtable_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pgtable_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -49,10 +49,13 @@
 		return;
 	}
 	pte = pte_offset_kernel(pmd, vaddr);
+
+	pax_open_kernel();
 	if (pte_val(pteval))
 		set_pte_at(&init_mm, vaddr, pte, pteval);
 	else
 		pte_clear(&init_mm, vaddr, pte);
+	pax_close_kernel();
 
 	/*
 	 * It's enough to flush this one mapping.
diff -uriN linux-2.6.32.43/arch/x86/mm/pgtable.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pgtable.c
--- linux-2.6.32.43/arch/x86/mm/pgtable.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/pgtable.c	2011-07-15 05:51:11.000000000 -0500
@@ -83,9 +83,52 @@
 	list_del(&page->lru);
 }
 
-#define UNSHARED_PTRS_PER_PGD				\
-	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+pgdval_t clone_pgd_mask __read_only = ~_PAGE_PRESENT;
 
+void __shadow_user_pgds(pgd_t *dst, const pgd_t *src, int count)
+{
+	while (count--)
+		*dst++ = __pgd((pgd_val(*src++) | (_PAGE_NX & __supported_pte_mask)) & ~_PAGE_USER);
+}
+#endif
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+void __clone_user_pgds(pgd_t *dst, const pgd_t *src, int count)
+{
+	while (count--)
+
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+		*dst++ = __pgd(pgd_val(*src++) & clone_pgd_mask);
+#else
+		*dst++ = *src++;
+#endif
+
+}
+#endif
+
+#ifdef CONFIG_X86_64
+#define pxd_t				pud_t
+#define pyd_t				pgd_t
+#define paravirt_release_pxd(pfn)	paravirt_release_pud(pfn)
+#define pxd_free(mm, pud)		pud_free((mm), (pud))
+#define pyd_populate(mm, pgd, pud)	pgd_populate((mm), (pgd), (pud))
+#define pyd_offset(mm ,address)		pgd_offset((mm), (address))
+#define PYD_SIZE			PGDIR_SIZE
+#else
+#define pxd_t				pmd_t
+#define pyd_t				pud_t
+#define paravirt_release_pxd(pfn)	paravirt_release_pmd(pfn)
+#define pxd_free(mm, pud)		pmd_free((mm), (pud))
+#define pyd_populate(mm, pgd, pud)	pud_populate((mm), (pgd), (pud))
+#define pyd_offset(mm ,address)		pud_offset((mm), (address))
+#define PYD_SIZE			PUD_SIZE
+#endif
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+static inline void pgd_ctor(pgd_t *pgd) {}
+static inline void pgd_dtor(pgd_t *pgd) {}
+#else
 static void pgd_ctor(pgd_t *pgd)
 {
 	/* If the pgd points to a shared pagetable level (either the
@@ -119,6 +162,7 @@
 	pgd_list_del(pgd);
 	spin_unlock_irqrestore(&pgd_lock, flags);
 }
+#endif
 
 /*
  * List of all pgd's needed for non-PAE so it can invalidate entries
@@ -131,7 +175,7 @@
  * -- wli
  */
 
-#ifdef CONFIG_X86_PAE
+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
 /*
  * In PAE mode, we need to do a cr3 reload (=tlb flush) when
  * updating the top-level pagetable entries to guarantee the
@@ -143,7 +187,7 @@
  * not shared between pagetables (!SHARED_KERNEL_PMDS), we allocate
  * and initialize the kernel pmds here.
  */
-#define PREALLOCATED_PMDS	UNSHARED_PTRS_PER_PGD
+#define PREALLOCATED_PXDS	(SHARED_KERNEL_PMD ? KERNEL_PGD_BOUNDARY : PTRS_PER_PGD)
 
 void pud_populate(struct mm_struct *mm, pud_t *pudp, pmd_t *pmd)
 {
@@ -161,36 +205,38 @@
 	 */
 	flush_tlb_mm(mm);
 }
+#elif defined(CONFIG_X86_64) && defined(CONFIG_PAX_PER_CPU_PGD)
+#define PREALLOCATED_PXDS	USER_PGD_PTRS
 #else  /* !CONFIG_X86_PAE */
 
 /* No need to prepopulate any pagetable entries in non-PAE modes. */
-#define PREALLOCATED_PMDS	0
+#define PREALLOCATED_PXDS	0
 
 #endif	/* CONFIG_X86_PAE */
 
-static void free_pmds(pmd_t *pmds[])
+static void free_pxds(pxd_t *pxds[])
 {
 	int i;
 
-	for(i = 0; i < PREALLOCATED_PMDS; i++)
-		if (pmds[i])
-			free_page((unsigned long)pmds[i]);
+	for(i = 0; i < PREALLOCATED_PXDS; i++)
+		if (pxds[i])
+			free_page((unsigned long)pxds[i]);
 }
 
-static int preallocate_pmds(pmd_t *pmds[])
+static int preallocate_pxds(pxd_t *pxds[])
 {
 	int i;
 	bool failed = false;
 
-	for(i = 0; i < PREALLOCATED_PMDS; i++) {
-		pmd_t *pmd = (pmd_t *)__get_free_page(PGALLOC_GFP);
-		if (pmd == NULL)
+	for(i = 0; i < PREALLOCATED_PXDS; i++) {
+		pxd_t *pxd = (pxd_t *)__get_free_page(PGALLOC_GFP);
+		if (pxd == NULL)
 			failed = true;
-		pmds[i] = pmd;
+		pxds[i] = pxd;
 	}
 
 	if (failed) {
-		free_pmds(pmds);
+		free_pxds(pxds);
 		return -ENOMEM;
 	}
 
@@ -203,51 +249,56 @@
  * preallocate which never got a corresponding vma will need to be
  * freed manually.
  */
-static void pgd_mop_up_pmds(struct mm_struct *mm, pgd_t *pgdp)
+static void pgd_mop_up_pxds(struct mm_struct *mm, pgd_t *pgdp)
 {
 	int i;
 
-	for(i = 0; i < PREALLOCATED_PMDS; i++) {
+	for(i = 0; i < PREALLOCATED_PXDS; i++) {
 		pgd_t pgd = pgdp[i];
 
 		if (pgd_val(pgd) != 0) {
-			pmd_t *pmd = (pmd_t *)pgd_page_vaddr(pgd);
+			pxd_t *pxd = (pxd_t *)pgd_page_vaddr(pgd);
 
-			pgdp[i] = native_make_pgd(0);
+			set_pgd(pgdp + i, native_make_pgd(0));
 
-			paravirt_release_pmd(pgd_val(pgd) >> PAGE_SHIFT);
-			pmd_free(mm, pmd);
+			paravirt_release_pxd(pgd_val(pgd) >> PAGE_SHIFT);
+			pxd_free(mm, pxd);
 		}
 	}
 }
 
-static void pgd_prepopulate_pmd(struct mm_struct *mm, pgd_t *pgd, pmd_t *pmds[])
+static void pgd_prepopulate_pxd(struct mm_struct *mm, pgd_t *pgd, pxd_t *pxds[])
 {
-	pud_t *pud;
+	pyd_t *pyd;
 	unsigned long addr;
 	int i;
 
-	if (PREALLOCATED_PMDS == 0) /* Work around gcc-3.4.x bug */
+	if (PREALLOCATED_PXDS == 0) /* Work around gcc-3.4.x bug */
 		return;
 
-	pud = pud_offset(pgd, 0);
-
- 	for (addr = i = 0; i < PREALLOCATED_PMDS;
-	     i++, pud++, addr += PUD_SIZE) {
-		pmd_t *pmd = pmds[i];
+#ifdef CONFIG_X86_64
+	pyd = pyd_offset(mm, 0L);
+#else
+	pyd = pyd_offset(pgd, 0L);
+#endif
+
+ 	for (addr = i = 0; i < PREALLOCATED_PXDS;
+	     i++, pyd++, addr += PYD_SIZE) {
+		pxd_t *pxd = pxds[i];
 
 		if (i >= KERNEL_PGD_BOUNDARY)
-			memcpy(pmd, (pmd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
-			       sizeof(pmd_t) * PTRS_PER_PMD);
+			memcpy(pxd, (pxd_t *)pgd_page_vaddr(swapper_pg_dir[i]),
+			       sizeof(pxd_t) * PTRS_PER_PMD);
 
-		pud_populate(mm, pud, pmd);
+		pyd_populate(mm, pyd, pxd);
 	}
 }
 
 pgd_t *pgd_alloc(struct mm_struct *mm)
 {
 	pgd_t *pgd;
-	pmd_t *pmds[PREALLOCATED_PMDS];
+	pxd_t *pxds[PREALLOCATED_PXDS];
+
 	unsigned long flags;
 
 	pgd = (pgd_t *)__get_free_page(PGALLOC_GFP);
@@ -257,11 +308,11 @@
 
 	mm->pgd = pgd;
 
-	if (preallocate_pmds(pmds) != 0)
+	if (preallocate_pxds(pxds) != 0)
 		goto out_free_pgd;
 
 	if (paravirt_pgd_alloc(mm) != 0)
-		goto out_free_pmds;
+		goto out_free_pxds;
 
 	/*
 	 * Make sure that pre-populating the pmds is atomic with
@@ -271,14 +322,14 @@
 	spin_lock_irqsave(&pgd_lock, flags);
 
 	pgd_ctor(pgd);
-	pgd_prepopulate_pmd(mm, pgd, pmds);
+	pgd_prepopulate_pxd(mm, pgd, pxds);
 
 	spin_unlock_irqrestore(&pgd_lock, flags);
 
 	return pgd;
 
-out_free_pmds:
-	free_pmds(pmds);
+out_free_pxds:
+	free_pxds(pxds);
 out_free_pgd:
 	free_page((unsigned long)pgd);
 out:
@@ -287,7 +338,7 @@
 
 void pgd_free(struct mm_struct *mm, pgd_t *pgd)
 {
-	pgd_mop_up_pmds(mm, pgd);
+	pgd_mop_up_pxds(mm, pgd);
 	pgd_dtor(pgd);
 	paravirt_pgd_free(mm, pgd);
 	free_page((unsigned long)pgd);
diff -uriN linux-2.6.32.43/arch/x86/mm/setup_nx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/setup_nx.c
--- linux-2.6.32.43/arch/x86/mm/setup_nx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/setup_nx.c	2011-07-15 05:51:11.000000000 -0500
@@ -4,11 +4,10 @@
 
 #include <asm/pgtable.h>
 
+#if defined(CONFIG_X86_32) && defined(CONFIG_X86_PAE)
 int nx_enabled;
 
-#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
-static int disable_nx __cpuinitdata;
-
+#ifndef CONFIG_PAX_PAGEEXEC
 /*
  * noexec = on|off
  *
@@ -22,32 +21,26 @@
 	if (!str)
 		return -EINVAL;
 	if (!strncmp(str, "on", 2)) {
-		__supported_pte_mask |= _PAGE_NX;
-		disable_nx = 0;
+		nx_enabled = 1;
 	} else if (!strncmp(str, "off", 3)) {
-		disable_nx = 1;
-		__supported_pte_mask &= ~_PAGE_NX;
+		nx_enabled = 0;
 	}
 	return 0;
 }
 early_param("noexec", noexec_setup);
 #endif
+#endif
 
 #ifdef CONFIG_X86_PAE
 void __init set_nx(void)
 {
-	unsigned int v[4], l, h;
+	if (!nx_enabled && cpu_has_nx) {
+		unsigned l, h;
 
-	if (cpu_has_pae && (cpuid_eax(0x80000000) > 0x80000001)) {
-		cpuid(0x80000001, &v[0], &v[1], &v[2], &v[3]);
-
-		if ((v[3] & (1 << 20)) && !disable_nx) {
-			rdmsr(MSR_EFER, l, h);
-			l |= EFER_NX;
-			wrmsr(MSR_EFER, l, h);
-			nx_enabled = 1;
-			__supported_pte_mask |= _PAGE_NX;
-		}
+		__supported_pte_mask &= ~_PAGE_NX;
+		rdmsr(MSR_EFER, l, h);
+		l &= ~EFER_NX;
+		wrmsr(MSR_EFER, l, h);
 	}
 }
 #else
@@ -62,7 +55,7 @@
 	unsigned long efer;
 
 	rdmsrl(MSR_EFER, efer);
-	if (!(efer & EFER_NX) || disable_nx)
+	if (!(efer & EFER_NX) || !nx_enabled)
 		__supported_pte_mask &= ~_PAGE_NX;
 }
 #endif
diff -uriN linux-2.6.32.43/arch/x86/mm/tlb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/tlb.c
--- linux-2.6.32.43/arch/x86/mm/tlb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/mm/tlb.c	2011-07-15 05:51:11.000000000 -0500
@@ -61,7 +61,11 @@
 		BUG();
 	cpumask_clear_cpu(cpu,
 			  mm_cpumask(percpu_read(cpu_tlbstate.active_mm)));
+
+#ifndef CONFIG_PAX_PER_CPU_PGD
 	load_cr3(swapper_pg_dir);
+#endif
+
 }
 EXPORT_SYMBOL_GPL(leave_mm);
 
diff -uriN linux-2.6.32.43/arch/x86/oprofile/backtrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/oprofile/backtrace.c
--- linux-2.6.32.43/arch/x86/oprofile/backtrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/oprofile/backtrace.c	2011-07-15 05:51:11.000000000 -0500
@@ -57,7 +57,7 @@
 	struct frame_head bufhead[2];
 
 	/* Also check accessibility of one struct frame_head beyond */
-	if (!access_ok(VERIFY_READ, head, sizeof(bufhead)))
+	if (!__access_ok(VERIFY_READ, head, sizeof(bufhead)))
 		return NULL;
 	if (__copy_from_user_inatomic(bufhead, head, sizeof(bufhead)))
 		return NULL;
@@ -77,7 +77,7 @@
 {
 	struct frame_head *head = (struct frame_head *)frame_pointer(regs);
 
-	if (!user_mode_vm(regs)) {
+	if (!user_mode(regs)) {
 		unsigned long stack = kernel_stack_pointer(regs);
 		if (depth)
 			dump_trace(NULL, regs, (unsigned long *)stack, 0,
diff -uriN linux-2.6.32.43/arch/x86/oprofile/op_model_p4.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/oprofile/op_model_p4.c
--- linux-2.6.32.43/arch/x86/oprofile/op_model_p4.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/oprofile/op_model_p4.c	2011-07-15 05:51:11.000000000 -0500
@@ -50,7 +50,7 @@
 #endif
 }
 
-static int inline addr_increment(void)
+static inline int addr_increment(void)
 {
 #ifdef CONFIG_SMP
 	return smp_num_siblings == 2 ? 2 : 1;
diff -uriN linux-2.6.32.43/arch/x86/pci/common.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/common.c
--- linux-2.6.32.43/arch/x86/pci/common.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/common.c	2011-07-15 05:51:11.000000000 -0500
@@ -31,8 +31,8 @@
 int pcibios_last_bus = -1;
 unsigned long pirq_table_addr;
 struct pci_bus *pci_root_bus;
-struct pci_raw_ops *raw_pci_ops;
-struct pci_raw_ops *raw_pci_ext_ops;
+const struct pci_raw_ops *raw_pci_ops;
+const struct pci_raw_ops *raw_pci_ext_ops;
 
 int raw_pci_read(unsigned int domain, unsigned int bus, unsigned int devfn,
 						int reg, int len, u32 *val)
diff -uriN linux-2.6.32.43/arch/x86/pci/direct.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/direct.c
--- linux-2.6.32.43/arch/x86/pci/direct.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/direct.c	2011-07-15 05:51:11.000000000 -0500
@@ -79,7 +79,7 @@
 
 #undef PCI_CONF1_ADDRESS
 
-struct pci_raw_ops pci_direct_conf1 = {
+const struct pci_raw_ops pci_direct_conf1 = {
 	.read =		pci_conf1_read,
 	.write =	pci_conf1_write,
 };
@@ -173,7 +173,7 @@
 
 #undef PCI_CONF2_ADDRESS
 
-struct pci_raw_ops pci_direct_conf2 = {
+const struct pci_raw_ops pci_direct_conf2 = {
 	.read =		pci_conf2_read,
 	.write =	pci_conf2_write,
 };
@@ -189,7 +189,7 @@
  * This should be close to trivial, but it isn't, because there are buggy
  * chipsets (yes, you guessed it, by Intel and Compaq) that have no class ID.
  */
-static int __init pci_sanity_check(struct pci_raw_ops *o)
+static int __init pci_sanity_check(const struct pci_raw_ops *o)
 {
 	u32 x = 0;
 	int year, devfn;
diff -uriN linux-2.6.32.43/arch/x86/pci/mmconfig_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/mmconfig_32.c
--- linux-2.6.32.43/arch/x86/pci/mmconfig_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/mmconfig_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -125,7 +125,7 @@
 	return 0;
 }
 
-static struct pci_raw_ops pci_mmcfg = {
+static const struct pci_raw_ops pci_mmcfg = {
 	.read =		pci_mmcfg_read,
 	.write =	pci_mmcfg_write,
 };
diff -uriN linux-2.6.32.43/arch/x86/pci/mmconfig_64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/mmconfig_64.c
--- linux-2.6.32.43/arch/x86/pci/mmconfig_64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/mmconfig_64.c	2011-07-15 05:51:11.000000000 -0500
@@ -104,7 +104,7 @@
 	return 0;
 }
 
-static struct pci_raw_ops pci_mmcfg = {
+static const struct pci_raw_ops pci_mmcfg = {
 	.read =		pci_mmcfg_read,
 	.write =	pci_mmcfg_write,
 };
diff -uriN linux-2.6.32.43/arch/x86/pci/numaq_32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/numaq_32.c
--- linux-2.6.32.43/arch/x86/pci/numaq_32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/numaq_32.c	2011-07-15 05:51:11.000000000 -0500
@@ -112,7 +112,7 @@
 
 #undef PCI_CONF1_MQ_ADDRESS
 
-static struct pci_raw_ops pci_direct_conf1_mq = {
+static const struct pci_raw_ops pci_direct_conf1_mq = {
 	.read	= pci_conf1_mq_read,
 	.write	= pci_conf1_mq_write
 };
diff -uriN linux-2.6.32.43/arch/x86/pci/olpc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/olpc.c
--- linux-2.6.32.43/arch/x86/pci/olpc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/olpc.c	2011-07-15 05:51:11.000000000 -0500
@@ -297,7 +297,7 @@
 	return 0;
 }
 
-static struct pci_raw_ops pci_olpc_conf = {
+static const struct pci_raw_ops pci_olpc_conf = {
 	.read =	pci_olpc_read,
 	.write = pci_olpc_write,
 };
diff -uriN linux-2.6.32.43/arch/x86/pci/pcbios.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/pcbios.c
--- linux-2.6.32.43/arch/x86/pci/pcbios.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/pci/pcbios.c	2011-07-15 05:51:11.000000000 -0500
@@ -56,50 +56,93 @@
 static struct {
 	unsigned long address;
 	unsigned short segment;
-} bios32_indirect = { 0, __KERNEL_CS };
+} bios32_indirect __read_only = { 0, __PCIBIOS_CS };
 
 /*
  * Returns the entry point for the given service, NULL on error
  */
 
-static unsigned long bios32_service(unsigned long service)
+static unsigned long __devinit bios32_service(unsigned long service)
 {
 	unsigned char return_code;	/* %al */
 	unsigned long address;		/* %ebx */
 	unsigned long length;		/* %ecx */
 	unsigned long entry;		/* %edx */
 	unsigned long flags;
+	struct desc_struct d, *gdt;
 
 	local_irq_save(flags);
-	__asm__("lcall *(%%edi); cld"
+
+	gdt = get_cpu_gdt_table(smp_processor_id());
+
+	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x9B, 0xC);
+	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
+	pack_descriptor(&d, 0UL, 0xFFFFFUL, 0x93, 0xC);
+	write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
+
+	__asm__("movw %w7, %%ds; lcall *(%%edi); push %%ss; pop %%ds; cld"
 		: "=a" (return_code),
 		  "=b" (address),
 		  "=c" (length),
 		  "=d" (entry)
 		: "0" (service),
 		  "1" (0),
-		  "D" (&bios32_indirect));
+		  "D" (&bios32_indirect),
+		  "r"(__PCIBIOS_DS)
+		: "memory");
+
+	pax_open_kernel();
+	gdt[GDT_ENTRY_PCIBIOS_CS].a = 0;
+	gdt[GDT_ENTRY_PCIBIOS_CS].b = 0;
+	gdt[GDT_ENTRY_PCIBIOS_DS].a = 0;
+	gdt[GDT_ENTRY_PCIBIOS_DS].b = 0;
+	pax_close_kernel();
+
 	local_irq_restore(flags);
 
 	switch (return_code) {
-		case 0:
-			return address + entry;
-		case 0x80:	/* Not present */
-			printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
-			return 0;
-		default: /* Shouldn't happen */
-			printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
-				service, return_code);
+	case 0: {
+		int cpu;
+		unsigned char flags;
+
+		printk(KERN_INFO "bios32_service: base:%08lx length:%08lx entry:%08lx\n", address, length, entry);
+		if (address >= 0xFFFF0 || length > 0x100000 - address || length <= entry) {
+			printk(KERN_WARNING "bios32_service: not valid\n");
 			return 0;
+		}
+		address = address + PAGE_OFFSET;
+		length += 16UL; /* some BIOSs underreport this... */
+		flags = 4;
+		if (length >= 64*1024*1024) {
+			length >>= PAGE_SHIFT;
+			flags |= 8;
+		}
+
+		for (cpu = 0; cpu < NR_CPUS; cpu++) {
+			gdt = get_cpu_gdt_table(cpu);
+			pack_descriptor(&d, address, length, 0x9b, flags);
+			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_CS, &d, DESCTYPE_S);
+			pack_descriptor(&d, address, length, 0x93, flags);
+			write_gdt_entry(gdt, GDT_ENTRY_PCIBIOS_DS, &d, DESCTYPE_S);
+		}
+		return entry;
+	}
+	case 0x80:	/* Not present */
+		printk(KERN_WARNING "bios32_service(0x%lx): not present\n", service);
+		return 0;
+	default: /* Shouldn't happen */
+		printk(KERN_WARNING "bios32_service(0x%lx): returned 0x%x -- BIOS bug!\n",
+			service, return_code);
+		return 0;
 	}
 }
 
 static struct {
 	unsigned long address;
 	unsigned short segment;
-} pci_indirect = { 0, __KERNEL_CS };
+} pci_indirect __read_only = { 0, __PCIBIOS_CS };
 
-static int pci_bios_present;
+static int pci_bios_present __read_only;
 
 static int __devinit check_pcibios(void)
 {
@@ -108,11 +151,13 @@
 	unsigned long flags, pcibios_entry;
 
 	if ((pcibios_entry = bios32_service(PCI_SERVICE))) {
-		pci_indirect.address = pcibios_entry + PAGE_OFFSET;
+		pci_indirect.address = pcibios_entry;
 
 		local_irq_save(flags);
-		__asm__(
-			"lcall *(%%edi); cld\n\t"
+		__asm__("movw %w6, %%ds\n\t"
+			"lcall *%%ss:(%%edi); cld\n\t"
+			"push %%ss\n\t"
+			"pop %%ds\n\t"
 			"jc 1f\n\t"
 			"xor %%ah, %%ah\n"
 			"1:"
@@ -121,7 +166,8 @@
 			  "=b" (ebx),
 			  "=c" (ecx)
 			: "1" (PCIBIOS_PCI_BIOS_PRESENT),
-			  "D" (&pci_indirect)
+			  "D" (&pci_indirect),
+			  "r" (__PCIBIOS_DS)
 			: "memory");
 		local_irq_restore(flags);
 
@@ -165,7 +211,10 @@
 
 	switch (len) {
 	case 1:
-		__asm__("lcall *(%%esi); cld\n\t"
+		__asm__("movw %w6, %%ds\n\t"
+			"lcall *%%ss:(%%esi); cld\n\t"
+			"push %%ss\n\t"
+			"pop %%ds\n\t"
 			"jc 1f\n\t"
 			"xor %%ah, %%ah\n"
 			"1:"
@@ -174,7 +223,8 @@
 			: "1" (PCIBIOS_READ_CONFIG_BYTE),
 			  "b" (bx),
 			  "D" ((long)reg),
-			  "S" (&pci_indirect));
+			  "S" (&pci_indirect),
+			  "r" (__PCIBIOS_DS));
 		/*
 		 * Zero-extend the result beyond 8 bits, do not trust the
 		 * BIOS having done it:
@@ -182,7 +232,10 @@
 		*value &= 0xff;
 		break;
 	case 2:
-		__asm__("lcall *(%%esi); cld\n\t"
+		__asm__("movw %w6, %%ds\n\t"
+			"lcall *%%ss:(%%esi); cld\n\t"
+			"push %%ss\n\t"
+			"pop %%ds\n\t"
 			"jc 1f\n\t"
 			"xor %%ah, %%ah\n"
 			"1:"
@@ -191,7 +244,8 @@
 			: "1" (PCIBIOS_READ_CONFIG_WORD),
 			  "b" (bx),
 			  "D" ((long)reg),
-			  "S" (&pci_indirect));
+			  "S" (&pci_indirect),
+			  "r" (__PCIBIOS_DS));
 		/*
 		 * Zero-extend the result beyond 16 bits, do not trust the
 		 * BIOS having done it:
@@ -199,7 +253,10 @@
 		*value &= 0xffff;
 		break;
 	case 4:
-		__asm__("lcall *(%%esi); cld\n\t"
+		__asm__("movw %w6, %%ds\n\t"
+			"lcall *%%ss:(%%esi); cld\n\t"
+			"push %%ss\n\t"
+			"pop %%ds\n\t"
 			"jc 1f\n\t"
 			"xor %%ah, %%ah\n"
 			"1:"
@@ -208,7 +265,8 @@
 			: "1" (PCIBIOS_READ_CONFIG_DWORD),
 			  "b" (bx),
 			  "D" ((long)reg),
-			  "S" (&pci_indirect));
+			  "S" (&pci_indirect),
+			  "r" (__PCIBIOS_DS));
 		break;
 	}
 
@@ -231,7 +289,10 @@
 
 	switch (len) {
 	case 1:
-		__asm__("lcall *(%%esi); cld\n\t"
+		__asm__("movw %w6, %%ds\n\t"
+			"lcall *%%ss:(%%esi); cld\n\t"
+			"push %%ss\n\t"
+			"pop %%ds\n\t"
 			"jc 1f\n\t"
 			"xor %%ah, %%ah\n"
 			"1:"
@@ -240,10 +301,14 @@
 			  "c" (value),
 			  "b" (bx),
 			  "D" ((long)reg),
-			  "S" (&pci_indirect));
+			  "S" (&pci_indirect),
+			  "r" (__PCIBIOS_DS));
 		break;
 	case 2:
-		__asm__("lcall *(%%esi); cld\n\t"
+		__asm__("movw %w6, %%ds\n\t"
+			"lcall *%%ss:(%%esi); cld\n\t"
+			"push %%ss\n\t"
+			"pop %%ds\n\t"
 			"jc 1f\n\t"
 			"xor %%ah, %%ah\n"
 			"1:"
@@ -252,10 +317,14 @@
 			  "c" (value),
 			  "b" (bx),
 			  "D" ((long)reg),
-			  "S" (&pci_indirect));
+			  "S" (&pci_indirect),
+			  "r" (__PCIBIOS_DS));
 		break;
 	case 4:
-		__asm__("lcall *(%%esi); cld\n\t"
+		__asm__("movw %w6, %%ds\n\t"
+			"lcall *%%ss:(%%esi); cld\n\t"
+			"push %%ss\n\t"
+			"pop %%ds\n\t"
 			"jc 1f\n\t"
 			"xor %%ah, %%ah\n"
 			"1:"
@@ -264,7 +333,8 @@
 			  "c" (value),
 			  "b" (bx),
 			  "D" ((long)reg),
-			  "S" (&pci_indirect));
+			  "S" (&pci_indirect),
+			  "r" (__PCIBIOS_DS));
 		break;
 	}
 
@@ -278,7 +348,7 @@
  * Function table for BIOS32 access
  */
 
-static struct pci_raw_ops pci_bios_access = {
+static const struct pci_raw_ops pci_bios_access = {
 	.read =		pci_bios_read,
 	.write =	pci_bios_write
 };
@@ -287,7 +357,7 @@
  * Try to find PCI BIOS.
  */
 
-static struct pci_raw_ops * __devinit pci_find_bios(void)
+static const struct pci_raw_ops * __devinit pci_find_bios(void)
 {
 	union bios32 *check;
 	unsigned char sum;
@@ -368,10 +438,13 @@
 
 	DBG("PCI: Fetching IRQ routing table... ");
 	__asm__("push %%es\n\t"
+		"movw %w8, %%ds\n\t"
 		"push %%ds\n\t"
 		"pop  %%es\n\t"
-		"lcall *(%%esi); cld\n\t"
+		"lcall *%%ss:(%%esi); cld\n\t"
 		"pop %%es\n\t"
+		"push %%ss\n\t"
+		"pop %%ds\n"
 		"jc 1f\n\t"
 		"xor %%ah, %%ah\n"
 		"1:"
@@ -382,7 +455,8 @@
 		  "1" (0),
 		  "D" ((long) &opt),
 		  "S" (&pci_indirect),
-		  "m" (opt)
+		  "m" (opt),
+		  "r" (__PCIBIOS_DS)
 		: "memory");
 	DBG("OK  ret=%d, size=%d, map=%x\n", ret, opt.size, map);
 	if (ret & 0xff00)
@@ -406,7 +480,10 @@
 {
 	int ret;
 
-	__asm__("lcall *(%%esi); cld\n\t"
+	__asm__("movw %w5, %%ds\n\t"
+		"lcall *%%ss:(%%esi); cld\n\t"
+		"push %%ss\n\t"
+		"pop %%ds\n"
 		"jc 1f\n\t"
 		"xor %%ah, %%ah\n"
 		"1:"
@@ -414,7 +491,8 @@
 		: "0" (PCIBIOS_SET_PCI_HW_INT),
 		  "b" ((dev->bus->number << 8) | dev->devfn),
 		  "c" ((irq << 8) | (pin + 10)),
-		  "S" (&pci_indirect));
+		  "S" (&pci_indirect),
+		  "r" (__PCIBIOS_DS));
 	return !(ret & 0xff00);
 }
 EXPORT_SYMBOL(pcibios_set_irq_routing);
diff -uriN linux-2.6.32.43/arch/x86/power/cpu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/power/cpu.c
--- linux-2.6.32.43/arch/x86/power/cpu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/power/cpu.c	2011-07-15 05:51:11.000000000 -0500
@@ -129,7 +129,7 @@
 static void fix_processor_context(void)
 {
 	int cpu = smp_processor_id();
-	struct tss_struct *t = &per_cpu(init_tss, cpu);
+	struct tss_struct *t = init_tss + cpu;
 
 	set_tss_desc(cpu, t);	/*
 				 * This just modifies memory; should not be
@@ -139,7 +139,9 @@
 				 */
 
 #ifdef CONFIG_X86_64
+	pax_open_kernel();
 	get_cpu_gdt_table(cpu)[GDT_ENTRY_TSS].type = 9;
+	pax_close_kernel();
 
 	syscall_init();				/* This sets MSR_*STAR and related */
 #endif
diff -uriN linux-2.6.32.43/arch/x86/vdso/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/Makefile
--- linux-2.6.32.43/arch/x86/vdso/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/Makefile	2011-07-15 05:51:11.000000000 -0500
@@ -122,7 +122,7 @@
 		       $(VDSO_LDFLAGS) $(VDSO_LDFLAGS_$(filter %.lds,$(^F))) \
 		       -Wl,-T,$(filter %.lds,$^) $(filter %.o,$^)
 
-VDSO_LDFLAGS = -fPIC -shared $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
+VDSO_LDFLAGS = -fPIC -shared -Wl,--no-undefined $(call cc-ldoption, -Wl$(comma)--hash-style=sysv)
 GCOV_PROFILE := n
 
 #
diff -uriN linux-2.6.32.43/arch/x86/vdso/vclock_gettime.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vclock_gettime.c
--- linux-2.6.32.43/arch/x86/vdso/vclock_gettime.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vclock_gettime.c	2011-07-15 05:51:11.000000000 -0500
@@ -22,24 +22,48 @@
 #include <asm/hpet.h>
 #include <asm/unistd.h>
 #include <asm/io.h>
+#include <asm/fixmap.h>
 #include "vextern.h"
 
 #define gtod vdso_vsyscall_gtod_data
 
+notrace noinline long __vdso_fallback_time(long *t)
+{
+	long secs;
+	asm volatile("syscall"
+		: "=a" (secs)
+		: "0" (__NR_time),"D" (t) : "r11", "cx", "memory");
+	return secs;
+}
+
 notrace static long vdso_fallback_gettime(long clock, struct timespec *ts)
 {
 	long ret;
 	asm("syscall" : "=a" (ret) :
-	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "memory");
+	    "0" (__NR_clock_gettime),"D" (clock), "S" (ts) : "r11", "cx", "memory");
 	return ret;
 }
 
+notrace static inline cycle_t __vdso_vread_hpet(void)
+{
+	return readl((const void __iomem *)fix_to_virt(VSYSCALL_HPET) + 0xf0);
+}
+
+notrace static inline cycle_t __vdso_vread_tsc(void)
+{
+	cycle_t ret = (cycle_t)vget_cycles();
+
+	return ret >= gtod->clock.cycle_last ? ret : gtod->clock.cycle_last;
+}
+
 notrace static inline long vgetns(void)
 {
 	long v;
-	cycles_t (*vread)(void);
-	vread = gtod->clock.vread;
-	v = (vread() - gtod->clock.cycle_last) & gtod->clock.mask;
+	if (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3])
+		v = __vdso_vread_tsc();
+	else
+		v = __vdso_vread_hpet();
+	v = (v - gtod->clock.cycle_last) & gtod->clock.mask;
 	return (v * gtod->clock.mult) >> gtod->clock.shift;
 }
 
@@ -113,7 +137,9 @@
 
 notrace int __vdso_clock_gettime(clockid_t clock, struct timespec *ts)
 {
-	if (likely(gtod->sysctl_enabled))
+	if (likely(gtod->sysctl_enabled &&
+		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
+		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
 		switch (clock) {
 		case CLOCK_REALTIME:
 			if (likely(gtod->clock.vread))
@@ -133,10 +159,20 @@
 int clock_gettime(clockid_t, struct timespec *)
 	__attribute__((weak, alias("__vdso_clock_gettime")));
 
-notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
+notrace noinline int __vdso_fallback_gettimeofday(struct timeval *tv, struct timezone *tz)
 {
 	long ret;
-	if (likely(gtod->sysctl_enabled && gtod->clock.vread)) {
+	asm("syscall" : "=a" (ret) :
+	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "r11", "cx", "memory");
+	return ret;
+}
+
+notrace int __vdso_gettimeofday(struct timeval *tv, struct timezone *tz)
+{
+	if (likely(gtod->sysctl_enabled &&
+		   ((gtod->clock.name[0] == 'h' && gtod->clock.name[1] == 'p' && gtod->clock.name[2] == 'e' && gtod->clock.name[3] == 't' && !gtod->clock.name[4]) ||
+		    (gtod->clock.name[0] == 't' && gtod->clock.name[1] == 's' && gtod->clock.name[2] == 'c' && !gtod->clock.name[3]))))
+	{
 		if (likely(tv != NULL)) {
 			BUILD_BUG_ON(offsetof(struct timeval, tv_usec) !=
 				     offsetof(struct timespec, tv_nsec) ||
@@ -151,9 +187,7 @@
 		}
 		return 0;
 	}
-	asm("syscall" : "=a" (ret) :
-	    "0" (__NR_gettimeofday), "D" (tv), "S" (tz) : "memory");
-	return ret;
+	return __vdso_fallback_gettimeofday(tv, tz);
 }
 int gettimeofday(struct timeval *, struct timezone *)
 	__attribute__((weak, alias("__vdso_gettimeofday")));
diff -uriN linux-2.6.32.43/arch/x86/vdso/vdso32-setup.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vdso32-setup.c
--- linux-2.6.32.43/arch/x86/vdso/vdso32-setup.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vdso32-setup.c	2011-07-15 05:51:11.000000000 -0500
@@ -25,6 +25,7 @@
 #include <asm/tlbflush.h>
 #include <asm/vdso.h>
 #include <asm/proto.h>
+#include <asm/mman.h>
 
 enum {
 	VDSO_DISABLED = 0,
@@ -226,7 +227,7 @@
 void enable_sep_cpu(void)
 {
 	int cpu = get_cpu();
-	struct tss_struct *tss = &per_cpu(init_tss, cpu);
+	struct tss_struct *tss = init_tss + cpu;
 
 	if (!boot_cpu_has(X86_FEATURE_SEP)) {
 		put_cpu();
@@ -249,7 +250,7 @@
 	gate_vma.vm_start = FIXADDR_USER_START;
 	gate_vma.vm_end = FIXADDR_USER_END;
 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-	gate_vma.vm_page_prot = __P101;
+	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
 	/*
 	 * Make sure the vDSO gets into every core dump.
 	 * Dumping its contents makes post-mortem fully interpretable later
@@ -331,14 +332,14 @@
 	if (compat)
 		addr = VDSO_HIGH_BASE;
 	else {
-		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, 0);
+		addr = get_unmapped_area(NULL, 0, PAGE_SIZE, 0, MAP_EXECUTABLE);
 		if (IS_ERR_VALUE(addr)) {
 			ret = addr;
 			goto up_fail;
 		}
 	}
 
-	current->mm->context.vdso = (void *)addr;
+	current->mm->context.vdso = addr;
 
 	if (compat_uses_vma || !compat) {
 		/*
@@ -361,11 +362,11 @@
 	}
 
 	current_thread_info()->sysenter_return =
-		VDSO32_SYMBOL(addr, SYSENTER_RETURN);
+		(__force void __user *)VDSO32_SYMBOL(addr, SYSENTER_RETURN);
 
   up_fail:
 	if (ret)
-		current->mm->context.vdso = NULL;
+		current->mm->context.vdso = 0;
 
 	up_write(&mm->mmap_sem);
 
@@ -413,8 +414,14 @@
 
 const char *arch_vma_name(struct vm_area_struct *vma)
 {
-	if (vma->vm_mm && vma->vm_start == (long)vma->vm_mm->context.vdso)
+	if (vma->vm_mm && vma->vm_start == vma->vm_mm->context.vdso)
 		return "[vdso]";
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (vma->vm_mm && vma->vm_mirror && vma->vm_mirror->vm_start == vma->vm_mm->context.vdso)
+		return "[vdso]";
+#endif
+
 	return NULL;
 }
 
@@ -423,7 +430,7 @@
 	struct mm_struct *mm = tsk->mm;
 
 	/* Check to see if this task was created in compat vdso mode */
-	if (mm && mm->context.vdso == (void *)VDSO_HIGH_BASE)
+	if (mm && mm->context.vdso == VDSO_HIGH_BASE)
 		return &gate_vma;
 	return NULL;
 }
diff -uriN linux-2.6.32.43/arch/x86/vdso/vdso.lds.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vdso.lds.S
--- linux-2.6.32.43/arch/x86/vdso/vdso.lds.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vdso.lds.S	2011-07-15 05:51:11.000000000 -0500
@@ -35,3 +35,9 @@
 #define VEXTERN(x)	VDSO64_ ## x = vdso_ ## x;
 #include "vextern.h"
 #undef	VEXTERN
+
+#define VEXTERN(x)	VDSO64_ ## x = __vdso_ ## x;
+VEXTERN(fallback_gettimeofday)
+VEXTERN(fallback_time)
+VEXTERN(getcpu)
+#undef	VEXTERN
diff -uriN linux-2.6.32.43/arch/x86/vdso/vextern.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vextern.h
--- linux-2.6.32.43/arch/x86/vdso/vextern.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vextern.h	2011-07-15 05:51:11.000000000 -0500
@@ -11,6 +11,5 @@
    put into vextern.h and be referenced as a pointer with vdso prefix.
    The main kernel later fills in the values.   */
 
-VEXTERN(jiffies)
 VEXTERN(vgetcpu_mode)
 VEXTERN(vsyscall_gtod_data)
diff -uriN linux-2.6.32.43/arch/x86/vdso/vma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vma.c
--- linux-2.6.32.43/arch/x86/vdso/vma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/vdso/vma.c	2011-07-15 05:51:11.000000000 -0500
@@ -57,7 +57,7 @@
 	if (!vbase)
 		goto oom;
 
-	if (memcmp(vbase, "\177ELF", 4)) {
+	if (memcmp(vbase, ELFMAG, SELFMAG)) {
 		printk("VDSO: I'm broken; not ELF\n");
 		vdso_enabled = 0;
 	}
@@ -66,6 +66,7 @@
 	*(typeof(__ ## x) **) var_ref(VDSO64_SYMBOL(vbase, x), #x) = &__ ## x;
 #include "vextern.h"
 #undef VEXTERN
+	vunmap(vbase);
 	return 0;
 
  oom:
@@ -116,7 +117,7 @@
 		goto up_fail;
 	}
 
-	current->mm->context.vdso = (void *)addr;
+	current->mm->context.vdso = addr;
 
 	ret = install_special_mapping(mm, addr, vdso_size,
 				      VM_READ|VM_EXEC|
@@ -124,7 +125,7 @@
 				      VM_ALWAYSDUMP,
 				      vdso_pages);
 	if (ret) {
-		current->mm->context.vdso = NULL;
+		current->mm->context.vdso = 0;
 		goto up_fail;
 	}
 
@@ -132,10 +133,3 @@
 	up_write(&mm->mmap_sem);
 	return ret;
 }
-
-static __init int vdso_setup(char *s)
-{
-	vdso_enabled = simple_strtoul(s, NULL, 0);
-	return 0;
-}
-__setup("vdso=", vdso_setup);
diff -uriN linux-2.6.32.43/arch/x86/xen/enlighten.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/enlighten.c
--- linux-2.6.32.43/arch/x86/xen/enlighten.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/enlighten.c	2011-07-15 05:51:11.000000000 -0500
@@ -71,8 +71,6 @@
 
 struct shared_info xen_dummy_shared_info;
 
-void *xen_initial_gdt;
-
 /*
  * Point at some empty memory to start with. We map the real shared_info
  * page as soon as fixmap is up and running.
@@ -548,7 +546,7 @@
 
 	preempt_disable();
 
-	start = __get_cpu_var(idt_desc).address;
+	start = (unsigned long)__get_cpu_var(idt_desc).address;
 	end = start + __get_cpu_var(idt_desc).size + 1;
 
 	xen_mc_flush();
@@ -993,7 +991,7 @@
 #endif
 };
 
-static void xen_reboot(int reason)
+static __noreturn void xen_reboot(int reason)
 {
 	struct sched_shutdown r = { .reason = reason };
 
@@ -1001,17 +999,17 @@
 		BUG();
 }
 
-static void xen_restart(char *msg)
+static __noreturn void xen_restart(char *msg)
 {
 	xen_reboot(SHUTDOWN_reboot);
 }
 
-static void xen_emergency_restart(void)
+static __noreturn void xen_emergency_restart(void)
 {
 	xen_reboot(SHUTDOWN_reboot);
 }
 
-static void xen_machine_halt(void)
+static __noreturn void xen_machine_halt(void)
 {
 	xen_reboot(SHUTDOWN_poweroff);
 }
@@ -1095,9 +1093,20 @@
 	 */
 	__userpte_alloc_gfp &= ~__GFP_HIGHMEM;
 
-#ifdef CONFIG_X86_64
 	/* Work out if we support NX */
-	check_efer();
+#if defined(CONFIG_X86_64) || defined(CONFIG_X86_PAE)
+	if ((cpuid_eax(0x80000000) & 0xffff0000) == 0x80000000 &&
+	    (cpuid_edx(0x80000001) & (1U << (X86_FEATURE_NX & 31)))) {
+		unsigned l, h;
+
+#ifdef CONFIG_X86_PAE
+		nx_enabled = 1;
+#endif
+		__supported_pte_mask |= _PAGE_NX;
+		rdmsr(MSR_EFER, l, h);
+		l |= EFER_NX;
+		wrmsr(MSR_EFER, l, h);
+	}
 #endif
 
 	xen_setup_features();
@@ -1129,13 +1138,6 @@
 
 	machine_ops = xen_machine_ops;
 
-	/*
-	 * The only reliable way to retain the initial address of the
-	 * percpu gdt_page is to remember it here, so we can go and
-	 * mark it RW later, when the initial percpu area is freed.
-	 */
-	xen_initial_gdt = &per_cpu(gdt_page, 0);
-
 	xen_smp_init();
 
 	pgd = (pgd_t *)xen_start_info->pt_base;
diff -uriN linux-2.6.32.43/arch/x86/xen/mmu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/mmu.c
--- linux-2.6.32.43/arch/x86/xen/mmu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/mmu.c	2011-07-15 05:51:11.000000000 -0500
@@ -1719,6 +1719,8 @@
 	convert_pfn_mfn(init_level4_pgt);
 	convert_pfn_mfn(level3_ident_pgt);
 	convert_pfn_mfn(level3_kernel_pgt);
+	convert_pfn_mfn(level3_vmalloc_pgt);
+	convert_pfn_mfn(level3_vmemmap_pgt);
 
 	l3 = m2v(pgd[pgd_index(__START_KERNEL_map)].pgd);
 	l2 = m2v(l3[pud_index(__START_KERNEL_map)].pud);
@@ -1737,7 +1739,10 @@
 	set_page_prot(init_level4_pgt, PAGE_KERNEL_RO);
 	set_page_prot(level3_ident_pgt, PAGE_KERNEL_RO);
 	set_page_prot(level3_kernel_pgt, PAGE_KERNEL_RO);
+	set_page_prot(level3_vmalloc_pgt, PAGE_KERNEL_RO);
+	set_page_prot(level3_vmemmap_pgt, PAGE_KERNEL_RO);
 	set_page_prot(level3_user_vsyscall, PAGE_KERNEL_RO);
+	set_page_prot(level2_vmemmap_pgt, PAGE_KERNEL_RO);
 	set_page_prot(level2_kernel_pgt, PAGE_KERNEL_RO);
 	set_page_prot(level2_fixmap_pgt, PAGE_KERNEL_RO);
 
diff -uriN linux-2.6.32.43/arch/x86/xen/smp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/smp.c
--- linux-2.6.32.43/arch/x86/xen/smp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/smp.c	2011-07-15 05:51:11.000000000 -0500
@@ -167,11 +167,6 @@
 {
 	BUG_ON(smp_processor_id() != 0);
 	native_smp_prepare_boot_cpu();
-
-	/* We've switched to the "real" per-cpu gdt, so make sure the
-	   old memory can be recycled */
-	make_lowmem_page_readwrite(xen_initial_gdt);
-
 	xen_setup_vcpu_info_placement();
 }
 
@@ -231,12 +226,12 @@
 	gdt = get_cpu_gdt_table(cpu);
 
 	ctxt->flags = VGCF_IN_KERNEL;
-	ctxt->user_regs.ds = __USER_DS;
-	ctxt->user_regs.es = __USER_DS;
+	ctxt->user_regs.ds = __KERNEL_DS;
+	ctxt->user_regs.es = __KERNEL_DS;
 	ctxt->user_regs.ss = __KERNEL_DS;
 #ifdef CONFIG_X86_32
 	ctxt->user_regs.fs = __KERNEL_PERCPU;
-	ctxt->user_regs.gs = __KERNEL_STACK_CANARY;
+	savesegment(gs, ctxt->user_regs.gs);
 #else
 	ctxt->gs_base_kernel = per_cpu_offset(cpu);
 #endif
@@ -287,13 +282,12 @@
 	int rc;
 
 	per_cpu(current_task, cpu) = idle;
+	per_cpu(current_tinfo, cpu) = &idle->tinfo;
 #ifdef CONFIG_X86_32
 	irq_ctx_init(cpu);
 #else
 	clear_tsk_thread_flag(idle, TIF_FORK);
-	per_cpu(kernel_stack, cpu) =
-		(unsigned long)task_stack_page(idle) -
-		KERNEL_STACK_OFFSET + THREAD_SIZE;
+	per_cpu(kernel_stack, cpu) = (unsigned long)task_stack_page(idle) - 16 + THREAD_SIZE;
 #endif
 	xen_setup_runstate_info(cpu);
 	xen_setup_timer(cpu);
diff -uriN linux-2.6.32.43/arch/x86/xen/xen-asm_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/xen-asm_32.S
--- linux-2.6.32.43/arch/x86/xen/xen-asm_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/xen-asm_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -83,14 +83,14 @@
 	ESP_OFFSET=4	# bytes pushed onto stack
 
 	/*
-	 * Store vcpu_info pointer for easy access.  Do it this way to
-	 * avoid having to reload %fs
+	 * Store vcpu_info pointer for easy access.
 	 */
 #ifdef CONFIG_SMP
-	GET_THREAD_INFO(%eax)
-	movl TI_cpu(%eax), %eax
-	movl __per_cpu_offset(,%eax,4), %eax
-	mov per_cpu__xen_vcpu(%eax), %eax
+	push %fs
+	mov $(__KERNEL_PERCPU), %eax
+	mov %eax, %fs
+	mov PER_CPU_VAR(xen_vcpu), %eax
+	pop %fs
 #else
 	movl per_cpu__xen_vcpu, %eax
 #endif
diff -uriN linux-2.6.32.43/arch/x86/xen/xen-head.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/xen-head.S
--- linux-2.6.32.43/arch/x86/xen/xen-head.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/xen-head.S	2011-07-15 05:51:11.000000000 -0500
@@ -19,6 +19,17 @@
 #ifdef CONFIG_X86_32
 	mov %esi,xen_start_info
 	mov $init_thread_union+THREAD_SIZE,%esp
+#ifdef CONFIG_SMP
+	movl $cpu_gdt_table,%edi
+	movl $__per_cpu_load,%eax
+	movw %ax,__KERNEL_PERCPU + 2(%edi)
+	rorl $16,%eax
+	movb %al,__KERNEL_PERCPU + 4(%edi)
+	movb %ah,__KERNEL_PERCPU + 7(%edi)
+	movl $__per_cpu_end - 1,%eax
+	subl $__per_cpu_start,%eax
+	movw %ax,__KERNEL_PERCPU + 0(%edi)
+#endif
 #else
 	mov %rsi,xen_start_info
 	mov $init_thread_union+THREAD_SIZE,%rsp
diff -uriN linux-2.6.32.43/arch/x86/xen/xen-ops.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/xen-ops.h
--- linux-2.6.32.43/arch/x86/xen/xen-ops.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/x86/xen/xen-ops.h	2011-07-15 05:51:11.000000000 -0500
@@ -10,8 +10,6 @@
 extern const char xen_hypervisor_callback[];
 extern const char xen_failsafe_callback[];
 
-extern void *xen_initial_gdt;
-
 struct trap_info;
 void xen_copy_trap_info(struct trap_info *traps);
 
diff -uriN linux-2.6.32.43/arch/xtensa/mm/fault.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/xtensa/mm/fault.c
--- linux-2.6.32.43/arch/xtensa/mm/fault.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/arch/xtensa/mm/fault.c	2011-07-15 05:50:11.000000000 -0500
@@ -151,7 +151,8 @@
 		down_read(&mm->mmap_sem);
 		goto survive;
 	}
-	printk("VM: killing process %s\n", current->comm);
+	printk("VM: killing process %s(%d:#%u)\n",
+		current->comm, task_pid_nr(current), current->xid);
 	if (user_mode(regs))
 		do_group_exit(SIGKILL);
 	bad_page_fault(regs, address, SIGKILL);
diff -uriN linux-2.6.32.43/block/blk-integrity.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-integrity.c
--- linux-2.6.32.43/block/blk-integrity.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-integrity.c	2011-07-15 05:51:11.000000000 -0500
@@ -278,7 +278,7 @@
 	NULL,
 };
 
-static struct sysfs_ops integrity_ops = {
+static const struct sysfs_ops integrity_ops = {
 	.show	= &integrity_attr_show,
 	.store	= &integrity_attr_store,
 };
diff -uriN linux-2.6.32.43/block/blk-iopoll.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-iopoll.c
--- linux-2.6.32.43/block/blk-iopoll.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-iopoll.c	2011-07-15 05:51:11.000000000 -0500
@@ -77,7 +77,7 @@
 }
 EXPORT_SYMBOL(blk_iopoll_complete);
 
-static void blk_iopoll_softirq(struct softirq_action *h)
+static void blk_iopoll_softirq(void)
 {
 	struct list_head *list = &__get_cpu_var(blk_cpu_iopoll);
 	int rearm = 0, budget = blk_iopoll_budget;
diff -uriN linux-2.6.32.43/block/blk-map.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-map.c
--- linux-2.6.32.43/block/blk-map.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-map.c	2011-07-15 05:51:11.000000000 -0500
@@ -54,7 +54,7 @@
 	 * direct dma. else, set up kernel bounce buffers
 	 */
 	uaddr = (unsigned long) ubuf;
-	if (blk_rq_aligned(q, ubuf, len) && !map_data)
+	if (blk_rq_aligned(q, (__force void *)ubuf, len) && !map_data)
 		bio = bio_map_user(q, NULL, uaddr, len, reading, gfp_mask);
 	else
 		bio = bio_copy_user(q, map_data, uaddr, len, reading, gfp_mask);
@@ -201,12 +201,13 @@
 	for (i = 0; i < iov_count; i++) {
 		unsigned long uaddr = (unsigned long)iov[i].iov_base;
 
+		if (!iov[i].iov_len)
+			return -EINVAL;
+
 		if (uaddr & queue_dma_alignment(q)) {
 			unaligned = 1;
 			break;
 		}
-		if (!iov[i].iov_len)
-			return -EINVAL;
 	}
 
 	if (unaligned || (q->dma_pad_mask & len) || map_data)
@@ -299,7 +300,7 @@
 	if (!len || !kbuf)
 		return -EINVAL;
 
-	do_copy = !blk_rq_aligned(q, kbuf, len) || object_is_on_stack(kbuf);
+	do_copy = !blk_rq_aligned(q, kbuf, len) || object_starts_on_stack(kbuf);
 	if (do_copy)
 		bio = bio_copy_kern(q, kbuf, len, gfp_mask, reading);
 	else
diff -uriN linux-2.6.32.43/block/blk-softirq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-softirq.c
--- linux-2.6.32.43/block/blk-softirq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-softirq.c	2011-07-15 05:51:11.000000000 -0500
@@ -17,7 +17,7 @@
  * Softirq action handler - move entries to local list and loop over them
  * while passing them to the queue registered handler.
  */
-static void blk_done_softirq(struct softirq_action *h)
+static void blk_done_softirq(void)
 {
 	struct list_head *cpu_list, local_list;
 
diff -uriN linux-2.6.32.43/block/blk-sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-sysfs.c
--- linux-2.6.32.43/block/blk-sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/blk-sysfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -414,7 +414,7 @@
 	kmem_cache_free(blk_requestq_cachep, q);
 }
 
-static struct sysfs_ops queue_sysfs_ops = {
+static const struct sysfs_ops queue_sysfs_ops = {
 	.show	= queue_attr_show,
 	.store	= queue_attr_store,
 };
diff -uriN linux-2.6.32.43/block/bsg.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/bsg.c
--- linux-2.6.32.43/block/bsg.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/bsg.c	2011-07-15 05:51:11.000000000 -0500
@@ -175,16 +175,24 @@
 				struct sg_io_v4 *hdr, struct bsg_device *bd,
 				fmode_t has_write_perm)
 {
+	unsigned char tmpcmd[sizeof(rq->__cmd)];
+	unsigned char *cmdptr;
+
 	if (hdr->request_len > BLK_MAX_CDB) {
 		rq->cmd = kzalloc(hdr->request_len, GFP_KERNEL);
 		if (!rq->cmd)
 			return -ENOMEM;
-	}
+		cmdptr = rq->cmd;
+	} else
+		cmdptr = tmpcmd;
 
-	if (copy_from_user(rq->cmd, (void *)(unsigned long)hdr->request,
+	if (copy_from_user(cmdptr, (void *)(unsigned long)hdr->request,
 			   hdr->request_len))
 		return -EFAULT;
 
+	if (cmdptr != rq->cmd)
+		memcpy(rq->cmd, cmdptr, hdr->request_len);
+
 	if (hdr->subprotocol == BSG_SUB_PROTOCOL_SCSI_CMD) {
 		if (blk_verify_command(rq->cmd, has_write_perm))
 			return -EPERM;
diff -uriN linux-2.6.32.43/block/elevator.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/elevator.c
--- linux-2.6.32.43/block/elevator.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/elevator.c	2011-07-15 05:51:11.000000000 -0500
@@ -889,7 +889,7 @@
 	return error;
 }
 
-static struct sysfs_ops elv_sysfs_ops = {
+static const struct sysfs_ops elv_sysfs_ops = {
 	.show	= elv_attr_show,
 	.store	= elv_attr_store,
 };
diff -uriN linux-2.6.32.43/block/scsi_ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/scsi_ioctl.c
--- linux-2.6.32.43/block/scsi_ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/block/scsi_ioctl.c	2011-07-15 05:51:11.000000000 -0500
@@ -220,8 +220,20 @@
 static int blk_fill_sghdr_rq(struct request_queue *q, struct request *rq,
 			     struct sg_io_hdr *hdr, fmode_t mode)
 {
-	if (copy_from_user(rq->cmd, hdr->cmdp, hdr->cmd_len))
+	unsigned char tmpcmd[sizeof(rq->__cmd)];
+	unsigned char *cmdptr;
+
+	if (rq->cmd != rq->__cmd)
+		cmdptr = rq->cmd;
+	else
+		cmdptr = tmpcmd;
+
+	if (copy_from_user(cmdptr, hdr->cmdp, hdr->cmd_len))
 		return -EFAULT;
+
+	if (cmdptr != rq->cmd)
+		memcpy(rq->cmd, cmdptr, hdr->cmd_len);
+
 	if (blk_verify_command(rq->cmd, mode & FMODE_WRITE))
 		return -EPERM;
 
@@ -430,6 +442,8 @@
 	int err;
 	unsigned int in_len, out_len, bytes, opcode, cmdlen;
 	char *buffer = NULL, sense[SCSI_SENSE_BUFFERSIZE];
+	unsigned char tmpcmd[sizeof(rq->__cmd)];
+	unsigned char *cmdptr;
 
 	if (!sic)
 		return -EINVAL;
@@ -463,9 +477,18 @@
 	 */
 	err = -EFAULT;
 	rq->cmd_len = cmdlen;
-	if (copy_from_user(rq->cmd, sic->data, cmdlen))
+
+	if (rq->cmd != rq->__cmd)
+		cmdptr = rq->cmd;
+	else
+		cmdptr = tmpcmd;
+
+	if (copy_from_user(cmdptr, sic->data, cmdlen))
 		goto error;
 
+	if (rq->cmd != cmdptr)
+		memcpy(rq->cmd, cmdptr, cmdlen);
+
 	if (in_len && copy_from_user(buffer, sic->data + cmdlen, in_len))
 		goto error;
 
diff -uriN linux-2.6.32.43/crypto/gf128mul.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/crypto/gf128mul.c
--- linux-2.6.32.43/crypto/gf128mul.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/crypto/gf128mul.c	2011-07-15 05:51:11.000000000 -0500
@@ -182,7 +182,7 @@
 	for (i = 0; i < 7; ++i)
 		gf128mul_x_lle(&p[i + 1], &p[i]);
 
-	memset(r, 0, sizeof(r));
+	memset(r, 0, sizeof(*r));
 	for (i = 0;;) {
 		u8 ch = ((u8 *)b)[15 - i];
 
@@ -220,7 +220,7 @@
 	for (i = 0; i < 7; ++i)
 		gf128mul_x_bbe(&p[i + 1], &p[i]);
 
-	memset(r, 0, sizeof(r));
+	memset(r, 0, sizeof(*r));
 	for (i = 0;;) {
 		u8 ch = ((u8 *)b)[i];
 
diff -uriN linux-2.6.32.43/crypto/serpent.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/crypto/serpent.c
--- linux-2.6.32.43/crypto/serpent.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/crypto/serpent.c	2011-07-15 05:51:11.000000000 -0500
@@ -224,6 +224,8 @@
 	u32 r0,r1,r2,r3,r4;
 	int i;
 
+	pax_track_stack();
+
 	/* Copy key, add padding */
 
 	for (i = 0; i < keylen; ++i)
diff -uriN linux-2.6.32.43/Documentation/dontdiff linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Documentation/dontdiff
--- linux-2.6.32.43/Documentation/dontdiff	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Documentation/dontdiff	2011-07-15 05:51:11.000000000 -0500
@@ -1,13 +1,16 @@
 *.a
 *.aux
 *.bin
+*.cis
 *.cpio
 *.csp
+*.dbg
 *.dsp
 *.dvi
 *.elf
 *.eps
 *.fw
+*.gcno
 *.gen.S
 *.gif
 *.grep
@@ -38,8 +41,10 @@
 *.tab.h
 *.tex
 *.ver
+*.vim
 *.xml
 *_MODULES
+*_reg_safe.h
 *_vga16.c
 *~
 *.9
@@ -49,11 +54,16 @@
 53c700_d.h
 CVS
 ChangeSet
+GPATH
+GRTAGS
+GSYMS
+GTAGS
 Image
 Kerntypes
 Module.markers
 Module.symvers
 PENDING
+PERF*
 SCCS
 System.map*
 TAGS
@@ -76,7 +86,11 @@
 build
 bvmlinux
 bzImage*
+capability_names.h
+capflags.c
 classlist.h*
+clut_vga16.c
+common-cmds.h
 comp*.log
 compile.h*
 conf
@@ -103,13 +117,14 @@
 gen_init_cpio
 genksyms
 *_gray256.c
+hash
 ihex2fw
 ikconfig.h*
 initramfs_data.cpio
+initramfs_data.cpio.bz2
 initramfs_data.cpio.gz
 initramfs_list
 kallsyms
-kconfig
 keywords.c
 ksym.c*
 ksym.h*
@@ -133,7 +148,9 @@
 mkbugboot
 mkcpustr
 mkdep
+mkpiggy
 mkprep
+mkregtable
 mktables
 mktree
 modpost
@@ -149,6 +166,7 @@
 pca200e.bin
 pca200e_ecd.bin2
 piggy.gz
+piggy.S
 piggyback
 pnmtologo
 ppc_defs.h*
@@ -157,12 +175,15 @@
 raid6altivec*.c
 raid6int*.c
 raid6tables.c
+regdb.c
 relocs
+rlim_names.h
 series
 setup
 setup.bin
 setup.elf
 sImage
+slabinfo
 sm_tbl*
 split-include
 syscalltab.h
@@ -186,14 +207,20 @@
 vmlinux
 vmlinux-*
 vmlinux.aout
+vmlinux.bin.all
+vmlinux.bin.bz2
 vmlinux.lds
+vmlinux.relocs
+voffset.h
 vsyscall.lds
 vsyscall_32.lds
 wanxlfw.inc
 uImage
 unifdef
+utsrelease.h
 wakeup.bin
 wakeup.elf
 wakeup.lds
 zImage*
 zconf.hash.c
+zoffset.h
diff -uriN linux-2.6.32.43/Documentation/kernel-parameters.txt linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Documentation/kernel-parameters.txt
--- linux-2.6.32.43/Documentation/kernel-parameters.txt	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Documentation/kernel-parameters.txt	2011-07-15 05:51:11.000000000 -0500
@@ -1837,6 +1837,13 @@
 			the specified number of seconds.  This is to be used if
 			your oopses keep scrolling off the screen.
 
+	pax_nouderef	[X86] disables UDEREF.  Most likely needed under certain
+			virtualization environments that don't cope well with the
+			expand down segment used by UDEREF on X86-32 or the frequent
+			page table updates on X86-64.
+
+	pax_softmode=	0/1 to disable/enable PaX softmode on boot already.
+
 	pcbit=		[HW,ISDN]
 
 	pcd.		[PARIDE]
diff -uriN linux-2.6.32.43/Documentation/scheduler/sched-cfs-hard-limits.txt linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Documentation/scheduler/sched-cfs-hard-limits.txt
--- linux-2.6.32.43/Documentation/scheduler/sched-cfs-hard-limits.txt	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Documentation/scheduler/sched-cfs-hard-limits.txt	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,48 @@
+CPU HARD LIMITS FOR CFS GROUPS
+==============================
+
+1. Overview
+2. Interface
+3. Examples
+
+1. Overview
+-----------
+
+CFS is a proportional share scheduler which tries to divide the CPU time
+proportionately between tasks or groups of tasks (task group/cgroup) depending
+on the priority/weight of the task or shares assigned to groups of tasks.
+In CFS, a task/task group can get more than its share of CPU if there are
+enough idle CPU cycles available in the system, due to the work conserving
+nature of the scheduler. However in certain scenarios (like pay-per-use),
+it is desirable not to provide extra time to a group even in the presence
+of idle CPU cycles. This is where hard limiting can be of use.
+
+Hard limits for task groups can be set by specifying how much CPU runtime a
+group can consume within a given period. If the group consumes more CPU time
+than the runtime in a given period, it gets throttled. None of the tasks of
+the throttled group gets to run until the runtime of the group gets refreshed
+at the beginning of the next period.
+
+2. Interface
+------------
+
+Hard limit feature adds 2 cgroup files for CFS group scheduler:
+
+cfs_runtime_us: Hard limit for the group in microseconds.
+
+cfs_period_us: Time period in microseconds within which hard limits is
+enforced.
+
+A group gets created with default values for runtime (infinite runtime which
+means hard limits disabled) and period (0.5s). Each group can set its own
+values for runtime and period independent of other groups in the system.
+
+3. Examples
+-----------
+
+# mount -t cgroup -ocpu none /cgroups/
+# cd /cgroups
+# mkdir 1
+# cd 1/
+# echo 250000 > cfs_runtime_us /* set a 250ms runtime or limit */
+# echo 500000 > cfs_period_us /* set a 500ms period */
diff -uriN linux-2.6.32.43/Documentation/vserver/debug.txt linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Documentation/vserver/debug.txt
--- linux-2.6.32.43/Documentation/vserver/debug.txt	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Documentation/vserver/debug.txt	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,154 @@
+
+debug_cvirt:
+
+ 2   4	"vx_map_tgid: %p/%llx: %d -> %d"
+	"vx_rmap_tgid: %p/%llx: %d -> %d"
+
+debug_dlim:
+
+ 0   1	"ALLOC (%p,#%d)%c inode (%d)"
+	"FREE  (%p,#%d)%c inode"
+ 1   2	"ALLOC (%p,#%d)%c %lld bytes (%d)"
+	"FREE  (%p,#%d)%c %lld bytes"
+ 2   4	"ADJUST: %lld,%lld on %ld,%ld [mult=%d]"
+ 3   8	"ext3_has_free_blocks(%p): %lu<%lu+1, %c, %u!=%u r=%d"
+	"ext3_has_free_blocks(%p): free=%lu, root=%lu"
+	"rcu_free_dl_info(%p)"
+ 4  10	"alloc_dl_info(%p,%d) = %p"
+	"dealloc_dl_info(%p)"
+	"get_dl_info(%p[#%d.%d])"
+	"put_dl_info(%p[#%d.%d])"
+ 5  20	"alloc_dl_info(%p,%d)*"
+ 6  40	"__hash_dl_info: %p[#%d]"
+	"__unhash_dl_info: %p[#%d]"
+ 7  80	"locate_dl_info(%p,#%d) = %p"
+
+debug_misc:
+
+ 0   1	"destroy_dqhash: %p [#0x%08x] c=%d"
+	"new_dqhash: %p [#0x%08x]"
+	"vroot[%d]_clr_dev: dev=%p[%lu,%d:%d]"
+	"vroot[%d]_get_real_bdev: dev=%p[%lu,%d:%d]"
+	"vroot[%d]_set_dev: dev=%p[%lu,%d:%d]"
+	"vroot_get_real_bdev not set"
+ 1   2	"cow_break_link(»%s«)"
+	"temp copy »%s«"
+ 2   4	"dentry_open(new): %p"
+	"dentry_open(old): %p"
+	"lookup_create(new): %p"
+	"old path »%s«"
+	"path_lookup(old): %d"
+	"vfs_create(new): %d"
+	"vfs_rename: %d"
+	"vfs_sendfile: %d"
+ 3   8	"fput(new_file=%p[#%d])"
+	"fput(old_file=%p[#%d])"
+ 4  10	"vx_info_kill(%p[#%d],%d,%d) = %d"
+	"vx_info_kill(%p[#%d],%d,%d)*"
+ 5  20	"vs_reboot(%p[#%d],%d)"
+ 6  40	"dropping task %p[#%u,%u] for %p[#%u,%u]"
+
+debug_net:
+
+ 2   4	"nx_addr_conflict(%p,%p) %d.%d,%d.%d"
+ 3   8	"inet_bind(%p) %d.%d.%d.%d, %d.%d.%d.%d, %d.%d.%d.%d"
+	"inet_bind(%p)* %p,%p;%lx %d.%d.%d.%d"
+ 4  10	"ip_route_connect(%p) %p,%p;%lx"
+ 5  20	"__addr_in_socket(%p,%d.%d.%d.%d) %p:%d.%d.%d.%d %p;%lx"
+ 6  40	"sk,egf: %p [#%d] (from %d)"
+	"sk,egn: %p [#%d] (from %d)"
+	"sk,req: %p [#%d] (from %d)"
+	"sk: %p [#%d] (from %d)"
+	"tw: %p [#%d] (from %d)"
+ 7  80	"__sock_recvmsg: %p[%p,%p,%p;%d]:%d/%d"
+	"__sock_sendmsg: %p[%p,%p,%p;%d]:%d/%d"
+
+debug_nid:
+
+ 0   1	"__lookup_nx_info(#%u): %p[#%u]"
+	"alloc_nx_info(%d) = %p"
+	"create_nx_info(%d) (dynamic rejected)"
+	"create_nx_info(%d) = %p (already there)"
+	"create_nx_info(%d) = %p (new)"
+	"dealloc_nx_info(%p)"
+ 1   2	"alloc_nx_info(%d)*"
+	"create_nx_info(%d)*"
+ 2   4	"get_nx_info(%p[#%d.%d])"
+	"put_nx_info(%p[#%d.%d])"
+ 3   8	"claim_nx_info(%p[#%d.%d.%d]) %p"
+	"clr_nx_info(%p[#%d.%d])"
+	"init_nx_info(%p[#%d.%d])"
+	"release_nx_info(%p[#%d.%d.%d]) %p"
+	"set_nx_info(%p[#%d.%d])"
+ 4  10	"__hash_nx_info: %p[#%d]"
+	"__nx_dynamic_id: [#%d]"
+	"__unhash_nx_info: %p[#%d.%d.%d]"
+ 5  20	"moved task %p into nxi:%p[#%d]"
+	"nx_migrate_task(%p,%p[#%d.%d.%d])"
+	"task_get_nx_info(%p)"
+ 6  40	"nx_clear_persistent(%p[#%d])"
+
+debug_quota:
+
+ 0   1	"quota_sync_dqh(%p,%d) discard inode %p"
+ 1   2	"quota_sync_dqh(%p,%d)"
+	"sync_dquots(%p,%d)"
+	"sync_dquots_dqh(%p,%d)"
+ 3   8	"do_quotactl(%p,%d,cmd=%d,id=%d,%p)"
+
+debug_switch:
+
+ 0   1	"vc: VCMD_%02d_%d[%d], %d,%p [%d,%d,%x,%x]"
+ 1   2	"vc: VCMD_%02d_%d[%d] = %08lx(%ld) [%d,%d]"
+ 4  10	"%s: (%s %s) returned %s with %d"
+
+debug_tag:
+
+ 7  80	"dx_parse_tag(»%s«): %d:#%d"
+	"dx_propagate_tag(%p[#%lu.%d]): %d,%d"
+
+debug_xid:
+
+ 0   1	"__lookup_vx_info(#%u): %p[#%u]"
+	"alloc_vx_info(%d) = %p"
+	"alloc_vx_info(%d)*"
+	"create_vx_info(%d) (dynamic rejected)"
+	"create_vx_info(%d) = %p (already there)"
+	"create_vx_info(%d) = %p (new)"
+	"dealloc_vx_info(%p)"
+	"loc_vx_info(%d) = %p (found)"
+	"loc_vx_info(%d) = %p (new)"
+	"loc_vx_info(%d) = %p (not available)"
+ 1   2	"create_vx_info(%d)*"
+	"loc_vx_info(%d)*"
+ 2   4	"get_vx_info(%p[#%d.%d])"
+	"put_vx_info(%p[#%d.%d])"
+ 3   8	"claim_vx_info(%p[#%d.%d.%d]) %p"
+	"clr_vx_info(%p[#%d.%d])"
+	"init_vx_info(%p[#%d.%d])"
+	"release_vx_info(%p[#%d.%d.%d]) %p"
+	"set_vx_info(%p[#%d.%d])"
+ 4  10	"__hash_vx_info: %p[#%d]"
+	"__unhash_vx_info: %p[#%d.%d.%d]"
+	"__vx_dynamic_id: [#%d]"
+ 5  20	"enter_vx_info(%p[#%d],%p) %p[#%d,%p]"
+	"leave_vx_info(%p[#%d,%p]) %p[#%d,%p]"
+	"moved task %p into vxi:%p[#%d]"
+	"task_get_vx_info(%p)"
+	"vx_migrate_task(%p,%p[#%d.%d])"
+ 6  40	"vx_clear_persistent(%p[#%d])"
+	"vx_exit_init(%p[#%d],%p[#%d,%d,%d])"
+	"vx_set_init(%p[#%d],%p[#%d,%d,%d])"
+	"vx_set_persistent(%p[#%d])"
+	"vx_set_reaper(%p[#%d],%p[#%d,%d])"
+ 7  80	"vx_child_reaper(%p[#%u,%u]) = %p[#%u,%u]"
+
+
+debug_limit:
+
+ n 2^n	"vx_acc_cres[%5d,%s,%2d]: %5d%s"
+	"vx_cres_avail[%5d,%s,%2d]: %5ld > %5d + %5d"
+
+ m 2^m	"vx_acc_page[%5d,%s,%2d]: %5d%s"
+	"vx_acc_pages[%5d,%s,%2d]: %5d += %5d"
+	"vx_pages_avail[%5d,%s,%2d]: %5ld > %5d + %5d"
diff -uriN linux-2.6.32.43/drivers/acpi/acpi_pad.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/acpi_pad.c
--- linux-2.6.32.43/drivers/acpi/acpi_pad.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/acpi_pad.c	2011-07-15 05:51:11.000000000 -0500
@@ -30,7 +30,7 @@
 #include <acpi/acpi_bus.h>
 #include <acpi/acpi_drivers.h>
 
-#define ACPI_PROCESSOR_AGGREGATOR_CLASS	"processor_aggregator"
+#define ACPI_PROCESSOR_AGGREGATOR_CLASS	"acpi_pad"
 #define ACPI_PROCESSOR_AGGREGATOR_DEVICE_NAME "Processor Aggregator"
 #define ACPI_PROCESSOR_AGGREGATOR_NOTIFY 0x80
 static DEFINE_MUTEX(isolated_cpus_lock);
diff -uriN linux-2.6.32.43/drivers/acpi/battery.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/battery.c
--- linux-2.6.32.43/drivers/acpi/battery.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/battery.c	2011-07-15 05:51:11.000000000 -0500
@@ -763,7 +763,7 @@
 	}
 
 static struct battery_file {
-	struct file_operations ops;
+	const struct file_operations ops;
 	mode_t mode;
 	const char *name;
 } acpi_battery_file[] = {
diff -uriN linux-2.6.32.43/drivers/acpi/dock.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/dock.c
--- linux-2.6.32.43/drivers/acpi/dock.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/dock.c	2011-07-15 05:51:11.000000000 -0500
@@ -77,7 +77,7 @@
 	struct list_head list;
 	struct list_head hotplug_list;
 	acpi_handle handle;
-	struct acpi_dock_ops *ops;
+	const struct acpi_dock_ops *ops;
 	void *context;
 };
 
@@ -605,7 +605,7 @@
  * the dock driver after _DCK is executed.
  */
 int
-register_hotplug_dock_device(acpi_handle handle, struct acpi_dock_ops *ops,
+register_hotplug_dock_device(acpi_handle handle, const struct acpi_dock_ops *ops,
 			     void *context)
 {
 	struct dock_dependent_device *dd;
diff -uriN linux-2.6.32.43/drivers/acpi/osl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/osl.c
--- linux-2.6.32.43/drivers/acpi/osl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/osl.c	2011-07-15 05:51:11.000000000 -0500
@@ -523,6 +523,8 @@
 	void __iomem *virt_addr;
 
 	virt_addr = ioremap(phys_addr, width);
+	if (!virt_addr)
+		return AE_NO_MEMORY;
 	if (!value)
 		value = &dummy;
 
@@ -551,6 +553,8 @@
 	void __iomem *virt_addr;
 
 	virt_addr = ioremap(phys_addr, width);
+	if (!virt_addr)
+		return AE_NO_MEMORY;
 
 	switch (width) {
 	case 8:
diff -uriN linux-2.6.32.43/drivers/acpi/power_meter.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/power_meter.c
--- linux-2.6.32.43/drivers/acpi/power_meter.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/power_meter.c	2011-07-15 05:51:11.000000000 -0500
@@ -315,8 +315,6 @@
 		return res;
 
 	temp /= 1000;
-	if (temp < 0)
-		return -EINVAL;
 
 	mutex_lock(&resource->lock);
 	resource->trip[attr->index - 7] = temp;
diff -uriN linux-2.6.32.43/drivers/acpi/proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/proc.c
--- linux-2.6.32.43/drivers/acpi/proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/proc.c	2011-07-15 05:51:11.000000000 -0500
@@ -391,20 +391,15 @@
 				size_t count, loff_t * ppos)
 {
 	struct list_head *node, *next;
-	char strbuf[5];
-	char str[5] = "";
-	unsigned int len = count;
+	char strbuf[5] = {0};
 	struct acpi_device *found_dev = NULL;
 
-	if (len > 4)
-		len = 4;
-	if (len < 0)
-		return -EFAULT;
+	if (count > 4)
+		count = 4;
 
-	if (copy_from_user(strbuf, buffer, len))
+	if (copy_from_user(strbuf, buffer, count))
 		return -EFAULT;
-	strbuf[len] = '\0';
-	sscanf(strbuf, "%s", str);
+	strbuf[count] = '\0';
 
 	mutex_lock(&acpi_device_lock);
 	list_for_each_safe(node, next, &acpi_wakeup_device_list) {
@@ -413,7 +408,7 @@
 		if (!dev->wakeup.flags.valid)
 			continue;
 
-		if (!strncmp(dev->pnp.bus_id, str, 4)) {
+		if (!strncmp(dev->pnp.bus_id, strbuf, 4)) {
 			dev->wakeup.state.enabled =
 			    dev->wakeup.state.enabled ? 0 : 1;
 			found_dev = dev;
diff -uriN linux-2.6.32.43/drivers/acpi/processor_core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/processor_core.c
--- linux-2.6.32.43/drivers/acpi/processor_core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/processor_core.c	2011-07-15 05:51:11.000000000 -0500
@@ -790,7 +790,7 @@
 		return 0;
 	}
 
-	BUG_ON((pr->id >= nr_cpu_ids) || (pr->id < 0));
+	BUG_ON(pr->id >= nr_cpu_ids);
 
 	/*
 	 * Buggy BIOS check
diff -uriN linux-2.6.32.43/drivers/acpi/sbshc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/sbshc.c
--- linux-2.6.32.43/drivers/acpi/sbshc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/sbshc.c	2011-07-15 05:51:11.000000000 -0500
@@ -17,7 +17,7 @@
 
 #define PREFIX "ACPI: "
 
-#define ACPI_SMB_HC_CLASS	"smbus_host_controller"
+#define ACPI_SMB_HC_CLASS	"smbus_host_ctl"
 #define ACPI_SMB_HC_DEVICE_NAME	"ACPI SMBus HC"
 
 struct acpi_smb_hc {
diff -uriN linux-2.6.32.43/drivers/acpi/sleep.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/sleep.c
--- linux-2.6.32.43/drivers/acpi/sleep.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/sleep.c	2011-07-15 05:51:11.000000000 -0500
@@ -283,7 +283,7 @@
 	}
 }
 
-static struct platform_suspend_ops acpi_suspend_ops = {
+static const struct platform_suspend_ops acpi_suspend_ops = {
 	.valid = acpi_suspend_state_valid,
 	.begin = acpi_suspend_begin,
 	.prepare_late = acpi_pm_prepare,
@@ -311,7 +311,7 @@
  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
  * been requested.
  */
-static struct platform_suspend_ops acpi_suspend_ops_old = {
+static const struct platform_suspend_ops acpi_suspend_ops_old = {
 	.valid = acpi_suspend_state_valid,
 	.begin = acpi_suspend_begin_old,
 	.prepare_late = acpi_pm_disable_gpes,
@@ -460,7 +460,7 @@
 	acpi_enable_all_runtime_gpes();
 }
 
-static struct platform_hibernation_ops acpi_hibernation_ops = {
+static const struct platform_hibernation_ops acpi_hibernation_ops = {
 	.begin = acpi_hibernation_begin,
 	.end = acpi_pm_end,
 	.pre_snapshot = acpi_hibernation_pre_snapshot,
@@ -513,7 +513,7 @@
  * The following callbacks are used if the pre-ACPI 2.0 suspend ordering has
  * been requested.
  */
-static struct platform_hibernation_ops acpi_hibernation_ops_old = {
+static const struct platform_hibernation_ops acpi_hibernation_ops_old = {
 	.begin = acpi_hibernation_begin_old,
 	.end = acpi_pm_end,
 	.pre_snapshot = acpi_hibernation_pre_snapshot_old,
diff -uriN linux-2.6.32.43/drivers/acpi/video.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/video.c
--- linux-2.6.32.43/drivers/acpi/video.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/acpi/video.c	2011-07-15 05:51:11.000000000 -0500
@@ -359,7 +359,7 @@
 				vd->brightness->levels[request_level]);
 }
 
-static struct backlight_ops acpi_backlight_ops = {
+static const struct backlight_ops acpi_backlight_ops = {
 	.get_brightness = acpi_video_get_brightness,
 	.update_status  = acpi_video_set_brightness,
 };
diff -uriN linux-2.6.32.43/drivers/ata/ahci.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/ahci.c
--- linux-2.6.32.43/drivers/ata/ahci.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/ahci.c	2011-07-15 05:51:11.000000000 -0500
@@ -387,7 +387,7 @@
 	.sdev_attrs		= ahci_sdev_attrs,
 };
 
-static struct ata_port_operations ahci_ops = {
+static const struct ata_port_operations ahci_ops = {
 	.inherits		= &sata_pmp_port_ops,
 
 	.qc_defer		= sata_pmp_qc_defer_cmd_switch,
@@ -424,17 +424,17 @@
 	.port_stop		= ahci_port_stop,
 };
 
-static struct ata_port_operations ahci_vt8251_ops = {
+static const struct ata_port_operations ahci_vt8251_ops = {
 	.inherits		= &ahci_ops,
 	.hardreset		= ahci_vt8251_hardreset,
 };
 
-static struct ata_port_operations ahci_p5wdh_ops = {
+static const struct ata_port_operations ahci_p5wdh_ops = {
 	.inherits		= &ahci_ops,
 	.hardreset		= ahci_p5wdh_hardreset,
 };
 
-static struct ata_port_operations ahci_sb600_ops = {
+static const struct ata_port_operations ahci_sb600_ops = {
 	.inherits		= &ahci_ops,
 	.softreset		= ahci_sb600_softreset,
 	.pmp_softreset		= ahci_sb600_softreset,
diff -uriN linux-2.6.32.43/drivers/ata/ata_generic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/ata_generic.c
--- linux-2.6.32.43/drivers/ata/ata_generic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/ata_generic.c	2011-07-15 05:51:11.000000000 -0500
@@ -104,7 +104,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations generic_port_ops = {
+static const struct ata_port_operations generic_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= ata_cable_unknown,
 	.set_mode	= generic_set_mode,
diff -uriN linux-2.6.32.43/drivers/ata/ata_piix.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/ata_piix.c
--- linux-2.6.32.43/drivers/ata/ata_piix.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/ata_piix.c	2011-07-15 05:51:11.000000000 -0500
@@ -318,7 +318,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations piix_pata_ops = {
+static const struct ata_port_operations piix_pata_ops = {
 	.inherits		= &ata_bmdma32_port_ops,
 	.cable_detect		= ata_cable_40wire,
 	.set_piomode		= piix_set_piomode,
@@ -326,22 +326,22 @@
 	.prereset		= piix_pata_prereset,
 };
 
-static struct ata_port_operations piix_vmw_ops = {
+static const struct ata_port_operations piix_vmw_ops = {
 	.inherits		= &piix_pata_ops,
 	.bmdma_status		= piix_vmw_bmdma_status,
 };
 
-static struct ata_port_operations ich_pata_ops = {
+static const struct ata_port_operations ich_pata_ops = {
 	.inherits		= &piix_pata_ops,
 	.cable_detect		= ich_pata_cable_detect,
 	.set_dmamode		= ich_set_dmamode,
 };
 
-static struct ata_port_operations piix_sata_ops = {
+static const struct ata_port_operations piix_sata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 };
 
-static struct ata_port_operations piix_sidpr_sata_ops = {
+static const struct ata_port_operations piix_sidpr_sata_ops = {
 	.inherits		= &piix_sata_ops,
 	.hardreset		= sata_std_hardreset,
 	.scr_read		= piix_sidpr_scr_read,
diff -uriN linux-2.6.32.43/drivers/ata/libata-acpi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/libata-acpi.c
--- linux-2.6.32.43/drivers/ata/libata-acpi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/libata-acpi.c	2011-07-15 05:51:11.000000000 -0500
@@ -223,12 +223,12 @@
 	ata_acpi_uevent(dev->link->ap, dev, event);
 }
 
-static struct acpi_dock_ops ata_acpi_dev_dock_ops = {
+static const struct acpi_dock_ops ata_acpi_dev_dock_ops = {
 	.handler = ata_acpi_dev_notify_dock,
 	.uevent = ata_acpi_dev_uevent,
 };
 
-static struct acpi_dock_ops ata_acpi_ap_dock_ops = {
+static const struct acpi_dock_ops ata_acpi_ap_dock_ops = {
 	.handler = ata_acpi_ap_notify_dock,
 	.uevent = ata_acpi_ap_uevent,
 };
diff -uriN linux-2.6.32.43/drivers/ata/libata-core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/libata-core.c
--- linux-2.6.32.43/drivers/ata/libata-core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/libata-core.c	2011-07-15 05:51:11.000000000 -0500
@@ -4954,7 +4954,7 @@
 	struct ata_port *ap;
 	unsigned int tag;
 
-	WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
+	BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
 	ap = qc->ap;
 
 	qc->flags = 0;
@@ -4970,7 +4970,7 @@
 	struct ata_port *ap;
 	struct ata_link *link;
 
-	WARN_ON_ONCE(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
+	BUG_ON(qc == NULL); /* ata_qc_from_tag _might_ return NULL */
 	WARN_ON_ONCE(!(qc->flags & ATA_QCFLAG_ACTIVE));
 	ap = qc->ap;
 	link = qc->dev->link;
@@ -5987,7 +5987,7 @@
  *	LOCKING:
  *	None.
  */
-static void ata_finalize_port_ops(struct ata_port_operations *ops)
+static void ata_finalize_port_ops(const struct ata_port_operations *ops)
 {
 	static DEFINE_SPINLOCK(lock);
 	const struct ata_port_operations *cur;
@@ -5999,6 +5999,7 @@
 		return;
 
 	spin_lock(&lock);
+	pax_open_kernel();
 
 	for (cur = ops->inherits; cur; cur = cur->inherits) {
 		void **inherit = (void **)cur;
@@ -6012,8 +6013,9 @@
 		if (IS_ERR(*pp))
 			*pp = NULL;
 
-	ops->inherits = NULL;
+	((struct ata_port_operations *)ops)->inherits = NULL;
 
+	pax_close_kernel();
 	spin_unlock(&lock);
 }
 
@@ -6110,7 +6112,7 @@
  */
 /* KILLME - the only user left is ipr */
 void ata_host_init(struct ata_host *host, struct device *dev,
-		   unsigned long flags, struct ata_port_operations *ops)
+		   unsigned long flags, const struct ata_port_operations *ops)
 {
 	spin_lock_init(&host->lock);
 	host->dev = dev;
@@ -6773,7 +6775,7 @@
 	/* truly dummy */
 }
 
-struct ata_port_operations ata_dummy_port_ops = {
+const struct ata_port_operations ata_dummy_port_ops = {
 	.qc_prep		= ata_noop_qc_prep,
 	.qc_issue		= ata_dummy_qc_issue,
 	.error_handler		= ata_dummy_error_handler,
diff -uriN linux-2.6.32.43/drivers/ata/libata-eh.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/libata-eh.c
--- linux-2.6.32.43/drivers/ata/libata-eh.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/libata-eh.c	2011-07-15 05:51:11.000000000 -0500
@@ -2423,6 +2423,8 @@
 {
 	struct ata_link *link;
 
+	pax_track_stack();
+
 	ata_for_each_link(link, ap, HOST_FIRST)
 		ata_eh_link_report(link);
 }
@@ -3590,7 +3592,7 @@
  */
 void ata_std_error_handler(struct ata_port *ap)
 {
-	struct ata_port_operations *ops = ap->ops;
+	const struct ata_port_operations *ops = ap->ops;
 	ata_reset_fn_t hardreset = ops->hardreset;
 
 	/* ignore built-in hardreset if SCR access is not available */
diff -uriN linux-2.6.32.43/drivers/ata/libata-pmp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/libata-pmp.c
--- linux-2.6.32.43/drivers/ata/libata-pmp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/libata-pmp.c	2011-07-15 05:51:11.000000000 -0500
@@ -841,7 +841,7 @@
  */
 static int sata_pmp_eh_recover(struct ata_port *ap)
 {
-	struct ata_port_operations *ops = ap->ops;
+	const struct ata_port_operations *ops = ap->ops;
 	int pmp_tries, link_tries[SATA_PMP_MAX_PORTS];
 	struct ata_link *pmp_link = &ap->link;
 	struct ata_device *pmp_dev = pmp_link->device;
diff -uriN linux-2.6.32.43/drivers/ata/pata_acpi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_acpi.c
--- linux-2.6.32.43/drivers/ata/pata_acpi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_acpi.c	2011-07-15 05:51:11.000000000 -0500
@@ -215,7 +215,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations pacpi_ops = {
+static const struct ata_port_operations pacpi_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.qc_issue		= pacpi_qc_issue,
 	.cable_detect		= pacpi_cable_detect,
diff -uriN linux-2.6.32.43/drivers/ata/pata_ali.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ali.c
--- linux-2.6.32.43/drivers/ata/pata_ali.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ali.c	2011-07-15 05:51:11.000000000 -0500
@@ -365,7 +365,7 @@
  *	Port operations for PIO only ALi
  */
 
-static struct ata_port_operations ali_early_port_ops = {
+static const struct ata_port_operations ali_early_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.cable_detect	= ata_cable_40wire,
 	.set_piomode	= ali_set_piomode,
@@ -382,7 +382,7 @@
  *	Port operations for DMA capable ALi without cable
  *	detect
  */
-static struct ata_port_operations ali_20_port_ops = {
+static const struct ata_port_operations ali_20_port_ops = {
 	.inherits	= &ali_dma_base_ops,
 	.cable_detect	= ata_cable_40wire,
 	.mode_filter	= ali_20_filter,
@@ -393,7 +393,7 @@
 /*
  *	Port operations for DMA capable ALi with cable detect
  */
-static struct ata_port_operations ali_c2_port_ops = {
+static const struct ata_port_operations ali_c2_port_ops = {
 	.inherits	= &ali_dma_base_ops,
 	.check_atapi_dma = ali_check_atapi_dma,
 	.cable_detect	= ali_c2_cable_detect,
@@ -404,7 +404,7 @@
 /*
  *	Port operations for DMA capable ALi with cable detect
  */
-static struct ata_port_operations ali_c4_port_ops = {
+static const struct ata_port_operations ali_c4_port_ops = {
 	.inherits	= &ali_dma_base_ops,
 	.check_atapi_dma = ali_check_atapi_dma,
 	.cable_detect	= ali_c2_cable_detect,
@@ -414,7 +414,7 @@
 /*
  *	Port operations for DMA capable ALi with cable detect and LBA48
  */
-static struct ata_port_operations ali_c5_port_ops = {
+static const struct ata_port_operations ali_c5_port_ops = {
 	.inherits	= &ali_dma_base_ops,
 	.check_atapi_dma = ali_check_atapi_dma,
 	.dev_config	= ali_warn_atapi_dma,
diff -uriN linux-2.6.32.43/drivers/ata/pata_amd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_amd.c
--- linux-2.6.32.43/drivers/ata/pata_amd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_amd.c	2011-07-15 05:51:11.000000000 -0500
@@ -397,28 +397,28 @@
 	.prereset	= amd_pre_reset,
 };
 
-static struct ata_port_operations amd33_port_ops = {
+static const struct ata_port_operations amd33_port_ops = {
 	.inherits	= &amd_base_port_ops,
 	.cable_detect	= ata_cable_40wire,
 	.set_piomode	= amd33_set_piomode,
 	.set_dmamode	= amd33_set_dmamode,
 };
 
-static struct ata_port_operations amd66_port_ops = {
+static const struct ata_port_operations amd66_port_ops = {
 	.inherits	= &amd_base_port_ops,
 	.cable_detect	= ata_cable_unknown,
 	.set_piomode	= amd66_set_piomode,
 	.set_dmamode	= amd66_set_dmamode,
 };
 
-static struct ata_port_operations amd100_port_ops = {
+static const struct ata_port_operations amd100_port_ops = {
 	.inherits	= &amd_base_port_ops,
 	.cable_detect	= ata_cable_unknown,
 	.set_piomode	= amd100_set_piomode,
 	.set_dmamode	= amd100_set_dmamode,
 };
 
-static struct ata_port_operations amd133_port_ops = {
+static const struct ata_port_operations amd133_port_ops = {
 	.inherits	= &amd_base_port_ops,
 	.cable_detect	= amd_cable_detect,
 	.set_piomode	= amd133_set_piomode,
@@ -433,13 +433,13 @@
 	.host_stop	= nv_host_stop,
 };
 
-static struct ata_port_operations nv100_port_ops = {
+static const struct ata_port_operations nv100_port_ops = {
 	.inherits	= &nv_base_port_ops,
 	.set_piomode	= nv100_set_piomode,
 	.set_dmamode	= nv100_set_dmamode,
 };
 
-static struct ata_port_operations nv133_port_ops = {
+static const struct ata_port_operations nv133_port_ops = {
 	.inherits	= &nv_base_port_ops,
 	.set_piomode	= nv133_set_piomode,
 	.set_dmamode	= nv133_set_dmamode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_artop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_artop.c
--- linux-2.6.32.43/drivers/ata/pata_artop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_artop.c	2011-07-15 05:51:11.000000000 -0500
@@ -311,7 +311,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations artop6210_ops = {
+static const struct ata_port_operations artop6210_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.cable_detect		= ata_cable_40wire,
 	.set_piomode		= artop6210_set_piomode,
@@ -320,7 +320,7 @@
 	.qc_defer		= artop6210_qc_defer,
 };
 
-static struct ata_port_operations artop6260_ops = {
+static const struct ata_port_operations artop6260_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.cable_detect		= artop6260_cable_detect,
 	.set_piomode		= artop6260_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_at32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_at32.c
--- linux-2.6.32.43/drivers/ata/pata_at32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_at32.c	2011-07-15 05:51:11.000000000 -0500
@@ -172,7 +172,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations at32_port_ops = {
+static const struct ata_port_operations at32_port_ops = {
 	.inherits		= &ata_sff_port_ops,
 	.cable_detect		= ata_cable_40wire,
 	.set_piomode		= pata_at32_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_at91.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_at91.c
--- linux-2.6.32.43/drivers/ata/pata_at91.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_at91.c	2011-07-15 05:51:11.000000000 -0500
@@ -195,7 +195,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations pata_at91_port_ops = {
+static const struct ata_port_operations pata_at91_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 
 	.sff_data_xfer	= pata_at91_data_xfer_noirq,
diff -uriN linux-2.6.32.43/drivers/ata/pata_atiixp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_atiixp.c
--- linux-2.6.32.43/drivers/ata/pata_atiixp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_atiixp.c	2011-07-15 05:51:11.000000000 -0500
@@ -205,7 +205,7 @@
 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
 };
 
-static struct ata_port_operations atiixp_port_ops = {
+static const struct ata_port_operations atiixp_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.qc_prep 	= ata_sff_dumb_qc_prep,
diff -uriN linux-2.6.32.43/drivers/ata/pata_atp867x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_atp867x.c
--- linux-2.6.32.43/drivers/ata/pata_atp867x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_atp867x.c	2011-07-15 05:51:11.000000000 -0500
@@ -274,7 +274,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations atp867x_ops = {
+static const struct ata_port_operations atp867x_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.cable_detect		= atp867x_cable_detect,
 	.set_piomode		= atp867x_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_bf54x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_bf54x.c
--- linux-2.6.32.43/drivers/ata/pata_bf54x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_bf54x.c	2011-07-15 05:51:11.000000000 -0500
@@ -1464,7 +1464,7 @@
 	.dma_boundary		= ATA_DMA_BOUNDARY,
 };
 
-static struct ata_port_operations bfin_pata_ops = {
+static const struct ata_port_operations bfin_pata_ops = {
 	.inherits		= &ata_sff_port_ops,
 
 	.set_piomode		= bfin_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_cmd640.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cmd640.c
--- linux-2.6.32.43/drivers/ata/pata_cmd640.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cmd640.c	2011-07-15 05:51:11.000000000 -0500
@@ -168,7 +168,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations cmd640_port_ops = {
+static const struct ata_port_operations cmd640_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	/* In theory xfer_noirq is not needed once we kill the prefetcher */
 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
diff -uriN linux-2.6.32.43/drivers/ata/pata_cmd64x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cmd64x.c
--- linux-2.6.32.43/drivers/ata/pata_cmd64x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cmd64x.c	2011-07-15 05:51:11.000000000 -0500
@@ -271,18 +271,18 @@
 	.set_dmamode	= cmd64x_set_dmamode,
 };
 
-static struct ata_port_operations cmd64x_port_ops = {
+static const struct ata_port_operations cmd64x_port_ops = {
 	.inherits	= &cmd64x_base_ops,
 	.cable_detect	= ata_cable_40wire,
 };
 
-static struct ata_port_operations cmd646r1_port_ops = {
+static const struct ata_port_operations cmd646r1_port_ops = {
 	.inherits	= &cmd64x_base_ops,
 	.bmdma_stop	= cmd646r1_bmdma_stop,
 	.cable_detect	= ata_cable_40wire,
 };
 
-static struct ata_port_operations cmd648_port_ops = {
+static const struct ata_port_operations cmd648_port_ops = {
 	.inherits	= &cmd64x_base_ops,
 	.bmdma_stop	= cmd648_bmdma_stop,
 	.cable_detect	= cmd648_cable_detect,
diff -uriN linux-2.6.32.43/drivers/ata/pata_cs5520.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cs5520.c
--- linux-2.6.32.43/drivers/ata/pata_cs5520.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cs5520.c	2011-07-15 05:51:11.000000000 -0500
@@ -144,7 +144,7 @@
 	.sg_tablesize		= LIBATA_DUMB_MAX_PRD,
 };
 
-static struct ata_port_operations cs5520_port_ops = {
+static const struct ata_port_operations cs5520_port_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.qc_prep		= ata_sff_dumb_qc_prep,
 	.cable_detect		= ata_cable_40wire,
diff -uriN linux-2.6.32.43/drivers/ata/pata_cs5530.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cs5530.c
--- linux-2.6.32.43/drivers/ata/pata_cs5530.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cs5530.c	2011-07-15 05:51:11.000000000 -0500
@@ -164,7 +164,7 @@
 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
 };
 
-static struct ata_port_operations cs5530_port_ops = {
+static const struct ata_port_operations cs5530_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.qc_prep 	= ata_sff_dumb_qc_prep,
diff -uriN linux-2.6.32.43/drivers/ata/pata_cs5535.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cs5535.c
--- linux-2.6.32.43/drivers/ata/pata_cs5535.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cs5535.c	2011-07-15 05:51:11.000000000 -0500
@@ -160,7 +160,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations cs5535_port_ops = {
+static const struct ata_port_operations cs5535_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= cs5535_cable_detect,
 	.set_piomode	= cs5535_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_cs5536.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cs5536.c
--- linux-2.6.32.43/drivers/ata/pata_cs5536.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cs5536.c	2011-07-15 05:51:11.000000000 -0500
@@ -223,7 +223,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations cs5536_port_ops = {
+static const struct ata_port_operations cs5536_port_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.cable_detect		= cs5536_cable_detect,
 	.set_piomode		= cs5536_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_cypress.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cypress.c
--- linux-2.6.32.43/drivers/ata/pata_cypress.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_cypress.c	2011-07-15 05:51:11.000000000 -0500
@@ -113,7 +113,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations cy82c693_port_ops = {
+static const struct ata_port_operations cy82c693_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= ata_cable_40wire,
 	.set_piomode	= cy82c693_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_efar.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_efar.c
--- linux-2.6.32.43/drivers/ata/pata_efar.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_efar.c	2011-07-15 05:51:11.000000000 -0500
@@ -222,7 +222,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations efar_ops = {
+static const struct ata_port_operations efar_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.cable_detect		= efar_cable_detect,
 	.set_piomode		= efar_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_hpt366.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_hpt366.c
--- linux-2.6.32.43/drivers/ata/pata_hpt366.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_hpt366.c	2011-07-15 05:51:11.000000000 -0500
@@ -282,7 +282,7 @@
  *	Configuration for HPT366/68
  */
 
-static struct ata_port_operations hpt366_port_ops = {
+static const struct ata_port_operations hpt366_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= hpt36x_cable_detect,
 	.mode_filter	= hpt366_filter,
diff -uriN linux-2.6.32.43/drivers/ata/pata_hpt37x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_hpt37x.c
--- linux-2.6.32.43/drivers/ata/pata_hpt37x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_hpt37x.c	2011-07-15 05:51:11.000000000 -0500
@@ -576,7 +576,7 @@
  *	Configuration for HPT370
  */
 
-static struct ata_port_operations hpt370_port_ops = {
+static const struct ata_port_operations hpt370_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.bmdma_stop	= hpt370_bmdma_stop,
@@ -591,7 +591,7 @@
  *	Configuration for HPT370A. Close to 370 but less filters
  */
 
-static struct ata_port_operations hpt370a_port_ops = {
+static const struct ata_port_operations hpt370a_port_ops = {
 	.inherits	= &hpt370_port_ops,
 	.mode_filter	= hpt370a_filter,
 };
@@ -601,7 +601,7 @@
  *	and DMA mode setting functionality.
  */
 
-static struct ata_port_operations hpt372_port_ops = {
+static const struct ata_port_operations hpt372_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.bmdma_stop	= hpt37x_bmdma_stop,
@@ -616,7 +616,7 @@
  *	but we have a different cable detection procedure for function 1.
  */
 
-static struct ata_port_operations hpt374_fn1_port_ops = {
+static const struct ata_port_operations hpt374_fn1_port_ops = {
 	.inherits	= &hpt372_port_ops,
 	.prereset	= hpt374_fn1_pre_reset,
 };
diff -uriN linux-2.6.32.43/drivers/ata/pata_hpt3x2n.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_hpt3x2n.c
--- linux-2.6.32.43/drivers/ata/pata_hpt3x2n.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_hpt3x2n.c	2011-07-15 05:51:11.000000000 -0500
@@ -337,7 +337,7 @@
  *	Configuration for HPT3x2n.
  */
 
-static struct ata_port_operations hpt3x2n_port_ops = {
+static const struct ata_port_operations hpt3x2n_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.bmdma_stop	= hpt3x2n_bmdma_stop,
diff -uriN linux-2.6.32.43/drivers/ata/pata_hpt3x3.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_hpt3x3.c
--- linux-2.6.32.43/drivers/ata/pata_hpt3x3.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_hpt3x3.c	2011-07-15 05:51:11.000000000 -0500
@@ -141,7 +141,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations hpt3x3_port_ops = {
+static const struct ata_port_operations hpt3x3_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= ata_cable_40wire,
 	.set_piomode	= hpt3x3_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_icside.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_icside.c
--- linux-2.6.32.43/drivers/ata/pata_icside.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_icside.c	2011-07-15 05:51:11.000000000 -0500
@@ -319,7 +319,7 @@
 	}
 }
 
-static struct ata_port_operations pata_icside_port_ops = {
+static const struct ata_port_operations pata_icside_port_ops = {
 	.inherits		= &ata_sff_port_ops,
 	/* no need to build any PRD tables for DMA */
 	.qc_prep		= ata_noop_qc_prep,
diff -uriN linux-2.6.32.43/drivers/ata/pata_isapnp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_isapnp.c
--- linux-2.6.32.43/drivers/ata/pata_isapnp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_isapnp.c	2011-07-15 05:51:11.000000000 -0500
@@ -23,12 +23,12 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations isapnp_port_ops = {
+static const struct ata_port_operations isapnp_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.cable_detect	= ata_cable_40wire,
 };
 
-static struct ata_port_operations isapnp_noalt_port_ops = {
+static const struct ata_port_operations isapnp_noalt_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.cable_detect	= ata_cable_40wire,
 	/* No altstatus so we don't want to use the lost interrupt poll */
diff -uriN linux-2.6.32.43/drivers/ata/pata_it8213.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_it8213.c
--- linux-2.6.32.43/drivers/ata/pata_it8213.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_it8213.c	2011-07-15 05:51:11.000000000 -0500
@@ -234,7 +234,7 @@
 };
 
 
-static struct ata_port_operations it8213_ops = {
+static const struct ata_port_operations it8213_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.cable_detect		= it8213_cable_detect,
 	.set_piomode		= it8213_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_it821x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_it821x.c
--- linux-2.6.32.43/drivers/ata/pata_it821x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_it821x.c	2011-07-15 05:51:11.000000000 -0500
@@ -800,7 +800,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations it821x_smart_port_ops = {
+static const struct ata_port_operations it821x_smart_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.check_atapi_dma= it821x_check_atapi_dma,
@@ -814,7 +814,7 @@
 	.port_start	= it821x_port_start,
 };
 
-static struct ata_port_operations it821x_passthru_port_ops = {
+static const struct ata_port_operations it821x_passthru_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.check_atapi_dma= it821x_check_atapi_dma,
@@ -830,7 +830,7 @@
 	.port_start	= it821x_port_start,
 };
 
-static struct ata_port_operations it821x_rdc_port_ops = {
+static const struct ata_port_operations it821x_rdc_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 
 	.check_atapi_dma= it821x_check_atapi_dma,
diff -uriN linux-2.6.32.43/drivers/ata/pata_ixp4xx_cf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ixp4xx_cf.c
--- linux-2.6.32.43/drivers/ata/pata_ixp4xx_cf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ixp4xx_cf.c	2011-07-15 05:51:11.000000000 -0500
@@ -89,7 +89,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations ixp4xx_port_ops = {
+static const struct ata_port_operations ixp4xx_port_ops = {
 	.inherits		= &ata_sff_port_ops,
 	.sff_data_xfer		= ixp4xx_mmio_data_xfer,
 	.cable_detect		= ata_cable_40wire,
diff -uriN linux-2.6.32.43/drivers/ata/pata_jmicron.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_jmicron.c
--- linux-2.6.32.43/drivers/ata/pata_jmicron.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_jmicron.c	2011-07-15 05:51:11.000000000 -0500
@@ -111,7 +111,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations jmicron_ops = {
+static const struct ata_port_operations jmicron_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.prereset		= jmicron_pre_reset,
 };
diff -uriN linux-2.6.32.43/drivers/ata/pata_legacy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_legacy.c
--- linux-2.6.32.43/drivers/ata/pata_legacy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_legacy.c	2011-07-15 05:51:11.000000000 -0500
@@ -106,7 +106,7 @@
 
 struct legacy_controller {
 	const char *name;
-	struct ata_port_operations *ops;
+	const struct ata_port_operations *ops;
 	unsigned int pio_mask;
 	unsigned int flags;
 	unsigned int pflags;
@@ -223,12 +223,12 @@
  *	pio_mask as well.
  */
 
-static struct ata_port_operations simple_port_ops = {
+static const struct ata_port_operations simple_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
 };
 
-static struct ata_port_operations legacy_port_ops = {
+static const struct ata_port_operations legacy_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
 	.set_mode	= legacy_set_mode,
@@ -324,7 +324,7 @@
 	return buflen;
 }
 
-static struct ata_port_operations pdc20230_port_ops = {
+static const struct ata_port_operations pdc20230_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= pdc20230_set_piomode,
 	.sff_data_xfer	= pdc_data_xfer_vlb,
@@ -357,7 +357,7 @@
 	ioread8(ap->ioaddr.status_addr);
 }
 
-static struct ata_port_operations ht6560a_port_ops = {
+static const struct ata_port_operations ht6560a_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= ht6560a_set_piomode,
 };
@@ -400,7 +400,7 @@
 	ioread8(ap->ioaddr.status_addr);
 }
 
-static struct ata_port_operations ht6560b_port_ops = {
+static const struct ata_port_operations ht6560b_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= ht6560b_set_piomode,
 };
@@ -499,7 +499,7 @@
 }
 
 
-static struct ata_port_operations opti82c611a_port_ops = {
+static const struct ata_port_operations opti82c611a_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= opti82c611a_set_piomode,
 };
@@ -609,7 +609,7 @@
 	return ata_sff_qc_issue(qc);
 }
 
-static struct ata_port_operations opti82c46x_port_ops = {
+static const struct ata_port_operations opti82c46x_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= opti82c46x_set_piomode,
 	.qc_issue	= opti82c46x_qc_issue,
@@ -771,20 +771,20 @@
 	return 0;
 }
 
-static struct ata_port_operations qdi6500_port_ops = {
+static const struct ata_port_operations qdi6500_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= qdi6500_set_piomode,
 	.qc_issue	= qdi_qc_issue,
 	.sff_data_xfer	= vlb32_data_xfer,
 };
 
-static struct ata_port_operations qdi6580_port_ops = {
+static const struct ata_port_operations qdi6580_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= qdi6580_set_piomode,
 	.sff_data_xfer	= vlb32_data_xfer,
 };
 
-static struct ata_port_operations qdi6580dp_port_ops = {
+static const struct ata_port_operations qdi6580dp_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= qdi6580dp_set_piomode,
 	.sff_data_xfer	= vlb32_data_xfer,
@@ -855,7 +855,7 @@
 	return 0;
 }
 
-static struct ata_port_operations winbond_port_ops = {
+static const struct ata_port_operations winbond_port_ops = {
 	.inherits	= &legacy_base_port_ops,
 	.set_piomode	= winbond_set_piomode,
 	.sff_data_xfer	= vlb32_data_xfer,
@@ -978,7 +978,7 @@
 	int pio_modes = controller->pio_mask;
 	unsigned long io = probe->port;
 	u32 mask = (1 << probe->slot);
-	struct ata_port_operations *ops = controller->ops;
+	const struct ata_port_operations *ops = controller->ops;
 	struct legacy_data *ld = &legacy_data[probe->slot];
 	struct ata_host *host = NULL;
 	struct ata_port *ap;
diff -uriN linux-2.6.32.43/drivers/ata/pata_marvell.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_marvell.c
--- linux-2.6.32.43/drivers/ata/pata_marvell.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_marvell.c	2011-07-15 05:51:11.000000000 -0500
@@ -100,7 +100,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations marvell_ops = {
+static const struct ata_port_operations marvell_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.cable_detect		= marvell_cable_detect,
 	.prereset		= marvell_pre_reset,
diff -uriN linux-2.6.32.43/drivers/ata/pata_mpc52xx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_mpc52xx.c
--- linux-2.6.32.43/drivers/ata/pata_mpc52xx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_mpc52xx.c	2011-07-15 05:51:11.000000000 -0500
@@ -609,7 +609,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations mpc52xx_ata_port_ops = {
+static const struct ata_port_operations mpc52xx_ata_port_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.sff_dev_select		= mpc52xx_ata_dev_select,
 	.set_piomode		= mpc52xx_ata_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_mpiix.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_mpiix.c
--- linux-2.6.32.43/drivers/ata/pata_mpiix.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_mpiix.c	2011-07-15 05:51:11.000000000 -0500
@@ -140,7 +140,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations mpiix_port_ops = {
+static const struct ata_port_operations mpiix_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.qc_issue	= mpiix_qc_issue,
 	.cable_detect	= ata_cable_40wire,
diff -uriN linux-2.6.32.43/drivers/ata/pata_netcell.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_netcell.c
--- linux-2.6.32.43/drivers/ata/pata_netcell.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_netcell.c	2011-07-15 05:51:11.000000000 -0500
@@ -34,7 +34,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations netcell_ops = {
+static const struct ata_port_operations netcell_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= ata_cable_80wire,
 	.read_id	= netcell_read_id,
diff -uriN linux-2.6.32.43/drivers/ata/pata_ninja32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ninja32.c
--- linux-2.6.32.43/drivers/ata/pata_ninja32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ninja32.c	2011-07-15 05:51:11.000000000 -0500
@@ -81,7 +81,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations ninja32_port_ops = {
+static const struct ata_port_operations ninja32_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.sff_dev_select = ninja32_dev_select,
 	.cable_detect	= ata_cable_40wire,
diff -uriN linux-2.6.32.43/drivers/ata/pata_ns87410.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ns87410.c
--- linux-2.6.32.43/drivers/ata/pata_ns87410.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ns87410.c	2011-07-15 05:51:11.000000000 -0500
@@ -132,7 +132,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations ns87410_port_ops = {
+static const struct ata_port_operations ns87410_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.qc_issue	= ns87410_qc_issue,
 	.cable_detect	= ata_cable_40wire,
diff -uriN linux-2.6.32.43/drivers/ata/pata_ns87415.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ns87415.c
--- linux-2.6.32.43/drivers/ata/pata_ns87415.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_ns87415.c	2011-07-15 05:51:11.000000000 -0500
@@ -299,7 +299,7 @@
 }
 #endif		/* 87560 SuperIO Support */
 
-static struct ata_port_operations ns87415_pata_ops = {
+static const struct ata_port_operations ns87415_pata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 
 	.check_atapi_dma	= ns87415_check_atapi_dma,
@@ -313,7 +313,7 @@
 };
 
 #if defined(CONFIG_SUPERIO)
-static struct ata_port_operations ns87560_pata_ops = {
+static const struct ata_port_operations ns87560_pata_ops = {
 	.inherits		= &ns87415_pata_ops,
 	.sff_tf_read		= ns87560_tf_read,
 	.sff_check_status	= ns87560_check_status,
diff -uriN linux-2.6.32.43/drivers/ata/pata_octeon_cf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_octeon_cf.c
--- linux-2.6.32.43/drivers/ata/pata_octeon_cf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_octeon_cf.c	2011-07-15 05:51:11.000000000 -0500
@@ -801,6 +801,7 @@
 	return 0;
 }
 
+/* cannot be const */
 static struct ata_port_operations octeon_cf_ops = {
 	.inherits		= &ata_sff_port_ops,
 	.check_atapi_dma	= octeon_cf_check_atapi_dma,
diff -uriN linux-2.6.32.43/drivers/ata/pata_oldpiix.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_oldpiix.c
--- linux-2.6.32.43/drivers/ata/pata_oldpiix.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_oldpiix.c	2011-07-15 05:51:11.000000000 -0500
@@ -208,7 +208,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations oldpiix_pata_ops = {
+static const struct ata_port_operations oldpiix_pata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.qc_issue		= oldpiix_qc_issue,
 	.cable_detect		= ata_cable_40wire,
diff -uriN linux-2.6.32.43/drivers/ata/pata_opti.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_opti.c
--- linux-2.6.32.43/drivers/ata/pata_opti.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_opti.c	2011-07-15 05:51:11.000000000 -0500
@@ -152,7 +152,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations opti_port_ops = {
+static const struct ata_port_operations opti_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.cable_detect	= ata_cable_40wire,
 	.set_piomode	= opti_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_optidma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_optidma.c
--- linux-2.6.32.43/drivers/ata/pata_optidma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_optidma.c	2011-07-15 05:51:11.000000000 -0500
@@ -337,7 +337,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations optidma_port_ops = {
+static const struct ata_port_operations optidma_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= ata_cable_40wire,
 	.set_piomode	= optidma_set_pio_mode,
@@ -346,7 +346,7 @@
 	.prereset	= optidma_pre_reset,
 };
 
-static struct ata_port_operations optiplus_port_ops = {
+static const struct ata_port_operations optiplus_port_ops = {
 	.inherits	= &optidma_port_ops,
 	.set_piomode	= optiplus_set_pio_mode,
 	.set_dmamode	= optiplus_set_dma_mode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_palmld.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_palmld.c
--- linux-2.6.32.43/drivers/ata/pata_palmld.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_palmld.c	2011-07-15 05:51:11.000000000 -0500
@@ -37,7 +37,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations palmld_port_ops = {
+static const struct ata_port_operations palmld_port_ops = {
 	.inherits		= &ata_sff_port_ops,
 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
 	.cable_detect		= ata_cable_40wire,
diff -uriN linux-2.6.32.43/drivers/ata/pata_pcmcia.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_pcmcia.c
--- linux-2.6.32.43/drivers/ata/pata_pcmcia.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_pcmcia.c	2011-07-15 05:51:11.000000000 -0500
@@ -162,14 +162,14 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations pcmcia_port_ops = {
+static const struct ata_port_operations pcmcia_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
 	.cable_detect	= ata_cable_40wire,
 	.set_mode	= pcmcia_set_mode,
 };
 
-static struct ata_port_operations pcmcia_8bit_port_ops = {
+static const struct ata_port_operations pcmcia_8bit_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.sff_data_xfer	= ata_data_xfer_8bit,
 	.cable_detect	= ata_cable_40wire,
@@ -256,7 +256,7 @@
 	unsigned long io_base, ctl_base;
 	void __iomem *io_addr, *ctl_addr;
 	int n_ports = 1;
-	struct ata_port_operations *ops = &pcmcia_port_ops;
+	const struct ata_port_operations *ops = &pcmcia_port_ops;
 
 	info = kzalloc(sizeof(*info), GFP_KERNEL);
 	if (info == NULL)
diff -uriN linux-2.6.32.43/drivers/ata/pata_pdc2027x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_pdc2027x.c
--- linux-2.6.32.43/drivers/ata/pata_pdc2027x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_pdc2027x.c	2011-07-15 05:51:11.000000000 -0500
@@ -132,14 +132,14 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations pdc2027x_pata100_ops = {
+static const struct ata_port_operations pdc2027x_pata100_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.check_atapi_dma	= pdc2027x_check_atapi_dma,
 	.cable_detect		= pdc2027x_cable_detect,
 	.prereset		= pdc2027x_prereset,
 };
 
-static struct ata_port_operations pdc2027x_pata133_ops = {
+static const struct ata_port_operations pdc2027x_pata133_ops = {
 	.inherits		= &pdc2027x_pata100_ops,
 	.mode_filter		= pdc2027x_mode_filter,
 	.set_piomode		= pdc2027x_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_pdc202xx_old.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_pdc202xx_old.c
--- linux-2.6.32.43/drivers/ata/pata_pdc202xx_old.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_pdc202xx_old.c	2011-07-15 05:51:11.000000000 -0500
@@ -274,7 +274,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations pdc2024x_port_ops = {
+static const struct ata_port_operations pdc2024x_port_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 
 	.cable_detect		= ata_cable_40wire,
@@ -284,7 +284,7 @@
 	.sff_exec_command	= pdc202xx_exec_command,
 };
 
-static struct ata_port_operations pdc2026x_port_ops = {
+static const struct ata_port_operations pdc2026x_port_ops = {
 	.inherits		= &pdc2024x_port_ops,
 
 	.check_atapi_dma	= pdc2026x_check_atapi_dma,
diff -uriN linux-2.6.32.43/drivers/ata/pata_platform.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_platform.c
--- linux-2.6.32.43/drivers/ata/pata_platform.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_platform.c	2011-07-15 05:51:11.000000000 -0500
@@ -48,7 +48,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations pata_platform_port_ops = {
+static const struct ata_port_operations pata_platform_port_ops = {
 	.inherits		= &ata_sff_port_ops,
 	.sff_data_xfer		= ata_sff_data_xfer_noirq,
 	.cable_detect		= ata_cable_unknown,
diff -uriN linux-2.6.32.43/drivers/ata/pata_qdi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_qdi.c
--- linux-2.6.32.43/drivers/ata/pata_qdi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_qdi.c	2011-07-15 05:51:11.000000000 -0500
@@ -157,7 +157,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations qdi6500_port_ops = {
+static const struct ata_port_operations qdi6500_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.qc_issue	= qdi_qc_issue,
 	.sff_data_xfer	= qdi_data_xfer,
@@ -165,7 +165,7 @@
 	.set_piomode	= qdi6500_set_piomode,
 };
 
-static struct ata_port_operations qdi6580_port_ops = {
+static const struct ata_port_operations qdi6580_port_ops = {
 	.inherits	= &qdi6500_port_ops,
 	.set_piomode	= qdi6580_set_piomode,
 };
diff -uriN linux-2.6.32.43/drivers/ata/pata_radisys.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_radisys.c
--- linux-2.6.32.43/drivers/ata/pata_radisys.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_radisys.c	2011-07-15 05:51:11.000000000 -0500
@@ -187,7 +187,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations radisys_pata_ops = {
+static const struct ata_port_operations radisys_pata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.qc_issue		= radisys_qc_issue,
 	.cable_detect		= ata_cable_unknown,
diff -uriN linux-2.6.32.43/drivers/ata/pata_rb532_cf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_rb532_cf.c
--- linux-2.6.32.43/drivers/ata/pata_rb532_cf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_rb532_cf.c	2011-07-15 05:51:11.000000000 -0500
@@ -68,7 +68,7 @@
 	return IRQ_HANDLED;
 }
 
-static struct ata_port_operations rb532_pata_port_ops = {
+static const struct ata_port_operations rb532_pata_port_ops = {
 	.inherits		= &ata_sff_port_ops,
 	.sff_data_xfer		= ata_sff_data_xfer32,
 };
diff -uriN linux-2.6.32.43/drivers/ata/pata_rdc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_rdc.c
--- linux-2.6.32.43/drivers/ata/pata_rdc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_rdc.c	2011-07-15 05:51:11.000000000 -0500
@@ -272,7 +272,7 @@
 	pci_write_config_byte(dev, 0x48, udma_enable);
 }
 
-static struct ata_port_operations rdc_pata_ops = {
+static const struct ata_port_operations rdc_pata_ops = {
 	.inherits		= &ata_bmdma32_port_ops,
 	.cable_detect		= rdc_pata_cable_detect,
 	.set_piomode		= rdc_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_rz1000.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_rz1000.c
--- linux-2.6.32.43/drivers/ata/pata_rz1000.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_rz1000.c	2011-07-15 05:51:11.000000000 -0500
@@ -54,7 +54,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations rz1000_port_ops = {
+static const struct ata_port_operations rz1000_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.cable_detect	= ata_cable_40wire,
 	.set_mode	= rz1000_set_mode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_sc1200.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sc1200.c
--- linux-2.6.32.43/drivers/ata/pata_sc1200.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sc1200.c	2011-07-15 05:51:11.000000000 -0500
@@ -207,7 +207,7 @@
 	.sg_tablesize	= LIBATA_DUMB_MAX_PRD,
 };
 
-static struct ata_port_operations sc1200_port_ops = {
+static const struct ata_port_operations sc1200_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.qc_prep 	= ata_sff_dumb_qc_prep,
 	.qc_issue	= sc1200_qc_issue,
diff -uriN linux-2.6.32.43/drivers/ata/pata_scc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_scc.c
--- linux-2.6.32.43/drivers/ata/pata_scc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_scc.c	2011-07-15 05:51:11.000000000 -0500
@@ -965,7 +965,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations scc_pata_ops = {
+static const struct ata_port_operations scc_pata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 
 	.set_piomode		= scc_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_sch.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sch.c
--- linux-2.6.32.43/drivers/ata/pata_sch.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sch.c	2011-07-15 05:51:11.000000000 -0500
@@ -75,7 +75,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations sch_pata_ops = {
+static const struct ata_port_operations sch_pata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.cable_detect		= ata_cable_unknown,
 	.set_piomode		= sch_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_serverworks.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_serverworks.c
--- linux-2.6.32.43/drivers/ata/pata_serverworks.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_serverworks.c	2011-07-15 05:51:11.000000000 -0500
@@ -299,7 +299,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations serverworks_osb4_port_ops = {
+static const struct ata_port_operations serverworks_osb4_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= serverworks_cable_detect,
 	.mode_filter	= serverworks_osb4_filter,
@@ -307,7 +307,7 @@
 	.set_dmamode	= serverworks_set_dmamode,
 };
 
-static struct ata_port_operations serverworks_csb_port_ops = {
+static const struct ata_port_operations serverworks_csb_port_ops = {
 	.inherits	= &serverworks_osb4_port_ops,
 	.mode_filter	= serverworks_csb_filter,
 };
diff -uriN linux-2.6.32.43/drivers/ata/pata_sil680.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sil680.c
--- linux-2.6.32.43/drivers/ata/pata_sil680.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sil680.c	2011-07-15 05:51:11.000000000 -0500
@@ -194,7 +194,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations sil680_port_ops = {
+static const struct ata_port_operations sil680_port_ops = {
 	.inherits	= &ata_bmdma32_port_ops,
 	.cable_detect	= sil680_cable_detect,
 	.set_piomode	= sil680_set_piomode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_sis.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sis.c
--- linux-2.6.32.43/drivers/ata/pata_sis.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sis.c	2011-07-15 05:51:11.000000000 -0500
@@ -503,47 +503,47 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations sis_133_for_sata_ops = {
+static const struct ata_port_operations sis_133_for_sata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.set_piomode		= sis_133_set_piomode,
 	.set_dmamode		= sis_133_set_dmamode,
 	.cable_detect		= sis_133_cable_detect,
 };
 
-static struct ata_port_operations sis_base_ops = {
+static const struct ata_port_operations sis_base_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.prereset		= sis_pre_reset,
 };
 
-static struct ata_port_operations sis_133_ops = {
+static const struct ata_port_operations sis_133_ops = {
 	.inherits		= &sis_base_ops,
 	.set_piomode		= sis_133_set_piomode,
 	.set_dmamode		= sis_133_set_dmamode,
 	.cable_detect		= sis_133_cable_detect,
 };
 
-static struct ata_port_operations sis_133_early_ops = {
+static const struct ata_port_operations sis_133_early_ops = {
 	.inherits		= &sis_base_ops,
 	.set_piomode		= sis_100_set_piomode,
 	.set_dmamode		= sis_133_early_set_dmamode,
 	.cable_detect		= sis_66_cable_detect,
 };
 
-static struct ata_port_operations sis_100_ops = {
+static const struct ata_port_operations sis_100_ops = {
 	.inherits		= &sis_base_ops,
 	.set_piomode		= sis_100_set_piomode,
 	.set_dmamode		= sis_100_set_dmamode,
 	.cable_detect		= sis_66_cable_detect,
 };
 
-static struct ata_port_operations sis_66_ops = {
+static const struct ata_port_operations sis_66_ops = {
 	.inherits		= &sis_base_ops,
 	.set_piomode		= sis_old_set_piomode,
 	.set_dmamode		= sis_66_set_dmamode,
 	.cable_detect		= sis_66_cable_detect,
 };
 
-static struct ata_port_operations sis_old_ops = {
+static const struct ata_port_operations sis_old_ops = {
 	.inherits		= &sis_base_ops,
 	.set_piomode		= sis_old_set_piomode,
 	.set_dmamode		= sis_old_set_dmamode,
diff -uriN linux-2.6.32.43/drivers/ata/pata_sl82c105.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sl82c105.c
--- linux-2.6.32.43/drivers/ata/pata_sl82c105.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_sl82c105.c	2011-07-15 05:51:11.000000000 -0500
@@ -231,7 +231,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations sl82c105_port_ops = {
+static const struct ata_port_operations sl82c105_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.qc_defer	= sl82c105_qc_defer,
 	.bmdma_start 	= sl82c105_bmdma_start,
diff -uriN linux-2.6.32.43/drivers/ata/pata_triflex.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_triflex.c
--- linux-2.6.32.43/drivers/ata/pata_triflex.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_triflex.c	2011-07-15 05:51:11.000000000 -0500
@@ -178,7 +178,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations triflex_port_ops = {
+static const struct ata_port_operations triflex_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.bmdma_start 	= triflex_bmdma_start,
 	.bmdma_stop	= triflex_bmdma_stop,
diff -uriN linux-2.6.32.43/drivers/ata/pata_via.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_via.c
--- linux-2.6.32.43/drivers/ata/pata_via.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_via.c	2011-07-15 05:51:11.000000000 -0500
@@ -419,7 +419,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations via_port_ops = {
+static const struct ata_port_operations via_port_ops = {
 	.inherits	= &ata_bmdma_port_ops,
 	.cable_detect	= via_cable_detect,
 	.set_piomode	= via_set_piomode,
@@ -429,7 +429,7 @@
 	.port_start	= via_port_start,
 };
 
-static struct ata_port_operations via_port_ops_noirq = {
+static const struct ata_port_operations via_port_ops_noirq = {
 	.inherits	= &via_port_ops,
 	.sff_data_xfer	= ata_sff_data_xfer_noirq,
 };
diff -uriN linux-2.6.32.43/drivers/ata/pata_winbond.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_winbond.c
--- linux-2.6.32.43/drivers/ata/pata_winbond.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pata_winbond.c	2011-07-15 05:51:11.000000000 -0500
@@ -125,7 +125,7 @@
 	ATA_PIO_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations winbond_port_ops = {
+static const struct ata_port_operations winbond_port_ops = {
 	.inherits	= &ata_sff_port_ops,
 	.sff_data_xfer	= winbond_data_xfer,
 	.cable_detect	= ata_cable_40wire,
diff -uriN linux-2.6.32.43/drivers/ata/pdc_adma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pdc_adma.c
--- linux-2.6.32.43/drivers/ata/pdc_adma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/pdc_adma.c	2011-07-15 05:51:11.000000000 -0500
@@ -145,7 +145,7 @@
 	.dma_boundary		= ADMA_DMA_BOUNDARY,
 };
 
-static struct ata_port_operations adma_ata_ops = {
+static const struct ata_port_operations adma_ata_ops = {
 	.inherits		= &ata_sff_port_ops,
 
 	.lost_interrupt		= ATA_OP_NULL,
diff -uriN linux-2.6.32.43/drivers/ata/sata_fsl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_fsl.c
--- linux-2.6.32.43/drivers/ata/sata_fsl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_fsl.c	2011-07-15 05:51:11.000000000 -0500
@@ -1258,7 +1258,7 @@
 	.dma_boundary = ATA_DMA_BOUNDARY,
 };
 
-static struct ata_port_operations sata_fsl_ops = {
+static const struct ata_port_operations sata_fsl_ops = {
 	.inherits		= &sata_pmp_port_ops,
 
 	.qc_defer = ata_std_qc_defer,
diff -uriN linux-2.6.32.43/drivers/ata/sata_inic162x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_inic162x.c
--- linux-2.6.32.43/drivers/ata/sata_inic162x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_inic162x.c	2011-07-15 05:51:11.000000000 -0500
@@ -721,7 +721,7 @@
 	return 0;
 }
 
-static struct ata_port_operations inic_port_ops = {
+static const struct ata_port_operations inic_port_ops = {
 	.inherits		= &sata_port_ops,
 
 	.check_atapi_dma	= inic_check_atapi_dma,
diff -uriN linux-2.6.32.43/drivers/ata/sata_mv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_mv.c
--- linux-2.6.32.43/drivers/ata/sata_mv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_mv.c	2011-07-15 05:51:11.000000000 -0500
@@ -656,7 +656,7 @@
 	.dma_boundary		= MV_DMA_BOUNDARY,
 };
 
-static struct ata_port_operations mv5_ops = {
+static const struct ata_port_operations mv5_ops = {
 	.inherits		= &ata_sff_port_ops,
 
 	.lost_interrupt		= ATA_OP_NULL,
@@ -678,7 +678,7 @@
 	.port_stop		= mv_port_stop,
 };
 
-static struct ata_port_operations mv6_ops = {
+static const struct ata_port_operations mv6_ops = {
 	.inherits		= &mv5_ops,
 	.dev_config             = mv6_dev_config,
 	.scr_read		= mv_scr_read,
@@ -698,7 +698,7 @@
 	.bmdma_status		= mv_bmdma_status,
 };
 
-static struct ata_port_operations mv_iie_ops = {
+static const struct ata_port_operations mv_iie_ops = {
 	.inherits		= &mv6_ops,
 	.dev_config		= ATA_OP_NULL,
 	.qc_prep		= mv_qc_prep_iie,
diff -uriN linux-2.6.32.43/drivers/ata/sata_nv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_nv.c
--- linux-2.6.32.43/drivers/ata/sata_nv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_nv.c	2011-07-15 05:51:11.000000000 -0500
@@ -464,7 +464,7 @@
  * cases.  Define nv_hardreset() which only kicks in for post-boot
  * probing and use it for all variants.
  */
-static struct ata_port_operations nv_generic_ops = {
+static const struct ata_port_operations nv_generic_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.lost_interrupt		= ATA_OP_NULL,
 	.scr_read		= nv_scr_read,
@@ -472,20 +472,20 @@
 	.hardreset		= nv_hardreset,
 };
 
-static struct ata_port_operations nv_nf2_ops = {
+static const struct ata_port_operations nv_nf2_ops = {
 	.inherits		= &nv_generic_ops,
 	.freeze			= nv_nf2_freeze,
 	.thaw			= nv_nf2_thaw,
 };
 
-static struct ata_port_operations nv_ck804_ops = {
+static const struct ata_port_operations nv_ck804_ops = {
 	.inherits		= &nv_generic_ops,
 	.freeze			= nv_ck804_freeze,
 	.thaw			= nv_ck804_thaw,
 	.host_stop		= nv_ck804_host_stop,
 };
 
-static struct ata_port_operations nv_adma_ops = {
+static const struct ata_port_operations nv_adma_ops = {
 	.inherits		= &nv_ck804_ops,
 
 	.check_atapi_dma	= nv_adma_check_atapi_dma,
@@ -509,7 +509,7 @@
 	.host_stop		= nv_adma_host_stop,
 };
 
-static struct ata_port_operations nv_swncq_ops = {
+static const struct ata_port_operations nv_swncq_ops = {
 	.inherits		= &nv_generic_ops,
 
 	.qc_defer		= ata_std_qc_defer,
diff -uriN linux-2.6.32.43/drivers/ata/sata_promise.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_promise.c
--- linux-2.6.32.43/drivers/ata/sata_promise.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_promise.c	2011-07-15 05:51:11.000000000 -0500
@@ -195,7 +195,7 @@
 	.error_handler		= pdc_error_handler,
 };
 
-static struct ata_port_operations pdc_sata_ops = {
+static const struct ata_port_operations pdc_sata_ops = {
 	.inherits		= &pdc_common_ops,
 	.cable_detect		= pdc_sata_cable_detect,
 	.freeze			= pdc_sata_freeze,
@@ -208,14 +208,14 @@
 
 /* First-generation chips need a more restrictive ->check_atapi_dma op,
    and ->freeze/thaw that ignore the hotplug controls. */
-static struct ata_port_operations pdc_old_sata_ops = {
+static const struct ata_port_operations pdc_old_sata_ops = {
 	.inherits		= &pdc_sata_ops,
 	.freeze			= pdc_freeze,
 	.thaw			= pdc_thaw,
 	.check_atapi_dma	= pdc_old_sata_check_atapi_dma,
 };
 
-static struct ata_port_operations pdc_pata_ops = {
+static const struct ata_port_operations pdc_pata_ops = {
 	.inherits		= &pdc_common_ops,
 	.cable_detect		= pdc_pata_cable_detect,
 	.freeze			= pdc_freeze,
diff -uriN linux-2.6.32.43/drivers/ata/sata_qstor.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_qstor.c
--- linux-2.6.32.43/drivers/ata/sata_qstor.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_qstor.c	2011-07-15 05:51:11.000000000 -0500
@@ -132,7 +132,7 @@
 	.dma_boundary		= QS_DMA_BOUNDARY,
 };
 
-static struct ata_port_operations qs_ata_ops = {
+static const struct ata_port_operations qs_ata_ops = {
 	.inherits		= &ata_sff_port_ops,
 
 	.check_atapi_dma	= qs_check_atapi_dma,
diff -uriN linux-2.6.32.43/drivers/ata/sata_sil24.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_sil24.c
--- linux-2.6.32.43/drivers/ata/sata_sil24.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_sil24.c	2011-07-15 05:51:11.000000000 -0500
@@ -388,7 +388,7 @@
 	.dma_boundary		= ATA_DMA_BOUNDARY,
 };
 
-static struct ata_port_operations sil24_ops = {
+static const struct ata_port_operations sil24_ops = {
 	.inherits		= &sata_pmp_port_ops,
 
 	.qc_defer		= sil24_qc_defer,
diff -uriN linux-2.6.32.43/drivers/ata/sata_sil.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_sil.c
--- linux-2.6.32.43/drivers/ata/sata_sil.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_sil.c	2011-07-15 05:51:11.000000000 -0500
@@ -182,7 +182,7 @@
 	.sg_tablesize		= ATA_MAX_PRD
 };
 
-static struct ata_port_operations sil_ops = {
+static const struct ata_port_operations sil_ops = {
 	.inherits		= &ata_bmdma32_port_ops,
 	.dev_config		= sil_dev_config,
 	.set_mode		= sil_set_mode,
diff -uriN linux-2.6.32.43/drivers/ata/sata_sis.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_sis.c
--- linux-2.6.32.43/drivers/ata/sata_sis.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_sis.c	2011-07-15 05:51:11.000000000 -0500
@@ -89,7 +89,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations sis_ops = {
+static const struct ata_port_operations sis_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.scr_read		= sis_scr_read,
 	.scr_write		= sis_scr_write,
diff -uriN linux-2.6.32.43/drivers/ata/sata_svw.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_svw.c
--- linux-2.6.32.43/drivers/ata/sata_svw.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_svw.c	2011-07-15 05:51:11.000000000 -0500
@@ -344,7 +344,7 @@
 };
 
 
-static struct ata_port_operations k2_sata_ops = {
+static const struct ata_port_operations k2_sata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.sff_tf_load		= k2_sata_tf_load,
 	.sff_tf_read		= k2_sata_tf_read,
diff -uriN linux-2.6.32.43/drivers/ata/sata_sx4.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_sx4.c
--- linux-2.6.32.43/drivers/ata/sata_sx4.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_sx4.c	2011-07-15 05:51:11.000000000 -0500
@@ -248,7 +248,7 @@
 };
 
 /* TODO: inherit from base port_ops after converting to new EH */
-static struct ata_port_operations pdc_20621_ops = {
+static const struct ata_port_operations pdc_20621_ops = {
 	.inherits		= &ata_sff_port_ops,
 
 	.check_atapi_dma	= pdc_check_atapi_dma,
diff -uriN linux-2.6.32.43/drivers/ata/sata_uli.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_uli.c
--- linux-2.6.32.43/drivers/ata/sata_uli.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_uli.c	2011-07-15 05:51:11.000000000 -0500
@@ -79,7 +79,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations uli_ops = {
+static const struct ata_port_operations uli_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.scr_read		= uli_scr_read,
 	.scr_write		= uli_scr_write,
diff -uriN linux-2.6.32.43/drivers/ata/sata_via.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_via.c
--- linux-2.6.32.43/drivers/ata/sata_via.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_via.c	2011-07-15 05:51:11.000000000 -0500
@@ -115,32 +115,32 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations svia_base_ops = {
+static const struct ata_port_operations svia_base_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.sff_tf_load		= svia_tf_load,
 };
 
-static struct ata_port_operations vt6420_sata_ops = {
+static const struct ata_port_operations vt6420_sata_ops = {
 	.inherits		= &svia_base_ops,
 	.freeze			= svia_noop_freeze,
 	.prereset		= vt6420_prereset,
 	.bmdma_start		= vt6420_bmdma_start,
 };
 
-static struct ata_port_operations vt6421_pata_ops = {
+static const struct ata_port_operations vt6421_pata_ops = {
 	.inherits		= &svia_base_ops,
 	.cable_detect		= vt6421_pata_cable_detect,
 	.set_piomode		= vt6421_set_pio_mode,
 	.set_dmamode		= vt6421_set_dma_mode,
 };
 
-static struct ata_port_operations vt6421_sata_ops = {
+static const struct ata_port_operations vt6421_sata_ops = {
 	.inherits		= &svia_base_ops,
 	.scr_read		= svia_scr_read,
 	.scr_write		= svia_scr_write,
 };
 
-static struct ata_port_operations vt8251_ops = {
+static const struct ata_port_operations vt8251_ops = {
 	.inherits		= &svia_base_ops,
 	.hardreset		= sata_std_hardreset,
 	.scr_read		= vt8251_scr_read,
diff -uriN linux-2.6.32.43/drivers/ata/sata_vsc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_vsc.c
--- linux-2.6.32.43/drivers/ata/sata_vsc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ata/sata_vsc.c	2011-07-15 05:51:11.000000000 -0500
@@ -306,7 +306,7 @@
 };
 
 
-static struct ata_port_operations vsc_sata_ops = {
+static const struct ata_port_operations vsc_sata_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	/* The IRQ handling is not quite standard SFF behaviour so we
 	   cannot use the default lost interrupt handler */
diff -uriN linux-2.6.32.43/drivers/atm/adummy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/adummy.c
--- linux-2.6.32.43/drivers/atm/adummy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/adummy.c	2011-07-15 05:51:11.000000000 -0500
@@ -77,7 +77,7 @@
 		vcc->pop(vcc, skb);
 	else
 		dev_kfree_skb_any(skb);
-	atomic_inc(&vcc->stats->tx);
+	atomic_inc_unchecked(&vcc->stats->tx);
 
 	return 0;
 }
diff -uriN linux-2.6.32.43/drivers/atm/ambassador.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/ambassador.c
--- linux-2.6.32.43/drivers/atm/ambassador.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/ambassador.c	2011-07-15 05:51:11.000000000 -0500
@@ -453,7 +453,7 @@
   PRINTD (DBG_FLOW|DBG_TX, "tx_complete %p %p", dev, tx);
   
   // VC layer stats
-  atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
+  atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
   
   // free the descriptor
   kfree (tx_descr);
@@ -494,7 +494,7 @@
 	  dump_skb ("<<<", vc, skb);
 	  
 	  // VC layer stats
-	  atomic_inc(&atm_vcc->stats->rx);
+	  atomic_inc_unchecked(&atm_vcc->stats->rx);
 	  __net_timestamp(skb);
 	  // end of our responsability
 	  atm_vcc->push (atm_vcc, skb);
@@ -509,7 +509,7 @@
       } else {
       	PRINTK (KERN_INFO, "dropped over-size frame");
 	// should we count this?
-	atomic_inc(&atm_vcc->stats->rx_drop);
+	atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
       }
       
     } else {
@@ -1341,7 +1341,7 @@
   }
   
   if (check_area (skb->data, skb->len)) {
-    atomic_inc(&atm_vcc->stats->tx_err);
+    atomic_inc_unchecked(&atm_vcc->stats->tx_err);
     return -ENOMEM; // ?
   }
   
diff -uriN linux-2.6.32.43/drivers/atm/atmtcp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/atmtcp.c
--- linux-2.6.32.43/drivers/atm/atmtcp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/atmtcp.c	2011-07-15 05:51:11.000000000 -0500
@@ -206,7 +206,7 @@
 		if (vcc->pop) vcc->pop(vcc,skb);
 		else dev_kfree_skb(skb);
 		if (dev_data) return 0;
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		return -ENOLINK;
 	}
 	size = skb->len+sizeof(struct atmtcp_hdr);
@@ -214,7 +214,7 @@
 	if (!new_skb) {
 		if (vcc->pop) vcc->pop(vcc,skb);
 		else dev_kfree_skb(skb);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		return -ENOBUFS;
 	}
 	hdr = (void *) skb_put(new_skb,sizeof(struct atmtcp_hdr));
@@ -225,8 +225,8 @@
 	if (vcc->pop) vcc->pop(vcc,skb);
 	else dev_kfree_skb(skb);
 	out_vcc->push(out_vcc,new_skb);
-	atomic_inc(&vcc->stats->tx);
-	atomic_inc(&out_vcc->stats->rx);
+	atomic_inc_unchecked(&vcc->stats->tx);
+	atomic_inc_unchecked(&out_vcc->stats->rx);
 	return 0;
 }
 
@@ -300,7 +300,7 @@
 	out_vcc = find_vcc(dev, ntohs(hdr->vpi), ntohs(hdr->vci));
 	read_unlock(&vcc_sklist_lock);
 	if (!out_vcc) {
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		goto done;
 	}
 	skb_pull(skb,sizeof(struct atmtcp_hdr));
@@ -312,8 +312,8 @@
 	__net_timestamp(new_skb);
 	skb_copy_from_linear_data(skb, skb_put(new_skb, skb->len), skb->len);
 	out_vcc->push(out_vcc,new_skb);
-	atomic_inc(&vcc->stats->tx);
-	atomic_inc(&out_vcc->stats->rx);
+	atomic_inc_unchecked(&vcc->stats->tx);
+	atomic_inc_unchecked(&out_vcc->stats->rx);
 done:
 	if (vcc->pop) vcc->pop(vcc,skb);
 	else dev_kfree_skb(skb);
diff -uriN linux-2.6.32.43/drivers/atm/eni.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/eni.c
--- linux-2.6.32.43/drivers/atm/eni.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/eni.c	2011-07-15 05:51:11.000000000 -0500
@@ -525,7 +525,7 @@
 		DPRINTK(DEV_LABEL "(itf %d): trashing empty cell\n",
 		    vcc->dev->number);
 		length = 0;
-		atomic_inc(&vcc->stats->rx_err);
+		atomic_inc_unchecked(&vcc->stats->rx_err);
 	}
 	else {
 		length = ATM_CELL_SIZE-1; /* no HEC */
@@ -580,7 +580,7 @@
 			    size);
 		}
 		eff = length = 0;
-		atomic_inc(&vcc->stats->rx_err);
+		atomic_inc_unchecked(&vcc->stats->rx_err);
 	}
 	else {
 		size = (descr & MID_RED_COUNT)*(ATM_CELL_PAYLOAD >> 2);
@@ -597,7 +597,7 @@
 			    "(VCI=%d,length=%ld,size=%ld (descr 0x%lx))\n",
 			    vcc->dev->number,vcc->vci,length,size << 2,descr);
 			length = eff = 0;
-			atomic_inc(&vcc->stats->rx_err);
+			atomic_inc_unchecked(&vcc->stats->rx_err);
 		}
 	}
 	skb = eff ? atm_alloc_charge(vcc,eff << 2,GFP_ATOMIC) : NULL;
@@ -770,7 +770,7 @@
 			vcc->push(vcc,skb);
 			pushed++;
 		}
-		atomic_inc(&vcc->stats->rx);
+		atomic_inc_unchecked(&vcc->stats->rx);
 	}
 	wake_up(&eni_dev->rx_wait);
 }
@@ -1227,7 +1227,7 @@
 		    PCI_DMA_TODEVICE);
 		if (vcc->pop) vcc->pop(vcc,skb);
 		else dev_kfree_skb_irq(skb);
-		atomic_inc(&vcc->stats->tx);
+		atomic_inc_unchecked(&vcc->stats->tx);
 		wake_up(&eni_dev->tx_wait);
 dma_complete++;
 	}
diff -uriN linux-2.6.32.43/drivers/atm/firestream.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/firestream.c
--- linux-2.6.32.43/drivers/atm/firestream.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/firestream.c	2011-07-15 05:51:11.000000000 -0500
@@ -748,7 +748,7 @@
 				}
 			}
 
-			atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
+			atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
 
 			fs_dprintk (FS_DEBUG_TXMEM, "i");
 			fs_dprintk (FS_DEBUG_ALLOC, "Free t-skb: %p\n", skb);
@@ -815,7 +815,7 @@
 #endif
 				skb_put (skb, qe->p1 & 0xffff); 
 				ATM_SKB(skb)->vcc = atm_vcc;
-				atomic_inc(&atm_vcc->stats->rx);
+				atomic_inc_unchecked(&atm_vcc->stats->rx);
 				__net_timestamp(skb);
 				fs_dprintk (FS_DEBUG_ALLOC, "Free rec-skb: %p (pushed)\n", skb);
 				atm_vcc->push (atm_vcc, skb);
@@ -836,12 +836,12 @@
 				kfree (pe);
 			}
 			if (atm_vcc)
-				atomic_inc(&atm_vcc->stats->rx_drop);
+				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
 			break;
 		case 0x1f: /*  Reassembly abort: no buffers. */
 			/* Silently increment error counter. */
 			if (atm_vcc)
-				atomic_inc(&atm_vcc->stats->rx_drop);
+				atomic_inc_unchecked(&atm_vcc->stats->rx_drop);
 			break;
 		default: /* Hmm. Haven't written the code to handle the others yet... -- REW */
 			printk (KERN_WARNING "Don't know what to do with RX status %x: %s.\n", 
diff -uriN linux-2.6.32.43/drivers/atm/fore200e.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/fore200e.c
--- linux-2.6.32.43/drivers/atm/fore200e.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/fore200e.c	2011-07-15 05:51:11.000000000 -0500
@@ -931,9 +931,9 @@
 #endif
 		/* check error condition */
 		if (*entry->status & STATUS_ERROR)
-		    atomic_inc(&vcc->stats->tx_err);
+		    atomic_inc_unchecked(&vcc->stats->tx_err);
 		else
-		    atomic_inc(&vcc->stats->tx);
+		    atomic_inc_unchecked(&vcc->stats->tx);
 	    }
 	}
 
@@ -1082,7 +1082,7 @@
     if (skb == NULL) {
 	DPRINTK(2, "unable to alloc new skb, rx PDU length = %d\n", pdu_len);
 
-	atomic_inc(&vcc->stats->rx_drop);
+	atomic_inc_unchecked(&vcc->stats->rx_drop);
 	return -ENOMEM;
     } 
 
@@ -1125,14 +1125,14 @@
 
 	dev_kfree_skb_any(skb);
 
-	atomic_inc(&vcc->stats->rx_drop);
+	atomic_inc_unchecked(&vcc->stats->rx_drop);
 	return -ENOMEM;
     }
 
     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
 
     vcc->push(vcc, skb);
-    atomic_inc(&vcc->stats->rx);
+    atomic_inc_unchecked(&vcc->stats->rx);
 
     ASSERT(atomic_read(&sk_atm(vcc)->sk_wmem_alloc) >= 0);
 
@@ -1210,7 +1210,7 @@
 		DPRINTK(2, "damaged PDU on %d.%d.%d\n",
 			fore200e->atm_dev->number,
 			entry->rpd->atm_header.vpi, entry->rpd->atm_header.vci);
-		atomic_inc(&vcc->stats->rx_err);
+		atomic_inc_unchecked(&vcc->stats->rx_err);
 	    }
 	}
 
@@ -1655,7 +1655,7 @@
 		goto retry_here;
 	    }
 
-	    atomic_inc(&vcc->stats->tx_err);
+	    atomic_inc_unchecked(&vcc->stats->tx_err);
 
 	    fore200e->tx_sat++;
 	    DPRINTK(2, "tx queue of device %s is saturated, PDU dropped - heartbeat is %08x\n",
diff -uriN linux-2.6.32.43/drivers/atm/he.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/he.c
--- linux-2.6.32.43/drivers/atm/he.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/he.c	2011-07-15 05:51:11.000000000 -0500
@@ -1769,7 +1769,7 @@
 
 		if (RBRQ_HBUF_ERR(he_dev->rbrq_head)) {
 			hprintk("HBUF_ERR!  (cid 0x%x)\n", cid);
-				atomic_inc(&vcc->stats->rx_drop);
+				atomic_inc_unchecked(&vcc->stats->rx_drop);
 			goto return_host_buffers;
 		}
 
@@ -1802,7 +1802,7 @@
 				RBRQ_LEN_ERR(he_dev->rbrq_head)
 							? "LEN_ERR" : "",
 							vcc->vpi, vcc->vci);
-			atomic_inc(&vcc->stats->rx_err);
+			atomic_inc_unchecked(&vcc->stats->rx_err);
 			goto return_host_buffers;
 		}
 
@@ -1861,7 +1861,7 @@
 		vcc->push(vcc, skb);
 		spin_lock(&he_dev->global_lock);
 
-		atomic_inc(&vcc->stats->rx);
+		atomic_inc_unchecked(&vcc->stats->rx);
 
 return_host_buffers:
 		++pdus_assembled;
@@ -2206,7 +2206,7 @@
 					tpd->vcc->pop(tpd->vcc, tpd->skb);
 				else
 					dev_kfree_skb_any(tpd->skb);
-				atomic_inc(&tpd->vcc->stats->tx_err);
+				atomic_inc_unchecked(&tpd->vcc->stats->tx_err);
 			}
 			pci_pool_free(he_dev->tpd_pool, tpd, TPD_ADDR(tpd->status));
 			return;
@@ -2618,7 +2618,7 @@
 			vcc->pop(vcc, skb);
 		else
 			dev_kfree_skb_any(skb);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		return -EINVAL;
 	}
 
@@ -2629,7 +2629,7 @@
 			vcc->pop(vcc, skb);
 		else
 			dev_kfree_skb_any(skb);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		return -EINVAL;
 	}
 #endif
@@ -2641,7 +2641,7 @@
 			vcc->pop(vcc, skb);
 		else
 			dev_kfree_skb_any(skb);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		spin_unlock_irqrestore(&he_dev->global_lock, flags);
 		return -ENOMEM;
 	}
@@ -2683,7 +2683,7 @@
 					vcc->pop(vcc, skb);
 				else
 					dev_kfree_skb_any(skb);
-				atomic_inc(&vcc->stats->tx_err);
+				atomic_inc_unchecked(&vcc->stats->tx_err);
 				spin_unlock_irqrestore(&he_dev->global_lock, flags);
 				return -ENOMEM;
 			}
@@ -2714,7 +2714,7 @@
 	__enqueue_tpd(he_dev, tpd, cid);
 	spin_unlock_irqrestore(&he_dev->global_lock, flags);
 
-	atomic_inc(&vcc->stats->tx);
+	atomic_inc_unchecked(&vcc->stats->tx);
 
 	return 0;
 }
diff -uriN linux-2.6.32.43/drivers/atm/horizon.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/horizon.c
--- linux-2.6.32.43/drivers/atm/horizon.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/horizon.c	2011-07-15 05:51:11.000000000 -0500
@@ -1033,7 +1033,7 @@
 	{
 	  struct atm_vcc * vcc = ATM_SKB(skb)->vcc;
 	  // VC layer stats
-	  atomic_inc(&vcc->stats->rx);
+	  atomic_inc_unchecked(&vcc->stats->rx);
 	  __net_timestamp(skb);
 	  // end of our responsability
 	  vcc->push (vcc, skb);
@@ -1185,7 +1185,7 @@
 	dev->tx_iovec = NULL;
 	
 	// VC layer stats
-	atomic_inc(&ATM_SKB(skb)->vcc->stats->tx);
+	atomic_inc_unchecked(&ATM_SKB(skb)->vcc->stats->tx);
 	
 	// free the skb
 	hrz_kfree_skb (skb);
diff -uriN linux-2.6.32.43/drivers/atm/idt77252.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/idt77252.c
--- linux-2.6.32.43/drivers/atm/idt77252.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/idt77252.c	2011-07-15 05:51:11.000000000 -0500
@@ -810,7 +810,7 @@
 		else
 			dev_kfree_skb(skb);
 
-		atomic_inc(&vcc->stats->tx);
+		atomic_inc_unchecked(&vcc->stats->tx);
 	}
 
 	atomic_dec(&scq->used);
@@ -1073,13 +1073,13 @@
 			if ((sb = dev_alloc_skb(64)) == NULL) {
 				printk("%s: Can't allocate buffers for aal0.\n",
 				       card->name);
-				atomic_add(i, &vcc->stats->rx_drop);
+				atomic_add_unchecked(i, &vcc->stats->rx_drop);
 				break;
 			}
 			if (!atm_charge(vcc, sb->truesize)) {
 				RXPRINTK("%s: atm_charge() dropped aal0 packets.\n",
 					 card->name);
-				atomic_add(i - 1, &vcc->stats->rx_drop);
+				atomic_add_unchecked(i - 1, &vcc->stats->rx_drop);
 				dev_kfree_skb(sb);
 				break;
 			}
@@ -1096,7 +1096,7 @@
 			ATM_SKB(sb)->vcc = vcc;
 			__net_timestamp(sb);
 			vcc->push(vcc, sb);
-			atomic_inc(&vcc->stats->rx);
+			atomic_inc_unchecked(&vcc->stats->rx);
 
 			cell += ATM_CELL_PAYLOAD;
 		}
@@ -1133,13 +1133,13 @@
 			         "(CDC: %08x)\n",
 			         card->name, len, rpp->len, readl(SAR_REG_CDC));
 			recycle_rx_pool_skb(card, rpp);
-			atomic_inc(&vcc->stats->rx_err);
+			atomic_inc_unchecked(&vcc->stats->rx_err);
 			return;
 		}
 		if (stat & SAR_RSQE_CRC) {
 			RXPRINTK("%s: AAL5 CRC error.\n", card->name);
 			recycle_rx_pool_skb(card, rpp);
-			atomic_inc(&vcc->stats->rx_err);
+			atomic_inc_unchecked(&vcc->stats->rx_err);
 			return;
 		}
 		if (skb_queue_len(&rpp->queue) > 1) {
@@ -1150,7 +1150,7 @@
 				RXPRINTK("%s: Can't alloc RX skb.\n",
 					 card->name);
 				recycle_rx_pool_skb(card, rpp);
-				atomic_inc(&vcc->stats->rx_err);
+				atomic_inc_unchecked(&vcc->stats->rx_err);
 				return;
 			}
 			if (!atm_charge(vcc, skb->truesize)) {
@@ -1169,7 +1169,7 @@
 			__net_timestamp(skb);
 
 			vcc->push(vcc, skb);
-			atomic_inc(&vcc->stats->rx);
+			atomic_inc_unchecked(&vcc->stats->rx);
 
 			return;
 		}
@@ -1191,7 +1191,7 @@
 		__net_timestamp(skb);
 
 		vcc->push(vcc, skb);
-		atomic_inc(&vcc->stats->rx);
+		atomic_inc_unchecked(&vcc->stats->rx);
 
 		if (skb->truesize > SAR_FB_SIZE_3)
 			add_rx_skb(card, 3, SAR_FB_SIZE_3, 1);
@@ -1303,14 +1303,14 @@
 		if (vcc->qos.aal != ATM_AAL0) {
 			RPRINTK("%s: raw cell for non AAL0 vc %u.%u\n",
 				card->name, vpi, vci);
-			atomic_inc(&vcc->stats->rx_drop);
+			atomic_inc_unchecked(&vcc->stats->rx_drop);
 			goto drop;
 		}
 	
 		if ((sb = dev_alloc_skb(64)) == NULL) {
 			printk("%s: Can't allocate buffers for AAL0.\n",
 			       card->name);
-			atomic_inc(&vcc->stats->rx_err);
+			atomic_inc_unchecked(&vcc->stats->rx_err);
 			goto drop;
 		}
 
@@ -1329,7 +1329,7 @@
 		ATM_SKB(sb)->vcc = vcc;
 		__net_timestamp(sb);
 		vcc->push(vcc, sb);
-		atomic_inc(&vcc->stats->rx);
+		atomic_inc_unchecked(&vcc->stats->rx);
 
 drop:
 		skb_pull(queue, 64);
@@ -1954,13 +1954,13 @@
 
 	if (vc == NULL) {
 		printk("%s: NULL connection in send().\n", card->name);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		dev_kfree_skb(skb);
 		return -EINVAL;
 	}
 	if (!test_bit(VCF_TX, &vc->flags)) {
 		printk("%s: Trying to transmit on a non-tx VC.\n", card->name);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		dev_kfree_skb(skb);
 		return -EINVAL;
 	}
@@ -1972,14 +1972,14 @@
 		break;
 	default:
 		printk("%s: Unsupported AAL: %d\n", card->name, vcc->qos.aal);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		dev_kfree_skb(skb);
 		return -EINVAL;
 	}
 
 	if (skb_shinfo(skb)->nr_frags != 0) {
 		printk("%s: No scatter-gather yet.\n", card->name);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		dev_kfree_skb(skb);
 		return -EINVAL;
 	}
@@ -1987,7 +1987,7 @@
 
 	err = queue_skb(card, vc, skb, oam);
 	if (err) {
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		dev_kfree_skb(skb);
 		return err;
 	}
@@ -2010,7 +2010,7 @@
 	skb = dev_alloc_skb(64);
 	if (!skb) {
 		printk("%s: Out of memory in send_oam().\n", card->name);
-		atomic_inc(&vcc->stats->tx_err);
+		atomic_inc_unchecked(&vcc->stats->tx_err);
 		return -ENOMEM;
 	}
 	atomic_add(skb->truesize, &sk_atm(vcc)->sk_wmem_alloc);
diff -uriN linux-2.6.32.43/drivers/atm/iphase.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/iphase.c
--- linux-2.6.32.43/drivers/atm/iphase.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/iphase.c	2011-07-15 05:51:11.000000000 -0500
@@ -1123,7 +1123,7 @@
 	status = (u_short) (buf_desc_ptr->desc_mode);  
 	if (status & (RX_CER | RX_PTE | RX_OFL))  
 	{  
-                atomic_inc(&vcc->stats->rx_err);
+                atomic_inc_unchecked(&vcc->stats->rx_err);
 		IF_ERR(printk("IA: bad packet, dropping it");)  
                 if (status & RX_CER) { 
                     IF_ERR(printk(" cause: packet CRC error\n");)
@@ -1146,7 +1146,7 @@
 	len = dma_addr - buf_addr;  
         if (len > iadev->rx_buf_sz) {
            printk("Over %d bytes sdu received, dropped!!!\n", iadev->rx_buf_sz);
-           atomic_inc(&vcc->stats->rx_err);
+           atomic_inc_unchecked(&vcc->stats->rx_err);
 	   goto out_free_desc;
         }
 		  
@@ -1296,7 +1296,7 @@
           ia_vcc = INPH_IA_VCC(vcc);
           if (ia_vcc == NULL)
           {
-             atomic_inc(&vcc->stats->rx_err);
+             atomic_inc_unchecked(&vcc->stats->rx_err);
              dev_kfree_skb_any(skb);
              atm_return(vcc, atm_guess_pdu2truesize(len));
              goto INCR_DLE;
@@ -1308,7 +1308,7 @@
           if ((length > iadev->rx_buf_sz) || (length > 
                               (skb->len - sizeof(struct cpcs_trailer))))
           {
-             atomic_inc(&vcc->stats->rx_err);
+             atomic_inc_unchecked(&vcc->stats->rx_err);
              IF_ERR(printk("rx_dle_intr: Bad  AAL5 trailer %d (skb len %d)", 
                                                             length, skb->len);)
              dev_kfree_skb_any(skb);
@@ -1324,7 +1324,7 @@
 
 	  IF_RX(printk("rx_dle_intr: skb push");)  
 	  vcc->push(vcc,skb);  
-	  atomic_inc(&vcc->stats->rx);
+	  atomic_inc_unchecked(&vcc->stats->rx);
           iadev->rx_pkt_cnt++;
       }  
 INCR_DLE:
@@ -2806,15 +2806,15 @@
          {
              struct k_sonet_stats *stats;
              stats = &PRIV(_ia_dev[board])->sonet_stats;
-             printk("section_bip: %d\n", atomic_read(&stats->section_bip));
-             printk("line_bip   : %d\n", atomic_read(&stats->line_bip));
-             printk("path_bip   : %d\n", atomic_read(&stats->path_bip));
-             printk("line_febe  : %d\n", atomic_read(&stats->line_febe));
-             printk("path_febe  : %d\n", atomic_read(&stats->path_febe));
-             printk("corr_hcs   : %d\n", atomic_read(&stats->corr_hcs));
-             printk("uncorr_hcs : %d\n", atomic_read(&stats->uncorr_hcs));
-             printk("tx_cells   : %d\n", atomic_read(&stats->tx_cells));
-             printk("rx_cells   : %d\n", atomic_read(&stats->rx_cells));
+             printk("section_bip: %d\n", atomic_read_unchecked(&stats->section_bip));
+             printk("line_bip   : %d\n", atomic_read_unchecked(&stats->line_bip));
+             printk("path_bip   : %d\n", atomic_read_unchecked(&stats->path_bip));
+             printk("line_febe  : %d\n", atomic_read_unchecked(&stats->line_febe));
+             printk("path_febe  : %d\n", atomic_read_unchecked(&stats->path_febe));
+             printk("corr_hcs   : %d\n", atomic_read_unchecked(&stats->corr_hcs));
+             printk("uncorr_hcs : %d\n", atomic_read_unchecked(&stats->uncorr_hcs));
+             printk("tx_cells   : %d\n", atomic_read_unchecked(&stats->tx_cells));
+             printk("rx_cells   : %d\n", atomic_read_unchecked(&stats->rx_cells));
          }
             ia_cmds.status = 0;
             break;
@@ -2919,7 +2919,7 @@
 	if ((desc == 0) || (desc > iadev->num_tx_desc))  
 	{  
 		IF_ERR(printk(DEV_LABEL "invalid desc for send: %d\n", desc);) 
-                atomic_inc(&vcc->stats->tx);
+                atomic_inc_unchecked(&vcc->stats->tx);
 		if (vcc->pop)   
 		    vcc->pop(vcc, skb);   
 		else  
@@ -3024,14 +3024,14 @@
         ATM_DESC(skb) = vcc->vci;
         skb_queue_tail(&iadev->tx_dma_q, skb);
 
-        atomic_inc(&vcc->stats->tx);
+        atomic_inc_unchecked(&vcc->stats->tx);
         iadev->tx_pkt_cnt++;
 	/* Increment transaction counter */  
 	writel(2, iadev->dma+IPHASE5575_TX_COUNTER);  
         
 #if 0        
         /* add flow control logic */ 
-        if (atomic_read(&vcc->stats->tx) % 20 == 0) {
+        if (atomic_read_unchecked(&vcc->stats->tx) % 20 == 0) {
           if (iavcc->vc_desc_cnt > 10) {
              vcc->tx_quota =  vcc->tx_quota * 3 / 4;
             printk("Tx1:  vcc->tx_quota = %d \n", (u32)vcc->tx_quota );
diff -uriN linux-2.6.32.43/drivers/atm/lanai.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/lanai.c
--- linux-2.6.32.43/drivers/atm/lanai.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/lanai.c	2011-07-15 05:51:11.000000000 -0500
@@ -1305,7 +1305,7 @@
 	vcc_tx_add_aal5_trailer(lvcc, skb->len, 0, 0);
 	lanai_endtx(lanai, lvcc);
 	lanai_free_skb(lvcc->tx.atmvcc, skb);
-	atomic_inc(&lvcc->tx.atmvcc->stats->tx);
+	atomic_inc_unchecked(&lvcc->tx.atmvcc->stats->tx);
 }
 
 /* Try to fill the buffer - don't call unless there is backlog */
@@ -1428,7 +1428,7 @@
 	ATM_SKB(skb)->vcc = lvcc->rx.atmvcc;
 	__net_timestamp(skb);
 	lvcc->rx.atmvcc->push(lvcc->rx.atmvcc, skb);
-	atomic_inc(&lvcc->rx.atmvcc->stats->rx);
+	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx);
     out:
 	lvcc->rx.buf.ptr = end;
 	cardvcc_write(lvcc, endptr, vcc_rxreadptr);
@@ -1670,7 +1670,7 @@
 		DPRINTK("(itf %d) got RX service entry 0x%X for non-AAL5 "
 		    "vcc %d\n", lanai->number, (unsigned int) s, vci);
 		lanai->stats.service_rxnotaal5++;
-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
 		return 0;
 	}
 	if (likely(!(s & (SERVICE_TRASH | SERVICE_STREAM | SERVICE_CRCERR)))) {
@@ -1682,7 +1682,7 @@
 		int bytes;
 		read_unlock(&vcc_sklist_lock);
 		DPRINTK("got trashed rx pdu on vci %d\n", vci);
-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
 		lvcc->stats.x.aal5.service_trash++;
 		bytes = (SERVICE_GET_END(s) * 16) -
 		    (((unsigned long) lvcc->rx.buf.ptr) -
@@ -1694,7 +1694,7 @@
 	}
 	if (s & SERVICE_STREAM) {
 		read_unlock(&vcc_sklist_lock);
-		atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
+		atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
 		lvcc->stats.x.aal5.service_stream++;
 		printk(KERN_ERR DEV_LABEL "(itf %d): Got AAL5 stream "
 		    "PDU on VCI %d!\n", lanai->number, vci);
@@ -1702,7 +1702,7 @@
 		return 0;
 	}
 	DPRINTK("got rx crc error on vci %d\n", vci);
-	atomic_inc(&lvcc->rx.atmvcc->stats->rx_err);
+	atomic_inc_unchecked(&lvcc->rx.atmvcc->stats->rx_err);
 	lvcc->stats.x.aal5.service_rxcrc++;
 	lvcc->rx.buf.ptr = &lvcc->rx.buf.start[SERVICE_GET_END(s) * 4];
 	cardvcc_write(lvcc, SERVICE_GET_END(s), vcc_rxreadptr);
diff -uriN linux-2.6.32.43/drivers/atm/nicstar.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/nicstar.c
--- linux-2.6.32.43/drivers/atm/nicstar.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/nicstar.c	2011-07-15 05:51:11.000000000 -0500
@@ -1723,7 +1723,7 @@
    if ((vc = (vc_map *) vcc->dev_data) == NULL)
    {
       printk("nicstar%d: vcc->dev_data == NULL on ns_send().\n", card->index);
-      atomic_inc(&vcc->stats->tx_err);
+      atomic_inc_unchecked(&vcc->stats->tx_err);
       dev_kfree_skb_any(skb);
       return -EINVAL;
    }
@@ -1731,7 +1731,7 @@
    if (!vc->tx)
    {
       printk("nicstar%d: Trying to transmit on a non-tx VC.\n", card->index);
-      atomic_inc(&vcc->stats->tx_err);
+      atomic_inc_unchecked(&vcc->stats->tx_err);
       dev_kfree_skb_any(skb);
       return -EINVAL;
    }
@@ -1739,7 +1739,7 @@
    if (vcc->qos.aal != ATM_AAL5 && vcc->qos.aal != ATM_AAL0)
    {
       printk("nicstar%d: Only AAL0 and AAL5 are supported.\n", card->index);
-      atomic_inc(&vcc->stats->tx_err);
+      atomic_inc_unchecked(&vcc->stats->tx_err);
       dev_kfree_skb_any(skb);
       return -EINVAL;
    }
@@ -1747,7 +1747,7 @@
    if (skb_shinfo(skb)->nr_frags != 0)
    {
       printk("nicstar%d: No scatter-gather yet.\n", card->index);
-      atomic_inc(&vcc->stats->tx_err);
+      atomic_inc_unchecked(&vcc->stats->tx_err);
       dev_kfree_skb_any(skb);
       return -EINVAL;
    }
@@ -1792,11 +1792,11 @@
 
    if (push_scqe(card, vc, scq, &scqe, skb) != 0)
    {
-      atomic_inc(&vcc->stats->tx_err);
+      atomic_inc_unchecked(&vcc->stats->tx_err);
       dev_kfree_skb_any(skb);
       return -EIO;
    }
-   atomic_inc(&vcc->stats->tx);
+   atomic_inc_unchecked(&vcc->stats->tx);
 
    return 0;
 }
@@ -2111,14 +2111,14 @@
          {
             printk("nicstar%d: Can't allocate buffers for aal0.\n",
                    card->index);
-            atomic_add(i,&vcc->stats->rx_drop);
+            atomic_add_unchecked(i,&vcc->stats->rx_drop);
             break;
          }
          if (!atm_charge(vcc, sb->truesize))
          {
             RXPRINTK("nicstar%d: atm_charge() dropped aal0 packets.\n",
                      card->index);
-            atomic_add(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
+            atomic_add_unchecked(i-1,&vcc->stats->rx_drop); /* already increased by 1 */
             dev_kfree_skb_any(sb);
             break;
          }
@@ -2133,7 +2133,7 @@
          ATM_SKB(sb)->vcc = vcc;
 	 __net_timestamp(sb);
          vcc->push(vcc, sb);
-         atomic_inc(&vcc->stats->rx);
+         atomic_inc_unchecked(&vcc->stats->rx);
          cell += ATM_CELL_PAYLOAD;
       }
 
@@ -2152,7 +2152,7 @@
 	 if (iovb == NULL)
 	 {
 	    printk("nicstar%d: Out of iovec buffers.\n", card->index);
-            atomic_inc(&vcc->stats->rx_drop);
+            atomic_inc_unchecked(&vcc->stats->rx_drop);
             recycle_rx_buf(card, skb);
             return;
 	 }
@@ -2182,7 +2182,7 @@
    else if (NS_SKB(iovb)->iovcnt >= NS_MAX_IOVECS)
    {
       printk("nicstar%d: received too big AAL5 SDU.\n", card->index);
-      atomic_inc(&vcc->stats->rx_err);
+      atomic_inc_unchecked(&vcc->stats->rx_err);
       recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data, NS_MAX_IOVECS);
       NS_SKB(iovb)->iovcnt = 0;
       iovb->len = 0;
@@ -2202,7 +2202,7 @@
          printk("nicstar%d: Expected a small buffer, and this is not one.\n",
 	        card->index);
          which_list(card, skb);
-         atomic_inc(&vcc->stats->rx_err);
+         atomic_inc_unchecked(&vcc->stats->rx_err);
          recycle_rx_buf(card, skb);
          vc->rx_iov = NULL;
          recycle_iov_buf(card, iovb);
@@ -2216,7 +2216,7 @@
          printk("nicstar%d: Expected a large buffer, and this is not one.\n",
 	        card->index);
          which_list(card, skb);
-         atomic_inc(&vcc->stats->rx_err);
+         atomic_inc_unchecked(&vcc->stats->rx_err);
          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
 	                       NS_SKB(iovb)->iovcnt);
          vc->rx_iov = NULL;
@@ -2240,7 +2240,7 @@
             printk(" - PDU size mismatch.\n");
          else
             printk(".\n");
-         atomic_inc(&vcc->stats->rx_err);
+         atomic_inc_unchecked(&vcc->stats->rx_err);
          recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
 	   NS_SKB(iovb)->iovcnt);
 	 vc->rx_iov = NULL;
@@ -2256,7 +2256,7 @@
          if (!atm_charge(vcc, skb->truesize))
          {
             push_rxbufs(card, skb);
-            atomic_inc(&vcc->stats->rx_drop);
+            atomic_inc_unchecked(&vcc->stats->rx_drop);
          }
          else
 	 {
@@ -2268,7 +2268,7 @@
             ATM_SKB(skb)->vcc = vcc;
 	    __net_timestamp(skb);
             vcc->push(vcc, skb);
-            atomic_inc(&vcc->stats->rx);
+            atomic_inc_unchecked(&vcc->stats->rx);
          }
       }
       else if (NS_SKB(iovb)->iovcnt == 2)	/* One small plus one large buffer */
@@ -2283,7 +2283,7 @@
             if (!atm_charge(vcc, sb->truesize))
             {
                push_rxbufs(card, sb);
-               atomic_inc(&vcc->stats->rx_drop);
+               atomic_inc_unchecked(&vcc->stats->rx_drop);
             }
             else
 	    {
@@ -2295,7 +2295,7 @@
                ATM_SKB(sb)->vcc = vcc;
 	       __net_timestamp(sb);
                vcc->push(vcc, sb);
-               atomic_inc(&vcc->stats->rx);
+               atomic_inc_unchecked(&vcc->stats->rx);
             }
 
             push_rxbufs(card, skb);
@@ -2306,7 +2306,7 @@
             if (!atm_charge(vcc, skb->truesize))
             {
                push_rxbufs(card, skb);
-               atomic_inc(&vcc->stats->rx_drop);
+               atomic_inc_unchecked(&vcc->stats->rx_drop);
             }
             else
             {
@@ -2320,7 +2320,7 @@
                ATM_SKB(skb)->vcc = vcc;
 	       __net_timestamp(skb);
                vcc->push(vcc, skb);
-               atomic_inc(&vcc->stats->rx);
+               atomic_inc_unchecked(&vcc->stats->rx);
             }
 
             push_rxbufs(card, sb);
@@ -2342,7 +2342,7 @@
             if (hb == NULL)
             {
                printk("nicstar%d: Out of huge buffers.\n", card->index);
-               atomic_inc(&vcc->stats->rx_drop);
+               atomic_inc_unchecked(&vcc->stats->rx_drop);
                recycle_iovec_rx_bufs(card, (struct iovec *) iovb->data,
 	                             NS_SKB(iovb)->iovcnt);
                vc->rx_iov = NULL;
@@ -2393,7 +2393,7 @@
             }
 	    else
 	       dev_kfree_skb_any(hb);
-	    atomic_inc(&vcc->stats->rx_drop);
+	    atomic_inc_unchecked(&vcc->stats->rx_drop);
          }
          else
 	 {
@@ -2427,7 +2427,7 @@
 #endif /* NS_USE_DESTRUCTORS */
 	    __net_timestamp(hb);
             vcc->push(vcc, hb);
-            atomic_inc(&vcc->stats->rx);
+            atomic_inc_unchecked(&vcc->stats->rx);
          }
       }
 
diff -uriN linux-2.6.32.43/drivers/atm/solos-pci.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/solos-pci.c
--- linux-2.6.32.43/drivers/atm/solos-pci.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/solos-pci.c	2011-07-15 05:51:11.000000000 -0500
@@ -708,7 +708,7 @@
 				}
 				atm_charge(vcc, skb->truesize);
 				vcc->push(vcc, skb);
-				atomic_inc(&vcc->stats->rx);
+				atomic_inc_unchecked(&vcc->stats->rx);
 				break;
 
 			case PKT_STATUS:
@@ -914,6 +914,8 @@
 	char msg[500];
 	char item[10];
 
+	pax_track_stack();
+
 	len = buf->len;
 	for (i = 0; i < len; i++){
 		if(i % 8 == 0)
@@ -1023,7 +1025,7 @@
 			vcc = SKB_CB(oldskb)->vcc;
 
 			if (vcc) {
-				atomic_inc(&vcc->stats->tx);
+				atomic_inc_unchecked(&vcc->stats->tx);
 				solos_pop(vcc, oldskb);
 			} else
 				dev_kfree_skb_irq(oldskb);
diff -uriN linux-2.6.32.43/drivers/atm/suni.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/suni.c
--- linux-2.6.32.43/drivers/atm/suni.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/suni.c	2011-07-15 05:51:11.000000000 -0500
@@ -49,8 +49,8 @@
 
 
 #define ADD_LIMITED(s,v) \
-    atomic_add((v),&stats->s); \
-    if (atomic_read(&stats->s) < 0) atomic_set(&stats->s,INT_MAX);
+    atomic_add_unchecked((v),&stats->s); \
+    if (atomic_read_unchecked(&stats->s) < 0) atomic_set_unchecked(&stats->s,INT_MAX);
 
 
 static void suni_hz(unsigned long from_timer)
diff -uriN linux-2.6.32.43/drivers/atm/uPD98402.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/uPD98402.c
--- linux-2.6.32.43/drivers/atm/uPD98402.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/uPD98402.c	2011-07-15 05:51:11.000000000 -0500
@@ -41,7 +41,7 @@
 	struct sonet_stats tmp;
  	int error = 0;
 
-	atomic_add(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
+	atomic_add_unchecked(GET(HECCT),&PRIV(dev)->sonet_stats.uncorr_hcs);
 	sonet_copy_stats(&PRIV(dev)->sonet_stats,&tmp);
 	if (arg) error = copy_to_user(arg,&tmp,sizeof(tmp));
 	if (zero && !error) {
@@ -160,9 +160,9 @@
 
 
 #define ADD_LIMITED(s,v) \
-    { atomic_add(GET(v),&PRIV(dev)->sonet_stats.s); \
-    if (atomic_read(&PRIV(dev)->sonet_stats.s) < 0) \
-	atomic_set(&PRIV(dev)->sonet_stats.s,INT_MAX); }
+    { atomic_add_unchecked(GET(v),&PRIV(dev)->sonet_stats.s); \
+    if (atomic_read_unchecked(&PRIV(dev)->sonet_stats.s) < 0) \
+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.s,INT_MAX); }
 
 
 static void stat_event(struct atm_dev *dev)
@@ -193,7 +193,7 @@
 		if (reason & uPD98402_INT_PFM) stat_event(dev);
 		if (reason & uPD98402_INT_PCO) {
 			(void) GET(PCOCR); /* clear interrupt cause */
-			atomic_add(GET(HECCT),
+			atomic_add_unchecked(GET(HECCT),
 			    &PRIV(dev)->sonet_stats.uncorr_hcs);
 		}
 		if ((reason & uPD98402_INT_RFO) && 
@@ -221,9 +221,9 @@
 	PUT(~(uPD98402_INT_PFM | uPD98402_INT_ALM | uPD98402_INT_RFO |
 	  uPD98402_INT_LOS),PIMR); /* enable them */
 	(void) fetch_stats(dev,NULL,1); /* clear kernel counters */
-	atomic_set(&PRIV(dev)->sonet_stats.corr_hcs,-1);
-	atomic_set(&PRIV(dev)->sonet_stats.tx_cells,-1);
-	atomic_set(&PRIV(dev)->sonet_stats.rx_cells,-1);
+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.corr_hcs,-1);
+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.tx_cells,-1);
+	atomic_set_unchecked(&PRIV(dev)->sonet_stats.rx_cells,-1);
 	return 0;
 }
 
diff -uriN linux-2.6.32.43/drivers/atm/zatm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/zatm.c
--- linux-2.6.32.43/drivers/atm/zatm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/atm/zatm.c	2011-07-15 05:51:11.000000000 -0500
@@ -458,7 +458,7 @@
 		}
 		if (!size) {
 			dev_kfree_skb_irq(skb);
-			if (vcc) atomic_inc(&vcc->stats->rx_err);
+			if (vcc) atomic_inc_unchecked(&vcc->stats->rx_err);
 			continue;
 		}
 		if (!atm_charge(vcc,skb->truesize)) {
@@ -468,7 +468,7 @@
 		skb->len = size;
 		ATM_SKB(skb)->vcc = vcc;
 		vcc->push(vcc,skb);
-		atomic_inc(&vcc->stats->rx);
+		atomic_inc_unchecked(&vcc->stats->rx);
 	}
 	zout(pos & 0xffff,MTA(mbx));
 #if 0 /* probably a stupid idea */
@@ -732,7 +732,7 @@
 			skb_queue_head(&zatm_vcc->backlog,skb);
 			break;
 		}
-	atomic_inc(&vcc->stats->tx);
+	atomic_inc_unchecked(&vcc->stats->tx);
 	wake_up(&zatm_vcc->tx_wait);
 }
 
diff -uriN linux-2.6.32.43/drivers/base/bus.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/bus.c
--- linux-2.6.32.43/drivers/base/bus.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/bus.c	2011-07-15 05:51:11.000000000 -0500
@@ -70,7 +70,7 @@
 	return ret;
 }
 
-static struct sysfs_ops driver_sysfs_ops = {
+static const struct sysfs_ops driver_sysfs_ops = {
 	.show	= drv_attr_show,
 	.store	= drv_attr_store,
 };
@@ -115,7 +115,7 @@
 	return ret;
 }
 
-static struct sysfs_ops bus_sysfs_ops = {
+static const struct sysfs_ops bus_sysfs_ops = {
 	.show	= bus_attr_show,
 	.store	= bus_attr_store,
 };
@@ -154,7 +154,7 @@
 	return 0;
 }
 
-static struct kset_uevent_ops bus_uevent_ops = {
+static const struct kset_uevent_ops bus_uevent_ops = {
 	.filter = bus_uevent_filter,
 };
 
diff -uriN linux-2.6.32.43/drivers/base/class.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/class.c
--- linux-2.6.32.43/drivers/base/class.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/class.c	2011-07-15 05:51:11.000000000 -0500
@@ -63,7 +63,7 @@
 	kfree(cp);
 }
 
-static struct sysfs_ops class_sysfs_ops = {
+static const struct sysfs_ops class_sysfs_ops = {
 	.show	= class_attr_show,
 	.store	= class_attr_store,
 };
diff -uriN linux-2.6.32.43/drivers/base/core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/core.c
--- linux-2.6.32.43/drivers/base/core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/core.c	2011-07-15 05:51:11.000000000 -0500
@@ -100,7 +100,7 @@
 	return ret;
 }
 
-static struct sysfs_ops dev_sysfs_ops = {
+static const struct sysfs_ops dev_sysfs_ops = {
 	.show	= dev_attr_show,
 	.store	= dev_attr_store,
 };
@@ -252,7 +252,7 @@
 	return retval;
 }
 
-static struct kset_uevent_ops device_uevent_ops = {
+static const struct kset_uevent_ops device_uevent_ops = {
 	.filter =	dev_uevent_filter,
 	.name =		dev_uevent_name,
 	.uevent =	dev_uevent,
diff -uriN linux-2.6.32.43/drivers/base/memory.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/memory.c
--- linux-2.6.32.43/drivers/base/memory.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/memory.c	2011-07-15 05:51:11.000000000 -0500
@@ -44,7 +44,7 @@
 	return retval;
 }
 
-static struct kset_uevent_ops memory_uevent_ops = {
+static const struct kset_uevent_ops memory_uevent_ops = {
 	.name		= memory_uevent_name,
 	.uevent		= memory_uevent,
 };
diff -uriN linux-2.6.32.43/drivers/base/sys.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/sys.c
--- linux-2.6.32.43/drivers/base/sys.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/base/sys.c	2011-07-15 05:51:11.000000000 -0500
@@ -54,7 +54,7 @@
 	return -EIO;
 }
 
-static struct sysfs_ops sysfs_ops = {
+static const struct sysfs_ops sysfs_ops = {
 	.show	= sysdev_show,
 	.store	= sysdev_store,
 };
@@ -104,7 +104,7 @@
 	return -EIO;
 }
 
-static struct sysfs_ops sysfs_class_ops = {
+static const struct sysfs_ops sysfs_class_ops = {
 	.show	= sysdev_class_show,
 	.store	= sysdev_class_store,
 };
diff -uriN linux-2.6.32.43/drivers/block/cciss.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/cciss.c
--- linux-2.6.32.43/drivers/block/cciss.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/cciss.c	2011-07-15 05:51:11.000000000 -0500
@@ -1011,6 +1011,8 @@
 	int err;
 	u32 cp;
 
+	memset(&arg64, 0, sizeof(arg64));
+
 	err = 0;
 	err |=
 	    copy_from_user(&arg64.LUN_info, &arg32->LUN_info,
diff -uriN linux-2.6.32.43/drivers/block/cpqarray.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/cpqarray.c
--- linux-2.6.32.43/drivers/block/cpqarray.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/cpqarray.c	2011-07-15 05:51:11.000000000 -0500
@@ -896,6 +896,8 @@
 	struct scatterlist tmp_sg[SG_MAX];
 	int i, dir, seg;
 
+	pax_track_stack();
+
 	if (blk_queue_plugged(q))
 		goto startio;
 
diff -uriN linux-2.6.32.43/drivers/block/DAC960.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/DAC960.c
--- linux-2.6.32.43/drivers/block/DAC960.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/DAC960.c	2011-07-15 05:51:11.000000000 -0500
@@ -1973,6 +1973,8 @@
   unsigned long flags;
   int Channel, TargetID;
 
+  pax_track_stack();
+
   if (!init_dma_loaf(Controller->PCIDevice, &local_dma, 
 		DAC960_V1_MaxChannels*(sizeof(DAC960_V1_DCDB_T) +
 			sizeof(DAC960_SCSI_Inquiry_T) +
diff -uriN linux-2.6.32.43/drivers/block/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/Kconfig
--- linux-2.6.32.43/drivers/block/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -271,6 +271,13 @@
 	  instead, which can be configured to be on-disk compatible with the
 	  cryptoloop device.
 
+config BLK_DEV_VROOT
+	tristate "Virtual Root device support"
+	depends on QUOTACTL
+	---help---
+	  Saying Y here will allow you to use quota/fs ioctls on a shared
+	  partition within a virtual server without compromising security.
+
 config BLK_DEV_NBD
 	tristate "Network block device support"
 	depends on NET
diff -uriN linux-2.6.32.43/drivers/block/loop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/loop.c
--- linux-2.6.32.43/drivers/block/loop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/loop.c	2011-07-15 05:50:11.000000000 -0500
@@ -74,6 +74,7 @@
 #include <linux/gfp.h>
 #include <linux/kthread.h>
 #include <linux/splice.h>
+#include <linux/vs_context.h>
 
 #include <asm/uaccess.h>
 
@@ -814,6 +815,7 @@
 	lo->lo_blocksize = lo_blocksize;
 	lo->lo_device = bdev;
 	lo->lo_flags = lo_flags;
+	lo->lo_xid = vx_current_xid();
 	lo->lo_backing_file = file;
 	lo->transfer = transfer_none;
 	lo->ioctl = NULL;
@@ -939,6 +941,7 @@
 	lo->lo_encrypt_key_size = 0;
 	lo->lo_flags = 0;
 	lo->lo_thread = NULL;
+	lo->lo_xid = 0;
 	memset(lo->lo_encrypt_key, 0, LO_KEY_SIZE);
 	memset(lo->lo_crypt_name, 0, LO_NAME_SIZE);
 	memset(lo->lo_file_name, 0, LO_NAME_SIZE);
@@ -973,7 +976,7 @@
 
 	if (lo->lo_encrypt_key_size &&
 	    lo->lo_key_owner != uid &&
-	    !capable(CAP_SYS_ADMIN))
+	    !vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_CLOOP))
 		return -EPERM;
 	if (lo->lo_state != Lo_bound)
 		return -ENXIO;
@@ -1057,7 +1060,8 @@
 	memcpy(info->lo_crypt_name, lo->lo_crypt_name, LO_NAME_SIZE);
 	info->lo_encrypt_type =
 		lo->lo_encryption ? lo->lo_encryption->number : 0;
-	if (lo->lo_encrypt_key_size && capable(CAP_SYS_ADMIN)) {
+	if (lo->lo_encrypt_key_size &&
+		vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_CLOOP)) {
 		info->lo_encrypt_key_size = lo->lo_encrypt_key_size;
 		memcpy(info->lo_encrypt_key, lo->lo_encrypt_key,
 		       lo->lo_encrypt_key_size);
@@ -1401,6 +1405,9 @@
 {
 	struct loop_device *lo = bdev->bd_disk->private_data;
 
+	if (!vx_check(lo->lo_xid, VS_IDENT|VS_HOSTID|VS_ADMIN_P))
+		return -EACCES;
+
 	mutex_lock(&lo->lo_ctl_mutex);
 	lo->lo_refcnt++;
 	mutex_unlock(&lo->lo_ctl_mutex);
diff -uriN linux-2.6.32.43/drivers/block/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/Makefile
--- linux-2.6.32.43/drivers/block/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/Makefile	2011-07-15 05:50:11.000000000 -0500
@@ -34,6 +34,7 @@
 obj-$(CONFIG_BLK_DEV_SX8)	+= sx8.o
 obj-$(CONFIG_BLK_DEV_UB)	+= ub.o
 obj-$(CONFIG_BLK_DEV_HD)	+= hd.o
+obj-$(CONFIG_BLK_DEV_VROOT)	+= vroot.o
 
 obj-$(CONFIG_XEN_BLKDEV_FRONTEND)	+= xen-blkfront.o
 
diff -uriN linux-2.6.32.43/drivers/block/nbd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/nbd.c
--- linux-2.6.32.43/drivers/block/nbd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/nbd.c	2011-07-15 05:51:11.000000000 -0500
@@ -155,6 +155,8 @@
 	struct kvec iov;
 	sigset_t blocked, oldset;
 
+	pax_track_stack();
+
 	if (unlikely(!sock)) {
 		printk(KERN_ERR "%s: Attempted %s on closed socket in sock_xmit\n",
 		       lo->disk->disk_name, (send ? "send" : "recv"));
@@ -569,6 +571,8 @@
 static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *lo,
 		       unsigned int cmd, unsigned long arg)
 {
+	pax_track_stack();
+
 	switch (cmd) {
 	case NBD_DISCONNECT: {
 		struct request sreq;
diff -uriN linux-2.6.32.43/drivers/block/pktcdvd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/pktcdvd.c
--- linux-2.6.32.43/drivers/block/pktcdvd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/pktcdvd.c	2011-07-15 05:51:11.000000000 -0500
@@ -284,7 +284,7 @@
 	return len;
 }
 
-static struct sysfs_ops kobj_pkt_ops = {
+static const struct sysfs_ops kobj_pkt_ops = {
 	.show = kobj_pkt_show,
 	.store = kobj_pkt_store
 };
diff -uriN linux-2.6.32.43/drivers/block/vroot.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/vroot.c
--- linux-2.6.32.43/drivers/block/vroot.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/block/vroot.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,281 @@
+/*
+ *  linux/drivers/block/vroot.c
+ *
+ *  written by Herbert Pötzl, 9/11/2002
+ *  ported to 2.6.10 by Herbert Pötzl, 30/12/2004
+ *
+ *  based on the loop.c code by Theodore Ts'o.
+ *
+ * Copyright (C) 2002-2007 by Herbert Pötzl.
+ * Redistribution of this file is permitted under the
+ * GNU General Public License.
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/file.h>
+#include <linux/major.h>
+#include <linux/blkdev.h>
+
+#include <linux/vroot.h>
+#include <linux/vs_context.h>
+
+
+static int max_vroot = 8;
+
+static struct vroot_device *vroot_dev;
+static struct gendisk **disks;
+
+
+static int vroot_set_dev(
+	struct vroot_device *vr,
+	struct block_device *bdev,
+	unsigned int arg)
+{
+	struct block_device *real_bdev;
+	struct file *file;
+	struct inode *inode;
+	int error;
+
+	error = -EBUSY;
+	if (vr->vr_state != Vr_unbound)
+		goto out;
+
+	error = -EBADF;
+	file = fget(arg);
+	if (!file)
+		goto out;
+
+	error = -EINVAL;
+	inode = file->f_dentry->d_inode;
+
+
+	if (S_ISBLK(inode->i_mode)) {
+		real_bdev = inode->i_bdev;
+		vr->vr_device = real_bdev;
+		__iget(real_bdev->bd_inode);
+	} else
+		goto out_fput;
+
+	vxdprintk(VXD_CBIT(misc, 0),
+		"vroot[%d]_set_dev: dev=" VXF_DEV,
+		vr->vr_number, VXD_DEV(real_bdev));
+
+	vr->vr_state = Vr_bound;
+	error = 0;
+
+ out_fput:
+	fput(file);
+ out:
+	return error;
+}
+
+static int vroot_clr_dev(
+	struct vroot_device *vr,
+	struct block_device *bdev)
+{
+	struct block_device *real_bdev;
+
+	if (vr->vr_state != Vr_bound)
+		return -ENXIO;
+	if (vr->vr_refcnt > 1)	/* we needed one fd for the ioctl */
+		return -EBUSY;
+
+	real_bdev = vr->vr_device;
+
+	vxdprintk(VXD_CBIT(misc, 0),
+		"vroot[%d]_clr_dev: dev=" VXF_DEV,
+		vr->vr_number, VXD_DEV(real_bdev));
+
+	bdput(real_bdev);
+	vr->vr_state = Vr_unbound;
+	vr->vr_device = NULL;
+	return 0;
+}
+
+
+static int vr_ioctl(struct block_device *bdev, fmode_t mode,
+	unsigned int cmd, unsigned long arg)
+{
+	struct vroot_device *vr = bdev->bd_disk->private_data;
+	int err;
+
+	down(&vr->vr_ctl_mutex);
+	switch (cmd) {
+	case VROOT_SET_DEV:
+		err = vroot_set_dev(vr, bdev, arg);
+		break;
+	case VROOT_CLR_DEV:
+		err = vroot_clr_dev(vr, bdev);
+		break;
+	default:
+		err = -EINVAL;
+		break;
+	}
+	up(&vr->vr_ctl_mutex);
+	return err;
+}
+
+static int vr_open(struct block_device *bdev, fmode_t mode)
+{
+	struct vroot_device *vr = bdev->bd_disk->private_data;
+
+	down(&vr->vr_ctl_mutex);
+	vr->vr_refcnt++;
+	up(&vr->vr_ctl_mutex);
+	return 0;
+}
+
+static int vr_release(struct gendisk *disk, fmode_t mode)
+{
+	struct vroot_device *vr = disk->private_data;
+
+	down(&vr->vr_ctl_mutex);
+	--vr->vr_refcnt;
+	up(&vr->vr_ctl_mutex);
+	return 0;
+}
+
+static struct block_device_operations vr_fops = {
+	.owner =	THIS_MODULE,
+	.open =		vr_open,
+	.release =	vr_release,
+	.ioctl =	vr_ioctl,
+};
+
+struct block_device *__vroot_get_real_bdev(struct block_device *bdev)
+{
+	struct inode *inode = bdev->bd_inode;
+	struct vroot_device *vr;
+	struct block_device *real_bdev;
+	int minor = iminor(inode);
+
+	vr = &vroot_dev[minor];
+	real_bdev = vr->vr_device;
+
+	vxdprintk(VXD_CBIT(misc, 0),
+		"vroot[%d]_get_real_bdev: dev=" VXF_DEV,
+		vr->vr_number, VXD_DEV(real_bdev));
+
+	if (vr->vr_state != Vr_bound)
+		return ERR_PTR(-ENXIO);
+
+	__iget(real_bdev->bd_inode);
+	return real_bdev;
+}
+
+/*
+ * And now the modules code and kernel interface.
+ */
+
+module_param(max_vroot, int, 0);
+
+MODULE_PARM_DESC(max_vroot, "Maximum number of vroot devices (1-256)");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS_BLOCKDEV_MAJOR(VROOT_MAJOR);
+
+MODULE_AUTHOR ("Herbert Pötzl");
+MODULE_DESCRIPTION ("Virtual Root Device Mapper");
+
+
+int __init vroot_init(void)
+{
+	int err, i;
+
+	if (max_vroot < 1 || max_vroot > 256) {
+		max_vroot = MAX_VROOT_DEFAULT;
+		printk(KERN_WARNING "vroot: invalid max_vroot "
+			"(must be between 1 and 256), "
+			"using default (%d)\n", max_vroot);
+	}
+
+	if (register_blkdev(VROOT_MAJOR, "vroot"))
+		return -EIO;
+
+	err = -ENOMEM;
+	vroot_dev = kmalloc(max_vroot * sizeof(struct vroot_device), GFP_KERNEL);
+	if (!vroot_dev)
+		goto out_mem1;
+	memset(vroot_dev, 0, max_vroot * sizeof(struct vroot_device));
+
+	disks = kmalloc(max_vroot * sizeof(struct gendisk *), GFP_KERNEL);
+	if (!disks)
+		goto out_mem2;
+
+	for (i = 0; i < max_vroot; i++) {
+		disks[i] = alloc_disk(1);
+		if (!disks[i])
+			goto out_mem3;
+		disks[i]->queue = blk_alloc_queue(GFP_KERNEL);
+		if (!disks[i]->queue)
+			goto out_mem3;
+	}
+
+	for (i = 0; i < max_vroot; i++) {
+		struct vroot_device *vr = &vroot_dev[i];
+		struct gendisk *disk = disks[i];
+
+		memset(vr, 0, sizeof(*vr));
+		init_MUTEX(&vr->vr_ctl_mutex);
+		vr->vr_number = i;
+		disk->major = VROOT_MAJOR;
+		disk->first_minor = i;
+		disk->fops = &vr_fops;
+		sprintf(disk->disk_name, "vroot%d", i);
+		disk->private_data = vr;
+	}
+
+	err = register_vroot_grb(&__vroot_get_real_bdev);
+	if (err)
+		goto out_mem3;
+
+	for (i = 0; i < max_vroot; i++)
+		add_disk(disks[i]);
+	printk(KERN_INFO "vroot: loaded (max %d devices)\n", max_vroot);
+	return 0;
+
+out_mem3:
+	while (i--)
+		put_disk(disks[i]);
+	kfree(disks);
+out_mem2:
+	kfree(vroot_dev);
+out_mem1:
+	unregister_blkdev(VROOT_MAJOR, "vroot");
+	printk(KERN_ERR "vroot: ran out of memory\n");
+	return err;
+}
+
+void vroot_exit(void)
+{
+	int i;
+
+	if (unregister_vroot_grb(&__vroot_get_real_bdev))
+		printk(KERN_WARNING "vroot: cannot unregister grb\n");
+
+	for (i = 0; i < max_vroot; i++) {
+		del_gendisk(disks[i]);
+		put_disk(disks[i]);
+	}
+	unregister_blkdev(VROOT_MAJOR, "vroot");
+
+	kfree(disks);
+	kfree(vroot_dev);
+}
+
+module_init(vroot_init);
+module_exit(vroot_exit);
+
+#ifndef MODULE
+
+static int __init max_vroot_setup(char *str)
+{
+	max_vroot = simple_strtol(str, NULL, 0);
+	return 1;
+}
+
+__setup("max_vroot=", max_vroot_setup);
+
+#endif
+
diff -uriN linux-2.6.32.43/drivers/char/agp/frontend.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/agp/frontend.c
--- linux-2.6.32.43/drivers/char/agp/frontend.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/agp/frontend.c	2011-07-15 05:51:11.000000000 -0500
@@ -824,7 +824,7 @@
 	if (copy_from_user(&reserve, arg, sizeof(struct agp_region)))
 		return -EFAULT;
 
-	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment))
+	if ((unsigned) reserve.seg_count >= ~0U/sizeof(struct agp_segment_priv))
 		return -EFAULT;
 
 	client = agp_find_client_by_pid(reserve.pid);
diff -uriN linux-2.6.32.43/drivers/char/briq_panel.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/briq_panel.c
--- linux-2.6.32.43/drivers/char/briq_panel.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/briq_panel.c	2011-07-15 05:51:11.000000000 -0500
@@ -10,6 +10,7 @@
 #include <linux/types.h>
 #include <linux/errno.h>
 #include <linux/tty.h>
+#include <linux/mutex.h>
 #include <linux/timer.h>
 #include <linux/kernel.h>
 #include <linux/wait.h>
@@ -36,6 +37,7 @@
 static unsigned char	vfd[40];
 static int		vfd_cursor;
 static unsigned char	ledpb, led;
+static DEFINE_MUTEX(vfd_mutex);
 
 static void update_vfd(void)
 {
@@ -142,12 +144,15 @@
 	if (!vfd_is_open)
 		return -EBUSY;
 
+	mutex_lock(&vfd_mutex);
 	for (;;) {
 		char c;
 		if (!indx)
 			break;
-		if (get_user(c, buf))
+		if (get_user(c, buf)) {
+			mutex_unlock(&vfd_mutex);
 			return -EFAULT;
+		}
 		if (esc) {
 			set_led(c);
 			esc = 0;
@@ -177,6 +182,7 @@
 		buf++;
 	}
 	update_vfd();
+	mutex_unlock(&vfd_mutex);
 
 	return len;
 }
diff -uriN linux-2.6.32.43/drivers/char/genrtc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/genrtc.c
--- linux-2.6.32.43/drivers/char/genrtc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/genrtc.c	2011-07-15 05:51:11.000000000 -0500
@@ -272,6 +272,7 @@
 	switch (cmd) {
 
 	case RTC_PLL_GET:
+	    memset(&pll, 0, sizeof(pll));
 	    if (get_rtc_pll(&pll))
 	 	    return -EINVAL;
 	    else
diff -uriN linux-2.6.32.43/drivers/char/hpet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hpet.c
--- linux-2.6.32.43/drivers/char/hpet.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hpet.c	2011-07-15 05:51:11.000000000 -0500
@@ -430,7 +430,7 @@
 	return 0;
 }
 
-static int hpet_ioctl_common(struct hpet_dev *, int, unsigned long, int);
+static int hpet_ioctl_common(struct hpet_dev *, unsigned int, unsigned long, int);
 
 static int
 hpet_ioctl(struct inode *inode, struct file *file, unsigned int cmd,
@@ -565,7 +565,7 @@
 }
 
 static int
-hpet_ioctl_common(struct hpet_dev *devp, int cmd, unsigned long arg, int kernel)
+hpet_ioctl_common(struct hpet_dev *devp, unsigned int cmd, unsigned long arg, int kernel)
 {
 	struct hpet_timer __iomem *timer;
 	struct hpet __iomem *hpet;
@@ -608,11 +608,11 @@
 		{
 			struct hpet_info info;
 
+			memset(&info, 0, sizeof(info));
+
 			if (devp->hd_ireqfreq)
 				info.hi_ireqfreq =
 					hpet_time_div(hpetp, devp->hd_ireqfreq);
-			else
-				info.hi_ireqfreq = 0;
 			info.hi_flags =
 			    readq(&timer->hpet_config) & Tn_PER_INT_CAP_MASK;
 			info.hi_hpet = hpetp->hp_which;
diff -uriN linux-2.6.32.43/drivers/char/hvc_beat.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_beat.c
--- linux-2.6.32.43/drivers/char/hvc_beat.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_beat.c	2011-07-15 05:51:11.000000000 -0500
@@ -84,7 +84,7 @@
 	return cnt;
 }
 
-static struct hv_ops hvc_beat_get_put_ops = {
+static const struct hv_ops hvc_beat_get_put_ops = {
 	.get_chars = hvc_beat_get_chars,
 	.put_chars = hvc_beat_put_chars,
 };
diff -uriN linux-2.6.32.43/drivers/char/hvc_console.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_console.c
--- linux-2.6.32.43/drivers/char/hvc_console.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_console.c	2011-07-15 05:51:11.000000000 -0500
@@ -125,7 +125,7 @@
  * console interfaces but can still be used as a tty device.  This has to be
  * static because kmalloc will not work during early console init.
  */
-static struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
+static const struct hv_ops *cons_ops[MAX_NR_HVC_CONSOLES];
 static uint32_t vtermnos[MAX_NR_HVC_CONSOLES] =
 	{[0 ... MAX_NR_HVC_CONSOLES - 1] = -1};
 
@@ -247,7 +247,7 @@
  * vty adapters do NOT get an hvc_instantiate() callback since they
  * appear after early console init.
  */
-int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops)
+int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops)
 {
 	struct hvc_struct *hp;
 
@@ -756,7 +756,7 @@
 };
 
 struct hvc_struct __devinit *hvc_alloc(uint32_t vtermno, int data,
-					struct hv_ops *ops, int outbuf_size)
+					const struct hv_ops *ops, int outbuf_size)
 {
 	struct hvc_struct *hp;
 	int i;
diff -uriN linux-2.6.32.43/drivers/char/hvc_console.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_console.h
--- linux-2.6.32.43/drivers/char/hvc_console.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_console.h	2011-07-15 05:51:11.000000000 -0500
@@ -55,7 +55,7 @@
 	int outbuf_size;
 	int n_outbuf;
 	uint32_t vtermno;
-	struct hv_ops *ops;
+	const struct hv_ops *ops;
 	int irq_requested;
 	int data;
 	struct winsize ws;
@@ -76,11 +76,11 @@
 };
 
 /* Register a vterm and a slot index for use as a console (console_init) */
-extern int hvc_instantiate(uint32_t vtermno, int index, struct hv_ops *ops);
+extern int hvc_instantiate(uint32_t vtermno, int index, const struct hv_ops *ops);
 
 /* register a vterm for hvc tty operation (module_init or hotplug add) */
 extern struct hvc_struct * __devinit hvc_alloc(uint32_t vtermno, int data,
-				struct hv_ops *ops, int outbuf_size);
+				const struct hv_ops *ops, int outbuf_size);
 /* remove a vterm from hvc tty operation (module_exit or hotplug remove) */
 extern int hvc_remove(struct hvc_struct *hp);
 
diff -uriN linux-2.6.32.43/drivers/char/hvc_iseries.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_iseries.c
--- linux-2.6.32.43/drivers/char/hvc_iseries.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_iseries.c	2011-07-15 05:51:11.000000000 -0500
@@ -197,7 +197,7 @@
 	return sent;
 }
 
-static struct hv_ops hvc_get_put_ops = {
+static const struct hv_ops hvc_get_put_ops = {
 	.get_chars = get_chars,
 	.put_chars = put_chars,
 	.notifier_add = notifier_add_irq,
diff -uriN linux-2.6.32.43/drivers/char/hvc_iucv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_iucv.c
--- linux-2.6.32.43/drivers/char/hvc_iucv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_iucv.c	2011-07-15 05:51:11.000000000 -0500
@@ -924,7 +924,7 @@
 
 
 /* HVC operations */
-static struct hv_ops hvc_iucv_ops = {
+static const struct hv_ops hvc_iucv_ops = {
 	.get_chars = hvc_iucv_get_chars,
 	.put_chars = hvc_iucv_put_chars,
 	.notifier_add = hvc_iucv_notifier_add,
diff -uriN linux-2.6.32.43/drivers/char/hvc_rtas.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_rtas.c
--- linux-2.6.32.43/drivers/char/hvc_rtas.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_rtas.c	2011-07-15 05:51:11.000000000 -0500
@@ -71,7 +71,7 @@
 	return i;
 }
 
-static struct hv_ops hvc_rtas_get_put_ops = {
+static const struct hv_ops hvc_rtas_get_put_ops = {
 	.get_chars = hvc_rtas_read_console,
 	.put_chars = hvc_rtas_write_console,
 };
diff -uriN linux-2.6.32.43/drivers/char/hvcs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvcs.c
--- linux-2.6.32.43/drivers/char/hvcs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvcs.c	2011-07-15 05:51:11.000000000 -0500
@@ -82,6 +82,7 @@
 #include <asm/hvcserver.h>
 #include <asm/uaccess.h>
 #include <asm/vio.h>
+#include <asm/local.h>
 
 /*
  * 1.3.0 -> 1.3.1 In hvcs_open memset(..,0x00,..) instead of memset(..,0x3F,00).
@@ -269,7 +270,7 @@
 	unsigned int index;
 
 	struct tty_struct *tty;
-	int open_count;
+	local_t open_count;
 
 	/*
 	 * Used to tell the driver kernel_thread what operations need to take
@@ -419,7 +420,7 @@
 
 	spin_lock_irqsave(&hvcsd->lock, flags);
 
-	if (hvcsd->open_count > 0) {
+	if (local_read(&hvcsd->open_count) > 0) {
 		spin_unlock_irqrestore(&hvcsd->lock, flags);
 		printk(KERN_INFO "HVCS: vterm state unchanged.  "
 				"The hvcs device node is still in use.\n");
@@ -1135,7 +1136,7 @@
 		if ((retval = hvcs_partner_connect(hvcsd)))
 			goto error_release;
 
-	hvcsd->open_count = 1;
+	local_set(&hvcsd->open_count, 1);
 	hvcsd->tty = tty;
 	tty->driver_data = hvcsd;
 
@@ -1169,7 +1170,7 @@
 
 	spin_lock_irqsave(&hvcsd->lock, flags);
 	kref_get(&hvcsd->kref);
-	hvcsd->open_count++;
+	local_inc(&hvcsd->open_count);
 	hvcsd->todo_mask |= HVCS_SCHED_READ;
 	spin_unlock_irqrestore(&hvcsd->lock, flags);
 
@@ -1213,7 +1214,7 @@
 	hvcsd = tty->driver_data;
 
 	spin_lock_irqsave(&hvcsd->lock, flags);
-	if (--hvcsd->open_count == 0) {
+	if (local_dec_and_test(&hvcsd->open_count)) {
 
 		vio_disable_interrupts(hvcsd->vdev);
 
@@ -1239,10 +1240,10 @@
 		free_irq(irq, hvcsd);
 		kref_put(&hvcsd->kref, destroy_hvcs_struct);
 		return;
-	} else if (hvcsd->open_count < 0) {
+	} else if (local_read(&hvcsd->open_count) < 0) {
 		printk(KERN_ERR "HVCS: vty-server@%X open_count: %d"
 				" is missmanaged.\n",
-		hvcsd->vdev->unit_address, hvcsd->open_count);
+		hvcsd->vdev->unit_address, local_read(&hvcsd->open_count));
 	}
 
 	spin_unlock_irqrestore(&hvcsd->lock, flags);
@@ -1258,7 +1259,7 @@
 
 	spin_lock_irqsave(&hvcsd->lock, flags);
 	/* Preserve this so that we know how many kref refs to put */
-	temp_open_count = hvcsd->open_count;
+	temp_open_count = local_read(&hvcsd->open_count);
 
 	/*
 	 * Don't kref put inside the spinlock because the destruction
@@ -1273,7 +1274,7 @@
 	hvcsd->tty->driver_data = NULL;
 	hvcsd->tty = NULL;
 
-	hvcsd->open_count = 0;
+	local_set(&hvcsd->open_count, 0);
 
 	/* This will drop any buffered data on the floor which is OK in a hangup
 	 * scenario. */
@@ -1344,7 +1345,7 @@
 	 * the middle of a write operation?  This is a crummy place to do this
 	 * but we want to keep it all in the spinlock.
 	 */
-	if (hvcsd->open_count <= 0) {
+	if (local_read(&hvcsd->open_count) <= 0) {
 		spin_unlock_irqrestore(&hvcsd->lock, flags);
 		return -ENODEV;
 	}
@@ -1418,7 +1419,7 @@
 {
 	struct hvcs_struct *hvcsd = tty->driver_data;
 
-	if (!hvcsd || hvcsd->open_count <= 0)
+	if (!hvcsd || local_read(&hvcsd->open_count) <= 0)
 		return 0;
 
 	return HVCS_BUFF_LEN - hvcsd->chars_in_buffer;
diff -uriN linux-2.6.32.43/drivers/char/hvc_udbg.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_udbg.c
--- linux-2.6.32.43/drivers/char/hvc_udbg.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_udbg.c	2011-07-15 05:51:11.000000000 -0500
@@ -58,7 +58,7 @@
 	return i;
 }
 
-static struct hv_ops hvc_udbg_ops = {
+static const struct hv_ops hvc_udbg_ops = {
 	.get_chars = hvc_udbg_get,
 	.put_chars = hvc_udbg_put,
 };
diff -uriN linux-2.6.32.43/drivers/char/hvc_vio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_vio.c
--- linux-2.6.32.43/drivers/char/hvc_vio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_vio.c	2011-07-15 05:51:11.000000000 -0500
@@ -77,7 +77,7 @@
 	return got;
 }
 
-static struct hv_ops hvc_get_put_ops = {
+static const struct hv_ops hvc_get_put_ops = {
 	.get_chars = filtered_get_chars,
 	.put_chars = hvc_put_chars,
 	.notifier_add = notifier_add_irq,
diff -uriN linux-2.6.32.43/drivers/char/hvc_xen.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_xen.c
--- linux-2.6.32.43/drivers/char/hvc_xen.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/hvc_xen.c	2011-07-15 05:51:11.000000000 -0500
@@ -120,7 +120,7 @@
 	return recv;
 }
 
-static struct hv_ops hvc_ops = {
+static const struct hv_ops hvc_ops = {
 	.get_chars = read_console,
 	.put_chars = write_console,
 	.notifier_add = notifier_add_irq,
diff -uriN linux-2.6.32.43/drivers/char/ipmi/ipmi_msghandler.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/ipmi/ipmi_msghandler.c
--- linux-2.6.32.43/drivers/char/ipmi/ipmi_msghandler.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/ipmi/ipmi_msghandler.c	2011-07-15 05:51:11.000000000 -0500
@@ -414,7 +414,7 @@
 	struct proc_dir_entry *proc_dir;
 	char                  proc_dir_name[10];
 
-	atomic_t stats[IPMI_NUM_STATS];
+	atomic_unchecked_t stats[IPMI_NUM_STATS];
 
 	/*
 	 * run_to_completion duplicate of smb_info, smi_info
@@ -447,9 +447,9 @@
 
 
 #define ipmi_inc_stat(intf, stat) \
-	atomic_inc(&(intf)->stats[IPMI_STAT_ ## stat])
+	atomic_inc_unchecked(&(intf)->stats[IPMI_STAT_ ## stat])
 #define ipmi_get_stat(intf, stat) \
-	((unsigned int) atomic_read(&(intf)->stats[IPMI_STAT_ ## stat]))
+	((unsigned int) atomic_read_unchecked(&(intf)->stats[IPMI_STAT_ ## stat]))
 
 static int is_lan_addr(struct ipmi_addr *addr)
 {
@@ -2808,7 +2808,7 @@
 	INIT_LIST_HEAD(&intf->cmd_rcvrs);
 	init_waitqueue_head(&intf->waitq);
 	for (i = 0; i < IPMI_NUM_STATS; i++)
-		atomic_set(&intf->stats[i], 0);
+		atomic_set_unchecked(&intf->stats[i], 0);
 
 	intf->proc_dir = NULL;
 
@@ -4160,6 +4160,8 @@
 	struct ipmi_smi_msg               smi_msg;
 	struct ipmi_recv_msg              recv_msg;
 
+	pax_track_stack();
+
 	si = (struct ipmi_system_interface_addr *) &addr;
 	si->addr_type = IPMI_SYSTEM_INTERFACE_ADDR_TYPE;
 	si->channel = IPMI_BMC_CHANNEL;
diff -uriN linux-2.6.32.43/drivers/char/ipmi/ipmi_si_intf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/ipmi/ipmi_si_intf.c
--- linux-2.6.32.43/drivers/char/ipmi/ipmi_si_intf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/ipmi/ipmi_si_intf.c	2011-07-15 05:51:11.000000000 -0500
@@ -277,7 +277,7 @@
 	unsigned char slave_addr;
 
 	/* Counters and things for the proc filesystem. */
-	atomic_t stats[SI_NUM_STATS];
+	atomic_unchecked_t stats[SI_NUM_STATS];
 
 	struct task_struct *thread;
 
@@ -285,9 +285,9 @@
 };
 
 #define smi_inc_stat(smi, stat) \
-	atomic_inc(&(smi)->stats[SI_STAT_ ## stat])
+	atomic_inc_unchecked(&(smi)->stats[SI_STAT_ ## stat])
 #define smi_get_stat(smi, stat) \
-	((unsigned int) atomic_read(&(smi)->stats[SI_STAT_ ## stat]))
+	((unsigned int) atomic_read_unchecked(&(smi)->stats[SI_STAT_ ## stat]))
 
 #define SI_MAX_PARMS 4
 
@@ -2931,7 +2931,7 @@
 	atomic_set(&new_smi->req_events, 0);
 	new_smi->run_to_completion = 0;
 	for (i = 0; i < SI_NUM_STATS; i++)
-		atomic_set(&new_smi->stats[i], 0);
+		atomic_set_unchecked(&new_smi->stats[i], 0);
 
 	new_smi->interrupt_disabled = 0;
 	atomic_set(&new_smi->stop_operation, 0);
diff -uriN linux-2.6.32.43/drivers/char/istallion.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/istallion.c
--- linux-2.6.32.43/drivers/char/istallion.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/istallion.c	2011-07-15 05:51:11.000000000 -0500
@@ -187,7 +187,6 @@
  *	re-used for each stats call.
  */
 static comstats_t	stli_comstats;
-static combrd_t		stli_brdstats;
 static struct asystats	stli_cdkstats;
 
 /*****************************************************************************/
@@ -4058,6 +4057,7 @@
 {
 	struct stlibrd *brdp;
 	unsigned int i;
+	combrd_t stli_brdstats;
 
 	if (copy_from_user(&stli_brdstats, bp, sizeof(combrd_t)))
 		return -EFAULT;
@@ -4269,6 +4269,8 @@
 	struct stliport stli_dummyport;
 	struct stliport *portp;
 
+	pax_track_stack();
+
 	if (copy_from_user(&stli_dummyport, arg, sizeof(struct stliport)))
 		return -EFAULT;
 	portp = stli_getport(stli_dummyport.brdnr, stli_dummyport.panelnr,
@@ -4291,6 +4293,8 @@
 	struct stlibrd stli_dummybrd;
 	struct stlibrd *brdp;
 
+	pax_track_stack();
+
 	if (copy_from_user(&stli_dummybrd, arg, sizeof(struct stlibrd)))
 		return -EFAULT;
 	if (stli_dummybrd.brdnr >= STL_MAXBRDS)
diff -uriN linux-2.6.32.43/drivers/char/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/Kconfig
--- linux-2.6.32.43/drivers/char/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/Kconfig	2011-07-15 05:51:11.000000000 -0500
@@ -90,7 +90,8 @@
 
 config DEVKMEM
 	bool "/dev/kmem virtual device support"
-	default y
+	default n
+	depends on !GRKERNSEC_KMEM
 	help
 	  Say Y here if you want to support the /dev/kmem device. The
 	  /dev/kmem device is rarely used, but can be used for certain
@@ -1114,6 +1115,7 @@
 	bool
 	depends on !M68K
 	depends on ISA || PCI
+	depends on !GRKERNSEC_KMEM
 	default y
 
 source "drivers/s390/char/Kconfig"
diff -uriN linux-2.6.32.43/drivers/char/keyboard.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/keyboard.c
--- linux-2.6.32.43/drivers/char/keyboard.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/keyboard.c	2011-07-15 05:51:11.000000000 -0500
@@ -635,6 +635,16 @@
 	     kbd->kbdmode == VC_MEDIUMRAW) &&
 	     value != KVAL(K_SAK))
 		return;		/* SAK is allowed even in raw mode */
+
+#if defined(CONFIG_GRKERNSEC_PROC) || defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
+	{
+		void *func = fn_handler[value];
+		if (func == fn_show_state || func == fn_show_ptregs ||
+		    func == fn_show_mem)
+			return;
+	}
+#endif
+
 	fn_handler[value](vc);
 }
 
@@ -1386,7 +1396,7 @@
                 .evbit = { BIT_MASK(EV_SND) },
         },
 
-	{ },    /* Terminating entry */
+	{ 0 },    /* Terminating entry */
 };
 
 MODULE_DEVICE_TABLE(input, kbd_ids);
diff -uriN linux-2.6.32.43/drivers/char/mem.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/mem.c
--- linux-2.6.32.43/drivers/char/mem.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/mem.c	2011-07-15 05:51:11.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/raw.h>
 #include <linux/tty.h>
 #include <linux/capability.h>
+#include <linux/security.h>
 #include <linux/ptrace.h>
 #include <linux/device.h>
 #include <linux/highmem.h>
@@ -35,6 +36,10 @@
 # include <linux/efi.h>
 #endif
 
+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
+extern struct file_operations grsec_fops;
+#endif
+
 static inline unsigned long size_inside_page(unsigned long start,
 					     unsigned long size)
 {
@@ -102,9 +107,13 @@
 
 	while (cursor < to) {
 		if (!devmem_is_allowed(pfn)) {
+#ifdef CONFIG_GRKERNSEC_KMEM
+			gr_handle_mem_readwrite(from, to);
+#else
 			printk(KERN_INFO
 		"Program %s tried to access /dev/mem between %Lx->%Lx.\n",
 				current->comm, from, to);
+#endif
 			return 0;
 		}
 		cursor += PAGE_SIZE;
@@ -112,6 +121,11 @@
 	}
 	return 1;
 }
+#elif defined(CONFIG_GRKERNSEC_KMEM)
+static inline int range_is_allowed(unsigned long pfn, unsigned long size)
+{
+	return 0;
+}
 #else
 static inline int range_is_allowed(unsigned long pfn, unsigned long size)
 {
@@ -155,6 +169,8 @@
 #endif
 
 	while (count > 0) {
+		char *temp;
+
 		/*
 		 * Handle first page in case it's not aligned
 		 */
@@ -177,11 +193,31 @@
 		if (!ptr)
 			return -EFAULT;
 
-		if (copy_to_user(buf, ptr, sz)) {
+#ifdef CONFIG_PAX_USERCOPY
+		temp = kmalloc(sz, GFP_KERNEL);
+		if (!temp) {
+			unxlate_dev_mem_ptr(p, ptr);
+			return -ENOMEM;
+		}
+		memcpy(temp, ptr, sz);
+#else
+		temp = ptr;
+#endif
+
+		if (copy_to_user(buf, temp, sz)) {
+
+#ifdef CONFIG_PAX_USERCOPY
+			kfree(temp);
+#endif
+
 			unxlate_dev_mem_ptr(p, ptr);
 			return -EFAULT;
 		}
 
+#ifdef CONFIG_PAX_USERCOPY
+		kfree(temp);
+#endif
+
 		unxlate_dev_mem_ptr(p, ptr);
 
 		buf += sz;
@@ -419,9 +455,8 @@
 			 size_t count, loff_t *ppos)
 {
 	unsigned long p = *ppos;
-	ssize_t low_count, read, sz;
+	ssize_t low_count, read, sz, err = 0;
 	char * kbuf; /* k-addr because vread() takes vmlist_lock rwlock */
-	int err = 0;
 
 	read = 0;
 	if (p < (unsigned long) high_memory) {
@@ -444,6 +479,8 @@
 		}
 #endif
 		while (low_count > 0) {
+			char *temp;
+
 			sz = size_inside_page(p, low_count);
 
 			/*
@@ -453,7 +490,22 @@
 			 */
 			kbuf = xlate_dev_kmem_ptr((char *)p);
 
-			if (copy_to_user(buf, kbuf, sz))
+#ifdef CONFIG_PAX_USERCOPY
+			temp = kmalloc(sz, GFP_KERNEL);
+			if (!temp)
+				return -ENOMEM;
+			memcpy(temp, kbuf, sz);
+#else
+			temp = kbuf;
+#endif
+
+			err = copy_to_user(buf, temp, sz);
+
+#ifdef CONFIG_PAX_USERCOPY
+			kfree(temp);
+#endif
+
+			if (err)
 				return -EFAULT;
 			buf += sz;
 			p += sz;
@@ -889,6 +941,9 @@
 #ifdef CONFIG_CRASH_DUMP
 	[12] = { "oldmem", 0, &oldmem_fops, NULL },
 #endif
+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
+	[13] = { "grsec",S_IRUSR | S_IWUGO, &grsec_fops, NULL },
+#endif
 };
 
 static int memory_open(struct inode *inode, struct file *filp)
diff -uriN linux-2.6.32.43/drivers/char/pcmcia/ipwireless/tty.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/pcmcia/ipwireless/tty.c
--- linux-2.6.32.43/drivers/char/pcmcia/ipwireless/tty.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/pcmcia/ipwireless/tty.c	2011-07-15 05:51:11.000000000 -0500
@@ -29,6 +29,7 @@
 #include <linux/tty_driver.h>
 #include <linux/tty_flip.h>
 #include <linux/uaccess.h>
+#include <asm/local.h>
 
 #include "tty.h"
 #include "network.h"
@@ -51,7 +52,7 @@
 	int tty_type;
 	struct ipw_network *network;
 	struct tty_struct *linux_tty;
-	int open_count;
+	local_t open_count;
 	unsigned int control_lines;
 	struct mutex ipw_tty_mutex;
 	int tx_bytes_queued;
@@ -127,10 +128,10 @@
 		mutex_unlock(&tty->ipw_tty_mutex);
 		return -ENODEV;
 	}
-	if (tty->open_count == 0)
+	if (local_read(&tty->open_count) == 0)
 		tty->tx_bytes_queued = 0;
 
-	tty->open_count++;
+	local_inc(&tty->open_count);
 
 	tty->linux_tty = linux_tty;
 	linux_tty->driver_data = tty;
@@ -146,9 +147,7 @@
 
 static void do_ipw_close(struct ipw_tty *tty)
 {
-	tty->open_count--;
-
-	if (tty->open_count == 0) {
+	if (local_dec_return(&tty->open_count) == 0) {
 		struct tty_struct *linux_tty = tty->linux_tty;
 
 		if (linux_tty != NULL) {
@@ -169,7 +168,7 @@
 		return;
 
 	mutex_lock(&tty->ipw_tty_mutex);
-	if (tty->open_count == 0) {
+	if (local_read(&tty->open_count) == 0) {
 		mutex_unlock(&tty->ipw_tty_mutex);
 		return;
 	}
@@ -198,7 +197,7 @@
 		return;
 	}
 
-	if (!tty->open_count) {
+	if (!local_read(&tty->open_count)) {
 		mutex_unlock(&tty->ipw_tty_mutex);
 		return;
 	}
@@ -240,7 +239,7 @@
 		return -ENODEV;
 
 	mutex_lock(&tty->ipw_tty_mutex);
-	if (!tty->open_count) {
+	if (!local_read(&tty->open_count)) {
 		mutex_unlock(&tty->ipw_tty_mutex);
 		return -EINVAL;
 	}
@@ -280,7 +279,7 @@
 	if (!tty)
 		return -ENODEV;
 
-	if (!tty->open_count)
+	if (!local_read(&tty->open_count))
 		return -EINVAL;
 
 	room = IPWIRELESS_TX_QUEUE_SIZE - tty->tx_bytes_queued;
@@ -322,7 +321,7 @@
 	if (!tty)
 		return 0;
 
-	if (!tty->open_count)
+	if (!local_read(&tty->open_count))
 		return 0;
 
 	return tty->tx_bytes_queued;
@@ -403,7 +402,7 @@
 	if (!tty)
 		return -ENODEV;
 
-	if (!tty->open_count)
+	if (!local_read(&tty->open_count))
 		return -EINVAL;
 
 	return get_control_lines(tty);
@@ -419,7 +418,7 @@
 	if (!tty)
 		return -ENODEV;
 
-	if (!tty->open_count)
+	if (!local_read(&tty->open_count))
 		return -EINVAL;
 
 	return set_control_lines(tty, set, clear);
@@ -433,7 +432,7 @@
 	if (!tty)
 		return -ENODEV;
 
-	if (!tty->open_count)
+	if (!local_read(&tty->open_count))
 		return -EINVAL;
 
 	/* FIXME: Exactly how is the tty object locked here .. */
@@ -591,7 +590,7 @@
 				   against a parallel ioctl etc */
 				mutex_lock(&ttyj->ipw_tty_mutex);
 			}
-			while (ttyj->open_count)
+			while (local_read(&ttyj->open_count))
 				do_ipw_close(ttyj);
 			ipwireless_disassociate_network_ttys(network,
 							     ttyj->channel_idx);
diff -uriN linux-2.6.32.43/drivers/char/pty.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/pty.c
--- linux-2.6.32.43/drivers/char/pty.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/pty.c	2011-07-15 05:51:11.000000000 -0500
@@ -682,7 +682,18 @@
 	return ret;
 }
 
-static struct file_operations ptmx_fops;
+static const struct file_operations ptmx_fops = {
+	.llseek		= no_llseek,
+	.read		= tty_read,
+	.write		= tty_write,
+	.poll		= tty_poll,
+	.unlocked_ioctl	= tty_ioctl,
+	.compat_ioctl	= tty_compat_ioctl,
+	.open		= ptmx_open,
+	.release	= tty_release,
+	.fasync		= tty_fasync,
+};
+
 
 static void __init unix98_pty_init(void)
 {
@@ -736,9 +747,6 @@
 	register_sysctl_table(pty_root_table);
 
 	/* Now create the /dev/ptmx special device */
-	tty_default_fops(&ptmx_fops);
-	ptmx_fops.open = ptmx_open;
-
 	cdev_init(&ptmx_cdev, &ptmx_fops);
 	if (cdev_add(&ptmx_cdev, MKDEV(TTYAUX_MAJOR, 2), 1) ||
 	    register_chrdev_region(MKDEV(TTYAUX_MAJOR, 2), 1, "/dev/ptmx") < 0)
diff -uriN linux-2.6.32.43/drivers/char/random.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/random.c
--- linux-2.6.32.43/drivers/char/random.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/random.c	2011-07-15 05:51:11.000000000 -0500
@@ -254,8 +254,13 @@
 /*
  * Configuration information
  */
+#ifdef CONFIG_GRKERNSEC_RANDNET
+#define INPUT_POOL_WORDS 512
+#define OUTPUT_POOL_WORDS 128
+#else
 #define INPUT_POOL_WORDS 128
 #define OUTPUT_POOL_WORDS 32
+#endif
 #define SEC_XFER_SIZE 512
 
 /*
@@ -292,10 +297,17 @@
 	int poolwords;
 	int tap1, tap2, tap3, tap4, tap5;
 } poolinfo_table[] = {
+#ifdef CONFIG_GRKERNSEC_RANDNET
+	/* x^512 + x^411 + x^308 + x^208 +x^104 + x + 1 -- 225 */
+	{ 512,	411,	308,	208,	104,	1 },
+	/* x^128 + x^103 + x^76 + x^51 + x^25 + x + 1 -- 105 */
+	{ 128,	103,	76,	51,	25,	1 },
+#else
 	/* x^128 + x^103 + x^76 + x^51 +x^25 + x + 1 -- 105 */
 	{ 128,	103,	76,	51,	25,	1 },
 	/* x^32 + x^26 + x^20 + x^14 + x^7 + x + 1 -- 15 */
 	{ 32,	26,	20,	14,	7,	1 },
+#endif
 #if 0
 	/* x^2048 + x^1638 + x^1231 + x^819 + x^411 + x + 1  -- 115 */
 	{ 2048,	1638,	1231,	819,	411,	1 },
@@ -1209,7 +1221,7 @@
 #include <linux/sysctl.h>
 
 static int min_read_thresh = 8, min_write_thresh;
-static int max_read_thresh = INPUT_POOL_WORDS * 32;
+static int max_read_thresh = OUTPUT_POOL_WORDS * 32;
 static int max_write_thresh = INPUT_POOL_WORDS * 32;
 static char sysctl_bootid[16];
 
diff -uriN linux-2.6.32.43/drivers/char/rocket.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/rocket.c
--- linux-2.6.32.43/drivers/char/rocket.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/rocket.c	2011-07-15 05:51:11.000000000 -0500
@@ -1266,6 +1266,8 @@
 	struct rocket_ports tmp;
 	int board;
 
+	pax_track_stack();
+
 	if (!retports)
 		return -EFAULT;
 	memset(&tmp, 0, sizeof (tmp));
diff -uriN linux-2.6.32.43/drivers/char/sonypi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/sonypi.c
--- linux-2.6.32.43/drivers/char/sonypi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/sonypi.c	2011-07-15 05:51:11.000000000 -0500
@@ -55,6 +55,7 @@
 #include <asm/uaccess.h>
 #include <asm/io.h>
 #include <asm/system.h>
+#include <asm/local.h>
 
 #include <linux/sonypi.h>
 
@@ -491,7 +492,7 @@
 	spinlock_t fifo_lock;
 	wait_queue_head_t fifo_proc_list;
 	struct fasync_struct *fifo_async;
-	int open_count;
+	local_t open_count;
 	int model;
 	struct input_dev *input_jog_dev;
 	struct input_dev *input_key_dev;
@@ -895,7 +896,7 @@
 static int sonypi_misc_release(struct inode *inode, struct file *file)
 {
 	mutex_lock(&sonypi_device.lock);
-	sonypi_device.open_count--;
+	local_dec(&sonypi_device.open_count);
 	mutex_unlock(&sonypi_device.lock);
 	return 0;
 }
@@ -905,9 +906,9 @@
 	lock_kernel();
 	mutex_lock(&sonypi_device.lock);
 	/* Flush input queue on first open */
-	if (!sonypi_device.open_count)
+	if (!local_read(&sonypi_device.open_count))
 		kfifo_reset(sonypi_device.fifo);
-	sonypi_device.open_count++;
+	local_inc(&sonypi_device.open_count);
 	mutex_unlock(&sonypi_device.lock);
 	unlock_kernel();
 	return 0;
diff -uriN linux-2.6.32.43/drivers/char/stallion.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/stallion.c
--- linux-2.6.32.43/drivers/char/stallion.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/stallion.c	2011-07-15 05:51:11.000000000 -0500
@@ -2448,6 +2448,8 @@
 	struct stlport	stl_dummyport;
 	struct stlport	*portp;
 
+	pax_track_stack();
+
 	if (copy_from_user(&stl_dummyport, arg, sizeof(struct stlport)))
 		return -EFAULT;
 	portp = stl_getport(stl_dummyport.brdnr, stl_dummyport.panelnr,
diff -uriN linux-2.6.32.43/drivers/char/sysrq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/sysrq.c
--- linux-2.6.32.43/drivers/char/sysrq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/sysrq.c	2011-07-15 05:50:11.000000000 -0500
@@ -38,6 +38,7 @@
 #include <linux/workqueue.h>
 #include <linux/hrtimer.h>
 #include <linux/oom.h>
+#include <linux/vserver/debug.h>
 
 #include <asm/ptrace.h>
 #include <asm/irq_regs.h>
@@ -391,6 +392,21 @@
 	.enable_mask	= SYSRQ_ENABLE_RTNICE,
 };
 
+
+#ifdef CONFIG_VSERVER_DEBUG
+static void sysrq_handle_vxinfo(int key, struct tty_struct *tty)
+{
+	dump_vx_info_inactive((key == 'x')?0:1);
+}
+
+static struct sysrq_key_op sysrq_showvxinfo_op = {
+	.handler	= sysrq_handle_vxinfo,
+	.help_msg	= "conteXt",
+	.action_msg	= "Show Context Info",
+	.enable_mask	= SYSRQ_ENABLE_DUMP,
+};
+#endif
+
 /* Key Operations table and lock */
 static DEFINE_SPINLOCK(sysrq_key_table_lock);
 
@@ -445,7 +461,11 @@
 	NULL,				/* v */
 	&sysrq_showstate_blocked_op,	/* w */
 	/* x: May be registered on ppc/powerpc for xmon */
+#ifdef CONFIG_VSERVER_DEBUG
+	&sysrq_showvxinfo_op,		/* x */
+#else
 	NULL,				/* x */
+#endif
 	/* y: May be registered on sparc64 for global register dump */
 	NULL,				/* y */
 	&sysrq_ftrace_dump_op,		/* z */
@@ -460,6 +480,8 @@
 		retval = key - '0';
 	else if ((key >= 'a') && (key <= 'z'))
 		retval = key + 10 - 'a';
+	else if ((key >= 'A') && (key <= 'Z'))
+		retval = key + 10 - 'A';
 	else
 		retval = -1;
 	return retval;
diff -uriN linux-2.6.32.43/drivers/char/tpm/tpm_bios.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/tpm/tpm_bios.c
--- linux-2.6.32.43/drivers/char/tpm/tpm_bios.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/tpm/tpm_bios.c	2011-07-15 05:51:11.000000000 -0500
@@ -172,7 +172,7 @@
 	event = addr;
 
 	if ((event->event_type == 0 && event->event_size == 0) ||
-	    ((addr + sizeof(struct tcpa_event) + event->event_size) >= limit))
+	    (event->event_size >= limit - addr - sizeof(struct tcpa_event)))
 		return NULL;
 
 	return addr;
@@ -197,7 +197,7 @@
 		return NULL;
 
 	if ((event->event_type == 0 && event->event_size == 0) ||
-	    ((v + sizeof(struct tcpa_event) + event->event_size) >= limit))
+	    (event->event_size >= limit - v - sizeof(struct tcpa_event)))
 		return NULL;
 
 	(*pos)++;
@@ -290,7 +290,8 @@
 	int i;
 
 	for (i = 0; i < sizeof(struct tcpa_event) + event->event_size; i++)
-		seq_putc(m, data[i]);
+		if (!seq_putc(m, data[i]))
+			return -EFAULT;
 
 	return 0;
 }
@@ -409,6 +410,11 @@
 	log->bios_event_log_end = log->bios_event_log + len;
 
 	virt = acpi_os_map_memory(start, len);
+	if (!virt) {
+		kfree(log->bios_event_log);
+		log->bios_event_log = NULL;
+		return -EFAULT;
+	}
 
 	memcpy(log->bios_event_log, virt, len);
 
diff -uriN linux-2.6.32.43/drivers/char/tpm/tpm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/tpm/tpm.c
--- linux-2.6.32.43/drivers/char/tpm/tpm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/tpm/tpm.c	2011-07-15 05:51:11.000000000 -0500
@@ -402,7 +402,7 @@
 		    chip->vendor.req_complete_val)
 			goto out_recv;
 
-		if ((status == chip->vendor.req_canceled)) {
+		if (status == chip->vendor.req_canceled) {
 			dev_err(chip->dev, "Operation Canceled\n");
 			rc = -ECANCELED;
 			goto out;
@@ -821,6 +821,8 @@
 
 	struct tpm_chip *chip = dev_get_drvdata(dev);
 
+	pax_track_stack();
+
 	tpm_cmd.header.in = tpm_readpubek_header;
 	err = transmit_cmd(chip, &tpm_cmd, READ_PUBEK_RESULT_SIZE,
 			"attempting to read the PUBEK");
diff -uriN linux-2.6.32.43/drivers/char/tty_io.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/tty_io.c
--- linux-2.6.32.43/drivers/char/tty_io.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/tty_io.c	2011-07-15 05:51:11.000000000 -0500
@@ -106,6 +106,7 @@
 
 #include <linux/kmod.h>
 #include <linux/nsproxy.h>
+#include <linux/vs_pid.h>
 
 #undef TTY_DEBUG_HANGUP
 
@@ -136,21 +137,10 @@
 DEFINE_MUTEX(tty_mutex);
 EXPORT_SYMBOL(tty_mutex);
 
-static ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
-static ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
 ssize_t redirected_tty_write(struct file *, const char __user *,
 							size_t, loff_t *);
-static unsigned int tty_poll(struct file *, poll_table *);
 static int tty_open(struct inode *, struct file *);
-static int tty_release(struct inode *, struct file *);
 long tty_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
-#ifdef CONFIG_COMPAT
-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
-				unsigned long arg);
-#else
-#define tty_compat_ioctl NULL
-#endif
-static int tty_fasync(int fd, struct file *filp, int on);
 static void release_tty(struct tty_struct *tty, int idx);
 static void __proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
 static void proc_set_tty(struct task_struct *tsk, struct tty_struct *tty);
@@ -870,7 +860,7 @@
  *	read calls may be outstanding in parallel.
  */
 
-static ssize_t tty_read(struct file *file, char __user *buf, size_t count,
+ssize_t tty_read(struct file *file, char __user *buf, size_t count,
 			loff_t *ppos)
 {
 	int i;
@@ -898,6 +888,8 @@
 	return i;
 }
 
+EXPORT_SYMBOL(tty_read);
+
 void tty_write_unlock(struct tty_struct *tty)
 {
 	mutex_unlock(&tty->atomic_write_lock);
@@ -1045,7 +1037,7 @@
  *	write method will not be invoked in parallel for each device.
  */
 
-static ssize_t tty_write(struct file *file, const char __user *buf,
+ssize_t tty_write(struct file *file, const char __user *buf,
 						size_t count, loff_t *ppos)
 {
 	struct tty_struct *tty;
@@ -1072,6 +1064,8 @@
 	return ret;
 }
 
+EXPORT_SYMBOL(tty_write);
+
 ssize_t redirected_tty_write(struct file *file, const char __user *buf,
 						size_t count, loff_t *ppos)
 {
@@ -1867,7 +1861,7 @@
  *		Takes bkl. See tty_release_dev
  */
 
-static int tty_release(struct inode *inode, struct file *filp)
+int tty_release(struct inode *inode, struct file *filp)
 {
 	lock_kernel();
 	tty_release_dev(filp);
@@ -1875,6 +1869,8 @@
 	return 0;
 }
 
+EXPORT_SYMBOL(tty_release);
+
 /**
  *	tty_poll	-	check tty status
  *	@filp: file being polled
@@ -1887,7 +1883,7 @@
  *	may be re-entered freely by other callers.
  */
 
-static unsigned int tty_poll(struct file *filp, poll_table *wait)
+unsigned int tty_poll(struct file *filp, poll_table *wait)
 {
 	struct tty_struct *tty;
 	struct tty_ldisc *ld;
@@ -1904,7 +1900,9 @@
 	return ret;
 }
 
-static int tty_fasync(int fd, struct file *filp, int on)
+EXPORT_SYMBOL(tty_poll);
+
+int tty_fasync(int fd, struct file *filp, int on)
 {
 	struct tty_struct *tty;
 	unsigned long flags;
@@ -1948,6 +1946,8 @@
 	return retval;
 }
 
+EXPORT_SYMBOL(tty_fasync);
+
 /**
  *	tiocsti			-	fake input character
  *	@tty: tty to fake input into
@@ -1970,7 +1970,8 @@
 	char ch, mbz = 0;
 	struct tty_ldisc *ld;
 
-	if ((current->signal->tty != tty) && !capable(CAP_SYS_ADMIN))
+	if (((current->signal->tty != tty) &&
+		!vx_capable(CAP_SYS_ADMIN, VXC_TIOCSTI)))
 		return -EPERM;
 	if (get_user(ch, p))
 		return -EFAULT;
@@ -2258,6 +2259,7 @@
 		return -ENOTTY;
 	if (get_user(pgrp_nr, p))
 		return -EFAULT;
+	pgrp_nr = vx_rmap_pid(pgrp_nr);
 	if (pgrp_nr < 0)
 		return -EINVAL;
 	rcu_read_lock();
@@ -2582,8 +2584,10 @@
 	return retval;
 }
 
+EXPORT_SYMBOL(tty_ioctl);
+
 #ifdef CONFIG_COMPAT
-static long tty_compat_ioctl(struct file *file, unsigned int cmd,
+long tty_compat_ioctl(struct file *file, unsigned int cmd,
 				unsigned long arg)
 {
 	struct inode *inode = file->f_dentry->d_inode;
@@ -2607,6 +2611,8 @@
 
 	return retval;
 }
+
+EXPORT_SYMBOL(tty_compat_ioctl);
 #endif
 
 /*
@@ -3050,11 +3056,6 @@
 }
 EXPORT_SYMBOL_GPL(get_current_tty);
 
-void tty_default_fops(struct file_operations *fops)
-{
-	*fops = tty_fops;
-}
-
 /*
  * Initialize the console device. This is called *early*, so
  * we can't necessarily depend on lots of kernel help here.
diff -uriN linux-2.6.32.43/drivers/char/tty_ldisc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/tty_ldisc.c
--- linux-2.6.32.43/drivers/char/tty_ldisc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/tty_ldisc.c	2011-07-15 05:51:11.000000000 -0500
@@ -74,7 +74,7 @@
 	if (atomic_dec_and_lock(&ld->users, &tty_ldisc_lock)) {
 		struct tty_ldisc_ops *ldo = ld->ops;
 
-		ldo->refcount--;
+		atomic_dec(&ldo->refcount);
 		module_put(ldo->owner);
 		spin_unlock_irqrestore(&tty_ldisc_lock, flags);
 
@@ -109,7 +109,7 @@
 	spin_lock_irqsave(&tty_ldisc_lock, flags);
 	tty_ldiscs[disc] = new_ldisc;
 	new_ldisc->num = disc;
-	new_ldisc->refcount = 0;
+	atomic_set(&new_ldisc->refcount, 0);
 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
 
 	return ret;
@@ -137,7 +137,7 @@
 		return -EINVAL;
 
 	spin_lock_irqsave(&tty_ldisc_lock, flags);
-	if (tty_ldiscs[disc]->refcount)
+	if (atomic_read(&tty_ldiscs[disc]->refcount))
 		ret = -EBUSY;
 	else
 		tty_ldiscs[disc] = NULL;
@@ -158,7 +158,7 @@
 	if (ldops) {
 		ret = ERR_PTR(-EAGAIN);
 		if (try_module_get(ldops->owner)) {
-			ldops->refcount++;
+			atomic_inc(&ldops->refcount);
 			ret = ldops;
 		}
 	}
@@ -171,7 +171,7 @@
 	unsigned long flags;
 
 	spin_lock_irqsave(&tty_ldisc_lock, flags);
-	ldops->refcount--;
+	atomic_dec(&ldops->refcount);
 	module_put(ldops->owner);
 	spin_unlock_irqrestore(&tty_ldisc_lock, flags);
 }
diff -uriN linux-2.6.32.43/drivers/char/virtio_console.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/virtio_console.c
--- linux-2.6.32.43/drivers/char/virtio_console.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/virtio_console.c	2011-07-15 05:51:11.000000000 -0500
@@ -44,6 +44,7 @@
 static char *in, *inbuf;
 
 /* The operations for our console. */
+/* cannot be const */
 static struct hv_ops virtio_cons;
 
 /* The hvc device */
diff -uriN linux-2.6.32.43/drivers/char/vt.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/vt.c
--- linux-2.6.32.43/drivers/char/vt.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/vt.c	2011-07-15 05:51:11.000000000 -0500
@@ -243,7 +243,7 @@
 
 static void notify_write(struct vc_data *vc, unsigned int unicode)
 {
-	struct vt_notifier_param param = { .vc = vc, unicode = unicode };
+	struct vt_notifier_param param = { .vc = vc, .c = unicode };
 	atomic_notifier_call_chain(&vt_notifier_list, VT_WRITE, &param);
 }
 
diff -uriN linux-2.6.32.43/drivers/char/vt_ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/vt_ioctl.c
--- linux-2.6.32.43/drivers/char/vt_ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/char/vt_ioctl.c	2011-07-15 05:51:11.000000000 -0500
@@ -210,9 +210,6 @@
 	if (copy_from_user(&tmp, user_kbe, sizeof(struct kbentry)))
 		return -EFAULT;
 
-	if (!capable(CAP_SYS_TTY_CONFIG))
-		perm = 0;
-
 	switch (cmd) {
 	case KDGKBENT:
 		key_map = key_maps[s];
@@ -224,8 +221,12 @@
 		    val = (i ? K_HOLE : K_NOSUCHMAP);
 		return put_user(val, &user_kbe->kb_value);
 	case KDSKBENT:
+		if (!capable(CAP_SYS_TTY_CONFIG))
+			perm = 0;
+
 		if (!perm)
 			return -EPERM;
+
 		if (!i && v == K_NOSUCHMAP) {
 			/* deallocate map */
 			key_map = key_maps[s];
@@ -325,9 +326,6 @@
 	int i, j, k;
 	int ret;
 
-	if (!capable(CAP_SYS_TTY_CONFIG))
-		perm = 0;
-
 	kbs = kmalloc(sizeof(*kbs), GFP_KERNEL);
 	if (!kbs) {
 		ret = -ENOMEM;
@@ -361,6 +359,9 @@
 		kfree(kbs);
 		return ((p && *p) ? -EOVERFLOW : 0);
 	case KDSKBSENT:
+		if (!capable(CAP_SYS_TTY_CONFIG))
+			perm = 0;
+
 		if (!perm) {
 			ret = -EPERM;
 			goto reterr;
diff -uriN linux-2.6.32.43/drivers/cpufreq/cpufreq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/cpufreq/cpufreq.c
--- linux-2.6.32.43/drivers/cpufreq/cpufreq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/cpufreq/cpufreq.c	2011-07-15 05:51:11.000000000 -0500
@@ -750,7 +750,7 @@
 	complete(&policy->kobj_unregister);
 }
 
-static struct sysfs_ops sysfs_ops = {
+static const struct sysfs_ops sysfs_ops = {
 	.show	= show,
 	.store	= store,
 };
diff -uriN linux-2.6.32.43/drivers/cpuidle/sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/cpuidle/sysfs.c
--- linux-2.6.32.43/drivers/cpuidle/sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/cpuidle/sysfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -191,7 +191,7 @@
 	return ret;
 }
 
-static struct sysfs_ops cpuidle_sysfs_ops = {
+static const struct sysfs_ops cpuidle_sysfs_ops = {
 	.show = cpuidle_show,
 	.store = cpuidle_store,
 };
@@ -277,7 +277,7 @@
 	return ret;
 }
 
-static struct sysfs_ops cpuidle_state_sysfs_ops = {
+static const struct sysfs_ops cpuidle_state_sysfs_ops = {
 	.show = cpuidle_state_show,
 };
 
@@ -294,7 +294,7 @@
 	.release = cpuidle_state_sysfs_release,
 };
 
-static void inline cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
+static inline void cpuidle_free_state_kobj(struct cpuidle_device *device, int i)
 {
 	kobject_put(&device->kobjs[i]->kobj);
 	wait_for_completion(&device->kobjs[i]->kobj_unregister);
diff -uriN linux-2.6.32.43/drivers/crypto/hifn_795x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/crypto/hifn_795x.c
--- linux-2.6.32.43/drivers/crypto/hifn_795x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/crypto/hifn_795x.c	2011-07-15 05:51:11.000000000 -0500
@@ -1655,6 +1655,8 @@
 		0xCA, 0x34, 0x2B, 0x2E};
 	struct scatterlist sg;
 
+	pax_track_stack();
+
 	memset(src, 0, sizeof(src));
 	memset(ctx.key, 0, sizeof(ctx.key));
 
diff -uriN linux-2.6.32.43/drivers/crypto/padlock-aes.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/crypto/padlock-aes.c
--- linux-2.6.32.43/drivers/crypto/padlock-aes.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/crypto/padlock-aes.c	2011-07-15 05:51:11.000000000 -0500
@@ -108,6 +108,8 @@
 	struct crypto_aes_ctx gen_aes;
 	int cpu;
 
+	pax_track_stack();
+
 	if (key_len % 8) {
 		*flags |= CRYPTO_TFM_RES_BAD_KEY_LEN;
 		return -EINVAL;
diff -uriN linux-2.6.32.43/drivers/dma/ioat/dma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/dma/ioat/dma.c
--- linux-2.6.32.43/drivers/dma/ioat/dma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/dma/ioat/dma.c	2011-07-15 05:51:11.000000000 -0500
@@ -1146,7 +1146,7 @@
 	return entry->show(&chan->common, page);
 }
 
-struct sysfs_ops ioat_sysfs_ops = {
+const struct sysfs_ops ioat_sysfs_ops = {
 	.show	= ioat_attr_show,
 };
 
diff -uriN linux-2.6.32.43/drivers/dma/ioat/dma.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/dma/ioat/dma.h
--- linux-2.6.32.43/drivers/dma/ioat/dma.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/dma/ioat/dma.h	2011-07-15 05:51:11.000000000 -0500
@@ -347,7 +347,7 @@
 			   unsigned long *phys_complete);
 void ioat_kobject_add(struct ioatdma_device *device, struct kobj_type *type);
 void ioat_kobject_del(struct ioatdma_device *device);
-extern struct sysfs_ops ioat_sysfs_ops;
+extern const struct sysfs_ops ioat_sysfs_ops;
 extern struct ioat_sysfs_entry ioat_version_attr;
 extern struct ioat_sysfs_entry ioat_cap_attr;
 #endif /* IOATDMA_H */
diff -uriN linux-2.6.32.43/drivers/edac/edac_device_sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/edac/edac_device_sysfs.c
--- linux-2.6.32.43/drivers/edac/edac_device_sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/edac/edac_device_sysfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -137,7 +137,7 @@
 }
 
 /* edac_dev file operations for an 'ctl_info' */
-static struct sysfs_ops device_ctl_info_ops = {
+static const struct sysfs_ops device_ctl_info_ops = {
 	.show = edac_dev_ctl_info_show,
 	.store = edac_dev_ctl_info_store
 };
@@ -373,7 +373,7 @@
 }
 
 /* edac_dev file operations for an 'instance' */
-static struct sysfs_ops device_instance_ops = {
+static const struct sysfs_ops device_instance_ops = {
 	.show = edac_dev_instance_show,
 	.store = edac_dev_instance_store
 };
@@ -476,7 +476,7 @@
 }
 
 /* edac_dev file operations for a 'block' */
-static struct sysfs_ops device_block_ops = {
+static const struct sysfs_ops device_block_ops = {
 	.show = edac_dev_block_show,
 	.store = edac_dev_block_store
 };
diff -uriN linux-2.6.32.43/drivers/edac/edac_mc_sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/edac/edac_mc_sysfs.c
--- linux-2.6.32.43/drivers/edac/edac_mc_sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/edac/edac_mc_sysfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -245,7 +245,7 @@
 	return -EIO;
 }
 
-static struct sysfs_ops csrowfs_ops = {
+static const struct sysfs_ops csrowfs_ops = {
 	.show = csrowdev_show,
 	.store = csrowdev_store
 };
@@ -575,7 +575,7 @@
 }
 
 /* Intermediate show/store table */
-static struct sysfs_ops mci_ops = {
+static const struct sysfs_ops mci_ops = {
 	.show = mcidev_show,
 	.store = mcidev_store
 };
diff -uriN linux-2.6.32.43/drivers/edac/edac_pci_sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/edac/edac_pci_sysfs.c
--- linux-2.6.32.43/drivers/edac/edac_pci_sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/edac/edac_pci_sysfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -25,8 +25,8 @@
 static int edac_pci_log_npe = 1;	/* log PCI non-parity error errors */
 static int edac_pci_poll_msec = 1000;	/* one second workq period */
 
-static atomic_t pci_parity_count = ATOMIC_INIT(0);
-static atomic_t pci_nonparity_count = ATOMIC_INIT(0);
+static atomic_unchecked_t pci_parity_count = ATOMIC_INIT(0);
+static atomic_unchecked_t pci_nonparity_count = ATOMIC_INIT(0);
 
 static struct kobject *edac_pci_top_main_kobj;
 static atomic_t edac_pci_sysfs_refcount = ATOMIC_INIT(0);
@@ -121,7 +121,7 @@
 }
 
 /* fs_ops table */
-static struct sysfs_ops pci_instance_ops = {
+static const struct sysfs_ops pci_instance_ops = {
 	.show = edac_pci_instance_show,
 	.store = edac_pci_instance_store
 };
@@ -261,7 +261,7 @@
 	return -EIO;
 }
 
-static struct sysfs_ops edac_pci_sysfs_ops = {
+static const struct sysfs_ops edac_pci_sysfs_ops = {
 	.show = edac_pci_dev_show,
 	.store = edac_pci_dev_store
 };
@@ -579,7 +579,7 @@
 			edac_printk(KERN_CRIT, EDAC_PCI,
 				"Signaled System Error on %s\n",
 				pci_name(dev));
-			atomic_inc(&pci_nonparity_count);
+			atomic_inc_unchecked(&pci_nonparity_count);
 		}
 
 		if (status & (PCI_STATUS_PARITY)) {
@@ -587,7 +587,7 @@
 				"Master Data Parity Error on %s\n",
 				pci_name(dev));
 
-			atomic_inc(&pci_parity_count);
+			atomic_inc_unchecked(&pci_parity_count);
 		}
 
 		if (status & (PCI_STATUS_DETECTED_PARITY)) {
@@ -595,7 +595,7 @@
 				"Detected Parity Error on %s\n",
 				pci_name(dev));
 
-			atomic_inc(&pci_parity_count);
+			atomic_inc_unchecked(&pci_parity_count);
 		}
 	}
 
@@ -616,7 +616,7 @@
 				edac_printk(KERN_CRIT, EDAC_PCI, "Bridge "
 					"Signaled System Error on %s\n",
 					pci_name(dev));
-				atomic_inc(&pci_nonparity_count);
+				atomic_inc_unchecked(&pci_nonparity_count);
 			}
 
 			if (status & (PCI_STATUS_PARITY)) {
@@ -624,7 +624,7 @@
 					"Master Data Parity Error on "
 					"%s\n", pci_name(dev));
 
-				atomic_inc(&pci_parity_count);
+				atomic_inc_unchecked(&pci_parity_count);
 			}
 
 			if (status & (PCI_STATUS_DETECTED_PARITY)) {
@@ -632,7 +632,7 @@
 					"Detected Parity Error on %s\n",
 					pci_name(dev));
 
-				atomic_inc(&pci_parity_count);
+				atomic_inc_unchecked(&pci_parity_count);
 			}
 		}
 	}
@@ -674,7 +674,7 @@
 	if (!check_pci_errors)
 		return;
 
-	before_count = atomic_read(&pci_parity_count);
+	before_count = atomic_read_unchecked(&pci_parity_count);
 
 	/* scan all PCI devices looking for a Parity Error on devices and
 	 * bridges.
@@ -686,7 +686,7 @@
 	/* Only if operator has selected panic on PCI Error */
 	if (edac_pci_get_panic_on_pe()) {
 		/* If the count is different 'after' from 'before' */
-		if (before_count != atomic_read(&pci_parity_count))
+		if (before_count != atomic_read_unchecked(&pci_parity_count))
 			panic("EDAC: PCI Parity Error");
 	}
 }
diff -uriN linux-2.6.32.43/drivers/firewire/core-cdev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firewire/core-cdev.c
--- linux-2.6.32.43/drivers/firewire/core-cdev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firewire/core-cdev.c	2011-07-15 05:51:11.000000000 -0500
@@ -1141,8 +1141,7 @@
 	int ret;
 
 	if ((request->channels == 0 && request->bandwidth == 0) ||
-	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL ||
-	    request->bandwidth < 0)
+	    request->bandwidth > BANDWIDTH_AVAILABLE_INITIAL)
 		return -EINVAL;
 
 	r  = kmalloc(sizeof(*r), GFP_KERNEL);
diff -uriN linux-2.6.32.43/drivers/firewire/core-transaction.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firewire/core-transaction.c
--- linux-2.6.32.43/drivers/firewire/core-transaction.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firewire/core-transaction.c	2011-07-15 05:51:11.000000000 -0500
@@ -36,6 +36,7 @@
 #include <linux/string.h>
 #include <linux/timer.h>
 #include <linux/types.h>
+#include <linux/sched.h>
 
 #include <asm/byteorder.h>
 
@@ -344,6 +345,8 @@
 	struct transaction_callback_data d;
 	struct fw_transaction t;
 
+	pax_track_stack();
+
 	init_completion(&d.done);
 	d.payload = payload;
 	fw_send_request(card, &t, tcode, destination_id, generation, speed,
diff -uriN linux-2.6.32.43/drivers/firmware/dmi_scan.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/dmi_scan.c
--- linux-2.6.32.43/drivers/firmware/dmi_scan.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/dmi_scan.c	2011-07-15 05:51:11.000000000 -0500
@@ -391,11 +391,6 @@
 		}
 	}
 	else {
-		/*
-		 * no iounmap() for that ioremap(); it would be a no-op, but
-		 * it's so early in setup that sucker gets confused into doing
-		 * what it shouldn't if we actually call it.
-		 */
 		p = dmi_ioremap(0xF0000, 0x10000);
 		if (p == NULL)
 			goto error;
diff -uriN linux-2.6.32.43/drivers/firmware/edd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/edd.c
--- linux-2.6.32.43/drivers/firmware/edd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/edd.c	2011-07-15 05:51:11.000000000 -0500
@@ -122,7 +122,7 @@
 	return ret;
 }
 
-static struct sysfs_ops edd_attr_ops = {
+static const struct sysfs_ops edd_attr_ops = {
 	.show = edd_attr_show,
 };
 
diff -uriN linux-2.6.32.43/drivers/firmware/efivars.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/efivars.c
--- linux-2.6.32.43/drivers/firmware/efivars.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/efivars.c	2011-07-15 05:51:11.000000000 -0500
@@ -362,7 +362,7 @@
 	return ret;
 }
 
-static struct sysfs_ops efivar_attr_ops = {
+static const struct sysfs_ops efivar_attr_ops = {
 	.show = efivar_attr_show,
 	.store = efivar_attr_store,
 };
diff -uriN linux-2.6.32.43/drivers/firmware/iscsi_ibft.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/iscsi_ibft.c
--- linux-2.6.32.43/drivers/firmware/iscsi_ibft.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/iscsi_ibft.c	2011-07-15 05:51:11.000000000 -0500
@@ -525,7 +525,7 @@
 	return ret;
 }
 
-static struct sysfs_ops ibft_attr_ops = {
+static const struct sysfs_ops ibft_attr_ops = {
 	.show = ibft_show_attribute,
 };
 
diff -uriN linux-2.6.32.43/drivers/firmware/memmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/memmap.c
--- linux-2.6.32.43/drivers/firmware/memmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/firmware/memmap.c	2011-07-15 05:51:11.000000000 -0500
@@ -74,7 +74,7 @@
 	NULL
 };
 
-static struct sysfs_ops memmap_attr_ops = {
+static const struct sysfs_ops memmap_attr_ops = {
 	.show = memmap_attr_show,
 };
 
diff -uriN linux-2.6.32.43/drivers/gpio/vr41xx_giu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpio/vr41xx_giu.c
--- linux-2.6.32.43/drivers/gpio/vr41xx_giu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpio/vr41xx_giu.c	2011-07-15 05:51:11.000000000 -0500
@@ -204,7 +204,7 @@
 	printk(KERN_ERR "spurious GIU interrupt: %04x(%04x),%04x(%04x)\n",
 	       maskl, pendl, maskh, pendh);
 
-	atomic_inc(&irq_err_count);
+	atomic_inc_unchecked(&irq_err_count);
 
 	return -EINVAL;
 }
diff -uriN linux-2.6.32.43/drivers/gpu/drm/drm_crtc_helper.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_crtc_helper.c
--- linux-2.6.32.43/drivers/gpu/drm/drm_crtc_helper.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_crtc_helper.c	2011-07-15 05:51:11.000000000 -0500
@@ -573,7 +573,7 @@
 	struct drm_crtc *tmp;
 	int crtc_mask = 1;
 
-	WARN(!crtc, "checking null crtc?");
+	BUG_ON(!crtc);
 
 	dev = crtc->dev;
 
@@ -642,6 +642,8 @@
 
 	adjusted_mode = drm_mode_duplicate(dev, mode);
 
+	pax_track_stack();
+
 	crtc->enabled = drm_helper_crtc_in_use(crtc);
 
 	if (!crtc->enabled)
diff -uriN linux-2.6.32.43/drivers/gpu/drm/drm_drv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_drv.c
--- linux-2.6.32.43/drivers/gpu/drm/drm_drv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_drv.c	2011-07-15 05:51:11.000000000 -0500
@@ -417,7 +417,7 @@
 	char *kdata = NULL;
 
 	atomic_inc(&dev->ioctl_count);
-	atomic_inc(&dev->counts[_DRM_STAT_IOCTLS]);
+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_IOCTLS]);
 	++file_priv->ioctl_count;
 
 	DRM_DEBUG("pid=%d, cmd=0x%02x, nr=0x%02x, dev 0x%lx, auth=%d\n",
diff -uriN linux-2.6.32.43/drivers/gpu/drm/drm_fops.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_fops.c
--- linux-2.6.32.43/drivers/gpu/drm/drm_fops.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_fops.c	2011-07-15 05:51:11.000000000 -0500
@@ -66,7 +66,7 @@
 	}
 
 	for (i = 0; i < ARRAY_SIZE(dev->counts); i++)
-		atomic_set(&dev->counts[i], 0);
+		atomic_set_unchecked(&dev->counts[i], 0);
 
 	dev->sigdata.lock = NULL;
 
@@ -130,9 +130,9 @@
 
 	retcode = drm_open_helper(inode, filp, dev);
 	if (!retcode) {
-		atomic_inc(&dev->counts[_DRM_STAT_OPENS]);
+		atomic_inc_unchecked(&dev->counts[_DRM_STAT_OPENS]);
 		spin_lock(&dev->count_lock);
-		if (!dev->open_count++) {
+		if (local_inc_return(&dev->open_count) == 1) {
 			spin_unlock(&dev->count_lock);
 			retcode = drm_setup(dev);
 			goto out;
@@ -435,7 +435,7 @@
 
 	lock_kernel();
 
-	DRM_DEBUG("open_count = %d\n", dev->open_count);
+	DRM_DEBUG("open_count = %d\n", local_read(&dev->open_count));
 
 	if (dev->driver->preclose)
 		dev->driver->preclose(dev, file_priv);
@@ -447,7 +447,7 @@
 	DRM_DEBUG("pid = %d, device = 0x%lx, open_count = %d\n",
 		  task_pid_nr(current),
 		  (long)old_encode_dev(file_priv->minor->device),
-		  dev->open_count);
+		  local_read(&dev->open_count));
 
 	/* if the master has gone away we can't do anything with the lock */
 	if (file_priv->minor->master)
@@ -524,9 +524,9 @@
 	 * End inline drm_release
 	 */
 
-	atomic_inc(&dev->counts[_DRM_STAT_CLOSES]);
+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_CLOSES]);
 	spin_lock(&dev->count_lock);
-	if (!--dev->open_count) {
+	if (local_dec_and_test(&dev->open_count)) {
 		if (atomic_read(&dev->ioctl_count)) {
 			DRM_ERROR("Device busy: %d\n",
 				  atomic_read(&dev->ioctl_count));
diff -uriN linux-2.6.32.43/drivers/gpu/drm/drm_gem.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_gem.c
--- linux-2.6.32.43/drivers/gpu/drm/drm_gem.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_gem.c	2011-07-15 05:51:11.000000000 -0500
@@ -83,11 +83,11 @@
 	spin_lock_init(&dev->object_name_lock);
 	idr_init(&dev->object_name_idr);
 	atomic_set(&dev->object_count, 0);
-	atomic_set(&dev->object_memory, 0);
+	atomic_set_unchecked(&dev->object_memory, 0);
 	atomic_set(&dev->pin_count, 0);
-	atomic_set(&dev->pin_memory, 0);
+	atomic_set_unchecked(&dev->pin_memory, 0);
 	atomic_set(&dev->gtt_count, 0);
-	atomic_set(&dev->gtt_memory, 0);
+	atomic_set_unchecked(&dev->gtt_memory, 0);
 
 	mm = kzalloc(sizeof(struct drm_gem_mm), GFP_KERNEL);
 	if (!mm) {
@@ -150,7 +150,7 @@
 		goto fput;
 	}
 	atomic_inc(&dev->object_count);
-	atomic_add(obj->size, &dev->object_memory);
+	atomic_add_unchecked(obj->size, &dev->object_memory);
 	return obj;
 fput:
 	fput(obj->filp);
@@ -429,7 +429,7 @@
 
 	fput(obj->filp);
 	atomic_dec(&dev->object_count);
-	atomic_sub(obj->size, &dev->object_memory);
+	atomic_sub_unchecked(obj->size, &dev->object_memory);
 	kfree(obj);
 }
 EXPORT_SYMBOL(drm_gem_object_free);
diff -uriN linux-2.6.32.43/drivers/gpu/drm/drm_info.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_info.c
--- linux-2.6.32.43/drivers/gpu/drm/drm_info.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_info.c	2011-07-15 05:51:11.000000000 -0500
@@ -75,10 +75,14 @@
 	struct drm_local_map *map;
 	struct drm_map_list *r_list;
 
-	/* Hardcoded from _DRM_FRAME_BUFFER,
-	   _DRM_REGISTERS, _DRM_SHM, _DRM_AGP, and
-	   _DRM_SCATTER_GATHER and _DRM_CONSISTENT */
-	const char *types[] = { "FB", "REG", "SHM", "AGP", "SG", "PCI" };
+	static const char * const types[] = {
+		[_DRM_FRAME_BUFFER] = "FB",
+		[_DRM_REGISTERS] = "REG",
+		[_DRM_SHM] = "SHM",
+		[_DRM_AGP] = "AGP",
+		[_DRM_SCATTER_GATHER] = "SG",
+		[_DRM_CONSISTENT] = "PCI",
+		[_DRM_GEM] = "GEM" };
 	const char *type;
 	int i;
 
@@ -89,7 +93,7 @@
 		map = r_list->map;
 		if (!map)
 			continue;
-		if (map->type < 0 || map->type > 5)
+		if (map->type >= ARRAY_SIZE(types))
 			type = "??";
 		else
 			type = types[map->type];
@@ -265,10 +269,10 @@
 	struct drm_device *dev = node->minor->dev;
 
 	seq_printf(m, "%d objects\n", atomic_read(&dev->object_count));
-	seq_printf(m, "%d object bytes\n", atomic_read(&dev->object_memory));
+	seq_printf(m, "%d object bytes\n", atomic_read_unchecked(&dev->object_memory));
 	seq_printf(m, "%d pinned\n", atomic_read(&dev->pin_count));
-	seq_printf(m, "%d pin bytes\n", atomic_read(&dev->pin_memory));
-	seq_printf(m, "%d gtt bytes\n", atomic_read(&dev->gtt_memory));
+	seq_printf(m, "%d pin bytes\n", atomic_read_unchecked(&dev->pin_memory));
+	seq_printf(m, "%d gtt bytes\n", atomic_read_unchecked(&dev->gtt_memory));
 	seq_printf(m, "%d gtt total\n", dev->gtt_total);
 	return 0;
 }
@@ -288,7 +292,11 @@
 	mutex_lock(&dev->struct_mutex);
 	seq_printf(m, "vma use count: %d, high_memory = %p, 0x%08llx\n",
 		   atomic_read(&dev->vma_count),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		   NULL, 0);
+#else
 		   high_memory, (u64)virt_to_phys(high_memory));
+#endif
 
 	list_for_each_entry(pt, &dev->vmalist, head) {
 		vma = pt->vma;
@@ -296,14 +304,23 @@
 			continue;
 		seq_printf(m,
 			   "\n%5d 0x%08lx-0x%08lx %c%c%c%c%c%c 0x%08lx000",
-			   pt->pid, vma->vm_start, vma->vm_end,
+			   pt->pid,
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			   0, 0,
+#else
+			   vma->vm_start, vma->vm_end,
+#endif
 			   vma->vm_flags & VM_READ ? 'r' : '-',
 			   vma->vm_flags & VM_WRITE ? 'w' : '-',
 			   vma->vm_flags & VM_EXEC ? 'x' : '-',
 			   vma->vm_flags & VM_MAYSHARE ? 's' : 'p',
 			   vma->vm_flags & VM_LOCKED ? 'l' : '-',
 			   vma->vm_flags & VM_IO ? 'i' : '-',
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			   0);
+#else
 			   vma->vm_pgoff);
+#endif
 
 #if defined(__i386__)
 		pgprot = pgprot_val(vma->vm_page_prot);
diff -uriN linux-2.6.32.43/drivers/gpu/drm/drm_ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_ioctl.c
--- linux-2.6.32.43/drivers/gpu/drm/drm_ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_ioctl.c	2011-07-15 05:51:11.000000000 -0500
@@ -283,7 +283,7 @@
 			stats->data[i].value =
 			    (file_priv->master->lock.hw_lock ? file_priv->master->lock.hw_lock->lock : 0);
 		else
-			stats->data[i].value = atomic_read(&dev->counts[i]);
+			stats->data[i].value = atomic_read_unchecked(&dev->counts[i]);
 		stats->data[i].type = dev->types[i];
 	}
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/drm_lock.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_lock.c
--- linux-2.6.32.43/drivers/gpu/drm/drm_lock.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/drm_lock.c	2011-07-15 05:51:11.000000000 -0500
@@ -87,7 +87,7 @@
 		if (drm_lock_take(&master->lock, lock->context)) {
 			master->lock.file_priv = file_priv;
 			master->lock.lock_time = jiffies;
-			atomic_inc(&dev->counts[_DRM_STAT_LOCKS]);
+			atomic_inc_unchecked(&dev->counts[_DRM_STAT_LOCKS]);
 			break;	/* Got lock */
 		}
 
@@ -165,7 +165,7 @@
 		return -EINVAL;
 	}
 
-	atomic_inc(&dev->counts[_DRM_STAT_UNLOCKS]);
+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_UNLOCKS]);
 
 	/* kernel_context_switch isn't used by any of the x86 drm
 	 * modules but is required by the Sparc driver.
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i810/i810_dma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i810/i810_dma.c
--- linux-2.6.32.43/drivers/gpu/drm/i810/i810_dma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i810/i810_dma.c	2011-07-15 05:51:11.000000000 -0500
@@ -952,8 +952,8 @@
 				 dma->buflist[vertex->idx],
 				 vertex->discard, vertex->used);
 
-	atomic_add(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
-	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
+	atomic_add_unchecked(vertex->used, &dev->counts[_DRM_STAT_SECONDARY]);
+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
 	sarea_priv->last_enqueue = dev_priv->counter - 1;
 	sarea_priv->last_dispatch = (int)hw_status[5];
 
@@ -1115,8 +1115,8 @@
 	i810_dma_dispatch_mc(dev, dma->buflist[mc->idx], mc->used,
 			     mc->last_render);
 
-	atomic_add(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
-	atomic_inc(&dev->counts[_DRM_STAT_DMA]);
+	atomic_add_unchecked(mc->used, &dev->counts[_DRM_STAT_SECONDARY]);
+	atomic_inc_unchecked(&dev->counts[_DRM_STAT_DMA]);
 	sarea_priv->last_enqueue = dev_priv->counter - 1;
 	sarea_priv->last_dispatch = (int)hw_status[5];
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i810/i810_drv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i810/i810_drv.h
--- linux-2.6.32.43/drivers/gpu/drm/i810/i810_drv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i810/i810_drv.h	2011-07-15 05:51:11.000000000 -0500
@@ -108,8 +108,8 @@
 	int page_flipping;
 
 	wait_queue_head_t irq_queue;
-	atomic_t irq_received;
-	atomic_t irq_emitted;
+	atomic_unchecked_t irq_received;
+	atomic_unchecked_t irq_emitted;
 
 	int front_offset;
 } drm_i810_private_t;
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i830/i830_drv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i830/i830_drv.h
--- linux-2.6.32.43/drivers/gpu/drm/i830/i830_drv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i830/i830_drv.h	2011-07-15 05:51:11.000000000 -0500
@@ -115,8 +115,8 @@
 	int page_flipping;
 
 	wait_queue_head_t irq_queue;
-	atomic_t irq_received;
-	atomic_t irq_emitted;
+	atomic_unchecked_t irq_received;
+	atomic_unchecked_t irq_emitted;
 
 	int use_mi_batchbuffer_start;
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i830/i830_irq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i830/i830_irq.c
--- linux-2.6.32.43/drivers/gpu/drm/i830/i830_irq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i830/i830_irq.c	2011-07-15 05:51:11.000000000 -0500
@@ -47,7 +47,7 @@
 
 	I830_WRITE16(I830REG_INT_IDENTITY_R, temp);
 
-	atomic_inc(&dev_priv->irq_received);
+	atomic_inc_unchecked(&dev_priv->irq_received);
 	wake_up_interruptible(&dev_priv->irq_queue);
 
 	return IRQ_HANDLED;
@@ -60,14 +60,14 @@
 
 	DRM_DEBUG("%s\n", __func__);
 
-	atomic_inc(&dev_priv->irq_emitted);
+	atomic_inc_unchecked(&dev_priv->irq_emitted);
 
 	BEGIN_LP_RING(2);
 	OUT_RING(0);
 	OUT_RING(GFX_OP_USER_INTERRUPT);
 	ADVANCE_LP_RING();
 
-	return atomic_read(&dev_priv->irq_emitted);
+	return atomic_read_unchecked(&dev_priv->irq_emitted);
 }
 
 static int i830_wait_irq(struct drm_device * dev, int irq_nr)
@@ -79,7 +79,7 @@
 
 	DRM_DEBUG("%s\n", __func__);
 
-	if (atomic_read(&dev_priv->irq_received) >= irq_nr)
+	if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
 		return 0;
 
 	dev_priv->sarea_priv->perf_boxes |= I830_BOX_WAIT;
@@ -88,7 +88,7 @@
 
 	for (;;) {
 		__set_current_state(TASK_INTERRUPTIBLE);
-		if (atomic_read(&dev_priv->irq_received) >= irq_nr)
+		if (atomic_read_unchecked(&dev_priv->irq_received) >= irq_nr)
 			break;
 		if ((signed)(end - jiffies) <= 0) {
 			DRM_ERROR("timeout iir %x imr %x ier %x hwstam %x\n",
@@ -163,8 +163,8 @@
 	I830_WRITE16(I830REG_HWSTAM, 0xffff);
 	I830_WRITE16(I830REG_INT_MASK_R, 0x0);
 	I830_WRITE16(I830REG_INT_ENABLE_R, 0x0);
-	atomic_set(&dev_priv->irq_received, 0);
-	atomic_set(&dev_priv->irq_emitted, 0);
+	atomic_set_unchecked(&dev_priv->irq_received, 0);
+	atomic_set_unchecked(&dev_priv->irq_emitted, 0);
 	init_waitqueue_head(&dev_priv->irq_queue);
 }
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7017.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_ch7017.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7017.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_ch7017.c	2011-07-15 05:51:11.000000000 -0500
@@ -443,7 +443,7 @@
 	}
 }
 
-struct intel_dvo_dev_ops ch7017_ops = {
+const struct intel_dvo_dev_ops ch7017_ops = {
 	.init = ch7017_init,
 	.detect = ch7017_detect,
 	.mode_valid = ch7017_mode_valid,
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7xxx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_ch7xxx.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ch7xxx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_ch7xxx.c	2011-07-15 05:51:11.000000000 -0500
@@ -356,7 +356,7 @@
 	}
 }
 
-struct intel_dvo_dev_ops ch7xxx_ops = {
+const struct intel_dvo_dev_ops ch7xxx_ops = {
 	.init = ch7xxx_init,
 	.detect = ch7xxx_detect,
 	.mode_valid = ch7xxx_mode_valid,
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/dvo.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo.h
--- linux-2.6.32.43/drivers/gpu/drm/i915/dvo.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo.h	2011-07-15 05:51:11.000000000 -0500
@@ -135,23 +135,23 @@
 	 *
 	 * \return singly-linked list of modes or NULL if no modes found.
 	 */
-	struct drm_display_mode *(*get_modes)(struct intel_dvo_device *dvo);
+	struct drm_display_mode *(* const get_modes)(struct intel_dvo_device *dvo);
 
 	/**
 	 * Clean up driver-specific bits of the output
 	 */
-	void (*destroy) (struct intel_dvo_device *dvo);
+	void (* const destroy) (struct intel_dvo_device *dvo);
 
 	/**
 	 * Debugging hook to dump device registers to log file
 	 */
-	void (*dump_regs)(struct intel_dvo_device *dvo);
+	void (* const dump_regs)(struct intel_dvo_device *dvo);
 };
 
-extern struct intel_dvo_dev_ops sil164_ops;
-extern struct intel_dvo_dev_ops ch7xxx_ops;
-extern struct intel_dvo_dev_ops ivch_ops;
-extern struct intel_dvo_dev_ops tfp410_ops;
-extern struct intel_dvo_dev_ops ch7017_ops;
+extern const struct intel_dvo_dev_ops sil164_ops;
+extern const struct intel_dvo_dev_ops ch7xxx_ops;
+extern const struct intel_dvo_dev_ops ivch_ops;
+extern const struct intel_dvo_dev_ops tfp410_ops;
+extern const struct intel_dvo_dev_ops ch7017_ops;
 
 #endif /* _INTEL_DVO_H */
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ivch.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_ivch.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_ivch.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_ivch.c	2011-07-15 05:51:11.000000000 -0500
@@ -430,7 +430,7 @@
 	}
 }
 
-struct intel_dvo_dev_ops ivch_ops= {
+const struct intel_dvo_dev_ops ivch_ops= {
 	.init = ivch_init,
 	.dpms = ivch_dpms,
 	.save = ivch_save,
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/dvo_sil164.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_sil164.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_sil164.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_sil164.c	2011-07-15 05:51:11.000000000 -0500
@@ -290,7 +290,7 @@
 	}
 }
 
-struct intel_dvo_dev_ops sil164_ops = {
+const struct intel_dvo_dev_ops sil164_ops = {
 	.init = sil164_init,
 	.detect = sil164_detect,
 	.mode_valid = sil164_mode_valid,
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/dvo_tfp410.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_tfp410.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/dvo_tfp410.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/dvo_tfp410.c	2011-07-15 05:51:11.000000000 -0500
@@ -323,7 +323,7 @@
 	}
 }
 
-struct intel_dvo_dev_ops tfp410_ops = {
+const struct intel_dvo_dev_ops tfp410_ops = {
 	.init = tfp410_init,
 	.detect = tfp410_detect,
 	.mode_valid = tfp410_mode_valid,
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/i915_debugfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_debugfs.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/i915_debugfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_debugfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -192,7 +192,7 @@
 			   I915_READ(GTIMR));
 	}
 	seq_printf(m, "Interrupts received: %d\n",
-		   atomic_read(&dev_priv->irq_received));
+		   atomic_read_unchecked(&dev_priv->irq_received));
 	if (dev_priv->hw_status_page != NULL) {
 		seq_printf(m, "Current sequence:    %d\n",
 			   i915_get_gem_seqno(dev));
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_drv.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_drv.c	2011-07-15 05:51:11.000000000 -0500
@@ -285,7 +285,7 @@
 	return i915_resume(dev);
 }
 
-static struct vm_operations_struct i915_gem_vm_ops = {
+static const struct vm_operations_struct i915_gem_vm_ops = {
 	.fault = i915_gem_fault,
 	.open = drm_gem_vm_open,
 	.close = drm_gem_vm_close,
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_drv.h
--- linux-2.6.32.43/drivers/gpu/drm/i915/i915_drv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_drv.h	2011-07-15 05:51:11.000000000 -0500
@@ -197,7 +197,7 @@
 	int page_flipping;
 
 	wait_queue_head_t irq_queue;
-	atomic_t irq_received;
+	atomic_unchecked_t irq_received;
 	/** Protects user_irq_refcount and irq_mask_reg */
 	spinlock_t user_irq_lock;
 	/** Refcount for i915_user_irq_get() versus i915_user_irq_put(). */
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/i915_gem.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_gem.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/i915_gem.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_gem.c	2011-07-15 05:51:11.000000000 -0500
@@ -102,7 +102,7 @@
 
 	args->aper_size = dev->gtt_total;
 	args->aper_available_size = (args->aper_size -
-				     atomic_read(&dev->pin_memory));
+				     atomic_read_unchecked(&dev->pin_memory));
 
 	return 0;
 }
@@ -492,6 +492,11 @@
 		return -EINVAL;
 	}
 
+	if (!access_ok(VERIFY_WRITE, (char __user *) (uintptr_t)args->data_ptr, args->size)) {
+		drm_gem_object_unreference(obj);
+		return -EFAULT;
+	}
+
 	if (i915_gem_object_needs_bit17_swizzle(obj)) {
 		ret = i915_gem_shmem_pread_slow(dev, obj, args, file_priv);
 	} else {
@@ -965,6 +970,11 @@
 		return -EINVAL;
 	}
 
+	if (!access_ok(VERIFY_READ, (char __user *) (uintptr_t)args->data_ptr, args->size)) {
+		drm_gem_object_unreference(obj);
+		return -EFAULT;
+	}
+
 	/* We can only do the GTT pwrite on untiled buffers, as otherwise
 	 * it would end up going through the fenced access, and we'll get
 	 * different detiling behavior between reading and writing.
@@ -2054,7 +2064,7 @@
 
 	if (obj_priv->gtt_space) {
 		atomic_dec(&dev->gtt_count);
-		atomic_sub(obj->size, &dev->gtt_memory);
+		atomic_sub_unchecked(obj->size, &dev->gtt_memory);
 
 		drm_mm_put_block(obj_priv->gtt_space);
 		obj_priv->gtt_space = NULL;
@@ -2697,7 +2707,7 @@
 		goto search_free;
 	}
 	atomic_inc(&dev->gtt_count);
-	atomic_add(obj->size, &dev->gtt_memory);
+	atomic_add_unchecked(obj->size, &dev->gtt_memory);
 
 	/* Assert that the object is not currently in any GPU domain. As it
 	 * wasn't in the GTT, there shouldn't be any way it could have been in
@@ -3751,9 +3761,9 @@
 					  "%d/%d gtt bytes\n",
 					  atomic_read(&dev->object_count),
 					  atomic_read(&dev->pin_count),
-					  atomic_read(&dev->object_memory),
-					  atomic_read(&dev->pin_memory),
-					  atomic_read(&dev->gtt_memory),
+					  atomic_read_unchecked(&dev->object_memory),
+					  atomic_read_unchecked(&dev->pin_memory),
+					  atomic_read_unchecked(&dev->gtt_memory),
 					  dev->gtt_total);
 			}
 			goto err;
@@ -3985,7 +3995,7 @@
 	 */
 	if (obj_priv->pin_count == 1) {
 		atomic_inc(&dev->pin_count);
-		atomic_add(obj->size, &dev->pin_memory);
+		atomic_add_unchecked(obj->size, &dev->pin_memory);
 		if (!obj_priv->active &&
 		    (obj->write_domain & I915_GEM_GPU_DOMAINS) == 0 &&
 		    !list_empty(&obj_priv->list))
@@ -4018,7 +4028,7 @@
 			list_move_tail(&obj_priv->list,
 				       &dev_priv->mm.inactive_list);
 		atomic_dec(&dev->pin_count);
-		atomic_sub(obj->size, &dev->pin_memory);
+		atomic_sub_unchecked(obj->size, &dev->pin_memory);
 	}
 	i915_verify_inactive(dev, __FILE__, __LINE__);
 }
diff -uriN linux-2.6.32.43/drivers/gpu/drm/i915/i915_irq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_irq.c
--- linux-2.6.32.43/drivers/gpu/drm/i915/i915_irq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/i915/i915_irq.c	2011-07-15 05:51:11.000000000 -0500
@@ -528,7 +528,7 @@
 	int irq_received;
 	int ret = IRQ_NONE;
 
-	atomic_inc(&dev_priv->irq_received);
+	atomic_inc_unchecked(&dev_priv->irq_received);
 
 	if (IS_IGDNG(dev))
 		return igdng_irq_handler(dev);
@@ -1021,7 +1021,7 @@
 {
 	drm_i915_private_t *dev_priv = (drm_i915_private_t *) dev->dev_private;
 
-	atomic_set(&dev_priv->irq_received, 0);
+	atomic_set_unchecked(&dev_priv->irq_received, 0);
 
 	INIT_WORK(&dev_priv->hotplug_work, i915_hotplug_work_func);
 	INIT_WORK(&dev_priv->error_work, i915_error_work_func);
diff -uriN linux-2.6.32.43/drivers/gpu/drm/mga/mga_drv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/mga/mga_drv.h
--- linux-2.6.32.43/drivers/gpu/drm/mga/mga_drv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/mga/mga_drv.h	2011-07-15 05:51:11.000000000 -0500
@@ -120,9 +120,9 @@
 	u32 clear_cmd;
 	u32 maccess;
 
-	atomic_t vbl_received;          /**< Number of vblanks received. */
+	atomic_unchecked_t vbl_received;          /**< Number of vblanks received. */
 	wait_queue_head_t fence_queue;
-	atomic_t last_fence_retired;
+	atomic_unchecked_t last_fence_retired;
 	u32 next_fence_to_post;
 
 	unsigned int fb_cpp;
diff -uriN linux-2.6.32.43/drivers/gpu/drm/mga/mga_irq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/mga/mga_irq.c
--- linux-2.6.32.43/drivers/gpu/drm/mga/mga_irq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/mga/mga_irq.c	2011-07-15 05:51:11.000000000 -0500
@@ -44,7 +44,7 @@
 	if (crtc != 0)
 		return 0;
 
-	return atomic_read(&dev_priv->vbl_received);
+	return atomic_read_unchecked(&dev_priv->vbl_received);
 }
 
 
@@ -60,7 +60,7 @@
 	/* VBLANK interrupt */
 	if (status & MGA_VLINEPEN) {
 		MGA_WRITE(MGA_ICLEAR, MGA_VLINEICLR);
-		atomic_inc(&dev_priv->vbl_received);
+		atomic_inc_unchecked(&dev_priv->vbl_received);
 		drm_handle_vblank(dev, 0);
 		handled = 1;
 	}
@@ -80,7 +80,7 @@
 			MGA_WRITE(MGA_PRIMEND, prim_end);
 		}
 
-		atomic_inc(&dev_priv->last_fence_retired);
+		atomic_inc_unchecked(&dev_priv->last_fence_retired);
 		DRM_WAKEUP(&dev_priv->fence_queue);
 		handled = 1;
 	}
@@ -131,7 +131,7 @@
 	 * using fences.
 	 */
 	DRM_WAIT_ON(ret, dev_priv->fence_queue, 3 * DRM_HZ,
-		    (((cur_fence = atomic_read(&dev_priv->last_fence_retired))
+		    (((cur_fence = atomic_read_unchecked(&dev_priv->last_fence_retired))
 		      - *sequence) <= (1 << 23)));
 
 	*sequence = cur_fence;
diff -uriN linux-2.6.32.43/drivers/gpu/drm/r128/r128_cce.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/r128/r128_cce.c
--- linux-2.6.32.43/drivers/gpu/drm/r128/r128_cce.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/r128/r128_cce.c	2011-07-15 05:51:11.000000000 -0500
@@ -377,7 +377,7 @@
 
 	/* GH: Simple idle check.
 	 */
-	atomic_set(&dev_priv->idle_count, 0);
+	atomic_set_unchecked(&dev_priv->idle_count, 0);
 
 	/* We don't support anything other than bus-mastering ring mode,
 	 * but the ring can be in either AGP or PCI space for the ring
diff -uriN linux-2.6.32.43/drivers/gpu/drm/r128/r128_drv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/r128/r128_drv.h
--- linux-2.6.32.43/drivers/gpu/drm/r128/r128_drv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/r128/r128_drv.h	2011-07-15 05:51:11.000000000 -0500
@@ -90,14 +90,14 @@
 	int is_pci;
 	unsigned long cce_buffers_offset;
 
-	atomic_t idle_count;
+	atomic_unchecked_t idle_count;
 
 	int page_flipping;
 	int current_page;
 	u32 crtc_offset;
 	u32 crtc_offset_cntl;
 
-	atomic_t vbl_received;
+	atomic_unchecked_t vbl_received;
 
 	u32 color_fmt;
 	unsigned int front_offset;
diff -uriN linux-2.6.32.43/drivers/gpu/drm/r128/r128_irq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/r128/r128_irq.c
--- linux-2.6.32.43/drivers/gpu/drm/r128/r128_irq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/r128/r128_irq.c	2011-07-15 05:51:11.000000000 -0500
@@ -42,7 +42,7 @@
 	if (crtc != 0)
 		return 0;
 
-	return atomic_read(&dev_priv->vbl_received);
+	return atomic_read_unchecked(&dev_priv->vbl_received);
 }
 
 irqreturn_t r128_driver_irq_handler(DRM_IRQ_ARGS)
@@ -56,7 +56,7 @@
 	/* VBLANK interrupt */
 	if (status & R128_CRTC_VBLANK_INT) {
 		R128_WRITE(R128_GEN_INT_STATUS, R128_CRTC_VBLANK_INT_AK);
-		atomic_inc(&dev_priv->vbl_received);
+		atomic_inc_unchecked(&dev_priv->vbl_received);
 		drm_handle_vblank(dev, 0);
 		return IRQ_HANDLED;
 	}
diff -uriN linux-2.6.32.43/drivers/gpu/drm/r128/r128_state.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/r128/r128_state.c
--- linux-2.6.32.43/drivers/gpu/drm/r128/r128_state.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/r128/r128_state.c	2011-07-15 05:51:11.000000000 -0500
@@ -323,10 +323,10 @@
 
 static void r128_cce_performance_boxes(drm_r128_private_t * dev_priv)
 {
-	if (atomic_read(&dev_priv->idle_count) == 0) {
+	if (atomic_read_unchecked(&dev_priv->idle_count) == 0) {
 		r128_clear_box(dev_priv, 64, 4, 8, 8, 0, 255, 0);
 	} else {
-		atomic_set(&dev_priv->idle_count, 0);
+		atomic_set_unchecked(&dev_priv->idle_count, 0);
 	}
 }
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/atom.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/atom.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/atom.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/atom.c	2011-07-15 05:51:11.000000000 -0500
@@ -1115,6 +1115,8 @@
 	char name[512];
 	int i;
 
+	pax_track_stack();
+
 	ctx->card = card;
 	ctx->bios = bios;
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/mkregtable.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/mkregtable.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/mkregtable.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/mkregtable.c	2011-07-15 05:51:11.000000000 -0500
@@ -637,14 +637,14 @@
 	regex_t mask_rex;
 	regmatch_t match[4];
 	char buf[1024];
-	size_t end;
+	long end;
 	int len;
 	int done = 0;
 	int r;
 	unsigned o;
 	struct offset *offset;
 	char last_reg_s[10];
-	int last_reg;
+	unsigned long last_reg;
 
 	if (regcomp
 	    (&mask_rex, "(0x[0-9a-fA-F]*) *([_a-zA-Z0-9]*)", REG_EXTENDED)) {
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_atombios.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_atombios.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_atombios.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_atombios.c	2011-07-15 05:51:11.000000000 -0500
@@ -275,6 +275,8 @@
 	bool linkb;
 	struct radeon_i2c_bus_rec ddc_bus;
 
+	pax_track_stack();
+
 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
 
 	if (data_offset == 0)
@@ -520,13 +522,13 @@
 	}
 }
 
-struct bios_connector {
+static struct bios_connector {
 	bool valid;
 	uint16_t line_mux;
 	uint16_t devices;
 	int connector_type;
 	struct radeon_i2c_bus_rec ddc_bus;
-};
+} bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
 
 bool radeon_get_atom_connector_info_from_supported_devices_table(struct
 								 drm_device
@@ -542,7 +544,6 @@
 	uint8_t dac;
 	union atom_supported_devices *supported_devices;
 	int i, j;
-	struct bios_connector bios_connectors[ATOM_MAX_SUPPORTED_DEVICE];
 
 	atom_parse_data_header(ctx, index, &size, &frev, &crev, &data_offset);
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_display.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_display.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_display.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_display.c	2011-07-15 05:51:11.000000000 -0500
@@ -482,7 +482,7 @@
 
 					if (flags & RADEON_PLL_PREFER_CLOSEST_LOWER) {
 						error = freq - current_freq;
-						error = error < 0 ? 0xffffffff : error;
+						error = (int32_t)error < 0 ? 0xffffffff : error;
 					} else
 						error = abs(current_freq - freq);
 					vco_diff = abs(vco - best_vco);
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_drv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_drv.h
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_drv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_drv.h	2011-07-15 05:51:11.000000000 -0500
@@ -253,7 +253,7 @@
 
 	/* SW interrupt */
 	wait_queue_head_t swi_queue;
-	atomic_t swi_emitted;
+	atomic_unchecked_t swi_emitted;
 	int vblank_crtc;
 	uint32_t irq_enable_reg;
 	uint32_t r500_disp_irq_reg;
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_fence.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_fence.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_fence.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_fence.c	2011-07-15 05:51:11.000000000 -0500
@@ -47,7 +47,7 @@
 		write_unlock_irqrestore(&rdev->fence_drv.lock, irq_flags);
 		return 0;
 	}
-	fence->seq = atomic_add_return(1, &rdev->fence_drv.seq);
+	fence->seq = atomic_add_return_unchecked(1, &rdev->fence_drv.seq);
 	if (!rdev->cp.ready) {
 		/* FIXME: cp is not running assume everythings is done right
 		 * away
@@ -364,7 +364,7 @@
 		return r;
 	}
 	WREG32(rdev->fence_drv.scratch_reg, 0);
-	atomic_set(&rdev->fence_drv.seq, 0);
+	atomic_set_unchecked(&rdev->fence_drv.seq, 0);
 	INIT_LIST_HEAD(&rdev->fence_drv.created);
 	INIT_LIST_HEAD(&rdev->fence_drv.emited);
 	INIT_LIST_HEAD(&rdev->fence_drv.signaled);
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon.h
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon.h	2011-07-15 05:51:11.000000000 -0500
@@ -149,7 +149,7 @@
  */
 struct radeon_fence_driver {
 	uint32_t			scratch_reg;
-	atomic_t			seq;
+	atomic_unchecked_t		seq;
 	uint32_t			last_seq;
 	unsigned long			count_timeout;
 	wait_queue_head_t		queue;
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ioc32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_ioc32.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ioc32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_ioc32.c	2011-07-15 05:51:11.000000000 -0500
@@ -368,7 +368,7 @@
 	request = compat_alloc_user_space(sizeof(*request));
 	if (!access_ok(VERIFY_WRITE, request, sizeof(*request))
 	    || __put_user(req32.param, &request->param)
-	    || __put_user((void __user *)(unsigned long)req32.value,
+	    || __put_user((unsigned long)req32.value,
 			  &request->value))
 		return -EFAULT;
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_irq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_irq.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_irq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_irq.c	2011-07-15 05:51:11.000000000 -0500
@@ -225,8 +225,8 @@
 	unsigned int ret;
 	RING_LOCALS;
 
-	atomic_inc(&dev_priv->swi_emitted);
-	ret = atomic_read(&dev_priv->swi_emitted);
+	atomic_inc_unchecked(&dev_priv->swi_emitted);
+	ret = atomic_read_unchecked(&dev_priv->swi_emitted);
 
 	BEGIN_RING(4);
 	OUT_RING_REG(RADEON_LAST_SWI_REG, ret);
@@ -352,7 +352,7 @@
 	drm_radeon_private_t *dev_priv =
 	    (drm_radeon_private_t *) dev->dev_private;
 
-	atomic_set(&dev_priv->swi_emitted, 0);
+	atomic_set_unchecked(&dev_priv->swi_emitted, 0);
 	DRM_INIT_WAITQUEUE(&dev_priv->swi_queue);
 
 	dev->max_vblank_count = 0x001fffff;
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_state.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_state.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_state.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_state.c	2011-07-15 05:51:11.000000000 -0500
@@ -3021,7 +3021,7 @@
 {
 	drm_radeon_private_t *dev_priv = dev->dev_private;
 	drm_radeon_getparam_t *param = data;
-	int value;
+	int value = 0;
 
 	DRM_DEBUG("pid=%d\n", DRM_CURRENTPID);
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ttm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_ttm.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/radeon_ttm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/radeon_ttm.c	2011-07-15 05:51:11.000000000 -0500
@@ -535,27 +535,10 @@
 	DRM_INFO("radeon: ttm finalized\n");
 }
 
-static struct vm_operations_struct radeon_ttm_vm_ops;
-static const struct vm_operations_struct *ttm_vm_ops = NULL;
-
-static int radeon_ttm_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
-{
-	struct ttm_buffer_object *bo;
-	int r;
-
-	bo = (struct ttm_buffer_object *)vma->vm_private_data;
-	if (bo == NULL) {
-		return VM_FAULT_NOPAGE;
-	}
-	r = ttm_vm_ops->fault(vma, vmf);
-	return r;
-}
-
 int radeon_mmap(struct file *filp, struct vm_area_struct *vma)
 {
 	struct drm_file *file_priv;
 	struct radeon_device *rdev;
-	int r;
 
 	if (unlikely(vma->vm_pgoff < DRM_FILE_PAGE_OFFSET)) {
 		return drm_mmap(filp, vma);
@@ -563,20 +546,9 @@
 
 	file_priv = (struct drm_file *)filp->private_data;
 	rdev = file_priv->minor->dev->dev_private;
-	if (rdev == NULL) {
+	if (!rdev)
 		return -EINVAL;
-	}
-	r = ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
-	if (unlikely(r != 0)) {
-		return r;
-	}
-	if (unlikely(ttm_vm_ops == NULL)) {
-		ttm_vm_ops = vma->vm_ops;
-		radeon_ttm_vm_ops = *ttm_vm_ops;
-		radeon_ttm_vm_ops.fault = &radeon_ttm_fault;
-	}
-	vma->vm_ops = &radeon_ttm_vm_ops;
-	return 0;
+	return ttm_bo_mmap(filp, vma, &rdev->mman.bdev);
 }
 
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/radeon/rs690.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/rs690.c
--- linux-2.6.32.43/drivers/gpu/drm/radeon/rs690.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/radeon/rs690.c	2011-07-15 05:51:11.000000000 -0500
@@ -302,9 +302,11 @@
 		if (rdev->pm.max_bandwidth.full > rdev->pm.sideport_bandwidth.full &&
 			rdev->pm.sideport_bandwidth.full)
 			rdev->pm.max_bandwidth = rdev->pm.sideport_bandwidth;
-		read_delay_latency.full = rfixed_const(370 * 800 * 1000);
+		read_delay_latency.full = rfixed_const(800 * 1000);
 		read_delay_latency.full = rfixed_div(read_delay_latency,
 			rdev->pm.igp_sideport_mclk);
+		a.full = rfixed_const(370);
+		read_delay_latency.full = rfixed_mul(read_delay_latency, a);
 	} else {
 		if (rdev->pm.max_bandwidth.full > rdev->pm.k8_bandwidth.full &&
 			rdev->pm.k8_bandwidth.full)
diff -uriN linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/ttm/ttm_bo.c
--- linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/ttm/ttm_bo.c	2011-07-15 05:51:11.000000000 -0500
@@ -67,7 +67,7 @@
 	NULL
 };
 
-static struct sysfs_ops ttm_bo_global_ops = {
+static const struct sysfs_ops ttm_bo_global_ops = {
 	.show = &ttm_bo_global_show
 };
 
diff -uriN linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo_vm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/ttm/ttm_bo_vm.c
--- linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_bo_vm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/ttm/ttm_bo_vm.c	2011-07-15 05:51:11.000000000 -0500
@@ -73,7 +73,7 @@
 {
 	struct ttm_buffer_object *bo = (struct ttm_buffer_object *)
 	    vma->vm_private_data;
-	struct ttm_bo_device *bdev = bo->bdev;
+	struct ttm_bo_device *bdev;
 	unsigned long bus_base;
 	unsigned long bus_offset;
 	unsigned long bus_size;
@@ -88,6 +88,10 @@
 	unsigned long address = (unsigned long)vmf->virtual_address;
 	int retval = VM_FAULT_NOPAGE;
 
+	if (!bo)
+		return VM_FAULT_NOPAGE;
+	bdev = bo->bdev;
+
 	/*
 	 * Work around locking order reversal in fault / nopfn
 	 * between mmap_sem and bo_reserve: Perform a trylock operation
diff -uriN linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_global.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/ttm/ttm_global.c
--- linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_global.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/ttm/ttm_global.c	2011-07-15 05:51:11.000000000 -0500
@@ -36,7 +36,7 @@
 struct ttm_global_item {
 	struct mutex mutex;
 	void *object;
-	int refcount;
+	atomic_t refcount;
 };
 
 static struct ttm_global_item glob[TTM_GLOBAL_NUM];
@@ -49,7 +49,7 @@
 		struct ttm_global_item *item = &glob[i];
 		mutex_init(&item->mutex);
 		item->object = NULL;
-		item->refcount = 0;
+		atomic_set(&item->refcount, 0);
 	}
 }
 
@@ -59,7 +59,7 @@
 	for (i = 0; i < TTM_GLOBAL_NUM; ++i) {
 		struct ttm_global_item *item = &glob[i];
 		BUG_ON(item->object != NULL);
-		BUG_ON(item->refcount != 0);
+		BUG_ON(atomic_read(&item->refcount) != 0);
 	}
 }
 
@@ -70,7 +70,7 @@
 	void *object;
 
 	mutex_lock(&item->mutex);
-	if (item->refcount == 0) {
+	if (atomic_read(&item->refcount) == 0) {
 		item->object = kzalloc(ref->size, GFP_KERNEL);
 		if (unlikely(item->object == NULL)) {
 			ret = -ENOMEM;
@@ -83,7 +83,7 @@
 			goto out_err;
 
 	}
-	++item->refcount;
+	atomic_inc(&item->refcount);
 	ref->object = item->object;
 	object = item->object;
 	mutex_unlock(&item->mutex);
@@ -100,9 +100,9 @@
 	struct ttm_global_item *item = &glob[ref->global_type];
 
 	mutex_lock(&item->mutex);
-	BUG_ON(item->refcount == 0);
+	BUG_ON(atomic_read(&item->refcount) == 0);
 	BUG_ON(ref->object != item->object);
-	if (--item->refcount == 0) {
+	if (atomic_dec_and_test(&item->refcount)) {
 		ref->release(ref);
 		item->object = NULL;
 	}
diff -uriN linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_memory.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/ttm/ttm_memory.c
--- linux-2.6.32.43/drivers/gpu/drm/ttm/ttm_memory.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/ttm/ttm_memory.c	2011-07-15 05:51:11.000000000 -0500
@@ -152,7 +152,7 @@
 	NULL
 };
 
-static struct sysfs_ops ttm_mem_zone_ops = {
+static const struct sysfs_ops ttm_mem_zone_ops = {
 	.show = &ttm_mem_zone_show,
 	.store = &ttm_mem_zone_store
 };
diff -uriN linux-2.6.32.43/drivers/gpu/drm/via/via_drv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/via/via_drv.h
--- linux-2.6.32.43/drivers/gpu/drm/via/via_drv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/via/via_drv.h	2011-07-15 05:51:11.000000000 -0500
@@ -51,7 +51,7 @@
 typedef uint32_t maskarray_t[5];
 
 typedef struct drm_via_irq {
-	atomic_t irq_received;
+	atomic_unchecked_t irq_received;
 	uint32_t pending_mask;
 	uint32_t enable_mask;
 	wait_queue_head_t irq_queue;
@@ -75,7 +75,7 @@
 	struct timeval last_vblank;
 	int last_vblank_valid;
 	unsigned usec_per_vblank;
-	atomic_t vbl_received;
+	atomic_unchecked_t vbl_received;
 	drm_via_state_t hc_state;
 	char pci_buf[VIA_PCI_BUF_SIZE];
 	const uint32_t *fire_offsets[VIA_FIRE_BUF_SIZE];
diff -uriN linux-2.6.32.43/drivers/gpu/drm/via/via_irq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/via/via_irq.c
--- linux-2.6.32.43/drivers/gpu/drm/via/via_irq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/gpu/drm/via/via_irq.c	2011-07-15 05:51:11.000000000 -0500
@@ -102,7 +102,7 @@
 	if (crtc != 0)
 		return 0;
 
-	return atomic_read(&dev_priv->vbl_received);
+	return atomic_read_unchecked(&dev_priv->vbl_received);
 }
 
 irqreturn_t via_driver_irq_handler(DRM_IRQ_ARGS)
@@ -117,8 +117,8 @@
 
 	status = VIA_READ(VIA_REG_INTERRUPT);
 	if (status & VIA_IRQ_VBLANK_PENDING) {
-		atomic_inc(&dev_priv->vbl_received);
-		if (!(atomic_read(&dev_priv->vbl_received) & 0x0F)) {
+		atomic_inc_unchecked(&dev_priv->vbl_received);
+		if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0x0F)) {
 			do_gettimeofday(&cur_vblank);
 			if (dev_priv->last_vblank_valid) {
 				dev_priv->usec_per_vblank =
@@ -128,7 +128,7 @@
 			dev_priv->last_vblank = cur_vblank;
 			dev_priv->last_vblank_valid = 1;
 		}
-		if (!(atomic_read(&dev_priv->vbl_received) & 0xFF)) {
+		if (!(atomic_read_unchecked(&dev_priv->vbl_received) & 0xFF)) {
 			DRM_DEBUG("US per vblank is: %u\n",
 				  dev_priv->usec_per_vblank);
 		}
@@ -138,7 +138,7 @@
 
 	for (i = 0; i < dev_priv->num_irqs; ++i) {
 		if (status & cur_irq->pending_mask) {
-			atomic_inc(&cur_irq->irq_received);
+			atomic_inc_unchecked(&cur_irq->irq_received);
 			DRM_WAKEUP(&cur_irq->irq_queue);
 			handled = 1;
 			if (dev_priv->irq_map[drm_via_irq_dma0_td] == i) {
@@ -244,11 +244,11 @@
 		DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
 			    ((VIA_READ(masks[irq][2]) & masks[irq][3]) ==
 			     masks[irq][4]));
-		cur_irq_sequence = atomic_read(&cur_irq->irq_received);
+		cur_irq_sequence = atomic_read_unchecked(&cur_irq->irq_received);
 	} else {
 		DRM_WAIT_ON(ret, cur_irq->irq_queue, 3 * DRM_HZ,
 			    (((cur_irq_sequence =
-			       atomic_read(&cur_irq->irq_received)) -
+			       atomic_read_unchecked(&cur_irq->irq_received)) -
 			      *sequence) <= (1 << 23)));
 	}
 	*sequence = cur_irq_sequence;
@@ -286,7 +286,7 @@
 		}
 
 		for (i = 0; i < dev_priv->num_irqs; ++i) {
-			atomic_set(&cur_irq->irq_received, 0);
+			atomic_set_unchecked(&cur_irq->irq_received, 0);
 			cur_irq->enable_mask = dev_priv->irq_masks[i][0];
 			cur_irq->pending_mask = dev_priv->irq_masks[i][1];
 			DRM_INIT_WAITQUEUE(&cur_irq->irq_queue);
@@ -368,7 +368,7 @@
 	switch (irqwait->request.type & ~VIA_IRQ_FLAGS_MASK) {
 	case VIA_IRQ_RELATIVE:
 		irqwait->request.sequence +=
-			atomic_read(&cur_irq->irq_received);
+			atomic_read_unchecked(&cur_irq->irq_received);
 		irqwait->request.type &= ~_DRM_VBLANK_RELATIVE;
 	case VIA_IRQ_ABSOLUTE:
 		break;
diff -uriN linux-2.6.32.43/drivers/hid/hid-core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hid/hid-core.c
--- linux-2.6.32.43/drivers/hid/hid-core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hid/hid-core.c	2011-07-15 05:51:11.000000000 -0500
@@ -1752,7 +1752,7 @@
 
 int hid_add_device(struct hid_device *hdev)
 {
-	static atomic_t id = ATOMIC_INIT(0);
+	static atomic_unchecked_t id = ATOMIC_INIT(0);
 	int ret;
 
 	if (WARN_ON(hdev->status & HID_STAT_ADDED))
@@ -1766,7 +1766,7 @@
 	/* XXX hack, any other cleaner solution after the driver core
 	 * is converted to allow more than 20 bytes as the device name? */
 	dev_set_name(&hdev->dev, "%04X:%04X:%04X.%04X", hdev->bus,
-		     hdev->vendor, hdev->product, atomic_inc_return(&id));
+		     hdev->vendor, hdev->product, atomic_inc_return_unchecked(&id));
 
 	ret = device_add(&hdev->dev);
 	if (!ret)
diff -uriN linux-2.6.32.43/drivers/hid/usbhid/hiddev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hid/usbhid/hiddev.c
--- linux-2.6.32.43/drivers/hid/usbhid/hiddev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hid/usbhid/hiddev.c	2011-07-15 05:51:11.000000000 -0500
@@ -617,7 +617,7 @@
 		return put_user(HID_VERSION, (int __user *)arg);
 
 	case HIDIOCAPPLICATION:
-		if (arg < 0 || arg >= hid->maxapplication)
+		if (arg >= hid->maxapplication)
 			return -EINVAL;
 
 		for (i = 0; i < hid->maxcollection; i++)
diff -uriN linux-2.6.32.43/drivers/hwmon/lis3lv02d.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hwmon/lis3lv02d.c
--- linux-2.6.32.43/drivers/hwmon/lis3lv02d.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hwmon/lis3lv02d.c	2011-07-15 05:51:11.000000000 -0500
@@ -146,7 +146,7 @@
 	 * the lid is closed. This leads to interrupts as soon as a little move
 	 * is done.
 	 */
-	atomic_inc(&lis3_dev.count);
+	atomic_inc_unchecked(&lis3_dev.count);
 
 	wake_up_interruptible(&lis3_dev.misc_wait);
 	kill_fasync(&lis3_dev.async_queue, SIGIO, POLL_IN);
@@ -160,7 +160,7 @@
 	if (test_and_set_bit(0, &lis3_dev.misc_opened))
 		return -EBUSY; /* already open */
 
-	atomic_set(&lis3_dev.count, 0);
+	atomic_set_unchecked(&lis3_dev.count, 0);
 
 	/*
 	 * The sensor can generate interrupts for free-fall and direction
@@ -206,7 +206,7 @@
 	add_wait_queue(&lis3_dev.misc_wait, &wait);
 	while (true) {
 		set_current_state(TASK_INTERRUPTIBLE);
-		data = atomic_xchg(&lis3_dev.count, 0);
+		data = atomic_xchg_unchecked(&lis3_dev.count, 0);
 		if (data)
 			break;
 
@@ -244,7 +244,7 @@
 static unsigned int lis3lv02d_misc_poll(struct file *file, poll_table *wait)
 {
 	poll_wait(file, &lis3_dev.misc_wait, wait);
-	if (atomic_read(&lis3_dev.count))
+	if (atomic_read_unchecked(&lis3_dev.count))
 		return POLLIN | POLLRDNORM;
 	return 0;
 }
diff -uriN linux-2.6.32.43/drivers/hwmon/lis3lv02d.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hwmon/lis3lv02d.h
--- linux-2.6.32.43/drivers/hwmon/lis3lv02d.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hwmon/lis3lv02d.h	2011-07-15 05:51:11.000000000 -0500
@@ -201,7 +201,7 @@
 
 	struct input_polled_dev	*idev;     /* input device */
 	struct platform_device	*pdev;     /* platform device */
-	atomic_t		count;     /* interrupt count after last read */
+	atomic_unchecked_t	count;     /* interrupt count after last read */
 	int			xcalib;    /* calibrated null value for x */
 	int			ycalib;    /* calibrated null value for y */
 	int			zcalib;    /* calibrated null value for z */
diff -uriN linux-2.6.32.43/drivers/hwmon/sht15.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hwmon/sht15.c
--- linux-2.6.32.43/drivers/hwmon/sht15.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hwmon/sht15.c	2011-07-15 05:51:11.000000000 -0500
@@ -112,7 +112,7 @@
 	int				supply_uV;
 	int				supply_uV_valid;
 	struct work_struct		update_supply_work;
-	atomic_t			interrupt_handled;
+	atomic_unchecked_t		interrupt_handled;
 };
 
 /**
@@ -245,13 +245,13 @@
 		return ret;
 
 	gpio_direction_input(data->pdata->gpio_data);
-	atomic_set(&data->interrupt_handled, 0);
+	atomic_set_unchecked(&data->interrupt_handled, 0);
 
 	enable_irq(gpio_to_irq(data->pdata->gpio_data));
 	if (gpio_get_value(data->pdata->gpio_data) == 0) {
 		disable_irq_nosync(gpio_to_irq(data->pdata->gpio_data));
 		/* Only relevant if the interrupt hasn't occured. */
-		if (!atomic_read(&data->interrupt_handled))
+		if (!atomic_read_unchecked(&data->interrupt_handled))
 			schedule_work(&data->read_work);
 	}
 	ret = wait_event_timeout(data->wait_queue,
@@ -398,7 +398,7 @@
 	struct sht15_data *data = d;
 	/* First disable the interrupt */
 	disable_irq_nosync(irq);
-	atomic_inc(&data->interrupt_handled);
+	atomic_inc_unchecked(&data->interrupt_handled);
 	/* Then schedule a reading work struct */
 	if (data->flag != SHT15_READING_NOTHING)
 		schedule_work(&data->read_work);
@@ -449,11 +449,11 @@
 		   here as could have gone low in meantime so verify
 		   it hasn't!
 		*/
-		atomic_set(&data->interrupt_handled, 0);
+		atomic_set_unchecked(&data->interrupt_handled, 0);
 		enable_irq(gpio_to_irq(data->pdata->gpio_data));
 		/* If still not occured or another handler has been scheduled */
 		if (gpio_get_value(data->pdata->gpio_data)
-		    || atomic_read(&data->interrupt_handled))
+		    || atomic_read_unchecked(&data->interrupt_handled))
 			return;
 	}
 	/* Read the data back from the device */
diff -uriN linux-2.6.32.43/drivers/hwmon/w83791d.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hwmon/w83791d.c
--- linux-2.6.32.43/drivers/hwmon/w83791d.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/hwmon/w83791d.c	2011-07-15 05:51:11.000000000 -0500
@@ -330,8 +330,8 @@
 			  struct i2c_board_info *info);
 static int w83791d_remove(struct i2c_client *client);
 
-static int w83791d_read(struct i2c_client *client, u8 register);
-static int w83791d_write(struct i2c_client *client, u8 register, u8 value);
+static int w83791d_read(struct i2c_client *client, u8 reg);
+static int w83791d_write(struct i2c_client *client, u8 reg, u8 value);
 static struct w83791d_data *w83791d_update_device(struct device *dev);
 
 #ifdef DEBUG
diff -uriN linux-2.6.32.43/drivers/ide/ide-cd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ide/ide-cd.c
--- linux-2.6.32.43/drivers/ide/ide-cd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ide/ide-cd.c	2011-07-15 05:51:11.000000000 -0500
@@ -774,7 +774,7 @@
 		alignment = queue_dma_alignment(q) | q->dma_pad_mask;
 		if ((unsigned long)buf & alignment
 		    || blk_rq_bytes(rq) & q->dma_pad_mask
-		    || object_is_on_stack(buf))
+		    || object_starts_on_stack(buf))
 			drive->dma = 0;
 	}
 }
diff -uriN linux-2.6.32.43/drivers/ide/ide-floppy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ide/ide-floppy.c
--- linux-2.6.32.43/drivers/ide/ide-floppy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ide/ide-floppy.c	2011-07-15 05:51:11.000000000 -0500
@@ -373,6 +373,8 @@
 	u8 pc_buf[256], header_len, desc_cnt;
 	int i, rc = 1, blocks, length;
 
+	pax_track_stack();
+
 	ide_debug_log(IDE_DBG_FUNC, "enter");
 
 	drive->bios_cyl = 0;
diff -uriN linux-2.6.32.43/drivers/ide/setup-pci.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ide/setup-pci.c
--- linux-2.6.32.43/drivers/ide/setup-pci.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ide/setup-pci.c	2011-07-15 05:51:11.000000000 -0500
@@ -542,6 +542,8 @@
 	int ret, i, n_ports = dev2 ? 4 : 2;
 	struct ide_hw hw[4], *hws[] = { NULL, NULL, NULL, NULL };
 
+	pax_track_stack();
+
 	for (i = 0; i < n_ports / 2; i++) {
 		ret = ide_setup_pci_controller(pdev[i], d, !i);
 		if (ret < 0)
diff -uriN linux-2.6.32.43/drivers/ieee1394/dv1394.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/dv1394.c
--- linux-2.6.32.43/drivers/ieee1394/dv1394.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/dv1394.c	2011-07-15 05:51:11.000000000 -0500
@@ -739,7 +739,7 @@
 	based upon DIF section and sequence
 */
 
-static void inline
+static inline void
 frame_put_packet (struct frame *f, struct packet *p)
 {
 	int section_type = p->data[0] >> 5;           /* section type is in bits 5 - 7 */
diff -uriN linux-2.6.32.43/drivers/ieee1394/hosts.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/hosts.c
--- linux-2.6.32.43/drivers/ieee1394/hosts.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/hosts.c	2011-07-15 05:51:11.000000000 -0500
@@ -78,6 +78,7 @@
 }
 
 static struct hpsb_host_driver dummy_driver = {
+	.name =		   "dummy",
 	.transmit_packet = dummy_transmit_packet,
 	.devctl =	   dummy_devctl,
 	.isoctl =	   dummy_isoctl
diff -uriN linux-2.6.32.43/drivers/ieee1394/init_ohci1394_dma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/init_ohci1394_dma.c
--- linux-2.6.32.43/drivers/ieee1394/init_ohci1394_dma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/init_ohci1394_dma.c	2011-07-15 05:51:11.000000000 -0500
@@ -257,7 +257,7 @@
 			for (func = 0; func < 8; func++) {
 				u32 class = read_pci_config(num,slot,func,
 							PCI_CLASS_REVISION);
-				if ((class == 0xffffffff))
+				if (class == 0xffffffff)
 					continue; /* No device at this func */
 
 				if (class>>8 != PCI_CLASS_SERIAL_FIREWIRE_OHCI)
diff -uriN linux-2.6.32.43/drivers/ieee1394/ohci1394.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/ohci1394.c
--- linux-2.6.32.43/drivers/ieee1394/ohci1394.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/ohci1394.c	2011-07-15 05:51:11.000000000 -0500
@@ -147,9 +147,9 @@
 printk(level "%s: fw-host%d: " fmt "\n" , OHCI1394_DRIVER_NAME, ohci->host->id , ## args)
 
 /* Module Parameters */
-static int phys_dma = 1;
+static int phys_dma;
 module_param(phys_dma, int, 0444);
-MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 1).");
+MODULE_PARM_DESC(phys_dma, "Enable physical DMA (default = 0).");
 
 static void dma_trm_tasklet(unsigned long data);
 static void dma_trm_reset(struct dma_trm_ctx *d);
diff -uriN linux-2.6.32.43/drivers/ieee1394/sbp2.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/sbp2.c
--- linux-2.6.32.43/drivers/ieee1394/sbp2.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/ieee1394/sbp2.c	2011-07-15 05:51:11.000000000 -0500
@@ -2111,7 +2111,7 @@
 MODULE_SUPPORTED_DEVICE(SBP2_DEVICE_NAME);
 MODULE_LICENSE("GPL");
 
-static int sbp2_module_init(void)
+static int __init sbp2_module_init(void)
 {
 	int ret;
 
diff -uriN linux-2.6.32.43/drivers/infiniband/core/cm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/core/cm.c
--- linux-2.6.32.43/drivers/infiniband/core/cm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/core/cm.c	2011-07-15 05:51:11.000000000 -0500
@@ -112,7 +112,7 @@
 
 struct cm_counter_group {
 	struct kobject obj;
-	atomic_long_t counter[CM_ATTR_COUNT];
+	atomic_long_unchecked_t counter[CM_ATTR_COUNT];
 };
 
 struct cm_counter_attribute {
@@ -1386,7 +1386,7 @@
 	struct ib_mad_send_buf *msg = NULL;
 	int ret;
 
-	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 			counter[CM_REQ_COUNTER]);
 
 	/* Quick state check to discard duplicate REQs. */
@@ -1764,7 +1764,7 @@
 	if (!cm_id_priv)
 		return;
 
-	atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+	atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 			counter[CM_REP_COUNTER]);
 	ret = cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg);
 	if (ret)
@@ -1931,7 +1931,7 @@
 	if (cm_id_priv->id.state != IB_CM_REP_SENT &&
 	    cm_id_priv->id.state != IB_CM_MRA_REP_RCVD) {
 		spin_unlock_irq(&cm_id_priv->lock);
-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 				counter[CM_RTU_COUNTER]);
 		goto out;
 	}
@@ -2110,7 +2110,7 @@
 	cm_id_priv = cm_acquire_id(dreq_msg->remote_comm_id,
 				   dreq_msg->local_comm_id);
 	if (!cm_id_priv) {
-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 				counter[CM_DREQ_COUNTER]);
 		cm_issue_drep(work->port, work->mad_recv_wc);
 		return -EINVAL;
@@ -2131,7 +2131,7 @@
 	case IB_CM_MRA_REP_RCVD:
 		break;
 	case IB_CM_TIMEWAIT:
-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 				counter[CM_DREQ_COUNTER]);
 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
 			goto unlock;
@@ -2145,7 +2145,7 @@
 			cm_free_msg(msg);
 		goto deref;
 	case IB_CM_DREQ_RCVD:
-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 				counter[CM_DREQ_COUNTER]);
 		goto unlock;
 	default:
@@ -2501,7 +2501,7 @@
 		    ib_modify_mad(cm_id_priv->av.port->mad_agent,
 				  cm_id_priv->msg, timeout)) {
 			if (cm_id_priv->id.lap_state == IB_CM_MRA_LAP_RCVD)
-				atomic_long_inc(&work->port->
+				atomic_long_inc_unchecked(&work->port->
 						counter_group[CM_RECV_DUPLICATES].
 						counter[CM_MRA_COUNTER]);
 			goto out;
@@ -2510,7 +2510,7 @@
 		break;
 	case IB_CM_MRA_REQ_RCVD:
 	case IB_CM_MRA_REP_RCVD:
-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 				counter[CM_MRA_COUNTER]);
 		/* fall through */
 	default:
@@ -2672,7 +2672,7 @@
 	case IB_CM_LAP_IDLE:
 		break;
 	case IB_CM_MRA_LAP_SENT:
-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 				counter[CM_LAP_COUNTER]);
 		if (cm_alloc_response_msg(work->port, work->mad_recv_wc, &msg))
 			goto unlock;
@@ -2688,7 +2688,7 @@
 			cm_free_msg(msg);
 		goto deref;
 	case IB_CM_LAP_RCVD:
-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 				counter[CM_LAP_COUNTER]);
 		goto unlock;
 	default:
@@ -2972,7 +2972,7 @@
 	cur_cm_id_priv = cm_insert_remote_sidr(cm_id_priv);
 	if (cur_cm_id_priv) {
 		spin_unlock_irq(&cm.lock);
-		atomic_long_inc(&work->port->counter_group[CM_RECV_DUPLICATES].
+		atomic_long_inc_unchecked(&work->port->counter_group[CM_RECV_DUPLICATES].
 				counter[CM_SIDR_REQ_COUNTER]);
 		goto out; /* Duplicate message. */
 	}
@@ -3184,10 +3184,10 @@
 	if (!msg->context[0] && (attr_index != CM_REJ_COUNTER))
 		msg->retries = 1;
 
-	atomic_long_add(1 + msg->retries,
+	atomic_long_add_unchecked(1 + msg->retries,
 			&port->counter_group[CM_XMIT].counter[attr_index]);
 	if (msg->retries)
-		atomic_long_add(msg->retries,
+		atomic_long_add_unchecked(msg->retries,
 				&port->counter_group[CM_XMIT_RETRIES].
 				counter[attr_index]);
 
@@ -3397,7 +3397,7 @@
 	}
 
 	attr_id = be16_to_cpu(mad_recv_wc->recv_buf.mad->mad_hdr.attr_id);
-	atomic_long_inc(&port->counter_group[CM_RECV].
+	atomic_long_inc_unchecked(&port->counter_group[CM_RECV].
 			counter[attr_id - CM_ATTR_ID_OFFSET]);
 
 	work = kmalloc(sizeof *work + sizeof(struct ib_sa_path_rec) * paths,
@@ -3595,10 +3595,10 @@
 	cm_attr = container_of(attr, struct cm_counter_attribute, attr);
 
 	return sprintf(buf, "%ld\n",
-		       atomic_long_read(&group->counter[cm_attr->index]));
+		       atomic_long_read_unchecked(&group->counter[cm_attr->index]));
 }
 
-static struct sysfs_ops cm_counter_ops = {
+static const struct sysfs_ops cm_counter_ops = {
 	.show = cm_show_counter
 };
 
diff -uriN linux-2.6.32.43/drivers/infiniband/core/fmr_pool.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/core/fmr_pool.c
--- linux-2.6.32.43/drivers/infiniband/core/fmr_pool.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/core/fmr_pool.c	2011-07-15 05:51:11.000000000 -0500
@@ -97,8 +97,8 @@
 
 	struct task_struct       *thread;
 
-	atomic_t                  req_ser;
-	atomic_t                  flush_ser;
+	atomic_unchecked_t        req_ser;
+	atomic_unchecked_t        flush_ser;
 
 	wait_queue_head_t         force_wait;
 };
@@ -179,10 +179,10 @@
 	struct ib_fmr_pool *pool = pool_ptr;
 
 	do {
-		if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) < 0) {
+		if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) < 0) {
 			ib_fmr_batch_release(pool);
 
-			atomic_inc(&pool->flush_ser);
+			atomic_inc_unchecked(&pool->flush_ser);
 			wake_up_interruptible(&pool->force_wait);
 
 			if (pool->flush_function)
@@ -190,7 +190,7 @@
 		}
 
 		set_current_state(TASK_INTERRUPTIBLE);
-		if (atomic_read(&pool->flush_ser) - atomic_read(&pool->req_ser) >= 0 &&
+		if (atomic_read_unchecked(&pool->flush_ser) - atomic_read_unchecked(&pool->req_ser) >= 0 &&
 		    !kthread_should_stop())
 			schedule();
 		__set_current_state(TASK_RUNNING);
@@ -282,8 +282,8 @@
 	pool->dirty_watermark = params->dirty_watermark;
 	pool->dirty_len       = 0;
 	spin_lock_init(&pool->pool_lock);
-	atomic_set(&pool->req_ser,   0);
-	atomic_set(&pool->flush_ser, 0);
+	atomic_set_unchecked(&pool->req_ser,   0);
+	atomic_set_unchecked(&pool->flush_ser, 0);
 	init_waitqueue_head(&pool->force_wait);
 
 	pool->thread = kthread_run(ib_fmr_cleanup_thread,
@@ -411,11 +411,11 @@
 	}
 	spin_unlock_irq(&pool->pool_lock);
 
-	serial = atomic_inc_return(&pool->req_ser);
+	serial = atomic_inc_return_unchecked(&pool->req_ser);
 	wake_up_process(pool->thread);
 
 	if (wait_event_interruptible(pool->force_wait,
-				     atomic_read(&pool->flush_ser) - serial >= 0))
+				     atomic_read_unchecked(&pool->flush_ser) - serial >= 0))
 		return -EINTR;
 
 	return 0;
@@ -525,7 +525,7 @@
 		} else {
 			list_add_tail(&fmr->list, &pool->dirty_list);
 			if (++pool->dirty_len >= pool->dirty_watermark) {
-				atomic_inc(&pool->req_ser);
+				atomic_inc_unchecked(&pool->req_ser);
 				wake_up_process(pool->thread);
 			}
 		}
diff -uriN linux-2.6.32.43/drivers/infiniband/core/sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/core/sysfs.c
--- linux-2.6.32.43/drivers/infiniband/core/sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/core/sysfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -79,7 +79,7 @@
 	return port_attr->show(p, port_attr, buf);
 }
 
-static struct sysfs_ops port_sysfs_ops = {
+static const struct sysfs_ops port_sysfs_ops = {
 	.show = port_attr_show
 };
 
diff -uriN linux-2.6.32.43/drivers/infiniband/core/uverbs_marshall.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/core/uverbs_marshall.c
--- linux-2.6.32.43/drivers/infiniband/core/uverbs_marshall.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/core/uverbs_marshall.c	2011-07-15 05:51:11.000000000 -0500
@@ -40,18 +40,21 @@
 	dst->grh.sgid_index        = src->grh.sgid_index;
 	dst->grh.hop_limit         = src->grh.hop_limit;
 	dst->grh.traffic_class     = src->grh.traffic_class;
+	memset(&dst->grh.reserved, 0, sizeof(dst->grh.reserved));
 	dst->dlid 	    	   = src->dlid;
 	dst->sl   	    	   = src->sl;
 	dst->src_path_bits 	   = src->src_path_bits;
 	dst->static_rate   	   = src->static_rate;
 	dst->is_global             = src->ah_flags & IB_AH_GRH ? 1 : 0;
 	dst->port_num 	    	   = src->port_num;
+	dst->reserved		   = 0;
 }
 EXPORT_SYMBOL(ib_copy_ah_attr_to_user);
 
 void ib_copy_qp_attr_to_user(struct ib_uverbs_qp_attr *dst,
 			     struct ib_qp_attr *src)
 {
+	dst->qp_state		= src->qp_state;
 	dst->cur_qp_state	= src->cur_qp_state;
 	dst->path_mtu		= src->path_mtu;
 	dst->path_mig_state	= src->path_mig_state;
@@ -83,6 +86,7 @@
 	dst->rnr_retry		= src->rnr_retry;
 	dst->alt_port_num	= src->alt_port_num;
 	dst->alt_timeout	= src->alt_timeout;
+	memset(dst->reserved, 0, sizeof(dst->reserved));
 }
 EXPORT_SYMBOL(ib_copy_qp_attr_to_user);
 
diff -uriN linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_fs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/ipath/ipath_fs.c
--- linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_fs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/ipath/ipath_fs.c	2011-07-15 05:51:11.000000000 -0500
@@ -110,6 +110,8 @@
 	struct infinipath_counters counters;
 	struct ipath_devdata *dd;
 
+	pax_track_stack();
+
 	dd = file->f_path.dentry->d_inode->i_private;
 	dd->ipath_f_read_counters(dd, &counters);
 
diff -uriN linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_user_pages.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/ipath/ipath_user_pages.c
--- linux-2.6.32.43/drivers/infiniband/hw/ipath/ipath_user_pages.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/ipath/ipath_user_pages.c	2011-07-15 05:50:11.000000000 -0500
@@ -34,6 +34,7 @@
 #include <linux/mm.h>
 #include <linux/device.h>
 #include <linux/sched.h>
+#include <linux/vs_memory.h>
 
 #include "ipath_kernel.h"
 
@@ -62,7 +63,8 @@
 	lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur >>
 		PAGE_SHIFT;
 
-	if (num_pages > lock_limit) {
+	if (num_pages > lock_limit ||
+		!vx_vmlocked_avail(current->mm, num_pages)) {
 		ret = -ENOMEM;
 		goto bail;
 	}
@@ -79,7 +81,7 @@
 			goto bail_release;
 	}
 
-	current->mm->locked_vm += num_pages;
+	vx_vmlocked_add(current->mm, num_pages);
 
 	ret = 0;
 	goto bail;
@@ -178,7 +180,7 @@
 
 	__ipath_release_user_pages(p, num_pages, 1);
 
-	current->mm->locked_vm -= num_pages;
+	vx_vmlocked_sub(current->mm, num_pages);
 
 	up_write(&current->mm->mmap_sem);
 }
@@ -195,7 +197,7 @@
 		container_of(_work, struct ipath_user_pages_work, work);
 
 	down_write(&work->mm->mmap_sem);
-	work->mm->locked_vm -= work->num_pages;
+	vx_vmlocked_sub(work->mm, work->num_pages);
 	up_write(&work->mm->mmap_sem);
 	mmput(work->mm);
 	kfree(work);
diff -uriN linux-2.6.32.43/drivers/infiniband/hw/nes/nes.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes.c
--- linux-2.6.32.43/drivers/infiniband/hw/nes/nes.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes.c	2011-07-15 05:51:11.000000000 -0500
@@ -102,7 +102,7 @@
 LIST_HEAD(nes_adapter_list);
 static LIST_HEAD(nes_dev_list);
 
-atomic_t qps_destroyed;
+atomic_unchecked_t qps_destroyed;
 
 static unsigned int ee_flsh_adapter;
 static unsigned int sysfs_nonidx_addr;
@@ -259,7 +259,7 @@
 	struct nes_adapter *nesadapter = nesdev->nesadapter;
 	u32 qp_id;
 
-	atomic_inc(&qps_destroyed);
+	atomic_inc_unchecked(&qps_destroyed);
 
 	/* Free the control structures */
 
diff -uriN linux-2.6.32.43/drivers/infiniband/hw/nes/nes_cm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes_cm.c
--- linux-2.6.32.43/drivers/infiniband/hw/nes/nes_cm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes_cm.c	2011-07-15 05:51:11.000000000 -0500
@@ -69,11 +69,11 @@
 u32 cm_listens_created;
 u32 cm_listens_destroyed;
 u32 cm_backlog_drops;
-atomic_t cm_loopbacks;
-atomic_t cm_nodes_created;
-atomic_t cm_nodes_destroyed;
-atomic_t cm_accel_dropped_pkts;
-atomic_t cm_resets_recvd;
+atomic_unchecked_t cm_loopbacks;
+atomic_unchecked_t cm_nodes_created;
+atomic_unchecked_t cm_nodes_destroyed;
+atomic_unchecked_t cm_accel_dropped_pkts;
+atomic_unchecked_t cm_resets_recvd;
 
 static inline int mini_cm_accelerated(struct nes_cm_core *,
 	struct nes_cm_node *);
@@ -149,13 +149,13 @@
 
 static struct nes_cm_core *g_cm_core;
 
-atomic_t cm_connects;
-atomic_t cm_accepts;
-atomic_t cm_disconnects;
-atomic_t cm_closes;
-atomic_t cm_connecteds;
-atomic_t cm_connect_reqs;
-atomic_t cm_rejects;
+atomic_unchecked_t cm_connects;
+atomic_unchecked_t cm_accepts;
+atomic_unchecked_t cm_disconnects;
+atomic_unchecked_t cm_closes;
+atomic_unchecked_t cm_connecteds;
+atomic_unchecked_t cm_connect_reqs;
+atomic_unchecked_t cm_rejects;
 
 
 /**
@@ -1195,7 +1195,7 @@
 		  cm_node->rem_mac);
 
 	add_hte_node(cm_core, cm_node);
-	atomic_inc(&cm_nodes_created);
+	atomic_inc_unchecked(&cm_nodes_created);
 
 	return cm_node;
 }
@@ -1253,7 +1253,7 @@
 	}
 
 	atomic_dec(&cm_core->node_cnt);
-	atomic_inc(&cm_nodes_destroyed);
+	atomic_inc_unchecked(&cm_nodes_destroyed);
 	nesqp = cm_node->nesqp;
 	if (nesqp) {
 		nesqp->cm_node = NULL;
@@ -1320,7 +1320,7 @@
 
 static void drop_packet(struct sk_buff *skb)
 {
-	atomic_inc(&cm_accel_dropped_pkts);
+	atomic_inc_unchecked(&cm_accel_dropped_pkts);
 	dev_kfree_skb_any(skb);
 }
 
@@ -1377,7 +1377,7 @@
 
 	int	reset = 0;	/* whether to send reset in case of err.. */
 	int	passive_state;
-	atomic_inc(&cm_resets_recvd);
+	atomic_inc_unchecked(&cm_resets_recvd);
 	nes_debug(NES_DBG_CM, "Received Reset, cm_node = %p, state = %u."
 			" refcnt=%d\n", cm_node, cm_node->state,
 			atomic_read(&cm_node->ref_count));
@@ -2000,7 +2000,7 @@
 				rem_ref_cm_node(cm_node->cm_core, cm_node);
 				return NULL;
 			}
-			atomic_inc(&cm_loopbacks);
+			atomic_inc_unchecked(&cm_loopbacks);
 			loopbackremotenode->loopbackpartner = cm_node;
 			loopbackremotenode->tcp_cntxt.rcv_wscale =
 				NES_CM_DEFAULT_RCV_WND_SCALE;
@@ -2262,7 +2262,7 @@
 			add_ref_cm_node(cm_node);
 		} else if (cm_node->state == NES_CM_STATE_TSA) {
 			rem_ref_cm_node(cm_core, cm_node);
-			atomic_inc(&cm_accel_dropped_pkts);
+			atomic_inc_unchecked(&cm_accel_dropped_pkts);
 			dev_kfree_skb_any(skb);
 			break;
 		}
@@ -2568,7 +2568,7 @@
 
 	if ((cm_id) && (cm_id->event_handler)) {
 		if (issue_disconn) {
-			atomic_inc(&cm_disconnects);
+			atomic_inc_unchecked(&cm_disconnects);
 			cm_event.event = IW_CM_EVENT_DISCONNECT;
 			cm_event.status = disconn_status;
 			cm_event.local_addr = cm_id->local_addr;
@@ -2590,7 +2590,7 @@
 		}
 
 		if (issue_close) {
-			atomic_inc(&cm_closes);
+			atomic_inc_unchecked(&cm_closes);
 			nes_disconnect(nesqp, 1);
 
 			cm_id->provider_data = nesqp;
@@ -2710,7 +2710,7 @@
 
 	nes_debug(NES_DBG_CM, "QP%u, cm_node=%p, jiffies = %lu listener = %p\n",
 		nesqp->hwqp.qp_id, cm_node, jiffies, cm_node->listener);
-	atomic_inc(&cm_accepts);
+	atomic_inc_unchecked(&cm_accepts);
 
 	nes_debug(NES_DBG_CM, "netdev refcnt = %u.\n",
 			atomic_read(&nesvnic->netdev->refcnt));
@@ -2919,7 +2919,7 @@
 
 	struct nes_cm_core *cm_core;
 
-	atomic_inc(&cm_rejects);
+	atomic_inc_unchecked(&cm_rejects);
 	cm_node = (struct nes_cm_node *) cm_id->provider_data;
 	loopback = cm_node->loopbackpartner;
 	cm_core = cm_node->cm_core;
@@ -2982,7 +2982,7 @@
 		ntohl(cm_id->local_addr.sin_addr.s_addr),
 		ntohs(cm_id->local_addr.sin_port));
 
-	atomic_inc(&cm_connects);
+	atomic_inc_unchecked(&cm_connects);
 	nesqp->active_conn = 1;
 
 	/* cache the cm_id in the qp */
@@ -3195,7 +3195,7 @@
 	if (nesqp->destroyed) {
 		return;
 	}
-	atomic_inc(&cm_connecteds);
+	atomic_inc_unchecked(&cm_connecteds);
 	nes_debug(NES_DBG_CM, "QP%u attempting to connect to  0x%08X:0x%04X on"
 			" local port 0x%04X. jiffies = %lu.\n",
 			nesqp->hwqp.qp_id,
@@ -3403,7 +3403,7 @@
 
 	ret = cm_id->event_handler(cm_id, &cm_event);
 	cm_id->add_ref(cm_id);
-	atomic_inc(&cm_closes);
+	atomic_inc_unchecked(&cm_closes);
 	cm_event.event = IW_CM_EVENT_CLOSE;
 	cm_event.status = IW_CM_EVENT_STATUS_OK;
 	cm_event.provider_data = cm_id->provider_data;
@@ -3439,7 +3439,7 @@
 		return;
 	cm_id = cm_node->cm_id;
 
-	atomic_inc(&cm_connect_reqs);
+	atomic_inc_unchecked(&cm_connect_reqs);
 	nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
 			cm_node, cm_id, jiffies);
 
@@ -3477,7 +3477,7 @@
 		return;
 	cm_id = cm_node->cm_id;
 
-	atomic_inc(&cm_connect_reqs);
+	atomic_inc_unchecked(&cm_connect_reqs);
 	nes_debug(NES_DBG_CM, "cm_node = %p - cm_id = %p, jiffies = %lu\n",
 			cm_node, cm_id, jiffies);
 
diff -uriN linux-2.6.32.43/drivers/infiniband/hw/nes/nes.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes.h
--- linux-2.6.32.43/drivers/infiniband/hw/nes/nes.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes.h	2011-07-15 05:51:11.000000000 -0500
@@ -174,17 +174,17 @@
 extern unsigned int wqm_quanta;
 extern struct list_head nes_adapter_list;
 
-extern atomic_t cm_connects;
-extern atomic_t cm_accepts;
-extern atomic_t cm_disconnects;
-extern atomic_t cm_closes;
-extern atomic_t cm_connecteds;
-extern atomic_t cm_connect_reqs;
-extern atomic_t cm_rejects;
-extern atomic_t mod_qp_timouts;
-extern atomic_t qps_created;
-extern atomic_t qps_destroyed;
-extern atomic_t sw_qps_destroyed;
+extern atomic_unchecked_t cm_connects;
+extern atomic_unchecked_t cm_accepts;
+extern atomic_unchecked_t cm_disconnects;
+extern atomic_unchecked_t cm_closes;
+extern atomic_unchecked_t cm_connecteds;
+extern atomic_unchecked_t cm_connect_reqs;
+extern atomic_unchecked_t cm_rejects;
+extern atomic_unchecked_t mod_qp_timouts;
+extern atomic_unchecked_t qps_created;
+extern atomic_unchecked_t qps_destroyed;
+extern atomic_unchecked_t sw_qps_destroyed;
 extern u32 mh_detected;
 extern u32 mh_pauses_sent;
 extern u32 cm_packets_sent;
@@ -196,11 +196,11 @@
 extern u32 cm_listens_created;
 extern u32 cm_listens_destroyed;
 extern u32 cm_backlog_drops;
-extern atomic_t cm_loopbacks;
-extern atomic_t cm_nodes_created;
-extern atomic_t cm_nodes_destroyed;
-extern atomic_t cm_accel_dropped_pkts;
-extern atomic_t cm_resets_recvd;
+extern atomic_unchecked_t cm_loopbacks;
+extern atomic_unchecked_t cm_nodes_created;
+extern atomic_unchecked_t cm_nodes_destroyed;
+extern atomic_unchecked_t cm_accel_dropped_pkts;
+extern atomic_unchecked_t cm_resets_recvd;
 
 extern u32 int_mod_timer_init;
 extern u32 int_mod_cq_depth_256;
diff -uriN linux-2.6.32.43/drivers/infiniband/hw/nes/nes_nic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes_nic.c
--- linux-2.6.32.43/drivers/infiniband/hw/nes/nes_nic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes_nic.c	2011-07-15 05:51:11.000000000 -0500
@@ -1210,17 +1210,17 @@
 	target_stat_values[++index] = mh_detected;
 	target_stat_values[++index] = mh_pauses_sent;
 	target_stat_values[++index] = nesvnic->endnode_ipv4_tcp_retransmits;
-	target_stat_values[++index] = atomic_read(&cm_connects);
-	target_stat_values[++index] = atomic_read(&cm_accepts);
-	target_stat_values[++index] = atomic_read(&cm_disconnects);
-	target_stat_values[++index] = atomic_read(&cm_connecteds);
-	target_stat_values[++index] = atomic_read(&cm_connect_reqs);
-	target_stat_values[++index] = atomic_read(&cm_rejects);
-	target_stat_values[++index] = atomic_read(&mod_qp_timouts);
-	target_stat_values[++index] = atomic_read(&qps_created);
-	target_stat_values[++index] = atomic_read(&sw_qps_destroyed);
-	target_stat_values[++index] = atomic_read(&qps_destroyed);
-	target_stat_values[++index] = atomic_read(&cm_closes);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_connects);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_accepts);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_disconnects);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_connecteds);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_connect_reqs);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_rejects);
+	target_stat_values[++index] = atomic_read_unchecked(&mod_qp_timouts);
+	target_stat_values[++index] = atomic_read_unchecked(&qps_created);
+	target_stat_values[++index] = atomic_read_unchecked(&sw_qps_destroyed);
+	target_stat_values[++index] = atomic_read_unchecked(&qps_destroyed);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_closes);
 	target_stat_values[++index] = cm_packets_sent;
 	target_stat_values[++index] = cm_packets_bounced;
 	target_stat_values[++index] = cm_packets_created;
@@ -1230,11 +1230,11 @@
 	target_stat_values[++index] = cm_listens_created;
 	target_stat_values[++index] = cm_listens_destroyed;
 	target_stat_values[++index] = cm_backlog_drops;
-	target_stat_values[++index] = atomic_read(&cm_loopbacks);
-	target_stat_values[++index] = atomic_read(&cm_nodes_created);
-	target_stat_values[++index] = atomic_read(&cm_nodes_destroyed);
-	target_stat_values[++index] = atomic_read(&cm_accel_dropped_pkts);
-	target_stat_values[++index] = atomic_read(&cm_resets_recvd);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_loopbacks);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_created);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_nodes_destroyed);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_accel_dropped_pkts);
+	target_stat_values[++index] = atomic_read_unchecked(&cm_resets_recvd);
 	target_stat_values[++index] = int_mod_timer_init;
 	target_stat_values[++index] = int_mod_cq_depth_1;
 	target_stat_values[++index] = int_mod_cq_depth_4;
diff -uriN linux-2.6.32.43/drivers/infiniband/hw/nes/nes_verbs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes_verbs.c
--- linux-2.6.32.43/drivers/infiniband/hw/nes/nes_verbs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/infiniband/hw/nes/nes_verbs.c	2011-07-15 05:51:11.000000000 -0500
@@ -45,9 +45,9 @@
 
 #include <rdma/ib_umem.h>
 
-atomic_t mod_qp_timouts;
-atomic_t qps_created;
-atomic_t sw_qps_destroyed;
+atomic_unchecked_t mod_qp_timouts;
+atomic_unchecked_t qps_created;
+atomic_unchecked_t sw_qps_destroyed;
 
 static void nes_unregister_ofa_device(struct nes_ib_device *nesibdev);
 
@@ -1240,7 +1240,7 @@
 	if (init_attr->create_flags)
 		return ERR_PTR(-EINVAL);
 
-	atomic_inc(&qps_created);
+	atomic_inc_unchecked(&qps_created);
 	switch (init_attr->qp_type) {
 		case IB_QPT_RC:
 			if (nes_drv_opt & NES_DRV_OPT_NO_INLINE_DATA) {
@@ -1568,7 +1568,7 @@
 	struct iw_cm_event cm_event;
 	int ret;
 
-	atomic_inc(&sw_qps_destroyed);
+	atomic_inc_unchecked(&sw_qps_destroyed);
 	nesqp->destroyed = 1;
 
 	/* Blow away the connection if it exists. */
diff -uriN linux-2.6.32.43/drivers/input/gameport/gameport.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/gameport/gameport.c
--- linux-2.6.32.43/drivers/input/gameport/gameport.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/gameport/gameport.c	2011-07-15 05:51:11.000000000 -0500
@@ -515,13 +515,13 @@
  */
 static void gameport_init_port(struct gameport *gameport)
 {
-	static atomic_t gameport_no = ATOMIC_INIT(0);
+	static atomic_unchecked_t gameport_no = ATOMIC_INIT(0);
 
 	__module_get(THIS_MODULE);
 
 	mutex_init(&gameport->drv_mutex);
 	device_initialize(&gameport->dev);
-	dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return(&gameport_no) - 1);
+	dev_set_name(&gameport->dev, "gameport%lu", (unsigned long)atomic_inc_return_unchecked(&gameport_no) - 1);
 	gameport->dev.bus = &gameport_bus;
 	gameport->dev.release = gameport_release_port;
 	if (gameport->parent)
diff -uriN linux-2.6.32.43/drivers/input/input.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/input.c
--- linux-2.6.32.43/drivers/input/input.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/input.c	2011-07-15 05:51:11.000000000 -0500
@@ -1558,7 +1558,7 @@
  */
 int input_register_device(struct input_dev *dev)
 {
-	static atomic_t input_no = ATOMIC_INIT(0);
+	static atomic_unchecked_t input_no = ATOMIC_INIT(0);
 	struct input_handler *handler;
 	const char *path;
 	int error;
@@ -1585,7 +1585,7 @@
 		dev->setkeycode = input_default_setkeycode;
 
 	dev_set_name(&dev->dev, "input%ld",
-		     (unsigned long) atomic_inc_return(&input_no) - 1);
+		     (unsigned long) atomic_inc_return_unchecked(&input_no) - 1);
 
 	error = device_add(&dev->dev);
 	if (error)
diff -uriN linux-2.6.32.43/drivers/input/joystick/sidewinder.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/joystick/sidewinder.c
--- linux-2.6.32.43/drivers/input/joystick/sidewinder.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/joystick/sidewinder.c	2011-07-15 05:51:11.000000000 -0500
@@ -30,6 +30,7 @@
 #include <linux/kernel.h>
 #include <linux/module.h>
 #include <linux/slab.h>
+#include <linux/sched.h>
 #include <linux/init.h>
 #include <linux/input.h>
 #include <linux/gameport.h>
@@ -428,6 +429,8 @@
 	unsigned char buf[SW_LENGTH];
 	int i;
 
+	pax_track_stack();
+
 	i = sw_read_packet(sw->gameport, buf, sw->length, 0);
 
 	if (sw->type == SW_ID_3DP && sw->length == 66 && i != 66) {		/* Broken packet, try to fix */
diff -uriN linux-2.6.32.43/drivers/input/joystick/xpad.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/joystick/xpad.c
--- linux-2.6.32.43/drivers/input/joystick/xpad.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/joystick/xpad.c	2011-07-15 05:51:11.000000000 -0500
@@ -621,7 +621,7 @@
 
 static int xpad_led_probe(struct usb_xpad *xpad)
 {
-	static atomic_t led_seq	= ATOMIC_INIT(0);
+	static atomic_unchecked_t led_seq	= ATOMIC_INIT(0);
 	long led_no;
 	struct xpad_led *led;
 	struct led_classdev *led_cdev;
@@ -634,7 +634,7 @@
 	if (!led)
 		return -ENOMEM;
 
-	led_no = (long)atomic_inc_return(&led_seq) - 1;
+	led_no = (long)atomic_inc_return_unchecked(&led_seq) - 1;
 
 	snprintf(led->name, sizeof(led->name), "xpad%ld", led_no);
 	led->xpad = xpad;
diff -uriN linux-2.6.32.43/drivers/input/serio/serio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/serio/serio.c
--- linux-2.6.32.43/drivers/input/serio/serio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/input/serio/serio.c	2011-07-15 05:51:11.000000000 -0500
@@ -527,7 +527,7 @@
  */
 static void serio_init_port(struct serio *serio)
 {
-	static atomic_t serio_no = ATOMIC_INIT(0);
+	static atomic_unchecked_t serio_no = ATOMIC_INIT(0);
 
 	__module_get(THIS_MODULE);
 
@@ -536,7 +536,7 @@
 	mutex_init(&serio->drv_mutex);
 	device_initialize(&serio->dev);
 	dev_set_name(&serio->dev, "serio%ld",
-			(long)atomic_inc_return(&serio_no) - 1);
+			(long)atomic_inc_return_unchecked(&serio_no) - 1);
 	serio->dev.bus = &serio_bus;
 	serio->dev.release = serio_release_port;
 	if (serio->parent) {
diff -uriN linux-2.6.32.43/drivers/isdn/gigaset/common.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/gigaset/common.c
--- linux-2.6.32.43/drivers/isdn/gigaset/common.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/gigaset/common.c	2011-07-15 05:51:11.000000000 -0500
@@ -712,7 +712,7 @@
 	cs->commands_pending = 0;
 	cs->cur_at_seq = 0;
 	cs->gotfwver = -1;
-	cs->open_count = 0;
+	local_set(&cs->open_count, 0);
 	cs->dev = NULL;
 	cs->tty = NULL;
 	cs->tty_dev = NULL;
diff -uriN linux-2.6.32.43/drivers/isdn/gigaset/gigaset.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/gigaset/gigaset.h
--- linux-2.6.32.43/drivers/isdn/gigaset/gigaset.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/gigaset/gigaset.h	2011-07-15 05:51:11.000000000 -0500
@@ -34,6 +34,7 @@
 #include <linux/tty_driver.h>
 #include <linux/list.h>
 #include <asm/atomic.h>
+#include <asm/local.h>
 
 #define GIG_VERSION {0,5,0,0}
 #define GIG_COMPAT  {0,4,0,0}
@@ -446,7 +447,7 @@
 	spinlock_t cmdlock;
 	unsigned curlen, cmdbytes;
 
-	unsigned open_count;
+	local_t open_count;
 	struct tty_struct *tty;
 	struct tasklet_struct if_wake_tasklet;
 	unsigned control_state;
diff -uriN linux-2.6.32.43/drivers/isdn/gigaset/interface.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/gigaset/interface.c
--- linux-2.6.32.43/drivers/isdn/gigaset/interface.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/gigaset/interface.c	2011-07-15 05:51:11.000000000 -0500
@@ -165,9 +165,7 @@
 		return -ERESTARTSYS; // FIXME -EINTR?
 	tty->driver_data = cs;
 
-	++cs->open_count;
-
-	if (cs->open_count == 1) {
+	if (local_inc_return(&cs->open_count) == 1) {
 		spin_lock_irqsave(&cs->lock, flags);
 		cs->tty = tty;
 		spin_unlock_irqrestore(&cs->lock, flags);
@@ -195,10 +193,10 @@
 
 	if (!cs->connected)
 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
-	else if (!cs->open_count)
+	else if (!local_read(&cs->open_count))
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
 	else {
-		if (!--cs->open_count) {
+		if (!local_dec_return(&cs->open_count)) {
 			spin_lock_irqsave(&cs->lock, flags);
 			cs->tty = NULL;
 			spin_unlock_irqrestore(&cs->lock, flags);
@@ -233,7 +231,7 @@
 	if (!cs->connected) {
 		gig_dbg(DEBUG_IF, "not connected");
 		retval = -ENODEV;
-	} else if (!cs->open_count)
+	} else if (!local_read(&cs->open_count))
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
 	else {
 		retval = 0;
@@ -361,7 +359,7 @@
 	if (!cs->connected) {
 		gig_dbg(DEBUG_IF, "not connected");
 		retval = -ENODEV;
-	} else if (!cs->open_count)
+	} else if (!local_read(&cs->open_count))
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
 	else if (cs->mstate != MS_LOCKED) {
 		dev_warn(cs->dev, "can't write to unlocked device\n");
@@ -395,7 +393,7 @@
 	if (!cs->connected) {
 		gig_dbg(DEBUG_IF, "not connected");
 		retval = -ENODEV;
-	} else if (!cs->open_count)
+	} else if (!local_read(&cs->open_count))
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
 	else if (cs->mstate != MS_LOCKED) {
 		dev_warn(cs->dev, "can't write to unlocked device\n");
@@ -425,7 +423,7 @@
 
 	if (!cs->connected)
 		gig_dbg(DEBUG_IF, "not connected");
-	else if (!cs->open_count)
+	else if (!local_read(&cs->open_count))
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
 	else if (cs->mstate != MS_LOCKED)
 		dev_warn(cs->dev, "can't write to unlocked device\n");
@@ -453,7 +451,7 @@
 
 	if (!cs->connected)
 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
-	else if (!cs->open_count)
+	else if (!local_read(&cs->open_count))
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
 	else {
 		//FIXME
@@ -478,7 +476,7 @@
 
 	if (!cs->connected)
 		gig_dbg(DEBUG_IF, "not connected");	/* nothing to do */
-	else if (!cs->open_count)
+	else if (!local_read(&cs->open_count))
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
 	else {
 		//FIXME
@@ -510,7 +508,7 @@
 		goto out;
 	}
 
-	if (!cs->open_count) {
+	if (!local_read(&cs->open_count)) {
 		dev_warn(cs->dev, "%s: device not opened\n", __func__);
 		goto out;
 	}
diff -uriN linux-2.6.32.43/drivers/isdn/hardware/avm/b1.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/avm/b1.c
--- linux-2.6.32.43/drivers/isdn/hardware/avm/b1.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/avm/b1.c	2011-07-15 05:51:11.000000000 -0500
@@ -173,7 +173,7 @@
 	}
 	if (left) {
 		if (t4file->user) {
-			if (copy_from_user(buf, dp, left))
+			if (left > sizeof buf || copy_from_user(buf, dp, left))
 				return -EFAULT;
 		} else {
 			memcpy(buf, dp, left);
@@ -221,7 +221,7 @@
 	}
 	if (left) {
 		if (config->user) {
-			if (copy_from_user(buf, dp, left))
+			if (left > sizeof buf || copy_from_user(buf, dp, left))
 				return -EFAULT;
 		} else {
 			memcpy(buf, dp, left);
diff -uriN linux-2.6.32.43/drivers/isdn/hardware/eicon/capidtmf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/capidtmf.c
--- linux-2.6.32.43/drivers/isdn/hardware/eicon/capidtmf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/capidtmf.c	2011-07-15 05:51:11.000000000 -0500
@@ -498,6 +498,7 @@
   byte goertzel_result_buffer[CAPIDTMF_RECV_TOTAL_FREQUENCY_COUNT];
     short windowed_sample_buffer[CAPIDTMF_RECV_WINDOWED_SAMPLES];
 
+  pax_track_stack();
 
   if (p_state->recv.state & CAPIDTMF_RECV_STATE_DTMF_ACTIVE)
   {
diff -uriN linux-2.6.32.43/drivers/isdn/hardware/eicon/capifunc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/capifunc.c
--- linux-2.6.32.43/drivers/isdn/hardware/eicon/capifunc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/capifunc.c	2011-07-15 05:51:11.000000000 -0500
@@ -1055,6 +1055,8 @@
 	IDI_SYNC_REQ req;
 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
 
+	pax_track_stack();
+
 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
 
 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
diff -uriN linux-2.6.32.43/drivers/isdn/hardware/eicon/diddfunc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/diddfunc.c
--- linux-2.6.32.43/drivers/isdn/hardware/eicon/diddfunc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/diddfunc.c	2011-07-15 05:51:11.000000000 -0500
@@ -54,6 +54,8 @@
 	IDI_SYNC_REQ req;
 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
 
+	pax_track_stack();
+
 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
 
 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
diff -uriN linux-2.6.32.43/drivers/isdn/hardware/eicon/divasfunc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/divasfunc.c
--- linux-2.6.32.43/drivers/isdn/hardware/eicon/divasfunc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/divasfunc.c	2011-07-15 05:51:11.000000000 -0500
@@ -161,6 +161,8 @@
 	IDI_SYNC_REQ req;
 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
 
+	pax_track_stack();
+
 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
 
 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
diff -uriN linux-2.6.32.43/drivers/isdn/hardware/eicon/idifunc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/idifunc.c
--- linux-2.6.32.43/drivers/isdn/hardware/eicon/idifunc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/idifunc.c	2011-07-15 05:51:11.000000000 -0500
@@ -188,6 +188,8 @@
 	IDI_SYNC_REQ req;
 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
 
+	pax_track_stack();
+
 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
 
 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
diff -uriN linux-2.6.32.43/drivers/isdn/hardware/eicon/message.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/message.c
--- linux-2.6.32.43/drivers/isdn/hardware/eicon/message.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/message.c	2011-07-15 05:51:11.000000000 -0500
@@ -4889,6 +4889,8 @@
   dword d;
   word w;
 
+  pax_track_stack();
+
   a = plci->adapter;
   Id = ((word)plci->Id<<8)|a->Id;
   PUT_WORD(&SS_Ind[4],0x0000);
@@ -7484,6 +7486,8 @@
   word j, n, w;
   dword d;
 
+  pax_track_stack();
+
 
   for(i=0;i<8;i++) bp_parms[i].length = 0;
   for(i=0;i<2;i++) global_config[i].length = 0;
@@ -7958,6 +7962,8 @@
   const byte llc3[] = {4,3,2,2,6,6,0};
   const byte header[] = {0,2,3,3,0,0,0};
 
+  pax_track_stack();
+
   for(i=0;i<8;i++) bp_parms[i].length = 0;
   for(i=0;i<6;i++) b2_config_parms[i].length = 0;
   for(i=0;i<5;i++) b3_config_parms[i].length = 0;
@@ -14761,6 +14767,8 @@
   word appl_number_group_type[MAX_APPL];
   PLCI   *auxplci;
 
+  pax_track_stack();
+
   set_group_ind_mask (plci); /* all APPLs within this inc. call are allowed to dial in */
 
   if(!a->group_optimization_enabled)
diff -uriN linux-2.6.32.43/drivers/isdn/hardware/eicon/mntfunc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/mntfunc.c
--- linux-2.6.32.43/drivers/isdn/hardware/eicon/mntfunc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/hardware/eicon/mntfunc.c	2011-07-15 05:51:11.000000000 -0500
@@ -79,6 +79,8 @@
 	IDI_SYNC_REQ req;
 	DESCRIPTOR DIDD_Table[MAX_DESCRIPTORS];
 
+	pax_track_stack();
+
 	DIVA_DIDD_Read(DIDD_Table, sizeof(DIDD_Table));
 
 	for (x = 0; x < MAX_DESCRIPTORS; x++) {
diff -uriN linux-2.6.32.43/drivers/isdn/i4l/isdn_common.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/i4l/isdn_common.c
--- linux-2.6.32.43/drivers/isdn/i4l/isdn_common.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/i4l/isdn_common.c	2011-07-15 05:51:11.000000000 -0500
@@ -1290,6 +1290,8 @@
 	} iocpar;
 	void __user *argp = (void __user *)arg;
 
+	pax_track_stack();
+
 #define name  iocpar.name
 #define bname iocpar.bname
 #define iocts iocpar.iocts
diff -uriN linux-2.6.32.43/drivers/isdn/icn/icn.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/icn/icn.c
--- linux-2.6.32.43/drivers/isdn/icn/icn.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/icn/icn.c	2011-07-15 05:51:11.000000000 -0500
@@ -1044,7 +1044,7 @@
 		if (count > len)
 			count = len;
 		if (user) {
-			if (copy_from_user(msg, buf, count))
+			if (count > sizeof msg || copy_from_user(msg, buf, count))
 				return -EFAULT;
 		} else
 			memcpy(msg, buf, count);
diff -uriN linux-2.6.32.43/drivers/isdn/mISDN/socket.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/mISDN/socket.c
--- linux-2.6.32.43/drivers/isdn/mISDN/socket.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/mISDN/socket.c	2011-07-15 05:51:11.000000000 -0500
@@ -391,6 +391,7 @@
 		if (dev) {
 			struct mISDN_devinfo di;
 
+			memset(&di, 0, sizeof(di));
 			di.id = dev->id;
 			di.Dprotocols = dev->Dprotocols;
 			di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
@@ -671,6 +672,7 @@
 		if (dev) {
 			struct mISDN_devinfo di;
 
+			memset(&di, 0, sizeof(di));
 			di.id = dev->id;
 			di.Dprotocols = dev->Dprotocols;
 			di.Bprotocols = dev->Bprotocols | get_all_Bprotocols();
diff -uriN linux-2.6.32.43/drivers/isdn/sc/interrupt.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/sc/interrupt.c
--- linux-2.6.32.43/drivers/isdn/sc/interrupt.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/isdn/sc/interrupt.c	2011-07-15 05:51:11.000000000 -0500
@@ -112,11 +112,19 @@
 			}
 			else if(callid>=0x0000 && callid<=0x7FFF)
 			{
+				int len;
+
 				pr_debug("%s: Got Incoming Call\n",
 						sc_adapter[card]->devicename);
-				strcpy(setup.phone,&(rcvmsg.msg_data.byte_array[4]));
-				strcpy(setup.eazmsn,
-					sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn);
+				len = strlcpy(setup.phone, &(rcvmsg.msg_data.byte_array[4]),
+						sizeof(setup.phone));
+				if (len >= sizeof(setup.phone))
+					continue;
+				len = strlcpy(setup.eazmsn,
+						sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+						sizeof(setup.eazmsn));
+				if (len >= sizeof(setup.eazmsn))
+					continue;
 				setup.si1 = 7;
 				setup.si2 = 0;
 				setup.plan = 0;
@@ -176,7 +184,9 @@
 		 * Handle a GetMyNumber Rsp
 		 */
 		if (IS_CE_MESSAGE(rcvmsg,Call,0,GetMyNumber)){
-			strcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no-1].dn,rcvmsg.msg_data.byte_array);
+			strlcpy(sc_adapter[card]->channel[rcvmsg.phy_link_no - 1].dn,
+				rcvmsg.msg_data.byte_array,
+				sizeof(rcvmsg.msg_data.byte_array));
 			continue;
 		}
 			
diff -uriN linux-2.6.32.43/drivers/lguest/core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/lguest/core.c
--- linux-2.6.32.43/drivers/lguest/core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/lguest/core.c	2011-07-15 05:51:11.000000000 -0500
@@ -91,9 +91,17 @@
 	 * it's worked so far.  The end address needs +1 because __get_vm_area
 	 * allocates an extra guard page, so we need space for that.
 	 */
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
+				     VM_ALLOC | VM_KERNEXEC, SWITCHER_ADDR, SWITCHER_ADDR
+				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
+#else
 	switcher_vma = __get_vm_area(TOTAL_SWITCHER_PAGES * PAGE_SIZE,
 				     VM_ALLOC, SWITCHER_ADDR, SWITCHER_ADDR
 				     + (TOTAL_SWITCHER_PAGES+1) * PAGE_SIZE);
+#endif
+
 	if (!switcher_vma) {
 		err = -ENOMEM;
 		printk("lguest: could not map switcher pages high\n");
@@ -118,7 +126,7 @@
 	 * Now the Switcher is mapped at the right address, we can't fail!
 	 * Copy in the compiled-in Switcher code (from <arch>_switcher.S).
 	 */
-	memcpy(switcher_vma->addr, start_switcher_text,
+	memcpy(switcher_vma->addr, ktla_ktva(start_switcher_text),
 	       end_switcher_text - start_switcher_text);
 
 	printk(KERN_INFO "lguest: mapped switcher at %p\n",
diff -uriN linux-2.6.32.43/drivers/lguest/x86/core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/lguest/x86/core.c
--- linux-2.6.32.43/drivers/lguest/x86/core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/lguest/x86/core.c	2011-07-15 05:51:11.000000000 -0500
@@ -59,7 +59,7 @@
 /* Offset from where switcher.S was compiled to where we've copied it */
 static unsigned long switcher_offset(void)
 {
-	return SWITCHER_ADDR - (unsigned long)start_switcher_text;
+	return SWITCHER_ADDR - (unsigned long)ktla_ktva(start_switcher_text);
 }
 
 /* This cpu's struct lguest_pages. */
@@ -100,7 +100,13 @@
 	 * These copies are pretty cheap, so we do them unconditionally: */
 	/* Save the current Host top-level page directory.
 	 */
+
+#ifdef CONFIG_PAX_PER_CPU_PGD
+	pages->state.host_cr3 = read_cr3();
+#else
 	pages->state.host_cr3 = __pa(current->mm->pgd);
+#endif
+
 	/*
 	 * Set up the Guest's page tables to see this CPU's pages (and no
 	 * other CPU's pages).
@@ -535,7 +541,7 @@
 	 * compiled-in switcher code and the high-mapped copy we just made.
 	 */
 	for (i = 0; i < IDT_ENTRIES; i++)
-		default_idt_entries[i] += switcher_offset();
+		default_idt_entries[i] = ktla_ktva(default_idt_entries[i]) + switcher_offset();
 
 	/*
 	 * Set up the Switcher's per-cpu areas.
@@ -618,7 +624,7 @@
 	 * it will be undisturbed when we switch.  To change %cs and jump we
 	 * need this structure to feed to Intel's "lcall" instruction.
 	 */
-	lguest_entry.offset = (long)switch_to_guest + switcher_offset();
+	lguest_entry.offset = (long)ktla_ktva(switch_to_guest) + switcher_offset();
 	lguest_entry.segment = LGUEST_CS;
 
 	/*
diff -uriN linux-2.6.32.43/drivers/lguest/x86/switcher_32.S linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/lguest/x86/switcher_32.S
--- linux-2.6.32.43/drivers/lguest/x86/switcher_32.S	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/lguest/x86/switcher_32.S	2011-07-15 05:51:11.000000000 -0500
@@ -87,6 +87,7 @@
 #include <asm/page.h>
 #include <asm/segment.h>
 #include <asm/lguest.h>
+#include <asm/processor-flags.h>
 
 // We mark the start of the code to copy
 // It's placed in .text tho it's never run here
@@ -149,6 +150,13 @@
 	// Changes type when we load it: damn Intel!
 	// For after we switch over our page tables
 	// That entry will be read-only: we'd crash.
+
+#ifdef CONFIG_PAX_KERNEXEC
+	mov	%cr0, %edx
+	xor	$X86_CR0_WP, %edx
+	mov	%edx, %cr0
+#endif
+
 	movl	$(GDT_ENTRY_TSS*8), %edx
 	ltr	%dx
 
@@ -157,9 +165,15 @@
 	// Let's clear it again for our return.
 	// The GDT descriptor of the Host
 	// Points to the table after two "size" bytes
-	movl	(LGUEST_PAGES_host_gdt_desc+2)(%eax), %edx
+	movl	(LGUEST_PAGES_host_gdt_desc+2)(%eax), %eax
 	// Clear "used" from type field (byte 5, bit 2)
-	andb	$0xFD, (GDT_ENTRY_TSS*8 + 5)(%edx)
+	andb	$0xFD, (GDT_ENTRY_TSS*8 + 5)(%eax)
+
+#ifdef CONFIG_PAX_KERNEXEC
+	mov	%cr0, %eax
+	xor	$X86_CR0_WP, %eax
+	mov	%eax, %cr0
+#endif
 
 	// Once our page table's switched, the Guest is live!
 	// The Host fades as we run this final step.
@@ -295,13 +309,12 @@
 	// I consulted gcc, and it gave
 	// These instructions, which I gladly credit:
 	leal	(%edx,%ebx,8), %eax
-	movzwl	(%eax),%edx
-	movl	4(%eax), %eax
-	xorw	%ax, %ax
-	orl	%eax, %edx
+	movl	4(%eax), %edx
+	movw	(%eax), %dx
 	// Now the address of the handler's in %edx
 	// We call it now: its "iret" drops us home.
-	jmp	*%edx
+	ljmp	$__KERNEL_CS, $1f
+1:	jmp	*%edx
 
 // Every interrupt can come to us here
 // But we must truly tell each apart.
diff -uriN linux-2.6.32.43/drivers/macintosh/via-pmu-backlight.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/macintosh/via-pmu-backlight.c
--- linux-2.6.32.43/drivers/macintosh/via-pmu-backlight.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/macintosh/via-pmu-backlight.c	2011-07-15 05:51:11.000000000 -0500
@@ -15,7 +15,7 @@
 
 #define MAX_PMU_LEVEL 0xFF
 
-static struct backlight_ops pmu_backlight_data;
+static const struct backlight_ops pmu_backlight_data;
 static DEFINE_SPINLOCK(pmu_backlight_lock);
 static int sleeping, uses_pmu_bl;
 static u8 bl_curve[FB_BACKLIGHT_LEVELS];
@@ -115,7 +115,7 @@
 	return bd->props.brightness;
 }
 
-static struct backlight_ops pmu_backlight_data = {
+static const struct backlight_ops pmu_backlight_data = {
 	.get_brightness	= pmu_backlight_get_brightness,
 	.update_status	= pmu_backlight_update_status,
 
diff -uriN linux-2.6.32.43/drivers/macintosh/via-pmu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/macintosh/via-pmu.c
--- linux-2.6.32.43/drivers/macintosh/via-pmu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/macintosh/via-pmu.c	2011-07-15 05:51:11.000000000 -0500
@@ -2232,7 +2232,7 @@
 		&& (pmac_call_feature(PMAC_FTR_SLEEP_STATE, NULL, 0, -1) >= 0);
 }
 
-static struct platform_suspend_ops pmu_pm_ops = {
+static const struct platform_suspend_ops pmu_pm_ops = {
 	.enter = powerbook_sleep,
 	.valid = pmu_sleep_valid,
 };
diff -uriN linux-2.6.32.43/drivers/md/dm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm.c
--- linux-2.6.32.43/drivers/md/dm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm.c	2011-07-15 05:51:11.000000000 -0500
@@ -19,6 +19,7 @@
 #include <linux/slab.h>
 #include <linux/idr.h>
 #include <linux/hdreg.h>
+#include <linux/vs_base.h>
 
 #include <trace/events/block.h>
 
@@ -119,6 +120,7 @@
 	rwlock_t map_lock;
 	atomic_t holders;
 	atomic_t open_count;
+	xid_t xid;
 
 	unsigned long flags;
 
@@ -163,9 +165,9 @@
 	/*
 	 * Event handling.
 	 */
-	atomic_t event_nr;
+	atomic_unchecked_t event_nr;
 	wait_queue_head_t eventq;
-	atomic_t uevent_seq;
+	atomic_unchecked_t uevent_seq;
 	struct list_head uevent_list;
 	spinlock_t uevent_lock; /* Protect access to uevent_list */
 
@@ -323,6 +325,7 @@
 static int dm_blk_open(struct block_device *bdev, fmode_t mode)
 {
 	struct mapped_device *md;
+	int ret = -ENXIO;
 
 	spin_lock(&_minor_lock);
 
@@ -331,18 +334,19 @@
 		goto out;
 
 	if (test_bit(DMF_FREEING, &md->flags) ||
-	    test_bit(DMF_DELETING, &md->flags)) {
-		md = NULL;
+	    test_bit(DMF_DELETING, &md->flags))
+		goto out;
+
+	ret = -EACCES;
+	if (!vx_check(md->xid, VS_IDENT|VS_HOSTID))
 		goto out;
-	}
 
 	dm_get(md);
 	atomic_inc(&md->open_count);
-
+	ret = 0;
 out:
 	spin_unlock(&_minor_lock);
-
-	return md ? 0 : -ENXIO;
+	return ret;
 }
 
 static int dm_blk_close(struct gendisk *disk, fmode_t mode)
@@ -553,6 +557,14 @@
 	return 0;
 }
 
+/*
+ * Get the xid associated with a dm device
+ */
+xid_t dm_get_xid(struct mapped_device *md)
+{
+	return md->xid;
+}
+
 /*-----------------------------------------------------------------
  * CRUD START:
  *   A more elegant soln is in the works that uses the queue
@@ -1770,11 +1782,12 @@
 	rwlock_init(&md->map_lock);
 	atomic_set(&md->holders, 1);
 	atomic_set(&md->open_count, 0);
-	atomic_set(&md->event_nr, 0);
-	atomic_set(&md->uevent_seq, 0);
+	atomic_set_unchecked(&md->event_nr, 0);
+	atomic_set_unchecked(&md->uevent_seq, 0);
 	INIT_LIST_HEAD(&md->uevent_list);
 	spin_lock_init(&md->uevent_lock);
 
+	md->xid = vx_current_xid();
 	md->queue = blk_init_queue(dm_request_fn, NULL);
 	if (!md->queue)
 		goto bad_queue;
@@ -1921,7 +1934,7 @@
 
 	dm_send_uevents(&uevents, &disk_to_dev(md->disk)->kobj);
 
-	atomic_inc(&md->event_nr);
+	atomic_inc_unchecked(&md->event_nr);
 	wake_up(&md->eventq);
 }
 
@@ -2556,18 +2569,18 @@
 
 uint32_t dm_next_uevent_seq(struct mapped_device *md)
 {
-	return atomic_add_return(1, &md->uevent_seq);
+	return atomic_add_return_unchecked(1, &md->uevent_seq);
 }
 
 uint32_t dm_get_event_nr(struct mapped_device *md)
 {
-	return atomic_read(&md->event_nr);
+	return atomic_read_unchecked(&md->event_nr);
 }
 
 int dm_wait_event(struct mapped_device *md, int event_nr)
 {
 	return wait_event_interruptible(md->eventq,
-			(event_nr != atomic_read(&md->event_nr)));
+			(event_nr != atomic_read_unchecked(&md->event_nr)));
 }
 
 void dm_uevent_add(struct mapped_device *md, struct list_head *elist)
diff -uriN linux-2.6.32.43/drivers/md/dm.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm.h
--- linux-2.6.32.43/drivers/md/dm.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm.h	2011-07-15 05:50:11.000000000 -0500
@@ -41,6 +41,8 @@
 struct dm_table;
 struct dm_md_mempools;
 
+xid_t dm_get_xid(struct mapped_device *md);
+
 /*-----------------------------------------------------------------
  * Internal table functions.
  *---------------------------------------------------------------*/
diff -uriN linux-2.6.32.43/drivers/md/dm-ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-ioctl.c
--- linux-2.6.32.43/drivers/md/dm-ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-ioctl.c	2011-07-15 05:51:11.000000000 -0500
@@ -16,6 +16,7 @@
 #include <linux/dm-ioctl.h>
 #include <linux/hdreg.h>
 #include <linux/compat.h>
+#include <linux/vs_context.h>
 
 #include <asm/uaccess.h>
 
@@ -106,7 +107,8 @@
 	unsigned int h = hash_str(str);
 
 	list_for_each_entry (hc, _name_buckets + h, name_list)
-		if (!strcmp(hc->name, str)) {
+		if (vx_check(dm_get_xid(hc->md), VS_WATCH_P | VS_IDENT) &&
+			!strcmp(hc->name, str)) {
 			dm_get(hc->md);
 			return hc;
 		}
@@ -120,7 +122,8 @@
 	unsigned int h = hash_str(str);
 
 	list_for_each_entry (hc, _uuid_buckets + h, uuid_list)
-		if (!strcmp(hc->uuid, str)) {
+		if (vx_check(dm_get_xid(hc->md), VS_WATCH_P | VS_IDENT) &&
+			!strcmp(hc->uuid, str)) {
 			dm_get(hc->md);
 			return hc;
 		}
@@ -369,6 +372,9 @@
 
 static int remove_all(struct dm_ioctl *param, size_t param_size)
 {
+	if (!vx_check(0, VS_ADMIN))
+		return -EPERM;
+
 	dm_hash_remove_all(1);
 	param->data_size = 0;
 	return 0;
@@ -416,6 +422,8 @@
 	 */
 	for (i = 0; i < NUM_BUCKETS; i++) {
 		list_for_each_entry (hc, _name_buckets + i, name_list) {
+			if (!vx_check(dm_get_xid(hc->md), VS_WATCH_P | VS_IDENT))
+				continue;
 			needed += sizeof(struct dm_name_list);
 			needed += strlen(hc->name) + 1;
 			needed += ALIGN_MASK;
@@ -439,6 +447,8 @@
 	 */
 	for (i = 0; i < NUM_BUCKETS; i++) {
 		list_for_each_entry (hc, _name_buckets + i, name_list) {
+			if (!vx_check(dm_get_xid(hc->md), VS_WATCH_P | VS_IDENT))
+				continue;
 			if (old_nl)
 				old_nl->next = (uint32_t) ((void *) nl -
 							   (void *) old_nl);
@@ -629,10 +639,11 @@
 	if (!md)
 		goto out;
 
-	mdptr = dm_get_mdptr(md);
+	if (vx_check(dm_get_xid(md), VS_WATCH_P | VS_IDENT))
+		mdptr = dm_get_mdptr(md);
+
 	if (!mdptr)
 		dm_put(md);
-
 out:
 	return mdptr;
 }
@@ -1437,7 +1448,7 @@
 	    cmd == DM_LIST_VERSIONS_CMD)
 		return 0;
 
-	if ((cmd == DM_DEV_CREATE_CMD)) {
+	if (cmd == DM_DEV_CREATE_CMD) {
 		if (!*param->name) {
 			DMWARN("name not supplied when creating device");
 			return -EINVAL;
@@ -1462,8 +1473,8 @@
 	ioctl_fn fn = NULL;
 	size_t param_size;
 
-	/* only root can play with this */
-	if (!capable(CAP_SYS_ADMIN))
+	/* only root and certain contexts can play with this */
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_ADMIN_MAPPER))
 		return -EACCES;
 
 	if (_IOC_TYPE(command) != DM_IOCTL)
diff -uriN linux-2.6.32.43/drivers/md/dm-raid1.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-raid1.c
--- linux-2.6.32.43/drivers/md/dm-raid1.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-raid1.c	2011-07-15 05:51:11.000000000 -0500
@@ -41,7 +41,7 @@
 
 struct mirror {
 	struct mirror_set *ms;
-	atomic_t error_count;
+	atomic_unchecked_t error_count;
 	unsigned long error_type;
 	struct dm_dev *dev;
 	sector_t offset;
@@ -203,7 +203,7 @@
 	 * simple way to tell if a device has encountered
 	 * errors.
 	 */
-	atomic_inc(&m->error_count);
+	atomic_inc_unchecked(&m->error_count);
 
 	if (test_and_set_bit(error_type, &m->error_type))
 		return;
@@ -225,7 +225,7 @@
 	}
 
 	for (new = ms->mirror; new < ms->mirror + ms->nr_mirrors; new++)
-		if (!atomic_read(&new->error_count)) {
+		if (!atomic_read_unchecked(&new->error_count)) {
 			set_default_mirror(new);
 			break;
 		}
@@ -363,7 +363,7 @@
 	struct mirror *m = get_default_mirror(ms);
 
 	do {
-		if (likely(!atomic_read(&m->error_count)))
+		if (likely(!atomic_read_unchecked(&m->error_count)))
 			return m;
 
 		if (m-- == ms->mirror)
@@ -377,7 +377,7 @@
 {
 	struct mirror *default_mirror = get_default_mirror(m->ms);
 
-	return !atomic_read(&default_mirror->error_count);
+	return !atomic_read_unchecked(&default_mirror->error_count);
 }
 
 static int mirror_available(struct mirror_set *ms, struct bio *bio)
@@ -484,7 +484,7 @@
 		 */
 		if (likely(region_in_sync(ms, region, 1)))
 			m = choose_mirror(ms, bio->bi_sector);
-		else if (m && atomic_read(&m->error_count))
+		else if (m && atomic_read_unchecked(&m->error_count))
 			m = NULL;
 
 		if (likely(m))
@@ -855,7 +855,7 @@
 	}
 
 	ms->mirror[mirror].ms = ms;
-	atomic_set(&(ms->mirror[mirror].error_count), 0);
+	atomic_set_unchecked(&(ms->mirror[mirror].error_count), 0);
 	ms->mirror[mirror].error_type = 0;
 	ms->mirror[mirror].offset = offset;
 
@@ -1241,7 +1241,7 @@
  */
 static char device_status_char(struct mirror *m)
 {
-	if (!atomic_read(&(m->error_count)))
+	if (!atomic_read_unchecked(&(m->error_count)))
 		return 'A';
 
 	return (test_bit(DM_RAID1_WRITE_ERROR, &(m->error_type))) ? 'D' :
diff -uriN linux-2.6.32.43/drivers/md/dm-stripe.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-stripe.c
--- linux-2.6.32.43/drivers/md/dm-stripe.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-stripe.c	2011-07-15 05:51:11.000000000 -0500
@@ -20,7 +20,7 @@
 	struct dm_dev *dev;
 	sector_t physical_start;
 
-	atomic_t error_count;
+	atomic_unchecked_t error_count;
 };
 
 struct stripe_c {
@@ -188,7 +188,7 @@
 			kfree(sc);
 			return r;
 		}
-		atomic_set(&(sc->stripe[i].error_count), 0);
+		atomic_set_unchecked(&(sc->stripe[i].error_count), 0);
 	}
 
 	ti->private = sc;
@@ -257,7 +257,7 @@
 		DMEMIT("%d ", sc->stripes);
 		for (i = 0; i < sc->stripes; i++)  {
 			DMEMIT("%s ", sc->stripe[i].dev->name);
-			buffer[i] = atomic_read(&(sc->stripe[i].error_count)) ?
+			buffer[i] = atomic_read_unchecked(&(sc->stripe[i].error_count)) ?
 				'D' : 'A';
 		}
 		buffer[i] = '\0';
@@ -304,8 +304,8 @@
 	 */
 	for (i = 0; i < sc->stripes; i++)
 		if (!strcmp(sc->stripe[i].dev->name, major_minor)) {
-			atomic_inc(&(sc->stripe[i].error_count));
-			if (atomic_read(&(sc->stripe[i].error_count)) <
+			atomic_inc_unchecked(&(sc->stripe[i].error_count));
+			if (atomic_read_unchecked(&(sc->stripe[i].error_count)) <
 			    DM_IO_ERROR_THRESHOLD)
 				queue_work(kstriped, &sc->kstriped_ws);
 		}
diff -uriN linux-2.6.32.43/drivers/md/dm-sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-sysfs.c
--- linux-2.6.32.43/drivers/md/dm-sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-sysfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -75,7 +75,7 @@
 	NULL,
 };
 
-static struct sysfs_ops dm_sysfs_ops = {
+static const struct sysfs_ops dm_sysfs_ops = {
 	.show	= dm_attr_show,
 };
 
diff -uriN linux-2.6.32.43/drivers/md/dm-table.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-table.c
--- linux-2.6.32.43/drivers/md/dm-table.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/dm-table.c	2011-07-15 05:51:11.000000000 -0500
@@ -376,7 +376,7 @@
 	if (!dev_size)
 		return 0;
 
-	if ((start >= dev_size) || (start + len > dev_size)) {
+	if ((start >= dev_size) || (len > dev_size - start)) {
 		DMWARN("%s: %s too small for target: "
 		       "start=%llu, len=%llu, dev_size=%llu",
 		       dm_device_name(ti->table->md), bdevname(bdev, b),
diff -uriN linux-2.6.32.43/drivers/md/md.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/md.c
--- linux-2.6.32.43/drivers/md/md.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/md.c	2011-07-15 05:51:11.000000000 -0500
@@ -153,10 +153,10 @@
  *  start build, activate spare
  */
 static DECLARE_WAIT_QUEUE_HEAD(md_event_waiters);
-static atomic_t md_event_count;
+static atomic_unchecked_t md_event_count;
 void md_new_event(mddev_t *mddev)
 {
-	atomic_inc(&md_event_count);
+	atomic_inc_unchecked(&md_event_count);
 	wake_up(&md_event_waiters);
 }
 EXPORT_SYMBOL_GPL(md_new_event);
@@ -166,7 +166,7 @@
  */
 static void md_new_event_inintr(mddev_t *mddev)
 {
-	atomic_inc(&md_event_count);
+	atomic_inc_unchecked(&md_event_count);
 	wake_up(&md_event_waiters);
 }
 
@@ -1218,7 +1218,7 @@
 
 	rdev->preferred_minor = 0xffff;
 	rdev->data_offset = le64_to_cpu(sb->data_offset);
-	atomic_set(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
+	atomic_set_unchecked(&rdev->corrected_errors, le32_to_cpu(sb->cnt_corrected_read));
 
 	rdev->sb_size = le32_to_cpu(sb->max_dev) * 2 + 256;
 	bmask = queue_logical_block_size(rdev->bdev->bd_disk->queue)-1;
@@ -1392,7 +1392,7 @@
 	else
 		sb->resync_offset = cpu_to_le64(0);
 
-	sb->cnt_corrected_read = cpu_to_le32(atomic_read(&rdev->corrected_errors));
+	sb->cnt_corrected_read = cpu_to_le32(atomic_read_unchecked(&rdev->corrected_errors));
 
 	sb->raid_disks = cpu_to_le32(mddev->raid_disks);
 	sb->size = cpu_to_le64(mddev->dev_sectors);
@@ -2214,7 +2214,7 @@
 static ssize_t
 errors_show(mdk_rdev_t *rdev, char *page)
 {
-	return sprintf(page, "%d\n", atomic_read(&rdev->corrected_errors));
+	return sprintf(page, "%d\n", atomic_read_unchecked(&rdev->corrected_errors));
 }
 
 static ssize_t
@@ -2223,7 +2223,7 @@
 	char *e;
 	unsigned long n = simple_strtoul(buf, &e, 10);
 	if (*buf && (*e == 0 || *e == '\n')) {
-		atomic_set(&rdev->corrected_errors, n);
+		atomic_set_unchecked(&rdev->corrected_errors, n);
 		return len;
 	}
 	return -EINVAL;
@@ -2517,7 +2517,7 @@
 	mdk_rdev_t *rdev = container_of(ko, mdk_rdev_t, kobj);
 	kfree(rdev);
 }
-static struct sysfs_ops rdev_sysfs_ops = {
+static const struct sysfs_ops rdev_sysfs_ops = {
 	.show		= rdev_attr_show,
 	.store		= rdev_attr_store,
 };
@@ -2566,8 +2566,8 @@
 	rdev->data_offset = 0;
 	rdev->sb_events = 0;
 	atomic_set(&rdev->nr_pending, 0);
-	atomic_set(&rdev->read_errors, 0);
-	atomic_set(&rdev->corrected_errors, 0);
+	atomic_set_unchecked(&rdev->read_errors, 0);
+	atomic_set_unchecked(&rdev->corrected_errors, 0);
 
 	size = rdev->bdev->bd_inode->i_size >> BLOCK_SIZE_BITS;
 	if (!size) {
@@ -3887,7 +3887,7 @@
 	kfree(mddev);
 }
 
-static struct sysfs_ops md_sysfs_ops = {
+static const struct sysfs_ops md_sysfs_ops = {
 	.show	= md_attr_show,
 	.store	= md_attr_store,
 };
@@ -4474,7 +4474,8 @@
 	err = 0;
 	blk_integrity_unregister(disk);
 	md_new_event(mddev);
-	sysfs_notify_dirent(mddev->sysfs_state);
+	if (mddev->sysfs_state)
+		sysfs_notify_dirent(mddev->sysfs_state);
 	return err;
 }
 
@@ -5954,7 +5955,7 @@
 
 		spin_unlock(&pers_lock);
 		seq_printf(seq, "\n");
-		mi->event = atomic_read(&md_event_count);
+		mi->event = atomic_read_unchecked(&md_event_count);
 		return 0;
 	}
 	if (v == (void*)2) {
@@ -6043,7 +6044,7 @@
 				chunk_kb ? "KB" : "B");
 			if (bitmap->file) {
 				seq_printf(seq, ", file: ");
-				seq_path(seq, &bitmap->file->f_path, " \t\n");
+				seq_path(seq, &bitmap->file->f_path, " \t\n\\");
 			}
 
 			seq_printf(seq, "\n");
@@ -6077,7 +6078,7 @@
 	else {
 		struct seq_file *p = file->private_data;
 		p->private = mi;
-		mi->event = atomic_read(&md_event_count);
+		mi->event = atomic_read_unchecked(&md_event_count);
 	}
 	return error;
 }
@@ -6093,7 +6094,7 @@
 	/* always allow read */
 	mask = POLLIN | POLLRDNORM;
 
-	if (mi->event != atomic_read(&md_event_count))
+	if (mi->event != atomic_read_unchecked(&md_event_count))
 		mask |= POLLERR | POLLPRI;
 	return mask;
 }
@@ -6137,7 +6138,7 @@
 		struct gendisk *disk = rdev->bdev->bd_contains->bd_disk;
 		curr_events = (int)part_stat_read(&disk->part0, sectors[0]) +
 			      (int)part_stat_read(&disk->part0, sectors[1]) -
-			      atomic_read(&disk->sync_io);
+			      atomic_read_unchecked(&disk->sync_io);
 		/* sync IO will cause sync_io to increase before the disk_stats
 		 * as sync_io is counted when a request starts, and
 		 * disk_stats is counted when it completes.
diff -uriN linux-2.6.32.43/drivers/md/md.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/md.h
--- linux-2.6.32.43/drivers/md/md.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/md.h	2011-07-15 05:51:11.000000000 -0500
@@ -94,10 +94,10 @@
 					 * only maintained for arrays that
 					 * support hot removal
 					 */
-	atomic_t	read_errors;	/* number of consecutive read errors that
+	atomic_unchecked_t	read_errors;	/* number of consecutive read errors that
 					 * we have tried to ignore.
 					 */
-	atomic_t	corrected_errors; /* number of corrected read errors,
+	atomic_unchecked_t	corrected_errors; /* number of corrected read errors,
 					   * for reporting to userspace and storing
 					   * in superblock.
 					   */
@@ -304,7 +304,7 @@
 
 static inline void md_sync_acct(struct block_device *bdev, unsigned long nr_sectors)
 {
-        atomic_add(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
+	atomic_add_unchecked(nr_sectors, &bdev->bd_contains->bd_disk->sync_io);
 }
 
 struct mdk_personality
diff -uriN linux-2.6.32.43/drivers/md/raid10.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/raid10.c
--- linux-2.6.32.43/drivers/md/raid10.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/raid10.c	2011-07-15 05:51:11.000000000 -0500
@@ -1255,7 +1255,7 @@
 	if (test_bit(BIO_UPTODATE, &bio->bi_flags))
 		set_bit(R10BIO_Uptodate, &r10_bio->state);
 	else {
-		atomic_add(r10_bio->sectors,
+		atomic_add_unchecked(r10_bio->sectors,
 			   &conf->mirrors[d].rdev->corrected_errors);
 		if (!test_bit(MD_RECOVERY_SYNC, &conf->mddev->recovery))
 			md_error(r10_bio->mddev,
@@ -1520,7 +1520,7 @@
 			    test_bit(In_sync, &rdev->flags)) {
 				atomic_inc(&rdev->nr_pending);
 				rcu_read_unlock();
-				atomic_add(s, &rdev->corrected_errors);
+				atomic_add_unchecked(s, &rdev->corrected_errors);
 				if (sync_page_io(rdev->bdev,
 						 r10_bio->devs[sl].addr +
 						 sect + rdev->data_offset,
diff -uriN linux-2.6.32.43/drivers/md/raid1.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/raid1.c
--- linux-2.6.32.43/drivers/md/raid1.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/raid1.c	2011-07-15 05:51:11.000000000 -0500
@@ -1415,7 +1415,7 @@
 					if (r1_bio->bios[d]->bi_end_io != end_sync_read)
 						continue;
 					rdev = conf->mirrors[d].rdev;
-					atomic_add(s, &rdev->corrected_errors);
+					atomic_add_unchecked(s, &rdev->corrected_errors);
 					if (sync_page_io(rdev->bdev,
 							 sect + rdev->data_offset,
 							 s<<9,
@@ -1564,7 +1564,7 @@
 					/* Well, this device is dead */
 					md_error(mddev, rdev);
 				else {
-					atomic_add(s, &rdev->corrected_errors);
+					atomic_add_unchecked(s, &rdev->corrected_errors);
 					printk(KERN_INFO
 					       "raid1:%s: read error corrected "
 					       "(%d sectors at %llu on %s)\n",
diff -uriN linux-2.6.32.43/drivers/md/raid5.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/raid5.c
--- linux-2.6.32.43/drivers/md/raid5.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/md/raid5.c	2011-07-15 05:51:11.000000000 -0500
@@ -482,7 +482,7 @@
 			bi->bi_next = NULL;
 			if ((rw & WRITE) &&
 			    test_bit(R5_ReWrite, &sh->dev[i].flags))
-				atomic_add(STRIPE_SECTORS,
+				atomic_add_unchecked(STRIPE_SECTORS,
 					&rdev->corrected_errors);
 			generic_make_request(bi);
 		} else {
@@ -1517,15 +1517,15 @@
 			clear_bit(R5_ReadError, &sh->dev[i].flags);
 			clear_bit(R5_ReWrite, &sh->dev[i].flags);
 		}
-		if (atomic_read(&conf->disks[i].rdev->read_errors))
-			atomic_set(&conf->disks[i].rdev->read_errors, 0);
+		if (atomic_read_unchecked(&conf->disks[i].rdev->read_errors))
+			atomic_set_unchecked(&conf->disks[i].rdev->read_errors, 0);
 	} else {
 		const char *bdn = bdevname(conf->disks[i].rdev->bdev, b);
 		int retry = 0;
 		rdev = conf->disks[i].rdev;
 
 		clear_bit(R5_UPTODATE, &sh->dev[i].flags);
-		atomic_inc(&rdev->read_errors);
+		atomic_inc_unchecked(&rdev->read_errors);
 		if (conf->mddev->degraded >= conf->max_degraded)
 			printk_rl(KERN_WARNING
 				  "raid5:%s: read error not correctable "
@@ -1543,7 +1543,7 @@
 				  (unsigned long long)(sh->sector
 						       + rdev->data_offset),
 				  bdn);
-		else if (atomic_read(&rdev->read_errors)
+		else if (atomic_read_unchecked(&rdev->read_errors)
 			 > conf->max_nr_stripes)
 			printk(KERN_WARNING
 			       "raid5:%s: Too many read errors, failing device %s.\n",
@@ -1870,6 +1870,7 @@
 	sector_t r_sector;
 	struct stripe_head sh2;
 
+	pax_track_stack();
 
 	chunk_offset = sector_div(new_sector, sectors_per_chunk);
 	stripe = new_sector;
diff -uriN linux-2.6.32.43/drivers/media/common/saa7146_hlp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/common/saa7146_hlp.c
--- linux-2.6.32.43/drivers/media/common/saa7146_hlp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/common/saa7146_hlp.c	2011-07-15 05:51:11.000000000 -0500
@@ -353,6 +353,8 @@
 
 	int x[32], y[32], w[32], h[32];
 
+	pax_track_stack();
+
 	/* clear out memory */
 	memset(&line_list[0],  0x00, sizeof(u32)*32);
 	memset(&pixel_list[0], 0x00, sizeof(u32)*32);
diff -uriN linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_ca_en50221.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/dvb/dvb-core/dvb_ca_en50221.c
--- linux-2.6.32.43/drivers/media/dvb/dvb-core/dvb_ca_en50221.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/dvb/dvb-core/dvb_ca_en50221.c	2011-07-15 05:51:11.000000000 -0500
@@ -590,6 +590,8 @@
 	u8 buf[HOST_LINK_BUF_SIZE];
 	int i;
 
+	pax_track_stack();
+
 	dprintk("%s\n", __func__);
 
 	/* check if we have space for a link buf in the rx_buffer */
@@ -1285,6 +1287,8 @@
 	unsigned long timeout;
 	int written;
 
+	pax_track_stack();
+
 	dprintk("%s\n", __func__);
 
 	/* Incoming packet has a 2 byte header. hdr[0] = slot_id, hdr[1] = connection_id */
diff -uriN linux-2.6.32.43/drivers/media/dvb/dvb-core/dvbdev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/dvb/dvb-core/dvbdev.c
--- linux-2.6.32.43/drivers/media/dvb/dvb-core/dvbdev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/dvb/dvb-core/dvbdev.c	2011-07-15 05:51:11.000000000 -0500
@@ -191,6 +191,7 @@
 			const struct dvb_device *template, void *priv, int type)
 {
 	struct dvb_device *dvbdev;
+	/* cannot be const */
 	struct file_operations *dvbdevfops;
 	struct device *clsdev;
 	int minor;
diff -uriN linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/dvb/dvb-usb/dib0700_core.c
--- linux-2.6.32.43/drivers/media/dvb/dvb-usb/dib0700_core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/dvb/dvb-usb/dib0700_core.c	2011-07-15 05:51:11.000000000 -0500
@@ -332,6 +332,8 @@
 
 	u8 buf[260];
 
+	pax_track_stack();
+
 	while ((ret = dvb_usb_get_hexline(fw, &hx, &pos)) > 0) {
 		deb_fwdata("writing to address 0x%08x (buffer: 0x%02x %02x)\n",hx.addr, hx.len, hx.chk);
 
diff -uriN linux-2.6.32.43/drivers/media/dvb/frontends/or51211.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/dvb/frontends/or51211.c
--- linux-2.6.32.43/drivers/media/dvb/frontends/or51211.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/dvb/frontends/or51211.c	2011-07-15 05:51:11.000000000 -0500
@@ -113,6 +113,8 @@
 	u8 tudata[585];
 	int i;
 
+	pax_track_stack();
+
 	dprintk("Firmware is %zd bytes\n",fw->size);
 
 	/* Get eprom data */
diff -uriN linux-2.6.32.43/drivers/media/radio/radio-cadet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/radio/radio-cadet.c
--- linux-2.6.32.43/drivers/media/radio/radio-cadet.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/radio/radio-cadet.c	2011-07-15 05:51:11.000000000 -0500
@@ -347,7 +347,7 @@
 	while (i < count && dev->rdsin != dev->rdsout)
 		readbuf[i++] = dev->rdsbuf[dev->rdsout++];
 
-	if (copy_to_user(data, readbuf, i))
+	if (i > sizeof readbuf || copy_to_user(data, readbuf, i))
 		return -EFAULT;
 	return i;
 }
diff -uriN linux-2.6.32.43/drivers/media/video/cx18/cx18-driver.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/cx18/cx18-driver.c
--- linux-2.6.32.43/drivers/media/video/cx18/cx18-driver.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/cx18/cx18-driver.c	2011-07-15 05:51:11.000000000 -0500
@@ -56,7 +56,7 @@
 
 MODULE_DEVICE_TABLE(pci, cx18_pci_tbl);
 
-static atomic_t cx18_instance = ATOMIC_INIT(0);
+static atomic_unchecked_t cx18_instance = ATOMIC_INIT(0);
 
 /* Parameter declarations */
 static int cardtype[CX18_MAX_CARDS];
@@ -288,6 +288,8 @@
 	struct i2c_client c;
 	u8 eedata[256];
 
+	pax_track_stack();
+
 	memset(&c, 0, sizeof(c));
 	strlcpy(c.name, "cx18 tveeprom tmp", sizeof(c.name));
 	c.adapter = &cx->i2c_adap[0];
@@ -800,7 +802,7 @@
 	struct cx18 *cx;
 
 	/* FIXME - module parameter arrays constrain max instances */
-	i = atomic_inc_return(&cx18_instance) - 1;
+	i = atomic_inc_return_unchecked(&cx18_instance) - 1;
 	if (i >= CX18_MAX_CARDS) {
 		printk(KERN_ERR "cx18: cannot manage card %d, driver has a "
 		       "limit of 0 - %d\n", i, CX18_MAX_CARDS - 1);
diff -uriN linux-2.6.32.43/drivers/media/video/ivtv/ivtv-driver.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/ivtv/ivtv-driver.c
--- linux-2.6.32.43/drivers/media/video/ivtv/ivtv-driver.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/ivtv/ivtv-driver.c	2011-07-15 05:51:11.000000000 -0500
@@ -79,7 +79,7 @@
 MODULE_DEVICE_TABLE(pci,ivtv_pci_tbl);
 
 /* ivtv instance counter */
-static atomic_t ivtv_instance = ATOMIC_INIT(0);
+static atomic_unchecked_t ivtv_instance = ATOMIC_INIT(0);
 
 /* Parameter declarations */
 static int cardtype[IVTV_MAX_CARDS];
diff -uriN linux-2.6.32.43/drivers/media/video/omap24xxcam.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/omap24xxcam.c
--- linux-2.6.32.43/drivers/media/video/omap24xxcam.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/omap24xxcam.c	2011-07-15 05:51:11.000000000 -0500
@@ -401,7 +401,7 @@
 	spin_unlock_irqrestore(&cam->core_enable_disable_lock, flags);
 
 	do_gettimeofday(&vb->ts);
-	vb->field_count = atomic_add_return(2, &fh->field_count);
+	vb->field_count = atomic_add_return_unchecked(2, &fh->field_count);
 	if (csr & csr_error) {
 		vb->state = VIDEOBUF_ERROR;
 		if (!atomic_read(&fh->cam->in_reset)) {
diff -uriN linux-2.6.32.43/drivers/media/video/omap24xxcam.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/omap24xxcam.h
--- linux-2.6.32.43/drivers/media/video/omap24xxcam.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/omap24xxcam.h	2011-07-15 05:51:11.000000000 -0500
@@ -533,7 +533,7 @@
 	spinlock_t vbq_lock; /* spinlock for the videobuf queue */
 	struct videobuf_queue vbq;
 	struct v4l2_pix_format pix; /* serialise pix by vbq->lock */
-	atomic_t field_count; /* field counter for videobuf_buffer */
+	atomic_unchecked_t field_count; /* field counter for videobuf_buffer */
 	/* accessing cam here doesn't need serialisation: it's constant */
 	struct omap24xxcam_device *cam;
 };
diff -uriN linux-2.6.32.43/drivers/media/video/pvrusb2/pvrusb2-eeprom.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/pvrusb2/pvrusb2-eeprom.c
--- linux-2.6.32.43/drivers/media/video/pvrusb2/pvrusb2-eeprom.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/pvrusb2/pvrusb2-eeprom.c	2011-07-15 05:51:11.000000000 -0500
@@ -119,6 +119,8 @@
 	u8 *eeprom;
 	struct tveeprom tvdata;
 
+	pax_track_stack();
+
 	memset(&tvdata,0,sizeof(tvdata));
 
 	eeprom = pvr2_eeprom_fetch(hdw);
diff -uriN linux-2.6.32.43/drivers/media/video/saa7134/saa6752hs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/saa7134/saa6752hs.c
--- linux-2.6.32.43/drivers/media/video/saa7134/saa6752hs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/saa7134/saa6752hs.c	2011-07-15 05:51:11.000000000 -0500
@@ -683,6 +683,8 @@
 	unsigned char localPAT[256];
 	unsigned char localPMT[256];
 
+	pax_track_stack();
+
 	/* Set video format - must be done first as it resets other settings */
 	set_reg8(client, 0x41, h->video_format);
 
diff -uriN linux-2.6.32.43/drivers/media/video/saa7164/saa7164-cmd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/saa7164/saa7164-cmd.c
--- linux-2.6.32.43/drivers/media/video/saa7164/saa7164-cmd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/saa7164/saa7164-cmd.c	2011-07-15 05:51:11.000000000 -0500
@@ -87,6 +87,8 @@
 	wait_queue_head_t *q = 0;
 	dprintk(DBGLVL_CMD, "%s()\n", __func__);
 
+	pax_track_stack();
+
 	/* While any outstand message on the bus exists... */
 	do {
 
@@ -126,6 +128,8 @@
 	u8 tmp[512];
 	dprintk(DBGLVL_CMD, "%s()\n", __func__);
 
+	pax_track_stack();
+
 	while (loop) {
 
 		tmComResInfo_t tRsp = { 0, 0, 0, 0, 0, 0 };
diff -uriN linux-2.6.32.43/drivers/media/video/usbvideo/konicawc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/usbvideo/konicawc.c
--- linux-2.6.32.43/drivers/media/video/usbvideo/konicawc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/usbvideo/konicawc.c	2011-07-15 05:51:11.000000000 -0500
@@ -225,7 +225,7 @@
 	int error;
 
 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
 
 	cam->input = input_dev = input_allocate_device();
 	if (!input_dev) {
diff -uriN linux-2.6.32.43/drivers/media/video/usbvideo/quickcam_messenger.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/usbvideo/quickcam_messenger.c
--- linux-2.6.32.43/drivers/media/video/usbvideo/quickcam_messenger.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/usbvideo/quickcam_messenger.c	2011-07-15 05:51:11.000000000 -0500
@@ -89,7 +89,7 @@
 	int error;
 
 	usb_make_path(dev, cam->input_physname, sizeof(cam->input_physname));
-	strncat(cam->input_physname, "/input0", sizeof(cam->input_physname));
+	strlcat(cam->input_physname, "/input0", sizeof(cam->input_physname));
 
 	cam->input = input_dev = input_allocate_device();
 	if (!input_dev) {
diff -uriN linux-2.6.32.43/drivers/media/video/usbvision/usbvision-core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/usbvision/usbvision-core.c
--- linux-2.6.32.43/drivers/media/video/usbvision/usbvision-core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/usbvision/usbvision-core.c	2011-07-15 05:51:11.000000000 -0500
@@ -820,6 +820,8 @@
 	unsigned char rv, gv, bv;
 	static unsigned char *Y, *U, *V;
 
+	pax_track_stack();
+
 	frame  = usbvision->curFrame;
 	imageSize = frame->frmwidth * frame->frmheight;
 	if ( (frame->v4l2_format.format == V4L2_PIX_FMT_YUV422P) ||
diff -uriN linux-2.6.32.43/drivers/media/video/v4l2-device.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/v4l2-device.c
--- linux-2.6.32.43/drivers/media/video/v4l2-device.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/v4l2-device.c	2011-07-15 05:51:11.000000000 -0500
@@ -50,9 +50,9 @@
 EXPORT_SYMBOL_GPL(v4l2_device_register);
 
 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
-						atomic_t *instance)
+						atomic_unchecked_t *instance)
 {
-	int num = atomic_inc_return(instance) - 1;
+	int num = atomic_inc_return_unchecked(instance) - 1;
 	int len = strlen(basename);
 
 	if (basename[len - 1] >= '0' && basename[len - 1] <= '9')
diff -uriN linux-2.6.32.43/drivers/media/video/videobuf-dma-sg.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/videobuf-dma-sg.c
--- linux-2.6.32.43/drivers/media/video/videobuf-dma-sg.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/media/video/videobuf-dma-sg.c	2011-07-15 05:51:11.000000000 -0500
@@ -693,6 +693,8 @@
 {
 	struct videobuf_queue q;
 
+	pax_track_stack();
+
 	/* Required to make generic handler to call __videobuf_alloc */
 	q.int_ops = &sg_ops;
 
diff -uriN linux-2.6.32.43/drivers/message/fusion/mptbase.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/fusion/mptbase.c
--- linux-2.6.32.43/drivers/message/fusion/mptbase.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/fusion/mptbase.c	2011-07-15 05:51:11.000000000 -0500
@@ -6709,8 +6709,14 @@
 	len += sprintf(buf+len, "  MaxChainDepth = 0x%02x frames\n", ioc->facts.MaxChainDepth);
 	len += sprintf(buf+len, "  MinBlockSize = 0x%02x bytes\n", 4*ioc->facts.BlockSize);
 
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	len += sprintf(buf+len, "  RequestFrames @ 0x%p (Dma @ 0x%p)\n",
+					NULL, NULL);
+#else
 	len += sprintf(buf+len, "  RequestFrames @ 0x%p (Dma @ 0x%p)\n",
 					(void *)ioc->req_frames, (void *)(ulong)ioc->req_frames_dma);
+#endif
+
 	/*
 	 *  Rounding UP to nearest 4-kB boundary here...
 	 */
diff -uriN linux-2.6.32.43/drivers/message/fusion/mptsas.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/fusion/mptsas.c
--- linux-2.6.32.43/drivers/message/fusion/mptsas.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/fusion/mptsas.c	2011-07-15 05:51:11.000000000 -0500
@@ -436,6 +436,23 @@
 		return 0;
 }
 
+static inline void
+mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
+{
+	if (phy_info->port_details) {
+		phy_info->port_details->rphy = rphy;
+		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
+		    ioc->name, rphy));
+	}
+
+	if (rphy) {
+		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
+		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
+		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
+		    ioc->name, rphy, rphy->dev.release));
+	}
+}
+
 /* no mutex */
 static void
 mptsas_port_delete(MPT_ADAPTER *ioc, struct mptsas_portinfo_details * port_details)
@@ -474,23 +491,6 @@
 		return NULL;
 }
 
-static inline void
-mptsas_set_rphy(MPT_ADAPTER *ioc, struct mptsas_phyinfo *phy_info, struct sas_rphy *rphy)
-{
-	if (phy_info->port_details) {
-		phy_info->port_details->rphy = rphy;
-		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "sas_rphy_add: rphy=%p\n",
-		    ioc->name, rphy));
-	}
-
-	if (rphy) {
-		dsaswideprintk(ioc, dev_printk(KERN_DEBUG,
-		    &rphy->dev, MYIOC_s_FMT "add:", ioc->name));
-		dsaswideprintk(ioc, printk(MYIOC_s_DEBUG_FMT "rphy=%p release=%p\n",
-		    ioc->name, rphy, rphy->dev.release));
-	}
-}
-
 static inline struct sas_port *
 mptsas_get_port(struct mptsas_phyinfo *phy_info)
 {
diff -uriN linux-2.6.32.43/drivers/message/fusion/mptscsih.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/fusion/mptscsih.c
--- linux-2.6.32.43/drivers/message/fusion/mptscsih.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/fusion/mptscsih.c	2011-07-15 05:51:11.000000000 -0500
@@ -1248,15 +1248,16 @@
 
 	h = shost_priv(SChost);
 
-	if (h) {
-		if (h->info_kbuf == NULL)
-			if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
-				return h->info_kbuf;
-		h->info_kbuf[0] = '\0';
+	if (!h)
+		return NULL;
 
-		mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
-		h->info_kbuf[size-1] = '\0';
-	}
+	if (h->info_kbuf == NULL)
+		if ((h->info_kbuf = kmalloc(0x1000 /* 4Kb */, GFP_KERNEL)) == NULL)
+			return h->info_kbuf;
+	h->info_kbuf[0] = '\0';
+
+	mpt_print_ioc_summary(h->ioc, h->info_kbuf, &size, 0, 0);
+	h->info_kbuf[size-1] = '\0';
 
 	return h->info_kbuf;
 }
diff -uriN linux-2.6.32.43/drivers/message/i2o/i2o_config.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/i2o/i2o_config.c
--- linux-2.6.32.43/drivers/message/i2o/i2o_config.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/i2o/i2o_config.c	2011-07-15 05:51:11.000000000 -0500
@@ -787,6 +787,8 @@
 	struct i2o_message *msg;
 	unsigned int iop;
 
+	pax_track_stack();
+
 	if (get_user(iop, &cmd->iop) || get_user(user_msg, &cmd->msg))
 		return -EFAULT;
 
diff -uriN linux-2.6.32.43/drivers/message/i2o/i2o_proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/i2o/i2o_proc.c
--- linux-2.6.32.43/drivers/message/i2o/i2o_proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/i2o/i2o_proc.c	2011-07-15 05:51:11.000000000 -0500
@@ -259,13 +259,6 @@
 	"Array Controller Device"
 };
 
-static char *chtostr(u8 * chars, int n)
-{
-	char tmp[256];
-	tmp[0] = 0;
-	return strncat(tmp, (char *)chars, n);
-}
-
 static int i2o_report_query_status(struct seq_file *seq, int block_status,
 				   char *group)
 {
@@ -842,8 +835,7 @@
 
 		seq_printf(seq, "%-#7x", ddm_table.i2o_vendor_id);
 		seq_printf(seq, "%-#8x", ddm_table.module_id);
-		seq_printf(seq, "%-29s",
-			   chtostr(ddm_table.module_name_version, 28));
+		seq_printf(seq, "%-.28s", ddm_table.module_name_version);
 		seq_printf(seq, "%9d  ", ddm_table.data_size);
 		seq_printf(seq, "%8d", ddm_table.code_size);
 
@@ -944,8 +936,8 @@
 
 		seq_printf(seq, "%-#7x", dst->i2o_vendor_id);
 		seq_printf(seq, "%-#8x", dst->module_id);
-		seq_printf(seq, "%-29s", chtostr(dst->module_name_version, 28));
-		seq_printf(seq, "%-9s", chtostr(dst->date, 8));
+		seq_printf(seq, "%-.28s", dst->module_name_version);
+		seq_printf(seq, "%-.8s", dst->date);
 		seq_printf(seq, "%8d ", dst->module_size);
 		seq_printf(seq, "%8d ", dst->mpb_size);
 		seq_printf(seq, "0x%04x", dst->module_flags);
@@ -1276,14 +1268,10 @@
 	seq_printf(seq, "Device Class  : %s\n", i2o_get_class_name(work16[0]));
 	seq_printf(seq, "Owner TID     : %0#5x\n", work16[2]);
 	seq_printf(seq, "Parent TID    : %0#5x\n", work16[3]);
-	seq_printf(seq, "Vendor info   : %s\n",
-		   chtostr((u8 *) (work32 + 2), 16));
-	seq_printf(seq, "Product info  : %s\n",
-		   chtostr((u8 *) (work32 + 6), 16));
-	seq_printf(seq, "Description   : %s\n",
-		   chtostr((u8 *) (work32 + 10), 16));
-	seq_printf(seq, "Product rev.  : %s\n",
-		   chtostr((u8 *) (work32 + 14), 8));
+	seq_printf(seq, "Vendor info   : %.16s\n", (u8 *) (work32 + 2));
+	seq_printf(seq, "Product info  : %.16s\n", (u8 *) (work32 + 6));
+	seq_printf(seq, "Description   : %.16s\n", (u8 *) (work32 + 10));
+	seq_printf(seq, "Product rev.  : %.8s\n", (u8 *) (work32 + 14));
 
 	seq_printf(seq, "Serial number : ");
 	print_serial_number(seq, (u8 *) (work32 + 16),
@@ -1328,10 +1316,8 @@
 	}
 
 	seq_printf(seq, "Registering DDM TID : 0x%03x\n", result.ddm_tid);
-	seq_printf(seq, "Module name         : %s\n",
-		   chtostr(result.module_name, 24));
-	seq_printf(seq, "Module revision     : %s\n",
-		   chtostr(result.module_rev, 8));
+	seq_printf(seq, "Module name         : %.24s\n", result.module_name);
+	seq_printf(seq, "Module revision     : %.8s\n", result.module_rev);
 
 	seq_printf(seq, "Serial number       : ");
 	print_serial_number(seq, result.serial_number, sizeof(result) - 36);
@@ -1362,14 +1348,10 @@
 		return 0;
 	}
 
-	seq_printf(seq, "Device name     : %s\n",
-		   chtostr(result.device_name, 64));
-	seq_printf(seq, "Service name    : %s\n",
-		   chtostr(result.service_name, 64));
-	seq_printf(seq, "Physical name   : %s\n",
-		   chtostr(result.physical_location, 64));
-	seq_printf(seq, "Instance number : %s\n",
-		   chtostr(result.instance_number, 4));
+	seq_printf(seq, "Device name     : %.64s\n", result.device_name);
+	seq_printf(seq, "Service name    : %.64s\n", result.service_name);
+	seq_printf(seq, "Physical name   : %.64s\n", result.physical_location);
+	seq_printf(seq, "Instance number : %.4s\n", result.instance_number);
 
 	return 0;
 }
diff -uriN linux-2.6.32.43/drivers/message/i2o/iop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/i2o/iop.c
--- linux-2.6.32.43/drivers/message/i2o/iop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/message/i2o/iop.c	2011-07-15 05:51:11.000000000 -0500
@@ -110,10 +110,10 @@
 
 	spin_lock_irqsave(&c->context_list_lock, flags);
 
-	if (unlikely(atomic_inc_and_test(&c->context_list_counter)))
-		atomic_inc(&c->context_list_counter);
+	if (unlikely(atomic_inc_and_test_unchecked(&c->context_list_counter)))
+		atomic_inc_unchecked(&c->context_list_counter);
 
-	entry->context = atomic_read(&c->context_list_counter);
+	entry->context = atomic_read_unchecked(&c->context_list_counter);
 
 	list_add(&entry->list, &c->context_list);
 
@@ -1076,7 +1076,7 @@
 
 #if BITS_PER_LONG == 64
 	spin_lock_init(&c->context_list_lock);
-	atomic_set(&c->context_list_counter, 0);
+	atomic_set_unchecked(&c->context_list_counter, 0);
 	INIT_LIST_HEAD(&c->context_list);
 #endif
 
diff -uriN linux-2.6.32.43/drivers/mfd/wm8350-i2c.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mfd/wm8350-i2c.c
--- linux-2.6.32.43/drivers/mfd/wm8350-i2c.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mfd/wm8350-i2c.c	2011-07-15 05:51:11.000000000 -0500
@@ -43,6 +43,8 @@
 	u8 msg[(WM8350_MAX_REGISTER << 1) + 1];
 	int ret;
 
+	pax_track_stack();
+
 	if (bytes > ((WM8350_MAX_REGISTER << 1) + 1))
 		return -EINVAL;
 
diff -uriN linux-2.6.32.43/drivers/misc/kgdbts.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/misc/kgdbts.c
--- linux-2.6.32.43/drivers/misc/kgdbts.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/misc/kgdbts.c	2011-07-15 05:51:11.000000000 -0500
@@ -118,7 +118,7 @@
 	} while (0)
 #define MAX_CONFIG_LEN		40
 
-static struct kgdb_io kgdbts_io_ops;
+static const struct kgdb_io kgdbts_io_ops;
 static char get_buf[BUFMAX];
 static int get_buf_cnt;
 static char put_buf[BUFMAX];
@@ -1102,7 +1102,7 @@
 		module_put(THIS_MODULE);
 }
 
-static struct kgdb_io kgdbts_io_ops = {
+static const struct kgdb_io kgdbts_io_ops = {
 	.name			= "kgdbts",
 	.read_char		= kgdbts_get_char,
 	.write_char		= kgdbts_put_char,
diff -uriN linux-2.6.32.43/drivers/misc/sgi-gru/gruhandles.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/misc/sgi-gru/gruhandles.c
--- linux-2.6.32.43/drivers/misc/sgi-gru/gruhandles.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/misc/sgi-gru/gruhandles.c	2011-07-15 05:51:11.000000000 -0500
@@ -39,8 +39,8 @@
 
 static void update_mcs_stats(enum mcs_op op, unsigned long clks)
 {
-	atomic_long_inc(&mcs_op_statistics[op].count);
-	atomic_long_add(clks, &mcs_op_statistics[op].total);
+	atomic_long_inc_unchecked(&mcs_op_statistics[op].count);
+	atomic_long_add_unchecked(clks, &mcs_op_statistics[op].total);
 	if (mcs_op_statistics[op].max < clks)
 		mcs_op_statistics[op].max = clks;
 }
diff -uriN linux-2.6.32.43/drivers/misc/sgi-gru/gruprocfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/misc/sgi-gru/gruprocfs.c
--- linux-2.6.32.43/drivers/misc/sgi-gru/gruprocfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/misc/sgi-gru/gruprocfs.c	2011-07-15 05:51:11.000000000 -0500
@@ -32,9 +32,9 @@
 
 #define printstat(s, f)		printstat_val(s, &gru_stats.f, #f)
 
-static void printstat_val(struct seq_file *s, atomic_long_t *v, char *id)
+static void printstat_val(struct seq_file *s, atomic_long_unchecked_t *v, char *id)
 {
-	unsigned long val = atomic_long_read(v);
+	unsigned long val = atomic_long_read_unchecked(v);
 
 	if (val)
 		seq_printf(s, "%16lu %s\n", val, id);
@@ -136,8 +136,8 @@
 		"cch_interrupt_sync", "cch_deallocate", "tgh_invalidate"};
 
 	for (op = 0; op < mcsop_last; op++) {
-		count = atomic_long_read(&mcs_op_statistics[op].count);
-		total = atomic_long_read(&mcs_op_statistics[op].total);
+		count = atomic_long_read_unchecked(&mcs_op_statistics[op].count);
+		total = atomic_long_read_unchecked(&mcs_op_statistics[op].total);
 		max = mcs_op_statistics[op].max;
 		seq_printf(s, "%-20s%12ld%12ld%12ld\n", id[op], count,
 			   count ? total / count : 0, max);
diff -uriN linux-2.6.32.43/drivers/misc/sgi-gru/grutables.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/misc/sgi-gru/grutables.h
--- linux-2.6.32.43/drivers/misc/sgi-gru/grutables.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/misc/sgi-gru/grutables.h	2011-07-15 05:51:11.000000000 -0500
@@ -167,84 +167,84 @@
  * GRU statistics.
  */
 struct gru_stats_s {
-	atomic_long_t vdata_alloc;
-	atomic_long_t vdata_free;
-	atomic_long_t gts_alloc;
-	atomic_long_t gts_free;
-	atomic_long_t vdata_double_alloc;
-	atomic_long_t gts_double_allocate;
-	atomic_long_t assign_context;
-	atomic_long_t assign_context_failed;
-	atomic_long_t free_context;
-	atomic_long_t load_user_context;
-	atomic_long_t load_kernel_context;
-	atomic_long_t lock_kernel_context;
-	atomic_long_t unlock_kernel_context;
-	atomic_long_t steal_user_context;
-	atomic_long_t steal_kernel_context;
-	atomic_long_t steal_context_failed;
-	atomic_long_t nopfn;
-	atomic_long_t break_cow;
-	atomic_long_t asid_new;
-	atomic_long_t asid_next;
-	atomic_long_t asid_wrap;
-	atomic_long_t asid_reuse;
-	atomic_long_t intr;
-	atomic_long_t intr_mm_lock_failed;
-	atomic_long_t call_os;
-	atomic_long_t call_os_offnode_reference;
-	atomic_long_t call_os_check_for_bug;
-	atomic_long_t call_os_wait_queue;
-	atomic_long_t user_flush_tlb;
-	atomic_long_t user_unload_context;
-	atomic_long_t user_exception;
-	atomic_long_t set_context_option;
-	atomic_long_t migrate_check;
-	atomic_long_t migrated_retarget;
-	atomic_long_t migrated_unload;
-	atomic_long_t migrated_unload_delay;
-	atomic_long_t migrated_nopfn_retarget;
-	atomic_long_t migrated_nopfn_unload;
-	atomic_long_t tlb_dropin;
-	atomic_long_t tlb_dropin_fail_no_asid;
-	atomic_long_t tlb_dropin_fail_upm;
-	atomic_long_t tlb_dropin_fail_invalid;
-	atomic_long_t tlb_dropin_fail_range_active;
-	atomic_long_t tlb_dropin_fail_idle;
-	atomic_long_t tlb_dropin_fail_fmm;
-	atomic_long_t tlb_dropin_fail_no_exception;
-	atomic_long_t tlb_dropin_fail_no_exception_war;
-	atomic_long_t tfh_stale_on_fault;
-	atomic_long_t mmu_invalidate_range;
-	atomic_long_t mmu_invalidate_page;
-	atomic_long_t mmu_clear_flush_young;
-	atomic_long_t flush_tlb;
-	atomic_long_t flush_tlb_gru;
-	atomic_long_t flush_tlb_gru_tgh;
-	atomic_long_t flush_tlb_gru_zero_asid;
-
-	atomic_long_t copy_gpa;
-
-	atomic_long_t mesq_receive;
-	atomic_long_t mesq_receive_none;
-	atomic_long_t mesq_send;
-	atomic_long_t mesq_send_failed;
-	atomic_long_t mesq_noop;
-	atomic_long_t mesq_send_unexpected_error;
-	atomic_long_t mesq_send_lb_overflow;
-	atomic_long_t mesq_send_qlimit_reached;
-	atomic_long_t mesq_send_amo_nacked;
-	atomic_long_t mesq_send_put_nacked;
-	atomic_long_t mesq_qf_not_full;
-	atomic_long_t mesq_qf_locked;
-	atomic_long_t mesq_qf_noop_not_full;
-	atomic_long_t mesq_qf_switch_head_failed;
-	atomic_long_t mesq_qf_unexpected_error;
-	atomic_long_t mesq_noop_unexpected_error;
-	atomic_long_t mesq_noop_lb_overflow;
-	atomic_long_t mesq_noop_qlimit_reached;
-	atomic_long_t mesq_noop_amo_nacked;
-	atomic_long_t mesq_noop_put_nacked;
+	atomic_long_unchecked_t vdata_alloc;
+	atomic_long_unchecked_t vdata_free;
+	atomic_long_unchecked_t gts_alloc;
+	atomic_long_unchecked_t gts_free;
+	atomic_long_unchecked_t vdata_double_alloc;
+	atomic_long_unchecked_t gts_double_allocate;
+	atomic_long_unchecked_t assign_context;
+	atomic_long_unchecked_t assign_context_failed;
+	atomic_long_unchecked_t free_context;
+	atomic_long_unchecked_t load_user_context;
+	atomic_long_unchecked_t load_kernel_context;
+	atomic_long_unchecked_t lock_kernel_context;
+	atomic_long_unchecked_t unlock_kernel_context;
+	atomic_long_unchecked_t steal_user_context;
+	atomic_long_unchecked_t steal_kernel_context;
+	atomic_long_unchecked_t steal_context_failed;
+	atomic_long_unchecked_t nopfn;
+	atomic_long_unchecked_t break_cow;
+	atomic_long_unchecked_t asid_new;
+	atomic_long_unchecked_t asid_next;
+	atomic_long_unchecked_t asid_wrap;
+	atomic_long_unchecked_t asid_reuse;
+	atomic_long_unchecked_t intr;
+	atomic_long_unchecked_t intr_mm_lock_failed;
+	atomic_long_unchecked_t call_os;
+	atomic_long_unchecked_t call_os_offnode_reference;
+	atomic_long_unchecked_t call_os_check_for_bug;
+	atomic_long_unchecked_t call_os_wait_queue;
+	atomic_long_unchecked_t user_flush_tlb;
+	atomic_long_unchecked_t user_unload_context;
+	atomic_long_unchecked_t user_exception;
+	atomic_long_unchecked_t set_context_option;
+	atomic_long_unchecked_t migrate_check;
+	atomic_long_unchecked_t migrated_retarget;
+	atomic_long_unchecked_t migrated_unload;
+	atomic_long_unchecked_t migrated_unload_delay;
+	atomic_long_unchecked_t migrated_nopfn_retarget;
+	atomic_long_unchecked_t migrated_nopfn_unload;
+	atomic_long_unchecked_t tlb_dropin;
+	atomic_long_unchecked_t tlb_dropin_fail_no_asid;
+	atomic_long_unchecked_t tlb_dropin_fail_upm;
+	atomic_long_unchecked_t tlb_dropin_fail_invalid;
+	atomic_long_unchecked_t tlb_dropin_fail_range_active;
+	atomic_long_unchecked_t tlb_dropin_fail_idle;
+	atomic_long_unchecked_t tlb_dropin_fail_fmm;
+	atomic_long_unchecked_t tlb_dropin_fail_no_exception;
+	atomic_long_unchecked_t tlb_dropin_fail_no_exception_war;
+	atomic_long_unchecked_t tfh_stale_on_fault;
+	atomic_long_unchecked_t mmu_invalidate_range;
+	atomic_long_unchecked_t mmu_invalidate_page;
+	atomic_long_unchecked_t mmu_clear_flush_young;
+	atomic_long_unchecked_t flush_tlb;
+	atomic_long_unchecked_t flush_tlb_gru;
+	atomic_long_unchecked_t flush_tlb_gru_tgh;
+	atomic_long_unchecked_t flush_tlb_gru_zero_asid;
+
+	atomic_long_unchecked_t copy_gpa;
+
+	atomic_long_unchecked_t mesq_receive;
+	atomic_long_unchecked_t mesq_receive_none;
+	atomic_long_unchecked_t mesq_send;
+	atomic_long_unchecked_t mesq_send_failed;
+	atomic_long_unchecked_t mesq_noop;
+	atomic_long_unchecked_t mesq_send_unexpected_error;
+	atomic_long_unchecked_t mesq_send_lb_overflow;
+	atomic_long_unchecked_t mesq_send_qlimit_reached;
+	atomic_long_unchecked_t mesq_send_amo_nacked;
+	atomic_long_unchecked_t mesq_send_put_nacked;
+	atomic_long_unchecked_t mesq_qf_not_full;
+	atomic_long_unchecked_t mesq_qf_locked;
+	atomic_long_unchecked_t mesq_qf_noop_not_full;
+	atomic_long_unchecked_t mesq_qf_switch_head_failed;
+	atomic_long_unchecked_t mesq_qf_unexpected_error;
+	atomic_long_unchecked_t mesq_noop_unexpected_error;
+	atomic_long_unchecked_t mesq_noop_lb_overflow;
+	atomic_long_unchecked_t mesq_noop_qlimit_reached;
+	atomic_long_unchecked_t mesq_noop_amo_nacked;
+	atomic_long_unchecked_t mesq_noop_put_nacked;
 
 };
 
@@ -252,8 +252,8 @@
 	cchop_deallocate, tghop_invalidate, mcsop_last};
 
 struct mcs_op_statistic {
-	atomic_long_t	count;
-	atomic_long_t	total;
+	atomic_long_unchecked_t	count;
+	atomic_long_unchecked_t	total;
 	unsigned long	max;
 };
 
@@ -276,7 +276,7 @@
 
 #define STAT(id)	do {						\
 				if (gru_options & OPT_STATS)		\
-					atomic_long_inc(&gru_stats.id);	\
+					atomic_long_inc_unchecked(&gru_stats.id);	\
 			} while (0)
 
 #ifdef CONFIG_SGI_GRU_DEBUG
diff -uriN linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0001.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/chips/cfi_cmdset_0001.c
--- linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0001.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/chips/cfi_cmdset_0001.c	2011-07-15 05:51:11.000000000 -0500
@@ -743,6 +743,8 @@
 	struct cfi_pri_intelext *cfip = cfi->cmdset_priv;
 	unsigned long timeo = jiffies + HZ;
 
+	pax_track_stack();
+
 	/* Prevent setting state FL_SYNCING for chip in suspended state. */
 	if (mode == FL_SYNCING && chip->oldstate != FL_READY)
 		goto sleep;
@@ -1642,6 +1644,8 @@
 	unsigned long initial_adr;
 	int initial_len = len;
 
+	pax_track_stack();
+
 	wbufsize = cfi_interleave(cfi) << cfi->cfiq->MaxBufWriteSize;
 	adr += chip->start;
 	initial_adr = adr;
@@ -1860,6 +1864,8 @@
 	int retries = 3;
 	int ret;
 
+	pax_track_stack();
+
 	adr += chip->start;
 
  retry:
diff -uriN linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0020.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/chips/cfi_cmdset_0020.c
--- linux-2.6.32.43/drivers/mtd/chips/cfi_cmdset_0020.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/chips/cfi_cmdset_0020.c	2011-07-15 05:51:11.000000000 -0500
@@ -255,6 +255,8 @@
 	unsigned long cmd_addr;
 	struct cfi_private *cfi = map->fldrv_priv;
 
+	pax_track_stack();
+
 	adr += chip->start;
 
 	/* Ensure cmd read/writes are aligned. */
@@ -428,6 +430,8 @@
 	DECLARE_WAITQUEUE(wait, current);
 	int wbufsize, z;
 
+	pax_track_stack();
+
         /* M58LW064A requires bus alignment for buffer wriets -- saw */
         if (adr & (map_bankwidth(map)-1))
             return -EINVAL;
@@ -742,6 +746,8 @@
 	DECLARE_WAITQUEUE(wait, current);
 	int ret = 0;
 
+	pax_track_stack();
+
 	adr += chip->start;
 
 	/* Let's determine this according to the interleave only once */
@@ -1047,6 +1053,8 @@
 	unsigned long timeo = jiffies + HZ;
 	DECLARE_WAITQUEUE(wait, current);
 
+	pax_track_stack();
+
 	adr += chip->start;
 
 	/* Let's determine this according to the interleave only once */
@@ -1196,6 +1204,8 @@
 	unsigned long timeo = jiffies + HZ;
 	DECLARE_WAITQUEUE(wait, current);
 
+	pax_track_stack();
+
 	adr += chip->start;
 
 	/* Let's determine this according to the interleave only once */
diff -uriN linux-2.6.32.43/drivers/mtd/devices/doc2000.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/devices/doc2000.c
--- linux-2.6.32.43/drivers/mtd/devices/doc2000.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/devices/doc2000.c	2011-07-15 05:51:11.000000000 -0500
@@ -776,7 +776,7 @@
 
 		/* The ECC will not be calculated correctly if less than 512 is written */
 /* DBB-
-		if (len != 0x200 && eccbuf)
+		if (len != 0x200)
 			printk(KERN_WARNING
 			       "ECC needs a full sector write (adr: %lx size %lx)\n",
 			       (long) to, (long) len);
diff -uriN linux-2.6.32.43/drivers/mtd/devices/doc2001.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/devices/doc2001.c
--- linux-2.6.32.43/drivers/mtd/devices/doc2001.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/devices/doc2001.c	2011-07-15 05:51:11.000000000 -0500
@@ -393,7 +393,7 @@
 	struct Nand *mychip = &this->chips[from >> (this->chipshift)];
 
 	/* Don't allow read past end of device */
-	if (from >= this->totlen)
+	if (from >= this->totlen || !len)
 		return -EINVAL;
 
 	/* Don't allow a single read to cross a 512-byte block boundary */
diff -uriN linux-2.6.32.43/drivers/mtd/ftl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/ftl.c
--- linux-2.6.32.43/drivers/mtd/ftl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/ftl.c	2011-07-15 05:51:11.000000000 -0500
@@ -474,6 +474,8 @@
     loff_t offset;
     uint16_t srcunitswap = cpu_to_le16(srcunit);
 
+    pax_track_stack();
+
     eun = &part->EUNInfo[srcunit];
     xfer = &part->XferInfo[xferunit];
     DEBUG(2, "ftl_cs: copying block 0x%x to 0x%x\n",
diff -uriN linux-2.6.32.43/drivers/mtd/inftlcore.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/inftlcore.c
--- linux-2.6.32.43/drivers/mtd/inftlcore.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/inftlcore.c	2011-07-15 05:51:11.000000000 -0500
@@ -260,6 +260,8 @@
 	struct inftl_oob oob;
 	size_t retlen;
 
+	pax_track_stack();
+
 	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: INFTL_foldchain(inftl=%p,thisVUC=%d,"
 		"pending=%d)\n", inftl, thisVUC, pendingblock);
 
diff -uriN linux-2.6.32.43/drivers/mtd/inftlmount.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/inftlmount.c
--- linux-2.6.32.43/drivers/mtd/inftlmount.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/inftlmount.c	2011-07-15 05:51:11.000000000 -0500
@@ -54,6 +54,8 @@
 	struct INFTLPartition *ip;
 	size_t retlen;
 
+	pax_track_stack();
+
 	DEBUG(MTD_DEBUG_LEVEL3, "INFTL: find_boot_record(inftl=%p)\n", inftl);
 
         /*
diff -uriN linux-2.6.32.43/drivers/mtd/lpddr/qinfo_probe.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/lpddr/qinfo_probe.c
--- linux-2.6.32.43/drivers/mtd/lpddr/qinfo_probe.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/lpddr/qinfo_probe.c	2011-07-15 05:51:11.000000000 -0500
@@ -106,6 +106,8 @@
 {
 	map_word pfow_val[4];
 
+	pax_track_stack();
+
 	/* Check identification string */
 	pfow_val[0] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_P);
 	pfow_val[1] = map_read(map, map->pfow_base + PFOW_QUERY_STRING_F);
diff -uriN linux-2.6.32.43/drivers/mtd/mtdchar.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/mtdchar.c
--- linux-2.6.32.43/drivers/mtd/mtdchar.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/mtdchar.c	2011-07-15 05:51:11.000000000 -0500
@@ -460,6 +460,8 @@
 	u_long size;
 	struct mtd_info_user info;
 
+	pax_track_stack();
+
 	DEBUG(MTD_DEBUG_LEVEL0, "MTD_ioctl\n");
 
 	size = (cmd & IOCSIZE_MASK) >> IOCSIZE_SHIFT;
diff -uriN linux-2.6.32.43/drivers/mtd/nftlcore.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/nftlcore.c
--- linux-2.6.32.43/drivers/mtd/nftlcore.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/nftlcore.c	2011-07-15 05:51:11.000000000 -0500
@@ -254,6 +254,8 @@
 	int inplace = 1;
 	size_t retlen;
 
+	pax_track_stack();
+
 	memset(BlockMap, 0xff, sizeof(BlockMap));
 	memset(BlockFreeFound, 0, sizeof(BlockFreeFound));
 
diff -uriN linux-2.6.32.43/drivers/mtd/nftlmount.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/nftlmount.c
--- linux-2.6.32.43/drivers/mtd/nftlmount.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/nftlmount.c	2011-07-15 05:51:11.000000000 -0500
@@ -23,6 +23,7 @@
 #include <asm/errno.h>
 #include <linux/delay.h>
 #include <linux/slab.h>
+#include <linux/sched.h>
 #include <linux/mtd/mtd.h>
 #include <linux/mtd/nand.h>
 #include <linux/mtd/nftl.h>
@@ -44,6 +45,8 @@
 	struct mtd_info *mtd = nftl->mbd.mtd;
 	unsigned int i;
 
+	pax_track_stack();
+
         /* Assume logical EraseSize == physical erasesize for starting the scan.
 	   We'll sort it out later if we find a MediaHeader which says otherwise */
 	/* Actually, we won't.  The new DiskOnChip driver has already scanned
diff -uriN linux-2.6.32.43/drivers/mtd/ubi/build.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/ubi/build.c
--- linux-2.6.32.43/drivers/mtd/ubi/build.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/mtd/ubi/build.c	2011-07-15 05:51:11.000000000 -0500
@@ -1255,7 +1255,7 @@
 static int __init bytes_str_to_int(const char *str)
 {
 	char *endp;
-	unsigned long result;
+	unsigned long result, scale = 1;
 
 	result = simple_strtoul(str, &endp, 0);
 	if (str == endp || result >= INT_MAX) {
@@ -1266,11 +1266,11 @@
 
 	switch (*endp) {
 	case 'G':
-		result *= 1024;
+		scale *= 1024;
 	case 'M':
-		result *= 1024;
+		scale *= 1024;
 	case 'K':
-		result *= 1024;
+		scale *= 1024;
 		if (endp[1] == 'i' && endp[2] == 'B')
 			endp += 2;
 	case '\0':
@@ -1281,7 +1281,13 @@
 		return -EINVAL;
 	}
 
-	return result;
+	if ((intoverflow_t)result*scale >= INT_MAX) {
+		printk(KERN_ERR "UBI error: incorrect bytes count: \"%s\"\n",
+		       str);
+		return -EINVAL;
+	}
+
+	return result*scale;
 }
 
 /**
diff -uriN linux-2.6.32.43/drivers/net/bnx2.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/bnx2.c
--- linux-2.6.32.43/drivers/net/bnx2.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/bnx2.c	2011-07-15 05:51:11.000000000 -0500
@@ -5809,6 +5809,8 @@
 	int rc = 0;
 	u32 magic, csum;
 
+	pax_track_stack();
+
 	if ((rc = bnx2_nvram_read(bp, 0, data, 4)) != 0)
 		goto test_nvram_done;
 
diff -uriN linux-2.6.32.43/drivers/net/cxgb3/t3_hw.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/cxgb3/t3_hw.c
--- linux-2.6.32.43/drivers/net/cxgb3/t3_hw.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/cxgb3/t3_hw.c	2011-07-15 05:51:11.000000000 -0500
@@ -699,6 +699,8 @@
 	int i, addr, ret;
 	struct t3_vpd vpd;
 
+	pax_track_stack();
+
 	/*
 	 * Card information is normally at VPD_BASE but some early cards had
 	 * it at 0.
diff -uriN linux-2.6.32.43/drivers/net/e1000e/82571.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/82571.c
--- linux-2.6.32.43/drivers/net/e1000e/82571.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/82571.c	2011-07-15 05:51:11.000000000 -0500
@@ -212,6 +212,7 @@
 {
 	struct e1000_hw *hw = &adapter->hw;
 	struct e1000_mac_info *mac = &hw->mac;
+	/* cannot be const */
 	struct e1000_mac_operations *func = &mac->ops;
 	u32 swsm = 0;
 	u32 swsm2 = 0;
@@ -1656,7 +1657,7 @@
 	temp = er32(ICRXDMTC);
 }
 
-static struct e1000_mac_operations e82571_mac_ops = {
+static const struct e1000_mac_operations e82571_mac_ops = {
 	/* .check_mng_mode: mac type dependent */
 	/* .check_for_link: media type dependent */
 	.id_led_init		= e1000e_id_led_init,
@@ -1674,7 +1675,7 @@
 	.setup_led		= e1000e_setup_led_generic,
 };
 
-static struct e1000_phy_operations e82_phy_ops_igp = {
+static const struct e1000_phy_operations e82_phy_ops_igp = {
 	.acquire_phy		= e1000_get_hw_semaphore_82571,
 	.check_reset_block	= e1000e_check_reset_block_generic,
 	.commit_phy		= NULL,
@@ -1691,7 +1692,7 @@
 	.cfg_on_link_up      	= NULL,
 };
 
-static struct e1000_phy_operations e82_phy_ops_m88 = {
+static const struct e1000_phy_operations e82_phy_ops_m88 = {
 	.acquire_phy		= e1000_get_hw_semaphore_82571,
 	.check_reset_block	= e1000e_check_reset_block_generic,
 	.commit_phy		= e1000e_phy_sw_reset,
@@ -1708,7 +1709,7 @@
 	.cfg_on_link_up      	= NULL,
 };
 
-static struct e1000_phy_operations e82_phy_ops_bm = {
+static const struct e1000_phy_operations e82_phy_ops_bm = {
 	.acquire_phy		= e1000_get_hw_semaphore_82571,
 	.check_reset_block	= e1000e_check_reset_block_generic,
 	.commit_phy		= e1000e_phy_sw_reset,
@@ -1725,7 +1726,7 @@
 	.cfg_on_link_up      	= NULL,
 };
 
-static struct e1000_nvm_operations e82571_nvm_ops = {
+static const struct e1000_nvm_operations e82571_nvm_ops = {
 	.acquire_nvm		= e1000_acquire_nvm_82571,
 	.read_nvm		= e1000e_read_nvm_eerd,
 	.release_nvm		= e1000_release_nvm_82571,
diff -uriN linux-2.6.32.43/drivers/net/e1000e/e1000.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/e1000.h
--- linux-2.6.32.43/drivers/net/e1000e/e1000.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/e1000.h	2011-07-15 05:51:11.000000000 -0500
@@ -375,9 +375,9 @@
 	u32			pba;
 	u32			max_hw_frame_size;
 	s32			(*get_variants)(struct e1000_adapter *);
-	struct e1000_mac_operations *mac_ops;
-	struct e1000_phy_operations *phy_ops;
-	struct e1000_nvm_operations *nvm_ops;
+	const struct e1000_mac_operations *mac_ops;
+	const struct e1000_phy_operations *phy_ops;
+	const struct e1000_nvm_operations *nvm_ops;
 };
 
 /* hardware capability, feature, and workaround flags */
diff -uriN linux-2.6.32.43/drivers/net/e1000e/es2lan.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/es2lan.c
--- linux-2.6.32.43/drivers/net/e1000e/es2lan.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/es2lan.c	2011-07-15 05:51:11.000000000 -0500
@@ -207,6 +207,7 @@
 {
 	struct e1000_hw *hw = &adapter->hw;
 	struct e1000_mac_info *mac = &hw->mac;
+	/* cannot be const */
 	struct e1000_mac_operations *func = &mac->ops;
 
 	/* Set media type */
@@ -1365,7 +1366,7 @@
 	temp = er32(ICRXDMTC);
 }
 
-static struct e1000_mac_operations es2_mac_ops = {
+static const struct e1000_mac_operations es2_mac_ops = {
 	.id_led_init		= e1000e_id_led_init,
 	.check_mng_mode		= e1000e_check_mng_mode_generic,
 	/* check_for_link dependent on media type */
@@ -1383,7 +1384,7 @@
 	.setup_led		= e1000e_setup_led_generic,
 };
 
-static struct e1000_phy_operations es2_phy_ops = {
+static const struct e1000_phy_operations es2_phy_ops = {
 	.acquire_phy		= e1000_acquire_phy_80003es2lan,
 	.check_reset_block	= e1000e_check_reset_block_generic,
 	.commit_phy	 	= e1000e_phy_sw_reset,
@@ -1400,7 +1401,7 @@
 	.cfg_on_link_up      	= e1000_cfg_on_link_up_80003es2lan,
 };
 
-static struct e1000_nvm_operations es2_nvm_ops = {
+static const struct e1000_nvm_operations es2_nvm_ops = {
 	.acquire_nvm		= e1000_acquire_nvm_80003es2lan,
 	.read_nvm		= e1000e_read_nvm_eerd,
 	.release_nvm		= e1000_release_nvm_80003es2lan,
diff -uriN linux-2.6.32.43/drivers/net/e1000e/hw.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/hw.h
--- linux-2.6.32.43/drivers/net/e1000e/hw.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/hw.h	2011-07-15 05:51:11.000000000 -0500
@@ -756,34 +756,34 @@
 
 /* Function pointers for the PHY. */
 struct e1000_phy_operations {
-	s32  (*acquire_phy)(struct e1000_hw *);
-	s32  (*check_polarity)(struct e1000_hw *);
-	s32  (*check_reset_block)(struct e1000_hw *);
-	s32  (*commit_phy)(struct e1000_hw *);
-	s32  (*force_speed_duplex)(struct e1000_hw *);
-	s32  (*get_cfg_done)(struct e1000_hw *hw);
-	s32  (*get_cable_length)(struct e1000_hw *);
-	s32  (*get_phy_info)(struct e1000_hw *);
-	s32  (*read_phy_reg)(struct e1000_hw *, u32, u16 *);
-	s32  (*read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
-	void (*release_phy)(struct e1000_hw *);
-	s32  (*reset_phy)(struct e1000_hw *);
-	s32  (*set_d0_lplu_state)(struct e1000_hw *, bool);
-	s32  (*set_d3_lplu_state)(struct e1000_hw *, bool);
-	s32  (*write_phy_reg)(struct e1000_hw *, u32, u16);
-	s32  (*write_phy_reg_locked)(struct e1000_hw *, u32, u16);
-	s32  (*cfg_on_link_up)(struct e1000_hw *);
+	s32  (* acquire_phy)(struct e1000_hw *);
+	s32  (* check_polarity)(struct e1000_hw *);
+	s32  (* check_reset_block)(struct e1000_hw *);
+	s32  (* commit_phy)(struct e1000_hw *);
+	s32  (* force_speed_duplex)(struct e1000_hw *);
+	s32  (* get_cfg_done)(struct e1000_hw *hw);
+	s32  (* get_cable_length)(struct e1000_hw *);
+	s32  (* get_phy_info)(struct e1000_hw *);
+	s32  (* read_phy_reg)(struct e1000_hw *, u32, u16 *);
+	s32  (* read_phy_reg_locked)(struct e1000_hw *, u32, u16 *);
+	void (* release_phy)(struct e1000_hw *);
+	s32  (* reset_phy)(struct e1000_hw *);
+	s32  (* set_d0_lplu_state)(struct e1000_hw *, bool);
+	s32  (* set_d3_lplu_state)(struct e1000_hw *, bool);
+	s32  (* write_phy_reg)(struct e1000_hw *, u32, u16);
+	s32  (* write_phy_reg_locked)(struct e1000_hw *, u32, u16);
+	s32  (* cfg_on_link_up)(struct e1000_hw *);
 };
 
 /* Function pointers for the NVM. */
 struct e1000_nvm_operations {
-	s32  (*acquire_nvm)(struct e1000_hw *);
-	s32  (*read_nvm)(struct e1000_hw *, u16, u16, u16 *);
-	void (*release_nvm)(struct e1000_hw *);
-	s32  (*update_nvm)(struct e1000_hw *);
-	s32  (*valid_led_default)(struct e1000_hw *, u16 *);
-	s32  (*validate_nvm)(struct e1000_hw *);
-	s32  (*write_nvm)(struct e1000_hw *, u16, u16, u16 *);
+	s32  (* const acquire_nvm)(struct e1000_hw *);
+	s32  (* const read_nvm)(struct e1000_hw *, u16, u16, u16 *);
+	void (* const release_nvm)(struct e1000_hw *);
+	s32  (* const update_nvm)(struct e1000_hw *);
+	s32  (* const valid_led_default)(struct e1000_hw *, u16 *);
+	s32  (* const validate_nvm)(struct e1000_hw *);
+	s32  (* const write_nvm)(struct e1000_hw *, u16, u16, u16 *);
 };
 
 struct e1000_mac_info {
diff -uriN linux-2.6.32.43/drivers/net/e1000e/ich8lan.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/ich8lan.c
--- linux-2.6.32.43/drivers/net/e1000e/ich8lan.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/e1000e/ich8lan.c	2011-07-15 05:51:11.000000000 -0500
@@ -3463,7 +3463,7 @@
 	}
 }
 
-static struct e1000_mac_operations ich8_mac_ops = {
+static const struct e1000_mac_operations ich8_mac_ops = {
 	.id_led_init		= e1000e_id_led_init,
 	.check_mng_mode		= e1000_check_mng_mode_ich8lan,
 	.check_for_link		= e1000_check_for_copper_link_ich8lan,
@@ -3481,7 +3481,7 @@
 	/* id_led_init dependent on mac type */
 };
 
-static struct e1000_phy_operations ich8_phy_ops = {
+static const struct e1000_phy_operations ich8_phy_ops = {
 	.acquire_phy		= e1000_acquire_swflag_ich8lan,
 	.check_reset_block	= e1000_check_reset_block_ich8lan,
 	.commit_phy		= NULL,
@@ -3497,7 +3497,7 @@
 	.write_phy_reg		= e1000e_write_phy_reg_igp,
 };
 
-static struct e1000_nvm_operations ich8_nvm_ops = {
+static const struct e1000_nvm_operations ich8_nvm_ops = {
 	.acquire_nvm		= e1000_acquire_nvm_ich8lan,
 	.read_nvm	 	= e1000_read_nvm_ich8lan,
 	.release_nvm		= e1000_release_nvm_ich8lan,
diff -uriN linux-2.6.32.43/drivers/net/hamradio/6pack.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/hamradio/6pack.c
--- linux-2.6.32.43/drivers/net/hamradio/6pack.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/hamradio/6pack.c	2011-07-15 05:51:11.000000000 -0500
@@ -461,6 +461,8 @@
 	unsigned char buf[512];
 	int count1;
 
+	pax_track_stack();
+
 	if (!count)
 		return;
 
diff -uriN linux-2.6.32.43/drivers/net/ibmveth.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/ibmveth.c
--- linux-2.6.32.43/drivers/net/ibmveth.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/ibmveth.c	2011-07-15 05:51:11.000000000 -0500
@@ -1577,7 +1577,7 @@
 	NULL,
 };
 
-static struct sysfs_ops veth_pool_ops = {
+static const struct sysfs_ops veth_pool_ops = {
 	.show   = veth_pool_show,
 	.store  = veth_pool_store,
 };
diff -uriN linux-2.6.32.43/drivers/net/igb/e1000_82575.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/igb/e1000_82575.c
--- linux-2.6.32.43/drivers/net/igb/e1000_82575.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/igb/e1000_82575.c	2011-07-15 05:51:11.000000000 -0500
@@ -1410,7 +1410,7 @@
 	wr32(E1000_VT_CTL, vt_ctl);
 }
 
-static struct e1000_mac_operations e1000_mac_ops_82575 = {
+static const struct e1000_mac_operations e1000_mac_ops_82575 = {
 	.reset_hw             = igb_reset_hw_82575,
 	.init_hw              = igb_init_hw_82575,
 	.check_for_link       = igb_check_for_link_82575,
@@ -1419,13 +1419,13 @@
 	.get_speed_and_duplex = igb_get_speed_and_duplex_copper,
 };
 
-static struct e1000_phy_operations e1000_phy_ops_82575 = {
+static const struct e1000_phy_operations e1000_phy_ops_82575 = {
 	.acquire              = igb_acquire_phy_82575,
 	.get_cfg_done         = igb_get_cfg_done_82575,
 	.release              = igb_release_phy_82575,
 };
 
-static struct e1000_nvm_operations e1000_nvm_ops_82575 = {
+static const struct e1000_nvm_operations e1000_nvm_ops_82575 = {
 	.acquire              = igb_acquire_nvm_82575,
 	.read                 = igb_read_nvm_eerd,
 	.release              = igb_release_nvm_82575,
diff -uriN linux-2.6.32.43/drivers/net/igb/e1000_hw.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/igb/e1000_hw.h
--- linux-2.6.32.43/drivers/net/igb/e1000_hw.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/igb/e1000_hw.h	2011-07-15 05:51:11.000000000 -0500
@@ -305,17 +305,17 @@
 };
 
 struct e1000_nvm_operations {
-	s32  (*acquire)(struct e1000_hw *);
-	s32  (*read)(struct e1000_hw *, u16, u16, u16 *);
-	void (*release)(struct e1000_hw *);
-	s32  (*write)(struct e1000_hw *, u16, u16, u16 *);
+	s32  (* const acquire)(struct e1000_hw *);
+	s32  (* const read)(struct e1000_hw *, u16, u16, u16 *);
+	void (* const release)(struct e1000_hw *);
+	s32  (* const write)(struct e1000_hw *, u16, u16, u16 *);
 };
 
 struct e1000_info {
 	s32 (*get_invariants)(struct e1000_hw *);
-	struct e1000_mac_operations *mac_ops;
-	struct e1000_phy_operations *phy_ops;
-	struct e1000_nvm_operations *nvm_ops;
+	const struct e1000_mac_operations *mac_ops;
+	const struct e1000_phy_operations *phy_ops;
+	const struct e1000_nvm_operations *nvm_ops;
 };
 
 extern const struct e1000_info e1000_82575_info;
diff -uriN linux-2.6.32.43/drivers/net/iseries_veth.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/iseries_veth.c
--- linux-2.6.32.43/drivers/net/iseries_veth.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/iseries_veth.c	2011-07-15 05:51:11.000000000 -0500
@@ -384,7 +384,7 @@
 	NULL
 };
 
-static struct sysfs_ops veth_cnx_sysfs_ops = {
+static const struct sysfs_ops veth_cnx_sysfs_ops = {
 		.show = veth_cnx_attribute_show
 };
 
@@ -441,7 +441,7 @@
 	NULL
 };
 
-static struct sysfs_ops veth_port_sysfs_ops = {
+static const struct sysfs_ops veth_port_sysfs_ops = {
 	.show = veth_port_attribute_show
 };
 
diff -uriN linux-2.6.32.43/drivers/net/ixgb/ixgb_main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/ixgb/ixgb_main.c
--- linux-2.6.32.43/drivers/net/ixgb/ixgb_main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/ixgb/ixgb_main.c	2011-07-15 05:51:11.000000000 -0500
@@ -1052,6 +1052,8 @@
 	u32 rctl;
 	int i;
 
+	pax_track_stack();
+
 	/* Check for Promiscuous and All Multicast modes */
 
 	rctl = IXGB_READ_REG(hw, RCTL);
diff -uriN linux-2.6.32.43/drivers/net/ixgb/ixgb_param.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/ixgb/ixgb_param.c
--- linux-2.6.32.43/drivers/net/ixgb/ixgb_param.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/ixgb/ixgb_param.c	2011-07-15 05:51:11.000000000 -0500
@@ -260,6 +260,9 @@
 ixgb_check_options(struct ixgb_adapter *adapter)
 {
 	int bd = adapter->bd_number;
+
+	pax_track_stack();
+
 	if (bd >= IXGB_MAX_NIC) {
 		printk(KERN_NOTICE
 			   "Warning: no configuration for board #%i\n", bd);
diff -uriN linux-2.6.32.43/drivers/net/mlx4/main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/mlx4/main.c
--- linux-2.6.32.43/drivers/net/mlx4/main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/mlx4/main.c	2011-07-15 05:51:11.000000000 -0500
@@ -38,6 +38,7 @@
 #include <linux/errno.h>
 #include <linux/pci.h>
 #include <linux/dma-mapping.h>
+#include <linux/sched.h>
 
 #include <linux/mlx4/device.h>
 #include <linux/mlx4/doorbell.h>
@@ -730,6 +731,8 @@
 	u64 icm_size;
 	int err;
 
+	pax_track_stack();
+
 	err = mlx4_QUERY_FW(dev);
 	if (err) {
 		if (err == -EACCES)
diff -uriN linux-2.6.32.43/drivers/net/niu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/niu.c
--- linux-2.6.32.43/drivers/net/niu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/niu.c	2011-07-15 05:51:11.000000000 -0500
@@ -9128,6 +9128,8 @@
 	int i, num_irqs, err;
 	u8 first_ldg;
 
+	pax_track_stack();
+
 	first_ldg = (NIU_NUM_LDG / parent->num_ports) * np->port;
 	for (i = 0; i < (NIU_NUM_LDG / parent->num_ports); i++)
 		ldg_num_map[i] = first_ldg + i;
diff -uriN linux-2.6.32.43/drivers/net/pcnet32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/pcnet32.c
--- linux-2.6.32.43/drivers/net/pcnet32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/pcnet32.c	2011-07-15 05:51:11.000000000 -0500
@@ -79,7 +79,7 @@
 /*
  * VLB I/O addresses
  */
-static unsigned int pcnet32_portlist[] __initdata =
+static unsigned int pcnet32_portlist[] __devinitdata =
     { 0x300, 0x320, 0x340, 0x360, 0 };
 
 static int pcnet32_debug = 0;
diff -uriN linux-2.6.32.43/drivers/net/tg3.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/tg3.h
--- linux-2.6.32.43/drivers/net/tg3.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/tg3.h	2011-07-15 05:51:11.000000000 -0500
@@ -95,6 +95,7 @@
 #define  CHIPREV_ID_5750_A0		 0x4000
 #define  CHIPREV_ID_5750_A1		 0x4001
 #define  CHIPREV_ID_5750_A3		 0x4003
+#define  CHIPREV_ID_5750_C1		 0x4201
 #define  CHIPREV_ID_5750_C2		 0x4202
 #define  CHIPREV_ID_5752_A0_HW		 0x5000
 #define  CHIPREV_ID_5752_A0		 0x6000
diff -uriN linux-2.6.32.43/drivers/net/tulip/de2104x.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/tulip/de2104x.c
--- linux-2.6.32.43/drivers/net/tulip/de2104x.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/tulip/de2104x.c	2011-07-15 05:51:11.000000000 -0500
@@ -1785,6 +1785,8 @@
 	struct de_srom_info_leaf *il;
 	void *bufp;
 
+	pax_track_stack();
+
 	/* download entire eeprom */
 	for (i = 0; i < DE_EEPROM_WORDS; i++)
 		((__le16 *)ee_data)[i] =
diff -uriN linux-2.6.32.43/drivers/net/tulip/de4x5.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/tulip/de4x5.c
--- linux-2.6.32.43/drivers/net/tulip/de4x5.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/tulip/de4x5.c	2011-07-15 05:51:11.000000000 -0500
@@ -5472,7 +5472,7 @@
 	for (i=0; i<ETH_ALEN; i++) {
 	    tmp.addr[i] = dev->dev_addr[i];
 	}
-	if (copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
+	if (ioc->len > sizeof tmp.addr || copy_to_user(ioc->data, tmp.addr, ioc->len)) return -EFAULT;
 	break;
 
     case DE4X5_SET_HWADDR:           /* Set the hardware address */
@@ -5512,7 +5512,7 @@
 	spin_lock_irqsave(&lp->lock, flags);
 	memcpy(&statbuf, &lp->pktStats, ioc->len);
 	spin_unlock_irqrestore(&lp->lock, flags);
-	if (copy_to_user(ioc->data, &statbuf, ioc->len))
+	if (ioc->len > sizeof statbuf || copy_to_user(ioc->data, &statbuf, ioc->len))
 		return -EFAULT;
 	break;
     }
diff -uriN linux-2.6.32.43/drivers/net/tun.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/tun.c
--- linux-2.6.32.43/drivers/net/tun.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/tun.c	2011-07-15 05:50:11.000000000 -0500
@@ -61,6 +61,7 @@
 #include <linux/crc32.h>
 #include <linux/nsproxy.h>
 #include <linux/virtio_net.h>
+#include <linux/vs_network.h>
 #include <net/net_namespace.h>
 #include <net/netns/generic.h>
 #include <net/rtnetlink.h>
@@ -102,6 +103,7 @@
 	unsigned int 		flags;
 	uid_t			owner;
 	gid_t			group;
+	nid_t			nid;
 
 	struct net_device	*dev;
 	struct fasync_struct	*fasync;
@@ -816,6 +818,7 @@
 
 	tun->owner = -1;
 	tun->group = -1;
+	tun->nid = current->nid;
 
 	dev->ethtool_ops = &tun_ethtool_ops;
 	dev->destructor = tun_free_netdev;
@@ -932,7 +935,7 @@
 
 		if (((tun->owner != -1 && cred->euid != tun->owner) ||
 		     (tun->group != -1 && !in_egroup_p(tun->group))) &&
-		    !capable(CAP_NET_ADMIN))
+		!cap_raised(current_cap(), CAP_NET_ADMIN))
 			return -EPERM;
 		err = security_tun_dev_attach(tun->socket.sk);
 		if (err < 0)
@@ -946,7 +949,7 @@
 		char *name;
 		unsigned long flags = 0;
 
-		if (!capable(CAP_NET_ADMIN))
+		if (!nx_capable(CAP_NET_ADMIN, NXC_TUN_CREATE))
 			return -EPERM;
 		err = security_tun_dev_create();
 		if (err < 0)
@@ -1014,6 +1017,9 @@
 
 		sk->sk_destruct = tun_sock_destruct;
 
+		if (!nx_check(tun->nid, VS_IDENT | VS_HOSTID | VS_ADMIN_P))
+			return -EPERM;
+
 		err = tun_attach(tun, file);
 		if (err < 0)
 			goto failed;
@@ -1203,6 +1209,16 @@
 		DBG(KERN_INFO "%s: group set to %d\n", tun->dev->name, tun->group);
 		break;
 
+	case TUNSETNID:
+		if (!capable(CAP_CONTEXT))
+			return -EPERM;
+
+		/* Set nid owner of the device */
+		tun->nid = (nid_t) arg;
+
+		DBG(KERN_INFO "%s: nid owner set to %u\n", tun->dev->name, tun->nid);
+		break;
+
 	case TUNSETLINK:
 		/* Only allow setting the type when the interface is down */
 		if (tun->dev->flags & IFF_UP) {
diff -uriN linux-2.6.32.43/drivers/net/usb/hso.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/usb/hso.c
--- linux-2.6.32.43/drivers/net/usb/hso.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/usb/hso.c	2011-07-15 05:51:11.000000000 -0500
@@ -71,7 +71,7 @@
 #include <asm/byteorder.h>
 #include <linux/serial_core.h>
 #include <linux/serial.h>
-
+#include <asm/local.h>
 
 #define DRIVER_VERSION			"1.2"
 #define MOD_AUTHOR			"Option Wireless"
@@ -258,7 +258,7 @@
 
 	/* from usb_serial_port */
 	struct tty_struct *tty;
-	int open_count;
+	local_t open_count;
 	spinlock_t serial_lock;
 
 	int (*write_data) (struct hso_serial *serial);
@@ -1180,7 +1180,7 @@
 	struct urb *urb;
 
 	urb = serial->rx_urb[0];
-	if (serial->open_count > 0) {
+	if (local_read(&serial->open_count) > 0) {
 		count = put_rxbuf_data(urb, serial);
 		if (count == -1)
 			return;
@@ -1216,7 +1216,7 @@
 	DUMP1(urb->transfer_buffer, urb->actual_length);
 
 	/* Anyone listening? */
-	if (serial->open_count == 0)
+	if (local_read(&serial->open_count) == 0)
 		return;
 
 	if (status == 0) {
@@ -1311,8 +1311,7 @@
 	spin_unlock_irq(&serial->serial_lock);
 
 	/* check for port already opened, if not set the termios */
-	serial->open_count++;
-	if (serial->open_count == 1) {
+	if (local_inc_return(&serial->open_count) == 1) {
 		tty->low_latency = 1;
 		serial->rx_state = RX_IDLE;
 		/* Force default termio settings */
@@ -1325,7 +1324,7 @@
 		result = hso_start_serial_device(serial->parent, GFP_KERNEL);
 		if (result) {
 			hso_stop_serial_device(serial->parent);
-			serial->open_count--;
+			local_dec(&serial->open_count);
 			kref_put(&serial->parent->ref, hso_serial_ref_free);
 		}
 	} else {
@@ -1362,10 +1361,10 @@
 
 	/* reset the rts and dtr */
 	/* do the actual close */
-	serial->open_count--;
+	local_dec(&serial->open_count);
 
-	if (serial->open_count <= 0) {
-		serial->open_count = 0;
+	if (local_read(&serial->open_count) <= 0) {
+		local_set(&serial->open_count,  0);
 		spin_lock_irq(&serial->serial_lock);
 		if (serial->tty == tty) {
 			serial->tty->driver_data = NULL;
@@ -1447,7 +1446,7 @@
 
 	/* the actual setup */
 	spin_lock_irqsave(&serial->serial_lock, flags);
-	if (serial->open_count)
+	if (local_read(&serial->open_count))
 		_hso_serial_set_termios(tty, old);
 	else
 		tty->termios = old;
@@ -3097,7 +3096,7 @@
 	/* Start all serial ports */
 	for (i = 0; i < HSO_SERIAL_TTY_MINORS; i++) {
 		if (serial_table[i] && (serial_table[i]->interface == iface)) {
-			if (dev2ser(serial_table[i])->open_count) {
+			if (local_read(&dev2ser(serial_table[i])->open_count)) {
 				result =
 				    hso_start_serial_device(serial_table[i], GFP_NOIO);
 				hso_kick_transmit(dev2ser(serial_table[i]));
diff -uriN linux-2.6.32.43/drivers/net/vxge/vxge-main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/vxge/vxge-main.c
--- linux-2.6.32.43/drivers/net/vxge/vxge-main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/vxge/vxge-main.c	2011-07-15 05:51:18.000000000 -0500
@@ -93,6 +93,8 @@
 	struct sk_buff *completed[NR_SKB_COMPLETED];
 	int more;
 
+	pax_track_stack();
+
 	do {
 		more = 0;
 		skb_ptr = completed;
@@ -1779,6 +1781,8 @@
 	u8 mtable[256] = {0}; /* CPU to vpath mapping  */
 	int index;
 
+	pax_track_stack();
+
 	/*
 	 * Filling
 	 * 	- itable with bucket numbers
diff -uriN linux-2.6.32.43/drivers/net/wan/cycx_x25.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wan/cycx_x25.c
--- linux-2.6.32.43/drivers/net/wan/cycx_x25.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wan/cycx_x25.c	2011-07-15 05:51:18.000000000 -0500
@@ -1017,6 +1017,8 @@
 	unsigned char hex[1024],
 	    	* phex = hex;
 
+	pax_track_stack();
+
 	if (len >= (sizeof(hex) / 2))
 		len = (sizeof(hex) / 2) - 1;
 
diff -uriN linux-2.6.32.43/drivers/net/wimax/i2400m/usb-fw.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wimax/i2400m/usb-fw.c
--- linux-2.6.32.43/drivers/net/wimax/i2400m/usb-fw.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wimax/i2400m/usb-fw.c	2011-07-15 05:51:18.000000000 -0500
@@ -263,6 +263,8 @@
 	int do_autopm = 1;
 	DECLARE_COMPLETION_ONSTACK(notif_completion);
 
+	pax_track_stack();
+
 	d_fnstart(8, dev, "(i2400m %p ack %p size %zu)\n",
 		  i2400m, ack, ack_size);
 	BUG_ON(_ack == i2400m->bm_ack_buf);
diff -uriN linux-2.6.32.43/drivers/net/wireless/airo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/airo.c
--- linux-2.6.32.43/drivers/net/wireless/airo.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/airo.c	2011-07-15 05:51:18.000000000 -0500
@@ -3003,6 +3003,8 @@
 	BSSListElement * loop_net;
 	BSSListElement * tmp_net;
 
+	pax_track_stack();
+
 	/* Blow away current list of scan results */
 	list_for_each_entry_safe (loop_net, tmp_net, &ai->network_list, list) {
 		list_move_tail (&loop_net->list, &ai->network_free_list);
@@ -3783,6 +3785,8 @@
 	WepKeyRid wkr;
 	int rc;
 
+	pax_track_stack();
+
 	memset( &mySsid, 0, sizeof( mySsid ) );
 	kfree (ai->flash);
 	ai->flash = NULL;
@@ -4758,6 +4762,8 @@
 	__le32 *vals = stats.vals;
 	int len;
 
+	pax_track_stack();
+
 	if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
 		return -ENOMEM;
 	data = (struct proc_data *)file->private_data;
@@ -5487,6 +5493,8 @@
 	/* If doLoseSync is not 1, we won't do a Lose Sync */
 	int doLoseSync = -1;
 
+	pax_track_stack();
+
 	if ((file->private_data = kzalloc(sizeof(struct proc_data ), GFP_KERNEL)) == NULL)
 		return -ENOMEM;
 	data = (struct proc_data *)file->private_data;
@@ -7193,6 +7201,8 @@
 	int i;
 	int loseSync = capable(CAP_NET_ADMIN) ? 1: -1;
 
+	pax_track_stack();
+
 	qual = kmalloc(IW_MAX_AP * sizeof(*qual), GFP_KERNEL);
 	if (!qual)
 		return -ENOMEM;
@@ -7753,6 +7763,8 @@
 	CapabilityRid cap_rid;
 	__le32 *vals = stats_rid.vals;
 
+	pax_track_stack();
+
 	/* Get stats out of the card */
 	clear_bit(JOB_WSTATS, &local->jobs);
 	if (local->power.event) {
diff -uriN linux-2.6.32.43/drivers/net/wireless/ath/ath5k/debug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/ath/ath5k/debug.c
--- linux-2.6.32.43/drivers/net/wireless/ath/ath5k/debug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/ath/ath5k/debug.c	2011-07-15 05:51:18.000000000 -0500
@@ -205,6 +205,8 @@
 	unsigned int v;
 	u64 tsf;
 
+	pax_track_stack();
+
 	v = ath5k_hw_reg_read(sc->ah, AR5K_BEACON);
 	len += snprintf(buf+len, sizeof(buf)-len,
 		"%-24s0x%08x\tintval: %d\tTIM: 0x%x\n",
@@ -318,6 +320,8 @@
 	unsigned int len = 0;
 	unsigned int i;
 
+	pax_track_stack();
+
 	len += snprintf(buf+len, sizeof(buf)-len,
 		"DEBUG LEVEL: 0x%08x\n\n", sc->debug.level);
 
diff -uriN linux-2.6.32.43/drivers/net/wireless/ath/ath9k/debug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/ath/ath9k/debug.c
--- linux-2.6.32.43/drivers/net/wireless/ath/ath9k/debug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/ath/ath9k/debug.c	2011-07-15 05:51:18.000000000 -0500
@@ -220,6 +220,8 @@
 	char buf[512];
 	unsigned int len = 0;
 
+	pax_track_stack();
+
 	len += snprintf(buf + len, sizeof(buf) - len,
 		"%8s: %10u\n", "RX", sc->debug.stats.istats.rxok);
 	len += snprintf(buf + len, sizeof(buf) - len,
@@ -360,6 +362,8 @@
 	int i;
 	u8 addr[ETH_ALEN];
 
+	pax_track_stack();
+
 	len += snprintf(buf + len, sizeof(buf) - len,
 			"primary: %s (%s chan=%d ht=%d)\n",
 			wiphy_name(sc->pri_wiphy->hw->wiphy),
diff -uriN linux-2.6.32.43/drivers/net/wireless/b43/debugfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/b43/debugfs.c
--- linux-2.6.32.43/drivers/net/wireless/b43/debugfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/b43/debugfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -43,7 +43,7 @@
 struct b43_debugfs_fops {
 	ssize_t (*read)(struct b43_wldev *dev, char *buf, size_t bufsize);
 	int (*write)(struct b43_wldev *dev, const char *buf, size_t count);
-	struct file_operations fops;
+	const struct file_operations fops;
 	/* Offset of struct b43_dfs_file in struct b43_dfsentry */
 	size_t file_struct_offset;
 };
diff -uriN linux-2.6.32.43/drivers/net/wireless/b43legacy/debugfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/b43legacy/debugfs.c
--- linux-2.6.32.43/drivers/net/wireless/b43legacy/debugfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/b43legacy/debugfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -44,7 +44,7 @@
 struct b43legacy_debugfs_fops {
 	ssize_t (*read)(struct b43legacy_wldev *dev, char *buf, size_t bufsize);
 	int (*write)(struct b43legacy_wldev *dev, const char *buf, size_t count);
-	struct file_operations fops;
+	const struct file_operations fops;
 	/* Offset of struct b43legacy_dfs_file in struct b43legacy_dfsentry */
 	size_t file_struct_offset;
 	/* Take wl->irq_lock before calling read/write? */
diff -uriN linux-2.6.32.43/drivers/net/wireless/ipw2x00/ipw2100.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/ipw2x00/ipw2100.c
--- linux-2.6.32.43/drivers/net/wireless/ipw2x00/ipw2100.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/ipw2x00/ipw2100.c	2011-07-15 05:51:18.000000000 -0500
@@ -2014,6 +2014,8 @@
 	int err;
 	DECLARE_SSID_BUF(ssid);
 
+	pax_track_stack();
+
 	IPW_DEBUG_HC("SSID: '%s'\n", print_ssid(ssid, essid, ssid_len));
 
 	if (ssid_len)
@@ -5380,6 +5382,8 @@
 	struct ipw2100_wep_key *wep_key = (void *)cmd.host_command_parameters;
 	int err;
 
+	pax_track_stack();
+
 	IPW_DEBUG_HC("WEP_KEY_INFO: index = %d, len = %d/%d\n",
 		     idx, keylen, len);
 
diff -uriN linux-2.6.32.43/drivers/net/wireless/ipw2x00/libipw_rx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/ipw2x00/libipw_rx.c
--- linux-2.6.32.43/drivers/net/wireless/ipw2x00/libipw_rx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/ipw2x00/libipw_rx.c	2011-07-15 05:51:18.000000000 -0500
@@ -1566,6 +1566,8 @@
 	unsigned long flags;
 	DECLARE_SSID_BUF(ssid);
 
+	pax_track_stack();
+
 	LIBIPW_DEBUG_SCAN("'%s' (%pM"
 		     "): %c%c%c%c %c%c%c%c-%c%c%c%c %c%c%c%c\n",
 		     print_ssid(ssid, info_element->data, info_element->len),
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-1000.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-1000.c
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-1000.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-1000.c	2011-07-15 05:51:18.000000000 -0500
@@ -137,7 +137,7 @@
 	 },
 };
 
-static struct iwl_ops iwl1000_ops = {
+static const struct iwl_ops iwl1000_ops = {
 	.ucode = &iwl5000_ucode,
 	.lib = &iwl1000_lib,
 	.hcmd = &iwl5000_hcmd,
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-3945.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-3945.c
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-3945.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-3945.c	2011-07-15 05:51:18.000000000 -0500
@@ -2874,7 +2874,7 @@
 	.build_addsta_hcmd = iwl3945_build_addsta_hcmd,
 };
 
-static struct iwl_ops iwl3945_ops = {
+static const struct iwl_ops iwl3945_ops = {
 	.ucode = &iwl3945_ucode,
 	.lib = &iwl3945_lib,
 	.hcmd = &iwl3945_hcmd,
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-4965.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-4965.c
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-4965.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-4965.c	2011-07-15 05:51:18.000000000 -0500
@@ -2345,7 +2345,7 @@
 	},
 };
 
-static struct iwl_ops iwl4965_ops = {
+static const struct iwl_ops iwl4965_ops = {
 	.ucode = &iwl4965_ucode,
 	.lib = &iwl4965_lib,
 	.hcmd = &iwl4965_hcmd,
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-5000.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-5000.c
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-5000.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-5000.c	2011-07-15 05:51:18.000000000 -0500
@@ -1633,14 +1633,14 @@
 	 },
 };
 
-struct iwl_ops iwl5000_ops = {
+const struct iwl_ops iwl5000_ops = {
 	.ucode = &iwl5000_ucode,
 	.lib = &iwl5000_lib,
 	.hcmd = &iwl5000_hcmd,
 	.utils = &iwl5000_hcmd_utils,
 };
 
-static struct iwl_ops iwl5150_ops = {
+static const struct iwl_ops iwl5150_ops = {
 	.ucode = &iwl5000_ucode,
 	.lib = &iwl5150_lib,
 	.hcmd = &iwl5000_hcmd,
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-6000.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-6000.c
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-6000.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-6000.c	2011-07-15 05:51:18.000000000 -0500
@@ -146,7 +146,7 @@
 	.calc_rssi = iwl5000_calc_rssi,
 };
 
-static struct iwl_ops iwl6000_ops = {
+static const struct iwl_ops iwl6000_ops = {
 	.ucode = &iwl5000_ucode,
 	.lib = &iwl6000_lib,
 	.hcmd = &iwl5000_hcmd,
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn-rs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-agn-rs.c
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-agn-rs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-agn-rs.c	2011-07-15 05:51:18.000000000 -0500
@@ -857,6 +857,8 @@
 	u8 active_index = 0;
 	s32 tpt = 0;
 
+	pax_track_stack();
+
 	IWL_DEBUG_RATE_LIMIT(priv, "get frame ack response, update rate scale window\n");
 
 	if (!ieee80211_is_data(hdr->frame_control) ||
@@ -2722,6 +2724,8 @@
 	u8 valid_tx_ant = 0;
 	struct iwl_link_quality_cmd *lq_cmd = &lq_sta->lq;
 
+	pax_track_stack();
+
 	/* Override starting rate (index 0) if needed for debug purposes */
 	rs_dbgfs_set_mcs(lq_sta, &new_rate, index);
 
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debugfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-debugfs.c
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debugfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-debugfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -524,6 +524,8 @@
 	int pos = 0;
 	const size_t bufsz = sizeof(buf);
 
+	pax_track_stack();
+
 	pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_ACTIVE:\t %d\n",
 		test_bit(STATUS_HCMD_ACTIVE, &priv->status));
 	pos += scnprintf(buf + pos, bufsz - pos, "STATUS_HCMD_SYNC_ACTIVE: %d\n",
@@ -658,6 +660,8 @@
 	const size_t bufsz = sizeof(buf);
 	ssize_t ret;
 
+	pax_track_stack();
+
 	for (i = 0; i < AC_NUM; i++) {
 		pos += scnprintf(buf + pos, bufsz - pos,
 			"\tcw_min\tcw_max\taifsn\ttxop\n");
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debug.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-debug.h
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-debug.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-debug.h	2011-07-15 05:51:18.000000000 -0500
@@ -118,8 +118,8 @@
 #endif
 
 #else
-#define IWL_DEBUG(__priv, level, fmt, args...)
-#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...)
+#define IWL_DEBUG(__priv, level, fmt, args...) do {} while (0)
+#define IWL_DEBUG_LIMIT(__priv, level, fmt, args...) do {} while (0)
 static inline void iwl_print_hex_dump(struct iwl_priv *priv, int level,
 				      void *p, u32 len)
 {}
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-dev.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-dev.h
--- linux-2.6.32.43/drivers/net/wireless/iwlwifi/iwl-dev.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwlwifi/iwl-dev.h	2011-07-15 05:51:18.000000000 -0500
@@ -68,7 +68,7 @@
 
 /* shared structures from iwl-5000.c */
 extern struct iwl_mod_params iwl50_mod_params;
-extern struct iwl_ops iwl5000_ops;
+extern const struct iwl_ops iwl5000_ops;
 extern struct iwl_ucode_ops iwl5000_ucode;
 extern struct iwl_lib_ops iwl5000_lib;
 extern struct iwl_hcmd_ops iwl5000_hcmd;
diff -uriN linux-2.6.32.43/drivers/net/wireless/iwmc3200wifi/debugfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwmc3200wifi/debugfs.c
--- linux-2.6.32.43/drivers/net/wireless/iwmc3200wifi/debugfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/iwmc3200wifi/debugfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -299,6 +299,8 @@
 	int buf_len = 512;
 	size_t len = 0;
 
+	pax_track_stack();
+
 	if (*ppos != 0)
 		return 0;
 	if (count < sizeof(buf))
diff -uriN linux-2.6.32.43/drivers/net/wireless/libertas/debugfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/libertas/debugfs.c
--- linux-2.6.32.43/drivers/net/wireless/libertas/debugfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/libertas/debugfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -708,7 +708,7 @@
 struct lbs_debugfs_files {
 	const char *name;
 	int perm;
-	struct file_operations fops;
+	const struct file_operations fops;
 };
 
 static const struct lbs_debugfs_files debugfs_files[] = {
diff -uriN linux-2.6.32.43/drivers/net/wireless/rndis_wlan.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/rndis_wlan.c
--- linux-2.6.32.43/drivers/net/wireless/rndis_wlan.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/net/wireless/rndis_wlan.c	2011-07-15 05:51:18.000000000 -0500
@@ -1176,7 +1176,7 @@
 
 	devdbg(usbdev, "set_rts_threshold %i", rts_threshold);
 
-	if (rts_threshold < 0 || rts_threshold > 2347)
+	if (rts_threshold > 2347)
 		rts_threshold = 2347;
 
 	tmp = cpu_to_le32(rts_threshold);
diff -uriN linux-2.6.32.43/drivers/oprofile/buffer_sync.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/buffer_sync.c
--- linux-2.6.32.43/drivers/oprofile/buffer_sync.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/buffer_sync.c	2011-07-15 05:51:18.000000000 -0500
@@ -341,7 +341,7 @@
 		if (cookie == NO_COOKIE)
 			offset = pc;
 		if (cookie == INVALID_COOKIE) {
-			atomic_inc(&oprofile_stats.sample_lost_no_mapping);
+			atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
 			offset = pc;
 		}
 		if (cookie != last_cookie) {
@@ -385,14 +385,14 @@
 	/* add userspace sample */
 
 	if (!mm) {
-		atomic_inc(&oprofile_stats.sample_lost_no_mm);
+		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mm);
 		return 0;
 	}
 
 	cookie = lookup_dcookie(mm, s->eip, &offset);
 
 	if (cookie == INVALID_COOKIE) {
-		atomic_inc(&oprofile_stats.sample_lost_no_mapping);
+		atomic_inc_unchecked(&oprofile_stats.sample_lost_no_mapping);
 		return 0;
 	}
 
@@ -561,7 +561,7 @@
 		/* ignore backtraces if failed to add a sample */
 		if (state == sb_bt_start) {
 			state = sb_bt_ignore;
-			atomic_inc(&oprofile_stats.bt_lost_no_mapping);
+			atomic_inc_unchecked(&oprofile_stats.bt_lost_no_mapping);
 		}
 	}
 	release_mm(mm);
diff -uriN linux-2.6.32.43/drivers/oprofile/event_buffer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/event_buffer.c
--- linux-2.6.32.43/drivers/oprofile/event_buffer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/event_buffer.c	2011-07-15 05:51:18.000000000 -0500
@@ -53,7 +53,7 @@
 	}
 
 	if (buffer_pos == buffer_size) {
-		atomic_inc(&oprofile_stats.event_lost_overflow);
+		atomic_inc_unchecked(&oprofile_stats.event_lost_overflow);
 		return;
 	}
 
diff -uriN linux-2.6.32.43/drivers/oprofile/oprof.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/oprof.c
--- linux-2.6.32.43/drivers/oprofile/oprof.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/oprof.c	2011-07-15 05:51:18.000000000 -0500
@@ -110,7 +110,7 @@
 	if (oprofile_ops.switch_events())
 		return;
 
-	atomic_inc(&oprofile_stats.multiplex_counter);
+	atomic_inc_unchecked(&oprofile_stats.multiplex_counter);
 	start_switch_worker();
 }
 
diff -uriN linux-2.6.32.43/drivers/oprofile/oprofilefs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/oprofilefs.c
--- linux-2.6.32.43/drivers/oprofile/oprofilefs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/oprofilefs.c	2011-07-15 05:51:18.000000000 -0500
@@ -187,7 +187,7 @@
 
 
 int oprofilefs_create_ro_atomic(struct super_block *sb, struct dentry *root,
-	char const *name, atomic_t *val)
+	char const *name, atomic_unchecked_t *val)
 {
 	struct dentry *d = __oprofilefs_create_file(sb, root, name,
 						     &atomic_ro_fops, 0444);
diff -uriN linux-2.6.32.43/drivers/oprofile/oprofile_stats.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/oprofile_stats.c
--- linux-2.6.32.43/drivers/oprofile/oprofile_stats.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/oprofile_stats.c	2011-07-15 05:51:18.000000000 -0500
@@ -30,11 +30,11 @@
 		cpu_buf->sample_invalid_eip = 0;
 	}
 
-	atomic_set(&oprofile_stats.sample_lost_no_mm, 0);
-	atomic_set(&oprofile_stats.sample_lost_no_mapping, 0);
-	atomic_set(&oprofile_stats.event_lost_overflow, 0);
-	atomic_set(&oprofile_stats.bt_lost_no_mapping, 0);
-	atomic_set(&oprofile_stats.multiplex_counter, 0);
+	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mm, 0);
+	atomic_set_unchecked(&oprofile_stats.sample_lost_no_mapping, 0);
+	atomic_set_unchecked(&oprofile_stats.event_lost_overflow, 0);
+	atomic_set_unchecked(&oprofile_stats.bt_lost_no_mapping, 0);
+	atomic_set_unchecked(&oprofile_stats.multiplex_counter, 0);
 }
 
 
diff -uriN linux-2.6.32.43/drivers/oprofile/oprofile_stats.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/oprofile_stats.h
--- linux-2.6.32.43/drivers/oprofile/oprofile_stats.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/oprofile/oprofile_stats.h	2011-07-15 05:51:18.000000000 -0500
@@ -13,11 +13,11 @@
 #include <asm/atomic.h>
 
 struct oprofile_stat_struct {
-	atomic_t sample_lost_no_mm;
-	atomic_t sample_lost_no_mapping;
-	atomic_t bt_lost_no_mapping;
-	atomic_t event_lost_overflow;
-	atomic_t multiplex_counter;
+	atomic_unchecked_t sample_lost_no_mm;
+	atomic_unchecked_t sample_lost_no_mapping;
+	atomic_unchecked_t bt_lost_no_mapping;
+	atomic_unchecked_t event_lost_overflow;
+	atomic_unchecked_t multiplex_counter;
 };
 
 extern struct oprofile_stat_struct oprofile_stats;
diff -uriN linux-2.6.32.43/drivers/parisc/pdc_stable.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/parisc/pdc_stable.c
--- linux-2.6.32.43/drivers/parisc/pdc_stable.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/parisc/pdc_stable.c	2011-07-15 05:51:18.000000000 -0500
@@ -481,7 +481,7 @@
 	return ret;
 }
 
-static struct sysfs_ops pdcspath_attr_ops = {
+static const struct sysfs_ops pdcspath_attr_ops = {
 	.show = pdcspath_attr_show,
 	.store = pdcspath_attr_store,
 };
diff -uriN linux-2.6.32.43/drivers/parport/procfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/parport/procfs.c
--- linux-2.6.32.43/drivers/parport/procfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/parport/procfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -64,7 +64,7 @@
 
 	*ppos += len;
 
-	return copy_to_user(result, buffer, len) ? -EFAULT : 0;
+	return (len > sizeof buffer || copy_to_user(result, buffer, len)) ? -EFAULT : 0;
 }
 
 #ifdef CONFIG_PARPORT_1284
@@ -106,7 +106,7 @@
 
 	*ppos += len;
 
-	return copy_to_user (result, buffer, len) ? -EFAULT : 0;
+	return (len > sizeof buffer || copy_to_user (result, buffer, len)) ? -EFAULT : 0;
 }
 #endif /* IEEE1284.3 support. */
 
diff -uriN linux-2.6.32.43/drivers/pci/hotplug/acpiphp_glue.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/hotplug/acpiphp_glue.c
--- linux-2.6.32.43/drivers/pci/hotplug/acpiphp_glue.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/hotplug/acpiphp_glue.c	2011-07-15 05:51:18.000000000 -0500
@@ -111,7 +111,7 @@
 }
 
 
-static struct acpi_dock_ops acpiphp_dock_ops = {
+static const struct acpi_dock_ops acpiphp_dock_ops = {
 	.handler = handle_hotplug_event_func,
 };
 
diff -uriN linux-2.6.32.43/drivers/pci/hotplug/cpqphp_nvram.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/hotplug/cpqphp_nvram.c
--- linux-2.6.32.43/drivers/pci/hotplug/cpqphp_nvram.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/hotplug/cpqphp_nvram.c	2011-07-15 05:51:18.000000000 -0500
@@ -428,9 +428,13 @@
 
 void compaq_nvram_init (void __iomem *rom_start)
 {
+
+#ifndef CONFIG_PAX_KERNEXEC
 	if (rom_start) {
 		compaq_int15_entry_point = (rom_start + ROM_INT15_PHY_ADDR - ROM_PHY_ADDR);
 	}
+#endif
+
 	dbg("int15 entry  = %p\n", compaq_int15_entry_point);
 
 	/* initialize our int15 lock */
diff -uriN linux-2.6.32.43/drivers/pci/hotplug/fakephp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/hotplug/fakephp.c
--- linux-2.6.32.43/drivers/pci/hotplug/fakephp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/hotplug/fakephp.c	2011-07-15 05:51:18.000000000 -0500
@@ -73,7 +73,7 @@
 }
 
 static struct kobj_type legacy_ktype = {
-	.sysfs_ops = &(struct sysfs_ops){
+	.sysfs_ops = &(const struct sysfs_ops){
 		.store = legacy_store, .show = legacy_show
 	},
 	.release = &legacy_release,
diff -uriN linux-2.6.32.43/drivers/pci/intel-iommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/intel-iommu.c
--- linux-2.6.32.43/drivers/pci/intel-iommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/intel-iommu.c	2011-07-15 05:51:18.000000000 -0500
@@ -2643,7 +2643,7 @@
 	return 0;
 }
 
-static dma_addr_t intel_map_page(struct device *dev, struct page *page,
+dma_addr_t intel_map_page(struct device *dev, struct page *page,
 				 unsigned long offset, size_t size,
 				 enum dma_data_direction dir,
 				 struct dma_attrs *attrs)
@@ -2719,7 +2719,7 @@
 	spin_unlock_irqrestore(&async_umap_flush_lock, flags);
 }
 
-static void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
+void intel_unmap_page(struct device *dev, dma_addr_t dev_addr,
 			     size_t size, enum dma_data_direction dir,
 			     struct dma_attrs *attrs)
 {
@@ -2768,7 +2768,7 @@
 	}
 }
 
-static void *intel_alloc_coherent(struct device *hwdev, size_t size,
+void *intel_alloc_coherent(struct device *hwdev, size_t size,
 				  dma_addr_t *dma_handle, gfp_t flags)
 {
 	void *vaddr;
@@ -2800,7 +2800,7 @@
 	return NULL;
 }
 
-static void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
+void intel_free_coherent(struct device *hwdev, size_t size, void *vaddr,
 				dma_addr_t dma_handle)
 {
 	int order;
@@ -2812,7 +2812,7 @@
 	free_pages((unsigned long)vaddr, order);
 }
 
-static void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
+void intel_unmap_sg(struct device *hwdev, struct scatterlist *sglist,
 			   int nelems, enum dma_data_direction dir,
 			   struct dma_attrs *attrs)
 {
@@ -2872,7 +2872,7 @@
 	return nelems;
 }
 
-static int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
+int intel_map_sg(struct device *hwdev, struct scatterlist *sglist, int nelems,
 			enum dma_data_direction dir, struct dma_attrs *attrs)
 {
 	int i;
@@ -2941,12 +2941,12 @@
 	return nelems;
 }
 
-static int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
+int intel_mapping_error(struct device *dev, dma_addr_t dma_addr)
 {
 	return !dma_addr;
 }
 
-struct dma_map_ops intel_dma_ops = {
+const struct dma_map_ops intel_dma_ops = {
 	.alloc_coherent = intel_alloc_coherent,
 	.free_coherent = intel_free_coherent,
 	.map_sg = intel_map_sg,
diff -uriN linux-2.6.32.43/drivers/pci/pcie/aspm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/pcie/aspm.c
--- linux-2.6.32.43/drivers/pci/pcie/aspm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/pcie/aspm.c	2011-07-15 05:51:18.000000000 -0500
@@ -27,9 +27,9 @@
 #define MODULE_PARAM_PREFIX "pcie_aspm."
 
 /* Note: those are not register definitions */
-#define ASPM_STATE_L0S_UP	(1)	/* Upstream direction L0s state */
-#define ASPM_STATE_L0S_DW	(2)	/* Downstream direction L0s state */
-#define ASPM_STATE_L1		(4)	/* L1 state */
+#define ASPM_STATE_L0S_UP	(1U)	/* Upstream direction L0s state */
+#define ASPM_STATE_L0S_DW	(2U)	/* Downstream direction L0s state */
+#define ASPM_STATE_L1		(4U)	/* L1 state */
 #define ASPM_STATE_L0S		(ASPM_STATE_L0S_UP | ASPM_STATE_L0S_DW)
 #define ASPM_STATE_ALL		(ASPM_STATE_L0S | ASPM_STATE_L1)
 
diff -uriN linux-2.6.32.43/drivers/pci/probe.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/probe.c
--- linux-2.6.32.43/drivers/pci/probe.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/probe.c	2011-07-15 05:51:18.000000000 -0500
@@ -62,14 +62,14 @@
 	return ret;
 }
 
-static ssize_t inline pci_bus_show_cpumaskaffinity(struct device *dev,
+static inline ssize_t pci_bus_show_cpumaskaffinity(struct device *dev,
 					struct device_attribute *attr,
 					char *buf)
 {
 	return pci_bus_show_cpuaffinity(dev, 0, attr, buf);
 }
 
-static ssize_t inline pci_bus_show_cpulistaffinity(struct device *dev,
+static inline ssize_t pci_bus_show_cpulistaffinity(struct device *dev,
 					struct device_attribute *attr,
 					char *buf)
 {
diff -uriN linux-2.6.32.43/drivers/pci/proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/proc.c
--- linux-2.6.32.43/drivers/pci/proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/proc.c	2011-07-15 05:51:18.000000000 -0500
@@ -480,7 +480,16 @@
 static int __init pci_proc_init(void)
 {
 	struct pci_dev *dev = NULL;
+
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR, NULL);
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	proc_bus_pci_dir = proc_mkdir_mode("bus/pci", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
+#endif
+#else
 	proc_bus_pci_dir = proc_mkdir("bus/pci", NULL);
+#endif
 	proc_create("devices", 0, proc_bus_pci_dir,
 		    &proc_bus_pci_dev_operations);
 	proc_initialized = 1;
diff -uriN linux-2.6.32.43/drivers/pci/slot.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/slot.c
--- linux-2.6.32.43/drivers/pci/slot.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pci/slot.c	2011-07-15 05:51:18.000000000 -0500
@@ -29,7 +29,7 @@
 	return attribute->store ? attribute->store(slot, buf, len) : -EIO;
 }
 
-static struct sysfs_ops pci_slot_sysfs_ops = {
+static const struct sysfs_ops pci_slot_sysfs_ops = {
 	.show = pci_slot_attr_show,
 	.store = pci_slot_attr_store,
 };
diff -uriN linux-2.6.32.43/drivers/pcmcia/pcmcia_ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pcmcia/pcmcia_ioctl.c
--- linux-2.6.32.43/drivers/pcmcia/pcmcia_ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pcmcia/pcmcia_ioctl.c	2011-07-15 05:51:18.000000000 -0500
@@ -819,7 +819,7 @@
 	    return -EFAULT;
 	}
     }
-    buf = kmalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
+    buf = kzalloc(sizeof(ds_ioctl_arg_t), GFP_KERNEL);
     if (!buf)
 	return -ENOMEM;
 
diff -uriN linux-2.6.32.43/drivers/platform/x86/acer-wmi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/acer-wmi.c
--- linux-2.6.32.43/drivers/platform/x86/acer-wmi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/acer-wmi.c	2011-07-15 05:51:18.000000000 -0500
@@ -918,7 +918,7 @@
 	return 0;
 }
 
-static struct backlight_ops acer_bl_ops = {
+static const struct backlight_ops acer_bl_ops = {
 	.get_brightness = read_brightness,
 	.update_status = update_bl_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/asus_acpi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/asus_acpi.c
--- linux-2.6.32.43/drivers/platform/x86/asus_acpi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/asus_acpi.c	2011-07-15 05:51:18.000000000 -0500
@@ -1396,7 +1396,7 @@
 	return 0;
 }
 
-static struct backlight_ops asus_backlight_data = {
+static const struct backlight_ops asus_backlight_data = {
 	.get_brightness = read_brightness,
 	.update_status  = set_brightness_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/asus-laptop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/asus-laptop.c
--- linux-2.6.32.43/drivers/platform/x86/asus-laptop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/asus-laptop.c	2011-07-15 05:51:18.000000000 -0500
@@ -250,7 +250,7 @@
  */
 static int read_brightness(struct backlight_device *bd);
 static int update_bl_status(struct backlight_device *bd);
-static struct backlight_ops asusbl_ops = {
+static const struct backlight_ops asusbl_ops = {
 	.get_brightness = read_brightness,
 	.update_status = update_bl_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/compal-laptop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/compal-laptop.c
--- linux-2.6.32.43/drivers/platform/x86/compal-laptop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/compal-laptop.c	2011-07-15 05:51:18.000000000 -0500
@@ -163,7 +163,7 @@
 	return set_lcd_level(b->props.brightness);
 }
 
-static struct backlight_ops compalbl_ops = {
+static const struct backlight_ops compalbl_ops = {
 	.get_brightness = bl_get_brightness,
 	.update_status	= bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/dell-laptop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/dell-laptop.c
--- linux-2.6.32.43/drivers/platform/x86/dell-laptop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/dell-laptop.c	2011-07-15 05:51:18.000000000 -0500
@@ -318,7 +318,7 @@
 	return buffer.output[1];
 }
 
-static struct backlight_ops dell_ops = {
+static const struct backlight_ops dell_ops = {
 	.get_brightness = dell_get_intensity,
 	.update_status  = dell_send_intensity,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/eeepc-laptop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/eeepc-laptop.c
--- linux-2.6.32.43/drivers/platform/x86/eeepc-laptop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/eeepc-laptop.c	2011-07-15 05:51:18.000000000 -0500
@@ -245,7 +245,7 @@
  */
 static int read_brightness(struct backlight_device *bd);
 static int update_bl_status(struct backlight_device *bd);
-static struct backlight_ops eeepcbl_ops = {
+static const struct backlight_ops eeepcbl_ops = {
 	.get_brightness = read_brightness,
 	.update_status = update_bl_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/fujitsu-laptop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/fujitsu-laptop.c
--- linux-2.6.32.43/drivers/platform/x86/fujitsu-laptop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/fujitsu-laptop.c	2011-07-15 05:51:18.000000000 -0500
@@ -436,7 +436,7 @@
 	return ret;
 }
 
-static struct backlight_ops fujitsubl_ops = {
+static const struct backlight_ops fujitsubl_ops = {
 	.get_brightness = bl_get_brightness,
 	.update_status = bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/msi-laptop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/msi-laptop.c
--- linux-2.6.32.43/drivers/platform/x86/msi-laptop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/msi-laptop.c	2011-07-15 05:51:18.000000000 -0500
@@ -161,7 +161,7 @@
 	return set_lcd_level(b->props.brightness);
 }
 
-static struct backlight_ops msibl_ops = {
+static const struct backlight_ops msibl_ops = {
 	.get_brightness = bl_get_brightness,
 	.update_status  = bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/panasonic-laptop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/panasonic-laptop.c
--- linux-2.6.32.43/drivers/platform/x86/panasonic-laptop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/panasonic-laptop.c	2011-07-15 05:51:18.000000000 -0500
@@ -352,7 +352,7 @@
 	return acpi_pcc_write_sset(pcc, SINF_DC_CUR_BRIGHT, bright);
 }
 
-static struct backlight_ops pcc_backlight_ops = {
+static const struct backlight_ops pcc_backlight_ops = {
 	.get_brightness	= bl_get,
 	.update_status	= bl_set_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/sony-laptop.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/sony-laptop.c
--- linux-2.6.32.43/drivers/platform/x86/sony-laptop.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/sony-laptop.c	2011-07-15 05:51:18.000000000 -0500
@@ -850,7 +850,7 @@
 }
 
 static struct backlight_device *sony_backlight_device;
-static struct backlight_ops sony_backlight_ops = {
+static const struct backlight_ops sony_backlight_ops = {
 	.update_status = sony_backlight_update_status,
 	.get_brightness = sony_backlight_get_brightness,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/thinkpad_acpi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/thinkpad_acpi.c
--- linux-2.6.32.43/drivers/platform/x86/thinkpad_acpi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/thinkpad_acpi.c	2011-07-15 05:51:18.000000000 -0500
@@ -6122,7 +6122,7 @@
 			       BACKLIGHT_UPDATE_HOTKEY);
 }
 
-static struct backlight_ops ibm_backlight_data = {
+static const struct backlight_ops ibm_backlight_data = {
 	.get_brightness = brightness_get,
 	.update_status  = brightness_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/platform/x86/toshiba_acpi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/toshiba_acpi.c
--- linux-2.6.32.43/drivers/platform/x86/toshiba_acpi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/platform/x86/toshiba_acpi.c	2011-07-15 05:51:18.000000000 -0500
@@ -671,7 +671,7 @@
 	return AE_OK;
 }
 
-static struct backlight_ops toshiba_backlight_data = {
+static const struct backlight_ops toshiba_backlight_data = {
         .get_brightness = get_lcd,
         .update_status  = set_lcd_status,
 };
diff -uriN linux-2.6.32.43/drivers/pnp/pnpbios/bioscalls.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pnp/pnpbios/bioscalls.c
--- linux-2.6.32.43/drivers/pnp/pnpbios/bioscalls.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pnp/pnpbios/bioscalls.c	2011-07-15 05:51:18.000000000 -0500
@@ -60,7 +60,7 @@
 	set_desc_limit(&gdt[(selname) >> 3], (size) - 1); \
 } while(0)
 
-static struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4092,
+static const struct desc_struct bad_bios_desc = GDT_ENTRY_INIT(0x4093,
 			(unsigned long)__va(0x400UL), PAGE_SIZE - 0x400 - 1);
 
 /*
@@ -97,7 +97,10 @@
 
 	cpu = get_cpu();
 	save_desc_40 = get_cpu_gdt_table(cpu)[0x40 / 8];
+
+	pax_open_kernel();
 	get_cpu_gdt_table(cpu)[0x40 / 8] = bad_bios_desc;
+	pax_close_kernel();
 
 	/* On some boxes IRQ's during PnP BIOS calls are deadly.  */
 	spin_lock_irqsave(&pnp_bios_lock, flags);
@@ -135,7 +138,10 @@
 			     :"memory");
 	spin_unlock_irqrestore(&pnp_bios_lock, flags);
 
+	pax_open_kernel();
 	get_cpu_gdt_table(cpu)[0x40 / 8] = save_desc_40;
+	pax_close_kernel();
+
 	put_cpu();
 
 	/* If we get here and this is set then the PnP BIOS faulted on us. */
@@ -469,7 +475,7 @@
 	return status;
 }
 
-void pnpbios_calls_init(union pnp_bios_install_struct *header)
+void __init pnpbios_calls_init(union pnp_bios_install_struct *header)
 {
 	int i;
 
@@ -477,6 +483,8 @@
 	pnp_bios_callpoint.offset = header->fields.pm16offset;
 	pnp_bios_callpoint.segment = PNP_CS16;
 
+	pax_open_kernel();
+
 	for_each_possible_cpu(i) {
 		struct desc_struct *gdt = get_cpu_gdt_table(i);
 		if (!gdt)
@@ -488,4 +496,6 @@
 		set_desc_base(&gdt[GDT_ENTRY_PNPBIOS_DS],
 			 (unsigned long)__va(header->fields.pm16dseg));
 	}
+
+	pax_close_kernel();
 }
diff -uriN linux-2.6.32.43/drivers/pnp/resource.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pnp/resource.c
--- linux-2.6.32.43/drivers/pnp/resource.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/pnp/resource.c	2011-07-15 05:51:18.000000000 -0500
@@ -355,7 +355,7 @@
 		return 1;
 
 	/* check if the resource is valid */
-	if (*irq < 0 || *irq > 15)
+	if (*irq > 15)
 		return 0;
 
 	/* check if the resource is reserved */
@@ -419,7 +419,7 @@
 		return 1;
 
 	/* check if the resource is valid */
-	if (*dma < 0 || *dma == 4 || *dma > 7)
+	if (*dma == 4 || *dma > 7)
 		return 0;
 
 	/* check if the resource is reserved */
diff -uriN linux-2.6.32.43/drivers/rtc/rtc-dev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/rtc/rtc-dev.c
--- linux-2.6.32.43/drivers/rtc/rtc-dev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/rtc/rtc-dev.c	2011-07-15 05:51:18.000000000 -0500
@@ -14,6 +14,7 @@
 #include <linux/module.h>
 #include <linux/rtc.h>
 #include <linux/sched.h>
+#include <linux/grsecurity.h>
 #include "rtc-core.h"
 
 static dev_t rtc_devt;
@@ -357,6 +358,8 @@
 		if (copy_from_user(&tm, uarg, sizeof(tm)))
 			return -EFAULT;
 
+		gr_log_timechange();
+
 		return rtc_set_time(rtc, &tm);
 
 	case RTC_PIE_ON:
diff -uriN linux-2.6.32.43/drivers/s390/cio/qdio_perf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/s390/cio/qdio_perf.c
--- linux-2.6.32.43/drivers/s390/cio/qdio_perf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/s390/cio/qdio_perf.c	2011-07-15 05:51:18.000000000 -0500
@@ -31,51 +31,51 @@
 static int qdio_perf_proc_show(struct seq_file *m, void *v)
 {
 	seq_printf(m, "Number of qdio interrupts\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.qdio_int));
+		   (long)atomic_long_read_unchecked(&perf_stats.qdio_int));
 	seq_printf(m, "Number of PCI interrupts\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.pci_int));
+		   (long)atomic_long_read_unchecked(&perf_stats.pci_int));
 	seq_printf(m, "Number of adapter interrupts\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.thin_int));
+		   (long)atomic_long_read_unchecked(&perf_stats.thin_int));
 	seq_printf(m, "\n");
 	seq_printf(m, "Inbound tasklet runs\t\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.tasklet_inbound));
+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_inbound));
 	seq_printf(m, "Outbound tasklet runs\t\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.tasklet_outbound));
+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_outbound));
 	seq_printf(m, "Adapter interrupt tasklet runs/loops\t\t: %li/%li\n",
-		   (long)atomic_long_read(&perf_stats.tasklet_thinint),
-		   (long)atomic_long_read(&perf_stats.tasklet_thinint_loop));
+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint),
+		   (long)atomic_long_read_unchecked(&perf_stats.tasklet_thinint_loop));
 	seq_printf(m, "Adapter interrupt inbound tasklet runs/loops\t: %li/%li\n",
-		   (long)atomic_long_read(&perf_stats.thinint_inbound),
-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop));
+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound),
+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop));
 	seq_printf(m, "\n");
 	seq_printf(m, "Number of SIGA In issued\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.siga_in));
+		   (long)atomic_long_read_unchecked(&perf_stats.siga_in));
 	seq_printf(m, "Number of SIGA Out issued\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.siga_out));
+		   (long)atomic_long_read_unchecked(&perf_stats.siga_out));
 	seq_printf(m, "Number of SIGA Sync issued\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.siga_sync));
+		   (long)atomic_long_read_unchecked(&perf_stats.siga_sync));
 	seq_printf(m, "\n");
 	seq_printf(m, "Number of inbound transfers\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.inbound_handler));
+		   (long)atomic_long_read_unchecked(&perf_stats.inbound_handler));
 	seq_printf(m, "Number of outbound transfers\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.outbound_handler));
+		   (long)atomic_long_read_unchecked(&perf_stats.outbound_handler));
 	seq_printf(m, "\n");
 	seq_printf(m, "Number of fast requeues (outg. SBAL w/o SIGA)\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.fast_requeue));
+		   (long)atomic_long_read_unchecked(&perf_stats.fast_requeue));
 	seq_printf(m, "Number of outbound target full condition\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.outbound_target_full));
+		   (long)atomic_long_read_unchecked(&perf_stats.outbound_target_full));
 	seq_printf(m, "Number of outbound tasklet mod_timer calls\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.debug_tl_out_timer));
+		   (long)atomic_long_read_unchecked(&perf_stats.debug_tl_out_timer));
 	seq_printf(m, "Number of stop polling calls\t\t\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.debug_stop_polling));
+		   (long)atomic_long_read_unchecked(&perf_stats.debug_stop_polling));
 	seq_printf(m, "AI inbound tasklet loops after stop polling\t: %li\n",
-		   (long)atomic_long_read(&perf_stats.thinint_inbound_loop2));
+		   (long)atomic_long_read_unchecked(&perf_stats.thinint_inbound_loop2));
 	seq_printf(m, "QEBSM EQBS total/incomplete\t\t\t: %li/%li\n",
-		   (long)atomic_long_read(&perf_stats.debug_eqbs_all),
-		   (long)atomic_long_read(&perf_stats.debug_eqbs_incomplete));
+		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_all),
+		   (long)atomic_long_read_unchecked(&perf_stats.debug_eqbs_incomplete));
 	seq_printf(m, "QEBSM SQBS total/incomplete\t\t\t: %li/%li\n",
-		   (long)atomic_long_read(&perf_stats.debug_sqbs_all),
-		   (long)atomic_long_read(&perf_stats.debug_sqbs_incomplete));
+		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_all),
+		   (long)atomic_long_read_unchecked(&perf_stats.debug_sqbs_incomplete));
 	seq_printf(m, "\n");
 	return 0;
 }
diff -uriN linux-2.6.32.43/drivers/s390/cio/qdio_perf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/s390/cio/qdio_perf.h
--- linux-2.6.32.43/drivers/s390/cio/qdio_perf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/s390/cio/qdio_perf.h	2011-07-15 05:51:18.000000000 -0500
@@ -13,46 +13,46 @@
 
 struct qdio_perf_stats {
 	/* interrupt handler calls */
-	atomic_long_t qdio_int;
-	atomic_long_t pci_int;
-	atomic_long_t thin_int;
+	atomic_long_unchecked_t qdio_int;
+	atomic_long_unchecked_t pci_int;
+	atomic_long_unchecked_t thin_int;
 
 	/* tasklet runs */
-	atomic_long_t tasklet_inbound;
-	atomic_long_t tasklet_outbound;
-	atomic_long_t tasklet_thinint;
-	atomic_long_t tasklet_thinint_loop;
-	atomic_long_t thinint_inbound;
-	atomic_long_t thinint_inbound_loop;
-	atomic_long_t thinint_inbound_loop2;
+	atomic_long_unchecked_t tasklet_inbound;
+	atomic_long_unchecked_t tasklet_outbound;
+	atomic_long_unchecked_t tasklet_thinint;
+	atomic_long_unchecked_t tasklet_thinint_loop;
+	atomic_long_unchecked_t thinint_inbound;
+	atomic_long_unchecked_t thinint_inbound_loop;
+	atomic_long_unchecked_t thinint_inbound_loop2;
 
 	/* signal adapter calls */
-	atomic_long_t siga_out;
-	atomic_long_t siga_in;
-	atomic_long_t siga_sync;
+	atomic_long_unchecked_t siga_out;
+	atomic_long_unchecked_t siga_in;
+	atomic_long_unchecked_t siga_sync;
 
 	/* misc */
-	atomic_long_t inbound_handler;
-	atomic_long_t outbound_handler;
-	atomic_long_t fast_requeue;
-	atomic_long_t outbound_target_full;
+	atomic_long_unchecked_t inbound_handler;
+	atomic_long_unchecked_t outbound_handler;
+	atomic_long_unchecked_t fast_requeue;
+	atomic_long_unchecked_t outbound_target_full;
 
 	/* for debugging */
-	atomic_long_t debug_tl_out_timer;
-	atomic_long_t debug_stop_polling;
-	atomic_long_t debug_eqbs_all;
-	atomic_long_t debug_eqbs_incomplete;
-	atomic_long_t debug_sqbs_all;
-	atomic_long_t debug_sqbs_incomplete;
+	atomic_long_unchecked_t debug_tl_out_timer;
+	atomic_long_unchecked_t debug_stop_polling;
+	atomic_long_unchecked_t debug_eqbs_all;
+	atomic_long_unchecked_t debug_eqbs_incomplete;
+	atomic_long_unchecked_t debug_sqbs_all;
+	atomic_long_unchecked_t debug_sqbs_incomplete;
 };
 
 extern struct qdio_perf_stats perf_stats;
 extern int qdio_performance_stats;
 
-static inline void qdio_perf_stat_inc(atomic_long_t *count)
+static inline void qdio_perf_stat_inc(atomic_long_unchecked_t *count)
 {
 	if (qdio_performance_stats)
-		atomic_long_inc(count);
+		atomic_long_inc_unchecked(count);
 }
 
 int qdio_setup_perf_stats(void);
diff -uriN linux-2.6.32.43/drivers/scsi/aacraid/commctrl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/aacraid/commctrl.c
--- linux-2.6.32.43/drivers/scsi/aacraid/commctrl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/aacraid/commctrl.c	2011-07-15 05:51:18.000000000 -0500
@@ -481,6 +481,7 @@
 	u32 actual_fibsize64, actual_fibsize = 0;
 	int i;
 
+	pax_track_stack();
 
 	if (dev->in_reset) {
 		dprintk((KERN_DEBUG"aacraid: send raw srb -EBUSY\n"));
diff -uriN linux-2.6.32.43/drivers/scsi/aic94xx/aic94xx_init.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/aic94xx/aic94xx_init.c
--- linux-2.6.32.43/drivers/scsi/aic94xx/aic94xx_init.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/aic94xx/aic94xx_init.c	2011-07-15 05:51:18.000000000 -0500
@@ -485,7 +485,7 @@
 			flash_error_table[i].reason);
 }
 
-static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUGO,
+static DEVICE_ATTR(update_bios, S_IRUGO|S_IWUSR,
 	asd_show_update_bios, asd_store_update_bios);
 
 static int asd_create_dev_attrs(struct asd_ha_struct *asd_ha)
diff -uriN linux-2.6.32.43/drivers/scsi/BusLogic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/BusLogic.c
--- linux-2.6.32.43/drivers/scsi/BusLogic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/BusLogic.c	2011-07-15 05:51:18.000000000 -0500
@@ -961,6 +961,8 @@
 static void __init BusLogic_InitializeProbeInfoList(struct BusLogic_HostAdapter
 						    *PrototypeHostAdapter)
 {
+	pax_track_stack();
+
 	/*
 	   If a PCI BIOS is present, interrogate it for MultiMaster and FlashPoint
 	   Host Adapters; otherwise, default to the standard ISA MultiMaster probe.
diff -uriN linux-2.6.32.43/drivers/scsi/dpt_i2o.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/dpt_i2o.c
--- linux-2.6.32.43/drivers/scsi/dpt_i2o.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/dpt_i2o.c	2011-07-15 05:51:18.000000000 -0500
@@ -1804,6 +1804,8 @@
 	dma_addr_t addr;
 	ulong flags = 0;
 
+	pax_track_stack();
+
 	memset(&msg, 0, MAX_MESSAGE_SIZE*4);
 	// get user msg size in u32s 
 	if(get_user(size, &user_msg[0])){
@@ -2297,6 +2299,8 @@
 	s32 rcode;
 	dma_addr_t addr;
 
+	pax_track_stack();
+
 	memset(msg, 0 , sizeof(msg));
 	len = scsi_bufflen(cmd);
 	direction = 0x00000000;	
diff -uriN linux-2.6.32.43/drivers/scsi/eata.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/eata.c
--- linux-2.6.32.43/drivers/scsi/eata.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/eata.c	2011-07-15 05:51:18.000000000 -0500
@@ -1087,6 +1087,8 @@
 	struct hostdata *ha;
 	char name[16];
 
+	pax_track_stack();
+
 	sprintf(name, "%s%d", driver_name, j);
 
 	if (!request_region(port_base, REGION_SIZE, driver_name)) {
diff -uriN linux-2.6.32.43/drivers/scsi/fcoe/libfcoe.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/fcoe/libfcoe.c
--- linux-2.6.32.43/drivers/scsi/fcoe/libfcoe.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/fcoe/libfcoe.c	2011-07-15 05:51:18.000000000 -0500
@@ -809,6 +809,8 @@
 	size_t rlen;
 	size_t dlen;
 
+	pax_track_stack();
+
 	fiph = (struct fip_header *)skb->data;
 	sub = fiph->fip_subcode;
 	if (sub != FIP_SC_REQ && sub != FIP_SC_REP)
diff -uriN linux-2.6.32.43/drivers/scsi/gdth.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/gdth.c
--- linux-2.6.32.43/drivers/scsi/gdth.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/gdth.c	2011-07-15 05:51:18.000000000 -0500
@@ -4102,6 +4102,8 @@
     ulong flags;
     gdth_ha_str *ha;
 
+    pax_track_stack();
+
     if (copy_from_user(&ldrv, arg, sizeof(gdth_ioctl_lockdrv)))
         return -EFAULT;
     ha = gdth_find_ha(ldrv.ionode);
@@ -4134,6 +4136,8 @@
     gdth_ha_str *ha;
     int rval;
 
+    pax_track_stack();
+
     if (copy_from_user(&res, arg, sizeof(gdth_ioctl_reset)) ||
         res.number >= MAX_HDRIVES)
         return -EFAULT;
@@ -4169,6 +4173,8 @@
     gdth_ha_str *ha;
     int rval;
 
+    pax_track_stack();
+
     if (copy_from_user(&gen, arg, sizeof(gdth_ioctl_general)))
         return -EFAULT;
     ha = gdth_find_ha(gen.ionode);
@@ -4625,6 +4631,9 @@
     int             i;
     gdth_cmd_str    gdtcmd;
     char            cmnd[MAX_COMMAND_SIZE];   
+
+    pax_track_stack();
+
     memset(cmnd, 0xff, MAX_COMMAND_SIZE);
 
     TRACE2(("gdth_flush() hanum %d\n", ha->hanum));
diff -uriN linux-2.6.32.43/drivers/scsi/gdth_proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/gdth_proc.c
--- linux-2.6.32.43/drivers/scsi/gdth_proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/gdth_proc.c	2011-07-15 05:51:18.000000000 -0500
@@ -46,6 +46,9 @@
     ulong64         paddr;
 
     char            cmnd[MAX_COMMAND_SIZE];
+
+    pax_track_stack();
+
     memset(cmnd, 0xff, 12);
     memset(&gdtcmd, 0, sizeof(gdth_cmd_str));
 
@@ -174,6 +177,8 @@
     gdth_hget_str *phg;
     char cmnd[MAX_COMMAND_SIZE];
 
+    pax_track_stack();
+
     gdtcmd = kmalloc(sizeof(*gdtcmd), GFP_KERNEL);
     estr = kmalloc(sizeof(*estr), GFP_KERNEL);
     if (!gdtcmd || !estr)
diff -uriN linux-2.6.32.43/drivers/scsi/hosts.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/hosts.c
--- linux-2.6.32.43/drivers/scsi/hosts.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/hosts.c	2011-07-15 05:51:18.000000000 -0500
@@ -40,7 +40,7 @@
 #include "scsi_logging.h"
 
 
-static atomic_t scsi_host_next_hn;	/* host_no for next new host */
+static atomic_unchecked_t scsi_host_next_hn;	/* host_no for next new host */
 
 
 static void scsi_host_cls_release(struct device *dev)
@@ -344,7 +344,7 @@
 	 * subtract one because we increment first then return, but we need to
 	 * know what the next host number was before increment
 	 */
-	shost->host_no = atomic_inc_return(&scsi_host_next_hn) - 1;
+	shost->host_no = atomic_inc_return_unchecked(&scsi_host_next_hn) - 1;
 	shost->dma_channel = 0xff;
 
 	/* These three are default values which can be overridden */
diff -uriN linux-2.6.32.43/drivers/scsi/ipr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/ipr.c
--- linux-2.6.32.43/drivers/scsi/ipr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/ipr.c	2011-07-15 05:51:18.000000000 -0500
@@ -5286,7 +5286,7 @@
 	return true;
 }
 
-static struct ata_port_operations ipr_sata_ops = {
+static const struct ata_port_operations ipr_sata_ops = {
 	.phy_reset = ipr_ata_phy_reset,
 	.hardreset = ipr_sata_reset,
 	.post_internal_cmd = ipr_ata_post_internal,
diff -uriN linux-2.6.32.43/drivers/scsi/libfc/fc_exch.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/libfc/fc_exch.c
--- linux-2.6.32.43/drivers/scsi/libfc/fc_exch.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/libfc/fc_exch.c	2011-07-15 05:51:18.000000000 -0500
@@ -86,12 +86,12 @@
 	 * all together if not used XXX
 	 */
 	struct {
-		atomic_t no_free_exch;
-		atomic_t no_free_exch_xid;
-		atomic_t xid_not_found;
-		atomic_t xid_busy;
-		atomic_t seq_not_found;
-		atomic_t non_bls_resp;
+		atomic_unchecked_t no_free_exch;
+		atomic_unchecked_t no_free_exch_xid;
+		atomic_unchecked_t xid_not_found;
+		atomic_unchecked_t xid_busy;
+		atomic_unchecked_t seq_not_found;
+		atomic_unchecked_t non_bls_resp;
 	} stats;
 };
 #define	fc_seq_exch(sp) container_of(sp, struct fc_exch, seq)
@@ -510,7 +510,7 @@
 	/* allocate memory for exchange */
 	ep = mempool_alloc(mp->ep_pool, GFP_ATOMIC);
 	if (!ep) {
-		atomic_inc(&mp->stats.no_free_exch);
+		atomic_inc_unchecked(&mp->stats.no_free_exch);
 		goto out;
 	}
 	memset(ep, 0, sizeof(*ep));
@@ -557,7 +557,7 @@
 	return ep;
 err:
 	spin_unlock_bh(&pool->lock);
-	atomic_inc(&mp->stats.no_free_exch_xid);
+	atomic_inc_unchecked(&mp->stats.no_free_exch_xid);
 	mempool_free(ep, mp->ep_pool);
 	return NULL;
 }
@@ -690,7 +690,7 @@
 		xid = ntohs(fh->fh_ox_id);	/* we originated exch */
 		ep = fc_exch_find(mp, xid);
 		if (!ep) {
-			atomic_inc(&mp->stats.xid_not_found);
+			atomic_inc_unchecked(&mp->stats.xid_not_found);
 			reject = FC_RJT_OX_ID;
 			goto out;
 		}
@@ -720,7 +720,7 @@
 		ep = fc_exch_find(mp, xid);
 		if ((f_ctl & FC_FC_FIRST_SEQ) && fc_sof_is_init(fr_sof(fp))) {
 			if (ep) {
-				atomic_inc(&mp->stats.xid_busy);
+				atomic_inc_unchecked(&mp->stats.xid_busy);
 				reject = FC_RJT_RX_ID;
 				goto rel;
 			}
@@ -731,7 +731,7 @@
 			}
 			xid = ep->xid;	/* get our XID */
 		} else if (!ep) {
-			atomic_inc(&mp->stats.xid_not_found);
+			atomic_inc_unchecked(&mp->stats.xid_not_found);
 			reject = FC_RJT_RX_ID;	/* XID not found */
 			goto out;
 		}
@@ -752,7 +752,7 @@
 	} else {
 		sp = &ep->seq;
 		if (sp->id != fh->fh_seq_id) {
-			atomic_inc(&mp->stats.seq_not_found);
+			atomic_inc_unchecked(&mp->stats.seq_not_found);
 			reject = FC_RJT_SEQ_ID;	/* sequence/exch should exist */
 			goto rel;
 		}
@@ -1163,22 +1163,22 @@
 
 	ep = fc_exch_find(mp, ntohs(fh->fh_ox_id));
 	if (!ep) {
-		atomic_inc(&mp->stats.xid_not_found);
+		atomic_inc_unchecked(&mp->stats.xid_not_found);
 		goto out;
 	}
 	if (ep->esb_stat & ESB_ST_COMPLETE) {
-		atomic_inc(&mp->stats.xid_not_found);
+		atomic_inc_unchecked(&mp->stats.xid_not_found);
 		goto out;
 	}
 	if (ep->rxid == FC_XID_UNKNOWN)
 		ep->rxid = ntohs(fh->fh_rx_id);
 	if (ep->sid != 0 && ep->sid != ntoh24(fh->fh_d_id)) {
-		atomic_inc(&mp->stats.xid_not_found);
+		atomic_inc_unchecked(&mp->stats.xid_not_found);
 		goto rel;
 	}
 	if (ep->did != ntoh24(fh->fh_s_id) &&
 	    ep->did != FC_FID_FLOGI) {
-		atomic_inc(&mp->stats.xid_not_found);
+		atomic_inc_unchecked(&mp->stats.xid_not_found);
 		goto rel;
 	}
 	sof = fr_sof(fp);
@@ -1189,7 +1189,7 @@
 	} else {
 		sp = &ep->seq;
 		if (sp->id != fh->fh_seq_id) {
-			atomic_inc(&mp->stats.seq_not_found);
+			atomic_inc_unchecked(&mp->stats.seq_not_found);
 			goto rel;
 		}
 	}
@@ -1249,9 +1249,9 @@
 	sp = fc_seq_lookup_orig(mp, fp);	/* doesn't hold sequence */
 
 	if (!sp)
-		atomic_inc(&mp->stats.xid_not_found);
+		atomic_inc_unchecked(&mp->stats.xid_not_found);
 	else
-		atomic_inc(&mp->stats.non_bls_resp);
+		atomic_inc_unchecked(&mp->stats.non_bls_resp);
 
 	fc_frame_free(fp);
 }
diff -uriN linux-2.6.32.43/drivers/scsi/libsas/sas_ata.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/libsas/sas_ata.c
--- linux-2.6.32.43/drivers/scsi/libsas/sas_ata.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/libsas/sas_ata.c	2011-07-15 05:51:18.000000000 -0500
@@ -343,7 +343,7 @@
 	}
 }
 
-static struct ata_port_operations sas_sata_ops = {
+static const struct ata_port_operations sas_sata_ops = {
 	.phy_reset		= sas_ata_phy_reset,
 	.post_internal_cmd	= sas_ata_post_internal,
 	.qc_defer               = ata_std_qc_defer,
diff -uriN linux-2.6.32.43/drivers/scsi/lpfc/lpfc_debugfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/lpfc/lpfc_debugfs.c
--- linux-2.6.32.43/drivers/scsi/lpfc/lpfc_debugfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/lpfc/lpfc_debugfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -124,7 +124,7 @@
 	int  len;
 };
 
-static atomic_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
+static atomic_unchecked_t lpfc_debugfs_seq_trc_cnt = ATOMIC_INIT(0);
 static unsigned long lpfc_debugfs_start_time = 0L;
 
 /**
@@ -158,7 +158,7 @@
 	lpfc_debugfs_enable = 0;
 
 	len = 0;
-	index = (atomic_read(&vport->disc_trc_cnt) + 1) &
+	index = (atomic_read_unchecked(&vport->disc_trc_cnt) + 1) &
 		(lpfc_debugfs_max_disc_trc - 1);
 	for (i = index; i < lpfc_debugfs_max_disc_trc; i++) {
 		dtp = vport->disc_trc + i;
@@ -219,7 +219,7 @@
 	lpfc_debugfs_enable = 0;
 
 	len = 0;
-	index = (atomic_read(&phba->slow_ring_trc_cnt) + 1) &
+	index = (atomic_read_unchecked(&phba->slow_ring_trc_cnt) + 1) &
 		(lpfc_debugfs_max_slow_ring_trc - 1);
 	for (i = index; i < lpfc_debugfs_max_slow_ring_trc; i++) {
 		dtp = phba->slow_ring_trc + i;
@@ -397,6 +397,8 @@
 	uint32_t *ptr;
 	char buffer[1024];
 
+	pax_track_stack();
+
 	off = 0;
 	spin_lock_irq(&phba->hbalock);
 
@@ -634,14 +636,14 @@
 		!vport || !vport->disc_trc)
 		return;
 
-	index = atomic_inc_return(&vport->disc_trc_cnt) &
+	index = atomic_inc_return_unchecked(&vport->disc_trc_cnt) &
 		(lpfc_debugfs_max_disc_trc - 1);
 	dtp = vport->disc_trc + index;
 	dtp->fmt = fmt;
 	dtp->data1 = data1;
 	dtp->data2 = data2;
 	dtp->data3 = data3;
-	dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
+	dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
 	dtp->jif = jiffies;
 #endif
 	return;
@@ -672,14 +674,14 @@
 		!phba || !phba->slow_ring_trc)
 		return;
 
-	index = atomic_inc_return(&phba->slow_ring_trc_cnt) &
+	index = atomic_inc_return_unchecked(&phba->slow_ring_trc_cnt) &
 		(lpfc_debugfs_max_slow_ring_trc - 1);
 	dtp = phba->slow_ring_trc + index;
 	dtp->fmt = fmt;
 	dtp->data1 = data1;
 	dtp->data2 = data2;
 	dtp->data3 = data3;
-	dtp->seq_cnt = atomic_inc_return(&lpfc_debugfs_seq_trc_cnt);
+	dtp->seq_cnt = atomic_inc_return_unchecked(&lpfc_debugfs_seq_trc_cnt);
 	dtp->jif = jiffies;
 #endif
 	return;
@@ -1364,7 +1366,7 @@
 						 "slow_ring buffer\n");
 				goto debug_failed;
 			}
-			atomic_set(&phba->slow_ring_trc_cnt, 0);
+			atomic_set_unchecked(&phba->slow_ring_trc_cnt, 0);
 			memset(phba->slow_ring_trc, 0,
 				(sizeof(struct lpfc_debugfs_trc) *
 				lpfc_debugfs_max_slow_ring_trc));
@@ -1410,7 +1412,7 @@
 				 "buffer\n");
 		goto debug_failed;
 	}
-	atomic_set(&vport->disc_trc_cnt, 0);
+	atomic_set_unchecked(&vport->disc_trc_cnt, 0);
 
 	snprintf(name, sizeof(name), "discovery_trace");
 	vport->debug_disc_trc =
diff -uriN linux-2.6.32.43/drivers/scsi/lpfc/lpfc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/lpfc/lpfc.h
--- linux-2.6.32.43/drivers/scsi/lpfc/lpfc.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/lpfc/lpfc.h	2011-07-15 05:51:18.000000000 -0500
@@ -400,7 +400,7 @@
 	struct dentry *debug_nodelist;
 	struct dentry *vport_debugfs_root;
 	struct lpfc_debugfs_trc *disc_trc;
-	atomic_t disc_trc_cnt;
+	atomic_unchecked_t disc_trc_cnt;
 #endif
 	uint8_t stat_data_enabled;
 	uint8_t stat_data_blocked;
@@ -725,8 +725,8 @@
 	struct timer_list fabric_block_timer;
 	unsigned long bit_flags;
 #define	FABRIC_COMANDS_BLOCKED	0
-	atomic_t num_rsrc_err;
-	atomic_t num_cmd_success;
+	atomic_unchecked_t num_rsrc_err;
+	atomic_unchecked_t num_cmd_success;
 	unsigned long last_rsrc_error_time;
 	unsigned long last_ramp_down_time;
 	unsigned long last_ramp_up_time;
@@ -740,7 +740,7 @@
 	struct dentry *debug_dumpDif;    /* BlockGuard BPL*/
 	struct dentry *debug_slow_ring_trc;
 	struct lpfc_debugfs_trc *slow_ring_trc;
-	atomic_t slow_ring_trc_cnt;
+	atomic_unchecked_t slow_ring_trc_cnt;
 #endif
 
 	/* Used for deferred freeing of ELS data buffers */
diff -uriN linux-2.6.32.43/drivers/scsi/lpfc/lpfc_scsi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/lpfc/lpfc_scsi.c
--- linux-2.6.32.43/drivers/scsi/lpfc/lpfc_scsi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/lpfc/lpfc_scsi.c	2011-07-15 05:51:18.000000000 -0500
@@ -259,7 +259,7 @@
 	uint32_t evt_posted;
 
 	spin_lock_irqsave(&phba->hbalock, flags);
-	atomic_inc(&phba->num_rsrc_err);
+	atomic_inc_unchecked(&phba->num_rsrc_err);
 	phba->last_rsrc_error_time = jiffies;
 
 	if ((phba->last_ramp_down_time + QUEUE_RAMP_DOWN_INTERVAL) > jiffies) {
@@ -300,7 +300,7 @@
 	unsigned long flags;
 	struct lpfc_hba *phba = vport->phba;
 	uint32_t evt_posted;
-	atomic_inc(&phba->num_cmd_success);
+	atomic_inc_unchecked(&phba->num_cmd_success);
 
 	if (vport->cfg_lun_queue_depth <= queue_depth)
 		return;
@@ -343,8 +343,8 @@
 	int i;
 	struct lpfc_rport_data *rdata;
 
-	num_rsrc_err = atomic_read(&phba->num_rsrc_err);
-	num_cmd_success = atomic_read(&phba->num_cmd_success);
+	num_rsrc_err = atomic_read_unchecked(&phba->num_rsrc_err);
+	num_cmd_success = atomic_read_unchecked(&phba->num_cmd_success);
 
 	vports = lpfc_create_vport_work_array(phba);
 	if (vports != NULL)
@@ -378,8 +378,8 @@
 			}
 		}
 	lpfc_destroy_vport_work_array(phba, vports);
-	atomic_set(&phba->num_rsrc_err, 0);
-	atomic_set(&phba->num_cmd_success, 0);
+	atomic_set_unchecked(&phba->num_rsrc_err, 0);
+	atomic_set_unchecked(&phba->num_cmd_success, 0);
 }
 
 /**
@@ -427,8 +427,8 @@
 			}
 		}
 	lpfc_destroy_vport_work_array(phba, vports);
-	atomic_set(&phba->num_rsrc_err, 0);
-	atomic_set(&phba->num_cmd_success, 0);
+	atomic_set_unchecked(&phba->num_rsrc_err, 0);
+	atomic_set_unchecked(&phba->num_cmd_success, 0);
 }
 
 /**
diff -uriN linux-2.6.32.43/drivers/scsi/megaraid/megaraid_mbox.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/megaraid/megaraid_mbox.c
--- linux-2.6.32.43/drivers/scsi/megaraid/megaraid_mbox.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/megaraid/megaraid_mbox.c	2011-07-15 05:51:18.000000000 -0500
@@ -3503,6 +3503,8 @@
 	int		rval;
 	int		i;
 
+	pax_track_stack();
+
 	// Allocate memory for the base list of scb for management module.
 	adapter->uscb_list = kcalloc(MBOX_MAX_USER_CMDS, sizeof(scb_t), GFP_KERNEL);
 
diff -uriN linux-2.6.32.43/drivers/scsi/osd/osd_initiator.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/osd/osd_initiator.c
--- linux-2.6.32.43/drivers/scsi/osd/osd_initiator.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/osd/osd_initiator.c	2011-07-15 05:51:18.000000000 -0500
@@ -94,6 +94,8 @@
 	int nelem = ARRAY_SIZE(get_attrs), a = 0;
 	int ret;
 
+	pax_track_stack();
+
 	or = osd_start_request(od, GFP_KERNEL);
 	if (!or)
 		return -ENOMEM;
diff -uriN linux-2.6.32.43/drivers/scsi/pmcraid.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/pmcraid.c
--- linux-2.6.32.43/drivers/scsi/pmcraid.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/pmcraid.c	2011-07-15 05:51:18.000000000 -0500
@@ -189,8 +189,8 @@
 		res->scsi_dev = scsi_dev;
 		scsi_dev->hostdata = res;
 		res->change_detected = 0;
-		atomic_set(&res->read_failures, 0);
-		atomic_set(&res->write_failures, 0);
+		atomic_set_unchecked(&res->read_failures, 0);
+		atomic_set_unchecked(&res->write_failures, 0);
 		rc = 0;
 	}
 	spin_unlock_irqrestore(&pinstance->resource_lock, lock_flags);
@@ -2396,9 +2396,9 @@
 
 	/* If this was a SCSI read/write command keep count of errors */
 	if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_READ_CMD)
-		atomic_inc(&res->read_failures);
+		atomic_inc_unchecked(&res->read_failures);
 	else if (SCSI_CMD_TYPE(scsi_cmd->cmnd[0]) == SCSI_WRITE_CMD)
-		atomic_inc(&res->write_failures);
+		atomic_inc_unchecked(&res->write_failures);
 
 	if (!RES_IS_GSCSI(res->cfg_entry) &&
 		masked_ioasc != PMCRAID_IOASC_HW_DEVICE_BUS_STATUS_ERROR) {
@@ -4113,7 +4113,7 @@
 
 	pinstance = container_of(workp, struct pmcraid_instance, worker_q);
 	/* add resources only after host is added into system */
-	if (!atomic_read(&pinstance->expose_resources))
+	if (!atomic_read_unchecked(&pinstance->expose_resources))
 		return;
 
 	spin_lock_irqsave(&pinstance->resource_lock, lock_flags);
@@ -4847,7 +4847,7 @@
 	init_waitqueue_head(&pinstance->reset_wait_q);
 
 	atomic_set(&pinstance->outstanding_cmds, 0);
-	atomic_set(&pinstance->expose_resources, 0);
+	atomic_set_unchecked(&pinstance->expose_resources, 0);
 
 	INIT_LIST_HEAD(&pinstance->free_res_q);
 	INIT_LIST_HEAD(&pinstance->used_res_q);
@@ -5499,7 +5499,7 @@
 	/* Schedule worker thread to handle CCN and take care of adding and
 	 * removing devices to OS
 	 */
-	atomic_set(&pinstance->expose_resources, 1);
+	atomic_set_unchecked(&pinstance->expose_resources, 1);
 	schedule_work(&pinstance->worker_q);
 	return rc;
 
diff -uriN linux-2.6.32.43/drivers/scsi/pmcraid.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/pmcraid.h
--- linux-2.6.32.43/drivers/scsi/pmcraid.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/pmcraid.h	2011-07-15 05:51:18.000000000 -0500
@@ -690,7 +690,7 @@
 	atomic_t outstanding_cmds;
 
 	/* should add/delete resources to mid-layer now ?*/
-	atomic_t expose_resources;
+	atomic_unchecked_t expose_resources;
 
 	/* Tasklet to handle deferred processing */
 	struct tasklet_struct isr_tasklet[PMCRAID_NUM_MSIX_VECTORS];
@@ -727,8 +727,8 @@
 	struct list_head queue;	/* link to "to be exposed" resources */
 	struct pmcraid_config_table_entry cfg_entry;
 	struct scsi_device *scsi_dev;	/* Link scsi_device structure */
-	atomic_t read_failures;		/* count of failed READ commands */
-	atomic_t write_failures;	/* count of failed WRITE commands */
+	atomic_unchecked_t read_failures;		/* count of failed READ commands */
+	atomic_unchecked_t write_failures;	/* count of failed WRITE commands */
 
 	/* To indicate add/delete/modify during CCN */
 	u8 change_detected;
diff -uriN linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_def.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/qla4xxx/ql4_def.h
--- linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_def.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/qla4xxx/ql4_def.h	2011-07-15 05:51:18.000000000 -0500
@@ -240,7 +240,7 @@
 	atomic_t retry_relogin_timer; /* Min Time between relogins
 				       * (4000 only) */
 	atomic_t relogin_timer;	/* Max Time to wait for relogin to complete */
-	atomic_t relogin_retry_count; /* Num of times relogin has been
+	atomic_unchecked_t relogin_retry_count; /* Num of times relogin has been
 				       * retried */
 
 	uint16_t port;
diff -uriN linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_init.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/qla4xxx/ql4_init.c
--- linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_init.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/qla4xxx/ql4_init.c	2011-07-15 05:51:18.000000000 -0500
@@ -482,7 +482,7 @@
 	atomic_set(&ddb_entry->port_down_timer, ha->port_down_retry_count);
 	atomic_set(&ddb_entry->retry_relogin_timer, INVALID_ENTRY);
 	atomic_set(&ddb_entry->relogin_timer, 0);
-	atomic_set(&ddb_entry->relogin_retry_count, 0);
+	atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
 	atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
 	list_add_tail(&ddb_entry->list, &ha->ddb_list);
 	ha->fw_ddb_index_map[fw_ddb_index] = ddb_entry;
@@ -1308,7 +1308,7 @@
 		atomic_set(&ddb_entry->state, DDB_STATE_ONLINE);
 		atomic_set(&ddb_entry->port_down_timer,
 			   ha->port_down_retry_count);
-		atomic_set(&ddb_entry->relogin_retry_count, 0);
+		atomic_set_unchecked(&ddb_entry->relogin_retry_count, 0);
 		atomic_set(&ddb_entry->relogin_timer, 0);
 		clear_bit(DF_RELOGIN, &ddb_entry->flags);
 		clear_bit(DF_NO_RELOGIN, &ddb_entry->flags);
diff -uriN linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_os.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/qla4xxx/ql4_os.c
--- linux-2.6.32.43/drivers/scsi/qla4xxx/ql4_os.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/qla4xxx/ql4_os.c	2011-07-15 05:51:18.000000000 -0500
@@ -641,13 +641,13 @@
 			    ddb_entry->fw_ddb_device_state ==
 			    DDB_DS_SESSION_FAILED) {
 				/* Reset retry relogin timer */
-				atomic_inc(&ddb_entry->relogin_retry_count);
+				atomic_inc_unchecked(&ddb_entry->relogin_retry_count);
 				DEBUG2(printk("scsi%ld: index[%d] relogin"
 					      " timed out-retrying"
 					      " relogin (%d)\n",
 					      ha->host_no,
 					      ddb_entry->fw_ddb_index,
-					      atomic_read(&ddb_entry->
+					      atomic_read_unchecked(&ddb_entry->
 							  relogin_retry_count))
 					);
 				start_dpc++;
diff -uriN linux-2.6.32.43/drivers/scsi/scsi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi.c
--- linux-2.6.32.43/drivers/scsi/scsi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi.c	2011-07-15 05:51:18.000000000 -0500
@@ -652,7 +652,7 @@
 	unsigned long timeout;
 	int rtn = 0;
 
-	atomic_inc(&cmd->device->iorequest_cnt);
+	atomic_inc_unchecked(&cmd->device->iorequest_cnt);
 
 	/* check if the device is still usable */
 	if (unlikely(cmd->device->sdev_state == SDEV_DEL)) {
diff -uriN linux-2.6.32.43/drivers/scsi/scsi_debug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_debug.c
--- linux-2.6.32.43/drivers/scsi/scsi_debug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_debug.c	2011-07-15 05:51:18.000000000 -0500
@@ -1395,6 +1395,8 @@
 	unsigned char arr[SDEBUG_MAX_MSELECT_SZ];
 	unsigned char *cmd = (unsigned char *)scp->cmnd;
 
+	pax_track_stack();
+
 	if ((errsts = check_readiness(scp, 1, devip)))
 		return errsts;
 	memset(arr, 0, sizeof(arr));
@@ -1492,6 +1494,8 @@
 	unsigned char arr[SDEBUG_MAX_LSENSE_SZ];
 	unsigned char *cmd = (unsigned char *)scp->cmnd;
 
+	pax_track_stack();
+
 	if ((errsts = check_readiness(scp, 1, devip)))
 		return errsts;
 	memset(arr, 0, sizeof(arr));
diff -uriN linux-2.6.32.43/drivers/scsi/scsi_lib.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_lib.c
--- linux-2.6.32.43/drivers/scsi/scsi_lib.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_lib.c	2011-07-15 05:51:18.000000000 -0500
@@ -1384,7 +1384,7 @@
 
 	scsi_init_cmd_errh(cmd);
 	cmd->result = DID_NO_CONNECT << 16;
-	atomic_inc(&cmd->device->iorequest_cnt);
+	atomic_inc_unchecked(&cmd->device->iorequest_cnt);
 
 	/*
 	 * SCSI request completion path will do scsi_device_unbusy(),
@@ -1415,9 +1415,9 @@
 	 */
 	cmd->serial_number = 0;
 
-	atomic_inc(&cmd->device->iodone_cnt);
+	atomic_inc_unchecked(&cmd->device->iodone_cnt);
 	if (cmd->result)
-		atomic_inc(&cmd->device->ioerr_cnt);
+		atomic_inc_unchecked(&cmd->device->ioerr_cnt);
 
 	disposition = scsi_decide_disposition(cmd);
 	if (disposition != SUCCESS &&
diff -uriN linux-2.6.32.43/drivers/scsi/scsi_sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_sysfs.c
--- linux-2.6.32.43/drivers/scsi/scsi_sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_sysfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -662,7 +662,7 @@
 		    char *buf)						\
 {									\
 	struct scsi_device *sdev = to_scsi_device(dev);			\
-	unsigned long long count = atomic_read(&sdev->field);		\
+	unsigned long long count = atomic_read_unchecked(&sdev->field);	\
 	return snprintf(buf, 20, "0x%llx\n", count);			\
 }									\
 static DEVICE_ATTR(field, S_IRUGO, show_iostat_##field, NULL)
diff -uriN linux-2.6.32.43/drivers/scsi/scsi_transport_fc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_transport_fc.c
--- linux-2.6.32.43/drivers/scsi/scsi_transport_fc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_transport_fc.c	2011-07-15 05:51:18.000000000 -0500
@@ -480,7 +480,7 @@
  * Netlink Infrastructure
  */
 
-static atomic_t fc_event_seq;
+static atomic_unchecked_t fc_event_seq;
 
 /**
  * fc_get_event_number - Obtain the next sequential FC event number
@@ -493,7 +493,7 @@
 u32
 fc_get_event_number(void)
 {
-	return atomic_add_return(1, &fc_event_seq);
+	return atomic_add_return_unchecked(1, &fc_event_seq);
 }
 EXPORT_SYMBOL(fc_get_event_number);
 
@@ -641,7 +641,7 @@
 {
 	int error;
 
-	atomic_set(&fc_event_seq, 0);
+	atomic_set_unchecked(&fc_event_seq, 0);
 
 	error = transport_class_register(&fc_host_class);
 	if (error)
diff -uriN linux-2.6.32.43/drivers/scsi/scsi_transport_iscsi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_transport_iscsi.c
--- linux-2.6.32.43/drivers/scsi/scsi_transport_iscsi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_transport_iscsi.c	2011-07-15 05:51:18.000000000 -0500
@@ -81,7 +81,7 @@
 	struct device_attribute *session_attrs[ISCSI_SESSION_ATTRS + 1];
 };
 
-static atomic_t iscsi_session_nr; /* sysfs session id for next new session */
+static atomic_unchecked_t iscsi_session_nr; /* sysfs session id for next new session */
 static struct workqueue_struct *iscsi_eh_timer_workq;
 
 /*
@@ -728,7 +728,7 @@
 	int err;
 
 	ihost = shost->shost_data;
-	session->sid = atomic_add_return(1, &iscsi_session_nr);
+	session->sid = atomic_add_return_unchecked(1, &iscsi_session_nr);
 
 	if (id == ISCSI_MAX_TARGET) {
 		for (id = 0; id < ISCSI_MAX_TARGET; id++) {
@@ -2060,7 +2060,7 @@
 	printk(KERN_INFO "Loading iSCSI transport class v%s.\n",
 		ISCSI_TRANSPORT_VERSION);
 
-	atomic_set(&iscsi_session_nr, 0);
+	atomic_set_unchecked(&iscsi_session_nr, 0);
 
 	err = class_register(&iscsi_transport_class);
 	if (err)
diff -uriN linux-2.6.32.43/drivers/scsi/scsi_transport_srp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_transport_srp.c
--- linux-2.6.32.43/drivers/scsi/scsi_transport_srp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/scsi_transport_srp.c	2011-07-15 05:51:18.000000000 -0500
@@ -33,7 +33,7 @@
 #include "scsi_transport_srp_internal.h"
 
 struct srp_host_attrs {
-	atomic_t next_port_id;
+	atomic_unchecked_t next_port_id;
 };
 #define to_srp_host_attrs(host)	((struct srp_host_attrs *)(host)->shost_data)
 
@@ -62,7 +62,7 @@
 	struct Scsi_Host *shost = dev_to_shost(dev);
 	struct srp_host_attrs *srp_host = to_srp_host_attrs(shost);
 
-	atomic_set(&srp_host->next_port_id, 0);
+	atomic_set_unchecked(&srp_host->next_port_id, 0);
 	return 0;
 }
 
@@ -211,7 +211,7 @@
 	memcpy(rport->port_id, ids->port_id, sizeof(rport->port_id));
 	rport->roles = ids->roles;
 
-	id = atomic_inc_return(&to_srp_host_attrs(shost)->next_port_id);
+	id = atomic_inc_return_unchecked(&to_srp_host_attrs(shost)->next_port_id);
 	dev_set_name(&rport->dev, "port-%d:%d", shost->host_no, id);
 
 	transport_setup_device(&rport->dev);
diff -uriN linux-2.6.32.43/drivers/scsi/sg.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/sg.c
--- linux-2.6.32.43/drivers/scsi/sg.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/sg.c	2011-07-15 05:51:18.000000000 -0500
@@ -2292,7 +2292,7 @@
 	const struct file_operations * fops;
 };
 
-static struct sg_proc_leaf sg_proc_leaf_arr[] = {
+static const struct sg_proc_leaf sg_proc_leaf_arr[] = {
 	{"allow_dio", &adio_fops},
 	{"debug", &debug_fops},
 	{"def_reserved_size", &dressz_fops},
@@ -2307,7 +2307,7 @@
 {
 	int k, mask;
 	int num_leaves = ARRAY_SIZE(sg_proc_leaf_arr);
-	struct sg_proc_leaf * leaf;
+	const struct sg_proc_leaf * leaf;
 
 	sg_proc_sgp = proc_mkdir(sg_proc_sg_dirname, NULL);
 	if (!sg_proc_sgp)
diff -uriN linux-2.6.32.43/drivers/scsi/sym53c8xx_2/sym_glue.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/sym53c8xx_2/sym_glue.c
--- linux-2.6.32.43/drivers/scsi/sym53c8xx_2/sym_glue.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/scsi/sym53c8xx_2/sym_glue.c	2011-07-15 05:51:18.000000000 -0500
@@ -1754,6 +1754,8 @@
 	int do_iounmap = 0;
 	int do_disable_device = 1;
 
+	pax_track_stack();
+
 	memset(&sym_dev, 0, sizeof(sym_dev));
 	memset(&nvram, 0, sizeof(nvram));
 	sym_dev.pdev = pdev;
diff -uriN linux-2.6.32.43/drivers/serial/kgdboc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/serial/kgdboc.c
--- linux-2.6.32.43/drivers/serial/kgdboc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/serial/kgdboc.c	2011-07-15 05:51:18.000000000 -0500
@@ -18,7 +18,7 @@
 
 #define MAX_CONFIG_LEN		40
 
-static struct kgdb_io		kgdboc_io_ops;
+static const struct kgdb_io	kgdboc_io_ops;
 
 /* -1 = init not run yet, 0 = unconfigured, 1 = configured. */
 static int configured		= -1;
@@ -154,7 +154,7 @@
 		module_put(THIS_MODULE);
 }
 
-static struct kgdb_io kgdboc_io_ops = {
+static const struct kgdb_io kgdboc_io_ops = {
 	.name			= "kgdboc",
 	.read_char		= kgdboc_get_char,
 	.write_char		= kgdboc_put_char,
diff -uriN linux-2.6.32.43/drivers/spi/spi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/spi/spi.c
--- linux-2.6.32.43/drivers/spi/spi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/spi/spi.c	2011-07-15 05:51:18.000000000 -0500
@@ -774,7 +774,7 @@
 EXPORT_SYMBOL_GPL(spi_sync);
 
 /* portable code must never pass more than 32 bytes */
-#define	SPI_BUFSIZ	max(32,SMP_CACHE_BYTES)
+#define	SPI_BUFSIZ	max(32U,SMP_CACHE_BYTES)
 
 static u8	*buf;
 
diff -uriN linux-2.6.32.43/drivers/staging/android/binder.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/android/binder.c
--- linux-2.6.32.43/drivers/staging/android/binder.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/android/binder.c	2011-07-15 05:51:18.000000000 -0500
@@ -2756,7 +2756,7 @@
 	binder_defer_work(proc, BINDER_DEFERRED_PUT_FILES);
 }
 
-static struct vm_operations_struct binder_vm_ops = {
+static const struct vm_operations_struct binder_vm_ops = {
 	.open = binder_vma_open,
 	.close = binder_vma_close,
 };
diff -uriN linux-2.6.32.43/drivers/staging/b3dfg/b3dfg.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/b3dfg/b3dfg.c
--- linux-2.6.32.43/drivers/staging/b3dfg/b3dfg.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/b3dfg/b3dfg.c	2011-07-15 05:51:18.000000000 -0500
@@ -455,7 +455,7 @@
 	return VM_FAULT_NOPAGE;
 }
 
-static struct vm_operations_struct b3dfg_vm_ops = {
+static const struct vm_operations_struct b3dfg_vm_ops = {
 	.fault = b3dfg_vma_fault,
 };
 
@@ -848,7 +848,7 @@
 	return r;
 }
 
-static struct file_operations b3dfg_fops = {
+static const struct file_operations b3dfg_fops = {
 	.owner = THIS_MODULE,
 	.open = b3dfg_open,
 	.release = b3dfg_release,
diff -uriN linux-2.6.32.43/drivers/staging/comedi/comedi_fops.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/comedi/comedi_fops.c
--- linux-2.6.32.43/drivers/staging/comedi/comedi_fops.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/comedi/comedi_fops.c	2011-07-15 05:51:18.000000000 -0500
@@ -1389,7 +1389,7 @@
 	mutex_unlock(&dev->mutex);
 }
 
-static struct vm_operations_struct comedi_vm_ops = {
+static const struct vm_operations_struct comedi_vm_ops = {
 	.close = comedi_unmap,
 };
 
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/adsp_driver.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/adsp_driver.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/adsp_driver.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/adsp_driver.c	2011-07-15 05:51:18.000000000 -0500
@@ -576,7 +576,7 @@
 static dev_t adsp_devno;
 static struct class *adsp_class;
 
-static struct file_operations adsp_fops = {
+static const struct file_operations adsp_fops = {
 	.owner = THIS_MODULE,
 	.open = adsp_open,
 	.unlocked_ioctl = adsp_ioctl,
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_aac.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_aac.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_aac.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_aac.c	2011-07-15 05:51:18.000000000 -0500
@@ -1022,7 +1022,7 @@
 	return rc;
 }
 
-static struct file_operations audio_aac_fops = {
+static const struct file_operations audio_aac_fops = {
 	.owner = THIS_MODULE,
 	.open = audio_open,
 	.release = audio_release,
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_amrnb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_amrnb.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_amrnb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_amrnb.c	2011-07-15 05:51:18.000000000 -0500
@@ -833,7 +833,7 @@
 	return rc;
 }
 
-static struct file_operations audio_amrnb_fops = {
+static const struct file_operations audio_amrnb_fops = {
 	.owner = THIS_MODULE,
 	.open = audamrnb_open,
 	.release = audamrnb_release,
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_evrc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_evrc.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_evrc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_evrc.c	2011-07-15 05:51:18.000000000 -0500
@@ -805,7 +805,7 @@
 	return rc;
 }
 
-static struct file_operations audio_evrc_fops = {
+static const struct file_operations audio_evrc_fops = {
 	.owner = THIS_MODULE,
 	.open = audevrc_open,
 	.release = audevrc_release,
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_in.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_in.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_in.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_in.c	2011-07-15 05:51:18.000000000 -0500
@@ -913,7 +913,7 @@
 	return 0;
 }
 
-static struct file_operations audio_fops = {
+static const struct file_operations audio_fops = {
 	.owner		= THIS_MODULE,
 	.open		= audio_in_open,
 	.release	= audio_in_release,
@@ -922,7 +922,7 @@
 	.unlocked_ioctl	= audio_in_ioctl,
 };
 
-static struct file_operations audpre_fops = {
+static const struct file_operations audpre_fops = {
 	.owner          = THIS_MODULE,
 	.open           = audpre_open,
 	.unlocked_ioctl = audpre_ioctl,
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_mp3.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_mp3.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_mp3.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_mp3.c	2011-07-15 05:51:18.000000000 -0500
@@ -941,7 +941,7 @@
 	return rc;
 }
 
-static struct file_operations audio_mp3_fops = {
+static const struct file_operations audio_mp3_fops = {
 	.owner		= THIS_MODULE,
 	.open		= audio_open,
 	.release	= audio_release,
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_out.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_out.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_out.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_out.c	2011-07-15 05:51:18.000000000 -0500
@@ -810,7 +810,7 @@
 	return 0;
 }
 
-static struct file_operations audio_fops = {
+static const struct file_operations audio_fops = {
 	.owner		= THIS_MODULE,
 	.open		= audio_open,
 	.release	= audio_release,
@@ -819,7 +819,7 @@
 	.unlocked_ioctl	= audio_ioctl,
 };
 
-static struct file_operations audpp_fops = {
+static const struct file_operations audpp_fops = {
 	.owner		= THIS_MODULE,
 	.open		= audpp_open,
 	.unlocked_ioctl	= audpp_ioctl,
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_qcelp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_qcelp.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/audio_qcelp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/audio_qcelp.c	2011-07-15 05:51:18.000000000 -0500
@@ -816,7 +816,7 @@
 	return rc;
 }
 
-static struct file_operations audio_qcelp_fops = {
+static const struct file_operations audio_qcelp_fops = {
 	.owner = THIS_MODULE,
 	.open = audqcelp_open,
 	.release = audqcelp_release,
diff -uriN linux-2.6.32.43/drivers/staging/dream/qdsp5/snd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/snd.c
--- linux-2.6.32.43/drivers/staging/dream/qdsp5/snd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/qdsp5/snd.c	2011-07-15 05:51:18.000000000 -0500
@@ -242,7 +242,7 @@
 	return rc;
 }
 
-static struct file_operations snd_fops = {
+static const struct file_operations snd_fops = {
 	.owner		= THIS_MODULE,
 	.open		= snd_open,
 	.release	= snd_release,
diff -uriN linux-2.6.32.43/drivers/staging/dream/smd/smd_qmi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/smd/smd_qmi.c
--- linux-2.6.32.43/drivers/staging/dream/smd/smd_qmi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/smd/smd_qmi.c	2011-07-15 05:51:18.000000000 -0500
@@ -793,7 +793,7 @@
 	return 0;
 }
 
-static struct file_operations qmi_fops = {
+static const struct file_operations qmi_fops = {
 	.owner = THIS_MODULE,
 	.read = qmi_read,
 	.write = qmi_write,
diff -uriN linux-2.6.32.43/drivers/staging/dream/smd/smd_rpcrouter_device.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/smd/smd_rpcrouter_device.c
--- linux-2.6.32.43/drivers/staging/dream/smd/smd_rpcrouter_device.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dream/smd/smd_rpcrouter_device.c	2011-07-15 05:51:18.000000000 -0500
@@ -214,7 +214,7 @@
 	return rc;
 }
 
-static struct file_operations rpcrouter_server_fops = {
+static const struct file_operations rpcrouter_server_fops = {
 	.owner	 = THIS_MODULE,
 	.open	 = rpcrouter_open,
 	.release = rpcrouter_release,
@@ -224,7 +224,7 @@
 	.unlocked_ioctl	 = rpcrouter_ioctl,
 };
 
-static struct file_operations rpcrouter_router_fops = {
+static const struct file_operations rpcrouter_router_fops = {
 	.owner	 = THIS_MODULE,
 	.open	 = rpcrouter_open,
 	.release = rpcrouter_release,
diff -uriN linux-2.6.32.43/drivers/staging/dst/dcore.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dst/dcore.c
--- linux-2.6.32.43/drivers/staging/dst/dcore.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dst/dcore.c	2011-07-15 05:51:18.000000000 -0500
@@ -149,7 +149,7 @@
 	return 0;
 }
 
-static struct block_device_operations dst_blk_ops = {
+static const struct block_device_operations dst_blk_ops = {
 	.open		= dst_bdev_open,
 	.release	= dst_bdev_release,
 	.owner		= THIS_MODULE,
@@ -588,7 +588,7 @@
 	n->size = ctl->size;
 
 	atomic_set(&n->refcnt, 1);
-	atomic_long_set(&n->gen, 0);
+	atomic_long_set_unchecked(&n->gen, 0);
 	snprintf(n->name, sizeof(n->name), "%s", ctl->name);
 
 	err = dst_node_sysfs_init(n);
diff -uriN linux-2.6.32.43/drivers/staging/dst/trans.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dst/trans.c
--- linux-2.6.32.43/drivers/staging/dst/trans.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/dst/trans.c	2011-07-15 05:51:18.000000000 -0500
@@ -169,7 +169,7 @@
 	t->error = 0;
 	t->retries = 0;
 	atomic_set(&t->refcnt, 1);
-	t->gen = atomic_long_inc_return(&n->gen);
+	t->gen = atomic_long_inc_return_unchecked(&n->gen);
 
 	t->enc = bio_data_dir(bio);
 	dst_bio_to_cmd(bio, &t->cmd, DST_IO, t->gen);
diff -uriN linux-2.6.32.43/drivers/staging/et131x/et1310_tx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/et131x/et1310_tx.c
--- linux-2.6.32.43/drivers/staging/et131x/et1310_tx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/et131x/et1310_tx.c	2011-07-15 05:51:18.000000000 -0500
@@ -710,11 +710,11 @@
 	struct net_device_stats *stats = &etdev->net_stats;
 
 	if (pMpTcb->Flags & fMP_DEST_BROAD)
-		atomic_inc(&etdev->Stats.brdcstxmt);
+		atomic_inc_unchecked(&etdev->Stats.brdcstxmt);
 	else if (pMpTcb->Flags & fMP_DEST_MULTI)
-		atomic_inc(&etdev->Stats.multixmt);
+		atomic_inc_unchecked(&etdev->Stats.multixmt);
 	else
-		atomic_inc(&etdev->Stats.unixmt);
+		atomic_inc_unchecked(&etdev->Stats.unixmt);
 
 	if (pMpTcb->Packet) {
 		stats->tx_bytes += pMpTcb->Packet->len;
diff -uriN linux-2.6.32.43/drivers/staging/et131x/et131x_adapter.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/et131x/et131x_adapter.h
--- linux-2.6.32.43/drivers/staging/et131x/et131x_adapter.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/et131x/et131x_adapter.h	2011-07-15 05:51:18.000000000 -0500
@@ -145,11 +145,11 @@
 	 * operations
 	 */
 	u32 unircv;	/* # multicast packets received */
-	atomic_t unixmt;	/* # multicast packets for Tx */
+	atomic_unchecked_t unixmt;	/* # multicast packets for Tx */
 	u32 multircv;	/* # multicast packets received */
-	atomic_t multixmt;	/* # multicast packets for Tx */
+	atomic_unchecked_t multixmt;	/* # multicast packets for Tx */
 	u32 brdcstrcv;	/* # broadcast packets received */
-	atomic_t brdcstxmt;	/* # broadcast packets for Tx */
+	atomic_unchecked_t brdcstxmt;	/* # broadcast packets for Tx */
 	u32 norcvbuf;	/* # Rx packets discarded */
 	u32 noxmtbuf;	/* # Tx packets discarded */
 
diff -uriN linux-2.6.32.43/drivers/staging/go7007/go7007-v4l2.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/go7007/go7007-v4l2.c
--- linux-2.6.32.43/drivers/staging/go7007/go7007-v4l2.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/go7007/go7007-v4l2.c	2011-07-15 05:51:18.000000000 -0500
@@ -1700,7 +1700,7 @@
 	return 0;
 }
 
-static struct vm_operations_struct go7007_vm_ops = {
+static const struct vm_operations_struct go7007_vm_ops = {
 	.open	= go7007_vm_open,
 	.close	= go7007_vm_close,
 	.fault	= go7007_vm_fault,
diff -uriN linux-2.6.32.43/drivers/staging/hv/blkvsc_drv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/blkvsc_drv.c
--- linux-2.6.32.43/drivers/staging/hv/blkvsc_drv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/blkvsc_drv.c	2011-07-15 05:51:18.000000000 -0500
@@ -153,7 +153,7 @@
 /* The one and only one */
 static struct blkvsc_driver_context g_blkvsc_drv;
 
-static struct block_device_operations block_ops = {
+static const struct block_device_operations block_ops = {
 	.owner = THIS_MODULE,
 	.open = blkvsc_open,
 	.release = blkvsc_release,
diff -uriN linux-2.6.32.43/drivers/staging/hv/Channel.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/Channel.c
--- linux-2.6.32.43/drivers/staging/hv/Channel.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/Channel.c	2011-07-15 05:51:18.000000000 -0500
@@ -464,8 +464,8 @@
 
 	DPRINT_ENTER(VMBUS);
 
-	nextGpadlHandle = atomic_read(&gVmbusConnection.NextGpadlHandle);
-	atomic_inc(&gVmbusConnection.NextGpadlHandle);
+	nextGpadlHandle = atomic_read_unchecked(&gVmbusConnection.NextGpadlHandle);
+	atomic_inc_unchecked(&gVmbusConnection.NextGpadlHandle);
 
 	VmbusChannelCreateGpadlHeader(Kbuffer, Size, &msgInfo, &msgCount);
 	ASSERT(msgInfo != NULL);
diff -uriN linux-2.6.32.43/drivers/staging/hv/Hv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/Hv.c
--- linux-2.6.32.43/drivers/staging/hv/Hv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/Hv.c	2011-07-15 05:51:18.000000000 -0500
@@ -161,7 +161,7 @@
 	u64 outputAddress = (Output) ? virt_to_phys(Output) : 0;
 	u32 outputAddressHi = outputAddress >> 32;
 	u32 outputAddressLo = outputAddress & 0xFFFFFFFF;
-	volatile void *hypercallPage = gHvContext.HypercallPage;
+	volatile void *hypercallPage = ktva_ktla(gHvContext.HypercallPage);
 
 	DPRINT_DBG(VMBUS, "Hypercall <control %llx input %p output %p>",
 		   Control, Input, Output);
diff -uriN linux-2.6.32.43/drivers/staging/hv/vmbus_drv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/vmbus_drv.c
--- linux-2.6.32.43/drivers/staging/hv/vmbus_drv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/vmbus_drv.c	2011-07-15 05:51:18.000000000 -0500
@@ -532,7 +532,7 @@
 				to_device_context(root_device_obj);
 	struct device_context *child_device_ctx =
 				to_device_context(child_device_obj);
-	static atomic_t device_num = ATOMIC_INIT(0);
+	static atomic_unchecked_t device_num = ATOMIC_INIT(0);
 
 	DPRINT_ENTER(VMBUS_DRV);
 
@@ -541,7 +541,7 @@
 
 	/* Set the device name. Otherwise, device_register() will fail. */
 	dev_set_name(&child_device_ctx->device, "vmbus_0_%d",
-		     atomic_inc_return(&device_num));
+		     atomic_inc_return_unchecked(&device_num));
 
 	/* The new device belongs to this bus */
 	child_device_ctx->device.bus = &g_vmbus_drv.bus; /* device->dev.bus; */
diff -uriN linux-2.6.32.43/drivers/staging/hv/VmbusPrivate.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/VmbusPrivate.h
--- linux-2.6.32.43/drivers/staging/hv/VmbusPrivate.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/hv/VmbusPrivate.h	2011-07-15 05:51:18.000000000 -0500
@@ -59,7 +59,7 @@
 struct VMBUS_CONNECTION {
 	enum VMBUS_CONNECT_STATE ConnectState;
 
-	atomic_t NextGpadlHandle;
+	atomic_unchecked_t NextGpadlHandle;
 
 	/*
 	 * Represents channel interrupts. Each bit position represents a
diff -uriN linux-2.6.32.43/drivers/staging/octeon/ethernet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/octeon/ethernet.c
--- linux-2.6.32.43/drivers/staging/octeon/ethernet.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/octeon/ethernet.c	2011-07-15 05:51:18.000000000 -0500
@@ -294,11 +294,11 @@
 		 * since the RX tasklet also increments it.
 		 */
 #ifdef CONFIG_64BIT
-		atomic64_add(rx_status.dropped_packets,
-			     (atomic64_t *)&priv->stats.rx_dropped);
+		atomic64_add_unchecked(rx_status.dropped_packets,
+			     (atomic64_unchecked_t *)&priv->stats.rx_dropped);
 #else
-		atomic_add(rx_status.dropped_packets,
-			     (atomic_t *)&priv->stats.rx_dropped);
+		atomic_add_unchecked(rx_status.dropped_packets,
+			     (atomic_unchecked_t *)&priv->stats.rx_dropped);
 #endif
 	}
 
diff -uriN linux-2.6.32.43/drivers/staging/octeon/ethernet-rx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/octeon/ethernet-rx.c
--- linux-2.6.32.43/drivers/staging/octeon/ethernet-rx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/octeon/ethernet-rx.c	2011-07-15 05:51:18.000000000 -0500
@@ -406,11 +406,11 @@
 				/* Increment RX stats for virtual ports */
 				if (work->ipprt >= CVMX_PIP_NUM_INPUT_PORTS) {
 #ifdef CONFIG_64BIT
-					atomic64_add(1, (atomic64_t *)&priv->stats.rx_packets);
-					atomic64_add(skb->len, (atomic64_t *)&priv->stats.rx_bytes);
+					atomic64_add_unchecked(1, (atomic64_unchecked_t *)&priv->stats.rx_packets);
+					atomic64_add_unchecked(skb->len, (atomic64_unchecked_t *)&priv->stats.rx_bytes);
 #else
-					atomic_add(1, (atomic_t *)&priv->stats.rx_packets);
-					atomic_add(skb->len, (atomic_t *)&priv->stats.rx_bytes);
+					atomic_add_unchecked(1, (atomic_unchecked_t *)&priv->stats.rx_packets);
+					atomic_add_unchecked(skb->len, (atomic_unchecked_t *)&priv->stats.rx_bytes);
 #endif
 				}
 				netif_receive_skb(skb);
@@ -424,9 +424,9 @@
 				   dev->name);
 				 */
 #ifdef CONFIG_64BIT
-				atomic64_add(1, (atomic64_t *)&priv->stats.rx_dropped);
+				atomic64_add_unchecked(1, (atomic64_t *)&priv->stats.rx_dropped);
 #else
-				atomic_add(1, (atomic_t *)&priv->stats.rx_dropped);
+				atomic_add_unchecked(1, (atomic_t *)&priv->stats.rx_dropped);
 #endif
 				dev_kfree_skb_irq(skb);
 			}
diff -uriN linux-2.6.32.43/drivers/staging/panel/panel.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/panel/panel.c
--- linux-2.6.32.43/drivers/staging/panel/panel.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/panel/panel.c	2011-07-15 05:51:18.000000000 -0500
@@ -1305,7 +1305,7 @@
 	return 0;
 }
 
-static struct file_operations lcd_fops = {
+static const struct file_operations lcd_fops = {
 	.write   = lcd_write,
 	.open    = lcd_open,
 	.release = lcd_release,
@@ -1565,7 +1565,7 @@
 	return 0;
 }
 
-static struct file_operations keypad_fops = {
+static const struct file_operations keypad_fops = {
 	.read    = keypad_read,		/* read */
 	.open    = keypad_open,		/* open */
 	.release = keypad_release,	/* close */
diff -uriN linux-2.6.32.43/drivers/staging/phison/phison.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/phison/phison.c
--- linux-2.6.32.43/drivers/staging/phison/phison.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/phison/phison.c	2011-07-15 05:51:18.000000000 -0500
@@ -43,7 +43,7 @@
 	ATA_BMDMA_SHT(DRV_NAME),
 };
 
-static struct ata_port_operations phison_ops = {
+static const struct ata_port_operations phison_ops = {
 	.inherits		= &ata_bmdma_port_ops,
 	.prereset		= phison_pre_reset,
 };
diff -uriN linux-2.6.32.43/drivers/staging/poch/poch.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/poch/poch.c
--- linux-2.6.32.43/drivers/staging/poch/poch.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/poch/poch.c	2011-07-15 05:51:18.000000000 -0500
@@ -1057,7 +1057,7 @@
 	return 0;
 }
 
-static struct file_operations poch_fops = {
+static const struct file_operations poch_fops = {
 	.owner = THIS_MODULE,
 	.open = poch_open,
 	.release = poch_release,
diff -uriN linux-2.6.32.43/drivers/staging/pohmelfs/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/pohmelfs/inode.c
--- linux-2.6.32.43/drivers/staging/pohmelfs/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/pohmelfs/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -1850,7 +1850,7 @@
 	mutex_init(&psb->mcache_lock);
 	psb->mcache_root = RB_ROOT;
 	psb->mcache_timeout = msecs_to_jiffies(5000);
-	atomic_long_set(&psb->mcache_gen, 0);
+	atomic_long_set_unchecked(&psb->mcache_gen, 0);
 
 	psb->trans_max_pages = 100;
 
@@ -1865,7 +1865,7 @@
 	INIT_LIST_HEAD(&psb->crypto_ready_list);
 	INIT_LIST_HEAD(&psb->crypto_active_list);
 
-	atomic_set(&psb->trans_gen, 1);
+	atomic_set_unchecked(&psb->trans_gen, 1);
 	atomic_long_set(&psb->total_inodes, 0);
 
 	mutex_init(&psb->state_lock);
diff -uriN linux-2.6.32.43/drivers/staging/pohmelfs/mcache.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/pohmelfs/mcache.c
--- linux-2.6.32.43/drivers/staging/pohmelfs/mcache.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/pohmelfs/mcache.c	2011-07-15 05:51:18.000000000 -0500
@@ -121,7 +121,7 @@
 	m->data = data;
 	m->start = start;
 	m->size = size;
-	m->gen = atomic_long_inc_return(&psb->mcache_gen);
+	m->gen = atomic_long_inc_return_unchecked(&psb->mcache_gen);
 
 	mutex_lock(&psb->mcache_lock);
 	err = pohmelfs_mcache_insert(psb, m);
diff -uriN linux-2.6.32.43/drivers/staging/pohmelfs/netfs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/pohmelfs/netfs.h
--- linux-2.6.32.43/drivers/staging/pohmelfs/netfs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/pohmelfs/netfs.h	2011-07-15 05:51:18.000000000 -0500
@@ -570,14 +570,14 @@
 struct pohmelfs_sb {
 	struct rb_root		mcache_root;
 	struct mutex		mcache_lock;
-	atomic_long_t		mcache_gen;
+	atomic_long_unchecked_t	mcache_gen;
 	unsigned long		mcache_timeout;
 
 	unsigned int		idx;
 
 	unsigned int		trans_retries;
 
-	atomic_t		trans_gen;
+	atomic_unchecked_t	trans_gen;
 
 	unsigned int		crypto_attached_size;
 	unsigned int		crypto_align_size;
diff -uriN linux-2.6.32.43/drivers/staging/pohmelfs/trans.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/pohmelfs/trans.c
--- linux-2.6.32.43/drivers/staging/pohmelfs/trans.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/pohmelfs/trans.c	2011-07-15 05:51:18.000000000 -0500
@@ -492,7 +492,7 @@
 	int err;
 	struct netfs_cmd *cmd = t->iovec.iov_base;
 
-	t->gen = atomic_inc_return(&psb->trans_gen);
+	t->gen = atomic_inc_return_unchecked(&psb->trans_gen);
 
 	cmd->size = t->iovec.iov_len - sizeof(struct netfs_cmd) +
 		t->attached_size + t->attached_pages * sizeof(struct netfs_cmd);
diff -uriN linux-2.6.32.43/drivers/staging/sep/sep_driver.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/sep/sep_driver.c
--- linux-2.6.32.43/drivers/staging/sep/sep_driver.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/sep/sep_driver.c	2011-07-15 05:51:18.000000000 -0500
@@ -2603,7 +2603,7 @@
 static dev_t sep_devno;
 
 /* the files operations structure of the driver */
-static struct file_operations sep_file_operations = {
+static const struct file_operations sep_file_operations = {
 	.owner = THIS_MODULE,
 	.ioctl = sep_ioctl,
 	.poll = sep_poll,
diff -uriN linux-2.6.32.43/drivers/staging/usbip/vhci.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/usbip/vhci.h
--- linux-2.6.32.43/drivers/staging/usbip/vhci.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/usbip/vhci.h	2011-07-15 05:51:18.000000000 -0500
@@ -92,7 +92,7 @@
 	unsigned	resuming:1;
 	unsigned long	re_timeout;
 
-	atomic_t seqnum;
+	atomic_unchecked_t seqnum;
 
 	/*
 	 * NOTE:
diff -uriN linux-2.6.32.43/drivers/staging/usbip/vhci_hcd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/usbip/vhci_hcd.c
--- linux-2.6.32.43/drivers/staging/usbip/vhci_hcd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/usbip/vhci_hcd.c	2011-07-15 05:51:18.000000000 -0500
@@ -534,7 +534,7 @@
 		return;
 	}
 
-	priv->seqnum = atomic_inc_return(&the_controller->seqnum);
+	priv->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
 	if (priv->seqnum == 0xffff)
 		usbip_uinfo("seqnum max\n");
 
@@ -793,7 +793,7 @@
 			return -ENOMEM;
 		}
 
-		unlink->seqnum = atomic_inc_return(&the_controller->seqnum);
+		unlink->seqnum = atomic_inc_return_unchecked(&the_controller->seqnum);
 		if (unlink->seqnum == 0xffff)
 			usbip_uinfo("seqnum max\n");
 
@@ -988,7 +988,7 @@
 		vdev->rhport = rhport;
 	}
 
-	atomic_set(&vhci->seqnum, 0);
+	atomic_set_unchecked(&vhci->seqnum, 0);
 	spin_lock_init(&vhci->lock);
 
 
diff -uriN linux-2.6.32.43/drivers/staging/usbip/vhci_rx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/usbip/vhci_rx.c
--- linux-2.6.32.43/drivers/staging/usbip/vhci_rx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/usbip/vhci_rx.c	2011-07-15 05:51:18.000000000 -0500
@@ -78,7 +78,7 @@
 		usbip_uerr("cannot find a urb of seqnum %u\n",
 							pdu->base.seqnum);
 		usbip_uinfo("max seqnum %d\n",
-					atomic_read(&the_controller->seqnum));
+					atomic_read_unchecked(&the_controller->seqnum));
 		usbip_event_add(ud, VDEV_EVENT_ERROR_TCP);
 		return;
 	}
diff -uriN linux-2.6.32.43/drivers/staging/vme/devices/vme_user.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/vme/devices/vme_user.c
--- linux-2.6.32.43/drivers/staging/vme/devices/vme_user.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/staging/vme/devices/vme_user.c	2011-07-15 05:51:18.000000000 -0500
@@ -136,7 +136,7 @@
 static int __init vme_user_probe(struct device *, int, int);
 static int __exit vme_user_remove(struct device *, int, int);
 
-static struct file_operations vme_user_fops = {
+static const struct file_operations vme_user_fops = {
         .open = vme_user_open,
         .release = vme_user_release,
         .read = vme_user_read,
diff -uriN linux-2.6.32.43/drivers/telephony/ixj.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/telephony/ixj.c
--- linux-2.6.32.43/drivers/telephony/ixj.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/telephony/ixj.c	2011-07-15 05:51:18.000000000 -0500
@@ -4976,6 +4976,8 @@
 	bool mContinue;
 	char *pIn, *pOut;
 
+	pax_track_stack();
+
 	if (!SCI_Prepare(j))
 		return 0;
 
diff -uriN linux-2.6.32.43/drivers/uio/uio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/uio/uio.c
--- linux-2.6.32.43/drivers/uio/uio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/uio/uio.c	2011-07-15 05:51:18.000000000 -0500
@@ -23,6 +23,7 @@
 #include <linux/string.h>
 #include <linux/kobject.h>
 #include <linux/uio_driver.h>
+#include <asm/local.h>
 
 #define UIO_MAX_DEVICES 255
 
@@ -30,10 +31,10 @@
 	struct module		*owner;
 	struct device		*dev;
 	int			minor;
-	atomic_t		event;
+	atomic_unchecked_t	event;
 	struct fasync_struct	*async_queue;
 	wait_queue_head_t	wait;
-	int			vma_count;
+	local_t			vma_count;
 	struct uio_info		*info;
 	struct kobject		*map_dir;
 	struct kobject		*portio_dir;
@@ -129,7 +130,7 @@
 	return entry->show(mem, buf);
 }
 
-static struct sysfs_ops map_sysfs_ops = {
+static const struct sysfs_ops map_sysfs_ops = {
 	.show = map_type_show,
 };
 
@@ -217,7 +218,7 @@
 	return entry->show(port, buf);
 }
 
-static struct sysfs_ops portio_sysfs_ops = {
+static const struct sysfs_ops portio_sysfs_ops = {
 	.show = portio_type_show,
 };
 
@@ -255,7 +256,7 @@
 	struct uio_device *idev = dev_get_drvdata(dev);
 	if (idev)
 		return sprintf(buf, "%u\n",
-				(unsigned int)atomic_read(&idev->event));
+				(unsigned int)atomic_read_unchecked(&idev->event));
 	else
 		return -ENODEV;
 }
@@ -424,7 +425,7 @@
 {
 	struct uio_device *idev = info->uio_dev;
 
-	atomic_inc(&idev->event);
+	atomic_inc_unchecked(&idev->event);
 	wake_up_interruptible(&idev->wait);
 	kill_fasync(&idev->async_queue, SIGIO, POLL_IN);
 }
@@ -477,7 +478,7 @@
 	}
 
 	listener->dev = idev;
-	listener->event_count = atomic_read(&idev->event);
+	listener->event_count = atomic_read_unchecked(&idev->event);
 	filep->private_data = listener;
 
 	if (idev->info->open) {
@@ -528,7 +529,7 @@
 		return -EIO;
 
 	poll_wait(filep, &idev->wait, wait);
-	if (listener->event_count != atomic_read(&idev->event))
+	if (listener->event_count != atomic_read_unchecked(&idev->event))
 		return POLLIN | POLLRDNORM;
 	return 0;
 }
@@ -553,7 +554,7 @@
 	do {
 		set_current_state(TASK_INTERRUPTIBLE);
 
-		event_count = atomic_read(&idev->event);
+		event_count = atomic_read_unchecked(&idev->event);
 		if (event_count != listener->event_count) {
 			if (copy_to_user(buf, &event_count, count))
 				retval = -EFAULT;
@@ -624,13 +625,13 @@
 static void uio_vma_open(struct vm_area_struct *vma)
 {
 	struct uio_device *idev = vma->vm_private_data;
-	idev->vma_count++;
+	local_inc(&idev->vma_count);
 }
 
 static void uio_vma_close(struct vm_area_struct *vma)
 {
 	struct uio_device *idev = vma->vm_private_data;
-	idev->vma_count--;
+	local_dec(&idev->vma_count);
 }
 
 static int uio_vma_fault(struct vm_area_struct *vma, struct vm_fault *vmf)
@@ -840,7 +841,7 @@
 	idev->owner = owner;
 	idev->info = info;
 	init_waitqueue_head(&idev->wait);
-	atomic_set(&idev->event, 0);
+	atomic_set_unchecked(&idev->event, 0);
 
 	ret = uio_get_minor(idev);
 	if (ret)
diff -uriN linux-2.6.32.43/drivers/usb/atm/usbatm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/atm/usbatm.c
--- linux-2.6.32.43/drivers/usb/atm/usbatm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/atm/usbatm.c	2011-07-15 05:51:18.000000000 -0500
@@ -333,7 +333,7 @@
 		if (printk_ratelimit())
 			atm_warn(instance, "%s: OAM not supported (vpi %d, vci %d)!\n",
 				__func__, vpi, vci);
-		atomic_inc(&vcc->stats->rx_err);
+		atomic_inc_unchecked(&vcc->stats->rx_err);
 		return;
 	}
 
@@ -361,7 +361,7 @@
 		if (length > ATM_MAX_AAL5_PDU) {
 			atm_rldbg(instance, "%s: bogus length %u (vcc: 0x%p)!\n",
 				  __func__, length, vcc);
-			atomic_inc(&vcc->stats->rx_err);
+			atomic_inc_unchecked(&vcc->stats->rx_err);
 			goto out;
 		}
 
@@ -370,14 +370,14 @@
 		if (sarb->len < pdu_length) {
 			atm_rldbg(instance, "%s: bogus pdu_length %u (sarb->len: %u, vcc: 0x%p)!\n",
 				  __func__, pdu_length, sarb->len, vcc);
-			atomic_inc(&vcc->stats->rx_err);
+			atomic_inc_unchecked(&vcc->stats->rx_err);
 			goto out;
 		}
 
 		if (crc32_be(~0, skb_tail_pointer(sarb) - pdu_length, pdu_length) != 0xc704dd7b) {
 			atm_rldbg(instance, "%s: packet failed crc check (vcc: 0x%p)!\n",
 				  __func__, vcc);
-			atomic_inc(&vcc->stats->rx_err);
+			atomic_inc_unchecked(&vcc->stats->rx_err);
 			goto out;
 		}
 
@@ -387,7 +387,7 @@
 			if (printk_ratelimit())
 				atm_err(instance, "%s: no memory for skb (length: %u)!\n",
 					__func__, length);
-			atomic_inc(&vcc->stats->rx_drop);
+			atomic_inc_unchecked(&vcc->stats->rx_drop);
 			goto out;
 		}
 
@@ -412,7 +412,7 @@
 
 		vcc->push(vcc, skb);
 
-		atomic_inc(&vcc->stats->rx);
+		atomic_inc_unchecked(&vcc->stats->rx);
 	out:
 		skb_trim(sarb, 0);
 	}
@@ -616,7 +616,7 @@
 			struct atm_vcc *vcc = UDSL_SKB(skb)->atm.vcc;
 
 			usbatm_pop(vcc, skb);
-			atomic_inc(&vcc->stats->tx);
+			atomic_inc_unchecked(&vcc->stats->tx);
 
 			skb = skb_dequeue(&instance->sndqueue);
 		}
@@ -775,11 +775,11 @@
 	if (!left--)
 		return sprintf(page,
 			       "AAL5: tx %d ( %d err ), rx %d ( %d err, %d drop )\n",
-			       atomic_read(&atm_dev->stats.aal5.tx),
-			       atomic_read(&atm_dev->stats.aal5.tx_err),
-			       atomic_read(&atm_dev->stats.aal5.rx),
-			       atomic_read(&atm_dev->stats.aal5.rx_err),
-			       atomic_read(&atm_dev->stats.aal5.rx_drop));
+			       atomic_read_unchecked(&atm_dev->stats.aal5.tx),
+			       atomic_read_unchecked(&atm_dev->stats.aal5.tx_err),
+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx),
+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_err),
+			       atomic_read_unchecked(&atm_dev->stats.aal5.rx_drop));
 
 	if (!left--) {
 		if (instance->disconnected)
diff -uriN linux-2.6.32.43/drivers/usb/class/cdc-wdm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/class/cdc-wdm.c
--- linux-2.6.32.43/drivers/usb/class/cdc-wdm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/class/cdc-wdm.c	2011-07-15 05:51:18.000000000 -0500
@@ -314,7 +314,7 @@
 	if (r < 0)
 		goto outnp;
 
-	if (!file->f_flags && O_NONBLOCK)
+	if (!(file->f_flags & O_NONBLOCK))
 		r = wait_event_interruptible(desc->wait, !test_bit(WDM_IN_USE,
 								&desc->flags));
 	else
diff -uriN linux-2.6.32.43/drivers/usb/core/hcd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/core/hcd.c
--- linux-2.6.32.43/drivers/usb/core/hcd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/core/hcd.c	2011-07-15 05:51:18.000000000 -0500
@@ -2216,7 +2216,7 @@
 
 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
 
-struct usb_mon_operations *mon_ops;
+const struct usb_mon_operations *mon_ops;
 
 /*
  * The registration is unlocked.
@@ -2226,7 +2226,7 @@
  * symbols from usbcore, usbcore gets referenced and cannot be unloaded first.
  */
  
-int usb_mon_register (struct usb_mon_operations *ops)
+int usb_mon_register (const struct usb_mon_operations *ops)
 {
 
 	if (mon_ops)
diff -uriN linux-2.6.32.43/drivers/usb/core/hcd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/core/hcd.h
--- linux-2.6.32.43/drivers/usb/core/hcd.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/core/hcd.h	2011-07-15 05:51:18.000000000 -0500
@@ -486,13 +486,13 @@
 #if defined(CONFIG_USB_MON) || defined(CONFIG_USB_MON_MODULE)
 
 struct usb_mon_operations {
-	void (*urb_submit)(struct usb_bus *bus, struct urb *urb);
-	void (*urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
-	void (*urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
+	void (* const urb_submit)(struct usb_bus *bus, struct urb *urb);
+	void (* const urb_submit_error)(struct usb_bus *bus, struct urb *urb, int err);
+	void (* const urb_complete)(struct usb_bus *bus, struct urb *urb, int status);
 	/* void (*urb_unlink)(struct usb_bus *bus, struct urb *urb); */
 };
 
-extern struct usb_mon_operations *mon_ops;
+extern const struct usb_mon_operations *mon_ops;
 
 static inline void usbmon_urb_submit(struct usb_bus *bus, struct urb *urb)
 {
@@ -514,7 +514,7 @@
 		(*mon_ops->urb_complete)(bus, urb, status);
 }
 
-int usb_mon_register(struct usb_mon_operations *ops);
+int usb_mon_register(const struct usb_mon_operations *ops);
 void usb_mon_deregister(void);
 
 #else
diff -uriN linux-2.6.32.43/drivers/usb/core/message.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/core/message.c
--- linux-2.6.32.43/drivers/usb/core/message.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/core/message.c	2011-07-15 05:51:18.000000000 -0500
@@ -914,8 +914,8 @@
 	buf = kmalloc(MAX_USB_STRING_SIZE, GFP_NOIO);
 	if (buf) {
 		len = usb_string(udev, index, buf, MAX_USB_STRING_SIZE);
-		if (len > 0) {
-			smallbuf = kmalloc(++len, GFP_NOIO);
+		if (len++ > 0) {
+			smallbuf = kmalloc(len, GFP_NOIO);
 			if (!smallbuf)
 				return buf;
 			memcpy(smallbuf, buf, len);
diff -uriN linux-2.6.32.43/drivers/usb/misc/appledisplay.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/misc/appledisplay.c
--- linux-2.6.32.43/drivers/usb/misc/appledisplay.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/misc/appledisplay.c	2011-07-15 05:51:18.000000000 -0500
@@ -178,7 +178,7 @@
 		return pdata->msgdata[1];
 }
 
-static struct backlight_ops appledisplay_bl_data = {
+static const struct backlight_ops appledisplay_bl_data = {
 	.get_brightness	= appledisplay_bl_get_brightness,
 	.update_status	= appledisplay_bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/usb/mon/mon_main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/mon/mon_main.c
--- linux-2.6.32.43/drivers/usb/mon/mon_main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/mon/mon_main.c	2011-07-15 05:51:18.000000000 -0500
@@ -238,7 +238,7 @@
 /*
  * Ops
  */
-static struct usb_mon_operations mon_ops_0 = {
+static const struct usb_mon_operations mon_ops_0 = {
 	.urb_submit =	mon_submit,
 	.urb_submit_error = mon_submit_error,
 	.urb_complete =	mon_complete,
diff -uriN linux-2.6.32.43/drivers/usb/wusbcore/wa-hc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/wusbcore/wa-hc.h
--- linux-2.6.32.43/drivers/usb/wusbcore/wa-hc.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/wusbcore/wa-hc.h	2011-07-15 05:51:18.000000000 -0500
@@ -192,7 +192,7 @@
 	struct list_head xfer_delayed_list;
 	spinlock_t xfer_list_lock;
 	struct work_struct xfer_work;
-	atomic_t xfer_id_count;
+	atomic_unchecked_t xfer_id_count;
 };
 
 
@@ -246,7 +246,7 @@
 	INIT_LIST_HEAD(&wa->xfer_delayed_list);
 	spin_lock_init(&wa->xfer_list_lock);
 	INIT_WORK(&wa->xfer_work, wa_urb_enqueue_run);
-	atomic_set(&wa->xfer_id_count, 1);
+	atomic_set_unchecked(&wa->xfer_id_count, 1);
 }
 
 /**
diff -uriN linux-2.6.32.43/drivers/usb/wusbcore/wa-xfer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/wusbcore/wa-xfer.c
--- linux-2.6.32.43/drivers/usb/wusbcore/wa-xfer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/usb/wusbcore/wa-xfer.c	2011-07-15 05:51:18.000000000 -0500
@@ -293,7 +293,7 @@
  */
 static void wa_xfer_id_init(struct wa_xfer *xfer)
 {
-	xfer->id = atomic_add_return(1, &xfer->wa->xfer_id_count);
+	xfer->id = atomic_add_return_unchecked(1, &xfer->wa->xfer_id_count);
 }
 
 /*
diff -uriN linux-2.6.32.43/drivers/uwb/wlp/messages.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/uwb/wlp/messages.c
--- linux-2.6.32.43/drivers/uwb/wlp/messages.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/uwb/wlp/messages.c	2011-07-15 05:51:18.000000000 -0500
@@ -903,7 +903,7 @@
 	size_t len = skb->len;
 	size_t used;
 	ssize_t result;
-	struct wlp_nonce enonce, rnonce;
+	struct wlp_nonce enonce = {{0}}, rnonce = {{0}};
 	enum wlp_assc_error assc_err;
 	char enonce_buf[WLP_WSS_NONCE_STRSIZE];
 	char rnonce_buf[WLP_WSS_NONCE_STRSIZE];
diff -uriN linux-2.6.32.43/drivers/uwb/wlp/sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/uwb/wlp/sysfs.c
--- linux-2.6.32.43/drivers/uwb/wlp/sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/uwb/wlp/sysfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -615,8 +615,7 @@
 	return ret;
 }
 
-static
-struct sysfs_ops wss_sysfs_ops = {
+static const struct sysfs_ops wss_sysfs_ops = {
 	.show	= wlp_wss_attr_show,
 	.store	= wlp_wss_attr_store,
 };
diff -uriN linux-2.6.32.43/drivers/video/atmel_lcdfb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/atmel_lcdfb.c
--- linux-2.6.32.43/drivers/video/atmel_lcdfb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/atmel_lcdfb.c	2011-07-15 05:51:18.000000000 -0500
@@ -110,7 +110,7 @@
 	return lcdc_readl(sinfo, ATMEL_LCDC_CONTRAST_VAL);
 }
 
-static struct backlight_ops atmel_lcdc_bl_ops = {
+static const struct backlight_ops atmel_lcdc_bl_ops = {
 	.update_status = atmel_bl_update_status,
 	.get_brightness = atmel_bl_get_brightness,
 };
diff -uriN linux-2.6.32.43/drivers/video/aty/aty128fb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/aty/aty128fb.c
--- linux-2.6.32.43/drivers/video/aty/aty128fb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/aty/aty128fb.c	2011-07-15 05:51:18.000000000 -0500
@@ -1787,7 +1787,7 @@
 	return bd->props.brightness;
 }
 
-static struct backlight_ops aty128_bl_data = {
+static const struct backlight_ops aty128_bl_data = {
 	.get_brightness	= aty128_bl_get_brightness,
 	.update_status	= aty128_bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/video/aty/atyfb_base.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/aty/atyfb_base.c
--- linux-2.6.32.43/drivers/video/aty/atyfb_base.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/aty/atyfb_base.c	2011-07-15 05:51:18.000000000 -0500
@@ -2225,7 +2225,7 @@
 	return bd->props.brightness;
 }
 
-static struct backlight_ops aty_bl_data = {
+static const struct backlight_ops aty_bl_data = {
 	.get_brightness = aty_bl_get_brightness,
 	.update_status	= aty_bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/video/aty/radeon_backlight.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/aty/radeon_backlight.c
--- linux-2.6.32.43/drivers/video/aty/radeon_backlight.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/aty/radeon_backlight.c	2011-07-15 05:51:18.000000000 -0500
@@ -127,7 +127,7 @@
 	return bd->props.brightness;
 }
 
-static struct backlight_ops radeon_bl_data = {
+static const struct backlight_ops radeon_bl_data = {
 	.get_brightness = radeon_bl_get_brightness,
 	.update_status	= radeon_bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/adp5520_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/adp5520_bl.c
--- linux-2.6.32.43/drivers/video/backlight/adp5520_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/adp5520_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -84,7 +84,7 @@
 	return error ? data->current_brightness : reg_val;
 }
 
-static struct backlight_ops adp5520_bl_ops = {
+static const struct backlight_ops adp5520_bl_ops = {
 	.update_status	= adp5520_bl_update_status,
 	.get_brightness	= adp5520_bl_get_brightness,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/adx_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/adx_bl.c
--- linux-2.6.32.43/drivers/video/backlight/adx_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/adx_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -61,7 +61,7 @@
 	return 1;
 }
 
-static struct backlight_ops adx_backlight_ops = {
+static const struct backlight_ops adx_backlight_ops = {
 	.options = 0,
 	.update_status = adx_backlight_update_status,
 	.get_brightness = adx_backlight_get_brightness,
diff -uriN linux-2.6.32.43/drivers/video/backlight/atmel-pwm-bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/atmel-pwm-bl.c
--- linux-2.6.32.43/drivers/video/backlight/atmel-pwm-bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/atmel-pwm-bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -113,7 +113,7 @@
 	return pwm_channel_enable(&pwmbl->pwmc);
 }
 
-static struct backlight_ops atmel_pwm_bl_ops = {
+static const struct backlight_ops atmel_pwm_bl_ops = {
 	.get_brightness = atmel_pwm_bl_get_intensity,
 	.update_status  = atmel_pwm_bl_set_intensity,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/backlight.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/backlight.c
--- linux-2.6.32.43/drivers/video/backlight/backlight.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/backlight.c	2011-07-15 05:51:18.000000000 -0500
@@ -269,7 +269,7 @@
  * ERR_PTR() or a pointer to the newly allocated device.
  */
 struct backlight_device *backlight_device_register(const char *name,
-		struct device *parent, void *devdata, struct backlight_ops *ops)
+		struct device *parent, void *devdata, const struct backlight_ops *ops)
 {
 	struct backlight_device *new_bd;
 	int rc;
diff -uriN linux-2.6.32.43/drivers/video/backlight/corgi_lcd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/corgi_lcd.c
--- linux-2.6.32.43/drivers/video/backlight/corgi_lcd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/corgi_lcd.c	2011-07-15 05:51:18.000000000 -0500
@@ -451,7 +451,7 @@
 }
 EXPORT_SYMBOL(corgi_lcd_limit_intensity);
 
-static struct backlight_ops corgi_bl_ops = {
+static const struct backlight_ops corgi_bl_ops = {
 	.get_brightness	= corgi_bl_get_intensity,
 	.update_status  = corgi_bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/cr_bllcd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/cr_bllcd.c
--- linux-2.6.32.43/drivers/video/backlight/cr_bllcd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/cr_bllcd.c	2011-07-15 05:51:18.000000000 -0500
@@ -108,7 +108,7 @@
 	return intensity;
 }
 
-static struct backlight_ops cr_backlight_ops = {
+static const struct backlight_ops cr_backlight_ops = {
 	.get_brightness = cr_backlight_get_intensity,
 	.update_status = cr_backlight_set_intensity,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/da903x_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/da903x_bl.c
--- linux-2.6.32.43/drivers/video/backlight/da903x_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/da903x_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -94,7 +94,7 @@
 	return data->current_brightness;
 }
 
-static struct backlight_ops da903x_backlight_ops = {
+static const struct backlight_ops da903x_backlight_ops = {
 	.update_status	= da903x_backlight_update_status,
 	.get_brightness	= da903x_backlight_get_brightness,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/generic_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/generic_bl.c
--- linux-2.6.32.43/drivers/video/backlight/generic_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/generic_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -70,7 +70,7 @@
 }
 EXPORT_SYMBOL(corgibl_limit_intensity);
 
-static struct backlight_ops genericbl_ops = {
+static const struct backlight_ops genericbl_ops = {
 	.options = BL_CORE_SUSPENDRESUME,
 	.get_brightness = genericbl_get_intensity,
 	.update_status  = genericbl_send_intensity,
diff -uriN linux-2.6.32.43/drivers/video/backlight/hp680_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/hp680_bl.c
--- linux-2.6.32.43/drivers/video/backlight/hp680_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/hp680_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -98,7 +98,7 @@
 	return current_intensity;
 }
 
-static struct backlight_ops hp680bl_ops = {
+static const struct backlight_ops hp680bl_ops = {
 	.get_brightness = hp680bl_get_intensity,
 	.update_status  = hp680bl_set_intensity,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/jornada720_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/jornada720_bl.c
--- linux-2.6.32.43/drivers/video/backlight/jornada720_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/jornada720_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -93,7 +93,7 @@
 	return ret;
 }
 
-static struct backlight_ops jornada_bl_ops = {
+static const struct backlight_ops jornada_bl_ops = {
 	.get_brightness = jornada_bl_get_brightness,
 	.update_status = jornada_bl_update_status,
 	.options = BL_CORE_SUSPENDRESUME,
diff -uriN linux-2.6.32.43/drivers/video/backlight/kb3886_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/kb3886_bl.c
--- linux-2.6.32.43/drivers/video/backlight/kb3886_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/kb3886_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -134,7 +134,7 @@
 	return kb3886bl_intensity;
 }
 
-static struct backlight_ops kb3886bl_ops = {
+static const struct backlight_ops kb3886bl_ops = {
 	.get_brightness = kb3886bl_get_intensity,
 	.update_status  = kb3886bl_send_intensity,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/locomolcd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/locomolcd.c
--- linux-2.6.32.43/drivers/video/backlight/locomolcd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/locomolcd.c	2011-07-15 05:51:18.000000000 -0500
@@ -141,7 +141,7 @@
 	return current_intensity;
 }
 
-static struct backlight_ops locomobl_data = {
+static const struct backlight_ops locomobl_data = {
 	.get_brightness = locomolcd_get_intensity,
 	.update_status  = locomolcd_set_intensity,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/mbp_nvidia_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/mbp_nvidia_bl.c
--- linux-2.6.32.43/drivers/video/backlight/mbp_nvidia_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/mbp_nvidia_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -33,7 +33,7 @@
 	unsigned long iostart;
 	unsigned long iolen;
 	/* Backlight operations structure. */
-	struct backlight_ops backlight_ops;
+	const struct backlight_ops backlight_ops;
 };
 
 /* Module parameters. */
diff -uriN linux-2.6.32.43/drivers/video/backlight/omap1_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/omap1_bl.c
--- linux-2.6.32.43/drivers/video/backlight/omap1_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/omap1_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -125,7 +125,7 @@
 	return bl->current_intensity;
 }
 
-static struct backlight_ops omapbl_ops = {
+static const struct backlight_ops omapbl_ops = {
 	.get_brightness = omapbl_get_intensity,
 	.update_status  = omapbl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/progear_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/progear_bl.c
--- linux-2.6.32.43/drivers/video/backlight/progear_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/progear_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -54,7 +54,7 @@
 	return intensity - HW_LEVEL_MIN;
 }
 
-static struct backlight_ops progearbl_ops = {
+static const struct backlight_ops progearbl_ops = {
 	.get_brightness = progearbl_get_intensity,
 	.update_status = progearbl_set_intensity,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/pwm_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/pwm_bl.c
--- linux-2.6.32.43/drivers/video/backlight/pwm_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/pwm_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -56,7 +56,7 @@
 	return bl->props.brightness;
 }
 
-static struct backlight_ops pwm_backlight_ops = {
+static const struct backlight_ops pwm_backlight_ops = {
 	.update_status	= pwm_backlight_update_status,
 	.get_brightness	= pwm_backlight_get_brightness,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/tosa_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/tosa_bl.c
--- linux-2.6.32.43/drivers/video/backlight/tosa_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/tosa_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -72,7 +72,7 @@
 	return props->brightness;
 }
 
-static struct backlight_ops bl_ops = {
+static const struct backlight_ops bl_ops = {
 	.get_brightness		= tosa_bl_get_brightness,
 	.update_status		= tosa_bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/video/backlight/wm831x_bl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/wm831x_bl.c
--- linux-2.6.32.43/drivers/video/backlight/wm831x_bl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/backlight/wm831x_bl.c	2011-07-15 05:51:18.000000000 -0500
@@ -112,7 +112,7 @@
 	return data->current_brightness;
 }
 
-static struct backlight_ops wm831x_backlight_ops = {
+static const struct backlight_ops wm831x_backlight_ops = {
 	.options = BL_CORE_SUSPENDRESUME,
 	.update_status	= wm831x_backlight_update_status,
 	.get_brightness	= wm831x_backlight_get_brightness,
diff -uriN linux-2.6.32.43/drivers/video/bf54x-lq043fb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/bf54x-lq043fb.c
--- linux-2.6.32.43/drivers/video/bf54x-lq043fb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/bf54x-lq043fb.c	2011-07-15 05:51:18.000000000 -0500
@@ -463,7 +463,7 @@
 	return 0;
 }
 
-static struct backlight_ops bfin_lq043fb_bl_ops = {
+static const struct backlight_ops bfin_lq043fb_bl_ops = {
 	.get_brightness = bl_get_brightness,
 };
 
diff -uriN linux-2.6.32.43/drivers/video/bfin-t350mcqb-fb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/bfin-t350mcqb-fb.c
--- linux-2.6.32.43/drivers/video/bfin-t350mcqb-fb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/bfin-t350mcqb-fb.c	2011-07-15 05:51:18.000000000 -0500
@@ -381,7 +381,7 @@
 	return 0;
 }
 
-static struct backlight_ops bfin_lq043fb_bl_ops = {
+static const struct backlight_ops bfin_lq043fb_bl_ops = {
 	.get_brightness = bl_get_brightness,
 };
 
diff -uriN linux-2.6.32.43/drivers/video/fbcmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/fbcmap.c
--- linux-2.6.32.43/drivers/video/fbcmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/fbcmap.c	2011-07-15 05:51:18.000000000 -0500
@@ -266,8 +266,7 @@
 		rc = -ENODEV;
 		goto out;
 	}
-	if (cmap->start < 0 || (!info->fbops->fb_setcolreg &&
-				!info->fbops->fb_setcmap)) {
+	if (!info->fbops->fb_setcolreg && !info->fbops->fb_setcmap) {
 		rc = -EINVAL;
 		goto out1;
 	}
diff -uriN linux-2.6.32.43/drivers/video/fbmem.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/fbmem.c
--- linux-2.6.32.43/drivers/video/fbmem.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/fbmem.c	2011-07-15 05:51:18.000000000 -0500
@@ -403,7 +403,7 @@
 			image->dx += image->width + 8;
 		}
 	} else if (rotate == FB_ROTATE_UD) {
-		for (x = 0; x < num && image->dx >= 0; x++) {
+		for (x = 0; x < num && (__s32)image->dx >= 0; x++) {
 			info->fbops->fb_imageblit(info, image);
 			image->dx -= image->width + 8;
 		}
@@ -415,7 +415,7 @@
 			image->dy += image->height + 8;
 		}
 	} else if (rotate == FB_ROTATE_CCW) {
-		for (x = 0; x < num && image->dy >= 0; x++) {
+		for (x = 0; x < num && (__s32)image->dy >= 0; x++) {
 			info->fbops->fb_imageblit(info, image);
 			image->dy -= image->height + 8;
 		}
@@ -915,6 +915,8 @@
 	int flags = info->flags;
 	int ret = 0;
 
+	pax_track_stack();
+
 	if (var->activate & FB_ACTIVATE_INV_MODE) {
 		struct fb_videomode mode1, mode2;
 
@@ -1040,6 +1042,8 @@
 	void __user *argp = (void __user *)arg;
 	long ret = 0;
 
+	pax_track_stack();
+
 	switch (cmd) {
 	case FBIOGET_VSCREENINFO:
 		if (!lock_fb_info(info))
@@ -1119,7 +1123,7 @@
 			return -EFAULT;
 		if (con2fb.console < 1 || con2fb.console > MAX_NR_CONSOLES)
 			return -EINVAL;
-		if (con2fb.framebuffer < 0 || con2fb.framebuffer >= FB_MAX)
+		if (con2fb.framebuffer >= FB_MAX)
 			return -EINVAL;
 		if (!registered_fb[con2fb.framebuffer])
 			request_module("fb%d", con2fb.framebuffer);
diff -uriN linux-2.6.32.43/drivers/video/i810/i810_accel.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/i810/i810_accel.c
--- linux-2.6.32.43/drivers/video/i810/i810_accel.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/i810/i810_accel.c	2011-07-15 05:51:18.000000000 -0500
@@ -73,6 +73,7 @@
 		}
 	}
 	printk("ringbuffer lockup!!!\n");
+	printk("head:%u tail:%u iring.size:%u space:%u\n", head, tail, par->iring.size, space);
 	i810_report_error(mmio); 
 	par->dev_flags |= LOCKUP;
 	info->pixmap.scan_align = 1;
diff -uriN linux-2.6.32.43/drivers/video/nvidia/nv_backlight.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/nvidia/nv_backlight.c
--- linux-2.6.32.43/drivers/video/nvidia/nv_backlight.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/nvidia/nv_backlight.c	2011-07-15 05:51:18.000000000 -0500
@@ -87,7 +87,7 @@
 	return bd->props.brightness;
 }
 
-static struct backlight_ops nvidia_bl_ops = {
+static const struct backlight_ops nvidia_bl_ops = {
 	.get_brightness = nvidia_bl_get_brightness,
 	.update_status	= nvidia_bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/video/riva/fbdev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/riva/fbdev.c
--- linux-2.6.32.43/drivers/video/riva/fbdev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/riva/fbdev.c	2011-07-15 05:51:18.000000000 -0500
@@ -331,7 +331,7 @@
 	return bd->props.brightness;
 }
 
-static struct backlight_ops riva_bl_ops = {
+static const struct backlight_ops riva_bl_ops = {
 	.get_brightness = riva_bl_get_brightness,
 	.update_status	= riva_bl_update_status,
 };
diff -uriN linux-2.6.32.43/drivers/video/uvesafb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/uvesafb.c
--- linux-2.6.32.43/drivers/video/uvesafb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/uvesafb.c	2011-07-15 05:51:18.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/fb.h>
 #include <linux/io.h>
 #include <linux/mutex.h>
+#include <linux/moduleloader.h>
 #include <video/edid.h>
 #include <video/uvesafb.h>
 #ifdef CONFIG_X86
@@ -120,7 +121,7 @@
 		NULL,
 	};
 
-	return call_usermodehelper(v86d_path, argv, envp, 1);
+	return call_usermodehelper(v86d_path, argv, envp, UMH_WAIT_PROC);
 }
 
 /*
@@ -568,10 +569,32 @@
 	if ((task->t.regs.eax & 0xffff) != 0x4f || task->t.regs.es < 0xc000) {
 		par->pmi_setpal = par->ypan = 0;
 	} else {
+
+#ifdef CONFIG_PAX_KERNEXEC
+#ifdef CONFIG_MODULES
+		par->pmi_code = module_alloc_exec((u16)task->t.regs.ecx);
+#endif
+		if (!par->pmi_code) {
+			par->pmi_setpal = par->ypan = 0;
+			return 0;
+		}
+#endif
+
 		par->pmi_base = (u16 *)phys_to_virt(((u32)task->t.regs.es << 4)
 						+ task->t.regs.edi);
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
+		pax_open_kernel();
+		memcpy(par->pmi_code, par->pmi_base, (u16)task->t.regs.ecx);
+		pax_close_kernel();
+
+		par->pmi_start = ktva_ktla(par->pmi_code + par->pmi_base[1]);
+		par->pmi_pal = ktva_ktla(par->pmi_code + par->pmi_base[2]);
+#else
 		par->pmi_start = (u8 *)par->pmi_base + par->pmi_base[1];
 		par->pmi_pal = (u8 *)par->pmi_base + par->pmi_base[2];
+#endif
+
 		printk(KERN_INFO "uvesafb: protected mode interface info at "
 				 "%04x:%04x\n",
 				 (u16)task->t.regs.es, (u16)task->t.regs.edi);
@@ -1799,6 +1822,11 @@
 	if (par->vbe_modes)
 		kfree(par->vbe_modes);
 
+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
+	if (par->pmi_code)
+		module_free_exec(NULL, par->pmi_code);
+#endif
+
 	framebuffer_release(info);
 	return err;
 }
@@ -1825,6 +1853,12 @@
 				kfree(par->vbe_state_orig);
 			if (par->vbe_state_saved)
 				kfree(par->vbe_state_saved);
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
+			if (par->pmi_code)
+				module_free_exec(NULL, par->pmi_code);
+#endif
+
 		}
 
 		framebuffer_release(info);
diff -uriN linux-2.6.32.43/drivers/video/vesafb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/vesafb.c
--- linux-2.6.32.43/drivers/video/vesafb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/video/vesafb.c	2011-07-15 05:51:18.000000000 -0500
@@ -9,6 +9,7 @@
  */
 
 #include <linux/module.h>
+#include <linux/moduleloader.h>
 #include <linux/kernel.h>
 #include <linux/errno.h>
 #include <linux/string.h>
@@ -53,8 +54,8 @@
 static int   vram_total __initdata;		/* Set total amount of memory */
 static int   pmi_setpal __read_mostly = 1;	/* pmi for palette changes ??? */
 static int   ypan       __read_mostly;		/* 0..nothing, 1..ypan, 2..ywrap */
-static void  (*pmi_start)(void) __read_mostly;
-static void  (*pmi_pal)  (void) __read_mostly;
+static void  (*pmi_start)(void) __read_only;
+static void  (*pmi_pal)  (void) __read_only;
 static int   depth      __read_mostly;
 static int   vga_compat __read_mostly;
 /* --------------------------------------------------------------------- */
@@ -233,6 +234,7 @@
 	unsigned int size_vmode;
 	unsigned int size_remap;
 	unsigned int size_total;
+	void *pmi_code = NULL;
 
 	if (screen_info.orig_video_isVGA != VIDEO_TYPE_VLFB)
 		return -ENODEV;
@@ -275,10 +277,6 @@
 		size_remap = size_total;
 	vesafb_fix.smem_len = size_remap;
 
-#ifndef __i386__
-	screen_info.vesapm_seg = 0;
-#endif
-
 	if (!request_mem_region(vesafb_fix.smem_start, size_total, "vesafb")) {
 		printk(KERN_WARNING
 		       "vesafb: cannot reserve video memory at 0x%lx\n",
@@ -315,9 +313,21 @@
 	printk(KERN_INFO "vesafb: mode is %dx%dx%d, linelength=%d, pages=%d\n",
 	       vesafb_defined.xres, vesafb_defined.yres, vesafb_defined.bits_per_pixel, vesafb_fix.line_length, screen_info.pages);
 
+#ifdef __i386__
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
+	pmi_code = module_alloc_exec(screen_info.vesapm_size);
+	if (!pmi_code)
+#elif !defined(CONFIG_PAX_KERNEXEC)
+	if (0)
+#endif
+
+#endif
+	screen_info.vesapm_seg = 0;
+
 	if (screen_info.vesapm_seg) {
-		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x\n",
-		       screen_info.vesapm_seg,screen_info.vesapm_off);
+		printk(KERN_INFO "vesafb: protected mode interface info at %04x:%04x %04x bytes\n",
+		       screen_info.vesapm_seg,screen_info.vesapm_off,screen_info.vesapm_size);
 	}
 
 	if (screen_info.vesapm_seg < 0xc000)
@@ -325,9 +335,25 @@
 
 	if (ypan || pmi_setpal) {
 		unsigned short *pmi_base;
-		pmi_base  = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
-		pmi_start = (void*)((char*)pmi_base + pmi_base[1]);
-		pmi_pal   = (void*)((char*)pmi_base + pmi_base[2]);
+
+		pmi_base = (unsigned short*)phys_to_virt(((unsigned long)screen_info.vesapm_seg << 4) + screen_info.vesapm_off);
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
+		pax_open_kernel();
+		memcpy(pmi_code, pmi_base, screen_info.vesapm_size);
+#else
+		pmi_code = pmi_base;
+#endif
+
+		pmi_start = (void*)((char*)pmi_code + pmi_base[1]);
+		pmi_pal   = (void*)((char*)pmi_code + pmi_base[2]);
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
+		pmi_start = ktva_ktla(pmi_start);
+		pmi_pal = ktva_ktla(pmi_pal);
+		pax_close_kernel();
+#endif
+
 		printk(KERN_INFO "vesafb: pmi: set display start = %p, set palette = %p\n",pmi_start,pmi_pal);
 		if (pmi_base[3]) {
 			printk(KERN_INFO "vesafb: pmi: ports = ");
@@ -469,6 +495,11 @@
 	       info->node, info->fix.id);
 	return 0;
 err:
+
+#if defined(__i386__) && defined(CONFIG_MODULES) && defined(CONFIG_PAX_KERNEXEC)
+	module_free_exec(NULL, pmi_code);
+#endif
+
 	if (info->screen_base)
 		iounmap(info->screen_base);
 	framebuffer_release(info);
diff -uriN linux-2.6.32.43/drivers/xen/sys-hypervisor.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/xen/sys-hypervisor.c
--- linux-2.6.32.43/drivers/xen/sys-hypervisor.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/drivers/xen/sys-hypervisor.c	2011-07-15 05:51:18.000000000 -0500
@@ -425,7 +425,7 @@
 	return 0;
 }
 
-static struct sysfs_ops hyp_sysfs_ops = {
+static const struct sysfs_ops hyp_sysfs_ops = {
 	.show = hyp_sysfs_show,
 	.store = hyp_sysfs_store,
 };
diff -uriN linux-2.6.32.43/fs/9p/vfs_inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/9p/vfs_inode.c
--- linux-2.6.32.43/fs/9p/vfs_inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/9p/vfs_inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -1079,7 +1079,7 @@
 static void
 v9fs_vfs_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
 {
-	char *s = nd_get_link(nd);
+	const char *s = nd_get_link(nd);
 
 	P9_DPRINTK(P9_DEBUG_VFS, " %s %s\n", dentry->d_name.name,
 		IS_ERR(s) ? "<error>" : s);
diff -uriN linux-2.6.32.43/fs/aio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/aio.c
--- linux-2.6.32.43/fs/aio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/aio.c	2011-07-15 05:51:18.000000000 -0500
@@ -115,7 +115,7 @@
 	size += sizeof(struct io_event) * nr_events;
 	nr_pages = (size + PAGE_SIZE-1) >> PAGE_SHIFT;
 
-	if (nr_pages < 0)
+	if (nr_pages <= 0)
 		return -EINVAL;
 
 	nr_events = (PAGE_SIZE * nr_pages - sizeof(struct aio_ring)) / sizeof(struct io_event);
@@ -1089,6 +1089,8 @@
 	struct aio_timeout	to;
 	int			retry = 0;
 
+	pax_track_stack();
+
 	/* needed to zero any padding within an entry (there shouldn't be 
 	 * any, but C is fun!
 	 */
@@ -1382,13 +1384,18 @@
 static ssize_t aio_setup_vectored_rw(int type, struct kiocb *kiocb)
 {
 	ssize_t ret;
+	struct iovec iovstack;
 
 	ret = rw_copy_check_uvector(type, (struct iovec __user *)kiocb->ki_buf,
 				    kiocb->ki_nbytes, 1,
-				    &kiocb->ki_inline_vec, &kiocb->ki_iovec);
+				    &iovstack, &kiocb->ki_iovec);
 	if (ret < 0)
 		goto out;
 
+	if (kiocb->ki_iovec == &iovstack) {
+		kiocb->ki_inline_vec = iovstack;
+		kiocb->ki_iovec = &kiocb->ki_inline_vec;
+	}
 	kiocb->ki_nr_segs = kiocb->ki_nbytes;
 	kiocb->ki_cur_seg = 0;
 	/* ki_nbytes/left now reflect bytes instead of segs */
diff -uriN linux-2.6.32.43/fs/attr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/attr.c
--- linux-2.6.32.43/fs/attr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/attr.c	2011-07-15 05:51:18.000000000 -0500
@@ -14,6 +14,9 @@
 #include <linux/fcntl.h>
 #include <linux/quotaops.h>
 #include <linux/security.h>
+#include <linux/proc_fs.h>
+#include <linux/devpts_fs.h>
+#include <linux/vs_tag.h>
 
 /* Taken over from the old code... */
 
@@ -55,6 +58,10 @@
 		if (!is_owner_or_cap(inode))
 			goto error;
 	}
+
+	if (dx_permission(inode, MAY_WRITE))
+		goto error;
+
 fine:
 	retval = 0;
 error:
@@ -83,6 +90,7 @@
 		unsigned long limit;
 
 		limit = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
+		gr_learn_resource(current, RLIMIT_FSIZE, (unsigned long)offset, 1);
 		if (limit != RLIM_INFINITY && offset > limit)
 			goto out_sig;
 		if (offset > inode->i_sb->s_maxbytes)
@@ -120,6 +128,8 @@
 		inode->i_uid = attr->ia_uid;
 	if (ia_valid & ATTR_GID)
 		inode->i_gid = attr->ia_gid;
+	if ((ia_valid & ATTR_TAG) && IS_TAGGED(inode))
+		inode->i_tag = attr->ia_tag;
 	if (ia_valid & ATTR_ATIME)
 		inode->i_atime = timespec_trunc(attr->ia_atime,
 						inode->i_sb->s_time_gran);
@@ -214,7 +224,8 @@
 		error = inode_change_ok(inode, attr);
 		if (!error) {
 			if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
-			    (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid))
+			    (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid) ||
+			    (ia_valid & ATTR_TAG && attr->ia_tag != inode->i_tag))
 				error = vfs_dq_transfer(inode, attr) ?
 					-EDQUOT : 0;
 			if (!error)
diff -uriN linux-2.6.32.43/fs/autofs/root.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/autofs/root.c
--- linux-2.6.32.43/fs/autofs/root.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/autofs/root.c	2011-07-15 05:51:18.000000000 -0500
@@ -299,7 +299,8 @@
 	set_bit(n,sbi->symlink_bitmap);
 	sl = &sbi->symlink[n];
 	sl->len = strlen(symname);
-	sl->data = kmalloc(slsize = sl->len+1, GFP_KERNEL);
+	slsize = sl->len+1;
+	sl->data = kmalloc(slsize, GFP_KERNEL);
 	if (!sl->data) {
 		clear_bit(n,sbi->symlink_bitmap);
 		unlock_kernel();
diff -uriN linux-2.6.32.43/fs/autofs4/symlink.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/autofs4/symlink.c
--- linux-2.6.32.43/fs/autofs4/symlink.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/autofs4/symlink.c	2011-07-15 05:51:18.000000000 -0500
@@ -15,7 +15,7 @@
 static void *autofs4_follow_link(struct dentry *dentry, struct nameidata *nd)
 {
 	struct autofs_info *ino = autofs4_dentry_ino(dentry);
-	nd_set_link(nd, (char *)ino->u.symlink);
+	nd_set_link(nd, ino->u.symlink);
 	return NULL;
 }
 
diff -uriN linux-2.6.32.43/fs/befs/linuxvfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/befs/linuxvfs.c
--- linux-2.6.32.43/fs/befs/linuxvfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/befs/linuxvfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -493,7 +493,7 @@
 {
 	befs_inode_info *befs_ino = BEFS_I(dentry->d_inode);
 	if (befs_ino->i_flags & BEFS_LONG_SYMLINK) {
-		char *link = nd_get_link(nd);
+		const char *link = nd_get_link(nd);
 		if (!IS_ERR(link))
 			kfree(link);
 	}
diff -uriN linux-2.6.32.43/fs/binfmt_aout.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/binfmt_aout.c
--- linux-2.6.32.43/fs/binfmt_aout.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/binfmt_aout.c	2011-07-15 05:51:18.000000000 -0500
@@ -16,6 +16,7 @@
 #include <linux/string.h>
 #include <linux/fs.h>
 #include <linux/file.h>
+#include <linux/security.h>
 #include <linux/stat.h>
 #include <linux/fcntl.h>
 #include <linux/ptrace.h>
@@ -24,6 +25,7 @@
 #include <linux/binfmts.h>
 #include <linux/personality.h>
 #include <linux/init.h>
+#include <linux/vs_memory.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -102,6 +104,8 @@
 #endif
 #       define START_STACK(u)   (u.start_stack)
 
+	memset(&dump, 0, sizeof(dump));
+
 	fs = get_fs();
 	set_fs(KERNEL_DS);
 	has_dumped = 1;
@@ -113,10 +117,12 @@
 
 /* If the size of the dump file exceeds the rlimit, then see what would happen
    if we wrote the stack, but not the data area.  */
+	gr_learn_resource(current, RLIMIT_CORE, (dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE, 1);
 	if ((dump.u_dsize + dump.u_ssize+1) * PAGE_SIZE > limit)
 		dump.u_dsize = 0;
 
 /* Make sure we have enough room to write the stack and data areas. */
+	gr_learn_resource(current, RLIMIT_CORE, (dump.u_ssize + 1) * PAGE_SIZE, 1);
 	if ((dump.u_ssize + 1) * PAGE_SIZE > limit)
 		dump.u_ssize = 0;
 
@@ -146,9 +152,7 @@
 		dump_size = dump.u_ssize << PAGE_SHIFT;
 		DUMP_WRITE(dump_start,dump_size);
 	}
-/* Finally dump the task struct.  Not be used by gdb, but could be useful */
-	set_fs(KERNEL_DS);
-	DUMP_WRITE(current,sizeof(*current));
+/* Finally, let's not dump the task struct.  Not be used by gdb, but could be useful to an attacker */
 end_coredump:
 	set_fs(fs);
 	return has_dumped;
@@ -249,6 +253,8 @@
 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
 	if (rlim >= RLIM_INFINITY)
 		rlim = ~0;
+
+	gr_learn_resource(current, RLIMIT_DATA, ex.a_data + ex.a_bss, 1);
 	if (ex.a_data + ex.a_bss > rlim)
 		return -ENOMEM;
 
@@ -277,6 +283,27 @@
 	install_exec_creds(bprm);
  	current->flags &= ~PF_FORKNOEXEC;
 
+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
+	current->mm->pax_flags = 0UL;
+#endif
+
+#ifdef CONFIG_PAX_PAGEEXEC
+	if (!(N_FLAGS(ex) & F_PAX_PAGEEXEC)) {
+		current->mm->pax_flags |= MF_PAX_PAGEEXEC;
+
+#ifdef CONFIG_PAX_EMUTRAMP
+		if (N_FLAGS(ex) & F_PAX_EMUTRAMP)
+			current->mm->pax_flags |= MF_PAX_EMUTRAMP;
+#endif
+
+#ifdef CONFIG_PAX_MPROTECT
+		if (!(N_FLAGS(ex) & F_PAX_MPROTECT))
+			current->mm->pax_flags |= MF_PAX_MPROTECT;
+#endif
+
+	}
+#endif
+
 	if (N_MAGIC(ex) == OMAGIC) {
 		unsigned long text_addr, map_size;
 		loff_t pos;
@@ -349,7 +376,7 @@
 
 		down_write(&current->mm->mmap_sem);
  		error = do_mmap(bprm->file, N_DATADDR(ex), ex.a_data,
-				PROT_READ | PROT_WRITE | PROT_EXEC,
+				PROT_READ | PROT_WRITE,
 				MAP_FIXED | MAP_PRIVATE | MAP_DENYWRITE | MAP_EXECUTABLE,
 				fd_offset + ex.a_text);
 		up_write(&current->mm->mmap_sem);
diff -uriN linux-2.6.32.43/fs/binfmt_elf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/binfmt_elf.c
--- linux-2.6.32.43/fs/binfmt_elf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/binfmt_elf.c	2011-07-15 05:51:18.000000000 -0500
@@ -31,6 +31,7 @@
 #include <linux/random.h>
 #include <linux/elf.h>
 #include <linux/utsname.h>
+#include <linux/vs_memory.h>
 #include <asm/uaccess.h>
 #include <asm/param.h>
 #include <asm/page.h>
@@ -50,6 +51,10 @@
 #define elf_core_dump	NULL
 #endif
 
+#ifdef CONFIG_PAX_MPROTECT
+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags);
+#endif
+
 #if ELF_EXEC_PAGESIZE > PAGE_SIZE
 #define ELF_MIN_ALIGN	ELF_EXEC_PAGESIZE
 #else
@@ -69,6 +74,11 @@
 		.load_binary	= load_elf_binary,
 		.load_shlib	= load_elf_library,
 		.core_dump	= elf_core_dump,
+
+#ifdef CONFIG_PAX_MPROTECT
+		.handle_mprotect= elf_handle_mprotect,
+#endif
+
 		.min_coredump	= ELF_EXEC_PAGESIZE,
 		.hasvdso	= 1
 };
@@ -77,6 +87,8 @@
 
 static int set_brk(unsigned long start, unsigned long end)
 {
+	unsigned long e = end;
+
 	start = ELF_PAGEALIGN(start);
 	end = ELF_PAGEALIGN(end);
 	if (end > start) {
@@ -87,7 +99,7 @@
 		if (BAD_ADDR(addr))
 			return addr;
 	}
-	current->mm->start_brk = current->mm->brk = end;
+	current->mm->start_brk = current->mm->brk = e;
 	return 0;
 }
 
@@ -148,12 +160,15 @@
 	elf_addr_t __user *u_rand_bytes;
 	const char *k_platform = ELF_PLATFORM;
 	const char *k_base_platform = ELF_BASE_PLATFORM;
-	unsigned char k_rand_bytes[16];
+	u32 k_rand_bytes[4];
 	int items;
 	elf_addr_t *elf_info;
 	int ei_index = 0;
 	const struct cred *cred = current_cred();
 	struct vm_area_struct *vma;
+	unsigned long saved_auxv[AT_VECTOR_SIZE];
+
+	pax_track_stack();
 
 	/*
 	 * In some cases (e.g. Hyper-Threading), we want to avoid L1
@@ -195,8 +210,12 @@
 	 * Generate 16 random bytes for userspace PRNG seeding.
 	 */
 	get_random_bytes(k_rand_bytes, sizeof(k_rand_bytes));
-	u_rand_bytes = (elf_addr_t __user *)
-		       STACK_ALLOC(p, sizeof(k_rand_bytes));
+	srandom32(k_rand_bytes[0] ^ random32());
+	srandom32(k_rand_bytes[1] ^ random32());
+	srandom32(k_rand_bytes[2] ^ random32());
+	srandom32(k_rand_bytes[3] ^ random32());
+	p = STACK_ROUND(p, sizeof(k_rand_bytes));
+	u_rand_bytes = (elf_addr_t __user *) p;
 	if (__copy_to_user(u_rand_bytes, k_rand_bytes, sizeof(k_rand_bytes)))
 		return -EFAULT;
 
@@ -308,9 +327,11 @@
 		return -EFAULT;
 	current->mm->env_end = p;
 
+	memcpy(saved_auxv, elf_info, ei_index * sizeof(elf_addr_t));
+
 	/* Put the elf_info on the stack in the right place.  */
 	sp = (elf_addr_t __user *)envp + 1;
-	if (copy_to_user(sp, elf_info, ei_index * sizeof(elf_addr_t)))
+	if (copy_to_user(sp, saved_auxv, ei_index * sizeof(elf_addr_t)))
 		return -EFAULT;
 	return 0;
 }
@@ -385,10 +406,10 @@
 {
 	struct elf_phdr *elf_phdata;
 	struct elf_phdr *eppnt;
-	unsigned long load_addr = 0;
+	unsigned long load_addr = 0, pax_task_size = TASK_SIZE;
 	int load_addr_set = 0;
 	unsigned long last_bss = 0, elf_bss = 0;
-	unsigned long error = ~0UL;
+	unsigned long error = -EINVAL;
 	unsigned long total_size;
 	int retval, i, size;
 
@@ -434,6 +455,11 @@
 		goto out_close;
 	}
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
 	eppnt = elf_phdata;
 	for (i = 0; i < interp_elf_ex->e_phnum; i++, eppnt++) {
 		if (eppnt->p_type == PT_LOAD) {
@@ -477,8 +503,8 @@
 			k = load_addr + eppnt->p_vaddr;
 			if (BAD_ADDR(k) ||
 			    eppnt->p_filesz > eppnt->p_memsz ||
-			    eppnt->p_memsz > TASK_SIZE ||
-			    TASK_SIZE - eppnt->p_memsz < k) {
+			    eppnt->p_memsz > pax_task_size ||
+			    pax_task_size - eppnt->p_memsz < k) {
 				error = -ENOMEM;
 				goto out_close;
 			}
@@ -532,6 +558,194 @@
 	return error;
 }
 
+#if (defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)) && defined(CONFIG_PAX_SOFTMODE)
+static unsigned long pax_parse_softmode(const struct elf_phdr * const elf_phdata)
+{
+	unsigned long pax_flags = 0UL;
+
+#ifdef CONFIG_PAX_PAGEEXEC
+	if (elf_phdata->p_flags & PF_PAGEEXEC)
+		pax_flags |= MF_PAX_PAGEEXEC;
+#endif
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (elf_phdata->p_flags & PF_SEGMEXEC)
+		pax_flags |= MF_PAX_SEGMEXEC;
+#endif
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
+		if (nx_enabled)
+			pax_flags &= ~MF_PAX_SEGMEXEC;
+		else
+			pax_flags &= ~MF_PAX_PAGEEXEC;
+	}
+#endif
+
+#ifdef CONFIG_PAX_EMUTRAMP
+	if (elf_phdata->p_flags & PF_EMUTRAMP)
+		pax_flags |= MF_PAX_EMUTRAMP;
+#endif
+
+#ifdef CONFIG_PAX_MPROTECT
+	if (elf_phdata->p_flags & PF_MPROTECT)
+		pax_flags |= MF_PAX_MPROTECT;
+#endif
+
+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
+	if (randomize_va_space && (elf_phdata->p_flags & PF_RANDMMAP))
+		pax_flags |= MF_PAX_RANDMMAP;
+#endif
+
+	return pax_flags;
+}
+#endif
+
+#ifdef CONFIG_PAX_PT_PAX_FLAGS
+static unsigned long pax_parse_hardmode(const struct elf_phdr * const elf_phdata)
+{
+	unsigned long pax_flags = 0UL;
+
+#ifdef CONFIG_PAX_PAGEEXEC
+	if (!(elf_phdata->p_flags & PF_NOPAGEEXEC))
+		pax_flags |= MF_PAX_PAGEEXEC;
+#endif
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (!(elf_phdata->p_flags & PF_NOSEGMEXEC))
+		pax_flags |= MF_PAX_SEGMEXEC;
+#endif
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
+		if (nx_enabled)
+			pax_flags &= ~MF_PAX_SEGMEXEC;
+		else
+			pax_flags &= ~MF_PAX_PAGEEXEC;
+	}
+#endif
+
+#ifdef CONFIG_PAX_EMUTRAMP
+	if (!(elf_phdata->p_flags & PF_NOEMUTRAMP))
+		pax_flags |= MF_PAX_EMUTRAMP;
+#endif
+
+#ifdef CONFIG_PAX_MPROTECT
+	if (!(elf_phdata->p_flags & PF_NOMPROTECT))
+		pax_flags |= MF_PAX_MPROTECT;
+#endif
+
+#if defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)
+	if (randomize_va_space && !(elf_phdata->p_flags & PF_NORANDMMAP))
+		pax_flags |= MF_PAX_RANDMMAP;
+#endif
+
+	return pax_flags;
+}
+#endif
+
+#ifdef CONFIG_PAX_EI_PAX
+static unsigned long pax_parse_ei_pax(const struct elfhdr * const elf_ex)
+{
+	unsigned long pax_flags = 0UL;
+
+#ifdef CONFIG_PAX_PAGEEXEC
+	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_PAGEEXEC))
+		pax_flags |= MF_PAX_PAGEEXEC;
+#endif
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (!(elf_ex->e_ident[EI_PAX] & EF_PAX_SEGMEXEC))
+		pax_flags |= MF_PAX_SEGMEXEC;
+#endif
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_PAX_SEGMEXEC)
+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) == (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
+		if (nx_enabled)
+			pax_flags &= ~MF_PAX_SEGMEXEC;
+		else
+			pax_flags &= ~MF_PAX_PAGEEXEC;
+	}
+#endif
+
+#ifdef CONFIG_PAX_EMUTRAMP
+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && (elf_ex->e_ident[EI_PAX] & EF_PAX_EMUTRAMP))
+		pax_flags |= MF_PAX_EMUTRAMP;
+#endif
+
+#ifdef CONFIG_PAX_MPROTECT
+	if ((pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) && !(elf_ex->e_ident[EI_PAX] & EF_PAX_MPROTECT))
+		pax_flags |= MF_PAX_MPROTECT;
+#endif
+
+#ifdef CONFIG_PAX_ASLR
+	if (randomize_va_space && !(elf_ex->e_ident[EI_PAX] & EF_PAX_RANDMMAP))
+		pax_flags |= MF_PAX_RANDMMAP;
+#endif
+
+	return pax_flags;
+}
+#endif
+
+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
+static long pax_parse_elf_flags(const struct elfhdr * const elf_ex, const struct elf_phdr * const elf_phdata)
+{
+	unsigned long pax_flags = 0UL;
+
+#ifdef CONFIG_PAX_PT_PAX_FLAGS
+	unsigned long i;
+	int found_flags = 0;
+#endif
+
+#ifdef CONFIG_PAX_EI_PAX
+	pax_flags = pax_parse_ei_pax(elf_ex);
+#endif
+
+#ifdef CONFIG_PAX_PT_PAX_FLAGS
+	for (i = 0UL; i < elf_ex->e_phnum; i++)
+		if (elf_phdata[i].p_type == PT_PAX_FLAGS) {
+			if (((elf_phdata[i].p_flags & PF_PAGEEXEC) && (elf_phdata[i].p_flags & PF_NOPAGEEXEC)) ||
+			    ((elf_phdata[i].p_flags & PF_SEGMEXEC) && (elf_phdata[i].p_flags & PF_NOSEGMEXEC)) ||
+			    ((elf_phdata[i].p_flags & PF_EMUTRAMP) && (elf_phdata[i].p_flags & PF_NOEMUTRAMP)) ||
+			    ((elf_phdata[i].p_flags & PF_MPROTECT) && (elf_phdata[i].p_flags & PF_NOMPROTECT)) ||
+			    ((elf_phdata[i].p_flags & PF_RANDMMAP) && (elf_phdata[i].p_flags & PF_NORANDMMAP)))
+				return -EINVAL;
+
+#ifdef CONFIG_PAX_SOFTMODE
+			if (pax_softmode)
+				pax_flags = pax_parse_softmode(&elf_phdata[i]);
+			else
+#endif
+
+				pax_flags = pax_parse_hardmode(&elf_phdata[i]);
+			found_flags = 1;
+			break;
+		}
+#endif
+
+#if !defined(CONFIG_PAX_EI_PAX) && defined(CONFIG_PAX_PT_PAX_FLAGS)
+	if (found_flags == 0) {
+		struct elf_phdr phdr;
+		memset(&phdr, 0, sizeof(phdr));
+		phdr.p_flags = PF_NOEMUTRAMP;
+#ifdef CONFIG_PAX_SOFTMODE
+		if (pax_softmode)
+			pax_flags = pax_parse_softmode(&phdr);
+	else
+#endif
+			pax_flags = pax_parse_hardmode(&phdr);
+	}
+#endif
+
+
+	if (0 > pax_check_flags(&pax_flags))
+		return -EINVAL;
+
+	current->mm->pax_flags = pax_flags;
+	return 0;
+}
+#endif
+
 /*
  * These are the functions used to load ELF style executables and shared
  * libraries.  There is no binary dependent code anywhere else.
@@ -548,6 +762,11 @@
 {
 	unsigned int random_variable = 0;
 
+#ifdef CONFIG_PAX_RANDUSTACK
+	if (randomize_va_space)
+		return stack_top - current->mm->delta_stack;
+#endif
+
 	if ((current->flags & PF_RANDOMIZE) &&
 		!(current->personality & ADDR_NO_RANDOMIZE)) {
 		random_variable = get_random_int() & STACK_RND_MASK;
@@ -566,7 +785,7 @@
  	unsigned long load_addr = 0, load_bias = 0;
 	int load_addr_set = 0;
 	char * elf_interpreter = NULL;
-	unsigned long error;
+	unsigned long error = 0;
 	struct elf_phdr *elf_ppnt, *elf_phdata;
 	unsigned long elf_bss, elf_brk;
 	int retval, i;
@@ -576,11 +795,11 @@
 	unsigned long start_code, end_code, start_data, end_data;
 	unsigned long reloc_func_desc = 0;
 	int executable_stack = EXSTACK_DEFAULT;
-	unsigned long def_flags = 0;
 	struct {
 		struct elfhdr elf_ex;
 		struct elfhdr interp_elf_ex;
 	} *loc;
+	unsigned long pax_task_size = TASK_SIZE;
 
 	loc = kmalloc(sizeof(*loc), GFP_KERNEL);
 	if (!loc) {
@@ -718,11 +937,80 @@
 
 	/* OK, This is the point of no return */
 	current->flags &= ~PF_FORKNOEXEC;
-	current->mm->def_flags = def_flags;
+
+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
+	current->mm->pax_flags = 0UL;
+#endif
+
+#ifdef CONFIG_PAX_DLRESOLVE
+	current->mm->call_dl_resolve = 0UL;
+#endif
+
+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
+	current->mm->call_syscall = 0UL;
+#endif
+
+#ifdef CONFIG_PAX_ASLR
+	current->mm->delta_mmap = 0UL;
+	current->mm->delta_stack = 0UL;
+#endif
+
+	current->mm->def_flags = 0;
+
+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS)
+	if (0 > pax_parse_elf_flags(&loc->elf_ex, elf_phdata)) {
+		send_sig(SIGKILL, current, 0);
+		goto out_free_dentry;
+	}
+#endif
+
+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
+	pax_set_initial_flags(bprm);
+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
+	if (pax_set_initial_flags_func)
+		(pax_set_initial_flags_func)(bprm);
+#endif
+
+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
+	if ((current->mm->pax_flags & MF_PAX_PAGEEXEC) && !nx_enabled) {
+		current->mm->context.user_cs_limit = PAGE_SIZE;
+		current->mm->def_flags |= VM_PAGEEXEC;
+	}
+#endif
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
+		current->mm->context.user_cs_base = SEGMEXEC_TASK_SIZE;
+		current->mm->context.user_cs_limit = TASK_SIZE-SEGMEXEC_TASK_SIZE;
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+	}
+#endif
+
+#if defined(CONFIG_ARCH_TRACK_EXEC_LIMIT) || defined(CONFIG_PAX_SEGMEXEC)
+	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
+		set_user_cs(current->mm->context.user_cs_base, current->mm->context.user_cs_limit, get_cpu());
+		put_cpu();
+	}
+#endif
 
 	/* Do this immediately, since STACK_TOP as used in setup_arg_pages
 	   may depend on the personality.  */
 	SET_PERSONALITY(loc->elf_ex);
+
+#ifdef CONFIG_PAX_ASLR
+	if (current->mm->pax_flags & MF_PAX_RANDMMAP) {
+		current->mm->delta_mmap = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN)-1)) << PAGE_SHIFT;
+		current->mm->delta_stack = (pax_get_random_long() & ((1UL << PAX_DELTA_STACK_LEN)-1)) << PAGE_SHIFT;
+	}
+#endif
+
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+	if (current->mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
+		executable_stack = EXSTACK_DISABLE_X;
+		current->personality &= ~READ_IMPLIES_EXEC;
+	} else
+#endif
+
 	if (elf_read_implies_exec(loc->elf_ex, executable_stack))
 		current->personality |= READ_IMPLIES_EXEC;
 
@@ -804,6 +1092,20 @@
 #else
 			load_bias = ELF_PAGESTART(ELF_ET_DYN_BASE - vaddr);
 #endif
+
+#ifdef CONFIG_PAX_RANDMMAP
+			/* PaX: randomize base address at the default exe base if requested */
+			if ((current->mm->pax_flags & MF_PAX_RANDMMAP) && elf_interpreter) {
+#ifdef CONFIG_SPARC64
+				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << (PAGE_SHIFT+1);
+#else
+				load_bias = (pax_get_random_long() & ((1UL << PAX_DELTA_MMAP_LEN) - 1)) << PAGE_SHIFT;
+#endif
+				load_bias = ELF_PAGESTART(PAX_ELF_ET_DYN_BASE - vaddr + load_bias);
+				elf_flags |= MAP_FIXED;
+			}
+#endif
+
 		}
 
 		error = elf_map(bprm->file, load_bias + vaddr, elf_ppnt,
@@ -836,9 +1138,9 @@
 		 * allowed task size. Note that p_filesz must always be
 		 * <= p_memsz so it is only necessary to check p_memsz.
 		 */
-		if (BAD_ADDR(k) || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
-		    elf_ppnt->p_memsz > TASK_SIZE ||
-		    TASK_SIZE - elf_ppnt->p_memsz < k) {
+		if (k >= pax_task_size || elf_ppnt->p_filesz > elf_ppnt->p_memsz ||
+		    elf_ppnt->p_memsz > pax_task_size ||
+		    pax_task_size - elf_ppnt->p_memsz < k) {
 			/* set_brk can never work. Avoid overflows. */
 			send_sig(SIGKILL, current, 0);
 			retval = -EINVAL;
@@ -866,6 +1168,11 @@
 	start_data += load_bias;
 	end_data += load_bias;
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (current->mm->pax_flags & MF_PAX_RANDMMAP)
+		elf_brk += PAGE_SIZE + ((pax_get_random_long() & ~PAGE_MASK) << 4);
+#endif
+
 	/* Calling set_brk effectively mmaps the pages that we need
 	 * for the bss and break sections.  We must do this before
 	 * mapping in the interpreter, to make sure it doesn't wind
@@ -877,9 +1184,11 @@
 		goto out_free_dentry;
 	}
 	if (likely(elf_bss != elf_brk) && unlikely(padzero(elf_bss))) {
-		send_sig(SIGSEGV, current, 0);
-		retval = -EFAULT; /* Nobody gets to see this, but.. */
-		goto out_free_dentry;
+		/*
+		 * This bss-zeroing can fail if the ELF
+		 * file specifies odd protections. So
+		 * we don't check the return value
+		 */
 	}
 
 	if (elf_interpreter) {
@@ -1112,8 +1421,10 @@
 			unsigned long n = off;
 			if (n > PAGE_SIZE)
 				n = PAGE_SIZE;
-			if (!dump_write(file, buf, n))
+			if (!dump_write(file, buf, n)) {
+				free_page((unsigned long)buf);
 				return 0;
+			}
 			off -= n;
 		}
 		free_page((unsigned long)buf);
@@ -1125,7 +1436,7 @@
  * Decide what to dump of a segment, part, all or none.
  */
 static unsigned long vma_dump_size(struct vm_area_struct *vma,
-				   unsigned long mm_flags)
+				   unsigned long mm_flags, long signr)
 {
 #define FILTER(type)	(mm_flags & (1UL << MMF_DUMP_##type))
 
@@ -1159,7 +1470,7 @@
 	if (vma->vm_file == NULL)
 		return 0;
 
-	if (FILTER(MAPPED_PRIVATE))
+	if (signr == SIGKILL || FILTER(MAPPED_PRIVATE))
 		goto whole;
 
 	/*
@@ -1255,8 +1566,11 @@
 #undef DUMP_WRITE
 
 #define DUMP_WRITE(addr, nr)	\
+	do { \
+	gr_learn_resource(current, RLIMIT_CORE, size + (nr), 1); \
 	if ((size += (nr)) > limit || !dump_write(file, (addr), (nr))) \
-		goto end_coredump;
+		goto end_coredump; \
+	} while (0);
 
 static void fill_elf_header(struct elfhdr *elf, int segs,
 			    u16 machine, u32 flags, u8 osabi)
@@ -1385,9 +1699,9 @@
 {
 	elf_addr_t *auxv = (elf_addr_t *) mm->saved_auxv;
 	int i = 0;
-	do
+	do {
 		i += 2;
-	while (auxv[i - 2] != AT_NULL);
+	} while (auxv[i - 2] != AT_NULL);
 	fill_note(note, "CORE", NT_AUXV, i * sizeof(elf_addr_t), auxv);
 }
 
@@ -1973,7 +2287,7 @@
 		phdr.p_offset = offset;
 		phdr.p_vaddr = vma->vm_start;
 		phdr.p_paddr = 0;
-		phdr.p_filesz = vma_dump_size(vma, mm_flags);
+		phdr.p_filesz = vma_dump_size(vma, mm_flags, signr);
 		phdr.p_memsz = vma->vm_end - vma->vm_start;
 		offset += phdr.p_filesz;
 		phdr.p_flags = vma->vm_flags & VM_READ ? PF_R : 0;
@@ -2006,7 +2320,7 @@
 		unsigned long addr;
 		unsigned long end;
 
-		end = vma->vm_start + vma_dump_size(vma, mm_flags);
+		end = vma->vm_start + vma_dump_size(vma, mm_flags, signr);
 
 		for (addr = vma->vm_start; addr < end; addr += PAGE_SIZE) {
 			struct page *page;
@@ -2015,6 +2329,7 @@
 			page = get_dump_page(addr);
 			if (page) {
 				void *kaddr = kmap(page);
+				gr_learn_resource(current, RLIMIT_CORE, size + PAGE_SIZE, 1);
 				stop = ((size += PAGE_SIZE) > limit) ||
 					!dump_write(file, kaddr, PAGE_SIZE);
 				kunmap(page);
@@ -2042,6 +2357,97 @@
 
 #endif		/* USE_ELF_CORE_DUMP */
 
+#ifdef CONFIG_PAX_MPROTECT
+/* PaX: non-PIC ELF libraries need relocations on their executable segments
+ * therefore we'll grant them VM_MAYWRITE once during their life. Similarly
+ * we'll remove VM_MAYWRITE for good on RELRO segments.
+ *
+ * The checks favour ld-linux.so behaviour which operates on a per ELF segment
+ * basis because we want to allow the common case and not the special ones.
+ */
+static void elf_handle_mprotect(struct vm_area_struct *vma, unsigned long newflags)
+{
+	struct elfhdr elf_h;
+	struct elf_phdr elf_p;
+	unsigned long i;
+	unsigned long oldflags;
+	bool is_textrel_rw, is_textrel_rx, is_relro;
+
+	if (!(vma->vm_mm->pax_flags & MF_PAX_MPROTECT))
+		return;
+
+	oldflags = vma->vm_flags & (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ);
+	newflags &= VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_EXEC | VM_WRITE | VM_READ;
+
+#ifdef CONFIG_PAX_ELFRELOCS
+	/* possible TEXTREL */
+	is_textrel_rw = vma->vm_file && !vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYREAD | VM_EXEC | VM_READ) && newflags == (VM_WRITE | VM_READ);
+	is_textrel_rx = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYEXEC | VM_MAYWRITE | VM_MAYREAD | VM_WRITE | VM_READ) && newflags == (VM_EXEC | VM_READ);
+#else
+	is_textrel_rw = false;
+	is_textrel_rx = false;
+#endif
+
+	/* possible RELRO */
+	is_relro = vma->vm_file && vma->anon_vma && oldflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ) && newflags == (VM_MAYWRITE | VM_MAYREAD | VM_READ);
+
+	if (!is_textrel_rw && !is_textrel_rx && !is_relro)
+		return;
+
+	if (sizeof(elf_h) != kernel_read(vma->vm_file, 0UL, (char *)&elf_h, sizeof(elf_h)) ||
+	    memcmp(elf_h.e_ident, ELFMAG, SELFMAG) ||
+
+#ifdef CONFIG_PAX_ETEXECRELOCS
+	    ((is_textrel_rw || is_textrel_rx) && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
+#else
+	    ((is_textrel_rw || is_textrel_rx) && elf_h.e_type != ET_DYN) ||
+#endif
+
+	    (is_relro && (elf_h.e_type != ET_DYN && elf_h.e_type != ET_EXEC)) ||
+	    !elf_check_arch(&elf_h) ||
+	    elf_h.e_phentsize != sizeof(struct elf_phdr) ||
+	    elf_h.e_phnum > 65536UL / sizeof(struct elf_phdr))
+		return;
+
+	for (i = 0UL; i < elf_h.e_phnum; i++) {
+		if (sizeof(elf_p) != kernel_read(vma->vm_file, elf_h.e_phoff + i*sizeof(elf_p), (char *)&elf_p, sizeof(elf_p)))
+			return;
+		switch (elf_p.p_type) {
+		case PT_DYNAMIC:
+			if (!is_textrel_rw && !is_textrel_rx)
+				continue;
+			i = 0UL;
+			while ((i+1) * sizeof(elf_dyn) <= elf_p.p_filesz) {
+				elf_dyn dyn;
+
+				if (sizeof(dyn) != kernel_read(vma->vm_file, elf_p.p_offset + i*sizeof(dyn), (char *)&dyn, sizeof(dyn)))
+					return;
+				if (dyn.d_tag == DT_NULL)
+					return;
+				if (dyn.d_tag == DT_TEXTREL || (dyn.d_tag == DT_FLAGS && (dyn.d_un.d_val & DF_TEXTREL))) {
+					gr_log_textrel(vma);
+					if (is_textrel_rw)
+						vma->vm_flags |= VM_MAYWRITE;
+					else
+						/* PaX: disallow write access after relocs are done, hopefully noone else needs it... */
+						vma->vm_flags &= ~VM_MAYWRITE;
+					return;
+				}
+				i++;
+			}
+			return;
+
+		case PT_GNU_RELRO:
+			if (!is_relro)
+				continue;
+			if ((elf_p.p_offset >> PAGE_SHIFT) == vma->vm_pgoff && ELF_PAGEALIGN(elf_p.p_memsz) == vma->vm_end - vma->vm_start)
+				vma->vm_flags &= ~VM_MAYWRITE;
+			return;
+		}
+	}
+}
+#endif
+
 static int __init init_elf_binfmt(void)
 {
 	return register_binfmt(&elf_format);
diff -uriN linux-2.6.32.43/fs/binfmt_flat.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/binfmt_flat.c
--- linux-2.6.32.43/fs/binfmt_flat.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/binfmt_flat.c	2011-07-15 05:51:18.000000000 -0500
@@ -35,6 +35,7 @@
 #include <linux/init.h>
 #include <linux/flat.h>
 #include <linux/syscalls.h>
+#include <linux/vs_memory.h>
 
 #include <asm/byteorder.h>
 #include <asm/system.h>
@@ -564,7 +565,9 @@
 				realdatastart = (unsigned long) -ENOMEM;
 			printk("Unable to allocate RAM for process data, errno %d\n",
 					(int)-realdatastart);
+			down_write(&current->mm->mmap_sem);
 			do_munmap(current->mm, textpos, text_len);
+			up_write(&current->mm->mmap_sem);
 			ret = realdatastart;
 			goto err;
 		}
@@ -588,8 +591,10 @@
 		}
 		if (IS_ERR_VALUE(result)) {
 			printk("Unable to read data+bss, errno %d\n", (int)-result);
+			down_write(&current->mm->mmap_sem);
 			do_munmap(current->mm, textpos, text_len);
 			do_munmap(current->mm, realdatastart, data_len + extra);
+			up_write(&current->mm->mmap_sem);
 			ret = result;
 			goto err;
 		}
@@ -658,8 +663,10 @@
 		}
 		if (IS_ERR_VALUE(result)) {
 			printk("Unable to read code+data+bss, errno %d\n",(int)-result);
+			down_write(&current->mm->mmap_sem);
 			do_munmap(current->mm, textpos, text_len + data_len + extra +
 				MAX_SHARED_LIBS * sizeof(unsigned long));
+			up_write(&current->mm->mmap_sem);
 			ret = result;
 			goto err;
 		}
diff -uriN linux-2.6.32.43/fs/binfmt_som.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/binfmt_som.c
--- linux-2.6.32.43/fs/binfmt_som.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/binfmt_som.c	2011-07-15 05:50:11.000000000 -0500
@@ -28,6 +28,7 @@
 #include <linux/shm.h>
 #include <linux/personality.h>
 #include <linux/init.h>
+#include <linux/vs_memory.h>
 
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
diff -uriN linux-2.6.32.43/fs/bio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/bio.c
--- linux-2.6.32.43/fs/bio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/bio.c	2011-07-15 05:51:18.000000000 -0500
@@ -78,7 +78,7 @@
 
 	i = 0;
 	while (i < bio_slab_nr) {
-		struct bio_slab *bslab = &bio_slabs[i];
+		bslab = &bio_slabs[i];
 
 		if (!bslab->slab && entry == -1)
 			entry = i;
@@ -1236,7 +1236,7 @@
 	const int read = bio_data_dir(bio) == READ;
 	struct bio_map_data *bmd = bio->bi_private;
 	int i;
-	char *p = bmd->sgvecs[0].iov_base;
+	char *p = (__force char *)bmd->sgvecs[0].iov_base;
 
 	__bio_for_each_segment(bvec, bio, i, 0) {
 		char *addr = page_address(bvec->bv_page);
diff -uriN linux-2.6.32.43/fs/block_dev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/block_dev.c
--- linux-2.6.32.43/fs/block_dev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/block_dev.c	2011-07-15 05:51:18.000000000 -0500
@@ -26,6 +26,7 @@
 #include <linux/namei.h>
 #include <linux/log2.h>
 #include <linux/kmemleak.h>
+#include <linux/vs_device.h>
 #include <asm/uaccess.h>
 #include "internal.h"
 
@@ -557,6 +558,7 @@
 		bdev->bd_invalidated = 0;
 		inode->i_mode = S_IFBLK;
 		inode->i_rdev = dev;
+		inode->i_mdev = dev;
 		inode->i_bdev = bdev;
 		inode->i_data.a_ops = &def_blk_aops;
 		mapping_set_gfp_mask(&inode->i_data, GFP_USER);
@@ -603,6 +605,11 @@
 static struct block_device *bd_acquire(struct inode *inode)
 {
 	struct block_device *bdev;
+	dev_t mdev;
+
+	if (!vs_map_blkdev(inode->i_rdev, &mdev, DATTR_OPEN))
+		return NULL;
+	inode->i_mdev = mdev;
 
 	spin_lock(&bdev_lock);
 	bdev = inode->i_bdev;
@@ -613,7 +620,7 @@
 	}
 	spin_unlock(&bdev_lock);
 
-	bdev = bdget(inode->i_rdev);
+	bdev = bdget(mdev);
 	if (bdev) {
 		spin_lock(&bdev_lock);
 		if (!inode->i_bdev) {
@@ -664,7 +671,7 @@
 	else if (bdev->bd_contains == bdev)
 		res = 0;  	 /* is a whole device which isn't held */
 
-	else if (bdev->bd_contains->bd_holder == bd_claim)
+	else if (bdev->bd_contains->bd_holder == (void *)bd_claim)
 		res = 0; 	 /* is a partition of a device that is being partitioned */
 	else if (bdev->bd_contains->bd_holder != NULL)
 		res = -EBUSY;	 /* is a partition of a held device */
diff -uriN linux-2.6.32.43/fs/btrfs/ctree.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/ctree.c
--- linux-2.6.32.43/fs/btrfs/ctree.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/ctree.c	2011-07-15 05:51:18.000000000 -0500
@@ -461,9 +461,12 @@
 		free_extent_buffer(buf);
 		add_root_to_dirty_list(root);
 	} else {
-		if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID)
-			parent_start = parent->start;
-		else
+		if (root->root_key.objectid == BTRFS_TREE_RELOC_OBJECTID) {
+			if (parent)
+				parent_start = parent->start;
+			else
+				parent_start = 0;
+		} else
 			parent_start = 0;
 
 		WARN_ON(trans->transid != btrfs_header_generation(parent));
@@ -3645,7 +3648,6 @@
 
 	ret = 0;
 	if (slot == 0) {
-		struct btrfs_disk_key disk_key;
 		btrfs_cpu_key_to_disk(&disk_key, cpu_key);
 		ret = fixup_low_keys(trans, root, path, &disk_key, 1);
 	}
diff -uriN linux-2.6.32.43/fs/btrfs/ctree.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/ctree.h
--- linux-2.6.32.43/fs/btrfs/ctree.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/ctree.h	2011-07-15 05:50:11.000000000 -0500
@@ -547,11 +547,14 @@
 	/* modification sequence number for NFS */
 	__le64 sequence;
 
+	__le16 tag;
 	/*
 	 * a little future expansion, for more than this we can
 	 * just grow the inode item and version it
 	 */
-	__le64 reserved[4];
+	__le16 reserved16;
+	__le32 reserved32;
+	__le64 reserved[3];
 	struct btrfs_timespec atime;
 	struct btrfs_timespec ctime;
 	struct btrfs_timespec mtime;
@@ -1162,6 +1165,8 @@
 #define BTRFS_MOUNT_NOSSD		(1 << 9)
 #define BTRFS_MOUNT_DISCARD		(1 << 10)
 
+#define BTRFS_MOUNT_TAGGED		(1 << 24)
+
 #define btrfs_clear_opt(o, opt)		((o) &= ~BTRFS_MOUNT_##opt)
 #define btrfs_set_opt(o, opt)		((o) |= BTRFS_MOUNT_##opt)
 #define btrfs_test_opt(root, opt)	((root)->fs_info->mount_opt & \
@@ -1181,6 +1186,10 @@
 #define BTRFS_INODE_NOATIME		(1 << 9)
 #define BTRFS_INODE_DIRSYNC		(1 << 10)
 
+#define BTRFS_INODE_IXUNLINK		(1 << 24)
+#define BTRFS_INODE_BARRIER		(1 << 25)
+#define BTRFS_INODE_COW			(1 << 26)
+
 
 #define BTRFS_INODE_ROOT_ITEM_INIT	(1 << 31)
 
@@ -1385,6 +1394,7 @@
 BTRFS_SETGET_FUNCS(inode_nlink, struct btrfs_inode_item, nlink, 32);
 BTRFS_SETGET_FUNCS(inode_uid, struct btrfs_inode_item, uid, 32);
 BTRFS_SETGET_FUNCS(inode_gid, struct btrfs_inode_item, gid, 32);
+BTRFS_SETGET_FUNCS(inode_tag, struct btrfs_inode_item, tag, 16);
 BTRFS_SETGET_FUNCS(inode_mode, struct btrfs_inode_item, mode, 32);
 BTRFS_SETGET_FUNCS(inode_rdev, struct btrfs_inode_item, rdev, 64);
 BTRFS_SETGET_FUNCS(inode_flags, struct btrfs_inode_item, flags, 64);
@@ -2360,6 +2370,7 @@
 long btrfs_ioctl(struct file *file, unsigned int cmd, unsigned long arg);
 void btrfs_update_iflags(struct inode *inode);
 void btrfs_inherit_iflags(struct inode *inode, struct inode *dir);
+int btrfs_sync_flags(struct inode *inode, int, int);
 
 /* file.c */
 int btrfs_sync_file(struct file *file, struct dentry *dentry, int datasync);
diff -uriN linux-2.6.32.43/fs/btrfs/disk-io.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/disk-io.c
--- linux-2.6.32.43/fs/btrfs/disk-io.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/disk-io.c	2011-07-15 05:51:18.000000000 -0500
@@ -39,7 +39,7 @@
 #include "tree-log.h"
 #include "free-space-cache.h"
 
-static struct extent_io_ops btree_extent_io_ops;
+static const struct extent_io_ops btree_extent_io_ops;
 static void end_workqueue_fn(struct btrfs_work *work);
 static void free_fs_root(struct btrfs_root *root);
 
@@ -1728,6 +1728,9 @@
 		goto fail_iput;
 	}
 
+	if (btrfs_test_opt(tree_root, TAGGED))
+		sb->s_flags |= MS_TAGGED;
+
 	features = btrfs_super_incompat_flags(disk_super) &
 		~BTRFS_FEATURE_INCOMPAT_SUPP;
 	if (features) {
@@ -2607,7 +2610,7 @@
 	return 0;
 }
 
-static struct extent_io_ops btree_extent_io_ops = {
+static const struct extent_io_ops btree_extent_io_ops = {
 	.write_cache_pages_lock_hook = btree_lock_page_hook,
 	.readpage_end_io_hook = btree_readpage_end_io_hook,
 	.submit_bio_hook = btree_submit_bio_hook,
diff -uriN linux-2.6.32.43/fs/btrfs/extent_io.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/extent_io.h
--- linux-2.6.32.43/fs/btrfs/extent_io.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/extent_io.h	2011-07-15 05:51:18.000000000 -0500
@@ -49,36 +49,36 @@
 				       struct bio *bio, int mirror_num,
 				       unsigned long bio_flags);
 struct extent_io_ops {
-	int (*fill_delalloc)(struct inode *inode, struct page *locked_page,
+	int (* const fill_delalloc)(struct inode *inode, struct page *locked_page,
 			     u64 start, u64 end, int *page_started,
 			     unsigned long *nr_written);
-	int (*writepage_start_hook)(struct page *page, u64 start, u64 end);
-	int (*writepage_io_hook)(struct page *page, u64 start, u64 end);
+	int (* const writepage_start_hook)(struct page *page, u64 start, u64 end);
+	int (* const writepage_io_hook)(struct page *page, u64 start, u64 end);
 	extent_submit_bio_hook_t *submit_bio_hook;
-	int (*merge_bio_hook)(struct page *page, unsigned long offset,
+	int (* const merge_bio_hook)(struct page *page, unsigned long offset,
 			      size_t size, struct bio *bio,
 			      unsigned long bio_flags);
-	int (*readpage_io_hook)(struct page *page, u64 start, u64 end);
-	int (*readpage_io_failed_hook)(struct bio *bio, struct page *page,
+	int (* const readpage_io_hook)(struct page *page, u64 start, u64 end);
+	int (* const readpage_io_failed_hook)(struct bio *bio, struct page *page,
 				       u64 start, u64 end,
 				       struct extent_state *state);
-	int (*writepage_io_failed_hook)(struct bio *bio, struct page *page,
+	int (* const writepage_io_failed_hook)(struct bio *bio, struct page *page,
 					u64 start, u64 end,
 				       struct extent_state *state);
-	int (*readpage_end_io_hook)(struct page *page, u64 start, u64 end,
+	int (* const readpage_end_io_hook)(struct page *page, u64 start, u64 end,
 				    struct extent_state *state);
-	int (*writepage_end_io_hook)(struct page *page, u64 start, u64 end,
+	int (* const writepage_end_io_hook)(struct page *page, u64 start, u64 end,
 				      struct extent_state *state, int uptodate);
-	int (*set_bit_hook)(struct inode *inode, u64 start, u64 end,
+	int (* const set_bit_hook)(struct inode *inode, u64 start, u64 end,
 			    unsigned long old, unsigned long bits);
-	int (*clear_bit_hook)(struct inode *inode, struct extent_state *state,
+	int (* const clear_bit_hook)(struct inode *inode, struct extent_state *state,
 			      unsigned long bits);
-	int (*merge_extent_hook)(struct inode *inode,
+	int (* const merge_extent_hook)(struct inode *inode,
 				 struct extent_state *new,
 				 struct extent_state *other);
-	int (*split_extent_hook)(struct inode *inode,
+	int (* const split_extent_hook)(struct inode *inode,
 				 struct extent_state *orig, u64 split);
-	int (*write_cache_pages_lock_hook)(struct page *page);
+	int (* const write_cache_pages_lock_hook)(struct page *page);
 };
 
 struct extent_io_tree {
@@ -88,7 +88,7 @@
 	u64 dirty_bytes;
 	spinlock_t lock;
 	spinlock_t buffer_lock;
-	struct extent_io_ops *ops;
+	const struct extent_io_ops *ops;
 };
 
 struct extent_state {
diff -uriN linux-2.6.32.43/fs/btrfs/extent-tree.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/extent-tree.c
--- linux-2.6.32.43/fs/btrfs/extent-tree.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/extent-tree.c	2011-07-15 05:51:18.000000000 -0500
@@ -7141,6 +7141,10 @@
 				u64 group_start = group->key.objectid;
 				new_extents = kmalloc(sizeof(*new_extents),
 						      GFP_NOFS);
+				if (!new_extents) {
+					ret = -ENOMEM;
+					goto out;
+				}
 				nr_extents = 1;
 				ret = get_new_locations(reloc_inode,
 							extent_key,
diff -uriN linux-2.6.32.43/fs/btrfs/free-space-cache.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/free-space-cache.c
--- linux-2.6.32.43/fs/btrfs/free-space-cache.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/free-space-cache.c	2011-07-15 05:51:18.000000000 -0500
@@ -1074,8 +1074,6 @@
 
 	while(1) {
 		if (entry->bytes < bytes || entry->offset < min_start) {
-			struct rb_node *node;
-
 			node = rb_next(&entry->offset_index);
 			if (!node)
 				break;
@@ -1226,7 +1224,7 @@
 	 */
 	while (entry->bitmap || found_bitmap ||
 	       (!entry->bitmap && entry->bytes < min_bytes)) {
-		struct rb_node *node = rb_next(&entry->offset_index);
+		node = rb_next(&entry->offset_index);
 
 		if (entry->bitmap && entry->bytes > bytes + empty_size) {
 			ret = btrfs_bitmap_cluster(block_group, entry, cluster,
diff -uriN linux-2.6.32.43/fs/btrfs/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/inode.c
--- linux-2.6.32.43/fs/btrfs/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -36,6 +36,8 @@
 #include <linux/xattr.h>
 #include <linux/posix_acl.h>
 #include <linux/falloc.h>
+#include <linux/vs_tag.h>
+
 #include "compat.h"
 #include "ctree.h"
 #include "disk-io.h"
@@ -63,7 +65,7 @@
 static const struct address_space_operations btrfs_aops;
 static const struct address_space_operations btrfs_symlink_aops;
 static const struct file_operations btrfs_dir_file_operations;
-static struct extent_io_ops btrfs_extent_io_ops;
+static const struct extent_io_ops btrfs_extent_io_ops;
 
 static struct kmem_cache *btrfs_inode_cachep;
 struct kmem_cache *btrfs_trans_handle_cachep;
@@ -925,6 +927,7 @@
 			 1, 0, NULL, GFP_NOFS);
 	while (start < end) {
 		async_cow = kmalloc(sizeof(*async_cow), GFP_NOFS);
+		BUG_ON(!async_cow);
 		async_cow->inode = inode;
 		async_cow->root = root;
 		async_cow->locked_page = locked_page;
@@ -2263,6 +2266,8 @@
 	int maybe_acls;
 	u64 alloc_group_block;
 	u32 rdev;
+	uid_t uid;
+	gid_t gid;
 	int ret;
 
 	path = btrfs_alloc_path();
@@ -2279,8 +2284,13 @@
 
 	inode->i_mode = btrfs_inode_mode(leaf, inode_item);
 	inode->i_nlink = btrfs_inode_nlink(leaf, inode_item);
-	inode->i_uid = btrfs_inode_uid(leaf, inode_item);
-	inode->i_gid = btrfs_inode_gid(leaf, inode_item);
+
+	uid = btrfs_inode_uid(leaf, inode_item);
+	gid = btrfs_inode_gid(leaf, inode_item);
+	inode->i_uid = INOTAG_UID(DX_TAG(inode), uid, gid);
+	inode->i_gid = INOTAG_GID(DX_TAG(inode), uid, gid);
+	inode->i_tag = INOTAG_TAG(DX_TAG(inode), uid, gid,
+		btrfs_inode_tag(leaf, inode_item));
 	btrfs_i_size_write(inode, btrfs_inode_size(leaf, inode_item));
 
 	tspec = btrfs_inode_atime(inode_item);
@@ -2362,8 +2372,15 @@
 			    struct btrfs_inode_item *item,
 			    struct inode *inode)
 {
-	btrfs_set_inode_uid(leaf, item, inode->i_uid);
-	btrfs_set_inode_gid(leaf, item, inode->i_gid);
+	uid_t uid = TAGINO_UID(DX_TAG(inode), inode->i_uid, inode->i_tag);
+	gid_t gid = TAGINO_GID(DX_TAG(inode), inode->i_gid, inode->i_tag);
+
+	btrfs_set_inode_uid(leaf, item, uid);
+	btrfs_set_inode_gid(leaf, item, gid);
+#ifdef CONFIG_TAGGING_INTERN
+	btrfs_set_inode_tag(leaf, item, inode->i_tag);
+#endif
+
 	btrfs_set_inode_size(leaf, item, BTRFS_I(inode)->disk_i_size);
 	btrfs_set_inode_mode(leaf, item, inode->i_mode);
 	btrfs_set_inode_nlink(leaf, item, inode->i_nlink);
@@ -4153,6 +4170,7 @@
 	} else
 		inode->i_gid = current_fsgid();
 
+	inode->i_tag = dx_current_fstag(root->fs_info->sb);
 	inode->i_mode = mode;
 	inode->i_ino = objectid;
 	inode_set_bytes(inode, 0);
@@ -4591,6 +4609,8 @@
 	inline_size = btrfs_file_extent_inline_item_len(leaf,
 					btrfs_item_nr(leaf, path->slots[0]));
 	tmp = kmalloc(inline_size, GFP_NOFS);
+	if (!tmp)
+		return -ENOMEM;
 	ptr = btrfs_file_extent_inline_start(item);
 
 	read_extent_buffer(leaf, tmp, ptr, inline_size);
@@ -5410,7 +5430,7 @@
 	return -ENOMEM;
 }
 
-static int btrfs_getattr(struct vfsmount *mnt,
+int btrfs_getattr(struct vfsmount *mnt,
 			 struct dentry *dentry, struct kstat *stat)
 {
 	struct inode *inode = dentry->d_inode;
@@ -5422,6 +5442,14 @@
 	return 0;
 }
 
+EXPORT_SYMBOL(btrfs_getattr);
+
+dev_t get_btrfs_dev_from_inode(struct inode *inode)
+{
+	return BTRFS_I(inode)->root->anon_super.s_dev;
+}
+EXPORT_SYMBOL(get_btrfs_dev_from_inode);
+
 static int btrfs_rename(struct inode *old_dir, struct dentry *old_dentry,
 			   struct inode *new_dir, struct dentry *new_dentry)
 {
@@ -5954,6 +5982,7 @@
 	.listxattr	= btrfs_listxattr,
 	.removexattr	= btrfs_removexattr,
 	.permission	= btrfs_permission,
+	.sync_flags	= btrfs_sync_flags,
 };
 static const struct inode_operations btrfs_dir_ro_inode_operations = {
 	.lookup		= btrfs_lookup,
@@ -5972,7 +6001,7 @@
 	.fsync		= btrfs_sync_file,
 };
 
-static struct extent_io_ops btrfs_extent_io_ops = {
+static const struct extent_io_ops btrfs_extent_io_ops = {
 	.fill_delalloc = run_delalloc_range,
 	.submit_bio_hook = btrfs_submit_bio_hook,
 	.merge_bio_hook = btrfs_merge_bio_hook,
@@ -6029,6 +6058,7 @@
 	.permission	= btrfs_permission,
 	.fallocate	= btrfs_fallocate,
 	.fiemap		= btrfs_fiemap,
+	.sync_flags	= btrfs_sync_flags,
 };
 static const struct inode_operations btrfs_special_inode_operations = {
 	.getattr	= btrfs_getattr,
diff -uriN linux-2.6.32.43/fs/btrfs/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/ioctl.c
--- linux-2.6.32.43/fs/btrfs/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/ioctl.c	2011-07-15 05:50:11.000000000 -0500
@@ -67,10 +67,13 @@
 {
 	unsigned int iflags = 0;
 
-	if (flags & BTRFS_INODE_SYNC)
-		iflags |= FS_SYNC_FL;
 	if (flags & BTRFS_INODE_IMMUTABLE)
 		iflags |= FS_IMMUTABLE_FL;
+	if (flags & BTRFS_INODE_IXUNLINK)
+		iflags |= FS_IXUNLINK_FL;
+
+	if (flags & BTRFS_INODE_SYNC)
+		iflags |= FS_SYNC_FL;
 	if (flags & BTRFS_INODE_APPEND)
 		iflags |= FS_APPEND_FL;
 	if (flags & BTRFS_INODE_NODUMP)
@@ -80,28 +83,78 @@
 	if (flags & BTRFS_INODE_DIRSYNC)
 		iflags |= FS_DIRSYNC_FL;
 
+	if (flags & BTRFS_INODE_BARRIER)
+		iflags |= FS_BARRIER_FL;
+	if (flags & BTRFS_INODE_COW)
+		iflags |= FS_COW_FL;
 	return iflags;
 }
 
 /*
- * Update inode->i_flags based on the btrfs internal flags.
+ * Update inode->i_(v)flags based on the btrfs internal flags.
  */
 void btrfs_update_iflags(struct inode *inode)
 {
 	struct btrfs_inode *ip = BTRFS_I(inode);
 
-	inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
+	inode->i_flags &= ~(S_IMMUTABLE | S_IXUNLINK |
+		S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
 
-	if (ip->flags & BTRFS_INODE_SYNC)
-		inode->i_flags |= S_SYNC;
 	if (ip->flags & BTRFS_INODE_IMMUTABLE)
 		inode->i_flags |= S_IMMUTABLE;
+	if (ip->flags & BTRFS_INODE_IXUNLINK)
+		inode->i_flags |= S_IXUNLINK;
+
+	if (ip->flags & BTRFS_INODE_SYNC)
+		inode->i_flags |= S_SYNC;
 	if (ip->flags & BTRFS_INODE_APPEND)
 		inode->i_flags |= S_APPEND;
 	if (ip->flags & BTRFS_INODE_NOATIME)
 		inode->i_flags |= S_NOATIME;
 	if (ip->flags & BTRFS_INODE_DIRSYNC)
 		inode->i_flags |= S_DIRSYNC;
+
+	inode->i_vflags &= ~(V_BARRIER | V_COW);
+
+	if (ip->flags & BTRFS_INODE_BARRIER)
+		inode->i_vflags |= V_BARRIER;
+	if (ip->flags & BTRFS_INODE_COW)
+		inode->i_vflags |= V_COW;
+}
+
+/*
+ * Update btrfs internal flags from inode->i_(v)flags.
+ */
+void btrfs_update_flags(struct inode *inode)
+{
+	struct btrfs_inode *ip = BTRFS_I(inode);
+
+	unsigned int flags = inode->i_flags;
+	unsigned int vflags = inode->i_vflags;
+
+	ip->flags &= ~(BTRFS_INODE_SYNC | BTRFS_INODE_APPEND |
+			BTRFS_INODE_IMMUTABLE | BTRFS_INODE_IXUNLINK |
+			BTRFS_INODE_NOATIME | BTRFS_INODE_DIRSYNC |
+			BTRFS_INODE_BARRIER | BTRFS_INODE_COW);
+
+	if (flags & S_IMMUTABLE)
+		ip->flags |= BTRFS_INODE_IMMUTABLE;
+	if (flags & S_IXUNLINK)
+		ip->flags |= BTRFS_INODE_IXUNLINK;
+
+	if (flags & S_SYNC)
+		ip->flags |= BTRFS_INODE_SYNC;
+	if (flags & S_APPEND)
+		ip->flags |= BTRFS_INODE_APPEND;
+	if (flags & S_NOATIME)
+		ip->flags |= BTRFS_INODE_NOATIME;
+	if (flags & S_DIRSYNC)
+		ip->flags |= BTRFS_INODE_DIRSYNC;
+
+	if (vflags & V_BARRIER)
+		ip->flags |= BTRFS_INODE_BARRIER;
+	if (vflags & V_COW)
+		ip->flags |= BTRFS_INODE_COW;
 }
 
 /*
@@ -119,7 +172,7 @@
 	flags = BTRFS_I(dir)->flags;
 
 	if (S_ISREG(inode->i_mode))
-		flags &= ~BTRFS_INODE_DIRSYNC;
+		flags &= ~(BTRFS_INODE_DIRSYNC | BTRFS_INODE_BARRIER);
 	else if (!S_ISDIR(inode->i_mode))
 		flags &= (BTRFS_INODE_NODUMP | BTRFS_INODE_NOATIME);
 
@@ -127,6 +180,30 @@
 	btrfs_update_iflags(inode);
 }
 
+int btrfs_sync_flags(struct inode *inode, int flags, int vflags)
+{
+	struct btrfs_inode *ip = BTRFS_I(inode);
+	struct btrfs_root *root = ip->root;
+	struct btrfs_trans_handle *trans;
+	int ret;
+
+	trans = btrfs_join_transaction(root, 1);
+	BUG_ON(!trans);
+
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+	btrfs_update_flags(inode);
+
+	ret = btrfs_update_inode(trans, root, inode);
+	BUG_ON(ret);
+
+	btrfs_update_iflags(inode);
+	inode->i_ctime = CURRENT_TIME;
+	btrfs_end_transaction(trans, root);
+
+	return 0;
+}
+
 static int btrfs_ioctl_getflags(struct file *file, void __user *arg)
 {
 	struct btrfs_inode *ip = BTRFS_I(file->f_path.dentry->d_inode);
@@ -149,6 +226,7 @@
 	if (copy_from_user(&flags, arg, sizeof(flags)))
 		return -EFAULT;
 
+	/* maybe add FS_IXUNLINK_FL ? */
 	if (flags & ~(FS_IMMUTABLE_FL | FS_APPEND_FL | \
 		      FS_NOATIME_FL | FS_NODUMP_FL | \
 		      FS_SYNC_FL | FS_DIRSYNC_FL))
@@ -161,7 +239,8 @@
 
 	flags = btrfs_mask_flags(inode->i_mode, flags);
 	oldflags = btrfs_flags_to_ioctl(ip->flags);
-	if ((flags ^ oldflags) & (FS_APPEND_FL | FS_IMMUTABLE_FL)) {
+	if ((flags ^ oldflags) & (FS_APPEND_FL |
+		FS_IMMUTABLE_FL | FS_IXUNLINK_FL)) {
 		if (!capable(CAP_LINUX_IMMUTABLE)) {
 			ret = -EPERM;
 			goto out_unlock;
@@ -172,14 +251,19 @@
 	if (ret)
 		goto out_unlock;
 
-	if (flags & FS_SYNC_FL)
-		ip->flags |= BTRFS_INODE_SYNC;
-	else
-		ip->flags &= ~BTRFS_INODE_SYNC;
 	if (flags & FS_IMMUTABLE_FL)
 		ip->flags |= BTRFS_INODE_IMMUTABLE;
 	else
 		ip->flags &= ~BTRFS_INODE_IMMUTABLE;
+	if (flags & FS_IXUNLINK_FL)
+		ip->flags |= BTRFS_INODE_IXUNLINK;
+	else
+		ip->flags &= ~BTRFS_INODE_IXUNLINK;
+
+	if (flags & FS_SYNC_FL)
+		ip->flags |= BTRFS_INODE_SYNC;
+	else
+		ip->flags &= ~BTRFS_INODE_SYNC;
 	if (flags & FS_APPEND_FL)
 		ip->flags |= BTRFS_INODE_APPEND;
 	else
diff -uriN linux-2.6.32.43/fs/btrfs/relocation.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/relocation.c
--- linux-2.6.32.43/fs/btrfs/relocation.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/relocation.c	2011-07-15 05:51:18.000000000 -0500
@@ -884,7 +884,7 @@
 	}
 	spin_unlock(&rc->reloc_root_tree.lock);
 
-	BUG_ON((struct btrfs_root *)node->data != root);
+	BUG_ON(!node || (struct btrfs_root *)node->data != root);
 
 	if (!del) {
 		spin_lock(&rc->reloc_root_tree.lock);
diff -uriN linux-2.6.32.43/fs/btrfs/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/super.c
--- linux-2.6.32.43/fs/btrfs/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/super.c	2011-07-15 05:50:11.000000000 -0500
@@ -67,7 +67,7 @@
 	Opt_max_extent, Opt_max_inline, Opt_alloc_start, Opt_nobarrier,
 	Opt_ssd, Opt_nossd, Opt_ssd_spread, Opt_thread_pool, Opt_noacl,
 	Opt_compress, Opt_notreelog, Opt_ratio, Opt_flushoncommit,
-	Opt_discard, Opt_err,
+	Opt_tag, Opt_notag, Opt_tagid, Opt_discard, Opt_err,
 };
 
 static match_table_t tokens = {
@@ -90,6 +90,9 @@
 	{Opt_flushoncommit, "flushoncommit"},
 	{Opt_ratio, "metadata_ratio=%d"},
 	{Opt_discard, "discard"},
+	{Opt_tag, "tag"},
+	{Opt_notag, "notag"},
+	{Opt_tagid, "tagid=%u"},
 	{Opt_err, NULL},
 };
 
@@ -264,6 +267,22 @@
 		case Opt_discard:
 			btrfs_set_opt(info->mount_opt, DISCARD);
 			break;
+#ifndef CONFIG_TAGGING_NONE
+		case Opt_tag:
+			printk(KERN_INFO "btrfs: use tagging\n");
+			btrfs_set_opt(info->mount_opt, TAGGED);
+			break;
+		case Opt_notag:
+			printk(KERN_INFO "btrfs: disabled tagging\n");
+			btrfs_clear_opt(info->mount_opt, TAGGED);
+			break;
+#endif
+#ifdef CONFIG_PROPAGATE
+		case Opt_tagid:
+			/* use args[0] */
+			btrfs_set_opt(info->mount_opt, TAGGED);
+			break;
+#endif
 		case Opt_err:
 			printk(KERN_INFO "btrfs: unrecognized mount option "
 			       "'%s'\n", p);
@@ -585,6 +604,12 @@
 	if (ret)
 		return -EINVAL;
 
+	if (btrfs_test_opt(root, TAGGED) && !(sb->s_flags & MS_TAGGED)) {
+		printk("btrfs: %s: tagging not permitted on remount.\n",
+			sb->s_id);
+		return -EINVAL;
+	}
+
 	if ((*flags & MS_RDONLY) == (sb->s_flags & MS_RDONLY))
 		return 0;
 
diff -uriN linux-2.6.32.43/fs/btrfs/sysfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/sysfs.c
--- linux-2.6.32.43/fs/btrfs/sysfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/btrfs/sysfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -164,12 +164,12 @@
 	complete(&root->kobj_unregister);
 }
 
-static struct sysfs_ops btrfs_super_attr_ops = {
+static const struct sysfs_ops btrfs_super_attr_ops = {
 	.show	= btrfs_super_attr_show,
 	.store	= btrfs_super_attr_store,
 };
 
-static struct sysfs_ops btrfs_root_attr_ops = {
+static const struct sysfs_ops btrfs_root_attr_ops = {
 	.show	= btrfs_root_attr_show,
 	.store	= btrfs_root_attr_store,
 };
diff -uriN linux-2.6.32.43/fs/buffer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/buffer.c
--- linux-2.6.32.43/fs/buffer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/buffer.c	2011-07-15 05:51:18.000000000 -0500
@@ -25,6 +25,7 @@
 #include <linux/percpu.h>
 #include <linux/slab.h>
 #include <linux/capability.h>
+#include <linux/security.h>
 #include <linux/blkdev.h>
 #include <linux/file.h>
 #include <linux/quotaops.h>
diff -uriN linux-2.6.32.43/fs/cachefiles/bind.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/bind.c
--- linux-2.6.32.43/fs/cachefiles/bind.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/bind.c	2011-07-15 05:51:18.000000000 -0500
@@ -39,13 +39,11 @@
 	       args);
 
 	/* start by checking things over */
-	ASSERT(cache->fstop_percent >= 0 &&
-	       cache->fstop_percent < cache->fcull_percent &&
+	ASSERT(cache->fstop_percent < cache->fcull_percent &&
 	       cache->fcull_percent < cache->frun_percent &&
 	       cache->frun_percent  < 100);
 
-	ASSERT(cache->bstop_percent >= 0 &&
-	       cache->bstop_percent < cache->bcull_percent &&
+	ASSERT(cache->bstop_percent < cache->bcull_percent &&
 	       cache->bcull_percent < cache->brun_percent &&
 	       cache->brun_percent  < 100);
 
diff -uriN linux-2.6.32.43/fs/cachefiles/daemon.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/daemon.c
--- linux-2.6.32.43/fs/cachefiles/daemon.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/daemon.c	2011-07-15 05:51:18.000000000 -0500
@@ -220,7 +220,7 @@
 	if (test_bit(CACHEFILES_DEAD, &cache->flags))
 		return -EIO;
 
-	if (datalen < 0 || datalen > PAGE_SIZE - 1)
+	if (datalen > PAGE_SIZE - 1)
 		return -EOPNOTSUPP;
 
 	/* drag the command string into the kernel so we can parse it */
@@ -385,7 +385,7 @@
 	if (args[0] != '%' || args[1] != '\0')
 		return -EINVAL;
 
-	if (fstop < 0 || fstop >= cache->fcull_percent)
+	if (fstop >= cache->fcull_percent)
 		return cachefiles_daemon_range_error(cache, args);
 
 	cache->fstop_percent = fstop;
@@ -457,7 +457,7 @@
 	if (args[0] != '%' || args[1] != '\0')
 		return -EINVAL;
 
-	if (bstop < 0 || bstop >= cache->bcull_percent)
+	if (bstop >= cache->bcull_percent)
 		return cachefiles_daemon_range_error(cache, args);
 
 	cache->bstop_percent = bstop;
diff -uriN linux-2.6.32.43/fs/cachefiles/internal.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/internal.h
--- linux-2.6.32.43/fs/cachefiles/internal.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/internal.h	2011-07-15 05:51:18.000000000 -0500
@@ -56,7 +56,7 @@
 	wait_queue_head_t		daemon_pollwq;	/* poll waitqueue for daemon */
 	struct rb_root			active_nodes;	/* active nodes (can't be culled) */
 	rwlock_t			active_lock;	/* lock for active_nodes */
-	atomic_t			gravecounter;	/* graveyard uniquifier */
+	atomic_unchecked_t		gravecounter;	/* graveyard uniquifier */
 	unsigned			frun_percent;	/* when to stop culling (% files) */
 	unsigned			fcull_percent;	/* when to start culling (% files) */
 	unsigned			fstop_percent;	/* when to stop allocating (% files) */
@@ -168,19 +168,19 @@
  * proc.c
  */
 #ifdef CONFIG_CACHEFILES_HISTOGRAM
-extern atomic_t cachefiles_lookup_histogram[HZ];
-extern atomic_t cachefiles_mkdir_histogram[HZ];
-extern atomic_t cachefiles_create_histogram[HZ];
+extern atomic_unchecked_t cachefiles_lookup_histogram[HZ];
+extern atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
+extern atomic_unchecked_t cachefiles_create_histogram[HZ];
 
 extern int __init cachefiles_proc_init(void);
 extern void cachefiles_proc_cleanup(void);
 static inline
-void cachefiles_hist(atomic_t histogram[], unsigned long start_jif)
+void cachefiles_hist(atomic_unchecked_t histogram[], unsigned long start_jif)
 {
 	unsigned long jif = jiffies - start_jif;
 	if (jif >= HZ)
 		jif = HZ - 1;
-	atomic_inc(&histogram[jif]);
+	atomic_inc_unchecked(&histogram[jif]);
 }
 
 #else
diff -uriN linux-2.6.32.43/fs/cachefiles/namei.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/namei.c
--- linux-2.6.32.43/fs/cachefiles/namei.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/namei.c	2011-07-15 05:51:18.000000000 -0500
@@ -250,7 +250,7 @@
 	/* first step is to make up a grave dentry in the graveyard */
 	sprintf(nbuffer, "%08x%08x",
 		(uint32_t) get_seconds(),
-		(uint32_t) atomic_inc_return(&cache->gravecounter));
+		(uint32_t) atomic_inc_return_unchecked(&cache->gravecounter));
 
 	/* do the multiway lock magic */
 	trap = lock_rename(cache->graveyard, dir);
diff -uriN linux-2.6.32.43/fs/cachefiles/proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/proc.c
--- linux-2.6.32.43/fs/cachefiles/proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/proc.c	2011-07-15 05:51:18.000000000 -0500
@@ -14,9 +14,9 @@
 #include <linux/seq_file.h>
 #include "internal.h"
 
-atomic_t cachefiles_lookup_histogram[HZ];
-atomic_t cachefiles_mkdir_histogram[HZ];
-atomic_t cachefiles_create_histogram[HZ];
+atomic_unchecked_t cachefiles_lookup_histogram[HZ];
+atomic_unchecked_t cachefiles_mkdir_histogram[HZ];
+atomic_unchecked_t cachefiles_create_histogram[HZ];
 
 /*
  * display the latency histogram
@@ -35,9 +35,9 @@
 		return 0;
 	default:
 		index = (unsigned long) v - 3;
-		x = atomic_read(&cachefiles_lookup_histogram[index]);
-		y = atomic_read(&cachefiles_mkdir_histogram[index]);
-		z = atomic_read(&cachefiles_create_histogram[index]);
+		x = atomic_read_unchecked(&cachefiles_lookup_histogram[index]);
+		y = atomic_read_unchecked(&cachefiles_mkdir_histogram[index]);
+		z = atomic_read_unchecked(&cachefiles_create_histogram[index]);
 		if (x == 0 && y == 0 && z == 0)
 			return 0;
 
diff -uriN linux-2.6.32.43/fs/cachefiles/rdwr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/rdwr.c
--- linux-2.6.32.43/fs/cachefiles/rdwr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cachefiles/rdwr.c	2011-07-15 05:51:18.000000000 -0500
@@ -946,7 +946,7 @@
 			old_fs = get_fs();
 			set_fs(KERNEL_DS);
 			ret = file->f_op->write(
-				file, (const void __user *) data, len, &pos);
+				file, (__force const void __user *) data, len, &pos);
 			set_fs(old_fs);
 			kunmap(page);
 			if (ret != len)
diff -uriN linux-2.6.32.43/fs/char_dev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/char_dev.c
--- linux-2.6.32.43/fs/char_dev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/char_dev.c	2011-07-15 05:50:11.000000000 -0500
@@ -20,6 +20,8 @@
 #include <linux/cdev.h>
 #include <linux/mutex.h>
 #include <linux/backing-dev.h>
+#include <linux/vs_context.h>
+#include <linux/vs_device.h>
 
 #include "internal.h"
 
@@ -370,14 +372,21 @@
 	struct cdev *p;
 	struct cdev *new = NULL;
 	int ret = 0;
+	dev_t mdev;
+
+	if (!vs_map_chrdev(inode->i_rdev, &mdev, DATTR_OPEN))
+		return -EPERM;
+	inode->i_mdev = mdev;
 
 	spin_lock(&cdev_lock);
 	p = inode->i_cdev;
 	if (!p) {
 		struct kobject *kobj;
 		int idx;
+
 		spin_unlock(&cdev_lock);
-		kobj = kobj_lookup(cdev_map, inode->i_rdev, &idx);
+
+		kobj = kobj_lookup(cdev_map, mdev, &idx);
 		if (!kobj)
 			return -ENXIO;
 		new = container_of(kobj, struct cdev, kobj);
diff -uriN linux-2.6.32.43/fs/cifs/cifs_debug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cifs/cifs_debug.c
--- linux-2.6.32.43/fs/cifs/cifs_debug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cifs/cifs_debug.c	2011-07-15 05:51:18.000000000 -0500
@@ -256,25 +256,25 @@
 					tcon = list_entry(tmp3,
 							  struct cifsTconInfo,
 							  tcon_list);
-					atomic_set(&tcon->num_smbs_sent, 0);
-					atomic_set(&tcon->num_writes, 0);
-					atomic_set(&tcon->num_reads, 0);
-					atomic_set(&tcon->num_oplock_brks, 0);
-					atomic_set(&tcon->num_opens, 0);
-					atomic_set(&tcon->num_posixopens, 0);
-					atomic_set(&tcon->num_posixmkdirs, 0);
-					atomic_set(&tcon->num_closes, 0);
-					atomic_set(&tcon->num_deletes, 0);
-					atomic_set(&tcon->num_mkdirs, 0);
-					atomic_set(&tcon->num_rmdirs, 0);
-					atomic_set(&tcon->num_renames, 0);
-					atomic_set(&tcon->num_t2renames, 0);
-					atomic_set(&tcon->num_ffirst, 0);
-					atomic_set(&tcon->num_fnext, 0);
-					atomic_set(&tcon->num_fclose, 0);
-					atomic_set(&tcon->num_hardlinks, 0);
-					atomic_set(&tcon->num_symlinks, 0);
-					atomic_set(&tcon->num_locks, 0);
+					atomic_set_unchecked(&tcon->num_smbs_sent, 0);
+					atomic_set_unchecked(&tcon->num_writes, 0);
+					atomic_set_unchecked(&tcon->num_reads, 0);
+					atomic_set_unchecked(&tcon->num_oplock_brks, 0);
+					atomic_set_unchecked(&tcon->num_opens, 0);
+					atomic_set_unchecked(&tcon->num_posixopens, 0);
+					atomic_set_unchecked(&tcon->num_posixmkdirs, 0);
+					atomic_set_unchecked(&tcon->num_closes, 0);
+					atomic_set_unchecked(&tcon->num_deletes, 0);
+					atomic_set_unchecked(&tcon->num_mkdirs, 0);
+					atomic_set_unchecked(&tcon->num_rmdirs, 0);
+					atomic_set_unchecked(&tcon->num_renames, 0);
+					atomic_set_unchecked(&tcon->num_t2renames, 0);
+					atomic_set_unchecked(&tcon->num_ffirst, 0);
+					atomic_set_unchecked(&tcon->num_fnext, 0);
+					atomic_set_unchecked(&tcon->num_fclose, 0);
+					atomic_set_unchecked(&tcon->num_hardlinks, 0);
+					atomic_set_unchecked(&tcon->num_symlinks, 0);
+					atomic_set_unchecked(&tcon->num_locks, 0);
 				}
 			}
 		}
@@ -334,41 +334,41 @@
 				if (tcon->need_reconnect)
 					seq_puts(m, "\tDISCONNECTED ");
 				seq_printf(m, "\nSMBs: %d Oplock Breaks: %d",
-					atomic_read(&tcon->num_smbs_sent),
-					atomic_read(&tcon->num_oplock_brks));
+					atomic_read_unchecked(&tcon->num_smbs_sent),
+					atomic_read_unchecked(&tcon->num_oplock_brks));
 				seq_printf(m, "\nReads:  %d Bytes: %lld",
-					atomic_read(&tcon->num_reads),
+					atomic_read_unchecked(&tcon->num_reads),
 					(long long)(tcon->bytes_read));
 				seq_printf(m, "\nWrites: %d Bytes: %lld",
-					atomic_read(&tcon->num_writes),
+					atomic_read_unchecked(&tcon->num_writes),
 					(long long)(tcon->bytes_written));
 				seq_printf(m, "\nFlushes: %d",
-					atomic_read(&tcon->num_flushes));
+					atomic_read_unchecked(&tcon->num_flushes));
 				seq_printf(m, "\nLocks: %d HardLinks: %d "
 					      "Symlinks: %d",
-					atomic_read(&tcon->num_locks),
-					atomic_read(&tcon->num_hardlinks),
-					atomic_read(&tcon->num_symlinks));
+					atomic_read_unchecked(&tcon->num_locks),
+					atomic_read_unchecked(&tcon->num_hardlinks),
+					atomic_read_unchecked(&tcon->num_symlinks));
 				seq_printf(m, "\nOpens: %d Closes: %d "
 					      "Deletes: %d",
-					atomic_read(&tcon->num_opens),
-					atomic_read(&tcon->num_closes),
-					atomic_read(&tcon->num_deletes));
+					atomic_read_unchecked(&tcon->num_opens),
+					atomic_read_unchecked(&tcon->num_closes),
+					atomic_read_unchecked(&tcon->num_deletes));
 				seq_printf(m, "\nPosix Opens: %d "
 					      "Posix Mkdirs: %d",
-					atomic_read(&tcon->num_posixopens),
-					atomic_read(&tcon->num_posixmkdirs));
+					atomic_read_unchecked(&tcon->num_posixopens),
+					atomic_read_unchecked(&tcon->num_posixmkdirs));
 				seq_printf(m, "\nMkdirs: %d Rmdirs: %d",
-					atomic_read(&tcon->num_mkdirs),
-					atomic_read(&tcon->num_rmdirs));
+					atomic_read_unchecked(&tcon->num_mkdirs),
+					atomic_read_unchecked(&tcon->num_rmdirs));
 				seq_printf(m, "\nRenames: %d T2 Renames %d",
-					atomic_read(&tcon->num_renames),
-					atomic_read(&tcon->num_t2renames));
+					atomic_read_unchecked(&tcon->num_renames),
+					atomic_read_unchecked(&tcon->num_t2renames));
 				seq_printf(m, "\nFindFirst: %d FNext %d "
 					      "FClose %d",
-					atomic_read(&tcon->num_ffirst),
-					atomic_read(&tcon->num_fnext),
-					atomic_read(&tcon->num_fclose));
+					atomic_read_unchecked(&tcon->num_ffirst),
+					atomic_read_unchecked(&tcon->num_fnext),
+					atomic_read_unchecked(&tcon->num_fclose));
 			}
 		}
 	}
diff -uriN linux-2.6.32.43/fs/cifs/cifsglob.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cifs/cifsglob.h
--- linux-2.6.32.43/fs/cifs/cifsglob.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cifs/cifsglob.h	2011-07-15 05:51:18.000000000 -0500
@@ -252,28 +252,28 @@
 	__u16 Flags;		/* optional support bits */
 	enum statusEnum tidStatus;
 #ifdef CONFIG_CIFS_STATS
-	atomic_t num_smbs_sent;
-	atomic_t num_writes;
-	atomic_t num_reads;
-	atomic_t num_flushes;
-	atomic_t num_oplock_brks;
-	atomic_t num_opens;
-	atomic_t num_closes;
-	atomic_t num_deletes;
-	atomic_t num_mkdirs;
-	atomic_t num_posixopens;
-	atomic_t num_posixmkdirs;
-	atomic_t num_rmdirs;
-	atomic_t num_renames;
-	atomic_t num_t2renames;
-	atomic_t num_ffirst;
-	atomic_t num_fnext;
-	atomic_t num_fclose;
-	atomic_t num_hardlinks;
-	atomic_t num_symlinks;
-	atomic_t num_locks;
-	atomic_t num_acl_get;
-	atomic_t num_acl_set;
+	atomic_unchecked_t num_smbs_sent;
+	atomic_unchecked_t num_writes;
+	atomic_unchecked_t num_reads;
+	atomic_unchecked_t num_flushes;
+	atomic_unchecked_t num_oplock_brks;
+	atomic_unchecked_t num_opens;
+	atomic_unchecked_t num_closes;
+	atomic_unchecked_t num_deletes;
+	atomic_unchecked_t num_mkdirs;
+	atomic_unchecked_t num_posixopens;
+	atomic_unchecked_t num_posixmkdirs;
+	atomic_unchecked_t num_rmdirs;
+	atomic_unchecked_t num_renames;
+	atomic_unchecked_t num_t2renames;
+	atomic_unchecked_t num_ffirst;
+	atomic_unchecked_t num_fnext;
+	atomic_unchecked_t num_fclose;
+	atomic_unchecked_t num_hardlinks;
+	atomic_unchecked_t num_symlinks;
+	atomic_unchecked_t num_locks;
+	atomic_unchecked_t num_acl_get;
+	atomic_unchecked_t num_acl_set;
 #ifdef CONFIG_CIFS_STATS2
 	unsigned long long time_writes;
 	unsigned long long time_reads;
@@ -414,7 +414,7 @@
 }
 
 #ifdef CONFIG_CIFS_STATS
-#define cifs_stats_inc atomic_inc
+#define cifs_stats_inc atomic_inc_unchecked
 
 static inline void cifs_stats_bytes_written(struct cifsTconInfo *tcon,
 					    unsigned int bytes)
diff -uriN linux-2.6.32.43/fs/cifs/link.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cifs/link.c
--- linux-2.6.32.43/fs/cifs/link.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/cifs/link.c	2011-07-15 05:51:18.000000000 -0500
@@ -215,7 +215,7 @@
 
 void cifs_put_link(struct dentry *direntry, struct nameidata *nd, void *cookie)
 {
-	char *p = nd_get_link(nd);
+	const char *p = nd_get_link(nd);
 	if (!IS_ERR(p))
 		kfree(p);
 }
diff -uriN linux-2.6.32.43/fs/coda/cache.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/coda/cache.c
--- linux-2.6.32.43/fs/coda/cache.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/coda/cache.c	2011-07-15 05:51:18.000000000 -0500
@@ -24,14 +24,14 @@
 #include <linux/coda_fs_i.h>
 #include <linux/coda_cache.h>
 
-static atomic_t permission_epoch = ATOMIC_INIT(0);
+static atomic_unchecked_t permission_epoch = ATOMIC_INIT(0);
 
 /* replace or extend an acl cache hit */
 void coda_cache_enter(struct inode *inode, int mask)
 {
 	struct coda_inode_info *cii = ITOC(inode);
 
-	cii->c_cached_epoch = atomic_read(&permission_epoch);
+	cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch);
 	if (cii->c_uid != current_fsuid()) {
 		cii->c_uid = current_fsuid();
                 cii->c_cached_perm = mask;
@@ -43,13 +43,13 @@
 void coda_cache_clear_inode(struct inode *inode)
 {
 	struct coda_inode_info *cii = ITOC(inode);
-	cii->c_cached_epoch = atomic_read(&permission_epoch) - 1;
+	cii->c_cached_epoch = atomic_read_unchecked(&permission_epoch) - 1;
 }
 
 /* remove all acl caches */
 void coda_cache_clear_all(struct super_block *sb)
 {
-	atomic_inc(&permission_epoch);
+	atomic_inc_unchecked(&permission_epoch);
 }
 
 
@@ -61,7 +61,7 @@
 	
         hit = (mask & cii->c_cached_perm) == mask &&
 		cii->c_uid == current_fsuid() &&
-		cii->c_cached_epoch == atomic_read(&permission_epoch);
+		cii->c_cached_epoch == atomic_read_unchecked(&permission_epoch);
 
         return hit;
 }
diff -uriN linux-2.6.32.43/fs/compat_binfmt_elf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/compat_binfmt_elf.c
--- linux-2.6.32.43/fs/compat_binfmt_elf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/compat_binfmt_elf.c	2011-07-15 05:51:18.000000000 -0500
@@ -29,10 +29,12 @@
 #undef	elfhdr
 #undef	elf_phdr
 #undef	elf_note
+#undef	elf_dyn
 #undef	elf_addr_t
 #define elfhdr		elf32_hdr
 #define elf_phdr	elf32_phdr
 #define elf_note	elf32_note
+#define elf_dyn		Elf32_Dyn
 #define elf_addr_t	Elf32_Addr
 
 /*
diff -uriN linux-2.6.32.43/fs/compat.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/compat.c
--- linux-2.6.32.43/fs/compat.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/compat.c	2011-07-15 05:51:18.000000000 -0500
@@ -830,6 +830,7 @@
 
 struct compat_readdir_callback {
 	struct compat_old_linux_dirent __user *dirent;
+	struct file * file;
 	int result;
 };
 
@@ -847,6 +848,10 @@
 		buf->result = -EOVERFLOW;
 		return -EOVERFLOW;
 	}
+
+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
+		return 0;
+
 	buf->result++;
 	dirent = buf->dirent;
 	if (!access_ok(VERIFY_WRITE, dirent,
@@ -879,6 +884,7 @@
 
 	buf.result = 0;
 	buf.dirent = dirent;
+	buf.file = file;
 
 	error = vfs_readdir(file, compat_fillonedir, &buf);
 	if (buf.result)
@@ -899,6 +905,7 @@
 struct compat_getdents_callback {
 	struct compat_linux_dirent __user *current_dir;
 	struct compat_linux_dirent __user *previous;
+	struct file * file;
 	int count;
 	int error;
 };
@@ -919,6 +926,10 @@
 		buf->error = -EOVERFLOW;
 		return -EOVERFLOW;
 	}
+
+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
+		return 0;
+
 	dirent = buf->previous;
 	if (dirent) {
 		if (__put_user(offset, &dirent->d_off))
@@ -966,6 +977,7 @@
 	buf.previous = NULL;
 	buf.count = count;
 	buf.error = 0;
+	buf.file = file;
 
 	error = vfs_readdir(file, compat_filldir, &buf);
 	if (error >= 0)
@@ -987,6 +999,7 @@
 struct compat_getdents_callback64 {
 	struct linux_dirent64 __user *current_dir;
 	struct linux_dirent64 __user *previous;
+	struct file * file;
 	int count;
 	int error;
 };
@@ -1003,6 +1016,10 @@
 	buf->error = -EINVAL;	/* only used if we fail.. */
 	if (reclen > buf->count)
 		return -EINVAL;
+
+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
+		return 0;
+
 	dirent = buf->previous;
 
 	if (dirent) {
@@ -1054,6 +1071,7 @@
 	buf.previous = NULL;
 	buf.count = count;
 	buf.error = 0;
+	buf.file = file;
 
 	error = vfs_readdir(file, compat_filldir64, &buf);
 	if (error >= 0)
@@ -1098,7 +1116,7 @@
 	 * verify all the pointers
 	 */
 	ret = -EINVAL;
-	if ((nr_segs > UIO_MAXIOV) || (nr_segs <= 0))
+	if (nr_segs > UIO_MAXIOV)
 		goto out;
 	if (!file->f_op)
 		goto out;
@@ -1463,6 +1481,11 @@
 	compat_uptr_t __user *envp,
 	struct pt_regs * regs)
 {
+#ifdef CONFIG_GRKERNSEC
+	struct file *old_exec_file;
+	struct acl_subject_label *old_acl;
+	struct rlimit old_rlim[RLIM_NLIMITS];
+#endif
 	struct linux_binprm *bprm;
 	struct file *file;
 	struct files_struct *displaced;
@@ -1499,6 +1522,19 @@
 	bprm->filename = filename;
 	bprm->interp = filename;
 
+	if (gr_process_user_ban()) {
+		retval = -EPERM;
+		goto out_file;
+	}
+
+	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
+	retval = -EAGAIN;
+	if (gr_handle_nproc())
+		goto out_file;
+	retval = -EACCES;
+	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt))
+		goto out_file;
+
 	retval = bprm_mm_init(bprm);
 	if (retval)
 		goto out_file;
@@ -1528,9 +1564,40 @@
 	if (retval < 0)
 		goto out;
 
+	if (!gr_tpe_allow(file)) {
+		retval = -EACCES;
+		goto out;
+	}
+
+	if (gr_check_crash_exec(file)) {
+		retval = -EACCES;
+		goto out;
+	}
+
+	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
+
+	gr_handle_exec_args_compat(bprm, argv);
+
+#ifdef CONFIG_GRKERNSEC
+	old_acl = current->acl;
+	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
+	old_exec_file = current->exec_file;
+	get_file(file);
+	current->exec_file = file;
+#endif
+
+	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
+				   bprm->unsafe & LSM_UNSAFE_SHARE);
+	if (retval < 0)
+		goto out_fail;
+
 	retval = search_binary_handler(bprm, regs);
 	if (retval < 0)
-		goto out;
+		goto out_fail;
+#ifdef CONFIG_GRKERNSEC
+	if (old_exec_file)
+		fput(old_exec_file);
+#endif
 
 	/* execve succeeded */
 	current->fs->in_exec = 0;
@@ -1541,6 +1608,14 @@
 		put_files_struct(displaced);
 	return retval;
 
+out_fail:
+#ifdef CONFIG_GRKERNSEC
+	current->acl = old_acl;
+	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
+	fput(current->exec_file);
+	current->exec_file = old_exec_file;
+#endif
+
 out:
 	if (bprm->mm) {
 		acct_arg_size(bprm, 0);
@@ -1711,6 +1786,8 @@
 	struct fdtable *fdt;
 	long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
 
+	pax_track_stack();
+
 	if (n < 0)
 		goto out_nofds;
 
diff -uriN linux-2.6.32.43/fs/compat_ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/compat_ioctl.c
--- linux-2.6.32.43/fs/compat_ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/compat_ioctl.c	2011-07-15 05:51:18.000000000 -0500
@@ -234,6 +234,8 @@
 	up = (struct compat_video_spu_palette __user *) arg;
 	err  = get_user(palp, &up->palette);
 	err |= get_user(length, &up->length);
+	if (err)
+		return -EFAULT;
 
 	up_native = compat_alloc_user_space(sizeof(struct video_spu_palette));
 	err  = put_user(compat_ptr(palp), &up_native->palette);
diff -uriN linux-2.6.32.43/fs/configfs/dir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/configfs/dir.c
--- linux-2.6.32.43/fs/configfs/dir.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/configfs/dir.c	2011-07-15 05:51:18.000000000 -0500
@@ -1572,7 +1572,8 @@
 			}
 			for (p=q->next; p!= &parent_sd->s_children; p=p->next) {
 				struct configfs_dirent *next;
-				const char * name;
+				const unsigned char * name;
+				char d_name[sizeof(next->s_dentry->d_iname)];
 				int len;
 
 				next = list_entry(p, struct configfs_dirent,
@@ -1581,7 +1582,12 @@
 					continue;
 
 				name = configfs_get_name(next);
-				len = strlen(name);
+				if (next->s_dentry && name == next->s_dentry->d_iname) {
+					len =  next->s_dentry->d_name.len;
+					memcpy(d_name, name, len);
+					name = d_name;
+				} else
+					len = strlen(name);
 				if (next->s_dentry)
 					ino = next->s_dentry->d_inode->i_ino;
 				else
diff -uriN linux-2.6.32.43/fs/dcache.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/dcache.c
--- linux-2.6.32.43/fs/dcache.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/dcache.c	2011-07-15 05:51:18.000000000 -0500
@@ -33,6 +33,7 @@
 #include <linux/bootmem.h>
 #include <linux/fs_struct.h>
 #include <linux/hardirq.h>
+#include <linux/vs_limit.h>
 #include "internal.h"
 
 int sysctl_vfs_cache_pressure __read_mostly = 100;
@@ -45,8 +46,6 @@
 
 static struct kmem_cache *dentry_cache __read_mostly;
 
-#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
-
 /*
  * This is the single most critical data structure when it comes
  * to the dcache: the hashtable for lookups. Somebody should try
@@ -230,6 +229,8 @@
 		return;
 	}
 
+	vx_dentry_dec(dentry);
+
 	/*
 	 * AV: ->d_delete() is _NOT_ allowed to block now.
 	 */
@@ -321,6 +322,7 @@
 {
 	atomic_inc(&dentry->d_count);
 	dentry_lru_del_init(dentry);
+	vx_dentry_inc(dentry);
 	return dentry;
 }
 
@@ -919,6 +921,9 @@
 	struct dentry *dentry;
 	char *dname;
 
+	if (!vx_dentry_avail(1))
+		return NULL;
+
 	dentry = kmem_cache_alloc(dentry_cache, GFP_KERNEL);
 	if (!dentry)
 		return NULL;
@@ -964,6 +969,7 @@
 	if (parent)
 		list_add(&dentry->d_u.d_child, &parent->d_subdirs);
 	dentry_stat.nr_dentry++;
+	vx_dentry_inc(dentry);
 	spin_unlock(&dcache_lock);
 
 	return dentry;
@@ -1410,6 +1416,7 @@
 		}
 
 		atomic_inc(&dentry->d_count);
+		vx_dentry_inc(dentry);
 		found = dentry;
 		spin_unlock(&dentry->d_lock);
 		break;
@@ -2319,7 +2326,7 @@
 	mempages -= reserve;
 
 	names_cachep = kmem_cache_create("names_cache", PATH_MAX, 0,
-			SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+			SLAB_HWCACHE_ALIGN|SLAB_PANIC|SLAB_USERCOPY, NULL);
 
 	dcache_init();
 	inode_init();
diff -uriN linux-2.6.32.43/fs/devpts/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/devpts/inode.c
--- linux-2.6.32.43/fs/devpts/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/devpts/inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -24,6 +24,7 @@
 #include <linux/parser.h>
 #include <linux/fsnotify.h>
 #include <linux/seq_file.h>
+#include <linux/vs_base.h>
 
 #define DEVPTS_DEFAULT_MODE 0600
 /*
@@ -35,6 +36,20 @@
 #define DEVPTS_DEFAULT_PTMX_MODE 0000
 #define PTMX_MINOR	2
 
+static int devpts_permission(struct inode *inode, int mask)
+{
+	int ret = -EACCES;
+
+	/* devpts is xid tagged */
+	if (vx_check((xid_t)inode->i_tag, VS_WATCH_P | VS_IDENT))
+		ret = generic_permission(inode, mask, NULL);
+	return ret;
+}
+
+static struct inode_operations devpts_file_inode_operations = {
+	.permission     = devpts_permission,
+};
+
 extern int pty_limit;			/* Config limit on Unix98 ptys */
 static DEFINE_MUTEX(allocated_ptys_lock);
 
@@ -262,6 +277,25 @@
 	return 0;
 }
 
+static int devpts_filter(struct dentry *de)
+{
+	/* devpts is xid tagged */
+	return vx_check((xid_t)de->d_inode->i_tag, VS_WATCH_P | VS_IDENT);
+}
+
+static int devpts_readdir(struct file * filp, void * dirent, filldir_t filldir)
+{
+	return dcache_readdir_filter(filp, dirent, filldir, devpts_filter);
+}
+
+static struct file_operations devpts_dir_operations = {
+	.open		= dcache_dir_open,
+	.release	= dcache_dir_close,
+	.llseek		= dcache_dir_lseek,
+	.read		= generic_read_dir,
+	.readdir	= devpts_readdir,
+};
+
 static const struct super_operations devpts_sops = {
 	.statfs		= simple_statfs,
 	.remount_fs	= devpts_remount,
@@ -301,12 +335,15 @@
 	inode = new_inode(s);
 	if (!inode)
 		goto free_fsi;
+
 	inode->i_ino = 1;
 	inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
 	inode->i_mode = S_IFDIR | S_IRUGO | S_IXUGO | S_IWUSR;
 	inode->i_op = &simple_dir_inode_operations;
-	inode->i_fop = &simple_dir_operations;
+	inode->i_fop = &devpts_dir_operations;
 	inode->i_nlink = 2;
+	/* devpts is xid tagged */
+	inode->i_tag = (tag_t)vx_current_xid();
 
 	s->s_root = d_alloc_root(inode);
 	if (s->s_root)
@@ -497,6 +534,9 @@
 	inode->i_gid = opts->setgid ? opts->gid : current_fsgid();
 	inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
 	init_special_inode(inode, S_IFCHR|opts->mode, device);
+	/* devpts is xid tagged */
+	inode->i_tag = (tag_t)vx_current_xid();
+	inode->i_op = &devpts_file_inode_operations;
 	inode->i_private = tty;
 	tty->driver_data = inode;
 
diff -uriN linux-2.6.32.43/fs/dlm/lockspace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/dlm/lockspace.c
--- linux-2.6.32.43/fs/dlm/lockspace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/dlm/lockspace.c	2011-07-15 05:51:18.000000000 -0500
@@ -148,7 +148,7 @@
 	kfree(ls);
 }
 
-static struct sysfs_ops dlm_attr_ops = {
+static const struct sysfs_ops dlm_attr_ops = {
 	.show  = dlm_attr_show,
 	.store = dlm_attr_store,
 };
diff -uriN linux-2.6.32.43/fs/ecryptfs/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ecryptfs/inode.c
--- linux-2.6.32.43/fs/ecryptfs/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ecryptfs/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -660,7 +660,7 @@
 	old_fs = get_fs();
 	set_fs(get_ds());
 	rc = lower_dentry->d_inode->i_op->readlink(lower_dentry,
-						   (char __user *)lower_buf,
+						   (__force char __user *)lower_buf,
 						   lower_bufsiz);
 	set_fs(old_fs);
 	if (rc < 0)
@@ -706,7 +706,7 @@
 	}
 	old_fs = get_fs();
 	set_fs(get_ds());
-	rc = dentry->d_inode->i_op->readlink(dentry, (char __user *)buf, len);
+	rc = dentry->d_inode->i_op->readlink(dentry, (__force char __user *)buf, len);
 	set_fs(old_fs);
 	if (rc < 0)
 		goto out_free;
diff -uriN linux-2.6.32.43/fs/exec.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/exec.c
--- linux-2.6.32.43/fs/exec.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/exec.c	2011-07-15 05:51:18.000000000 -0500
@@ -56,12 +56,24 @@
 #include <linux/fsnotify.h>
 #include <linux/fs_struct.h>
 #include <linux/pipe_fs_i.h>
+#include <linux/random.h>
+#include <linux/seq_file.h>
+
+#ifdef CONFIG_PAX_REFCOUNT
+#include <linux/kallsyms.h>
+#include <linux/kdebug.h>
+#endif
 
 #include <asm/uaccess.h>
 #include <asm/mmu_context.h>
 #include <asm/tlb.h>
 #include "internal.h"
 
+#ifdef CONFIG_PAX_HOOK_ACL_FLAGS
+void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
+EXPORT_SYMBOL(pax_set_initial_flags_func);
+#endif
+
 int core_uses_pid;
 char core_pattern[CORENAME_MAX_SIZE] = "core";
 unsigned int core_pipe_limit;
@@ -115,7 +127,7 @@
 		goto out;
 
 	file = do_filp_open(AT_FDCWD, tmp,
-				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
 				MAY_READ | MAY_EXEC | MAY_OPEN);
 	putname(tmp);
 	error = PTR_ERR(file);
@@ -178,18 +190,10 @@
 		int write)
 {
 	struct page *page;
-	int ret;
 
-#ifdef CONFIG_STACK_GROWSUP
-	if (write) {
-		ret = expand_stack_downwards(bprm->vma, pos);
-		if (ret < 0)
-			return NULL;
-	}
-#endif
-	ret = get_user_pages(current, bprm->mm, pos,
-			1, write, 1, &page, NULL);
-	if (ret <= 0)
+	if (0 > expand_stack_downwards(bprm->vma, pos))
+		return NULL;
+	if (0 >= get_user_pages(current, bprm->mm, pos, 1, write, 1, &page, NULL))
 		return NULL;
 
 	if (write) {
@@ -263,6 +267,11 @@
 	vma->vm_end = STACK_TOP_MAX;
 	vma->vm_start = vma->vm_end - PAGE_SIZE;
 	vma->vm_flags = VM_STACK_FLAGS;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	vma->vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
+#endif
+
 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
 
 	err = security_file_mmap(NULL, 0, 0, 0, vma->vm_start, 1);
@@ -273,9 +282,17 @@
 	if (err)
 		goto err;
 
-	mm->stack_vm = mm->total_vm = 1;
+	mm->total_vm = 0;
+	vx_vmpages_inc(mm);
+	mm->stack_vm = 1;
 	up_write(&mm->mmap_sem);
 	bprm->p = vma->vm_end - sizeof(void *);
+
+#ifdef CONFIG_PAX_RANDUSTACK
+	if (randomize_va_space)
+		bprm->p ^= (pax_get_random_long() & ~15) & ~PAGE_MASK;
+#endif
+
 	return 0;
 err:
 	up_write(&mm->mmap_sem);
@@ -510,7 +527,7 @@
 	int r;
 	mm_segment_t oldfs = get_fs();
 	set_fs(KERNEL_DS);
-	r = copy_strings(argc, (char __user * __user *)argv, bprm);
+	r = copy_strings(argc, (__force char __user * __user *)argv, bprm);
 	set_fs(oldfs);
 	return r;
 }
@@ -540,7 +557,8 @@
 	unsigned long new_end = old_end - shift;
 	struct mmu_gather *tlb;
 
-	BUG_ON(new_start > new_end);
+	if (new_start >= new_end || new_start < mmap_min_addr)
+		return -ENOMEM;
 
 	/*
 	 * ensure there are no vmas between where we want to go
@@ -549,6 +567,10 @@
 	if (vma != find_vma(mm, new_start))
 		return -EFAULT;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	BUG_ON(pax_find_mirror_vma(vma));
+#endif
+
 	/*
 	 * cover the whole range: [new_start, old_end)
 	 */
@@ -630,10 +652,6 @@
 	stack_top = arch_align_stack(stack_top);
 	stack_top = PAGE_ALIGN(stack_top);
 
-	if (unlikely(stack_top < mmap_min_addr) ||
-	    unlikely(vma->vm_end - vma->vm_start >= stack_top - mmap_min_addr))
-		return -ENOMEM;
-
 	stack_shift = vma->vm_end - stack_top;
 
 	bprm->p -= stack_shift;
@@ -645,6 +663,14 @@
 	bprm->exec -= stack_shift;
 
 	down_write(&mm->mmap_sem);
+
+	/* Move stack pages down in memory. */
+	if (stack_shift) {
+		ret = shift_arg_pages(vma, stack_shift);
+		if (ret)
+			goto out_unlock;
+	}
+
 	vm_flags = VM_STACK_FLAGS;
 
 	/*
@@ -658,19 +684,24 @@
 		vm_flags &= ~VM_EXEC;
 	vm_flags |= mm->def_flags;
 
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
+		vm_flags &= ~VM_EXEC;
+
+#ifdef CONFIG_PAX_MPROTECT
+		if (mm->pax_flags & MF_PAX_MPROTECT)
+			vm_flags &= ~VM_MAYEXEC;
+#endif
+
+	}
+#endif
+
 	ret = mprotect_fixup(vma, &prev, vma->vm_start, vma->vm_end,
 			vm_flags);
 	if (ret)
 		goto out_unlock;
 	BUG_ON(prev != vma);
 
-	/* Move stack pages down in memory. */
-	if (stack_shift) {
-		ret = shift_arg_pages(vma, stack_shift);
-		if (ret)
-			goto out_unlock;
-	}
-
 	stack_expand = EXTRA_STACK_VM_PAGES * PAGE_SIZE;
 	stack_size = vma->vm_end - vma->vm_start;
 	/*
@@ -707,7 +738,7 @@
 	int err;
 
 	file = do_filp_open(AT_FDCWD, name,
-				O_LARGEFILE | O_RDONLY | FMODE_EXEC, 0,
+				O_LARGEFILE | O_RDONLY | FMODE_EXEC | FMODE_GREXEC, 0,
 				MAY_EXEC | MAY_OPEN);
 	if (IS_ERR(file))
 		goto out;
@@ -744,7 +775,7 @@
 	old_fs = get_fs();
 	set_fs(get_ds());
 	/* The cast to a user pointer is valid due to the set_fs() */
-	result = vfs_read(file, (void __user *)addr, count, &pos);
+	result = vfs_read(file, (__force void __user *)addr, count, &pos);
 	set_fs(old_fs);
 	return result;
 }
@@ -1152,7 +1183,7 @@
 	}
 	rcu_read_unlock();
 
-	if (p->fs->users > n_fs) {
+	if (atomic_read(&p->fs->users) > n_fs) {
 		bprm->unsafe |= LSM_UNSAFE_SHARE;
 	} else {
 		res = -EAGAIN;
@@ -1347,6 +1378,11 @@
 	char __user *__user *envp,
 	struct pt_regs * regs)
 {
+#ifdef CONFIG_GRKERNSEC
+	struct file *old_exec_file;
+	struct acl_subject_label *old_acl;
+	struct rlimit old_rlim[RLIM_NLIMITS];
+#endif
 	struct linux_binprm *bprm;
 	struct file *file;
 	struct files_struct *displaced;
@@ -1383,6 +1419,23 @@
 	bprm->filename = filename;
 	bprm->interp = filename;
 
+	if (gr_process_user_ban()) {
+		retval = -EPERM;
+		goto out_file;
+	}
+
+	gr_learn_resource(current, RLIMIT_NPROC, atomic_read(&current->cred->user->processes), 1);
+
+	if (gr_handle_nproc()) {
+		retval = -EAGAIN;
+		goto out_file;
+	}
+
+	if (!gr_acl_handle_execve(file->f_dentry, file->f_vfsmnt)) {
+		retval = -EACCES;
+		goto out_file;
+	}
+
 	retval = bprm_mm_init(bprm);
 	if (retval)
 		goto out_file;
@@ -1412,10 +1465,41 @@
 	if (retval < 0)
 		goto out;
 
+	if (!gr_tpe_allow(file)) {
+		retval = -EACCES;
+		goto out;
+	}
+
+	if (gr_check_crash_exec(file)) {
+		retval = -EACCES;
+		goto out;
+	}
+
+	gr_log_chroot_exec(file->f_dentry, file->f_vfsmnt);
+
+	gr_handle_exec_args(bprm, (const char __user *const __user *)argv);
+
+#ifdef CONFIG_GRKERNSEC
+	old_acl = current->acl;
+	memcpy(old_rlim, current->signal->rlim, sizeof(old_rlim));
+	old_exec_file = current->exec_file;
+	get_file(file);
+	current->exec_file = file;
+#endif
+
+	retval = gr_set_proc_label(file->f_dentry, file->f_vfsmnt,
+				   bprm->unsafe & LSM_UNSAFE_SHARE);
+	if (retval < 0)
+		goto out_fail;
+
 	current->flags &= ~PF_KTHREAD;
 	retval = search_binary_handler(bprm,regs);
 	if (retval < 0)
-		goto out;
+		goto out_fail;
+#ifdef CONFIG_GRKERNSEC
+	if (old_exec_file)
+		fput(old_exec_file);
+#endif
 
 	/* execve succeeded */
 	current->fs->in_exec = 0;
@@ -1426,6 +1510,14 @@
 		put_files_struct(displaced);
 	return retval;
 
+out_fail:
+#ifdef CONFIG_GRKERNSEC
+	current->acl = old_acl;
+	memcpy(current->signal->rlim, old_rlim, sizeof(old_rlim));
+	fput(current->exec_file);
+	current->exec_file = old_exec_file;
+#endif
+
 out:
 	if (bprm->mm) {
 		acct_arg_size(bprm, 0);
@@ -1534,7 +1626,7 @@
 			/* UNIX time of coredump */
 			case 't': {
 				struct timeval tv;
-				do_gettimeofday(&tv);
+				vx_gettimeofday(&tv);
 				rc = snprintf(out_ptr, out_end - out_ptr,
 					      "%lu", tv.tv_sec);
 				if (rc > out_end - out_ptr)
@@ -1591,6 +1683,220 @@
 	return ispipe;
 }
 
+int pax_check_flags(unsigned long *flags)
+{
+	int retval = 0;
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_SEGMEXEC)
+	if (*flags & MF_PAX_SEGMEXEC)
+	{
+		*flags &= ~MF_PAX_SEGMEXEC;
+		retval = -EINVAL;
+	}
+#endif
+
+	if ((*flags & MF_PAX_PAGEEXEC)
+
+#ifdef CONFIG_PAX_PAGEEXEC
+	    &&  (*flags & MF_PAX_SEGMEXEC)
+#endif
+
+	   )
+	{
+		*flags &= ~MF_PAX_PAGEEXEC;
+		retval = -EINVAL;
+	}
+
+	if ((*flags & MF_PAX_MPROTECT)
+
+#ifdef CONFIG_PAX_MPROTECT
+	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
+#endif
+
+	   )
+	{
+		*flags &= ~MF_PAX_MPROTECT;
+		retval = -EINVAL;
+	}
+
+	if ((*flags & MF_PAX_EMUTRAMP)
+
+#ifdef CONFIG_PAX_EMUTRAMP
+	    && !(*flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC))
+#endif
+
+	   )
+	{
+		*flags &= ~MF_PAX_EMUTRAMP;
+		retval = -EINVAL;
+	}
+
+	return retval;
+}
+
+EXPORT_SYMBOL(pax_check_flags);
+
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+void pax_report_fault(struct pt_regs *regs, void *pc, void *sp)
+{
+	struct task_struct *tsk = current;
+	struct mm_struct *mm = current->mm;
+	char *buffer_exec = (char *)__get_free_page(GFP_KERNEL);
+	char *buffer_fault = (char *)__get_free_page(GFP_KERNEL);
+	char *path_exec = NULL;
+	char *path_fault = NULL;
+	unsigned long start = 0UL, end = 0UL, offset = 0UL;
+
+	if (buffer_exec && buffer_fault) {
+		struct vm_area_struct *vma, *vma_exec = NULL, *vma_fault = NULL;
+
+		down_read(&mm->mmap_sem);
+		vma = mm->mmap;
+		while (vma && (!vma_exec || !vma_fault)) {
+			if ((vma->vm_flags & VM_EXECUTABLE) && vma->vm_file)
+				vma_exec = vma;
+			if (vma->vm_start <= (unsigned long)pc && (unsigned long)pc < vma->vm_end)
+				vma_fault = vma;
+			vma = vma->vm_next;
+		}
+		if (vma_exec) {
+			path_exec = d_path(&vma_exec->vm_file->f_path, buffer_exec, PAGE_SIZE);
+			if (IS_ERR(path_exec))
+				path_exec = "<path too long>";
+			else {
+				path_exec = mangle_path(buffer_exec, path_exec, "\t\n\\");
+				if (path_exec) {
+					*path_exec = 0;
+					path_exec = buffer_exec;
+				} else
+					path_exec = "<path too long>";
+			}
+		}
+		if (vma_fault) {
+			start = vma_fault->vm_start;
+			end = vma_fault->vm_end;
+			offset = vma_fault->vm_pgoff << PAGE_SHIFT;
+			if (vma_fault->vm_file) {
+				path_fault = d_path(&vma_fault->vm_file->f_path, buffer_fault, PAGE_SIZE);
+				if (IS_ERR(path_fault))
+					path_fault = "<path too long>";
+				else {
+					path_fault = mangle_path(buffer_fault, path_fault, "\t\n\\");
+					if (path_fault) {
+						*path_fault = 0;
+						path_fault = buffer_fault;
+					} else
+						path_fault = "<path too long>";
+				}
+			} else
+				path_fault = "<anonymous mapping>";
+		}
+		up_read(&mm->mmap_sem);
+	}
+	if (tsk->signal->curr_ip)
+		printk(KERN_ERR "PAX: From %pI4: execution attempt in: %s, %08lx-%08lx %08lx\n", &tsk->signal->curr_ip, path_fault, start, end, offset);
+	else
+		printk(KERN_ERR "PAX: execution attempt in: %s, %08lx-%08lx %08lx\n", path_fault, start, end, offset);
+	printk(KERN_ERR "PAX: terminating task: %s(%s):%d, uid/euid: %u/%u, "
+			"PC: %p, SP: %p\n", path_exec, tsk->comm, task_pid_nr(tsk),
+			task_uid(tsk), task_euid(tsk), pc, sp);
+	free_page((unsigned long)buffer_exec);
+	free_page((unsigned long)buffer_fault);
+	pax_report_insns(pc, sp);
+	do_coredump(SIGKILL, SIGKILL, regs);
+}
+#endif
+
+#ifdef CONFIG_PAX_REFCOUNT
+void pax_report_refcount_overflow(struct pt_regs *regs)
+{
+	if (current->signal->curr_ip)
+		printk(KERN_ERR "PAX: From %pI4: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
+				 &current->signal->curr_ip, current->comm, task_pid_nr(current), current_uid(), current_euid());
+	else
+		printk(KERN_ERR "PAX: refcount overflow detected in: %s:%d, uid/euid: %u/%u\n",
+				 current->comm, task_pid_nr(current), current_uid(), current_euid());
+	print_symbol(KERN_ERR "PAX: refcount overflow occured at: %s\n", instruction_pointer(regs));
+	show_regs(regs);
+	force_sig_specific(SIGKILL, current);
+}
+#endif
+
+#ifdef CONFIG_PAX_USERCOPY
+/* 0: not at all, 1: fully, 2: fully inside frame, -1: partially (implies an error) */
+int object_is_on_stack(const void *obj, unsigned long len)
+{
+	const void * const stack = task_stack_page(current);
+	const void * const stackend = stack + THREAD_SIZE;
+
+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
+	const void *frame = NULL;
+	const void *oldframe;
+#endif
+
+	if (obj + len < obj)
+		return -1;
+
+	if (obj + len <= stack || stackend <= obj)
+		return 0;
+
+	if (obj < stack || stackend < obj + len)
+		return -1;
+
+#if defined(CONFIG_FRAME_POINTER) && defined(CONFIG_X86)
+	oldframe = __builtin_frame_address(1);
+	if (oldframe)
+		frame = __builtin_frame_address(2);
+	/*
+	  low ----------------------------------------------> high
+	  [saved bp][saved ip][args][local vars][saved bp][saved ip]
+			      ^----------------^
+			  allow copies only within here
+	*/
+	while (stack <= frame && frame < stackend) {
+		/* if obj + len extends past the last frame, this
+		   check won't pass and the next frame will be 0,
+		   causing us to bail out and correctly report
+		   the copy as invalid
+		*/
+		if (obj + len <= frame)
+			return obj >= oldframe + 2 * sizeof(void *) ? 2 : -1;
+		oldframe = frame;
+		frame = *(const void * const *)frame;
+	}
+	return -1;
+#else
+	return 1;
+#endif
+}
+
+
+NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type)
+{
+	if (current->signal->curr_ip)
+		printk(KERN_ERR "PAX: From %pI4: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
+			&current->signal->curr_ip, to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
+	else
+		printk(KERN_ERR "PAX: kernel memory %s attempt detected %s %p (%s) (%lu bytes)\n",
+			to ? "leak" : "overwrite", to ? "from" : "to", ptr, type ? : "unknown", len);
+
+	dump_stack();
+	gr_handle_kernel_exploit();
+	do_group_exit(SIGKILL);
+}
+#endif
+
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+void pax_track_stack(void)
+{
+	unsigned long sp = (unsigned long)&sp;
+	if (sp < current_thread_info()->lowest_stack &&
+	    sp > (unsigned long)task_stack_page(current))
+		current_thread_info()->lowest_stack = sp;
+}
+EXPORT_SYMBOL(pax_track_stack);
+#endif
+
 static int zap_process(struct task_struct *start)
 {
 	struct task_struct *t;
@@ -1793,17 +2099,17 @@
 	pipe = file->f_path.dentry->d_inode->i_pipe;
 
 	pipe_lock(pipe);
-	pipe->readers++;
-	pipe->writers--;
+	atomic_inc(&pipe->readers);
+	atomic_dec(&pipe->writers);
 
-	while ((pipe->readers > 1) && (!signal_pending(current))) {
+	while ((atomic_read(&pipe->readers) > 1) && (!signal_pending(current))) {
 		wake_up_interruptible_sync(&pipe->wait);
 		kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
 		pipe_wait(pipe);
 	}
 
-	pipe->readers--;
-	pipe->writers++;
+	atomic_dec(&pipe->readers);
+	atomic_inc(&pipe->writers);
 	pipe_unlock(pipe);
 
 }
@@ -1826,10 +2132,13 @@
 	char **helper_argv = NULL;
 	int helper_argc = 0;
 	int dump_count = 0;
-	static atomic_t core_dump_count = ATOMIC_INIT(0);
+	static atomic_unchecked_t core_dump_count = ATOMIC_INIT(0);
 
 	audit_core_dumps(signr);
 
+	if (signr == SIGSEGV || signr == SIGBUS || signr == SIGKILL || signr == SIGILL)
+		gr_handle_brute_attach(current, mm->flags);
+
 	binfmt = mm->binfmt;
 	if (!binfmt || !binfmt->core_dump)
 		goto fail;
@@ -1874,6 +2183,8 @@
 	 */
 	clear_thread_flag(TIF_SIGPENDING);
 
+	gr_learn_resource(current, RLIMIT_CORE, binfmt->min_coredump, 1);
+
 	/*
 	 * lock_kernel() because format_corename() is controlled by sysctl, which
 	 * uses lock_kernel()
@@ -1908,7 +2219,7 @@
 			goto fail_unlock;
 		}
 
-		dump_count = atomic_inc_return(&core_dump_count);
+		dump_count = atomic_inc_return_unchecked(&core_dump_count);
 		if (core_pipe_limit && (core_pipe_limit < dump_count)) {
 			printk(KERN_WARNING "Pid %d(%s) over core_pipe_limit\n",
 			       task_tgid_vnr(current), current->comm);
@@ -1972,7 +2283,7 @@
 	filp_close(file, NULL);
 fail_dropcount:
 	if (dump_count)
-		atomic_dec(&core_dump_count);
+		atomic_dec_unchecked(&core_dump_count);
 fail_unlock:
 	if (helper_argv)
 		argv_free(helper_argv);
diff -uriN linux-2.6.32.43/fs/ext2/balloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/balloc.c
--- linux-2.6.32.43/fs/ext2/balloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/balloc.c	2011-07-15 05:51:18.000000000 -0500
@@ -701,7 +701,6 @@
 			start = 0;
 		end = EXT2_BLOCKS_PER_GROUP(sb);
 	}
-
 	BUG_ON(start > EXT2_BLOCKS_PER_GROUP(sb));
 
 repeat:
@@ -1192,7 +1191,7 @@
 
 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
-	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
 		sbi->s_resuid != current_fsuid() &&
 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
 		return 0;
diff -uriN linux-2.6.32.43/fs/ext2/ext2.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/ext2.h
--- linux-2.6.32.43/fs/ext2/ext2.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/ext2.h	2011-07-15 05:50:11.000000000 -0500
@@ -131,6 +131,7 @@
 int __ext2_write_begin(struct file *file, struct address_space *mapping,
 		loff_t pos, unsigned len, unsigned flags,
 		struct page **pagep, void **fsdata);
+extern int ext2_sync_flags(struct inode *, int, int);
 
 /* ioctl.c */
 extern long ext2_ioctl(struct file *, unsigned int, unsigned long);
diff -uriN linux-2.6.32.43/fs/ext2/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/file.c
--- linux-2.6.32.43/fs/ext2/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/file.c	2011-07-15 05:50:11.000000000 -0500
@@ -87,4 +87,5 @@
 	.setattr	= ext2_setattr,
 	.check_acl	= ext2_check_acl,
 	.fiemap		= ext2_fiemap,
+	.sync_flags	= ext2_sync_flags,
 };
diff -uriN linux-2.6.32.43/fs/ext2/ialloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/ialloc.c
--- linux-2.6.32.43/fs/ext2/ialloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/ialloc.c	2011-07-15 05:50:11.000000000 -0500
@@ -17,6 +17,7 @@
 #include <linux/backing-dev.h>
 #include <linux/buffer_head.h>
 #include <linux/random.h>
+#include <linux/vs_tag.h>
 #include "ext2.h"
 #include "xattr.h"
 #include "acl.h"
@@ -560,6 +561,7 @@
 	} else
 		inode->i_gid = current_fsgid();
 	inode->i_mode = mode;
+	inode->i_tag = dx_current_fstag(sb);
 
 	inode->i_ino = ino;
 	inode->i_blocks = 0;
diff -uriN linux-2.6.32.43/fs/ext2/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/inode.c
--- linux-2.6.32.43/fs/ext2/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -33,6 +33,7 @@
 #include <linux/mpage.h>
 #include <linux/fiemap.h>
 #include <linux/namei.h>
+#include <linux/vs_tag.h>
 #include "ext2.h"
 #include "acl.h"
 #include "xip.h"
@@ -1040,7 +1041,7 @@
 		return;
 	if (ext2_inode_is_fast_symlink(inode))
 		return;
-	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
+	if (IS_APPEND(inode) || IS_IXORUNLINK(inode))
 		return;
 
 	blocksize = inode->i_sb->s_blocksize;
@@ -1178,36 +1179,61 @@
 {
 	unsigned int flags = EXT2_I(inode)->i_flags;
 
-	inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
+	inode->i_flags &= ~(S_IMMUTABLE | S_IXUNLINK |
+		S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
+
+
+	if (flags & EXT2_IMMUTABLE_FL)
+		inode->i_flags |= S_IMMUTABLE;
+	if (flags & EXT2_IXUNLINK_FL)
+		inode->i_flags |= S_IXUNLINK;
+
 	if (flags & EXT2_SYNC_FL)
 		inode->i_flags |= S_SYNC;
 	if (flags & EXT2_APPEND_FL)
 		inode->i_flags |= S_APPEND;
-	if (flags & EXT2_IMMUTABLE_FL)
-		inode->i_flags |= S_IMMUTABLE;
 	if (flags & EXT2_NOATIME_FL)
 		inode->i_flags |= S_NOATIME;
 	if (flags & EXT2_DIRSYNC_FL)
 		inode->i_flags |= S_DIRSYNC;
+
+	inode->i_vflags &= ~(V_BARRIER | V_COW);
+
+	if (flags & EXT2_BARRIER_FL)
+		inode->i_vflags |= V_BARRIER;
+	if (flags & EXT2_COW_FL)
+		inode->i_vflags |= V_COW;
 }
 
 /* Propagate flags from i_flags to EXT2_I(inode)->i_flags */
 void ext2_get_inode_flags(struct ext2_inode_info *ei)
 {
 	unsigned int flags = ei->vfs_inode.i_flags;
+	unsigned int vflags = ei->vfs_inode.i_vflags;
+
+	ei->i_flags &= ~(EXT2_SYNC_FL | EXT2_APPEND_FL |
+			EXT2_IMMUTABLE_FL | EXT2_IXUNLINK_FL |
+			EXT2_NOATIME_FL | EXT2_DIRSYNC_FL |
+			EXT2_BARRIER_FL | EXT2_COW_FL);
+
+	if (flags & S_IMMUTABLE)
+		ei->i_flags |= EXT2_IMMUTABLE_FL;
+	if (flags & S_IXUNLINK)
+		ei->i_flags |= EXT2_IXUNLINK_FL;
 
-	ei->i_flags &= ~(EXT2_SYNC_FL|EXT2_APPEND_FL|
-			EXT2_IMMUTABLE_FL|EXT2_NOATIME_FL|EXT2_DIRSYNC_FL);
 	if (flags & S_SYNC)
 		ei->i_flags |= EXT2_SYNC_FL;
 	if (flags & S_APPEND)
 		ei->i_flags |= EXT2_APPEND_FL;
-	if (flags & S_IMMUTABLE)
-		ei->i_flags |= EXT2_IMMUTABLE_FL;
 	if (flags & S_NOATIME)
 		ei->i_flags |= EXT2_NOATIME_FL;
 	if (flags & S_DIRSYNC)
 		ei->i_flags |= EXT2_DIRSYNC_FL;
+
+	if (vflags & V_BARRIER)
+		ei->i_flags |= EXT2_BARRIER_FL;
+	if (vflags & V_COW)
+		ei->i_flags |= EXT2_COW_FL;
 }
 
 struct inode *ext2_iget (struct super_block *sb, unsigned long ino)
@@ -1217,6 +1243,8 @@
 	struct ext2_inode *raw_inode;
 	struct inode *inode;
 	long ret = -EIO;
+	uid_t uid;
+	gid_t gid;
 	int n;
 
 	inode = iget_locked(sb, ino);
@@ -1235,12 +1263,17 @@
 	}
 
 	inode->i_mode = le16_to_cpu(raw_inode->i_mode);
-	inode->i_uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
-	inode->i_gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low);
+	uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
+	gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low);
 	if (!(test_opt (inode->i_sb, NO_UID32))) {
-		inode->i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
-		inode->i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
+		uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
+		gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
 	}
+	inode->i_uid = INOTAG_UID(DX_TAG(inode), uid, gid);
+	inode->i_gid = INOTAG_GID(DX_TAG(inode), uid, gid);
+	inode->i_tag = INOTAG_TAG(DX_TAG(inode), uid, gid,
+		le16_to_cpu(raw_inode->i_raw_tag));
+
 	inode->i_nlink = le16_to_cpu(raw_inode->i_links_count);
 	inode->i_size = le32_to_cpu(raw_inode->i_size);
 	inode->i_atime.tv_sec = (signed)le32_to_cpu(raw_inode->i_atime);
@@ -1338,8 +1371,8 @@
 	struct ext2_inode_info *ei = EXT2_I(inode);
 	struct super_block *sb = inode->i_sb;
 	ino_t ino = inode->i_ino;
-	uid_t uid = inode->i_uid;
-	gid_t gid = inode->i_gid;
+	uid_t uid = TAGINO_UID(DX_TAG(inode), inode->i_uid, inode->i_tag);
+	gid_t gid = TAGINO_GID(DX_TAG(inode), inode->i_gid, inode->i_tag);
 	struct buffer_head * bh;
 	struct ext2_inode * raw_inode = ext2_get_inode(sb, ino, &bh);
 	int n;
@@ -1375,6 +1408,9 @@
 		raw_inode->i_uid_high = 0;
 		raw_inode->i_gid_high = 0;
 	}
+#ifdef CONFIG_TAGGING_INTERN
+	raw_inode->i_raw_tag = cpu_to_le16(inode->i_tag);
+#endif
 	raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
 	raw_inode->i_size = cpu_to_le32(inode->i_size);
 	raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec);
@@ -1456,7 +1492,8 @@
 	if (error)
 		return error;
 	if ((iattr->ia_valid & ATTR_UID && iattr->ia_uid != inode->i_uid) ||
-	    (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid)) {
+	    (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid) ||
+	    (iattr->ia_valid & ATTR_TAG && iattr->ia_tag != inode->i_tag)) {
 		error = vfs_dq_transfer(inode, iattr) ? -EDQUOT : 0;
 		if (error)
 			return error;
diff -uriN linux-2.6.32.43/fs/ext2/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/ioctl.c
--- linux-2.6.32.43/fs/ext2/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/ioctl.c	2011-07-15 05:50:11.000000000 -0500
@@ -17,6 +17,16 @@
 #include <asm/uaccess.h>
 
 
+int ext2_sync_flags(struct inode *inode, int flags, int vflags)
+{
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+	ext2_get_inode_flags(EXT2_I(inode));
+	inode->i_ctime = CURRENT_TIME_SEC;
+	mark_inode_dirty(inode);
+	return 0;
+}
+
 long ext2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	struct inode *inode = filp->f_dentry->d_inode;
@@ -51,6 +61,11 @@
 
 		flags = ext2_mask_flags(inode->i_mode, flags);
 
+		if (IS_BARRIER(inode)) {
+			vxwprintk_task(1, "messing with the barrier.");
+			return -EACCES;
+		}
+
 		mutex_lock(&inode->i_mutex);
 		/* Is it quota file? Do not allow user to mess with it */
 		if (IS_NOQUOTA(inode)) {
@@ -66,7 +81,9 @@
 		 *
 		 * This test looks nicer. Thanks to Pauline Middelink
 		 */
-		if ((flags ^ oldflags) & (EXT2_APPEND_FL | EXT2_IMMUTABLE_FL)) {
+		if ((oldflags & EXT2_IMMUTABLE_FL) ||
+			((flags ^ oldflags) & (EXT2_APPEND_FL |
+			EXT2_IMMUTABLE_FL | EXT2_IXUNLINK_FL))) {
 			if (!capable(CAP_LINUX_IMMUTABLE)) {
 				mutex_unlock(&inode->i_mutex);
 				ret = -EPERM;
@@ -74,7 +91,7 @@
 			}
 		}
 
-		flags = flags & EXT2_FL_USER_MODIFIABLE;
+		flags &= EXT2_FL_USER_MODIFIABLE;
 		flags |= oldflags & ~EXT2_FL_USER_MODIFIABLE;
 		ei->i_flags = flags;
 		mutex_unlock(&inode->i_mutex);
diff -uriN linux-2.6.32.43/fs/ext2/namei.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/namei.c
--- linux-2.6.32.43/fs/ext2/namei.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/namei.c	2011-07-15 05:50:11.000000000 -0500
@@ -31,6 +31,7 @@
  */
 
 #include <linux/pagemap.h>
+#include <linux/vs_tag.h>
 #include "ext2.h"
 #include "xattr.h"
 #include "acl.h"
@@ -74,6 +75,7 @@
 				return ERR_PTR(-EIO);
 			} else {
 				return ERR_CAST(inode);
+		dx_propagate_tag(nd, inode);
 			}
 		}
 	}
@@ -396,6 +398,7 @@
 #endif
 	.setattr	= ext2_setattr,
 	.check_acl	= ext2_check_acl,
+	.sync_flags	= ext2_sync_flags,
 };
 
 const struct inode_operations ext2_special_inode_operations = {
diff -uriN linux-2.6.32.43/fs/ext2/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/super.c
--- linux-2.6.32.43/fs/ext2/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext2/super.c	2011-07-15 05:50:11.000000000 -0500
@@ -382,7 +382,8 @@
 	Opt_err_ro, Opt_nouid32, Opt_nocheck, Opt_debug,
 	Opt_oldalloc, Opt_orlov, Opt_nobh, Opt_user_xattr, Opt_nouser_xattr,
 	Opt_acl, Opt_noacl, Opt_xip, Opt_ignore, Opt_err, Opt_quota,
-	Opt_usrquota, Opt_grpquota, Opt_reservation, Opt_noreservation
+	Opt_usrquota, Opt_grpquota, Opt_reservation, Opt_noreservation,
+	Opt_tag, Opt_notag, Opt_tagid
 };
 
 static const match_table_t tokens = {
@@ -410,6 +411,9 @@
 	{Opt_acl, "acl"},
 	{Opt_noacl, "noacl"},
 	{Opt_xip, "xip"},
+	{Opt_tag, "tag"},
+	{Opt_notag, "notag"},
+	{Opt_tagid, "tagid=%u"},
 	{Opt_grpquota, "grpquota"},
 	{Opt_ignore, "noquota"},
 	{Opt_quota, "quota"},
@@ -480,6 +484,20 @@
 		case Opt_nouid32:
 			set_opt (sbi->s_mount_opt, NO_UID32);
 			break;
+#ifndef CONFIG_TAGGING_NONE
+		case Opt_tag:
+			set_opt (sbi->s_mount_opt, TAGGED);
+			break;
+		case Opt_notag:
+			clear_opt (sbi->s_mount_opt, TAGGED);
+			break;
+#endif
+#ifdef CONFIG_PROPAGATE
+		case Opt_tagid:
+			/* use args[0] */
+			set_opt (sbi->s_mount_opt, TAGGED);
+			break;
+#endif
 		case Opt_nocheck:
 			clear_opt (sbi->s_mount_opt, CHECK);
 			break;
@@ -829,6 +847,8 @@
 	if (!parse_options ((char *) data, sbi))
 		goto failed_mount;
 
+	if (EXT2_SB(sb)->s_mount_opt & EXT2_MOUNT_TAGGED)
+		sb->s_flags |= MS_TAGGED;
 	sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
 		((EXT2_SB(sb)->s_mount_opt & EXT2_MOUNT_POSIX_ACL) ?
 		 MS_POSIXACL : 0);
@@ -1174,6 +1194,14 @@
 		err = -EINVAL;
 		goto restore_opts;
 	}
+
+	if ((sbi->s_mount_opt & EXT2_MOUNT_TAGGED) &&
+		!(sb->s_flags & MS_TAGGED)) {
+		printk("EXT2-fs: %s: tagging not permitted on remount.\n",
+		       sb->s_id);
+		err = -EINVAL;
+		goto restore_opts;
+	}
 
 	sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
 		((sbi->s_mount_opt & EXT2_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
diff -uriN linux-2.6.32.43/fs/ext3/balloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/balloc.c
--- linux-2.6.32.43/fs/ext3/balloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/balloc.c	2011-07-15 05:51:18.000000000 -0500
@@ -1421,7 +1421,7 @@
 
 	free_blocks = percpu_counter_read_positive(&sbi->s_freeblocks_counter);
 	root_blocks = le32_to_cpu(sbi->s_es->s_r_blocks_count);
-	if (free_blocks < root_blocks + 1 && !capable(CAP_SYS_RESOURCE) &&
+	if (free_blocks < root_blocks + 1 && !capable_nolog(CAP_SYS_RESOURCE) &&
 		sbi->s_resuid != current_fsuid() &&
 		(sbi->s_resgid == 0 || !in_group_p (sbi->s_resgid))) {
 		return 0;
diff -uriN linux-2.6.32.43/fs/ext3/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/file.c
--- linux-2.6.32.43/fs/ext3/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/file.c	2011-07-15 05:50:11.000000000 -0500
@@ -80,5 +80,6 @@
 #endif
 	.check_acl	= ext3_check_acl,
 	.fiemap		= ext3_fiemap,
+	.sync_flags	= ext3_sync_flags,
 };
 
diff -uriN linux-2.6.32.43/fs/ext3/ialloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/ialloc.c
--- linux-2.6.32.43/fs/ext3/ialloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/ialloc.c	2011-07-15 05:50:11.000000000 -0500
@@ -23,6 +23,7 @@
 #include <linux/buffer_head.h>
 #include <linux/random.h>
 #include <linux/bitops.h>
+#include <linux/vs_tag.h>
 
 #include <asm/byteorder.h>
 
@@ -548,6 +549,7 @@
 	} else
 		inode->i_gid = current_fsgid();
 	inode->i_mode = mode;
+	inode->i_tag = dx_current_fstag(sb);
 
 	inode->i_ino = ino;
 	/* This is the optimal IO size (for stat), not the fs block size */
diff -uriN linux-2.6.32.43/fs/ext3/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/inode.c
--- linux-2.6.32.43/fs/ext3/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -38,6 +38,7 @@
 #include <linux/bio.h>
 #include <linux/fiemap.h>
 #include <linux/namei.h>
+#include <linux/vs_tag.h>
 #include "xattr.h"
 #include "acl.h"
 
@@ -2343,7 +2344,7 @@
 
 int ext3_can_truncate(struct inode *inode)
 {
-	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
+	if (IS_APPEND(inode) || IS_IXORUNLINK(inode))
 		return 0;
 	if (S_ISREG(inode->i_mode))
 		return 1;
@@ -2728,36 +2729,60 @@
 {
 	unsigned int flags = EXT3_I(inode)->i_flags;
 
-	inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
+	inode->i_flags &= ~(S_IMMUTABLE | S_IXUNLINK |
+		S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
+
+	if (flags & EXT3_IMMUTABLE_FL)
+		inode->i_flags |= S_IMMUTABLE;
+	if (flags & EXT3_IXUNLINK_FL)
+		inode->i_flags |= S_IXUNLINK;
+
 	if (flags & EXT3_SYNC_FL)
 		inode->i_flags |= S_SYNC;
 	if (flags & EXT3_APPEND_FL)
 		inode->i_flags |= S_APPEND;
-	if (flags & EXT3_IMMUTABLE_FL)
-		inode->i_flags |= S_IMMUTABLE;
 	if (flags & EXT3_NOATIME_FL)
 		inode->i_flags |= S_NOATIME;
 	if (flags & EXT3_DIRSYNC_FL)
 		inode->i_flags |= S_DIRSYNC;
+
+	inode->i_vflags &= ~(V_BARRIER | V_COW);
+
+	if (flags & EXT3_BARRIER_FL)
+		inode->i_vflags |= V_BARRIER;
+	if (flags & EXT3_COW_FL)
+		inode->i_vflags |= V_COW;
 }
 
 /* Propagate flags from i_flags to EXT3_I(inode)->i_flags */
 void ext3_get_inode_flags(struct ext3_inode_info *ei)
 {
 	unsigned int flags = ei->vfs_inode.i_flags;
+	unsigned int vflags = ei->vfs_inode.i_vflags;
+
+	ei->i_flags &= ~(EXT3_SYNC_FL | EXT3_APPEND_FL |
+			EXT3_IMMUTABLE_FL | EXT3_IXUNLINK_FL |
+			EXT3_NOATIME_FL | EXT3_DIRSYNC_FL |
+			EXT3_BARRIER_FL | EXT3_COW_FL);
+
+	if (flags & S_IMMUTABLE)
+		ei->i_flags |= EXT3_IMMUTABLE_FL;
+	if (flags & S_IXUNLINK)
+		ei->i_flags |= EXT3_IXUNLINK_FL;
 
-	ei->i_flags &= ~(EXT3_SYNC_FL|EXT3_APPEND_FL|
-			EXT3_IMMUTABLE_FL|EXT3_NOATIME_FL|EXT3_DIRSYNC_FL);
 	if (flags & S_SYNC)
 		ei->i_flags |= EXT3_SYNC_FL;
 	if (flags & S_APPEND)
 		ei->i_flags |= EXT3_APPEND_FL;
-	if (flags & S_IMMUTABLE)
-		ei->i_flags |= EXT3_IMMUTABLE_FL;
 	if (flags & S_NOATIME)
 		ei->i_flags |= EXT3_NOATIME_FL;
 	if (flags & S_DIRSYNC)
 		ei->i_flags |= EXT3_DIRSYNC_FL;
+
+	if (vflags & V_BARRIER)
+		ei->i_flags |= EXT3_BARRIER_FL;
+	if (vflags & V_COW)
+		ei->i_flags |= EXT3_COW_FL;
 }
 
 struct inode *ext3_iget(struct super_block *sb, unsigned long ino)
@@ -2771,6 +2796,8 @@
 	transaction_t *transaction;
 	long ret;
 	int block;
+	uid_t uid;
+	gid_t gid;
 
 	inode = iget_locked(sb, ino);
 	if (!inode)
@@ -2787,12 +2814,17 @@
 	bh = iloc.bh;
 	raw_inode = ext3_raw_inode(&iloc);
 	inode->i_mode = le16_to_cpu(raw_inode->i_mode);
-	inode->i_uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
-	inode->i_gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low);
+	uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
+	gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low);
 	if(!(test_opt (inode->i_sb, NO_UID32))) {
-		inode->i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
-		inode->i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
+		uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
+		gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
 	}
+	inode->i_uid = INOTAG_UID(DX_TAG(inode), uid, gid);
+	inode->i_gid = INOTAG_GID(DX_TAG(inode), uid, gid);
+	inode->i_tag = INOTAG_TAG(DX_TAG(inode), uid, gid,
+		le16_to_cpu(raw_inode->i_raw_tag));
+
 	inode->i_nlink = le16_to_cpu(raw_inode->i_links_count);
 	inode->i_size = le32_to_cpu(raw_inode->i_size);
 	inode->i_atime.tv_sec = (signed)le32_to_cpu(raw_inode->i_atime);
@@ -2947,6 +2979,8 @@
 	struct ext3_inode *raw_inode = ext3_raw_inode(iloc);
 	struct ext3_inode_info *ei = EXT3_I(inode);
 	struct buffer_head *bh = iloc->bh;
+	uid_t uid = TAGINO_UID(DX_TAG(inode), inode->i_uid, inode->i_tag);
+	gid_t gid = TAGINO_GID(DX_TAG(inode), inode->i_gid, inode->i_tag);
 	int err = 0, rc, block;
 
 again:
@@ -2961,29 +2995,32 @@
 	ext3_get_inode_flags(ei);
 	raw_inode->i_mode = cpu_to_le16(inode->i_mode);
 	if(!(test_opt(inode->i_sb, NO_UID32))) {
-		raw_inode->i_uid_low = cpu_to_le16(low_16_bits(inode->i_uid));
-		raw_inode->i_gid_low = cpu_to_le16(low_16_bits(inode->i_gid));
+		raw_inode->i_uid_low = cpu_to_le16(low_16_bits(uid));
+		raw_inode->i_gid_low = cpu_to_le16(low_16_bits(gid));
 /*
  * Fix up interoperability with old kernels. Otherwise, old inodes get
  * re-used with the upper 16 bits of the uid/gid intact
  */
 		if(!ei->i_dtime) {
 			raw_inode->i_uid_high =
-				cpu_to_le16(high_16_bits(inode->i_uid));
+				cpu_to_le16(high_16_bits(uid));
 			raw_inode->i_gid_high =
-				cpu_to_le16(high_16_bits(inode->i_gid));
+				cpu_to_le16(high_16_bits(gid));
 		} else {
 			raw_inode->i_uid_high = 0;
 			raw_inode->i_gid_high = 0;
 		}
 	} else {
 		raw_inode->i_uid_low =
-			cpu_to_le16(fs_high2lowuid(inode->i_uid));
+			cpu_to_le16(fs_high2lowuid(uid));
 		raw_inode->i_gid_low =
-			cpu_to_le16(fs_high2lowgid(inode->i_gid));
+			cpu_to_le16(fs_high2lowgid(gid));
 		raw_inode->i_uid_high = 0;
 		raw_inode->i_gid_high = 0;
 	}
+#ifdef CONFIG_TAGGING_INTERN
+	raw_inode->i_raw_tag = cpu_to_le16(inode->i_tag);
+#endif
 	raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
 	raw_inode->i_size = cpu_to_le32(ei->i_disksize);
 	raw_inode->i_atime = cpu_to_le32(inode->i_atime.tv_sec);
@@ -3141,7 +3178,8 @@
 		return error;
 
 	if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
-		(ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) {
+		(ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid) ||
+		(ia_valid & ATTR_TAG && attr->ia_tag != inode->i_tag)) {
 		handle_t *handle;
 
 		/* (user+group)*(old+new) structure, inode write (sb,
@@ -3163,6 +3201,8 @@
 			inode->i_uid = attr->ia_uid;
 		if (attr->ia_valid & ATTR_GID)
 			inode->i_gid = attr->ia_gid;
+		if ((attr->ia_valid & ATTR_TAG) && IS_TAGGED(inode))
+			inode->i_tag = attr->ia_tag;
 		error = ext3_mark_inode_dirty(handle, inode);
 		ext3_journal_stop(handle);
 	}
diff -uriN linux-2.6.32.43/fs/ext3/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/ioctl.c
--- linux-2.6.32.43/fs/ext3/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/ioctl.c	2011-07-15 05:50:11.000000000 -0500
@@ -8,6 +8,7 @@
  */
 
 #include <linux/fs.h>
+#include <linux/mount.h>
 #include <linux/jbd.h>
 #include <linux/capability.h>
 #include <linux/ext3_fs.h>
@@ -17,6 +18,34 @@
 #include <linux/compat.h>
 #include <asm/uaccess.h>
 
+
+int ext3_sync_flags(struct inode *inode, int flags, int vflags)
+{
+	handle_t *handle = NULL;
+	struct ext3_iloc iloc;
+	int err;
+
+	handle = ext3_journal_start(inode, 1);
+	if (IS_ERR(handle))
+		return PTR_ERR(handle);
+
+	if (IS_SYNC(inode))
+		handle->h_sync = 1;
+	err = ext3_reserve_inode_write(handle, inode, &iloc);
+	if (err)
+		goto flags_err;
+
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+	ext3_get_inode_flags(EXT3_I(inode));
+	inode->i_ctime = CURRENT_TIME_SEC;
+
+	err = ext3_mark_iloc_dirty(handle, inode, &iloc);
+flags_err:
+	ext3_journal_stop(handle);
+	return err;
+}
+
 long ext3_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	struct inode *inode = filp->f_dentry->d_inode;
@@ -50,6 +79,11 @@
 
 		flags = ext3_mask_flags(inode->i_mode, flags);
 
+		if (IS_BARRIER(inode)) {
+			vxwprintk_task(1, "messing with the barrier.");
+			return -EACCES;
+		}
+
 		mutex_lock(&inode->i_mutex);
 
 		/* Is it quota file? Do not allow user to mess with it */
@@ -68,7 +102,9 @@
 		 *
 		 * This test looks nicer. Thanks to Pauline Middelink
 		 */
-		if ((flags ^ oldflags) & (EXT3_APPEND_FL | EXT3_IMMUTABLE_FL)) {
+		if ((oldflags & EXT3_IMMUTABLE_FL) ||
+			((flags ^ oldflags) & (EXT3_APPEND_FL |
+			EXT3_IMMUTABLE_FL | EXT3_IXUNLINK_FL))) {
 			if (!capable(CAP_LINUX_IMMUTABLE))
 				goto flags_out;
 		}
@@ -93,7 +129,7 @@
 		if (err)
 			goto flags_err;
 
-		flags = flags & EXT3_FL_USER_MODIFIABLE;
+		flags &= EXT3_FL_USER_MODIFIABLE;
 		flags |= oldflags & ~EXT3_FL_USER_MODIFIABLE;
 		ei->i_flags = flags;
 
diff -uriN linux-2.6.32.43/fs/ext3/namei.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/namei.c
--- linux-2.6.32.43/fs/ext3/namei.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/namei.c	2011-07-15 05:50:11.000000000 -0500
@@ -36,6 +36,7 @@
 #include <linux/quotaops.h>
 #include <linux/buffer_head.h>
 #include <linux/bio.h>
+#include <linux/vs_tag.h>
 
 #include "namei.h"
 #include "xattr.h"
@@ -912,6 +913,7 @@
 				if (bh)
 					ll_rw_block(READ_META, 1, &bh);
 			}
+		dx_propagate_tag(nd, inode);
 		}
 		if ((bh = bh_use[ra_ptr++]) == NULL)
 			goto next;
@@ -2455,6 +2457,7 @@
 	.removexattr	= generic_removexattr,
 #endif
 	.check_acl	= ext3_check_acl,
+	.sync_flags	= ext3_sync_flags,
 };
 
 const struct inode_operations ext3_special_inode_operations = {
diff -uriN linux-2.6.32.43/fs/ext3/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/super.c
--- linux-2.6.32.43/fs/ext3/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext3/super.c	2011-07-15 05:50:11.000000000 -0500
@@ -789,7 +789,7 @@
 	Opt_usrjquota, Opt_grpjquota, Opt_offusrjquota, Opt_offgrpjquota,
 	Opt_jqfmt_vfsold, Opt_jqfmt_vfsv0, Opt_quota, Opt_noquota,
 	Opt_ignore, Opt_barrier, Opt_err, Opt_resize, Opt_usrquota,
-	Opt_grpquota
+	Opt_grpquota, Opt_tag, Opt_notag, Opt_tagid
 };
 
 static const match_table_t tokens = {
@@ -842,6 +842,9 @@
 	{Opt_usrquota, "usrquota"},
 	{Opt_barrier, "barrier=%u"},
 	{Opt_resize, "resize"},
+	{Opt_tag, "tag"},
+	{Opt_notag, "notag"},
+	{Opt_tagid, "tagid=%u"},
 	{Opt_err, NULL},
 };
 
@@ -934,6 +937,20 @@
 		case Opt_nouid32:
 			set_opt (sbi->s_mount_opt, NO_UID32);
 			break;
+#ifndef CONFIG_TAGGING_NONE
+		case Opt_tag:
+			set_opt (sbi->s_mount_opt, TAGGED);
+			break;
+		case Opt_notag:
+			clear_opt (sbi->s_mount_opt, TAGGED);
+			break;
+#endif
+#ifdef CONFIG_PROPAGATE
+		case Opt_tagid:
+			/* use args[0] */
+			set_opt (sbi->s_mount_opt, TAGGED);
+			break;
+#endif
 		case Opt_nocheck:
 			clear_opt (sbi->s_mount_opt, CHECK);
 			break;
@@ -1665,6 +1682,9 @@
 			    NULL, 0))
 		goto failed_mount;
 
+	if (EXT3_SB(sb)->s_mount_opt & EXT3_MOUNT_TAGGED)
+		sb->s_flags |= MS_TAGGED;
+
 	sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
 		((sbi->s_mount_opt & EXT3_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
 
@@ -2534,6 +2554,14 @@
 	if (sbi->s_mount_opt & EXT3_MOUNT_ABORT)
 		ext3_abort(sb, __func__, "Abort forced by user");
 
+	if ((sbi->s_mount_opt & EXT3_MOUNT_TAGGED) &&
+		!(sb->s_flags & MS_TAGGED)) {
+		printk("EXT3-fs: %s: tagging not permitted on remount.\n",
+			sb->s_id);
+		err = -EINVAL;
+		goto restore_opts;
+	}
+
 	sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
 		((sbi->s_mount_opt & EXT3_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
 
diff -uriN linux-2.6.32.43/fs/ext4/balloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/balloc.c
--- linux-2.6.32.43/fs/ext4/balloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/balloc.c	2011-07-15 05:51:18.000000000 -0500
@@ -570,7 +570,7 @@
 	/* Hm, nope.  Are (enough) root reserved blocks available? */
 	if (sbi->s_resuid == current_fsuid() ||
 	    ((sbi->s_resgid != 0) && in_group_p(sbi->s_resgid)) ||
-	    capable(CAP_SYS_RESOURCE)) {
+	    capable_nolog(CAP_SYS_RESOURCE)) {
 		if (free_blocks >= (nblocks + dirty_blocks))
 			return 1;
 	}
diff -uriN linux-2.6.32.43/fs/ext4/ext4.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/ext4.h
--- linux-2.6.32.43/fs/ext4/ext4.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/ext4.h	2011-07-15 05:51:18.000000000 -0500
@@ -289,8 +289,12 @@
 #define EXT4_EXTENTS_FL			0x00080000 /* Inode uses extents */
 #define EXT4_EA_INODE_FL	        0x00200000 /* Inode used for large EA */
 #define EXT4_EOFBLOCKS_FL		0x00400000 /* Blocks allocated beyond EOF */
+#define EXT4_IXUNLINK_FL		0x08000000 /* Immutable invert on unlink */
 #define EXT4_RESERVED_FL		0x80000000 /* reserved for ext4 lib */
 
+#define EXT4_BARRIER_FL			0x04000000 /* Barrier for chroot() */
+#define EXT4_COW_FL			0x20000000 /* Copy on Write marker */
+
 #define EXT4_FL_USER_VISIBLE		0x004BDFFF /* User visible flags */
 #define EXT4_FL_USER_MODIFIABLE		0x004B80FF /* User modifiable flags */
 
@@ -552,7 +556,8 @@
 			__le16	l_i_file_acl_high;
 			__le16	l_i_uid_high;	/* these 2 fields */
 			__le16	l_i_gid_high;	/* were reserved2[0] */
-			__u32	l_i_reserved2;
+			__le16	l_i_tag;	/* Context Tag */
+			__u16	l_i_reserved2;
 		} linux2;
 		struct {
 			__le16	h_i_reserved1;	/* Obsoleted fragment number/size which are removed in ext4 */
@@ -666,6 +671,7 @@
 #define i_gid_low	i_gid
 #define i_uid_high	osd2.linux2.l_i_uid_high
 #define i_gid_high	osd2.linux2.l_i_gid_high
+#define i_raw_tag	osd2.linux2.l_i_tag
 #define i_reserved2	osd2.linux2.l_i_reserved2
 
 #elif defined(__GNU__)
@@ -840,6 +846,7 @@
 #define EXT4_MOUNT_QUOTA		0x80000 /* Some quota option set */
 #define EXT4_MOUNT_USRQUOTA		0x100000 /* "old" user quota */
 #define EXT4_MOUNT_GRPQUOTA		0x200000 /* "old" group quota */
+#define EXT4_MOUNT_TAGGED		0x400000 /* Enable Context Tags */
 #define EXT4_MOUNT_JOURNAL_CHECKSUM	0x800000 /* Journal checksums */
 #define EXT4_MOUNT_JOURNAL_ASYNC_COMMIT	0x1000000 /* Journal Async Commit */
 #define EXT4_MOUNT_I_VERSION            0x2000000 /* i_version support */
@@ -1078,19 +1085,19 @@
 
 	/* stats for buddy allocator */
 	spinlock_t s_mb_pa_lock;
-	atomic_t s_bal_reqs;	/* number of reqs with len > 1 */
-	atomic_t s_bal_success;	/* we found long enough chunks */
-	atomic_t s_bal_allocated;	/* in blocks */
-	atomic_t s_bal_ex_scanned;	/* total extents scanned */
-	atomic_t s_bal_goals;	/* goal hits */
-	atomic_t s_bal_breaks;	/* too long searches */
-	atomic_t s_bal_2orders;	/* 2^order hits */
+	atomic_unchecked_t s_bal_reqs;	/* number of reqs with len > 1 */
+	atomic_unchecked_t s_bal_success;	/* we found long enough chunks */
+	atomic_unchecked_t s_bal_allocated;	/* in blocks */
+	atomic_unchecked_t s_bal_ex_scanned;	/* total extents scanned */
+	atomic_unchecked_t s_bal_goals;	/* goal hits */
+	atomic_unchecked_t s_bal_breaks;	/* too long searches */
+	atomic_unchecked_t s_bal_2orders;	/* 2^order hits */
 	spinlock_t s_bal_lock;
 	unsigned long s_mb_buddies_generated;
 	unsigned long long s_mb_generation_time;
-	atomic_t s_mb_lost_chunks;
-	atomic_t s_mb_preallocated;
-	atomic_t s_mb_discarded;
+	atomic_unchecked_t s_mb_lost_chunks;
+	atomic_unchecked_t s_mb_preallocated;
+	atomic_unchecked_t s_mb_discarded;
 	atomic_t s_lock_busy;
 
 	/* locality groups */
@@ -1865,6 +1872,7 @@
 			   struct buffer_head *bh, int flags);
 extern int ext4_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 			__u64 start, __u64 len);
+extern int ext4_sync_flags(struct inode *, int, int);
 /* move_extent.c */
 extern int ext4_move_extents(struct file *o_filp, struct file *d_filp,
 			     __u64 start_orig, __u64 start_donor,
diff -uriN linux-2.6.32.43/fs/ext4/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/file.c
--- linux-2.6.32.43/fs/ext4/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/file.c	2011-07-15 05:50:11.000000000 -0500
@@ -161,5 +161,6 @@
 	.check_acl	= ext4_check_acl,
 	.fallocate	= ext4_fallocate,
 	.fiemap		= ext4_fiemap,
+	.sync_flags	= ext4_sync_flags,
 };
 
diff -uriN linux-2.6.32.43/fs/ext4/ialloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/ialloc.c
--- linux-2.6.32.43/fs/ext4/ialloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/ialloc.c	2011-07-15 05:50:11.000000000 -0500
@@ -22,6 +22,7 @@
 #include <linux/random.h>
 #include <linux/bitops.h>
 #include <linux/blkdev.h>
+#include <linux/vs_tag.h>
 #include <asm/byteorder.h>
 
 #include "ext4.h"
@@ -988,6 +989,7 @@
 	} else
 		inode->i_gid = current_fsgid();
 	inode->i_mode = mode;
+	inode->i_tag = dx_current_fstag(sb);
 
 	inode->i_ino = ino + group * EXT4_INODES_PER_GROUP(sb);
 	/* This is the optimal IO size (for stat), not the fs block size */
diff -uriN linux-2.6.32.43/fs/ext4/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/inode.c
--- linux-2.6.32.43/fs/ext4/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -38,6 +38,7 @@
 #include <linux/uio.h>
 #include <linux/bio.h>
 #include <linux/workqueue.h>
+#include <linux/vs_tag.h>
 
 #include "ext4_jbd2.h"
 #include "xattr.h"
@@ -4446,7 +4447,7 @@
 
 int ext4_can_truncate(struct inode *inode)
 {
-	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
+	if (IS_APPEND(inode) || IS_IXORUNLINK(inode))
 		return 0;
 	if (S_ISREG(inode->i_mode))
 		return 1;
@@ -4799,41 +4800,64 @@
 {
 	unsigned int flags = EXT4_I(inode)->i_flags;
 
-	inode->i_flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
+	inode->i_flags &= ~(S_IMMUTABLE | S_IXUNLINK |
+		S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
+
+	if (flags & EXT4_IMMUTABLE_FL)
+		inode->i_flags |= S_IMMUTABLE;
+	if (flags & EXT4_IXUNLINK_FL)
+		inode->i_flags |= S_IXUNLINK;
+
 	if (flags & EXT4_SYNC_FL)
 		inode->i_flags |= S_SYNC;
 	if (flags & EXT4_APPEND_FL)
 		inode->i_flags |= S_APPEND;
-	if (flags & EXT4_IMMUTABLE_FL)
-		inode->i_flags |= S_IMMUTABLE;
 	if (flags & EXT4_NOATIME_FL)
 		inode->i_flags |= S_NOATIME;
 	if (flags & EXT4_DIRSYNC_FL)
 		inode->i_flags |= S_DIRSYNC;
+
+	inode->i_vflags &= ~(V_BARRIER | V_COW);
+
+	if (flags & EXT4_BARRIER_FL)
+		inode->i_vflags |= V_BARRIER;
+	if (flags & EXT4_COW_FL)
+		inode->i_vflags |= V_COW;
 }
 
 /* Propagate flags from i_flags to EXT4_I(inode)->i_flags */
 void ext4_get_inode_flags(struct ext4_inode_info *ei)
 {
-	unsigned int vfs_fl;
+	unsigned int vfs_fl, vflags;
 	unsigned long old_fl, new_fl;
 
 	do {
 		vfs_fl = ei->vfs_inode.i_flags;
+		vflags = ei->vfs_inode.i_vflags;
 		old_fl = ei->i_flags;
-		new_fl = old_fl & ~(EXT4_SYNC_FL|EXT4_APPEND_FL|
-				EXT4_IMMUTABLE_FL|EXT4_NOATIME_FL|
-				EXT4_DIRSYNC_FL);
+		new_fl = old_fl & ~(EXT4_SYNC_FL | EXT4_APPEND_FL |
+				EXT4_IMMUTABLE_FL | EXT4_IXUNLINK_FL |
+				EXT4_NOATIME_FL | EXT4_DIRSYNC_FL |
+				EXT4_BARRIER_FL | EXT4_COW_FL);
+
+		if (vfs_fl & S_IMMUTABLE)
+			new_fl |= EXT4_IMMUTABLE_FL;
+		if (vfs_fl & S_IXUNLINK)
+			new_fl |= EXT4_IXUNLINK_FL;
+
 		if (vfs_fl & S_SYNC)
 			new_fl |= EXT4_SYNC_FL;
 		if (vfs_fl & S_APPEND)
 			new_fl |= EXT4_APPEND_FL;
-		if (vfs_fl & S_IMMUTABLE)
-			new_fl |= EXT4_IMMUTABLE_FL;
 		if (vfs_fl & S_NOATIME)
 			new_fl |= EXT4_NOATIME_FL;
 		if (vfs_fl & S_DIRSYNC)
 			new_fl |= EXT4_DIRSYNC_FL;
+
+		if (vflags & V_BARRIER)
+			new_fl |= EXT4_BARRIER_FL;
+		if (vflags & V_COW)
+			new_fl |= EXT4_COW_FL;
 	} while (cmpxchg(&ei->i_flags, old_fl, new_fl) != old_fl);
 }
 
@@ -4869,6 +4893,8 @@
 	journal_t *journal = EXT4_SB(sb)->s_journal;
 	long ret;
 	int block;
+	uid_t uid;
+	gid_t gid;
 
 	inode = iget_locked(sb, ino);
 	if (!inode)
@@ -4884,12 +4910,16 @@
 		goto bad_inode;
 	raw_inode = ext4_raw_inode(&iloc);
 	inode->i_mode = le16_to_cpu(raw_inode->i_mode);
-	inode->i_uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
-	inode->i_gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low);
+	uid = (uid_t)le16_to_cpu(raw_inode->i_uid_low);
+	gid = (gid_t)le16_to_cpu(raw_inode->i_gid_low);
 	if (!(test_opt(inode->i_sb, NO_UID32))) {
-		inode->i_uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
-		inode->i_gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
+		uid |= le16_to_cpu(raw_inode->i_uid_high) << 16;
+		gid |= le16_to_cpu(raw_inode->i_gid_high) << 16;
 	}
+	inode->i_uid = INOTAG_UID(DX_TAG(inode), uid, gid);
+	inode->i_gid = INOTAG_GID(DX_TAG(inode), uid, gid);
+	inode->i_tag = INOTAG_TAG(DX_TAG(inode), uid, gid,
+		le16_to_cpu(raw_inode->i_raw_tag));
 	inode->i_nlink = le16_to_cpu(raw_inode->i_links_count);
 
 	ei->i_state_flags = 0;
@@ -5111,6 +5141,8 @@
 	struct ext4_inode *raw_inode = ext4_raw_inode(iloc);
 	struct ext4_inode_info *ei = EXT4_I(inode);
 	struct buffer_head *bh = iloc->bh;
+	uid_t uid = TAGINO_UID(DX_TAG(inode), inode->i_uid, inode->i_tag);
+	gid_t gid = TAGINO_GID(DX_TAG(inode), inode->i_gid, inode->i_tag);
 	int err = 0, rc, block;
 
 	/* For fields not not tracking in the in-memory inode,
@@ -5121,29 +5153,32 @@
 	ext4_get_inode_flags(ei);
 	raw_inode->i_mode = cpu_to_le16(inode->i_mode);
 	if (!(test_opt(inode->i_sb, NO_UID32))) {
-		raw_inode->i_uid_low = cpu_to_le16(low_16_bits(inode->i_uid));
-		raw_inode->i_gid_low = cpu_to_le16(low_16_bits(inode->i_gid));
+		raw_inode->i_uid_low = cpu_to_le16(low_16_bits(uid));
+		raw_inode->i_gid_low = cpu_to_le16(low_16_bits(gid));
 /*
  * Fix up interoperability with old kernels. Otherwise, old inodes get
  * re-used with the upper 16 bits of the uid/gid intact
  */
 		if (!ei->i_dtime) {
 			raw_inode->i_uid_high =
-				cpu_to_le16(high_16_bits(inode->i_uid));
+				cpu_to_le16(high_16_bits(uid));
 			raw_inode->i_gid_high =
-				cpu_to_le16(high_16_bits(inode->i_gid));
+				cpu_to_le16(high_16_bits(gid));
 		} else {
 			raw_inode->i_uid_high = 0;
 			raw_inode->i_gid_high = 0;
 		}
 	} else {
 		raw_inode->i_uid_low =
-			cpu_to_le16(fs_high2lowuid(inode->i_uid));
+			cpu_to_le16(fs_high2lowuid(uid));
 		raw_inode->i_gid_low =
-			cpu_to_le16(fs_high2lowgid(inode->i_gid));
+			cpu_to_le16(fs_high2lowgid(gid));
 		raw_inode->i_uid_high = 0;
 		raw_inode->i_gid_high = 0;
 	}
+#ifdef CONFIG_TAGGING_INTERN
+	raw_inode->i_raw_tag = cpu_to_le16(inode->i_tag);
+#endif
 	raw_inode->i_links_count = cpu_to_le16(inode->i_nlink);
 
 	EXT4_INODE_SET_XTIME(i_ctime, inode, raw_inode);
@@ -5329,7 +5364,8 @@
 		return error;
 
 	if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
-		(ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) {
+		(ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid) ||
+		(ia_valid & ATTR_TAG && attr->ia_tag != inode->i_tag)) {
 		handle_t *handle;
 
 		/* (user+group)*(old+new) structure, inode write (sb,
@@ -5351,6 +5387,8 @@
 			inode->i_uid = attr->ia_uid;
 		if (attr->ia_valid & ATTR_GID)
 			inode->i_gid = attr->ia_gid;
+		if ((attr->ia_valid & ATTR_TAG) && IS_TAGGED(inode))
+			inode->i_tag = attr->ia_tag;
 		error = ext4_mark_inode_dirty(handle, inode);
 		ext4_journal_stop(handle);
 	}
diff -uriN linux-2.6.32.43/fs/ext4/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/ioctl.c
--- linux-2.6.32.43/fs/ext4/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/ioctl.c	2011-07-15 05:50:11.000000000 -0500
@@ -14,10 +14,39 @@
 #include <linux/compat.h>
 #include <linux/mount.h>
 #include <linux/file.h>
+#include <linux/vs_tag.h>
 #include <asm/uaccess.h>
 #include "ext4_jbd2.h"
 #include "ext4.h"
 
+
+int ext4_sync_flags(struct inode *inode, int flags, int vflags)
+{
+	handle_t *handle = NULL;
+	struct ext4_iloc iloc;
+	int err;
+
+	handle = ext4_journal_start(inode, 1);
+	if (IS_ERR(handle))
+		return PTR_ERR(handle);
+
+	if (IS_SYNC(inode))
+		ext4_handle_sync(handle);
+	err = ext4_reserve_inode_write(handle, inode, &iloc);
+	if (err)
+		goto flags_err;
+
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+	ext4_get_inode_flags(EXT4_I(inode));
+	inode->i_ctime = ext4_current_time(inode);
+
+	err = ext4_mark_iloc_dirty(handle, inode, &iloc);
+flags_err:
+	ext4_journal_stop(handle);
+	return err;
+}
+
 long ext4_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	struct inode *inode = filp->f_dentry->d_inode;
@@ -50,6 +79,11 @@
 
 		flags = ext4_mask_flags(inode->i_mode, flags);
 
+		if (IS_BARRIER(inode)) {
+			vxwprintk_task(1, "messing with the barrier.");
+			return -EACCES;
+		}
+
 		err = -EPERM;
 		mutex_lock(&inode->i_mutex);
 		/* Is it quota file? Do not allow user to mess with it */
@@ -67,7 +101,9 @@
 		 *
 		 * This test looks nicer. Thanks to Pauline Middelink
 		 */
-		if ((flags ^ oldflags) & (EXT4_APPEND_FL | EXT4_IMMUTABLE_FL)) {
+		if ((oldflags & EXT4_IMMUTABLE_FL) ||
+			((flags ^ oldflags) & (EXT4_APPEND_FL |
+			EXT4_IMMUTABLE_FL | EXT4_IXUNLINK_FL))) {
 			if (!capable(CAP_LINUX_IMMUTABLE))
 				goto flags_out;
 		}
diff -uriN linux-2.6.32.43/fs/ext4/mballoc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/mballoc.c
--- linux-2.6.32.43/fs/ext4/mballoc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/mballoc.c	2011-07-15 05:51:18.000000000 -0500
@@ -1755,7 +1755,7 @@
 		BUG_ON(ac->ac_b_ex.fe_len != ac->ac_g_ex.fe_len);
 
 		if (EXT4_SB(sb)->s_mb_stats)
-			atomic_inc(&EXT4_SB(sb)->s_bal_2orders);
+			atomic_inc_unchecked(&EXT4_SB(sb)->s_bal_2orders);
 
 		break;
 	}
@@ -2131,7 +2131,7 @@
 			ac->ac_status = AC_STATUS_CONTINUE;
 			ac->ac_flags |= EXT4_MB_HINT_FIRST;
 			cr = 3;
-			atomic_inc(&sbi->s_mb_lost_chunks);
+			atomic_inc_unchecked(&sbi->s_mb_lost_chunks);
 			goto repeat;
 		}
 	}
@@ -2174,6 +2174,8 @@
 		ext4_grpblk_t counters[16];
 	} sg;
 
+	pax_track_stack();
+
 	group--;
 	if (group == 0)
 		seq_printf(seq, "#%-5s: %-5s %-5s %-5s "
@@ -2534,25 +2536,25 @@
 	if (sbi->s_mb_stats) {
 		printk(KERN_INFO
 		       "EXT4-fs: mballoc: %u blocks %u reqs (%u success)\n",
-				atomic_read(&sbi->s_bal_allocated),
-				atomic_read(&sbi->s_bal_reqs),
-				atomic_read(&sbi->s_bal_success));
+				atomic_read_unchecked(&sbi->s_bal_allocated),
+				atomic_read_unchecked(&sbi->s_bal_reqs),
+				atomic_read_unchecked(&sbi->s_bal_success));
 		printk(KERN_INFO
 		      "EXT4-fs: mballoc: %u extents scanned, %u goal hits, "
 				"%u 2^N hits, %u breaks, %u lost\n",
-				atomic_read(&sbi->s_bal_ex_scanned),
-				atomic_read(&sbi->s_bal_goals),
-				atomic_read(&sbi->s_bal_2orders),
-				atomic_read(&sbi->s_bal_breaks),
-				atomic_read(&sbi->s_mb_lost_chunks));
+				atomic_read_unchecked(&sbi->s_bal_ex_scanned),
+				atomic_read_unchecked(&sbi->s_bal_goals),
+				atomic_read_unchecked(&sbi->s_bal_2orders),
+				atomic_read_unchecked(&sbi->s_bal_breaks),
+				atomic_read_unchecked(&sbi->s_mb_lost_chunks));
 		printk(KERN_INFO
 		       "EXT4-fs: mballoc: %lu generated and it took %Lu\n",
 				sbi->s_mb_buddies_generated++,
 				sbi->s_mb_generation_time);
 		printk(KERN_INFO
 		       "EXT4-fs: mballoc: %u preallocated, %u discarded\n",
-				atomic_read(&sbi->s_mb_preallocated),
-				atomic_read(&sbi->s_mb_discarded));
+				atomic_read_unchecked(&sbi->s_mb_preallocated),
+				atomic_read_unchecked(&sbi->s_mb_discarded));
 	}
 
 	free_percpu(sbi->s_locality_groups);
@@ -3034,16 +3036,16 @@
 	struct ext4_sb_info *sbi = EXT4_SB(ac->ac_sb);
 
 	if (sbi->s_mb_stats && ac->ac_g_ex.fe_len > 1) {
-		atomic_inc(&sbi->s_bal_reqs);
-		atomic_add(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
+		atomic_inc_unchecked(&sbi->s_bal_reqs);
+		atomic_add_unchecked(ac->ac_b_ex.fe_len, &sbi->s_bal_allocated);
 		if (ac->ac_o_ex.fe_len >= ac->ac_g_ex.fe_len)
-			atomic_inc(&sbi->s_bal_success);
-		atomic_add(ac->ac_found, &sbi->s_bal_ex_scanned);
+			atomic_inc_unchecked(&sbi->s_bal_success);
+		atomic_add_unchecked(ac->ac_found, &sbi->s_bal_ex_scanned);
 		if (ac->ac_g_ex.fe_start == ac->ac_b_ex.fe_start &&
 				ac->ac_g_ex.fe_group == ac->ac_b_ex.fe_group)
-			atomic_inc(&sbi->s_bal_goals);
+			atomic_inc_unchecked(&sbi->s_bal_goals);
 		if (ac->ac_found > sbi->s_mb_max_to_scan)
-			atomic_inc(&sbi->s_bal_breaks);
+			atomic_inc_unchecked(&sbi->s_bal_breaks);
 	}
 
 	if (ac->ac_op == EXT4_MB_HISTORY_ALLOC)
@@ -3443,7 +3445,7 @@
 	trace_ext4_mb_new_inode_pa(ac, pa);
 
 	ext4_mb_use_inode_pa(ac, pa);
-	atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
+	atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
 
 	ei = EXT4_I(ac->ac_inode);
 	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
@@ -3503,7 +3505,7 @@
 	trace_ext4_mb_new_group_pa(ac, pa);
 
 	ext4_mb_use_group_pa(ac, pa);
-	atomic_add(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
+	atomic_add_unchecked(pa->pa_free, &EXT4_SB(sb)->s_mb_preallocated);
 
 	grp = ext4_get_group_info(sb, ac->ac_b_ex.fe_group);
 	lg = ac->ac_lg;
@@ -3607,7 +3609,7 @@
 		 * from the bitmap and continue.
 		 */
 	}
-	atomic_add(free, &sbi->s_mb_discarded);
+	atomic_add_unchecked(free, &sbi->s_mb_discarded);
 
 	return err;
 }
@@ -3626,7 +3628,7 @@
 	ext4_get_group_no_and_offset(sb, pa->pa_pstart, &group, &bit);
 	BUG_ON(group != e4b->bd_group && pa->pa_len != 0);
 	mb_free_blocks(pa->pa_inode, e4b, bit, pa->pa_len);
-	atomic_add(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
+	atomic_add_unchecked(pa->pa_len, &EXT4_SB(sb)->s_mb_discarded);
 
 	if (ac) {
 		ac->ac_sb = sb;
diff -uriN linux-2.6.32.43/fs/ext4/namei.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/namei.c
--- linux-2.6.32.43/fs/ext4/namei.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/namei.c	2011-07-15 05:50:11.000000000 -0500
@@ -34,6 +34,7 @@
 #include <linux/quotaops.h>
 #include <linux/buffer_head.h>
 #include <linux/bio.h>
+#include <linux/vs_tag.h>
 #include "ext4.h"
 #include "ext4_jbd2.h"
 
@@ -941,6 +942,7 @@
 				if (bh)
 					ll_rw_block(READ_META, 1, &bh);
 			}
+		dx_propagate_tag(nd, inode);
 		}
 		if ((bh = bh_use[ra_ptr++]) == NULL)
 			goto next;
@@ -2543,6 +2545,7 @@
 #endif
 	.check_acl	= ext4_check_acl,
 	.fiemap         = ext4_fiemap,
+	.sync_flags	= ext4_sync_flags,
 };
 
 const struct inode_operations ext4_special_inode_operations = {
diff -uriN linux-2.6.32.43/fs/ext4/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/super.c
--- linux-2.6.32.43/fs/ext4/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ext4/super.c	2011-07-15 05:51:18.000000000 -0500
@@ -1100,6 +1100,7 @@
 	Opt_block_validity, Opt_noblock_validity,
 	Opt_inode_readahead_blks, Opt_journal_ioprio,
 	Opt_discard, Opt_nodiscard,
+	Opt_tag, Opt_notag, Opt_tagid
 };
 
 static const match_table_t tokens = {
@@ -1167,6 +1168,9 @@
 	{Opt_noauto_da_alloc, "noauto_da_alloc"},
 	{Opt_discard, "discard"},
 	{Opt_nodiscard, "nodiscard"},
+	{Opt_tag, "tag"},
+	{Opt_notag, "notag"},
+	{Opt_tagid, "tagid=%u"},
 	{Opt_err, NULL},
 };
 
@@ -1269,6 +1273,20 @@
 		case Opt_nouid32:
 			set_opt(sbi->s_mount_opt, NO_UID32);
 			break;
+#ifndef CONFIG_TAGGING_NONE
+		case Opt_tag:
+			set_opt (sbi->s_mount_opt, TAGGED);
+			break;
+		case Opt_notag:
+			clear_opt (sbi->s_mount_opt, TAGGED);
+			break;
+#endif
+#ifdef CONFIG_PROPAGATE
+		case Opt_tagid:
+			/* use args[0] */
+			set_opt (sbi->s_mount_opt, TAGGED);
+			break;
+#endif
 		case Opt_debug:
 			set_opt(sbi->s_mount_opt, DEBUG);
 			break;
@@ -2287,7 +2305,7 @@
 }
 
 
-static struct sysfs_ops ext4_attr_ops = {
+static const struct sysfs_ops ext4_attr_ops = {
 	.show	= ext4_attr_show,
 	.store	= ext4_attr_store,
 };
@@ -2471,6 +2489,9 @@
 			   &journal_ioprio, NULL, 0))
 		goto failed_mount;
 
+	if (EXT4_SB(sb)->s_mount_opt & EXT4_MOUNT_TAGGED)
+		sb->s_flags |= MS_TAGGED;
+
 	sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
 		((sbi->s_mount_opt & EXT4_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
 
@@ -3522,6 +3543,14 @@
 	if (sbi->s_mount_flags & EXT4_MF_FS_ABORTED)
 		ext4_abort(sb, __func__, "Abort forced by user");
 
+	if ((sbi->s_mount_opt & EXT4_MOUNT_TAGGED) &&
+		!(sb->s_flags & MS_TAGGED)) {
+		printk("EXT4-fs: %s: tagging not permitted on remount.\n",
+			sb->s_id);
+		err = -EINVAL;
+		goto restore_opts;
+	}
+
 	sb->s_flags = (sb->s_flags & ~MS_POSIXACL) |
 		((sbi->s_mount_opt & EXT4_MOUNT_POSIX_ACL) ? MS_POSIXACL : 0);
 
diff -uriN linux-2.6.32.43/fs/fcntl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fcntl.c
--- linux-2.6.32.43/fs/fcntl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fcntl.c	2011-07-15 05:51:18.000000000 -0500
@@ -19,6 +19,7 @@
 #include <linux/signal.h>
 #include <linux/rcupdate.h>
 #include <linux/pid_namespace.h>
+#include <linux/vs_limit.h>
 
 #include <asm/poll.h>
 #include <asm/siginfo.h>
@@ -102,6 +103,8 @@
 
 	if (tofree)
 		filp_close(tofree, files);
+	else
+		vx_openfd_inc(newfd);	/* fd was unused */
 
 	return newfd;
 
@@ -223,6 +226,11 @@
 	if (err)
 		return err;
 
+	if (gr_handle_chroot_fowner(pid, type))
+		return -ENOENT;
+	if (gr_check_protected_task_fowner(pid, type))
+		return -EACCES;
+
 	f_modown(filp, pid, type, force);
 	return 0;
 }
@@ -344,6 +352,7 @@
 	switch (cmd) {
 	case F_DUPFD:
 	case F_DUPFD_CLOEXEC:
+		gr_learn_resource(current, RLIMIT_NOFILE, arg, 0);
 		if (arg >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
 			break;
 		err = alloc_fd(arg, cmd == F_DUPFD_CLOEXEC ? O_CLOEXEC : 0);
@@ -426,6 +435,8 @@
 	filp = fget(fd);
 	if (!filp)
 		goto out;
+	if (!vx_files_avail(1))
+		goto out;
 
 	err = security_file_fcntl(filp, cmd, arg);
 	if (err) {
diff -uriN linux-2.6.32.43/fs/fifo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fifo.c
--- linux-2.6.32.43/fs/fifo.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fifo.c	2011-07-15 05:51:18.000000000 -0500
@@ -59,10 +59,10 @@
 	 */
 		filp->f_op = &read_pipefifo_fops;
 		pipe->r_counter++;
-		if (pipe->readers++ == 0)
+		if (atomic_inc_return(&pipe->readers) == 1)
 			wake_up_partner(inode);
 
-		if (!pipe->writers) {
+		if (!atomic_read(&pipe->writers)) {
 			if ((filp->f_flags & O_NONBLOCK)) {
 				/* suppress POLLHUP until we have
 				 * seen a writer */
@@ -83,15 +83,15 @@
 	 *  errno=ENXIO when there is no process reading the FIFO.
 	 */
 		ret = -ENXIO;
-		if ((filp->f_flags & O_NONBLOCK) && !pipe->readers)
+		if ((filp->f_flags & O_NONBLOCK) && !atomic_read(&pipe->readers))
 			goto err;
 
 		filp->f_op = &write_pipefifo_fops;
 		pipe->w_counter++;
-		if (!pipe->writers++)
+		if (atomic_inc_return(&pipe->writers) == 1)
 			wake_up_partner(inode);
 
-		if (!pipe->readers) {
+		if (!atomic_read(&pipe->readers)) {
 			wait_for_partner(inode, &pipe->r_counter);
 			if (signal_pending(current))
 				goto err_wr;
@@ -107,11 +107,11 @@
 	 */
 		filp->f_op = &rdwr_pipefifo_fops;
 
-		pipe->readers++;
-		pipe->writers++;
+		atomic_inc(&pipe->readers);
+		atomic_inc(&pipe->writers);
 		pipe->r_counter++;
 		pipe->w_counter++;
-		if (pipe->readers == 1 || pipe->writers == 1)
+		if (atomic_read(&pipe->readers) == 1 || atomic_read(&pipe->writers) == 1)
 			wake_up_partner(inode);
 		break;
 
@@ -125,19 +125,19 @@
 	return 0;
 
 err_rd:
-	if (!--pipe->readers)
+	if (atomic_dec_and_test(&pipe->readers))
 		wake_up_interruptible(&pipe->wait);
 	ret = -ERESTARTSYS;
 	goto err;
 
 err_wr:
-	if (!--pipe->writers)
+	if (atomic_dec_and_test(&pipe->writers))
 		wake_up_interruptible(&pipe->wait);
 	ret = -ERESTARTSYS;
 	goto err;
 
 err:
-	if (!pipe->readers && !pipe->writers)
+	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers))
 		free_pipe_info(inode);
 
 err_nocleanup:
diff -uriN linux-2.6.32.43/fs/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/file.c
--- linux-2.6.32.43/fs/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/file.c	2011-07-15 05:51:18.000000000 -0500
@@ -14,12 +14,14 @@
 #include <linux/slab.h>
 #include <linux/vmalloc.h>
 #include <linux/file.h>
+#include <linux/security.h>
 #include <linux/fdtable.h>
 #include <linux/bitops.h>
 #include <linux/interrupt.h>
 #include <linux/spinlock.h>
 #include <linux/rcupdate.h>
 #include <linux/workqueue.h>
+#include <linux/vs_limit.h>
 
 struct fdtable_defer {
 	spinlock_t lock;
@@ -257,6 +259,8 @@
 	 * N.B. For clone tasks sharing a files structure, this test
 	 * will limit the total number of files that can be opened.
 	 */
+
+	gr_learn_resource(current, RLIMIT_NOFILE, nr, 0);
 	if (nr >= current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
 		return -EMFILE;
 
@@ -368,6 +372,8 @@
 		struct file *f = *old_fds++;
 		if (f) {
 			get_file(f);
+			/* TODO: sum it first for check and performance */
+			vx_openfd_inc(open_files - i);
 		} else {
 			/*
 			 * The fd may be claimed in the fd bitmap but not yet
@@ -476,6 +482,7 @@
 	else
 		FD_CLR(fd, fdt->close_on_exec);
 	error = fd;
+	vx_openfd_inc(fd);
 #if 1
 	/* Sanity check */
 	if (rcu_dereference(fdt->fd[fd]) != NULL) {
diff -uriN linux-2.6.32.43/fs/filesystems.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/filesystems.c
--- linux-2.6.32.43/fs/filesystems.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/filesystems.c	2011-07-15 05:51:18.000000000 -0500
@@ -272,7 +272,12 @@
 	int len = dot ? dot - name : strlen(name);
 
 	fs = __get_fs_type(name, len);
+
+#ifdef CONFIG_GRKERNSEC_MODHARDEN
+	if (!fs && (___request_module(true, "grsec_modharden_fs", "%.*s", len, name) == 0))
+#else
 	if (!fs && (request_module("%.*s", len, name) == 0))
+#endif
 		fs = __get_fs_type(name, len);
 
 	if (dot && fs && !(fs->fs_flags & FS_HAS_SUBTYPE)) {
diff -uriN linux-2.6.32.43/fs/file_table.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/file_table.c
--- linux-2.6.32.43/fs/file_table.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/file_table.c	2011-07-15 05:50:11.000000000 -0500
@@ -22,6 +22,8 @@
 #include <linux/fsnotify.h>
 #include <linux/sysctl.h>
 #include <linux/percpu_counter.h>
+#include <linux/vs_limit.h>
+#include <linux/vs_context.h>
 
 #include <asm/atomic.h>
 
@@ -131,6 +133,8 @@
 	spin_lock_init(&f->f_lock);
 	eventpoll_init_file(f);
 	/* f->f_version: 0 */
+	f->f_xid = vx_current_xid();
+	vx_files_inc(f);
 	return f;
 
 over:
@@ -285,6 +289,8 @@
 		cdev_put(inode->i_cdev);
 	fops_put(file->f_op);
 	put_pid(file->f_owner.pid);
+	vx_files_dec(file);
+	file->f_xid = 0;
 	file_kill(file);
 	if (file->f_mode & FMODE_WRITE)
 		drop_file_write_access(file);
@@ -352,6 +358,8 @@
 {
 	if (atomic_long_dec_and_test(&file->f_count)) {
 		security_file_free(file);
+		vx_files_dec(file);
+		file->f_xid = 0;
 		file_kill(file);
 		file_free(file);
 	}
diff -uriN linux-2.6.32.43/fs/fscache/cookie.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/cookie.c
--- linux-2.6.32.43/fs/fscache/cookie.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/cookie.c	2011-07-15 05:51:18.000000000 -0500
@@ -68,11 +68,11 @@
 	       parent ? (char *) parent->def->name : "<no-parent>",
 	       def->name, netfs_data);
 
-	fscache_stat(&fscache_n_acquires);
+	fscache_stat_unchecked(&fscache_n_acquires);
 
 	/* if there's no parent cookie, then we don't create one here either */
 	if (!parent) {
-		fscache_stat(&fscache_n_acquires_null);
+		fscache_stat_unchecked(&fscache_n_acquires_null);
 		_leave(" [no parent]");
 		return NULL;
 	}
@@ -87,7 +87,7 @@
 	/* allocate and initialise a cookie */
 	cookie = kmem_cache_alloc(fscache_cookie_jar, GFP_KERNEL);
 	if (!cookie) {
-		fscache_stat(&fscache_n_acquires_oom);
+		fscache_stat_unchecked(&fscache_n_acquires_oom);
 		_leave(" [ENOMEM]");
 		return NULL;
 	}
@@ -109,13 +109,13 @@
 
 	switch (cookie->def->type) {
 	case FSCACHE_COOKIE_TYPE_INDEX:
-		fscache_stat(&fscache_n_cookie_index);
+		fscache_stat_unchecked(&fscache_n_cookie_index);
 		break;
 	case FSCACHE_COOKIE_TYPE_DATAFILE:
-		fscache_stat(&fscache_n_cookie_data);
+		fscache_stat_unchecked(&fscache_n_cookie_data);
 		break;
 	default:
-		fscache_stat(&fscache_n_cookie_special);
+		fscache_stat_unchecked(&fscache_n_cookie_special);
 		break;
 	}
 
@@ -126,13 +126,13 @@
 		if (fscache_acquire_non_index_cookie(cookie) < 0) {
 			atomic_dec(&parent->n_children);
 			__fscache_cookie_put(cookie);
-			fscache_stat(&fscache_n_acquires_nobufs);
+			fscache_stat_unchecked(&fscache_n_acquires_nobufs);
 			_leave(" = NULL");
 			return NULL;
 		}
 	}
 
-	fscache_stat(&fscache_n_acquires_ok);
+	fscache_stat_unchecked(&fscache_n_acquires_ok);
 	_leave(" = %p", cookie);
 	return cookie;
 }
@@ -168,7 +168,7 @@
 	cache = fscache_select_cache_for_object(cookie->parent);
 	if (!cache) {
 		up_read(&fscache_addremove_sem);
-		fscache_stat(&fscache_n_acquires_no_cache);
+		fscache_stat_unchecked(&fscache_n_acquires_no_cache);
 		_leave(" = -ENOMEDIUM [no cache]");
 		return -ENOMEDIUM;
 	}
@@ -256,12 +256,12 @@
 	object = cache->ops->alloc_object(cache, cookie);
 	fscache_stat_d(&fscache_n_cop_alloc_object);
 	if (IS_ERR(object)) {
-		fscache_stat(&fscache_n_object_no_alloc);
+		fscache_stat_unchecked(&fscache_n_object_no_alloc);
 		ret = PTR_ERR(object);
 		goto error;
 	}
 
-	fscache_stat(&fscache_n_object_alloc);
+	fscache_stat_unchecked(&fscache_n_object_alloc);
 
 	object->debug_id = atomic_inc_return(&fscache_object_debug_id);
 
@@ -377,10 +377,10 @@
 	struct fscache_object *object;
 	struct hlist_node *_p;
 
-	fscache_stat(&fscache_n_updates);
+	fscache_stat_unchecked(&fscache_n_updates);
 
 	if (!cookie) {
-		fscache_stat(&fscache_n_updates_null);
+		fscache_stat_unchecked(&fscache_n_updates_null);
 		_leave(" [no cookie]");
 		return;
 	}
@@ -414,12 +414,12 @@
 	struct fscache_object *object;
 	unsigned long event;
 
-	fscache_stat(&fscache_n_relinquishes);
+	fscache_stat_unchecked(&fscache_n_relinquishes);
 	if (retire)
-		fscache_stat(&fscache_n_relinquishes_retire);
+		fscache_stat_unchecked(&fscache_n_relinquishes_retire);
 
 	if (!cookie) {
-		fscache_stat(&fscache_n_relinquishes_null);
+		fscache_stat_unchecked(&fscache_n_relinquishes_null);
 		_leave(" [no cookie]");
 		return;
 	}
@@ -435,7 +435,7 @@
 
 	/* wait for the cookie to finish being instantiated (or to fail) */
 	if (test_bit(FSCACHE_COOKIE_CREATING, &cookie->flags)) {
-		fscache_stat(&fscache_n_relinquishes_waitcrt);
+		fscache_stat_unchecked(&fscache_n_relinquishes_waitcrt);
 		wait_on_bit(&cookie->flags, FSCACHE_COOKIE_CREATING,
 			    fscache_wait_bit, TASK_UNINTERRUPTIBLE);
 	}
diff -uriN linux-2.6.32.43/fs/fscache/internal.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/internal.h
--- linux-2.6.32.43/fs/fscache/internal.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/internal.h	2011-07-15 05:51:18.000000000 -0500
@@ -136,94 +136,94 @@
 extern atomic_t fscache_n_ops_processed[FSCACHE_MAX_THREADS];
 extern atomic_t fscache_n_objs_processed[FSCACHE_MAX_THREADS];
 
-extern atomic_t fscache_n_op_pend;
-extern atomic_t fscache_n_op_run;
-extern atomic_t fscache_n_op_enqueue;
-extern atomic_t fscache_n_op_deferred_release;
-extern atomic_t fscache_n_op_release;
-extern atomic_t fscache_n_op_gc;
-extern atomic_t fscache_n_op_cancelled;
-extern atomic_t fscache_n_op_rejected;
-
-extern atomic_t fscache_n_attr_changed;
-extern atomic_t fscache_n_attr_changed_ok;
-extern atomic_t fscache_n_attr_changed_nobufs;
-extern atomic_t fscache_n_attr_changed_nomem;
-extern atomic_t fscache_n_attr_changed_calls;
-
-extern atomic_t fscache_n_allocs;
-extern atomic_t fscache_n_allocs_ok;
-extern atomic_t fscache_n_allocs_wait;
-extern atomic_t fscache_n_allocs_nobufs;
-extern atomic_t fscache_n_allocs_intr;
-extern atomic_t fscache_n_allocs_object_dead;
-extern atomic_t fscache_n_alloc_ops;
-extern atomic_t fscache_n_alloc_op_waits;
-
-extern atomic_t fscache_n_retrievals;
-extern atomic_t fscache_n_retrievals_ok;
-extern atomic_t fscache_n_retrievals_wait;
-extern atomic_t fscache_n_retrievals_nodata;
-extern atomic_t fscache_n_retrievals_nobufs;
-extern atomic_t fscache_n_retrievals_intr;
-extern atomic_t fscache_n_retrievals_nomem;
-extern atomic_t fscache_n_retrievals_object_dead;
-extern atomic_t fscache_n_retrieval_ops;
-extern atomic_t fscache_n_retrieval_op_waits;
-
-extern atomic_t fscache_n_stores;
-extern atomic_t fscache_n_stores_ok;
-extern atomic_t fscache_n_stores_again;
-extern atomic_t fscache_n_stores_nobufs;
-extern atomic_t fscache_n_stores_oom;
-extern atomic_t fscache_n_store_ops;
-extern atomic_t fscache_n_store_calls;
-extern atomic_t fscache_n_store_pages;
-extern atomic_t fscache_n_store_radix_deletes;
-extern atomic_t fscache_n_store_pages_over_limit;
-
-extern atomic_t fscache_n_store_vmscan_not_storing;
-extern atomic_t fscache_n_store_vmscan_gone;
-extern atomic_t fscache_n_store_vmscan_busy;
-extern atomic_t fscache_n_store_vmscan_cancelled;
-
-extern atomic_t fscache_n_marks;
-extern atomic_t fscache_n_uncaches;
-
-extern atomic_t fscache_n_acquires;
-extern atomic_t fscache_n_acquires_null;
-extern atomic_t fscache_n_acquires_no_cache;
-extern atomic_t fscache_n_acquires_ok;
-extern atomic_t fscache_n_acquires_nobufs;
-extern atomic_t fscache_n_acquires_oom;
-
-extern atomic_t fscache_n_updates;
-extern atomic_t fscache_n_updates_null;
-extern atomic_t fscache_n_updates_run;
-
-extern atomic_t fscache_n_relinquishes;
-extern atomic_t fscache_n_relinquishes_null;
-extern atomic_t fscache_n_relinquishes_waitcrt;
-extern atomic_t fscache_n_relinquishes_retire;
-
-extern atomic_t fscache_n_cookie_index;
-extern atomic_t fscache_n_cookie_data;
-extern atomic_t fscache_n_cookie_special;
-
-extern atomic_t fscache_n_object_alloc;
-extern atomic_t fscache_n_object_no_alloc;
-extern atomic_t fscache_n_object_lookups;
-extern atomic_t fscache_n_object_lookups_negative;
-extern atomic_t fscache_n_object_lookups_positive;
-extern atomic_t fscache_n_object_lookups_timed_out;
-extern atomic_t fscache_n_object_created;
-extern atomic_t fscache_n_object_avail;
-extern atomic_t fscache_n_object_dead;
-
-extern atomic_t fscache_n_checkaux_none;
-extern atomic_t fscache_n_checkaux_okay;
-extern atomic_t fscache_n_checkaux_update;
-extern atomic_t fscache_n_checkaux_obsolete;
+extern atomic_unchecked_t fscache_n_op_pend;
+extern atomic_unchecked_t fscache_n_op_run;
+extern atomic_unchecked_t fscache_n_op_enqueue;
+extern atomic_unchecked_t fscache_n_op_deferred_release;
+extern atomic_unchecked_t fscache_n_op_release;
+extern atomic_unchecked_t fscache_n_op_gc;
+extern atomic_unchecked_t fscache_n_op_cancelled;
+extern atomic_unchecked_t fscache_n_op_rejected;
+
+extern atomic_unchecked_t fscache_n_attr_changed;
+extern atomic_unchecked_t fscache_n_attr_changed_ok;
+extern atomic_unchecked_t fscache_n_attr_changed_nobufs;
+extern atomic_unchecked_t fscache_n_attr_changed_nomem;
+extern atomic_unchecked_t fscache_n_attr_changed_calls;
+
+extern atomic_unchecked_t fscache_n_allocs;
+extern atomic_unchecked_t fscache_n_allocs_ok;
+extern atomic_unchecked_t fscache_n_allocs_wait;
+extern atomic_unchecked_t fscache_n_allocs_nobufs;
+extern atomic_unchecked_t fscache_n_allocs_intr;
+extern atomic_unchecked_t fscache_n_allocs_object_dead;
+extern atomic_unchecked_t fscache_n_alloc_ops;
+extern atomic_unchecked_t fscache_n_alloc_op_waits;
+
+extern atomic_unchecked_t fscache_n_retrievals;
+extern atomic_unchecked_t fscache_n_retrievals_ok;
+extern atomic_unchecked_t fscache_n_retrievals_wait;
+extern atomic_unchecked_t fscache_n_retrievals_nodata;
+extern atomic_unchecked_t fscache_n_retrievals_nobufs;
+extern atomic_unchecked_t fscache_n_retrievals_intr;
+extern atomic_unchecked_t fscache_n_retrievals_nomem;
+extern atomic_unchecked_t fscache_n_retrievals_object_dead;
+extern atomic_unchecked_t fscache_n_retrieval_ops;
+extern atomic_unchecked_t fscache_n_retrieval_op_waits;
+
+extern atomic_unchecked_t fscache_n_stores;
+extern atomic_unchecked_t fscache_n_stores_ok;
+extern atomic_unchecked_t fscache_n_stores_again;
+extern atomic_unchecked_t fscache_n_stores_nobufs;
+extern atomic_unchecked_t fscache_n_stores_oom;
+extern atomic_unchecked_t fscache_n_store_ops;
+extern atomic_unchecked_t fscache_n_store_calls;
+extern atomic_unchecked_t fscache_n_store_pages;
+extern atomic_unchecked_t fscache_n_store_radix_deletes;
+extern atomic_unchecked_t fscache_n_store_pages_over_limit;
+
+extern atomic_unchecked_t fscache_n_store_vmscan_not_storing;
+extern atomic_unchecked_t fscache_n_store_vmscan_gone;
+extern atomic_unchecked_t fscache_n_store_vmscan_busy;
+extern atomic_unchecked_t fscache_n_store_vmscan_cancelled;
+
+extern atomic_unchecked_t fscache_n_marks;
+extern atomic_unchecked_t fscache_n_uncaches;
+
+extern atomic_unchecked_t fscache_n_acquires;
+extern atomic_unchecked_t fscache_n_acquires_null;
+extern atomic_unchecked_t fscache_n_acquires_no_cache;
+extern atomic_unchecked_t fscache_n_acquires_ok;
+extern atomic_unchecked_t fscache_n_acquires_nobufs;
+extern atomic_unchecked_t fscache_n_acquires_oom;
+
+extern atomic_unchecked_t fscache_n_updates;
+extern atomic_unchecked_t fscache_n_updates_null;
+extern atomic_unchecked_t fscache_n_updates_run;
+
+extern atomic_unchecked_t fscache_n_relinquishes;
+extern atomic_unchecked_t fscache_n_relinquishes_null;
+extern atomic_unchecked_t fscache_n_relinquishes_waitcrt;
+extern atomic_unchecked_t fscache_n_relinquishes_retire;
+
+extern atomic_unchecked_t fscache_n_cookie_index;
+extern atomic_unchecked_t fscache_n_cookie_data;
+extern atomic_unchecked_t fscache_n_cookie_special;
+
+extern atomic_unchecked_t fscache_n_object_alloc;
+extern atomic_unchecked_t fscache_n_object_no_alloc;
+extern atomic_unchecked_t fscache_n_object_lookups;
+extern atomic_unchecked_t fscache_n_object_lookups_negative;
+extern atomic_unchecked_t fscache_n_object_lookups_positive;
+extern atomic_unchecked_t fscache_n_object_lookups_timed_out;
+extern atomic_unchecked_t fscache_n_object_created;
+extern atomic_unchecked_t fscache_n_object_avail;
+extern atomic_unchecked_t fscache_n_object_dead;
+
+extern atomic_unchecked_t fscache_n_checkaux_none;
+extern atomic_unchecked_t fscache_n_checkaux_okay;
+extern atomic_unchecked_t fscache_n_checkaux_update;
+extern atomic_unchecked_t fscache_n_checkaux_obsolete;
 
 extern atomic_t fscache_n_cop_alloc_object;
 extern atomic_t fscache_n_cop_lookup_object;
@@ -247,6 +247,11 @@
 	atomic_inc(stat);
 }
 
+static inline void fscache_stat_unchecked(atomic_unchecked_t *stat)
+{
+	atomic_inc_unchecked(stat);
+}
+
 static inline void fscache_stat_d(atomic_t *stat)
 {
 	atomic_dec(stat);
@@ -259,6 +264,7 @@
 
 #define __fscache_stat(stat) (NULL)
 #define fscache_stat(stat) do {} while (0)
+#define fscache_stat_unchecked(stat) do {} while (0)
 #define fscache_stat_d(stat) do {} while (0)
 #endif
 
diff -uriN linux-2.6.32.43/fs/fscache/object.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/object.c
--- linux-2.6.32.43/fs/fscache/object.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/object.c	2011-07-15 05:51:18.000000000 -0500
@@ -144,7 +144,7 @@
 		/* update the object metadata on disk */
 	case FSCACHE_OBJECT_UPDATING:
 		clear_bit(FSCACHE_OBJECT_EV_UPDATE, &object->events);
-		fscache_stat(&fscache_n_updates_run);
+		fscache_stat_unchecked(&fscache_n_updates_run);
 		fscache_stat(&fscache_n_cop_update_object);
 		object->cache->ops->update_object(object);
 		fscache_stat_d(&fscache_n_cop_update_object);
@@ -233,7 +233,7 @@
 		spin_lock(&object->lock);
 		object->state = FSCACHE_OBJECT_DEAD;
 		spin_unlock(&object->lock);
-		fscache_stat(&fscache_n_object_dead);
+		fscache_stat_unchecked(&fscache_n_object_dead);
 		goto terminal_transit;
 
 		/* handle the parent cache of this object being withdrawn from
@@ -248,7 +248,7 @@
 		spin_lock(&object->lock);
 		object->state = FSCACHE_OBJECT_DEAD;
 		spin_unlock(&object->lock);
-		fscache_stat(&fscache_n_object_dead);
+		fscache_stat_unchecked(&fscache_n_object_dead);
 		goto terminal_transit;
 
 		/* complain about the object being woken up once it is
@@ -492,7 +492,7 @@
 	       parent->cookie->def->name, cookie->def->name,
 	       object->cache->tag->name);
 
-	fscache_stat(&fscache_n_object_lookups);
+	fscache_stat_unchecked(&fscache_n_object_lookups);
 	fscache_stat(&fscache_n_cop_lookup_object);
 	ret = object->cache->ops->lookup_object(object);
 	fscache_stat_d(&fscache_n_cop_lookup_object);
@@ -503,7 +503,7 @@
 	if (ret == -ETIMEDOUT) {
 		/* probably stuck behind another object, so move this one to
 		 * the back of the queue */
-		fscache_stat(&fscache_n_object_lookups_timed_out);
+		fscache_stat_unchecked(&fscache_n_object_lookups_timed_out);
 		set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
 	}
 
@@ -526,7 +526,7 @@
 
 	spin_lock(&object->lock);
 	if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
-		fscache_stat(&fscache_n_object_lookups_negative);
+		fscache_stat_unchecked(&fscache_n_object_lookups_negative);
 
 		/* transit here to allow write requests to begin stacking up
 		 * and read requests to begin returning ENODATA */
@@ -572,7 +572,7 @@
 	 * result, in which case there may be data available */
 	spin_lock(&object->lock);
 	if (object->state == FSCACHE_OBJECT_LOOKING_UP) {
-		fscache_stat(&fscache_n_object_lookups_positive);
+		fscache_stat_unchecked(&fscache_n_object_lookups_positive);
 
 		clear_bit(FSCACHE_COOKIE_NO_DATA_YET, &cookie->flags);
 
@@ -586,7 +586,7 @@
 		set_bit(FSCACHE_OBJECT_EV_REQUEUE, &object->events);
 	} else {
 		ASSERTCMP(object->state, ==, FSCACHE_OBJECT_CREATING);
-		fscache_stat(&fscache_n_object_created);
+		fscache_stat_unchecked(&fscache_n_object_created);
 
 		object->state = FSCACHE_OBJECT_AVAILABLE;
 		spin_unlock(&object->lock);
@@ -633,7 +633,7 @@
 	fscache_enqueue_dependents(object);
 
 	fscache_hist(fscache_obj_instantiate_histogram, object->lookup_jif);
-	fscache_stat(&fscache_n_object_avail);
+	fscache_stat_unchecked(&fscache_n_object_avail);
 
 	_leave("");
 }
@@ -861,7 +861,7 @@
 	enum fscache_checkaux result;
 
 	if (!object->cookie->def->check_aux) {
-		fscache_stat(&fscache_n_checkaux_none);
+		fscache_stat_unchecked(&fscache_n_checkaux_none);
 		return FSCACHE_CHECKAUX_OKAY;
 	}
 
@@ -870,17 +870,17 @@
 	switch (result) {
 		/* entry okay as is */
 	case FSCACHE_CHECKAUX_OKAY:
-		fscache_stat(&fscache_n_checkaux_okay);
+		fscache_stat_unchecked(&fscache_n_checkaux_okay);
 		break;
 
 		/* entry requires update */
 	case FSCACHE_CHECKAUX_NEEDS_UPDATE:
-		fscache_stat(&fscache_n_checkaux_update);
+		fscache_stat_unchecked(&fscache_n_checkaux_update);
 		break;
 
 		/* entry requires deletion */
 	case FSCACHE_CHECKAUX_OBSOLETE:
-		fscache_stat(&fscache_n_checkaux_obsolete);
+		fscache_stat_unchecked(&fscache_n_checkaux_obsolete);
 		break;
 
 	default:
diff -uriN linux-2.6.32.43/fs/fscache/operation.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/operation.c
--- linux-2.6.32.43/fs/fscache/operation.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/operation.c	2011-07-15 05:51:18.000000000 -0500
@@ -16,7 +16,7 @@
 #include <linux/seq_file.h>
 #include "internal.h"
 
-atomic_t fscache_op_debug_id;
+atomic_unchecked_t fscache_op_debug_id;
 EXPORT_SYMBOL(fscache_op_debug_id);
 
 /**
@@ -39,7 +39,7 @@
 	ASSERTCMP(op->object->state, >=, FSCACHE_OBJECT_AVAILABLE);
 	ASSERTCMP(atomic_read(&op->usage), >, 0);
 
-	fscache_stat(&fscache_n_op_enqueue);
+	fscache_stat_unchecked(&fscache_n_op_enqueue);
 	switch (op->flags & FSCACHE_OP_TYPE) {
 	case FSCACHE_OP_FAST:
 		_debug("queue fast");
@@ -76,7 +76,7 @@
 		wake_up_bit(&op->flags, FSCACHE_OP_WAITING);
 	if (op->processor)
 		fscache_enqueue_operation(op);
-	fscache_stat(&fscache_n_op_run);
+	fscache_stat_unchecked(&fscache_n_op_run);
 }
 
 /*
@@ -107,11 +107,11 @@
 		if (object->n_ops > 0) {
 			atomic_inc(&op->usage);
 			list_add_tail(&op->pend_link, &object->pending_ops);
-			fscache_stat(&fscache_n_op_pend);
+			fscache_stat_unchecked(&fscache_n_op_pend);
 		} else if (!list_empty(&object->pending_ops)) {
 			atomic_inc(&op->usage);
 			list_add_tail(&op->pend_link, &object->pending_ops);
-			fscache_stat(&fscache_n_op_pend);
+			fscache_stat_unchecked(&fscache_n_op_pend);
 			fscache_start_operations(object);
 		} else {
 			ASSERTCMP(object->n_in_progress, ==, 0);
@@ -127,7 +127,7 @@
 		object->n_exclusive++;	/* reads and writes must wait */
 		atomic_inc(&op->usage);
 		list_add_tail(&op->pend_link, &object->pending_ops);
-		fscache_stat(&fscache_n_op_pend);
+		fscache_stat_unchecked(&fscache_n_op_pend);
 		ret = 0;
 	} else {
 		/* not allowed to submit ops in any other state */
@@ -214,11 +214,11 @@
 		if (object->n_exclusive > 0) {
 			atomic_inc(&op->usage);
 			list_add_tail(&op->pend_link, &object->pending_ops);
-			fscache_stat(&fscache_n_op_pend);
+			fscache_stat_unchecked(&fscache_n_op_pend);
 		} else if (!list_empty(&object->pending_ops)) {
 			atomic_inc(&op->usage);
 			list_add_tail(&op->pend_link, &object->pending_ops);
-			fscache_stat(&fscache_n_op_pend);
+			fscache_stat_unchecked(&fscache_n_op_pend);
 			fscache_start_operations(object);
 		} else {
 			ASSERTCMP(object->n_exclusive, ==, 0);
@@ -230,12 +230,12 @@
 		object->n_ops++;
 		atomic_inc(&op->usage);
 		list_add_tail(&op->pend_link, &object->pending_ops);
-		fscache_stat(&fscache_n_op_pend);
+		fscache_stat_unchecked(&fscache_n_op_pend);
 		ret = 0;
 	} else if (object->state == FSCACHE_OBJECT_DYING ||
 		   object->state == FSCACHE_OBJECT_LC_DYING ||
 		   object->state == FSCACHE_OBJECT_WITHDRAWING) {
-		fscache_stat(&fscache_n_op_rejected);
+		fscache_stat_unchecked(&fscache_n_op_rejected);
 		ret = -ENOBUFS;
 	} else if (!test_bit(FSCACHE_IOERROR, &object->cache->flags)) {
 		fscache_report_unexpected_submission(object, op, ostate);
@@ -305,7 +305,7 @@
 
 	ret = -EBUSY;
 	if (!list_empty(&op->pend_link)) {
-		fscache_stat(&fscache_n_op_cancelled);
+		fscache_stat_unchecked(&fscache_n_op_cancelled);
 		list_del_init(&op->pend_link);
 		object->n_ops--;
 		if (test_bit(FSCACHE_OP_EXCLUSIVE, &op->flags))
@@ -344,7 +344,7 @@
 	if (test_and_set_bit(FSCACHE_OP_DEAD, &op->flags))
 		BUG();
 
-	fscache_stat(&fscache_n_op_release);
+	fscache_stat_unchecked(&fscache_n_op_release);
 
 	if (op->release) {
 		op->release(op);
@@ -361,7 +361,7 @@
 	 * lock, and defer it otherwise */
 	if (!spin_trylock(&object->lock)) {
 		_debug("defer put");
-		fscache_stat(&fscache_n_op_deferred_release);
+		fscache_stat_unchecked(&fscache_n_op_deferred_release);
 
 		cache = object->cache;
 		spin_lock(&cache->op_gc_list_lock);
@@ -423,7 +423,7 @@
 
 		_debug("GC DEFERRED REL OBJ%x OP%x",
 		       object->debug_id, op->debug_id);
-		fscache_stat(&fscache_n_op_gc);
+		fscache_stat_unchecked(&fscache_n_op_gc);
 
 		ASSERTCMP(atomic_read(&op->usage), ==, 0);
 
diff -uriN linux-2.6.32.43/fs/fscache/page.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/page.c
--- linux-2.6.32.43/fs/fscache/page.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/page.c	2011-07-15 05:51:18.000000000 -0500
@@ -59,7 +59,7 @@
 	val = radix_tree_lookup(&cookie->stores, page->index);
 	if (!val) {
 		rcu_read_unlock();
-		fscache_stat(&fscache_n_store_vmscan_not_storing);
+		fscache_stat_unchecked(&fscache_n_store_vmscan_not_storing);
 		__fscache_uncache_page(cookie, page);
 		return true;
 	}
@@ -89,11 +89,11 @@
 	spin_unlock(&cookie->stores_lock);
 
 	if (xpage) {
-		fscache_stat(&fscache_n_store_vmscan_cancelled);
-		fscache_stat(&fscache_n_store_radix_deletes);
+		fscache_stat_unchecked(&fscache_n_store_vmscan_cancelled);
+		fscache_stat_unchecked(&fscache_n_store_radix_deletes);
 		ASSERTCMP(xpage, ==, page);
 	} else {
-		fscache_stat(&fscache_n_store_vmscan_gone);
+		fscache_stat_unchecked(&fscache_n_store_vmscan_gone);
 	}
 
 	wake_up_bit(&cookie->flags, 0);
@@ -106,7 +106,7 @@
 	/* we might want to wait here, but that could deadlock the allocator as
 	 * the slow-work threads writing to the cache may all end up sleeping
 	 * on memory allocation */
-	fscache_stat(&fscache_n_store_vmscan_busy);
+	fscache_stat_unchecked(&fscache_n_store_vmscan_busy);
 	return false;
 }
 EXPORT_SYMBOL(__fscache_maybe_release_page);
@@ -130,7 +130,7 @@
 				     FSCACHE_COOKIE_STORING_TAG);
 		if (!radix_tree_tag_get(&cookie->stores, page->index,
 					FSCACHE_COOKIE_PENDING_TAG)) {
-			fscache_stat(&fscache_n_store_radix_deletes);
+			fscache_stat_unchecked(&fscache_n_store_radix_deletes);
 			xpage = radix_tree_delete(&cookie->stores, page->index);
 		}
 		spin_unlock(&cookie->stores_lock);
@@ -151,7 +151,7 @@
 
 	_enter("{OBJ%x OP%x}", object->debug_id, op->debug_id);
 
-	fscache_stat(&fscache_n_attr_changed_calls);
+	fscache_stat_unchecked(&fscache_n_attr_changed_calls);
 
 	if (fscache_object_is_active(object)) {
 		fscache_set_op_state(op, "CallFS");
@@ -178,11 +178,11 @@
 
 	ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
 
-	fscache_stat(&fscache_n_attr_changed);
+	fscache_stat_unchecked(&fscache_n_attr_changed);
 
 	op = kzalloc(sizeof(*op), GFP_KERNEL);
 	if (!op) {
-		fscache_stat(&fscache_n_attr_changed_nomem);
+		fscache_stat_unchecked(&fscache_n_attr_changed_nomem);
 		_leave(" = -ENOMEM");
 		return -ENOMEM;
 	}
@@ -202,7 +202,7 @@
 	if (fscache_submit_exclusive_op(object, op) < 0)
 		goto nobufs;
 	spin_unlock(&cookie->lock);
-	fscache_stat(&fscache_n_attr_changed_ok);
+	fscache_stat_unchecked(&fscache_n_attr_changed_ok);
 	fscache_put_operation(op);
 	_leave(" = 0");
 	return 0;
@@ -210,7 +210,7 @@
 nobufs:
 	spin_unlock(&cookie->lock);
 	kfree(op);
-	fscache_stat(&fscache_n_attr_changed_nobufs);
+	fscache_stat_unchecked(&fscache_n_attr_changed_nobufs);
 	_leave(" = %d", -ENOBUFS);
 	return -ENOBUFS;
 }
@@ -264,7 +264,7 @@
 	/* allocate a retrieval operation and attempt to submit it */
 	op = kzalloc(sizeof(*op), GFP_NOIO);
 	if (!op) {
-		fscache_stat(&fscache_n_retrievals_nomem);
+		fscache_stat_unchecked(&fscache_n_retrievals_nomem);
 		return NULL;
 	}
 
@@ -294,13 +294,13 @@
 		return 0;
 	}
 
-	fscache_stat(&fscache_n_retrievals_wait);
+	fscache_stat_unchecked(&fscache_n_retrievals_wait);
 
 	jif = jiffies;
 	if (wait_on_bit(&cookie->flags, FSCACHE_COOKIE_LOOKING_UP,
 			fscache_wait_bit_interruptible,
 			TASK_INTERRUPTIBLE) != 0) {
-		fscache_stat(&fscache_n_retrievals_intr);
+		fscache_stat_unchecked(&fscache_n_retrievals_intr);
 		_leave(" = -ERESTARTSYS");
 		return -ERESTARTSYS;
 	}
@@ -318,8 +318,8 @@
  */
 static int fscache_wait_for_retrieval_activation(struct fscache_object *object,
 						 struct fscache_retrieval *op,
-						 atomic_t *stat_op_waits,
-						 atomic_t *stat_object_dead)
+						 atomic_unchecked_t *stat_op_waits,
+						 atomic_unchecked_t *stat_object_dead)
 {
 	int ret;
 
@@ -327,7 +327,7 @@
 		goto check_if_dead;
 
 	_debug(">>> WT");
-	fscache_stat(stat_op_waits);
+	fscache_stat_unchecked(stat_op_waits);
 	if (wait_on_bit(&op->op.flags, FSCACHE_OP_WAITING,
 			fscache_wait_bit_interruptible,
 			TASK_INTERRUPTIBLE) < 0) {
@@ -344,7 +344,7 @@
 
 check_if_dead:
 	if (unlikely(fscache_object_is_dead(object))) {
-		fscache_stat(stat_object_dead);
+		fscache_stat_unchecked(stat_object_dead);
 		return -ENOBUFS;
 	}
 	return 0;
@@ -371,7 +371,7 @@
 
 	_enter("%p,%p,,,", cookie, page);
 
-	fscache_stat(&fscache_n_retrievals);
+	fscache_stat_unchecked(&fscache_n_retrievals);
 
 	if (hlist_empty(&cookie->backing_objects))
 		goto nobufs;
@@ -405,7 +405,7 @@
 		goto nobufs_unlock;
 	spin_unlock(&cookie->lock);
 
-	fscache_stat(&fscache_n_retrieval_ops);
+	fscache_stat_unchecked(&fscache_n_retrieval_ops);
 
 	/* pin the netfs read context in case we need to do the actual netfs
 	 * read because we've encountered a cache read failure */
@@ -435,15 +435,15 @@
 
 error:
 	if (ret == -ENOMEM)
-		fscache_stat(&fscache_n_retrievals_nomem);
+		fscache_stat_unchecked(&fscache_n_retrievals_nomem);
 	else if (ret == -ERESTARTSYS)
-		fscache_stat(&fscache_n_retrievals_intr);
+		fscache_stat_unchecked(&fscache_n_retrievals_intr);
 	else if (ret == -ENODATA)
-		fscache_stat(&fscache_n_retrievals_nodata);
+		fscache_stat_unchecked(&fscache_n_retrievals_nodata);
 	else if (ret < 0)
-		fscache_stat(&fscache_n_retrievals_nobufs);
+		fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
 	else
-		fscache_stat(&fscache_n_retrievals_ok);
+		fscache_stat_unchecked(&fscache_n_retrievals_ok);
 
 	fscache_put_retrieval(op);
 	_leave(" = %d", ret);
@@ -453,7 +453,7 @@
 	spin_unlock(&cookie->lock);
 	kfree(op);
 nobufs:
-	fscache_stat(&fscache_n_retrievals_nobufs);
+	fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
 	_leave(" = -ENOBUFS");
 	return -ENOBUFS;
 }
@@ -491,7 +491,7 @@
 
 	_enter("%p,,%d,,,", cookie, *nr_pages);
 
-	fscache_stat(&fscache_n_retrievals);
+	fscache_stat_unchecked(&fscache_n_retrievals);
 
 	if (hlist_empty(&cookie->backing_objects))
 		goto nobufs;
@@ -522,7 +522,7 @@
 		goto nobufs_unlock;
 	spin_unlock(&cookie->lock);
 
-	fscache_stat(&fscache_n_retrieval_ops);
+	fscache_stat_unchecked(&fscache_n_retrieval_ops);
 
 	/* pin the netfs read context in case we need to do the actual netfs
 	 * read because we've encountered a cache read failure */
@@ -552,15 +552,15 @@
 
 error:
 	if (ret == -ENOMEM)
-		fscache_stat(&fscache_n_retrievals_nomem);
+		fscache_stat_unchecked(&fscache_n_retrievals_nomem);
 	else if (ret == -ERESTARTSYS)
-		fscache_stat(&fscache_n_retrievals_intr);
+		fscache_stat_unchecked(&fscache_n_retrievals_intr);
 	else if (ret == -ENODATA)
-		fscache_stat(&fscache_n_retrievals_nodata);
+		fscache_stat_unchecked(&fscache_n_retrievals_nodata);
 	else if (ret < 0)
-		fscache_stat(&fscache_n_retrievals_nobufs);
+		fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
 	else
-		fscache_stat(&fscache_n_retrievals_ok);
+		fscache_stat_unchecked(&fscache_n_retrievals_ok);
 
 	fscache_put_retrieval(op);
 	_leave(" = %d", ret);
@@ -570,7 +570,7 @@
 	spin_unlock(&cookie->lock);
 	kfree(op);
 nobufs:
-	fscache_stat(&fscache_n_retrievals_nobufs);
+	fscache_stat_unchecked(&fscache_n_retrievals_nobufs);
 	_leave(" = -ENOBUFS");
 	return -ENOBUFS;
 }
@@ -594,7 +594,7 @@
 
 	_enter("%p,%p,,,", cookie, page);
 
-	fscache_stat(&fscache_n_allocs);
+	fscache_stat_unchecked(&fscache_n_allocs);
 
 	if (hlist_empty(&cookie->backing_objects))
 		goto nobufs;
@@ -621,7 +621,7 @@
 		goto nobufs_unlock;
 	spin_unlock(&cookie->lock);
 
-	fscache_stat(&fscache_n_alloc_ops);
+	fscache_stat_unchecked(&fscache_n_alloc_ops);
 
 	ret = fscache_wait_for_retrieval_activation(
 		object, op,
@@ -637,11 +637,11 @@
 
 error:
 	if (ret == -ERESTARTSYS)
-		fscache_stat(&fscache_n_allocs_intr);
+		fscache_stat_unchecked(&fscache_n_allocs_intr);
 	else if (ret < 0)
-		fscache_stat(&fscache_n_allocs_nobufs);
+		fscache_stat_unchecked(&fscache_n_allocs_nobufs);
 	else
-		fscache_stat(&fscache_n_allocs_ok);
+		fscache_stat_unchecked(&fscache_n_allocs_ok);
 
 	fscache_put_retrieval(op);
 	_leave(" = %d", ret);
@@ -651,7 +651,7 @@
 	spin_unlock(&cookie->lock);
 	kfree(op);
 nobufs:
-	fscache_stat(&fscache_n_allocs_nobufs);
+	fscache_stat_unchecked(&fscache_n_allocs_nobufs);
 	_leave(" = -ENOBUFS");
 	return -ENOBUFS;
 }
@@ -694,7 +694,7 @@
 
 	spin_lock(&cookie->stores_lock);
 
-	fscache_stat(&fscache_n_store_calls);
+	fscache_stat_unchecked(&fscache_n_store_calls);
 
 	/* find a page to store */
 	page = NULL;
@@ -705,7 +705,7 @@
 	page = results[0];
 	_debug("gang %d [%lx]", n, page->index);
 	if (page->index > op->store_limit) {
-		fscache_stat(&fscache_n_store_pages_over_limit);
+		fscache_stat_unchecked(&fscache_n_store_pages_over_limit);
 		goto superseded;
 	}
 
@@ -721,7 +721,7 @@
 
 	if (page) {
 		fscache_set_op_state(&op->op, "Store");
-		fscache_stat(&fscache_n_store_pages);
+		fscache_stat_unchecked(&fscache_n_store_pages);
 		fscache_stat(&fscache_n_cop_write_page);
 		ret = object->cache->ops->write_page(op, page);
 		fscache_stat_d(&fscache_n_cop_write_page);
@@ -792,7 +792,7 @@
 	ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
 	ASSERT(PageFsCache(page));
 
-	fscache_stat(&fscache_n_stores);
+	fscache_stat_unchecked(&fscache_n_stores);
 
 	op = kzalloc(sizeof(*op), GFP_NOIO);
 	if (!op)
@@ -844,7 +844,7 @@
 	spin_unlock(&cookie->stores_lock);
 	spin_unlock(&object->lock);
 
-	op->op.debug_id	= atomic_inc_return(&fscache_op_debug_id);
+	op->op.debug_id	= atomic_inc_return_unchecked(&fscache_op_debug_id);
 	op->store_limit = object->store_limit;
 
 	if (fscache_submit_op(object, &op->op) < 0)
@@ -852,8 +852,8 @@
 
 	spin_unlock(&cookie->lock);
 	radix_tree_preload_end();
-	fscache_stat(&fscache_n_store_ops);
-	fscache_stat(&fscache_n_stores_ok);
+	fscache_stat_unchecked(&fscache_n_store_ops);
+	fscache_stat_unchecked(&fscache_n_stores_ok);
 
 	/* the slow work queue now carries its own ref on the object */
 	fscache_put_operation(&op->op);
@@ -861,14 +861,14 @@
 	return 0;
 
 already_queued:
-	fscache_stat(&fscache_n_stores_again);
+	fscache_stat_unchecked(&fscache_n_stores_again);
 already_pending:
 	spin_unlock(&cookie->stores_lock);
 	spin_unlock(&object->lock);
 	spin_unlock(&cookie->lock);
 	radix_tree_preload_end();
 	kfree(op);
-	fscache_stat(&fscache_n_stores_ok);
+	fscache_stat_unchecked(&fscache_n_stores_ok);
 	_leave(" = 0");
 	return 0;
 
@@ -886,14 +886,14 @@
 	spin_unlock(&cookie->lock);
 	radix_tree_preload_end();
 	kfree(op);
-	fscache_stat(&fscache_n_stores_nobufs);
+	fscache_stat_unchecked(&fscache_n_stores_nobufs);
 	_leave(" = -ENOBUFS");
 	return -ENOBUFS;
 
 nomem_free:
 	kfree(op);
 nomem:
-	fscache_stat(&fscache_n_stores_oom);
+	fscache_stat_unchecked(&fscache_n_stores_oom);
 	_leave(" = -ENOMEM");
 	return -ENOMEM;
 }
@@ -911,7 +911,7 @@
 	ASSERTCMP(cookie->def->type, !=, FSCACHE_COOKIE_TYPE_INDEX);
 	ASSERTCMP(page, !=, NULL);
 
-	fscache_stat(&fscache_n_uncaches);
+	fscache_stat_unchecked(&fscache_n_uncaches);
 
 	/* cache withdrawal may beat us to it */
 	if (!PageFsCache(page))
@@ -964,7 +964,7 @@
 	unsigned long loop;
 
 #ifdef CONFIG_FSCACHE_STATS
-	atomic_add(pagevec->nr, &fscache_n_marks);
+	atomic_add_unchecked(pagevec->nr, &fscache_n_marks);
 #endif
 
 	for (loop = 0; loop < pagevec->nr; loop++) {
diff -uriN linux-2.6.32.43/fs/fscache/stats.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/stats.c
--- linux-2.6.32.43/fs/fscache/stats.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fscache/stats.c	2011-07-15 05:51:18.000000000 -0500
@@ -18,95 +18,95 @@
 /*
  * operation counters
  */
-atomic_t fscache_n_op_pend;
-atomic_t fscache_n_op_run;
-atomic_t fscache_n_op_enqueue;
-atomic_t fscache_n_op_requeue;
-atomic_t fscache_n_op_deferred_release;
-atomic_t fscache_n_op_release;
-atomic_t fscache_n_op_gc;
-atomic_t fscache_n_op_cancelled;
-atomic_t fscache_n_op_rejected;
-
-atomic_t fscache_n_attr_changed;
-atomic_t fscache_n_attr_changed_ok;
-atomic_t fscache_n_attr_changed_nobufs;
-atomic_t fscache_n_attr_changed_nomem;
-atomic_t fscache_n_attr_changed_calls;
-
-atomic_t fscache_n_allocs;
-atomic_t fscache_n_allocs_ok;
-atomic_t fscache_n_allocs_wait;
-atomic_t fscache_n_allocs_nobufs;
-atomic_t fscache_n_allocs_intr;
-atomic_t fscache_n_allocs_object_dead;
-atomic_t fscache_n_alloc_ops;
-atomic_t fscache_n_alloc_op_waits;
-
-atomic_t fscache_n_retrievals;
-atomic_t fscache_n_retrievals_ok;
-atomic_t fscache_n_retrievals_wait;
-atomic_t fscache_n_retrievals_nodata;
-atomic_t fscache_n_retrievals_nobufs;
-atomic_t fscache_n_retrievals_intr;
-atomic_t fscache_n_retrievals_nomem;
-atomic_t fscache_n_retrievals_object_dead;
-atomic_t fscache_n_retrieval_ops;
-atomic_t fscache_n_retrieval_op_waits;
-
-atomic_t fscache_n_stores;
-atomic_t fscache_n_stores_ok;
-atomic_t fscache_n_stores_again;
-atomic_t fscache_n_stores_nobufs;
-atomic_t fscache_n_stores_oom;
-atomic_t fscache_n_store_ops;
-atomic_t fscache_n_store_calls;
-atomic_t fscache_n_store_pages;
-atomic_t fscache_n_store_radix_deletes;
-atomic_t fscache_n_store_pages_over_limit;
-
-atomic_t fscache_n_store_vmscan_not_storing;
-atomic_t fscache_n_store_vmscan_gone;
-atomic_t fscache_n_store_vmscan_busy;
-atomic_t fscache_n_store_vmscan_cancelled;
-
-atomic_t fscache_n_marks;
-atomic_t fscache_n_uncaches;
-
-atomic_t fscache_n_acquires;
-atomic_t fscache_n_acquires_null;
-atomic_t fscache_n_acquires_no_cache;
-atomic_t fscache_n_acquires_ok;
-atomic_t fscache_n_acquires_nobufs;
-atomic_t fscache_n_acquires_oom;
-
-atomic_t fscache_n_updates;
-atomic_t fscache_n_updates_null;
-atomic_t fscache_n_updates_run;
-
-atomic_t fscache_n_relinquishes;
-atomic_t fscache_n_relinquishes_null;
-atomic_t fscache_n_relinquishes_waitcrt;
-atomic_t fscache_n_relinquishes_retire;
-
-atomic_t fscache_n_cookie_index;
-atomic_t fscache_n_cookie_data;
-atomic_t fscache_n_cookie_special;
-
-atomic_t fscache_n_object_alloc;
-atomic_t fscache_n_object_no_alloc;
-atomic_t fscache_n_object_lookups;
-atomic_t fscache_n_object_lookups_negative;
-atomic_t fscache_n_object_lookups_positive;
-atomic_t fscache_n_object_lookups_timed_out;
-atomic_t fscache_n_object_created;
-atomic_t fscache_n_object_avail;
-atomic_t fscache_n_object_dead;
-
-atomic_t fscache_n_checkaux_none;
-atomic_t fscache_n_checkaux_okay;
-atomic_t fscache_n_checkaux_update;
-atomic_t fscache_n_checkaux_obsolete;
+atomic_unchecked_t fscache_n_op_pend;
+atomic_unchecked_t fscache_n_op_run;
+atomic_unchecked_t fscache_n_op_enqueue;
+atomic_unchecked_t fscache_n_op_requeue;
+atomic_unchecked_t fscache_n_op_deferred_release;
+atomic_unchecked_t fscache_n_op_release;
+atomic_unchecked_t fscache_n_op_gc;
+atomic_unchecked_t fscache_n_op_cancelled;
+atomic_unchecked_t fscache_n_op_rejected;
+
+atomic_unchecked_t fscache_n_attr_changed;
+atomic_unchecked_t fscache_n_attr_changed_ok;
+atomic_unchecked_t fscache_n_attr_changed_nobufs;
+atomic_unchecked_t fscache_n_attr_changed_nomem;
+atomic_unchecked_t fscache_n_attr_changed_calls;
+
+atomic_unchecked_t fscache_n_allocs;
+atomic_unchecked_t fscache_n_allocs_ok;
+atomic_unchecked_t fscache_n_allocs_wait;
+atomic_unchecked_t fscache_n_allocs_nobufs;
+atomic_unchecked_t fscache_n_allocs_intr;
+atomic_unchecked_t fscache_n_allocs_object_dead;
+atomic_unchecked_t fscache_n_alloc_ops;
+atomic_unchecked_t fscache_n_alloc_op_waits;
+
+atomic_unchecked_t fscache_n_retrievals;
+atomic_unchecked_t fscache_n_retrievals_ok;
+atomic_unchecked_t fscache_n_retrievals_wait;
+atomic_unchecked_t fscache_n_retrievals_nodata;
+atomic_unchecked_t fscache_n_retrievals_nobufs;
+atomic_unchecked_t fscache_n_retrievals_intr;
+atomic_unchecked_t fscache_n_retrievals_nomem;
+atomic_unchecked_t fscache_n_retrievals_object_dead;
+atomic_unchecked_t fscache_n_retrieval_ops;
+atomic_unchecked_t fscache_n_retrieval_op_waits;
+
+atomic_unchecked_t fscache_n_stores;
+atomic_unchecked_t fscache_n_stores_ok;
+atomic_unchecked_t fscache_n_stores_again;
+atomic_unchecked_t fscache_n_stores_nobufs;
+atomic_unchecked_t fscache_n_stores_oom;
+atomic_unchecked_t fscache_n_store_ops;
+atomic_unchecked_t fscache_n_store_calls;
+atomic_unchecked_t fscache_n_store_pages;
+atomic_unchecked_t fscache_n_store_radix_deletes;
+atomic_unchecked_t fscache_n_store_pages_over_limit;
+
+atomic_unchecked_t fscache_n_store_vmscan_not_storing;
+atomic_unchecked_t fscache_n_store_vmscan_gone;
+atomic_unchecked_t fscache_n_store_vmscan_busy;
+atomic_unchecked_t fscache_n_store_vmscan_cancelled;
+
+atomic_unchecked_t fscache_n_marks;
+atomic_unchecked_t fscache_n_uncaches;
+
+atomic_unchecked_t fscache_n_acquires;
+atomic_unchecked_t fscache_n_acquires_null;
+atomic_unchecked_t fscache_n_acquires_no_cache;
+atomic_unchecked_t fscache_n_acquires_ok;
+atomic_unchecked_t fscache_n_acquires_nobufs;
+atomic_unchecked_t fscache_n_acquires_oom;
+
+atomic_unchecked_t fscache_n_updates;
+atomic_unchecked_t fscache_n_updates_null;
+atomic_unchecked_t fscache_n_updates_run;
+
+atomic_unchecked_t fscache_n_relinquishes;
+atomic_unchecked_t fscache_n_relinquishes_null;
+atomic_unchecked_t fscache_n_relinquishes_waitcrt;
+atomic_unchecked_t fscache_n_relinquishes_retire;
+
+atomic_unchecked_t fscache_n_cookie_index;
+atomic_unchecked_t fscache_n_cookie_data;
+atomic_unchecked_t fscache_n_cookie_special;
+
+atomic_unchecked_t fscache_n_object_alloc;
+atomic_unchecked_t fscache_n_object_no_alloc;
+atomic_unchecked_t fscache_n_object_lookups;
+atomic_unchecked_t fscache_n_object_lookups_negative;
+atomic_unchecked_t fscache_n_object_lookups_positive;
+atomic_unchecked_t fscache_n_object_lookups_timed_out;
+atomic_unchecked_t fscache_n_object_created;
+atomic_unchecked_t fscache_n_object_avail;
+atomic_unchecked_t fscache_n_object_dead;
+
+atomic_unchecked_t fscache_n_checkaux_none;
+atomic_unchecked_t fscache_n_checkaux_okay;
+atomic_unchecked_t fscache_n_checkaux_update;
+atomic_unchecked_t fscache_n_checkaux_obsolete;
 
 atomic_t fscache_n_cop_alloc_object;
 atomic_t fscache_n_cop_lookup_object;
@@ -133,113 +133,113 @@
 	seq_puts(m, "FS-Cache statistics\n");
 
 	seq_printf(m, "Cookies: idx=%u dat=%u spc=%u\n",
-		   atomic_read(&fscache_n_cookie_index),
-		   atomic_read(&fscache_n_cookie_data),
-		   atomic_read(&fscache_n_cookie_special));
+		   atomic_read_unchecked(&fscache_n_cookie_index),
+		   atomic_read_unchecked(&fscache_n_cookie_data),
+		   atomic_read_unchecked(&fscache_n_cookie_special));
 
 	seq_printf(m, "Objects: alc=%u nal=%u avl=%u ded=%u\n",
-		   atomic_read(&fscache_n_object_alloc),
-		   atomic_read(&fscache_n_object_no_alloc),
-		   atomic_read(&fscache_n_object_avail),
-		   atomic_read(&fscache_n_object_dead));
+		   atomic_read_unchecked(&fscache_n_object_alloc),
+		   atomic_read_unchecked(&fscache_n_object_no_alloc),
+		   atomic_read_unchecked(&fscache_n_object_avail),
+		   atomic_read_unchecked(&fscache_n_object_dead));
 	seq_printf(m, "ChkAux : non=%u ok=%u upd=%u obs=%u\n",
-		   atomic_read(&fscache_n_checkaux_none),
-		   atomic_read(&fscache_n_checkaux_okay),
-		   atomic_read(&fscache_n_checkaux_update),
-		   atomic_read(&fscache_n_checkaux_obsolete));
+		   atomic_read_unchecked(&fscache_n_checkaux_none),
+		   atomic_read_unchecked(&fscache_n_checkaux_okay),
+		   atomic_read_unchecked(&fscache_n_checkaux_update),
+		   atomic_read_unchecked(&fscache_n_checkaux_obsolete));
 
 	seq_printf(m, "Pages  : mrk=%u unc=%u\n",
-		   atomic_read(&fscache_n_marks),
-		   atomic_read(&fscache_n_uncaches));
+		   atomic_read_unchecked(&fscache_n_marks),
+		   atomic_read_unchecked(&fscache_n_uncaches));
 
 	seq_printf(m, "Acquire: n=%u nul=%u noc=%u ok=%u nbf=%u"
 		   " oom=%u\n",
-		   atomic_read(&fscache_n_acquires),
-		   atomic_read(&fscache_n_acquires_null),
-		   atomic_read(&fscache_n_acquires_no_cache),
-		   atomic_read(&fscache_n_acquires_ok),
-		   atomic_read(&fscache_n_acquires_nobufs),
-		   atomic_read(&fscache_n_acquires_oom));
+		   atomic_read_unchecked(&fscache_n_acquires),
+		   atomic_read_unchecked(&fscache_n_acquires_null),
+		   atomic_read_unchecked(&fscache_n_acquires_no_cache),
+		   atomic_read_unchecked(&fscache_n_acquires_ok),
+		   atomic_read_unchecked(&fscache_n_acquires_nobufs),
+		   atomic_read_unchecked(&fscache_n_acquires_oom));
 
 	seq_printf(m, "Lookups: n=%u neg=%u pos=%u crt=%u tmo=%u\n",
-		   atomic_read(&fscache_n_object_lookups),
-		   atomic_read(&fscache_n_object_lookups_negative),
-		   atomic_read(&fscache_n_object_lookups_positive),
-		   atomic_read(&fscache_n_object_lookups_timed_out),
-		   atomic_read(&fscache_n_object_created));
+		   atomic_read_unchecked(&fscache_n_object_lookups),
+		   atomic_read_unchecked(&fscache_n_object_lookups_negative),
+		   atomic_read_unchecked(&fscache_n_object_lookups_positive),
+		   atomic_read_unchecked(&fscache_n_object_lookups_timed_out),
+		   atomic_read_unchecked(&fscache_n_object_created));
 
 	seq_printf(m, "Updates: n=%u nul=%u run=%u\n",
-		   atomic_read(&fscache_n_updates),
-		   atomic_read(&fscache_n_updates_null),
-		   atomic_read(&fscache_n_updates_run));
+		   atomic_read_unchecked(&fscache_n_updates),
+		   atomic_read_unchecked(&fscache_n_updates_null),
+		   atomic_read_unchecked(&fscache_n_updates_run));
 
 	seq_printf(m, "Relinqs: n=%u nul=%u wcr=%u rtr=%u\n",
-		   atomic_read(&fscache_n_relinquishes),
-		   atomic_read(&fscache_n_relinquishes_null),
-		   atomic_read(&fscache_n_relinquishes_waitcrt),
-		   atomic_read(&fscache_n_relinquishes_retire));
+		   atomic_read_unchecked(&fscache_n_relinquishes),
+		   atomic_read_unchecked(&fscache_n_relinquishes_null),
+		   atomic_read_unchecked(&fscache_n_relinquishes_waitcrt),
+		   atomic_read_unchecked(&fscache_n_relinquishes_retire));
 
 	seq_printf(m, "AttrChg: n=%u ok=%u nbf=%u oom=%u run=%u\n",
-		   atomic_read(&fscache_n_attr_changed),
-		   atomic_read(&fscache_n_attr_changed_ok),
-		   atomic_read(&fscache_n_attr_changed_nobufs),
-		   atomic_read(&fscache_n_attr_changed_nomem),
-		   atomic_read(&fscache_n_attr_changed_calls));
+		   atomic_read_unchecked(&fscache_n_attr_changed),
+		   atomic_read_unchecked(&fscache_n_attr_changed_ok),
+		   atomic_read_unchecked(&fscache_n_attr_changed_nobufs),
+		   atomic_read_unchecked(&fscache_n_attr_changed_nomem),
+		   atomic_read_unchecked(&fscache_n_attr_changed_calls));
 
 	seq_printf(m, "Allocs : n=%u ok=%u wt=%u nbf=%u int=%u\n",
-		   atomic_read(&fscache_n_allocs),
-		   atomic_read(&fscache_n_allocs_ok),
-		   atomic_read(&fscache_n_allocs_wait),
-		   atomic_read(&fscache_n_allocs_nobufs),
-		   atomic_read(&fscache_n_allocs_intr));
+		   atomic_read_unchecked(&fscache_n_allocs),
+		   atomic_read_unchecked(&fscache_n_allocs_ok),
+		   atomic_read_unchecked(&fscache_n_allocs_wait),
+		   atomic_read_unchecked(&fscache_n_allocs_nobufs),
+		   atomic_read_unchecked(&fscache_n_allocs_intr));
 	seq_printf(m, "Allocs : ops=%u owt=%u abt=%u\n",
-		   atomic_read(&fscache_n_alloc_ops),
-		   atomic_read(&fscache_n_alloc_op_waits),
-		   atomic_read(&fscache_n_allocs_object_dead));
+		   atomic_read_unchecked(&fscache_n_alloc_ops),
+		   atomic_read_unchecked(&fscache_n_alloc_op_waits),
+		   atomic_read_unchecked(&fscache_n_allocs_object_dead));
 
 	seq_printf(m, "Retrvls: n=%u ok=%u wt=%u nod=%u nbf=%u"
 		   " int=%u oom=%u\n",
-		   atomic_read(&fscache_n_retrievals),
-		   atomic_read(&fscache_n_retrievals_ok),
-		   atomic_read(&fscache_n_retrievals_wait),
-		   atomic_read(&fscache_n_retrievals_nodata),
-		   atomic_read(&fscache_n_retrievals_nobufs),
-		   atomic_read(&fscache_n_retrievals_intr),
-		   atomic_read(&fscache_n_retrievals_nomem));
+		   atomic_read_unchecked(&fscache_n_retrievals),
+		   atomic_read_unchecked(&fscache_n_retrievals_ok),
+		   atomic_read_unchecked(&fscache_n_retrievals_wait),
+		   atomic_read_unchecked(&fscache_n_retrievals_nodata),
+		   atomic_read_unchecked(&fscache_n_retrievals_nobufs),
+		   atomic_read_unchecked(&fscache_n_retrievals_intr),
+		   atomic_read_unchecked(&fscache_n_retrievals_nomem));
 	seq_printf(m, "Retrvls: ops=%u owt=%u abt=%u\n",
-		   atomic_read(&fscache_n_retrieval_ops),
-		   atomic_read(&fscache_n_retrieval_op_waits),
-		   atomic_read(&fscache_n_retrievals_object_dead));
+		   atomic_read_unchecked(&fscache_n_retrieval_ops),
+		   atomic_read_unchecked(&fscache_n_retrieval_op_waits),
+		   atomic_read_unchecked(&fscache_n_retrievals_object_dead));
 
 	seq_printf(m, "Stores : n=%u ok=%u agn=%u nbf=%u oom=%u\n",
-		   atomic_read(&fscache_n_stores),
-		   atomic_read(&fscache_n_stores_ok),
-		   atomic_read(&fscache_n_stores_again),
-		   atomic_read(&fscache_n_stores_nobufs),
-		   atomic_read(&fscache_n_stores_oom));
+		   atomic_read_unchecked(&fscache_n_stores),
+		   atomic_read_unchecked(&fscache_n_stores_ok),
+		   atomic_read_unchecked(&fscache_n_stores_again),
+		   atomic_read_unchecked(&fscache_n_stores_nobufs),
+		   atomic_read_unchecked(&fscache_n_stores_oom));
 	seq_printf(m, "Stores : ops=%u run=%u pgs=%u rxd=%u olm=%u\n",
-		   atomic_read(&fscache_n_store_ops),
-		   atomic_read(&fscache_n_store_calls),
-		   atomic_read(&fscache_n_store_pages),
-		   atomic_read(&fscache_n_store_radix_deletes),
-		   atomic_read(&fscache_n_store_pages_over_limit));
+		   atomic_read_unchecked(&fscache_n_store_ops),
+		   atomic_read_unchecked(&fscache_n_store_calls),
+		   atomic_read_unchecked(&fscache_n_store_pages),
+		   atomic_read_unchecked(&fscache_n_store_radix_deletes),
+		   atomic_read_unchecked(&fscache_n_store_pages_over_limit));
 
 	seq_printf(m, "VmScan : nos=%u gon=%u bsy=%u can=%u\n",
-		   atomic_read(&fscache_n_store_vmscan_not_storing),
-		   atomic_read(&fscache_n_store_vmscan_gone),
-		   atomic_read(&fscache_n_store_vmscan_busy),
-		   atomic_read(&fscache_n_store_vmscan_cancelled));
+		   atomic_read_unchecked(&fscache_n_store_vmscan_not_storing),
+		   atomic_read_unchecked(&fscache_n_store_vmscan_gone),
+		   atomic_read_unchecked(&fscache_n_store_vmscan_busy),
+		   atomic_read_unchecked(&fscache_n_store_vmscan_cancelled));
 
 	seq_printf(m, "Ops    : pend=%u run=%u enq=%u can=%u rej=%u\n",
-		   atomic_read(&fscache_n_op_pend),
-		   atomic_read(&fscache_n_op_run),
-		   atomic_read(&fscache_n_op_enqueue),
-		   atomic_read(&fscache_n_op_cancelled),
-		   atomic_read(&fscache_n_op_rejected));
+		   atomic_read_unchecked(&fscache_n_op_pend),
+		   atomic_read_unchecked(&fscache_n_op_run),
+		   atomic_read_unchecked(&fscache_n_op_enqueue),
+		   atomic_read_unchecked(&fscache_n_op_cancelled),
+		   atomic_read_unchecked(&fscache_n_op_rejected));
 	seq_printf(m, "Ops    : dfr=%u rel=%u gc=%u\n",
-		   atomic_read(&fscache_n_op_deferred_release),
-		   atomic_read(&fscache_n_op_release),
-		   atomic_read(&fscache_n_op_gc));
+		   atomic_read_unchecked(&fscache_n_op_deferred_release),
+		   atomic_read_unchecked(&fscache_n_op_release),
+		   atomic_read_unchecked(&fscache_n_op_gc));
 
 	seq_printf(m, "CacheOp: alo=%d luo=%d luc=%d gro=%d\n",
 		   atomic_read(&fscache_n_cop_alloc_object),
diff -uriN linux-2.6.32.43/fs/fs_struct.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fs_struct.c
--- linux-2.6.32.43/fs/fs_struct.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fs_struct.c	2011-07-15 05:52:38.000000000 -0500
@@ -4,6 +4,8 @@
 #include <linux/path.h>
 #include <linux/slab.h>
 #include <linux/fs_struct.h>
+#include <linux/grsecurity.h>
+#include <linux/vserver/global.h>
 
 /*
  * Replace the fs->{rootmnt,root} with {mnt,dentry}. Put the old values.
@@ -17,6 +19,7 @@
 	old_root = fs->root;
 	fs->root = *path;
 	path_get(path);
+	gr_set_chroot_entries(current, path);
 	write_unlock(&fs->lock);
 	if (old_root.dentry)
 		path_put(&old_root);
@@ -56,6 +59,7 @@
 			    && fs->root.mnt == old_root->mnt) {
 				path_get(new_root);
 				fs->root = *new_root;
+				gr_set_chroot_entries(p, new_root);
 				count++;
 			}
 			if (fs->pwd.dentry == old_root->dentry
@@ -77,6 +81,7 @@
 {
 	path_put(&fs->root);
 	path_put(&fs->pwd);
+	atomic_dec(&vs_global_fs);
 	kmem_cache_free(fs_cachep, fs);
 }
 
@@ -89,7 +94,8 @@
 		task_lock(tsk);
 		write_lock(&fs->lock);
 		tsk->fs = NULL;
-		kill = !--fs->users;
+		gr_clear_chroot_entries(tsk);
+		kill = !atomic_dec_return(&fs->users);
 		write_unlock(&fs->lock);
 		task_unlock(tsk);
 		if (kill)
@@ -102,7 +108,7 @@
 	struct fs_struct *fs = kmem_cache_alloc(fs_cachep, GFP_KERNEL);
 	/* We don't need to lock fs - think why ;-) */
 	if (fs) {
-		fs->users = 1;
+		atomic_set(&fs->users, 1);
 		fs->in_exec = 0;
 		rwlock_init(&fs->lock);
 		fs->umask = old->umask;
@@ -112,6 +118,7 @@
 		fs->pwd = old->pwd;
 		path_get(&old->pwd);
 		read_unlock(&old->lock);
+		atomic_inc(&vs_global_fs);
 	}
 	return fs;
 }
@@ -127,8 +134,9 @@
 
 	task_lock(current);
 	write_lock(&fs->lock);
-	kill = !--fs->users;
+	kill = !atomic_dec_return(&fs->users);
 	current->fs = new_fs;
+	gr_set_chroot_entries(current, &new_fs->root);
 	write_unlock(&fs->lock);
 	task_unlock(current);
 
@@ -147,7 +155,7 @@
 
 /* to be mentioned only in INIT_TASK */
 struct fs_struct init_fs = {
-	.users		= 1,
+	.users		= ATOMIC_INIT(1),
 	.lock		= __RW_LOCK_UNLOCKED(init_fs.lock),
 	.umask		= 0022,
 };
@@ -162,12 +170,13 @@
 		task_lock(current);
 
 		write_lock(&init_fs.lock);
-		init_fs.users++;
+		atomic_inc(&init_fs.users);
 		write_unlock(&init_fs.lock);
 
 		write_lock(&fs->lock);
 		current->fs = &init_fs;
-		kill = !--fs->users;
+		gr_set_chroot_entries(current, &current->fs->root);
+		kill = !atomic_dec_return(&fs->users);
 		write_unlock(&fs->lock);
 
 		task_unlock(current);
diff -uriN linux-2.6.32.43/fs/fuse/cuse.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fuse/cuse.c
--- linux-2.6.32.43/fs/fuse/cuse.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fuse/cuse.c	2011-07-15 05:51:18.000000000 -0500
@@ -528,8 +528,18 @@
 	return rc;
 }
 
-static struct file_operations cuse_channel_fops; /* initialized during init */
-
+static const struct file_operations cuse_channel_fops = { /* initialized during init */
+	.owner		= THIS_MODULE,
+	.llseek		= no_llseek,
+	.read		= do_sync_read,
+	.aio_read	= fuse_dev_read,
+	.write		= do_sync_write,
+	.aio_write	= fuse_dev_write,
+	.poll		= fuse_dev_poll,
+	.open		= cuse_channel_open,
+	.release	= cuse_channel_release,
+	.fasync		= fuse_dev_fasync,
+};
 
 /**************************************************************************
  * Misc stuff and module initializatiion
@@ -575,12 +585,6 @@
 	for (i = 0; i < CUSE_CONNTBL_LEN; i++)
 		INIT_LIST_HEAD(&cuse_conntbl[i]);
 
-	/* inherit and extend fuse_dev_operations */
-	cuse_channel_fops		= fuse_dev_operations;
-	cuse_channel_fops.owner		= THIS_MODULE;
-	cuse_channel_fops.open		= cuse_channel_open;
-	cuse_channel_fops.release	= cuse_channel_release;
-
 	cuse_class = class_create(THIS_MODULE, "cuse");
 	if (IS_ERR(cuse_class))
 		return PTR_ERR(cuse_class);
diff -uriN linux-2.6.32.43/fs/fuse/dev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fuse/dev.c
--- linux-2.6.32.43/fs/fuse/dev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fuse/dev.c	2011-07-15 05:51:18.000000000 -0500
@@ -745,7 +745,7 @@
  * request_end().  Otherwise add it to the processing list, and set
  * the 'sent' flag.
  */
-static ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
+ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
 			      unsigned long nr_segs, loff_t pos)
 {
 	int err;
@@ -827,6 +827,7 @@
 	spin_unlock(&fc->lock);
 	return err;
 }
+EXPORT_SYMBOL_GPL(fuse_dev_read);
 
 static int fuse_notify_poll(struct fuse_conn *fc, unsigned int size,
 			    struct fuse_copy_state *cs)
@@ -885,7 +886,7 @@
 {
 	struct fuse_notify_inval_entry_out outarg;
 	int err = -EINVAL;
-	char buf[FUSE_NAME_MAX+1];
+	char *buf = NULL;
 	struct qstr name;
 
 	if (size < sizeof(outarg))
@@ -899,6 +900,11 @@
 	if (outarg.namelen > FUSE_NAME_MAX)
 		goto err;
 
+	err = -ENOMEM;
+	buf = kmalloc(FUSE_NAME_MAX+1, GFP_KERNEL);
+	if (!buf)
+		goto err;
+
 	name.name = buf;
 	name.len = outarg.namelen;
 	err = fuse_copy_one(cs, buf, outarg.namelen + 1);
@@ -910,17 +916,15 @@
 
 	down_read(&fc->killsb);
 	err = -ENOENT;
-	if (!fc->sb)
-		goto err_unlock;
-
-	err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
-
-err_unlock:
+	if (fc->sb)
+		err = fuse_reverse_inval_entry(fc->sb, outarg.parent, &name);
 	up_read(&fc->killsb);
+	kfree(buf);
 	return err;
 
 err:
 	fuse_copy_finish(cs);
+	kfree(buf);
 	return err;
 }
 
@@ -987,7 +991,7 @@
  * it from the list and copy the rest of the buffer to the request.
  * The request is finished by calling request_end()
  */
-static ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
+ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
 			       unsigned long nr_segs, loff_t pos)
 {
 	int err;
@@ -1083,8 +1087,9 @@
 	fuse_copy_finish(&cs);
 	return err;
 }
+EXPORT_SYMBOL_GPL(fuse_dev_write);
 
-static unsigned fuse_dev_poll(struct file *file, poll_table *wait)
+unsigned fuse_dev_poll(struct file *file, poll_table *wait)
 {
 	unsigned mask = POLLOUT | POLLWRNORM;
 	struct fuse_conn *fc = fuse_get_conn(file);
@@ -1102,6 +1107,7 @@
 
 	return mask;
 }
+EXPORT_SYMBOL_GPL(fuse_dev_poll);
 
 /*
  * Abort all requests on the given list (pending or processing)
@@ -1218,7 +1224,7 @@
 }
 EXPORT_SYMBOL_GPL(fuse_dev_release);
 
-static int fuse_dev_fasync(int fd, struct file *file, int on)
+int fuse_dev_fasync(int fd, struct file *file, int on)
 {
 	struct fuse_conn *fc = fuse_get_conn(file);
 	if (!fc)
@@ -1227,6 +1233,7 @@
 	/* No locking - fasync_helper does its own locking */
 	return fasync_helper(fd, file, on, &fc->fasync);
 }
+EXPORT_SYMBOL_GPL(fuse_dev_fasync);
 
 const struct file_operations fuse_dev_operations = {
 	.owner		= THIS_MODULE,
diff -uriN linux-2.6.32.43/fs/fuse/dir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fuse/dir.c
--- linux-2.6.32.43/fs/fuse/dir.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fuse/dir.c	2011-07-15 05:51:18.000000000 -0500
@@ -1127,7 +1127,7 @@
 	return link;
 }
 
-static void free_link(char *link)
+static void free_link(const char *link)
 {
 	if (!IS_ERR(link))
 		free_page((unsigned long) link);
diff -uriN linux-2.6.32.43/fs/fuse/fuse_i.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fuse/fuse_i.h
--- linux-2.6.32.43/fs/fuse/fuse_i.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/fuse/fuse_i.h	2011-07-15 05:51:18.000000000 -0500
@@ -525,6 +525,16 @@
 
 extern const struct dentry_operations fuse_dentry_operations;
 
+extern ssize_t fuse_dev_read(struct kiocb *iocb, const struct iovec *iov,
+			      unsigned long nr_segs, loff_t pos);
+
+extern ssize_t fuse_dev_write(struct kiocb *iocb, const struct iovec *iov,
+			       unsigned long nr_segs, loff_t pos);
+
+extern unsigned fuse_dev_poll(struct file *file, poll_table *wait);
+
+extern int fuse_dev_fasync(int fd, struct file *file, int on);
+
 /**
  * Inode to nodeid comparison.
  */
diff -uriN linux-2.6.32.43/fs/gfs2/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/gfs2/file.c
--- linux-2.6.32.43/fs/gfs2/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/gfs2/file.c	2011-07-15 05:50:11.000000000 -0500
@@ -132,6 +132,9 @@
 	[7] = GFS2_DIF_NOATIME,
 	[12] = GFS2_DIF_EXHASH,
 	[14] = GFS2_DIF_INHERIT_JDATA,
+	[27] = GFS2_DIF_IXUNLINK,
+	[26] = GFS2_DIF_BARRIER,
+	[29] = GFS2_DIF_COW,
 };
 
 static const u32 gfs2_to_fsflags[32] = {
@@ -141,6 +144,9 @@
 	[gfs2fl_NoAtime] = FS_NOATIME_FL,
 	[gfs2fl_ExHash] = FS_INDEX_FL,
 	[gfs2fl_InheritJdata] = FS_JOURNAL_DATA_FL,
+	[gfs2fl_IXUnlink] = FS_IXUNLINK_FL,
+	[gfs2fl_Barrier] = FS_BARRIER_FL,
+	[gfs2fl_Cow] = FS_COW_FL,
 };
 
 static int gfs2_get_flags(struct file *filp, u32 __user *ptr)
@@ -171,10 +177,16 @@
 {
 	struct gfs2_inode *ip = GFS2_I(inode);
 	unsigned int flags = inode->i_flags;
+	unsigned int vflags = inode->i_vflags;
+
+	flags &= ~(S_IMMUTABLE | S_IXUNLINK |
+		S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
 
-	flags &= ~(S_SYNC|S_APPEND|S_IMMUTABLE|S_NOATIME|S_DIRSYNC);
 	if (ip->i_diskflags & GFS2_DIF_IMMUTABLE)
 		flags |= S_IMMUTABLE;
+	if (ip->i_diskflags & GFS2_DIF_IXUNLINK)
+		flags |= S_IXUNLINK;
+
 	if (ip->i_diskflags & GFS2_DIF_APPENDONLY)
 		flags |= S_APPEND;
 	if (ip->i_diskflags & GFS2_DIF_NOATIME)
@@ -182,6 +194,43 @@
 	if (ip->i_diskflags & GFS2_DIF_SYNC)
 		flags |= S_SYNC;
 	inode->i_flags = flags;
+
+	vflags &= ~(V_BARRIER | V_COW);
+
+	if (ip->i_diskflags & GFS2_DIF_BARRIER)
+		vflags |= V_BARRIER;
+	if (ip->i_diskflags & GFS2_DIF_COW)
+		vflags |= V_COW;
+	inode->i_vflags = vflags;
+}
+
+void gfs2_get_inode_flags(struct inode *inode)
+{
+	struct gfs2_inode *ip = GFS2_I(inode);
+	unsigned int flags = inode->i_flags;
+	unsigned int vflags = inode->i_vflags;
+
+	ip->i_diskflags &= ~(GFS2_DIF_APPENDONLY |
+			GFS2_DIF_NOATIME | GFS2_DIF_SYNC |
+			GFS2_DIF_IMMUTABLE | GFS2_DIF_IXUNLINK |
+			GFS2_DIF_BARRIER | GFS2_DIF_COW);
+
+	if (flags & S_IMMUTABLE)
+		ip->i_diskflags |= GFS2_DIF_IMMUTABLE;
+	if (flags & S_IXUNLINK)
+		ip->i_diskflags |= GFS2_DIF_IXUNLINK;
+
+	if (flags & S_APPEND)
+		ip->i_diskflags |= GFS2_DIF_APPENDONLY;
+	if (flags & S_NOATIME)
+		ip->i_diskflags |= GFS2_DIF_NOATIME;
+	if (flags & S_SYNC)
+		ip->i_diskflags |= GFS2_DIF_SYNC;
+
+	if (vflags & V_BARRIER)
+		ip->i_diskflags |= GFS2_DIF_BARRIER;
+	if (vflags & V_COW)
+		ip->i_diskflags |= GFS2_DIF_COW;
 }
 
 /* Flags that can be set by user space */
@@ -293,6 +342,37 @@
 	return do_gfs2_set_flags(filp, gfsflags, ~GFS2_DIF_JDATA);
 }
 
+int gfs2_sync_flags(struct inode *inode, int flags, int vflags)
+{
+	struct gfs2_inode *ip = GFS2_I(inode);
+	struct gfs2_sbd *sdp = GFS2_SB(inode);
+	struct buffer_head *bh;
+	struct gfs2_holder gh;
+	int error;
+
+	error = gfs2_glock_nq_init(ip->i_gl, LM_ST_EXCLUSIVE, 0, &gh);
+	if (error)
+		return error;
+	error = gfs2_trans_begin(sdp, RES_DINODE, 0);
+	if (error)
+		goto out;
+	error = gfs2_meta_inode_buffer(ip, &bh);
+	if (error)
+		goto out_trans_end;
+	gfs2_trans_add_bh(ip->i_gl, bh, 1);
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+	gfs2_get_inode_flags(inode);
+	gfs2_dinode_out(ip, bh->b_data);
+	brelse(bh);
+	gfs2_set_aops(inode);
+out_trans_end:
+	gfs2_trans_end(sdp);
+out:
+	gfs2_glock_dq_uninit(&gh);
+	return error;
+}
+
 static long gfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	switch(cmd) {
diff -uriN linux-2.6.32.43/fs/gfs2/inode.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/gfs2/inode.h
--- linux-2.6.32.43/fs/gfs2/inode.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/gfs2/inode.h	2011-07-15 05:50:11.000000000 -0500
@@ -109,6 +109,7 @@
 extern const struct file_operations gfs2_dir_fops_nolock;
 
 extern void gfs2_set_inode_flags(struct inode *inode);
+extern int gfs2_sync_flags(struct inode *inode, int flags, int vflags);
  
 #ifdef CONFIG_GFS2_FS_LOCKING_DLM
 extern const struct file_operations gfs2_file_fops;
diff -uriN linux-2.6.32.43/fs/gfs2/ops_inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/gfs2/ops_inode.c
--- linux-2.6.32.43/fs/gfs2/ops_inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/gfs2/ops_inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -752,6 +752,8 @@
 	unsigned int x;
 	int error;
 
+	pax_track_stack();
+
 	if (ndentry->d_inode) {
 		nip = GFS2_I(ndentry->d_inode);
 		if (ip == nip)
@@ -1400,6 +1402,7 @@
 	.listxattr = gfs2_listxattr,
 	.removexattr = gfs2_removexattr,
 	.fiemap = gfs2_fiemap,
+	.sync_flags = gfs2_sync_flags,
 };
 
 const struct inode_operations gfs2_dir_iops = {
@@ -1420,6 +1423,7 @@
 	.listxattr = gfs2_listxattr,
 	.removexattr = gfs2_removexattr,
 	.fiemap = gfs2_fiemap,
+	.sync_flags = gfs2_sync_flags,
 };
 
 const struct inode_operations gfs2_symlink_iops = {
diff -uriN linux-2.6.32.43/fs/gfs2/sys.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/gfs2/sys.c
--- linux-2.6.32.43/fs/gfs2/sys.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/gfs2/sys.c	2011-07-15 05:51:18.000000000 -0500
@@ -49,7 +49,7 @@
 	return a->store ? a->store(sdp, buf, len) : len;
 }
 
-static struct sysfs_ops gfs2_attr_ops = {
+static const struct sysfs_ops gfs2_attr_ops = {
 	.show  = gfs2_attr_show,
 	.store = gfs2_attr_store,
 };
@@ -584,7 +584,7 @@
 	return 0;
 }
 
-static struct kset_uevent_ops gfs2_uevent_ops = {
+static const struct kset_uevent_ops gfs2_uevent_ops = {
 	.uevent = gfs2_uevent,
 };
 
diff -uriN linux-2.6.32.43/fs/hfsplus/catalog.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/catalog.c
--- linux-2.6.32.43/fs/hfsplus/catalog.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/catalog.c	2011-07-15 05:51:18.000000000 -0500
@@ -157,6 +157,8 @@
 	int err;
 	u16 type;
 
+	pax_track_stack();
+
 	hfsplus_cat_build_key(sb, fd->search_key, cnid, NULL);
 	err = hfs_brec_read(fd, &tmp, sizeof(hfsplus_cat_entry));
 	if (err)
@@ -186,6 +188,8 @@
 	int entry_size;
 	int err;
 
+	pax_track_stack();
+
 	dprint(DBG_CAT_MOD, "create_cat: %s,%u(%d)\n", str->name, cnid, inode->i_nlink);
 	sb = dir->i_sb;
 	hfs_find_init(HFSPLUS_SB(sb).cat_tree, &fd);
@@ -318,6 +322,8 @@
 	int entry_size, type;
 	int err = 0;
 
+	pax_track_stack();
+
 	dprint(DBG_CAT_MOD, "rename_cat: %u - %lu,%s - %lu,%s\n", cnid, src_dir->i_ino, src_name->name,
 		dst_dir->i_ino, dst_name->name);
 	sb = src_dir->i_sb;
diff -uriN linux-2.6.32.43/fs/hfsplus/dir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/dir.c
--- linux-2.6.32.43/fs/hfsplus/dir.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/dir.c	2011-07-15 05:51:18.000000000 -0500
@@ -121,6 +121,8 @@
 	struct hfsplus_readdir_data *rd;
 	u16 type;
 
+	pax_track_stack();
+
 	if (filp->f_pos >= inode->i_size)
 		return 0;
 
diff -uriN linux-2.6.32.43/fs/hfsplus/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/inode.c
--- linux-2.6.32.43/fs/hfsplus/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -399,6 +399,8 @@
 	int res = 0;
 	u16 type;
 
+	pax_track_stack();
+
 	type = hfs_bnode_read_u16(fd->bnode, fd->entryoffset);
 
 	HFSPLUS_I(inode).dev = 0;
@@ -461,6 +463,8 @@
 	struct hfs_find_data fd;
 	hfsplus_cat_entry entry;
 
+	pax_track_stack();
+
 	if (HFSPLUS_IS_RSRC(inode))
 		main_inode = HFSPLUS_I(inode).rsrc_inode;
 
diff -uriN linux-2.6.32.43/fs/hfsplus/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/ioctl.c
--- linux-2.6.32.43/fs/hfsplus/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/ioctl.c	2011-07-15 05:51:18.000000000 -0500
@@ -17,6 +17,7 @@
 #include <linux/mount.h>
 #include <linux/sched.h>
 #include <linux/xattr.h>
+#include <linux/mount.h>
 #include <asm/uaccess.h>
 #include "hfsplus_fs.h"
 
@@ -101,6 +102,8 @@
 	struct hfsplus_cat_file *file;
 	int res;
 
+	pax_track_stack();
+
 	if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
 		return -EOPNOTSUPP;
 
@@ -143,6 +146,8 @@
 	struct hfsplus_cat_file *file;
 	ssize_t res = 0;
 
+	pax_track_stack();
+
 	if (!S_ISREG(inode->i_mode) || HFSPLUS_IS_RSRC(inode))
 		return -EOPNOTSUPP;
 
diff -uriN linux-2.6.32.43/fs/hfsplus/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/super.c
--- linux-2.6.32.43/fs/hfsplus/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hfsplus/super.c	2011-07-15 05:51:18.000000000 -0500
@@ -312,6 +312,8 @@
 	struct nls_table *nls = NULL;
 	int err = -EINVAL;
 
+	pax_track_stack();
+
 	sbi = kzalloc(sizeof(*sbi), GFP_KERNEL);
 	if (!sbi)
 		return -ENOMEM;
diff -uriN linux-2.6.32.43/fs/hugetlbfs/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hugetlbfs/inode.c
--- linux-2.6.32.43/fs/hugetlbfs/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/hugetlbfs/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -909,7 +909,7 @@
 	.kill_sb	= kill_litter_super,
 };
 
-static struct vfsmount *hugetlbfs_vfsmount;
+struct vfsmount *hugetlbfs_vfsmount;
 
 static int can_do_hugetlb_shm(void)
 {
diff -uriN linux-2.6.32.43/fs/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/inode.c
--- linux-2.6.32.43/fs/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -133,6 +133,9 @@
 	struct address_space *const mapping = &inode->i_data;
 
 	inode->i_sb = sb;
+
+	/* essential because of inode slab reuse */
+	inode->i_tag = 0;
 	inode->i_blkbits = sb->s_blocksize_bits;
 	inode->i_flags = 0;
 	atomic_set(&inode->i_count, 1);
@@ -153,6 +156,7 @@
 	inode->i_bdev = NULL;
 	inode->i_cdev = NULL;
 	inode->i_rdev = 0;
+	inode->i_mdev = 0;
 	inode->dirtied_when = 0;
 
 	if (security_inode_alloc(inode))
@@ -315,6 +319,8 @@
 	inodes_stat.nr_unused--;
 }
 
+EXPORT_SYMBOL_GPL(__iget);
+
 /**
  * clear_inode - clear an inode
  * @inode: inode to clear
@@ -1619,9 +1625,11 @@
 	if (S_ISCHR(mode)) {
 		inode->i_fop = &def_chr_fops;
 		inode->i_rdev = rdev;
+		inode->i_mdev = rdev;
 	} else if (S_ISBLK(mode)) {
 		inode->i_fop = &def_blk_fops;
 		inode->i_rdev = rdev;
+		inode->i_mdev = rdev;
 	} else if (S_ISFIFO(mode))
 		inode->i_fop = &def_fifo_fops;
 	else if (S_ISSOCK(mode))
diff -uriN linux-2.6.32.43/fs/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ioctl.c
--- linux-2.6.32.43/fs/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ioctl.c	2011-07-15 05:51:18.000000000 -0500
@@ -16,6 +16,9 @@
 #include <linux/writeback.h>
 #include <linux/buffer_head.h>
 #include <linux/falloc.h>
+#include <linux/proc_fs.h>
+#include <linux/vserver/inode.h>
+#include <linux/vs_tag.h>
 
 #include <asm/ioctls.h>
 
@@ -97,7 +100,7 @@
 			    u64 phys, u64 len, u32 flags)
 {
 	struct fiemap_extent extent;
-	struct fiemap_extent *dest = fieinfo->fi_extents_start;
+	struct fiemap_extent __user *dest = fieinfo->fi_extents_start;
 
 	/* only count the extents */
 	if (fieinfo->fi_extents_max == 0) {
@@ -207,7 +210,7 @@
 
 	fieinfo.fi_flags = fiemap.fm_flags;
 	fieinfo.fi_extents_max = fiemap.fm_extent_count;
-	fieinfo.fi_extents_start = (struct fiemap_extent *)(arg + sizeof(fiemap));
+	fieinfo.fi_extents_start = (struct fiemap_extent __user *)(arg + sizeof(fiemap));
 
 	if (fiemap.fm_extent_count != 0 &&
 	    !access_ok(VERIFY_WRITE, fieinfo.fi_extents_start,
@@ -220,7 +223,7 @@
 	error = inode->i_op->fiemap(inode, &fieinfo, fiemap.fm_start, len);
 	fiemap.fm_flags = fieinfo.fi_flags;
 	fiemap.fm_mapped_extents = fieinfo.fi_extents_mapped;
-	if (copy_to_user((char *)arg, &fiemap, sizeof(fiemap)))
+	if (copy_to_user((__force char __user *)arg, &fiemap, sizeof(fiemap)))
 		error = -EFAULT;
 
 	return error;
diff -uriN linux-2.6.32.43/fs/ioprio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ioprio.c
--- linux-2.6.32.43/fs/ioprio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ioprio.c	2011-07-15 05:50:11.000000000 -0500
@@ -26,6 +26,7 @@
 #include <linux/syscalls.h>
 #include <linux/security.h>
 #include <linux/pid_namespace.h>
+#include <linux/vs_base.h>
 
 int set_task_ioprio(struct task_struct *task, int ioprio)
 {
@@ -123,6 +124,8 @@
 			else
 				pgrp = find_vpid(who);
 			do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
+				if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
+					continue;
 				ret = set_task_ioprio(p, ioprio);
 				if (ret)
 					break;
@@ -212,6 +215,8 @@
 			else
 				pgrp = find_vpid(who);
 			do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
+				if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
+					continue;
 				tmpio = get_task_ioprio(p);
 				if (tmpio < 0)
 					continue;
diff -uriN linux-2.6.32.43/fs/jbd/checkpoint.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jbd/checkpoint.c
--- linux-2.6.32.43/fs/jbd/checkpoint.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jbd/checkpoint.c	2011-07-15 05:51:18.000000000 -0500
@@ -348,6 +348,8 @@
 	tid_t this_tid;
 	int result;
 
+	pax_track_stack();
+
 	jbd_debug(1, "Start checkpoint\n");
 
 	/*
diff -uriN linux-2.6.32.43/fs/jffs2/compr_rtime.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/compr_rtime.c
--- linux-2.6.32.43/fs/jffs2/compr_rtime.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/compr_rtime.c	2011-07-15 05:51:18.000000000 -0500
@@ -37,6 +37,8 @@
 	int outpos = 0;
 	int pos=0;
 
+	pax_track_stack();
+
 	memset(positions,0,sizeof(positions));
 
 	while (pos < (*sourcelen) && outpos <= (*dstlen)-2) {
@@ -79,6 +81,8 @@
 	int outpos = 0;
 	int pos=0;
 
+	pax_track_stack();
+
 	memset(positions,0,sizeof(positions));
 
 	while (outpos<destlen) {
diff -uriN linux-2.6.32.43/fs/jffs2/compr_rubin.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/compr_rubin.c
--- linux-2.6.32.43/fs/jffs2/compr_rubin.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/compr_rubin.c	2011-07-15 05:51:18.000000000 -0500
@@ -314,6 +314,8 @@
 	int ret;
 	uint32_t mysrclen, mydstlen;
 
+	pax_track_stack();
+
 	mysrclen = *sourcelen;
 	mydstlen = *dstlen - 8;
 
diff -uriN linux-2.6.32.43/fs/jffs2/erase.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/erase.c
--- linux-2.6.32.43/fs/jffs2/erase.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/erase.c	2011-07-15 05:51:18.000000000 -0500
@@ -434,7 +434,8 @@
 		struct jffs2_unknown_node marker = {
 			.magic =	cpu_to_je16(JFFS2_MAGIC_BITMASK),
 			.nodetype =	cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
-			.totlen =	cpu_to_je32(c->cleanmarker_size)
+			.totlen =	cpu_to_je32(c->cleanmarker_size),
+			.hdr_crc =	cpu_to_je32(0)
 		};
 
 		jffs2_prealloc_raw_node_refs(c, jeb, 1);
diff -uriN linux-2.6.32.43/fs/jffs2/wbuf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/wbuf.c
--- linux-2.6.32.43/fs/jffs2/wbuf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/wbuf.c	2011-07-15 05:51:18.000000000 -0500
@@ -1012,7 +1012,8 @@
 {
 	.magic = constant_cpu_to_je16(JFFS2_MAGIC_BITMASK),
 	.nodetype = constant_cpu_to_je16(JFFS2_NODETYPE_CLEANMARKER),
-	.totlen = constant_cpu_to_je32(8)
+	.totlen = constant_cpu_to_je32(8),
+	.hdr_crc = constant_cpu_to_je32(0)
 };
 
 /*
diff -uriN linux-2.6.32.43/fs/jffs2/xattr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/xattr.c
--- linux-2.6.32.43/fs/jffs2/xattr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jffs2/xattr.c	2011-07-15 05:51:18.000000000 -0500
@@ -773,6 +773,8 @@
 
 	BUG_ON(!(c->flags & JFFS2_SB_FLAG_BUILDING));
 
+	pax_track_stack();
+
 	/* Phase.1 : Merge same xref */
 	for (i=0; i < XREF_TMPHASH_SIZE; i++)
 		xref_tmphash[i] = NULL;
diff -uriN linux-2.6.32.43/fs/jfs/acl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/acl.c
--- linux-2.6.32.43/fs/jfs/acl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/acl.c	2011-07-15 05:50:11.000000000 -0500
@@ -216,7 +216,8 @@
 		return rc;
 
 	if ((iattr->ia_valid & ATTR_UID && iattr->ia_uid != inode->i_uid) ||
-	    (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid)) {
+	    (iattr->ia_valid & ATTR_GID && iattr->ia_gid != inode->i_gid) ||
+	    (iattr->ia_valid & ATTR_TAG && iattr->ia_tag != inode->i_tag)) {
 		if (vfs_dq_transfer(inode, iattr))
 			return -EDQUOT;
 	}
diff -uriN linux-2.6.32.43/fs/jfs/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/file.c
--- linux-2.6.32.43/fs/jfs/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/file.c	2011-07-15 05:50:11.000000000 -0500
@@ -98,6 +98,7 @@
 	.setattr	= jfs_setattr,
 	.check_acl	= jfs_check_acl,
 #endif
+	.sync_flags	= jfs_sync_flags,
 };
 
 const struct file_operations jfs_file_operations = {
diff -uriN linux-2.6.32.43/fs/jfs/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/ioctl.c
--- linux-2.6.32.43/fs/jfs/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/ioctl.c	2011-07-15 05:50:11.000000000 -0500
@@ -11,6 +11,7 @@
 #include <linux/mount.h>
 #include <linux/time.h>
 #include <linux/sched.h>
+#include <linux/mount.h>
 #include <asm/current.h>
 #include <asm/uaccess.h>
 
@@ -52,6 +53,16 @@
 }
 
 
+int jfs_sync_flags(struct inode *inode, int flags, int vflags)
+{
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+	jfs_get_inode_flags(JFS_IP(inode));
+	inode->i_ctime = CURRENT_TIME_SEC;
+	mark_inode_dirty(inode);
+	return 0;
+}
+
 long jfs_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	struct inode *inode = filp->f_dentry->d_inode;
@@ -85,6 +96,11 @@
 		if (!S_ISDIR(inode->i_mode))
 			flags &= ~JFS_DIRSYNC_FL;
 
+		if (IS_BARRIER(inode)) {
+			vxwprintk_task(1, "messing with the barrier.");
+			return -EACCES;
+		}
+
 		/* Is it quota file? Do not allow user to mess with it */
 		if (IS_NOQUOTA(inode)) {
 			err = -EPERM;
@@ -102,8 +118,8 @@
 		 * the relevant capability.
 		 */
 		if ((oldflags & JFS_IMMUTABLE_FL) ||
-			((flags ^ oldflags) &
-			(JFS_APPEND_FL | JFS_IMMUTABLE_FL))) {
+			((flags ^ oldflags) & (JFS_APPEND_FL |
+			JFS_IMMUTABLE_FL | JFS_IXUNLINK_FL))) {
 			if (!capable(CAP_LINUX_IMMUTABLE)) {
 				mutex_unlock(&inode->i_mutex);
 				err = -EPERM;
@@ -111,7 +127,7 @@
 			}
 		}
 
-		flags = flags & JFS_FL_USER_MODIFIABLE;
+		flags &= JFS_FL_USER_MODIFIABLE;
 		flags |= oldflags & ~JFS_FL_USER_MODIFIABLE;
 		jfs_inode->mode2 = flags;
 
diff -uriN linux-2.6.32.43/fs/jfs/jfs_dinode.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_dinode.h
--- linux-2.6.32.43/fs/jfs/jfs_dinode.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_dinode.h	2011-07-15 05:50:11.000000000 -0500
@@ -161,9 +161,13 @@
 
 #define JFS_APPEND_FL		0x01000000 /* writes to file may only append */
 #define JFS_IMMUTABLE_FL	0x02000000 /* Immutable file */
+#define JFS_IXUNLINK_FL		0x08000000 /* Immutable invert on unlink */
 
-#define JFS_FL_USER_VISIBLE	0x03F80000
-#define JFS_FL_USER_MODIFIABLE	0x03F80000
+#define JFS_BARRIER_FL		0x04000000 /* Barrier for chroot() */
+#define JFS_COW_FL		0x20000000 /* Copy on Write marker */
+
+#define JFS_FL_USER_VISIBLE	0x07F80000
+#define JFS_FL_USER_MODIFIABLE	0x07F80000
 #define JFS_FL_INHERIT		0x03C80000
 
 /* These are identical to EXT[23]_IOC_GETFLAGS/SETFLAGS */
diff -uriN linux-2.6.32.43/fs/jfs/jfs_filsys.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_filsys.h
--- linux-2.6.32.43/fs/jfs/jfs_filsys.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_filsys.h	2011-07-15 05:50:11.000000000 -0500
@@ -263,6 +263,7 @@
 #define JFS_NAME_MAX	255
 #define JFS_PATH_MAX	BPSIZE
 
+#define JFS_TAGGED		0x00800000	/* Context Tagging */
 
 /*
  *	file system state (superblock state)
diff -uriN linux-2.6.32.43/fs/jfs/jfs_imap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_imap.c
--- linux-2.6.32.43/fs/jfs/jfs_imap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_imap.c	2011-07-15 05:50:11.000000000 -0500
@@ -45,6 +45,7 @@
 #include <linux/buffer_head.h>
 #include <linux/pagemap.h>
 #include <linux/quotaops.h>
+#include <linux/vs_tag.h>
 
 #include "jfs_incore.h"
 #include "jfs_inode.h"
@@ -3059,6 +3060,8 @@
 {
 	struct jfs_inode_info *jfs_ip = JFS_IP(ip);
 	struct jfs_sb_info *sbi = JFS_SBI(ip->i_sb);
+	uid_t uid;
+	gid_t gid;
 
 	jfs_ip->fileset = le32_to_cpu(dip->di_fileset);
 	jfs_ip->mode2 = le32_to_cpu(dip->di_mode);
@@ -3079,14 +3082,18 @@
 	}
 	ip->i_nlink = le32_to_cpu(dip->di_nlink);
 
-	jfs_ip->saved_uid = le32_to_cpu(dip->di_uid);
+	uid = le32_to_cpu(dip->di_uid);
+	gid = le32_to_cpu(dip->di_gid);
+	ip->i_tag = INOTAG_TAG(DX_TAG(ip), uid, gid, 0);
+
+	jfs_ip->saved_uid = INOTAG_UID(DX_TAG(ip), uid, gid);
 	if (sbi->uid == -1)
 		ip->i_uid = jfs_ip->saved_uid;
 	else {
 		ip->i_uid = sbi->uid;
 	}
 
-	jfs_ip->saved_gid = le32_to_cpu(dip->di_gid);
+	jfs_ip->saved_gid = INOTAG_GID(DX_TAG(ip), uid, gid);
 	if (sbi->gid == -1)
 		ip->i_gid = jfs_ip->saved_gid;
 	else {
@@ -3151,14 +3158,12 @@
 	dip->di_size = cpu_to_le64(ip->i_size);
 	dip->di_nblocks = cpu_to_le64(PBLK2LBLK(ip->i_sb, ip->i_blocks));
 	dip->di_nlink = cpu_to_le32(ip->i_nlink);
-	if (sbi->uid == -1)
-		dip->di_uid = cpu_to_le32(ip->i_uid);
-	else
-		dip->di_uid = cpu_to_le32(jfs_ip->saved_uid);
-	if (sbi->gid == -1)
-		dip->di_gid = cpu_to_le32(ip->i_gid);
-	else
-		dip->di_gid = cpu_to_le32(jfs_ip->saved_gid);
+
+	dip->di_uid = cpu_to_le32(TAGINO_UID(DX_TAG(ip),
+		(sbi->uid == -1) ? ip->i_uid : jfs_ip->saved_uid, ip->i_tag));
+	dip->di_gid = cpu_to_le32(TAGINO_GID(DX_TAG(ip),
+		(sbi->gid == -1) ? ip->i_gid : jfs_ip->saved_gid, ip->i_tag));
+
 	jfs_get_inode_flags(jfs_ip);
 	/*
 	 * mode2 is only needed for storing the higher order bits.
diff -uriN linux-2.6.32.43/fs/jfs/jfs_inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_inode.c
--- linux-2.6.32.43/fs/jfs/jfs_inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -18,6 +18,7 @@
 
 #include <linux/fs.h>
 #include <linux/quotaops.h>
+#include <linux/vs_tag.h>
 #include "jfs_incore.h"
 #include "jfs_inode.h"
 #include "jfs_filsys.h"
@@ -30,29 +31,46 @@
 {
 	unsigned int flags = JFS_IP(inode)->mode2;
 
-	inode->i_flags &= ~(S_IMMUTABLE | S_APPEND |
-		S_NOATIME | S_DIRSYNC | S_SYNC);
+	inode->i_flags &= ~(S_IMMUTABLE | S_IXUNLINK |
+		S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
 
 	if (flags & JFS_IMMUTABLE_FL)
 		inode->i_flags |= S_IMMUTABLE;
+	if (flags & JFS_IXUNLINK_FL)
+		inode->i_flags |= S_IXUNLINK;
+
+	if (flags & JFS_SYNC_FL)
+		inode->i_flags |= S_SYNC;
 	if (flags & JFS_APPEND_FL)
 		inode->i_flags |= S_APPEND;
 	if (flags & JFS_NOATIME_FL)
 		inode->i_flags |= S_NOATIME;
 	if (flags & JFS_DIRSYNC_FL)
 		inode->i_flags |= S_DIRSYNC;
-	if (flags & JFS_SYNC_FL)
-		inode->i_flags |= S_SYNC;
+
+	inode->i_vflags &= ~(V_BARRIER | V_COW);
+
+	if (flags & JFS_BARRIER_FL)
+		inode->i_vflags |= V_BARRIER;
+	if (flags & JFS_COW_FL)
+		inode->i_vflags |= V_COW;
 }
 
 void jfs_get_inode_flags(struct jfs_inode_info *jfs_ip)
 {
 	unsigned int flags = jfs_ip->vfs_inode.i_flags;
+	unsigned int vflags = jfs_ip->vfs_inode.i_vflags;
+
+	jfs_ip->mode2 &= ~(JFS_IMMUTABLE_FL | JFS_IXUNLINK_FL |
+			   JFS_APPEND_FL | JFS_NOATIME_FL |
+			   JFS_DIRSYNC_FL | JFS_SYNC_FL |
+			   JFS_BARRIER_FL | JFS_COW_FL);
 
-	jfs_ip->mode2 &= ~(JFS_IMMUTABLE_FL | JFS_APPEND_FL | JFS_NOATIME_FL |
-			   JFS_DIRSYNC_FL | JFS_SYNC_FL);
 	if (flags & S_IMMUTABLE)
 		jfs_ip->mode2 |= JFS_IMMUTABLE_FL;
+	if (flags & S_IXUNLINK)
+		jfs_ip->mode2 |= JFS_IXUNLINK_FL;
+
 	if (flags & S_APPEND)
 		jfs_ip->mode2 |= JFS_APPEND_FL;
 	if (flags & S_NOATIME)
@@ -61,6 +79,11 @@
 		jfs_ip->mode2 |= JFS_DIRSYNC_FL;
 	if (flags & S_SYNC)
 		jfs_ip->mode2 |= JFS_SYNC_FL;
+
+	if (vflags & V_BARRIER)
+		jfs_ip->mode2 |= JFS_BARRIER_FL;
+	if (vflags & V_COW)
+		jfs_ip->mode2 |= JFS_COW_FL;
 }
 
 /*
@@ -105,6 +128,7 @@
 			mode |= S_ISGID;
 	} else
 		inode->i_gid = current_fsgid();
+	inode->i_tag = dx_current_fstag(sb);
 
 	/*
 	 * New inodes need to save sane values on disk when
diff -uriN linux-2.6.32.43/fs/jfs/jfs_inode.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_inode.h
--- linux-2.6.32.43/fs/jfs/jfs_inode.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/jfs_inode.h	2011-07-15 05:50:11.000000000 -0500
@@ -39,6 +39,7 @@
 extern struct dentry *jfs_fh_to_parent(struct super_block *sb, struct fid *fid,
 	int fh_len, int fh_type);
 extern void jfs_set_inode_flags(struct inode *);
+extern int jfs_sync_flags(struct inode *, int, int);
 extern int jfs_get_block(struct inode *, sector_t, struct buffer_head *, int);
 
 extern const struct address_space_operations jfs_aops;
diff -uriN linux-2.6.32.43/fs/jfs/namei.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/namei.c
--- linux-2.6.32.43/fs/jfs/namei.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/namei.c	2011-07-15 05:50:11.000000000 -0500
@@ -21,6 +21,7 @@
 #include <linux/ctype.h>
 #include <linux/quotaops.h>
 #include <linux/exportfs.h>
+#include <linux/vs_tag.h>
 #include "jfs_incore.h"
 #include "jfs_superblock.h"
 #include "jfs_inode.h"
@@ -1476,6 +1477,7 @@
 		return ERR_CAST(ip);
 	}
 
+	dx_propagate_tag(nd, ip);
 	dentry = d_splice_alias(ip, dentry);
 
 	if (dentry && (JFS_SBI(dip->i_sb)->mntflag & JFS_OS2))
@@ -1545,6 +1547,7 @@
 	.setattr	= jfs_setattr,
 	.check_acl	= jfs_check_acl,
 #endif
+	.sync_flags	= jfs_sync_flags,
 };
 
 const struct file_operations jfs_dir_operations = {
diff -uriN linux-2.6.32.43/fs/jfs/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/super.c
--- linux-2.6.32.43/fs/jfs/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/jfs/super.c	2011-07-15 05:51:18.000000000 -0500
@@ -192,7 +192,8 @@
 enum {
 	Opt_integrity, Opt_nointegrity, Opt_iocharset, Opt_resize,
 	Opt_resize_nosize, Opt_errors, Opt_ignore, Opt_err, Opt_quota,
-	Opt_usrquota, Opt_grpquota, Opt_uid, Opt_gid, Opt_umask
+	Opt_usrquota, Opt_grpquota, Opt_uid, Opt_gid, Opt_umask,
+	Opt_tag, Opt_notag, Opt_tagid
 };
 
 static const match_table_t tokens = {
@@ -202,6 +203,10 @@
 	{Opt_resize, "resize=%u"},
 	{Opt_resize_nosize, "resize"},
 	{Opt_errors, "errors=%s"},
+	{Opt_tag, "tag"},
+	{Opt_notag, "notag"},
+	{Opt_tagid, "tagid=%u"},
+	{Opt_tag, "tagxid"},
 	{Opt_ignore, "noquota"},
 	{Opt_ignore, "quota"},
 	{Opt_usrquota, "usrquota"},
@@ -336,6 +341,20 @@
 			}
 			break;
 		}
+#ifndef CONFIG_TAGGING_NONE
+		case Opt_tag:
+			*flag |= JFS_TAGGED;
+			break;
+		case Opt_notag:
+			*flag &= JFS_TAGGED;
+			break;
+#endif
+#ifdef CONFIG_PROPAGATE
+		case Opt_tagid:
+			/* use args[0] */
+			*flag |= JFS_TAGGED;
+			break;
+#endif
 		default:
 			printk("jfs: Unrecognized mount option \"%s\" "
 					" or missing value\n", p);
@@ -366,6 +385,12 @@
 	if (!parse_options(data, sb, &newLVSize, &flag)) {
 		return -EINVAL;
 	}
+	if ((flag & JFS_TAGGED) && !(sb->s_flags & MS_TAGGED)) {
+		printk(KERN_ERR "JFS: %s: tagging not permitted on remount.\n",
+			sb->s_id);
+		return -EINVAL;
+	}
+
 	lock_kernel();
 	if (newLVSize) {
 		if (sb->s_flags & MS_RDONLY) {
@@ -449,6 +474,9 @@
 #ifdef CONFIG_JFS_POSIX_ACL
 	sb->s_flags |= MS_POSIXACL;
 #endif
+	/* map mount option tagxid */
+	if (sbi->flag & JFS_TAGGED)
+		sb->s_flags |= MS_TAGGED;
 
 	if (newLVSize) {
 		printk(KERN_ERR "resize option for remount only\n");
@@ -793,7 +821,7 @@
 
 	jfs_inode_cachep =
 	    kmem_cache_create("jfs_ip", sizeof(struct jfs_inode_info), 0,
-			    SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD,
+			    SLAB_RECLAIM_ACCOUNT|SLAB_MEM_SPREAD|SLAB_USERCOPY,
 			    init_once);
 	if (jfs_inode_cachep == NULL)
 		return -ENOMEM;
diff -uriN linux-2.6.32.43/fs/Kconfig.binfmt linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/Kconfig.binfmt
--- linux-2.6.32.43/fs/Kconfig.binfmt	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/Kconfig.binfmt	2011-07-15 05:51:18.000000000 -0500
@@ -86,7 +86,7 @@
 
 config BINFMT_AOUT
 	tristate "Kernel support for a.out and ECOFF binaries"
-	depends on HAVE_AOUT
+	depends on HAVE_AOUT && BROKEN
 	---help---
 	  A.out (Assembler.OUTput) is a set of formats for libraries and
 	  executables used in the earliest versions of UNIX.  Linux used
diff -uriN linux-2.6.32.43/fs/libfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/libfs.c
--- linux-2.6.32.43/fs/libfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/libfs.c	2011-07-15 06:09:54.000000000 -0500
@@ -127,7 +127,8 @@
  * both impossible due to the lock on directory.
  */
 
-int dcache_readdir(struct file * filp, void * dirent, filldir_t filldir)
+static inline int do_dcache_readdir_filter(struct file *filp,
+	void *dirent, filldir_t filldir, int (*filter)(struct dentry *dentry))
 {
 	struct dentry *dentry = filp->f_path.dentry;
 	struct dentry *cursor = filp->private_data;
@@ -157,12 +158,22 @@
 
 			for (p=q->next; p != &dentry->d_subdirs; p=p->next) {
 				struct dentry *next;
+				char d_name[sizeof(next->d_iname)];
+				const unsigned char *name;
+
 				next = list_entry(p, struct dentry, d_u.d_child);
 				if (d_unhashed(next) || !next->d_inode)
 					continue;
+				if (filter && !filter(next))
+					continue;
 
 				spin_unlock(&dcache_lock);
-				if (filldir(dirent, next->d_name.name, 
+				name = next->d_name.name;
+				if (name == next->d_iname) {
+					memcpy(d_name, name, next->d_name.len);
+					name = d_name;
+				}
+				if (filldir(dirent, name, 
 					    next->d_name.len, filp->f_pos, 
 					    next->d_inode->i_ino, 
 					    dt_type(next->d_inode)) < 0)
@@ -178,6 +189,18 @@
 	return 0;
 }
 
+int dcache_readdir(struct file *filp, void *dirent, filldir_t filldir)
+{
+	return do_dcache_readdir_filter(filp, dirent, filldir, NULL);
+}
+
+int dcache_readdir_filter(struct file *filp, void *dirent, filldir_t filldir,
+	int (*filter)(struct dentry *))
+{
+	return do_dcache_readdir_filter(filp, dirent, filldir, filter);
+}
+
+
 ssize_t generic_read_dir(struct file *filp, char __user *buf, size_t siz, loff_t *ppos)
 {
 	return -EISDIR;
@@ -842,6 +865,7 @@
 EXPORT_SYMBOL(dcache_dir_lseek);
 EXPORT_SYMBOL(dcache_dir_open);
 EXPORT_SYMBOL(dcache_readdir);
+EXPORT_SYMBOL(dcache_readdir_filter);
 EXPORT_SYMBOL(generic_read_dir);
 EXPORT_SYMBOL(get_sb_pseudo);
 EXPORT_SYMBOL(simple_write_begin);
diff -uriN linux-2.6.32.43/fs/lockd/clntproc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/lockd/clntproc.c
--- linux-2.6.32.43/fs/lockd/clntproc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/lockd/clntproc.c	2011-07-15 05:51:18.000000000 -0500
@@ -36,11 +36,11 @@
 /*
  * Cookie counter for NLM requests
  */
-static atomic_t	nlm_cookie = ATOMIC_INIT(0x1234);
+static atomic_unchecked_t	nlm_cookie = ATOMIC_INIT(0x1234);
 
 void nlmclnt_next_cookie(struct nlm_cookie *c)
 {
-	u32	cookie = atomic_inc_return(&nlm_cookie);
+	u32	cookie = atomic_inc_return_unchecked(&nlm_cookie);
 
 	memcpy(c->data, &cookie, 4);
 	c->len=4;
@@ -621,6 +621,8 @@
 	struct nlm_rqst reqst, *req;
 	int		status;
 
+	pax_track_stack();
+
 	req = &reqst;
 	memset(req, 0, sizeof(*req));
 	locks_init_lock(&req->a_args.lock.fl);
diff -uriN linux-2.6.32.43/fs/lockd/svc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/lockd/svc.c
--- linux-2.6.32.43/fs/lockd/svc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/lockd/svc.c	2011-07-15 05:51:18.000000000 -0500
@@ -43,7 +43,7 @@
 
 static struct svc_program	nlmsvc_program;
 
-struct nlmsvc_binding *		nlmsvc_ops;
+const struct nlmsvc_binding *	nlmsvc_ops;
 EXPORT_SYMBOL_GPL(nlmsvc_ops);
 
 static DEFINE_MUTEX(nlmsvc_mutex);
diff -uriN linux-2.6.32.43/fs/locks.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/locks.c
--- linux-2.6.32.43/fs/locks.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/locks.c	2011-07-15 12:38:49.000000000 -0500
@@ -127,6 +127,8 @@
 #include <linux/time.h>
 #include <linux/rcupdate.h>
 #include <linux/pid_namespace.h>
+#include <linux/vs_base.h>
+#include <linux/vs_limit.h>
 
 #include <asm/uaccess.h>
 
@@ -145,10 +147,30 @@
 
 static struct kmem_cache *filelock_cache __read_mostly;
 
+static void locks_init_lock_always(struct file_lock *fl)
+{
+	fl->fl_next = NULL;
+	fl->fl_fasync = NULL;
+	fl->fl_owner = NULL;
+	fl->fl_pid = 0;
+	fl->fl_nspid = NULL;
+	fl->fl_file = NULL;
+	fl->fl_flags = 0;
+	fl->fl_type = 0;
+	fl->fl_start = fl->fl_end = 0;
+}
+
 /* Allocate an empty lock structure. */
 static struct file_lock *locks_alloc_lock(void)
 {
-	return kmem_cache_alloc(filelock_cache, GFP_KERNEL);
+	if (!vx_locks_avail(1))
+		return NULL;
+	struct file_lock *fl = kmem_cache_alloc(filelock_cache, GFP_KERNEL);
+
+	if (fl)
+		locks_init_lock_always(fl);
+
+	return fl;
 }
 
 void locks_release_private(struct file_lock *fl)
@@ -165,6 +187,7 @@
 	}
 
 }
+
 EXPORT_SYMBOL_GPL(locks_release_private);
 
 /* Free a lock which is not in use. */
@@ -174,6 +197,7 @@
 	BUG_ON(!list_empty(&fl->fl_block));
 	BUG_ON(!list_empty(&fl->fl_link));
 
+	vx_locks_dec(fl);
 	locks_release_private(fl);
 	kmem_cache_free(filelock_cache, fl);
 }
@@ -183,17 +207,10 @@
 	INIT_LIST_HEAD(&fl->fl_link);
 	INIT_LIST_HEAD(&fl->fl_block);
 	init_waitqueue_head(&fl->fl_wait);
-	fl->fl_next = NULL;
-	fl->fl_fasync = NULL;
-	fl->fl_owner = NULL;
-	fl->fl_pid = 0;
-	fl->fl_nspid = NULL;
-	fl->fl_file = NULL;
-	fl->fl_flags = 0;
-	fl->fl_type = 0;
-	fl->fl_start = fl->fl_end = 0;
 	fl->fl_ops = NULL;
 	fl->fl_lmops = NULL;
+	locks_init_lock_always(fl);
+	fl->fl_xid = -1;
 }
 
 EXPORT_SYMBOL(locks_init_lock);
@@ -248,6 +265,7 @@
 	new->fl_file = fl->fl_file;
 	new->fl_ops = fl->fl_ops;
 	new->fl_lmops = fl->fl_lmops;
+	new->fl_xid = fl->fl_xid;
 
 	locks_copy_private(new, fl);
 }
@@ -286,6 +304,11 @@
 	fl->fl_flags = FL_FLOCK;
 	fl->fl_type = type;
 	fl->fl_end = OFFSET_MAX;
+
+	vxd_assert(filp->f_xid == vx_current_xid(),
+		"f_xid(%d) == current(%d)", filp->f_xid, vx_current_xid());
+	fl->fl_xid = filp->f_xid;
+	vx_locks_inc(fl);
 	
 	*lock = fl;
 	return 0;
@@ -451,6 +474,7 @@
 
 	fl->fl_owner = current->files;
 	fl->fl_pid = current->tgid;
+	fl->fl_xid = vx_current_xid();
 
 	fl->fl_file = filp;
 	fl->fl_flags = FL_LEASE;
@@ -470,6 +494,11 @@
 	if (fl == NULL)
 		return ERR_PTR(error);
 
+	fl->fl_xid = vx_current_xid();
+	if (filp)
+		vxd_assert(filp->f_xid == fl->fl_xid,
+			"f_xid(%d) == fl_xid(%d)", filp->f_xid, fl->fl_xid);
+	vx_locks_inc(fl);
 	error = lease_init(filp, type, fl);
 	if (error) {
 		locks_free_lock(fl);
@@ -770,6 +799,7 @@
 	if (found)
 		cond_resched();
 
+	new_fl->fl_xid = -1;
 find_conflict:
 	for_each_lock(inode, before) {
 		struct file_lock *fl = *before;
@@ -790,6 +820,7 @@
 		goto out;
 	locks_copy_lock(new_fl, request);
 	locks_insert_lock(before, new_fl);
+	vx_locks_inc(new_fl);
 	new_fl = NULL;
 	error = 0;
 
@@ -800,7 +831,8 @@
 	return error;
 }
 
-static int __posix_lock_file(struct inode *inode, struct file_lock *request, struct file_lock *conflock)
+static int __posix_lock_file(struct inode *inode, struct file_lock *request,
+	struct file_lock *conflock, xid_t xid)
 {
 	struct file_lock *fl;
 	struct file_lock *new_fl = NULL;
@@ -810,6 +842,8 @@
 	struct file_lock **before;
 	int error, added = 0;
 
+	vxd_assert(xid == vx_current_xid(),
+		"xid(%d) == current(%d)", xid, vx_current_xid());
 	/*
 	 * We may need two file_lock structures for this operation,
 	 * so we get them in advance to avoid races.
@@ -820,7 +854,11 @@
 	    (request->fl_type != F_UNLCK ||
 	     request->fl_start != 0 || request->fl_end != OFFSET_MAX)) {
 		new_fl = locks_alloc_lock();
+		new_fl->fl_xid = xid;
+		vx_locks_inc(new_fl);
 		new_fl2 = locks_alloc_lock();
+		new_fl2->fl_xid = xid;
+		vx_locks_inc(new_fl2);
 	}
 
 	lock_kernel();
@@ -1019,7 +1057,8 @@
 int posix_lock_file(struct file *filp, struct file_lock *fl,
 			struct file_lock *conflock)
 {
-	return __posix_lock_file(filp->f_path.dentry->d_inode, fl, conflock);
+	return __posix_lock_file(filp->f_path.dentry->d_inode,
+		fl, conflock, filp->f_xid);
 }
 EXPORT_SYMBOL(posix_lock_file);
 
@@ -1109,7 +1148,7 @@
 	fl.fl_end = offset + count - 1;
 
 	for (;;) {
-		error = __posix_lock_file(inode, &fl, NULL);
+		error = __posix_lock_file(inode, &fl, NULL, filp->f_xid);
 		if (error != FILE_LOCK_DEFERRED)
 			break;
 		error = wait_event_interruptible(fl.fl_wait, !fl.fl_next);
@@ -1424,6 +1463,7 @@
 
 	locks_copy_lock(new_fl, lease);
 	locks_insert_lock(before, new_fl);
+	vx_locks_inc(new_fl);
 
 	*flp = new_fl;
 	return 0;
@@ -1779,6 +1819,11 @@
 	if (file_lock == NULL)
 		return -ENOLCK;
 
+	vxd_assert(filp->f_xid == vx_current_xid(),
+		"f_xid(%d) == current(%d)", filp->f_xid, vx_current_xid());
+	file_lock->fl_xid = filp->f_xid;
+	vx_locks_inc(file_lock);
+
 	/*
 	 * This might block, so we do it before checking the inode.
 	 */
@@ -1897,6 +1942,11 @@
 	if (file_lock == NULL)
 		return -ENOLCK;
 
+	vxd_assert(filp->f_xid == vx_current_xid(),
+		"f_xid(%d) == current(%d)", filp->f_xid, vx_current_xid());
+	file_lock->fl_xid = filp->f_xid;
+	vx_locks_inc(file_lock);
+
 	/*
 	 * This might block, so we do it before checking the inode.
 	 */
@@ -2007,16 +2057,16 @@
 		return;
 
 	if (filp->f_op && filp->f_op->flock) {
-		struct file_lock fl = {
+		struct file_lock flock = {
 			.fl_pid = current->tgid,
 			.fl_file = filp,
 			.fl_flags = FL_FLOCK,
 			.fl_type = F_UNLCK,
 			.fl_end = OFFSET_MAX,
 		};
-		filp->f_op->flock(filp, F_SETLKW, &fl);
-		if (fl.fl_ops && fl.fl_ops->fl_release_private)
-			fl.fl_ops->fl_release_private(&fl);
+		filp->f_op->flock(filp, F_SETLKW, &flock);
+		if (flock.fl_ops && flock.fl_ops->fl_release_private)
+			flock.fl_ops->fl_release_private(&flock);
 	}
 
 	lock_kernel();
@@ -2162,8 +2212,11 @@
 
 	lock_get_status(f, fl, (long)f->private, "");
 
-	list_for_each_entry(bfl, &fl->fl_block, fl_block)
+	list_for_each_entry(bfl, &fl->fl_block, fl_block) {
+		if (!vx_check(fl->fl_xid, VS_WATCH_P | VS_IDENT))
+			continue;
 		lock_get_status(f, bfl, (long)f->private, " ->");
+	}
 
 	f->private++;
 	return 0;
diff -uriN linux-2.6.32.43/fs/namei.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/namei.c
--- linux-2.6.32.43/fs/namei.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/namei.c	2011-07-15 05:51:18.000000000 -0500
@@ -33,6 +33,14 @@
 #include <linux/fcntl.h>
 #include <linux/device_cgroup.h>
 #include <linux/fs_struct.h>
+#include <linux/proc_fs.h>
+#include <linux/vserver/inode.h>
+#include <linux/vs_base.h>
+#include <linux/vs_tag.h>
+#include <linux/vs_cowbl.h>
+#include <linux/vs_device.h>
+#include <linux/vs_context.h>
+#include <linux/pid_namespace.h>
 #include <asm/uaccess.h>
 
 #define ACC_MODE(x) ("\000\004\002\006"[(x)&O_ACCMODE])
@@ -169,6 +177,77 @@
 EXPORT_SYMBOL(putname);
 #endif
 
+static inline int dx_barrier(const struct inode *inode)
+{
+	if (IS_BARRIER(inode) && !vx_check(0, VS_ADMIN | VS_WATCH)) {
+		vxwprintk_task(1, "did hit the barrier.");
+		return 1;
+	}
+	return 0;
+}
+
+static int __dx_permission(const struct inode *inode, int mask)
+{
+	if (dx_barrier(inode))
+		return -EACCES;
+
+	if (inode->i_sb->s_magic == DEVPTS_SUPER_MAGIC) {
+		/* devpts is xid tagged */
+		if (S_ISDIR(inode->i_mode) ||
+		    vx_check((xid_t)inode->i_tag, VS_IDENT | VS_WATCH_P))
+			return 0;
+	}
+	else if (inode->i_sb->s_magic == PROC_SUPER_MAGIC) {
+		struct proc_dir_entry *de = PDE(inode);
+
+		if (de && !vx_hide_check(0, de->vx_flags))
+			goto out;
+
+		if ((mask & (MAY_WRITE | MAY_APPEND))) {
+			struct pid *pid;
+			struct task_struct *tsk;
+
+			if (vx_check(0, VS_ADMIN | VS_WATCH_P) ||
+			    vx_flags(VXF_STATE_SETUP, 0))
+				return 0;
+
+			pid = PROC_I(inode)->pid;
+			if (!pid)
+				goto out;
+
+			tsk = pid_task(pid, PIDTYPE_PID);
+			vxdprintk(VXD_CBIT(tag, 0), "accessing %p[#%u]",
+				  tsk, (tsk ? vx_task_xid(tsk) : 0));
+			if (tsk && vx_check(vx_task_xid(tsk), VS_IDENT | VS_WATCH_P))
+				return 0;
+		}
+		else {
+			/* FIXME: Should we block some entries here? */
+			return 0;
+		}
+	}
+	else {
+		if (dx_notagcheck(inode->i_sb) ||
+		    dx_check(inode->i_tag, DX_HOSTID | DX_ADMIN | DX_WATCH |
+			     DX_IDENT))
+			return 0;
+	}
+
+out:
+	return -EACCES;
+}
+
+int dx_permission(const struct inode *inode, int mask)
+{
+	int ret = __dx_permission(inode, mask);
+	if (unlikely(ret)) {
+		vxwprintk_task(1, "denied %x access to %s:%p[#%d,%lu]",
+			mask, inode->i_sb->s_id, inode, inode->i_tag,
+			inode->i_ino);
+	}
+	return ret;
+}
+
 /*
  * This does basic POSIX ACL permission checking
  */
@@ -224,14 +303,6 @@
 		return ret;
 
 	/*
-	 * Read/write DACs are always overridable.
-	 * Executable DACs are overridable if at least one exec bit is set.
-	 */
-	if (!(mask & MAY_EXEC) || execute_ok(inode))
-		if (capable(CAP_DAC_OVERRIDE))
-			return 0;
-
-	/*
 	 * Searching includes executable on directories, else just read.
 	 */
 	mask &= MAY_READ | MAY_WRITE | MAY_EXEC;
@@ -239,6 +310,14 @@
 		if (capable(CAP_DAC_READ_SEARCH))
 			return 0;
 
+	/*
+	 * Read/write DACs are always overridable.
+	 * Executable DACs are overridable if at least one exec bit is set.
+	 */
+	if (!(mask & MAY_EXEC) || execute_ok(inode))
+		if (capable(CAP_DAC_OVERRIDE))
+			return 0;
+
 	return -EACCES;
 }
 
@@ -269,10 +348,14 @@
 		/*
 		 * Nobody gets write access to an immutable file.
 		 */
-		if (IS_IMMUTABLE(inode))
+		if (IS_IMMUTABLE(inode) && !IS_COW(inode))
 			return -EACCES;
 	}
 
+	retval = dx_permission(inode, mask);
+	if (retval)
+		return retval;
+
 	if (inode->i_op->permission)
 		retval = inode->i_op->permission(inode, mask);
 	else
@@ -448,6 +531,9 @@
 {
 	int ret;
 
+	if (dx_barrier(inode))
+		return -EACCES;
+
 	if (inode->i_op->permission) {
 		ret = inode->i_op->permission(inode, MAY_EXEC);
 		if (!ret)
@@ -458,7 +544,8 @@
 	if (!ret)
 		goto ok;
 
-	if (capable(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH))
+	if (capable_nolog(CAP_DAC_OVERRIDE) || capable(CAP_DAC_READ_SEARCH) ||
+			capable(CAP_DAC_OVERRIDE))
 		goto ok;
 
 	return ret;
@@ -638,7 +725,7 @@
 	cookie = dentry->d_inode->i_op->follow_link(dentry, nd);
 	error = PTR_ERR(cookie);
 	if (!IS_ERR(cookie)) {
-		char *s = nd_get_link(nd);
+		const char *s = nd_get_link(nd);
 		error = 0;
 		if (s)
 			error = __vfs_follow_link(nd, s);
@@ -669,6 +756,13 @@
 	err = security_inode_follow_link(path->dentry, nd);
 	if (err)
 		goto loop;
+
+	if (gr_handle_follow_link(path->dentry->d_parent->d_inode,
+				  path->dentry->d_inode, path->dentry, nd->path.mnt)) {
+		err = -EACCES;
+		goto loop;
+	}
+
 	current->link_count++;
 	current->total_link_count++;
 	nd->depth++;
@@ -763,7 +857,8 @@
 
 		if (nd->path.dentry == nd->root.dentry &&
 		    nd->path.mnt == nd->root.mnt) {
-			break;
+			/* for sane '/' avoid follow_mount() */
+			return;
 		}
 		spin_lock(&dcache_lock);
 		if (nd->path.dentry != nd->path.mnt->mnt_root) {
@@ -799,16 +894,30 @@
 {
 	struct vfsmount *mnt = nd->path.mnt;
 	struct dentry *dentry = __d_lookup(nd->path.dentry, name);
+	struct inode *inode;
 
 	if (!dentry)
 		goto need_lookup;
 	if (dentry->d_op && dentry->d_op->d_revalidate)
 		goto need_revalidate;
+	inode = dentry->d_inode;
+	if (!inode)
+		goto done;
+
+	if (__dx_permission(inode, MAY_ACCESS))
+		goto hidden;
+
 done:
 	path->mnt = mnt;
 	path->dentry = dentry;
 	__follow_mount(path);
 	return 0;
+hidden:
+	vxwprintk_task(1, "did lookup hidden %s:%p[#%d,%lu] »%s/%.*s«.",
+		inode->i_sb->s_id, inode, inode->i_tag, inode->i_ino,
+		vxd_path(&nd->path), name->len, name->name);
+	dput(dentry);
+	return -ENOENT;
 
 need_lookup:
 	dentry = real_lookup(nd->path.dentry, name, nd);
@@ -1016,11 +1125,18 @@
 				break;
 		}
 return_base:
+		if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt)) {
+			path_put(&nd->path);
+			return -ENOENT;
+		}
 		return 0;
 out_dput:
 		path_put_conditional(&next, nd);
 		break;
 	}
+	if (!gr_acl_handle_hidden_file(nd->path.dentry, nd->path.mnt))
+		err = -ENOENT;
+
 	path_put(&nd->path);
 return_err:
 	return err;
@@ -1091,13 +1207,20 @@
 	int retval = path_init(dfd, name, flags, nd);
 	if (!retval)
 		retval = path_walk(name, nd);
-	if (unlikely(!retval && !audit_dummy_context() && nd->path.dentry &&
-				nd->path.dentry->d_inode))
-		audit_inode(name, nd->path.dentry);
+
+	if (likely(!retval)) {
+		if (nd->path.dentry && nd->path.dentry->d_inode) {
+			if (*name != '/' && !gr_chroot_fchdir(nd->path.dentry, nd->path.mnt))
+				retval = -ENOENT;
+			if (!audit_dummy_context())
+				audit_inode(name, nd->path.dentry);
+		}
+	}
 	if (nd->root.mnt) {
 		path_put(&nd->root);
 		nd->root.mnt = NULL;
 	}
+
 	return retval;
 }
 
@@ -1400,7 +1523,7 @@
 	if (IS_APPEND(dir))
 		return -EPERM;
 	if (check_sticky(dir, victim->d_inode)||IS_APPEND(victim->d_inode)||
-	    IS_IMMUTABLE(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
+		IS_IXORUNLINK(victim->d_inode) || IS_SWAPFILE(victim->d_inode))
 		return -EPERM;
 	if (isdir) {
 		if (!S_ISDIR(victim->d_inode->i_mode))
@@ -1540,6 +1663,14 @@
 		break;
 	}
 
+#ifdef	CONFIG_VSERVER_COWBL
+	if (IS_COW(inode) && (flag & FMODE_WRITE)) {
+		if (IS_COW_LINK(inode))
+			return -EMLINK;
+		inode->i_flags &= ~(S_IXUNLINK | S_IMMUTABLE);
+		mark_inode_dirty(inode);
+	}
+#endif
 	error = inode_permission(inode, acc_mode);
 	if (error)
 		return error;
@@ -1576,6 +1707,20 @@
 	if (error)
 		goto err_out;
 
+
+	if (gr_handle_rofs_blockwrite(dentry, path->mnt, acc_mode)) {
+		error = -EPERM;
+		goto err_out;
+	}
+	if (gr_handle_rawio(inode)) {
+		error = -EPERM;
+		goto err_out;
+	}
+	if (!gr_acl_handle_open(dentry, path->mnt, flag)) {
+		error = -EACCES;
+		goto err_out;
+	}
+
 	if (flag & O_TRUNC) {
 		error = get_write_access(inode);
 		if (error)
@@ -1621,12 +1766,19 @@
 	int error;
 	struct dentry *dir = nd->path.dentry;
 
+	if (!gr_acl_handle_creat(path->dentry, nd->path.dentry, nd->path.mnt, flag, mode)) {
+		error = -EACCES;
+		goto out_unlock;
+	}
+
 	if (!IS_POSIXACL(dir->d_inode))
 		mode &= ~current_umask();
 	error = security_path_mknod(&nd->path, path->dentry, mode, 0);
 	if (error)
 		goto out_unlock;
 	error = vfs_create(dir->d_inode, path->dentry, mode, nd);
+	if (!error)
+		gr_handle_create(path->dentry, nd->path.mnt);
 out_unlock:
 	mutex_unlock(&dir->d_inode->i_mutex);
 	dput(nd->path.dentry);
@@ -1688,7 +1840,11 @@
 	int count = 0;
 	int will_write;
 	int flag = open_to_namei_flags(open_flag);
-
+#ifdef	CONFIG_VSERVER_COWBL
+	int rflag = flag;
+	int rmode = mode;
+restart:
+#endif
 	if (!acc_mode)
 		acc_mode = MAY_OPEN | ACC_MODE(flag);
 
@@ -1709,6 +1865,22 @@
 					 &nd, flag);
 		if (error)
 			return ERR_PTR(error);
+
+		if (gr_handle_rofs_blockwrite(nd.path.dentry, nd.path.mnt, acc_mode)) {
+			error = -EPERM;
+			goto exit;
+		}
+
+		if (gr_handle_rawio(nd.path.dentry->d_inode)) {
+			error = -EPERM;
+			goto exit;
+		}
+
+		if (!gr_acl_handle_open(nd.path.dentry, nd.path.mnt, flag)) {
+			error = -EACCES;
+			goto exit;
+		}
+
 		goto ok;
 	}
 
@@ -1795,6 +1967,14 @@
 	/*
 	 * It already exists.
 	 */
+
+	/* only check if O_CREAT is specified, all other checks need
+	   to go into may_open */
+	if (gr_handle_fifo(path.dentry, path.mnt, dir, flag, acc_mode)) {
+		error = -EACCES;
+		goto exit_mutex_unlock;
+	}
+
 	mutex_unlock(&dir->d_inode->i_mutex);
 	audit_inode(pathname, path.dentry);
 
@@ -1836,6 +2016,25 @@
 			goto exit;
 	}
 	error = may_open(&nd.path, acc_mode, flag);
+#ifdef	CONFIG_VSERVER_COWBL
+	if (error == -EMLINK) {
+		struct dentry *dentry;
+		dentry = cow_break_link(pathname);
+		if (IS_ERR(dentry)) {
+			error = PTR_ERR(dentry);
+			goto exit_cow;
+		}
+		dput(dentry);
+		if (will_write)
+			mnt_drop_write(nd.path.mnt);
+		release_open_intent(&nd);
+		path_put(&nd.path);
+		flag = rflag;
+		mode = rmode;
+		goto restart;
+	}
+exit_cow:
+#endif
 	if (error) {
 		if (will_write)
 			mnt_drop_write(nd.path.mnt);
@@ -1887,6 +2086,13 @@
 	error = security_inode_follow_link(path.dentry, &nd);
 	if (error)
 		goto exit_dput;
+
+	if (gr_handle_follow_link(path.dentry->d_parent->d_inode, path.dentry->d_inode,
+				  path.dentry, nd.path.mnt)) {
+		error = -EACCES;
+		goto exit_dput;
+	}
+
 	error = __do_follow_link(&path, &nd);
 	if (error) {
 		/* Does someone understand code flow here? Or it is only
@@ -1998,9 +2204,17 @@
 	if (error)
 		return error;
 
-	if ((S_ISCHR(mode) || S_ISBLK(mode)) && !capable(CAP_MKNOD))
+	if (!(S_ISCHR(mode) || S_ISBLK(mode)))
+		goto okay;
+
+	if (!capable(CAP_MKNOD))
 		return -EPERM;
 
+	if (S_ISCHR(mode) && !vs_chrdev_perm(dev, DATTR_CREATE))
+		return -EPERM;
+	if (S_ISBLK(mode) && !vs_blkdev_perm(dev, DATTR_CREATE))
+		return -EPERM;
+okay:
 	if (!dir->i_op->mknod)
 		return -EPERM;
 
@@ -2061,6 +2275,17 @@
 	error = may_mknod(mode);
 	if (error)
 		goto out_dput;
+
+	if (gr_handle_chroot_mknod(dentry, nd.path.mnt, mode)) {
+		error = -EPERM;
+		goto out_dput;
+	}
+
+	if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
+		error = -EACCES;
+		goto out_dput;
+	}
+
 	error = mnt_want_write(nd.path.mnt);
 	if (error)
 		goto out_dput;
@@ -2081,6 +2306,9 @@
 	}
 out_drop_write:
 	mnt_drop_write(nd.path.mnt);
+
+	if (!error)
+		gr_handle_create(dentry, nd.path.mnt);
 out_dput:
 	dput(dentry);
 out_unlock:
@@ -2134,6 +2362,11 @@
 	if (IS_ERR(dentry))
 		goto out_unlock;
 
+	if (!gr_acl_handle_mkdir(dentry, nd.path.dentry, nd.path.mnt)) {
+		error = -EACCES;
+		goto out_dput;
+	}
+
 	if (!IS_POSIXACL(nd.path.dentry->d_inode))
 		mode &= ~current_umask();
 	error = mnt_want_write(nd.path.mnt);
@@ -2145,6 +2378,10 @@
 	error = vfs_mkdir(nd.path.dentry->d_inode, dentry, mode);
 out_drop_write:
 	mnt_drop_write(nd.path.mnt);
+
+	if (!error)
+		gr_handle_create(dentry, nd.path.mnt);
+
 out_dput:
 	dput(dentry);
 out_unlock:
@@ -2226,6 +2463,8 @@
 	char * name;
 	struct dentry *dentry;
 	struct nameidata nd;
+	ino_t saved_ino = 0;
+	dev_t saved_dev = 0;
 
 	error = user_path_parent(dfd, pathname, &nd, &name);
 	if (error)
@@ -2250,6 +2489,19 @@
 	error = PTR_ERR(dentry);
 	if (IS_ERR(dentry))
 		goto exit2;
+
+	if (dentry->d_inode != NULL) {
+		if (dentry->d_inode->i_nlink <= 1) {
+			saved_ino = dentry->d_inode->i_ino;
+			saved_dev = gr_get_dev_from_dentry(dentry);
+		}
+
+		if (!gr_acl_handle_rmdir(dentry, nd.path.mnt)) {
+			error = -EACCES;
+			goto exit3;
+		}
+	}
+
 	error = mnt_want_write(nd.path.mnt);
 	if (error)
 		goto exit3;
@@ -2257,6 +2509,8 @@
 	if (error)
 		goto exit4;
 	error = vfs_rmdir(nd.path.dentry->d_inode, dentry);
+	if (!error && (saved_dev || saved_ino))
+		gr_handle_delete(saved_ino, saved_dev);
 exit4:
 	mnt_drop_write(nd.path.mnt);
 exit3:
@@ -2318,6 +2572,8 @@
 	struct dentry *dentry;
 	struct nameidata nd;
 	struct inode *inode = NULL;
+	ino_t saved_ino = 0;
+	dev_t saved_dev = 0;
 
 	error = user_path_parent(dfd, pathname, &nd, &name);
 	if (error)
@@ -2337,8 +2593,19 @@
 		if (nd.last.name[nd.last.len])
 			goto slashes;
 		inode = dentry->d_inode;
-		if (inode)
+		if (inode) {
+			if (inode->i_nlink <= 1) {
+				saved_ino = inode->i_ino;
+				saved_dev = gr_get_dev_from_dentry(dentry);
+			}
+
 			atomic_inc(&inode->i_count);
+
+			if (!gr_acl_handle_unlink(dentry, nd.path.mnt)) {
+				error = -EACCES;
+				goto exit2;
+			}
+		}
 		error = mnt_want_write(nd.path.mnt);
 		if (error)
 			goto exit2;
@@ -2346,6 +2613,8 @@
 		if (error)
 			goto exit3;
 		error = vfs_unlink(nd.path.dentry->d_inode, dentry);
+		if (!error && (saved_ino || saved_dev))
+			gr_handle_delete(saved_ino, saved_dev);
 exit3:
 		mnt_drop_write(nd.path.mnt);
 	exit2:
@@ -2424,6 +2693,11 @@
 	if (IS_ERR(dentry))
 		goto out_unlock;
 
+	if (!gr_acl_handle_symlink(dentry, nd.path.dentry, nd.path.mnt, from)) {
+		error = -EACCES;
+		goto out_dput;
+	}
+
 	error = mnt_want_write(nd.path.mnt);
 	if (error)
 		goto out_dput;
@@ -2431,6 +2705,8 @@
 	if (error)
 		goto out_drop_write;
 	error = vfs_symlink(nd.path.dentry->d_inode, dentry, from);
+	if (!error)
+		gr_handle_create(dentry, nd.path.mnt);
 out_drop_write:
 	mnt_drop_write(nd.path.mnt);
 out_dput:
@@ -2467,7 +2743,7 @@
 	/*
 	 * A link to an append-only or immutable file cannot be created.
 	 */
-	if (IS_APPEND(inode) || IS_IMMUTABLE(inode))
+	if (IS_APPEND(inode) || IS_IXORUNLINK(inode))
 		return -EPERM;
 	if (!dir->i_op->link)
 		return -EPERM;
@@ -2524,6 +2800,20 @@
 	error = PTR_ERR(new_dentry);
 	if (IS_ERR(new_dentry))
 		goto out_unlock;
+
+	if (gr_handle_hardlink(old_path.dentry, old_path.mnt,
+			       old_path.dentry->d_inode,
+			       old_path.dentry->d_inode->i_mode, to)) {
+		error = -EACCES;
+		goto out_dput;
+	}
+
+	if (!gr_acl_handle_link(new_dentry, nd.path.dentry, nd.path.mnt,
+				old_path.dentry, old_path.mnt, to)) {
+		error = -EACCES;
+		goto out_dput;
+	}
+
 	error = mnt_want_write(nd.path.mnt);
 	if (error)
 		goto out_dput;
@@ -2531,6 +2821,8 @@
 	if (error)
 		goto out_drop_write;
 	error = vfs_link(old_path.dentry, nd.path.dentry->d_inode, new_dentry);
+	if (!error)
+		gr_handle_create(new_dentry, nd.path.mnt);
 out_drop_write:
 	mnt_drop_write(nd.path.mnt);
 out_dput:
@@ -2708,6 +3000,8 @@
 	char *to;
 	int error;
 
+	pax_track_stack();
+
 	error = user_path_parent(olddfd, oldname, &oldnd, &from);
 	if (error)
 		goto exit;
@@ -2764,6 +3058,12 @@
 	if (new_dentry == trap)
 		goto exit5;
 
+	error = gr_acl_handle_rename(new_dentry, new_dir, newnd.path.mnt,
+				     old_dentry, old_dir->d_inode, oldnd.path.mnt,
+				     to);
+	if (error)
+		goto exit5;
+
 	error = mnt_want_write(oldnd.path.mnt);
 	if (error)
 		goto exit5;
@@ -2773,6 +3073,9 @@
 		goto exit6;
 	error = vfs_rename(old_dir->d_inode, old_dentry,
 				   new_dir->d_inode, new_dentry);
+	if (!error)
+		gr_handle_rename(old_dir->d_inode, new_dir->d_inode, old_dentry,
+				 new_dentry, oldnd.path.mnt, new_dentry->d_inode ? 1 : 0);
 exit6:
 	mnt_drop_write(oldnd.path.mnt);
 exit5:
@@ -2798,6 +3101,8 @@
 
 int vfs_readlink(struct dentry *dentry, char __user *buffer, int buflen, const char *link)
 {
+	char tmpbuf[64];
+	const char *newlink;
 	int len;
 
 	len = PTR_ERR(link);
@@ -2807,7 +3112,14 @@
 	len = strlen(link);
 	if (len > (unsigned) buflen)
 		len = buflen;
-	if (copy_to_user(buffer, link, len))
+
+	if (len < sizeof(tmpbuf)) {
+		memcpy(tmpbuf, link, len);
+		newlink = tmpbuf;
+	} else
+		newlink = link;
+
+	if (copy_to_user(buffer, newlink, len))
 		len = -EFAULT;
 out:
 	return len;
@@ -2840,6 +3152,219 @@
 	return __vfs_follow_link(nd, link);
 }
 
+
+#ifdef	CONFIG_VSERVER_COWBL
+
+#include <linux/file.h>
+
+static inline
+long do_cow_splice(struct file *in, struct file *out, size_t len)
+{
+	loff_t ppos = 0;
+
+	return do_splice_direct(in, &ppos, out, len, 0);
+}
+
+struct dentry *cow_break_link(const char *pathname)
+{
+	int ret, mode, pathlen, redo = 0;
+	struct nameidata old_nd, dir_nd;
+	struct path old_path, new_path;
+	struct dentry *dir, *res = NULL;
+	struct file *old_file;
+	struct file *new_file;
+	char *to, *path, pad='\251';
+	loff_t size;
+
+	vxdprintk(VXD_CBIT(misc, 1), "cow_break_link(»%s«)", pathname);
+	path = kmalloc(PATH_MAX, GFP_KERNEL);
+	ret = -ENOMEM;
+	if (!path)
+		goto out;
+
+	/* old_nd will have refs to dentry and mnt */
+	ret = path_lookup(pathname, LOOKUP_FOLLOW, &old_nd);
+	vxdprintk(VXD_CBIT(misc, 2), "path_lookup(old): %d", ret);
+	if (ret < 0)
+		goto out_free_path;
+
+	old_path = old_nd.path;
+	mode = old_path.dentry->d_inode->i_mode;
+
+	to = d_path(&old_path, path, PATH_MAX-2);
+	pathlen = strlen(to);
+	vxdprintk(VXD_CBIT(misc, 2), "old path »%s« [»%.*s«:%d]", to,
+		old_path.dentry->d_name.len, old_path.dentry->d_name.name,
+		old_path.dentry->d_name.len);
+
+	to[pathlen + 1] = 0;
+retry:
+	to[pathlen] = pad--;
+	ret = -EMLINK;
+	if (pad <= '\240')
+		goto out_rel_old;
+
+	vxdprintk(VXD_CBIT(misc, 1), "temp copy »%s«", to);
+	/* dir_nd will have refs to dentry and mnt */
+	ret = path_lookup(to,
+		LOOKUP_PARENT | LOOKUP_OPEN | LOOKUP_CREATE, &dir_nd);
+	vxdprintk(VXD_CBIT(misc, 2),
+		"path_lookup(new): %d", ret);
+	if (ret < 0)
+		goto retry;
+
+	/* this puppy downs the inode mutex */
+	new_path.dentry = lookup_create(&dir_nd, 0);
+	if (!new_path.dentry || IS_ERR(new_path.dentry)) {
+		vxdprintk(VXD_CBIT(misc, 2),
+			"lookup_create(new): %p", new_path.dentry);
+		mutex_unlock(&dir_nd.path.dentry->d_inode->i_mutex);
+		path_put(&dir_nd.path);
+		goto retry;
+	}
+	vxdprintk(VXD_CBIT(misc, 2),
+		"lookup_create(new): %p [»%.*s«:%d]", new_path.dentry,
+		new_path.dentry->d_name.len, new_path.dentry->d_name.name,
+		new_path.dentry->d_name.len);
+	dir = dir_nd.path.dentry;
+
+	ret = vfs_create(dir_nd.path.dentry->d_inode, new_path.dentry, mode, &dir_nd);
+	vxdprintk(VXD_CBIT(misc, 2),
+		"vfs_create(new): %d", ret);
+	if (ret == -EEXIST) {
+		mutex_unlock(&dir->d_inode->i_mutex);
+		dput(new_path.dentry);
+		path_put(&dir_nd.path);
+		goto retry;
+	}
+	else if (ret < 0)
+		goto out_unlock_new;
+
+	/* drop out early, ret passes ENOENT */
+	ret = -ENOENT;
+	if ((redo = d_unhashed(old_path.dentry)))
+		goto out_unlock_new;
+
+	new_path.mnt = dir_nd.path.mnt;
+	dget(old_path.dentry);
+	mntget(old_path.mnt);
+	/* this one cleans up the dentry/mnt in case of failure */
+	old_file = dentry_open(old_path.dentry, old_path.mnt,
+		O_RDONLY, current_cred());
+	vxdprintk(VXD_CBIT(misc, 2),
+		"dentry_open(old): %p", old_file);
+	if (!old_file || IS_ERR(old_file)) {
+		res = IS_ERR(old_file) ? (void *) old_file : res;
+		goto out_unlock_new;
+	}
+
+	dget(new_path.dentry);
+	mntget(new_path.mnt);
+	/* this one cleans up the dentry/mnt in case of failure */
+	new_file = dentry_open(new_path.dentry, new_path.mnt,
+		O_WRONLY, current_cred());
+	vxdprintk(VXD_CBIT(misc, 2),
+		"dentry_open(new): %p", new_file);
+
+	ret = IS_ERR(new_file) ? PTR_ERR(new_file) : -ENOENT;
+	if (!new_file || IS_ERR(new_file))
+		goto out_fput_old;
+
+	size = i_size_read(old_file->f_dentry->d_inode);
+	ret = do_cow_splice(old_file, new_file, size);
+	vxdprintk(VXD_CBIT(misc, 2), "do_splice_direct: %d", ret);
+	if (ret < 0) {
+		goto out_fput_both;
+	} else if (ret < size) {
+		ret = -ENOSPC;
+		goto out_fput_both;
+	} else {
+		struct inode *old_inode = old_path.dentry->d_inode;
+		struct inode *new_inode = new_path.dentry->d_inode;
+		struct iattr attr = {
+			.ia_uid = old_inode->i_uid,
+			.ia_gid = old_inode->i_gid,
+			.ia_valid = ATTR_UID | ATTR_GID
+			};
+
+		ret = inode_setattr(new_inode, &attr);
+		if (ret)
+			goto out_fput_both;
+	}
+
+	mutex_lock(&old_path.dentry->d_inode->i_sb->s_vfs_rename_mutex);
+
+	/* drop out late */
+	ret = -ENOENT;
+	if ((redo = d_unhashed(old_path.dentry)))
+		goto out_unlock;
+
+	vxdprintk(VXD_CBIT(misc, 2),
+		"vfs_rename: [»%*s«:%d] -> [»%*s«:%d]",
+		new_path.dentry->d_name.len, new_path.dentry->d_name.name,
+		new_path.dentry->d_name.len,
+		old_path.dentry->d_name.len, old_path.dentry->d_name.name,
+		old_path.dentry->d_name.len);
+	ret = vfs_rename(dir_nd.path.dentry->d_inode, new_path.dentry,
+		old_nd.path.dentry->d_parent->d_inode, old_path.dentry);
+	vxdprintk(VXD_CBIT(misc, 2), "vfs_rename: %d", ret);
+	res = new_path.dentry;
+
+out_unlock:
+	mutex_unlock(&old_path.dentry->d_inode->i_sb->s_vfs_rename_mutex);
+
+out_fput_both:
+	vxdprintk(VXD_CBIT(misc, 3),
+		"fput(new_file=%p[#%ld])", new_file,
+		atomic_long_read(&new_file->f_count));
+	fput(new_file);
+
+out_fput_old:
+	vxdprintk(VXD_CBIT(misc, 3),
+		"fput(old_file=%p[#%ld])", old_file,
+		atomic_long_read(&old_file->f_count));
+	fput(old_file);
+
+out_unlock_new:
+	mutex_unlock(&dir->d_inode->i_mutex);
+	if (!ret)
+		goto out_redo;
+
+	/* error path cleanup */
+	vfs_unlink(dir->d_inode, new_path.dentry);
+	dput(new_path.dentry);
+
+out_redo:
+	if (!redo)
+		goto out_rel_both;
+	/* lookup dentry once again */
+	path_put(&old_nd.path);
+	ret = path_lookup(pathname, LOOKUP_FOLLOW, &old_nd);
+	if (ret)
+		goto out_rel_both;
+
+	new_path.dentry = old_nd.path.dentry;
+	vxdprintk(VXD_CBIT(misc, 2),
+		"path_lookup(redo): %p [»%.*s«:%d]", new_path.dentry,
+		new_path.dentry->d_name.len, new_path.dentry->d_name.name,
+		new_path.dentry->d_name.len);
+	dget(new_path.dentry);
+	res = new_path.dentry;
+
+out_rel_both:
+	path_put(&dir_nd.path);
+out_rel_old:
+	path_put(&old_nd.path);
+out_free_path:
+	kfree(path);
+out:
+	if (ret)
+		res = ERR_PTR(ret);
+	return res;
+}
+
+#endif
+
 /* get the link contents into pagecache */
 static char *page_getlink(struct dentry * dentry, struct page **ppage)
 {
diff -uriN linux-2.6.32.43/fs/namespace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/namespace.c
--- linux-2.6.32.43/fs/namespace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/namespace.c	2011-07-15 05:51:18.000000000 -0500
@@ -29,6 +29,11 @@
 #include <linux/log2.h>
 #include <linux/idr.h>
 #include <linux/fs_struct.h>
+#include <linux/vs_base.h>
+#include <linux/vs_context.h>
+#include <linux/vs_tag.h>
+#include <linux/vserver/space.h>
+#include <linux/vserver/global.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 #include "pnode.h"
@@ -567,6 +572,7 @@
 		mnt->mnt_root = dget(root);
 		mnt->mnt_mountpoint = mnt->mnt_root;
 		mnt->mnt_parent = mnt;
+		mnt->mnt_tag = old->mnt_tag;
 
 		if (flag & CL_SLAVE) {
 			list_add(&mnt->mnt_slave, &old->mnt_slave_list);
@@ -661,6 +667,31 @@
 	seq_escape(m, s, " \t\n\\");
 }
 
+static int mnt_is_reachable(struct vfsmount *mnt)
+{
+	struct path root;
+	struct dentry *point;
+	int ret;
+
+	if (mnt == mnt->mnt_ns->root)
+		return 1;
+
+	spin_lock(&vfsmount_lock);
+	root = current->fs->root;
+	point = root.dentry;
+
+	while ((mnt != mnt->mnt_parent) && (mnt != root.mnt)) {
+		point = mnt->mnt_mountpoint;
+		mnt = mnt->mnt_parent;
+	}
+
+	ret = (mnt == root.mnt) && is_subdir(point, root.dentry);
+
+	spin_unlock(&vfsmount_lock);
+
+	return ret;
+}
+
 /*
  * Simple .show_options callback for filesystems which don't want to
  * implement more complex mount option showing.
@@ -748,6 +779,8 @@
 		{ MS_SYNCHRONOUS, ",sync" },
 		{ MS_DIRSYNC, ",dirsync" },
 		{ MS_MANDLOCK, ",mand" },
+		{ MS_TAGGED, ",tag" },
+		{ MS_NOTAGCHECK, ",notagcheck" },
 		{ 0, NULL }
 	};
 	const struct proc_fs_info *fs_infop;
@@ -795,10 +828,20 @@
 	int err = 0;
 	struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
 
-	mangle(m, mnt->mnt_devname ? mnt->mnt_devname : "none");
-	seq_putc(m, ' ');
-	seq_path(m, &mnt_path, " \t\n\\");
-	seq_putc(m, ' ');
+	if (vx_flags(VXF_HIDE_MOUNT, 0))
+		return SEQ_SKIP;
+	if (!mnt_is_reachable(mnt) && !vx_check(0, VS_WATCH_P))
+		return SEQ_SKIP;
+
+	if (!vx_check(0, VS_ADMIN|VS_WATCH) &&
+		mnt == current->fs->root.mnt) {
+		seq_puts(m, "/dev/root / ");
+	} else {
+		mangle(m, mnt->mnt_devname ? mnt->mnt_devname : "none");
+		seq_putc(m, ' ');
+		seq_path(m, &mnt_path, " \t\n\\");
+		seq_putc(m, ' ');
+	}
 	show_type(m, mnt->mnt_sb);
 	seq_puts(m, __mnt_is_readonly(mnt) ? " ro" : " rw");
 	err = show_sb_opts(m, mnt->mnt_sb);
@@ -828,6 +871,11 @@
 	struct path root = p->root;
 	int err = 0;
 
+	if (vx_flags(VXF_HIDE_MOUNT, 0))
+		return SEQ_SKIP;
+	if (!mnt_is_reachable(mnt) && !vx_check(0, VS_WATCH_P))
+		return SEQ_SKIP;
+
 	seq_printf(m, "%i %i %u:%u ", mnt->mnt_id, mnt->mnt_parent->mnt_id,
 		   MAJOR(sb->s_dev), MINOR(sb->s_dev));
 	seq_dentry(m, mnt->mnt_root, " \t\n\\");
@@ -886,17 +934,27 @@
 	struct path mnt_path = { .dentry = mnt->mnt_root, .mnt = mnt };
 	int err = 0;
 
-	/* device */
-	if (mnt->mnt_devname) {
-		seq_puts(m, "device ");
-		mangle(m, mnt->mnt_devname);
-	} else
-		seq_puts(m, "no device");
-
-	/* mount point */
-	seq_puts(m, " mounted on ");
-	seq_path(m, &mnt_path, " \t\n\\");
-	seq_putc(m, ' ');
+	if (vx_flags(VXF_HIDE_MOUNT, 0))
+		return SEQ_SKIP;
+	if (!mnt_is_reachable(mnt) && !vx_check(0, VS_WATCH_P))
+		return SEQ_SKIP;
+
+	if (!vx_check(0, VS_ADMIN|VS_WATCH) &&
+		mnt == current->fs->root.mnt) {
+		seq_puts(m, "device /dev/root mounted on / ");
+	} else {
+		/* device */
+		if (mnt->mnt_devname) {
+			seq_puts(m, "device ");
+			mangle(m, mnt->mnt_devname);
+		} else
+			seq_puts(m, "no device");
+
+		/* mount point */
+		seq_puts(m, " mounted on ");
+		seq_path(m, &mnt_path, " \t\n\\");
+		seq_putc(m, ' ');
+	}
 
 	/* file system type */
 	seq_puts(m, "with fstype ");
@@ -1083,6 +1141,9 @@
 		if (!(sb->s_flags & MS_RDONLY))
 			retval = do_remount_sb(sb, MS_RDONLY, NULL, 0);
 		up_write(&sb->s_umount);
+
+		gr_log_remount(mnt->mnt_devname, retval);
+
 		return retval;
 	}
 
@@ -1104,6 +1165,9 @@
 		security_sb_umount_busy(mnt);
 	up_write(&namespace_sem);
 	release_mounts(&umount_list);
+
+	gr_log_unmount(mnt->mnt_devname, retval);
+
 	return retval;
 }
 
@@ -1137,7 +1201,7 @@
 		goto dput_and_out;
 
 	retval = -EPERM;
-	if (!capable(CAP_SYS_ADMIN))
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_SECURE_MOUNT))
 		goto dput_and_out;
 
 	retval = do_umount(path.mnt, flags);
@@ -1163,7 +1227,7 @@
 
 static int mount_is_safe(struct path *path)
 {
-	if (capable(CAP_SYS_ADMIN))
+	if (vx_capable(CAP_SYS_ADMIN, VXC_SECURE_MOUNT))
 		return 0;
 	return -EPERM;
 #ifdef notyet
@@ -1427,7 +1491,7 @@
 	int type = flag & ~MS_REC;
 	int err = 0;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_NAMESPACE))
 		return -EPERM;
 
 	if (path->dentry != path->mnt->mnt_root)
@@ -1454,11 +1518,13 @@
  * do loopback mount.
  */
 static int do_loopback(struct path *path, char *old_name,
-				int recurse)
+	tag_t tag, unsigned long flags, int mnt_flags)
 {
 	struct path old_path;
 	struct vfsmount *mnt = NULL;
 	int err = mount_is_safe(path);
+	int recurse = flags & MS_REC;
+
 	if (err)
 		return err;
 	if (!old_name || !*old_name)
@@ -1492,6 +1558,7 @@
 		spin_unlock(&vfsmount_lock);
 		release_mounts(&umount_list);
 	}
+	mnt->mnt_flags = mnt_flags;
 
 out:
 	up_write(&namespace_sem);
@@ -1522,12 +1589,12 @@
  * on it - tough luck.
  */
 static int do_remount(struct path *path, int flags, int mnt_flags,
-		      void *data)
+	void *data, xid_t xid)
 {
 	int err;
 	struct super_block *sb = path->mnt->mnt_sb;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_SECURE_REMOUNT))
 		return -EPERM;
 
 	if (!check_mnt(path->mnt))
@@ -1569,7 +1636,7 @@
 	struct path old_path, parent_path;
 	struct vfsmount *p;
 	int err = 0;
-	if (!capable(CAP_SYS_ADMIN))
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_SECURE_MOUNT))
 		return -EPERM;
 	if (!old_name || !*old_name)
 		return -EINVAL;
@@ -1651,7 +1718,7 @@
 		return -EINVAL;
 
 	/* we need capabilities... */
-	if (!capable(CAP_SYS_ADMIN))
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_SECURE_MOUNT))
 		return -EPERM;
 
 	lock_kernel();
@@ -1915,6 +1982,7 @@
 	struct path path;
 	int retval = 0;
 	int mnt_flags = 0;
+	tag_t tag = 0;
 
 	/* Discard magic */
 	if ((flags & MS_MGC_MSK) == MS_MGC_VAL)
@@ -1932,6 +2000,12 @@
 	if (!(flags & MS_NOATIME))
 		mnt_flags |= MNT_RELATIME;
 
+	if (dx_parse_tag(data_page, &tag, 1, &mnt_flags, &flags)) {
+		/* FIXME: bind and re-mounts get the tag flag? */
+		if (flags & (MS_BIND|MS_REMOUNT))
+			flags |= MS_TAGID;
+	}
+
 	/* Separate the per-mountpoint flags */
 	if (flags & MS_NOSUID)
 		mnt_flags |= MNT_NOSUID;
@@ -1948,6 +2022,8 @@
 	if (flags & MS_RDONLY)
 		mnt_flags |= MNT_READONLY;
 
+	if (!capable(CAP_SYS_ADMIN))
+		mnt_flags |= MNT_NODEV;
 	flags &= ~(MS_NOSUID | MS_NOEXEC | MS_NODEV | MS_ACTIVE |
 		   MS_NOATIME | MS_NODIRATIME | MS_RELATIME| MS_KERNMOUNT |
 		   MS_STRICTATIME);
@@ -1962,11 +2038,21 @@
 	if (retval)
 		goto dput_out;
 
+	if (gr_handle_rofs_mount(path.dentry, path.mnt, mnt_flags)) {
+		retval = -EPERM;
+		goto dput_out;
+	}
+
+	if (gr_handle_chroot_mount(path.dentry, path.mnt, dev_name)) {
+		retval = -EPERM;
+		goto dput_out;
+	}
+
 	if (flags & MS_REMOUNT)
 		retval = do_remount(&path, flags & ~MS_REMOUNT, mnt_flags,
-				    data_page);
+				    data_page, tag);
 	else if (flags & MS_BIND)
-		retval = do_loopback(&path, dev_name, flags & MS_REC);
+		retval = do_loopback(&path, dev_name, tag, flags, mnt_flags);
 	else if (flags & (MS_SHARED | MS_PRIVATE | MS_SLAVE | MS_UNBINDABLE))
 		retval = do_change_type(&path, flags);
 	else if (flags & MS_MOVE)
@@ -1976,6 +2062,9 @@
 				      dev_name, data_page);
 dput_out:
 	path_put(&path);
+
+	gr_log_mount(dev_name, dir_name, retval);
+
 	return retval;
 }
 
@@ -2045,6 +2134,7 @@
 		q = next_mnt(q, new_ns->root);
 	}
 	up_write(&namespace_sem);
+	atomic_inc(&vs_global_mnt_ns);
 
 	if (rootmnt)
 		mntput(rootmnt);
@@ -2182,6 +2272,12 @@
 		goto out1;
 	}
 
+	if (gr_handle_chroot_pivot()) {
+		error = -EPERM;
+		path_put(&old);
+		goto out1;
+	}
+
 	read_lock(&current->fs->lock);
 	root = current->fs->root;
 	path_get(&current->fs->root);
@@ -2189,9 +2285,10 @@
 	down_write(&namespace_sem);
 	mutex_lock(&old.dentry->d_inode->i_mutex);
 	error = -EINVAL;
-	if (IS_MNT_SHARED(old.mnt) ||
+	if ((IS_MNT_SHARED(old.mnt) ||
 		IS_MNT_SHARED(new.mnt->mnt_parent) ||
-		IS_MNT_SHARED(root.mnt->mnt_parent))
+		IS_MNT_SHARED(root.mnt->mnt_parent)) &&
+		!vx_flags(VXF_STATE_SETUP, 0))
 		goto out2;
 	if (!check_mnt(root.mnt))
 		goto out2;
@@ -2327,6 +2424,7 @@
 	spin_unlock(&vfsmount_lock);
 	up_write(&namespace_sem);
 	release_mounts(&umount_list);
+	atomic_dec(&vs_global_mnt_ns);
 	kfree(ns);
 }
 EXPORT_SYMBOL(put_mnt_ns);
diff -uriN linux-2.6.32.43/fs/ncpfs/dir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ncpfs/dir.c
--- linux-2.6.32.43/fs/ncpfs/dir.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ncpfs/dir.c	2011-07-15 05:51:18.000000000 -0500
@@ -275,6 +275,8 @@
 	int res, val = 0, len;
 	__u8 __name[NCP_MAXPATHLEN + 1];
 
+	pax_track_stack();
+
 	parent = dget_parent(dentry);
 	dir = parent->d_inode;
 
@@ -799,6 +801,8 @@
 	int error, res, len;
 	__u8 __name[NCP_MAXPATHLEN + 1];
 
+	pax_track_stack();
+
 	lock_kernel();
 	error = -EIO;
 	if (!ncp_conn_valid(server))
@@ -883,10 +887,12 @@
 	int error, result, len;
 	int opmode;
 	__u8 __name[NCP_MAXPATHLEN + 1];
-	
+
 	PPRINTK("ncp_create_new: creating %s/%s, mode=%x\n",
 		dentry->d_parent->d_name.name, dentry->d_name.name, mode);
 
+	pax_track_stack();
+
 	error = -EIO;
 	lock_kernel();
 	if (!ncp_conn_valid(server))
@@ -952,6 +958,8 @@
 	int error, len;
 	__u8 __name[NCP_MAXPATHLEN + 1];
 
+	pax_track_stack();
+
 	DPRINTK("ncp_mkdir: making %s/%s\n",
 		dentry->d_parent->d_name.name, dentry->d_name.name);
 
@@ -960,6 +968,8 @@
 	if (!ncp_conn_valid(server))
 		goto out;
 
+	pax_track_stack();
+
 	ncp_age_dentry(server, dentry);
 	len = sizeof(__name);
 	error = ncp_io2vol(server, __name, &len, dentry->d_name.name,
@@ -1114,6 +1124,8 @@
 	int old_len, new_len;
 	__u8 __old_name[NCP_MAXPATHLEN + 1], __new_name[NCP_MAXPATHLEN + 1];
 
+	pax_track_stack();
+
 	DPRINTK("ncp_rename: %s/%s to %s/%s\n",
 		old_dentry->d_parent->d_name.name, old_dentry->d_name.name,
 		new_dentry->d_parent->d_name.name, new_dentry->d_name.name);
diff -uriN linux-2.6.32.43/fs/ncpfs/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ncpfs/inode.c
--- linux-2.6.32.43/fs/ncpfs/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ncpfs/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -445,6 +445,8 @@
 #endif
 	struct ncp_entry_info finfo;
 
+	pax_track_stack();
+
 	data.wdog_pid = NULL;
 	server = kzalloc(sizeof(struct ncp_server), GFP_KERNEL);
 	if (!server)
diff -uriN linux-2.6.32.43/fs/nfs/client.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/client.c
--- linux-2.6.32.43/fs/nfs/client.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/client.c	2011-07-15 05:50:11.000000000 -0500
@@ -738,6 +738,9 @@
 	if (server->flags & NFS_MOUNT_SOFT)
 		server->client->cl_softrtry = 1;
 
+	server->client->cl_tag = 0;
+	if (server->flags & NFS_MOUNT_TAGGED)
+		server->client->cl_tag = 1;
 	return 0;
 }
 
@@ -909,6 +912,10 @@
 		server->acdirmin = server->acdirmax = 0;
 	}
 
+	/* FIXME: needs fsinfo
+	if (server->flags & NFS_MOUNT_TAGGED)
+		sb->s_flags |= MS_TAGGED;	*/
+
 	server->maxfilesize = fsinfo->maxfilesize;
 
 	/* We're airborne Set socket buffersize */
diff -uriN linux-2.6.32.43/fs/nfs/dir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/dir.c
--- linux-2.6.32.43/fs/nfs/dir.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/dir.c	2011-07-15 05:50:11.000000000 -0500
@@ -33,6 +33,7 @@
 #include <linux/namei.h>
 #include <linux/mount.h>
 #include <linux/sched.h>
+#include <linux/vs_tag.h>
 
 #include "nfs4_fs.h"
 #include "delegation.h"
@@ -951,6 +952,7 @@
 	if (IS_ERR(res))
 		goto out_unblock_sillyrename;
 
+	dx_propagate_tag(nd, inode);
 no_entry:
 	res = d_materialise_unique(dentry, inode);
 	if (res != NULL) {
diff -uriN linux-2.6.32.43/fs/nfs/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/inode.c
--- linux-2.6.32.43/fs/nfs/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -36,6 +36,7 @@
 #include <linux/vfs.h>
 #include <linux/inet.h>
 #include <linux/nfs_xdr.h>
+#include <linux/vs_tag.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -156,7 +157,7 @@
 	nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
 	nfsi->attrtimeo_timestamp = jiffies;
 
-	memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_COOKIEVERF(inode)));
+	memset(NFS_COOKIEVERF(inode), 0, sizeof(NFS_I(inode)->cookieverf));
 	if (S_ISREG(mode) || S_ISDIR(mode) || S_ISLNK(mode))
 		nfsi->cache_validity |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_DATA|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL|NFS_INO_REVAL_PAGECACHE;
 	else
@@ -279,6 +280,8 @@
 	if (inode->i_state & I_NEW) {
 		struct nfs_inode *nfsi = NFS_I(inode);
 		unsigned long now = jiffies;
+		uid_t uid;
+		gid_t gid;
 
 		/* We set i_ino for the few things that still rely on it,
 		 * such as stat(2) */
@@ -327,8 +330,8 @@
 		nfsi->change_attr = 0;
 		inode->i_size = 0;
 		inode->i_nlink = 0;
-		inode->i_uid = -2;
-		inode->i_gid = -2;
+		uid = -2;
+		gid = -2;
 		inode->i_blocks = 0;
 		memset(nfsi->cookieverf, 0, sizeof(nfsi->cookieverf));
 
@@ -365,13 +368,13 @@
 		else if (nfs_server_capable(inode, NFS_CAP_NLINK))
 			nfsi->cache_validity |= NFS_INO_INVALID_ATTR;
 		if (fattr->valid & NFS_ATTR_FATTR_OWNER)
-			inode->i_uid = fattr->uid;
+			uid = fattr->uid;
 		else if (nfs_server_capable(inode, NFS_CAP_OWNER))
 			nfsi->cache_validity |= NFS_INO_INVALID_ATTR
 				| NFS_INO_INVALID_ACCESS
 				| NFS_INO_INVALID_ACL;
 		if (fattr->valid & NFS_ATTR_FATTR_GROUP)
-			inode->i_gid = fattr->gid;
+			gid = fattr->gid;
 		else if (nfs_server_capable(inode, NFS_CAP_OWNER_GROUP))
 			nfsi->cache_validity |= NFS_INO_INVALID_ATTR
 				| NFS_INO_INVALID_ACCESS
@@ -384,6 +387,11 @@
 			 */
 			inode->i_blocks = nfs_calc_block_size(fattr->du.nfs3.used);
 		}
+		inode->i_uid = INOTAG_UID(DX_TAG(inode), uid, gid);
+		inode->i_gid = INOTAG_GID(DX_TAG(inode), uid, gid);
+		inode->i_tag = INOTAG_TAG(DX_TAG(inode), uid, gid, 0);
+				/* maybe fattr->xid someday */
+
 		nfsi->attrtimeo = NFS_MINATTRTIMEO(inode);
 		nfsi->attrtimeo_timestamp = now;
 		nfsi->access_cache = RB_ROOT;
@@ -496,6 +504,8 @@
 			inode->i_uid = attr->ia_uid;
 		if ((attr->ia_valid & ATTR_GID) != 0)
 			inode->i_gid = attr->ia_gid;
+		if ((attr->ia_valid & ATTR_TAG) && IS_TAGGED(inode))
+			inode->i_tag = attr->ia_tag;
 		NFS_I(inode)->cache_validity |= NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
 		spin_unlock(&inode->i_lock);
 	}
@@ -914,6 +924,9 @@
 	struct nfs_inode *nfsi = NFS_I(inode);
 	loff_t cur_size, new_isize;
 	unsigned long invalid = 0;
+	uid_t uid;
+	gid_t gid;
+	tag_t tag;
 
 
 	/* Has the inode gone and changed behind our back? */
@@ -937,13 +950,18 @@
 			invalid |= NFS_INO_INVALID_ATTR|NFS_INO_REVAL_PAGECACHE;
 	}
 
+	uid = INOTAG_UID(DX_TAG(inode), fattr->uid, fattr->gid);
+	gid = INOTAG_GID(DX_TAG(inode), fattr->uid, fattr->gid);
+	tag = INOTAG_TAG(DX_TAG(inode), fattr->uid, fattr->gid, 0);
+
 	/* Have any file permissions changed? */
 	if ((fattr->valid & NFS_ATTR_FATTR_MODE) && (inode->i_mode & S_IALLUGO) != (fattr->mode & S_IALLUGO))
 		invalid |= NFS_INO_INVALID_ATTR | NFS_INO_INVALID_ACCESS | NFS_INO_INVALID_ACL;
-	if ((fattr->valid & NFS_ATTR_FATTR_OWNER) && inode->i_uid != fattr->uid)
+	if ((fattr->valid & NFS_ATTR_FATTR_OWNER) && uid != fattr->uid)
 		invalid |= NFS_INO_INVALID_ATTR | NFS_INO_INVALID_ACCESS | NFS_INO_INVALID_ACL;
-	if ((fattr->valid & NFS_ATTR_FATTR_GROUP) && inode->i_gid != fattr->gid)
+	if ((fattr->valid & NFS_ATTR_FATTR_GROUP) && gid != fattr->gid)
 		invalid |= NFS_INO_INVALID_ATTR | NFS_INO_INVALID_ACCESS | NFS_INO_INVALID_ACL;
+		/* maybe check for tag too? */
 
 	/* Has the link count changed? */
 	if ((fattr->valid & NFS_ATTR_FATTR_NLINK) && inode->i_nlink != fattr->nlink)
@@ -973,16 +991,16 @@
 	return nfs_size_to_loff_t(fattr->size) > i_size_read(inode);
 }
 
-static atomic_long_t nfs_attr_generation_counter;
+static atomic_long_unchecked_t nfs_attr_generation_counter;
 
 static unsigned long nfs_read_attr_generation_counter(void)
 {
-	return atomic_long_read(&nfs_attr_generation_counter);
+	return atomic_long_read_unchecked(&nfs_attr_generation_counter);
 }
 
 unsigned long nfs_inc_attr_generation_counter(void)
 {
-	return atomic_long_inc_return(&nfs_attr_generation_counter);
+	return atomic_long_inc_return_unchecked(&nfs_attr_generation_counter);
 }
 
 void nfs_fattr_init(struct nfs_fattr *fattr)
@@ -1158,6 +1176,9 @@
 	unsigned long invalid = 0;
 	unsigned long now = jiffies;
 	unsigned long save_cache_validity;
+	uid_t uid;
+	gid_t gid;
+	tag_t tag;
 
 	dfprintk(VFS, "NFS: %s(%s/%ld ct=%d info=0x%x)\n",
 			__func__, inode->i_sb->s_id, inode->i_ino,
@@ -1260,6 +1281,9 @@
 				| NFS_INO_REVAL_PAGECACHE
 				| NFS_INO_REVAL_FORCED);
 
+	uid = INOTAG_UID(DX_TAG(inode), fattr->uid, fattr->gid);
+	gid = INOTAG_GID(DX_TAG(inode), fattr->uid, fattr->gid);
+	tag = INOTAG_TAG(DX_TAG(inode), fattr->uid, fattr->gid, 0);
 
 	if (fattr->valid & NFS_ATTR_FATTR_ATIME)
 		memcpy(&inode->i_atime, &fattr->atime, sizeof(inode->i_atime));
@@ -1279,9 +1303,9 @@
 				| NFS_INO_REVAL_FORCED);
 
 	if (fattr->valid & NFS_ATTR_FATTR_OWNER) {
-		if (inode->i_uid != fattr->uid) {
+		if (uid != fattr->uid) {
 			invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-			inode->i_uid = fattr->uid;
+			uid = fattr->uid;
 		}
 	} else if (server->caps & NFS_CAP_OWNER)
 		invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
@@ -1290,9 +1314,9 @@
 				| NFS_INO_REVAL_FORCED);
 
 	if (fattr->valid & NFS_ATTR_FATTR_GROUP) {
-		if (inode->i_gid != fattr->gid) {
+		if (gid != fattr->gid) {
 			invalid |= NFS_INO_INVALID_ATTR|NFS_INO_INVALID_ACCESS|NFS_INO_INVALID_ACL;
-			inode->i_gid = fattr->gid;
+			gid = fattr->gid;
 		}
 	} else if (server->caps & NFS_CAP_OWNER_GROUP)
 		invalid |= save_cache_validity & (NFS_INO_INVALID_ATTR
@@ -1300,6 +1324,10 @@
 				| NFS_INO_INVALID_ACL
 				| NFS_INO_REVAL_FORCED);
 
+	inode->i_uid = uid;
+	inode->i_gid = gid;
+	inode->i_tag = tag;
+
 	if (fattr->valid & NFS_ATTR_FATTR_NLINK) {
 		if (inode->i_nlink != fattr->nlink) {
 			invalid |= NFS_INO_INVALID_ATTR;
diff -uriN linux-2.6.32.43/fs/nfs/nfs3xdr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/nfs3xdr.c
--- linux-2.6.32.43/fs/nfs/nfs3xdr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/nfs3xdr.c	2011-07-15 05:50:11.000000000 -0500
@@ -21,6 +21,7 @@
 #include <linux/nfs3.h>
 #include <linux/nfs_fs.h>
 #include <linux/nfsacl.h>
+#include <linux/vs_tag.h>
 #include "internal.h"
 
 #define NFSDBG_FACILITY		NFSDBG_XDR
@@ -176,7 +177,7 @@
 }
 
 static inline __be32 *
-xdr_encode_sattr(__be32 *p, struct iattr *attr)
+xdr_encode_sattr(__be32 *p, struct iattr *attr, int tag)
 {
 	if (attr->ia_valid & ATTR_MODE) {
 		*p++ = xdr_one;
@@ -184,15 +185,17 @@
 	} else {
 		*p++ = xdr_zero;
 	}
-	if (attr->ia_valid & ATTR_UID) {
+	if (attr->ia_valid & ATTR_UID ||
+		(tag && (attr->ia_valid & ATTR_TAG))) {
 		*p++ = xdr_one;
-		*p++ = htonl(attr->ia_uid);
+		*p++ = htonl(TAGINO_UID(tag, attr->ia_uid, attr->ia_tag));
 	} else {
 		*p++ = xdr_zero;
 	}
-	if (attr->ia_valid & ATTR_GID) {
+	if (attr->ia_valid & ATTR_GID ||
+		(tag && (attr->ia_valid & ATTR_TAG))) {
 		*p++ = xdr_one;
-		*p++ = htonl(attr->ia_gid);
+		*p++ = htonl(TAGINO_GID(tag, attr->ia_gid, attr->ia_tag));
 	} else {
 		*p++ = xdr_zero;
 	}
@@ -279,7 +282,8 @@
 nfs3_xdr_sattrargs(struct rpc_rqst *req, __be32 *p, struct nfs3_sattrargs *args)
 {
 	p = xdr_encode_fhandle(p, args->fh);
-	p = xdr_encode_sattr(p, args->sattr);
+	p = xdr_encode_sattr(p, args->sattr,
+		req->rq_task->tk_client->cl_tag);
 	*p++ = htonl(args->guard);
 	if (args->guard)
 		p = xdr_encode_time3(p, &args->guardtime);
@@ -384,7 +388,8 @@
 		*p++ = args->verifier[0];
 		*p++ = args->verifier[1];
 	} else
-		p = xdr_encode_sattr(p, args->sattr);
+		p = xdr_encode_sattr(p, args->sattr,
+			req->rq_task->tk_client->cl_tag);
 
 	req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
 	return 0;
@@ -398,7 +403,8 @@
 {
 	p = xdr_encode_fhandle(p, args->fh);
 	p = xdr_encode_array(p, args->name, args->len);
-	p = xdr_encode_sattr(p, args->sattr);
+	p = xdr_encode_sattr(p, args->sattr,
+		req->rq_task->tk_client->cl_tag);
 	req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
 	return 0;
 }
@@ -411,7 +417,8 @@
 {
 	p = xdr_encode_fhandle(p, args->fromfh);
 	p = xdr_encode_array(p, args->fromname, args->fromlen);
-	p = xdr_encode_sattr(p, args->sattr);
+	p = xdr_encode_sattr(p, args->sattr,
+		req->rq_task->tk_client->cl_tag);
 	*p++ = htonl(args->pathlen);
 	req->rq_slen = xdr_adjust_iovec(req->rq_svec, p);
 
@@ -429,7 +436,8 @@
 	p = xdr_encode_fhandle(p, args->fh);
 	p = xdr_encode_array(p, args->name, args->len);
 	*p++ = htonl(args->type);
-	p = xdr_encode_sattr(p, args->sattr);
+	p = xdr_encode_sattr(p, args->sattr,
+		req->rq_task->tk_client->cl_tag);
 	if (args->type == NF3CHR || args->type == NF3BLK) {
 		*p++ = htonl(MAJOR(args->rdev));
 		*p++ = htonl(MINOR(args->rdev));
diff -uriN linux-2.6.32.43/fs/nfs/nfsroot.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/nfsroot.c
--- linux-2.6.32.43/fs/nfs/nfsroot.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/nfsroot.c	2011-07-15 05:50:11.000000000 -0500
@@ -122,12 +122,12 @@
 enum {
 	/* Options that take integer arguments */
 	Opt_port, Opt_rsize, Opt_wsize, Opt_timeo, Opt_retrans, Opt_acregmin,
-	Opt_acregmax, Opt_acdirmin, Opt_acdirmax,
+	Opt_acregmax, Opt_acdirmin, Opt_acdirmax, Opt_tagid,
 	/* Options that take no arguments */
 	Opt_soft, Opt_hard, Opt_intr,
 	Opt_nointr, Opt_posix, Opt_noposix, Opt_cto, Opt_nocto, Opt_ac, 
 	Opt_noac, Opt_lock, Opt_nolock, Opt_v2, Opt_v3, Opt_udp, Opt_tcp,
-	Opt_acl, Opt_noacl,
+	Opt_acl, Opt_noacl, Opt_tag, Opt_notag,
 	/* Error token */
 	Opt_err
 };
@@ -164,6 +164,9 @@
 	{Opt_tcp, "tcp"},
 	{Opt_acl, "acl"},
 	{Opt_noacl, "noacl"},
+	{Opt_tag, "tag"},
+	{Opt_notag, "notag"},
+	{Opt_tagid, "tagid=%u"},
 	{Opt_err, NULL}
 	
 };
@@ -275,6 +278,20 @@
 			case Opt_noacl:
 				nfs_data.flags |= NFS_MOUNT_NOACL;
 				break;
+#ifndef CONFIG_TAGGING_NONE
+			case Opt_tag:
+				nfs_data.flags |= NFS_MOUNT_TAGGED;
+				break;
+			case Opt_notag:
+				nfs_data.flags &= ~NFS_MOUNT_TAGGED;
+				break;
+#endif
+#ifdef CONFIG_PROPAGATE
+			case Opt_tagid:
+				/* use args[0] */
+				nfs_data.flags |= NFS_MOUNT_TAGGED;
+				break;
+#endif
 			default:
 				printk(KERN_WARNING "Root-NFS: unknown "
 					"option: %s\n", p);
diff -uriN linux-2.6.32.43/fs/nfs/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/super.c
--- linux-2.6.32.43/fs/nfs/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfs/super.c	2011-07-15 05:50:11.000000000 -0500
@@ -53,6 +53,7 @@
 #include <linux/nfs_xdr.h>
 #include <linux/magic.h>
 #include <linux/parser.h>
+#include <linux/vs_tag.h>
 
 #include <asm/system.h>
 #include <asm/uaccess.h>
@@ -570,6 +571,7 @@
 		{ NFS_MOUNT_NORDIRPLUS, ",nordirplus", "" },
 		{ NFS_MOUNT_UNSHARED, ",nosharecache", "" },
 		{ NFS_MOUNT_NORESVPORT, ",noresvport", "" },
+		{ NFS_MOUNT_TAGGED, ",tag", "" },
 		{ 0, NULL, NULL }
 	};
 	const struct proc_nfs_info *nfs_infop;
diff -uriN linux-2.6.32.43/fs/nfsd/auth.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/auth.c
--- linux-2.6.32.43/fs/nfsd/auth.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/auth.c	2011-07-15 05:50:11.000000000 -0500
@@ -10,6 +10,7 @@
 #include <linux/sunrpc/svcauth.h>
 #include <linux/nfsd/nfsd.h>
 #include <linux/nfsd/export.h>
+#include <linux/vs_tag.h>
 #include "auth.h"
 
 int nfsexp_flags(struct svc_rqst *rqstp, struct svc_export *exp)
@@ -44,6 +45,9 @@
 
 	new->fsuid = rqstp->rq_cred.cr_uid;
 	new->fsgid = rqstp->rq_cred.cr_gid;
+	/* FIXME: this desperately needs a tag :)
+	new->xid = (xid_t)INOTAG_TAG(DX_TAG_NFSD, cred.cr_uid, cred.cr_gid, 0);
+			*/
 
 	rqgi = rqstp->rq_cred.cr_group_info;
 
diff -uriN linux-2.6.32.43/fs/nfsd/lockd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/lockd.c
--- linux-2.6.32.43/fs/nfsd/lockd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/lockd.c	2011-07-15 05:51:18.000000000 -0500
@@ -66,7 +66,7 @@
 	fput(filp);
 }
 
-static struct nlmsvc_binding	nfsd_nlm_ops = {
+static const struct nlmsvc_binding	nfsd_nlm_ops = {
 	.fopen		= nlm_fopen,		/* open file for locking */
 	.fclose		= nlm_fclose,		/* close file */
 };
diff -uriN linux-2.6.32.43/fs/nfsd/nfs3xdr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/nfs3xdr.c
--- linux-2.6.32.43/fs/nfsd/nfs3xdr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/nfs3xdr.c	2011-07-15 05:50:11.000000000 -0500
@@ -21,6 +21,7 @@
 #include <linux/sunrpc/svc.h>
 #include <linux/nfsd/nfsd.h>
 #include <linux/nfsd/xdr3.h>
+#include <linux/vs_tag.h>
 #include "auth.h"
 
 #define NFSDDBG_FACILITY		NFSDDBG_XDR
@@ -108,6 +109,8 @@
 decode_sattr3(__be32 *p, struct iattr *iap)
 {
 	u32	tmp;
+	uid_t	uid = 0;
+	gid_t	gid = 0;
 
 	iap->ia_valid = 0;
 
@@ -117,12 +120,15 @@
 	}
 	if (*p++) {
 		iap->ia_valid |= ATTR_UID;
-		iap->ia_uid = ntohl(*p++);
+		uid = ntohl(*p++);
 	}
 	if (*p++) {
 		iap->ia_valid |= ATTR_GID;
-		iap->ia_gid = ntohl(*p++);
+		gid = ntohl(*p++);
 	}
+	iap->ia_uid = INOTAG_UID(DX_TAG_NFSD, uid, gid);
+	iap->ia_gid = INOTAG_GID(DX_TAG_NFSD, uid, gid);
+	iap->ia_tag = INOTAG_TAG(DX_TAG_NFSD, uid, gid, 0);
 	if (*p++) {
 		u64	newsize;
 
@@ -178,8 +184,12 @@
 	*p++ = htonl(nfs3_ftypes[(stat->mode & S_IFMT) >> 12]);
 	*p++ = htonl((u32) stat->mode);
 	*p++ = htonl((u32) stat->nlink);
-	*p++ = htonl((u32) nfsd_ruid(rqstp, stat->uid));
-	*p++ = htonl((u32) nfsd_rgid(rqstp, stat->gid));
+	*p++ = htonl((u32) nfsd_ruid(rqstp,
+		TAGINO_UID(0 /* FIXME: DX_TAG(dentry->d_inode) */,
+		stat->uid, stat->tag)));
+	*p++ = htonl((u32) nfsd_rgid(rqstp,
+		TAGINO_GID(0 /* FIXME: DX_TAG(dentry->d_inode) */,
+		stat->gid, stat->tag)));
 	if (S_ISLNK(stat->mode) && stat->size > NFS3_MAXPATHLEN) {
 		p = xdr_encode_hyper(p, (u64) NFS3_MAXPATHLEN);
 	} else {
diff -uriN linux-2.6.32.43/fs/nfsd/nfs4state.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/nfs4state.c
--- linux-2.6.32.43/fs/nfsd/nfs4state.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/nfs4state.c	2011-07-15 05:51:18.000000000 -0500
@@ -3457,6 +3457,8 @@
 	unsigned int cmd;
 	int err;
 
+	pax_track_stack();
+
 	dprintk("NFSD: nfsd4_lock: start=%Ld length=%Ld\n",
 		(long long) lock->lk_offset,
 		(long long) lock->lk_length);
diff -uriN linux-2.6.32.43/fs/nfsd/nfs4xdr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/nfs4xdr.c
--- linux-2.6.32.43/fs/nfsd/nfs4xdr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/nfs4xdr.c	2011-07-15 05:51:18.000000000 -0500
@@ -57,6 +57,7 @@
 #include <linux/nfs4_acl.h>
 #include <linux/sunrpc/gss_api.h>
 #include <linux/sunrpc/svcauth_gss.h>
+#include <linux/vs_tag.h>
 
 #define NFSDDBG_FACILITY		NFSDDBG_XDR
 
@@ -1751,6 +1752,8 @@
 	struct nfsd4_compoundres *resp = rqstp->rq_resp;
 	u32 minorversion = resp->cstate.minorversion;
 
+	pax_track_stack();
+
 	BUG_ON(bmval1 & NFSD_WRITEONLY_ATTRS_WORD1);
 	BUG_ON(bmval0 & ~nfsd_suppattrs0(minorversion));
 	BUG_ON(bmval1 & ~nfsd_suppattrs1(minorversion));
@@ -2047,14 +2050,18 @@
 		WRITE32(stat.nlink);
 	}
 	if (bmval1 & FATTR4_WORD1_OWNER) {
-		status = nfsd4_encode_user(rqstp, stat.uid, &p, &buflen);
+		status = nfsd4_encode_user(rqstp,
+			TAGINO_UID(DX_TAG(dentry->d_inode),
+			stat.uid, stat.tag), &p, &buflen);
 		if (status == nfserr_resource)
 			goto out_resource;
 		if (status)
 			goto out;
 	}
 	if (bmval1 & FATTR4_WORD1_OWNER_GROUP) {
-		status = nfsd4_encode_group(rqstp, stat.gid, &p, &buflen);
+		status = nfsd4_encode_group(rqstp,
+			TAGINO_GID(DX_TAG(dentry->d_inode),
+			stat.gid, stat.tag), &p, &buflen);
 		if (status == nfserr_resource)
 			goto out_resource;
 		if (status)
diff -uriN linux-2.6.32.43/fs/nfsd/nfsxdr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/nfsxdr.c
--- linux-2.6.32.43/fs/nfsd/nfsxdr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/nfsxdr.c	2011-07-15 05:50:11.000000000 -0500
@@ -15,6 +15,7 @@
 #include <linux/nfsd/nfsd.h>
 #include <linux/nfsd/xdr.h>
 #include <linux/mm.h>
+#include <linux/vs_tag.h>
 #include "auth.h"
 
 #define NFSDDBG_FACILITY		NFSDDBG_XDR
@@ -98,6 +99,8 @@
 decode_sattr(__be32 *p, struct iattr *iap)
 {
 	u32	tmp, tmp1;
+	uid_t	uid = 0;
+	gid_t	gid = 0;
 
 	iap->ia_valid = 0;
 
@@ -111,12 +114,15 @@
 	}
 	if ((tmp = ntohl(*p++)) != (u32)-1) {
 		iap->ia_valid |= ATTR_UID;
-		iap->ia_uid = tmp;
+		uid = tmp;
 	}
 	if ((tmp = ntohl(*p++)) != (u32)-1) {
 		iap->ia_valid |= ATTR_GID;
-		iap->ia_gid = tmp;
+		gid = tmp;
 	}
+	iap->ia_uid = INOTAG_UID(DX_TAG_NFSD, uid, gid);
+	iap->ia_gid = INOTAG_GID(DX_TAG_NFSD, uid, gid);
+	iap->ia_tag = INOTAG_TAG(DX_TAG_NFSD, uid, gid, 0);
 	if ((tmp = ntohl(*p++)) != (u32)-1) {
 		iap->ia_valid |= ATTR_SIZE;
 		iap->ia_size = tmp;
@@ -161,8 +167,10 @@
 	*p++ = htonl(nfs_ftypes[type >> 12]);
 	*p++ = htonl((u32) stat->mode);
 	*p++ = htonl((u32) stat->nlink);
-	*p++ = htonl((u32) nfsd_ruid(rqstp, stat->uid));
-	*p++ = htonl((u32) nfsd_rgid(rqstp, stat->gid));
+	*p++ = htonl((u32) nfsd_ruid(rqstp,
+		TAGINO_UID(DX_TAG(dentry->d_inode), stat->uid, stat->tag)));
+	*p++ = htonl((u32) nfsd_rgid(rqstp,
+		TAGINO_GID(DX_TAG(dentry->d_inode), stat->gid, stat->tag)));
 
 	if (S_ISLNK(type) && stat->size > NFS_MAXPATHLEN) {
 		*p++ = htonl(NFS_MAXPATHLEN);
diff -uriN linux-2.6.32.43/fs/nfsd/vfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/vfs.c
--- linux-2.6.32.43/fs/nfsd/vfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nfsd/vfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -937,7 +937,7 @@
 	} else {
 		oldfs = get_fs();
 		set_fs(KERNEL_DS);
-		host_err = vfs_readv(file, (struct iovec __user *)vec, vlen, &offset);
+		host_err = vfs_readv(file, (__force struct iovec __user *)vec, vlen, &offset);
 		set_fs(oldfs);
 	}
 
@@ -1060,7 +1060,7 @@
 
 	/* Write the data. */
 	oldfs = get_fs(); set_fs(KERNEL_DS);
-	host_err = vfs_writev(file, (struct iovec __user *)vec, vlen, &offset);
+	host_err = vfs_writev(file, (__force struct iovec __user *)vec, vlen, &offset);
 	set_fs(oldfs);
 	if (host_err < 0)
 		goto out_nfserr;
@@ -1542,7 +1542,7 @@
 	 */
 
 	oldfs = get_fs(); set_fs(KERNEL_DS);
-	host_err = inode->i_op->readlink(dentry, buf, *lenp);
+	host_err = inode->i_op->readlink(dentry, (__force char __user *)buf, *lenp);
 	set_fs(oldfs);
 
 	if (host_err < 0)
diff -uriN linux-2.6.32.43/fs/nilfs2/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nilfs2/ioctl.c
--- linux-2.6.32.43/fs/nilfs2/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/nilfs2/ioctl.c	2011-07-15 05:51:18.000000000 -0500
@@ -480,7 +480,7 @@
 				      unsigned int cmd, void __user *argp)
 {
 	struct nilfs_argv argv[5];
-	const static size_t argsz[5] = {
+	static const size_t argsz[5] = {
 		sizeof(struct nilfs_vdesc),
 		sizeof(struct nilfs_period),
 		sizeof(__u64),
diff -uriN linux-2.6.32.43/fs/notify/dnotify/dnotify.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/notify/dnotify/dnotify.c
--- linux-2.6.32.43/fs/notify/dnotify/dnotify.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/notify/dnotify/dnotify.c	2011-07-15 05:51:18.000000000 -0500
@@ -173,7 +173,7 @@
 	kmem_cache_free(dnotify_mark_entry_cache, dnentry);
 }
 
-static struct fsnotify_ops dnotify_fsnotify_ops = {
+static const struct fsnotify_ops dnotify_fsnotify_ops = {
 	.handle_event = dnotify_handle_event,
 	.should_send_event = dnotify_should_send_event,
 	.free_group_priv = NULL,
diff -uriN linux-2.6.32.43/fs/notify/notification.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/notify/notification.c
--- linux-2.6.32.43/fs/notify/notification.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/notify/notification.c	2011-07-15 05:51:18.000000000 -0500
@@ -57,7 +57,7 @@
  * get set to 0 so it will never get 'freed'
  */
 static struct fsnotify_event q_overflow_event;
-static atomic_t fsnotify_sync_cookie = ATOMIC_INIT(0);
+static atomic_unchecked_t fsnotify_sync_cookie = ATOMIC_INIT(0);
 
 /**
  * fsnotify_get_cookie - return a unique cookie for use in synchronizing events.
@@ -65,7 +65,7 @@
  */
 u32 fsnotify_get_cookie(void)
 {
-	return atomic_inc_return(&fsnotify_sync_cookie);
+	return atomic_inc_return_unchecked(&fsnotify_sync_cookie);
 }
 EXPORT_SYMBOL_GPL(fsnotify_get_cookie);
 
diff -uriN linux-2.6.32.43/fs/ntfs/dir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ntfs/dir.c
--- linux-2.6.32.43/fs/ntfs/dir.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ntfs/dir.c	2011-07-15 05:51:18.000000000 -0500
@@ -1328,7 +1328,7 @@
 	ia = (INDEX_ALLOCATION*)(kaddr + (ia_pos & ~PAGE_CACHE_MASK &
 			~(s64)(ndir->itype.index.block_size - 1)));
 	/* Bounds checks. */
-	if (unlikely((u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
+	if (unlikely(!kaddr || (u8*)ia < kaddr || (u8*)ia > kaddr + PAGE_CACHE_SIZE)) {
 		ntfs_error(sb, "Out of bounds check failed. Corrupt directory "
 				"inode 0x%lx or driver bug.", vdir->i_ino);
 		goto err_out;
diff -uriN linux-2.6.32.43/fs/ntfs/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ntfs/file.c
--- linux-2.6.32.43/fs/ntfs/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ntfs/file.c	2011-07-15 05:51:18.000000000 -0500
@@ -2243,6 +2243,6 @@
 #endif /* NTFS_RW */
 };
 
-const struct file_operations ntfs_empty_file_ops = {};
+const struct file_operations ntfs_empty_file_ops __read_only;
 
-const struct inode_operations ntfs_empty_inode_ops = {};
+const struct inode_operations ntfs_empty_inode_ops __read_only;
diff -uriN linux-2.6.32.43/fs/ocfs2/cluster/masklog.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/cluster/masklog.c
--- linux-2.6.32.43/fs/ocfs2/cluster/masklog.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/cluster/masklog.c	2011-07-15 05:51:18.000000000 -0500
@@ -135,7 +135,7 @@
 	return mlog_mask_store(mlog_attr->mask, buf, count);
 }
 
-static struct sysfs_ops mlog_attr_ops = {
+static const struct sysfs_ops mlog_attr_ops = {
 	.show  = mlog_show,
 	.store = mlog_store,
 };
diff -uriN linux-2.6.32.43/fs/ocfs2/dlm/dlmfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/dlm/dlmfs.c
--- linux-2.6.32.43/fs/ocfs2/dlm/dlmfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/dlm/dlmfs.c	2011-07-15 05:50:11.000000000 -0500
@@ -43,6 +43,7 @@
 #include <linux/init.h>
 #include <linux/string.h>
 #include <linux/backing-dev.h>
+#include <linux/vs_tag.h>
 
 #include <asm/uaccess.h>
 
@@ -342,6 +343,7 @@
 		inode->i_mode = mode;
 		inode->i_uid = current_fsuid();
 		inode->i_gid = current_fsgid();
+		inode->i_tag = dx_current_fstag(sb);
 		inode->i_mapping->backing_dev_info = &dlmfs_backing_dev_info;
 		inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
 		inc_nlink(inode);
@@ -367,6 +369,7 @@
 	inode->i_mode = mode;
 	inode->i_uid = current_fsuid();
 	inode->i_gid = current_fsgid();
+	inode->i_tag = dx_current_fstag(sb);
 	inode->i_mapping->backing_dev_info = &dlmfs_backing_dev_info;
 	inode->i_atime = inode->i_mtime = inode->i_ctime = CURRENT_TIME;
 
diff -uriN linux-2.6.32.43/fs/ocfs2/dlmglue.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/dlmglue.c
--- linux-2.6.32.43/fs/ocfs2/dlmglue.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/dlmglue.c	2011-07-15 05:50:11.000000000 -0500
@@ -1991,6 +1991,7 @@
 	lvb->lvb_iclusters = cpu_to_be32(oi->ip_clusters);
 	lvb->lvb_iuid      = cpu_to_be32(inode->i_uid);
 	lvb->lvb_igid      = cpu_to_be32(inode->i_gid);
+	lvb->lvb_itag      = cpu_to_be16(inode->i_tag);
 	lvb->lvb_imode     = cpu_to_be16(inode->i_mode);
 	lvb->lvb_inlink    = cpu_to_be16(inode->i_nlink);
 	lvb->lvb_iatime_packed  =
@@ -2045,6 +2046,7 @@
 
 	inode->i_uid     = be32_to_cpu(lvb->lvb_iuid);
 	inode->i_gid     = be32_to_cpu(lvb->lvb_igid);
+	inode->i_tag     = be16_to_cpu(lvb->lvb_itag);
 	inode->i_mode    = be16_to_cpu(lvb->lvb_imode);
 	inode->i_nlink   = be16_to_cpu(lvb->lvb_inlink);
 	ocfs2_unpack_timespec(&inode->i_atime,
diff -uriN linux-2.6.32.43/fs/ocfs2/dlmglue.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/dlmglue.h
--- linux-2.6.32.43/fs/ocfs2/dlmglue.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/dlmglue.h	2011-07-15 05:50:11.000000000 -0500
@@ -46,7 +46,8 @@
 	__be16       lvb_inlink;
 	__be32       lvb_iattr;
 	__be32       lvb_igeneration;
-	__be32       lvb_reserved2;
+	__be16       lvb_itag;
+	__be16       lvb_reserved2;
 };
 
 #define OCFS2_QINFO_LVB_VERSION 1
diff -uriN linux-2.6.32.43/fs/ocfs2/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/file.c
--- linux-2.6.32.43/fs/ocfs2/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/file.c	2011-07-15 05:50:11.000000000 -0500
@@ -960,13 +960,15 @@
 		mlog(0, "uid change: %d\n", attr->ia_uid);
 	if (attr->ia_valid & ATTR_GID)
 		mlog(0, "gid change: %d\n", attr->ia_gid);
+	if (attr->ia_valid & ATTR_TAG)
+		mlog(0, "tag change: %d\n", attr->ia_tag);
 	if (attr->ia_valid & ATTR_SIZE)
 		mlog(0, "size change...\n");
 	if (attr->ia_valid & (ATTR_ATIME | ATTR_MTIME | ATTR_CTIME))
 		mlog(0, "time change...\n");
 
 #define OCFS2_VALID_ATTRS (ATTR_ATIME | ATTR_MTIME | ATTR_CTIME | ATTR_SIZE \
-			   | ATTR_GID | ATTR_UID | ATTR_MODE)
+			   | ATTR_GID | ATTR_UID | ATTR_TAG | ATTR_MODE)
 	if (!(attr->ia_valid & OCFS2_VALID_ATTRS)) {
 		mlog(0, "can't handle attrs: 0x%x\n", attr->ia_valid);
 		return 0;
diff -uriN linux-2.6.32.43/fs/ocfs2/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/inode.c
--- linux-2.6.32.43/fs/ocfs2/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -29,6 +29,7 @@
 #include <linux/highmem.h>
 #include <linux/pagemap.h>
 #include <linux/quotaops.h>
+#include <linux/vs_tag.h>
 
 #include <asm/byteorder.h>
 
@@ -79,11 +80,13 @@
 {
 	unsigned int flags = OCFS2_I(inode)->ip_attr;
 
-	inode->i_flags &= ~(S_IMMUTABLE |
+	inode->i_flags &= ~(S_IMMUTABLE | S_IXUNLINK |
 		S_SYNC | S_APPEND | S_NOATIME | S_DIRSYNC);
 
 	if (flags & OCFS2_IMMUTABLE_FL)
 		inode->i_flags |= S_IMMUTABLE;
+	if (flags & OCFS2_IXUNLINK_FL)
+		inode->i_flags |= S_IXUNLINK;
 
 	if (flags & OCFS2_SYNC_FL)
 		inode->i_flags |= S_SYNC;
@@ -93,25 +96,44 @@
 		inode->i_flags |= S_NOATIME;
 	if (flags & OCFS2_DIRSYNC_FL)
 		inode->i_flags |= S_DIRSYNC;
+
+	inode->i_vflags &= ~(V_BARRIER | V_COW);
+
+	if (flags & OCFS2_BARRIER_FL)
+		inode->i_vflags |= V_BARRIER;
+	if (flags & OCFS2_COW_FL)
+		inode->i_vflags |= V_COW;
 }
 
 /* Propagate flags from i_flags to OCFS2_I(inode)->ip_attr */
 void ocfs2_get_inode_flags(struct ocfs2_inode_info *oi)
 {
 	unsigned int flags = oi->vfs_inode.i_flags;
+	unsigned int vflags = oi->vfs_inode.i_vflags;
+
+	oi->ip_attr &= ~(OCFS2_SYNC_FL | OCFS2_APPEND_FL |
+			OCFS2_IMMUTABLE_FL | OCFS2_IXUNLINK_FL |
+			OCFS2_NOATIME_FL | OCFS2_DIRSYNC_FL |
+			OCFS2_BARRIER_FL | OCFS2_COW_FL);
+
+	if (flags & S_IMMUTABLE)
+		oi->ip_attr |= OCFS2_IMMUTABLE_FL;
+	if (flags & S_IXUNLINK)
+		oi->ip_attr |= OCFS2_IXUNLINK_FL;
 
-	oi->ip_attr &= ~(OCFS2_SYNC_FL|OCFS2_APPEND_FL|
-			OCFS2_IMMUTABLE_FL|OCFS2_NOATIME_FL|OCFS2_DIRSYNC_FL);
 	if (flags & S_SYNC)
 		oi->ip_attr |= OCFS2_SYNC_FL;
 	if (flags & S_APPEND)
 		oi->ip_attr |= OCFS2_APPEND_FL;
-	if (flags & S_IMMUTABLE)
-		oi->ip_attr |= OCFS2_IMMUTABLE_FL;
 	if (flags & S_NOATIME)
 		oi->ip_attr |= OCFS2_NOATIME_FL;
 	if (flags & S_DIRSYNC)
 		oi->ip_attr |= OCFS2_DIRSYNC_FL;
+
+	if (vflags & V_BARRIER)
+		oi->ip_attr |= OCFS2_BARRIER_FL;
+	if (vflags & V_COW)
+		oi->ip_attr |= OCFS2_COW_FL;
 }
 
 struct inode *ocfs2_ilookup(struct super_block *sb, u64 blkno)
@@ -246,6 +268,8 @@
 	struct super_block *sb;
 	struct ocfs2_super *osb;
 	int use_plocks = 1;
+	uid_t uid;
+	gid_t gid;
 
 	mlog_entry("(0x%p, size:%llu)\n", inode,
 		   (unsigned long long)le64_to_cpu(fe->i_size));
@@ -277,8 +301,12 @@
 	inode->i_generation = le32_to_cpu(fe->i_generation);
 	inode->i_rdev = huge_decode_dev(le64_to_cpu(fe->id1.dev1.i_rdev));
 	inode->i_mode = le16_to_cpu(fe->i_mode);
-	inode->i_uid = le32_to_cpu(fe->i_uid);
-	inode->i_gid = le32_to_cpu(fe->i_gid);
+	uid = le32_to_cpu(fe->i_uid);
+	gid = le32_to_cpu(fe->i_gid);
+	inode->i_uid = INOTAG_UID(DX_TAG(inode), uid, gid);
+	inode->i_gid = INOTAG_GID(DX_TAG(inode), uid, gid);
+	inode->i_tag = INOTAG_TAG(DX_TAG(inode), uid, gid,
+		/* le16_to_cpu(raw_inode->i_raw_tag)i */ 0);
 
 	/* Fast symlinks will have i_size but no allocated clusters. */
 	if (S_ISLNK(inode->i_mode) && !fe->i_clusters)
diff -uriN linux-2.6.32.43/fs/ocfs2/inode.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/inode.h
--- linux-2.6.32.43/fs/ocfs2/inode.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/inode.h	2011-07-15 05:50:11.000000000 -0500
@@ -150,6 +150,7 @@
 
 void ocfs2_set_inode_flags(struct inode *inode);
 void ocfs2_get_inode_flags(struct ocfs2_inode_info *oi);
+int ocfs2_sync_flags(struct inode *inode, int, int);
 
 static inline blkcnt_t ocfs2_inode_sector_count(struct inode *inode)
 {
diff -uriN linux-2.6.32.43/fs/ocfs2/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/ioctl.c
--- linux-2.6.32.43/fs/ocfs2/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/ioctl.c	2011-07-15 05:50:11.000000000 -0500
@@ -42,7 +42,41 @@
 	return status;
 }
 
-static int ocfs2_set_inode_attr(struct inode *inode, unsigned flags,
+int ocfs2_sync_flags(struct inode *inode, int flags, int vflags)
+{
+	struct ocfs2_super *osb = OCFS2_SB(inode->i_sb);
+	struct buffer_head *bh = NULL;
+	handle_t *handle = NULL;
+	int status;
+
+	status = ocfs2_inode_lock(inode, &bh, 1);
+	if (status < 0) {
+		mlog_errno(status);
+		return status;
+	}
+	handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
+	if (IS_ERR(handle)) {
+		status = PTR_ERR(handle);
+		mlog_errno(status);
+		goto bail_unlock;
+	}
+
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+	ocfs2_get_inode_flags(OCFS2_I(inode));
+
+	status = ocfs2_mark_inode_dirty(handle, inode, bh);
+	if (status < 0)
+		mlog_errno(status);
+
+	ocfs2_commit_trans(osb, handle);
+bail_unlock:
+	ocfs2_inode_unlock(inode, 1);
+	brelse(bh);
+	return status;
+}
+
+int ocfs2_set_inode_attr(struct inode *inode, unsigned flags,
 				unsigned mask)
 {
 	struct ocfs2_inode_info *ocfs2_inode = OCFS2_I(inode);
@@ -67,6 +101,11 @@
 	if (!S_ISDIR(inode->i_mode))
 		flags &= ~OCFS2_DIRSYNC_FL;
 
+	if (IS_BARRIER(inode)) {
+		vxwprintk_task(1, "messing with the barrier.");
+		goto bail_unlock;
+	}
+
 	handle = ocfs2_start_trans(osb, OCFS2_INODE_UPDATE_CREDITS);
 	if (IS_ERR(handle)) {
 		status = PTR_ERR(handle);
@@ -108,6 +147,7 @@
 	return status;
 }
 
+
 long ocfs2_ioctl(struct file *filp, unsigned int cmd, unsigned long arg)
 {
 	struct inode *inode = filp->f_path.dentry->d_inode;
diff -uriN linux-2.6.32.43/fs/ocfs2/localalloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/localalloc.c
--- linux-2.6.32.43/fs/ocfs2/localalloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/localalloc.c	2011-07-15 05:51:18.000000000 -0500
@@ -1188,7 +1188,7 @@
 		goto bail;
 	}
 
-	atomic_inc(&osb->alloc_stats.moves);
+	atomic_inc_unchecked(&osb->alloc_stats.moves);
 
 	status = 0;
 bail:
diff -uriN linux-2.6.32.43/fs/ocfs2/namei.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/namei.c
--- linux-2.6.32.43/fs/ocfs2/namei.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/namei.c	2011-07-15 05:51:18.000000000 -0500
@@ -41,6 +41,7 @@
 #include <linux/slab.h>
 #include <linux/highmem.h>
 #include <linux/quotaops.h>
+#include <linux/vs_tag.h>
 
 #define MLOG_MASK_PREFIX ML_NAMEI
 #include <cluster/masklog.h>
@@ -481,6 +482,7 @@
 	u64 fe_blkno = 0;
 	u16 suballoc_bit;
 	u16 feat;
+	tag_t tag;
 
 	*new_fe_bh = NULL;
 
@@ -524,8 +526,11 @@
 	fe->i_blkno = cpu_to_le64(fe_blkno);
 	fe->i_suballoc_bit = cpu_to_le16(suballoc_bit);
 	fe->i_suballoc_slot = cpu_to_le16(inode_ac->ac_alloc_slot);
-	fe->i_uid = cpu_to_le32(inode->i_uid);
-	fe->i_gid = cpu_to_le32(inode->i_gid);
+
+	tag = dx_current_fstag(osb->sb);
+	fe->i_uid = cpu_to_le32(TAGINO_UID(DX_TAG(inode), inode->i_uid, tag));
+	fe->i_gid = cpu_to_le32(TAGINO_GID(DX_TAG(inode), inode->i_gid, tag));
+	inode->i_tag = tag;
 	fe->i_mode = cpu_to_le16(inode->i_mode);
 	if (S_ISCHR(inode->i_mode) || S_ISBLK(inode->i_mode))
 		fe->id1.dev1.i_rdev = cpu_to_le64(huge_encode_dev(dev));
@@ -1043,6 +1048,8 @@
 	struct ocfs2_dir_lookup_result orphan_insert = { NULL, };
 	struct ocfs2_dir_lookup_result target_insert = { NULL, };
 
+	pax_track_stack();
+
 	/* At some point it might be nice to break this function up a
 	 * bit. */
 
diff -uriN linux-2.6.32.43/fs/ocfs2/ocfs2_fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/ocfs2_fs.h
--- linux-2.6.32.43/fs/ocfs2/ocfs2_fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/ocfs2_fs.h	2011-07-15 05:50:11.000000000 -0500
@@ -231,18 +231,23 @@
 #define OCFS2_HAS_REFCOUNT_FL   (0x0010)
 
 /* Inode attributes, keep in sync with EXT2 */
-#define OCFS2_SECRM_FL		(0x00000001)	/* Secure deletion */
-#define OCFS2_UNRM_FL		(0x00000002)	/* Undelete */
-#define OCFS2_COMPR_FL		(0x00000004)	/* Compress file */
-#define OCFS2_SYNC_FL		(0x00000008)	/* Synchronous updates */
-#define OCFS2_IMMUTABLE_FL	(0x00000010)	/* Immutable file */
-#define OCFS2_APPEND_FL		(0x00000020)	/* writes to file may only append */
-#define OCFS2_NODUMP_FL		(0x00000040)	/* do not dump file */
-#define OCFS2_NOATIME_FL	(0x00000080)	/* do not update atime */
-#define OCFS2_DIRSYNC_FL	(0x00010000)	/* dirsync behaviour (directories only) */
+#define OCFS2_SECRM_FL		FS_SECRM_FL	/* Secure deletion */
+#define OCFS2_UNRM_FL		FS_UNRM_FL	/* Undelete */
+#define OCFS2_COMPR_FL		FS_COMPR_FL	/* Compress file */
+#define OCFS2_SYNC_FL		FS_SYNC_FL	/* Synchronous updates */
+#define OCFS2_IMMUTABLE_FL	FS_IMMUTABLE_FL	/* Immutable file */
+#define OCFS2_APPEND_FL		FS_APPEND_FL	/* writes to file may only append */
+#define OCFS2_NODUMP_FL		FS_NODUMP_FL	/* do not dump file */
+#define OCFS2_NOATIME_FL	FS_NOATIME_FL	/* do not update atime */
 
-#define OCFS2_FL_VISIBLE	(0x000100FF)	/* User visible flags */
-#define OCFS2_FL_MODIFIABLE	(0x000100FF)	/* User modifiable flags */
+#define OCFS2_DIRSYNC_FL	FS_DIRSYNC_FL	/* dirsync behaviour (directories only) */
+#define OCFS2_IXUNLINK_FL	FS_IXUNLINK_FL	/* Immutable invert on unlink */
+
+#define OCFS2_BARRIER_FL	FS_BARRIER_FL	/* Barrier for chroot() */
+#define OCFS2_COW_FL		FS_COW_FL	/* Copy on Write marker */
+
+#define OCFS2_FL_VISIBLE	(0x010300FF)	/* User visible flags */
+#define OCFS2_FL_MODIFIABLE	(0x010300FF)	/* User modifiable flags */
 
 /*
  * Extent record flags (e_node.leaf.flags)
diff -uriN linux-2.6.32.43/fs/ocfs2/ocfs2.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/ocfs2.h
--- linux-2.6.32.43/fs/ocfs2/ocfs2.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/ocfs2.h	2011-07-15 05:51:18.000000000 -0500
@@ -217,11 +217,11 @@
 
 struct ocfs2_alloc_stats
 {
-	atomic_t moves;
-	atomic_t local_data;
-	atomic_t bitmap_data;
-	atomic_t bg_allocs;
-	atomic_t bg_extends;
+	atomic_unchecked_t moves;
+	atomic_unchecked_t local_data;
+	atomic_unchecked_t bitmap_data;
+	atomic_unchecked_t bg_allocs;
+	atomic_unchecked_t bg_extends;
 };
 
 enum ocfs2_local_alloc_state
@@ -248,6 +248,7 @@
 	OCFS2_MOUNT_POSIX_ACL = 1 << 8,	/* POSIX access control lists */
 	OCFS2_MOUNT_USRQUOTA = 1 << 9, /* We support user quotas */
 	OCFS2_MOUNT_GRPQUOTA = 1 << 10, /* We support group quotas */
+	OCFS2_MOUNT_TAGGED = 1 << 11, /* use tagging */
 };
 
 #define OCFS2_OSB_SOFT_RO			0x0001
diff -uriN linux-2.6.32.43/fs/ocfs2/suballoc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/suballoc.c
--- linux-2.6.32.43/fs/ocfs2/suballoc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/suballoc.c	2011-07-15 05:51:18.000000000 -0500
@@ -623,7 +623,7 @@
 				mlog_errno(status);
 			goto bail;
 		}
-		atomic_inc(&osb->alloc_stats.bg_extends);
+		atomic_inc_unchecked(&osb->alloc_stats.bg_extends);
 
 		/* You should never ask for this much metadata */
 		BUG_ON(bits_wanted >
@@ -1654,7 +1654,7 @@
 		mlog_errno(status);
 		goto bail;
 	}
-	atomic_inc(&osb->alloc_stats.bg_allocs);
+	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
 
 	*blkno_start = bg_blkno + (u64) *suballoc_bit_start;
 	ac->ac_bits_given += (*num_bits);
@@ -1728,7 +1728,7 @@
 		mlog_errno(status);
 		goto bail;
 	}
-	atomic_inc(&osb->alloc_stats.bg_allocs);
+	atomic_inc_unchecked(&osb->alloc_stats.bg_allocs);
 
 	BUG_ON(num_bits != 1);
 
@@ -1830,7 +1830,7 @@
 						      cluster_start,
 						      num_clusters);
 		if (!status)
-			atomic_inc(&osb->alloc_stats.local_data);
+			atomic_inc_unchecked(&osb->alloc_stats.local_data);
 	} else {
 		if (min_clusters > (osb->bitmap_cpg - 1)) {
 			/* The only paths asking for contiguousness
@@ -1858,7 +1858,7 @@
 				ocfs2_desc_bitmap_to_cluster_off(ac->ac_inode,
 								 bg_blkno,
 								 bg_bit_off);
-			atomic_inc(&osb->alloc_stats.bitmap_data);
+			atomic_inc_unchecked(&osb->alloc_stats.bitmap_data);
 		}
 	}
 	if (status < 0) {
diff -uriN linux-2.6.32.43/fs/ocfs2/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/super.c
--- linux-2.6.32.43/fs/ocfs2/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/ocfs2/super.c	2011-07-15 05:51:18.000000000 -0500
@@ -173,6 +173,7 @@
 	Opt_noacl,
 	Opt_usrquota,
 	Opt_grpquota,
+	Opt_tag, Opt_notag, Opt_tagid,
 	Opt_err,
 };
 
@@ -199,6 +200,9 @@
 	{Opt_noacl, "noacl"},
 	{Opt_usrquota, "usrquota"},
 	{Opt_grpquota, "grpquota"},
+	{Opt_tag, "tag"},
+	{Opt_notag, "notag"},
+	{Opt_tagid, "tagid=%u"},
 	{Opt_err, NULL}
 };
 
@@ -284,11 +288,11 @@
 			"%10s => GlobalAllocs: %d  LocalAllocs: %d  "
 			"SubAllocs: %d  LAWinMoves: %d  SAExtends: %d\n",
 			"Stats",
-			atomic_read(&osb->alloc_stats.bitmap_data),
-			atomic_read(&osb->alloc_stats.local_data),
-			atomic_read(&osb->alloc_stats.bg_allocs),
-			atomic_read(&osb->alloc_stats.moves),
-			atomic_read(&osb->alloc_stats.bg_extends));
+			atomic_read_unchecked(&osb->alloc_stats.bitmap_data),
+			atomic_read_unchecked(&osb->alloc_stats.local_data),
+			atomic_read_unchecked(&osb->alloc_stats.bg_allocs),
+			atomic_read_unchecked(&osb->alloc_stats.moves),
+			atomic_read_unchecked(&osb->alloc_stats.bg_extends));
 
 	out += snprintf(buf + out, len - out,
 			"%10s => State: %u  Descriptor: %llu  Size: %u bits  "
@@ -605,6 +609,13 @@
 		goto out;
 	}
 
+	if ((osb->s_mount_opt & OCFS2_MOUNT_TAGGED) !=
+	    (parsed_options.mount_opt & OCFS2_MOUNT_TAGGED)) {
+		ret = -EINVAL;
+		mlog(ML_ERROR, "Cannot change tagging on remount\n");
+		goto out;
+	}
+
 	if ((osb->s_mount_opt & OCFS2_MOUNT_HB_LOCAL) !=
 	    (parsed_options.mount_opt & OCFS2_MOUNT_HB_LOCAL)) {
 		ret = -EINVAL;
@@ -1152,6 +1163,9 @@
 
 	ocfs2_complete_mount_recovery(osb);
 
+	if (osb->s_mount_opt & OCFS2_MOUNT_TAGGED)
+		sb->s_flags |= MS_TAGGED;
+
 	if (ocfs2_mount_local(osb))
 		snprintf(nodestr, sizeof(nodestr), "local");
 	else
@@ -1430,6 +1444,20 @@
 			printk(KERN_INFO "ocfs2 (no)acl options not supported\n");
 			break;
 #endif
+#ifndef CONFIG_TAGGING_NONE
+		case Opt_tag:
+			mopt->mount_opt |= OCFS2_MOUNT_TAGGED;
+			break;
+		case Opt_notag:
+			mopt->mount_opt &= ~OCFS2_MOUNT_TAGGED;
+			break;
+#endif
+#ifdef CONFIG_PROPAGATE
+		case Opt_tagid:
+			/* use args[0] */
+			mopt->mount_opt |= OCFS2_MOUNT_TAGGED;
+			break;
+#endif
 		default:
 			mlog(ML_ERROR,
 			     "Unrecognized mount option \"%s\" "
@@ -2002,11 +2030,11 @@
 	spin_lock_init(&osb->osb_xattr_lock);
 	ocfs2_init_inode_steal_slot(osb);
 
-	atomic_set(&osb->alloc_stats.moves, 0);
-	atomic_set(&osb->alloc_stats.local_data, 0);
-	atomic_set(&osb->alloc_stats.bitmap_data, 0);
-	atomic_set(&osb->alloc_stats.bg_allocs, 0);
-	atomic_set(&osb->alloc_stats.bg_extends, 0);
+	atomic_set_unchecked(&osb->alloc_stats.moves, 0);
+	atomic_set_unchecked(&osb->alloc_stats.local_data, 0);
+	atomic_set_unchecked(&osb->alloc_stats.bitmap_data, 0);
+	atomic_set_unchecked(&osb->alloc_stats.bg_allocs, 0);
+	atomic_set_unchecked(&osb->alloc_stats.bg_extends, 0);
 
 	/* Copy the blockcheck stats from the superblock probe */
 	osb->osb_ecc_stats = *stats;
diff -uriN linux-2.6.32.43/fs/open.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/open.c
--- linux-2.6.32.43/fs/open.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/open.c	2011-07-15 06:07:33.000000000 -0500
@@ -30,22 +30,30 @@
 #include <linux/audit.h>
 #include <linux/falloc.h>
 #include <linux/fs_struct.h>
+#include <linux/vs_base.h>
+#include <linux/vs_limit.h>
+#include <linux/vs_tag.h>
+#include <linux/vs_cowbl.h>
 
 int vfs_statfs(struct dentry *dentry, struct kstatfs *buf)
 {
 	int retval = -ENODEV;
 
 	if (dentry) {
+		struct super_block *sb = dentry->d_sb;
+
 		retval = -ENOSYS;
-		if (dentry->d_sb->s_op->statfs) {
+		if (sb->s_op->statfs) {
 			memset(buf, 0, sizeof(*buf));
 			retval = security_sb_statfs(dentry);
 			if (retval)
 				return retval;
-			retval = dentry->d_sb->s_op->statfs(dentry, buf);
+			retval = sb->s_op->statfs(dentry, buf);
 			if (retval == 0 && buf->f_frsize == 0)
 				buf->f_frsize = buf->f_bsize;
 		}
+		if (!vx_check(0, VS_ADMIN|VS_WATCH))
+			vx_vsi_statfs(sb, buf);
 	}
 	return retval;
 }
@@ -275,6 +283,10 @@
 	error = locks_verify_truncate(inode, NULL, length);
 	if (!error)
 		error = security_path_truncate(&path, length, 0);
+
+	if (!error && !gr_acl_handle_truncate(path.dentry, path.mnt))
+		error = -EACCES;
+
 	if (!error) {
 		vfs_dq_init(inode);
 		error = do_truncate(path.dentry, length, 0, NULL);
@@ -511,6 +523,9 @@
 	if (__mnt_is_readonly(path.mnt))
 		res = -EROFS;
 
+	if (!res && !gr_acl_handle_access(path.dentry, path.mnt, mode))
+		res = -EACCES;
+
 out_path_release:
 	path_put(&path);
 out:
@@ -537,6 +552,8 @@
 	if (error)
 		goto dput_and_out;
 
+	gr_log_chdir(path.dentry, path.mnt);
+
 	set_fs_pwd(current->fs, &path);
 
 dput_and_out:
@@ -563,6 +580,13 @@
 		goto out_putf;
 
 	error = inode_permission(inode, MAY_EXEC | MAY_ACCESS);
+
+	if (!error && !gr_chroot_fchdir(file->f_path.dentry, file->f_path.mnt))
+		error = -EPERM;
+
+	if (!error)
+		gr_log_chdir(file->f_path.dentry, file->f_path.mnt);
+
 	if (!error)
 		set_fs_pwd(current->fs, &file->f_path);
 out_putf:
@@ -588,7 +612,18 @@
 	if (!capable(CAP_SYS_CHROOT))
 		goto dput_and_out;
 
+	if (gr_handle_chroot_chroot(path.dentry, path.mnt))
+		goto dput_and_out;
+
+	if (gr_handle_chroot_caps(&path)) {
+		error = -ENOMEM;
+		goto dput_and_out;
+	}
+
 	set_fs_root(current->fs, &path);
+
+	gr_handle_chroot_chdir(&path);
+
 	error = 0;
 dput_and_out:
 	path_put(&path);
@@ -616,12 +651,27 @@
 	err = mnt_want_write_file(file);
 	if (err)
 		goto out_putf;
+
 	mutex_lock(&inode->i_mutex);
+
+	if (!gr_acl_handle_fchmod(dentry, file->f_path.mnt, mode)) {
+		err = -EACCES;
+		goto out_unlock;
+	}
+
 	if (mode == (mode_t) -1)
 		mode = inode->i_mode;
+
+	if (gr_handle_chroot_chmod(dentry, file->f_path.mnt, mode)) {
+		err = -EPERM;
+		goto out_unlock;
+	}
+
 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
 	err = notify_change(dentry, &newattrs);
+
+out_unlock:
 	mutex_unlock(&inode->i_mutex);
 	mnt_drop_write(file->f_path.mnt);
 out_putf:
@@ -640,17 +690,36 @@
 	error = user_path_at(dfd, filename, LOOKUP_FOLLOW, &path);
 	if (error)
 		goto out;
+
+	error = cow_check_and_break(&path);
+	if (error)
+		goto dput_and_out;
 	inode = path.dentry->d_inode;
 
 	error = mnt_want_write(path.mnt);
 	if (error)
 		goto dput_and_out;
+
 	mutex_lock(&inode->i_mutex);
+
+	if (!gr_acl_handle_chmod(path.dentry, path.mnt, mode)) {
+		error = -EACCES;
+		goto out_unlock;
+	}
+
 	if (mode == (mode_t) -1)
 		mode = inode->i_mode;
+
+	if (gr_handle_chroot_chmod(path.dentry, path.mnt, mode)) {
+		error = -EACCES;
+		goto out_unlock;
+	}
+
 	newattrs.ia_mode = (mode & S_IALLUGO) | (inode->i_mode & ~S_IALLUGO);
 	newattrs.ia_valid = ATTR_MODE | ATTR_CTIME;
 	error = notify_change(path.dentry, &newattrs);
+
+out_unlock:
 	mutex_unlock(&inode->i_mutex);
 	mnt_drop_write(path.mnt);
 dput_and_out:
@@ -664,20 +733,23 @@
 	return sys_fchmodat(AT_FDCWD, filename, mode);
 }
 
-static int chown_common(struct dentry * dentry, uid_t user, gid_t group)
+static int chown_common(struct dentry * dentry, uid_t user, gid_t group, struct vfsmount *mnt)
 {
 	struct inode *inode = dentry->d_inode;
 	int error;
 	struct iattr newattrs;
 
+	if (!gr_acl_handle_chown(dentry, mnt))
+		return -EACCES;
+
 	newattrs.ia_valid =  ATTR_CTIME;
 	if (user != (uid_t) -1) {
 		newattrs.ia_valid |= ATTR_UID;
-		newattrs.ia_uid = user;
+		newattrs.ia_uid = dx_map_uid(user);
 	}
 	if (group != (gid_t) -1) {
 		newattrs.ia_valid |= ATTR_GID;
-		newattrs.ia_gid = group;
+		newattrs.ia_gid = dx_map_gid(group);
 	}
 	if (!S_ISDIR(inode->i_mode))
 		newattrs.ia_valid |=
@@ -700,7 +772,11 @@
 	error = mnt_want_write(path.mnt);
 	if (error)
 		goto out_release;
-	error = chown_common(path.dentry, user, group);
+#ifdef CONFIG_VSERVER_COWBL
+	error = cow_check_and_break(&path);
+	if (!error)
+#endif
+	error = chown_common(path.dentry, user, group, path.mnt);
 	mnt_drop_write(path.mnt);
 out_release:
 	path_put(&path);
@@ -725,7 +801,11 @@
 	error = mnt_want_write(path.mnt);
 	if (error)
 		goto out_release;
-	error = chown_common(path.dentry, user, group);
+#ifdef CONFIG_VSERVER_COWBL
+	error = cow_check_and_break(&path);
+	if (!error)
+#endif
+	error = chown_common(path.dentry, user, group, path.mnt);
 	mnt_drop_write(path.mnt);
 out_release:
 	path_put(&path);
@@ -744,7 +824,11 @@
 	error = mnt_want_write(path.mnt);
 	if (error)
 		goto out_release;
-	error = chown_common(path.dentry, user, group);
+#ifdef CONFIG_VSERVER_COWBL
+	error = cow_check_and_break(&path);
+	if (!error)
+#endif
+	error = chown_common(path.dentry, user, group, path.mnt);
 	mnt_drop_write(path.mnt);
 out_release:
 	path_put(&path);
@@ -767,7 +851,7 @@
 		goto out_fput;
 	dentry = file->f_path.dentry;
 	audit_inode(NULL, dentry);
-	error = chown_common(dentry, user, group);
+	error = chown_common(dentry, user, group, file->f_path.mnt);
 	mnt_drop_write(file->f_path.mnt);
 out_fput:
 	fput(file);
@@ -990,6 +1074,7 @@
 	__FD_CLR(fd, fdt->open_fds);
 	if (fd < files->next_fd)
 		files->next_fd = fd;
+	vx_openfd_dec(fd);
 }
 
 void put_unused_fd(unsigned int fd)
@@ -1036,7 +1121,10 @@
 	if (!IS_ERR(tmp)) {
 		fd = get_unused_fd_flags(flags);
 		if (fd >= 0) {
-			struct file *f = do_filp_open(dfd, tmp, flags, mode, 0);
+			struct file *f;
+			/* don't allow to be set by userland */
+			flags &= ~FMODE_GREXEC;
+			f = do_filp_open(dfd, tmp, flags, mode, 0);
 			if (IS_ERR(f)) {
 				put_unused_fd(fd);
 				fd = PTR_ERR(f);
diff -uriN linux-2.6.32.43/fs/partitions/ldm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/partitions/ldm.c
--- linux-2.6.32.43/fs/partitions/ldm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/partitions/ldm.c	2011-07-15 05:51:18.000000000 -0500
@@ -1311,6 +1311,7 @@
 		ldm_error ("A VBLK claims to have %d parts.", num);
 		return false;
 	}
+
 	if (rec >= num) {
 		ldm_error("REC value (%d) exceeds NUM value (%d)", rec, num);
 		return false;
@@ -1322,7 +1323,7 @@
 			goto found;
 	}
 
-	f = kmalloc (sizeof (*f) + size*num, GFP_KERNEL);
+	f = kmalloc (size*num + sizeof (*f), GFP_KERNEL);
 	if (!f) {
 		ldm_crit ("Out of memory.");
 		return false;
diff -uriN linux-2.6.32.43/fs/partitions/mac.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/partitions/mac.c
--- linux-2.6.32.43/fs/partitions/mac.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/partitions/mac.c	2011-07-15 05:51:18.000000000 -0500
@@ -59,11 +59,11 @@
 		return 0;		/* not a MacOS disk */
 	}
 	blocks_in_map = be32_to_cpu(part->map_count);
+	printk(" [mac]");
 	if (blocks_in_map < 0 || blocks_in_map >= DISK_MAX_PARTS) {
 		put_dev_sector(sect);
 		return 0;
 	}
-	printk(" [mac]");
 	for (slot = 1; slot <= blocks_in_map; ++slot) {
 		int pos = slot * secsize;
 		put_dev_sector(sect);
diff -uriN linux-2.6.32.43/fs/pipe.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/pipe.c
--- linux-2.6.32.43/fs/pipe.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/pipe.c	2011-07-15 05:51:18.000000000 -0500
@@ -401,9 +401,9 @@
 		}
 		if (bufs)	/* More to do? */
 			continue;
-		if (!pipe->writers)
+		if (!atomic_read(&pipe->writers))
 			break;
-		if (!pipe->waiting_writers) {
+		if (!atomic_read(&pipe->waiting_writers)) {
 			/* syscall merging: Usually we must not sleep
 			 * if O_NONBLOCK is set, or if we got some data.
 			 * But if a writer sleeps in kernel space, then
@@ -462,7 +462,7 @@
 	mutex_lock(&inode->i_mutex);
 	pipe = inode->i_pipe;
 
-	if (!pipe->readers) {
+	if (!atomic_read(&pipe->readers)) {
 		send_sig(SIGPIPE, current, 0);
 		ret = -EPIPE;
 		goto out;
@@ -511,7 +511,7 @@
 	for (;;) {
 		int bufs;
 
-		if (!pipe->readers) {
+		if (!atomic_read(&pipe->readers)) {
 			send_sig(SIGPIPE, current, 0);
 			if (!ret)
 				ret = -EPIPE;
@@ -597,9 +597,9 @@
 			kill_fasync(&pipe->fasync_readers, SIGIO, POLL_IN);
 			do_wakeup = 0;
 		}
-		pipe->waiting_writers++;
+		atomic_inc(&pipe->waiting_writers);
 		pipe_wait(pipe);
-		pipe->waiting_writers--;
+		atomic_dec(&pipe->waiting_writers);
 	}
 out:
 	mutex_unlock(&inode->i_mutex);
@@ -666,7 +666,7 @@
 	mask = 0;
 	if (filp->f_mode & FMODE_READ) {
 		mask = (nrbufs > 0) ? POLLIN | POLLRDNORM : 0;
-		if (!pipe->writers && filp->f_version != pipe->w_counter)
+		if (!atomic_read(&pipe->writers) && filp->f_version != pipe->w_counter)
 			mask |= POLLHUP;
 	}
 
@@ -676,7 +676,7 @@
 		 * Most Unices do not set POLLERR for FIFOs but on Linux they
 		 * behave exactly like pipes for poll().
 		 */
-		if (!pipe->readers)
+		if (!atomic_read(&pipe->readers))
 			mask |= POLLERR;
 	}
 
@@ -690,10 +690,10 @@
 
 	mutex_lock(&inode->i_mutex);
 	pipe = inode->i_pipe;
-	pipe->readers -= decr;
-	pipe->writers -= decw;
+	atomic_sub(decr, &pipe->readers);
+	atomic_sub(decw, &pipe->writers);
 
-	if (!pipe->readers && !pipe->writers) {
+	if (!atomic_read(&pipe->readers) && !atomic_read(&pipe->writers)) {
 		free_pipe_info(inode);
 	} else {
 		wake_up_interruptible_sync(&pipe->wait);
@@ -783,7 +783,7 @@
 
 	if (inode->i_pipe) {
 		ret = 0;
-		inode->i_pipe->readers++;
+		atomic_inc(&inode->i_pipe->readers);
 	}
 
 	mutex_unlock(&inode->i_mutex);
@@ -800,7 +800,7 @@
 
 	if (inode->i_pipe) {
 		ret = 0;
-		inode->i_pipe->writers++;
+		atomic_inc(&inode->i_pipe->writers);
 	}
 
 	mutex_unlock(&inode->i_mutex);
@@ -818,9 +818,9 @@
 	if (inode->i_pipe) {
 		ret = 0;
 		if (filp->f_mode & FMODE_READ)
-			inode->i_pipe->readers++;
+			atomic_inc(&inode->i_pipe->readers);
 		if (filp->f_mode & FMODE_WRITE)
-			inode->i_pipe->writers++;
+			atomic_inc(&inode->i_pipe->writers);
 	}
 
 	mutex_unlock(&inode->i_mutex);
@@ -905,7 +905,7 @@
 	inode->i_pipe = NULL;
 }
 
-static struct vfsmount *pipe_mnt __read_mostly;
+struct vfsmount *pipe_mnt __read_mostly;
 static int pipefs_delete_dentry(struct dentry *dentry)
 {
 	/*
@@ -945,7 +945,8 @@
 		goto fail_iput;
 	inode->i_pipe = pipe;
 
-	pipe->readers = pipe->writers = 1;
+	atomic_set(&pipe->readers, 1);
+	atomic_set(&pipe->writers, 1);
 	inode->i_fop = &rdwr_pipefifo_fops;
 
 	/*
diff -uriN linux-2.6.32.43/fs/proc/array.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/array.c
--- linux-2.6.32.43/fs/proc/array.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/array.c	2011-07-15 05:51:18.000000000 -0500
@@ -60,6 +60,7 @@
 #include <linux/tty.h>
 #include <linux/string.h>
 #include <linux/mman.h>
+#include <linux/grsecurity.h>
 #include <linux/proc_fs.h>
 #include <linux/ioport.h>
 #include <linux/uaccess.h>
@@ -82,6 +83,8 @@
 #include <linux/pid_namespace.h>
 #include <linux/ptrace.h>
 #include <linux/tracehook.h>
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
 
 #include <asm/pgtable.h>
 #include <asm/processor.h>
@@ -166,6 +169,9 @@
 	rcu_read_lock();
 	ppid = pid_alive(p) ?
 		task_tgid_nr_ns(rcu_dereference(p->real_parent), ns) : 0;
+	if (unlikely(vx_current_initpid(p->pid)))
+		ppid = 0;
+
 	tpid = 0;
 	if (pid_alive(p)) {
 		struct task_struct *tracer = tracehook_tracer_task(p);
@@ -281,7 +287,7 @@
 }
 
 static void render_cap_t(struct seq_file *m, const char *header,
-			kernel_cap_t *a)
+			struct vx_info *vxi, kernel_cap_t *a)
 {
 	unsigned __capi;
 
@@ -306,10 +312,11 @@
 	cap_bset	= cred->cap_bset;
 	rcu_read_unlock();
 
-	render_cap_t(m, "CapInh:\t", &cap_inheritable);
-	render_cap_t(m, "CapPrm:\t", &cap_permitted);
-	render_cap_t(m, "CapEff:\t", &cap_effective);
-	render_cap_t(m, "CapBnd:\t", &cap_bset);
+	/* FIXME: maybe move the p->vx_info masking to __task_cred() ? */
+	render_cap_t(m, "CapInh:\t", p->vx_info, &cap_inheritable);
+	render_cap_t(m, "CapPrm:\t", p->vx_info, &cap_permitted);
+	render_cap_t(m, "CapEff:\t", p->vx_info, &cap_effective);
+	render_cap_t(m, "CapBnd:\t", p->vx_info, &cap_bset);
 }
 
 static inline void task_context_switch_counts(struct seq_file *m,
@@ -321,6 +328,58 @@
 			p->nivcsw);
 }
 
+
+int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
+			struct pid *pid, struct task_struct *task)
+{
+	seq_printf(m,	"Proxy:\t%p(%c)\n"
+			"Count:\t%u\n"
+			"uts:\t%p(%c)\n"
+			"ipc:\t%p(%c)\n"
+			"mnt:\t%p(%c)\n"
+			"pid:\t%p(%c)\n"
+			"net:\t%p(%c)\n",
+			task->nsproxy,
+			(task->nsproxy == init_task.nsproxy ? 'I' : '-'),
+			atomic_read(&task->nsproxy->count),
+			task->nsproxy->uts_ns,
+			(task->nsproxy->uts_ns == init_task.nsproxy->uts_ns ? 'I' : '-'),
+			task->nsproxy->ipc_ns,
+			(task->nsproxy->ipc_ns == init_task.nsproxy->ipc_ns ? 'I' : '-'),
+			task->nsproxy->mnt_ns,
+			(task->nsproxy->mnt_ns == init_task.nsproxy->mnt_ns ? 'I' : '-'),
+			task->nsproxy->pid_ns,
+			(task->nsproxy->pid_ns == init_task.nsproxy->pid_ns ? 'I' : '-'),
+			task->nsproxy->net_ns,
+			(task->nsproxy->net_ns == init_task.nsproxy->net_ns ? 'I' : '-'));
+	return 0;
+}
+
+void task_vs_id(struct seq_file *m, struct task_struct *task)
+{
+	if (task_vx_flags(task, VXF_HIDE_VINFO, 0))
+		return;
+
+	seq_printf(m, "VxID: %d\n", vx_task_xid(task));
+	seq_printf(m, "NxID: %d\n", nx_task_nid(task));
+}
+
+
+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
+static inline void task_pax(struct seq_file *m, struct task_struct *p)
+{
+	if (p->mm)
+		seq_printf(m, "PaX:\t%c%c%c%c%c\n",
+			   p->mm->pax_flags & MF_PAX_PAGEEXEC ? 'P' : 'p',
+			   p->mm->pax_flags & MF_PAX_EMUTRAMP ? 'E' : 'e',
+			   p->mm->pax_flags & MF_PAX_MPROTECT ? 'M' : 'm',
+			   p->mm->pax_flags & MF_PAX_RANDMMAP ? 'R' : 'r',
+			   p->mm->pax_flags & MF_PAX_SEGMEXEC ? 'S' : 's');
+	else
+		seq_printf(m, "PaX:\t-----\n");
+}
+#endif
+
 int proc_pid_status(struct seq_file *m, struct pid_namespace *ns,
 			struct pid *pid, struct task_struct *task)
 {
@@ -336,10 +395,26 @@
 	task_sig(m, task);
 	task_cap(m, task);
 	cpuset_task_status_allowed(m, task);
+	task_vs_id(m, task);
 	task_context_switch_counts(m, task);
+
+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
+	task_pax(m, task);
+#endif
+
+#if defined(CONFIG_GRKERNSEC) && !defined(CONFIG_GRKERNSEC_NO_RBAC)
+	task_grsec_rbac(m, task);
+#endif
+
 	return 0;
 }
 
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
+#endif
+
 static int do_task_stat(struct seq_file *m, struct pid_namespace *ns,
 			struct pid *pid, struct task_struct *task, int whole)
 {
@@ -358,9 +433,11 @@
 	cputime_t cutime, cstime, utime, stime;
 	cputime_t cgtime, gtime;
 	unsigned long rsslim = 0;
-	char tcomm[sizeof(task->comm)];
+	char tcomm[sizeof(task->comm)] = { 0 };
 	unsigned long flags;
 
+	pax_track_stack();
+
 	state = *get_task_state(task);
 	vsize = eip = esp = 0;
 	permitted = ptrace_may_access(task, PTRACE_MODE_READ);
@@ -433,6 +510,19 @@
 		gtime = task_gtime(task);
 	}
 
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+	if (PAX_RAND_FLAGS(mm)) {
+		eip = 0;
+		esp = 0;
+		wchan = 0;
+	}
+#endif
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	wchan = 0;
+	eip =0;
+	esp =0;
+#endif
+
 	/* scale priority and nice values from timeslices to -20..20 */
 	/* to make it look like a "normal" Unix priority/nice value  */
 	priority = task_prio(task);
@@ -446,6 +536,17 @@
 	/* convert nsec -> ticks */
 	start_time = nsec_to_clock_t(start_time);
 
+	/* fixup start time for virt uptime */
+	if (vx_flags(VXF_VIRT_UPTIME, 0)) {
+		unsigned long long bias =
+			current->vx_info->cvirt.bias_clock;
+
+		if (start_time > bias)
+			start_time -= bias;
+		else
+			start_time = 0;
+	}
+
 	seq_printf(m, "%d (%s) %c %d %d %d %d %d %u %lu \
 %lu %lu %lu %lu %lu %ld %ld %ld %ld %d 0 %llu %lu %ld %lu %lu %lu %lu %lu \
 %lu %lu %lu %lu %lu %lu %lu %lu %d %d %u %u %llu %lu %ld\n",
@@ -473,9 +574,15 @@
 		vsize,
 		mm ? get_mm_rss(mm) : 0,
 		rsslim,
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+		PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->start_code : 1) : 0),
+		PAX_RAND_FLAGS(mm) ? 1 : (mm ? (permitted ? mm->end_code : 1) : 0),
+		PAX_RAND_FLAGS(mm) ? 0 : ((permitted && mm) ? mm->start_stack : 0),
+#else
 		mm ? (permitted ? mm->start_code : 1) : 0,
 		mm ? (permitted ? mm->end_code : 1) : 0,
 		(permitted && mm) ? mm->start_stack : 0,
+#endif
 		esp,
 		eip,
 		/* The signal information here is obsolete.
@@ -528,3 +635,18 @@
 
 	return 0;
 }
+
+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
+int proc_pid_ipaddr(struct task_struct *task, char *buffer)
+{
+	u32 curr_ip = 0;
+	unsigned long flags;
+
+	if (lock_task_sighand(task, &flags)) {
+		curr_ip = task->signal->curr_ip;
+		unlock_task_sighand(task, &flags);
+	}
+
+	return sprintf(buffer, "%pI4\n", &curr_ip);
+}
+#endif
diff -uriN linux-2.6.32.43/fs/proc/base.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/base.c
--- linux-2.6.32.43/fs/proc/base.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/base.c	2011-07-15 12:28:36.000000000 -0500
@@ -81,6 +81,8 @@
 #include <linux/elf.h>
 #include <linux/pid_namespace.h>
 #include <linux/fs_struct.h>
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
 #include "internal.h"
 
 /* NOTE:
@@ -102,6 +104,22 @@
 	union proc_op op;
 };
 
+struct getdents_callback {
+	struct linux_dirent __user * current_dir;
+	struct linux_dirent __user * previous;
+	struct file * file;
+	int count;
+	int error;
+};
+
+static int gr_fake_filldir(void * __buf, const char *name, int namlen, 
+			   loff_t offset, u64 ino, unsigned int d_type)
+{
+	struct getdents_callback * buf = (struct getdents_callback *) __buf;
+	buf->error = -EINVAL;
+	return 0;
+}
+
 #define NOD(NAME, MODE, IOP, FOP, OP) {			\
 	.name = (NAME),					\
 	.len  = sizeof(NAME) - 1,			\
@@ -213,6 +231,9 @@
 	if (task == current)
 		return 0;
 
+	if (gr_handle_proc_ptrace(task) || gr_acl_handle_procpidmem(task))
+		return -EPERM;
+
 	/*
 	 * If current is actively ptrace'ing, and would also be
 	 * permitted to freshly attach with ptrace now, permit it.
@@ -260,6 +281,9 @@
 	if (!mm->arg_end)
 		goto out_mm;	/* Shh! No looking before we're done */
 
+	if (gr_acl_handle_procpidmem(task))
+		goto out_mm;
+
  	len = mm->arg_end - mm->arg_start;
  
 	if (len > PAGE_SIZE)
@@ -287,12 +311,28 @@
 	return res;
 }
 
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
+#endif
+
 static int proc_pid_auxv(struct task_struct *task, char *buffer)
 {
 	int res = 0;
 	struct mm_struct *mm = get_task_mm(task);
 	if (mm) {
 		unsigned int nwords = 0;
+
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+		/* allow if we're currently ptracing this task */
+		if (PAX_RAND_FLAGS(mm) &&
+		    (!(task->ptrace & PT_PTRACED) || (task->parent != current))) {
+			mmput(mm);
+			return res;
+		}
+#endif
+
 		do {
 			nwords += 2;
 		} while (mm->saved_auxv[nwords - 2] != 0); /* AT_NULL */
@@ -306,7 +346,7 @@
 }
 
 
-#ifdef CONFIG_KALLSYMS
+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
 /*
  * Provides a wchan file via kallsyms in a proper one-value-per-file format.
  * Returns the resolved symbol.  If that fails, simply return the address.
@@ -328,7 +368,7 @@
 }
 #endif /* CONFIG_KALLSYMS */
 
-#ifdef CONFIG_STACKTRACE
+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
 
 #define MAX_STACK_TRACE_DEPTH	64
 
@@ -522,7 +562,7 @@
 	return count;
 }
 
-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
 static int proc_pid_syscall(struct task_struct *task, char *buffer)
 {
 	long nr;
@@ -547,7 +587,7 @@
 /************************************************************************/
 
 /* permission checks */
-static int proc_fd_access_allowed(struct inode *inode)
+static int proc_fd_access_allowed(struct inode *inode, unsigned int log)
 {
 	struct task_struct *task;
 	int allowed = 0;
@@ -557,7 +597,10 @@
 	 */
 	task = get_proc_task(inode);
 	if (task) {
-		allowed = ptrace_may_access(task, PTRACE_MODE_READ);
+		if (log)
+			allowed = ptrace_may_access_log(task, PTRACE_MODE_READ);
+		else
+			allowed = ptrace_may_access(task, PTRACE_MODE_READ);
 		put_task_struct(task);
 	}
 	return allowed;
@@ -936,6 +979,9 @@
 	if (!task)
 		goto out_no_task;
 
+	if (gr_acl_handle_procpidmem(task))
+		goto out;
+
 	if (!ptrace_may_access(task, PTRACE_MODE_READ))
 		goto out;
 
@@ -1048,12 +1094,17 @@
 		return -ESRCH;
 	}
 
-	if (oom_adjust < task->signal->oom_adj && !capable(CAP_SYS_RESOURCE)) {
+	if (oom_adjust < task->signal->oom_adj &&
+		!vx_capable(CAP_SYS_RESOURCE, VXC_OOM_ADJUST)) {
 		unlock_task_sighand(task, &flags);
 		put_task_struct(task);
 		return -EACCES;
 	}
 
+	/* prevent guest processes from circumventing the oom killer */
+	if (vx_current_xid() && (oom_adjust == OOM_DISABLE))
+		oom_adjust = OOM_ADJUST_MIN;
+
 	task->signal->oom_adj = oom_adjust;
 
 	unlock_task_sighand(task, &flags);
@@ -1093,7 +1144,7 @@
 	ssize_t length;
 	uid_t loginuid;
 
-	if (!capable(CAP_AUDIT_CONTROL))
+	if (!vx_capable(CAP_AUDIT_CONTROL, VXC_AUDIT_CONTROL))
 		return -EPERM;
 
 	if (current != pid_task(proc_pid(inode), PIDTYPE_PID))
@@ -1350,7 +1401,7 @@
 	path_put(&nd->path);
 
 	/* Are we allowed to snoop on the tasks file descriptors? */
-	if (!proc_fd_access_allowed(inode))
+	if (!proc_fd_access_allowed(inode,0))
 		goto out;
 
 	error = PROC_I(inode)->op.proc_get_link(inode, &nd->path);
@@ -1390,8 +1441,18 @@
 	struct path path;
 
 	/* Are we allowed to snoop on the tasks file descriptors? */
-	if (!proc_fd_access_allowed(inode))
-		goto out;
+	/* logging this is needed for learning on chromium to work properly,
+	   but we don't want to flood the logs from 'ps' which does a readlink
+	   on /proc/fd/2 of tasks in the listing, nor do we want 'ps' to learn
+	   CAP_SYS_PTRACE as it's not necessary for its basic functionality
+	 */
+	if (dentry->d_name.name[0] == '2' && dentry->d_name.name[1] == '\0') {
+		if (!proc_fd_access_allowed(inode,0))
+			goto out;
+	} else {
+		if (!proc_fd_access_allowed(inode,1))
+			goto out;
+	}
 
 	error = PROC_I(inode)->op.proc_get_link(inode, &path);
 	if (error)
@@ -1456,9 +1517,15 @@
 		rcu_read_lock();
 		cred = __task_cred(task);
 		inode->i_uid = cred->euid;
+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
+		inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
+#else
 		inode->i_gid = cred->egid;
+#endif
 		rcu_read_unlock();
 	}
+	/* procfs is xid tagged */
+	inode->i_tag = (tag_t)vx_task_xid(task);
 	security_task_to_inode(task, inode);
 
 out:
@@ -1474,6 +1541,9 @@
 	struct inode *inode = dentry->d_inode;
 	struct task_struct *task;
 	const struct cred *cred;
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	const struct cred *tmpcred = current_cred();
+#endif
 
 	generic_fillattr(inode, stat);
 
@@ -1481,13 +1551,41 @@
 	stat->uid = 0;
 	stat->gid = 0;
 	task = pid_task(proc_pid(inode), PIDTYPE_PID);
+
+	if (task && (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))) {
+		rcu_read_unlock();
+		return -ENOENT;
+	}
+
 	if (task) {
+		cred = __task_cred(task);
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+		if (!tmpcred->uid || (tmpcred->uid == cred->uid)
+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
+		    || in_group_p(CONFIG_GRKERNSEC_PROC_GID)
+#endif
+		) {
+#endif
 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
+#endif
 		    task_dumpable(task)) {
-			cred = __task_cred(task);
 			stat->uid = cred->euid;
+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
+			stat->gid = CONFIG_GRKERNSEC_PROC_GID;
+#else
 			stat->gid = cred->egid;
+#endif
 		}
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+		} else {
+			rcu_read_unlock();
+			return -ENOENT;
+		}
+#endif
 	}
 	rcu_read_unlock();
 	return 0;
@@ -1518,11 +1616,20 @@
 
 	if (task) {
 		if ((inode->i_mode == (S_IFDIR|S_IRUGO|S_IXUGO)) ||
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IXUSR)) ||
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+		    (inode->i_mode == (S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP)) ||
+#endif
 		    task_dumpable(task)) {
 			rcu_read_lock();
 			cred = __task_cred(task);
 			inode->i_uid = cred->euid;
+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
+			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
+#else
 			inode->i_gid = cred->egid;
+#endif
 			rcu_read_unlock();
 		} else {
 			inode->i_uid = 0;
@@ -1643,7 +1750,8 @@
 	int fd = proc_fd(inode);
 
 	if (task) {
-		files = get_files_struct(task);
+		if (!gr_acl_handle_procpidmem(task))
+			files = get_files_struct(task);
 		put_task_struct(task);
 	}
 	if (files) {
@@ -1895,12 +2003,22 @@
 static int proc_fd_permission(struct inode *inode, int mask)
 {
 	int rv;
+	struct task_struct *task;
 
 	rv = generic_permission(inode, mask, NULL);
-	if (rv == 0)
-		return 0;
+
 	if (task_pid(current) == proc_pid(inode))
 		rv = 0;
+
+	task = get_proc_task(inode);
+	if (task == NULL)
+		return rv;
+
+	if (gr_acl_handle_procpidmem(task))
+		rv = -EACCES;
+
+	put_task_struct(task);
+
 	return rv;
 }
 
@@ -2009,6 +2127,16 @@
 	if (!task)
 		goto out_no_task;
 
+	/* TODO: maybe we can come up with a generic approach? */
+	if (task_vx_flags(task, VXF_HIDE_VINFO, 0) &&
+		(dentry->d_name.len == 5) &&
+		(!memcmp(dentry->d_name.name, "vinfo", 5) ||
+		!memcmp(dentry->d_name.name, "ninfo", 5)))
+		goto out;
+
+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
+		goto out;
+
 	/*
 	 * Yes, it does not scale. And it should not. Don't add
 	 * new entries into /proc/<tgid>/ without very good reasons.
@@ -2053,6 +2181,9 @@
 	if (!task)
 		goto out_no_task;
 
+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
+		goto out;
+
 	ret = 0;
 	i = filp->f_pos;
 	switch (i) {
@@ -2320,7 +2451,7 @@
 static void proc_self_put_link(struct dentry *dentry, struct nameidata *nd,
 				void *cookie)
 {
-	char *s = nd_get_link(nd);
+	const char *s = nd_get_link(nd);
 	if (!IS_ERR(s))
 		__putname(s);
 }
@@ -2414,7 +2545,7 @@
 static struct dentry *proc_base_lookup(struct inode *dir, struct dentry *dentry)
 {
 	struct dentry *error;
-	struct task_struct *task = get_proc_task(dir);
+	struct task_struct *task = get_proc_task_real(dir);
 	const struct pid_entry *p, *last;
 
 	error = ERR_PTR(-ENOENT);
@@ -2504,6 +2635,9 @@
 static const struct file_operations proc_task_operations;
 static const struct inode_operations proc_task_inode_operations;
 
+extern int proc_pid_vx_info(struct task_struct *, char *);
+extern int proc_pid_nx_info(struct task_struct *, char *);
+
 static const struct pid_entry tgid_base_stuff[] = {
 	DIR("task",       S_IRUGO|S_IXUGO, proc_task_inode_operations, proc_task_operations),
 	DIR("fd",         S_IRUSR|S_IXUSR, proc_fd_inode_operations, proc_fd_operations),
@@ -2519,7 +2653,7 @@
 #ifdef CONFIG_SCHED_DEBUG
 	REG("sched",      S_IRUGO|S_IWUSR, proc_pid_sched_operations),
 #endif
-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
 	INF("syscall",    S_IRUSR, proc_pid_syscall),
 #endif
 	INF("cmdline",    S_IRUGO, proc_pid_cmdline),
@@ -2544,10 +2678,10 @@
 #ifdef CONFIG_SECURITY
 	DIR("attr",       S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
 #endif
-#ifdef CONFIG_KALLSYMS
+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
 	INF("wchan",      S_IRUGO, proc_pid_wchan),
 #endif
-#ifdef CONFIG_STACKTRACE
+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
 	ONE("stack",      S_IRUSR, proc_pid_stack),
 #endif
 #ifdef CONFIG_SCHEDSTATS
@@ -2562,6 +2696,8 @@
 #ifdef CONFIG_CGROUPS
 	REG("cgroup",  S_IRUGO, proc_cgroup_operations),
 #endif
+	INF("vinfo",      S_IRUGO, proc_pid_vx_info),
+	INF("ninfo",	  S_IRUGO, proc_pid_nx_info),
 	INF("oom_score",  S_IRUGO, proc_oom_score),
 	REG("oom_adj",    S_IRUGO|S_IWUSR, proc_oom_adjust_operations),
 #ifdef CONFIG_AUDITSYSCALL
@@ -2577,6 +2713,7 @@
 #ifdef CONFIG_TASK_IO_ACCOUNTING
 	INF("io",	S_IRUGO, proc_tgid_io_accounting),
 #endif
+	ONE("nsproxy",	S_IRUGO, proc_pid_nsproxy),
 };
 
 static int proc_tgid_base_readdir(struct file * filp,
@@ -2701,7 +2838,14 @@
 	if (!inode)
 		goto out;
 
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+	inode->i_mode = S_IFDIR|S_IRUSR|S_IXUSR;
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
+	inode->i_mode = S_IFDIR|S_IRUSR|S_IRGRP|S_IXUSR|S_IXGRP;
+#else
 	inode->i_mode = S_IFDIR|S_IRUGO|S_IXUGO;
+#endif
 	inode->i_op = &proc_tgid_base_inode_operations;
 	inode->i_fop = &proc_tgid_base_operations;
 	inode->i_flags|=S_IMMUTABLE;
@@ -2743,7 +2887,11 @@
 	if (!task)
 		goto out;
 
+	if (gr_pid_is_chrooted(task) || gr_check_hidden_task(task))
+		goto out_put_task;
+
 	result = proc_pid_instantiate(dir, dentry, task, NULL);
+out_put_task:
 	put_task_struct(task);
 out:
 	return result;
@@ -2768,7 +2916,7 @@
 	iter.task = NULL;
 	pid = find_ge_pid(iter.tgid, ns);
 	if (pid) {
-		iter.tgid = pid_nr_ns(pid, ns);
+		iter.tgid = pid_unmapped_nr_ns(pid, ns);
 		iter.task = pid_task(pid, PIDTYPE_PID);
 		/* What we to know is if the pid we have find is the
 		 * pid of a thread_group_leader.  Testing for task
@@ -2798,7 +2946,7 @@
 	struct tgid_iter iter)
 {
 	char name[PROC_NUMBUF];
-	int len = snprintf(name, sizeof(name), "%d", iter.tgid);
+	int len = snprintf(name, sizeof(name), "%d", vx_map_tgid(iter.tgid));
 	return proc_fill_cache(filp, dirent, filldir, name, len,
 				proc_pid_instantiate, iter.task, NULL);
 }
@@ -2808,6 +2956,11 @@
 {
 	unsigned int nr;
 	struct task_struct *reaper;
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	const struct cred *tmpcred = current_cred();
+	const struct cred *itercred;
+#endif
+	filldir_t __filldir = filldir;
 	struct tgid_iter iter;
 	struct pid_namespace *ns;
 
@@ -2815,7 +2968,7 @@
 		goto out_no_task;
 	nr = filp->f_pos - FIRST_PROCESS_ENTRY;
 
-	reaper = get_proc_task(filp->f_path.dentry->d_inode);
+	reaper = get_proc_task_real(filp->f_path.dentry->d_inode);
 	if (!reaper)
 		goto out_no_task;
 
@@ -2831,8 +2984,29 @@
 	for (iter = next_tgid(ns, iter);
 	     iter.task;
 	     iter.tgid += 1, iter = next_tgid(ns, iter)) {
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+		rcu_read_lock();
+		itercred = __task_cred(iter.task);
+#endif
+		if (gr_pid_is_chrooted(iter.task) || gr_check_hidden_task(iter.task)
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+		    || (tmpcred->uid && (itercred->uid != tmpcred->uid)
+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
+			&& !in_group_p(CONFIG_GRKERNSEC_PROC_GID)
+#endif
+			)
+#endif
+		)
+			__filldir = &gr_fake_filldir;
+		else
+			__filldir = filldir;
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	rcu_read_unlock();
+#endif
 		filp->f_pos = iter.tgid + TGID_OFFSET;
-		if (proc_pid_fill_cache(filp, dirent, filldir, iter) < 0) {
+		if (!vx_proc_task_visible(iter.task))
+			continue;
+		if (proc_pid_fill_cache(filp, dirent, __filldir, iter) < 0) {
 			put_task_struct(iter.task);
 			goto out;
 		}
@@ -2858,7 +3032,7 @@
 #ifdef CONFIG_SCHED_DEBUG
 	REG("sched",     S_IRUGO|S_IWUSR, proc_pid_sched_operations),
 #endif
-#ifdef CONFIG_HAVE_ARCH_TRACEHOOK
+#if defined(CONFIG_HAVE_ARCH_TRACEHOOK) && !defined(CONFIG_GRKERNSEC_PROC_MEMMAP)
 	INF("syscall",   S_IRUSR, proc_pid_syscall),
 #endif
 	INF("cmdline",   S_IRUGO, proc_pid_cmdline),
@@ -2882,10 +3056,10 @@
 #ifdef CONFIG_SECURITY
 	DIR("attr",      S_IRUGO|S_IXUGO, proc_attr_dir_inode_operations, proc_attr_dir_operations),
 #endif
-#ifdef CONFIG_KALLSYMS
+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
 	INF("wchan",     S_IRUGO, proc_pid_wchan),
 #endif
-#ifdef CONFIG_STACKTRACE
+#if defined(CONFIG_STACKTRACE) && !defined(CONFIG_GRKERNSEC_HIDESYM)
 	ONE("stack",      S_IRUSR, proc_pid_stack),
 #endif
 #ifdef CONFIG_SCHEDSTATS
@@ -2912,6 +3086,9 @@
 #ifdef CONFIG_TASK_IO_ACCOUNTING
 	INF("io",	S_IRUGO, proc_tid_io_accounting),
 #endif
+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
+	INF("ipaddr",	  S_IRUSR, proc_pid_ipaddr),
+#endif
 };
 
 static int proc_tid_base_readdir(struct file * filp,
@@ -2978,6 +3155,8 @@
 	tid = name_to_int(dentry);
 	if (tid == ~0U)
 		goto out;
+	if (vx_current_initpid(tid))
+		goto out;
 
 	ns = dentry->d_sb->s_fs_info;
 	rcu_read_lock();
diff -uriN linux-2.6.32.43/fs/proc/cmdline.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/cmdline.c
--- linux-2.6.32.43/fs/proc/cmdline.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/cmdline.c	2011-07-15 05:51:18.000000000 -0500
@@ -23,7 +23,11 @@
 
 static int __init proc_cmdline_init(void)
 {
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+	proc_create_grsec("cmdline", 0, NULL, &cmdline_proc_fops);
+#else
 	proc_create("cmdline", 0, NULL, &cmdline_proc_fops);
+#endif
 	return 0;
 }
 module_init(proc_cmdline_init);
diff -uriN linux-2.6.32.43/fs/proc/devices.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/devices.c
--- linux-2.6.32.43/fs/proc/devices.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/devices.c	2011-07-15 05:51:18.000000000 -0500
@@ -64,7 +64,11 @@
 
 static int __init proc_devices_init(void)
 {
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+	proc_create_grsec("devices", 0, NULL, &proc_devinfo_operations);
+#else
 	proc_create("devices", 0, NULL, &proc_devinfo_operations);
+#endif
 	return 0;
 }
 module_init(proc_devices_init);
diff -uriN linux-2.6.32.43/fs/proc/generic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/generic.c
--- linux-2.6.32.43/fs/proc/generic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/generic.c	2011-07-15 05:50:11.000000000 -0500
@@ -20,6 +20,7 @@
 #include <linux/bitops.h>
 #include <linux/spinlock.h>
 #include <linux/completion.h>
+#include <linux/vserver/inode.h>
 #include <asm/uaccess.h>
 
 #include "internal.h"
@@ -425,6 +426,8 @@
 	for (de = de->subdir; de ; de = de->next) {
 		if (de->namelen != dentry->d_name.len)
 			continue;
+			if (!vx_hide_check(0, de->vx_flags))
+				continue;
 		if (!memcmp(dentry->d_name.name, de->name, de->namelen)) {
 			unsigned int ino;
 
@@ -433,6 +436,8 @@
 			spin_unlock(&proc_subdir_lock);
 			error = -EINVAL;
 			inode = proc_get_inode(dir->i_sb, ino, de);
+				/* generic proc entries belong to the host */
+				inode->i_tag = 0;
 			goto out_unlock;
 		}
 	}
@@ -510,6 +515,8 @@
 
 				/* filldir passes info to user space */
 				de_get(de);
+				if (!vx_hide_check(0, de->vx_flags))
+					goto skip;
 				spin_unlock(&proc_subdir_lock);
 				if (filldir(dirent, de->name, de->namelen, filp->f_pos,
 					    de->low_ino, de->mode >> 12) < 0) {
@@ -517,6 +524,7 @@
 					goto out;
 				}
 				spin_lock(&proc_subdir_lock);
+			skip:
 				filp->f_pos++;
 				next = de->next;
 				de_put(de);
@@ -631,6 +639,7 @@
 	ent->nlink = nlink;
 	atomic_set(&ent->count, 1);
 	ent->pde_users = 0;
+	ent->vx_flags = IATTR_PROC_DEFAULT;
 	spin_lock_init(&ent->pde_unload_lock);
 	ent->pde_unload_completion = NULL;
 	INIT_LIST_HEAD(&ent->pde_openers);
@@ -654,7 +663,8 @@
 				kfree(ent->data);
 				kfree(ent);
 				ent = NULL;
-			}
+			} else
+				ent->vx_flags = IATTR_PROC_SYMLINK;
 		} else {
 			kfree(ent);
 			ent = NULL;
diff -uriN linux-2.6.32.43/fs/proc/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/inode.c
--- linux-2.6.32.43/fs/proc/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -457,8 +457,14 @@
 		if (de->mode) {
 			inode->i_mode = de->mode;
 			inode->i_uid = de->uid;
+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
+			inode->i_gid = CONFIG_GRKERNSEC_PROC_GID;
+#else
 			inode->i_gid = de->gid;
+#endif
 		}
+		if (de->vx_flags)
+			PROC_I(inode)->vx_flags = de->vx_flags;
 		if (de->size)
 			inode->i_size = de->size;
 		if (de->nlink)
diff -uriN linux-2.6.32.43/fs/proc/internal.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/internal.h
--- linux-2.6.32.43/fs/proc/internal.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/internal.h	2011-07-15 05:54:25.000000000 -0500
@@ -10,6 +10,7 @@
  */
 
 #include <linux/proc_fs.h>
+#include <linux/vs_pid.h>
 
 extern struct proc_dir_entry proc_root;
 #ifdef CONFIG_PROC_SYSCTL
@@ -51,6 +52,12 @@
 				struct pid *pid, struct task_struct *task);
 extern int proc_pid_statm(struct seq_file *m, struct pid_namespace *ns,
 				struct pid *pid, struct task_struct *task);
+extern int proc_pid_nsproxy(struct seq_file *m, struct pid_namespace *ns,
+				struct pid *pid, struct task_struct *task);
+#ifdef CONFIG_GRKERNSEC_PROC_IPADDR
+extern int proc_pid_ipaddr(struct task_struct *task, char *buffer);
+#endif
+
 extern loff_t mem_lseek(struct file *file, loff_t offset, int orig);
 
 extern const struct file_operations proc_maps_operations;
@@ -70,11 +77,16 @@
 	return PROC_I(inode)->pid;
 }
 
-static inline struct task_struct *get_proc_task(struct inode *inode)
+static inline struct task_struct *get_proc_task_real(struct inode *inode)
 {
 	return get_pid_task(proc_pid(inode), PIDTYPE_PID);
 }
 
+static inline struct task_struct *get_proc_task(struct inode *inode)
+{
+	return vx_get_proc_task(inode, proc_pid(inode));
+}
+
 static inline int proc_fd(struct inode *inode)
 {
 	return PROC_I(inode)->fd;
diff -uriN linux-2.6.32.43/fs/proc/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/Kconfig
--- linux-2.6.32.43/fs/proc/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/Kconfig	2011-07-15 05:51:18.000000000 -0500
@@ -30,12 +30,12 @@
 
 config PROC_KCORE
 	bool "/proc/kcore support" if !ARM
-	depends on PROC_FS && MMU
+	depends on PROC_FS && MMU && !GRKERNSEC_PROC_ADD
 
 config PROC_VMCORE
         bool "/proc/vmcore support (EXPERIMENTAL)"
-        depends on PROC_FS && CRASH_DUMP
-	default y
+        depends on PROC_FS && CRASH_DUMP && !GRKERNSEC
+	default n
         help
         Exports the dump image of crashed kernel in ELF format.
 
@@ -59,8 +59,8 @@
 	  limited in memory.
 
 config PROC_PAGE_MONITOR
- 	default y
-	depends on PROC_FS && MMU
+ 	default n
+	depends on PROC_FS && MMU && !GRKERNSEC
 	bool "Enable /proc page monitoring" if EMBEDDED
  	help
 	  Various /proc files exist to monitor process memory utilization:
diff -uriN linux-2.6.32.43/fs/proc/kcore.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/kcore.c
--- linux-2.6.32.43/fs/proc/kcore.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/kcore.c	2011-07-15 05:51:18.000000000 -0500
@@ -320,6 +320,8 @@
 	off_t offset = 0;
 	struct kcore_list *m;
 
+	pax_track_stack();
+
 	/* setup ELF header */
 	elf = (struct elfhdr *) bufp;
 	bufp += sizeof(struct elfhdr);
@@ -477,9 +479,10 @@
 	 * the addresses in the elf_phdr on our list.
 	 */
 	start = kc_offset_to_vaddr(*fpos - elf_buflen);
-	if ((tsz = (PAGE_SIZE - (start & ~PAGE_MASK))) > buflen)
+	tsz = PAGE_SIZE - (start & ~PAGE_MASK);
+	if (tsz > buflen)
 		tsz = buflen;
-		
+
 	while (buflen) {
 		struct kcore_list *m;
 
@@ -508,20 +511,23 @@
 			kfree(elf_buf);
 		} else {
 			if (kern_addr_valid(start)) {
-				unsigned long n;
+				char *elf_buf;
+				mm_segment_t oldfs;
 
-				n = copy_to_user(buffer, (char *)start, tsz);
-				/*
-				 * We cannot distingush between fault on source
-				 * and fault on destination. When this happens
-				 * we clear too and hope it will trigger the
-				 * EFAULT again.
-				 */
-				if (n) { 
-					if (clear_user(buffer + tsz - n,
-								n))
+				elf_buf = kmalloc(tsz, GFP_KERNEL);
+				if (!elf_buf)
+					return -ENOMEM;
+				oldfs = get_fs();
+				set_fs(KERNEL_DS);
+				if (!__copy_from_user(elf_buf, (const void __user *)start, tsz)) {
+					set_fs(oldfs);
+					if (copy_to_user(buffer, elf_buf, tsz)) {
+						kfree(elf_buf);
 						return -EFAULT;
+					}
 				}
+				set_fs(oldfs);
+				kfree(elf_buf);
 			} else {
 				if (clear_user(buffer, tsz))
 					return -EFAULT;
@@ -541,6 +547,9 @@
 
 static int open_kcore(struct inode *inode, struct file *filp)
 {
+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
+	return -EPERM;
+#endif
 	if (!capable(CAP_SYS_RAWIO))
 		return -EPERM;
 	if (kcore_need_update)
diff -uriN linux-2.6.32.43/fs/proc/loadavg.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/loadavg.c
--- linux-2.6.32.43/fs/proc/loadavg.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/loadavg.c	2011-07-15 05:50:11.000000000 -0500
@@ -12,15 +12,27 @@
 
 static int loadavg_proc_show(struct seq_file *m, void *v)
 {
+	unsigned long running;
+	unsigned int threads;
 	unsigned long avnrun[3];
 
 	get_avenrun(avnrun, FIXED_1/200, 0);
 
+	if (vx_flags(VXF_VIRT_LOAD, 0)) {
+		struct vx_info *vxi = current_vx_info();
+
+		running = atomic_read(&vxi->cvirt.nr_running);
+		threads = atomic_read(&vxi->cvirt.nr_threads);
+	} else {
+		running = nr_running();
+		threads = nr_threads;
+	}
+
 	seq_printf(m, "%lu.%02lu %lu.%02lu %lu.%02lu %ld/%d %d\n",
 		LOAD_INT(avnrun[0]), LOAD_FRAC(avnrun[0]),
 		LOAD_INT(avnrun[1]), LOAD_FRAC(avnrun[1]),
 		LOAD_INT(avnrun[2]), LOAD_FRAC(avnrun[2]),
-		nr_running(), nr_threads,
+		running, threads,
 		task_active_pid_ns(current)->last_pid);
 	return 0;
 }
diff -uriN linux-2.6.32.43/fs/proc/meminfo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/meminfo.c
--- linux-2.6.32.43/fs/proc/meminfo.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/meminfo.c	2011-07-15 05:51:18.000000000 -0500
@@ -29,6 +29,8 @@
 	unsigned long pages[NR_LRU_LISTS];
 	int lru;
 
+	pax_track_stack();
+
 /*
  * display in kilobytes.
  */
@@ -39,7 +41,8 @@
 	allowed = ((totalram_pages - hugetlb_total_pages())
 		* sysctl_overcommit_ratio / 100) + total_swap_pages;
 
-	cached = global_page_state(NR_FILE_PAGES) -
+	cached = vx_flags(VXF_VIRT_MEM, 0) ?
+		vx_vsi_cached(&i) : global_page_state(NR_FILE_PAGES) -
 			total_swapcache_pages - i.bufferram;
 	if (cached < 0)
 		cached = 0;
@@ -149,7 +152,7 @@
 		vmi.used >> 10,
 		vmi.largest_chunk >> 10
 #ifdef CONFIG_MEMORY_FAILURE
-		,atomic_long_read(&mce_bad_pages) << (PAGE_SHIFT - 10)
+		,atomic_long_read_unchecked(&mce_bad_pages) << (PAGE_SHIFT - 10)
 #endif
 		);
 
diff -uriN linux-2.6.32.43/fs/proc/nommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/nommu.c
--- linux-2.6.32.43/fs/proc/nommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/nommu.c	2011-07-15 05:51:18.000000000 -0500
@@ -67,7 +67,7 @@
 		if (len < 1)
 			len = 1;
 		seq_printf(m, "%*c", len, ' ');
-		seq_path(m, &file->f_path, "");
+		seq_path(m, &file->f_path, "\n\\");
 	}
 
 	seq_putc(m, '\n');
diff -uriN linux-2.6.32.43/fs/proc/proc_net.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/proc_net.c
--- linux-2.6.32.43/fs/proc/proc_net.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/proc_net.c	2011-07-15 05:51:18.000000000 -0500
@@ -104,6 +104,17 @@
 	struct task_struct *task;
 	struct nsproxy *ns;
 	struct net *net = NULL;
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	const struct cred *cred = current_cred();
+#endif
+
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+	if (cred->fsuid)
+		return net;
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	if (cred->fsuid && !in_group_p(CONFIG_GRKERNSEC_PROC_GID))
+		return net;
+#endif
 
 	rcu_read_lock();
 	task = pid_task(proc_pid(dir), PIDTYPE_PID);
diff -uriN linux-2.6.32.43/fs/proc/proc_sysctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/proc_sysctl.c
--- linux-2.6.32.43/fs/proc/proc_sysctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/proc_sysctl.c	2011-07-15 05:51:18.000000000 -0500
@@ -7,6 +7,8 @@
 #include <linux/security.h>
 #include "internal.h"
 
+extern __u32 gr_handle_sysctl(const struct ctl_table *table, const int op);
+
 static const struct dentry_operations proc_sys_dentry_operations;
 static const struct file_operations proc_sys_file_operations;
 static const struct inode_operations proc_sys_inode_operations;
@@ -109,6 +111,9 @@
 	if (!p)
 		goto out;
 
+	if (gr_handle_sysctl(p, MAY_EXEC))
+		goto out;
+
 	err = ERR_PTR(-ENOMEM);
 	inode = proc_sys_make_inode(dir->i_sb, h ? h : head, p);
 	if (h)
@@ -228,6 +233,9 @@
 		if (*pos < file->f_pos)
 			continue;
 
+		if (gr_handle_sysctl(table, 0))
+			continue;
+
 		res = proc_sys_fill_cache(file, dirent, filldir, head, table);
 		if (res)
 			return res;
@@ -344,6 +352,9 @@
 	if (IS_ERR(head))
 		return PTR_ERR(head);
 
+	if (table && gr_handle_sysctl(table, MAY_EXEC))
+		return -ENOENT;
+
 	generic_fillattr(inode, stat);
 	if (table)
 		stat->mode = (stat->mode & S_IFMT) | table->mode;
diff -uriN linux-2.6.32.43/fs/proc/root.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/root.c
--- linux-2.6.32.43/fs/proc/root.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/root.c	2011-07-15 05:51:18.000000000 -0500
@@ -18,9 +18,14 @@
 #include <linux/bitops.h>
 #include <linux/mount.h>
 #include <linux/pid_namespace.h>
+#include <linux/vserver/inode.h>
 
 #include "internal.h"
 
+struct proc_dir_entry *proc_virtual;
+
+extern void proc_vx_init(void);
+
 static int proc_test_super(struct super_block *sb, void *data)
 {
 	return sb->s_fs_info == data;
@@ -134,8 +139,17 @@
 #ifdef CONFIG_PROC_DEVICETREE
 	proc_device_tree_init();
 #endif
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR, NULL);
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	proc_mkdir_mode("bus", S_IRUSR | S_IXUSR | S_IRGRP | S_IXGRP, NULL);
+#endif
+#else
 	proc_mkdir("bus", NULL);
+#endif
 	proc_sys_init();
+	proc_vx_init();
 }
 
 static int proc_root_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat
@@ -203,6 +217,7 @@
 	.proc_iops	= &proc_root_inode_operations, 
 	.proc_fops	= &proc_root_operations,
 	.parent		= &proc_root,
+	.vx_flags	= IATTR_ADMIN | IATTR_WATCH,
 };
 
 int pid_ns_prepare_proc(struct pid_namespace *ns)
diff -uriN linux-2.6.32.43/fs/proc/task_mmu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/task_mmu.c
--- linux-2.6.32.43/fs/proc/task_mmu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/task_mmu.c	2011-07-15 05:51:18.000000000 -0500
@@ -46,15 +46,26 @@
 		"VmStk:\t%8lu kB\n"
 		"VmExe:\t%8lu kB\n"
 		"VmLib:\t%8lu kB\n"
-		"VmPTE:\t%8lu kB\n",
-		hiwater_vm << (PAGE_SHIFT-10),
+		"VmPTE:\t%8lu kB\n"
+
+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
+		"CsBase:\t%8lx\nCsLim:\t%8lx\n"
+#endif
+
+		,hiwater_vm << (PAGE_SHIFT-10),
 		(total_vm - mm->reserved_vm) << (PAGE_SHIFT-10),
 		mm->locked_vm << (PAGE_SHIFT-10),
 		hiwater_rss << (PAGE_SHIFT-10),
 		total_rss << (PAGE_SHIFT-10),
 		data << (PAGE_SHIFT-10),
 		mm->stack_vm << (PAGE_SHIFT-10), text, lib,
-		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10);
+		(PTRS_PER_PTE*sizeof(pte_t)*mm->nr_ptes) >> 10
+
+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
+		, mm->context.user_cs_base, mm->context.user_cs_limit
+#endif
+
+	);
 }
 
 unsigned long task_vsize(struct mm_struct *mm)
@@ -175,7 +186,8 @@
 	struct proc_maps_private *priv = m->private;
 	struct vm_area_struct *vma = v;
 
-	vma_stop(priv, vma);
+	if (!IS_ERR(vma))
+		vma_stop(priv, vma);
 	if (priv->task)
 		put_task_struct(priv->task);
 }
@@ -199,6 +211,12 @@
 	return ret;
 }
 
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+#define PAX_RAND_FLAGS(_mm) (_mm != NULL && _mm != current->mm && \
+			     (_mm->pax_flags & MF_PAX_RANDMMAP || \
+			      _mm->pax_flags & MF_PAX_SEGMEXEC))
+#endif
+
 static void show_map_vma(struct seq_file *m, struct vm_area_struct *vma)
 {
 	struct mm_struct *mm = vma->vm_mm;
@@ -206,7 +224,6 @@
 	int flags = vma->vm_flags;
 	unsigned long ino = 0;
 	unsigned long long pgoff = 0;
-	unsigned long start;
 	dev_t dev = 0;
 	int len;
 
@@ -217,20 +234,23 @@
 		pgoff = ((loff_t)vma->vm_pgoff) << PAGE_SHIFT;
 	}
 
-	/* We don't show the stack guard page in /proc/maps */
-	start = vma->vm_start;
-	if (vma->vm_flags & VM_GROWSDOWN)
-		if (!vma_stack_continue(vma->vm_prev, vma->vm_start))
-			start += PAGE_SIZE;
-
 	seq_printf(m, "%08lx-%08lx %c%c%c%c %08llx %02x:%02x %lu %n",
-			start,
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_start,
+			PAX_RAND_FLAGS(mm) ? 0UL : vma->vm_end,
+#else
+			vma->vm_start,
 			vma->vm_end,
+#endif
 			flags & VM_READ ? 'r' : '-',
 			flags & VM_WRITE ? 'w' : '-',
 			flags & VM_EXEC ? 'x' : '-',
 			flags & VM_MAYSHARE ? 's' : 'p',
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+			PAX_RAND_FLAGS(mm) ? 0UL : pgoff,
+#else
 			pgoff,
+#endif
 			MAJOR(dev), MINOR(dev), ino, &len);
 
 	/*
@@ -239,7 +259,7 @@
 	 */
 	if (file) {
 		pad_len_spaces(m, len);
-		seq_path(m, &file->f_path, "\n");
+		seq_path(m, &file->f_path, "\n\\");
 	} else {
 		const char *name = arch_vma_name(vma);
 		if (!name) {
@@ -247,8 +267,9 @@
 				if (vma->vm_start <= mm->brk &&
 						vma->vm_end >= mm->start_brk) {
 					name = "[heap]";
-				} else if (vma->vm_start <= mm->start_stack &&
-					   vma->vm_end >= mm->start_stack) {
+				} else if ((vma->vm_flags & (VM_GROWSDOWN | VM_GROWSUP)) ||
+					   (vma->vm_start <= mm->start_stack &&
+					    vma->vm_end >= mm->start_stack)) {
 					name = "[stack]";
 				}
 			} else {
@@ -391,9 +412,16 @@
 	};
 
 	memset(&mss, 0, sizeof mss);
-	mss.vma = vma;
-	if (vma->vm_mm && !is_vm_hugetlb_page(vma))
-		walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
+
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+	if (!PAX_RAND_FLAGS(vma->vm_mm)) {
+#endif
+		mss.vma = vma;
+		if (vma->vm_mm && !is_vm_hugetlb_page(vma))
+			walk_page_range(vma->vm_start, vma->vm_end, &smaps_walk);
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+	}
+#endif
 
 	show_map_vma(m, vma);
 
@@ -409,7 +437,11 @@
 		   "Swap:           %8lu kB\n"
 		   "KernelPageSize: %8lu kB\n"
 		   "MMUPageSize:    %8lu kB\n",
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+		   PAX_RAND_FLAGS(vma->vm_mm) ? 0UL : (vma->vm_end - vma->vm_start) >> 10,
+#else
 		   (vma->vm_end - vma->vm_start) >> 10,
+#endif
 		   mss.resident >> 10,
 		   (unsigned long)(mss.pss >> (10 + PSS_SHIFT)),
 		   mss.shared_clean  >> 10,
diff -uriN linux-2.6.32.43/fs/proc/task_nommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/task_nommu.c
--- linux-2.6.32.43/fs/proc/task_nommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/task_nommu.c	2011-07-15 05:51:18.000000000 -0500
@@ -50,7 +50,7 @@
 	else
 		bytes += kobjsize(mm);
 	
-	if (current->fs && current->fs->users > 1)
+	if (current->fs && atomic_read(&current->fs->users) > 1)
 		sbytes += kobjsize(current->fs);
 	else
 		bytes += kobjsize(current->fs);
@@ -154,7 +154,7 @@
 		if (len < 1)
 			len = 1;
 		seq_printf(m, "%*c", len, ' ');
-		seq_path(m, &file->f_path, "");
+		seq_path(m, &file->f_path, "\n\\");
 	}
 
 	seq_putc(m, '\n');
diff -uriN linux-2.6.32.43/fs/proc/uptime.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/uptime.c
--- linux-2.6.32.43/fs/proc/uptime.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/proc/uptime.c	2011-07-15 05:50:11.000000000 -0500
@@ -4,22 +4,22 @@
 #include <linux/sched.h>
 #include <linux/seq_file.h>
 #include <linux/time.h>
-#include <linux/kernel_stat.h>
+#include <linux/vserver/cvirt.h>
 #include <asm/cputime.h>
 
 static int uptime_proc_show(struct seq_file *m, void *v)
 {
 	struct timespec uptime;
 	struct timespec idle;
-	int i;
-	cputime_t idletime = cputime_zero;
-
-	for_each_possible_cpu(i)
-		idletime = cputime64_add(idletime, kstat_cpu(i).cpustat.idle);
+	cputime_t idletime = cputime_add(init_task.utime, init_task.stime);
 
 	do_posix_clock_monotonic_gettime(&uptime);
 	monotonic_to_bootbased(&uptime);
 	cputime_to_timespec(idletime, &idle);
+
+	if (vx_flags(VXF_VIRT_UPTIME, 0))
+		vx_vsi_uptime(&uptime, &idle);
+
 	seq_printf(m, "%lu.%02lu %lu.%02lu\n",
 			(unsigned long) uptime.tv_sec,
 			(uptime.tv_nsec / (NSEC_PER_SEC / 100)),
diff -uriN linux-2.6.32.43/fs/quota/quota.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/quota/quota.c
--- linux-2.6.32.43/fs/quota/quota.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/quota/quota.c	2011-07-15 05:50:11.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/capability.h>
 #include <linux/quotaops.h>
 #include <linux/types.h>
+#include <linux/vs_context.h>
 
 /* Check validity of generic quotactl commands */
 static int generic_quotactl_valid(struct super_block *sb, int type, int cmd,
@@ -83,11 +84,11 @@
 	if (cmd == Q_GETQUOTA) {
 		if (((type == USRQUOTA && current_euid() != id) ||
 		     (type == GRPQUOTA && !in_egroup_p(id))) &&
-		    !capable(CAP_SYS_ADMIN))
+		    !vx_capable(CAP_SYS_ADMIN, VXC_QUOTA_CTL))
 			return -EPERM;
 	}
 	else if (cmd != Q_GETFMT && cmd != Q_SYNC && cmd != Q_GETINFO)
-		if (!capable(CAP_SYS_ADMIN))
+		if (!vx_capable(CAP_SYS_ADMIN, VXC_QUOTA_CTL))
 			return -EPERM;
 
 	return 0;
@@ -135,10 +136,10 @@
 	if (cmd == Q_XGETQUOTA) {
 		if (((type == XQM_USRQUOTA && current_euid() != id) ||
 		     (type == XQM_GRPQUOTA && !in_egroup_p(id))) &&
-		     !capable(CAP_SYS_ADMIN))
+		     !vx_capable(CAP_SYS_ADMIN, VXC_QUOTA_CTL))
 			return -EPERM;
 	} else if (cmd != Q_XGETQSTAT && cmd != Q_XQUOTASYNC) {
-		if (!capable(CAP_SYS_ADMIN))
+		if (!vx_capable(CAP_SYS_ADMIN, VXC_QUOTA_CTL))
 			return -EPERM;
 	}
 
@@ -351,6 +352,46 @@
 	return 0;
 }
 
+#if defined(CONFIG_BLK_DEV_VROOT) || defined(CONFIG_BLK_DEV_VROOT_MODULE)
+
+#include <linux/vroot.h>
+#include <linux/major.h>
+#include <linux/module.h>
+#include <linux/kallsyms.h>
+#include <linux/vserver/debug.h>
+
+static vroot_grb_func *vroot_get_real_bdev = NULL;
+
+static spinlock_t vroot_grb_lock = SPIN_LOCK_UNLOCKED;
+
+int register_vroot_grb(vroot_grb_func *func) {
+	int ret = -EBUSY;
+
+	spin_lock(&vroot_grb_lock);
+	if (!vroot_get_real_bdev) {
+		vroot_get_real_bdev = func;
+		ret = 0;
+	}
+	spin_unlock(&vroot_grb_lock);
+	return ret;
+}
+EXPORT_SYMBOL(register_vroot_grb);
+
+int unregister_vroot_grb(vroot_grb_func *func) {
+	int ret = -EINVAL;
+
+	spin_lock(&vroot_grb_lock);
+	if (vroot_get_real_bdev) {
+		vroot_get_real_bdev = NULL;
+		ret = 0;
+	}
+	spin_unlock(&vroot_grb_lock);
+	return ret;
+}
+EXPORT_SYMBOL(unregister_vroot_grb);
+
+#endif
+
 /*
  * look up a superblock on which quota ops will be performed
  * - use the name of a block device to find the superblock thereon
@@ -368,6 +409,22 @@
 	putname(tmp);
 	if (IS_ERR(bdev))
 		return ERR_CAST(bdev);
+#if defined(CONFIG_BLK_DEV_VROOT) || defined(CONFIG_BLK_DEV_VROOT_MODULE)
+	if (bdev && bdev->bd_inode &&
+			imajor(bdev->bd_inode) == VROOT_MAJOR) {
+		struct block_device *bdnew = (void *)-EINVAL;
+
+		if (vroot_get_real_bdev)
+			bdnew = vroot_get_real_bdev(bdev);
+		else
+			vxdprintk(VXD_CBIT(misc, 0),
+					"vroot_get_real_bdev not set");
+		bdput(bdev);
+		if (IS_ERR(bdnew))
+			return ERR_PTR(PTR_ERR(bdnew));
+		bdev = bdnew;
+	}
+#endif
 	sb = get_super(bdev);
 	bdput(bdev);
 	if (!sb)
diff -uriN linux-2.6.32.43/fs/readdir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/readdir.c
--- linux-2.6.32.43/fs/readdir.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/readdir.c	2011-07-15 05:51:18.000000000 -0500
@@ -16,6 +16,7 @@
 #include <linux/security.h>
 #include <linux/syscalls.h>
 #include <linux/unistd.h>
+#include <linux/namei.h>
 
 #include <asm/uaccess.h>
 
@@ -67,6 +68,7 @@
 
 struct readdir_callback {
 	struct old_linux_dirent __user * dirent;
+	struct file * file;
 	int result;
 };
 
@@ -84,6 +86,10 @@
 		buf->result = -EOVERFLOW;
 		return -EOVERFLOW;
 	}
+
+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
+		return 0;
+
 	buf->result++;
 	dirent = buf->dirent;
 	if (!access_ok(VERIFY_WRITE, dirent,
@@ -116,6 +122,7 @@
 
 	buf.result = 0;
 	buf.dirent = dirent;
+	buf.file = file;
 
 	error = vfs_readdir(file, fillonedir, &buf);
 	if (buf.result)
@@ -142,6 +149,7 @@
 struct getdents_callback {
 	struct linux_dirent __user * current_dir;
 	struct linux_dirent __user * previous;
+	struct file * file;
 	int count;
 	int error;
 };
@@ -162,6 +170,10 @@
 		buf->error = -EOVERFLOW;
 		return -EOVERFLOW;
 	}
+
+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
+		return 0;
+
 	dirent = buf->previous;
 	if (dirent) {
 		if (__put_user(offset, &dirent->d_off))
@@ -209,6 +221,7 @@
 	buf.previous = NULL;
 	buf.count = count;
 	buf.error = 0;
+	buf.file = file;
 
 	error = vfs_readdir(file, filldir, &buf);
 	if (error >= 0)
@@ -228,6 +241,7 @@
 struct getdents_callback64 {
 	struct linux_dirent64 __user * current_dir;
 	struct linux_dirent64 __user * previous;
+	struct file *file;
 	int count;
 	int error;
 };
@@ -242,6 +256,10 @@
 	buf->error = -EINVAL;	/* only used if we fail.. */
 	if (reclen > buf->count)
 		return -EINVAL;
+
+	if (!gr_acl_handle_filldir(buf->file, name, namlen, ino))
+		return 0;
+
 	dirent = buf->previous;
 	if (dirent) {
 		if (__put_user(offset, &dirent->d_off))
@@ -289,6 +307,7 @@
 
 	buf.current_dir = dirent;
 	buf.previous = NULL;
+	buf.file = file;
 	buf.count = count;
 	buf.error = 0;
 
diff -uriN linux-2.6.32.43/fs/reiserfs/dir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/dir.c
--- linux-2.6.32.43/fs/reiserfs/dir.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/dir.c	2011-07-15 05:51:18.000000000 -0500
@@ -66,6 +66,8 @@
 	struct reiserfs_dir_entry de;
 	int ret = 0;
 
+	pax_track_stack();
+
 	reiserfs_write_lock(inode->i_sb);
 
 	reiserfs_check_lock_depth(inode->i_sb, "readdir");
diff -uriN linux-2.6.32.43/fs/reiserfs/do_balan.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/do_balan.c
--- linux-2.6.32.43/fs/reiserfs/do_balan.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/do_balan.c	2011-07-15 05:51:18.000000000 -0500
@@ -2058,7 +2058,7 @@
 		return;
 	}
 
-	atomic_inc(&(fs_generation(tb->tb_sb)));
+	atomic_inc_unchecked(&(fs_generation(tb->tb_sb)));
 	do_balance_starts(tb);
 
 	/* balance leaf returns 0 except if combining L R and S into
diff -uriN linux-2.6.32.43/fs/reiserfs/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/file.c
--- linux-2.6.32.43/fs/reiserfs/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/file.c	2011-07-15 05:50:11.000000000 -0500
@@ -307,4 +307,5 @@
 	.listxattr = reiserfs_listxattr,
 	.removexattr = reiserfs_removexattr,
 	.permission = reiserfs_permission,
+	.sync_flags = reiserfs_sync_flags,
 };
diff -uriN linux-2.6.32.43/fs/reiserfs/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/inode.c
--- linux-2.6.32.43/fs/reiserfs/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/writeback.h>
 #include <linux/quotaops.h>
 #include <linux/swap.h>
+#include <linux/vs_tag.h>
 
 int reiserfs_commit_write(struct file *f, struct page *page,
 			  unsigned from, unsigned to);
@@ -1117,6 +1118,8 @@
 	struct buffer_head *bh;
 	struct item_head *ih;
 	__u32 rdev;
+	uid_t uid;
+	gid_t gid;
 	//int version = ITEM_VERSION_1;
 
 	bh = PATH_PLAST_BUFFER(path);
@@ -1138,12 +1141,13 @@
 		    (struct stat_data_v1 *)B_I_PITEM(bh, ih);
 		unsigned long blocks;
 
+		uid = sd_v1_uid(sd);
+		gid = sd_v1_gid(sd);
+
 		set_inode_item_key_version(inode, KEY_FORMAT_3_5);
 		set_inode_sd_version(inode, STAT_DATA_V1);
 		inode->i_mode = sd_v1_mode(sd);
 		inode->i_nlink = sd_v1_nlink(sd);
-		inode->i_uid = sd_v1_uid(sd);
-		inode->i_gid = sd_v1_gid(sd);
 		inode->i_size = sd_v1_size(sd);
 		inode->i_atime.tv_sec = sd_v1_atime(sd);
 		inode->i_mtime.tv_sec = sd_v1_mtime(sd);
@@ -1185,11 +1189,12 @@
 		// (directories and symlinks)
 		struct stat_data *sd = (struct stat_data *)B_I_PITEM(bh, ih);
 
+		uid    = sd_v2_uid(sd);
+		gid    = sd_v2_gid(sd);
+
 		inode->i_mode = sd_v2_mode(sd);
 		inode->i_nlink = sd_v2_nlink(sd);
-		inode->i_uid = sd_v2_uid(sd);
 		inode->i_size = sd_v2_size(sd);
-		inode->i_gid = sd_v2_gid(sd);
 		inode->i_mtime.tv_sec = sd_v2_mtime(sd);
 		inode->i_atime.tv_sec = sd_v2_atime(sd);
 		inode->i_ctime.tv_sec = sd_v2_ctime(sd);
@@ -1219,6 +1224,10 @@
 		sd_attrs_to_i_attrs(sd_v2_attrs(sd), inode);
 	}
 
+	inode->i_uid = INOTAG_UID(DX_TAG(inode), uid, gid);
+	inode->i_gid = INOTAG_GID(DX_TAG(inode), uid, gid);
+	inode->i_tag = INOTAG_TAG(DX_TAG(inode), uid, gid, 0);
+
 	pathrelse(path);
 	if (S_ISREG(inode->i_mode)) {
 		inode->i_op = &reiserfs_file_inode_operations;
@@ -1241,13 +1250,15 @@
 static void inode2sd(void *sd, struct inode *inode, loff_t size)
 {
 	struct stat_data *sd_v2 = (struct stat_data *)sd;
+	uid_t uid = TAGINO_UID(DX_TAG(inode), inode->i_uid, inode->i_tag);
+	gid_t gid = TAGINO_GID(DX_TAG(inode), inode->i_gid, inode->i_tag);
 	__u16 flags;
 
+	set_sd_v2_uid(sd_v2, uid);
+	set_sd_v2_gid(sd_v2, gid);
 	set_sd_v2_mode(sd_v2, inode->i_mode);
 	set_sd_v2_nlink(sd_v2, inode->i_nlink);
-	set_sd_v2_uid(sd_v2, inode->i_uid);
 	set_sd_v2_size(sd_v2, size);
-	set_sd_v2_gid(sd_v2, inode->i_gid);
 	set_sd_v2_mtime(sd_v2, inode->i_mtime.tv_sec);
 	set_sd_v2_atime(sd_v2, inode->i_atime.tv_sec);
 	set_sd_v2_ctime(sd_v2, inode->i_ctime.tv_sec);
@@ -2839,14 +2850,19 @@
 void sd_attrs_to_i_attrs(__u16 sd_attrs, struct inode *inode)
 {
 	if (reiserfs_attrs(inode->i_sb)) {
-		if (sd_attrs & REISERFS_SYNC_FL)
-			inode->i_flags |= S_SYNC;
-		else
-			inode->i_flags &= ~S_SYNC;
 		if (sd_attrs & REISERFS_IMMUTABLE_FL)
 			inode->i_flags |= S_IMMUTABLE;
 		else
 			inode->i_flags &= ~S_IMMUTABLE;
+		if (sd_attrs & REISERFS_IXUNLINK_FL)
+			inode->i_flags |= S_IXUNLINK;
+		else
+			inode->i_flags &= ~S_IXUNLINK;
+
+		if (sd_attrs & REISERFS_SYNC_FL)
+			inode->i_flags |= S_SYNC;
+		else
+			inode->i_flags &= ~S_SYNC;
 		if (sd_attrs & REISERFS_APPEND_FL)
 			inode->i_flags |= S_APPEND;
 		else
@@ -2859,6 +2875,15 @@
 			REISERFS_I(inode)->i_flags |= i_nopack_mask;
 		else
 			REISERFS_I(inode)->i_flags &= ~i_nopack_mask;
+
+		if (sd_attrs & REISERFS_BARRIER_FL)
+			inode->i_vflags |= V_BARRIER;
+		else
+			inode->i_vflags &= ~V_BARRIER;
+		if (sd_attrs & REISERFS_COW_FL)
+			inode->i_vflags |= V_COW;
+		else
+			inode->i_vflags &= ~V_COW;
 	}
 }
 
@@ -2869,6 +2894,11 @@
 			*sd_attrs |= REISERFS_IMMUTABLE_FL;
 		else
 			*sd_attrs &= ~REISERFS_IMMUTABLE_FL;
+		if (inode->i_flags & S_IXUNLINK)
+			*sd_attrs |= REISERFS_IXUNLINK_FL;
+		else
+			*sd_attrs &= ~REISERFS_IXUNLINK_FL;
+
 		if (inode->i_flags & S_SYNC)
 			*sd_attrs |= REISERFS_SYNC_FL;
 		else
@@ -2881,6 +2911,15 @@
 			*sd_attrs |= REISERFS_NOTAIL_FL;
 		else
 			*sd_attrs &= ~REISERFS_NOTAIL_FL;
+
+		if (inode->i_vflags & V_BARRIER)
+			*sd_attrs |= REISERFS_BARRIER_FL;
+		else
+			*sd_attrs &= ~REISERFS_BARRIER_FL;
+		if (inode->i_vflags & V_COW)
+			*sd_attrs |= REISERFS_COW_FL;
+		else
+			*sd_attrs &= ~REISERFS_COW_FL;
 	}
 }
 
@@ -3101,9 +3140,11 @@
 	}
 
 	error = inode_change_ok(inode, attr);
+
 	if (!error) {
 		if ((ia_valid & ATTR_UID && attr->ia_uid != inode->i_uid) ||
-		    (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid)) {
+		    (ia_valid & ATTR_GID && attr->ia_gid != inode->i_gid) ||
+		    (ia_valid & ATTR_TAG && attr->ia_tag != inode->i_tag)) {
 			error = reiserfs_chown_xattrs(inode, attr);
 
 			if (!error) {
@@ -3133,6 +3174,9 @@
 					inode->i_uid = attr->ia_uid;
 				if (attr->ia_valid & ATTR_GID)
 					inode->i_gid = attr->ia_gid;
+				if ((attr->ia_valid & ATTR_TAG) &&
+					IS_TAGGED(inode))
+					inode->i_tag = attr->ia_tag;
 				mark_inode_dirty(inode);
 				error =
 				    journal_end(&th, inode->i_sb, jbegin_count);
diff -uriN linux-2.6.32.43/fs/reiserfs/ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/ioctl.c
--- linux-2.6.32.43/fs/reiserfs/ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/ioctl.c	2011-07-15 05:50:11.000000000 -0500
@@ -7,11 +7,27 @@
 #include <linux/mount.h>
 #include <linux/reiserfs_fs.h>
 #include <linux/time.h>
+#include <linux/mount.h>
 #include <asm/uaccess.h>
 #include <linux/pagemap.h>
 #include <linux/smp_lock.h>
 #include <linux/compat.h>
 
+
+int reiserfs_sync_flags(struct inode *inode, int flags, int vflags)
+{
+	__u16 sd_attrs = 0;
+
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+
+	i_attrs_to_sd_attrs(inode, &sd_attrs);
+	REISERFS_I(inode)->i_attrs = sd_attrs;
+	inode->i_ctime = CURRENT_TIME_SEC;
+	mark_inode_dirty(inode);
+	return 0;
+}
+
 /*
 ** reiserfs_ioctl - handler for ioctl for inode
 ** supported commands:
@@ -23,7 +39,7 @@
 int reiserfs_ioctl(struct inode *inode, struct file *filp, unsigned int cmd,
 		   unsigned long arg)
 {
-	unsigned int flags;
+	unsigned int flags, oldflags;
 	int err = 0;
 
 	switch (cmd) {
@@ -43,6 +59,7 @@
 
 		flags = REISERFS_I(inode)->i_attrs;
 		i_attrs_to_sd_attrs(inode, (__u16 *) & flags);
+		flags &= REISERFS_FL_USER_VISIBLE;
 		return put_user(flags, (int __user *)arg);
 	case REISERFS_IOC_SETFLAGS:{
 			if (!reiserfs_attrs(inode->i_sb))
@@ -60,6 +77,10 @@
 				err = -EFAULT;
 				goto setflags_out;
 			}
+			if (IS_BARRIER(inode)) {
+				vxwprintk_task(1, "messing with the barrier.");
+				return -EACCES;
+			}
 			/*
 			 * Is it quota file? Do not allow user to mess with it
 			 */
@@ -84,6 +105,10 @@
 					goto setflags_out;
 				}
 			}
+
+			oldflags = REISERFS_I(inode)->i_attrs;
+			flags &= REISERFS_FL_USER_MODIFIABLE;
+			flags |= oldflags & ~REISERFS_FL_USER_MODIFIABLE;
 			sd_attrs_to_i_attrs(flags, inode);
 			REISERFS_I(inode)->i_attrs = flags;
 			inode->i_ctime = CURRENT_TIME_SEC;
diff -uriN linux-2.6.32.43/fs/reiserfs/item_ops.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/item_ops.c
--- linux-2.6.32.43/fs/reiserfs/item_ops.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/item_ops.c	2011-07-15 05:51:18.000000000 -0500
@@ -102,7 +102,7 @@
 			 vi->vi_index, vi->vi_type, vi->vi_ih);
 }
 
-static struct item_operations stat_data_ops = {
+static const struct item_operations stat_data_ops = {
 	.bytes_number = sd_bytes_number,
 	.decrement_key = sd_decrement_key,
 	.is_left_mergeable = sd_is_left_mergeable,
@@ -196,7 +196,7 @@
 			 vi->vi_index, vi->vi_type, vi->vi_ih);
 }
 
-static struct item_operations direct_ops = {
+static const struct item_operations direct_ops = {
 	.bytes_number = direct_bytes_number,
 	.decrement_key = direct_decrement_key,
 	.is_left_mergeable = direct_is_left_mergeable,
@@ -341,7 +341,7 @@
 			 vi->vi_index, vi->vi_type, vi->vi_ih);
 }
 
-static struct item_operations indirect_ops = {
+static const struct item_operations indirect_ops = {
 	.bytes_number = indirect_bytes_number,
 	.decrement_key = indirect_decrement_key,
 	.is_left_mergeable = indirect_is_left_mergeable,
@@ -628,7 +628,7 @@
 	printk("\n");
 }
 
-static struct item_operations direntry_ops = {
+static const struct item_operations direntry_ops = {
 	.bytes_number = direntry_bytes_number,
 	.decrement_key = direntry_decrement_key,
 	.is_left_mergeable = direntry_is_left_mergeable,
@@ -724,7 +724,7 @@
 			 "Invalid item type observed, run fsck ASAP");
 }
 
-static struct item_operations errcatch_ops = {
+static const struct item_operations errcatch_ops = {
 	errcatch_bytes_number,
 	errcatch_decrement_key,
 	errcatch_is_left_mergeable,
@@ -746,7 +746,7 @@
 #error Item types must use disk-format assigned values.
 #endif
 
-struct item_operations *item_ops[TYPE_ANY + 1] = {
+const struct item_operations * const item_ops[TYPE_ANY + 1] = {
 	&stat_data_ops,
 	&indirect_ops,
 	&direct_ops,
diff -uriN linux-2.6.32.43/fs/reiserfs/journal.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/journal.c
--- linux-2.6.32.43/fs/reiserfs/journal.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/journal.c	2011-07-15 05:51:18.000000000 -0500
@@ -2329,6 +2329,8 @@
 	struct buffer_head *bh;
 	int i, j;
 
+	pax_track_stack();
+
 	bh = __getblk(dev, block, bufsize);
 	if (buffer_uptodate(bh))
 		return (bh);
diff -uriN linux-2.6.32.43/fs/reiserfs/namei.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/namei.c
--- linux-2.6.32.43/fs/reiserfs/namei.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/namei.c	2011-07-15 05:51:18.000000000 -0500
@@ -17,6 +17,7 @@
 #include <linux/reiserfs_acl.h>
 #include <linux/reiserfs_xattr.h>
 #include <linux/quotaops.h>
+#include <linux/vs_tag.h>
 
 #define INC_DIR_INODE_NLINK(i) if (i->i_nlink != 1) { inc_nlink(i); if (i->i_nlink >= REISERFS_LINK_MAX) i->i_nlink=1; }
 #define DEC_DIR_INODE_NLINK(i) if (i->i_nlink != 1) drop_nlink(i);
@@ -354,6 +355,7 @@
 	if (retval == IO_ERROR) {
 		return ERR_PTR(-EIO);
 	}
+		dx_propagate_tag(nd, inode);
 
 	return d_splice_alias(inode, dentry);
 }
@@ -570,6 +572,7 @@
 	} else {
 		inode->i_gid = current_fsgid();
 	}
+	inode->i_tag = dx_current_fstag(inode->i_sb);
 	vfs_dq_init(inode);
 	return 0;
 }
@@ -1214,6 +1217,8 @@
 	unsigned long savelink = 1;
 	struct timespec ctime;
 
+	pax_track_stack();
+
 	/* three balancings: (1) old name removal, (2) new name insertion
 	   and (3) maybe "save" link insertion
 	   stat data updates: (1) old directory,
@@ -1515,6 +1520,7 @@
 	.listxattr = reiserfs_listxattr,
 	.removexattr = reiserfs_removexattr,
 	.permission = reiserfs_permission,
+	.sync_flags = reiserfs_sync_flags,
 };
 
 /*
diff -uriN linux-2.6.32.43/fs/reiserfs/procfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/procfs.c
--- linux-2.6.32.43/fs/reiserfs/procfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/procfs.c	2011-07-15 05:51:18.000000000 -0500
@@ -123,7 +123,7 @@
 		   "SMALL_TAILS " : "NO_TAILS ",
 		   replay_only(sb) ? "REPLAY_ONLY " : "",
 		   convert_reiserfs(sb) ? "CONV " : "",
-		   atomic_read(&r->s_generation_counter),
+		   atomic_read_unchecked(&r->s_generation_counter),
 		   SF(s_disk_reads), SF(s_disk_writes), SF(s_fix_nodes),
 		   SF(s_do_balance), SF(s_unneeded_left_neighbor),
 		   SF(s_good_search_by_key_reada), SF(s_bmaps),
@@ -309,6 +309,8 @@
 	struct journal_params *jp = &rs->s_v1.s_journal;
 	char b[BDEVNAME_SIZE];
 
+	pax_track_stack();
+
 	seq_printf(m,		/* on-disk fields */
 		   "jp_journal_1st_block: \t%i\n"
 		   "jp_journal_dev: \t%s[%x]\n"
diff -uriN linux-2.6.32.43/fs/reiserfs/stree.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/stree.c
--- linux-2.6.32.43/fs/reiserfs/stree.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/stree.c	2011-07-15 05:51:18.000000000 -0500
@@ -1159,6 +1159,8 @@
 	int iter = 0;
 #endif
 
+	pax_track_stack();
+
 	BUG_ON(!th->t_trans_id);
 
 	init_tb_struct(th, &s_del_balance, sb, path,
@@ -1296,6 +1298,8 @@
 	int retval;
 	int quota_cut_bytes = 0;
 
+	pax_track_stack();
+
 	BUG_ON(!th->t_trans_id);
 
 	le_key2cpu_key(&cpu_key, key);
@@ -1525,6 +1529,8 @@
 	int quota_cut_bytes;
 	loff_t tail_pos = 0;
 
+	pax_track_stack();
+
 	BUG_ON(!th->t_trans_id);
 
 	init_tb_struct(th, &s_cut_balance, inode->i_sb, path,
@@ -1920,6 +1926,8 @@
 	int retval;
 	int fs_gen;
 
+	pax_track_stack();
+
 	BUG_ON(!th->t_trans_id);
 
 	fs_gen = get_generation(inode->i_sb);
@@ -2007,6 +2015,8 @@
 	int fs_gen = 0;
 	int quota_bytes = 0;
 
+	pax_track_stack();
+
 	BUG_ON(!th->t_trans_id);
 
 	if (inode) {		/* Do we count quotas for item? */
diff -uriN linux-2.6.32.43/fs/reiserfs/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/super.c
--- linux-2.6.32.43/fs/reiserfs/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/super.c	2011-07-15 05:51:18.000000000 -0500
@@ -884,6 +884,14 @@
 		{"user_xattr",.setmask = 1 << REISERFS_UNSUPPORTED_OPT},
 		{"nouser_xattr",.clrmask = 1 << REISERFS_UNSUPPORTED_OPT},
 #endif
+#ifndef CONFIG_TAGGING_NONE
+		{"tagxid",.setmask = 1 << REISERFS_TAGGED},
+		{"tag",.setmask = 1 << REISERFS_TAGGED},
+		{"notag",.clrmask = 1 << REISERFS_TAGGED},
+#endif
+#ifdef CONFIG_PROPAGATE
+		{"tag",.arg_required = 'T',.values = NULL},
+#endif
 #ifdef CONFIG_REISERFS_FS_POSIX_ACL
 		{"acl",.setmask = 1 << REISERFS_POSIXACL},
 		{"noacl",.clrmask = 1 << REISERFS_POSIXACL},
@@ -912,6 +920,8 @@
 		{.option_name = NULL}
 	};
 
+	pax_track_stack();
+
 	*blocks = 0;
 	if (!options || !*options)
 		/* use default configuration: create tails, journaling on, no
@@ -1190,6 +1200,14 @@
 	handle_quota_files(s, qf_names, &qfmt);
 #endif
 
+	if ((mount_options & (1 << REISERFS_TAGGED)) &&
+		!(s->s_flags & MS_TAGGED)) {
+		reiserfs_warning(s, "super-vs01",
+			"reiserfs: tagging not permitted on remount.");
+		err = -EINVAL;
+		goto out_err;
+	}
+
 	handle_attrs(s);
 
 	/* Add options that are safe here */
@@ -1652,6 +1670,10 @@
 		goto error;
 	}
 
+	/* map mount option tagxid */
+	if (REISERFS_SB(s)->s_mount_opt & (1 << REISERFS_TAGGED))
+		s->s_flags |= MS_TAGGED;
+
 	rs = SB_DISK_SUPER_BLOCK(s);
 	/* Let's do basic sanity check to verify that underlying device is not
 	   smaller than the filesystem. If the check fails then abort and scream,
diff -uriN linux-2.6.32.43/fs/reiserfs/xattr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/xattr.c
--- linux-2.6.32.43/fs/reiserfs/xattr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/reiserfs/xattr.c	2011-07-15 05:50:11.000000000 -0500
@@ -39,6 +39,7 @@
 #include <linux/namei.h>
 #include <linux/errno.h>
 #include <linux/fs.h>
+#include <linux/mount.h>
 #include <linux/file.h>
 #include <linux/pagemap.h>
 #include <linux/xattr.h>
diff -uriN linux-2.6.32.43/fs/select.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/select.c
--- linux-2.6.32.43/fs/select.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/select.c	2011-07-15 05:51:18.000000000 -0500
@@ -20,6 +20,7 @@
 #include <linux/module.h>
 #include <linux/slab.h>
 #include <linux/poll.h>
+#include <linux/security.h>
 #include <linux/personality.h> /* for STICKY_TIMEOUTS */
 #include <linux/file.h>
 #include <linux/fdtable.h>
@@ -401,6 +402,8 @@
 	int retval, i, timed_out = 0;
 	unsigned long slack = 0;
 
+	pax_track_stack();
+
 	rcu_read_lock();
 	retval = max_select_fd(n, fds);
 	rcu_read_unlock();
@@ -529,6 +532,8 @@
 	/* Allocate small arguments on the stack to save memory and be faster */
 	long stack_fds[SELECT_STACK_ALLOC/sizeof(long)];
 
+	pax_track_stack();
+
 	ret = -EINVAL;
 	if (n < 0)
 		goto out_nofds;
@@ -821,6 +826,9 @@
  	struct poll_list *walk = head;
  	unsigned long todo = nfds;
 
+	pax_track_stack();
+
+	gr_learn_resource(current, RLIMIT_NOFILE, nfds, 1);
 	if (nfds > current->signal->rlim[RLIMIT_NOFILE].rlim_cur)
 		return -EINVAL;
 
diff -uriN linux-2.6.32.43/fs/seq_file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/seq_file.c
--- linux-2.6.32.43/fs/seq_file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/seq_file.c	2011-07-15 05:51:18.000000000 -0500
@@ -76,7 +76,8 @@
 		return 0;
 	}
 	if (!m->buf) {
-		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+		m->size = PAGE_SIZE;
+		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 		if (!m->buf)
 			return -ENOMEM;
 	}
@@ -116,7 +117,8 @@
 Eoverflow:
 	m->op->stop(m, p);
 	kfree(m->buf);
-	m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+	m->size <<= 1;
+	m->buf = kmalloc(m->size, GFP_KERNEL);
 	return !m->buf ? -ENOMEM : -EAGAIN;
 }
 
@@ -169,7 +171,8 @@
 	m->version = file->f_version;
 	/* grab buffer if we didn't have one */
 	if (!m->buf) {
-		m->buf = kmalloc(m->size = PAGE_SIZE, GFP_KERNEL);
+		m->size = PAGE_SIZE;
+		m->buf = kmalloc(PAGE_SIZE, GFP_KERNEL);
 		if (!m->buf)
 			goto Enomem;
 	}
@@ -210,7 +213,8 @@
 			goto Fill;
 		m->op->stop(m, p);
 		kfree(m->buf);
-		m->buf = kmalloc(m->size <<= 1, GFP_KERNEL);
+		m->size <<= 1;
+		m->buf = kmalloc(m->size, GFP_KERNEL);
 		if (!m->buf)
 			goto Enomem;
 		m->count = 0;
diff -uriN linux-2.6.32.43/fs/smbfs/symlink.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/smbfs/symlink.c
--- linux-2.6.32.43/fs/smbfs/symlink.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/smbfs/symlink.c	2011-07-15 05:51:18.000000000 -0500
@@ -55,7 +55,7 @@
 
 static void smb_put_link(struct dentry *dentry, struct nameidata *nd, void *p)
 {
-	char *s = nd_get_link(nd);
+	const char *s = nd_get_link(nd);
 	if (!IS_ERR(s))
 		__putname(s);
 }
diff -uriN linux-2.6.32.43/fs/splice.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/splice.c
--- linux-2.6.32.43/fs/splice.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/splice.c	2011-07-15 05:51:18.000000000 -0500
@@ -185,7 +185,7 @@
 	pipe_lock(pipe);
 
 	for (;;) {
-		if (!pipe->readers) {
+		if (!atomic_read(&pipe->readers)) {
 			send_sig(SIGPIPE, current, 0);
 			if (!ret)
 				ret = -EPIPE;
@@ -239,9 +239,9 @@
 			do_wakeup = 0;
 		}
 
-		pipe->waiting_writers++;
+		atomic_inc(&pipe->waiting_writers);
 		pipe_wait(pipe);
-		pipe->waiting_writers--;
+		atomic_dec(&pipe->waiting_writers);
 	}
 
 	pipe_unlock(pipe);
@@ -285,6 +285,8 @@
 		.spd_release = spd_release_page,
 	};
 
+	pax_track_stack();
+
 	index = *ppos >> PAGE_CACHE_SHIFT;
 	loff = *ppos & ~PAGE_CACHE_MASK;
 	req_pages = (len + loff + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
@@ -521,7 +523,7 @@
 	old_fs = get_fs();
 	set_fs(get_ds());
 	/* The cast to a user pointer is valid due to the set_fs() */
-	res = vfs_readv(file, (const struct iovec __user *)vec, vlen, &pos);
+	res = vfs_readv(file, (__force const struct iovec __user *)vec, vlen, &pos);
 	set_fs(old_fs);
 
 	return res;
@@ -536,7 +538,7 @@
 	old_fs = get_fs();
 	set_fs(get_ds());
 	/* The cast to a user pointer is valid due to the set_fs() */
-	res = vfs_write(file, (const char __user *)buf, count, &pos);
+	res = vfs_write(file, (__force const char __user *)buf, count, &pos);
 	set_fs(old_fs);
 
 	return res;
@@ -565,6 +567,8 @@
 		.spd_release = spd_release_page,
 	};
 
+	pax_track_stack();
+
 	index = *ppos >> PAGE_CACHE_SHIFT;
 	offset = *ppos & ~PAGE_CACHE_MASK;
 	nr_pages = (len + offset + PAGE_CACHE_SIZE - 1) >> PAGE_CACHE_SHIFT;
@@ -578,7 +582,7 @@
 			goto err;
 
 		this_len = min_t(size_t, len, PAGE_CACHE_SIZE - offset);
-		vec[i].iov_base = (void __user *) page_address(page);
+		vec[i].iov_base = (__force void __user *) page_address(page);
 		vec[i].iov_len = this_len;
 		pages[i] = page;
 		spd.nr_pages++;
@@ -800,10 +804,10 @@
 int splice_from_pipe_next(struct pipe_inode_info *pipe, struct splice_desc *sd)
 {
 	while (!pipe->nrbufs) {
-		if (!pipe->writers)
+		if (!atomic_read(&pipe->writers))
 			return 0;
 
-		if (!pipe->waiting_writers && sd->num_spliced)
+		if (!atomic_read(&pipe->waiting_writers) && sd->num_spliced)
 			return 0;
 
 		if (sd->flags & SPLICE_F_NONBLOCK)
@@ -1140,7 +1144,7 @@
 		 * out of the pipe right after the splice_to_pipe(). So set
 		 * PIPE_READERS appropriately.
 		 */
-		pipe->readers = 1;
+		atomic_set(&pipe->readers, 1);
 
 		current->splice_pipe = pipe;
 	}
@@ -1592,6 +1596,8 @@
 		.spd_release = spd_release_page,
 	};
 
+	pax_track_stack();
+
 	pipe = pipe_info(file->f_path.dentry->d_inode);
 	if (!pipe)
 		return -EBADF;
@@ -1700,9 +1706,9 @@
 			ret = -ERESTARTSYS;
 			break;
 		}
-		if (!pipe->writers)
+		if (!atomic_read(&pipe->writers))
 			break;
-		if (!pipe->waiting_writers) {
+		if (!atomic_read(&pipe->waiting_writers)) {
 			if (flags & SPLICE_F_NONBLOCK) {
 				ret = -EAGAIN;
 				break;
@@ -1734,7 +1740,7 @@
 	pipe_lock(pipe);
 
 	while (pipe->nrbufs >= PIPE_BUFFERS) {
-		if (!pipe->readers) {
+		if (!atomic_read(&pipe->readers)) {
 			send_sig(SIGPIPE, current, 0);
 			ret = -EPIPE;
 			break;
@@ -1747,9 +1753,9 @@
 			ret = -ERESTARTSYS;
 			break;
 		}
-		pipe->waiting_writers++;
+		atomic_inc(&pipe->waiting_writers);
 		pipe_wait(pipe);
-		pipe->waiting_writers--;
+		atomic_dec(&pipe->waiting_writers);
 	}
 
 	pipe_unlock(pipe);
@@ -1785,14 +1791,14 @@
 	pipe_double_lock(ipipe, opipe);
 
 	do {
-		if (!opipe->readers) {
+		if (!atomic_read(&opipe->readers)) {
 			send_sig(SIGPIPE, current, 0);
 			if (!ret)
 				ret = -EPIPE;
 			break;
 		}
 
-		if (!ipipe->nrbufs && !ipipe->writers)
+		if (!ipipe->nrbufs && !atomic_read(&ipipe->writers))
 			break;
 
 		/*
@@ -1892,7 +1898,7 @@
 	pipe_double_lock(ipipe, opipe);
 
 	do {
-		if (!opipe->readers) {
+		if (!atomic_read(&opipe->readers)) {
 			send_sig(SIGPIPE, current, 0);
 			if (!ret)
 				ret = -EPIPE;
@@ -1937,7 +1943,7 @@
 	 * return EAGAIN if we have the potential of some data in the
 	 * future, otherwise just return 0
 	 */
-	if (!ret && ipipe->waiting_writers && (flags & SPLICE_F_NONBLOCK))
+	if (!ret && atomic_read(&ipipe->waiting_writers) && (flags & SPLICE_F_NONBLOCK))
 		ret = -EAGAIN;
 
 	pipe_unlock(ipipe);
diff -uriN linux-2.6.32.43/fs/stat.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/stat.c
--- linux-2.6.32.43/fs/stat.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/stat.c	2011-07-15 05:50:11.000000000 -0500
@@ -26,6 +26,7 @@
 	stat->nlink = inode->i_nlink;
 	stat->uid = inode->i_uid;
 	stat->gid = inode->i_gid;
+	stat->tag = inode->i_tag;
 	stat->rdev = inode->i_rdev;
 	stat->atime = inode->i_atime;
 	stat->mtime = inode->i_mtime;
diff -uriN linux-2.6.32.43/fs/super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/super.c
--- linux-2.6.32.43/fs/super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/super.c	2011-07-15 05:50:11.000000000 -0500
@@ -37,6 +37,9 @@
 #include <linux/kobject.h>
 #include <linux/mutex.h>
 #include <linux/file.h>
+#include <linux/devpts_fs.h>
+#include <linux/proc_fs.h>
+#include <linux/vs_context.h>
 #include <asm/uaccess.h>
 #include "internal.h"
 
@@ -914,12 +917,18 @@
 vfs_kern_mount(struct file_system_type *type, int flags, const char *name, void *data)
 {
 	struct vfsmount *mnt;
+	struct super_block *sb;
 	char *secdata = NULL;
 	int error;
 
 	if (!type)
 		return ERR_PTR(-ENODEV);
 
+	error = -EPERM;
+	if ((type->fs_flags & FS_BINARY_MOUNTDATA) &&
+		!vx_capable(CAP_SYS_ADMIN, VXC_BINARY_MOUNT))
+		goto out;
+
 	error = -ENOMEM;
 	mnt = alloc_vfsmnt(name);
 	if (!mnt)
@@ -938,9 +947,17 @@
 	error = type->get_sb(type, flags, name, data, mnt);
 	if (error < 0)
 		goto out_free_secdata;
-	BUG_ON(!mnt->mnt_sb);
 
- 	error = security_sb_kern_mount(mnt->mnt_sb, flags, secdata);
+	sb = mnt->mnt_sb;
+	BUG_ON(!sb);
+
+	error = -EPERM;
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_BINARY_MOUNT) && !sb->s_bdev &&
+		(sb->s_magic != PROC_SUPER_MAGIC) &&
+		(sb->s_magic != DEVPTS_SUPER_MAGIC))
+		goto out_sb;
+
+	error = security_sb_kern_mount(sb, flags, secdata);
  	if (error)
  		goto out_sb;
 
diff -uriN linux-2.6.32.43/fs/sysfs/file.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/sysfs/file.c
--- linux-2.6.32.43/fs/sysfs/file.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/sysfs/file.c	2011-07-15 05:51:18.000000000 -0500
@@ -44,7 +44,7 @@
 
 struct sysfs_open_dirent {
 	atomic_t		refcnt;
-	atomic_t		event;
+	atomic_unchecked_t	event;
 	wait_queue_head_t	poll;
 	struct list_head	buffers; /* goes through sysfs_buffer.list */
 };
@@ -53,7 +53,7 @@
 	size_t			count;
 	loff_t			pos;
 	char			* page;
-	struct sysfs_ops	* ops;
+	const struct sysfs_ops	* ops;
 	struct mutex		mutex;
 	int			needs_read_fill;
 	int			event;
@@ -75,7 +75,7 @@
 {
 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-	struct sysfs_ops * ops = buffer->ops;
+	const struct sysfs_ops * ops = buffer->ops;
 	int ret = 0;
 	ssize_t count;
 
@@ -88,7 +88,7 @@
 	if (!sysfs_get_active_two(attr_sd))
 		return -ENODEV;
 
-	buffer->event = atomic_read(&attr_sd->s_attr.open->event);
+	buffer->event = atomic_read_unchecked(&attr_sd->s_attr.open->event);
 	count = ops->show(kobj, attr_sd->s_attr.attr, buffer->page);
 
 	sysfs_put_active_two(attr_sd);
@@ -199,7 +199,7 @@
 {
 	struct sysfs_dirent *attr_sd = dentry->d_fsdata;
 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
-	struct sysfs_ops * ops = buffer->ops;
+	const struct sysfs_ops * ops = buffer->ops;
 	int rc;
 
 	/* need attr_sd for attr and ops, its parent for kobj */
@@ -294,7 +294,7 @@
 		return -ENOMEM;
 
 	atomic_set(&new_od->refcnt, 0);
-	atomic_set(&new_od->event, 1);
+	atomic_set_unchecked(&new_od->event, 1);
 	init_waitqueue_head(&new_od->poll);
 	INIT_LIST_HEAD(&new_od->buffers);
 	goto retry;
@@ -335,7 +335,7 @@
 	struct sysfs_dirent *attr_sd = file->f_path.dentry->d_fsdata;
 	struct kobject *kobj = attr_sd->s_parent->s_dir.kobj;
 	struct sysfs_buffer *buffer;
-	struct sysfs_ops *ops;
+	const struct sysfs_ops *ops;
 	int error = -EACCES;
 	char *p;
 
@@ -444,7 +444,7 @@
 
 	sysfs_put_active_two(attr_sd);
 
-	if (buffer->event != atomic_read(&od->event))
+	if (buffer->event != atomic_read_unchecked(&od->event))
 		goto trigger;
 
 	return DEFAULT_POLLMASK;
@@ -463,7 +463,7 @@
 
 	od = sd->s_attr.open;
 	if (od) {
-		atomic_inc(&od->event);
+		atomic_inc_unchecked(&od->event);
 		wake_up_interruptible(&od->poll);
 	}
 
diff -uriN linux-2.6.32.43/fs/sysfs/mount.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/sysfs/mount.c
--- linux-2.6.32.43/fs/sysfs/mount.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/sysfs/mount.c	2011-07-15 05:51:18.000000000 -0500
@@ -36,7 +36,11 @@
 	.s_name		= "",
 	.s_count	= ATOMIC_INIT(1),
 	.s_flags	= SYSFS_DIR,
+#ifdef CONFIG_GRKERNSEC_SYSFS_RESTRICT
+	.s_mode		= S_IFDIR | S_IRWXU,
+#else
 	.s_mode		= S_IFDIR | S_IRWXU | S_IRUGO | S_IXUGO,
+#endif
 	.s_ino		= 1,
 };
 
@@ -47,7 +51,7 @@
 
 	sb->s_blocksize = PAGE_CACHE_SIZE;
 	sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
-	sb->s_magic = SYSFS_MAGIC;
+	sb->s_magic = SYSFS_SUPER_MAGIC;
 	sb->s_op = &sysfs_ops;
 	sb->s_time_gran = 1;
 	sysfs_sb = sb;
diff -uriN linux-2.6.32.43/fs/sysfs/symlink.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/sysfs/symlink.c
--- linux-2.6.32.43/fs/sysfs/symlink.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/sysfs/symlink.c	2011-07-15 05:51:18.000000000 -0500
@@ -204,7 +204,7 @@
 
 static void sysfs_put_link(struct dentry *dentry, struct nameidata *nd, void *cookie)
 {
-	char *page = nd_get_link(nd);
+	const char *page = nd_get_link(nd);
 	if (!IS_ERR(page))
 		free_page((unsigned long)page);
 }
diff -uriN linux-2.6.32.43/fs/udf/balloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/udf/balloc.c
--- linux-2.6.32.43/fs/udf/balloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/udf/balloc.c	2011-07-15 05:51:18.000000000 -0500
@@ -172,9 +172,7 @@
 
 	mutex_lock(&sbi->s_alloc_mutex);
 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-	if (bloc->logicalBlockNum < 0 ||
-	    (bloc->logicalBlockNum + count) >
-		partmap->s_partition_len) {
+	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
 		udf_debug("%d < %d || %d + %d > %d\n",
 			  bloc->logicalBlockNum, 0, bloc->logicalBlockNum,
 			  count, partmap->s_partition_len);
@@ -436,9 +434,7 @@
 
 	mutex_lock(&sbi->s_alloc_mutex);
 	partmap = &sbi->s_partmaps[bloc->partitionReferenceNum];
-	if (bloc->logicalBlockNum < 0 ||
-	    (bloc->logicalBlockNum + count) >
-		partmap->s_partition_len) {
+	if ((bloc->logicalBlockNum + count) > partmap->s_partition_len) {
 		udf_debug("%d < %d || %d + %d > %d\n",
 			  bloc.logicalBlockNum, 0, bloc.logicalBlockNum, count,
 			  partmap->s_partition_len);
diff -uriN linux-2.6.32.43/fs/udf/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/udf/inode.c
--- linux-2.6.32.43/fs/udf/inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/udf/inode.c	2011-07-15 05:51:18.000000000 -0500
@@ -484,6 +484,8 @@
 	int goal = 0, pgoal = iinfo->i_location.logicalBlockNum;
 	int lastblock = 0;
 
+	pax_track_stack();
+
 	prev_epos.offset = udf_file_entry_alloc_offset(inode);
 	prev_epos.block = iinfo->i_location;
 	prev_epos.bh = NULL;
diff -uriN linux-2.6.32.43/fs/udf/misc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/udf/misc.c
--- linux-2.6.32.43/fs/udf/misc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/udf/misc.c	2011-07-15 05:51:18.000000000 -0500
@@ -286,7 +286,7 @@
 
 u8 udf_tag_checksum(const struct tag *t)
 {
-	u8 *data = (u8 *)t;
+	const u8 *data = (const u8 *)t;
 	u8 checksum = 0;
 	int i;
 	for (i = 0; i < sizeof(struct tag); ++i)
diff -uriN linux-2.6.32.43/fs/utimes.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/utimes.c
--- linux-2.6.32.43/fs/utimes.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/utimes.c	2011-07-15 05:51:18.000000000 -0500
@@ -1,6 +1,7 @@
 #include <linux/compiler.h>
 #include <linux/file.h>
 #include <linux/fs.h>
+#include <linux/security.h>
 #include <linux/linkage.h>
 #include <linux/mount.h>
 #include <linux/namei.h>
@@ -8,6 +9,8 @@
 #include <linux/stat.h>
 #include <linux/utime.h>
 #include <linux/syscalls.h>
+#include <linux/mount.h>
+#include <linux/vs_cowbl.h>
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
 
@@ -101,6 +104,12 @@
 				goto mnt_drop_write_and_out;
 		}
 	}
+
+	if (!gr_acl_handle_utime(path->dentry, path->mnt)) {
+		error = -EACCES;
+		goto mnt_drop_write_and_out;
+	}
+
 	mutex_lock(&inode->i_mutex);
 	error = notify_change(path->dentry, &newattrs);
 	mutex_unlock(&inode->i_mutex);
diff -uriN linux-2.6.32.43/fs/xattr_acl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xattr_acl.c
--- linux-2.6.32.43/fs/xattr_acl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xattr_acl.c	2011-07-15 05:51:18.000000000 -0500
@@ -17,8 +17,8 @@
 struct posix_acl *
 posix_acl_from_xattr(const void *value, size_t size)
 {
-	posix_acl_xattr_header *header = (posix_acl_xattr_header *)value;
-	posix_acl_xattr_entry *entry = (posix_acl_xattr_entry *)(header+1), *end;
+	const posix_acl_xattr_header *header = (const posix_acl_xattr_header *)value;
+	const posix_acl_xattr_entry *entry = (const posix_acl_xattr_entry *)(header+1), *end;
 	int count;
 	struct posix_acl *acl;
 	struct posix_acl_entry *acl_e;
diff -uriN linux-2.6.32.43/fs/xattr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xattr.c
--- linux-2.6.32.43/fs/xattr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xattr.c	2011-07-15 05:51:18.000000000 -0500
@@ -18,6 +18,7 @@
 #include <linux/module.h>
 #include <linux/fsnotify.h>
 #include <linux/audit.h>
+#include <linux/mount.h>
 #include <asm/uaccess.h>
 
 
@@ -49,7 +50,7 @@
 	 * The trusted.* namespace can only be accessed by a privileged user.
 	 */
 	if (!strncmp(name, XATTR_TRUSTED_PREFIX, XATTR_TRUSTED_PREFIX_LEN))
-		return (capable(CAP_SYS_ADMIN) ? 0 : -EPERM);
+		return (vx_capable(CAP_SYS_ADMIN, VXC_FS_TRUSTED) ? 0 : -EPERM);
 
 	/* In user.* namespace, only regular files and directories can have
 	 * extended attributes. For sticky directories, only the owner and
@@ -247,7 +248,7 @@
  * Extended attribute SET operations
  */
 static long
-setxattr(struct dentry *d, const char __user *name, const void __user *value,
+setxattr(struct path *path, const char __user *name, const void __user *value,
 	 size_t size, int flags)
 {
 	int error;
@@ -271,7 +272,13 @@
 			return PTR_ERR(kvalue);
 	}
 
-	error = vfs_setxattr(d, kname, kvalue, size, flags);
+	if (!gr_acl_handle_setxattr(path->dentry, path->mnt)) {
+		error = -EACCES;
+		goto out;
+	}
+
+	error = vfs_setxattr(path->dentry, kname, kvalue, size, flags);
+out:
 	kfree(kvalue);
 	return error;
 }
@@ -288,7 +295,7 @@
 		return error;
 	error = mnt_want_write(path.mnt);
 	if (!error) {
-		error = setxattr(path.dentry, name, value, size, flags);
+		error = setxattr(&path, name, value, size, flags);
 		mnt_drop_write(path.mnt);
 	}
 	path_put(&path);
@@ -307,7 +314,7 @@
 		return error;
 	error = mnt_want_write(path.mnt);
 	if (!error) {
-		error = setxattr(path.dentry, name, value, size, flags);
+		error = setxattr(&path, name, value, size, flags);
 		mnt_drop_write(path.mnt);
 	}
 	path_put(&path);
@@ -318,17 +325,15 @@
 		const void __user *,value, size_t, size, int, flags)
 {
 	struct file *f;
-	struct dentry *dentry;
 	int error = -EBADF;
 
 	f = fget(fd);
 	if (!f)
 		return error;
-	dentry = f->f_path.dentry;
-	audit_inode(NULL, dentry);
+	audit_inode(NULL, f->f_path.dentry);
 	error = mnt_want_write_file(f);
 	if (!error) {
-		error = setxattr(dentry, name, value, size, flags);
+		error = setxattr(&f->f_path, name, value, size, flags);
 		mnt_drop_write(f->f_path.mnt);
 	}
 	fput(f);
diff -uriN linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_ioctl32.c
--- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_ioctl32.c	2011-07-15 05:51:18.000000000 -0500
@@ -75,6 +75,7 @@
 	xfs_fsop_geom_t		  fsgeo;
 	int			  error;
 
+	memset(&fsgeo, 0, sizeof(fsgeo));
 	error = xfs_fs_geometry(mp, &fsgeo, 3);
 	if (error)
 		return -error;
diff -uriN linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_ioctl.c
--- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_ioctl.c	2011-07-15 05:51:18.000000000 -0500
@@ -34,7 +34,6 @@
 #include "xfs_dir2_sf.h"
 #include "xfs_dinode.h"
 #include "xfs_inode.h"
-#include "xfs_ioctl.h"
 #include "xfs_btree.h"
 #include "xfs_ialloc.h"
 #include "xfs_rtalloc.h"
@@ -134,7 +133,7 @@
 	}
 
 	error = -EFAULT;
-	if (copy_to_user(hreq->ohandle, &handle, hsize) ||
+	if (hsize > sizeof handle || copy_to_user(hreq->ohandle, &handle, hsize) ||
 	    copy_to_user(hreq->ohandlen, &hsize, sizeof(__s32)))
 		goto out_put;
 
@@ -423,7 +422,7 @@
 	if (IS_ERR(dentry))
 		return PTR_ERR(dentry);
 
-	kbuf = kmalloc(al_hreq.buflen, GFP_KERNEL);
+	kbuf = kzalloc(al_hreq.buflen, GFP_KERNEL);
 	if (!kbuf)
 		goto out_dput;
 
@@ -697,7 +696,7 @@
 	xfs_mount_t		*mp,
 	void			__user *arg)
 {
-	xfs_fsop_geom_t         fsgeo;
+	xfs_fsop_geom_t		fsgeo;
 	int			error;
 
 	error = xfs_fs_geometry(mp, &fsgeo, 3);
@@ -746,6 +745,10 @@
 		xflags |= XFS_XFLAG_IMMUTABLE;
 	else
 		xflags &= ~XFS_XFLAG_IMMUTABLE;
+	if (flags & FS_IXUNLINK_FL)
+		xflags |= XFS_XFLAG_IXUNLINK;
+	else
+		xflags &= ~XFS_XFLAG_IXUNLINK;
 	if (flags & FS_APPEND_FL)
 		xflags |= XFS_XFLAG_APPEND;
 	else
@@ -774,6 +777,8 @@
 
 	if (di_flags & XFS_DIFLAG_IMMUTABLE)
 		flags |= FS_IMMUTABLE_FL;
+	if (di_flags & XFS_DIFLAG_IXUNLINK)
+		flags |= FS_IXUNLINK_FL;
 	if (di_flags & XFS_DIFLAG_APPEND)
 		flags |= FS_APPEND_FL;
 	if (di_flags & XFS_DIFLAG_SYNC)
@@ -834,6 +839,8 @@
 	di_flags = (ip->i_d.di_flags & XFS_DIFLAG_PREALLOC);
 	if (xflags & XFS_XFLAG_IMMUTABLE)
 		di_flags |= XFS_DIFLAG_IMMUTABLE;
+	if (xflags & XFS_XFLAG_IXUNLINK)
+		di_flags |= XFS_DIFLAG_IXUNLINK;
 	if (xflags & XFS_XFLAG_APPEND)
 		di_flags |= XFS_DIFLAG_APPEND;
 	if (xflags & XFS_XFLAG_SYNC)
@@ -876,6 +883,10 @@
 		inode->i_flags |= S_IMMUTABLE;
 	else
 		inode->i_flags &= ~S_IMMUTABLE;
+	if (xflags & XFS_XFLAG_IXUNLINK)
+		inode->i_flags |= S_IXUNLINK;
+	else
+		inode->i_flags &= ~S_IXUNLINK;
 	if (xflags & XFS_XFLAG_APPEND)
 		inode->i_flags |= S_APPEND;
 	else
@@ -1352,10 +1363,18 @@
 	case XFS_IOC_FSGETXATTRA:
 		return xfs_ioc_fsgetxattr(ip, 1, arg);
 	case XFS_IOC_FSSETXATTR:
+		if (IS_BARRIER(inode)) {
+			vxwprintk_task(1, "messing with the barrier.");
+			return -XFS_ERROR(EACCES);
+		}
 		return xfs_ioc_fssetxattr(ip, filp, arg);
 	case XFS_IOC_GETXFLAGS:
 		return xfs_ioc_getxflags(ip, arg);
 	case XFS_IOC_SETXFLAGS:
+		if (IS_BARRIER(inode)) {
+			vxwprintk_task(1, "messing with the barrier.");
+			return -XFS_ERROR(EACCES);
+		}
 		return xfs_ioc_setxflags(ip, filp, arg);
 
 	case XFS_IOC_FSSETDM: {
diff -uriN linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_ioctl.h
--- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_ioctl.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_ioctl.h	2011-07-15 05:50:11.000000000 -0500
@@ -70,6 +70,12 @@
 	void __user		*uhandle,
 	u32			hlen);
 
+extern int
+xfs_sync_flags(
+	struct inode		*inode,
+	int			flags,
+	int			vflags);
+
 extern long
 xfs_file_ioctl(
 	struct file		*filp,
diff -uriN linux-2.6.32.43/fs/xfs/linux-2.6/xfs_iops.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_iops.c
--- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_iops.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_iops.c	2011-07-15 05:51:18.000000000 -0500
@@ -36,6 +36,7 @@
 #include "xfs_attr_sf.h"
 #include "xfs_dinode.h"
 #include "xfs_inode.h"
+#include "xfs_ioctl.h"
 #include "xfs_bmap.h"
 #include "xfs_btree.h"
 #include "xfs_ialloc.h"
@@ -55,6 +56,7 @@
 #include <linux/security.h>
 #include <linux/falloc.h>
 #include <linux/fiemap.h>
+#include <linux/vs_tag.h>
 
 /*
  * Bring the timestamps in the XFS inode uptodate.
@@ -468,7 +470,7 @@
 	struct nameidata *nd,
 	void		*p)
 {
-	char		*s = nd_get_link(nd);
+	const char	*s = nd_get_link(nd);
 
 	if (!IS_ERR(s))
 		kfree(s);
@@ -495,6 +497,7 @@
 	stat->nlink = ip->i_d.di_nlink;
 	stat->uid = ip->i_d.di_uid;
 	stat->gid = ip->i_d.di_gid;
+	stat->tag = ip->i_d.di_tag;
 	stat->ino = ip->i_ino;
 	stat->atime = inode->i_atime;
 	stat->mtime = inode->i_mtime;
@@ -686,6 +689,7 @@
 	.listxattr		= xfs_vn_listxattr,
 	.fallocate		= xfs_vn_fallocate,
 	.fiemap			= xfs_vn_fiemap,
+	.sync_flags		= xfs_sync_flags,
 };
 
 static const struct inode_operations xfs_dir_inode_operations = {
@@ -711,6 +715,7 @@
 	.getxattr		= generic_getxattr,
 	.removexattr		= generic_removexattr,
 	.listxattr		= xfs_vn_listxattr,
+	.sync_flags		= xfs_sync_flags,
 };
 
 static const struct inode_operations xfs_dir_ci_inode_operations = {
@@ -760,6 +765,10 @@
 		inode->i_flags |= S_IMMUTABLE;
 	else
 		inode->i_flags &= ~S_IMMUTABLE;
+	if (ip->i_d.di_flags & XFS_DIFLAG_IXUNLINK)
+		inode->i_flags |= S_IXUNLINK;
+	else
+		inode->i_flags &= ~S_IXUNLINK;
 	if (ip->i_d.di_flags & XFS_DIFLAG_APPEND)
 		inode->i_flags |= S_APPEND;
 	else
@@ -772,6 +781,15 @@
 		inode->i_flags |= S_NOATIME;
 	else
 		inode->i_flags &= ~S_NOATIME;
+
+	if (ip->i_d.di_vflags & XFS_DIVFLAG_BARRIER)
+		inode->i_vflags |= V_BARRIER;
+	else
+		inode->i_vflags &= ~V_BARRIER;
+	if (ip->i_d.di_vflags & XFS_DIVFLAG_COW)
+		inode->i_vflags |= V_COW;
+	else
+		inode->i_vflags &= ~V_COW;
 }
 
 /*
@@ -800,6 +818,7 @@
 	inode->i_nlink	= ip->i_d.di_nlink;
 	inode->i_uid	= ip->i_d.di_uid;
 	inode->i_gid	= ip->i_d.di_gid;
+	inode->i_tag    = ip->i_d.di_tag;
 
 	switch (inode->i_mode & S_IFMT) {
 	case S_IFBLK:
diff -uriN linux-2.6.32.43/fs/xfs/linux-2.6/xfs_linux.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_linux.h
--- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_linux.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_linux.h	2011-07-15 05:50:11.000000000 -0500
@@ -119,6 +119,7 @@
 
 #define current_cpu()		(raw_smp_processor_id())
 #define current_pid()		(current->pid)
+#define current_fstag(cred,vp)	(dx_current_fstag((vp)->i_sb))
 #define current_test_flags(f)	(current->flags & (f))
 #define current_set_flags_nested(sp, f)		\
 		(*(sp) = current->flags, current->flags |= (f))
diff -uriN linux-2.6.32.43/fs/xfs/linux-2.6/xfs_super.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_super.c
--- linux-2.6.32.43/fs/xfs/linux-2.6/xfs_super.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/linux-2.6/xfs_super.c	2011-07-15 05:50:11.000000000 -0500
@@ -117,6 +117,9 @@
 #define MNTOPT_DMAPI	"dmapi"		/* DMI enabled (DMAPI / XDSM) */
 #define MNTOPT_XDSM	"xdsm"		/* DMI enabled (DMAPI / XDSM) */
 #define MNTOPT_DMI	"dmi"		/* DMI enabled (DMAPI / XDSM) */
+#define MNTOPT_TAGXID	"tagxid"	/* context tagging for inodes */
+#define MNTOPT_TAGGED	"tag"		/* context tagging for inodes */
+#define MNTOPT_NOTAGTAG	"notag"		/* do not use context tagging */
 
 /*
  * Table driven mount option parser.
@@ -125,10 +128,14 @@
  * in the future, too.
  */
 enum {
+	Opt_tag, Opt_notag,
 	Opt_barrier, Opt_nobarrier, Opt_err
 };
 
 static const match_table_t tokens = {
+	{Opt_tag, "tagxid"},
+	{Opt_tag, "tag"},
+	{Opt_notag, "notag"},
 	{Opt_barrier, "barrier"},
 	{Opt_nobarrier, "nobarrier"},
 	{Opt_err, NULL}
@@ -382,6 +389,19 @@
 		} else if (!strcmp(this_char, "irixsgid")) {
 			cmn_err(CE_WARN,
 	"XFS: irixsgid is now a sysctl(2) variable, option is deprecated.");
+#ifndef CONFIG_TAGGING_NONE
+		} else if (!strcmp(this_char, MNTOPT_TAGGED)) {
+			mp->m_flags |= XFS_MOUNT_TAGGED;
+		} else if (!strcmp(this_char, MNTOPT_NOTAGTAG)) {
+			mp->m_flags &= ~XFS_MOUNT_TAGGED;
+		} else if (!strcmp(this_char, MNTOPT_TAGXID)) {
+			mp->m_flags |= XFS_MOUNT_TAGGED;
+#endif
+#ifdef CONFIG_PROPAGATE
+		} else if (!strcmp(this_char, MNTOPT_TAGGED)) {
+			/* use value */
+			mp->m_flags |= XFS_MOUNT_TAGGED;
+#endif
 		} else {
 			cmn_err(CE_WARN,
 				"XFS: unknown mount option [%s].", this_char);
@@ -1295,6 +1315,16 @@
 		case Opt_nobarrier:
 			mp->m_flags &= ~XFS_MOUNT_BARRIER;
 			break;
+		case Opt_tag:
+			if (!(sb->s_flags & MS_TAGGED)) {
+				printk(KERN_INFO
+					"XFS: %s: tagging not permitted on remount.\n",
+					sb->s_id);
+				return -EINVAL;
+			}
+			break;
+		case Opt_notag:
+			break;
 		default:
 			/*
 			 * Logically we would return an error here to prevent
@@ -1530,6 +1560,9 @@
 
 	XFS_SEND_MOUNT(mp, DM_RIGHT_NULL, mtpt, mp->m_fsname);
 
+	if (mp->m_flags & XFS_MOUNT_TAGGED)
+		sb->s_flags |= MS_TAGGED;
+
 	sb->s_magic = XFS_SB_MAGIC;
 	sb->s_blocksize = mp->m_sb.sb_blocksize;
 	sb->s_blocksize_bits = ffs(sb->s_blocksize) - 1;
diff -uriN linux-2.6.32.43/fs/xfs/xfs_bmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_bmap.c
--- linux-2.6.32.43/fs/xfs/xfs_bmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_bmap.c	2011-07-15 05:51:18.000000000 -0500
@@ -360,7 +360,7 @@
 	int			nmap,
 	int			ret_nmap);
 #else
-#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap)
+#define	xfs_bmap_validate_ret(bno,len,flags,mval,onmap,nmap) do {} while (0)
 #endif /* DEBUG */
 
 #if defined(XFS_RW_TRACE)
diff -uriN linux-2.6.32.43/fs/xfs/xfs_dinode.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_dinode.h
--- linux-2.6.32.43/fs/xfs/xfs_dinode.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_dinode.h	2011-07-15 05:50:11.000000000 -0500
@@ -50,7 +50,9 @@
 	__be32		di_gid;		/* owner's group id */
 	__be32		di_nlink;	/* number of links to file */
 	__be16		di_projid;	/* owner's project id */
-	__u8		di_pad[8];	/* unused, zeroed space */
+	__be16		di_tag;		/* context tagging */
+	__be16		di_vflags;	/* vserver specific flags */
+	__u8		di_pad[4];	/* unused, zeroed space */
 	__be16		di_flushiter;	/* incremented on flush */
 	xfs_timestamp_t	di_atime;	/* time last accessed */
 	xfs_timestamp_t	di_mtime;	/* time last modified */
@@ -183,6 +185,8 @@
 #define XFS_DIFLAG_EXTSZINHERIT_BIT 12	/* inherit inode extent size */
 #define XFS_DIFLAG_NODEFRAG_BIT     13	/* do not reorganize/defragment */
 #define XFS_DIFLAG_FILESTREAM_BIT   14  /* use filestream allocator */
+#define XFS_DIFLAG_IXUNLINK_BIT     15	/* Immutable inver on unlink */
+
 #define XFS_DIFLAG_REALTIME      (1 << XFS_DIFLAG_REALTIME_BIT)
 #define XFS_DIFLAG_PREALLOC      (1 << XFS_DIFLAG_PREALLOC_BIT)
 #define XFS_DIFLAG_NEWRTBM       (1 << XFS_DIFLAG_NEWRTBM_BIT)
@@ -198,6 +202,7 @@
 #define XFS_DIFLAG_EXTSZINHERIT  (1 << XFS_DIFLAG_EXTSZINHERIT_BIT)
 #define XFS_DIFLAG_NODEFRAG      (1 << XFS_DIFLAG_NODEFRAG_BIT)
 #define XFS_DIFLAG_FILESTREAM    (1 << XFS_DIFLAG_FILESTREAM_BIT)
+#define XFS_DIFLAG_IXUNLINK      (1 << XFS_DIFLAG_IXUNLINK_BIT)
 
 #ifdef CONFIG_XFS_RT
 #define XFS_IS_REALTIME_INODE(ip) ((ip)->i_d.di_flags & XFS_DIFLAG_REALTIME)
@@ -210,6 +215,10 @@
 	 XFS_DIFLAG_IMMUTABLE | XFS_DIFLAG_APPEND | XFS_DIFLAG_SYNC | \
 	 XFS_DIFLAG_NOATIME | XFS_DIFLAG_NODUMP | XFS_DIFLAG_RTINHERIT | \
 	 XFS_DIFLAG_PROJINHERIT | XFS_DIFLAG_NOSYMLINKS | XFS_DIFLAG_EXTSIZE | \
-	 XFS_DIFLAG_EXTSZINHERIT | XFS_DIFLAG_NODEFRAG | XFS_DIFLAG_FILESTREAM)
+	 XFS_DIFLAG_EXTSZINHERIT | XFS_DIFLAG_NODEFRAG | XFS_DIFLAG_FILESTREAM | \
+	 XFS_DIFLAG_IXUNLINK)
+
+#define XFS_DIVFLAG_BARRIER	0x01
+#define XFS_DIVFLAG_COW		0x02
 
 #endif	/* __XFS_DINODE_H__ */
diff -uriN linux-2.6.32.43/fs/xfs/xfs_dir2_sf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_dir2_sf.c
--- linux-2.6.32.43/fs/xfs/xfs_dir2_sf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_dir2_sf.c	2011-07-15 05:51:18.000000000 -0500
@@ -779,7 +779,15 @@
 		}
 
 		ino = xfs_dir2_sf_get_inumber(sfp, xfs_dir2_sf_inumberp(sfep));
-		if (filldir(dirent, sfep->name, sfep->namelen,
+		if (dp->i_df.if_u1.if_data == dp->i_df.if_u2.if_inline_data) {
+			char name[sfep->namelen];
+			memcpy(name, sfep->name, sfep->namelen);
+			if (filldir(dirent, name, sfep->namelen,
+			    off & 0x7fffffff, ino, DT_UNKNOWN)) {
+				*offset = off & 0x7fffffff;
+				return 0;
+			}
+		} else if (filldir(dirent, sfep->name, sfep->namelen,
 			    off & 0x7fffffff, ino, DT_UNKNOWN)) {
 			*offset = off & 0x7fffffff;
 			return 0;
diff -uriN linux-2.6.32.43/fs/xfs/xfs_fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_fs.h
--- linux-2.6.32.43/fs/xfs/xfs_fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_fs.h	2011-07-15 05:50:11.000000000 -0500
@@ -67,6 +67,9 @@
 #define XFS_XFLAG_EXTSZINHERIT	0x00001000	/* inherit inode extent size */
 #define XFS_XFLAG_NODEFRAG	0x00002000  	/* do not defragment */
 #define XFS_XFLAG_FILESTREAM	0x00004000	/* use filestream allocator */
+#define XFS_XFLAG_IXUNLINK	0x00008000	/* immutable invert on unlink */
+#define XFS_XFLAG_BARRIER	0x10000000	/* chroot() barrier */
+#define XFS_XFLAG_COW		0x20000000	/* copy on write mark */
 #define XFS_XFLAG_HASATTR	0x80000000	/* no DIFLAG for this	*/
 
 /*
@@ -292,7 +295,8 @@
 	__s32		bs_extents;	/* number of extents		*/
 	__u32		bs_gen;		/* generation count		*/
 	__u16		bs_projid;	/* project id			*/
-	unsigned char	bs_pad[14];	/* pad space, unused		*/
+	__u16		bs_tag;		/* context tagging		*/
+	unsigned char	bs_pad[12];	/* pad space, unused		*/
 	__u32		bs_dmevmask;	/* DMIG event mask		*/
 	__u16		bs_dmstate;	/* DMIG state info		*/
 	__u16		bs_aextents;	/* attribute number of extents	*/
diff -uriN linux-2.6.32.43/fs/xfs/xfs_ialloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_ialloc.c
--- linux-2.6.32.43/fs/xfs/xfs_ialloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_ialloc.c	2011-07-15 05:50:11.000000000 -0500
@@ -41,7 +41,6 @@
 #include "xfs_error.h"
 #include "xfs_bmap.h"
 
-
 /*
  * Allocation group level functions.
  */
diff -uriN linux-2.6.32.43/fs/xfs/xfs_inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_inode.c
--- linux-2.6.32.43/fs/xfs/xfs_inode.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -249,6 +249,7 @@
 	return 0;
 }
 
+#include <linux/vs_tag.h>
 
 /*
  * This routine is called to map an inode to the buffer containing
@@ -654,15 +655,25 @@
 STATIC void
 xfs_dinode_from_disk(
 	xfs_icdinode_t		*to,
-	xfs_dinode_t		*from)
+	xfs_dinode_t		*from,
+	int tagged)
 {
+	uint32_t uid, gid, tag;
+
 	to->di_magic = be16_to_cpu(from->di_magic);
 	to->di_mode = be16_to_cpu(from->di_mode);
 	to->di_version = from ->di_version;
 	to->di_format = from->di_format;
 	to->di_onlink = be16_to_cpu(from->di_onlink);
-	to->di_uid = be32_to_cpu(from->di_uid);
-	to->di_gid = be32_to_cpu(from->di_gid);
+
+	uid = be32_to_cpu(from->di_uid);
+	gid = be32_to_cpu(from->di_gid);
+	tag = be16_to_cpu(from->di_tag);
+
+	to->di_uid = INOTAG_UID(tagged, uid, gid);
+	to->di_gid = INOTAG_GID(tagged, uid, gid);
+	to->di_tag = INOTAG_TAG(tagged, uid, gid, tag);
+
 	to->di_nlink = be32_to_cpu(from->di_nlink);
 	to->di_projid = be16_to_cpu(from->di_projid);
 	memcpy(to->di_pad, from->di_pad, sizeof(to->di_pad));
@@ -683,21 +694,26 @@
 	to->di_dmevmask	= be32_to_cpu(from->di_dmevmask);
 	to->di_dmstate	= be16_to_cpu(from->di_dmstate);
 	to->di_flags	= be16_to_cpu(from->di_flags);
+	to->di_vflags	= be16_to_cpu(from->di_vflags);
 	to->di_gen	= be32_to_cpu(from->di_gen);
 }
 
 void
 xfs_dinode_to_disk(
 	xfs_dinode_t		*to,
-	xfs_icdinode_t		*from)
+	xfs_icdinode_t		*from,
+	int tagged)
 {
 	to->di_magic = cpu_to_be16(from->di_magic);
 	to->di_mode = cpu_to_be16(from->di_mode);
 	to->di_version = from ->di_version;
 	to->di_format = from->di_format;
 	to->di_onlink = cpu_to_be16(from->di_onlink);
-	to->di_uid = cpu_to_be32(from->di_uid);
-	to->di_gid = cpu_to_be32(from->di_gid);
+
+	to->di_uid = cpu_to_be32(TAGINO_UID(tagged, from->di_uid, from->di_tag));
+	to->di_gid = cpu_to_be32(TAGINO_GID(tagged, from->di_gid, from->di_tag));
+	to->di_tag = cpu_to_be16(TAGINO_TAG(tagged, from->di_tag));
+
 	to->di_nlink = cpu_to_be32(from->di_nlink);
 	to->di_projid = cpu_to_be16(from->di_projid);
 	memcpy(to->di_pad, from->di_pad, sizeof(to->di_pad));
@@ -718,12 +734,14 @@
 	to->di_dmevmask = cpu_to_be32(from->di_dmevmask);
 	to->di_dmstate = cpu_to_be16(from->di_dmstate);
 	to->di_flags = cpu_to_be16(from->di_flags);
+	to->di_vflags = cpu_to_be16(from->di_vflags);
 	to->di_gen = cpu_to_be32(from->di_gen);
 }
 
 STATIC uint
 _xfs_dic2xflags(
-	__uint16_t		di_flags)
+	__uint16_t		di_flags,
+	__uint16_t		di_vflags)
 {
 	uint			flags = 0;
 
@@ -734,6 +752,8 @@
 			flags |= XFS_XFLAG_PREALLOC;
 		if (di_flags & XFS_DIFLAG_IMMUTABLE)
 			flags |= XFS_XFLAG_IMMUTABLE;
+		if (di_flags & XFS_DIFLAG_IXUNLINK)
+			flags |= XFS_XFLAG_IXUNLINK;
 		if (di_flags & XFS_DIFLAG_APPEND)
 			flags |= XFS_XFLAG_APPEND;
 		if (di_flags & XFS_DIFLAG_SYNC)
@@ -758,6 +778,10 @@
 			flags |= XFS_XFLAG_FILESTREAM;
 	}
 
+	if (di_vflags & XFS_DIVFLAG_BARRIER)
+		flags |= FS_BARRIER_FL;
+	if (di_vflags & XFS_DIVFLAG_COW)
+		flags |= FS_COW_FL;
 	return flags;
 }
 
@@ -767,7 +791,7 @@
 {
 	xfs_icdinode_t		*dic = &ip->i_d;
 
-	return _xfs_dic2xflags(dic->di_flags) |
+	return _xfs_dic2xflags(dic->di_flags, dic->di_vflags) |
 				(XFS_IFORK_Q(ip) ? XFS_XFLAG_HASATTR : 0);
 }
 
@@ -775,7 +799,8 @@
 xfs_dic2xflags(
 	xfs_dinode_t		*dip)
 {
-	return _xfs_dic2xflags(be16_to_cpu(dip->di_flags)) |
+	return _xfs_dic2xflags(be16_to_cpu(dip->di_flags),
+				be16_to_cpu(dip->di_vflags)) |
 				(XFS_DFORK_Q(dip) ? XFS_XFLAG_HASATTR : 0);
 }
 
@@ -808,7 +833,6 @@
 	if (error)
 		return error;
 	dip = (xfs_dinode_t *)xfs_buf_offset(bp, ip->i_imap.im_boffset);
-
 	/*
 	 * If we got something that isn't an inode it means someone
 	 * (nfs or dmi) has a stale handle.
@@ -833,7 +857,8 @@
 	 * Otherwise, just get the truly permanent information.
 	 */
 	if (dip->di_mode) {
-		xfs_dinode_from_disk(&ip->i_d, dip);
+		xfs_dinode_from_disk(&ip->i_d, dip,
+			mp->m_flags & XFS_MOUNT_TAGGED);
 		error = xfs_iformat(ip, dip);
 		if (error)  {
 #ifdef DEBUG
@@ -1033,6 +1058,7 @@
 	ASSERT(ip->i_d.di_nlink == nlink);
 	ip->i_d.di_uid = current_fsuid();
 	ip->i_d.di_gid = current_fsgid();
+	ip->i_d.di_tag = current_fstag(cr, &ip->i_vnode);
 	ip->i_d.di_projid = prid;
 	memset(&(ip->i_d.di_pad[0]), 0, sizeof(ip->i_d.di_pad));
 
@@ -1093,6 +1119,7 @@
 	ip->i_d.di_dmevmask = 0;
 	ip->i_d.di_dmstate = 0;
 	ip->i_d.di_flags = 0;
+	ip->i_d.di_vflags = 0;
 	flags = XFS_ILOG_CORE;
 	switch (mode & S_IFMT) {
 	case S_IFIFO:
@@ -2169,6 +2196,7 @@
 	}
 	ip->i_d.di_mode = 0;		/* mark incore inode as free */
 	ip->i_d.di_flags = 0;
+	ip->i_d.di_vflags = 0;
 	ip->i_d.di_dmevmask = 0;
 	ip->i_d.di_forkoff = 0;		/* mark the attr fork not in use */
 	ip->i_df.if_ext_max =
@@ -3149,7 +3177,8 @@
 	 * because if the inode is dirty at all the core must
 	 * be.
 	 */
-	xfs_dinode_to_disk(dip, &ip->i_d);
+	xfs_dinode_to_disk(dip, &ip->i_d,
+		mp->m_flags & XFS_MOUNT_TAGGED);
 
 	/* Wrap, we never let the log put out DI_MAX_FLUSH */
 	if (ip->i_d.di_flushiter == DI_MAX_FLUSH)
diff -uriN linux-2.6.32.43/fs/xfs/xfs_inode.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_inode.h
--- linux-2.6.32.43/fs/xfs/xfs_inode.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_inode.h	2011-07-15 05:50:11.000000000 -0500
@@ -135,7 +135,9 @@
 	__uint32_t	di_gid;		/* owner's group id */
 	__uint32_t	di_nlink;	/* number of links to file */
 	__uint16_t	di_projid;	/* owner's project id */
-	__uint8_t	di_pad[8];	/* unused, zeroed space */
+	__uint16_t	di_tag;		/* context tagging */
+	__uint16_t	di_vflags;	/* vserver specific flags */
+	__uint8_t	di_pad[4];	/* unused, zeroed space */
 	__uint16_t	di_flushiter;	/* incremented on flush */
 	xfs_ictimestamp_t di_atime;	/* time last accessed */
 	xfs_ictimestamp_t di_mtime;	/* time last modified */
@@ -569,7 +571,7 @@
 int		xfs_iread(struct xfs_mount *, struct xfs_trans *,
 			  struct xfs_inode *, uint);
 void		xfs_dinode_to_disk(struct xfs_dinode *,
-				   struct xfs_icdinode *);
+				   struct xfs_icdinode *, int);
 void		xfs_idestroy_fork(struct xfs_inode *, int);
 void		xfs_idata_realloc(struct xfs_inode *, int, int);
 void		xfs_iroot_realloc(struct xfs_inode *, int, int);
diff -uriN linux-2.6.32.43/fs/xfs/xfs_itable.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_itable.c
--- linux-2.6.32.43/fs/xfs/xfs_itable.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_itable.c	2011-07-15 05:50:11.000000000 -0500
@@ -100,6 +100,7 @@
 	buf->bs_mode = dic->di_mode;
 	buf->bs_uid = dic->di_uid;
 	buf->bs_gid = dic->di_gid;
+	buf->bs_tag = dic->di_tag;
 	buf->bs_size = dic->di_size;
 
 	/*
diff -uriN linux-2.6.32.43/fs/xfs/xfs_log_recover.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_log_recover.c
--- linux-2.6.32.43/fs/xfs/xfs_log_recover.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_log_recover.c	2011-07-15 05:50:11.000000000 -0500
@@ -2467,7 +2467,8 @@
 	}
 
 	/* The core is in in-core format */
-	xfs_dinode_to_disk(dip, (xfs_icdinode_t *)item->ri_buf[1].i_addr);
+	xfs_dinode_to_disk(dip, (xfs_icdinode_t *)item->ri_buf[1].i_addr,
+		mp->m_flags & XFS_MOUNT_TAGGED);
 
 	/* the rest is in on-disk format */
 	if (item->ri_buf[1].i_len > sizeof(struct xfs_icdinode)) {
diff -uriN linux-2.6.32.43/fs/xfs/xfs_mount.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_mount.h
--- linux-2.6.32.43/fs/xfs/xfs_mount.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_mount.h	2011-07-15 05:50:11.000000000 -0500
@@ -285,6 +285,7 @@
 						   allocator */
 #define XFS_MOUNT_NOATTR2	(1ULL << 25)	/* disable use of attr2 format */
 
+#define XFS_MOUNT_TAGGED	(1ULL << 31)	/* context tagging */
 
 /*
  * Default minimum read and write sizes.
diff -uriN linux-2.6.32.43/fs/xfs/xfs_vnodeops.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_vnodeops.c
--- linux-2.6.32.43/fs/xfs/xfs_vnodeops.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_vnodeops.c	2011-07-15 05:50:11.000000000 -0500
@@ -54,6 +54,80 @@
 #include "xfs_filestream.h"
 #include "xfs_vnodeops.h"
 
+
+STATIC void
+xfs_get_inode_flags(
+	xfs_inode_t	*ip)
+{
+	struct inode 	*inode = VFS_I(ip);
+	unsigned int 	flags = inode->i_flags;
+	unsigned int 	vflags = inode->i_vflags;
+
+	if (flags & S_IMMUTABLE)
+		ip->i_d.di_flags |= XFS_DIFLAG_IMMUTABLE;
+	else
+		ip->i_d.di_flags &= ~XFS_DIFLAG_IMMUTABLE;
+	if (flags & S_IXUNLINK)
+		ip->i_d.di_flags |= XFS_DIFLAG_IXUNLINK;
+	else
+		ip->i_d.di_flags &= ~XFS_DIFLAG_IXUNLINK;
+
+	if (vflags & V_BARRIER)
+		ip->i_d.di_vflags |= XFS_DIVFLAG_BARRIER;
+	else
+		ip->i_d.di_vflags &= ~XFS_DIVFLAG_BARRIER;
+	if (vflags & V_COW)
+		ip->i_d.di_vflags |= XFS_DIVFLAG_COW;
+	else
+		ip->i_d.di_vflags &= ~XFS_DIVFLAG_COW;
+}
+
+int
+xfs_sync_flags(
+	struct inode		*inode,
+	int			flags,
+	int			vflags)
+{
+	struct xfs_inode	*ip = XFS_I(inode);
+	struct xfs_mount	*mp = ip->i_mount;
+	struct xfs_trans        *tp;
+	unsigned int		lock_flags = 0;
+	int			code;
+
+	tp = xfs_trans_alloc(mp, XFS_TRANS_SETATTR_NOT_SIZE);
+	code = xfs_trans_reserve(tp, 0, XFS_ICHANGE_LOG_RES(mp), 0, 0, 0);
+	if (code)
+		goto error_out;
+
+	lock_flags = XFS_ILOCK_EXCL;
+	xfs_ilock(ip, lock_flags);
+
+	xfs_trans_ijoin(tp, ip, lock_flags);
+	xfs_trans_ihold(tp, ip);
+
+	inode->i_flags = flags;
+	inode->i_vflags = vflags;
+	xfs_get_inode_flags(ip);
+
+	xfs_trans_log_inode(tp, ip, XFS_ILOG_CORE);
+	xfs_ichgtime(ip, XFS_ICHGTIME_CHG);
+
+	XFS_STATS_INC(xs_ig_attrchg);
+
+	if (mp->m_flags & XFS_MOUNT_WSYNC)
+		xfs_trans_set_sync(tp);
+	code = xfs_trans_commit(tp, 0);
+	xfs_iunlock(ip, lock_flags);
+	return code;
+
+error_out:
+	xfs_trans_cancel(tp, 0);
+	if (lock_flags)
+		xfs_iunlock(ip, lock_flags);
+	return code;
+}
+
+
 int
 xfs_setattr(
 	struct xfs_inode	*ip,
@@ -69,6 +143,7 @@
 	uint			commit_flags=0;
 	uid_t			uid=0, iuid=0;
 	gid_t			gid=0, igid=0;
+	tag_t			tag=0, itag=0;
 	struct xfs_dquot	*udqp, *gdqp, *olddquot1, *olddquot2;
 	int			need_iolock = 1;
 
@@ -161,7 +236,7 @@
 	/*
 	 * Change file ownership.  Must be the owner or privileged.
 	 */
-	if (mask & (ATTR_UID|ATTR_GID)) {
+	if (mask & (ATTR_UID|ATTR_GID|ATTR_TAG)) {
 		/*
 		 * These IDs could have changed since we last looked at them.
 		 * But, we're assured that if the ownership did change
@@ -170,8 +245,10 @@
 		 */
 		iuid = ip->i_d.di_uid;
 		igid = ip->i_d.di_gid;
+		itag = ip->i_d.di_tag;
 		gid = (mask & ATTR_GID) ? iattr->ia_gid : igid;
 		uid = (mask & ATTR_UID) ? iattr->ia_uid : iuid;
+		tag = (mask & ATTR_TAG) ? iattr->ia_tag : itag;
 
 		/*
 		 * Do a quota reservation only if uid/gid is actually
@@ -179,7 +256,8 @@
 		 */
 		if (XFS_IS_QUOTA_RUNNING(mp) &&
 		    ((XFS_IS_UQUOTA_ON(mp) && iuid != uid) ||
-		     (XFS_IS_GQUOTA_ON(mp) && igid != gid))) {
+		     (XFS_IS_GQUOTA_ON(mp) && igid != gid) ||
+		     (XFS_IS_GQUOTA_ON(mp) && itag != tag))) {
 			ASSERT(tp);
 			code = xfs_qm_vop_chown_reserve(tp, ip, udqp, gdqp,
 						capable(CAP_FOWNER) ?
@@ -340,7 +418,7 @@
 	/*
 	 * Change file ownership.  Must be the owner or privileged.
 	 */
-	if (mask & (ATTR_UID|ATTR_GID)) {
+	if (mask & (ATTR_UID|ATTR_GID|ATTR_TAG)) {
 		/*
 		 * CAP_FSETID overrides the following restrictions:
 		 *
@@ -356,6 +434,10 @@
 		 * Change the ownerships and register quota modifications
 		 * in the transaction.
 		 */
+		if (itag != tag) {
+			ip->i_d.di_tag = tag;
+			inode->i_tag = tag;
+		}
 		if (iuid != uid) {
 			if (XFS_IS_QUOTA_RUNNING(mp) && XFS_IS_UQUOTA_ON(mp)) {
 				ASSERT(mask & ATTR_UID);
diff -uriN linux-2.6.32.43/fs/xfs/xfs_vnodeops.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_vnodeops.h
--- linux-2.6.32.43/fs/xfs/xfs_vnodeops.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/fs/xfs/xfs_vnodeops.h	2011-07-15 05:50:11.000000000 -0500
@@ -14,6 +14,7 @@
 struct xfs_iomap;
 
 
+int xfs_sync_xflags(struct xfs_inode *ip);
 int xfs_setattr(struct xfs_inode *ip, struct iattr *vap, int flags);
 #define	XFS_ATTR_DMI		0x01	/* invocation from a DMI function */
 #define	XFS_ATTR_NONBLOCK	0x02	/* return EAGAIN if operation would block */
diff -uriN linux-2.6.32.43/grsecurity/gracl_alloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_alloc.c
--- linux-2.6.32.43/grsecurity/gracl_alloc.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_alloc.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,105 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/gracl.h>
+#include <linux/grsecurity.h>
+
+static unsigned long alloc_stack_next = 1;
+static unsigned long alloc_stack_size = 1;
+static void **alloc_stack;
+
+static __inline__ int
+alloc_pop(void)
+{
+	if (alloc_stack_next == 1)
+		return 0;
+
+	kfree(alloc_stack[alloc_stack_next - 2]);
+
+	alloc_stack_next--;
+
+	return 1;
+}
+
+static __inline__ int
+alloc_push(void *buf)
+{
+	if (alloc_stack_next >= alloc_stack_size)
+		return 1;
+
+	alloc_stack[alloc_stack_next - 1] = buf;
+
+	alloc_stack_next++;
+
+	return 0;
+}
+
+void *
+acl_alloc(unsigned long len)
+{
+	void *ret = NULL;
+
+	if (!len || len > PAGE_SIZE)
+		goto out;
+
+	ret = kmalloc(len, GFP_KERNEL);
+
+	if (ret) {
+		if (alloc_push(ret)) {
+			kfree(ret);
+			ret = NULL;
+		}
+	}
+
+out:
+	return ret;
+}
+
+void *
+acl_alloc_num(unsigned long num, unsigned long len)
+{
+	if (!len || (num > (PAGE_SIZE / len)))
+		return NULL;
+
+	return acl_alloc(num * len);
+}
+
+void
+acl_free_all(void)
+{
+	if (gr_acl_is_enabled() || !alloc_stack)
+		return;
+
+	while (alloc_pop()) ;
+
+	if (alloc_stack) {
+		if ((alloc_stack_size * sizeof (void *)) <= PAGE_SIZE)
+			kfree(alloc_stack);
+		else
+			vfree(alloc_stack);
+	}
+
+	alloc_stack = NULL;
+	alloc_stack_size = 1;
+	alloc_stack_next = 1;
+
+	return;
+}
+
+int
+acl_alloc_stack_init(unsigned long size)
+{
+	if ((size * sizeof (void *)) <= PAGE_SIZE)
+		alloc_stack =
+		    (void **) kmalloc(size * sizeof (void *), GFP_KERNEL);
+	else
+		alloc_stack = (void **) vmalloc(size * sizeof (void *));
+
+	alloc_stack_size = size;
+
+	if (!alloc_stack)
+		return 0;
+	else
+		return 1;
+}
diff -uriN linux-2.6.32.43/grsecurity/gracl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl.c
--- linux-2.6.32.43/grsecurity/gracl.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,4082 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/namei.h>
+#include <linux/mount.h>
+#include <linux/tty.h>
+#include <linux/proc_fs.h>
+#include <linux/smp_lock.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/types.h>
+#include <linux/sysctl.h>
+#include <linux/netdevice.h>
+#include <linux/ptrace.h>
+#include <linux/gracl.h>
+#include <linux/gralloc.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+#include <linux/pid_namespace.h>
+#include <linux/fdtable.h>
+#include <linux/percpu.h>
+
+#include <asm/uaccess.h>
+#include <asm/errno.h>
+#include <asm/mman.h>
+
+static struct acl_role_db acl_role_set;
+static struct name_db name_set;
+static struct inodev_db inodev_set;
+
+/* for keeping track of userspace pointers used for subjects, so we
+   can share references in the kernel as well
+*/
+
+static struct dentry *real_root;
+static struct vfsmount *real_root_mnt;
+
+static struct acl_subj_map_db subj_map_set;
+
+static struct acl_role_label *default_role;
+
+static struct acl_role_label *role_list;
+
+static u16 acl_sp_role_value;
+
+extern char *gr_shared_page[4];
+static DEFINE_MUTEX(gr_dev_mutex);
+DEFINE_RWLOCK(gr_inode_lock);
+
+struct gr_arg *gr_usermode;
+
+static unsigned int gr_status __read_only = GR_STATUS_INIT;
+
+extern int chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum);
+extern void gr_clear_learn_entries(void);
+
+#ifdef CONFIG_GRKERNSEC_RESLOG
+extern void gr_log_resource(const struct task_struct *task,
+			    const int res, const unsigned long wanted, const int gt);
+#endif
+
+unsigned char *gr_system_salt;
+unsigned char *gr_system_sum;
+
+static struct sprole_pw **acl_special_roles = NULL;
+static __u16 num_sprole_pws = 0;
+
+static struct acl_role_label *kernel_role = NULL;
+
+static unsigned int gr_auth_attempts = 0;
+static unsigned long gr_auth_expires = 0UL;
+
+#ifdef CONFIG_NET
+extern struct vfsmount *sock_mnt;
+#endif
+extern struct vfsmount *pipe_mnt;
+extern struct vfsmount *shm_mnt;
+#ifdef CONFIG_HUGETLBFS
+extern struct vfsmount *hugetlbfs_vfsmount;
+#endif
+
+static struct acl_object_label *fakefs_obj_rw;
+static struct acl_object_label *fakefs_obj_rwx;
+
+extern int gr_init_uidset(void);
+extern void gr_free_uidset(void);
+extern void gr_remove_uid(uid_t uid);
+extern int gr_find_uid(uid_t uid);
+
+__inline__ int
+gr_acl_is_enabled(void)
+{
+	return (gr_status & GR_READY);
+}
+
+#ifdef CONFIG_BTRFS_FS
+extern dev_t get_btrfs_dev_from_inode(struct inode *inode);
+extern int btrfs_getattr(struct vfsmount *mnt, struct dentry *dentry, struct kstat *stat);
+#endif
+
+static inline dev_t __get_dev(const struct dentry *dentry)
+{
+#ifdef CONFIG_BTRFS_FS
+	if (dentry->d_inode->i_op && dentry->d_inode->i_op->getattr == &btrfs_getattr)
+		return get_btrfs_dev_from_inode(dentry->d_inode);
+	else
+#endif
+		return dentry->d_inode->i_sb->s_dev;
+}
+
+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
+{
+	return __get_dev(dentry);
+}
+
+static char gr_task_roletype_to_char(struct task_struct *task)
+{
+	switch (task->role->roletype &
+		(GR_ROLE_DEFAULT | GR_ROLE_USER | GR_ROLE_GROUP |
+		 GR_ROLE_SPECIAL)) {
+	case GR_ROLE_DEFAULT:
+		return 'D';
+	case GR_ROLE_USER:
+		return 'U';
+	case GR_ROLE_GROUP:
+		return 'G';
+	case GR_ROLE_SPECIAL:
+		return 'S';
+	}
+
+	return 'X';
+}
+
+char gr_roletype_to_char(void)
+{
+	return gr_task_roletype_to_char(current);
+}
+
+__inline__ int
+gr_acl_tpe_check(void)
+{
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+	if (current->role->roletype & GR_ROLE_TPE)
+		return 1;
+	else
+		return 0;
+}
+
+int
+gr_handle_rawio(const struct inode *inode)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
+	if (inode && S_ISBLK(inode->i_mode) &&
+	    grsec_enable_chroot_caps && proc_is_chrooted(current) &&
+	    !capable(CAP_SYS_RAWIO))
+		return 1;
+#endif
+	return 0;
+}
+
+static int
+gr_streq(const char *a, const char *b, const unsigned int lena, const unsigned int lenb)
+{
+	if (likely(lena != lenb))
+		return 0;
+
+	return !memcmp(a, b, lena);
+}
+
+/* this must be called with vfsmount_lock and dcache_lock held */
+
+static char * __our_d_path(struct dentry *dentry, struct vfsmount *vfsmnt,
+	                   struct dentry *root, struct vfsmount *rootmnt,
+			   char *buffer, int buflen)
+{
+	char * end = buffer+buflen;
+	char * retval;
+	int namelen;
+
+	*--end = '\0';
+	buflen--;
+
+	if (buflen < 1)
+		goto Elong;
+	/* Get '/' right */
+	retval = end-1;
+	*retval = '/';
+
+	for (;;) {
+		struct dentry * parent;
+
+		if (dentry == root && vfsmnt == rootmnt)
+			break;
+		if (dentry == vfsmnt->mnt_root || IS_ROOT(dentry)) {
+			/* Global root? */
+			if (vfsmnt->mnt_parent == vfsmnt)
+				goto global_root;
+			dentry = vfsmnt->mnt_mountpoint;
+			vfsmnt = vfsmnt->mnt_parent;
+			continue;
+		}
+		parent = dentry->d_parent;
+		prefetch(parent);
+		namelen = dentry->d_name.len;
+		buflen -= namelen + 1;
+		if (buflen < 0)
+			goto Elong;
+		end -= namelen;
+		memcpy(end, dentry->d_name.name, namelen);
+		*--end = '/';
+		retval = end;
+		dentry = parent;
+	}
+
+out:
+	return retval;
+
+global_root:
+	namelen = dentry->d_name.len;
+	buflen -= namelen;
+	if (buflen < 0)
+		goto Elong;
+	retval -= namelen-1;	/* hit the slash */
+	memcpy(retval, dentry->d_name.name, namelen);
+	goto out;
+Elong:
+	retval = ERR_PTR(-ENAMETOOLONG);
+	goto out;
+}
+
+static char *
+gen_full_path(struct dentry *dentry, struct vfsmount *vfsmnt,
+              struct dentry *root, struct vfsmount *rootmnt, char *buf, int buflen)
+{
+	char *retval;
+
+	retval = __our_d_path(dentry, vfsmnt, root, rootmnt, buf, buflen);
+	if (unlikely(IS_ERR(retval)))
+		retval = strcpy(buf, "<path too long>");
+	else if (unlikely(retval[1] == '/' && retval[2] == '\0'))
+		retval[1] = '\0';
+
+	return retval;
+}
+
+static char *
+__d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
+		char *buf, int buflen)
+{
+	char *res;
+
+	/* we can use real_root, real_root_mnt, because this is only called
+	   by the RBAC system */
+	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, real_root, real_root_mnt, buf, buflen);
+
+	return res;
+}
+
+static char *
+d_real_path(const struct dentry *dentry, const struct vfsmount *vfsmnt,
+	    char *buf, int buflen)
+{
+	char *res;
+	struct dentry *root;
+	struct vfsmount *rootmnt;
+	struct task_struct *reaper = &init_task;
+
+	/* we can't use real_root, real_root_mnt, because they belong only to the RBAC system */
+	read_lock(&reaper->fs->lock);
+	root = dget(reaper->fs->root.dentry);
+	rootmnt = mntget(reaper->fs->root.mnt);
+	read_unlock(&reaper->fs->lock);
+
+	spin_lock(&dcache_lock);
+	spin_lock(&vfsmount_lock);
+	res = gen_full_path((struct dentry *)dentry, (struct vfsmount *)vfsmnt, root, rootmnt, buf, buflen);
+	spin_unlock(&vfsmount_lock);
+	spin_unlock(&dcache_lock);
+
+	dput(root);
+	mntput(rootmnt);
+	return res;
+}
+
+static char *
+gr_to_filename_rbac(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	char *ret;
+	spin_lock(&dcache_lock);
+	spin_lock(&vfsmount_lock);
+	ret = __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
+			     PAGE_SIZE);
+	spin_unlock(&vfsmount_lock);
+	spin_unlock(&dcache_lock);
+	return ret;
+}
+
+char *
+gr_to_filename_nolock(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return __d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0],smp_processor_id()),
+			     PAGE_SIZE);
+}
+
+char *
+gr_to_filename(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
+			   PAGE_SIZE);
+}
+
+char *
+gr_to_filename1(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[1], smp_processor_id()),
+			   PAGE_SIZE);
+}
+
+char *
+gr_to_filename2(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[2], smp_processor_id()),
+			   PAGE_SIZE);
+}
+
+char *
+gr_to_filename3(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[3], smp_processor_id()),
+			   PAGE_SIZE);
+}
+
+__inline__ __u32
+to_gr_audit(const __u32 reqmode)
+{
+	/* masks off auditable permission flags, then shifts them to create
+	   auditing flags, and adds the special case of append auditing if
+	   we're requesting write */
+	return (((reqmode & ~GR_AUDITS) << 10) | ((reqmode & GR_WRITE) ? GR_AUDIT_APPEND : 0));
+}
+
+struct acl_subject_label *
+lookup_subject_map(const struct acl_subject_label *userp)
+{
+	unsigned int index = shash(userp, subj_map_set.s_size);
+	struct subject_map *match;
+
+	match = subj_map_set.s_hash[index];
+
+	while (match && match->user != userp)
+		match = match->next;
+
+	if (match != NULL)
+		return match->kernel;
+	else
+		return NULL;
+}
+
+static void
+insert_subj_map_entry(struct subject_map *subjmap)
+{
+	unsigned int index = shash(subjmap->user, subj_map_set.s_size);
+	struct subject_map **curr;
+
+	subjmap->prev = NULL;
+
+	curr = &subj_map_set.s_hash[index];
+	if (*curr != NULL)
+		(*curr)->prev = subjmap;
+
+	subjmap->next = *curr;
+	*curr = subjmap;
+
+	return;
+}
+
+static struct acl_role_label *
+lookup_acl_role_label(const struct task_struct *task, const uid_t uid,
+		      const gid_t gid)
+{
+	unsigned int index = rhash(uid, GR_ROLE_USER, acl_role_set.r_size);
+	struct acl_role_label *match;
+	struct role_allowed_ip *ipp;
+	unsigned int x;
+	u32 curr_ip = task->signal->curr_ip;
+
+	task->signal->saved_ip = curr_ip;
+
+	match = acl_role_set.r_hash[index];
+
+	while (match) {
+		if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_USER)) == (GR_ROLE_DOMAIN | GR_ROLE_USER)) {
+			for (x = 0; x < match->domain_child_num; x++) {
+				if (match->domain_children[x] == uid)
+					goto found;
+			}
+		} else if (match->uidgid == uid && match->roletype & GR_ROLE_USER)
+			break;
+		match = match->next;
+	}
+found:
+	if (match == NULL) {
+	      try_group:
+		index = rhash(gid, GR_ROLE_GROUP, acl_role_set.r_size);
+		match = acl_role_set.r_hash[index];
+
+		while (match) {
+			if ((match->roletype & (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) == (GR_ROLE_DOMAIN | GR_ROLE_GROUP)) {
+				for (x = 0; x < match->domain_child_num; x++) {
+					if (match->domain_children[x] == gid)
+						goto found2;
+				}
+			} else if (match->uidgid == gid && match->roletype & GR_ROLE_GROUP)
+				break;
+			match = match->next;
+		}
+found2:
+		if (match == NULL)
+			match = default_role;
+		if (match->allowed_ips == NULL)
+			return match;
+		else {
+			for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
+				if (likely
+				    ((ntohl(curr_ip) & ipp->netmask) ==
+				     (ntohl(ipp->addr) & ipp->netmask)))
+					return match;
+			}
+			match = default_role;
+		}
+	} else if (match->allowed_ips == NULL) {
+		return match;
+	} else {
+		for (ipp = match->allowed_ips; ipp; ipp = ipp->next) {
+			if (likely
+			    ((ntohl(curr_ip) & ipp->netmask) ==
+			     (ntohl(ipp->addr) & ipp->netmask)))
+				return match;
+		}
+		goto try_group;
+	}
+
+	return match;
+}
+
+struct acl_subject_label *
+lookup_acl_subj_label(const ino_t ino, const dev_t dev,
+		      const struct acl_role_label *role)
+{
+	unsigned int index = fhash(ino, dev, role->subj_hash_size);
+	struct acl_subject_label *match;
+
+	match = role->subj_hash[index];
+
+	while (match && (match->inode != ino || match->device != dev ||
+	       (match->mode & GR_DELETED))) {
+		match = match->next;
+	}
+
+	if (match && !(match->mode & GR_DELETED))
+		return match;
+	else
+		return NULL;
+}
+
+struct acl_subject_label *
+lookup_acl_subj_label_deleted(const ino_t ino, const dev_t dev,
+			  const struct acl_role_label *role)
+{
+	unsigned int index = fhash(ino, dev, role->subj_hash_size);
+	struct acl_subject_label *match;
+
+	match = role->subj_hash[index];
+
+	while (match && (match->inode != ino || match->device != dev ||
+	       !(match->mode & GR_DELETED))) {
+		match = match->next;
+	}
+
+	if (match && (match->mode & GR_DELETED))
+		return match;
+	else
+		return NULL;
+}
+
+static struct acl_object_label *
+lookup_acl_obj_label(const ino_t ino, const dev_t dev,
+		     const struct acl_subject_label *subj)
+{
+	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
+	struct acl_object_label *match;
+
+	match = subj->obj_hash[index];
+
+	while (match && (match->inode != ino || match->device != dev ||
+	       (match->mode & GR_DELETED))) {
+		match = match->next;
+	}
+
+	if (match && !(match->mode & GR_DELETED))
+		return match;
+	else
+		return NULL;
+}
+
+static struct acl_object_label *
+lookup_acl_obj_label_create(const ino_t ino, const dev_t dev,
+		     const struct acl_subject_label *subj)
+{
+	unsigned int index = fhash(ino, dev, subj->obj_hash_size);
+	struct acl_object_label *match;
+
+	match = subj->obj_hash[index];
+
+	while (match && (match->inode != ino || match->device != dev ||
+	       !(match->mode & GR_DELETED))) {
+		match = match->next;
+	}
+
+	if (match && (match->mode & GR_DELETED))
+		return match;
+
+	match = subj->obj_hash[index];
+
+	while (match && (match->inode != ino || match->device != dev ||
+	       (match->mode & GR_DELETED))) {
+		match = match->next;
+	}
+
+	if (match && !(match->mode & GR_DELETED))
+		return match;
+	else
+		return NULL;
+}
+
+static struct name_entry *
+lookup_name_entry(const char *name)
+{
+	unsigned int len = strlen(name);
+	unsigned int key = full_name_hash(name, len);
+	unsigned int index = key % name_set.n_size;
+	struct name_entry *match;
+
+	match = name_set.n_hash[index];
+
+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len)))
+		match = match->next;
+
+	return match;
+}
+
+static struct name_entry *
+lookup_name_entry_create(const char *name)
+{
+	unsigned int len = strlen(name);
+	unsigned int key = full_name_hash(name, len);
+	unsigned int index = key % name_set.n_size;
+	struct name_entry *match;
+
+	match = name_set.n_hash[index];
+
+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
+			 !match->deleted))
+		match = match->next;
+
+	if (match && match->deleted)
+		return match;
+
+	match = name_set.n_hash[index];
+
+	while (match && (match->key != key || !gr_streq(match->name, name, match->len, len) ||
+			 match->deleted))
+		match = match->next;
+
+	if (match && !match->deleted)
+		return match;
+	else
+		return NULL;
+}
+
+static struct inodev_entry *
+lookup_inodev_entry(const ino_t ino, const dev_t dev)
+{
+	unsigned int index = fhash(ino, dev, inodev_set.i_size);
+	struct inodev_entry *match;
+
+	match = inodev_set.i_hash[index];
+
+	while (match && (match->nentry->inode != ino || match->nentry->device != dev))
+		match = match->next;
+
+	return match;
+}
+
+static void
+insert_inodev_entry(struct inodev_entry *entry)
+{
+	unsigned int index = fhash(entry->nentry->inode, entry->nentry->device,
+				    inodev_set.i_size);
+	struct inodev_entry **curr;
+
+	entry->prev = NULL;
+
+	curr = &inodev_set.i_hash[index];
+	if (*curr != NULL)
+		(*curr)->prev = entry;
+	
+	entry->next = *curr;
+	*curr = entry;
+
+	return;
+}
+
+static void
+__insert_acl_role_label(struct acl_role_label *role, uid_t uidgid)
+{
+	unsigned int index =
+	    rhash(uidgid, role->roletype & (GR_ROLE_USER | GR_ROLE_GROUP), acl_role_set.r_size);
+	struct acl_role_label **curr;
+	struct acl_role_label *tmp;
+
+	curr = &acl_role_set.r_hash[index];
+
+	/* if role was already inserted due to domains and already has
+	   a role in the same bucket as it attached, then we need to
+	   combine these two buckets
+	*/
+	if (role->next) {
+		tmp = role->next;
+		while (tmp->next)
+			tmp = tmp->next;
+		tmp->next = *curr;
+	} else
+		role->next = *curr;
+	*curr = role;
+
+	return;
+}
+
+static void
+insert_acl_role_label(struct acl_role_label *role)
+{
+	int i;
+
+	if (role_list == NULL) {
+		role_list = role;
+		role->prev = NULL;
+	} else {
+		role->prev = role_list;
+		role_list = role;
+	}
+	
+	/* used for hash chains */
+	role->next = NULL;
+
+	if (role->roletype & GR_ROLE_DOMAIN) {
+		for (i = 0; i < role->domain_child_num; i++)
+			__insert_acl_role_label(role, role->domain_children[i]);
+	} else
+		__insert_acl_role_label(role, role->uidgid);
+}
+					
+static int
+insert_name_entry(char *name, const ino_t inode, const dev_t device, __u8 deleted)
+{
+	struct name_entry **curr, *nentry;
+	struct inodev_entry *ientry;
+	unsigned int len = strlen(name);
+	unsigned int key = full_name_hash(name, len);
+	unsigned int index = key % name_set.n_size;
+
+	curr = &name_set.n_hash[index];
+
+	while (*curr && ((*curr)->key != key || !gr_streq((*curr)->name, name, (*curr)->len, len)))
+		curr = &((*curr)->next);
+
+	if (*curr != NULL)
+		return 1;
+
+	nentry = acl_alloc(sizeof (struct name_entry));
+	if (nentry == NULL)
+		return 0;
+	ientry = acl_alloc(sizeof (struct inodev_entry));
+	if (ientry == NULL)
+		return 0;
+	ientry->nentry = nentry;
+
+	nentry->key = key;
+	nentry->name = name;
+	nentry->inode = inode;
+	nentry->device = device;
+	nentry->len = len;
+	nentry->deleted = deleted;
+
+	nentry->prev = NULL;
+	curr = &name_set.n_hash[index];
+	if (*curr != NULL)
+		(*curr)->prev = nentry;
+	nentry->next = *curr;
+	*curr = nentry;
+
+	/* insert us into the table searchable by inode/dev */
+	insert_inodev_entry(ientry);
+
+	return 1;
+}
+
+static void
+insert_acl_obj_label(struct acl_object_label *obj,
+		     struct acl_subject_label *subj)
+{
+	unsigned int index =
+	    fhash(obj->inode, obj->device, subj->obj_hash_size);
+	struct acl_object_label **curr;
+
+	
+	obj->prev = NULL;
+
+	curr = &subj->obj_hash[index];
+	if (*curr != NULL)
+		(*curr)->prev = obj;
+
+	obj->next = *curr;
+	*curr = obj;
+
+	return;
+}
+
+static void
+insert_acl_subj_label(struct acl_subject_label *obj,
+		      struct acl_role_label *role)
+{
+	unsigned int index = fhash(obj->inode, obj->device, role->subj_hash_size);
+	struct acl_subject_label **curr;
+
+	obj->prev = NULL;
+
+	curr = &role->subj_hash[index];
+	if (*curr != NULL)
+		(*curr)->prev = obj;
+
+	obj->next = *curr;
+	*curr = obj;
+
+	return;
+}
+
+/* allocating chained hash tables, so optimal size is where lambda ~ 1 */
+
+static void *
+create_table(__u32 * len, int elementsize)
+{
+	unsigned int table_sizes[] = {
+		7, 13, 31, 61, 127, 251, 509, 1021, 2039, 4093, 8191, 16381,
+		32749, 65521, 131071, 262139, 524287, 1048573, 2097143,
+		4194301, 8388593, 16777213, 33554393, 67108859
+	};
+	void *newtable = NULL;
+	unsigned int pwr = 0;
+
+	while ((pwr < ((sizeof (table_sizes) / sizeof (table_sizes[0])) - 1)) &&
+	       table_sizes[pwr] <= *len)
+		pwr++;
+
+	if (table_sizes[pwr] <= *len || (table_sizes[pwr] > ULONG_MAX / elementsize))
+		return newtable;
+
+	if ((table_sizes[pwr] * elementsize) <= PAGE_SIZE)
+		newtable =
+		    kmalloc(table_sizes[pwr] * elementsize, GFP_KERNEL);
+	else
+		newtable = vmalloc(table_sizes[pwr] * elementsize);
+
+	*len = table_sizes[pwr];
+
+	return newtable;
+}
+
+static int
+init_variables(const struct gr_arg *arg)
+{
+	struct task_struct *reaper = &init_task;
+	unsigned int stacksize;
+
+	subj_map_set.s_size = arg->role_db.num_subjects;
+	acl_role_set.r_size = arg->role_db.num_roles + arg->role_db.num_domain_children;
+	name_set.n_size = arg->role_db.num_objects;
+	inodev_set.i_size = arg->role_db.num_objects;
+
+	if (!subj_map_set.s_size || !acl_role_set.r_size ||
+	    !name_set.n_size || !inodev_set.i_size)
+		return 1;
+
+	if (!gr_init_uidset())
+		return 1;
+
+	/* set up the stack that holds allocation info */
+
+	stacksize = arg->role_db.num_pointers + 5;
+
+	if (!acl_alloc_stack_init(stacksize))
+		return 1;
+
+	/* grab reference for the real root dentry and vfsmount */
+	read_lock(&reaper->fs->lock);
+	real_root = dget(reaper->fs->root.dentry);
+	real_root_mnt = mntget(reaper->fs->root.mnt);
+	read_unlock(&reaper->fs->lock);
+	
+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
+	printk(KERN_ALERT "Obtained real root device=%d, inode=%lu\n", __get_dev(real_root), real_root->d_inode->i_ino);
+#endif
+
+	fakefs_obj_rw = acl_alloc(sizeof(struct acl_object_label));
+	if (fakefs_obj_rw == NULL)
+		return 1;
+	fakefs_obj_rw->mode = GR_FIND | GR_READ | GR_WRITE;
+
+	fakefs_obj_rwx = acl_alloc(sizeof(struct acl_object_label));
+	if (fakefs_obj_rwx == NULL)
+		return 1;
+	fakefs_obj_rwx->mode = GR_FIND | GR_READ | GR_WRITE | GR_EXEC;
+
+	subj_map_set.s_hash =
+	    (struct subject_map **) create_table(&subj_map_set.s_size, sizeof(void *));
+	acl_role_set.r_hash =
+	    (struct acl_role_label **) create_table(&acl_role_set.r_size, sizeof(void *));
+	name_set.n_hash = (struct name_entry **) create_table(&name_set.n_size, sizeof(void *));
+	inodev_set.i_hash =
+	    (struct inodev_entry **) create_table(&inodev_set.i_size, sizeof(void *));
+
+	if (!subj_map_set.s_hash || !acl_role_set.r_hash ||
+	    !name_set.n_hash || !inodev_set.i_hash)
+		return 1;
+
+	memset(subj_map_set.s_hash, 0,
+	       sizeof(struct subject_map *) * subj_map_set.s_size);
+	memset(acl_role_set.r_hash, 0,
+	       sizeof (struct acl_role_label *) * acl_role_set.r_size);
+	memset(name_set.n_hash, 0,
+	       sizeof (struct name_entry *) * name_set.n_size);
+	memset(inodev_set.i_hash, 0,
+	       sizeof (struct inodev_entry *) * inodev_set.i_size);
+
+	return 0;
+}
+
+/* free information not needed after startup
+   currently contains user->kernel pointer mappings for subjects
+*/
+
+static void
+free_init_variables(void)
+{
+	__u32 i;
+
+	if (subj_map_set.s_hash) {
+		for (i = 0; i < subj_map_set.s_size; i++) {
+			if (subj_map_set.s_hash[i]) {
+				kfree(subj_map_set.s_hash[i]);
+				subj_map_set.s_hash[i] = NULL;
+			}
+		}
+
+		if ((subj_map_set.s_size * sizeof (struct subject_map *)) <=
+		    PAGE_SIZE)
+			kfree(subj_map_set.s_hash);
+		else
+			vfree(subj_map_set.s_hash);
+	}
+
+	return;
+}
+
+static void
+free_variables(void)
+{
+	struct acl_subject_label *s;
+	struct acl_role_label *r;
+	struct task_struct *task, *task2;
+	unsigned int x;
+
+	gr_clear_learn_entries();
+
+	read_lock(&tasklist_lock);
+	do_each_thread(task2, task) {
+		task->acl_sp_role = 0;
+		task->acl_role_id = 0;
+		task->acl = NULL;
+		task->role = NULL;
+	} while_each_thread(task2, task);
+	read_unlock(&tasklist_lock);
+
+	/* release the reference to the real root dentry and vfsmount */
+	if (real_root)
+		dput(real_root);
+	real_root = NULL;
+	if (real_root_mnt)
+		mntput(real_root_mnt);
+	real_root_mnt = NULL;
+
+	/* free all object hash tables */
+
+	FOR_EACH_ROLE_START(r)
+		if (r->subj_hash == NULL)
+			goto next_role;
+		FOR_EACH_SUBJECT_START(r, s, x)
+			if (s->obj_hash == NULL)
+				break;
+			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
+				kfree(s->obj_hash);
+			else
+				vfree(s->obj_hash);
+		FOR_EACH_SUBJECT_END(s, x)
+		FOR_EACH_NESTED_SUBJECT_START(r, s)
+			if (s->obj_hash == NULL)
+				break;
+			if ((s->obj_hash_size * sizeof (struct acl_object_label *)) <= PAGE_SIZE)
+				kfree(s->obj_hash);
+			else
+				vfree(s->obj_hash);
+		FOR_EACH_NESTED_SUBJECT_END(s)
+		if ((r->subj_hash_size * sizeof (struct acl_subject_label *)) <= PAGE_SIZE)
+			kfree(r->subj_hash);
+		else
+			vfree(r->subj_hash);
+		r->subj_hash = NULL;
+next_role:
+	FOR_EACH_ROLE_END(r)
+
+	acl_free_all();
+
+	if (acl_role_set.r_hash) {
+		if ((acl_role_set.r_size * sizeof (struct acl_role_label *)) <=
+		    PAGE_SIZE)
+			kfree(acl_role_set.r_hash);
+		else
+			vfree(acl_role_set.r_hash);
+	}
+	if (name_set.n_hash) {
+		if ((name_set.n_size * sizeof (struct name_entry *)) <=
+		    PAGE_SIZE)
+			kfree(name_set.n_hash);
+		else
+			vfree(name_set.n_hash);
+	}
+
+	if (inodev_set.i_hash) {
+		if ((inodev_set.i_size * sizeof (struct inodev_entry *)) <=
+		    PAGE_SIZE)
+			kfree(inodev_set.i_hash);
+		else
+			vfree(inodev_set.i_hash);
+	}
+
+	gr_free_uidset();
+
+	memset(&name_set, 0, sizeof (struct name_db));
+	memset(&inodev_set, 0, sizeof (struct inodev_db));
+	memset(&acl_role_set, 0, sizeof (struct acl_role_db));
+	memset(&subj_map_set, 0, sizeof (struct acl_subj_map_db));
+
+	default_role = NULL;
+	role_list = NULL;
+
+	return;
+}
+
+static __u32
+count_user_objs(struct acl_object_label *userp)
+{
+	struct acl_object_label o_tmp;
+	__u32 num = 0;
+
+	while (userp) {
+		if (copy_from_user(&o_tmp, userp,
+				   sizeof (struct acl_object_label)))
+			break;
+
+		userp = o_tmp.prev;
+		num++;
+	}
+
+	return num;
+}
+
+static struct acl_subject_label *
+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role);
+
+static int
+copy_user_glob(struct acl_object_label *obj)
+{
+	struct acl_object_label *g_tmp, **guser;
+	unsigned int len;
+	char *tmp;
+
+	if (obj->globbed == NULL)
+		return 0;
+
+	guser = &obj->globbed;
+	while (*guser) {
+		g_tmp = (struct acl_object_label *)
+			acl_alloc(sizeof (struct acl_object_label));
+		if (g_tmp == NULL)
+			return -ENOMEM;
+
+		if (copy_from_user(g_tmp, *guser,
+				   sizeof (struct acl_object_label)))
+			return -EFAULT;
+
+		len = strnlen_user(g_tmp->filename, PATH_MAX);
+
+		if (!len || len >= PATH_MAX)
+			return -EINVAL;
+
+		if ((tmp = (char *) acl_alloc(len)) == NULL)
+			return -ENOMEM;
+
+		if (copy_from_user(tmp, g_tmp->filename, len))
+			return -EFAULT;
+		tmp[len-1] = '\0';
+		g_tmp->filename = tmp;
+
+		*guser = g_tmp;
+		guser = &(g_tmp->next);
+	}
+
+	return 0;
+}
+
+static int
+copy_user_objs(struct acl_object_label *userp, struct acl_subject_label *subj,
+	       struct acl_role_label *role)
+{
+	struct acl_object_label *o_tmp;
+	unsigned int len;
+	int ret;
+	char *tmp;
+
+	while (userp) {
+		if ((o_tmp = (struct acl_object_label *)
+		     acl_alloc(sizeof (struct acl_object_label))) == NULL)
+			return -ENOMEM;
+
+		if (copy_from_user(o_tmp, userp,
+				   sizeof (struct acl_object_label)))
+			return -EFAULT;
+
+		userp = o_tmp->prev;
+
+		len = strnlen_user(o_tmp->filename, PATH_MAX);
+
+		if (!len || len >= PATH_MAX)
+			return -EINVAL;
+
+		if ((tmp = (char *) acl_alloc(len)) == NULL)
+			return -ENOMEM;
+
+		if (copy_from_user(tmp, o_tmp->filename, len))
+			return -EFAULT;
+		tmp[len-1] = '\0';
+		o_tmp->filename = tmp;
+
+		insert_acl_obj_label(o_tmp, subj);
+		if (!insert_name_entry(o_tmp->filename, o_tmp->inode,
+				       o_tmp->device, (o_tmp->mode & GR_DELETED) ? 1 : 0))
+			return -ENOMEM;
+
+		ret = copy_user_glob(o_tmp);
+		if (ret)
+			return ret;
+
+		if (o_tmp->nested) {
+			o_tmp->nested = do_copy_user_subj(o_tmp->nested, role);
+			if (IS_ERR(o_tmp->nested))
+				return PTR_ERR(o_tmp->nested);
+
+			/* insert into nested subject list */
+			o_tmp->nested->next = role->hash->first;
+			role->hash->first = o_tmp->nested;
+		}
+	}
+
+	return 0;
+}
+
+static __u32
+count_user_subjs(struct acl_subject_label *userp)
+{
+	struct acl_subject_label s_tmp;
+	__u32 num = 0;
+
+	while (userp) {
+		if (copy_from_user(&s_tmp, userp,
+				   sizeof (struct acl_subject_label)))
+			break;
+
+		userp = s_tmp.prev;
+		/* do not count nested subjects against this count, since
+		   they are not included in the hash table, but are
+		   attached to objects.  We have already counted
+		   the subjects in userspace for the allocation 
+		   stack
+		*/
+		if (!(s_tmp.mode & GR_NESTED))
+			num++;
+	}
+
+	return num;
+}
+
+static int
+copy_user_allowedips(struct acl_role_label *rolep)
+{
+	struct role_allowed_ip *ruserip, *rtmp = NULL, *rlast;
+
+	ruserip = rolep->allowed_ips;
+
+	while (ruserip) {
+		rlast = rtmp;
+
+		if ((rtmp = (struct role_allowed_ip *)
+		     acl_alloc(sizeof (struct role_allowed_ip))) == NULL)
+			return -ENOMEM;
+
+		if (copy_from_user(rtmp, ruserip,
+				   sizeof (struct role_allowed_ip)))
+			return -EFAULT;
+
+		ruserip = rtmp->prev;
+
+		if (!rlast) {
+			rtmp->prev = NULL;
+			rolep->allowed_ips = rtmp;
+		} else {
+			rlast->next = rtmp;
+			rtmp->prev = rlast;
+		}
+
+		if (!ruserip)
+			rtmp->next = NULL;
+	}
+
+	return 0;
+}
+
+static int
+copy_user_transitions(struct acl_role_label *rolep)
+{
+	struct role_transition *rusertp, *rtmp = NULL, *rlast;
+	
+	unsigned int len;
+	char *tmp;
+
+	rusertp = rolep->transitions;
+
+	while (rusertp) {
+		rlast = rtmp;
+
+		if ((rtmp = (struct role_transition *)
+		     acl_alloc(sizeof (struct role_transition))) == NULL)
+			return -ENOMEM;
+
+		if (copy_from_user(rtmp, rusertp,
+				   sizeof (struct role_transition)))
+			return -EFAULT;
+
+		rusertp = rtmp->prev;
+
+		len = strnlen_user(rtmp->rolename, GR_SPROLE_LEN);
+
+		if (!len || len >= GR_SPROLE_LEN)
+			return -EINVAL;
+
+		if ((tmp = (char *) acl_alloc(len)) == NULL)
+			return -ENOMEM;
+
+		if (copy_from_user(tmp, rtmp->rolename, len))
+			return -EFAULT;
+		tmp[len-1] = '\0';
+		rtmp->rolename = tmp;
+
+		if (!rlast) {
+			rtmp->prev = NULL;
+			rolep->transitions = rtmp;
+		} else {
+			rlast->next = rtmp;
+			rtmp->prev = rlast;
+		}
+
+		if (!rusertp)
+			rtmp->next = NULL;
+	}
+
+	return 0;
+}
+
+static struct acl_subject_label *
+do_copy_user_subj(struct acl_subject_label *userp, struct acl_role_label *role)
+{
+	struct acl_subject_label *s_tmp = NULL, *s_tmp2;
+	unsigned int len;
+	char *tmp;
+	__u32 num_objs;
+	struct acl_ip_label **i_tmp, *i_utmp2;
+	struct gr_hash_struct ghash;
+	struct subject_map *subjmap;
+	unsigned int i_num;
+	int err;
+
+	s_tmp = lookup_subject_map(userp);
+
+	/* we've already copied this subject into the kernel, just return
+	   the reference to it, and don't copy it over again
+	*/
+	if (s_tmp)
+		return(s_tmp);
+
+	if ((s_tmp = (struct acl_subject_label *)
+	    acl_alloc(sizeof (struct acl_subject_label))) == NULL)
+		return ERR_PTR(-ENOMEM);
+
+	subjmap = (struct subject_map *)kmalloc(sizeof (struct subject_map), GFP_KERNEL);
+	if (subjmap == NULL)
+		return ERR_PTR(-ENOMEM);
+
+	subjmap->user = userp;
+	subjmap->kernel = s_tmp;
+	insert_subj_map_entry(subjmap);
+
+	if (copy_from_user(s_tmp, userp,
+			   sizeof (struct acl_subject_label)))
+		return ERR_PTR(-EFAULT);
+
+	len = strnlen_user(s_tmp->filename, PATH_MAX);
+
+	if (!len || len >= PATH_MAX)
+		return ERR_PTR(-EINVAL);
+
+	if ((tmp = (char *) acl_alloc(len)) == NULL)
+		return ERR_PTR(-ENOMEM);
+
+	if (copy_from_user(tmp, s_tmp->filename, len))
+		return ERR_PTR(-EFAULT);
+	tmp[len-1] = '\0';
+	s_tmp->filename = tmp;
+
+	if (!strcmp(s_tmp->filename, "/"))
+		role->root_label = s_tmp;
+
+	if (copy_from_user(&ghash, s_tmp->hash, sizeof(struct gr_hash_struct)))
+		return ERR_PTR(-EFAULT);
+
+	/* copy user and group transition tables */
+
+	if (s_tmp->user_trans_num) {
+		uid_t *uidlist;
+
+		uidlist = (uid_t *)acl_alloc_num(s_tmp->user_trans_num, sizeof(uid_t));
+		if (uidlist == NULL)
+			return ERR_PTR(-ENOMEM);
+		if (copy_from_user(uidlist, s_tmp->user_transitions, s_tmp->user_trans_num * sizeof(uid_t)))
+			return ERR_PTR(-EFAULT);
+
+		s_tmp->user_transitions = uidlist;
+	}
+
+	if (s_tmp->group_trans_num) {
+		gid_t *gidlist;
+
+		gidlist = (gid_t *)acl_alloc_num(s_tmp->group_trans_num, sizeof(gid_t));
+		if (gidlist == NULL)
+			return ERR_PTR(-ENOMEM);
+		if (copy_from_user(gidlist, s_tmp->group_transitions, s_tmp->group_trans_num * sizeof(gid_t)))
+			return ERR_PTR(-EFAULT);
+
+		s_tmp->group_transitions = gidlist;
+	}
+
+	/* set up object hash table */
+	num_objs = count_user_objs(ghash.first);
+
+	s_tmp->obj_hash_size = num_objs;
+	s_tmp->obj_hash =
+	    (struct acl_object_label **)
+	    create_table(&(s_tmp->obj_hash_size), sizeof(void *));
+
+	if (!s_tmp->obj_hash)
+		return ERR_PTR(-ENOMEM);
+
+	memset(s_tmp->obj_hash, 0,
+	       s_tmp->obj_hash_size *
+	       sizeof (struct acl_object_label *));
+
+	/* add in objects */
+	err = copy_user_objs(ghash.first, s_tmp, role);
+
+	if (err)
+		return ERR_PTR(err);
+
+	/* set pointer for parent subject */
+	if (s_tmp->parent_subject) {
+		s_tmp2 = do_copy_user_subj(s_tmp->parent_subject, role);
+
+		if (IS_ERR(s_tmp2))
+			return s_tmp2;
+
+		s_tmp->parent_subject = s_tmp2;
+	}
+
+	/* add in ip acls */
+
+	if (!s_tmp->ip_num) {
+		s_tmp->ips = NULL;
+		goto insert;
+	}
+
+	i_tmp =
+	    (struct acl_ip_label **) acl_alloc_num(s_tmp->ip_num,
+					       sizeof (struct acl_ip_label *));
+
+	if (!i_tmp)
+		return ERR_PTR(-ENOMEM);
+
+	for (i_num = 0; i_num < s_tmp->ip_num; i_num++) {
+		*(i_tmp + i_num) =
+		    (struct acl_ip_label *)
+		    acl_alloc(sizeof (struct acl_ip_label));
+		if (!*(i_tmp + i_num))
+			return ERR_PTR(-ENOMEM);
+
+		if (copy_from_user
+		    (&i_utmp2, s_tmp->ips + i_num,
+		     sizeof (struct acl_ip_label *)))
+			return ERR_PTR(-EFAULT);
+
+		if (copy_from_user
+		    (*(i_tmp + i_num), i_utmp2,
+		     sizeof (struct acl_ip_label)))
+			return ERR_PTR(-EFAULT);
+		
+		if ((*(i_tmp + i_num))->iface == NULL)
+			continue;
+
+		len = strnlen_user((*(i_tmp + i_num))->iface, IFNAMSIZ);
+		if (!len || len >= IFNAMSIZ)
+			return ERR_PTR(-EINVAL);
+		tmp = acl_alloc(len);
+		if (tmp == NULL)
+			return ERR_PTR(-ENOMEM);
+		if (copy_from_user(tmp, (*(i_tmp + i_num))->iface, len))
+			return ERR_PTR(-EFAULT);
+		(*(i_tmp + i_num))->iface = tmp;
+	}
+
+	s_tmp->ips = i_tmp;
+
+insert:
+	if (!insert_name_entry(s_tmp->filename, s_tmp->inode,
+			       s_tmp->device, (s_tmp->mode & GR_DELETED) ? 1 : 0))
+		return ERR_PTR(-ENOMEM);
+
+	return s_tmp;
+}
+
+static int
+copy_user_subjs(struct acl_subject_label *userp, struct acl_role_label *role)
+{
+	struct acl_subject_label s_pre;
+	struct acl_subject_label * ret;
+	int err;
+
+	while (userp) {
+		if (copy_from_user(&s_pre, userp,
+				   sizeof (struct acl_subject_label)))
+			return -EFAULT;
+		
+		/* do not add nested subjects here, add
+		   while parsing objects
+		*/
+
+		if (s_pre.mode & GR_NESTED) {
+			userp = s_pre.prev;
+			continue;
+		}
+
+		ret = do_copy_user_subj(userp, role);
+
+		err = PTR_ERR(ret);
+		if (IS_ERR(ret))
+			return err;
+
+		insert_acl_subj_label(ret, role);
+
+		userp = s_pre.prev;
+	}
+
+	return 0;
+}
+
+static int
+copy_user_acl(struct gr_arg *arg)
+{
+	struct acl_role_label *r_tmp = NULL, **r_utmp, *r_utmp2;
+	struct sprole_pw *sptmp;
+	struct gr_hash_struct *ghash;
+	uid_t *domainlist;
+	unsigned int r_num;
+	unsigned int len;
+	char *tmp;
+	int err = 0;
+	__u16 i;
+	__u32 num_subjs;
+
+	/* we need a default and kernel role */
+	if (arg->role_db.num_roles < 2)
+		return -EINVAL;
+
+	/* copy special role authentication info from userspace */
+
+	num_sprole_pws = arg->num_sprole_pws;
+	acl_special_roles = (struct sprole_pw **) acl_alloc_num(num_sprole_pws, sizeof(struct sprole_pw *));
+
+	if (!acl_special_roles) {
+		err = -ENOMEM;
+		goto cleanup;
+	}
+
+	for (i = 0; i < num_sprole_pws; i++) {
+		sptmp = (struct sprole_pw *) acl_alloc(sizeof(struct sprole_pw));
+		if (!sptmp) {
+			err = -ENOMEM;
+			goto cleanup;
+		}
+		if (copy_from_user(sptmp, arg->sprole_pws + i,
+				   sizeof (struct sprole_pw))) {
+			err = -EFAULT;
+			goto cleanup;
+		}
+
+		len =
+		    strnlen_user(sptmp->rolename, GR_SPROLE_LEN);
+
+		if (!len || len >= GR_SPROLE_LEN) {
+			err = -EINVAL;
+			goto cleanup;
+		}
+
+		if ((tmp = (char *) acl_alloc(len)) == NULL) {
+			err = -ENOMEM;
+			goto cleanup;
+		}
+
+		if (copy_from_user(tmp, sptmp->rolename, len)) {
+			err = -EFAULT;
+			goto cleanup;
+		}
+		tmp[len-1] = '\0';
+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
+		printk(KERN_ALERT "Copying special role %s\n", tmp);
+#endif
+		sptmp->rolename = tmp;
+		acl_special_roles[i] = sptmp;
+	}
+
+	r_utmp = (struct acl_role_label **) arg->role_db.r_table;
+
+	for (r_num = 0; r_num < arg->role_db.num_roles; r_num++) {
+		r_tmp = acl_alloc(sizeof (struct acl_role_label));
+
+		if (!r_tmp) {
+			err = -ENOMEM;
+			goto cleanup;
+		}
+
+		if (copy_from_user(&r_utmp2, r_utmp + r_num,
+				   sizeof (struct acl_role_label *))) {
+			err = -EFAULT;
+			goto cleanup;
+		}
+
+		if (copy_from_user(r_tmp, r_utmp2,
+				   sizeof (struct acl_role_label))) {
+			err = -EFAULT;
+			goto cleanup;
+		}
+
+		len = strnlen_user(r_tmp->rolename, GR_SPROLE_LEN);
+
+		if (!len || len >= PATH_MAX) {
+			err = -EINVAL;
+			goto cleanup;
+		}
+
+		if ((tmp = (char *) acl_alloc(len)) == NULL) {
+			err = -ENOMEM;
+			goto cleanup;
+		}
+		if (copy_from_user(tmp, r_tmp->rolename, len)) {
+			err = -EFAULT;
+			goto cleanup;
+		}
+		tmp[len-1] = '\0';
+		r_tmp->rolename = tmp;
+
+		if (!strcmp(r_tmp->rolename, "default")
+		    && (r_tmp->roletype & GR_ROLE_DEFAULT)) {
+			default_role = r_tmp;
+		} else if (!strcmp(r_tmp->rolename, ":::kernel:::")) {
+			kernel_role = r_tmp;
+		}
+
+		if ((ghash = (struct gr_hash_struct *) acl_alloc(sizeof(struct gr_hash_struct))) == NULL) {
+			err = -ENOMEM;
+			goto cleanup;
+		}
+		if (copy_from_user(ghash, r_tmp->hash, sizeof(struct gr_hash_struct))) {
+			err = -EFAULT;
+			goto cleanup;
+		}
+
+		r_tmp->hash = ghash;
+
+		num_subjs = count_user_subjs(r_tmp->hash->first);
+
+		r_tmp->subj_hash_size = num_subjs;
+		r_tmp->subj_hash =
+		    (struct acl_subject_label **)
+		    create_table(&(r_tmp->subj_hash_size), sizeof(void *));
+
+		if (!r_tmp->subj_hash) {
+			err = -ENOMEM;
+			goto cleanup;
+		}
+
+		err = copy_user_allowedips(r_tmp);
+		if (err)
+			goto cleanup;
+
+		/* copy domain info */
+		if (r_tmp->domain_children != NULL) {
+			domainlist = acl_alloc_num(r_tmp->domain_child_num, sizeof(uid_t));
+			if (domainlist == NULL) {
+				err = -ENOMEM;
+				goto cleanup;
+			}
+			if (copy_from_user(domainlist, r_tmp->domain_children, r_tmp->domain_child_num * sizeof(uid_t))) {
+				err = -EFAULT;
+				goto cleanup;
+			}
+			r_tmp->domain_children = domainlist;
+		}
+
+		err = copy_user_transitions(r_tmp);
+		if (err)
+			goto cleanup;
+
+		memset(r_tmp->subj_hash, 0,
+		       r_tmp->subj_hash_size *
+		       sizeof (struct acl_subject_label *));
+
+		err = copy_user_subjs(r_tmp->hash->first, r_tmp);
+
+		if (err)
+			goto cleanup;
+
+		/* set nested subject list to null */
+		r_tmp->hash->first = NULL;
+
+		insert_acl_role_label(r_tmp);
+	}
+
+	goto return_err;
+      cleanup:
+	free_variables();
+      return_err:
+	return err;
+
+}
+
+static int
+gracl_init(struct gr_arg *args)
+{
+	int error = 0;
+
+	memcpy(gr_system_salt, args->salt, GR_SALT_LEN);
+	memcpy(gr_system_sum, args->sum, GR_SHA_LEN);
+
+	if (init_variables(args)) {
+		gr_log_str(GR_DONT_AUDIT_GOOD, GR_INITF_ACL_MSG, GR_VERSION);
+		error = -ENOMEM;
+		free_variables();
+		goto out;
+	}
+
+	error = copy_user_acl(args);
+	free_init_variables();
+	if (error) {
+		free_variables();
+		goto out;
+	}
+
+	if ((error = gr_set_acls(0))) {
+		free_variables();
+		goto out;
+	}
+
+	pax_open_kernel();
+	gr_status |= GR_READY;
+	pax_close_kernel();
+
+      out:
+	return error;
+}
+
+/* derived from glibc fnmatch() 0: match, 1: no match*/
+
+static int
+glob_match(const char *p, const char *n)
+{
+	char c;
+
+	while ((c = *p++) != '\0') {
+	switch (c) {
+		case '?':
+			if (*n == '\0')
+				return 1;
+			else if (*n == '/')
+				return 1;
+			break;
+		case '\\':
+			if (*n != c)
+				return 1;
+			break;
+		case '*':
+			for (c = *p++; c == '?' || c == '*'; c = *p++) {
+				if (*n == '/')
+					return 1;
+				else if (c == '?') {
+					if (*n == '\0')
+						return 1;
+					else
+						++n;
+				}
+			}
+			if (c == '\0') {
+				return 0;
+			} else {
+				const char *endp;
+
+				if ((endp = strchr(n, '/')) == NULL)
+					endp = n + strlen(n);
+
+				if (c == '[') {
+					for (--p; n < endp; ++n)
+						if (!glob_match(p, n))
+							return 0;
+				} else if (c == '/') {
+					while (*n != '\0' && *n != '/')
+						++n;
+					if (*n == '/' && !glob_match(p, n + 1))
+						return 0;
+				} else {
+					for (--p; n < endp; ++n)
+						if (*n == c && !glob_match(p, n))
+							return 0;
+				}
+
+				return 1;
+			}
+		case '[':
+			{
+			int not;
+			char cold;
+
+			if (*n == '\0' || *n == '/')
+				return 1;
+
+			not = (*p == '!' || *p == '^');
+			if (not)
+				++p;
+
+			c = *p++;
+			for (;;) {
+				unsigned char fn = (unsigned char)*n;
+
+				if (c == '\0')
+					return 1;
+				else {
+					if (c == fn)
+						goto matched;
+					cold = c;
+					c = *p++;
+
+					if (c == '-' && *p != ']') {
+						unsigned char cend = *p++;
+
+						if (cend == '\0')
+							return 1;
+
+						if (cold <= fn && fn <= cend)
+							goto matched;
+
+						c = *p++;
+					}
+				}
+
+				if (c == ']')
+					break;
+			}
+			if (!not)
+				return 1;
+			break;
+		matched:
+			while (c != ']') {
+				if (c == '\0')
+					return 1;
+
+				c = *p++;
+			}
+			if (not)
+				return 1;
+		}
+		break;
+	default:
+		if (c != *n)
+			return 1;
+	}
+
+	++n;
+	}
+
+	if (*n == '\0')
+		return 0;
+
+	if (*n == '/')
+		return 0;
+
+	return 1;
+}
+
+static struct acl_object_label *
+chk_glob_label(struct acl_object_label *globbed,
+	struct dentry *dentry, struct vfsmount *mnt, char **path)
+{
+	struct acl_object_label *tmp;
+
+	if (*path == NULL)
+		*path = gr_to_filename_nolock(dentry, mnt);
+
+	tmp = globbed;
+
+	while (tmp) {
+		if (!glob_match(tmp->filename, *path))
+			return tmp;
+		tmp = tmp->next;
+	}
+
+	return NULL;
+}
+
+static struct acl_object_label *
+__full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
+	    const ino_t curr_ino, const dev_t curr_dev,
+	    const struct acl_subject_label *subj, char **path, const int checkglob)
+{
+	struct acl_subject_label *tmpsubj;
+	struct acl_object_label *retval;
+	struct acl_object_label *retval2;
+
+	tmpsubj = (struct acl_subject_label *) subj;
+	read_lock(&gr_inode_lock);
+	do {
+		retval = lookup_acl_obj_label(curr_ino, curr_dev, tmpsubj);
+		if (retval) {
+			if (checkglob && retval->globbed) {
+				retval2 = chk_glob_label(retval->globbed, (struct dentry *)orig_dentry,
+						(struct vfsmount *)orig_mnt, path);
+				if (retval2)
+					retval = retval2;
+			}
+			break;
+		}
+	} while ((tmpsubj = tmpsubj->parent_subject));
+	read_unlock(&gr_inode_lock);
+
+	return retval;
+}
+
+static __inline__ struct acl_object_label *
+full_lookup(const struct dentry *orig_dentry, const struct vfsmount *orig_mnt,
+	    const struct dentry *curr_dentry,
+	    const struct acl_subject_label *subj, char **path, const int checkglob)
+{
+	int newglob = checkglob;
+
+	/* if we aren't checking a subdirectory of the original path yet, don't do glob checking
+	   as we don't want a / * rule to match instead of the / object
+	   don't do this for create lookups that call this function though, since they're looking up
+	   on the parent and thus need globbing checks on all paths
+	*/
+	if (orig_dentry == curr_dentry && newglob != GR_CREATE_GLOB)
+		newglob = GR_NO_GLOB;
+
+	return __full_lookup(orig_dentry, orig_mnt,
+			     curr_dentry->d_inode->i_ino, 
+			     __get_dev(curr_dentry), subj, path, newglob);
+}
+
+static struct acl_object_label *
+__chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
+	      const struct acl_subject_label *subj, char *path, const int checkglob)
+{
+	struct dentry *dentry = (struct dentry *) l_dentry;
+	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
+	struct acl_object_label *retval;
+
+	spin_lock(&dcache_lock);
+	spin_lock(&vfsmount_lock);
+
+	if (unlikely((mnt == shm_mnt && dentry->d_inode->i_nlink == 0) || mnt == pipe_mnt || 
+#ifdef CONFIG_NET
+	    mnt == sock_mnt ||
+#endif
+#ifdef CONFIG_HUGETLBFS
+	    (mnt == hugetlbfs_vfsmount && dentry->d_inode->i_nlink == 0) ||
+#endif
+		/* ignore Eric Biederman */
+	    IS_PRIVATE(l_dentry->d_inode))) {
+		retval = (subj->mode & GR_SHMEXEC) ? fakefs_obj_rwx : fakefs_obj_rw;
+		goto out;
+	}
+
+	for (;;) {
+		if (dentry == real_root && mnt == real_root_mnt)
+			break;
+
+		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
+			if (mnt->mnt_parent == mnt)
+				break;
+
+			retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
+			if (retval != NULL)
+				goto out;
+
+			dentry = mnt->mnt_mountpoint;
+			mnt = mnt->mnt_parent;
+			continue;
+		}
+
+		retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
+		if (retval != NULL)
+			goto out;
+
+		dentry = dentry->d_parent;
+	}
+
+	retval = full_lookup(l_dentry, l_mnt, dentry, subj, &path, checkglob);
+
+	if (retval == NULL)
+		retval = full_lookup(l_dentry, l_mnt, real_root, subj, &path, checkglob);
+out:
+	spin_unlock(&vfsmount_lock);
+	spin_unlock(&dcache_lock);
+
+	BUG_ON(retval == NULL);
+
+	return retval;
+}
+
+static __inline__ struct acl_object_label *
+chk_obj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
+	      const struct acl_subject_label *subj)
+{
+	char *path = NULL;
+	return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_REG_GLOB);
+}
+
+static __inline__ struct acl_object_label *
+chk_obj_label_noglob(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
+	      const struct acl_subject_label *subj)
+{
+	char *path = NULL;
+	return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_NO_GLOB);
+}
+
+static __inline__ struct acl_object_label *
+chk_obj_create_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
+		     const struct acl_subject_label *subj, char *path)
+{
+	return __chk_obj_label(l_dentry, l_mnt, subj, path, GR_CREATE_GLOB);
+}
+
+static struct acl_subject_label *
+chk_subj_label(const struct dentry *l_dentry, const struct vfsmount *l_mnt,
+	       const struct acl_role_label *role)
+{
+	struct dentry *dentry = (struct dentry *) l_dentry;
+	struct vfsmount *mnt = (struct vfsmount *) l_mnt;
+	struct acl_subject_label *retval;
+
+	spin_lock(&dcache_lock);
+	spin_lock(&vfsmount_lock);
+
+	for (;;) {
+		if (dentry == real_root && mnt == real_root_mnt)
+			break;
+		if (dentry == mnt->mnt_root || IS_ROOT(dentry)) {
+			if (mnt->mnt_parent == mnt)
+				break;
+
+			read_lock(&gr_inode_lock);
+			retval =
+				lookup_acl_subj_label(dentry->d_inode->i_ino,
+						__get_dev(dentry), role);
+			read_unlock(&gr_inode_lock);
+			if (retval != NULL)
+				goto out;
+
+			dentry = mnt->mnt_mountpoint;
+			mnt = mnt->mnt_parent;
+			continue;
+		}
+
+		read_lock(&gr_inode_lock);
+		retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
+					  __get_dev(dentry), role);
+		read_unlock(&gr_inode_lock);
+		if (retval != NULL)
+			goto out;
+
+		dentry = dentry->d_parent;
+	}
+
+	read_lock(&gr_inode_lock);
+	retval = lookup_acl_subj_label(dentry->d_inode->i_ino,
+				  __get_dev(dentry), role);
+	read_unlock(&gr_inode_lock);
+
+	if (unlikely(retval == NULL)) {
+		read_lock(&gr_inode_lock);
+		retval = lookup_acl_subj_label(real_root->d_inode->i_ino,
+					  __get_dev(real_root), role);
+		read_unlock(&gr_inode_lock);
+	}
+out:
+	spin_unlock(&vfsmount_lock);
+	spin_unlock(&dcache_lock);
+
+	BUG_ON(retval == NULL);
+
+	return retval;
+}
+
+static void
+gr_log_learn(const struct dentry *dentry, const struct vfsmount *mnt, const __u32 mode)
+{
+	struct task_struct *task = current;
+	const struct cred *cred = current_cred();
+
+	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
+		       1UL, 1UL, gr_to_filename(dentry, mnt), (unsigned long) mode, &task->signal->saved_ip);
+
+	return;
+}
+
+static void
+gr_log_learn_sysctl(const char *path, const __u32 mode)
+{
+	struct task_struct *task = current;
+	const struct cred *cred = current_cred();
+
+	security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename, task->role->roletype,
+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
+		       1UL, 1UL, path, (unsigned long) mode, &task->signal->saved_ip);
+
+	return;
+}
+
+static void
+gr_log_learn_id_change(const char type, const unsigned int real, 
+		       const unsigned int effective, const unsigned int fs)
+{
+	struct task_struct *task = current;
+	const struct cred *cred = current_cred();
+
+	security_learn(GR_ID_LEARN_MSG, task->role->rolename, task->role->roletype,
+		       cred->uid, cred->gid, task->exec_file ? gr_to_filename1(task->exec_file->f_path.dentry,
+		       task->exec_file->f_path.mnt) : task->acl->filename, task->acl->filename,
+		       type, real, effective, fs, &task->signal->saved_ip);
+
+	return;
+}
+
+__u32
+gr_check_link(const struct dentry * new_dentry,
+	      const struct dentry * parent_dentry,
+	      const struct vfsmount * parent_mnt,
+	      const struct dentry * old_dentry, const struct vfsmount * old_mnt)
+{
+	struct acl_object_label *obj;
+	__u32 oldmode, newmode;
+	__u32 needmode;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return (GR_CREATE | GR_LINK);
+
+	obj = chk_obj_label(old_dentry, old_mnt, current->acl);
+	oldmode = obj->mode;
+
+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
+		oldmode |= (GR_CREATE | GR_LINK);
+
+	needmode = GR_CREATE | GR_AUDIT_CREATE | GR_SUPPRESS;
+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
+		needmode |= GR_SETID | GR_AUDIT_SETID;
+
+	newmode =
+	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
+			    oldmode | needmode);
+
+	needmode = newmode & (GR_FIND | GR_APPEND | GR_WRITE | GR_EXEC |
+			      GR_SETID | GR_READ | GR_FIND | GR_DELETE |
+			      GR_INHERIT | GR_AUDIT_INHERIT);
+
+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID) && !(newmode & GR_SETID))
+		goto bad;
+
+	if ((oldmode & needmode) != needmode)
+		goto bad;
+
+	needmode = oldmode & (GR_NOPTRACE | GR_PTRACERD | GR_INHERIT | GR_AUDITS);
+	if ((newmode & needmode) != needmode)
+		goto bad;
+
+	if ((newmode & (GR_CREATE | GR_LINK)) == (GR_CREATE | GR_LINK))
+		return newmode;
+bad:
+	needmode = oldmode;
+	if (old_dentry->d_inode->i_mode & (S_ISUID | S_ISGID))
+		needmode |= GR_SETID;
+	
+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) {
+		gr_log_learn(old_dentry, old_mnt, needmode);
+		return (GR_CREATE | GR_LINK);
+	} else if (newmode & GR_SUPPRESS)
+		return GR_SUPPRESS;
+	else
+		return 0;
+}
+
+__u32
+gr_search_file(const struct dentry * dentry, const __u32 mode,
+	       const struct vfsmount * mnt)
+{
+	__u32 retval = mode;
+	struct acl_subject_label *curracl;
+	struct acl_object_label *currobj;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return (mode & ~GR_AUDITS);
+
+	curracl = current->acl;
+
+	currobj = chk_obj_label(dentry, mnt, curracl);
+	retval = currobj->mode & mode;
+
+	/* if we're opening a specified transfer file for writing
+	   (e.g. /dev/initctl), then transfer our role to init
+	*/
+	if (unlikely(currobj->mode & GR_INIT_TRANSFER && retval & GR_WRITE &&
+		     current->role->roletype & GR_ROLE_PERSIST)) {
+		struct task_struct *task = init_pid_ns.child_reaper;
+
+		if (task->role != current->role) {
+			task->acl_sp_role = 0;
+			task->acl_role_id = current->acl_role_id;
+			task->role = current->role;
+			rcu_read_lock();
+			read_lock(&grsec_exec_file_lock);
+			gr_apply_subject_to_task(task);
+			read_unlock(&grsec_exec_file_lock);
+			rcu_read_unlock();
+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_INIT_TRANSFER_MSG);
+		}
+	}
+
+	if (unlikely
+	    ((curracl->mode & (GR_LEARN | GR_INHERITLEARN)) && !(mode & GR_NOPTRACE)
+	     && (retval != (mode & ~(GR_AUDITS | GR_SUPPRESS))))) {
+		__u32 new_mode = mode;
+
+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
+
+		retval = new_mode;
+
+		if (new_mode & GR_EXEC && curracl->mode & GR_INHERITLEARN)
+			new_mode |= GR_INHERIT;
+
+		if (!(mode & GR_NOLEARN))
+			gr_log_learn(dentry, mnt, new_mode);
+	}
+
+	return retval;
+}
+
+__u32
+gr_check_create(const struct dentry * new_dentry, const struct dentry * parent,
+		const struct vfsmount * mnt, const __u32 mode)
+{
+	struct name_entry *match;
+	struct acl_object_label *matchpo;
+	struct acl_subject_label *curracl;
+	char *path;
+	__u32 retval;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return (mode & ~GR_AUDITS);
+
+	preempt_disable();
+	path = gr_to_filename_rbac(new_dentry, mnt);
+	match = lookup_name_entry_create(path);
+
+	if (!match)
+		goto check_parent;
+
+	curracl = current->acl;
+
+	read_lock(&gr_inode_lock);
+	matchpo = lookup_acl_obj_label_create(match->inode, match->device, curracl);
+	read_unlock(&gr_inode_lock);
+
+	if (matchpo) {
+		if ((matchpo->mode & mode) !=
+		    (mode & ~(GR_AUDITS | GR_SUPPRESS))
+		    && curracl->mode & (GR_LEARN | GR_INHERITLEARN)) {
+			__u32 new_mode = mode;
+
+			new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
+
+			gr_log_learn(new_dentry, mnt, new_mode);
+
+			preempt_enable();
+			return new_mode;
+		}
+		preempt_enable();
+		return (matchpo->mode & mode);
+	}
+
+      check_parent:
+	curracl = current->acl;
+
+	matchpo = chk_obj_create_label(parent, mnt, curracl, path);
+	retval = matchpo->mode & mode;
+
+	if ((retval != (mode & ~(GR_AUDITS | GR_SUPPRESS)))
+	    && (curracl->mode & (GR_LEARN | GR_INHERITLEARN))) {
+		__u32 new_mode = mode;
+
+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
+
+		gr_log_learn(new_dentry, mnt, new_mode);
+		preempt_enable();
+		return new_mode;
+	}
+
+	preempt_enable();
+	return retval;
+}
+
+int
+gr_check_hidden_task(const struct task_struct *task)
+{
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+
+	if (!(task->acl->mode & GR_PROCFIND) && !(current->acl->mode & GR_VIEW))
+		return 1;
+
+	return 0;
+}
+
+int
+gr_check_protected_task(const struct task_struct *task)
+{
+	if (unlikely(!(gr_status & GR_READY) || !task))
+		return 0;
+
+	if ((task->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
+	    task->acl != current->acl)
+		return 1;
+
+	return 0;
+}
+
+int
+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
+{
+	struct task_struct *p;
+	int ret = 0;
+
+	if (unlikely(!(gr_status & GR_READY) || !pid))
+		return ret;
+
+	read_lock(&tasklist_lock);
+	do_each_pid_task(pid, type, p) {
+		if ((p->acl->mode & GR_PROTECTED) && !(current->acl->mode & GR_KILL) &&
+		    p->acl != current->acl) {
+			ret = 1;
+			goto out;
+		}
+	} while_each_pid_task(pid, type, p);
+out:
+	read_unlock(&tasklist_lock);
+
+	return ret;
+}
+
+void
+gr_copy_label(struct task_struct *tsk)
+{
+	tsk->signal->used_accept = 0;
+	tsk->acl_sp_role = 0;
+	tsk->acl_role_id = current->acl_role_id;
+	tsk->acl = current->acl;
+	tsk->role = current->role;
+	tsk->signal->curr_ip = current->signal->curr_ip;
+	tsk->signal->saved_ip = current->signal->saved_ip;
+	if (current->exec_file)
+		get_file(current->exec_file);
+	tsk->exec_file = current->exec_file;
+	tsk->is_writable = current->is_writable;
+	if (unlikely(current->signal->used_accept)) {
+		current->signal->curr_ip = 0;
+		current->signal->saved_ip = 0;
+	}
+
+	return;
+}
+
+static void
+gr_set_proc_res(struct task_struct *task)
+{
+	struct acl_subject_label *proc;
+	unsigned short i;
+
+	proc = task->acl;
+
+	if (proc->mode & (GR_LEARN | GR_INHERITLEARN))
+		return;
+
+	for (i = 0; i < RLIM_NLIMITS; i++) {
+		if (!(proc->resmask & (1 << i)))
+			continue;
+
+		task->signal->rlim[i].rlim_cur = proc->res[i].rlim_cur;
+		task->signal->rlim[i].rlim_max = proc->res[i].rlim_max;
+	}
+
+	return;
+}
+
+extern int __gr_process_user_ban(struct user_struct *user);
+
+int
+gr_check_user_change(int real, int effective, int fs)
+{
+	unsigned int i;
+	__u16 num;
+	uid_t *uidlist;
+	int curuid;
+	int realok = 0;
+	int effectiveok = 0;
+	int fsok = 0;
+
+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
+	struct user_struct *user;
+
+	if (real == -1)
+		goto skipit;
+
+	user = find_user(real);
+	if (user == NULL)
+		goto skipit;
+
+	if (__gr_process_user_ban(user)) {
+		/* for find_user */
+		free_uid(user);
+		return 1;
+	}
+
+	/* for find_user */
+	free_uid(user);
+
+skipit:
+#endif
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+
+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
+		gr_log_learn_id_change('u', real, effective, fs);
+
+	num = current->acl->user_trans_num;
+	uidlist = current->acl->user_transitions;
+
+	if (uidlist == NULL)
+		return 0;
+
+	if (real == -1)
+		realok = 1;
+	if (effective == -1)
+		effectiveok = 1;
+	if (fs == -1)
+		fsok = 1;
+
+	if (current->acl->user_trans_type & GR_ID_ALLOW) {
+		for (i = 0; i < num; i++) {
+			curuid = (int)uidlist[i];
+			if (real == curuid)
+				realok = 1;
+			if (effective == curuid)
+				effectiveok = 1;
+			if (fs == curuid)
+				fsok = 1;
+		}
+	} else if (current->acl->user_trans_type & GR_ID_DENY) {
+		for (i = 0; i < num; i++) {
+			curuid = (int)uidlist[i];
+			if (real == curuid)
+				break;
+			if (effective == curuid)
+				break;
+			if (fs == curuid)
+				break;
+		}
+		/* not in deny list */
+		if (i == num) {
+			realok = 1;
+			effectiveok = 1;
+			fsok = 1;
+		}
+	}
+
+	if (realok && effectiveok && fsok)
+		return 0;
+	else {
+		gr_log_int(GR_DONT_AUDIT, GR_USRCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
+		return 1;
+	}
+}
+
+int
+gr_check_group_change(int real, int effective, int fs)
+{
+	unsigned int i;
+	__u16 num;
+	gid_t *gidlist;
+	int curgid;
+	int realok = 0;
+	int effectiveok = 0;
+	int fsok = 0;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+
+	if (current->acl->mode & (GR_LEARN | GR_INHERITLEARN))
+		gr_log_learn_id_change('g', real, effective, fs);
+
+	num = current->acl->group_trans_num;
+	gidlist = current->acl->group_transitions;
+
+	if (gidlist == NULL)
+		return 0;
+
+	if (real == -1)
+		realok = 1;
+	if (effective == -1)
+		effectiveok = 1;
+	if (fs == -1)
+		fsok = 1;
+
+	if (current->acl->group_trans_type & GR_ID_ALLOW) {
+		for (i = 0; i < num; i++) {
+			curgid = (int)gidlist[i];
+			if (real == curgid)
+				realok = 1;
+			if (effective == curgid)
+				effectiveok = 1;
+			if (fs == curgid)
+				fsok = 1;
+		}
+	} else if (current->acl->group_trans_type & GR_ID_DENY) {
+		for (i = 0; i < num; i++) {
+			curgid = (int)gidlist[i];
+			if (real == curgid)
+				break;
+			if (effective == curgid)
+				break;
+			if (fs == curgid)
+				break;
+		}
+		/* not in deny list */
+		if (i == num) {
+			realok = 1;
+			effectiveok = 1;
+			fsok = 1;
+		}
+	}
+
+	if (realok && effectiveok && fsok)
+		return 0;
+	else {
+		gr_log_int(GR_DONT_AUDIT, GR_GRPCHANGE_ACL_MSG, realok ? (effectiveok ? (fsok ? 0 : fs) : effective) : real);
+		return 1;
+	}
+}
+
+void
+gr_set_role_label(struct task_struct *task, const uid_t uid, const uid_t gid)
+{
+	struct acl_role_label *role = task->role;
+	struct acl_subject_label *subj = NULL;
+	struct acl_object_label *obj;
+	struct file *filp;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return;
+
+	filp = task->exec_file;
+
+	/* kernel process, we'll give them the kernel role */
+	if (unlikely(!filp)) {
+		task->role = kernel_role;
+		task->acl = kernel_role->root_label;
+		return;
+	} else if (!task->role || !(task->role->roletype & GR_ROLE_SPECIAL))
+		role = lookup_acl_role_label(task, uid, gid);
+
+	/* perform subject lookup in possibly new role
+	   we can use this result below in the case where role == task->role
+	*/
+	subj = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, role);
+
+	/* if we changed uid/gid, but result in the same role
+	   and are using inheritance, don't lose the inherited subject
+	   if current subject is other than what normal lookup
+	   would result in, we arrived via inheritance, don't
+	   lose subject
+	*/
+	if (role != task->role || (!(task->acl->mode & GR_INHERITLEARN) &&
+				   (subj == task->acl)))
+		task->acl = subj;
+
+	task->role = role;
+
+	task->is_writable = 0;
+
+	/* ignore additional mmap checks for processes that are writable 
+	   by the default ACL */
+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
+	if (unlikely(obj->mode & GR_WRITE))
+		task->is_writable = 1;
+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
+	if (unlikely(obj->mode & GR_WRITE))
+		task->is_writable = 1;
+
+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
+	printk(KERN_ALERT "Set role label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
+#endif
+
+	gr_set_proc_res(task);
+
+	return;
+}
+
+int
+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
+		  const int unsafe_share)
+{
+	struct task_struct *task = current;
+	struct acl_subject_label *newacl;
+	struct acl_object_label *obj;
+	__u32 retmode;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+
+	newacl = chk_subj_label(dentry, mnt, task->role);
+
+	task_lock(task);
+	if ((((task->ptrace & PT_PTRACED) || unsafe_share) &&
+	     !(task->acl->mode & GR_POVERRIDE) && (task->acl != newacl) &&
+	     !(task->role->roletype & GR_ROLE_GOD) &&
+	     !gr_search_file(dentry, GR_PTRACERD, mnt) &&
+	     !(task->acl->mode & (GR_LEARN | GR_INHERITLEARN)))) {
+                task_unlock(task);
+		if (unsafe_share)
+			gr_log_fs_generic(GR_DONT_AUDIT, GR_UNSAFESHARE_EXEC_ACL_MSG, dentry, mnt);
+		else
+			gr_log_fs_generic(GR_DONT_AUDIT, GR_PTRACE_EXEC_ACL_MSG, dentry, mnt);
+		return -EACCES;
+	}
+	task_unlock(task);
+
+	obj = chk_obj_label(dentry, mnt, task->acl);
+	retmode = obj->mode & (GR_INHERIT | GR_AUDIT_INHERIT);
+
+	if (!(task->acl->mode & GR_INHERITLEARN) &&
+	    ((newacl->mode & GR_LEARN) || !(retmode & GR_INHERIT))) {
+		if (obj->nested)
+			task->acl = obj->nested;
+		else
+			task->acl = newacl;
+	} else if (retmode & GR_INHERIT && retmode & GR_AUDIT_INHERIT)
+		gr_log_str_fs(GR_DO_AUDIT, GR_INHERIT_ACL_MSG, task->acl->filename, dentry, mnt);
+
+	task->is_writable = 0;
+
+	/* ignore additional mmap checks for processes that are writable 
+	   by the default ACL */
+	obj = chk_obj_label(dentry, mnt, default_role->root_label);
+	if (unlikely(obj->mode & GR_WRITE))
+		task->is_writable = 1;
+	obj = chk_obj_label(dentry, mnt, task->role->root_label);
+	if (unlikely(obj->mode & GR_WRITE))
+		task->is_writable = 1;
+
+	gr_set_proc_res(task);
+
+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
+	printk(KERN_ALERT "Set subject label for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
+#endif
+	return 0;
+}
+
+/* always called with valid inodev ptr */
+static void
+do_handle_delete(struct inodev_entry *inodev, const ino_t ino, const dev_t dev)
+{
+	struct acl_object_label *matchpo;
+	struct acl_subject_label *matchps;
+	struct acl_subject_label *subj;
+	struct acl_role_label *role;
+	unsigned int x;
+
+	FOR_EACH_ROLE_START(role)
+		FOR_EACH_SUBJECT_START(role, subj, x)
+			if ((matchpo = lookup_acl_obj_label(ino, dev, subj)) != NULL)
+				matchpo->mode |= GR_DELETED;
+		FOR_EACH_SUBJECT_END(subj,x)
+		FOR_EACH_NESTED_SUBJECT_START(role, subj)
+			if (subj->inode == ino && subj->device == dev)
+				subj->mode |= GR_DELETED;
+		FOR_EACH_NESTED_SUBJECT_END(subj)
+		if ((matchps = lookup_acl_subj_label(ino, dev, role)) != NULL)
+			matchps->mode |= GR_DELETED;
+	FOR_EACH_ROLE_END(role)
+
+	inodev->nentry->deleted = 1;
+
+	return;
+}
+
+void
+gr_handle_delete(const ino_t ino, const dev_t dev)
+{
+	struct inodev_entry *inodev;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return;
+
+	write_lock(&gr_inode_lock);
+	inodev = lookup_inodev_entry(ino, dev);
+	if (inodev != NULL)
+		do_handle_delete(inodev, ino, dev);
+	write_unlock(&gr_inode_lock);
+
+	return;
+}
+
+static void
+update_acl_obj_label(const ino_t oldinode, const dev_t olddevice,
+		     const ino_t newinode, const dev_t newdevice,
+		     struct acl_subject_label *subj)
+{
+	unsigned int index = fhash(oldinode, olddevice, subj->obj_hash_size);
+	struct acl_object_label *match;
+
+	match = subj->obj_hash[index];
+
+	while (match && (match->inode != oldinode ||
+	       match->device != olddevice ||
+	       !(match->mode & GR_DELETED)))
+		match = match->next;
+
+	if (match && (match->inode == oldinode)
+	    && (match->device == olddevice)
+	    && (match->mode & GR_DELETED)) {
+		if (match->prev == NULL) {
+			subj->obj_hash[index] = match->next;
+			if (match->next != NULL)
+				match->next->prev = NULL;
+		} else {
+			match->prev->next = match->next;
+			if (match->next != NULL)
+				match->next->prev = match->prev;
+		}
+		match->prev = NULL;
+		match->next = NULL;
+		match->inode = newinode;
+		match->device = newdevice;
+		match->mode &= ~GR_DELETED;
+
+		insert_acl_obj_label(match, subj);
+	}
+
+	return;
+}
+
+static void
+update_acl_subj_label(const ino_t oldinode, const dev_t olddevice,
+		      const ino_t newinode, const dev_t newdevice,
+		      struct acl_role_label *role)
+{
+	unsigned int index = fhash(oldinode, olddevice, role->subj_hash_size);
+	struct acl_subject_label *match;
+
+	match = role->subj_hash[index];
+
+	while (match && (match->inode != oldinode ||
+	       match->device != olddevice ||
+	       !(match->mode & GR_DELETED)))
+		match = match->next;
+
+	if (match && (match->inode == oldinode)
+	    && (match->device == olddevice)
+	    && (match->mode & GR_DELETED)) {
+		if (match->prev == NULL) {
+			role->subj_hash[index] = match->next;
+			if (match->next != NULL)
+				match->next->prev = NULL;
+		} else {
+			match->prev->next = match->next;
+			if (match->next != NULL)
+				match->next->prev = match->prev;
+		}
+		match->prev = NULL;
+		match->next = NULL;
+		match->inode = newinode;
+		match->device = newdevice;
+		match->mode &= ~GR_DELETED;
+
+		insert_acl_subj_label(match, role);
+	}
+
+	return;
+}
+
+static void
+update_inodev_entry(const ino_t oldinode, const dev_t olddevice,
+		    const ino_t newinode, const dev_t newdevice)
+{
+	unsigned int index = fhash(oldinode, olddevice, inodev_set.i_size);
+	struct inodev_entry *match;
+
+	match = inodev_set.i_hash[index];
+
+	while (match && (match->nentry->inode != oldinode ||
+	       match->nentry->device != olddevice || !match->nentry->deleted))
+		match = match->next;
+
+	if (match && (match->nentry->inode == oldinode)
+	    && (match->nentry->device == olddevice) &&
+	    match->nentry->deleted) {
+		if (match->prev == NULL) {
+			inodev_set.i_hash[index] = match->next;
+			if (match->next != NULL)
+				match->next->prev = NULL;
+		} else {
+			match->prev->next = match->next;
+			if (match->next != NULL)
+				match->next->prev = match->prev;
+		}
+		match->prev = NULL;
+		match->next = NULL;
+		match->nentry->inode = newinode;
+		match->nentry->device = newdevice;
+		match->nentry->deleted = 0;
+
+		insert_inodev_entry(match);
+	}
+
+	return;
+}
+
+static void
+do_handle_create(const struct name_entry *matchn, const struct dentry *dentry,
+		 const struct vfsmount *mnt)
+{
+	struct acl_subject_label *subj;
+	struct acl_role_label *role;
+	unsigned int x;
+	ino_t inode = dentry->d_inode->i_ino;
+	dev_t dev = __get_dev(dentry);
+	
+	FOR_EACH_ROLE_START(role)
+		update_acl_subj_label(matchn->inode, matchn->device,
+				      inode, dev, role);
+
+		FOR_EACH_NESTED_SUBJECT_START(role, subj)
+			if ((subj->inode == inode) && (subj->device == dev)) {
+				subj->inode = inode;
+				subj->device = dev;
+			}
+		FOR_EACH_NESTED_SUBJECT_END(subj)
+		FOR_EACH_SUBJECT_START(role, subj, x)
+			update_acl_obj_label(matchn->inode, matchn->device,
+					     inode, dev, subj);
+		FOR_EACH_SUBJECT_END(subj,x)
+	FOR_EACH_ROLE_END(role)
+
+	update_inodev_entry(matchn->inode, matchn->device, inode, dev);
+
+	return;
+}
+
+void
+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	struct name_entry *matchn;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return;
+
+	preempt_disable();
+	matchn = lookup_name_entry(gr_to_filename_rbac(dentry, mnt));
+
+	if (unlikely((unsigned long)matchn)) {
+		write_lock(&gr_inode_lock);
+		do_handle_create(matchn, dentry, mnt);
+		write_unlock(&gr_inode_lock);
+	}
+	preempt_enable();
+
+	return;
+}
+
+void
+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
+		 struct dentry *old_dentry,
+		 struct dentry *new_dentry,
+		 struct vfsmount *mnt, const __u8 replace)
+{
+	struct name_entry *matchn;
+	struct inodev_entry *inodev;
+	ino_t oldinode = old_dentry->d_inode->i_ino;
+	dev_t olddev = __get_dev(old_dentry);
+
+	/* vfs_rename swaps the name and parent link for old_dentry and
+	   new_dentry
+	   at this point, old_dentry has the new name, parent link, and inode
+	   for the renamed file
+	   if a file is being replaced by a rename, new_dentry has the inode
+	   and name for the replaced file
+	*/
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return;
+
+	preempt_disable();
+	matchn = lookup_name_entry(gr_to_filename_rbac(old_dentry, mnt));
+
+	/* we wouldn't have to check d_inode if it weren't for
+	   NFS silly-renaming
+	 */
+
+	write_lock(&gr_inode_lock);
+	if (unlikely(replace && new_dentry->d_inode)) {
+		ino_t newinode = new_dentry->d_inode->i_ino;
+		dev_t newdev = __get_dev(new_dentry);
+		inodev = lookup_inodev_entry(newinode, newdev);
+		if (inodev != NULL && (new_dentry->d_inode->i_nlink <= 1))
+			do_handle_delete(inodev, newinode, newdev);
+	}
+
+	inodev = lookup_inodev_entry(oldinode, olddev);
+	if (inodev != NULL && (old_dentry->d_inode->i_nlink <= 1))
+		do_handle_delete(inodev, oldinode, olddev);
+
+	if (unlikely((unsigned long)matchn))
+		do_handle_create(matchn, old_dentry, mnt);
+
+	write_unlock(&gr_inode_lock);
+	preempt_enable();
+
+	return;
+}
+
+static int
+lookup_special_role_auth(__u16 mode, const char *rolename, unsigned char **salt,
+			 unsigned char **sum)
+{
+	struct acl_role_label *r;
+	struct role_allowed_ip *ipp;
+	struct role_transition *trans;
+	unsigned int i;
+	int found = 0;
+	u32 curr_ip = current->signal->curr_ip;
+
+	current->signal->saved_ip = curr_ip;
+
+	/* check transition table */
+
+	for (trans = current->role->transitions; trans; trans = trans->next) {
+		if (!strcmp(rolename, trans->rolename)) {
+			found = 1;
+			break;
+		}
+	}
+
+	if (!found)
+		return 0;
+
+	/* handle special roles that do not require authentication
+	   and check ip */
+
+	FOR_EACH_ROLE_START(r)
+		if (!strcmp(rolename, r->rolename) &&
+		    (r->roletype & GR_ROLE_SPECIAL)) {
+			found = 0;
+			if (r->allowed_ips != NULL) {
+				for (ipp = r->allowed_ips; ipp; ipp = ipp->next) {
+					if ((ntohl(curr_ip) & ipp->netmask) ==
+					     (ntohl(ipp->addr) & ipp->netmask))
+						found = 1;
+				}
+			} else
+				found = 2;
+			if (!found)
+				return 0;
+
+			if (((mode == GR_SPROLE) && (r->roletype & GR_ROLE_NOPW)) ||
+			    ((mode == GR_SPROLEPAM) && (r->roletype & GR_ROLE_PAM))) {
+				*salt = NULL;
+				*sum = NULL;
+				return 1;
+			}
+		}
+	FOR_EACH_ROLE_END(r)
+
+	for (i = 0; i < num_sprole_pws; i++) {
+		if (!strcmp(rolename, acl_special_roles[i]->rolename)) {
+			*salt = acl_special_roles[i]->salt;
+			*sum = acl_special_roles[i]->sum;
+			return 1;
+		}
+	}
+
+	return 0;
+}
+
+static void
+assign_special_role(char *rolename)
+{
+	struct acl_object_label *obj;
+	struct acl_role_label *r;
+	struct acl_role_label *assigned = NULL;
+	struct task_struct *tsk;
+	struct file *filp;
+
+	FOR_EACH_ROLE_START(r)
+		if (!strcmp(rolename, r->rolename) &&
+		    (r->roletype & GR_ROLE_SPECIAL)) {
+			assigned = r;
+			break;
+		}
+	FOR_EACH_ROLE_END(r)
+
+	if (!assigned)
+		return;
+
+	read_lock(&tasklist_lock);
+	read_lock(&grsec_exec_file_lock);
+
+	tsk = current->real_parent;
+	if (tsk == NULL)
+		goto out_unlock;
+
+	filp = tsk->exec_file;
+	if (filp == NULL)
+		goto out_unlock;
+
+	tsk->is_writable = 0;
+
+	tsk->acl_sp_role = 1;
+	tsk->acl_role_id = ++acl_sp_role_value;
+	tsk->role = assigned;
+	tsk->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role);
+
+	/* ignore additional mmap checks for processes that are writable 
+	   by the default ACL */
+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
+	if (unlikely(obj->mode & GR_WRITE))
+		tsk->is_writable = 1;
+	obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, tsk->role->root_label);
+	if (unlikely(obj->mode & GR_WRITE))
+		tsk->is_writable = 1;
+
+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
+	printk(KERN_ALERT "Assigning special role:%s subject:%s to process (%s:%d)\n", tsk->role->rolename, tsk->acl->filename, tsk->comm, tsk->pid);
+#endif
+
+out_unlock:
+	read_unlock(&grsec_exec_file_lock);
+	read_unlock(&tasklist_lock);
+	return;
+}
+
+int gr_check_secure_terminal(struct task_struct *task)
+{
+	struct task_struct *p, *p2, *p3;
+	struct files_struct *files;
+	struct fdtable *fdt;
+	struct file *our_file = NULL, *file;
+	int i;
+
+	if (task->signal->tty == NULL)
+		return 1;
+
+	files = get_files_struct(task);
+	if (files != NULL) {
+		rcu_read_lock();
+		fdt = files_fdtable(files);
+		for (i=0; i < fdt->max_fds; i++) {
+			file = fcheck_files(files, i);
+			if (file && (our_file == NULL) && (file->private_data == task->signal->tty)) {
+				get_file(file);
+				our_file = file;
+			}
+		}
+		rcu_read_unlock();
+		put_files_struct(files);
+	}
+
+	if (our_file == NULL)
+		return 1;
+
+	read_lock(&tasklist_lock);
+	do_each_thread(p2, p) {
+		files = get_files_struct(p);
+		if (files == NULL ||
+		    (p->signal && p->signal->tty == task->signal->tty)) {
+			if (files != NULL)
+				put_files_struct(files);
+			continue;
+		}
+		rcu_read_lock();
+		fdt = files_fdtable(files);
+		for (i=0; i < fdt->max_fds; i++) {
+			file = fcheck_files(files, i);
+			if (file && S_ISCHR(file->f_path.dentry->d_inode->i_mode) &&
+			    file->f_path.dentry->d_inode->i_rdev == our_file->f_path.dentry->d_inode->i_rdev) {
+				p3 = task;
+				while (p3->pid > 0) {
+					if (p3 == p)
+						break;
+					p3 = p3->real_parent;
+				}
+				if (p3 == p)
+					break;
+				gr_log_ttysniff(GR_DONT_AUDIT_GOOD, GR_TTYSNIFF_ACL_MSG, p);
+				gr_handle_alertkill(p);
+				rcu_read_unlock();
+				put_files_struct(files);
+				read_unlock(&tasklist_lock);
+				fput(our_file);
+				return 0;
+			}
+		}
+		rcu_read_unlock();
+		put_files_struct(files);
+	} while_each_thread(p2, p);
+	read_unlock(&tasklist_lock);
+
+	fput(our_file);
+	return 1;
+}
+
+ssize_t
+write_grsec_handler(struct file *file, const char * buf, size_t count, loff_t *ppos)
+{
+	struct gr_arg_wrapper uwrap;
+	unsigned char *sprole_salt = NULL;
+	unsigned char *sprole_sum = NULL;
+	int error = sizeof (struct gr_arg_wrapper);
+	int error2 = 0;
+
+	mutex_lock(&gr_dev_mutex);
+
+	if ((gr_status & GR_READY) && !(current->acl->mode & GR_KERNELAUTH)) {
+		error = -EPERM;
+		goto out;
+	}
+
+	if (count != sizeof (struct gr_arg_wrapper)) {
+		gr_log_int_int(GR_DONT_AUDIT_GOOD, GR_DEV_ACL_MSG, (int)count, (int)sizeof(struct gr_arg_wrapper));
+		error = -EINVAL;
+		goto out;
+	}
+
+	
+	if (gr_auth_expires && time_after_eq(get_seconds(), gr_auth_expires)) {
+		gr_auth_expires = 0;
+		gr_auth_attempts = 0;
+	}
+
+	if (copy_from_user(&uwrap, buf, sizeof (struct gr_arg_wrapper))) {
+		error = -EFAULT;
+		goto out;
+	}
+
+	if ((uwrap.version != GRSECURITY_VERSION) || (uwrap.size != sizeof(struct gr_arg))) {
+		error = -EINVAL;
+		goto out;
+	}
+
+	if (copy_from_user(gr_usermode, uwrap.arg, sizeof (struct gr_arg))) {
+		error = -EFAULT;
+		goto out;
+	}
+
+	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_SPROLEPAM &&
+	    gr_auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
+	    time_after(gr_auth_expires, get_seconds())) {
+		error = -EBUSY;
+		goto out;
+	}
+
+	/* if non-root trying to do anything other than use a special role,
+	   do not attempt authentication, do not count towards authentication
+	   locking
+	 */
+
+	if (gr_usermode->mode != GR_SPROLE && gr_usermode->mode != GR_STATUS &&
+	    gr_usermode->mode != GR_UNSPROLE && gr_usermode->mode != GR_SPROLEPAM &&
+	    current_uid()) {
+		error = -EPERM;
+		goto out;
+	}
+
+	/* ensure pw and special role name are null terminated */
+
+	gr_usermode->pw[GR_PW_LEN - 1] = '\0';
+	gr_usermode->sp_role[GR_SPROLE_LEN - 1] = '\0';
+
+	/* Okay. 
+	 * We have our enough of the argument structure..(we have yet
+	 * to copy_from_user the tables themselves) . Copy the tables
+	 * only if we need them, i.e. for loading operations. */
+
+	switch (gr_usermode->mode) {
+	case GR_STATUS:
+			if (gr_status & GR_READY) {
+				error = 1;
+				if (!gr_check_secure_terminal(current))
+					error = 3;
+			} else
+				error = 2;
+			goto out;
+	case GR_SHUTDOWN:
+		if ((gr_status & GR_READY)
+		    && !(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
+			pax_open_kernel();
+			gr_status &= ~GR_READY;
+			pax_close_kernel();
+
+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTS_ACL_MSG);
+			free_variables();
+			memset(gr_usermode, 0, sizeof (struct gr_arg));
+			memset(gr_system_salt, 0, GR_SALT_LEN);
+			memset(gr_system_sum, 0, GR_SHA_LEN);
+		} else if (gr_status & GR_READY) {
+			gr_log_noargs(GR_DONT_AUDIT, GR_SHUTF_ACL_MSG);
+			error = -EPERM;
+		} else {
+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SHUTI_ACL_MSG);
+			error = -EAGAIN;
+		}
+		break;
+	case GR_ENABLE:
+		if (!(gr_status & GR_READY) && !(error2 = gracl_init(gr_usermode)))
+			gr_log_str(GR_DONT_AUDIT_GOOD, GR_ENABLE_ACL_MSG, GR_VERSION);
+		else {
+			if (gr_status & GR_READY)
+				error = -EAGAIN;
+			else
+				error = error2;
+			gr_log_str(GR_DONT_AUDIT, GR_ENABLEF_ACL_MSG, GR_VERSION);
+		}
+		break;
+	case GR_RELOAD:
+		if (!(gr_status & GR_READY)) {
+			gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOADI_ACL_MSG, GR_VERSION);
+			error = -EAGAIN;
+		} else if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
+			lock_kernel();
+
+			pax_open_kernel();
+			gr_status &= ~GR_READY;
+			pax_close_kernel();
+
+			free_variables();
+			if (!(error2 = gracl_init(gr_usermode))) {
+				unlock_kernel();
+				gr_log_str(GR_DONT_AUDIT_GOOD, GR_RELOAD_ACL_MSG, GR_VERSION);
+			} else {
+				unlock_kernel();
+				error = error2;
+				gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
+			}
+		} else {
+			gr_log_str(GR_DONT_AUDIT, GR_RELOADF_ACL_MSG, GR_VERSION);
+			error = -EPERM;
+		}
+		break;
+	case GR_SEGVMOD:
+		if (unlikely(!(gr_status & GR_READY))) {
+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODI_ACL_MSG);
+			error = -EAGAIN;
+			break;
+		}
+
+		if (!(chkpw(gr_usermode, gr_system_salt, gr_system_sum))) {
+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SEGVMODS_ACL_MSG);
+			if (gr_usermode->segv_device && gr_usermode->segv_inode) {
+				struct acl_subject_label *segvacl;
+				segvacl =
+				    lookup_acl_subj_label(gr_usermode->segv_inode,
+							  gr_usermode->segv_device,
+							  current->role);
+				if (segvacl) {
+					segvacl->crashes = 0;
+					segvacl->expires = 0;
+				}
+			} else if (gr_find_uid(gr_usermode->segv_uid) >= 0) {
+				gr_remove_uid(gr_usermode->segv_uid);
+			}
+		} else {
+			gr_log_noargs(GR_DONT_AUDIT, GR_SEGVMODF_ACL_MSG);
+			error = -EPERM;
+		}
+		break;
+	case GR_SPROLE:
+	case GR_SPROLEPAM:
+		if (unlikely(!(gr_status & GR_READY))) {
+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_SPROLEI_ACL_MSG);
+			error = -EAGAIN;
+			break;
+		}
+
+		if (current->role->expires && time_after_eq(get_seconds(), current->role->expires)) {
+			current->role->expires = 0;
+			current->role->auth_attempts = 0;
+		}
+
+		if (current->role->auth_attempts >= CONFIG_GRKERNSEC_ACL_MAXTRIES &&
+		    time_after(current->role->expires, get_seconds())) {
+			error = -EBUSY;
+			goto out;
+		}
+
+		if (lookup_special_role_auth
+		    (gr_usermode->mode, gr_usermode->sp_role, &sprole_salt, &sprole_sum)
+		    && ((!sprole_salt && !sprole_sum)
+			|| !(chkpw(gr_usermode, sprole_salt, sprole_sum)))) {
+			char *p = "";
+			assign_special_role(gr_usermode->sp_role);
+			read_lock(&tasklist_lock);
+			if (current->real_parent)
+				p = current->real_parent->role->rolename;
+			read_unlock(&tasklist_lock);
+			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLES_ACL_MSG,
+					p, acl_sp_role_value);
+		} else {
+			gr_log_str(GR_DONT_AUDIT, GR_SPROLEF_ACL_MSG, gr_usermode->sp_role);
+			error = -EPERM;
+			if(!(current->role->auth_attempts++))
+				current->role->expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
+
+			goto out;
+		}
+		break;
+	case GR_UNSPROLE:
+		if (unlikely(!(gr_status & GR_READY))) {
+			gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_UNSPROLEI_ACL_MSG);
+			error = -EAGAIN;
+			break;
+		}
+
+		if (current->role->roletype & GR_ROLE_SPECIAL) {
+			char *p = "";
+			int i = 0;
+
+			read_lock(&tasklist_lock);
+			if (current->real_parent) {
+				p = current->real_parent->role->rolename;
+				i = current->real_parent->acl_role_id;
+			}
+			read_unlock(&tasklist_lock);
+
+			gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_UNSPROLES_ACL_MSG, p, i);
+			gr_set_acls(1);
+		} else {
+			error = -EPERM;
+			goto out;
+		}
+		break;
+	default:
+		gr_log_int(GR_DONT_AUDIT, GR_INVMODE_ACL_MSG, gr_usermode->mode);
+		error = -EINVAL;
+		break;
+	}
+
+	if (error != -EPERM)
+		goto out;
+
+	if(!(gr_auth_attempts++))
+		gr_auth_expires = get_seconds() + CONFIG_GRKERNSEC_ACL_TIMEOUT;
+
+      out:
+	mutex_unlock(&gr_dev_mutex);
+	return error;
+}
+
+/* must be called with
+	rcu_read_lock();
+	read_lock(&tasklist_lock);
+	read_lock(&grsec_exec_file_lock);
+*/
+int gr_apply_subject_to_task(struct task_struct *task)
+{
+	struct acl_object_label *obj;
+	char *tmpname;
+	struct acl_subject_label *tmpsubj;
+	struct file *filp;
+	struct name_entry *nmatch;
+
+	filp = task->exec_file;
+	if (filp == NULL)
+		return 0;
+
+	/* the following is to apply the correct subject 
+	   on binaries running when the RBAC system 
+	   is enabled, when the binaries have been 
+	   replaced or deleted since their execution
+	   -----
+	   when the RBAC system starts, the inode/dev
+	   from exec_file will be one the RBAC system
+	   is unaware of.  It only knows the inode/dev
+	   of the present file on disk, or the absence
+	   of it.
+	*/
+	preempt_disable();
+	tmpname = gr_to_filename_rbac(filp->f_path.dentry, filp->f_path.mnt);
+			
+	nmatch = lookup_name_entry(tmpname);
+	preempt_enable();
+	tmpsubj = NULL;
+	if (nmatch) {
+		if (nmatch->deleted)
+			tmpsubj = lookup_acl_subj_label_deleted(nmatch->inode, nmatch->device, task->role);
+		else
+			tmpsubj = lookup_acl_subj_label(nmatch->inode, nmatch->device, task->role);
+		if (tmpsubj != NULL)
+			task->acl = tmpsubj;
+	}
+	if (tmpsubj == NULL)
+		task->acl = chk_subj_label(filp->f_path.dentry, filp->f_path.mnt,
+					   task->role);
+	if (task->acl) {
+		task->is_writable = 0;
+		/* ignore additional mmap checks for processes that are writable 
+		   by the default ACL */
+		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
+		if (unlikely(obj->mode & GR_WRITE))
+			task->is_writable = 1;
+		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, task->role->root_label);
+		if (unlikely(obj->mode & GR_WRITE))
+			task->is_writable = 1;
+
+		gr_set_proc_res(task);
+
+#ifdef CONFIG_GRKERNSEC_RBAC_DEBUG
+		printk(KERN_ALERT "gr_set_acls for (%s:%d): role:%s, subject:%s\n", task->comm, task->pid, task->role->rolename, task->acl->filename);
+#endif
+	} else {
+		return 1;
+	}
+
+	return 0;
+}
+
+int
+gr_set_acls(const int type)
+{
+	struct task_struct *task, *task2;
+	struct acl_role_label *role = current->role;
+	__u16 acl_role_id = current->acl_role_id;
+	const struct cred *cred;
+	int ret;
+
+	rcu_read_lock();
+	read_lock(&tasklist_lock);
+	read_lock(&grsec_exec_file_lock);
+	do_each_thread(task2, task) {
+		/* check to see if we're called from the exit handler,
+		   if so, only replace ACLs that have inherited the admin
+		   ACL */
+
+		if (type && (task->role != role ||
+			     task->acl_role_id != acl_role_id))
+			continue;
+
+		task->acl_role_id = 0;
+		task->acl_sp_role = 0;
+
+		if (task->exec_file) {
+			cred = __task_cred(task);
+			task->role = lookup_acl_role_label(task, cred->uid, cred->gid);
+
+			ret = gr_apply_subject_to_task(task);
+			if (ret) {
+				read_unlock(&grsec_exec_file_lock);
+				read_unlock(&tasklist_lock);
+				rcu_read_unlock();
+				gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_DEFACL_MSG, task->comm, task->pid);
+				return ret;
+			}
+		} else {
+			// it's a kernel process
+			task->role = kernel_role;
+			task->acl = kernel_role->root_label;
+#ifdef CONFIG_GRKERNSEC_ACL_HIDEKERN
+			task->acl->mode &= ~GR_PROCFIND;
+#endif
+		}
+	} while_each_thread(task2, task);
+	read_unlock(&grsec_exec_file_lock);
+	read_unlock(&tasklist_lock);
+	rcu_read_unlock();
+
+	return 0;
+}
+
+void
+gr_learn_resource(const struct task_struct *task,
+		  const int res, const unsigned long wanted, const int gt)
+{
+	struct acl_subject_label *acl;
+	const struct cred *cred;
+
+	if (unlikely((gr_status & GR_READY) &&
+		     task->acl && (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))))
+		goto skip_reslog;
+
+#ifdef CONFIG_GRKERNSEC_RESLOG
+	gr_log_resource(task, res, wanted, gt);
+#endif
+      skip_reslog:
+
+	if (unlikely(!(gr_status & GR_READY) || !wanted || res >= GR_NLIMITS))
+		return;
+
+	acl = task->acl;
+
+	if (likely(!acl || !(acl->mode & (GR_LEARN | GR_INHERITLEARN)) ||
+		   !(acl->resmask & (1 << (unsigned short) res))))
+		return;
+
+	if (wanted >= acl->res[res].rlim_cur) {
+		unsigned long res_add;
+
+		res_add = wanted;
+		switch (res) {
+		case RLIMIT_CPU:
+			res_add += GR_RLIM_CPU_BUMP;
+			break;
+		case RLIMIT_FSIZE:
+			res_add += GR_RLIM_FSIZE_BUMP;
+			break;
+		case RLIMIT_DATA:
+			res_add += GR_RLIM_DATA_BUMP;
+			break;
+		case RLIMIT_STACK:
+			res_add += GR_RLIM_STACK_BUMP;
+			break;
+		case RLIMIT_CORE:
+			res_add += GR_RLIM_CORE_BUMP;
+			break;
+		case RLIMIT_RSS:
+			res_add += GR_RLIM_RSS_BUMP;
+			break;
+		case RLIMIT_NPROC:
+			res_add += GR_RLIM_NPROC_BUMP;
+			break;
+		case RLIMIT_NOFILE:
+			res_add += GR_RLIM_NOFILE_BUMP;
+			break;
+		case RLIMIT_MEMLOCK:
+			res_add += GR_RLIM_MEMLOCK_BUMP;
+			break;
+		case RLIMIT_AS:
+			res_add += GR_RLIM_AS_BUMP;
+			break;
+		case RLIMIT_LOCKS:
+			res_add += GR_RLIM_LOCKS_BUMP;
+			break;
+		case RLIMIT_SIGPENDING:
+			res_add += GR_RLIM_SIGPENDING_BUMP;
+			break;
+		case RLIMIT_MSGQUEUE:
+			res_add += GR_RLIM_MSGQUEUE_BUMP;
+			break;
+		case RLIMIT_NICE:
+			res_add += GR_RLIM_NICE_BUMP;
+			break;
+		case RLIMIT_RTPRIO:
+			res_add += GR_RLIM_RTPRIO_BUMP;
+			break;
+		case RLIMIT_RTTIME:
+			res_add += GR_RLIM_RTTIME_BUMP;
+			break;
+		}
+
+		acl->res[res].rlim_cur = res_add;
+
+		if (wanted > acl->res[res].rlim_max)
+			acl->res[res].rlim_max = res_add;
+
+		/* only log the subject filename, since resource logging is supported for
+		   single-subject learning only */
+		rcu_read_lock();
+		cred = __task_cred(task);
+		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
+			       task->role->roletype, cred->uid, cred->gid, acl->filename,
+			       acl->filename, acl->res[res].rlim_cur, acl->res[res].rlim_max,
+			       "", (unsigned long) res, &task->signal->saved_ip);
+		rcu_read_unlock();
+	}
+
+	return;
+}
+
+#if defined(CONFIG_PAX_HAVE_ACL_FLAGS) && (defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR))
+void
+pax_set_initial_flags(struct linux_binprm *bprm)
+{
+	struct task_struct *task = current;
+        struct acl_subject_label *proc;
+	unsigned long flags;
+
+        if (unlikely(!(gr_status & GR_READY)))
+                return;
+
+	flags = pax_get_flags(task);
+
+        proc = task->acl;
+
+	if (proc->pax_flags & GR_PAX_DISABLE_PAGEEXEC)
+		flags &= ~MF_PAX_PAGEEXEC;
+	if (proc->pax_flags & GR_PAX_DISABLE_SEGMEXEC)
+		flags &= ~MF_PAX_SEGMEXEC;
+	if (proc->pax_flags & GR_PAX_DISABLE_RANDMMAP)
+		flags &= ~MF_PAX_RANDMMAP;
+	if (proc->pax_flags & GR_PAX_DISABLE_EMUTRAMP)
+		flags &= ~MF_PAX_EMUTRAMP;
+	if (proc->pax_flags & GR_PAX_DISABLE_MPROTECT)
+		flags &= ~MF_PAX_MPROTECT;
+
+	if (proc->pax_flags & GR_PAX_ENABLE_PAGEEXEC)
+		flags |= MF_PAX_PAGEEXEC;
+	if (proc->pax_flags & GR_PAX_ENABLE_SEGMEXEC)
+		flags |= MF_PAX_SEGMEXEC;
+	if (proc->pax_flags & GR_PAX_ENABLE_RANDMMAP)
+		flags |= MF_PAX_RANDMMAP;
+	if (proc->pax_flags & GR_PAX_ENABLE_EMUTRAMP)
+		flags |= MF_PAX_EMUTRAMP;
+	if (proc->pax_flags & GR_PAX_ENABLE_MPROTECT)
+		flags |= MF_PAX_MPROTECT;
+
+	pax_set_flags(task, flags);
+
+        return;
+}
+#endif
+
+#ifdef CONFIG_SYSCTL
+/* Eric Biederman likes breaking userland ABI and every inode-based security
+   system to save 35kb of memory */
+
+/* we modify the passed in filename, but adjust it back before returning */
+static struct acl_object_label *gr_lookup_by_name(char *name, unsigned int len)
+{
+	struct name_entry *nmatch;
+	char *p, *lastp = NULL;
+	struct acl_object_label *obj = NULL, *tmp;
+	struct acl_subject_label *tmpsubj;
+	char c = '\0';
+
+	read_lock(&gr_inode_lock);
+
+	p = name + len - 1;
+	do {
+		nmatch = lookup_name_entry(name);
+		if (lastp != NULL)
+			*lastp = c;
+
+		if (nmatch == NULL)
+			goto next_component;
+		tmpsubj = current->acl;
+		do {
+			obj = lookup_acl_obj_label(nmatch->inode, nmatch->device, tmpsubj);
+			if (obj != NULL) {
+				tmp = obj->globbed;
+				while (tmp) {
+					if (!glob_match(tmp->filename, name)) {
+						obj = tmp;
+						goto found_obj;
+					}
+					tmp = tmp->next;
+				}
+				goto found_obj;
+			}
+		} while ((tmpsubj = tmpsubj->parent_subject));
+next_component:
+		/* end case */
+		if (p == name)
+			break;
+
+		while (*p != '/')
+			p--;
+		if (p == name)
+			lastp = p + 1;
+		else {
+			lastp = p;
+			p--;
+		}
+		c = *lastp;
+		*lastp = '\0';
+	} while (1);
+found_obj:
+	read_unlock(&gr_inode_lock);
+	/* obj returned will always be non-null */
+	return obj;
+}
+
+/* returns 0 when allowing, non-zero on error
+   op of 0 is used for readdir, so we don't log the names of hidden files
+*/
+__u32
+gr_handle_sysctl(const struct ctl_table *table, const int op)
+{
+	ctl_table *tmp;
+	const char *proc_sys = "/proc/sys";
+	char *path;
+	struct acl_object_label *obj;
+	unsigned short len = 0, pos = 0, depth = 0, i;
+	__u32 err = 0;
+	__u32 mode = 0;
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+
+	/* for now, ignore operations on non-sysctl entries if it's not a
+	   readdir*/
+	if (table->child != NULL && op != 0)
+		return 0;
+
+	mode |= GR_FIND;
+	/* it's only a read if it's an entry, read on dirs is for readdir */
+	if (op & MAY_READ)
+		mode |= GR_READ;
+	if (op & MAY_WRITE)
+		mode |= GR_WRITE;
+
+	preempt_disable();
+
+	path = per_cpu_ptr(gr_shared_page[0], smp_processor_id());
+
+	/* it's only a read/write if it's an actual entry, not a dir
+	   (which are opened for readdir)
+	*/
+
+	/* convert the requested sysctl entry into a pathname */
+
+	for (tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
+		len += strlen(tmp->procname);
+		len++;
+		depth++;
+	}
+
+	if ((len + depth + strlen(proc_sys) + 1) > PAGE_SIZE) {
+		/* deny */
+		goto out;
+	}
+
+	memset(path, 0, PAGE_SIZE);
+
+	memcpy(path, proc_sys, strlen(proc_sys));
+
+	pos += strlen(proc_sys);
+
+	for (; depth > 0; depth--) {
+		path[pos] = '/';
+		pos++;
+		for (i = 1, tmp = (ctl_table *)table; tmp != NULL; tmp = tmp->parent) {
+			if (depth == i) {
+				memcpy(path + pos, tmp->procname,
+				       strlen(tmp->procname));
+				pos += strlen(tmp->procname);
+			}
+			i++;
+		}
+	}
+
+	obj = gr_lookup_by_name(path, pos);
+	err = obj->mode & (mode | to_gr_audit(mode) | GR_SUPPRESS);
+
+	if (unlikely((current->acl->mode & (GR_LEARN | GR_INHERITLEARN)) &&
+		     ((err & mode) != mode))) {
+		__u32 new_mode = mode;
+
+		new_mode &= ~(GR_AUDITS | GR_SUPPRESS);
+
+		err = 0;
+		gr_log_learn_sysctl(path, new_mode);
+	} else if (!(err & GR_FIND) && !(err & GR_SUPPRESS) && op != 0) {
+		gr_log_hidden_sysctl(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, path);
+		err = -ENOENT;
+	} else if (!(err & GR_FIND)) {
+		err = -ENOENT;
+	} else if (((err & mode) & ~GR_FIND) != (mode & ~GR_FIND) && !(err & GR_SUPPRESS)) {
+		gr_log_str4(GR_DONT_AUDIT, GR_SYSCTL_ACL_MSG, "denied",
+			       path, (mode & GR_READ) ? " reading" : "",
+			       (mode & GR_WRITE) ? " writing" : "");
+		err = -EACCES;
+	} else if ((err & mode) != mode) {
+		err = -EACCES;
+	} else if ((((err & mode) & ~GR_FIND) == (mode & ~GR_FIND)) && (err & GR_AUDITS)) {
+		gr_log_str4(GR_DO_AUDIT, GR_SYSCTL_ACL_MSG, "successful",
+			       path, (mode & GR_READ) ? " reading" : "",
+			       (mode & GR_WRITE) ? " writing" : "");
+		err = 0;
+	} else
+		err = 0;
+
+      out:
+	preempt_enable();
+
+	return err;
+}
+#endif
+
+int
+gr_handle_proc_ptrace(struct task_struct *task)
+{
+	struct file *filp;
+	struct task_struct *tmp = task;
+	struct task_struct *curtemp = current;
+	__u32 retmode;
+
+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+#endif
+
+	read_lock(&tasklist_lock);
+	read_lock(&grsec_exec_file_lock);
+	filp = task->exec_file;
+
+	while (tmp->pid > 0) {
+		if (tmp == curtemp)
+			break;
+		tmp = tmp->real_parent;
+	}
+
+	if (!filp || (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
+				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE))))) {
+		read_unlock(&grsec_exec_file_lock);
+		read_unlock(&tasklist_lock);
+		return 1;
+	}
+
+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
+	if (!(gr_status & GR_READY)) {
+		read_unlock(&grsec_exec_file_lock);
+		read_unlock(&tasklist_lock);
+		return 0;
+	}
+#endif
+
+	retmode = gr_search_file(filp->f_path.dentry, GR_NOPTRACE, filp->f_path.mnt);
+	read_unlock(&grsec_exec_file_lock);
+	read_unlock(&tasklist_lock);
+
+	if (retmode & GR_NOPTRACE)
+		return 1;
+
+	if (!(current->acl->mode & GR_POVERRIDE) && !(current->role->roletype & GR_ROLE_GOD)
+	    && (current->acl != task->acl || (current->acl != current->role->root_label
+	    && current->pid != task->pid)))
+		return 1;
+
+	return 0;
+}
+
+void task_grsec_rbac(struct seq_file *m, struct task_struct *p)
+{
+	if (unlikely(!(gr_status & GR_READY)))
+		return;
+
+	if (!(current->role->roletype & GR_ROLE_GOD))
+		return;
+
+	seq_printf(m, "RBAC:\t%.64s:%c:%.950s\n",
+			p->role->rolename, gr_task_roletype_to_char(p),
+			p->acl->filename);
+}
+
+int
+gr_handle_ptrace(struct task_struct *task, const long request)
+{
+	struct task_struct *tmp = task;
+	struct task_struct *curtemp = current;
+	__u32 retmode;
+
+#ifndef CONFIG_GRKERNSEC_HARDEN_PTRACE
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+#endif
+
+	read_lock(&tasklist_lock);
+	while (tmp->pid > 0) {
+		if (tmp == curtemp)
+			break;
+		tmp = tmp->real_parent;
+	}
+
+	if (tmp->pid == 0 && ((grsec_enable_harden_ptrace && current_uid() && !(gr_status & GR_READY)) ||
+				((gr_status & GR_READY)	&& !(current->acl->mode & GR_RELAXPTRACE)))) {
+		read_unlock(&tasklist_lock);
+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
+		return 1;
+	}
+	read_unlock(&tasklist_lock);
+
+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
+	if (!(gr_status & GR_READY))
+		return 0;
+#endif
+
+	read_lock(&grsec_exec_file_lock);
+	if (unlikely(!task->exec_file)) {
+		read_unlock(&grsec_exec_file_lock);
+		return 0;
+	}
+
+	retmode = gr_search_file(task->exec_file->f_path.dentry, GR_PTRACERD | GR_NOPTRACE, task->exec_file->f_path.mnt);
+	read_unlock(&grsec_exec_file_lock);
+
+	if (retmode & GR_NOPTRACE) {
+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
+		return 1;
+	}
+		
+	if (retmode & GR_PTRACERD) {
+		switch (request) {
+		case PTRACE_POKETEXT:
+		case PTRACE_POKEDATA:
+		case PTRACE_POKEUSR:
+#if !defined(CONFIG_PPC32) && !defined(CONFIG_PPC64) && !defined(CONFIG_PARISC) && !defined(CONFIG_ALPHA) && !defined(CONFIG_IA64)
+		case PTRACE_SETREGS:
+		case PTRACE_SETFPREGS:
+#endif
+#ifdef CONFIG_X86
+		case PTRACE_SETFPXREGS:
+#endif
+#ifdef CONFIG_ALTIVEC
+		case PTRACE_SETVRREGS:
+#endif
+			return 1;
+		default:
+			return 0;
+		}
+	} else if (!(current->acl->mode & GR_POVERRIDE) &&
+		   !(current->role->roletype & GR_ROLE_GOD) &&
+		   (current->acl != task->acl)) {
+		gr_log_ptrace(GR_DONT_AUDIT, GR_PTRACE_ACL_MSG, task);
+		return 1;
+	}
+
+	return 0;
+}
+
+static int is_writable_mmap(const struct file *filp)
+{
+	struct task_struct *task = current;
+	struct acl_object_label *obj, *obj2;
+
+	if (gr_status & GR_READY && !(task->acl->mode & GR_OVERRIDE) &&
+	    !task->is_writable && S_ISREG(filp->f_path.dentry->d_inode->i_mode) && (filp->f_path.mnt != shm_mnt || (filp->f_path.dentry->d_inode->i_nlink > 0))) {
+		obj = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt, default_role->root_label);
+		obj2 = chk_obj_label(filp->f_path.dentry, filp->f_path.mnt,
+				     task->role->root_label);
+		if (unlikely((obj->mode & GR_WRITE) || (obj2->mode & GR_WRITE))) {
+			gr_log_fs_generic(GR_DONT_AUDIT, GR_WRITLIB_ACL_MSG, filp->f_path.dentry, filp->f_path.mnt);
+			return 1;
+		}
+	}
+	return 0;
+}
+
+int
+gr_acl_handle_mmap(const struct file *file, const unsigned long prot)
+{
+	__u32 mode;
+
+	if (unlikely(!file || !(prot & PROT_EXEC)))
+		return 1;
+
+	if (is_writable_mmap(file))
+		return 0;
+
+	mode =
+	    gr_search_file(file->f_path.dentry,
+			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
+			   file->f_path.mnt);
+
+	if (!gr_tpe_allow(file))
+		return 0;
+
+	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
+		return 0;
+	} else if (unlikely(!(mode & GR_EXEC))) {
+		return 0;
+	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MMAP_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
+		return 1;
+	}
+
+	return 1;
+}
+
+int
+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
+{
+	__u32 mode;
+
+	if (unlikely(!file || !(prot & PROT_EXEC)))
+		return 1;
+
+	if (is_writable_mmap(file))
+		return 0;
+
+	mode =
+	    gr_search_file(file->f_path.dentry,
+			   GR_EXEC | GR_AUDIT_EXEC | GR_SUPPRESS,
+			   file->f_path.mnt);
+
+	if (!gr_tpe_allow(file))
+		return 0;
+
+	if (unlikely(!(mode & GR_EXEC) && !(mode & GR_SUPPRESS))) {
+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
+		return 0;
+	} else if (unlikely(!(mode & GR_EXEC))) {
+		return 0;
+	} else if (unlikely(mode & GR_EXEC && mode & GR_AUDIT_EXEC)) {
+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_MPROTECT_ACL_MSG, file->f_path.dentry, file->f_path.mnt);
+		return 1;
+	}
+
+	return 1;
+}
+
+void
+gr_acl_handle_psacct(struct task_struct *task, const long code)
+{
+	unsigned long runtime;
+	unsigned long cputime;
+	unsigned int wday, cday;
+	__u8 whr, chr;
+	__u8 wmin, cmin;
+	__u8 wsec, csec;
+	struct timespec timeval;
+
+	if (unlikely(!(gr_status & GR_READY) || !task->acl ||
+		     !(task->acl->mode & GR_PROCACCT)))
+		return;
+
+	do_posix_clock_monotonic_gettime(&timeval);
+	runtime = timeval.tv_sec - task->start_time.tv_sec;
+	wday = runtime / (3600 * 24);
+	runtime -= wday * (3600 * 24);
+	whr = runtime / 3600;
+	runtime -= whr * 3600;
+	wmin = runtime / 60;
+	runtime -= wmin * 60;
+	wsec = runtime;
+
+	cputime = (task->utime + task->stime) / HZ;
+	cday = cputime / (3600 * 24);
+	cputime -= cday * (3600 * 24);
+	chr = cputime / 3600;
+	cputime -= chr * 3600;
+	cmin = cputime / 60;
+	cputime -= cmin * 60;
+	csec = cputime;
+
+	gr_log_procacct(GR_DO_AUDIT, GR_ACL_PROCACCT_MSG, task, wday, whr, wmin, wsec, cday, chr, cmin, csec, code);
+
+	return;
+}
+
+void gr_set_kernel_label(struct task_struct *task)
+{
+	if (gr_status & GR_READY) {
+		task->role = kernel_role;
+		task->acl = kernel_role->root_label;
+	}
+	return;
+}
+
+#ifdef CONFIG_TASKSTATS
+int gr_is_taskstats_denied(int pid)
+{
+	struct task_struct *task;
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	const struct cred *cred;
+#endif
+	int ret = 0;
+
+	/* restrict taskstats viewing to un-chrooted root users
+	   who have the 'view' subject flag if the RBAC system is enabled
+	*/
+
+	rcu_read_lock();
+	read_lock(&tasklist_lock);
+	task = find_task_by_vpid(pid);
+	if (task) {
+#ifdef CONFIG_GRKERNSEC_CHROOT
+		if (proc_is_chrooted(task))
+			ret = -EACCES;
+#endif
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+		cred = __task_cred(task);
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+		if (cred->uid != 0)
+			ret = -EACCES;
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+		if (cred->uid != 0 && !groups_search(cred->group_info, CONFIG_GRKERNSEC_PROC_GID))
+			ret = -EACCES;
+#endif
+#endif
+		if (gr_status & GR_READY) {
+			if (!(task->acl->mode & GR_VIEW))
+				ret = -EACCES;
+		}
+	} else
+		ret = -ENOENT;
+
+	read_unlock(&tasklist_lock);
+	rcu_read_unlock();
+
+	return ret;
+}
+#endif
+
+/* AUXV entries are filled via a descendant of search_binary_handler
+   after we've already applied the subject for the target
+*/
+int gr_acl_enable_at_secure(void)
+{
+	if (unlikely(!(gr_status & GR_READY)))
+		return 0;
+
+	if (current->acl->mode & GR_ATSECURE)
+		return 1;
+
+	return 0;
+}
+	
+int gr_acl_handle_filldir(const struct file *file, const char *name, const unsigned int namelen, const ino_t ino)
+{
+	struct task_struct *task = current;
+	struct dentry *dentry = file->f_path.dentry;
+	struct vfsmount *mnt = file->f_path.mnt;
+	struct acl_object_label *obj, *tmp;
+	struct acl_subject_label *subj;
+	unsigned int bufsize;
+	int is_not_root;
+	char *path;
+	dev_t dev = __get_dev(dentry);
+
+	if (unlikely(!(gr_status & GR_READY)))
+		return 1;
+
+	if (task->acl->mode & (GR_LEARN | GR_INHERITLEARN))
+		return 1;
+
+	/* ignore Eric Biederman */
+	if (IS_PRIVATE(dentry->d_inode))
+		return 1;
+
+	subj = task->acl;
+	do {
+		obj = lookup_acl_obj_label(ino, dev, subj);
+		if (obj != NULL)
+			return (obj->mode & GR_FIND) ? 1 : 0;
+	} while ((subj = subj->parent_subject));
+	
+	/* this is purely an optimization since we're looking for an object
+	   for the directory we're doing a readdir on
+	   if it's possible for any globbed object to match the entry we're
+	   filling into the directory, then the object we find here will be
+	   an anchor point with attached globbed objects
+	*/
+	obj = chk_obj_label_noglob(dentry, mnt, task->acl);
+	if (obj->globbed == NULL)
+		return (obj->mode & GR_FIND) ? 1 : 0;
+
+	is_not_root = ((obj->filename[0] == '/') &&
+		   (obj->filename[1] == '\0')) ? 0 : 1;
+	bufsize = PAGE_SIZE - namelen - is_not_root;
+
+	/* check bufsize > PAGE_SIZE || bufsize == 0 */
+	if (unlikely((bufsize - 1) > (PAGE_SIZE - 1)))
+		return 1;
+
+	preempt_disable();
+	path = d_real_path(dentry, mnt, per_cpu_ptr(gr_shared_page[0], smp_processor_id()),
+			   bufsize);
+
+	bufsize = strlen(path);
+
+	/* if base is "/", don't append an additional slash */
+	if (is_not_root)
+		*(path + bufsize) = '/';
+	memcpy(path + bufsize + is_not_root, name, namelen);
+	*(path + bufsize + namelen + is_not_root) = '\0';
+
+	tmp = obj->globbed;
+	while (tmp) {
+		if (!glob_match(tmp->filename, path)) {
+			preempt_enable();
+			return (tmp->mode & GR_FIND) ? 1 : 0;
+		}
+		tmp = tmp->next;
+	}
+	preempt_enable();
+	return (obj->mode & GR_FIND) ? 1 : 0;
+}
+
+#ifdef CONFIG_NETFILTER_XT_MATCH_GRADM_MODULE
+EXPORT_SYMBOL(gr_acl_is_enabled);
+#endif
+EXPORT_SYMBOL(gr_learn_resource);
+EXPORT_SYMBOL(gr_set_kernel_label);
+#ifdef CONFIG_SECURITY
+EXPORT_SYMBOL(gr_check_user_change);
+EXPORT_SYMBOL(gr_check_group_change);
+#endif
+
diff -uriN linux-2.6.32.43/grsecurity/gracl_cap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_cap.c
--- linux-2.6.32.43/grsecurity/gracl_cap.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_cap.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,138 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/gracl.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+static const char *captab_log[] = {
+	"CAP_CHOWN",
+	"CAP_DAC_OVERRIDE",
+	"CAP_DAC_READ_SEARCH",
+	"CAP_FOWNER",
+	"CAP_FSETID",
+	"CAP_KILL",
+	"CAP_SETGID",
+	"CAP_SETUID",
+	"CAP_SETPCAP",
+	"CAP_LINUX_IMMUTABLE",
+	"CAP_NET_BIND_SERVICE",
+	"CAP_NET_BROADCAST",
+	"CAP_NET_ADMIN",
+	"CAP_NET_RAW",
+	"CAP_IPC_LOCK",
+	"CAP_IPC_OWNER",
+	"CAP_SYS_MODULE",
+	"CAP_SYS_RAWIO",
+	"CAP_SYS_CHROOT",
+	"CAP_SYS_PTRACE",
+	"CAP_SYS_PACCT",
+	"CAP_SYS_ADMIN",
+	"CAP_SYS_BOOT",
+	"CAP_SYS_NICE",
+	"CAP_SYS_RESOURCE",
+	"CAP_SYS_TIME",
+	"CAP_SYS_TTY_CONFIG",
+	"CAP_MKNOD",
+	"CAP_LEASE",
+	"CAP_AUDIT_WRITE",
+	"CAP_AUDIT_CONTROL",
+	"CAP_SETFCAP",
+	"CAP_MAC_OVERRIDE",
+	"CAP_MAC_ADMIN"
+};
+
+EXPORT_SYMBOL(gr_is_capable);
+EXPORT_SYMBOL(gr_is_capable_nolog);
+
+int
+gr_is_capable(const int cap)
+{
+	struct task_struct *task = current;
+	const struct cred *cred = current_cred();
+	struct acl_subject_label *curracl;
+	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
+	kernel_cap_t cap_audit = __cap_empty_set;
+
+	if (!gr_acl_is_enabled())
+		return 1;
+
+	curracl = task->acl;
+
+	cap_drop = curracl->cap_lower;
+	cap_mask = curracl->cap_mask;
+	cap_audit = curracl->cap_invert_audit;
+
+	while ((curracl = curracl->parent_subject)) {
+		/* if the cap isn't specified in the current computed mask but is specified in the
+		   current level subject, and is lowered in the current level subject, then add
+		   it to the set of dropped capabilities
+		   otherwise, add the current level subject's mask to the current computed mask
+		 */
+		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
+			cap_raise(cap_mask, cap);
+			if (cap_raised(curracl->cap_lower, cap))
+				cap_raise(cap_drop, cap);
+			if (cap_raised(curracl->cap_invert_audit, cap))
+				cap_raise(cap_audit, cap);
+		}
+	}
+
+	if (!cap_raised(cap_drop, cap)) {
+		if (cap_raised(cap_audit, cap))
+			gr_log_cap(GR_DO_AUDIT, GR_CAP_ACL_MSG2, task, captab_log[cap]);
+		return 1;
+	}
+
+	curracl = task->acl;
+
+	if ((curracl->mode & (GR_LEARN | GR_INHERITLEARN))
+	    && cap_raised(cred->cap_effective, cap)) {
+		security_learn(GR_LEARN_AUDIT_MSG, task->role->rolename,
+			       task->role->roletype, cred->uid,
+			       cred->gid, task->exec_file ?
+			       gr_to_filename(task->exec_file->f_path.dentry,
+			       task->exec_file->f_path.mnt) : curracl->filename,
+			       curracl->filename, 0UL,
+			       0UL, "", (unsigned long) cap, &task->signal->saved_ip);
+		return 1;
+	}
+
+	if ((cap >= 0) && (cap < (sizeof(captab_log)/sizeof(captab_log[0]))) && cap_raised(cred->cap_effective, cap) && !cap_raised(cap_audit, cap))
+		gr_log_cap(GR_DONT_AUDIT, GR_CAP_ACL_MSG, task, captab_log[cap]);
+	return 0;
+}
+
+int
+gr_is_capable_nolog(const int cap)
+{
+	struct acl_subject_label *curracl;
+	kernel_cap_t cap_drop = __cap_empty_set, cap_mask = __cap_empty_set;
+
+	if (!gr_acl_is_enabled())
+		return 1;
+
+	curracl = current->acl;
+
+	cap_drop = curracl->cap_lower;
+	cap_mask = curracl->cap_mask;
+
+	while ((curracl = curracl->parent_subject)) {
+		/* if the cap isn't specified in the current computed mask but is specified in the
+		   current level subject, and is lowered in the current level subject, then add
+		   it to the set of dropped capabilities
+		   otherwise, add the current level subject's mask to the current computed mask
+		 */
+		if (!cap_raised(cap_mask, cap) && cap_raised(curracl->cap_mask, cap)) {
+			cap_raise(cap_mask, cap);
+			if (cap_raised(curracl->cap_lower, cap))
+				cap_raise(cap_drop, cap);
+		}
+	}
+
+	if (!cap_raised(cap_drop, cap))
+		return 1;
+
+	return 0;
+}
+
diff -uriN linux-2.6.32.43/grsecurity/gracl_fs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_fs.c
--- linux-2.6.32.43/grsecurity/gracl_fs.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_fs.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,431 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/types.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/stat.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+#include <linux/gracl.h>
+
+__u32
+gr_acl_handle_hidden_file(const struct dentry * dentry,
+			  const struct vfsmount * mnt)
+{
+	__u32 mode;
+
+	if (unlikely(!dentry->d_inode))
+		return GR_FIND;
+
+	mode =
+	    gr_search_file(dentry, GR_FIND | GR_AUDIT_FIND | GR_SUPPRESS, mnt);
+
+	if (unlikely(mode & GR_FIND && mode & GR_AUDIT_FIND)) {
+		gr_log_fs_rbac_generic(GR_DO_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
+		return mode;
+	} else if (unlikely(!(mode & GR_FIND) && !(mode & GR_SUPPRESS))) {
+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, GR_HIDDEN_ACL_MSG, dentry, mnt);
+		return 0;
+	} else if (unlikely(!(mode & GR_FIND)))
+		return 0;
+
+	return GR_FIND;
+}
+
+__u32
+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
+		   const int fmode)
+{
+	__u32 reqmode = GR_FIND;
+	__u32 mode;
+
+	if (unlikely(!dentry->d_inode))
+		return reqmode;
+
+	if (unlikely(fmode & O_APPEND))
+		reqmode |= GR_APPEND;
+	else if (unlikely(fmode & FMODE_WRITE))
+		reqmode |= GR_WRITE;
+	if (likely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
+		reqmode |= GR_READ;
+	if ((fmode & FMODE_GREXEC) && (fmode & FMODE_EXEC))
+		reqmode &= ~GR_READ;
+	mode =
+	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
+			   mnt);
+
+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
+		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
+			       reqmode & GR_READ ? " reading" : "",
+			       reqmode & GR_WRITE ? " writing" : reqmode &
+			       GR_APPEND ? " appending" : "");
+		return reqmode;
+	} else
+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
+	{
+		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_OPEN_ACL_MSG, dentry, mnt,
+			       reqmode & GR_READ ? " reading" : "",
+			       reqmode & GR_WRITE ? " writing" : reqmode &
+			       GR_APPEND ? " appending" : "");
+		return 0;
+	} else if (unlikely((mode & reqmode) != reqmode))
+		return 0;
+
+	return reqmode;
+}
+
+__u32
+gr_acl_handle_creat(const struct dentry * dentry,
+		    const struct dentry * p_dentry,
+		    const struct vfsmount * p_mnt, const int fmode,
+		    const int imode)
+{
+	__u32 reqmode = GR_WRITE | GR_CREATE;
+	__u32 mode;
+
+	if (unlikely(fmode & O_APPEND))
+		reqmode |= GR_APPEND;
+	if (unlikely((fmode & FMODE_READ) && !(fmode & O_DIRECTORY)))
+		reqmode |= GR_READ;
+	if (unlikely((fmode & O_CREAT) && (imode & (S_ISUID | S_ISGID))))
+		reqmode |= GR_SETID;
+
+	mode =
+	    gr_check_create(dentry, p_dentry, p_mnt,
+			    reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
+
+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
+		gr_log_fs_rbac_mode2(GR_DO_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
+			       reqmode & GR_READ ? " reading" : "",
+			       reqmode & GR_WRITE ? " writing" : reqmode &
+			       GR_APPEND ? " appending" : "");
+		return reqmode;
+	} else
+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
+	{
+		gr_log_fs_rbac_mode2(GR_DONT_AUDIT, GR_CREATE_ACL_MSG, dentry, p_mnt,
+			       reqmode & GR_READ ? " reading" : "",
+			       reqmode & GR_WRITE ? " writing" : reqmode &
+			       GR_APPEND ? " appending" : "");
+		return 0;
+	} else if (unlikely((mode & reqmode) != reqmode))
+		return 0;
+
+	return reqmode;
+}
+
+__u32
+gr_acl_handle_access(const struct dentry * dentry, const struct vfsmount * mnt,
+		     const int fmode)
+{
+	__u32 mode, reqmode = GR_FIND;
+
+	if ((fmode & S_IXOTH) && !S_ISDIR(dentry->d_inode->i_mode))
+		reqmode |= GR_EXEC;
+	if (fmode & S_IWOTH)
+		reqmode |= GR_WRITE;
+	if (fmode & S_IROTH)
+		reqmode |= GR_READ;
+
+	mode =
+	    gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS,
+			   mnt);
+
+	if (unlikely(((mode & reqmode) == reqmode) && mode & GR_AUDITS)) {
+		gr_log_fs_rbac_mode3(GR_DO_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
+			       reqmode & GR_READ ? " reading" : "",
+			       reqmode & GR_WRITE ? " writing" : "",
+			       reqmode & GR_EXEC ? " executing" : "");
+		return reqmode;
+	} else
+	    if (unlikely((mode & reqmode) != reqmode && !(mode & GR_SUPPRESS)))
+	{
+		gr_log_fs_rbac_mode3(GR_DONT_AUDIT, GR_ACCESS_ACL_MSG, dentry, mnt,
+			       reqmode & GR_READ ? " reading" : "",
+			       reqmode & GR_WRITE ? " writing" : "",
+			       reqmode & GR_EXEC ? " executing" : "");
+		return 0;
+	} else if (unlikely((mode & reqmode) != reqmode))
+		return 0;
+
+	return reqmode;
+}
+
+static __u32 generic_fs_handler(const struct dentry *dentry, const struct vfsmount *mnt, __u32 reqmode, const char *fmt)
+{
+	__u32 mode;
+
+	mode = gr_search_file(dentry, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS, mnt);
+
+	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
+		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, dentry, mnt);
+		return mode;
+	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, dentry, mnt);
+		return 0;
+	} else if (unlikely((mode & (reqmode)) != (reqmode)))
+		return 0;
+
+	return (reqmode);
+}
+
+__u32
+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
+{
+	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_RMDIR_ACL_MSG);
+}
+
+__u32
+gr_acl_handle_unlink(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return generic_fs_handler(dentry, mnt, GR_WRITE | GR_DELETE , GR_UNLINK_ACL_MSG);
+}
+
+__u32
+gr_acl_handle_truncate(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_TRUNCATE_ACL_MSG);
+}
+
+__u32
+gr_acl_handle_utime(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_ATIME_ACL_MSG);
+}
+
+__u32
+gr_acl_handle_fchmod(const struct dentry *dentry, const struct vfsmount *mnt,
+		     mode_t mode)
+{
+	if (unlikely(dentry->d_inode && S_ISSOCK(dentry->d_inode->i_mode)))
+		return 1;
+
+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
+				   GR_FCHMOD_ACL_MSG);
+	} else {
+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_FCHMOD_ACL_MSG);
+	}
+}
+
+__u32
+gr_acl_handle_chmod(const struct dentry *dentry, const struct vfsmount *mnt,
+		    mode_t mode)
+{
+	if (unlikely((mode != (mode_t)-1) && (mode & (S_ISUID | S_ISGID)))) {
+		return generic_fs_handler(dentry, mnt, GR_WRITE | GR_SETID,
+				   GR_CHMOD_ACL_MSG);
+	} else {
+		return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHMOD_ACL_MSG);
+	}
+}
+
+__u32
+gr_acl_handle_chown(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_CHOWN_ACL_MSG);
+}
+
+__u32
+gr_acl_handle_setxattr(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return generic_fs_handler(dentry, mnt, GR_WRITE, GR_SETXATTR_ACL_MSG);
+}
+
+__u32
+gr_acl_handle_execve(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return generic_fs_handler(dentry, mnt, GR_EXEC, GR_EXEC_ACL_MSG);
+}
+
+__u32
+gr_acl_handle_unix(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return generic_fs_handler(dentry, mnt, GR_READ | GR_WRITE,
+			   GR_UNIXCONNECT_ACL_MSG);
+}
+
+/* hardlinks require at minimum create permission,
+   any additional privilege required is based on the
+   privilege of the file being linked to
+*/
+__u32
+gr_acl_handle_link(const struct dentry * new_dentry,
+		   const struct dentry * parent_dentry,
+		   const struct vfsmount * parent_mnt,
+		   const struct dentry * old_dentry,
+		   const struct vfsmount * old_mnt, const char *to)
+{
+	__u32 mode;
+	__u32 needmode = GR_CREATE | GR_LINK;
+	__u32 needaudit = GR_AUDIT_CREATE | GR_AUDIT_LINK;
+
+	mode =
+	    gr_check_link(new_dentry, parent_dentry, parent_mnt, old_dentry,
+			  old_mnt);
+
+	if (unlikely(((mode & needmode) == needmode) && (mode & needaudit))) {
+		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
+		return mode;
+	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
+		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_LINK_ACL_MSG, old_dentry, old_mnt, to);
+		return 0;
+	} else if (unlikely((mode & needmode) != needmode))
+		return 0;
+
+	return 1;
+}
+
+__u32
+gr_acl_handle_symlink(const struct dentry * new_dentry,
+		      const struct dentry * parent_dentry,
+		      const struct vfsmount * parent_mnt, const char *from)
+{
+	__u32 needmode = GR_WRITE | GR_CREATE;
+	__u32 mode;
+
+	mode =
+	    gr_check_create(new_dentry, parent_dentry, parent_mnt,
+			    GR_CREATE | GR_AUDIT_CREATE |
+			    GR_WRITE | GR_AUDIT_WRITE | GR_SUPPRESS);
+
+	if (unlikely(mode & GR_WRITE && mode & GR_AUDITS)) {
+		gr_log_fs_str_rbac(GR_DO_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
+		return mode;
+	} else if (unlikely(((mode & needmode) != needmode) && !(mode & GR_SUPPRESS))) {
+		gr_log_fs_str_rbac(GR_DONT_AUDIT, GR_SYMLINK_ACL_MSG, from, new_dentry, parent_mnt);
+		return 0;
+	} else if (unlikely((mode & needmode) != needmode))
+		return 0;
+
+	return (GR_WRITE | GR_CREATE);
+}
+
+static __u32 generic_fs_create_handler(const struct dentry *new_dentry, const struct dentry *parent_dentry, const struct vfsmount *parent_mnt, __u32 reqmode, const char *fmt)
+{
+	__u32 mode;
+
+	mode = gr_check_create(new_dentry, parent_dentry, parent_mnt, reqmode | to_gr_audit(reqmode) | GR_SUPPRESS);
+
+	if (unlikely(((mode & (reqmode)) == (reqmode)) && mode & GR_AUDITS)) {
+		gr_log_fs_rbac_generic(GR_DO_AUDIT, fmt, new_dentry, parent_mnt);
+		return mode;
+	} else if (unlikely((mode & (reqmode)) != (reqmode) && !(mode & GR_SUPPRESS))) {
+		gr_log_fs_rbac_generic(GR_DONT_AUDIT, fmt, new_dentry, parent_mnt);
+		return 0;
+	} else if (unlikely((mode & (reqmode)) != (reqmode)))
+		return 0;
+
+	return (reqmode);
+}
+
+__u32
+gr_acl_handle_mknod(const struct dentry * new_dentry,
+		    const struct dentry * parent_dentry,
+		    const struct vfsmount * parent_mnt,
+		    const int mode)
+{
+	__u32 reqmode = GR_WRITE | GR_CREATE;
+	if (unlikely(mode & (S_ISUID | S_ISGID)))
+		reqmode |= GR_SETID;
+
+	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
+				  reqmode, GR_MKNOD_ACL_MSG);
+}
+
+__u32
+gr_acl_handle_mkdir(const struct dentry *new_dentry,
+		    const struct dentry *parent_dentry,
+		    const struct vfsmount *parent_mnt)
+{
+	return generic_fs_create_handler(new_dentry, parent_dentry, parent_mnt,
+				  GR_WRITE | GR_CREATE, GR_MKDIR_ACL_MSG);
+}
+
+#define RENAME_CHECK_SUCCESS(old, new) \
+	(((old & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)) && \
+	 ((new & (GR_WRITE | GR_READ)) == (GR_WRITE | GR_READ)))
+
+int
+gr_acl_handle_rename(struct dentry *new_dentry,
+		     struct dentry *parent_dentry,
+		     const struct vfsmount *parent_mnt,
+		     struct dentry *old_dentry,
+		     struct inode *old_parent_inode,
+		     struct vfsmount *old_mnt, const char *newname)
+{
+	__u32 comp1, comp2;
+	int error = 0;
+
+	if (unlikely(!gr_acl_is_enabled()))
+		return 0;
+
+	if (!new_dentry->d_inode) {
+		comp1 = gr_check_create(new_dentry, parent_dentry, parent_mnt,
+					GR_READ | GR_WRITE | GR_CREATE | GR_AUDIT_READ |
+					GR_AUDIT_WRITE | GR_AUDIT_CREATE | GR_SUPPRESS);
+		comp2 = gr_search_file(old_dentry, GR_READ | GR_WRITE |
+				       GR_DELETE | GR_AUDIT_DELETE |
+				       GR_AUDIT_READ | GR_AUDIT_WRITE |
+				       GR_SUPPRESS, old_mnt);
+	} else {
+		comp1 = gr_search_file(new_dentry, GR_READ | GR_WRITE |
+				       GR_CREATE | GR_DELETE |
+				       GR_AUDIT_CREATE | GR_AUDIT_DELETE |
+				       GR_AUDIT_READ | GR_AUDIT_WRITE |
+				       GR_SUPPRESS, parent_mnt);
+		comp2 =
+		    gr_search_file(old_dentry,
+				   GR_READ | GR_WRITE | GR_AUDIT_READ |
+				   GR_DELETE | GR_AUDIT_DELETE |
+				   GR_AUDIT_WRITE | GR_SUPPRESS, old_mnt);
+	}
+
+	if (RENAME_CHECK_SUCCESS(comp1, comp2) &&
+	    ((comp1 & GR_AUDITS) || (comp2 & GR_AUDITS)))
+		gr_log_fs_rbac_str(GR_DO_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
+	else if (!RENAME_CHECK_SUCCESS(comp1, comp2) && !(comp1 & GR_SUPPRESS)
+		 && !(comp2 & GR_SUPPRESS)) {
+		gr_log_fs_rbac_str(GR_DONT_AUDIT, GR_RENAME_ACL_MSG, old_dentry, old_mnt, newname);
+		error = -EACCES;
+	} else if (unlikely(!RENAME_CHECK_SUCCESS(comp1, comp2)))
+		error = -EACCES;
+
+	return error;
+}
+
+void
+gr_acl_handle_exit(void)
+{
+	u16 id;
+	char *rolename;
+	struct file *exec_file;
+
+	if (unlikely(current->acl_sp_role && gr_acl_is_enabled() && 
+		     !(current->role->roletype & GR_ROLE_PERSIST))) {
+		id = current->acl_role_id;
+		rolename = current->role->rolename;
+		gr_set_acls(1);
+		gr_log_str_int(GR_DONT_AUDIT_GOOD, GR_SPROLEL_ACL_MSG, rolename, id);
+	}
+
+	write_lock(&grsec_exec_file_lock);
+	exec_file = current->exec_file;
+	current->exec_file = NULL;
+	write_unlock(&grsec_exec_file_lock);
+
+	if (exec_file)
+		fput(exec_file);
+}
+
+int
+gr_acl_handle_procpidmem(const struct task_struct *task)
+{
+	if (unlikely(!gr_acl_is_enabled()))
+		return 0;
+
+	if (task != current && task->acl->mode & GR_PROTPROCFD)
+		return -EACCES;
+
+	return 0;
+}
diff -uriN linux-2.6.32.43/grsecurity/gracl_ip.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_ip.c
--- linux-2.6.32.43/grsecurity/gracl_ip.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_ip.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,382 @@
+#include <linux/kernel.h>
+#include <asm/uaccess.h>
+#include <asm/errno.h>
+#include <net/sock.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/net.h>
+#include <linux/in.h>
+#include <linux/skbuff.h>
+#include <linux/ip.h>
+#include <linux/udp.h>
+#include <linux/smp_lock.h>
+#include <linux/types.h>
+#include <linux/sched.h>
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <linux/gracl.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+#define GR_BIND			0x01
+#define GR_CONNECT		0x02
+#define GR_INVERT		0x04
+#define GR_BINDOVERRIDE		0x08
+#define GR_CONNECTOVERRIDE	0x10
+#define GR_SOCK_FAMILY		0x20
+
+static const char * gr_protocols[IPPROTO_MAX] = {
+	"ip", "icmp", "igmp", "ggp", "ipencap", "st", "tcp", "cbt",
+	"egp", "igp", "bbn-rcc", "nvp", "pup", "argus", "emcon", "xnet",
+	"chaos", "udp", "mux", "dcn", "hmp", "prm", "xns-idp", "trunk-1",
+	"trunk-2", "leaf-1", "leaf-2", "rdp", "irtp", "iso-tp4", "netblt", "mfe-nsp",
+	"merit-inp", "sep", "3pc", "idpr", "xtp", "ddp", "idpr-cmtp", "tp++",
+	"il", "ipv6", "sdrp", "ipv6-route", "ipv6-frag", "idrp", "rsvp", "gre",
+	"mhrp", "bna", "ipv6-crypt", "ipv6-auth", "i-nlsp", "swipe", "narp", "mobile",
+	"tlsp", "skip", "ipv6-icmp", "ipv6-nonxt", "ipv6-opts", "unknown:61", "cftp", "unknown:63",
+	"sat-expak", "kryptolan", "rvd", "ippc", "unknown:68", "sat-mon", "visa", "ipcv",
+	"cpnx", "cphb", "wsn", "pvp", "br-sat-mon", "sun-nd", "wb-mon", "wb-expak", 
+	"iso-ip", "vmtp", "secure-vmtp", "vines", "ttp", "nfsnet-igp", "dgp", "tcf", 
+	"eigrp", "ospf", "sprite-rpc", "larp", "mtp", "ax.25", "ipip", "micp",
+	"scc-sp", "etherip", "encap", "unknown:99", "gmtp", "ifmp", "pnni", "pim",
+	"aris", "scps", "qnx", "a/n", "ipcomp", "snp", "compaq-peer", "ipx-in-ip",
+	"vrrp", "pgm", "unknown:114", "l2tp", "ddx", "iatp", "stp", "srp",
+	"uti", "smp", "sm", "ptp", "isis", "fire", "crtp", "crdup",
+	"sscopmce", "iplt", "sps", "pipe", "sctp", "fc", "unkown:134", "unknown:135",
+	"unknown:136", "unknown:137", "unknown:138", "unknown:139", "unknown:140", "unknown:141", "unknown:142", "unknown:143",
+	"unknown:144", "unknown:145", "unknown:146", "unknown:147", "unknown:148", "unknown:149", "unknown:150", "unknown:151",
+	"unknown:152", "unknown:153", "unknown:154", "unknown:155", "unknown:156", "unknown:157", "unknown:158", "unknown:159",
+	"unknown:160", "unknown:161", "unknown:162", "unknown:163", "unknown:164", "unknown:165", "unknown:166", "unknown:167",
+	"unknown:168", "unknown:169", "unknown:170", "unknown:171", "unknown:172", "unknown:173", "unknown:174", "unknown:175",
+	"unknown:176", "unknown:177", "unknown:178", "unknown:179", "unknown:180", "unknown:181", "unknown:182", "unknown:183",
+	"unknown:184", "unknown:185", "unknown:186", "unknown:187", "unknown:188", "unknown:189", "unknown:190", "unknown:191",
+	"unknown:192", "unknown:193", "unknown:194", "unknown:195", "unknown:196", "unknown:197", "unknown:198", "unknown:199",
+	"unknown:200", "unknown:201", "unknown:202", "unknown:203", "unknown:204", "unknown:205", "unknown:206", "unknown:207",
+	"unknown:208", "unknown:209", "unknown:210", "unknown:211", "unknown:212", "unknown:213", "unknown:214", "unknown:215",
+	"unknown:216", "unknown:217", "unknown:218", "unknown:219", "unknown:220", "unknown:221", "unknown:222", "unknown:223",
+	"unknown:224", "unknown:225", "unknown:226", "unknown:227", "unknown:228", "unknown:229", "unknown:230", "unknown:231",
+	"unknown:232", "unknown:233", "unknown:234", "unknown:235", "unknown:236", "unknown:237", "unknown:238", "unknown:239",
+	"unknown:240", "unknown:241", "unknown:242", "unknown:243", "unknown:244", "unknown:245", "unknown:246", "unknown:247",
+	"unknown:248", "unknown:249", "unknown:250", "unknown:251", "unknown:252", "unknown:253", "unknown:254", "unknown:255",
+	};
+
+static const char * gr_socktypes[SOCK_MAX] = {
+	"unknown:0", "stream", "dgram", "raw", "rdm", "seqpacket", "unknown:6", 
+	"unknown:7", "unknown:8", "unknown:9", "packet"
+	};
+
+static const char * gr_sockfamilies[AF_MAX+1] = {
+	"unspec", "unix", "inet", "ax25", "ipx", "appletalk", "netrom", "bridge", "atmpvc", "x25",
+	"inet6", "rose", "decnet", "netbeui", "security", "key", "netlink", "packet", "ash",
+	"econet", "atmsvc", "rds", "sna", "irda", "ppox", "wanpipe", "llc", "fam_27", "fam_28",
+	"tipc", "bluetooth", "iucv", "rxrpc", "isdn", "phonet", "ieee802154"
+	};
+
+const char *
+gr_proto_to_name(unsigned char proto)
+{
+	return gr_protocols[proto];
+}
+
+const char *
+gr_socktype_to_name(unsigned char type)
+{
+	return gr_socktypes[type];
+}
+
+const char *
+gr_sockfamily_to_name(unsigned char family)
+{
+	return gr_sockfamilies[family];
+}
+
+int
+gr_search_socket(const int domain, const int type, const int protocol)
+{
+	struct acl_subject_label *curr;
+	const struct cred *cred = current_cred();
+
+	if (unlikely(!gr_acl_is_enabled()))
+		goto exit;
+
+	if ((domain < 0) || (type < 0) || (protocol < 0) ||
+	    (domain >= AF_MAX) || (type >= SOCK_MAX) || (protocol >= IPPROTO_MAX))
+		goto exit;	// let the kernel handle it
+
+	curr = current->acl;
+
+	if (curr->sock_families[domain / 32] & (1 << (domain % 32))) {
+		/* the family is allowed, if this is PF_INET allow it only if
+		   the extra sock type/protocol checks pass */
+		if (domain == PF_INET)
+			goto inet_check;
+		goto exit;
+	} else {
+		if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
+			__u32 fakeip = 0;
+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
+				       current->role->roletype, cred->uid,
+				       cred->gid, current->exec_file ?
+				       gr_to_filename(current->exec_file->f_path.dentry,
+				       current->exec_file->f_path.mnt) :
+				       curr->filename, curr->filename,
+				       &fakeip, domain, 0, 0, GR_SOCK_FAMILY,
+				       &current->signal->saved_ip);
+			goto exit;
+		}
+		goto exit_fail;
+	}
+
+inet_check:
+	/* the rest of this checking is for IPv4 only */
+	if (!curr->ips)
+		goto exit;
+
+	if ((curr->ip_type & (1 << type)) &&
+	    (curr->ip_proto[protocol / 32] & (1 << (protocol % 32))))
+		goto exit;
+
+	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
+		/* we don't place acls on raw sockets , and sometimes
+		   dgram/ip sockets are opened for ioctl and not
+		   bind/connect, so we'll fake a bind learn log */
+		if (type == SOCK_RAW || type == SOCK_PACKET) {
+			__u32 fakeip = 0;
+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
+				       current->role->roletype, cred->uid,
+				       cred->gid, current->exec_file ?
+				       gr_to_filename(current->exec_file->f_path.dentry,
+				       current->exec_file->f_path.mnt) :
+				       curr->filename, curr->filename,
+				       &fakeip, 0, type,
+				       protocol, GR_CONNECT, &current->signal->saved_ip);
+		} else if ((type == SOCK_DGRAM) && (protocol == IPPROTO_IP)) {
+			__u32 fakeip = 0;
+			security_learn(GR_IP_LEARN_MSG, current->role->rolename,
+				       current->role->roletype, cred->uid,
+				       cred->gid, current->exec_file ?
+				       gr_to_filename(current->exec_file->f_path.dentry,
+				       current->exec_file->f_path.mnt) :
+				       curr->filename, curr->filename,
+				       &fakeip, 0, type,
+				       protocol, GR_BIND, &current->signal->saved_ip);
+		}
+		/* we'll log when they use connect or bind */
+		goto exit;
+	}
+
+exit_fail:
+	if (domain == PF_INET)
+		gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(domain), 
+			    gr_socktype_to_name(type), gr_proto_to_name(protocol));
+	else
+		gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(domain), 
+			    gr_socktype_to_name(type), protocol);
+
+	return 0;
+exit:
+	return 1;
+}
+
+int check_ip_policy(struct acl_ip_label *ip, __u32 ip_addr, __u16 ip_port, __u8 protocol, const int mode, const int type, __u32 our_addr, __u32 our_netmask)
+{
+	if ((ip->mode & mode) &&
+	    (ip_port >= ip->low) &&
+	    (ip_port <= ip->high) &&
+	    ((ntohl(ip_addr) & our_netmask) ==
+	     (ntohl(our_addr) & our_netmask))
+	    && (ip->proto[protocol / 32] & (1 << (protocol % 32)))
+	    && (ip->type & (1 << type))) {
+		if (ip->mode & GR_INVERT)
+			return 2; // specifically denied
+		else
+			return 1; // allowed
+	}
+
+	return 0; // not specifically allowed, may continue parsing
+}
+
+static int
+gr_search_connectbind(const int full_mode, struct sock *sk,
+		      struct sockaddr_in *addr, const int type)
+{
+	char iface[IFNAMSIZ] = {0};
+	struct acl_subject_label *curr;
+	struct acl_ip_label *ip;
+	struct inet_sock *isk;
+	struct net_device *dev;
+	struct in_device *idev;
+	unsigned long i;
+	int ret;
+	int mode = full_mode & (GR_BIND | GR_CONNECT);
+	__u32 ip_addr = 0;
+	__u32 our_addr;
+	__u32 our_netmask;
+	char *p;
+	__u16 ip_port = 0;
+	const struct cred *cred = current_cred();
+
+	if (unlikely(!gr_acl_is_enabled() || sk->sk_family != PF_INET))
+		return 0;
+
+	curr = current->acl;
+	isk = inet_sk(sk);
+
+	/* INADDR_ANY overriding for binds, inaddr_any_override is already in network order */
+	if ((full_mode & GR_BINDOVERRIDE) && addr->sin_addr.s_addr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0)
+		addr->sin_addr.s_addr = curr->inaddr_any_override;
+	if ((full_mode & GR_CONNECT) && isk->saddr == htonl(INADDR_ANY) && curr->inaddr_any_override != 0) {
+		struct sockaddr_in saddr;
+		int err;
+
+		saddr.sin_family = AF_INET;
+		saddr.sin_addr.s_addr = curr->inaddr_any_override;
+		saddr.sin_port = isk->sport;
+
+		err = security_socket_bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
+		if (err)
+			return err;
+
+		err = sk->sk_socket->ops->bind(sk->sk_socket, (struct sockaddr *)&saddr, sizeof(struct sockaddr_in));
+		if (err)
+			return err;
+	}
+
+	if (!curr->ips)
+		return 0;
+
+	ip_addr = addr->sin_addr.s_addr;
+	ip_port = ntohs(addr->sin_port);
+
+	if (curr->mode & (GR_LEARN | GR_INHERITLEARN)) {
+		security_learn(GR_IP_LEARN_MSG, current->role->rolename,
+			       current->role->roletype, cred->uid,
+			       cred->gid, current->exec_file ?
+			       gr_to_filename(current->exec_file->f_path.dentry,
+			       current->exec_file->f_path.mnt) :
+			       curr->filename, curr->filename,
+			       &ip_addr, ip_port, type,
+			       sk->sk_protocol, mode, &current->signal->saved_ip);
+		return 0;
+	}
+
+	for (i = 0; i < curr->ip_num; i++) {
+		ip = *(curr->ips + i);
+		if (ip->iface != NULL) {
+			strncpy(iface, ip->iface, IFNAMSIZ - 1);
+			p = strchr(iface, ':');
+			if (p != NULL)
+				*p = '\0';
+			dev = dev_get_by_name(sock_net(sk), iface);
+			if (dev == NULL)
+				continue;
+			idev = in_dev_get(dev);
+			if (idev == NULL) {
+				dev_put(dev);
+				continue;
+			}
+			rcu_read_lock();
+			for_ifa(idev) {
+				if (!strcmp(ip->iface, ifa->ifa_label)) {
+					our_addr = ifa->ifa_address;
+					our_netmask = 0xffffffff;
+					ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
+					if (ret == 1) {
+						rcu_read_unlock();
+						in_dev_put(idev);
+						dev_put(dev);
+						return 0;
+					} else if (ret == 2) {
+						rcu_read_unlock();
+						in_dev_put(idev);
+						dev_put(dev);
+						goto denied;
+					}
+				}
+			} endfor_ifa(idev);
+			rcu_read_unlock();
+			in_dev_put(idev);
+			dev_put(dev);
+		} else {
+			our_addr = ip->addr;
+			our_netmask = ip->netmask;
+			ret = check_ip_policy(ip, ip_addr, ip_port, sk->sk_protocol, mode, type, our_addr, our_netmask);
+			if (ret == 1)
+				return 0;
+			else if (ret == 2)
+				goto denied;
+		}
+	}
+
+denied:
+	if (mode == GR_BIND)
+		gr_log_int5_str2(GR_DONT_AUDIT, GR_BIND_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
+	else if (mode == GR_CONNECT)
+		gr_log_int5_str2(GR_DONT_AUDIT, GR_CONNECT_ACL_MSG, &ip_addr, ip_port, gr_socktype_to_name(type), gr_proto_to_name(sk->sk_protocol));
+
+	return -EACCES;
+}
+
+int
+gr_search_connect(struct socket *sock, struct sockaddr_in *addr)
+{
+	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sock->sk, addr, sock->type);
+}
+
+int
+gr_search_bind(struct socket *sock, struct sockaddr_in *addr)
+{
+	return gr_search_connectbind(GR_BIND | GR_BINDOVERRIDE, sock->sk, addr, sock->type);
+}
+
+int gr_search_listen(struct socket *sock)
+{
+	struct sock *sk = sock->sk;
+	struct sockaddr_in addr;
+
+	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
+	addr.sin_port = inet_sk(sk)->sport;
+
+	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
+}
+
+int gr_search_accept(struct socket *sock)
+{
+	struct sock *sk = sock->sk;
+	struct sockaddr_in addr;
+
+	addr.sin_addr.s_addr = inet_sk(sk)->saddr;
+	addr.sin_port = inet_sk(sk)->sport;
+
+	return gr_search_connectbind(GR_BIND | GR_CONNECTOVERRIDE, sock->sk, &addr, sock->type);
+}
+
+int
+gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr)
+{
+	if (addr)
+		return gr_search_connectbind(GR_CONNECT, sk, addr, SOCK_DGRAM);
+	else {
+		struct sockaddr_in sin;
+		const struct inet_sock *inet = inet_sk(sk);
+
+		sin.sin_addr.s_addr = inet->daddr;
+		sin.sin_port = inet->dport;
+
+		return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
+	}
+}
+
+int
+gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb)
+{
+	struct sockaddr_in sin;
+
+	if (unlikely(skb->len < sizeof (struct udphdr)))
+		return 0;	// skip this packet
+
+	sin.sin_addr.s_addr = ip_hdr(skb)->saddr;
+	sin.sin_port = udp_hdr(skb)->source;
+
+	return gr_search_connectbind(GR_CONNECT | GR_CONNECTOVERRIDE, sk, &sin, SOCK_DGRAM);
+}
diff -uriN linux-2.6.32.43/grsecurity/gracl_learn.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_learn.c
--- linux-2.6.32.43/grsecurity/gracl_learn.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_learn.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,208 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/poll.h>
+#include <linux/smp_lock.h>
+#include <linux/string.h>
+#include <linux/file.h>
+#include <linux/types.h>
+#include <linux/vmalloc.h>
+#include <linux/grinternal.h>
+
+extern ssize_t write_grsec_handler(struct file * file, const char __user * buf,
+				   size_t count, loff_t *ppos);
+extern int gr_acl_is_enabled(void);
+
+static DECLARE_WAIT_QUEUE_HEAD(learn_wait);
+static int gr_learn_attached;
+
+/* use a 512k buffer */
+#define LEARN_BUFFER_SIZE (512 * 1024)
+
+static DEFINE_SPINLOCK(gr_learn_lock);
+static DEFINE_MUTEX(gr_learn_user_mutex);
+
+/* we need to maintain two buffers, so that the kernel context of grlearn
+   uses a semaphore around the userspace copying, and the other kernel contexts
+   use a spinlock when copying into the buffer, since they cannot sleep
+*/
+static char *learn_buffer;
+static char *learn_buffer_user;
+static int learn_buffer_len;
+static int learn_buffer_user_len;
+
+static ssize_t
+read_learn(struct file *file, char __user * buf, size_t count, loff_t * ppos)
+{
+	DECLARE_WAITQUEUE(wait, current);
+	ssize_t retval = 0;
+
+	add_wait_queue(&learn_wait, &wait);
+	set_current_state(TASK_INTERRUPTIBLE);
+	do {
+		mutex_lock(&gr_learn_user_mutex);
+		spin_lock(&gr_learn_lock);
+		if (learn_buffer_len)
+			break;
+		spin_unlock(&gr_learn_lock);
+		mutex_unlock(&gr_learn_user_mutex);
+		if (file->f_flags & O_NONBLOCK) {
+			retval = -EAGAIN;
+			goto out;
+		}
+		if (signal_pending(current)) {
+			retval = -ERESTARTSYS;
+			goto out;
+		}
+
+		schedule();
+	} while (1);
+
+	memcpy(learn_buffer_user, learn_buffer, learn_buffer_len);
+	learn_buffer_user_len = learn_buffer_len;
+	retval = learn_buffer_len;
+	learn_buffer_len = 0;
+
+	spin_unlock(&gr_learn_lock);
+
+	if (copy_to_user(buf, learn_buffer_user, learn_buffer_user_len))
+		retval = -EFAULT;
+
+	mutex_unlock(&gr_learn_user_mutex);
+out:
+	set_current_state(TASK_RUNNING);
+	remove_wait_queue(&learn_wait, &wait);
+	return retval;
+}
+
+static unsigned int
+poll_learn(struct file * file, poll_table * wait)
+{
+	poll_wait(file, &learn_wait, wait);
+
+	if (learn_buffer_len)
+		return (POLLIN | POLLRDNORM);
+
+	return 0;
+}
+
+void
+gr_clear_learn_entries(void)
+{
+	char *tmp;
+
+	mutex_lock(&gr_learn_user_mutex);
+	spin_lock(&gr_learn_lock);
+	tmp = learn_buffer;
+	learn_buffer = NULL;
+	spin_unlock(&gr_learn_lock);
+	if (tmp)
+		vfree(tmp);
+	if (learn_buffer_user != NULL) {
+		vfree(learn_buffer_user);
+		learn_buffer_user = NULL;
+	}
+	learn_buffer_len = 0;
+	mutex_unlock(&gr_learn_user_mutex);
+
+	return;
+}
+
+void
+gr_add_learn_entry(const char *fmt, ...)
+{
+	va_list args;
+	unsigned int len;
+
+	if (!gr_learn_attached)
+		return;
+
+	spin_lock(&gr_learn_lock);
+
+	/* leave a gap at the end so we know when it's "full" but don't have to
+	   compute the exact length of the string we're trying to append
+	*/
+	if (learn_buffer_len > LEARN_BUFFER_SIZE - 16384) {
+		spin_unlock(&gr_learn_lock);
+		wake_up_interruptible(&learn_wait);
+		return;
+	}
+	if (learn_buffer == NULL) {
+		spin_unlock(&gr_learn_lock);
+		return;
+	}
+
+	va_start(args, fmt);
+	len = vsnprintf(learn_buffer + learn_buffer_len, LEARN_BUFFER_SIZE - learn_buffer_len, fmt, args);
+	va_end(args);
+
+	learn_buffer_len += len + 1;
+
+	spin_unlock(&gr_learn_lock);
+	wake_up_interruptible(&learn_wait);
+
+	return;
+}
+
+static int
+open_learn(struct inode *inode, struct file *file)
+{
+	if (file->f_mode & FMODE_READ && gr_learn_attached)
+		return -EBUSY;
+	if (file->f_mode & FMODE_READ) {
+		int retval = 0;
+		mutex_lock(&gr_learn_user_mutex);
+		if (learn_buffer == NULL)
+			learn_buffer = vmalloc(LEARN_BUFFER_SIZE);
+		if (learn_buffer_user == NULL)
+			learn_buffer_user = vmalloc(LEARN_BUFFER_SIZE);
+		if (learn_buffer == NULL) {
+			retval = -ENOMEM;
+			goto out_error;
+		}
+		if (learn_buffer_user == NULL) {
+			retval = -ENOMEM;
+			goto out_error;
+		}
+		learn_buffer_len = 0;
+		learn_buffer_user_len = 0;
+		gr_learn_attached = 1;
+out_error:
+		mutex_unlock(&gr_learn_user_mutex);
+		return retval;
+	}
+	return 0;
+}
+
+static int
+close_learn(struct inode *inode, struct file *file)
+{
+	if (file->f_mode & FMODE_READ) {
+		char *tmp = NULL;
+		mutex_lock(&gr_learn_user_mutex);
+		spin_lock(&gr_learn_lock);
+		tmp = learn_buffer;
+		learn_buffer = NULL;
+		spin_unlock(&gr_learn_lock);
+		if (tmp)
+			vfree(tmp);
+		if (learn_buffer_user != NULL) {
+			vfree(learn_buffer_user);
+			learn_buffer_user = NULL;
+		}
+		learn_buffer_len = 0;
+		learn_buffer_user_len = 0;
+		gr_learn_attached = 0;
+		mutex_unlock(&gr_learn_user_mutex);
+	}
+
+	return 0;
+}
+		
+const struct file_operations grsec_fops = {
+	.read		= read_learn,
+	.write		= write_grsec_handler,
+	.open		= open_learn,
+	.release	= close_learn,
+	.poll		= poll_learn,
+};
diff -uriN linux-2.6.32.43/grsecurity/gracl_res.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_res.c
--- linux-2.6.32.43/grsecurity/gracl_res.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_res.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,67 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/gracl.h>
+#include <linux/grinternal.h>
+
+static const char *restab_log[] = {
+	[RLIMIT_CPU] = "RLIMIT_CPU",
+	[RLIMIT_FSIZE] = "RLIMIT_FSIZE",
+	[RLIMIT_DATA] = "RLIMIT_DATA",
+	[RLIMIT_STACK] = "RLIMIT_STACK",
+	[RLIMIT_CORE] = "RLIMIT_CORE",
+	[RLIMIT_RSS] = "RLIMIT_RSS",
+	[RLIMIT_NPROC] = "RLIMIT_NPROC",
+	[RLIMIT_NOFILE] = "RLIMIT_NOFILE",
+	[RLIMIT_MEMLOCK] = "RLIMIT_MEMLOCK",
+	[RLIMIT_AS] = "RLIMIT_AS",
+	[RLIMIT_LOCKS] = "RLIMIT_LOCKS",
+	[RLIMIT_SIGPENDING] = "RLIMIT_SIGPENDING",
+	[RLIMIT_MSGQUEUE] = "RLIMIT_MSGQUEUE",
+	[RLIMIT_NICE] = "RLIMIT_NICE",
+	[RLIMIT_RTPRIO] = "RLIMIT_RTPRIO",
+	[RLIMIT_RTTIME] = "RLIMIT_RTTIME",
+	[GR_CRASH_RES] = "RLIMIT_CRASH"
+};
+
+void
+gr_log_resource(const struct task_struct *task,
+		const int res, const unsigned long wanted, const int gt)
+{
+	const struct cred *cred;
+	unsigned long rlim;
+
+	if (!gr_acl_is_enabled() && !grsec_resource_logging)
+		return;
+
+	// not yet supported resource
+	if (unlikely(!restab_log[res]))
+		return;
+
+	if (res == RLIMIT_CPU || res == RLIMIT_RTTIME)
+		rlim = task->signal->rlim[res].rlim_max;
+	else
+		rlim = task->signal->rlim[res].rlim_cur;
+	if (likely((rlim == RLIM_INFINITY) || (gt && wanted <= rlim) || (!gt && wanted < rlim)))
+		return;
+
+	rcu_read_lock();
+	cred = __task_cred(task);
+
+	if (res == RLIMIT_NPROC && 
+	    (cap_raised(cred->cap_effective, CAP_SYS_ADMIN) || 
+	     cap_raised(cred->cap_effective, CAP_SYS_RESOURCE)))
+		goto out_rcu_unlock;
+	else if (res == RLIMIT_MEMLOCK &&
+		 cap_raised(cred->cap_effective, CAP_IPC_LOCK))
+		goto out_rcu_unlock;
+	else if (res == RLIMIT_NICE && cap_raised(cred->cap_effective, CAP_SYS_NICE))
+		goto out_rcu_unlock;
+	rcu_read_unlock();
+
+	gr_log_res_ulong2_str(GR_DONT_AUDIT, GR_RESOURCE_MSG, task, wanted, restab_log[res], rlim);
+
+	return;
+out_rcu_unlock:
+	rcu_read_unlock();
+	return;
+}
diff -uriN linux-2.6.32.43/grsecurity/gracl_segv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_segv.c
--- linux-2.6.32.43/grsecurity/gracl_segv.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_segv.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,284 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <asm/uaccess.h>
+#include <asm/errno.h>
+#include <asm/mman.h>
+#include <net/sock.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/net.h>
+#include <linux/in.h>
+#include <linux/smp_lock.h>
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/sched.h>
+#include <linux/timer.h>
+#include <linux/gracl.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+static struct crash_uid *uid_set;
+static unsigned short uid_used;
+static DEFINE_SPINLOCK(gr_uid_lock);
+extern rwlock_t gr_inode_lock;
+extern struct acl_subject_label *
+	lookup_acl_subj_label(const ino_t inode, const dev_t dev,
+			      struct acl_role_label *role);
+extern int gr_fake_force_sig(int sig, struct task_struct *t);
+
+int
+gr_init_uidset(void)
+{
+	uid_set =
+	    kmalloc(GR_UIDTABLE_MAX * sizeof (struct crash_uid), GFP_KERNEL);
+	uid_used = 0;
+
+	return uid_set ? 1 : 0;
+}
+
+void
+gr_free_uidset(void)
+{
+	if (uid_set)
+		kfree(uid_set);
+
+	return;
+}
+
+int
+gr_find_uid(const uid_t uid)
+{
+	struct crash_uid *tmp = uid_set;
+	uid_t buid;
+	int low = 0, high = uid_used - 1, mid;
+
+	while (high >= low) {
+		mid = (low + high) >> 1;
+		buid = tmp[mid].uid;
+		if (buid == uid)
+			return mid;
+		if (buid > uid)
+			high = mid - 1;
+		if (buid < uid)
+			low = mid + 1;
+	}
+
+	return -1;
+}
+
+static __inline__ void
+gr_insertsort(void)
+{
+	unsigned short i, j;
+	struct crash_uid index;
+
+	for (i = 1; i < uid_used; i++) {
+		index = uid_set[i];
+		j = i;
+		while ((j > 0) && uid_set[j - 1].uid > index.uid) {
+			uid_set[j] = uid_set[j - 1];
+			j--;
+		}
+		uid_set[j] = index;
+	}
+
+	return;
+}
+
+static __inline__ void
+gr_insert_uid(const uid_t uid, const unsigned long expires)
+{
+	int loc;
+
+	if (uid_used == GR_UIDTABLE_MAX)
+		return;
+
+	loc = gr_find_uid(uid);
+
+	if (loc >= 0) {
+		uid_set[loc].expires = expires;
+		return;
+	}
+
+	uid_set[uid_used].uid = uid;
+	uid_set[uid_used].expires = expires;
+	uid_used++;
+
+	gr_insertsort();
+
+	return;
+}
+
+void
+gr_remove_uid(const unsigned short loc)
+{
+	unsigned short i;
+
+	for (i = loc + 1; i < uid_used; i++)
+		uid_set[i - 1] = uid_set[i];
+
+	uid_used--;
+
+	return;
+}
+
+int
+gr_check_crash_uid(const uid_t uid)
+{
+	int loc;
+	int ret = 0;
+
+	if (unlikely(!gr_acl_is_enabled()))
+		return 0;
+
+	spin_lock(&gr_uid_lock);
+	loc = gr_find_uid(uid);
+
+	if (loc < 0)
+		goto out_unlock;
+
+	if (time_before_eq(uid_set[loc].expires, get_seconds()))
+		gr_remove_uid(loc);
+	else
+		ret = 1;
+
+out_unlock:
+	spin_unlock(&gr_uid_lock);
+	return ret;
+}
+
+static __inline__ int
+proc_is_setxid(const struct cred *cred)
+{
+	if (cred->uid != cred->euid || cred->uid != cred->suid ||
+	    cred->uid != cred->fsuid)
+		return 1;
+	if (cred->gid != cred->egid || cred->gid != cred->sgid ||
+	    cred->gid != cred->fsgid)
+		return 1;
+
+	return 0;
+}
+
+void
+gr_handle_crash(struct task_struct *task, const int sig)
+{
+	struct acl_subject_label *curr;
+	struct acl_subject_label *curr2;
+	struct task_struct *tsk, *tsk2;
+	const struct cred *cred;
+	const struct cred *cred2;
+
+	if (sig != SIGSEGV && sig != SIGKILL && sig != SIGBUS && sig != SIGILL)
+		return;
+
+	if (unlikely(!gr_acl_is_enabled()))
+		return;
+
+	curr = task->acl;
+
+	if (!(curr->resmask & (1 << GR_CRASH_RES)))
+		return;
+
+	if (time_before_eq(curr->expires, get_seconds())) {
+		curr->expires = 0;
+		curr->crashes = 0;
+	}
+
+	curr->crashes++;
+
+	if (!curr->expires)
+		curr->expires = get_seconds() + curr->res[GR_CRASH_RES].rlim_max;
+
+	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
+	    time_after(curr->expires, get_seconds())) {
+		rcu_read_lock();
+		cred = __task_cred(task);
+		if (cred->uid && proc_is_setxid(cred)) {
+			gr_log_crash1(GR_DONT_AUDIT, GR_SEGVSTART_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
+			spin_lock(&gr_uid_lock);
+			gr_insert_uid(cred->uid, curr->expires);
+			spin_unlock(&gr_uid_lock);
+			curr->expires = 0;
+			curr->crashes = 0;
+			read_lock(&tasklist_lock);
+			do_each_thread(tsk2, tsk) {
+				cred2 = __task_cred(tsk);
+				if (tsk != task && cred2->uid == cred->uid)
+					gr_fake_force_sig(SIGKILL, tsk);
+			} while_each_thread(tsk2, tsk);
+			read_unlock(&tasklist_lock);
+		} else {
+			gr_log_crash2(GR_DONT_AUDIT, GR_SEGVNOSUID_ACL_MSG, task, curr->res[GR_CRASH_RES].rlim_max);
+			read_lock(&tasklist_lock);
+			do_each_thread(tsk2, tsk) {
+				if (likely(tsk != task)) {
+					curr2 = tsk->acl;
+
+					if (curr2->device == curr->device &&
+					    curr2->inode == curr->inode)
+						gr_fake_force_sig(SIGKILL, tsk);
+				}
+			} while_each_thread(tsk2, tsk);
+			read_unlock(&tasklist_lock);
+		}
+		rcu_read_unlock();
+	}
+
+	return;
+}
+
+int
+gr_check_crash_exec(const struct file *filp)
+{
+	struct acl_subject_label *curr;
+
+	if (unlikely(!gr_acl_is_enabled()))
+		return 0;
+
+	read_lock(&gr_inode_lock);
+	curr = lookup_acl_subj_label(filp->f_path.dentry->d_inode->i_ino,
+				     filp->f_path.dentry->d_inode->i_sb->s_dev,
+				     current->role);
+	read_unlock(&gr_inode_lock);
+
+	if (!curr || !(curr->resmask & (1 << GR_CRASH_RES)) ||
+	    (!curr->crashes && !curr->expires))
+		return 0;
+
+	if ((curr->crashes >= curr->res[GR_CRASH_RES].rlim_cur) &&
+	    time_after(curr->expires, get_seconds()))
+		return 1;
+	else if (time_before_eq(curr->expires, get_seconds())) {
+		curr->crashes = 0;
+		curr->expires = 0;
+	}
+
+	return 0;
+}
+
+void
+gr_handle_alertkill(struct task_struct *task)
+{
+	struct acl_subject_label *curracl;
+	__u32 curr_ip;
+	struct task_struct *p, *p2;
+
+	if (unlikely(!gr_acl_is_enabled()))
+		return;
+
+	curracl = task->acl;
+	curr_ip = task->signal->curr_ip;
+
+	if ((curracl->mode & GR_KILLIPPROC) && curr_ip) {
+		read_lock(&tasklist_lock);
+		do_each_thread(p2, p) {
+			if (p->signal->curr_ip == curr_ip)
+				gr_fake_force_sig(SIGKILL, p);
+		} while_each_thread(p2, p);
+		read_unlock(&tasklist_lock);
+	} else if (curracl->mode & GR_KILLPROC)
+		gr_fake_force_sig(SIGKILL, task);
+
+	return;
+}
diff -uriN linux-2.6.32.43/grsecurity/gracl_shm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_shm.c
--- linux-2.6.32.43/grsecurity/gracl_shm.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/gracl_shm.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,40 @@
+#include <linux/kernel.h>
+#include <linux/mm.h>
+#include <linux/sched.h>
+#include <linux/file.h>
+#include <linux/ipc.h>
+#include <linux/gracl.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+int
+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
+		const time_t shm_createtime, const uid_t cuid, const int shmid)
+{
+	struct task_struct *task;
+
+	if (!gr_acl_is_enabled())
+		return 1;
+
+	rcu_read_lock();
+	read_lock(&tasklist_lock);
+
+	task = find_task_by_vpid(shm_cprid);
+
+	if (unlikely(!task))
+		task = find_task_by_vpid(shm_lapid);
+
+	if (unlikely(task && (time_before_eq((unsigned long)task->start_time.tv_sec, (unsigned long)shm_createtime) ||
+			      (task->pid == shm_lapid)) &&
+		     (task->acl->mode & GR_PROTSHM) &&
+		     (task->acl != current->acl))) {
+		read_unlock(&tasklist_lock);
+		rcu_read_unlock();
+		gr_log_int3(GR_DONT_AUDIT, GR_SHMAT_ACL_MSG, cuid, shm_cprid, shmid);
+		return 0;
+	}
+	read_unlock(&tasklist_lock);
+	rcu_read_unlock();
+
+	return 1;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_chdir.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_chdir.c
--- linux-2.6.32.43/grsecurity/grsec_chdir.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_chdir.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,19 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+void
+gr_log_chdir(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
+	if ((grsec_enable_chdir && grsec_enable_group &&
+	     in_group_p(grsec_audit_gid)) || (grsec_enable_chdir &&
+					      !grsec_enable_group)) {
+		gr_log_fs_generic(GR_DO_AUDIT, GR_CHDIR_AUDIT_MSG, dentry, mnt);
+	}
+#endif
+	return;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_chroot.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_chroot.c
--- linux-2.6.32.43/grsecurity/grsec_chroot.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_chroot.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,378 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/mount.h>
+#include <linux/types.h>
+#include <linux/pid_namespace.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+void gr_set_chroot_entries(struct task_struct *task, struct path *path)
+{
+#ifdef CONFIG_GRKERNSEC
+	if (task->pid > 1 && path->dentry != init_task.fs->root.dentry &&
+	    		     path->dentry != task->nsproxy->mnt_ns->root->mnt_root)
+		task->gr_is_chrooted = 1;
+	else
+		task->gr_is_chrooted = 0;
+
+	task->gr_chroot_dentry = path->dentry;
+#endif
+	return;
+}
+
+void gr_clear_chroot_entries(struct task_struct *task)
+{
+#ifdef CONFIG_GRKERNSEC
+	task->gr_is_chrooted = 0;
+	task->gr_chroot_dentry = NULL;
+#endif
+	return;
+}	
+
+int
+gr_handle_chroot_unix(const pid_t pid)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
+	struct task_struct *p;
+
+	if (unlikely(!grsec_enable_chroot_unix))
+		return 1;
+
+	if (likely(!proc_is_chrooted(current)))
+		return 1;
+
+	rcu_read_lock();
+	read_lock(&tasklist_lock);
+
+	p = find_task_by_vpid_unrestricted(pid);
+	if (unlikely(p && !have_same_root(current, p))) {
+		read_unlock(&tasklist_lock);
+		rcu_read_unlock();
+		gr_log_noargs(GR_DONT_AUDIT, GR_UNIX_CHROOT_MSG);
+		return 0;
+	}
+	read_unlock(&tasklist_lock);
+	rcu_read_unlock();
+#endif
+	return 1;
+}
+
+int
+gr_handle_chroot_nice(void)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
+	if (grsec_enable_chroot_nice && proc_is_chrooted(current)) {
+		gr_log_noargs(GR_DONT_AUDIT, GR_NICE_CHROOT_MSG);
+		return -EPERM;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_chroot_setpriority(struct task_struct *p, const int niceval)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
+	if (grsec_enable_chroot_nice && (niceval < task_nice(p))
+			&& proc_is_chrooted(current)) {
+		gr_log_str_int(GR_DONT_AUDIT, GR_PRIORITY_CHROOT_MSG, p->comm, p->pid);
+		return -EACCES;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_chroot_rawio(const struct inode *inode)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
+	if (grsec_enable_chroot_caps && proc_is_chrooted(current) && 
+	    inode && S_ISBLK(inode->i_mode) && !capable(CAP_SYS_RAWIO))
+		return 1;
+#endif
+	return 0;
+}
+
+int
+gr_handle_chroot_fowner(struct pid *pid, enum pid_type type)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
+	struct task_struct *p;
+	int ret = 0;
+	if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || !pid)
+		return ret;
+
+	read_lock(&tasklist_lock);
+	do_each_pid_task(pid, type, p) {
+		if (!have_same_root(current, p)) {
+			ret = 1;
+			goto out;
+		}
+	} while_each_pid_task(pid, type, p);
+out:
+	read_unlock(&tasklist_lock);
+	return ret;
+#endif
+	return 0;
+}
+
+int
+gr_pid_is_chrooted(struct task_struct *p)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
+	if (!grsec_enable_chroot_findtask || !proc_is_chrooted(current) || p == NULL)
+		return 0;
+
+	if ((p->exit_state & (EXIT_ZOMBIE | EXIT_DEAD)) ||
+	    !have_same_root(current, p)) {
+		return 1;
+	}
+#endif
+	return 0;
+}
+
+EXPORT_SYMBOL(gr_pid_is_chrooted);
+
+#if defined(CONFIG_GRKERNSEC_CHROOT_DOUBLE) || defined(CONFIG_GRKERNSEC_CHROOT_FCHDIR)
+int gr_is_outside_chroot(const struct dentry *u_dentry, const struct vfsmount *u_mnt)
+{
+	struct dentry *dentry = (struct dentry *)u_dentry;
+	struct vfsmount *mnt = (struct vfsmount *)u_mnt;
+	struct dentry *realroot;
+	struct vfsmount *realrootmnt;
+	struct dentry *currentroot;
+	struct vfsmount *currentmnt;
+	struct task_struct *reaper = &init_task;
+	int ret = 1;
+
+	read_lock(&reaper->fs->lock);
+	realrootmnt = mntget(reaper->fs->root.mnt);
+	realroot = dget(reaper->fs->root.dentry);
+	read_unlock(&reaper->fs->lock);
+
+	read_lock(&current->fs->lock);
+	currentmnt = mntget(current->fs->root.mnt);
+	currentroot = dget(current->fs->root.dentry);
+	read_unlock(&current->fs->lock);
+
+	spin_lock(&dcache_lock);
+	for (;;) {
+		if (unlikely((dentry == realroot && mnt == realrootmnt)
+		     || (dentry == currentroot && mnt == currentmnt)))
+			break;
+		if (unlikely(dentry == mnt->mnt_root || IS_ROOT(dentry))) {
+			if (mnt->mnt_parent == mnt)
+				break;
+			dentry = mnt->mnt_mountpoint;
+			mnt = mnt->mnt_parent;
+			continue;
+		}
+		dentry = dentry->d_parent;
+	}
+	spin_unlock(&dcache_lock);
+
+	dput(currentroot);
+	mntput(currentmnt);
+
+	/* access is outside of chroot */
+	if (dentry == realroot && mnt == realrootmnt)
+		ret = 0;
+
+	dput(realroot);
+	mntput(realrootmnt);
+	return ret;
+}
+#endif
+
+int
+gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
+	if (!grsec_enable_chroot_fchdir)
+		return 1;
+
+	if (!proc_is_chrooted(current))
+		return 1;
+	else if (!gr_is_outside_chroot(u_dentry, u_mnt)) {
+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_FCHDIR_MSG, u_dentry, u_mnt);
+		return 0;
+	}
+#endif
+	return 1;
+}
+
+int
+gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
+		const time_t shm_createtime)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
+	struct task_struct *p;
+	time_t starttime;
+
+	if (unlikely(!grsec_enable_chroot_shmat))
+		return 1;
+
+	if (likely(!proc_is_chrooted(current)))
+		return 1;
+
+	rcu_read_lock();
+	read_lock(&tasklist_lock);
+
+	if ((p = find_task_by_vpid_unrestricted(shm_cprid))) {
+		starttime = p->start_time.tv_sec;
+		if (unlikely(!have_same_root(current, p) &&
+			     time_before_eq((unsigned long)starttime, (unsigned long)shm_createtime))) {
+			read_unlock(&tasklist_lock);
+			rcu_read_unlock();
+			gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
+			return 0;
+		}
+	} else if ((p = find_task_by_vpid_unrestricted(shm_lapid))) {
+		if (unlikely(!have_same_root(current, p))) {
+			read_unlock(&tasklist_lock);
+			rcu_read_unlock();
+			gr_log_noargs(GR_DONT_AUDIT, GR_SHMAT_CHROOT_MSG);
+			return 0;
+		}
+	}
+
+	read_unlock(&tasklist_lock);
+	rcu_read_unlock();
+#endif
+	return 1;
+}
+
+void
+gr_log_chroot_exec(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
+	if (grsec_enable_chroot_execlog && proc_is_chrooted(current))
+		gr_log_fs_generic(GR_DO_AUDIT, GR_EXEC_CHROOT_MSG, dentry, mnt);
+#endif
+	return;
+}
+
+int
+gr_handle_chroot_mknod(const struct dentry *dentry,
+		       const struct vfsmount *mnt, const int mode)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
+	if (grsec_enable_chroot_mknod && !S_ISFIFO(mode) && !S_ISREG(mode) && 
+	    proc_is_chrooted(current)) {
+		gr_log_fs_generic(GR_DONT_AUDIT, GR_MKNOD_CHROOT_MSG, dentry, mnt);
+		return -EPERM;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_chroot_mount(const struct dentry *dentry,
+		       const struct vfsmount *mnt, const char *dev_name)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
+	if (grsec_enable_chroot_mount && proc_is_chrooted(current)) {
+		gr_log_str_fs(GR_DONT_AUDIT, GR_MOUNT_CHROOT_MSG, dev_name ? dev_name : "none" , dentry, mnt);
+		return -EPERM;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_chroot_pivot(void)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
+	if (grsec_enable_chroot_pivot && proc_is_chrooted(current)) {
+		gr_log_noargs(GR_DONT_AUDIT, GR_PIVOT_CHROOT_MSG);
+		return -EPERM;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_chroot_chroot(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
+	if (grsec_enable_chroot_double && proc_is_chrooted(current) &&
+	    !gr_is_outside_chroot(dentry, mnt)) {
+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHROOT_CHROOT_MSG, dentry, mnt);
+		return -EPERM;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_chroot_caps(struct path *path)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
+	if (grsec_enable_chroot_caps && current->pid > 1 && current->fs != NULL &&
+		(init_task.fs->root.dentry != path->dentry) &&
+		(current->nsproxy->mnt_ns->root->mnt_root != path->dentry)) {
+
+		kernel_cap_t chroot_caps = GR_CHROOT_CAPS;
+		const struct cred *old = current_cred();
+		struct cred *new = prepare_creds();
+		if (new == NULL)
+			return 1;
+
+		new->cap_permitted = cap_drop(old->cap_permitted, 
+					      chroot_caps);
+		new->cap_inheritable = cap_drop(old->cap_inheritable, 
+						chroot_caps);
+		new->cap_effective = cap_drop(old->cap_effective,
+					      chroot_caps);
+
+		commit_creds(new);
+
+		return 0;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_chroot_sysctl(const int op)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
+	if (grsec_enable_chroot_sysctl && proc_is_chrooted(current)
+	    && (op & MAY_WRITE))
+		return -EACCES;
+#endif
+	return 0;
+}
+
+void
+gr_handle_chroot_chdir(struct path *path)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
+	if (grsec_enable_chroot_chdir)
+		set_fs_pwd(current->fs, path);
+#endif
+	return;
+}
+
+int
+gr_handle_chroot_chmod(const struct dentry *dentry,
+		       const struct vfsmount *mnt, const int mode)
+{
+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
+	/* allow chmod +s on directories, but not on files */
+	if (grsec_enable_chroot_chmod && !S_ISDIR(dentry->d_inode->i_mode) &&
+	    ((mode & S_ISUID) || ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP))) &&
+	    proc_is_chrooted(current)) {
+		gr_log_fs_generic(GR_DONT_AUDIT, GR_CHMOD_CHROOT_MSG, dentry, mnt);
+		return -EPERM;
+	}
+#endif
+	return 0;
+}
+
+#ifdef CONFIG_SECURITY
+EXPORT_SYMBOL(gr_handle_chroot_caps);
+#endif
diff -uriN linux-2.6.32.43/grsecurity/grsec_disabled.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_disabled.c
--- linux-2.6.32.43/grsecurity/grsec_disabled.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_disabled.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,447 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/kdev_t.h>
+#include <linux/net.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <linux/skbuff.h>
+#include <linux/sysctl.h>
+
+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
+void
+pax_set_initial_flags(struct linux_binprm *bprm)
+{
+	return;
+}
+#endif
+
+#ifdef CONFIG_SYSCTL
+__u32
+gr_handle_sysctl(const struct ctl_table * table, const int op)
+{
+	return 0;
+}
+#endif
+
+#ifdef CONFIG_TASKSTATS
+int gr_is_taskstats_denied(int pid)
+{
+	return 0;
+}
+#endif
+
+int
+gr_acl_is_enabled(void)
+{
+	return 0;
+}
+
+int
+gr_handle_rawio(const struct inode *inode)
+{
+	return 0;
+}
+
+void
+gr_acl_handle_psacct(struct task_struct *task, const long code)
+{
+	return;
+}
+
+int
+gr_handle_ptrace(struct task_struct *task, const long request)
+{
+	return 0;
+}
+
+int
+gr_handle_proc_ptrace(struct task_struct *task)
+{
+	return 0;
+}
+
+void
+gr_learn_resource(const struct task_struct *task,
+		  const int res, const unsigned long wanted, const int gt)
+{
+	return;
+}
+
+int
+gr_set_acls(const int type)
+{
+	return 0;
+}
+
+int
+gr_check_hidden_task(const struct task_struct *tsk)
+{
+	return 0;
+}
+
+int
+gr_check_protected_task(const struct task_struct *task)
+{
+	return 0;
+}
+
+int
+gr_check_protected_task_fowner(struct pid *pid, enum pid_type type)
+{
+	return 0;
+}
+
+void
+gr_copy_label(struct task_struct *tsk)
+{
+	return;
+}
+
+void
+gr_set_pax_flags(struct task_struct *task)
+{
+	return;
+}
+
+int
+gr_set_proc_label(const struct dentry *dentry, const struct vfsmount *mnt,
+		  const int unsafe_share)
+{
+	return 0;
+}
+
+void
+gr_handle_delete(const ino_t ino, const dev_t dev)
+{
+	return;
+}
+
+void
+gr_handle_create(const struct dentry *dentry, const struct vfsmount *mnt)
+{
+	return;
+}
+
+void
+gr_handle_crash(struct task_struct *task, const int sig)
+{
+	return;
+}
+
+int
+gr_check_crash_exec(const struct file *filp)
+{
+	return 0;
+}
+
+int
+gr_check_crash_uid(const uid_t uid)
+{
+	return 0;
+}
+
+void
+gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
+		 struct dentry *old_dentry,
+		 struct dentry *new_dentry,
+		 struct vfsmount *mnt, const __u8 replace)
+{
+	return;
+}
+
+int
+gr_search_socket(const int family, const int type, const int protocol)
+{
+	return 1;
+}
+
+int
+gr_search_connectbind(const int mode, const struct socket *sock,
+		      const struct sockaddr_in *addr)
+{
+	return 0;
+}
+
+int
+gr_is_capable(const int cap)
+{
+	return 1;
+}
+
+int
+gr_is_capable_nolog(const int cap)
+{
+	return 1;
+}
+
+void
+gr_handle_alertkill(struct task_struct *task)
+{
+	return;
+}
+
+__u32
+gr_acl_handle_execve(const struct dentry * dentry, const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_hidden_file(const struct dentry * dentry,
+			  const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_open(const struct dentry * dentry, const struct vfsmount * mnt,
+		   const int fmode)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_rmdir(const struct dentry * dentry, const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_unlink(const struct dentry * dentry, const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+int
+gr_acl_handle_mmap(const struct file *file, const unsigned long prot,
+		   unsigned int *vm_flags)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_truncate(const struct dentry * dentry,
+		       const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_utime(const struct dentry * dentry, const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_access(const struct dentry * dentry,
+		     const struct vfsmount * mnt, const int fmode)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_fchmod(const struct dentry * dentry, const struct vfsmount * mnt,
+		     mode_t mode)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_chmod(const struct dentry * dentry, const struct vfsmount * mnt,
+		    mode_t mode)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_chown(const struct dentry * dentry, const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_setxattr(const struct dentry * dentry, const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+void
+grsecurity_init(void)
+{
+	return;
+}
+
+__u32
+gr_acl_handle_mknod(const struct dentry * new_dentry,
+		    const struct dentry * parent_dentry,
+		    const struct vfsmount * parent_mnt,
+		    const int mode)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_mkdir(const struct dentry * new_dentry,
+		    const struct dentry * parent_dentry,
+		    const struct vfsmount * parent_mnt)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_symlink(const struct dentry * new_dentry,
+		      const struct dentry * parent_dentry,
+		      const struct vfsmount * parent_mnt, const char *from)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_link(const struct dentry * new_dentry,
+		   const struct dentry * parent_dentry,
+		   const struct vfsmount * parent_mnt,
+		   const struct dentry * old_dentry,
+		   const struct vfsmount * old_mnt, const char *to)
+{
+	return 1;
+}
+
+int
+gr_acl_handle_rename(const struct dentry *new_dentry,
+		     const struct dentry *parent_dentry,
+		     const struct vfsmount *parent_mnt,
+		     const struct dentry *old_dentry,
+		     const struct inode *old_parent_inode,
+		     const struct vfsmount *old_mnt, const char *newname)
+{
+	return 0;
+}
+
+int
+gr_acl_handle_filldir(const struct file *file, const char *name,
+		      const int namelen, const ino_t ino)
+{
+	return 1;
+}
+
+int
+gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
+		const time_t shm_createtime, const uid_t cuid, const int shmid)
+{
+	return 1;
+}
+
+int
+gr_search_bind(const struct socket *sock, const struct sockaddr_in *addr)
+{
+	return 0;
+}
+
+int
+gr_search_accept(const struct socket *sock)
+{
+	return 0;
+}
+
+int
+gr_search_listen(const struct socket *sock)
+{
+	return 0;
+}
+
+int
+gr_search_connect(const struct socket *sock, const struct sockaddr_in *addr)
+{
+	return 0;
+}
+
+__u32
+gr_acl_handle_unix(const struct dentry * dentry, const struct vfsmount * mnt)
+{
+	return 1;
+}
+
+__u32
+gr_acl_handle_creat(const struct dentry * dentry,
+		    const struct dentry * p_dentry,
+		    const struct vfsmount * p_mnt, const int fmode,
+		    const int imode)
+{
+	return 1;
+}
+
+void
+gr_acl_handle_exit(void)
+{
+	return;
+}
+
+int
+gr_acl_handle_mprotect(const struct file *file, const unsigned long prot)
+{
+	return 1;
+}
+
+void
+gr_set_role_label(const uid_t uid, const gid_t gid)
+{
+	return;
+}
+
+int
+gr_acl_handle_procpidmem(const struct task_struct *task)
+{
+	return 0;
+}
+
+int
+gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb)
+{
+	return 0;
+}
+
+int
+gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr)
+{
+	return 0;
+}
+
+void
+gr_set_kernel_label(struct task_struct *task)
+{
+	return;
+}
+
+int
+gr_check_user_change(int real, int effective, int fs)
+{
+	return 0;
+}
+
+int
+gr_check_group_change(int real, int effective, int fs)
+{
+	return 0;
+}
+
+int gr_acl_enable_at_secure(void)
+{
+	return 0;
+}
+
+dev_t gr_get_dev_from_dentry(struct dentry *dentry)
+{
+	return dentry->d_inode->i_sb->s_dev;
+}
+
+EXPORT_SYMBOL(gr_is_capable);
+EXPORT_SYMBOL(gr_is_capable_nolog);
+EXPORT_SYMBOL(gr_learn_resource);
+EXPORT_SYMBOL(gr_set_kernel_label);
+#ifdef CONFIG_SECURITY
+EXPORT_SYMBOL(gr_check_user_change);
+EXPORT_SYMBOL(gr_check_group_change);
+#endif
diff -uriN linux-2.6.32.43/grsecurity/grsec_exec.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_exec.c
--- linux-2.6.32.43/grsecurity/grsec_exec.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_exec.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,148 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/file.h>
+#include <linux/binfmts.h>
+#include <linux/smp_lock.h>
+#include <linux/fs.h>
+#include <linux/types.h>
+#include <linux/grdefs.h>
+#include <linux/grinternal.h>
+#include <linux/capability.h>
+#include <linux/compat.h>
+
+#include <asm/uaccess.h>
+
+#ifdef CONFIG_GRKERNSEC_EXECLOG
+static char gr_exec_arg_buf[132];
+static DEFINE_MUTEX(gr_exec_arg_mutex);
+#endif
+
+int
+gr_handle_nproc(void)
+{
+#ifdef CONFIG_GRKERNSEC_EXECVE
+	const struct cred *cred = current_cred();
+	if (grsec_enable_execve && cred->user &&
+	    (atomic_read(&cred->user->processes) >
+	     current->signal->rlim[RLIMIT_NPROC].rlim_cur) &&
+	    !capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE)) {
+		gr_log_noargs(GR_DONT_AUDIT, GR_NPROC_MSG);
+		return -EAGAIN;
+	}
+#endif
+	return 0;
+}
+
+void
+gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv)
+{
+#ifdef CONFIG_GRKERNSEC_EXECLOG
+	char *grarg = gr_exec_arg_buf;
+	unsigned int i, x, execlen = 0;
+	char c;
+
+	if (!((grsec_enable_execlog && grsec_enable_group &&
+	       in_group_p(grsec_audit_gid))
+	      || (grsec_enable_execlog && !grsec_enable_group)))
+		return;
+
+	mutex_lock(&gr_exec_arg_mutex);
+	memset(grarg, 0, sizeof(gr_exec_arg_buf));
+
+	if (unlikely(argv == NULL))
+		goto log;
+
+	for (i = 0; i < bprm->argc && execlen < 128; i++) {
+		const char __user *p;
+		unsigned int len;
+
+		if (copy_from_user(&p, argv + i, sizeof(p)))
+			goto log;
+		if (!p)
+			goto log;
+		len = strnlen_user(p, 128 - execlen);
+		if (len > 128 - execlen)
+			len = 128 - execlen;
+		else if (len > 0)
+			len--;
+		if (copy_from_user(grarg + execlen, p, len))
+			goto log;
+
+		/* rewrite unprintable characters */
+		for (x = 0; x < len; x++) {
+			c = *(grarg + execlen + x);
+			if (c < 32 || c > 126)
+				*(grarg + execlen + x) = ' ';
+		}
+
+		execlen += len;
+		*(grarg + execlen) = ' ';
+		*(grarg + execlen + 1) = '\0';
+		execlen++;
+	}
+
+      log:
+	gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
+			bprm->file->f_path.mnt, grarg);
+	mutex_unlock(&gr_exec_arg_mutex);
+#endif
+	return;
+}
+
+#ifdef CONFIG_COMPAT
+void
+gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv)
+{
+#ifdef CONFIG_GRKERNSEC_EXECLOG
+	char *grarg = gr_exec_arg_buf;
+	unsigned int i, x, execlen = 0;
+	char c;
+
+	if (!((grsec_enable_execlog && grsec_enable_group &&
+	       in_group_p(grsec_audit_gid))
+	      || (grsec_enable_execlog && !grsec_enable_group)))
+		return;
+
+	mutex_lock(&gr_exec_arg_mutex);
+	memset(grarg, 0, sizeof(gr_exec_arg_buf));
+
+	if (unlikely(argv == NULL))
+		goto log;
+
+	for (i = 0; i < bprm->argc && execlen < 128; i++) {
+		compat_uptr_t p;
+		unsigned int len;
+
+		if (get_user(p, argv + i))
+			goto log;
+		len = strnlen_user(compat_ptr(p), 128 - execlen);
+		if (len > 128 - execlen)
+			len = 128 - execlen;
+		else if (len > 0)
+			len--;
+		else
+			goto log;
+		if (copy_from_user(grarg + execlen, compat_ptr(p), len))
+			goto log;
+
+		/* rewrite unprintable characters */
+		for (x = 0; x < len; x++) {
+			c = *(grarg + execlen + x);
+			if (c < 32 || c > 126)
+				*(grarg + execlen + x) = ' ';
+		}
+
+		execlen += len;
+		*(grarg + execlen) = ' ';
+		*(grarg + execlen + 1) = '\0';
+		execlen++;
+	}
+
+      log:
+	gr_log_fs_str(GR_DO_AUDIT, GR_EXEC_AUDIT_MSG, bprm->file->f_path.dentry,
+			bprm->file->f_path.mnt, grarg);
+	mutex_unlock(&gr_exec_arg_mutex);
+#endif
+	return;
+}
+#endif
diff -uriN linux-2.6.32.43/grsecurity/grsec_fifo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_fifo.c
--- linux-2.6.32.43/grsecurity/grsec_fifo.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_fifo.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,24 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/grinternal.h>
+
+int
+gr_handle_fifo(const struct dentry *dentry, const struct vfsmount *mnt,
+	       const struct dentry *dir, const int flag, const int acc_mode)
+{
+#ifdef CONFIG_GRKERNSEC_FIFO
+	const struct cred *cred = current_cred();
+
+	if (grsec_enable_fifo && S_ISFIFO(dentry->d_inode->i_mode) &&
+	    !(flag & O_EXCL) && (dir->d_inode->i_mode & S_ISVTX) &&
+	    (dentry->d_inode->i_uid != dir->d_inode->i_uid) &&
+	    (cred->fsuid != dentry->d_inode->i_uid)) {
+		if (!inode_permission(dentry->d_inode, acc_mode))
+			gr_log_fs_int2(GR_DONT_AUDIT, GR_FIFO_MSG, dentry, mnt, dentry->d_inode->i_uid, dentry->d_inode->i_gid);
+		return -EACCES;
+	}
+#endif
+	return 0;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_fork.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_fork.c
--- linux-2.6.32.43/grsecurity/grsec_fork.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_fork.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,23 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+#include <linux/errno.h>
+
+void
+gr_log_forkfail(const int retval)
+{
+#ifdef CONFIG_GRKERNSEC_FORKFAIL
+	if (grsec_enable_forkfail && (retval == -EAGAIN || retval == -ENOMEM)) {
+		switch (retval) {
+			case -EAGAIN:
+				gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "EAGAIN");
+				break;
+			case -ENOMEM:
+				gr_log_str(GR_DONT_AUDIT, GR_FAILFORK_MSG, "ENOMEM");
+				break;
+		}
+	}
+#endif
+	return;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_init.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_init.c
--- linux-2.6.32.43/grsecurity/grsec_init.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_init.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,274 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/smp_lock.h>
+#include <linux/gracl.h>
+#include <linux/slab.h>
+#include <linux/vmalloc.h>
+#include <linux/percpu.h>
+#include <linux/module.h>
+
+int grsec_enable_brute;
+int grsec_enable_link;
+int grsec_enable_dmesg;
+int grsec_enable_harden_ptrace;
+int grsec_enable_fifo;
+int grsec_enable_execve;
+int grsec_enable_execlog;
+int grsec_enable_signal;
+int grsec_enable_forkfail;
+int grsec_enable_audit_ptrace;
+int grsec_enable_time;
+int grsec_enable_audit_textrel;
+int grsec_enable_group;
+int grsec_audit_gid;
+int grsec_enable_chdir;
+int grsec_enable_mount;
+int grsec_enable_rofs;
+int grsec_enable_chroot_findtask;
+int grsec_enable_chroot_mount;
+int grsec_enable_chroot_shmat;
+int grsec_enable_chroot_fchdir;
+int grsec_enable_chroot_double;
+int grsec_enable_chroot_pivot;
+int grsec_enable_chroot_chdir;
+int grsec_enable_chroot_chmod;
+int grsec_enable_chroot_mknod;
+int grsec_enable_chroot_nice;
+int grsec_enable_chroot_execlog;
+int grsec_enable_chroot_caps;
+int grsec_enable_chroot_sysctl;
+int grsec_enable_chroot_unix;
+int grsec_enable_tpe;
+int grsec_tpe_gid;
+int grsec_enable_blackhole;
+#ifdef CONFIG_IPV6_MODULE
+EXPORT_SYMBOL(grsec_enable_blackhole);
+#endif
+int grsec_lastack_retries;
+int grsec_enable_tpe_all;
+int grsec_enable_tpe_invert;
+int grsec_enable_socket_all;
+int grsec_socket_all_gid;
+int grsec_enable_socket_client;
+int grsec_socket_client_gid;
+int grsec_enable_socket_server;
+int grsec_socket_server_gid;
+int grsec_resource_logging;
+int grsec_disable_privio;
+int grsec_enable_log_rwxmaps;
+int grsec_lock;
+
+DEFINE_SPINLOCK(grsec_alert_lock);
+unsigned long grsec_alert_wtime = 0;
+unsigned long grsec_alert_fyet = 0;
+
+DEFINE_SPINLOCK(grsec_audit_lock);
+
+DEFINE_RWLOCK(grsec_exec_file_lock);
+
+char *gr_shared_page[4];
+
+char *gr_alert_log_fmt;
+char *gr_audit_log_fmt;
+char *gr_alert_log_buf;
+char *gr_audit_log_buf;
+
+extern struct gr_arg *gr_usermode;
+extern unsigned char *gr_system_salt;
+extern unsigned char *gr_system_sum;
+
+void __init
+grsecurity_init(void)
+{
+	int j;
+	/* create the per-cpu shared pages */
+
+#ifdef CONFIG_X86
+	memset((char *)(0x41a + PAGE_OFFSET), 0, 36);
+#endif
+
+	for (j = 0; j < 4; j++) {
+		gr_shared_page[j] = (char *)__alloc_percpu(PAGE_SIZE, __alignof__(unsigned long long));
+		if (gr_shared_page[j] == NULL) {
+			panic("Unable to allocate grsecurity shared page");
+			return;
+		}
+	}
+
+	/* allocate log buffers */
+	gr_alert_log_fmt = kmalloc(512, GFP_KERNEL);
+	if (!gr_alert_log_fmt) {
+		panic("Unable to allocate grsecurity alert log format buffer");
+		return;
+	}
+	gr_audit_log_fmt = kmalloc(512, GFP_KERNEL);
+	if (!gr_audit_log_fmt) {
+		panic("Unable to allocate grsecurity audit log format buffer");
+		return;
+	}
+	gr_alert_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
+	if (!gr_alert_log_buf) {
+		panic("Unable to allocate grsecurity alert log buffer");
+		return;
+	}
+	gr_audit_log_buf = (char *) get_zeroed_page(GFP_KERNEL);
+	if (!gr_audit_log_buf) {
+		panic("Unable to allocate grsecurity audit log buffer");
+		return;
+	}
+
+	/* allocate memory for authentication structure */
+	gr_usermode = kmalloc(sizeof(struct gr_arg), GFP_KERNEL);
+	gr_system_salt = kmalloc(GR_SALT_LEN, GFP_KERNEL);
+	gr_system_sum = kmalloc(GR_SHA_LEN, GFP_KERNEL);
+
+	if (!gr_usermode || !gr_system_salt || !gr_system_sum) {
+		panic("Unable to allocate grsecurity authentication structure");
+		return;
+	}
+
+
+#ifdef CONFIG_GRKERNSEC_IO
+#if !defined(CONFIG_GRKERNSEC_SYSCTL_DISTRO)
+	grsec_disable_privio = 1;
+#elif defined(CONFIG_GRKERNSEC_SYSCTL_ON)
+	grsec_disable_privio = 1;
+#else
+	grsec_disable_privio = 0;
+#endif
+#endif
+
+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
+	/* for backward compatibility, tpe_invert always defaults to on if
+	   enabled in the kernel
+	*/
+	grsec_enable_tpe_invert = 1;
+#endif
+
+#if !defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_SYSCTL_ON)
+#ifndef CONFIG_GRKERNSEC_SYSCTL
+	grsec_lock = 1;
+#endif
+
+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
+	grsec_enable_audit_textrel = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
+	grsec_enable_log_rwxmaps = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
+	grsec_enable_group = 1;
+	grsec_audit_gid = CONFIG_GRKERNSEC_AUDIT_GID;
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
+	grsec_enable_chdir = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
+	grsec_enable_harden_ptrace = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
+	grsec_enable_mount = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_LINK
+	grsec_enable_link = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_BRUTE
+	grsec_enable_brute = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_DMESG
+	grsec_enable_dmesg = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+	grsec_enable_blackhole = 1;
+	grsec_lastack_retries = 4;
+#endif
+#ifdef CONFIG_GRKERNSEC_FIFO
+	grsec_enable_fifo = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_EXECVE
+	grsec_enable_execve = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_EXECLOG
+	grsec_enable_execlog = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_SIGNAL
+	grsec_enable_signal = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_FORKFAIL
+	grsec_enable_forkfail = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_TIME
+	grsec_enable_time = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_RESLOG
+	grsec_resource_logging = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
+	grsec_enable_chroot_findtask = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
+	grsec_enable_chroot_unix = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
+	grsec_enable_chroot_mount = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
+	grsec_enable_chroot_fchdir = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
+	grsec_enable_chroot_shmat = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
+	grsec_enable_audit_ptrace = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
+	grsec_enable_chroot_double = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
+	grsec_enable_chroot_pivot = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
+	grsec_enable_chroot_chdir = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
+	grsec_enable_chroot_chmod = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
+	grsec_enable_chroot_mknod = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
+	grsec_enable_chroot_nice = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
+	grsec_enable_chroot_execlog = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
+	grsec_enable_chroot_caps = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
+	grsec_enable_chroot_sysctl = 1;
+#endif
+#ifdef CONFIG_GRKERNSEC_TPE
+	grsec_enable_tpe = 1;
+	grsec_tpe_gid = CONFIG_GRKERNSEC_TPE_GID;
+#ifdef CONFIG_GRKERNSEC_TPE_ALL
+	grsec_enable_tpe_all = 1;
+#endif
+#endif
+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
+	grsec_enable_socket_all = 1;
+	grsec_socket_all_gid = CONFIG_GRKERNSEC_SOCKET_ALL_GID;
+#endif
+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
+	grsec_enable_socket_client = 1;
+	grsec_socket_client_gid = CONFIG_GRKERNSEC_SOCKET_CLIENT_GID;
+#endif
+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
+	grsec_enable_socket_server = 1;
+	grsec_socket_server_gid = CONFIG_GRKERNSEC_SOCKET_SERVER_GID;
+#endif
+#endif
+
+	return;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_link.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_link.c
--- linux-2.6.32.43/grsecurity/grsec_link.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_link.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,43 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/grinternal.h>
+
+int
+gr_handle_follow_link(const struct inode *parent,
+		      const struct inode *inode,
+		      const struct dentry *dentry, const struct vfsmount *mnt)
+{
+#ifdef CONFIG_GRKERNSEC_LINK
+	const struct cred *cred = current_cred();
+
+	if (grsec_enable_link && S_ISLNK(inode->i_mode) &&
+	    (parent->i_mode & S_ISVTX) && (parent->i_uid != inode->i_uid) &&
+	    (parent->i_mode & S_IWOTH) && (cred->fsuid != inode->i_uid)) {
+		gr_log_fs_int2(GR_DONT_AUDIT, GR_SYMLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid);
+		return -EACCES;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_hardlink(const struct dentry *dentry,
+		   const struct vfsmount *mnt,
+		   struct inode *inode, const int mode, const char *to)
+{
+#ifdef CONFIG_GRKERNSEC_LINK
+	const struct cred *cred = current_cred();
+
+	if (grsec_enable_link && cred->fsuid != inode->i_uid &&
+	    (!S_ISREG(mode) || (mode & S_ISUID) ||
+	     ((mode & (S_ISGID | S_IXGRP)) == (S_ISGID | S_IXGRP)) ||
+	     (inode_permission(inode, MAY_READ | MAY_WRITE))) &&
+	    !capable(CAP_FOWNER) && cred->uid) {
+		gr_log_fs_int2_str(GR_DONT_AUDIT, GR_HARDLINK_MSG, dentry, mnt, inode->i_uid, inode->i_gid, to);
+		return -EPERM;
+	}
+#endif
+	return 0;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_log.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_log.c
--- linux-2.6.32.43/grsecurity/grsec_log.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_log.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,310 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/file.h>
+#include <linux/tty.h>
+#include <linux/fs.h>
+#include <linux/grinternal.h>
+
+#ifdef CONFIG_TREE_PREEMPT_RCU
+#define DISABLE_PREEMPT() preempt_disable()
+#define ENABLE_PREEMPT() preempt_enable()
+#else
+#define DISABLE_PREEMPT()
+#define ENABLE_PREEMPT()
+#endif
+
+#define BEGIN_LOCKS(x) \
+	DISABLE_PREEMPT(); \
+	rcu_read_lock(); \
+	read_lock(&tasklist_lock); \
+	read_lock(&grsec_exec_file_lock); \
+	if (x != GR_DO_AUDIT) \
+		spin_lock(&grsec_alert_lock); \
+	else \
+		spin_lock(&grsec_audit_lock)
+
+#define END_LOCKS(x) \
+	if (x != GR_DO_AUDIT) \
+		spin_unlock(&grsec_alert_lock); \
+	else \
+		spin_unlock(&grsec_audit_lock); \
+	read_unlock(&grsec_exec_file_lock); \
+	read_unlock(&tasklist_lock); \
+	rcu_read_unlock(); \
+	ENABLE_PREEMPT(); \
+	if (x == GR_DONT_AUDIT) \
+		gr_handle_alertkill(current)
+
+enum {
+	FLOODING,
+	NO_FLOODING
+};
+
+extern char *gr_alert_log_fmt;
+extern char *gr_audit_log_fmt;
+extern char *gr_alert_log_buf;
+extern char *gr_audit_log_buf;
+
+static int gr_log_start(int audit)
+{
+	char *loglevel = (audit == GR_DO_AUDIT) ? KERN_INFO : KERN_ALERT;
+	char *fmt = (audit == GR_DO_AUDIT) ? gr_audit_log_fmt : gr_alert_log_fmt;
+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
+
+	if (audit == GR_DO_AUDIT)
+		goto set_fmt;
+
+	if (!grsec_alert_wtime || jiffies - grsec_alert_wtime > CONFIG_GRKERNSEC_FLOODTIME * HZ) {
+		grsec_alert_wtime = jiffies;
+		grsec_alert_fyet = 0;
+	} else if ((jiffies - grsec_alert_wtime < CONFIG_GRKERNSEC_FLOODTIME * HZ) && (grsec_alert_fyet < CONFIG_GRKERNSEC_FLOODBURST)) {
+		grsec_alert_fyet++;
+	} else if (grsec_alert_fyet == CONFIG_GRKERNSEC_FLOODBURST) {
+		grsec_alert_wtime = jiffies;
+		grsec_alert_fyet++;
+		printk(KERN_ALERT "grsec: more alerts, logging disabled for %d seconds\n", CONFIG_GRKERNSEC_FLOODTIME);
+		return FLOODING;
+	} else return FLOODING;
+
+set_fmt:
+	memset(buf, 0, PAGE_SIZE);
+	if (current->signal->curr_ip && gr_acl_is_enabled()) {
+		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: (%.64s:%c:%.950s) ");
+		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
+	} else if (current->signal->curr_ip) {
+		sprintf(fmt, "%s%s", loglevel, "grsec: From %pI4: ");
+		snprintf(buf, PAGE_SIZE - 1, fmt, &current->signal->curr_ip);
+	} else if (gr_acl_is_enabled()) {
+		sprintf(fmt, "%s%s", loglevel, "grsec: (%.64s:%c:%.950s) ");
+		snprintf(buf, PAGE_SIZE - 1, fmt, current->role->rolename, gr_roletype_to_char(), current->acl->filename);
+	} else {
+		sprintf(fmt, "%s%s", loglevel, "grsec: ");
+		strcpy(buf, fmt);
+	}
+
+	return NO_FLOODING;
+}
+
+static void gr_log_middle(int audit, const char *msg, va_list ap)
+	__attribute__ ((format (printf, 2, 0)));
+
+static void gr_log_middle(int audit, const char *msg, va_list ap)
+{
+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
+	unsigned int len = strlen(buf);
+
+	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
+
+	return;
+}
+
+static void gr_log_middle_varargs(int audit, const char *msg, ...)
+	__attribute__ ((format (printf, 2, 3)));
+
+static void gr_log_middle_varargs(int audit, const char *msg, ...)
+{
+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
+	unsigned int len = strlen(buf);
+	va_list ap;
+
+	va_start(ap, msg);
+	vsnprintf(buf + len, PAGE_SIZE - len - 1, msg, ap);
+	va_end(ap);
+
+	return;
+}
+
+static void gr_log_end(int audit)
+{
+	char *buf = (audit == GR_DO_AUDIT) ? gr_audit_log_buf : gr_alert_log_buf;
+	unsigned int len = strlen(buf);
+
+	snprintf(buf + len, PAGE_SIZE - len - 1, DEFAULTSECMSG, DEFAULTSECARGS(current, current_cred(), __task_cred(current->real_parent)));
+	printk("%s\n", buf);
+
+	return;
+}
+
+void gr_log_varargs(int audit, const char *msg, int argtypes, ...)
+{
+	int logtype;
+	char *result = (audit == GR_DO_AUDIT) ? "successful" : "denied";
+	char *str1 = NULL, *str2 = NULL, *str3 = NULL;
+	void *voidptr = NULL;
+	int num1 = 0, num2 = 0;
+	unsigned long ulong1 = 0, ulong2 = 0;
+	struct dentry *dentry = NULL;
+	struct vfsmount *mnt = NULL;
+	struct file *file = NULL;
+	struct task_struct *task = NULL;
+	const struct cred *cred, *pcred;
+	va_list ap;
+
+	BEGIN_LOCKS(audit);
+	logtype = gr_log_start(audit);
+	if (logtype == FLOODING) {
+		END_LOCKS(audit);
+		return;
+	}
+	va_start(ap, argtypes);
+	switch (argtypes) {
+	case GR_TTYSNIFF:
+		task = va_arg(ap, struct task_struct *);
+		gr_log_middle_varargs(audit, msg, &task->signal->curr_ip, gr_task_fullpath0(task), task->comm, task->pid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid);
+		break;
+	case GR_SYSCTL_HIDDEN:
+		str1 = va_arg(ap, char *);
+		gr_log_middle_varargs(audit, msg, result, str1);
+		break;
+	case GR_RBAC:
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt));
+		break;
+	case GR_RBAC_STR:
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		str1 = va_arg(ap, char *);
+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1);
+		break;
+	case GR_STR_RBAC:
+		str1 = va_arg(ap, char *);
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		gr_log_middle_varargs(audit, msg, result, str1, gr_to_filename(dentry, mnt));
+		break;
+	case GR_RBAC_MODE2:
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		str1 = va_arg(ap, char *);
+		str2 = va_arg(ap, char *);
+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2);
+		break;
+	case GR_RBAC_MODE3:
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		str1 = va_arg(ap, char *);
+		str2 = va_arg(ap, char *);
+		str3 = va_arg(ap, char *);
+		gr_log_middle_varargs(audit, msg, result, gr_to_filename(dentry, mnt), str1, str2, str3);
+		break;
+	case GR_FILENAME:
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt));
+		break;
+	case GR_STR_FILENAME:
+		str1 = va_arg(ap, char *);
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		gr_log_middle_varargs(audit, msg, str1, gr_to_filename(dentry, mnt));
+		break;
+	case GR_FILENAME_STR:
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		str1 = va_arg(ap, char *);
+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), str1);
+		break;
+	case GR_FILENAME_TWO_INT:
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		num1 = va_arg(ap, int);
+		num2 = va_arg(ap, int);
+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2);
+		break;
+	case GR_FILENAME_TWO_INT_STR:
+		dentry = va_arg(ap, struct dentry *);
+		mnt = va_arg(ap, struct vfsmount *);
+		num1 = va_arg(ap, int);
+		num2 = va_arg(ap, int);
+		str1 = va_arg(ap, char *);
+		gr_log_middle_varargs(audit, msg, gr_to_filename(dentry, mnt), num1, num2, str1);
+		break;
+	case GR_TEXTREL:
+		file = va_arg(ap, struct file *);
+		ulong1 = va_arg(ap, unsigned long);
+		ulong2 = va_arg(ap, unsigned long);
+		gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>", ulong1, ulong2);
+		break;
+	case GR_PTRACE:
+		task = va_arg(ap, struct task_struct *);
+		gr_log_middle_varargs(audit, msg, task->exec_file ? gr_to_filename(task->exec_file->f_path.dentry, task->exec_file->f_path.mnt) : "(none)", task->comm, task->pid);
+		break;
+	case GR_RESOURCE:
+		task = va_arg(ap, struct task_struct *);
+		cred = __task_cred(task);
+		pcred = __task_cred(task->real_parent);
+		ulong1 = va_arg(ap, unsigned long);
+		str1 = va_arg(ap, char *);
+		ulong2 = va_arg(ap, unsigned long);
+		gr_log_middle_varargs(audit, msg, ulong1, str1, ulong2, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
+		break;
+	case GR_CAP:
+		task = va_arg(ap, struct task_struct *);
+		cred = __task_cred(task);
+		pcred = __task_cred(task->real_parent);
+		str1 = va_arg(ap, char *);
+		gr_log_middle_varargs(audit, msg, str1, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
+		break;
+	case GR_SIG:
+		str1 = va_arg(ap, char *);
+		voidptr = va_arg(ap, void *);
+		gr_log_middle_varargs(audit, msg, str1, voidptr);
+		break;
+	case GR_SIG2:
+		task = va_arg(ap, struct task_struct *);
+		cred = __task_cred(task);
+		pcred = __task_cred(task->real_parent);
+		num1 = va_arg(ap, int);
+		gr_log_middle_varargs(audit, msg, num1, gr_task_fullpath0(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath0(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid);
+		break;
+	case GR_CRASH1:
+		task = va_arg(ap, struct task_struct *);
+		cred = __task_cred(task);
+		pcred = __task_cred(task->real_parent);
+		ulong1 = va_arg(ap, unsigned long);
+		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, cred->uid, ulong1);
+		break;
+	case GR_CRASH2:
+		task = va_arg(ap, struct task_struct *);
+		cred = __task_cred(task);
+		pcred = __task_cred(task->real_parent);
+		ulong1 = va_arg(ap, unsigned long);
+		gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, cred->uid, cred->euid, cred->gid, cred->egid, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, pcred->uid, pcred->euid, pcred->gid, pcred->egid, ulong1);
+		break;
+	case GR_RWXMAP:
+		file = va_arg(ap, struct file *);
+		gr_log_middle_varargs(audit, msg, file ? gr_to_filename(file->f_path.dentry, file->f_path.mnt) : "<anonymous mapping>");
+		break;
+	case GR_PSACCT:
+		{
+			unsigned int wday, cday;
+			__u8 whr, chr;
+			__u8 wmin, cmin;
+			__u8 wsec, csec;
+			char cur_tty[64] = { 0 };
+			char parent_tty[64] = { 0 };
+
+			task = va_arg(ap, struct task_struct *);
+			wday = va_arg(ap, unsigned int);
+			cday = va_arg(ap, unsigned int);
+			whr = va_arg(ap, int);
+			chr = va_arg(ap, int);
+			wmin = va_arg(ap, int);
+			cmin = va_arg(ap, int);
+			wsec = va_arg(ap, int);
+			csec = va_arg(ap, int);
+			ulong1 = va_arg(ap, unsigned long);
+			cred = __task_cred(task);
+			pcred = __task_cred(task->real_parent);
+
+			gr_log_middle_varargs(audit, msg, gr_task_fullpath(task), task->comm, task->pid, &task->signal->curr_ip, tty_name(task->signal->tty, cur_tty), cred->uid, cred->euid, cred->gid, cred->egid, wday, whr, wmin, wsec, cday, chr, cmin, csec, (task->flags & PF_SIGNALED) ? "killed by signal" : "exited", ulong1, gr_parent_task_fullpath(task), task->real_parent->comm, task->real_parent->pid, &task->real_parent->signal->curr_ip, tty_name(task->real_parent->signal->tty, parent_tty), pcred->uid, pcred->euid, pcred->gid, pcred->egid);
+		}
+		break;
+	default:
+		gr_log_middle(audit, msg, ap);
+	}
+	va_end(ap);
+	gr_log_end(audit);
+	END_LOCKS(audit);
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_mem.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_mem.c
--- linux-2.6.32.43/grsecurity/grsec_mem.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_mem.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,33 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/mman.h>
+#include <linux/grinternal.h>
+
+void
+gr_handle_ioperm(void)
+{
+	gr_log_noargs(GR_DONT_AUDIT, GR_IOPERM_MSG);
+	return;
+}
+
+void
+gr_handle_iopl(void)
+{
+	gr_log_noargs(GR_DONT_AUDIT, GR_IOPL_MSG);
+	return;
+}
+
+void
+gr_handle_mem_readwrite(u64 from, u64 to)
+{
+	gr_log_two_u64(GR_DONT_AUDIT, GR_MEM_READWRITE_MSG, from, to);
+	return;
+}
+
+void
+gr_handle_vm86(void)
+{
+	gr_log_noargs(GR_DONT_AUDIT, GR_VM86_MSG);
+	return;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_mount.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_mount.c
--- linux-2.6.32.43/grsecurity/grsec_mount.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_mount.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,62 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/mount.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+void
+gr_log_remount(const char *devname, const int retval)
+{
+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
+	if (grsec_enable_mount && (retval >= 0))
+		gr_log_str(GR_DO_AUDIT, GR_REMOUNT_AUDIT_MSG, devname ? devname : "none");
+#endif
+	return;
+}
+
+void
+gr_log_unmount(const char *devname, const int retval)
+{
+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
+	if (grsec_enable_mount && (retval >= 0))
+		gr_log_str(GR_DO_AUDIT, GR_UNMOUNT_AUDIT_MSG, devname ? devname : "none");
+#endif
+	return;
+}
+
+void
+gr_log_mount(const char *from, const char *to, const int retval)
+{
+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
+	if (grsec_enable_mount && (retval >= 0))
+		gr_log_str_str(GR_DO_AUDIT, GR_MOUNT_AUDIT_MSG, from ? from : "none", to);
+#endif
+	return;
+}
+
+int
+gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags)
+{
+#ifdef CONFIG_GRKERNSEC_ROFS
+	if (grsec_enable_rofs && !(mnt_flags & MNT_READONLY)) {
+		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_MOUNT_MSG, dentry, mnt);
+		return -EPERM;
+	} else
+		return 0;
+#endif
+	return 0;
+}
+
+int
+gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode)
+{
+#ifdef CONFIG_GRKERNSEC_ROFS
+	if (grsec_enable_rofs && (acc_mode & MAY_WRITE) &&
+	    dentry->d_inode && S_ISBLK(dentry->d_inode->i_mode)) {
+		gr_log_fs_generic(GR_DO_AUDIT, GR_ROFS_BLOCKWRITE_MSG, dentry, mnt);
+		return -EPERM;
+	} else
+		return 0;
+#endif
+	return 0;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_pax.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_pax.c
--- linux-2.6.32.43/grsecurity/grsec_pax.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_pax.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,36 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/file.h>
+#include <linux/grinternal.h>
+#include <linux/grsecurity.h>
+
+void
+gr_log_textrel(struct vm_area_struct * vma)
+{
+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
+	if (grsec_enable_audit_textrel)
+		gr_log_textrel_ulong_ulong(GR_DO_AUDIT, GR_TEXTREL_AUDIT_MSG, vma->vm_file, vma->vm_start, vma->vm_pgoff);
+#endif
+	return;
+}
+
+void
+gr_log_rwxmmap(struct file *file)
+{
+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
+	if (grsec_enable_log_rwxmaps)
+		gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMMAP_MSG, file);
+#endif
+	return;
+}
+
+void
+gr_log_rwxmprotect(struct file *file)
+{
+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
+	if (grsec_enable_log_rwxmaps)
+		gr_log_rwxmap(GR_DONT_AUDIT, GR_RWXMPROTECT_MSG, file);
+#endif
+	return;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_ptrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_ptrace.c
--- linux-2.6.32.43/grsecurity/grsec_ptrace.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_ptrace.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,14 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/grinternal.h>
+#include <linux/grsecurity.h>
+
+void
+gr_audit_ptrace(struct task_struct *task)
+{
+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
+	if (grsec_enable_audit_ptrace)
+		gr_log_ptrace(GR_DO_AUDIT, GR_PTRACE_AUDIT_MSG, task);
+#endif
+	return;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_sig.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_sig.c
--- linux-2.6.32.43/grsecurity/grsec_sig.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_sig.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,205 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/delay.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+#include <linux/hardirq.h>
+
+char *signames[] = {
+	[SIGSEGV] = "Segmentation fault",
+	[SIGILL] = "Illegal instruction",
+	[SIGABRT] = "Abort",
+	[SIGBUS] = "Invalid alignment/Bus error"
+};
+
+void
+gr_log_signal(const int sig, const void *addr, const struct task_struct *t)
+{
+#ifdef CONFIG_GRKERNSEC_SIGNAL
+	if (grsec_enable_signal && ((sig == SIGSEGV) || (sig == SIGILL) ||
+				    (sig == SIGABRT) || (sig == SIGBUS))) {
+		if (t->pid == current->pid) {
+			gr_log_sig_addr(GR_DONT_AUDIT_GOOD, GR_UNISIGLOG_MSG, signames[sig], addr);
+		} else {
+			gr_log_sig_task(GR_DONT_AUDIT_GOOD, GR_DUALSIGLOG_MSG, t, sig);
+		}
+	}
+#endif
+	return;
+}
+
+int
+gr_handle_signal(const struct task_struct *p, const int sig)
+{
+#ifdef CONFIG_GRKERNSEC
+	if (current->pid > 1 && gr_check_protected_task(p)) {
+		gr_log_sig_task(GR_DONT_AUDIT, GR_SIG_ACL_MSG, p, sig);
+		return -EPERM;
+	} else if (gr_pid_is_chrooted((struct task_struct *)p)) {
+		return -EPERM;
+	}
+#endif
+	return 0;
+}
+
+#ifdef CONFIG_GRKERNSEC
+extern int specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t);
+
+int gr_fake_force_sig(int sig, struct task_struct *t)
+{
+	unsigned long int flags;
+	int ret, blocked, ignored;
+	struct k_sigaction *action;
+
+	spin_lock_irqsave(&t->sighand->siglock, flags);
+	action = &t->sighand->action[sig-1];
+	ignored = action->sa.sa_handler == SIG_IGN;
+	blocked = sigismember(&t->blocked, sig);
+	if (blocked || ignored) {
+		action->sa.sa_handler = SIG_DFL;
+		if (blocked) {
+			sigdelset(&t->blocked, sig);
+			recalc_sigpending_and_wake(t);
+		}
+	}
+	if (action->sa.sa_handler == SIG_DFL)
+		t->signal->flags &= ~SIGNAL_UNKILLABLE;
+	ret = specific_send_sig_info(sig, SEND_SIG_PRIV, t);
+
+	spin_unlock_irqrestore(&t->sighand->siglock, flags);
+
+	return ret;
+}
+#endif
+
+#ifdef CONFIG_GRKERNSEC_BRUTE
+#define GR_USER_BAN_TIME (15 * 60)
+
+static int __get_dumpable(unsigned long mm_flags)
+{
+	int ret;
+
+	ret = mm_flags & MMF_DUMPABLE_MASK;
+	return (ret >= 2) ? 2 : ret;
+}
+#endif
+
+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags)
+{
+#ifdef CONFIG_GRKERNSEC_BRUTE
+	uid_t uid = 0;
+
+	if (!grsec_enable_brute)
+		return;
+
+	rcu_read_lock();
+	read_lock(&tasklist_lock);
+	read_lock(&grsec_exec_file_lock);
+	if (p->real_parent && p->real_parent->exec_file == p->exec_file)
+		p->real_parent->brute = 1;
+	else {
+		const struct cred *cred = __task_cred(p), *cred2;
+		struct task_struct *tsk, *tsk2;
+
+		if (!__get_dumpable(mm_flags) && cred->uid) {
+			struct user_struct *user;
+
+			uid = cred->uid;
+
+			/* this is put upon execution past expiration */
+			user = find_user(uid);
+			if (user == NULL)
+				goto unlock;
+			user->banned = 1;
+			user->ban_expires = get_seconds() + GR_USER_BAN_TIME;
+			if (user->ban_expires == ~0UL)
+				user->ban_expires--;
+
+			do_each_thread(tsk2, tsk) {
+				cred2 = __task_cred(tsk);
+				if (tsk != p && cred2->uid == uid)
+					gr_fake_force_sig(SIGKILL, tsk);
+			} while_each_thread(tsk2, tsk);
+		}
+	}
+unlock:
+	read_unlock(&grsec_exec_file_lock);
+	read_unlock(&tasklist_lock);
+	rcu_read_unlock();
+
+	if (uid)
+		printk(KERN_ALERT "grsec: bruteforce prevention initiated against uid %u, banning for %d minutes\n", uid, GR_USER_BAN_TIME / 60);
+#endif
+	return;
+}
+
+void gr_handle_brute_check(void)
+{
+#ifdef CONFIG_GRKERNSEC_BRUTE
+	if (current->brute)
+		msleep(30 * 1000);
+#endif
+	return;
+}
+
+void gr_handle_kernel_exploit(void)
+{
+#ifdef CONFIG_GRKERNSEC_KERN_LOCKOUT
+	const struct cred *cred;
+	struct task_struct *tsk, *tsk2;
+	struct user_struct *user;
+	uid_t uid;
+
+	if (in_irq() || in_serving_softirq() || in_nmi())
+		panic("grsec: halting the system due to suspicious kernel crash caused in interrupt context");
+
+	uid = current_uid();
+
+	if (uid == 0)
+		panic("grsec: halting the system due to suspicious kernel crash caused by root");
+	else {
+		/* kill all the processes of this user, hold a reference
+		   to their creds struct, and prevent them from creating
+		   another process until system reset
+		*/
+		printk(KERN_ALERT "grsec: banning user with uid %u until system restart for suspicious kernel crash\n", uid);
+		/* we intentionally leak this ref */
+		user = get_uid(current->cred->user);
+		if (user) {
+			user->banned = 1;
+			user->ban_expires = ~0UL;
+		}
+
+		read_lock(&tasklist_lock);
+		do_each_thread(tsk2, tsk) {
+			cred = __task_cred(tsk);
+			if (cred->uid == uid)
+				gr_fake_force_sig(SIGKILL, tsk);
+		} while_each_thread(tsk2, tsk);
+		read_unlock(&tasklist_lock);
+	}
+#endif
+}
+
+int __gr_process_user_ban(struct user_struct *user)
+{
+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
+	if (unlikely(user->banned)) {
+		if (user->ban_expires != ~0UL && time_after_eq(get_seconds(), user->ban_expires)) {
+			user->banned = 0;
+			user->ban_expires = 0;
+			free_uid(user);
+		} else
+			return -EPERM;
+	}
+#endif
+	return 0;
+}
+
+int gr_process_user_ban(void)
+{
+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
+	return __gr_process_user_ban(current->cred->user);
+#endif
+	return 0;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_sock.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_sock.c
--- linux-2.6.32.43/grsecurity/grsec_sock.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_sock.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,275 @@
+#include <linux/kernel.h>
+#include <linux/module.h>
+#include <linux/sched.h>
+#include <linux/file.h>
+#include <linux/net.h>
+#include <linux/in.h>
+#include <linux/ip.h>
+#include <net/sock.h>
+#include <net/inet_sock.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+#include <linux/gracl.h>
+
+kernel_cap_t gr_cap_rtnetlink(struct sock *sock);
+EXPORT_SYMBOL(gr_cap_rtnetlink);
+
+extern int gr_search_udp_recvmsg(const struct sock *sk, const struct sk_buff *skb);
+extern int gr_search_udp_sendmsg(const struct sock *sk, const struct sockaddr_in *addr);
+
+EXPORT_SYMBOL(gr_search_udp_recvmsg);
+EXPORT_SYMBOL(gr_search_udp_sendmsg);
+
+#ifdef CONFIG_UNIX_MODULE
+EXPORT_SYMBOL(gr_acl_handle_unix);
+EXPORT_SYMBOL(gr_acl_handle_mknod);
+EXPORT_SYMBOL(gr_handle_chroot_unix);
+EXPORT_SYMBOL(gr_handle_create);
+#endif
+
+#ifdef CONFIG_GRKERNSEC
+#define gr_conn_table_size 32749
+struct conn_table_entry {
+	struct conn_table_entry *next;
+	struct signal_struct *sig;
+};
+
+struct conn_table_entry *gr_conn_table[gr_conn_table_size];
+DEFINE_SPINLOCK(gr_conn_table_lock);
+
+extern const char * gr_socktype_to_name(unsigned char type);
+extern const char * gr_proto_to_name(unsigned char proto);
+extern const char * gr_sockfamily_to_name(unsigned char family);
+
+static __inline__ int 
+conn_hash(__u32 saddr, __u32 daddr, __u16 sport, __u16 dport, unsigned int size)
+{
+	return ((daddr + saddr + (sport << 8) + (dport << 16)) % size);
+}
+
+static __inline__ int
+conn_match(const struct signal_struct *sig, __u32 saddr, __u32 daddr, 
+	   __u16 sport, __u16 dport)
+{
+	if (unlikely(sig->gr_saddr == saddr && sig->gr_daddr == daddr &&
+		     sig->gr_sport == sport && sig->gr_dport == dport))
+		return 1;
+	else
+		return 0;
+}
+
+static void gr_add_to_task_ip_table_nolock(struct signal_struct *sig, struct conn_table_entry *newent)
+{
+	struct conn_table_entry **match;
+	unsigned int index;
+
+	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
+			  sig->gr_sport, sig->gr_dport, 
+			  gr_conn_table_size);
+
+	newent->sig = sig;
+	
+	match = &gr_conn_table[index];
+	newent->next = *match;
+	*match = newent;
+
+	return;
+}
+
+static void gr_del_task_from_ip_table_nolock(struct signal_struct *sig)
+{
+	struct conn_table_entry *match, *last = NULL;
+	unsigned int index;
+
+	index = conn_hash(sig->gr_saddr, sig->gr_daddr, 
+			  sig->gr_sport, sig->gr_dport, 
+			  gr_conn_table_size);
+
+	match = gr_conn_table[index];
+	while (match && !conn_match(match->sig, 
+		sig->gr_saddr, sig->gr_daddr, sig->gr_sport, 
+		sig->gr_dport)) {
+		last = match;
+		match = match->next;
+	}
+
+	if (match) {
+		if (last)
+			last->next = match->next;
+		else
+			gr_conn_table[index] = NULL;
+		kfree(match);
+	}
+
+	return;
+}
+
+static struct signal_struct * gr_lookup_task_ip_table(__u32 saddr, __u32 daddr,
+					     __u16 sport, __u16 dport)
+{
+	struct conn_table_entry *match;
+	unsigned int index;
+
+	index = conn_hash(saddr, daddr, sport, dport, gr_conn_table_size);
+
+	match = gr_conn_table[index];
+	while (match && !conn_match(match->sig, saddr, daddr, sport, dport))
+		match = match->next;
+
+	if (match)
+		return match->sig;
+	else
+		return NULL;
+}
+
+#endif
+
+void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet)
+{
+#ifdef CONFIG_GRKERNSEC
+	struct signal_struct *sig = task->signal;
+	struct conn_table_entry *newent;
+
+	newent = kmalloc(sizeof(struct conn_table_entry), GFP_ATOMIC);
+	if (newent == NULL)
+		return;
+	/* no bh lock needed since we are called with bh disabled */
+	spin_lock(&gr_conn_table_lock);
+	gr_del_task_from_ip_table_nolock(sig);
+	sig->gr_saddr = inet->rcv_saddr;
+	sig->gr_daddr = inet->daddr;
+	sig->gr_sport = inet->sport;
+	sig->gr_dport = inet->dport;
+	gr_add_to_task_ip_table_nolock(sig, newent);
+	spin_unlock(&gr_conn_table_lock);
+#endif
+	return;
+}
+
+void gr_del_task_from_ip_table(struct task_struct *task)
+{
+#ifdef CONFIG_GRKERNSEC
+	spin_lock_bh(&gr_conn_table_lock);
+	gr_del_task_from_ip_table_nolock(task->signal);
+	spin_unlock_bh(&gr_conn_table_lock);
+#endif
+	return;
+}
+
+void
+gr_attach_curr_ip(const struct sock *sk)
+{
+#ifdef CONFIG_GRKERNSEC
+	struct signal_struct *p, *set;
+	const struct inet_sock *inet = inet_sk(sk);	
+
+	if (unlikely(sk->sk_protocol != IPPROTO_TCP))
+		return;
+
+	set = current->signal;
+
+	spin_lock_bh(&gr_conn_table_lock);
+	p = gr_lookup_task_ip_table(inet->daddr, inet->rcv_saddr,
+				    inet->dport, inet->sport);
+	if (unlikely(p != NULL)) {
+		set->curr_ip = p->curr_ip;
+		set->used_accept = 1;
+		gr_del_task_from_ip_table_nolock(p);
+		spin_unlock_bh(&gr_conn_table_lock);
+		return;
+	}
+	spin_unlock_bh(&gr_conn_table_lock);
+
+	set->curr_ip = inet->daddr;
+	set->used_accept = 1;
+#endif
+	return;
+}
+
+int
+gr_handle_sock_all(const int family, const int type, const int protocol)
+{
+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
+	if (grsec_enable_socket_all && in_group_p(grsec_socket_all_gid) &&
+	    (family != AF_UNIX)) {
+		if (family == AF_INET)
+			gr_log_str3(GR_DONT_AUDIT, GR_SOCK_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), gr_proto_to_name(protocol));
+		else
+			gr_log_str2_int(GR_DONT_AUDIT, GR_SOCK_NOINET_MSG, gr_sockfamily_to_name(family), gr_socktype_to_name(type), protocol);
+		return -EACCES;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_sock_server(const struct sockaddr *sck)
+{
+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
+	if (grsec_enable_socket_server &&
+	    in_group_p(grsec_socket_server_gid) &&
+	    sck && (sck->sa_family != AF_UNIX) &&
+	    (sck->sa_family != AF_LOCAL)) {
+		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
+		return -EACCES;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_sock_server_other(const struct sock *sck)
+{
+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
+	if (grsec_enable_socket_server &&
+	    in_group_p(grsec_socket_server_gid) &&
+	    sck && (sck->sk_family != AF_UNIX) &&
+	    (sck->sk_family != AF_LOCAL)) {
+		gr_log_noargs(GR_DONT_AUDIT, GR_BIND_MSG);
+		return -EACCES;
+	}
+#endif
+	return 0;
+}
+
+int
+gr_handle_sock_client(const struct sockaddr *sck)
+{
+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
+	if (grsec_enable_socket_client && in_group_p(grsec_socket_client_gid) &&
+	    sck && (sck->sa_family != AF_UNIX) &&
+	    (sck->sa_family != AF_LOCAL)) {
+		gr_log_noargs(GR_DONT_AUDIT, GR_CONNECT_MSG);
+		return -EACCES;
+	}
+#endif
+	return 0;
+}
+
+kernel_cap_t
+gr_cap_rtnetlink(struct sock *sock)
+{
+#ifdef CONFIG_GRKERNSEC
+	if (!gr_acl_is_enabled())
+		return current_cap();
+	else if (sock->sk_protocol == NETLINK_ISCSI &&
+		 cap_raised(current_cap(), CAP_SYS_ADMIN) &&
+		 gr_is_capable(CAP_SYS_ADMIN))
+		return current_cap();
+	else if (sock->sk_protocol == NETLINK_AUDIT &&
+		 cap_raised(current_cap(), CAP_AUDIT_WRITE) &&
+		 gr_is_capable(CAP_AUDIT_WRITE) &&
+		 cap_raised(current_cap(), CAP_AUDIT_CONTROL) &&
+		 gr_is_capable(CAP_AUDIT_CONTROL))
+		return current_cap();
+	else if (cap_raised(current_cap(), CAP_NET_ADMIN) &&
+		 ((sock->sk_protocol == NETLINK_ROUTE) ? 
+		  gr_is_capable_nolog(CAP_NET_ADMIN) : 
+		  gr_is_capable(CAP_NET_ADMIN)))
+		return current_cap();
+	else
+		return __cap_empty_set;
+#else
+	return current_cap();
+#endif
+}
diff -uriN linux-2.6.32.43/grsecurity/grsec_sysctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_sysctl.c
--- linux-2.6.32.43/grsecurity/grsec_sysctl.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_sysctl.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,489 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/sysctl.h>
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+int
+gr_handle_sysctl_mod(const char *dirname, const char *name, const int op)
+{
+#ifdef CONFIG_GRKERNSEC_SYSCTL
+	if (!strcmp(dirname, "grsecurity") && grsec_lock && (op & MAY_WRITE)) {
+		gr_log_str(GR_DONT_AUDIT, GR_SYSCTL_MSG, name);
+		return -EACCES;
+	}
+#endif
+	return 0;
+}
+
+#ifdef CONFIG_GRKERNSEC_ROFS
+static int __maybe_unused one = 1;
+#endif
+
+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
+ctl_table grsecurity_table[] = {
+#ifdef CONFIG_GRKERNSEC_SYSCTL
+#ifdef CONFIG_GRKERNSEC_SYSCTL_DISTRO
+#ifdef CONFIG_GRKERNSEC_IO
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "disable_priv_io",
+		.data		= &grsec_disable_privio,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#endif
+#ifdef CONFIG_GRKERNSEC_LINK
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "linking_restrictions",
+		.data		= &grsec_enable_link,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_BRUTE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "deter_bruteforce",
+		.data		= &grsec_enable_brute,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_FIFO
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "fifo_restrictions",
+		.data		= &grsec_enable_fifo,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_EXECVE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "execve_limiting",
+		.data		= &grsec_enable_execve,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "ip_blackhole",
+		.data		= &grsec_enable_blackhole,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "lastack_retries",
+		.data		= &grsec_lastack_retries,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_EXECLOG
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "exec_logging",
+		.data		= &grsec_enable_execlog,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_RWXMAP_LOG
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "rwxmap_logging",
+		.data		= &grsec_enable_log_rwxmaps,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_SIGNAL
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "signal_logging",
+		.data		= &grsec_enable_signal,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_FORKFAIL
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "forkfail_logging",
+		.data		= &grsec_enable_forkfail,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_TIME
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "timechange_logging",
+		.data		= &grsec_enable_time,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_SHMAT
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_shmat",
+		.data		= &grsec_enable_chroot_shmat,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_unix",
+		.data		= &grsec_enable_chroot_unix,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_MOUNT
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_mount",
+		.data		= &grsec_enable_chroot_mount,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_FCHDIR
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_fchdir",
+		.data		= &grsec_enable_chroot_fchdir,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_DOUBLE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_chroot",
+		.data		= &grsec_enable_chroot_double,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_PIVOT
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_pivot",
+		.data		= &grsec_enable_chroot_pivot,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_CHDIR
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_enforce_chdir",
+		.data		= &grsec_enable_chroot_chdir,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_CHMOD
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_chmod",
+		.data		= &grsec_enable_chroot_chmod,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_MKNOD
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_mknod",
+		.data		= &grsec_enable_chroot_mknod,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_NICE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_restrict_nice",
+		.data		= &grsec_enable_chroot_nice,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_EXECLOG
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_execlog",
+		.data		= &grsec_enable_chroot_execlog,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_CAPS
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_caps",
+		.data		= &grsec_enable_chroot_caps,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_SYSCTL
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_deny_sysctl",
+		.data		= &grsec_enable_chroot_sysctl,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_TPE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "tpe",
+		.data		= &grsec_enable_tpe,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "tpe_gid",
+		.data		= &grsec_tpe_gid,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "tpe_invert",
+		.data		= &grsec_enable_tpe_invert,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_TPE_ALL
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "tpe_restrict_all",
+		.data		= &grsec_enable_tpe_all,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_SOCKET_ALL
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "socket_all",
+		.data		= &grsec_enable_socket_all,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "socket_all_gid",
+		.data		= &grsec_socket_all_gid,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_SOCKET_CLIENT
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "socket_client",
+		.data		= &grsec_enable_socket_client,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "socket_client_gid",
+		.data		= &grsec_socket_client_gid,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_SOCKET_SERVER
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "socket_server",
+		.data		= &grsec_enable_socket_server,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "socket_server_gid",
+		.data		= &grsec_socket_server_gid,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_GROUP
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "audit_group",
+		.data		= &grsec_enable_group,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "audit_gid",
+		.data		= &grsec_audit_gid,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_CHDIR
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "audit_chdir",
+		.data		= &grsec_enable_chdir,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_MOUNT
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "audit_mount",
+		.data		= &grsec_enable_mount,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_TEXTREL
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "audit_textrel",
+		.data		= &grsec_enable_audit_textrel,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_DMESG
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "dmesg",
+		.data		= &grsec_enable_dmesg,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "chroot_findtask",
+		.data		= &grsec_enable_chroot_findtask,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_RESLOG
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "resource_logging",
+		.data		= &grsec_resource_logging,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_AUDIT_PTRACE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "audit_ptrace",
+		.data		= &grsec_enable_audit_ptrace,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_HARDEN_PTRACE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "harden_ptrace",
+		.data		= &grsec_enable_harden_ptrace,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "grsec_lock",
+		.data		= &grsec_lock,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+#endif
+#ifdef CONFIG_GRKERNSEC_ROFS
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "romount_protect",
+		.data		= &grsec_enable_rofs,
+		.maxlen		= sizeof(int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec_minmax,
+		.extra1		= &one,
+		.extra2		= &one,
+	},
+#endif
+	{ .ctl_name = 0 }
+};
+#endif
diff -uriN linux-2.6.32.43/grsecurity/grsec_time.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_time.c
--- linux-2.6.32.43/grsecurity/grsec_time.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_time.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,16 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/grinternal.h>
+#include <linux/module.h>
+
+void
+gr_log_timechange(void)
+{
+#ifdef CONFIG_GRKERNSEC_TIME
+	if (grsec_enable_time)
+		gr_log_noargs(GR_DONT_AUDIT_GOOD, GR_TIME_MSG);
+#endif
+	return;
+}
+
+EXPORT_SYMBOL(gr_log_timechange);
diff -uriN linux-2.6.32.43/grsecurity/grsec_tpe.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_tpe.c
--- linux-2.6.32.43/grsecurity/grsec_tpe.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsec_tpe.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,39 @@
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/file.h>
+#include <linux/fs.h>
+#include <linux/grinternal.h>
+
+extern int gr_acl_tpe_check(void);
+
+int
+gr_tpe_allow(const struct file *file)
+{
+#ifdef CONFIG_GRKERNSEC
+	struct inode *inode = file->f_path.dentry->d_parent->d_inode;
+	const struct cred *cred = current_cred();
+
+	if (cred->uid && ((grsec_enable_tpe &&
+#ifdef CONFIG_GRKERNSEC_TPE_INVERT
+	    ((grsec_enable_tpe_invert && !in_group_p(grsec_tpe_gid)) ||
+	     (!grsec_enable_tpe_invert && in_group_p(grsec_tpe_gid)))
+#else
+	    in_group_p(grsec_tpe_gid)
+#endif
+	    ) || gr_acl_tpe_check()) &&
+	    (inode->i_uid || (!inode->i_uid && ((inode->i_mode & S_IWGRP) ||
+						(inode->i_mode & S_IWOTH))))) {
+		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
+		return 0;
+	}
+#ifdef CONFIG_GRKERNSEC_TPE_ALL
+	if (cred->uid && grsec_enable_tpe && grsec_enable_tpe_all &&
+	    ((inode->i_uid && (inode->i_uid != cred->uid)) ||
+	     (inode->i_mode & S_IWGRP) || (inode->i_mode & S_IWOTH))) {
+		gr_log_fs_generic(GR_DONT_AUDIT, GR_EXEC_TPE_MSG, file->f_path.dentry, file->f_path.mnt);
+		return 0;
+	}
+#endif
+#endif
+	return 1;
+}
diff -uriN linux-2.6.32.43/grsecurity/grsum.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsum.c
--- linux-2.6.32.43/grsecurity/grsum.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/grsum.c	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,61 @@
+#include <linux/err.h>
+#include <linux/kernel.h>
+#include <linux/sched.h>
+#include <linux/mm.h>
+#include <linux/scatterlist.h>
+#include <linux/crypto.h>
+#include <linux/gracl.h>
+
+
+#if !defined(CONFIG_CRYPTO) || defined(CONFIG_CRYPTO_MODULE) || !defined(CONFIG_CRYPTO_SHA256) || defined(CONFIG_CRYPTO_SHA256_MODULE)
+#error "crypto and sha256 must be built into the kernel"
+#endif
+
+int
+chkpw(struct gr_arg *entry, unsigned char *salt, unsigned char *sum)
+{
+	char *p;
+	struct crypto_hash *tfm;
+	struct hash_desc desc;
+	struct scatterlist sg;
+	unsigned char temp_sum[GR_SHA_LEN];
+	volatile int retval = 0;
+	volatile int dummy = 0;
+	unsigned int i;
+
+	sg_init_table(&sg, 1);
+
+	tfm = crypto_alloc_hash("sha256", 0, CRYPTO_ALG_ASYNC);
+	if (IS_ERR(tfm)) {
+		/* should never happen, since sha256 should be built in */
+		return 1;
+	}
+
+	desc.tfm = tfm;
+	desc.flags = 0;
+
+	crypto_hash_init(&desc);
+
+	p = salt;
+	sg_set_buf(&sg, p, GR_SALT_LEN);
+	crypto_hash_update(&desc, &sg, sg.length);
+
+	p = entry->pw;
+	sg_set_buf(&sg, p, strlen(p));
+	
+	crypto_hash_update(&desc, &sg, sg.length);
+
+	crypto_hash_final(&desc, temp_sum);
+
+	memset(entry->pw, 0, GR_PW_LEN);
+
+	for (i = 0; i < GR_SHA_LEN; i++)
+		if (sum[i] != temp_sum[i])
+			retval = 1;
+		else
+			dummy = 1;	// waste a cycle
+
+	crypto_free_hash(tfm);
+
+	return retval;
+}
diff -uriN linux-2.6.32.43/grsecurity/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/Kconfig
--- linux-2.6.32.43/grsecurity/Kconfig	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/Kconfig	2011-07-15 06:54:21.000000000 -0500
@@ -0,0 +1,1040 @@
+#
+# grecurity configuration
+#
+
+menu "Grsecurity"
+
+config GRKERNSEC
+	bool "Grsecurity"
+	select CRYPTO
+	select CRYPTO_SHA256
+	help
+	  If you say Y here, you will be able to configure many features
+	  that will enhance the security of your system.  It is highly
+	  recommended that you say Y here and read through the help
+	  for each option so that you fully understand the features and
+	  can evaluate their usefulness for your machine.
+
+choice
+	prompt "Security Level"
+	depends on GRKERNSEC
+	default GRKERNSEC_CUSTOM
+
+config GRKERNSEC_LOW
+	bool "Low"
+	select GRKERNSEC_LINK
+	select GRKERNSEC_FIFO
+	select GRKERNSEC_EXECVE
+	select GRKERNSEC_RANDNET
+	select GRKERNSEC_DMESG
+	select GRKERNSEC_CHROOT
+	select GRKERNSEC_CHROOT_CHDIR
+
+	help
+	  If you choose this option, several of the grsecurity options will
+	  be enabled that will give you greater protection against a number
+	  of attacks, while assuring that none of your software will have any
+	  conflicts with the additional security measures.  If you run a lot
+	  of unusual software, or you are having problems with the higher
+	  security levels, you should say Y here.  With this option, the
+	  following features are enabled:
+
+	  - Linking restrictions
+	  - FIFO restrictions
+	  - Enforcing RLIMIT_NPROC on execve
+	  - Restricted dmesg
+	  - Enforced chdir("/") on chroot
+	  - Runtime module disabling
+
+config GRKERNSEC_MEDIUM
+	bool "Medium"
+	select PAX
+	select PAX_EI_PAX
+	select PAX_PT_PAX_FLAGS
+	select PAX_HAVE_ACL_FLAGS
+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
+	select GRKERNSEC_CHROOT
+	select GRKERNSEC_CHROOT_SYSCTL
+	select GRKERNSEC_LINK
+	select GRKERNSEC_FIFO
+	select GRKERNSEC_EXECVE
+	select GRKERNSEC_DMESG
+	select GRKERNSEC_RANDNET
+	select GRKERNSEC_FORKFAIL
+	select GRKERNSEC_TIME
+	select GRKERNSEC_SIGNAL
+	select GRKERNSEC_CHROOT
+	select GRKERNSEC_CHROOT_UNIX
+	select GRKERNSEC_CHROOT_PIVOT
+	select GRKERNSEC_CHROOT_CHDIR
+	select GRKERNSEC_CHROOT_MKNOD
+	select GRKERNSEC_PROC
+	select GRKERNSEC_PROC_USERGROUP
+	select PAX_RANDUSTACK
+	select PAX_ASLR
+	select PAX_RANDMMAP
+	select PAX_REFCOUNT if (X86 || SPARC64)
+	select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
+
+	help
+	  If you say Y here, several features in addition to those included
+	  in the low additional security level will be enabled.  These
+	  features provide even more security to your system, though in rare
+	  cases they may be incompatible with very old or poorly written
+	  software.  If you enable this option, make sure that your auth
+	  service (identd) is running as gid 1001.  With this option, 
+	  the following features (in addition to those provided in the 
+	  low additional security level) will be enabled:
+
+	  - Failed fork logging
+	  - Time change logging
+	  - Signal logging
+	  - Deny mounts in chroot
+	  - Deny double chrooting
+	  - Deny sysctl writes in chroot
+	  - Deny mknod in chroot
+	  - Deny access to abstract AF_UNIX sockets out of chroot
+	  - Deny pivot_root in chroot
+	  - Denied writes of /dev/kmem, /dev/mem, and /dev/port
+	  - /proc restrictions with special GID set to 10 (usually wheel)
+	  - Address Space Layout Randomization (ASLR)
+	  - Prevent exploitation of most refcount overflows
+	  - Bounds checking of copying between the kernel and userland
+
+config GRKERNSEC_HIGH
+	bool "High"
+	select GRKERNSEC_LINK
+	select GRKERNSEC_FIFO
+	select GRKERNSEC_EXECVE
+	select GRKERNSEC_DMESG
+	select GRKERNSEC_FORKFAIL
+	select GRKERNSEC_TIME
+	select GRKERNSEC_SIGNAL
+	select GRKERNSEC_CHROOT
+	select GRKERNSEC_CHROOT_SHMAT
+	select GRKERNSEC_CHROOT_UNIX
+	select GRKERNSEC_CHROOT_FCHDIR
+	select GRKERNSEC_CHROOT_PIVOT
+	select GRKERNSEC_CHROOT_CHDIR
+	select GRKERNSEC_CHROOT_MKNOD
+	select GRKERNSEC_CHROOT_SYSCTL
+	select GRKERNSEC_SYSFS_RESTRICT
+	select GRKERNSEC_PROC
+	select GRKERNSEC_PROC_MEMMAP if (PAX_NOEXEC || PAX_ASLR)
+	select GRKERNSEC_HIDESYM
+	select GRKERNSEC_BRUTE
+	select GRKERNSEC_PROC_USERGROUP
+	select GRKERNSEC_KMEM
+	select GRKERNSEC_RESLOG
+	select GRKERNSEC_RANDNET
+	select GRKERNSEC_PROC_ADD
+	select GRKERNSEC_CHROOT_NICE
+	select GRKERNSEC_AUDIT_MOUNT
+	select GRKERNSEC_MODHARDEN if (MODULES)
+	select GRKERNSEC_HARDEN_PTRACE
+	select GRKERNSEC_VM86 if (X86_32)
+	select GRKERNSEC_KERN_LOCKOUT if (X86 || ARM || PPC || SPARC)
+	select PAX
+	select PAX_RANDUSTACK
+	select PAX_ASLR
+	select PAX_RANDMMAP
+	select PAX_NOEXEC
+	select PAX_MPROTECT
+	select PAX_EI_PAX
+	select PAX_PT_PAX_FLAGS
+	select PAX_HAVE_ACL_FLAGS
+	select PAX_KERNEXEC if ((PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN)
+	select PAX_MEMORY_UDEREF if (X86 && !XEN)
+	select PAX_RANDKSTACK if (X86_TSC && X86)
+	select PAX_SEGMEXEC if (X86_32)
+	select PAX_PAGEEXEC
+	select PAX_EMUPLT if (ALPHA || PARISC || SPARC)
+	select PAX_EMUTRAMP if (PARISC)
+	select PAX_EMUSIGRT if (PARISC)
+	select PAX_ETEXECRELOCS if (ALPHA || IA64 || PARISC)
+	select PAX_ELFRELOCS if (PAX_ETEXECRELOCS || (IA64 || PPC || X86))
+	select PAX_REFCOUNT if (X86 || SPARC64)
+	select PAX_USERCOPY if ((X86 || SPARC || PPC || ARM) && (SLAB || SLUB || SLOB))
+	help
+	  If you say Y here, many of the features of grsecurity will be
+	  enabled, which will protect you against many kinds of attacks
+	  against your system.  The heightened security comes at a cost
+	  of an increased chance of incompatibilities with rare software
+	  on your machine.  Since this security level enables PaX, you should
+	  view <http://pax.grsecurity.net> and read about the PaX
+	  project.  While you are there, download chpax and run it on
+	  binaries that cause problems with PaX.  Also remember that
+	  since the /proc restrictions are enabled, you must run your
+	  identd as gid 1001.  This security level enables the following 
+	  features in addition to those listed in the low and medium 
+	  security levels:
+
+	  - Additional /proc restrictions
+	  - Chmod restrictions in chroot
+	  - No signals, ptrace, or viewing of processes outside of chroot
+	  - Capability restrictions in chroot
+	  - Deny fchdir out of chroot
+	  - Priority restrictions in chroot
+	  - Segmentation-based implementation of PaX
+	  - Mprotect restrictions
+	  - Removal of addresses from /proc/<pid>/[smaps|maps|stat]
+	  - Kernel stack randomization
+	  - Mount/unmount/remount logging
+	  - Kernel symbol hiding
+	  - Prevention of memory exhaustion-based exploits
+	  - Hardening of module auto-loading
+	  - Ptrace restrictions
+	  - Restricted vm86 mode
+	  - Restricted sysfs/debugfs
+	  - Active kernel exploit response
+
+config GRKERNSEC_CUSTOM
+	bool "Custom"
+	help
+	  If you say Y here, you will be able to configure every grsecurity
+	  option, which allows you to enable many more features that aren't
+	  covered in the basic security levels.  These additional features
+	  include TPE, socket restrictions, and the sysctl system for
+	  grsecurity.  It is advised that you read through the help for
+	  each option to determine its usefulness in your situation.
+
+endchoice
+
+menu "Address Space Protection"
+depends on GRKERNSEC
+
+config GRKERNSEC_KMEM
+	bool "Deny writing to /dev/kmem, /dev/mem, and /dev/port"
+	select STRICT_DEVMEM if (X86 || ARM || TILE || S390)
+	help
+	  If you say Y here, /dev/kmem and /dev/mem won't be allowed to
+	  be written to via mmap or otherwise to modify the running kernel.
+	  /dev/port will also not be allowed to be opened. If you have module
+	  support disabled, enabling this will close up four ways that are
+	  currently used  to insert malicious code into the running kernel.
+	  Even with all these features enabled, we still highly recommend that
+	  you use the RBAC system, as it is still possible for an attacker to
+	  modify the running kernel through privileged I/O granted by ioperm/iopl.
+	  If you are not using XFree86, you may be able to stop this additional
+	  case by enabling the 'Disable privileged I/O' option. Though nothing
+	  legitimately writes to /dev/kmem, XFree86 does need to write to /dev/mem,
+	  but only to video memory, which is the only writing we allow in this
+	  case.  If /dev/kmem or /dev/mem are mmaped without PROT_WRITE, they will
+	  not be allowed to mprotect it with PROT_WRITE later.
+	  It is highly recommended that you say Y here if you meet all the
+	  conditions above.
+
+config GRKERNSEC_VM86
+	bool "Restrict VM86 mode"
+	depends on X86_32
+
+	help
+	  If you say Y here, only processes with CAP_SYS_RAWIO will be able to
+	  make use of a special execution mode on 32bit x86 processors called
+	  Virtual 8086 (VM86) mode.  XFree86 may need vm86 mode for certain
+	  video cards and will still work with this option enabled.  The purpose
+	  of the option is to prevent exploitation of emulation errors in
+	  virtualization of vm86 mode like the one discovered in VMWare in 2009.
+	  Nearly all users should be able to enable this option.
+
+config GRKERNSEC_IO
+	bool "Disable privileged I/O"
+	depends on X86
+	select RTC_CLASS
+	select RTC_INTF_DEV
+	select RTC_DRV_CMOS
+
+	help
+	  If you say Y here, all ioperm and iopl calls will return an error.
+	  Ioperm and iopl can be used to modify the running kernel.
+	  Unfortunately, some programs need this access to operate properly,
+	  the most notable of which are XFree86 and hwclock.  hwclock can be
+	  remedied by having RTC support in the kernel, so real-time 
+	  clock support is enabled if this option is enabled, to ensure 
+	  that hwclock operates correctly.  XFree86 still will not 
+	  operate correctly with this option enabled, so DO NOT CHOOSE Y 
+	  IF YOU USE XFree86.  If you use XFree86 and you still want to 
+	  protect your kernel against modification, use the RBAC system.
+
+config GRKERNSEC_PROC_MEMMAP
+	bool "Remove addresses from /proc/<pid>/[smaps|maps|stat]"
+	default y if (PAX_NOEXEC || PAX_ASLR)
+	depends on PAX_NOEXEC || PAX_ASLR
+	help
+	  If you say Y here, the /proc/<pid>/maps and /proc/<pid>/stat files will
+	  give no information about the addresses of its mappings if
+	  PaX features that rely on random addresses are enabled on the task.
+	  If you use PaX it is greatly recommended that you say Y here as it
+	  closes up a hole that makes the full ASLR useless for suid
+	  binaries.
+
+config GRKERNSEC_BRUTE
+	bool "Deter exploit bruteforcing"
+	help
+	  If you say Y here, attempts to bruteforce exploits against forking
+	  daemons such as apache or sshd, as well as against suid/sgid binaries
+	  will be deterred.  When a child of a forking daemon is killed by PaX
+	  or crashes due to an illegal instruction or other suspicious signal,
+	  the parent process will be delayed 30 seconds upon every subsequent
+	  fork until the administrator is able to assess the situation and
+	  restart the daemon.
+	  In the suid/sgid case, the attempt is logged, the user has all their
+	  processes terminated, and they are prevented from executing any further
+	  processes for 15 minutes.
+	  It is recommended that you also enable signal logging in the auditing
+	  section so that logs are generated when a process triggers a suspicious
+	  signal.
+	  If the sysctl option is enabled, a sysctl option with name
+	  "deter_bruteforce" is created.
+
+config GRKERNSEC_MODHARDEN
+	bool "Harden module auto-loading"
+	depends on MODULES
+	help
+	  If you say Y here, module auto-loading in response to use of some
+	  feature implemented by an unloaded module will be restricted to
+	  root users.  Enabling this option helps defend against attacks 
+	  by unprivileged users who abuse the auto-loading behavior to 
+	  cause a vulnerable module to load that is then exploited.
+
+	  If this option prevents a legitimate use of auto-loading for a 
+	  non-root user, the administrator can execute modprobe manually 
+	  with the exact name of the module mentioned in the alert log.
+	  Alternatively, the administrator can add the module to the list
+	  of modules loaded at boot by modifying init scripts.
+
+	  Modification of init scripts will most likely be needed on 
+	  Ubuntu servers with encrypted home directory support enabled,
+	  as the first non-root user logging in will cause the ecb(aes),
+	  ecb(aes)-all, cbc(aes), and cbc(aes)-all  modules to be loaded.
+
+config GRKERNSEC_HIDESYM
+	bool "Hide kernel symbols"
+	help
+	  If you say Y here, getting information on loaded modules, and
+	  displaying all kernel symbols through a syscall will be restricted
+	  to users with CAP_SYS_MODULE.  For software compatibility reasons,
+	  /proc/kallsyms will be restricted to the root user.  The RBAC
+	  system can hide that entry even from root.
+
+	  This option also prevents leaking of kernel addresses through
+	  several /proc entries.
+
+	  Note that this option is only effective provided the following
+	  conditions are met:
+	  1) The kernel using grsecurity is not precompiled by some distribution
+	  2) You have also enabled GRKERNSEC_DMESG
+	  3) You are using the RBAC system and hiding other files such as your
+	     kernel image and System.map.  Alternatively, enabling this option
+	     causes the permissions on /boot, /lib/modules, and the kernel
+	     source directory to change at compile time to prevent 
+	     reading by non-root users.
+	  If the above conditions are met, this option will aid in providing a
+	  useful protection against local kernel exploitation of overflows
+	  and arbitrary read/write vulnerabilities.
+
+config GRKERNSEC_KERN_LOCKOUT
+	bool "Active kernel exploit response"
+	depends on X86 || ARM || PPC || SPARC
+	help
+	  If you say Y here, when a PaX alert is triggered due to suspicious
+	  activity in the kernel (from KERNEXEC/UDEREF/USERCOPY)
+	  or an OOPs occurs due to bad memory accesses, instead of just
+	  terminating the offending process (and potentially allowing
+	  a subsequent exploit from the same user), we will take one of two
+	  actions:
+	   If the user was root, we will panic the system
+	   If the user was non-root, we will log the attempt, terminate
+	   all processes owned by the user, then prevent them from creating
+	   any new processes until the system is restarted
+	  This deters repeated kernel exploitation/bruteforcing attempts
+	  and is useful for later forensics.
+
+endmenu
+menu "Role Based Access Control Options"
+depends on GRKERNSEC
+
+config GRKERNSEC_RBAC_DEBUG
+	bool
+
+config GRKERNSEC_NO_RBAC
+	bool "Disable RBAC system"
+	help
+	  If you say Y here, the /dev/grsec device will be removed from the kernel,
+	  preventing the RBAC system from being enabled.  You should only say Y
+	  here if you have no intention of using the RBAC system, so as to prevent
+	  an attacker with root access from misusing the RBAC system to hide files
+	  and processes when loadable module support and /dev/[k]mem have been
+	  locked down.
+
+config GRKERNSEC_ACL_HIDEKERN
+	bool "Hide kernel processes"
+	help
+	  If you say Y here, all kernel threads will be hidden to all
+	  processes but those whose subject has the "view hidden processes"
+	  flag.
+
+config GRKERNSEC_ACL_MAXTRIES
+	int "Maximum tries before password lockout"
+	default 3
+	help
+	  This option enforces the maximum number of times a user can attempt
+	  to authorize themselves with the grsecurity RBAC system before being
+	  denied the ability to attempt authorization again for a specified time.
+	  The lower the number, the harder it will be to brute-force a password.
+
+config GRKERNSEC_ACL_TIMEOUT
+	int "Time to wait after max password tries, in seconds"
+	default 30
+	help
+	  This option specifies the time the user must wait after attempting to
+	  authorize to the RBAC system with the maximum number of invalid
+	  passwords.  The higher the number, the harder it will be to brute-force
+	  a password.
+
+endmenu
+menu "Filesystem Protections"
+depends on GRKERNSEC
+
+config GRKERNSEC_PROC
+	bool "Proc restrictions"
+	help
+	  If you say Y here, the permissions of the /proc filesystem
+	  will be altered to enhance system security and privacy.  You MUST
+  	  choose either a user only restriction or a user and group restriction.
+	  Depending upon the option you choose, you can either restrict users to
+	  see only the processes they themselves run, or choose a group that can
+	  view all processes and files normally restricted to root if you choose
+	  the "restrict to user only" option.  NOTE: If you're running identd as
+	  a non-root user, you will have to run it as the group you specify here.
+
+config GRKERNSEC_PROC_USER
+	bool "Restrict /proc to user only"
+	depends on GRKERNSEC_PROC
+	help
+	  If you say Y here, non-root users will only be able to view their own
+	  processes, and restricts them from viewing network-related information,
+	  and viewing kernel symbol and module information.
+
+config GRKERNSEC_PROC_USERGROUP
+	bool "Allow special group"
+	depends on GRKERNSEC_PROC && !GRKERNSEC_PROC_USER
+	help
+	  If you say Y here, you will be able to select a group that will be
+	  able to view all processes and network-related information.  If you've
+	  enabled GRKERNSEC_HIDESYM, kernel and symbol information may still
+	  remain hidden.  This option is useful if you want to run identd as
+	  a non-root user.
+
+config GRKERNSEC_PROC_GID
+	int "GID for special group"
+	depends on GRKERNSEC_PROC_USERGROUP
+	default 1001
+
+config GRKERNSEC_PROC_ADD
+	bool "Additional restrictions"
+	depends on GRKERNSEC_PROC_USER || GRKERNSEC_PROC_USERGROUP
+	help
+	  If you say Y here, additional restrictions will be placed on
+	  /proc that keep normal users from viewing device information and 
+	  slabinfo information that could be useful for exploits.
+
+config GRKERNSEC_LINK
+	bool "Linking restrictions"
+	help
+	  If you say Y here, /tmp race exploits will be prevented, since users
+	  will no longer be able to follow symlinks owned by other users in
+	  world-writable +t directories (e.g. /tmp), unless the owner of the
+	  symlink is the owner of the directory. users will also not be
+	  able to hardlink to files they do not own.  If the sysctl option is
+	  enabled, a sysctl option with name "linking_restrictions" is created.
+
+config GRKERNSEC_FIFO
+	bool "FIFO restrictions"
+	help
+	  If you say Y here, users will not be able to write to FIFOs they don't
+	  own in world-writable +t directories (e.g. /tmp), unless the owner of
+	  the FIFO is the same owner of the directory it's held in.  If the sysctl
+	  option is enabled, a sysctl option with name "fifo_restrictions" is
+	  created.
+
+config GRKERNSEC_SYSFS_RESTRICT
+	bool "Sysfs/debugfs restriction"
+	depends on SYSFS
+	help
+	  If you say Y here, sysfs (the pseudo-filesystem mounted at /sys) and
+	  any filesystem normally mounted under it (e.g. debugfs) will only
+	  be accessible by root.  These filesystems generally provide access
+	  to hardware and debug information that isn't appropriate for unprivileged
+	  users of the system.  Sysfs and debugfs have also become a large source
+	  of new vulnerabilities, ranging from infoleaks to local compromise.
+	  There has been very little oversight with an eye toward security involved
+	  in adding new exporters of information to these filesystems, so their
+	  use is discouraged.
+	  This option is equivalent to a chmod 0700 of the mount paths.
+
+config GRKERNSEC_ROFS
+	bool "Runtime read-only mount protection"
+	help
+	  If you say Y here, a sysctl option with name "romount_protect" will
+	  be created.  By setting this option to 1 at runtime, filesystems
+	  will be protected in the following ways:
+	  * No new writable mounts will be allowed
+	  * Existing read-only mounts won't be able to be remounted read/write
+	  * Write operations will be denied on all block devices
+	  This option acts independently of grsec_lock: once it is set to 1,
+	  it cannot be turned off.  Therefore, please be mindful of the resulting
+	  behavior if this option is enabled in an init script on a read-only
+	  filesystem.  This feature is mainly intended for secure embedded systems.
+
+config GRKERNSEC_CHROOT
+	bool "Chroot jail restrictions"
+	help
+	  If you say Y here, you will be able to choose several options that will
+	  make breaking out of a chrooted jail much more difficult.  If you
+	  encounter no software incompatibilities with the following options, it
+	  is recommended that you enable each one.
+
+config GRKERNSEC_CHROOT_MOUNT
+	bool "Deny mounts"
+	depends on GRKERNSEC_CHROOT && !VSERVER
+	help
+	  If you say Y here, processes inside a chroot will not be able to
+	  mount or remount filesystems.  If the sysctl option is enabled, a
+	  sysctl option with name "chroot_deny_mount" is created.
+
+config GRKERNSEC_CHROOT_DOUBLE
+	bool "Deny double-chroots"
+	depends on GRKERNSEC_CHROOT && !VSERVER
+	help
+	  If you say Y here, processes inside a chroot will not be able to chroot
+	  again outside the chroot.  This is a widely used method of breaking
+	  out of a chroot jail and should not be allowed.  If the sysctl 
+	  option is enabled, a sysctl option with name 
+	  "chroot_deny_chroot" is created.
+
+config GRKERNSEC_CHROOT_PIVOT
+	bool "Deny pivot_root in chroot"
+	depends on GRKERNSEC_CHROOT
+	help
+	  If you say Y here, processes inside a chroot will not be able to use
+	  a function called pivot_root() that was introduced in Linux 2.3.41.  It
+	  works similar to chroot in that it changes the root filesystem.  This
+	  function could be misused in a chrooted process to attempt to break out
+	  of the chroot, and therefore should not be allowed.  If the sysctl
+	  option is enabled, a sysctl option with name "chroot_deny_pivot" is
+	  created.
+
+config GRKERNSEC_CHROOT_CHDIR
+	bool "Enforce chdir(\"/\") on all chroots"
+	depends on GRKERNSEC_CHROOT
+	help
+	  If you say Y here, the current working directory of all newly-chrooted
+	  applications will be set to the the root directory of the chroot.
+	  The man page on chroot(2) states:
+	  Note that this call does not change  the  current  working
+	  directory,  so  that `.' can be outside the tree rooted at
+	  `/'.  In particular, the  super-user  can  escape  from  a
+	  `chroot jail' by doing `mkdir foo; chroot foo; cd ..'.
+
+	  It is recommended that you say Y here, since it's not known to break
+	  any software.  If the sysctl option is enabled, a sysctl option with
+	  name "chroot_enforce_chdir" is created.
+
+config GRKERNSEC_CHROOT_CHMOD
+	bool "Deny (f)chmod +s"
+	depends on GRKERNSEC_CHROOT && !VSERVER
+	help
+	  If you say Y here, processes inside a chroot will not be able to chmod
+	  or fchmod files to make them have suid or sgid bits.  This protects
+	  against another published method of breaking a chroot.  If the sysctl
+	  option is enabled, a sysctl option with name "chroot_deny_chmod" is
+	  created.
+
+config GRKERNSEC_CHROOT_FCHDIR
+	bool "Deny fchdir out of chroot"
+	depends on GRKERNSEC_CHROOT
+	help
+	  If you say Y here, a well-known method of breaking chroots by fchdir'ing
+	  to a file descriptor of the chrooting process that points to a directory
+	  outside the filesystem will be stopped.  If the sysctl option
+	  is enabled, a sysctl option with name "chroot_deny_fchdir" is created.
+
+config GRKERNSEC_CHROOT_MKNOD
+	bool "Deny mknod"
+	depends on GRKERNSEC_CHROOT
+	help
+	  If you say Y here, processes inside a chroot will not be allowed to
+	  mknod.  The problem with using mknod inside a chroot is that it
+	  would allow an attacker to create a device entry that is the same
+	  as one on the physical root of your system, which could range from
+	  anything from the console device to a device for your harddrive (which
+	  they could then use to wipe the drive or steal data).  It is recommended
+	  that you say Y here, unless you run into software incompatibilities.
+	  If the sysctl option is enabled, a sysctl option with name
+	  "chroot_deny_mknod" is created.
+
+config GRKERNSEC_CHROOT_SHMAT
+	bool "Deny shmat() out of chroot"
+	depends on GRKERNSEC_CHROOT
+	help
+	  If you say Y here, processes inside a chroot will not be able to attach
+	  to shared memory segments that were created outside of the chroot jail.
+	  It is recommended that you say Y here.  If the sysctl option is enabled,
+	  a sysctl option with name "chroot_deny_shmat" is created.
+
+config GRKERNSEC_CHROOT_UNIX
+	bool "Deny access to abstract AF_UNIX sockets out of chroot"
+	depends on GRKERNSEC_CHROOT
+	help
+	  If you say Y here, processes inside a chroot will not be able to
+	  connect to abstract (meaning not belonging to a filesystem) Unix
+	  domain sockets that were bound outside of a chroot.  It is recommended
+	  that you say Y here.  If the sysctl option is enabled, a sysctl option
+	  with name "chroot_deny_unix" is created.
+
+config GRKERNSEC_CHROOT_FINDTASK
+	bool "Protect outside processes"
+	depends on GRKERNSEC_CHROOT && !VSERVER
+	help
+	  If you say Y here, processes inside a chroot will not be able to
+	  kill, send signals with fcntl, ptrace, capget, getpgid, setpgid, 
+	  getsid, or view any process outside of the chroot.  If the sysctl
+	  option is enabled, a sysctl option with name "chroot_findtask" is
+	  created.
+
+config GRKERNSEC_CHROOT_NICE
+	bool "Restrict priority changes"
+	depends on GRKERNSEC_CHROOT
+	help
+	  If you say Y here, processes inside a chroot will not be able to raise
+	  the priority of processes in the chroot, or alter the priority of
+	  processes outside the chroot.  This provides more security than simply
+	  removing CAP_SYS_NICE from the process' capability set.  If the
+	  sysctl option is enabled, a sysctl option with name "chroot_restrict_nice"
+	  is created.
+
+config GRKERNSEC_CHROOT_SYSCTL
+	bool "Deny sysctl writes"
+	depends on GRKERNSEC_CHROOT
+	help
+	  If you say Y here, an attacker in a chroot will not be able to
+	  write to sysctl entries, either by sysctl(2) or through a /proc
+	  interface.  It is strongly recommended that you say Y here. If the
+	  sysctl option is enabled, a sysctl option with name
+	  "chroot_deny_sysctl" is created.
+
+config GRKERNSEC_CHROOT_CAPS
+	bool "Capability restrictions"
+	depends on GRKERNSEC_CHROOT && !VSERVER
+	help
+	  If you say Y here, the capabilities on all root processes within a
+	  chroot jail will be lowered to stop module insertion, raw i/o,
+	  system and net admin tasks, rebooting the system, modifying immutable
+	  files, modifying IPC owned by another, and changing the system time.
+	  This is left an option because it can break some apps.  Disable this
+	  if your chrooted apps are having problems performing those kinds of
+	  tasks.  If the sysctl option is enabled, a sysctl option with
+	  name "chroot_caps" is created.
+
+endmenu
+menu "Kernel Auditing"
+depends on GRKERNSEC
+
+config GRKERNSEC_AUDIT_GROUP
+	bool "Single group for auditing"
+	help
+	  If you say Y here, the exec, chdir, and (un)mount logging features
+	  will only operate on a group you specify.  This option is recommended
+	  if you only want to watch certain users instead of having a large
+	  amount of logs from the entire system.  If the sysctl option is enabled,
+	  a sysctl option with name "audit_group" is created.
+
+config GRKERNSEC_AUDIT_GID
+	int "GID for auditing"
+	depends on GRKERNSEC_AUDIT_GROUP
+	default 1007
+
+config GRKERNSEC_EXECLOG
+	bool "Exec logging"
+	help
+	  If you say Y here, all execve() calls will be logged (since the
+	  other exec*() calls are frontends to execve(), all execution
+	  will be logged).  Useful for shell-servers that like to keep track
+	  of their users.  If the sysctl option is enabled, a sysctl option with
+	  name "exec_logging" is created.
+	  WARNING: This option when enabled will produce a LOT of logs, especially
+	  on an active system.
+
+config GRKERNSEC_RESLOG
+	bool "Resource logging"
+	help
+	  If you say Y here, all attempts to overstep resource limits will
+	  be logged with the resource name, the requested size, and the current
+	  limit.  It is highly recommended that you say Y here.  If the sysctl
+	  option is enabled, a sysctl option with name "resource_logging" is
+	  created.  If the RBAC system is enabled, the sysctl value is ignored.
+
+config GRKERNSEC_CHROOT_EXECLOG
+	bool "Log execs within chroot"
+	help
+	  If you say Y here, all executions inside a chroot jail will be logged
+	  to syslog.  This can cause a large amount of logs if certain
+	  applications (eg. djb's daemontools) are installed on the system, and
+	  is therefore left as an option.  If the sysctl option is enabled, a
+	  sysctl option with name "chroot_execlog" is created.
+
+config GRKERNSEC_AUDIT_PTRACE
+	bool "Ptrace logging"
+	help
+	  If you say Y here, all attempts to attach to a process via ptrace
+	  will be logged.  If the sysctl option is enabled, a sysctl option
+	  with name "audit_ptrace" is created.
+
+config GRKERNSEC_AUDIT_CHDIR
+	bool "Chdir logging"
+	help
+	  If you say Y here, all chdir() calls will be logged.  If the sysctl
+ 	  option is enabled, a sysctl option with name "audit_chdir" is created.
+
+config GRKERNSEC_AUDIT_MOUNT
+	bool "(Un)Mount logging"
+	help
+	  If you say Y here, all mounts and unmounts will be logged.  If the
+	  sysctl option is enabled, a sysctl option with name "audit_mount" is
+	  created.
+
+config GRKERNSEC_SIGNAL
+	bool "Signal logging"
+	help
+	  If you say Y here, certain important signals will be logged, such as
+	  SIGSEGV, which will as a result inform you of when a error in a program
+	  occurred, which in some cases could mean a possible exploit attempt.
+	  If the sysctl option is enabled, a sysctl option with name
+	  "signal_logging" is created.
+
+config GRKERNSEC_FORKFAIL
+	bool "Fork failure logging"
+	help
+	  If you say Y here, all failed fork() attempts will be logged.
+	  This could suggest a fork bomb, or someone attempting to overstep
+	  their process limit.  If the sysctl option is enabled, a sysctl option
+	  with name "forkfail_logging" is created.
+
+config GRKERNSEC_TIME
+	bool "Time change logging"
+	help
+	  If you say Y here, any changes of the system clock will be logged.
+	  If the sysctl option is enabled, a sysctl option with name
+	  "timechange_logging" is created.
+
+config GRKERNSEC_PROC_IPADDR
+	bool "/proc/<pid>/ipaddr support"
+	help
+	  If you say Y here, a new entry will be added to each /proc/<pid>
+	  directory that contains the IP address of the person using the task.
+	  The IP is carried across local TCP and AF_UNIX stream sockets.
+	  This information can be useful for IDS/IPSes to perform remote response
+	  to a local attack.  The entry is readable by only the owner of the
+	  process (and root if he has CAP_DAC_OVERRIDE, which can be removed via
+	  the RBAC system), and thus does not create privacy concerns.
+
+config GRKERNSEC_RWXMAP_LOG
+	bool 'Denied RWX mmap/mprotect logging'
+	depends on PAX_MPROTECT && !PAX_EMUPLT && !PAX_EMUSIGRT
+	help
+	  If you say Y here, calls to mmap() and mprotect() with explicit
+	  usage of PROT_WRITE and PROT_EXEC together will be logged when
+	  denied by the PAX_MPROTECT feature.  If the sysctl option is
+	  enabled, a sysctl option with name "rwxmap_logging" is created.
+
+config GRKERNSEC_AUDIT_TEXTREL
+	bool 'ELF text relocations logging (READ HELP)'
+	depends on PAX_MPROTECT
+	help
+	  If you say Y here, text relocations will be logged with the filename
+	  of the offending library or binary.  The purpose of the feature is
+	  to help Linux distribution developers get rid of libraries and
+	  binaries that need text relocations which hinder the future progress
+	  of PaX.  Only Linux distribution developers should say Y here, and
+	  never on a production machine, as this option creates an information
+	  leak that could aid an attacker in defeating the randomization of
+	  a single memory region.  If the sysctl option is enabled, a sysctl
+	  option with name "audit_textrel" is created.
+
+endmenu
+
+menu "Executable Protections"
+depends on GRKERNSEC
+
+config GRKERNSEC_EXECVE
+	bool "Enforce RLIMIT_NPROC on execs"
+	help
+	  If you say Y here, users with a resource limit on processes will
+	  have the value checked during execve() calls.  The current system
+	  only checks the system limit during fork() calls.  If the sysctl option
+	  is enabled, a sysctl option with name "execve_limiting" is created.
+
+config GRKERNSEC_DMESG
+	bool "Dmesg(8) restriction"
+	help
+	  If you say Y here, non-root users will not be able to use dmesg(8)
+	  to view up to the last 4kb of messages in the kernel's log buffer.
+	  The kernel's log buffer often contains kernel addresses and other
+	  identifying information useful to an attacker in fingerprinting a
+	  system for a targeted exploit.
+	  If the sysctl option is enabled, a sysctl option with name "dmesg" is
+	  created.
+
+config GRKERNSEC_HARDEN_PTRACE
+	bool "Deter ptrace-based process snooping"
+	help
+	  If you say Y here, TTY sniffers and other malicious monitoring
+	  programs implemented through ptrace will be defeated.  If you
+	  have been using the RBAC system, this option has already been
+	  enabled for several years for all users, with the ability to make
+	  fine-grained exceptions.
+
+	  This option only affects the ability of non-root users to ptrace
+	  processes that are not a descendent of the ptracing process.
+	  This means that strace ./binary and gdb ./binary will still work,
+	  but attaching to arbitrary processes will not.  If the sysctl
+	  option is enabled, a sysctl option with name "harden_ptrace" is
+	  created.
+
+config GRKERNSEC_TPE
+	bool "Trusted Path Execution (TPE)"
+	help
+	  If you say Y here, you will be able to choose a gid to add to the
+	  supplementary groups of users you want to mark as "untrusted."
+	  These users will not be able to execute any files that are not in
+	  root-owned directories writable only by root.  If the sysctl option
+	  is enabled, a sysctl option with name "tpe" is created.
+
+config GRKERNSEC_TPE_ALL
+	bool "Partially restrict all non-root users"
+	depends on GRKERNSEC_TPE
+	help
+	  If you say Y here, all non-root users will be covered under
+	  a weaker TPE restriction.  This is separate from, and in addition to,
+	  the main TPE options that you have selected elsewhere.  Thus, if a
+	  "trusted" GID is chosen, this restriction applies to even that GID.
+	  Under this restriction, all non-root users will only be allowed to
+	  execute files in directories they own that are not group or
+	  world-writable, or in directories owned by root and writable only by
+	  root.  If the sysctl option is enabled, a sysctl option with name
+	  "tpe_restrict_all" is created.
+
+config GRKERNSEC_TPE_INVERT
+	bool "Invert GID option"
+	depends on GRKERNSEC_TPE
+	help
+	  If you say Y here, the group you specify in the TPE configuration will
+	  decide what group TPE restrictions will be *disabled* for.  This
+	  option is useful if you want TPE restrictions to be applied to most
+	  users on the system.  If the sysctl option is enabled, a sysctl option
+	  with name "tpe_invert" is created.  Unlike other sysctl options, this
+	  entry will default to on for backward-compatibility.
+
+config GRKERNSEC_TPE_GID
+	int "GID for untrusted users"
+	depends on GRKERNSEC_TPE && !GRKERNSEC_TPE_INVERT
+	default 1005
+	help
+	  Setting this GID determines what group TPE restrictions will be
+	  *enabled* for.  If the sysctl option is enabled, a sysctl option
+	  with name "tpe_gid" is created.
+
+config GRKERNSEC_TPE_GID
+	int "GID for trusted users"
+	depends on GRKERNSEC_TPE && GRKERNSEC_TPE_INVERT
+	default 1005
+	help
+	  Setting this GID determines what group TPE restrictions will be
+	  *disabled* for.  If the sysctl option is enabled, a sysctl option
+	  with name "tpe_gid" is created.
+
+endmenu
+menu "Network Protections"
+depends on GRKERNSEC
+
+config GRKERNSEC_RANDNET
+	bool "Larger entropy pools"
+	help
+	  If you say Y here, the entropy pools used for many features of Linux
+	  and grsecurity will be doubled in size.  Since several grsecurity
+	  features use additional randomness, it is recommended that you say Y
+	  here.  Saying Y here has a similar effect as modifying
+	  /proc/sys/kernel/random/poolsize.
+
+config GRKERNSEC_BLACKHOLE
+	bool "TCP/UDP blackhole and LAST_ACK DoS prevention"
+	help
+	  If you say Y here, neither TCP resets nor ICMP
+	  destination-unreachable packets will be sent in response to packets
+	  sent to ports for which no associated listening process exists.
+	  This feature supports both IPV4 and IPV6 and exempts the 
+	  loopback interface from blackholing.  Enabling this feature 
+	  makes a host more resilient to DoS attacks and reduces network
+	  visibility against scanners.
+
+	  The blackhole feature as-implemented is equivalent to the FreeBSD
+	  blackhole feature, as it prevents RST responses to all packets, not
+	  just SYNs.  Under most application behavior this causes no
+	  problems, but applications (like haproxy) may not close certain
+	  connections in a way that cleanly terminates them on the remote
+	  end, leaving the remote host in LAST_ACK state.  Because of this
+	  side-effect and to prevent intentional LAST_ACK DoSes, this
+	  feature also adds automatic mitigation against such attacks.
+	  The mitigation drastically reduces the amount of time a socket
+	  can spend in LAST_ACK state.  If you're using haproxy and not
+	  all servers it connects to have this option enabled, consider
+	  disabling this feature on the haproxy host.
+
+	  If the sysctl option is enabled, two sysctl options with names
+	  "ip_blackhole" and "lastack_retries" will be created.
+	  While "ip_blackhole" takes the standard zero/non-zero on/off
+	  toggle, "lastack_retries" uses the same kinds of values as
+	  "tcp_retries1" and "tcp_retries2".  The default value of 4
+	  prevents a socket from lasting more than 45 seconds in LAST_ACK
+	  state.
+
+config GRKERNSEC_SOCKET
+	bool "Socket restrictions"
+	help
+	  If you say Y here, you will be able to choose from several options.
+	  If you assign a GID on your system and add it to the supplementary
+	  groups of users you want to restrict socket access to, this patch
+	  will perform up to three things, based on the option(s) you choose.
+
+config GRKERNSEC_SOCKET_ALL
+	bool "Deny any sockets to group"
+	depends on GRKERNSEC_SOCKET
+	help
+	  If you say Y here, you will be able to choose a GID of whose users will
+	  be unable to connect to other hosts from your machine or run server
+	  applications from your machine.  If the sysctl option is enabled, a
+	  sysctl option with name "socket_all" is created.
+
+config GRKERNSEC_SOCKET_ALL_GID
+	int "GID to deny all sockets for"
+	depends on GRKERNSEC_SOCKET_ALL
+	default 1004
+	help
+	  Here you can choose the GID to disable socket access for. Remember to
+	  add the users you want socket access disabled for to the GID
+	  specified here.  If the sysctl option is enabled, a sysctl option
+	  with name "socket_all_gid" is created.
+
+config GRKERNSEC_SOCKET_CLIENT
+	bool "Deny client sockets to group"
+	depends on GRKERNSEC_SOCKET
+	help
+	  If you say Y here, you will be able to choose a GID of whose users will
+	  be unable to connect to other hosts from your machine, but will be
+	  able to run servers.  If this option is enabled, all users in the group
+	  you specify will have to use passive mode when initiating ftp transfers
+	  from the shell on your machine.  If the sysctl option is enabled, a
+	  sysctl option with name "socket_client" is created.
+
+config GRKERNSEC_SOCKET_CLIENT_GID
+	int "GID to deny client sockets for"
+	depends on GRKERNSEC_SOCKET_CLIENT
+	default 1003
+	help
+	  Here you can choose the GID to disable client socket access for.
+	  Remember to add the users you want client socket access disabled for to
+	  the GID specified here.  If the sysctl option is enabled, a sysctl
+	  option with name "socket_client_gid" is created.
+
+config GRKERNSEC_SOCKET_SERVER
+	bool "Deny server sockets to group"
+	depends on GRKERNSEC_SOCKET
+	help
+	  If you say Y here, you will be able to choose a GID of whose users will
+	  be unable to run server applications from your machine.  If the sysctl
+	  option is enabled, a sysctl option with name "socket_server" is created.
+
+config GRKERNSEC_SOCKET_SERVER_GID
+	int "GID to deny server sockets for"
+	depends on GRKERNSEC_SOCKET_SERVER
+	default 1002
+	help
+	  Here you can choose the GID to disable server socket access for.
+	  Remember to add the users you want server socket access disabled for to
+	  the GID specified here.  If the sysctl option is enabled, a sysctl
+	  option with name "socket_server_gid" is created.
+
+endmenu
+menu "Sysctl support"
+depends on GRKERNSEC && SYSCTL
+
+config GRKERNSEC_SYSCTL
+	bool "Sysctl support"
+	help
+	  If you say Y here, you will be able to change the options that
+	  grsecurity runs with at bootup, without having to recompile your
+	  kernel.  You can echo values to files in /proc/sys/kernel/grsecurity
+	  to enable (1) or disable (0) various features.  All the sysctl entries
+	  are mutable until the "grsec_lock" entry is set to a non-zero value.
+	  All features enabled in the kernel configuration are disabled at boot
+	  if you do not say Y to the "Turn on features by default" option.
+	  All options should be set at startup, and the grsec_lock entry should
+	  be set to a non-zero value after all the options are set.
+	  *THIS IS EXTREMELY IMPORTANT*
+
+config GRKERNSEC_SYSCTL_DISTRO
+	bool "Extra sysctl support for distro makers (READ HELP)"
+	depends on GRKERNSEC_SYSCTL && GRKERNSEC_IO
+	help
+	  If you say Y here, additional sysctl options will be created
+	  for features that affect processes running as root.  Therefore,
+	  it is critical when using this option that the grsec_lock entry be
+	  enabled after boot.  Only distros with prebuilt kernel packages
+	  with this option enabled that can ensure grsec_lock is enabled
+	  after boot should use this option.
+	  *Failure to set grsec_lock after boot makes all grsec features
+	  this option covers useless*
+
+	  Currently this option creates the following sysctl entries:
+	  "Disable Privileged I/O": "disable_priv_io"	
+
+config GRKERNSEC_SYSCTL_ON
+	bool "Turn on features by default"
+	depends on GRKERNSEC_SYSCTL
+	help
+	  If you say Y here, instead of having all features enabled in the
+	  kernel configuration disabled at boot time, the features will be
+	  enabled at boot time.  It is recommended you say Y here unless
+	  there is some reason you would want all sysctl-tunable features to
+	  be disabled by default.  As mentioned elsewhere, it is important
+	  to enable the grsec_lock entry once you have finished modifying
+	  the sysctl entries.
+
+endmenu
+menu "Logging Options"
+depends on GRKERNSEC
+
+config GRKERNSEC_FLOODTIME
+	int "Seconds in between log messages (minimum)"
+	default 10
+	help
+	  This option allows you to enforce the number of seconds between
+	  grsecurity log messages.  The default should be suitable for most
+	  people, however, if you choose to change it, choose a value small enough
+	  to allow informative logs to be produced, but large enough to
+	  prevent flooding.
+
+config GRKERNSEC_FLOODBURST
+	int "Number of messages in a burst (maximum)"
+	default 4
+	help
+	  This option allows you to choose the maximum number of messages allowed
+	  within the flood time interval you chose in a separate option.  The
+	  default should be suitable for most people, however if you find that
+	  many of your logs are being interpreted as flooding, you may want to
+	  raise this value.
+
+endmenu
+
+endmenu
diff -uriN linux-2.6.32.43/grsecurity/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/Makefile
--- linux-2.6.32.43/grsecurity/Makefile	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/grsecurity/Makefile	2011-07-15 05:51:18.000000000 -0500
@@ -0,0 +1,33 @@
+# grsecurity's ACL system was originally written in 2001 by Michael Dalton
+# during 2001-2009 it has been completely redesigned by Brad Spengler
+# into an RBAC system
+#
+# All code in this directory and various hooks inserted throughout the kernel
+# are copyright Brad Spengler - Open Source Security, Inc., and released 
+# under the GPL v2 or higher
+
+obj-y = grsec_chdir.o grsec_chroot.o grsec_exec.o grsec_fifo.o grsec_fork.o \
+	grsec_mount.o grsec_sig.o grsec_sock.o grsec_sysctl.o \
+	grsec_time.o grsec_tpe.o grsec_link.o grsec_pax.o grsec_ptrace.o
+
+obj-$(CONFIG_GRKERNSEC) += grsec_init.o grsum.o gracl.o gracl_segv.o \
+	gracl_cap.o gracl_alloc.o gracl_shm.o grsec_mem.o gracl_fs.o \
+	gracl_learn.o grsec_log.o
+obj-$(CONFIG_GRKERNSEC_RESLOG) += gracl_res.o
+
+ifdef CONFIG_NET
+obj-$(CONFIG_GRKERNSEC) += gracl_ip.o
+endif
+
+ifndef CONFIG_GRKERNSEC
+obj-y += grsec_disabled.o
+endif
+
+ifdef CONFIG_GRKERNSEC_HIDESYM
+extra-y := grsec_hidesym.o
+$(obj)/grsec_hidesym.o:
+	@-chmod -f 500 /boot
+	@-chmod -f 500 /lib/modules
+	@-chmod -f 700 .
+	@echo '  grsec: protected kernel image paths'
+endif
diff -uriN linux-2.6.32.43/include/acpi/acpi_drivers.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/acpi/acpi_drivers.h
--- linux-2.6.32.43/include/acpi/acpi_drivers.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/acpi/acpi_drivers.h	2011-07-15 05:51:18.000000000 -0500
@@ -119,8 +119,8 @@
                                   Dock Station
   -------------------------------------------------------------------------- */
 struct acpi_dock_ops {
-	acpi_notify_handler handler;
-	acpi_notify_handler uevent;
+	const acpi_notify_handler handler;
+	const acpi_notify_handler uevent;
 };
 
 #if defined(CONFIG_ACPI_DOCK) || defined(CONFIG_ACPI_DOCK_MODULE)
@@ -128,7 +128,7 @@
 extern int register_dock_notifier(struct notifier_block *nb);
 extern void unregister_dock_notifier(struct notifier_block *nb);
 extern int register_hotplug_dock_device(acpi_handle handle,
-					struct acpi_dock_ops *ops,
+					const struct acpi_dock_ops *ops,
 					void *context);
 extern void unregister_hotplug_dock_device(acpi_handle handle);
 #else
@@ -144,7 +144,7 @@
 {
 }
 static inline int register_hotplug_dock_device(acpi_handle handle,
-					       struct acpi_dock_ops *ops,
+					       const struct acpi_dock_ops *ops,
 					       void *context)
 {
 	return -ENODEV;
diff -uriN linux-2.6.32.43/include/asm-generic/atomic-long.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/atomic-long.h
--- linux-2.6.32.43/include/asm-generic/atomic-long.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/atomic-long.h	2011-07-15 05:51:18.000000000 -0500
@@ -22,6 +22,12 @@
 
 typedef atomic64_t atomic_long_t;
 
+#ifdef CONFIG_PAX_REFCOUNT
+typedef atomic64_unchecked_t atomic_long_unchecked_t;
+#else
+typedef atomic64_t atomic_long_unchecked_t;
+#endif
+
 #define ATOMIC_LONG_INIT(i)	ATOMIC64_INIT(i)
 
 static inline long atomic_long_read(atomic_long_t *l)
@@ -31,6 +37,15 @@
 	return (long)atomic64_read(v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
+{
+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
+
+	return (long)atomic64_read_unchecked(v);
+}
+#endif
+
 static inline void atomic_long_set(atomic_long_t *l, long i)
 {
 	atomic64_t *v = (atomic64_t *)l;
@@ -38,6 +53,15 @@
 	atomic64_set(v, i);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
+{
+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
+
+	atomic64_set_unchecked(v, i);
+}
+#endif
+
 static inline void atomic_long_inc(atomic_long_t *l)
 {
 	atomic64_t *v = (atomic64_t *)l;
@@ -45,6 +69,15 @@
 	atomic64_inc(v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
+{
+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
+
+	atomic64_inc_unchecked(v);
+}
+#endif
+
 static inline void atomic_long_dec(atomic_long_t *l)
 {
 	atomic64_t *v = (atomic64_t *)l;
@@ -52,6 +85,15 @@
 	atomic64_dec(v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
+{
+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
+
+	atomic64_dec_unchecked(v);
+}
+#endif
+
 static inline void atomic_long_add(long i, atomic_long_t *l)
 {
 	atomic64_t *v = (atomic64_t *)l;
@@ -59,6 +101,15 @@
 	atomic64_add(i, v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
+{
+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
+
+	atomic64_add_unchecked(i, v);
+}
+#endif
+
 static inline void atomic_long_sub(long i, atomic_long_t *l)
 {
 	atomic64_t *v = (atomic64_t *)l;
@@ -115,6 +166,15 @@
 	return (long)atomic64_inc_return(v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
+{
+	atomic64_unchecked_t *v = (atomic64_unchecked_t *)l;
+
+	return (long)atomic64_inc_return_unchecked(v);
+}
+#endif
+
 static inline long atomic_long_dec_return(atomic_long_t *l)
 {
 	atomic64_t *v = (atomic64_t *)l;
@@ -140,6 +200,12 @@
 
 typedef atomic_t atomic_long_t;
 
+#ifdef CONFIG_PAX_REFCOUNT
+typedef atomic_unchecked_t atomic_long_unchecked_t;
+#else
+typedef atomic_t atomic_long_unchecked_t;
+#endif
+
 #define ATOMIC_LONG_INIT(i)	ATOMIC_INIT(i)
 static inline long atomic_long_read(atomic_long_t *l)
 {
@@ -148,6 +214,15 @@
 	return (long)atomic_read(v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline long atomic_long_read_unchecked(atomic_long_unchecked_t *l)
+{
+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
+
+	return (long)atomic_read_unchecked(v);
+}
+#endif
+
 static inline void atomic_long_set(atomic_long_t *l, long i)
 {
 	atomic_t *v = (atomic_t *)l;
@@ -155,6 +230,15 @@
 	atomic_set(v, i);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void atomic_long_set_unchecked(atomic_long_unchecked_t *l, long i)
+{
+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
+
+	atomic_set_unchecked(v, i);
+}
+#endif
+
 static inline void atomic_long_inc(atomic_long_t *l)
 {
 	atomic_t *v = (atomic_t *)l;
@@ -162,6 +246,15 @@
 	atomic_inc(v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void atomic_long_inc_unchecked(atomic_long_unchecked_t *l)
+{
+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
+
+	atomic_inc_unchecked(v);
+}
+#endif
+
 static inline void atomic_long_dec(atomic_long_t *l)
 {
 	atomic_t *v = (atomic_t *)l;
@@ -169,6 +262,15 @@
 	atomic_dec(v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void atomic_long_dec_unchecked(atomic_long_unchecked_t *l)
+{
+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
+
+	atomic_dec_unchecked(v);
+}
+#endif
+
 static inline void atomic_long_add(long i, atomic_long_t *l)
 {
 	atomic_t *v = (atomic_t *)l;
@@ -176,6 +278,15 @@
 	atomic_add(i, v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void atomic_long_add_unchecked(long i, atomic_long_unchecked_t *l)
+{
+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
+
+	atomic_add_unchecked(i, v);
+}
+#endif
+
 static inline void atomic_long_sub(long i, atomic_long_t *l)
 {
 	atomic_t *v = (atomic_t *)l;
@@ -232,6 +343,15 @@
 	return (long)atomic_inc_return(v);
 }
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline long atomic_long_inc_return_unchecked(atomic_long_unchecked_t *l)
+{
+	atomic_unchecked_t *v = (atomic_unchecked_t *)l;
+
+	return (long)atomic_inc_return_unchecked(v);
+}
+#endif
+
 static inline long atomic_long_dec_return(atomic_long_t *l)
 {
 	atomic_t *v = (atomic_t *)l;
@@ -255,4 +375,47 @@
 
 #endif  /*  BITS_PER_LONG == 64  */
 
+#ifdef CONFIG_PAX_REFCOUNT
+static inline void pax_refcount_needs_these_functions(void)
+{
+	atomic_read_unchecked((atomic_unchecked_t *)NULL);
+	atomic_set_unchecked((atomic_unchecked_t *)NULL, 0);
+	atomic_add_unchecked(0, (atomic_unchecked_t *)NULL);
+	atomic_sub_unchecked(0, (atomic_unchecked_t *)NULL);
+	atomic_inc_unchecked((atomic_unchecked_t *)NULL);
+	(void)atomic_inc_and_test_unchecked((atomic_unchecked_t *)NULL);
+	atomic_inc_return_unchecked((atomic_unchecked_t *)NULL);
+	atomic_add_return_unchecked(0, (atomic_unchecked_t *)NULL);
+	atomic_dec_unchecked((atomic_unchecked_t *)NULL);
+	atomic_cmpxchg_unchecked((atomic_unchecked_t *)NULL, 0, 0);
+	(void)atomic_xchg_unchecked((atomic_unchecked_t *)NULL, 0);
+
+	atomic_long_read_unchecked((atomic_long_unchecked_t *)NULL);
+	atomic_long_set_unchecked((atomic_long_unchecked_t *)NULL, 0);
+	atomic_long_add_unchecked(0, (atomic_long_unchecked_t *)NULL);
+	atomic_long_inc_unchecked((atomic_long_unchecked_t *)NULL);
+	atomic_long_inc_return_unchecked((atomic_long_unchecked_t *)NULL);
+	atomic_long_dec_unchecked((atomic_long_unchecked_t *)NULL);
+}
+#else
+#define atomic_read_unchecked(v) atomic_read(v)
+#define atomic_set_unchecked(v, i) atomic_set((v), (i))
+#define atomic_add_unchecked(i, v) atomic_add((i), (v))
+#define atomic_sub_unchecked(i, v) atomic_sub((i), (v))
+#define atomic_inc_unchecked(v) atomic_inc(v)
+#define atomic_inc_and_test_unchecked(v) atomic_inc_and_test(v)
+#define atomic_inc_return_unchecked(v) atomic_inc_return(v)
+#define atomic_add_return_unchecked(i, v) atomic_add_return((i), (v))
+#define atomic_dec_unchecked(v) atomic_dec(v)
+#define atomic_cmpxchg_unchecked(v, o, n) atomic_cmpxchg((v), (o), (n))
+#define atomic_xchg_unchecked(v, i) atomic_xchg((v), (i))
+
+#define atomic_long_read_unchecked(v) atomic_long_read(v)
+#define atomic_long_set_unchecked(v, i) atomic_long_set((v), (i))
+#define atomic_long_add_unchecked(i, v) atomic_long_add((i), (v))
+#define atomic_long_inc_unchecked(v) atomic_long_inc(v)
+#define atomic_long_inc_return_unchecked(v) atomic_long_inc_return(v)
+#define atomic_long_dec_unchecked(v) atomic_long_dec(v)
+#endif
+
 #endif  /*  _ASM_GENERIC_ATOMIC_LONG_H  */
diff -uriN linux-2.6.32.43/include/asm-generic/cache.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/cache.h
--- linux-2.6.32.43/include/asm-generic/cache.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/cache.h	2011-07-15 05:51:18.000000000 -0500
@@ -6,7 +6,7 @@
  * cache lines need to provide their own cache.h.
  */
 
-#define L1_CACHE_SHIFT		5
-#define L1_CACHE_BYTES		(1 << L1_CACHE_SHIFT)
+#define L1_CACHE_SHIFT		5UL
+#define L1_CACHE_BYTES		(1UL << L1_CACHE_SHIFT)
 
 #endif /* __ASM_GENERIC_CACHE_H */
diff -uriN linux-2.6.32.43/include/asm-generic/dma-mapping-common.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/dma-mapping-common.h
--- linux-2.6.32.43/include/asm-generic/dma-mapping-common.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/dma-mapping-common.h	2011-07-15 05:51:18.000000000 -0500
@@ -11,7 +11,7 @@
 					      enum dma_data_direction dir,
 					      struct dma_attrs *attrs)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 	dma_addr_t addr;
 
 	kmemcheck_mark_initialized(ptr, size);
@@ -30,7 +30,7 @@
 					  enum dma_data_direction dir,
 					  struct dma_attrs *attrs)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	if (ops->unmap_page)
@@ -42,7 +42,7 @@
 				   int nents, enum dma_data_direction dir,
 				   struct dma_attrs *attrs)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 	int i, ents;
 	struct scatterlist *s;
 
@@ -59,7 +59,7 @@
 				      int nents, enum dma_data_direction dir,
 				      struct dma_attrs *attrs)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	debug_dma_unmap_sg(dev, sg, nents, dir);
@@ -71,7 +71,7 @@
 				      size_t offset, size_t size,
 				      enum dma_data_direction dir)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 	dma_addr_t addr;
 
 	kmemcheck_mark_initialized(page_address(page) + offset, size);
@@ -85,7 +85,7 @@
 static inline void dma_unmap_page(struct device *dev, dma_addr_t addr,
 				  size_t size, enum dma_data_direction dir)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	if (ops->unmap_page)
@@ -97,7 +97,7 @@
 					   size_t size,
 					   enum dma_data_direction dir)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	if (ops->sync_single_for_cpu)
@@ -109,7 +109,7 @@
 					      dma_addr_t addr, size_t size,
 					      enum dma_data_direction dir)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	if (ops->sync_single_for_device)
@@ -123,7 +123,7 @@
 						 size_t size,
 						 enum dma_data_direction dir)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	if (ops->sync_single_range_for_cpu) {
@@ -140,7 +140,7 @@
 						    size_t size,
 						    enum dma_data_direction dir)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	if (ops->sync_single_range_for_device) {
@@ -155,7 +155,7 @@
 dma_sync_sg_for_cpu(struct device *dev, struct scatterlist *sg,
 		    int nelems, enum dma_data_direction dir)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	if (ops->sync_sg_for_cpu)
@@ -167,7 +167,7 @@
 dma_sync_sg_for_device(struct device *dev, struct scatterlist *sg,
 		       int nelems, enum dma_data_direction dir)
 {
-	struct dma_map_ops *ops = get_dma_ops(dev);
+	const struct dma_map_ops *ops = get_dma_ops(dev);
 
 	BUG_ON(!valid_dma_direction(dir));
 	if (ops->sync_sg_for_device)
diff -uriN linux-2.6.32.43/include/asm-generic/futex.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/futex.h
--- linux-2.6.32.43/include/asm-generic/futex.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/futex.h	2011-07-15 05:51:18.000000000 -0500
@@ -6,7 +6,7 @@
 #include <asm/errno.h>
 
 static inline int
-futex_atomic_op_inuser (int encoded_op, int __user *uaddr)
+futex_atomic_op_inuser (int encoded_op, u32 __user *uaddr)
 {
 	int op = (encoded_op >> 28) & 7;
 	int cmp = (encoded_op >> 24) & 15;
@@ -48,7 +48,7 @@
 }
 
 static inline int
-futex_atomic_cmpxchg_inatomic(int __user *uaddr, int oldval, int newval)
+futex_atomic_cmpxchg_inatomic(u32 __user *uaddr, int oldval, int newval)
 {
 	return -ENOSYS;
 }
diff -uriN linux-2.6.32.43/include/asm-generic/int-l64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/int-l64.h
--- linux-2.6.32.43/include/asm-generic/int-l64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/int-l64.h	2011-07-15 05:51:18.000000000 -0500
@@ -46,6 +46,8 @@
 typedef signed long s64;
 typedef unsigned long u64;
 
+typedef unsigned int intoverflow_t __attribute__ ((mode(TI)));
+
 #define S8_C(x)  x
 #define U8_C(x)  x ## U
 #define S16_C(x) x
diff -uriN linux-2.6.32.43/include/asm-generic/int-ll64.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/int-ll64.h
--- linux-2.6.32.43/include/asm-generic/int-ll64.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/int-ll64.h	2011-07-15 05:51:19.000000000 -0500
@@ -51,6 +51,8 @@
 typedef signed long long s64;
 typedef unsigned long long u64;
 
+typedef unsigned long long intoverflow_t;
+
 #define S8_C(x)  x
 #define U8_C(x)  x ## U
 #define S16_C(x) x
diff -uriN linux-2.6.32.43/include/asm-generic/kmap_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/kmap_types.h
--- linux-2.6.32.43/include/asm-generic/kmap_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/kmap_types.h	2011-07-15 05:51:19.000000000 -0500
@@ -28,7 +28,8 @@
 KMAP_D(16)	KM_IRQ_PTE,
 KMAP_D(17)	KM_NMI,
 KMAP_D(18)	KM_NMI_PTE,
-KMAP_D(19)	KM_TYPE_NR
+KMAP_D(19)	KM_CLEARPAGE,
+KMAP_D(20)	KM_TYPE_NR
 };
 
 #undef KMAP_D
diff -uriN linux-2.6.32.43/include/asm-generic/pgtable.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/pgtable.h
--- linux-2.6.32.43/include/asm-generic/pgtable.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/pgtable.h	2011-07-15 05:51:19.000000000 -0500
@@ -344,6 +344,14 @@
 				unsigned long size);
 #endif
 
+#ifndef __HAVE_ARCH_PAX_OPEN_KERNEL
+static inline unsigned long pax_open_kernel(void) { return 0; }
+#endif
+
+#ifndef __HAVE_ARCH_PAX_CLOSE_KERNEL
+static inline unsigned long pax_close_kernel(void) { return 0; }
+#endif
+
 #endif /* !__ASSEMBLY__ */
 
 #endif /* _ASM_GENERIC_PGTABLE_H */
diff -uriN linux-2.6.32.43/include/asm-generic/pgtable-nopmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/pgtable-nopmd.h
--- linux-2.6.32.43/include/asm-generic/pgtable-nopmd.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/pgtable-nopmd.h	2011-07-15 05:51:19.000000000 -0500
@@ -1,14 +1,19 @@
 #ifndef _PGTABLE_NOPMD_H
 #define _PGTABLE_NOPMD_H
 
-#ifndef __ASSEMBLY__
-
 #include <asm-generic/pgtable-nopud.h>
 
-struct mm_struct;
-
 #define __PAGETABLE_PMD_FOLDED
 
+#define PMD_SHIFT	PUD_SHIFT
+#define PTRS_PER_PMD	1
+#define PMD_SIZE  	(_AC(1,UL) << PMD_SHIFT)
+#define PMD_MASK  	(~(PMD_SIZE-1))
+
+#ifndef __ASSEMBLY__
+
+struct mm_struct;
+
 /*
  * Having the pmd type consist of a pud gets the size right, and allows
  * us to conceptually access the pud entry that this pmd is folded into
@@ -16,11 +21,6 @@
  */
 typedef struct { pud_t pud; } pmd_t;
 
-#define PMD_SHIFT	PUD_SHIFT
-#define PTRS_PER_PMD	1
-#define PMD_SIZE  	(1UL << PMD_SHIFT)
-#define PMD_MASK  	(~(PMD_SIZE-1))
-
 /*
  * The "pud_xxx()" functions here are trivial for a folded two-level
  * setup: the pmd is never bad, and a pmd always exists (as it's folded
diff -uriN linux-2.6.32.43/include/asm-generic/pgtable-nopud.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/pgtable-nopud.h
--- linux-2.6.32.43/include/asm-generic/pgtable-nopud.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/pgtable-nopud.h	2011-07-15 05:51:19.000000000 -0500
@@ -1,10 +1,15 @@
 #ifndef _PGTABLE_NOPUD_H
 #define _PGTABLE_NOPUD_H
 
-#ifndef __ASSEMBLY__
-
 #define __PAGETABLE_PUD_FOLDED
 
+#define PUD_SHIFT	PGDIR_SHIFT
+#define PTRS_PER_PUD	1
+#define PUD_SIZE  	(_AC(1,UL) << PUD_SHIFT)
+#define PUD_MASK  	(~(PUD_SIZE-1))
+
+#ifndef __ASSEMBLY__
+
 /*
  * Having the pud type consist of a pgd gets the size right, and allows
  * us to conceptually access the pgd entry that this pud is folded into
@@ -12,11 +17,6 @@
  */
 typedef struct { pgd_t pgd; } pud_t;
 
-#define PUD_SHIFT	PGDIR_SHIFT
-#define PTRS_PER_PUD	1
-#define PUD_SIZE  	(1UL << PUD_SHIFT)
-#define PUD_MASK  	(~(PUD_SIZE-1))
-
 /*
  * The "pgd_xxx()" functions here are trivial for a folded two-level
  * setup: the pud is never bad, and a pud always exists (as it's folded
diff -uriN linux-2.6.32.43/include/asm-generic/tlb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/tlb.h
--- linux-2.6.32.43/include/asm-generic/tlb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/tlb.h	2011-07-15 05:50:11.000000000 -0500
@@ -14,6 +14,7 @@
 #define _ASM_GENERIC__TLB_H
 
 #include <linux/swap.h>
+#include <linux/vs_memory.h>
 #include <asm/pgalloc.h>
 #include <asm/tlbflush.h>
 
diff -uriN linux-2.6.32.43/include/asm-generic/vmlinux.lds.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/vmlinux.lds.h
--- linux-2.6.32.43/include/asm-generic/vmlinux.lds.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/asm-generic/vmlinux.lds.h	2011-07-15 05:51:19.000000000 -0500
@@ -199,6 +199,7 @@
 	.rodata           : AT(ADDR(.rodata) - LOAD_OFFSET) {		\
 		VMLINUX_SYMBOL(__start_rodata) = .;			\
 		*(.rodata) *(.rodata.*)					\
+		*(.data.read_only)					\
 		*(__vermagic)		/* Kernel version magic */	\
 		*(__markers_strings)	/* Markers: strings */		\
 		*(__tracepoints_strings)/* Tracepoints: strings */	\
@@ -656,22 +657,24 @@
  * section in the linker script will go there too.  @phdr should have
  * a leading colon.
  *
- * Note that this macros defines __per_cpu_load as an absolute symbol.
+ * Note that this macros defines per_cpu_load as an absolute symbol.
  * If there is no need to put the percpu section at a predetermined
  * address, use PERCPU().
  */
 #define PERCPU_VADDR(vaddr, phdr)					\
-	VMLINUX_SYMBOL(__per_cpu_load) = .;				\
-	.data.percpu vaddr : AT(VMLINUX_SYMBOL(__per_cpu_load)		\
+	per_cpu_load = .;						\
+	.data.percpu vaddr : AT(VMLINUX_SYMBOL(per_cpu_load)		\
 				- LOAD_OFFSET) {			\
+		VMLINUX_SYMBOL(__per_cpu_load) = . + per_cpu_load;	\
 		VMLINUX_SYMBOL(__per_cpu_start) = .;			\
 		*(.data.percpu.first)					\
-		*(.data.percpu.page_aligned)				\
 		*(.data.percpu)						\
+		. = ALIGN(PAGE_SIZE);					\
+		*(.data.percpu.page_aligned)				\
 		*(.data.percpu.shared_aligned)				\
 		VMLINUX_SYMBOL(__per_cpu_end) = .;			\
 	} phdr								\
-	. = VMLINUX_SYMBOL(__per_cpu_load) + SIZEOF(.data.percpu);
+	. = VMLINUX_SYMBOL(per_cpu_load) + SIZEOF(.data.percpu);
 
 /**
  * PERCPU - define output section for percpu area, simple version
diff -uriN linux-2.6.32.43/include/drm/drmP.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/drm/drmP.h
--- linux-2.6.32.43/include/drm/drmP.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/drm/drmP.h	2011-07-15 05:51:19.000000000 -0500
@@ -71,6 +71,7 @@
 #include <linux/workqueue.h>
 #include <linux/poll.h>
 #include <asm/pgalloc.h>
+#include <asm/local.h>
 #include "drm.h"
 
 #include <linux/idr.h>
@@ -814,7 +815,7 @@
 	void (*vgaarb_irq)(struct drm_device *dev, bool state);
 
 	/* Driver private ops for this object */
-	struct vm_operations_struct *gem_vm_ops;
+	const struct vm_operations_struct *gem_vm_ops;
 
 	int major;
 	int minor;
@@ -917,7 +918,7 @@
 
 	/** \name Usage Counters */
 	/*@{ */
-	int open_count;			/**< Outstanding files open */
+	local_t open_count;		/**< Outstanding files open */
 	atomic_t ioctl_count;		/**< Outstanding IOCTLs pending */
 	atomic_t vma_count;		/**< Outstanding vma areas open */
 	int buf_use;			/**< Buffers in use -- cannot alloc */
@@ -928,7 +929,7 @@
 	/*@{ */
 	unsigned long counters;
 	enum drm_stat_type types[15];
-	atomic_t counts[15];
+	atomic_unchecked_t counts[15];
 	/*@} */
 
 	struct list_head filelist;
@@ -1016,7 +1017,7 @@
 	struct pci_controller *hose;
 #endif
 	struct drm_sg_mem *sg;	/**< Scatter gather memory */
-	unsigned int num_crtcs;                  /**< Number of CRTCs on this device */
+	unsigned int num_crtcs;		/**< Number of CRTCs on this device */
 	void *dev_private;		/**< device private data */
 	void *mm_private;
 	struct address_space *dev_mapping;
@@ -1042,11 +1043,11 @@
 	spinlock_t object_name_lock;
 	struct idr object_name_idr;
 	atomic_t object_count;
-	atomic_t object_memory;
+	atomic_unchecked_t object_memory;
 	atomic_t pin_count;
-	atomic_t pin_memory;
+	atomic_unchecked_t pin_memory;
 	atomic_t gtt_count;
-	atomic_t gtt_memory;
+	atomic_unchecked_t gtt_memory;
 	uint32_t gtt_total;
 	uint32_t invalidate_domains;    /* domains pending invalidation */
 	uint32_t flush_domains;         /* domains pending flush */
diff -uriN linux-2.6.32.43/include/linux/a.out.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/a.out.h
--- linux-2.6.32.43/include/linux/a.out.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/a.out.h	2011-07-15 05:51:19.000000000 -0500
@@ -39,6 +39,14 @@
   M_MIPS2 = 152		/* MIPS R6000/R4000 binary */
 };
 
+/* Constants for the N_FLAGS field */
+#define F_PAX_PAGEEXEC	1	/* Paging based non-executable pages */
+#define F_PAX_EMUTRAMP	2	/* Emulate trampolines */
+#define F_PAX_MPROTECT	4	/* Restrict mprotect() */
+#define F_PAX_RANDMMAP	8	/* Randomize mmap() base */
+/*#define F_PAX_RANDEXEC	16*/	/* Randomize ET_EXEC base */
+#define F_PAX_SEGMEXEC	32	/* Segmentation based non-executable pages */
+
 #if !defined (N_MAGIC)
 #define N_MAGIC(exec) ((exec).a_info & 0xffff)
 #endif
diff -uriN linux-2.6.32.43/include/linux/atmdev.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/atmdev.h
--- linux-2.6.32.43/include/linux/atmdev.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/atmdev.h	2011-07-15 05:51:19.000000000 -0500
@@ -237,7 +237,7 @@
 #endif
 
 struct k_atm_aal_stats {
-#define __HANDLE_ITEM(i) atomic_t i
+#define __HANDLE_ITEM(i) atomic_unchecked_t i
 	__AAL_STAT_ITEMS
 #undef __HANDLE_ITEM
 };
diff -uriN linux-2.6.32.43/include/linux/backlight.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/backlight.h
--- linux-2.6.32.43/include/linux/backlight.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/backlight.h	2011-07-15 05:51:19.000000000 -0500
@@ -36,18 +36,18 @@
 struct fb_info;
 
 struct backlight_ops {
-	unsigned int options;
+	const unsigned int options;
 
 #define BL_CORE_SUSPENDRESUME	(1 << 0)
 
 	/* Notify the backlight driver some property has changed */
-	int (*update_status)(struct backlight_device *);
+	int (* const update_status)(struct backlight_device *);
 	/* Return the current backlight brightness (accounting for power,
 	   fb_blank etc.) */
-	int (*get_brightness)(struct backlight_device *);
+	int (* const get_brightness)(struct backlight_device *);
 	/* Check if given framebuffer device is the one bound to this backlight;
 	   return 0 if not, !=0 if it is. If NULL, backlight always matches the fb. */
-	int (*check_fb)(struct fb_info *);
+	int (* const check_fb)(struct fb_info *);
 };
 
 /* This structure defines all the properties of a backlight */
@@ -86,7 +86,7 @@
 	   registered this device has been unloaded, and if class_get_devdata()
 	   points to something in the body of that driver, it is also invalid. */
 	struct mutex ops_lock;
-	struct backlight_ops *ops;
+	const struct backlight_ops *ops;
 
 	/* The framebuffer notifier block */
 	struct notifier_block fb_notif;
@@ -103,7 +103,7 @@
 }
 
 extern struct backlight_device *backlight_device_register(const char *name,
-	struct device *dev, void *devdata, struct backlight_ops *ops);
+	struct device *dev, void *devdata, const struct backlight_ops *ops);
 extern void backlight_device_unregister(struct backlight_device *bd);
 extern void backlight_force_update(struct backlight_device *bd,
 				   enum backlight_update_reason reason);
diff -uriN linux-2.6.32.43/include/linux/binfmts.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/binfmts.h
--- linux-2.6.32.43/include/linux/binfmts.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/binfmts.h	2011-07-15 05:51:19.000000000 -0500
@@ -83,6 +83,7 @@
 	int (*load_binary)(struct linux_binprm *, struct  pt_regs * regs);
 	int (*load_shlib)(struct file *);
 	int (*core_dump)(long signr, struct pt_regs *regs, struct file *file, unsigned long limit);
+	void (*handle_mprotect)(struct vm_area_struct *vma, unsigned long newflags);
 	unsigned long min_coredump;	/* minimal dump size */
 	int hasvdso;
 };
diff -uriN linux-2.6.32.43/include/linux/blkdev.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/blkdev.h
--- linux-2.6.32.43/include/linux/blkdev.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/blkdev.h	2011-07-15 05:51:19.000000000 -0500
@@ -1265,19 +1265,19 @@
 #endif /* CONFIG_BLK_DEV_INTEGRITY */
 
 struct block_device_operations {
-	int (*open) (struct block_device *, fmode_t);
-	int (*release) (struct gendisk *, fmode_t);
-	int (*locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-	int (*ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-	int (*compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
-	int (*direct_access) (struct block_device *, sector_t,
+	int (* const open) (struct block_device *, fmode_t);
+	int (* const release) (struct gendisk *, fmode_t);
+	int (* const locked_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+	int (* const ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+	int (* const compat_ioctl) (struct block_device *, fmode_t, unsigned, unsigned long);
+	int (* const direct_access) (struct block_device *, sector_t,
 						void **, unsigned long *);
-	int (*media_changed) (struct gendisk *);
-	unsigned long long (*set_capacity) (struct gendisk *,
+	int (* const media_changed) (struct gendisk *);
+	unsigned long long (* const set_capacity) (struct gendisk *,
 						unsigned long long);
-	int (*revalidate_disk) (struct gendisk *);
-	int (*getgeo)(struct block_device *, struct hd_geometry *);
-	struct module *owner;
+	int (* const revalidate_disk) (struct gendisk *);
+	int (*const getgeo)(struct block_device *, struct hd_geometry *);
+	struct module * const owner;
 };
 
 extern int __blkdev_driver_ioctl(struct block_device *, fmode_t, unsigned int,
diff -uriN linux-2.6.32.43/include/linux/blktrace_api.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/blktrace_api.h
--- linux-2.6.32.43/include/linux/blktrace_api.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/blktrace_api.h	2011-07-15 05:51:19.000000000 -0500
@@ -160,7 +160,7 @@
 	struct dentry *dir;
 	struct dentry *dropped_file;
 	struct dentry *msg_file;
-	atomic_t dropped;
+	atomic_unchecked_t dropped;
 };
 
 extern int blk_trace_ioctl(struct block_device *, unsigned, char __user *);
diff -uriN linux-2.6.32.43/include/linux/byteorder/little_endian.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/byteorder/little_endian.h
--- linux-2.6.32.43/include/linux/byteorder/little_endian.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/byteorder/little_endian.h	2011-07-15 05:51:19.000000000 -0500
@@ -42,51 +42,51 @@
 
 static inline __le64 __cpu_to_le64p(const __u64 *p)
 {
-	return (__force __le64)*p;
+	return (__force const __le64)*p;
 }
 static inline __u64 __le64_to_cpup(const __le64 *p)
 {
-	return (__force __u64)*p;
+	return (__force const __u64)*p;
 }
 static inline __le32 __cpu_to_le32p(const __u32 *p)
 {
-	return (__force __le32)*p;
+	return (__force const __le32)*p;
 }
 static inline __u32 __le32_to_cpup(const __le32 *p)
 {
-	return (__force __u32)*p;
+	return (__force const __u32)*p;
 }
 static inline __le16 __cpu_to_le16p(const __u16 *p)
 {
-	return (__force __le16)*p;
+	return (__force const __le16)*p;
 }
 static inline __u16 __le16_to_cpup(const __le16 *p)
 {
-	return (__force __u16)*p;
+	return (__force const __u16)*p;
 }
 static inline __be64 __cpu_to_be64p(const __u64 *p)
 {
-	return (__force __be64)__swab64p(p);
+	return (__force const __be64)__swab64p(p);
 }
 static inline __u64 __be64_to_cpup(const __be64 *p)
 {
-	return __swab64p((__u64 *)p);
+	return __swab64p((const __u64 *)p);
 }
 static inline __be32 __cpu_to_be32p(const __u32 *p)
 {
-	return (__force __be32)__swab32p(p);
+	return (__force const __be32)__swab32p(p);
 }
 static inline __u32 __be32_to_cpup(const __be32 *p)
 {
-	return __swab32p((__u32 *)p);
+	return __swab32p((const __u32 *)p);
 }
 static inline __be16 __cpu_to_be16p(const __u16 *p)
 {
-	return (__force __be16)__swab16p(p);
+	return (__force const __be16)__swab16p(p);
 }
 static inline __u16 __be16_to_cpup(const __be16 *p)
 {
-	return __swab16p((__u16 *)p);
+	return __swab16p((const __u16 *)p);
 }
 #define __cpu_to_le64s(x) do { (void)(x); } while (0)
 #define __le64_to_cpus(x) do { (void)(x); } while (0)
diff -uriN linux-2.6.32.43/include/linux/cache.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/cache.h
--- linux-2.6.32.43/include/linux/cache.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/cache.h	2011-07-15 05:51:19.000000000 -0500
@@ -16,6 +16,10 @@
 #define __read_mostly
 #endif
 
+#ifndef __read_only
+#define __read_only __read_mostly
+#endif
+
 #ifndef ____cacheline_aligned
 #define ____cacheline_aligned __attribute__((__aligned__(SMP_CACHE_BYTES)))
 #endif
diff -uriN linux-2.6.32.43/include/linux/capability.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/capability.h
--- linux-2.6.32.43/include/linux/capability.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/capability.h	2011-07-15 05:51:19.000000000 -0500
@@ -285,6 +285,7 @@
    arbitrary SCSI commands */
 /* Allow setting encryption key on loopback filesystem */
 /* Allow setting zone reclaim policy */
+/* Allow the selection of a security context */
 
 #define CAP_SYS_ADMIN        21
 
@@ -357,7 +358,13 @@
 
 #define CAP_MAC_ADMIN        33
 
-#define CAP_LAST_CAP         CAP_MAC_ADMIN
+/* Allow context manipulations */
+/* Allow changing context info on files */
+
+#define CAP_CONTEXT	     34
+
+
+#define CAP_LAST_CAP         CAP_CONTEXT
 
 #define cap_valid(x) ((x) >= 0 && (x) <= CAP_LAST_CAP)
 
@@ -563,6 +570,7 @@
 	(security_real_capable_noaudit((t), (cap)) == 0)
 
 extern int capable(int cap);
+int capable_nolog(int cap);
 
 /* audit system wants to get cap info from files as well */
 struct dentry;
diff -uriN linux-2.6.32.43/include/linux/compiler-gcc4.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/compiler-gcc4.h
--- linux-2.6.32.43/include/linux/compiler-gcc4.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/compiler-gcc4.h	2011-07-15 05:51:19.000000000 -0500
@@ -36,4 +36,8 @@
    the kernel context */
 #define __cold			__attribute__((__cold__))
 
+#define __alloc_size(...)	__attribute((alloc_size(__VA_ARGS__)))
+#define __bos(ptr, arg)		__builtin_object_size((ptr), (arg))
+#define __bos0(ptr)		__bos((ptr), 0)
+#define __bos1(ptr)		__bos((ptr), 1)
 #endif
diff -uriN linux-2.6.32.43/include/linux/compiler.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/compiler.h
--- linux-2.6.32.43/include/linux/compiler.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/compiler.h	2011-07-15 05:51:19.000000000 -0500
@@ -256,6 +256,22 @@
 #define __cold
 #endif
 
+#ifndef __alloc_size
+#define __alloc_size
+#endif
+
+#ifndef __bos
+#define __bos
+#endif
+
+#ifndef __bos0
+#define __bos0
+#endif
+
+#ifndef __bos1
+#define __bos1
+#endif
+
 /* Simple shorthand for a section definition */
 #ifndef __section
 # define __section(S) __attribute__ ((__section__(#S)))
@@ -278,6 +294,7 @@
  * use is to mediate communication between process-level code and irq/NMI
  * handlers, all running on the same CPU.
  */
-#define ACCESS_ONCE(x) (*(volatile typeof(x) *)&(x))
+#define ACCESS_ONCE(x) (*(volatile const typeof(x) *)&(x))
+#define ACCESS_ONCE_RW(x) (*(volatile typeof(x) *)&(x))
 
 #endif /* __LINUX_COMPILER_H */
diff -uriN linux-2.6.32.43/include/linux/dcache.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/dcache.h
--- linux-2.6.32.43/include/linux/dcache.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/dcache.h	2011-07-15 05:51:19.000000000 -0500
@@ -119,6 +119,8 @@
 	unsigned char d_iname[DNAME_INLINE_LEN_MIN];	/* small names */
 };
 
+#define DNAME_INLINE_LEN (sizeof(struct dentry)-offsetof(struct dentry,d_iname))
+
 /*
  * dentry->d_lock spinlock nesting subclasses:
  *
diff -uriN linux-2.6.32.43/include/linux/decompress/mm.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/decompress/mm.h
--- linux-2.6.32.43/include/linux/decompress/mm.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/decompress/mm.h	2011-07-15 05:51:19.000000000 -0500
@@ -78,7 +78,7 @@
  * warnings when not needed (indeed large_malloc / large_free are not
  * needed by inflate */
 
-#define malloc(a) kmalloc(a, GFP_KERNEL)
+#define malloc(a) kmalloc((a), GFP_KERNEL)
 #define free(a) kfree(a)
 
 #define large_malloc(a) vmalloc(a)
diff -uriN linux-2.6.32.43/include/linux/devpts_fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/devpts_fs.h
--- linux-2.6.32.43/include/linux/devpts_fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/devpts_fs.h	2011-07-15 05:50:11.000000000 -0500
@@ -45,5 +45,4 @@
 
 #endif
 
-
 #endif /* _LINUX_DEVPTS_FS_H */
diff -uriN linux-2.6.32.43/include/linux/dma-mapping.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/dma-mapping.h
--- linux-2.6.32.43/include/linux/dma-mapping.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/dma-mapping.h	2011-07-15 05:51:19.000000000 -0500
@@ -16,50 +16,50 @@
 };
 
 struct dma_map_ops {
-	void* (*alloc_coherent)(struct device *dev, size_t size,
+	void* (* const alloc_coherent)(struct device *dev, size_t size,
 				dma_addr_t *dma_handle, gfp_t gfp);
-	void (*free_coherent)(struct device *dev, size_t size,
+	void (* const free_coherent)(struct device *dev, size_t size,
 			      void *vaddr, dma_addr_t dma_handle);
-	dma_addr_t (*map_page)(struct device *dev, struct page *page,
+	dma_addr_t (* const map_page)(struct device *dev, struct page *page,
 			       unsigned long offset, size_t size,
 			       enum dma_data_direction dir,
 			       struct dma_attrs *attrs);
-	void (*unmap_page)(struct device *dev, dma_addr_t dma_handle,
+	void (* const unmap_page)(struct device *dev, dma_addr_t dma_handle,
 			   size_t size, enum dma_data_direction dir,
 			   struct dma_attrs *attrs);
-	int (*map_sg)(struct device *dev, struct scatterlist *sg,
+	int (* const map_sg)(struct device *dev, struct scatterlist *sg,
 		      int nents, enum dma_data_direction dir,
 		      struct dma_attrs *attrs);
-	void (*unmap_sg)(struct device *dev,
+	void (* const unmap_sg)(struct device *dev,
 			 struct scatterlist *sg, int nents,
 			 enum dma_data_direction dir,
 			 struct dma_attrs *attrs);
-	void (*sync_single_for_cpu)(struct device *dev,
+	void (* const sync_single_for_cpu)(struct device *dev,
 				    dma_addr_t dma_handle, size_t size,
 				    enum dma_data_direction dir);
-	void (*sync_single_for_device)(struct device *dev,
+	void (* const sync_single_for_device)(struct device *dev,
 				       dma_addr_t dma_handle, size_t size,
 				       enum dma_data_direction dir);
-	void (*sync_single_range_for_cpu)(struct device *dev,
+	void (* const sync_single_range_for_cpu)(struct device *dev,
 					  dma_addr_t dma_handle,
 					  unsigned long offset,
 					  size_t size,
 					  enum dma_data_direction dir);
-	void (*sync_single_range_for_device)(struct device *dev,
+	void (* const sync_single_range_for_device)(struct device *dev,
 					     dma_addr_t dma_handle,
 					     unsigned long offset,
 					     size_t size,
 					     enum dma_data_direction dir);
-	void (*sync_sg_for_cpu)(struct device *dev,
+	void (* const sync_sg_for_cpu)(struct device *dev,
 				struct scatterlist *sg, int nents,
 				enum dma_data_direction dir);
-	void (*sync_sg_for_device)(struct device *dev,
+	void (* const sync_sg_for_device)(struct device *dev,
 				   struct scatterlist *sg, int nents,
 				   enum dma_data_direction dir);
-	int (*mapping_error)(struct device *dev, dma_addr_t dma_addr);
-	int (*dma_supported)(struct device *dev, u64 mask);
+	int (* const mapping_error)(struct device *dev, dma_addr_t dma_addr);
+	int (* const dma_supported)(struct device *dev, u64 mask);
 	int (*set_dma_mask)(struct device *dev, u64 mask);
-	int is_phys;
+	const int is_phys;
 };
 
 #define DMA_BIT_MASK(n)	(((n) == 64) ? ~0ULL : ((1ULL<<(n))-1))
diff -uriN linux-2.6.32.43/include/linux/dst.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/dst.h
--- linux-2.6.32.43/include/linux/dst.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/dst.h	2011-07-15 05:51:19.000000000 -0500
@@ -380,7 +380,7 @@
 	struct thread_pool	*pool;
 
 	/* Transaction IDs live here */
-	atomic_long_t		gen;
+	atomic_long_unchecked_t	gen;
 
 	/*
 	 * How frequently and how many times transaction
diff -uriN linux-2.6.32.43/include/linux/elf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/elf.h
--- linux-2.6.32.43/include/linux/elf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/elf.h	2011-07-15 05:51:19.000000000 -0500
@@ -49,6 +49,17 @@
 #define PT_GNU_EH_FRAME		0x6474e550
 
 #define PT_GNU_STACK	(PT_LOOS + 0x474e551)
+#define PT_GNU_RELRO	(PT_LOOS + 0x474e552)
+
+#define PT_PAX_FLAGS	(PT_LOOS + 0x5041580)
+
+/* Constants for the e_flags field */
+#define EF_PAX_PAGEEXEC		1	/* Paging based non-executable pages */
+#define EF_PAX_EMUTRAMP		2	/* Emulate trampolines */
+#define EF_PAX_MPROTECT		4	/* Restrict mprotect() */
+#define EF_PAX_RANDMMAP		8	/* Randomize mmap() base */
+/*#define EF_PAX_RANDEXEC		16*/	/* Randomize ET_EXEC base */
+#define EF_PAX_SEGMEXEC		32	/* Segmentation based non-executable pages */
 
 /* These constants define the different elf file types */
 #define ET_NONE   0
@@ -84,6 +95,8 @@
 #define DT_DEBUG	21
 #define DT_TEXTREL	22
 #define DT_JMPREL	23
+#define DT_FLAGS	30
+  #define DF_TEXTREL  0x00000004
 #define DT_ENCODING	32
 #define OLD_DT_LOOS	0x60000000
 #define DT_LOOS		0x6000000d
@@ -230,6 +243,19 @@
 #define PF_W		0x2
 #define PF_X		0x1
 
+#define PF_PAGEEXEC	(1U << 4)	/* Enable  PAGEEXEC */
+#define PF_NOPAGEEXEC	(1U << 5)	/* Disable PAGEEXEC */
+#define PF_SEGMEXEC	(1U << 6)	/* Enable  SEGMEXEC */
+#define PF_NOSEGMEXEC	(1U << 7)	/* Disable SEGMEXEC */
+#define PF_MPROTECT	(1U << 8)	/* Enable  MPROTECT */
+#define PF_NOMPROTECT	(1U << 9)	/* Disable MPROTECT */
+/*#define PF_RANDEXEC	(1U << 10)*/	/* Enable  RANDEXEC */
+/*#define PF_NORANDEXEC	(1U << 11)*/	/* Disable RANDEXEC */
+#define PF_EMUTRAMP	(1U << 12)	/* Enable  EMUTRAMP */
+#define PF_NOEMUTRAMP	(1U << 13)	/* Disable EMUTRAMP */
+#define PF_RANDMMAP	(1U << 14)	/* Enable  RANDMMAP */
+#define PF_NORANDMMAP	(1U << 15)	/* Disable RANDMMAP */
+
 typedef struct elf32_phdr{
   Elf32_Word	p_type;
   Elf32_Off	p_offset;
@@ -322,6 +348,8 @@
 #define	EI_OSABI	7
 #define	EI_PAD		8
 
+#define	EI_PAX		14
+
 #define	ELFMAG0		0x7f		/* EI_MAG */
 #define	ELFMAG1		'E'
 #define	ELFMAG2		'L'
@@ -386,6 +414,7 @@
 #define elf_phdr	elf32_phdr
 #define elf_note	elf32_note
 #define elf_addr_t	Elf32_Off
+#define elf_dyn		Elf32_Dyn
 
 #else
 
@@ -394,6 +423,7 @@
 #define elf_phdr	elf64_phdr
 #define elf_note	elf64_note
 #define elf_addr_t	Elf64_Off
+#define elf_dyn		Elf64_Dyn
 
 #endif
 
diff -uriN linux-2.6.32.43/include/linux/ext2_fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ext2_fs.h
--- linux-2.6.32.43/include/linux/ext2_fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ext2_fs.h	2011-07-15 05:50:11.000000000 -0500
@@ -189,8 +189,12 @@
 #define EXT2_NOTAIL_FL			FS_NOTAIL_FL	/* file tail should not be merged */
 #define EXT2_DIRSYNC_FL			FS_DIRSYNC_FL	/* dirsync behaviour (directories only) */
 #define EXT2_TOPDIR_FL			FS_TOPDIR_FL	/* Top of directory hierarchies*/
+#define EXT2_IXUNLINK_FL		FS_IXUNLINK_FL	/* Immutable invert on unlink */
 #define EXT2_RESERVED_FL		FS_RESERVED_FL	/* reserved for ext2 lib */
 
+#define EXT2_BARRIER_FL			FS_BARRIER_FL	/* Barrier for chroot() */
+#define EXT2_COW_FL			FS_COW_FL	/* Copy on Write marker */
+
 #define EXT2_FL_USER_VISIBLE		FS_FL_USER_VISIBLE	/* User visible flags */
 #define EXT2_FL_USER_MODIFIABLE		FS_FL_USER_MODIFIABLE	/* User modifiable flags */
 
@@ -274,7 +278,8 @@
 			__u16	i_pad1;
 			__le16	l_i_uid_high;	/* these 2 fields    */
 			__le16	l_i_gid_high;	/* were reserved2[0] */
-			__u32	l_i_reserved2;
+			__le16	l_i_tag;	/* Context Tag */
+			__u16	l_i_reserved2;
 		} linux2;
 		struct {
 			__u8	h_i_frag;	/* Fragment number */
@@ -303,6 +308,7 @@
 #define i_gid_low	i_gid
 #define i_uid_high	osd2.linux2.l_i_uid_high
 #define i_gid_high	osd2.linux2.l_i_gid_high
+#define i_raw_tag	osd2.linux2.l_i_tag
 #define i_reserved2	osd2.linux2.l_i_reserved2
 #endif
 
@@ -347,6 +353,7 @@
 #define EXT2_MOUNT_USRQUOTA		0x020000  /* user quota */
 #define EXT2_MOUNT_GRPQUOTA		0x040000  /* group quota */
 #define EXT2_MOUNT_RESERVATION		0x080000  /* Preallocation */
+#define EXT2_MOUNT_TAGGED		(1<<24)	  /* Enable Context Tags */
 
 
 #define clear_opt(o, opt)		o &= ~EXT2_MOUNT_##opt
diff -uriN linux-2.6.32.43/include/linux/ext3_fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ext3_fs.h
--- linux-2.6.32.43/include/linux/ext3_fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ext3_fs.h	2011-07-15 05:50:11.000000000 -0500
@@ -173,10 +173,14 @@
 #define EXT3_NOTAIL_FL			0x00008000 /* file tail should not be merged */
 #define EXT3_DIRSYNC_FL			0x00010000 /* dirsync behaviour (directories only) */
 #define EXT3_TOPDIR_FL			0x00020000 /* Top of directory hierarchies*/
+#define EXT3_IXUNLINK_FL		0x08000000 /* Immutable invert on unlink */
 #define EXT3_RESERVED_FL		0x80000000 /* reserved for ext3 lib */
 
-#define EXT3_FL_USER_VISIBLE		0x0003DFFF /* User visible flags */
-#define EXT3_FL_USER_MODIFIABLE		0x000380FF /* User modifiable flags */
+#define EXT3_BARRIER_FL			0x04000000 /* Barrier for chroot() */
+#define EXT3_COW_FL			0x20000000 /* Copy on Write marker */
+
+#define EXT3_FL_USER_VISIBLE		0x0103DFFF /* User visible flags */
+#define EXT3_FL_USER_MODIFIABLE		0x010380FF /* User modifiable flags */
 
 /* Flags that should be inherited by new inodes from their parent. */
 #define EXT3_FL_INHERITED (EXT3_SECRM_FL | EXT3_UNRM_FL | EXT3_COMPR_FL |\
@@ -320,7 +324,8 @@
 			__u16	i_pad1;
 			__le16	l_i_uid_high;	/* these 2 fields    */
 			__le16	l_i_gid_high;	/* were reserved2[0] */
-			__u32	l_i_reserved2;
+			__le16	l_i_tag;	/* Context Tag */
+			__u16	l_i_reserved2;
 		} linux2;
 		struct {
 			__u8	h_i_frag;	/* Fragment number */
@@ -351,6 +356,7 @@
 #define i_gid_low	i_gid
 #define i_uid_high	osd2.linux2.l_i_uid_high
 #define i_gid_high	osd2.linux2.l_i_gid_high
+#define i_raw_tag	osd2.linux2.l_i_tag
 #define i_reserved2	osd2.linux2.l_i_reserved2
 
 #elif defined(__GNU__)
@@ -414,6 +420,7 @@
 #define EXT3_MOUNT_GRPQUOTA		0x200000 /* "old" group quota */
 #define EXT3_MOUNT_DATA_ERR_ABORT	0x400000 /* Abort on file data write
 						  * error in ordered mode */
+#define EXT3_MOUNT_TAGGED		(1<<24) /* Enable Context Tags */
 
 /* Compatibility, for having both ext2_fs.h and ext3_fs.h included at once */
 #ifndef _LINUX_EXT2_FS_H
@@ -892,6 +899,7 @@
 extern void ext3_set_aops(struct inode *inode);
 extern int ext3_fiemap(struct inode *inode, struct fiemap_extent_info *fieinfo,
 		       u64 start, u64 len);
+extern int ext3_sync_flags(struct inode *, int, int);
 
 /* ioctl.c */
 extern long ext3_ioctl(struct file *, unsigned int, unsigned long);
diff -uriN linux-2.6.32.43/include/linux/fscache-cache.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/fscache-cache.h
--- linux-2.6.32.43/include/linux/fscache-cache.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/fscache-cache.h	2011-07-15 05:51:19.000000000 -0500
@@ -116,7 +116,7 @@
 #endif
 };
 
-extern atomic_t fscache_op_debug_id;
+extern atomic_unchecked_t fscache_op_debug_id;
 extern const struct slow_work_ops fscache_op_slow_work_ops;
 
 extern void fscache_enqueue_operation(struct fscache_operation *);
@@ -134,7 +134,7 @@
 					  fscache_operation_release_t release)
 {
 	atomic_set(&op->usage, 1);
-	op->debug_id = atomic_inc_return(&fscache_op_debug_id);
+	op->debug_id = atomic_inc_return_unchecked(&fscache_op_debug_id);
 	op->release = release;
 	INIT_LIST_HEAD(&op->pend_link);
 	fscache_set_op_state(op, "Init");
diff -uriN linux-2.6.32.43/include/linux/fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/fs.h
--- linux-2.6.32.43/include/linux/fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/fs.h	2011-07-15 05:51:19.000000000 -0500
@@ -90,6 +90,11 @@
 /* Expect random access pattern */
 #define FMODE_RANDOM		((__force fmode_t)4096)
 
+/* Hack for grsec so as not to require read permission simply to execute
+ * a binary
+ */
+#define FMODE_GREXEC		((__force fmode_t)0x2000000)
+
 /*
  * The below are the various read and write types that we support. Some of
  * them include behavioral modifiers that send information down to the
@@ -208,6 +213,9 @@
 #define MS_KERNMOUNT	(1<<22) /* this is a kern_mount call */
 #define MS_I_VERSION	(1<<23) /* Update inode I_version field */
 #define MS_STRICTATIME	(1<<24) /* Always perform atime updates */
+#define MS_TAGGED	(1<<25) /* use generic inode tagging */
+#define MS_TAGID	(1<<26) /* use specific tag for this mount */
+#define MS_NOTAGCHECK	(1<<27) /* don't check tags */
 #define MS_ACTIVE	(1<<30)
 #define MS_NOUSER	(1<<31)
 
@@ -234,6 +242,14 @@
 #define S_NOCMTIME	128	/* Do not update file c/mtime */
 #define S_SWAPFILE	256	/* Do not truncate: swapon got its bmaps */
 #define S_PRIVATE	512	/* Inode is fs-internal */
+#define S_IXUNLINK	1024	/* Immutable Invert on unlink */
+
+/* Linux-VServer related Inode flags */
+
+#define V_VALID		1
+#define V_XATTR		2
+#define V_BARRIER	4	/* Barrier for chroot() */
+#define V_COW		8	/* Copy on Write */
 
 /*
  * Note that nosuid etc flags are inode-specific: setting some file-system
@@ -256,12 +272,15 @@
 #define IS_DIRSYNC(inode)	(__IS_FLG(inode, MS_SYNCHRONOUS|MS_DIRSYNC) || \
 					((inode)->i_flags & (S_SYNC|S_DIRSYNC)))
 #define IS_MANDLOCK(inode)	__IS_FLG(inode, MS_MANDLOCK)
-#define IS_NOATIME(inode)   __IS_FLG(inode, MS_RDONLY|MS_NOATIME)
-#define IS_I_VERSION(inode)   __IS_FLG(inode, MS_I_VERSION)
+#define IS_NOATIME(inode)	__IS_FLG(inode, MS_RDONLY|MS_NOATIME)
+#define IS_I_VERSION(inode)	__IS_FLG(inode, MS_I_VERSION)
+#define IS_TAGGED(inode)	__IS_FLG(inode, MS_TAGGED)
 
 #define IS_NOQUOTA(inode)	((inode)->i_flags & S_NOQUOTA)
 #define IS_APPEND(inode)	((inode)->i_flags & S_APPEND)
 #define IS_IMMUTABLE(inode)	((inode)->i_flags & S_IMMUTABLE)
+#define IS_IXUNLINK(inode)	((inode)->i_flags & S_IXUNLINK)
+#define IS_IXORUNLINK(inode)	((IS_IXUNLINK(inode) ? S_IMMUTABLE : 0) ^ IS_IMMUTABLE(inode))
 #define IS_POSIXACL(inode)	__IS_FLG(inode, MS_POSIXACL)
 
 #define IS_DEADDIR(inode)	((inode)->i_flags & S_DEAD)
@@ -269,6 +288,16 @@
 #define IS_SWAPFILE(inode)	((inode)->i_flags & S_SWAPFILE)
 #define IS_PRIVATE(inode)	((inode)->i_flags & S_PRIVATE)
 
+#define IS_BARRIER(inode)	(S_ISDIR((inode)->i_mode) && ((inode)->i_vflags & V_BARRIER))
+
+#ifdef CONFIG_VSERVER_COWBL
+#  define IS_COW(inode)		(IS_IXUNLINK(inode) && IS_IMMUTABLE(inode))
+#  define IS_COW_LINK(inode)	(S_ISREG((inode)->i_mode) && ((inode)->i_nlink > 1))
+#else
+#  define IS_COW(inode)		(0)
+#  define IS_COW_LINK(inode)	(0)
+#endif
+
 /* the read-only stuff doesn't really belong here, but any other place is
    probably as bad and I don't want to create yet another include file. */
 
@@ -350,11 +379,14 @@
 #define FS_TOPDIR_FL			0x00020000 /* Top of directory hierarchies*/
 #define FS_EXTENT_FL			0x00080000 /* Extents */
 #define FS_DIRECTIO_FL			0x00100000 /* Use direct i/o */
+#define FS_IXUNLINK_FL			0x08000000 /* Immutable invert on unlink */
 #define FS_RESERVED_FL			0x80000000 /* reserved for ext2 lib */
 
-#define FS_FL_USER_VISIBLE		0x0003DFFF /* User visible flags */
-#define FS_FL_USER_MODIFIABLE		0x000380FF /* User modifiable flags */
+#define FS_BARRIER_FL			0x04000000 /* Barrier for chroot() */
+#define FS_COW_FL			0x20000000 /* Copy on Write marker */
 
+#define FS_FL_USER_VISIBLE		0x0103DFFF /* User visible flags */
+#define FS_FL_USER_MODIFIABLE		0x010380FF /* User modifiable flags */
 
 #define SYNC_FILE_RANGE_WAIT_BEFORE	1
 #define SYNC_FILE_RANGE_WRITE		2
@@ -436,6 +468,7 @@
 #define ATTR_KILL_PRIV	(1 << 14)
 #define ATTR_OPEN	(1 << 15) /* Truncating from open(O_TRUNC) */
 #define ATTR_TIMES_SET	(1 << 16)
+#define ATTR_TAG	(1 << 17)
 
 /*
  * This is the Inode Attributes structure, used for notify_change().  It
@@ -451,6 +484,7 @@
 	umode_t		ia_mode;
 	uid_t		ia_uid;
 	gid_t		ia_gid;
+	tag_t		ia_tag;
 	loff_t		ia_size;
 	struct timespec	ia_atime;
 	struct timespec	ia_mtime;
@@ -464,6 +498,9 @@
 	struct file	*ia_file;
 };
 
+#define ATTR_FLAG_BARRIER	512	/* Barrier for chroot() */
+#define ATTR_FLAG_IXUNLINK	1024	/* Immutable invert on unlink */
+
 /*
  * Includes for diskquotas.
  */
@@ -568,41 +605,41 @@
 		unsigned long, unsigned long);
 
 struct address_space_operations {
-	int (*writepage)(struct page *page, struct writeback_control *wbc);
-	int (*readpage)(struct file *, struct page *);
-	void (*sync_page)(struct page *);
+	int (* const writepage)(struct page *page, struct writeback_control *wbc);
+	int (* const readpage)(struct file *, struct page *);
+	void (* const sync_page)(struct page *);
 
 	/* Write back some dirty pages from this mapping. */
-	int (*writepages)(struct address_space *, struct writeback_control *);
+	int (* const writepages)(struct address_space *, struct writeback_control *);
 
 	/* Set a page dirty.  Return true if this dirtied it */
-	int (*set_page_dirty)(struct page *page);
+	int (* const set_page_dirty)(struct page *page);
 
-	int (*readpages)(struct file *filp, struct address_space *mapping,
+	int (* const readpages)(struct file *filp, struct address_space *mapping,
 			struct list_head *pages, unsigned nr_pages);
 
-	int (*write_begin)(struct file *, struct address_space *mapping,
+	int (* const write_begin)(struct file *, struct address_space *mapping,
 				loff_t pos, unsigned len, unsigned flags,
 				struct page **pagep, void **fsdata);
-	int (*write_end)(struct file *, struct address_space *mapping,
+	int (* const write_end)(struct file *, struct address_space *mapping,
 				loff_t pos, unsigned len, unsigned copied,
 				struct page *page, void *fsdata);
 
 	/* Unfortunately this kludge is needed for FIBMAP. Don't use it */
-	sector_t (*bmap)(struct address_space *, sector_t);
-	void (*invalidatepage) (struct page *, unsigned long);
-	int (*releasepage) (struct page *, gfp_t);
-	ssize_t (*direct_IO)(int, struct kiocb *, const struct iovec *iov,
+	sector_t (* const bmap)(struct address_space *, sector_t);
+	void (* const invalidatepage) (struct page *, unsigned long);
+	int (* const releasepage) (struct page *, gfp_t);
+	ssize_t (* const direct_IO)(int, struct kiocb *, const struct iovec *iov,
 			loff_t offset, unsigned long nr_segs);
-	int (*get_xip_mem)(struct address_space *, pgoff_t, int,
+	int (* const get_xip_mem)(struct address_space *, pgoff_t, int,
 						void **, unsigned long *);
 	/* migrate the contents of a page to the specified target */
-	int (*migratepage) (struct address_space *,
+	int (* const migratepage) (struct address_space *,
 			struct page *, struct page *);
-	int (*launder_page) (struct page *);
-	int (*is_partially_uptodate) (struct page *, read_descriptor_t *,
+	int (* const launder_page) (struct page *);
+	int (* const is_partially_uptodate) (struct page *, read_descriptor_t *,
 					unsigned long);
-	int (*error_remove_page)(struct address_space *, struct page *);
+	int (* const error_remove_page)(struct address_space *, struct page *);
 };
 
 /*
@@ -730,7 +767,9 @@
 	unsigned int		i_nlink;
 	uid_t			i_uid;
 	gid_t			i_gid;
+	tag_t			i_tag;
 	dev_t			i_rdev;
+	dev_t			i_mdev;
 	u64			i_version;
 	loff_t			i_size;
 #ifdef __NEED_I_SIZE_ORDERED
@@ -777,7 +816,8 @@
 	unsigned long		i_state;
 	unsigned long		dirtied_when;	/* jiffies of first dirtying */
 
-	unsigned int		i_flags;
+	unsigned short		i_flags;
+	unsigned short		i_vflags;
 
 	atomic_t		i_writecount;
 #ifdef CONFIG_SECURITY
@@ -865,12 +905,12 @@
 
 static inline unsigned iminor(const struct inode *inode)
 {
-	return MINOR(inode->i_rdev);
+	return MINOR(inode->i_mdev);
 }
 
 static inline unsigned imajor(const struct inode *inode)
 {
-	return MAJOR(inode->i_rdev);
+	return MAJOR(inode->i_mdev);
 }
 
 extern struct block_device *I_BDEV(struct inode *inode);
@@ -929,6 +969,7 @@
 	loff_t			f_pos;
 	struct fown_struct	f_owner;
 	const struct cred	*f_cred;
+	xid_t			f_xid;
 	struct file_ra_state	f_ra;
 
 	u64			f_version;
@@ -1031,19 +1072,19 @@
 typedef struct files_struct *fl_owner_t;
 
 struct file_lock_operations {
-	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
-	void (*fl_release_private)(struct file_lock *);
+	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
+	void (* const fl_release_private)(struct file_lock *);
 };
 
 struct lock_manager_operations {
-	int (*fl_compare_owner)(struct file_lock *, struct file_lock *);
-	void (*fl_notify)(struct file_lock *);	/* unblock callback */
-	int (*fl_grant)(struct file_lock *, struct file_lock *, int);
-	void (*fl_copy_lock)(struct file_lock *, struct file_lock *);
-	void (*fl_release_private)(struct file_lock *);
-	void (*fl_break)(struct file_lock *);
-	int (*fl_mylease)(struct file_lock *, struct file_lock *);
-	int (*fl_change)(struct file_lock **, int);
+	int (* const fl_compare_owner)(struct file_lock *, struct file_lock *);
+	void (* const fl_notify)(struct file_lock *);	/* unblock callback */
+	int (* const fl_grant)(struct file_lock *, struct file_lock *, int);
+	void (* const fl_copy_lock)(struct file_lock *, struct file_lock *);
+	void (* const fl_release_private)(struct file_lock *);
+	void (* const fl_break)(struct file_lock *);
+	int (* const fl_mylease)(struct file_lock *, struct file_lock *);
+	int (* const fl_change)(struct file_lock **, int);
 };
 
 struct lock_manager {
@@ -1070,6 +1111,7 @@
 	struct file *fl_file;
 	loff_t fl_start;
 	loff_t fl_end;
+	xid_t fl_xid;
 
 	struct fasync_struct *	fl_fasync; /* for lease break notifications */
 	unsigned long fl_break_time;	/* for nonblocking lease breaks */
@@ -1442,7 +1484,7 @@
 	unsigned int fi_flags;		/* Flags as passed from user */
 	unsigned int fi_extents_mapped;	/* Number of mapped extents */
 	unsigned int fi_extents_max;	/* Size of fiemap_extent array */
-	struct fiemap_extent *fi_extents_start; /* Start of fiemap_extent
+	struct fiemap_extent __user *fi_extents_start; /* Start of fiemap_extent
 						 * array */
 };
 int fiemap_fill_next_extent(struct fiemap_extent_info *info, u64 logical,
@@ -1537,6 +1579,7 @@
 	ssize_t (*getxattr) (struct dentry *, const char *, void *, size_t);
 	ssize_t (*listxattr) (struct dentry *, char *, size_t);
 	int (*removexattr) (struct dentry *, const char *);
+	int (*sync_flags) (struct inode *, int, int);
 	void (*truncate_range)(struct inode *, loff_t, loff_t);
 	long (*fallocate)(struct inode *inode, int mode, loff_t offset,
 			  loff_t len);
@@ -1557,32 +1600,33 @@
 		unsigned long, loff_t *);
 extern ssize_t vfs_writev(struct file *, const struct iovec __user *,
 		unsigned long, loff_t *);
+ssize_t vfs_sendfile(struct file *, struct file *, loff_t *, size_t, loff_t);
 
 struct super_operations {
-   	struct inode *(*alloc_inode)(struct super_block *sb);
-	void (*destroy_inode)(struct inode *);
+   	struct inode *(* const alloc_inode)(struct super_block *sb);
+	void (* const destroy_inode)(struct inode *);
 
-   	void (*dirty_inode) (struct inode *);
-	int (*write_inode) (struct inode *, int);
-	void (*drop_inode) (struct inode *);
-	void (*delete_inode) (struct inode *);
-	void (*put_super) (struct super_block *);
-	void (*write_super) (struct super_block *);
-	int (*sync_fs)(struct super_block *sb, int wait);
-	int (*freeze_fs) (struct super_block *);
-	int (*unfreeze_fs) (struct super_block *);
-	int (*statfs) (struct dentry *, struct kstatfs *);
-	int (*remount_fs) (struct super_block *, int *, char *);
-	void (*clear_inode) (struct inode *);
-	void (*umount_begin) (struct super_block *);
+   	void (* const dirty_inode) (struct inode *);
+	int (* const write_inode) (struct inode *, int);
+	void (* const drop_inode) (struct inode *);
+	void (* const delete_inode) (struct inode *);
+	void (* const put_super) (struct super_block *);
+	void (* const write_super) (struct super_block *);
+	int (* const sync_fs)(struct super_block *sb, int wait);
+	int (* const freeze_fs) (struct super_block *);
+	int (* const unfreeze_fs) (struct super_block *);
+	int (* const statfs) (struct dentry *, struct kstatfs *);
+	int (* const remount_fs) (struct super_block *, int *, char *);
+	void (* const clear_inode) (struct inode *);
+	void (* const umount_begin) (struct super_block *);
 
-	int (*show_options)(struct seq_file *, struct vfsmount *);
-	int (*show_stats)(struct seq_file *, struct vfsmount *);
+	int (* const show_options)(struct seq_file *, struct vfsmount *);
+	int (* const show_stats)(struct seq_file *, struct vfsmount *);
 #ifdef CONFIG_QUOTA
-	ssize_t (*quota_read)(struct super_block *, int, char *, size_t, loff_t);
-	ssize_t (*quota_write)(struct super_block *, int, const char *, size_t, loff_t);
+	ssize_t (* const quota_read)(struct super_block *, int, char *, size_t, loff_t);
+	ssize_t (* const quota_write)(struct super_block *, int, const char *, size_t, loff_t);
 #endif
-	int (*bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
+	int (* const bdev_try_to_free_page)(struct super_block*, struct page*, gfp_t);
 };
 
 /*
@@ -2356,6 +2400,7 @@
 extern int dcache_dir_close(struct inode *, struct file *);
 extern loff_t dcache_dir_lseek(struct file *, loff_t, int);
 extern int dcache_readdir(struct file *, void *, filldir_t);
+extern int dcache_readdir_filter(struct file *, void *, filldir_t, int (*)(struct dentry *));
 extern int simple_getattr(struct vfsmount *, struct dentry *, struct kstat *);
 extern int simple_statfs(struct dentry *, struct kstatfs *);
 extern int simple_link(struct dentry *, struct inode *, struct dentry *);
diff -uriN linux-2.6.32.43/include/linux/fs_struct.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/fs_struct.h
--- linux-2.6.32.43/include/linux/fs_struct.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/fs_struct.h	2011-07-15 05:51:19.000000000 -0500
@@ -4,7 +4,7 @@
 #include <linux/path.h>
 
 struct fs_struct {
-	int users;
+	atomic_t users;
 	rwlock_t lock;
 	int umask;
 	int in_exec;
diff -uriN linux-2.6.32.43/include/linux/ftrace_event.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ftrace_event.h
--- linux-2.6.32.43/include/linux/ftrace_event.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ftrace_event.h	2011-07-15 05:51:19.000000000 -0500
@@ -163,7 +163,7 @@
 			      int filter_type);
 extern int trace_define_common_fields(struct ftrace_event_call *call);
 
-#define is_signed_type(type)	(((type)(-1)) < 0)
+#define is_signed_type(type)	(((type)(-1)) < (type)1)
 
 int trace_set_clr_event(const char *system, const char *event, int set);
 
diff -uriN linux-2.6.32.43/include/linux/genhd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/genhd.h
--- linux-2.6.32.43/include/linux/genhd.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/genhd.h	2011-07-15 05:51:19.000000000 -0500
@@ -161,7 +161,7 @@
 
 	struct timer_rand_state *random;
 
-	atomic_t sync_io;		/* RAID */
+	atomic_unchecked_t sync_io;	/* RAID */
 	struct work_struct async_notify;
 #ifdef  CONFIG_BLK_DEV_INTEGRITY
 	struct blk_integrity *integrity;
diff -uriN linux-2.6.32.43/include/linux/gfs2_ondisk.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/gfs2_ondisk.h
--- linux-2.6.32.43/include/linux/gfs2_ondisk.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/gfs2_ondisk.h	2011-07-15 05:50:11.000000000 -0500
@@ -235,6 +235,9 @@
 	gfs2fl_NoAtime		= 7,
 	gfs2fl_Sync		= 8,
 	gfs2fl_System		= 9,
+	gfs2fl_IXUnlink		= 16,
+	gfs2fl_Barrier		= 17,
+	gfs2fl_Cow		= 18,
 	gfs2fl_TruncInProg	= 29,
 	gfs2fl_InheritDirectio	= 30,
 	gfs2fl_InheritJdata	= 31,
@@ -251,6 +254,9 @@
 #define GFS2_DIF_NOATIME		0x00000080
 #define GFS2_DIF_SYNC			0x00000100
 #define GFS2_DIF_SYSTEM			0x00000200 /* New in gfs2 */
+#define GFS2_DIF_IXUNLINK		0x00010000
+#define GFS2_DIF_BARRIER		0x00020000
+#define GFS2_DIF_COW			0x00040000
 #define GFS2_DIF_TRUNC_IN_PROG		0x20000000 /* New in gfs2 */
 #define GFS2_DIF_INHERIT_DIRECTIO	0x40000000
 #define GFS2_DIF_INHERIT_JDATA		0x80000000
diff -uriN linux-2.6.32.43/include/linux/gracl.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/gracl.h
--- linux-2.6.32.43/include/linux/gracl.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/gracl.h	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1,317 @@
+#ifndef GR_ACL_H
+#define GR_ACL_H
+
+#include <linux/grdefs.h>
+#include <linux/resource.h>
+#include <linux/capability.h>
+#include <linux/dcache.h>
+#include <asm/resource.h>
+
+/* Major status information */
+
+#define GR_VERSION  "grsecurity 2.2.2"
+#define GRSECURITY_VERSION 0x2202
+
+enum {
+	GR_SHUTDOWN = 0,
+	GR_ENABLE = 1,
+	GR_SPROLE = 2,
+	GR_RELOAD = 3,
+	GR_SEGVMOD = 4,
+	GR_STATUS = 5,
+	GR_UNSPROLE = 6,
+	GR_PASSSET = 7,
+	GR_SPROLEPAM = 8,
+};
+
+/* Password setup definitions
+ * kernel/grhash.c */
+enum {
+	GR_PW_LEN = 128,
+	GR_SALT_LEN = 16,
+	GR_SHA_LEN = 32,
+};
+
+enum {
+	GR_SPROLE_LEN = 64,
+};
+
+enum {
+	GR_NO_GLOB = 0,
+	GR_REG_GLOB,
+	GR_CREATE_GLOB
+};
+
+#define GR_NLIMITS 32
+
+/* Begin Data Structures */
+
+struct sprole_pw {
+	unsigned char *rolename;
+	unsigned char salt[GR_SALT_LEN];
+	unsigned char sum[GR_SHA_LEN];	/* 256-bit SHA hash of the password */
+};
+
+struct name_entry {
+	__u32 key;
+	ino_t inode;
+	dev_t device;
+	char *name;
+	__u16 len;
+	__u8 deleted;
+	struct name_entry *prev;
+	struct name_entry *next;
+};
+
+struct inodev_entry {
+	struct name_entry *nentry;
+	struct inodev_entry *prev;
+	struct inodev_entry *next;
+};
+
+struct acl_role_db {
+	struct acl_role_label **r_hash;
+	__u32 r_size;
+};
+
+struct inodev_db {
+	struct inodev_entry **i_hash;
+	__u32 i_size;
+};
+
+struct name_db {
+	struct name_entry **n_hash;
+	__u32 n_size;
+};
+
+struct crash_uid {
+	uid_t uid;
+	unsigned long expires;
+};
+
+struct gr_hash_struct {
+	void **table;
+	void **nametable;
+	void *first;
+	__u32 table_size;
+	__u32 used_size;
+	int type;
+};
+
+/* Userspace Grsecurity ACL data structures */
+
+struct acl_subject_label {
+	char *filename;
+	ino_t inode;
+	dev_t device;
+	__u32 mode;
+	kernel_cap_t cap_mask;
+	kernel_cap_t cap_lower;
+	kernel_cap_t cap_invert_audit;
+
+	struct rlimit res[GR_NLIMITS];
+	__u32 resmask;
+
+	__u8 user_trans_type;
+	__u8 group_trans_type;
+	uid_t *user_transitions;
+	gid_t *group_transitions;
+	__u16 user_trans_num;
+	__u16 group_trans_num;
+
+	__u32 sock_families[2];
+	__u32 ip_proto[8];
+	__u32 ip_type;
+	struct acl_ip_label **ips;
+	__u32 ip_num;
+	__u32 inaddr_any_override;
+
+	__u32 crashes;
+	unsigned long expires;
+
+	struct acl_subject_label *parent_subject;
+	struct gr_hash_struct *hash;
+	struct acl_subject_label *prev;
+	struct acl_subject_label *next;
+
+	struct acl_object_label **obj_hash;
+	__u32 obj_hash_size;
+	__u16 pax_flags;
+};
+
+struct role_allowed_ip {
+	__u32 addr;
+	__u32 netmask;
+
+	struct role_allowed_ip *prev;
+	struct role_allowed_ip *next;
+};
+
+struct role_transition {
+	char *rolename;
+
+	struct role_transition *prev;
+	struct role_transition *next;
+};
+
+struct acl_role_label {
+	char *rolename;
+	uid_t uidgid;
+	__u16 roletype;
+
+	__u16 auth_attempts;
+	unsigned long expires;
+
+	struct acl_subject_label *root_label;
+	struct gr_hash_struct *hash;
+
+	struct acl_role_label *prev;
+	struct acl_role_label *next;
+
+	struct role_transition *transitions;
+	struct role_allowed_ip *allowed_ips;
+	uid_t *domain_children;
+	__u16 domain_child_num;
+
+	struct acl_subject_label **subj_hash;
+	__u32 subj_hash_size;
+};
+
+struct user_acl_role_db {
+	struct acl_role_label **r_table;
+	__u32 num_pointers;		/* Number of allocations to track */
+	__u32 num_roles;		/* Number of roles */
+	__u32 num_domain_children;	/* Number of domain children */
+	__u32 num_subjects;		/* Number of subjects */
+	__u32 num_objects;		/* Number of objects */
+};
+
+struct acl_object_label {
+	char *filename;
+	ino_t inode;
+	dev_t device;
+	__u32 mode;
+
+	struct acl_subject_label *nested;
+	struct acl_object_label *globbed;
+
+	/* next two structures not used */
+
+	struct acl_object_label *prev;
+	struct acl_object_label *next;
+};
+
+struct acl_ip_label {
+	char *iface;
+	__u32 addr;
+	__u32 netmask;
+	__u16 low, high;
+	__u8 mode;
+	__u32 type;
+	__u32 proto[8];
+
+	/* next two structures not used */
+
+	struct acl_ip_label *prev;
+	struct acl_ip_label *next;
+};
+
+struct gr_arg {
+	struct user_acl_role_db role_db;
+	unsigned char pw[GR_PW_LEN];
+	unsigned char salt[GR_SALT_LEN];
+	unsigned char sum[GR_SHA_LEN];
+	unsigned char sp_role[GR_SPROLE_LEN];
+	struct sprole_pw *sprole_pws;
+	dev_t segv_device;
+	ino_t segv_inode;
+	uid_t segv_uid;
+	__u16 num_sprole_pws;
+	__u16 mode;
+};
+
+struct gr_arg_wrapper {
+	struct gr_arg *arg;
+	__u32 version;
+	__u32 size;
+};
+
+struct subject_map {
+	struct acl_subject_label *user;
+	struct acl_subject_label *kernel;
+	struct subject_map *prev;
+	struct subject_map *next;
+};
+
+struct acl_subj_map_db {
+	struct subject_map **s_hash;
+	__u32 s_size;
+};
+
+/* End Data Structures Section */
+
+/* Hash functions generated by empirical testing by Brad Spengler
+   Makes good use of the low bits of the inode.  Generally 0-1 times
+   in loop for successful match.  0-3 for unsuccessful match.
+   Shift/add algorithm with modulus of table size and an XOR*/
+
+static __inline__ unsigned int
+rhash(const uid_t uid, const __u16 type, const unsigned int sz)
+{
+	return ((((uid + type) << (16 + type)) ^ uid) % sz);
+}
+
+ static __inline__ unsigned int
+shash(const struct acl_subject_label *userp, const unsigned int sz)
+{
+	return ((const unsigned long)userp % sz);
+}
+
+static __inline__ unsigned int
+fhash(const ino_t ino, const dev_t dev, const unsigned int sz)
+{
+	return (((ino + dev) ^ ((ino << 13) + (ino << 23) + (dev << 9))) % sz);
+}
+
+static __inline__ unsigned int
+nhash(const char *name, const __u16 len, const unsigned int sz)
+{
+	return full_name_hash((const unsigned char *)name, len) % sz;
+}
+
+#define FOR_EACH_ROLE_START(role) \
+	role = role_list; \
+	while (role) {
+
+#define FOR_EACH_ROLE_END(role) \
+		role = role->prev; \
+	}
+
+#define FOR_EACH_SUBJECT_START(role,subj,iter) \
+	subj = NULL; \
+	iter = 0; \
+	while (iter < role->subj_hash_size) { \
+		if (subj == NULL) \
+			subj = role->subj_hash[iter]; \
+		if (subj == NULL) { \
+			iter++; \
+			continue; \
+		}
+
+#define FOR_EACH_SUBJECT_END(subj,iter) \
+		subj = subj->next; \
+		if (subj == NULL) \
+			iter++; \
+	}
+
+
+#define FOR_EACH_NESTED_SUBJECT_START(role,subj) \
+	subj = role->hash->first; \
+	while (subj != NULL) {
+
+#define FOR_EACH_NESTED_SUBJECT_END(subj) \
+		subj = subj->next; \
+	}
+
+#endif
+
diff -uriN linux-2.6.32.43/include/linux/gralloc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/gralloc.h
--- linux-2.6.32.43/include/linux/gralloc.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/gralloc.h	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1,9 @@
+#ifndef __GRALLOC_H
+#define __GRALLOC_H
+
+void acl_free_all(void);
+int acl_alloc_stack_init(unsigned long size);
+void *acl_alloc(unsigned long len);
+void *acl_alloc_num(unsigned long num, unsigned long len);
+
+#endif
diff -uriN linux-2.6.32.43/include/linux/grdefs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/grdefs.h
--- linux-2.6.32.43/include/linux/grdefs.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/grdefs.h	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1,140 @@
+#ifndef GRDEFS_H
+#define GRDEFS_H
+
+/* Begin grsecurity status declarations */
+
+enum {
+	GR_READY = 0x01,
+	GR_STATUS_INIT = 0x00	// disabled state
+};
+
+/* Begin  ACL declarations */
+
+/* Role flags */
+
+enum {
+	GR_ROLE_USER = 0x0001,
+	GR_ROLE_GROUP = 0x0002,
+	GR_ROLE_DEFAULT = 0x0004,
+	GR_ROLE_SPECIAL = 0x0008,
+	GR_ROLE_AUTH = 0x0010,
+	GR_ROLE_NOPW = 0x0020,
+	GR_ROLE_GOD = 0x0040,
+	GR_ROLE_LEARN = 0x0080,
+	GR_ROLE_TPE = 0x0100,
+	GR_ROLE_DOMAIN = 0x0200,
+	GR_ROLE_PAM = 0x0400,
+	GR_ROLE_PERSIST = 0x800
+};
+
+/* ACL Subject and Object mode flags */
+enum {
+	GR_DELETED = 0x80000000
+};
+
+/* ACL Object-only mode flags */
+enum {
+	GR_READ 	= 0x00000001,
+	GR_APPEND 	= 0x00000002,
+	GR_WRITE 	= 0x00000004,
+	GR_EXEC 	= 0x00000008,
+	GR_FIND 	= 0x00000010,
+	GR_INHERIT 	= 0x00000020,
+	GR_SETID 	= 0x00000040,
+	GR_CREATE 	= 0x00000080,
+	GR_DELETE 	= 0x00000100,
+	GR_LINK		= 0x00000200,
+	GR_AUDIT_READ 	= 0x00000400,
+	GR_AUDIT_APPEND = 0x00000800,
+	GR_AUDIT_WRITE 	= 0x00001000,
+	GR_AUDIT_EXEC 	= 0x00002000,
+	GR_AUDIT_FIND 	= 0x00004000,
+	GR_AUDIT_INHERIT= 0x00008000,
+	GR_AUDIT_SETID 	= 0x00010000,
+	GR_AUDIT_CREATE = 0x00020000,
+	GR_AUDIT_DELETE = 0x00040000,
+	GR_AUDIT_LINK	= 0x00080000,
+	GR_PTRACERD 	= 0x00100000,
+	GR_NOPTRACE	= 0x00200000,
+	GR_SUPPRESS 	= 0x00400000,
+	GR_NOLEARN 	= 0x00800000,
+	GR_INIT_TRANSFER= 0x01000000
+};
+
+#define GR_AUDITS (GR_AUDIT_READ | GR_AUDIT_WRITE | GR_AUDIT_APPEND | GR_AUDIT_EXEC | \
+		   GR_AUDIT_FIND | GR_AUDIT_INHERIT | GR_AUDIT_SETID | \
+		   GR_AUDIT_CREATE | GR_AUDIT_DELETE | GR_AUDIT_LINK)
+
+/* ACL subject-only mode flags */
+enum {
+	GR_KILL 	= 0x00000001,
+	GR_VIEW 	= 0x00000002,
+	GR_PROTECTED 	= 0x00000004,
+	GR_LEARN 	= 0x00000008,
+	GR_OVERRIDE 	= 0x00000010,
+	/* just a placeholder, this mode is only used in userspace */
+	GR_DUMMY 	= 0x00000020,
+	GR_PROTSHM	= 0x00000040,
+	GR_KILLPROC	= 0x00000080,
+	GR_KILLIPPROC	= 0x00000100,
+	/* just a placeholder, this mode is only used in userspace */
+	GR_NOTROJAN	= 0x00000200,
+	GR_PROTPROCFD	= 0x00000400,
+	GR_PROCACCT	= 0x00000800,
+	GR_RELAXPTRACE	= 0x00001000,
+	GR_NESTED	= 0x00002000,
+	GR_INHERITLEARN	= 0x00004000,
+	GR_PROCFIND	= 0x00008000,
+	GR_POVERRIDE	= 0x00010000,
+	GR_KERNELAUTH	= 0x00020000,
+	GR_ATSECURE	= 0x00040000,
+	GR_SHMEXEC	= 0x00080000
+};
+
+enum {
+	GR_PAX_ENABLE_SEGMEXEC	= 0x0001,
+	GR_PAX_ENABLE_PAGEEXEC	= 0x0002,
+	GR_PAX_ENABLE_MPROTECT	= 0x0004,
+	GR_PAX_ENABLE_RANDMMAP	= 0x0008,
+	GR_PAX_ENABLE_EMUTRAMP	= 0x0010,
+	GR_PAX_DISABLE_SEGMEXEC	= 0x0100,
+	GR_PAX_DISABLE_PAGEEXEC	= 0x0200,
+	GR_PAX_DISABLE_MPROTECT	= 0x0400,
+	GR_PAX_DISABLE_RANDMMAP	= 0x0800,
+	GR_PAX_DISABLE_EMUTRAMP	= 0x1000,
+};
+
+enum {
+	GR_ID_USER	= 0x01,
+	GR_ID_GROUP	= 0x02,
+};
+
+enum {
+	GR_ID_ALLOW	= 0x01,
+	GR_ID_DENY	= 0x02,
+};
+
+#define GR_CRASH_RES	31
+#define GR_UIDTABLE_MAX 500
+
+/* begin resource learning section */
+enum {
+	GR_RLIM_CPU_BUMP = 60,
+	GR_RLIM_FSIZE_BUMP = 50000,
+	GR_RLIM_DATA_BUMP = 10000,
+	GR_RLIM_STACK_BUMP = 1000,
+	GR_RLIM_CORE_BUMP = 10000,
+	GR_RLIM_RSS_BUMP = 500000,
+	GR_RLIM_NPROC_BUMP = 1,
+	GR_RLIM_NOFILE_BUMP = 5,
+	GR_RLIM_MEMLOCK_BUMP = 50000,
+	GR_RLIM_AS_BUMP = 500000,
+	GR_RLIM_LOCKS_BUMP = 2,
+	GR_RLIM_SIGPENDING_BUMP = 5,
+	GR_RLIM_MSGQUEUE_BUMP = 10000,
+	GR_RLIM_NICE_BUMP = 1,
+	GR_RLIM_RTPRIO_BUMP = 1,
+	GR_RLIM_RTTIME_BUMP = 1000000
+};
+
+#endif
diff -uriN linux-2.6.32.43/include/linux/grinternal.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/grinternal.h
--- linux-2.6.32.43/include/linux/grinternal.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/grinternal.h	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1,218 @@
+#ifndef __GRINTERNAL_H
+#define __GRINTERNAL_H
+
+#ifdef CONFIG_GRKERNSEC
+
+#include <linux/fs.h>
+#include <linux/mnt_namespace.h>
+#include <linux/nsproxy.h>
+#include <linux/gracl.h>
+#include <linux/grdefs.h>
+#include <linux/grmsg.h>
+
+void gr_add_learn_entry(const char *fmt, ...)
+	__attribute__ ((format (printf, 1, 2)));
+__u32 gr_search_file(const struct dentry *dentry, const __u32 mode,
+			    const struct vfsmount *mnt);
+__u32 gr_check_create(const struct dentry *new_dentry,
+			     const struct dentry *parent,
+			     const struct vfsmount *mnt, const __u32 mode);
+int gr_check_protected_task(const struct task_struct *task);
+__u32 to_gr_audit(const __u32 reqmode);
+int gr_set_acls(const int type);
+int gr_apply_subject_to_task(struct task_struct *task);
+int gr_acl_is_enabled(void);
+char gr_roletype_to_char(void);
+
+void gr_handle_alertkill(struct task_struct *task);
+char *gr_to_filename(const struct dentry *dentry,
+			    const struct vfsmount *mnt);
+char *gr_to_filename1(const struct dentry *dentry,
+			    const struct vfsmount *mnt);
+char *gr_to_filename2(const struct dentry *dentry,
+			    const struct vfsmount *mnt);
+char *gr_to_filename3(const struct dentry *dentry,
+			    const struct vfsmount *mnt);
+
+extern int grsec_enable_harden_ptrace;
+extern int grsec_enable_link;
+extern int grsec_enable_fifo;
+extern int grsec_enable_execve;
+extern int grsec_enable_shm;
+extern int grsec_enable_execlog;
+extern int grsec_enable_signal;
+extern int grsec_enable_audit_ptrace;
+extern int grsec_enable_forkfail;
+extern int grsec_enable_time;
+extern int grsec_enable_rofs;
+extern int grsec_enable_chroot_shmat;
+extern int grsec_enable_chroot_mount;
+extern int grsec_enable_chroot_double;
+extern int grsec_enable_chroot_pivot;
+extern int grsec_enable_chroot_chdir;
+extern int grsec_enable_chroot_chmod;
+extern int grsec_enable_chroot_mknod;
+extern int grsec_enable_chroot_fchdir;
+extern int grsec_enable_chroot_nice;
+extern int grsec_enable_chroot_execlog;
+extern int grsec_enable_chroot_caps;
+extern int grsec_enable_chroot_sysctl;
+extern int grsec_enable_chroot_unix;
+extern int grsec_enable_tpe;
+extern int grsec_tpe_gid;
+extern int grsec_enable_tpe_all;
+extern int grsec_enable_tpe_invert;
+extern int grsec_enable_socket_all;
+extern int grsec_socket_all_gid;
+extern int grsec_enable_socket_client;
+extern int grsec_socket_client_gid;
+extern int grsec_enable_socket_server;
+extern int grsec_socket_server_gid;
+extern int grsec_audit_gid;
+extern int grsec_enable_group;
+extern int grsec_enable_audit_textrel;
+extern int grsec_enable_log_rwxmaps;
+extern int grsec_enable_mount;
+extern int grsec_enable_chdir;
+extern int grsec_resource_logging;
+extern int grsec_enable_blackhole;
+extern int grsec_lastack_retries;
+extern int grsec_enable_brute;
+extern int grsec_lock;
+
+extern spinlock_t grsec_alert_lock;
+extern unsigned long grsec_alert_wtime;
+extern unsigned long grsec_alert_fyet;
+
+extern spinlock_t grsec_audit_lock;
+
+extern rwlock_t grsec_exec_file_lock;
+
+#define gr_task_fullpath(tsk) ((tsk)->exec_file ? \
+			gr_to_filename2((tsk)->exec_file->f_path.dentry, \
+			(tsk)->exec_file->f_vfsmnt) : "/")
+
+#define gr_parent_task_fullpath(tsk) ((tsk)->real_parent->exec_file ? \
+			gr_to_filename3((tsk)->real_parent->exec_file->f_path.dentry, \
+			(tsk)->real_parent->exec_file->f_vfsmnt) : "/")
+
+#define gr_task_fullpath0(tsk) ((tsk)->exec_file ? \
+			gr_to_filename((tsk)->exec_file->f_path.dentry, \
+			(tsk)->exec_file->f_vfsmnt) : "/")
+
+#define gr_parent_task_fullpath0(tsk) ((tsk)->real_parent->exec_file ? \
+			gr_to_filename1((tsk)->real_parent->exec_file->f_path.dentry, \
+			(tsk)->real_parent->exec_file->f_vfsmnt) : "/")
+
+#define proc_is_chrooted(tsk_a)  ((tsk_a)->gr_is_chrooted)
+
+#define have_same_root(tsk_a,tsk_b) ((tsk_a)->gr_chroot_dentry == (tsk_b)->gr_chroot_dentry)
+
+#define DEFAULTSECARGS(task, cred, pcred) gr_task_fullpath(task), (task)->comm, \
+		       (task)->pid, (cred)->uid, \
+		       (cred)->euid, (cred)->gid, (cred)->egid, \
+		       gr_parent_task_fullpath(task), \
+		       (task)->real_parent->comm, (task)->real_parent->pid, \
+		       (pcred)->uid, (pcred)->euid, \
+		       (pcred)->gid, (pcred)->egid
+
+#define GR_CHROOT_CAPS {{ \
+	CAP_TO_MASK(CAP_LINUX_IMMUTABLE) | CAP_TO_MASK(CAP_NET_ADMIN) | \
+	CAP_TO_MASK(CAP_SYS_MODULE) | CAP_TO_MASK(CAP_SYS_RAWIO) | \
+	CAP_TO_MASK(CAP_SYS_PACCT) | CAP_TO_MASK(CAP_SYS_ADMIN) | \
+	CAP_TO_MASK(CAP_SYS_BOOT) | CAP_TO_MASK(CAP_SYS_TIME) | \
+	CAP_TO_MASK(CAP_NET_RAW) | CAP_TO_MASK(CAP_SYS_TTY_CONFIG) | \
+	CAP_TO_MASK(CAP_IPC_OWNER) , 0 }}
+
+#define security_learn(normal_msg,args...) \
+({ \
+	read_lock(&grsec_exec_file_lock); \
+	gr_add_learn_entry(normal_msg "\n", ## args); \
+	read_unlock(&grsec_exec_file_lock); \
+})
+
+enum {
+	GR_DO_AUDIT,
+	GR_DONT_AUDIT,
+	GR_DONT_AUDIT_GOOD
+};
+
+enum {
+	GR_TTYSNIFF,
+	GR_RBAC,
+	GR_RBAC_STR,
+	GR_STR_RBAC,
+	GR_RBAC_MODE2,
+	GR_RBAC_MODE3,
+	GR_FILENAME,
+	GR_SYSCTL_HIDDEN,
+	GR_NOARGS,
+	GR_ONE_INT,
+	GR_ONE_INT_TWO_STR,
+	GR_ONE_STR,
+	GR_STR_INT,
+	GR_TWO_STR_INT,
+	GR_TWO_INT,
+	GR_TWO_U64,
+	GR_THREE_INT,
+	GR_FIVE_INT_TWO_STR,
+	GR_TWO_STR,
+	GR_THREE_STR,
+	GR_FOUR_STR,
+	GR_STR_FILENAME,
+	GR_FILENAME_STR,
+	GR_FILENAME_TWO_INT,
+	GR_FILENAME_TWO_INT_STR,
+	GR_TEXTREL,
+	GR_PTRACE,
+	GR_RESOURCE,
+	GR_CAP,
+	GR_SIG,
+	GR_SIG2,
+	GR_CRASH1,
+	GR_CRASH2,
+	GR_PSACCT,
+	GR_RWXMAP
+};
+
+#define gr_log_hidden_sysctl(audit, msg, str) gr_log_varargs(audit, msg, GR_SYSCTL_HIDDEN, str)
+#define gr_log_ttysniff(audit, msg, task) gr_log_varargs(audit, msg, GR_TTYSNIFF, task)
+#define gr_log_fs_rbac_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_RBAC, dentry, mnt)
+#define gr_log_fs_rbac_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_RBAC_STR, dentry, mnt, str)
+#define gr_log_fs_str_rbac(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_RBAC, str, dentry, mnt)
+#define gr_log_fs_rbac_mode2(audit, msg, dentry, mnt, str1, str2) gr_log_varargs(audit, msg, GR_RBAC_MODE2, dentry, mnt, str1, str2)
+#define gr_log_fs_rbac_mode3(audit, msg, dentry, mnt, str1, str2, str3) gr_log_varargs(audit, msg, GR_RBAC_MODE3, dentry, mnt, str1, str2, str3)
+#define gr_log_fs_generic(audit, msg, dentry, mnt) gr_log_varargs(audit, msg, GR_FILENAME, dentry, mnt)
+#define gr_log_noargs(audit, msg) gr_log_varargs(audit, msg, GR_NOARGS)
+#define gr_log_int(audit, msg, num) gr_log_varargs(audit, msg, GR_ONE_INT, num)
+#define gr_log_int_str2(audit, msg, num, str1, str2) gr_log_varargs(audit, msg, GR_ONE_INT_TWO_STR, num, str1, str2)
+#define gr_log_str(audit, msg, str) gr_log_varargs(audit, msg, GR_ONE_STR, str)
+#define gr_log_str_int(audit, msg, str, num) gr_log_varargs(audit, msg, GR_STR_INT, str, num)
+#define gr_log_int_int(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_INT, num1, num2)
+#define gr_log_two_u64(audit, msg, num1, num2) gr_log_varargs(audit, msg, GR_TWO_U64, num1, num2)
+#define gr_log_int3(audit, msg, num1, num2, num3) gr_log_varargs(audit, msg, GR_THREE_INT, num1, num2, num3)
+#define gr_log_int5_str2(audit, msg, num1, num2, str1, str2) gr_log_varargs(audit, msg, GR_FIVE_INT_TWO_STR, num1, num2, str1, str2)
+#define gr_log_str_str(audit, msg, str1, str2) gr_log_varargs(audit, msg, GR_TWO_STR, str1, str2)
+#define gr_log_str2_int(audit, msg, str1, str2, num) gr_log_varargs(audit, msg, GR_TWO_STR_INT, str1, str2, num)
+#define gr_log_str3(audit, msg, str1, str2, str3) gr_log_varargs(audit, msg, GR_THREE_STR, str1, str2, str3)
+#define gr_log_str4(audit, msg, str1, str2, str3, str4) gr_log_varargs(audit, msg, GR_FOUR_STR, str1, str2, str3, str4)
+#define gr_log_str_fs(audit, msg, str, dentry, mnt) gr_log_varargs(audit, msg, GR_STR_FILENAME, str, dentry, mnt)
+#define gr_log_fs_str(audit, msg, dentry, mnt, str) gr_log_varargs(audit, msg, GR_FILENAME_STR, dentry, mnt, str)
+#define gr_log_fs_int2(audit, msg, dentry, mnt, num1, num2) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT, dentry, mnt, num1, num2)
+#define gr_log_fs_int2_str(audit, msg, dentry, mnt, num1, num2, str) gr_log_varargs(audit, msg, GR_FILENAME_TWO_INT_STR, dentry, mnt, num1, num2, str)
+#define gr_log_textrel_ulong_ulong(audit, msg, file, ulong1, ulong2) gr_log_varargs(audit, msg, GR_TEXTREL, file, ulong1, ulong2)
+#define gr_log_ptrace(audit, msg, task) gr_log_varargs(audit, msg, GR_PTRACE, task)
+#define gr_log_res_ulong2_str(audit, msg, task, ulong1, str, ulong2) gr_log_varargs(audit, msg, GR_RESOURCE, task, ulong1, str, ulong2)
+#define gr_log_cap(audit, msg, task, str) gr_log_varargs(audit, msg, GR_CAP, task, str)
+#define gr_log_sig_addr(audit, msg, str, addr) gr_log_varargs(audit, msg, GR_SIG, str, addr)
+#define gr_log_sig_task(audit, msg, task, num) gr_log_varargs(audit, msg, GR_SIG2, task, num)
+#define gr_log_crash1(audit, msg, task, ulong) gr_log_varargs(audit, msg, GR_CRASH1, task, ulong)
+#define gr_log_crash2(audit, msg, task, ulong1) gr_log_varargs(audit, msg, GR_CRASH2, task, ulong1)
+#define gr_log_procacct(audit, msg, task, num1, num2, num3, num4, num5, num6, num7, num8, num9) gr_log_varargs(audit, msg, GR_PSACCT, task, num1, num2, num3, num4, num5, num6, num7, num8, num9)
+#define gr_log_rwxmap(audit, msg, str) gr_log_varargs(audit, msg, GR_RWXMAP, str)
+
+void gr_log_varargs(int audit, const char *msg, int argtypes, ...);
+
+#endif
+
+#endif
diff -uriN linux-2.6.32.43/include/linux/grmsg.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/grmsg.h
--- linux-2.6.32.43/include/linux/grmsg.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/grmsg.h	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1,108 @@
+#define DEFAULTSECMSG "%.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u, parent %.256s[%.16s:%d] uid/euid:%u/%u gid/egid:%u/%u"
+#define GR_ACL_PROCACCT_MSG "%.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u run time:[%ud %uh %um %us] cpu time:[%ud %uh %um %us] %s with exit code %ld, parent %.256s[%.16s:%d] IP:%pI4 TTY:%.64s uid/euid:%u/%u gid/egid:%u/%u"
+#define GR_PTRACE_ACL_MSG "denied ptrace of %.950s(%.16s:%d) by "
+#define GR_STOPMOD_MSG "denied modification of module state by "
+#define GR_ROFS_BLOCKWRITE_MSG "denied write to block device %.950s by "
+#define GR_ROFS_MOUNT_MSG "denied writable mount of %.950s by "
+#define GR_IOPERM_MSG "denied use of ioperm() by "
+#define GR_IOPL_MSG "denied use of iopl() by "
+#define GR_SHMAT_ACL_MSG "denied attach of shared memory of UID %u, PID %d, ID %u by "
+#define GR_UNIX_CHROOT_MSG "denied connect() to abstract AF_UNIX socket outside of chroot by "
+#define GR_SHMAT_CHROOT_MSG "denied attach of shared memory outside of chroot by "
+#define GR_MEM_READWRITE_MSG "denied access of range %Lx -> %Lx in /dev/mem by "
+#define GR_SYMLINK_MSG "not following symlink %.950s owned by %d.%d by "
+#define GR_LEARN_AUDIT_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%lu\t%lu\t%.4095s\t%lu\t%pI4"
+#define GR_ID_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%c\t%d\t%d\t%d\t%pI4"
+#define GR_HIDDEN_ACL_MSG "%s access to hidden file %.950s by "
+#define GR_OPEN_ACL_MSG "%s open of %.950s for%s%s by "
+#define GR_CREATE_ACL_MSG "%s create of %.950s for%s%s by "
+#define GR_FIFO_MSG "denied writing FIFO %.950s of %d.%d by "
+#define GR_MKNOD_CHROOT_MSG "denied mknod of %.950s from chroot by "
+#define GR_MKNOD_ACL_MSG "%s mknod of %.950s by "
+#define GR_UNIXCONNECT_ACL_MSG "%s connect() to the unix domain socket %.950s by "
+#define GR_TTYSNIFF_ACL_MSG "terminal being sniffed by IP:%pI4 %.480s[%.16s:%d], parent %.480s[%.16s:%d] against "
+#define GR_MKDIR_ACL_MSG "%s mkdir of %.950s by "
+#define GR_RMDIR_ACL_MSG "%s rmdir of %.950s by "
+#define GR_UNLINK_ACL_MSG "%s unlink of %.950s by "
+#define GR_SYMLINK_ACL_MSG "%s symlink from %.480s to %.480s by "
+#define GR_HARDLINK_MSG "denied hardlink of %.930s (owned by %d.%d) to %.30s for "
+#define GR_LINK_ACL_MSG "%s link of %.480s to %.480s by "
+#define GR_INHERIT_ACL_MSG "successful inherit of %.480s's ACL for %.480s by "
+#define GR_RENAME_ACL_MSG "%s rename of %.480s to %.480s by "
+#define GR_UNSAFESHARE_EXEC_ACL_MSG "denied exec with cloned fs of %.950s by "
+#define GR_PTRACE_EXEC_ACL_MSG "denied ptrace of %.950s by "
+#define GR_NPROC_MSG "denied overstep of process limit by "
+#define GR_EXEC_ACL_MSG "%s execution of %.950s by "
+#define GR_EXEC_TPE_MSG "denied untrusted exec of %.950s by "
+#define GR_SEGVSTART_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning uid %u from login for %lu seconds"
+#define GR_SEGVNOSUID_ACL_MSG "possible exploit bruteforcing on " DEFAULTSECMSG " banning execution for %lu seconds"
+#define GR_MOUNT_CHROOT_MSG "denied mount of %.256s as %.930s from chroot by "
+#define GR_PIVOT_CHROOT_MSG "denied pivot_root from chroot by "
+#define GR_TRUNCATE_ACL_MSG "%s truncate of %.950s by "
+#define GR_ATIME_ACL_MSG "%s access time change of %.950s by "
+#define GR_ACCESS_ACL_MSG "%s access of %.950s for%s%s%s by "
+#define GR_CHROOT_CHROOT_MSG "denied double chroot to %.950s by "
+#define GR_FCHMOD_ACL_MSG "%s fchmod of %.950s by "
+#define GR_CHMOD_CHROOT_MSG "denied chmod +s of %.950s by "
+#define GR_CHMOD_ACL_MSG "%s chmod of %.950s by "
+#define GR_CHROOT_FCHDIR_MSG "denied fchdir outside of chroot to %.950s by "
+#define GR_CHOWN_ACL_MSG "%s chown of %.950s by "
+#define GR_SETXATTR_ACL_MSG "%s setting extended attributes of %.950s by "
+#define GR_WRITLIB_ACL_MSG "denied load of writable library %.950s by "
+#define GR_INITF_ACL_MSG "init_variables() failed %s by "
+#define GR_DISABLED_ACL_MSG "Error loading %s, trying to run kernel with acls disabled. To disable acls at startup use <kernel image name> gracl=off from your boot loader"
+#define GR_DEV_ACL_MSG "/dev/grsec: %d bytes sent %d required, being fed garbaged by "
+#define GR_SHUTS_ACL_MSG "shutdown auth success for "
+#define GR_SHUTF_ACL_MSG "shutdown auth failure for "
+#define GR_SHUTI_ACL_MSG "ignoring shutdown for disabled RBAC system for "
+#define GR_SEGVMODS_ACL_MSG "segvmod auth success for "
+#define GR_SEGVMODF_ACL_MSG "segvmod auth failure for "
+#define GR_SEGVMODI_ACL_MSG "ignoring segvmod for disabled RBAC system for "
+#define GR_ENABLE_ACL_MSG "%s RBAC system loaded by "
+#define GR_ENABLEF_ACL_MSG "unable to load %s for "
+#define GR_RELOADI_ACL_MSG "ignoring reload request for disabled RBAC system"
+#define GR_RELOAD_ACL_MSG "%s RBAC system reloaded by "
+#define GR_RELOADF_ACL_MSG "failed reload of %s for "
+#define GR_SPROLEI_ACL_MSG "ignoring change to special role for disabled RBAC system for "
+#define GR_SPROLES_ACL_MSG "successful change to special role %s (id %d) by "
+#define GR_SPROLEL_ACL_MSG "special role %s (id %d) exited by "
+#define GR_SPROLEF_ACL_MSG "special role %s failure for "
+#define GR_UNSPROLEI_ACL_MSG "ignoring unauth of special role for disabled RBAC system for "
+#define GR_UNSPROLES_ACL_MSG "successful unauth of special role %s (id %d) by "
+#define GR_INVMODE_ACL_MSG "invalid mode %d by "
+#define GR_PRIORITY_CHROOT_MSG "denied priority change of process (%.16s:%d) by "
+#define GR_FAILFORK_MSG "failed fork with errno %s by "
+#define GR_NICE_CHROOT_MSG "denied priority change by "
+#define GR_UNISIGLOG_MSG "%.32s occurred at %p in "
+#define GR_DUALSIGLOG_MSG "signal %d sent to " DEFAULTSECMSG " by "
+#define GR_SIG_ACL_MSG "denied send of signal %d to protected task " DEFAULTSECMSG " by "
+#define GR_SYSCTL_MSG "denied modification of grsecurity sysctl value : %.32s by "
+#define GR_SYSCTL_ACL_MSG "%s sysctl of %.950s for%s%s by "
+#define GR_TIME_MSG "time set by "
+#define GR_DEFACL_MSG "fatal: unable to find subject for (%.16s:%d), loaded by "
+#define GR_MMAP_ACL_MSG "%s executable mmap of %.950s by "
+#define GR_MPROTECT_ACL_MSG "%s executable mprotect of %.950s by "
+#define GR_SOCK_MSG "denied socket(%.16s,%.16s,%.16s) by "
+#define GR_SOCK_NOINET_MSG "denied socket(%.16s,%.16s,%d) by "
+#define GR_BIND_MSG "denied bind() by "
+#define GR_CONNECT_MSG "denied connect() by "
+#define GR_BIND_ACL_MSG "denied bind() to %pI4 port %u sock type %.16s protocol %.16s by "
+#define GR_CONNECT_ACL_MSG "denied connect() to %pI4 port %u sock type %.16s protocol %.16s by "
+#define GR_IP_LEARN_MSG "%s\t%u\t%u\t%u\t%.4095s\t%.4095s\t%pI4\t%u\t%u\t%u\t%u\t%pI4"
+#define GR_EXEC_CHROOT_MSG "exec of %.980s within chroot by process "
+#define GR_CAP_ACL_MSG "use of %s denied for "
+#define GR_CAP_ACL_MSG2 "use of %s permitted for "
+#define GR_USRCHANGE_ACL_MSG "change to uid %u denied for "
+#define GR_GRPCHANGE_ACL_MSG "change to gid %u denied for "
+#define GR_REMOUNT_AUDIT_MSG "remount of %.256s by "
+#define GR_UNMOUNT_AUDIT_MSG "unmount of %.256s by "
+#define GR_MOUNT_AUDIT_MSG "mount of %.256s to %.256s by "
+#define GR_CHDIR_AUDIT_MSG "chdir to %.980s by "
+#define GR_EXEC_AUDIT_MSG "exec of %.930s (%.128s) by "
+#define GR_RESOURCE_MSG "denied resource overstep by requesting %lu for %.16s against limit %lu for "
+#define GR_RWXMMAP_MSG "denied RWX mmap of %.950s by "
+#define GR_RWXMPROTECT_MSG "denied RWX mprotect of %.950s by "
+#define GR_TEXTREL_AUDIT_MSG "text relocation in %s, VMA:0x%08lx 0x%08lx by "
+#define GR_VM86_MSG "denied use of vm86 by "
+#define GR_PTRACE_AUDIT_MSG "process %.950s(%.16s:%d) attached to via ptrace by "
+#define GR_INIT_TRANSFER_MSG "persistent special role transferred privilege to init by "
diff -uriN linux-2.6.32.43/include/linux/grsecurity.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/grsecurity.h
--- linux-2.6.32.43/include/linux/grsecurity.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/grsecurity.h	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1,215 @@
+#ifndef GR_SECURITY_H
+#define GR_SECURITY_H
+#include <linux/fs.h>
+#include <linux/fs_struct.h>
+#include <linux/binfmts.h>
+#include <linux/gracl.h>
+#include <linux/compat.h>
+
+/* notify of brain-dead configs */
+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_PAGEEXEC) && !defined(CONFIG_PAX_SEGMEXEC) && !defined(CONFIG_PAX_KERNEXEC)
+#error "CONFIG_PAX_NOEXEC enabled, but PAGEEXEC, SEGMEXEC, and KERNEXEC are disabled."
+#endif
+#if defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
+#error "CONFIG_PAX_NOEXEC enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
+#endif
+#if defined(CONFIG_PAX_ASLR) && (defined(CONFIG_PAX_RANDMMAP) || defined(CONFIG_PAX_RANDUSTACK)) && !defined(CONFIG_PAX_EI_PAX) && !defined(CONFIG_PAX_PT_PAX_FLAGS)
+#error "CONFIG_PAX_ASLR enabled, but neither CONFIG_PAX_EI_PAX nor CONFIG_PAX_PT_PAX_FLAGS are enabled."
+#endif
+#if defined(CONFIG_PAX_ASLR) && !defined(CONFIG_PAX_RANDKSTACK) && !defined(CONFIG_PAX_RANDUSTACK) && !defined(CONFIG_PAX_RANDMMAP)
+#error "CONFIG_PAX_ASLR enabled, but RANDKSTACK, RANDUSTACK, and RANDMMAP are disabled."
+#endif
+#if defined(CONFIG_PAX) && !defined(CONFIG_PAX_NOEXEC) && !defined(CONFIG_PAX_ASLR)
+#error "CONFIG_PAX enabled, but no PaX options are enabled."
+#endif
+
+void gr_handle_brute_attach(struct task_struct *p, unsigned long mm_flags);
+void gr_handle_brute_check(void);
+void gr_handle_kernel_exploit(void);
+int gr_process_user_ban(void);
+
+char gr_roletype_to_char(void);
+
+int gr_acl_enable_at_secure(void);
+
+int gr_check_user_change(int real, int effective, int fs);
+int gr_check_group_change(int real, int effective, int fs);
+
+void gr_del_task_from_ip_table(struct task_struct *p);
+
+int gr_pid_is_chrooted(struct task_struct *p);
+int gr_handle_chroot_fowner(struct pid *pid, enum pid_type type);
+int gr_handle_chroot_nice(void);
+int gr_handle_chroot_sysctl(const int op);
+int gr_handle_chroot_setpriority(struct task_struct *p,
+					const int niceval);
+int gr_chroot_fchdir(struct dentry *u_dentry, struct vfsmount *u_mnt);
+int gr_handle_chroot_chroot(const struct dentry *dentry,
+				   const struct vfsmount *mnt);
+int gr_handle_chroot_caps(struct path *path);
+void gr_handle_chroot_chdir(struct path *path);
+int gr_handle_chroot_chmod(const struct dentry *dentry,
+				  const struct vfsmount *mnt, const int mode);
+int gr_handle_chroot_mknod(const struct dentry *dentry,
+				  const struct vfsmount *mnt, const int mode);
+int gr_handle_chroot_mount(const struct dentry *dentry,
+				  const struct vfsmount *mnt,
+				  const char *dev_name);
+int gr_handle_chroot_pivot(void);
+int gr_handle_chroot_unix(const pid_t pid);
+
+int gr_handle_rawio(const struct inode *inode);
+int gr_handle_nproc(void);
+
+void gr_handle_ioperm(void);
+void gr_handle_iopl(void);
+
+int gr_tpe_allow(const struct file *file);
+
+void gr_set_chroot_entries(struct task_struct *task, struct path *path);
+void gr_clear_chroot_entries(struct task_struct *task);
+
+void gr_log_forkfail(const int retval);
+void gr_log_timechange(void);
+void gr_log_signal(const int sig, const void *addr, const struct task_struct *t);
+void gr_log_chdir(const struct dentry *dentry,
+			 const struct vfsmount *mnt);
+void gr_log_chroot_exec(const struct dentry *dentry,
+			       const struct vfsmount *mnt);
+void gr_handle_exec_args(struct linux_binprm *bprm, const char __user *const __user *argv);
+#ifdef CONFIG_COMPAT
+void gr_handle_exec_args_compat(struct linux_binprm *bprm, compat_uptr_t __user *argv);
+#endif
+void gr_log_remount(const char *devname, const int retval);
+void gr_log_unmount(const char *devname, const int retval);
+void gr_log_mount(const char *from, const char *to, const int retval);
+void gr_log_textrel(struct vm_area_struct *vma);
+void gr_log_rwxmmap(struct file *file);
+void gr_log_rwxmprotect(struct file *file);
+
+int gr_handle_follow_link(const struct inode *parent,
+				 const struct inode *inode,
+				 const struct dentry *dentry,
+				 const struct vfsmount *mnt);
+int gr_handle_fifo(const struct dentry *dentry,
+			  const struct vfsmount *mnt,
+			  const struct dentry *dir, const int flag,
+			  const int acc_mode);
+int gr_handle_hardlink(const struct dentry *dentry,
+			      const struct vfsmount *mnt,
+			      struct inode *inode,
+			      const int mode, const char *to);
+
+int gr_is_capable(const int cap);
+int gr_is_capable_nolog(const int cap);
+void gr_learn_resource(const struct task_struct *task, const int limit,
+			      const unsigned long wanted, const int gt);
+void gr_copy_label(struct task_struct *tsk);
+void gr_handle_crash(struct task_struct *task, const int sig);
+int gr_handle_signal(const struct task_struct *p, const int sig);
+int gr_check_crash_uid(const uid_t uid);
+int gr_check_protected_task(const struct task_struct *task);
+int gr_check_protected_task_fowner(struct pid *pid, enum pid_type type);
+int gr_acl_handle_mmap(const struct file *file,
+			      const unsigned long prot);
+int gr_acl_handle_mprotect(const struct file *file,
+				  const unsigned long prot);
+int gr_check_hidden_task(const struct task_struct *tsk);
+__u32 gr_acl_handle_truncate(const struct dentry *dentry,
+				    const struct vfsmount *mnt);
+__u32 gr_acl_handle_utime(const struct dentry *dentry,
+				 const struct vfsmount *mnt);
+__u32 gr_acl_handle_access(const struct dentry *dentry,
+				  const struct vfsmount *mnt, const int fmode);
+__u32 gr_acl_handle_fchmod(const struct dentry *dentry,
+				  const struct vfsmount *mnt, mode_t mode);
+__u32 gr_acl_handle_chmod(const struct dentry *dentry,
+				 const struct vfsmount *mnt, mode_t mode);
+__u32 gr_acl_handle_chown(const struct dentry *dentry,
+				 const struct vfsmount *mnt);
+__u32 gr_acl_handle_setxattr(const struct dentry *dentry,
+				 const struct vfsmount *mnt);
+int gr_handle_ptrace(struct task_struct *task, const long request);
+int gr_handle_proc_ptrace(struct task_struct *task);
+__u32 gr_acl_handle_execve(const struct dentry *dentry,
+				  const struct vfsmount *mnt);
+int gr_check_crash_exec(const struct file *filp);
+int gr_acl_is_enabled(void);
+void gr_set_kernel_label(struct task_struct *task);
+void gr_set_role_label(struct task_struct *task, const uid_t uid,
+			      const gid_t gid);
+int gr_set_proc_label(const struct dentry *dentry,
+			const struct vfsmount *mnt,
+			const int unsafe_share);
+__u32 gr_acl_handle_hidden_file(const struct dentry *dentry,
+				const struct vfsmount *mnt);
+__u32 gr_acl_handle_open(const struct dentry *dentry,
+				const struct vfsmount *mnt, const int fmode);
+__u32 gr_acl_handle_creat(const struct dentry *dentry,
+				 const struct dentry *p_dentry,
+				 const struct vfsmount *p_mnt, const int fmode,
+				 const int imode);
+void gr_handle_create(const struct dentry *dentry,
+			     const struct vfsmount *mnt);
+__u32 gr_acl_handle_mknod(const struct dentry *new_dentry,
+				 const struct dentry *parent_dentry,
+				 const struct vfsmount *parent_mnt,
+				 const int mode);
+__u32 gr_acl_handle_mkdir(const struct dentry *new_dentry,
+				 const struct dentry *parent_dentry,
+				 const struct vfsmount *parent_mnt);
+__u32 gr_acl_handle_rmdir(const struct dentry *dentry,
+				 const struct vfsmount *mnt);
+void gr_handle_delete(const ino_t ino, const dev_t dev);
+__u32 gr_acl_handle_unlink(const struct dentry *dentry,
+				  const struct vfsmount *mnt);
+__u32 gr_acl_handle_symlink(const struct dentry *new_dentry,
+				   const struct dentry *parent_dentry,
+				   const struct vfsmount *parent_mnt,
+				   const char *from);
+__u32 gr_acl_handle_link(const struct dentry *new_dentry,
+				const struct dentry *parent_dentry,
+				const struct vfsmount *parent_mnt,
+				const struct dentry *old_dentry,
+				const struct vfsmount *old_mnt, const char *to);
+int gr_acl_handle_rename(struct dentry *new_dentry,
+				struct dentry *parent_dentry,
+				const struct vfsmount *parent_mnt,
+				struct dentry *old_dentry,
+				struct inode *old_parent_inode,
+				struct vfsmount *old_mnt, const char *newname);
+void gr_handle_rename(struct inode *old_dir, struct inode *new_dir,
+				struct dentry *old_dentry,
+				struct dentry *new_dentry,
+				struct vfsmount *mnt, const __u8 replace);
+__u32 gr_check_link(const struct dentry *new_dentry,
+			   const struct dentry *parent_dentry,
+			   const struct vfsmount *parent_mnt,
+			   const struct dentry *old_dentry,
+			   const struct vfsmount *old_mnt);
+int gr_acl_handle_filldir(const struct file *file, const char *name,
+				 const unsigned int namelen, const ino_t ino);
+
+__u32 gr_acl_handle_unix(const struct dentry *dentry,
+				const struct vfsmount *mnt);
+void gr_acl_handle_exit(void);
+void gr_acl_handle_psacct(struct task_struct *task, const long code);
+int gr_acl_handle_procpidmem(const struct task_struct *task);
+int gr_handle_rofs_mount(struct dentry *dentry, struct vfsmount *mnt, int mnt_flags);
+int gr_handle_rofs_blockwrite(struct dentry *dentry, struct vfsmount *mnt, int acc_mode);
+void gr_audit_ptrace(struct task_struct *task);
+dev_t gr_get_dev_from_dentry(struct dentry *dentry);
+
+#ifdef CONFIG_GRKERNSEC
+void task_grsec_rbac(struct seq_file *m, struct task_struct *p);
+void gr_handle_vm86(void);
+void gr_handle_mem_readwrite(u64 from, u64 to);
+
+extern int grsec_enable_dmesg;
+extern int grsec_disable_privio;
+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
+extern int grsec_enable_chroot_findtask;
+#endif
+#endif
+
+#endif
diff -uriN linux-2.6.32.43/include/linux/hdpu_features.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/hdpu_features.h
--- linux-2.6.32.43/include/linux/hdpu_features.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/hdpu_features.h	2011-07-15 05:51:19.000000000 -0500
@@ -3,7 +3,7 @@
 struct cpustate_t {
 	spinlock_t lock;
 	int excl;
-        int open_count;
+	atomic_t open_count;
 	unsigned char cached_val;
 	int inited;
 	unsigned long *set_addr;
diff -uriN linux-2.6.32.43/include/linux/highmem.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/highmem.h
--- linux-2.6.32.43/include/linux/highmem.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/highmem.h	2011-07-15 05:51:19.000000000 -0500
@@ -137,6 +137,18 @@
 	kunmap_atomic(kaddr, KM_USER0);
 }
 
+static inline void sanitize_highpage(struct page *page)
+{
+	void *kaddr;
+	unsigned long flags;
+
+	local_irq_save(flags);
+	kaddr = kmap_atomic(page, KM_CLEARPAGE);
+	clear_page(kaddr);
+	kunmap_atomic(kaddr, KM_CLEARPAGE);
+	local_irq_restore(flags);
+}
+
 static inline void zero_user_segments(struct page *page,
 	unsigned start1, unsigned end1,
 	unsigned start2, unsigned end2)
diff -uriN linux-2.6.32.43/include/linux/i2o.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/i2o.h
--- linux-2.6.32.43/include/linux/i2o.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/i2o.h	2011-07-15 05:51:19.000000000 -0500
@@ -564,7 +564,7 @@
 	struct i2o_device *exec;	/* Executive */
 #if BITS_PER_LONG == 64
 	spinlock_t context_list_lock;	/* lock for context_list */
-	atomic_t context_list_counter;	/* needed for unique contexts */
+	atomic_unchecked_t context_list_counter;	/* needed for unique contexts */
 	struct list_head context_list;	/* list of context id's
 					   and pointers */
 #endif
diff -uriN linux-2.6.32.43/include/linux/if_tun.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/if_tun.h
--- linux-2.6.32.43/include/linux/if_tun.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/if_tun.h	2011-07-15 05:50:11.000000000 -0500
@@ -48,6 +48,7 @@
 #define TUNGETIFF      _IOR('T', 210, unsigned int)
 #define TUNGETSNDBUF   _IOR('T', 211, int)
 #define TUNSETSNDBUF   _IOW('T', 212, int)
+#define TUNSETNID     _IOW('T', 215, int)
 
 /* TUNSETIFF ifr flags */
 #define IFF_TUN		0x0001
diff -uriN linux-2.6.32.43/include/linux/init_task.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/init_task.h
--- linux-2.6.32.43/include/linux/init_task.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/init_task.h	2011-07-15 05:51:19.000000000 -0500
@@ -83,6 +83,12 @@
 #define INIT_IDS
 #endif
 
+#ifdef CONFIG_X86
+#define INIT_TASK_THREAD_INFO .tinfo = INIT_THREAD_INFO,
+#else
+#define INIT_TASK_THREAD_INFO
+#endif
+
 #ifdef CONFIG_SECURITY_FILE_CAPABILITIES
 /*
  * Because of the reduced scope of CAP_SETPCAP when filesystem
@@ -156,6 +162,7 @@
 		 __MUTEX_INITIALIZER(tsk.cred_guard_mutex),		\
 	.comm		= "swapper",					\
 	.thread		= INIT_THREAD,					\
+	INIT_TASK_THREAD_INFO						\
 	.fs		= &init_fs,					\
 	.files		= &init_files,					\
 	.signal		= &init_signals,				\
@@ -184,6 +191,10 @@
 	INIT_FTRACE_GRAPH						\
 	INIT_TRACE_RECURSION						\
 	INIT_TASK_RCU_PREEMPT(tsk)					\
+	.xid		= 0,						\
+	.vx_info	= NULL,						\
+	.nid		= 0,						\
+	.nx_info	= NULL,						\
 }
 
 
diff -uriN linux-2.6.32.43/include/linux/interrupt.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/interrupt.h
--- linux-2.6.32.43/include/linux/interrupt.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/interrupt.h	2011-07-15 05:51:19.000000000 -0500
@@ -363,7 +363,7 @@
 /* map softirq index to softirq name. update 'softirq_to_name' in
  * kernel/softirq.c when adding a new softirq.
  */
-extern char *softirq_to_name[NR_SOFTIRQS];
+extern const char * const softirq_to_name[NR_SOFTIRQS];
 
 /* softirq mask and active fields moved to irq_cpustat_t in
  * asm/hardirq.h to get better cache usage.  KAO
@@ -371,12 +371,12 @@
 
 struct softirq_action
 {
-	void	(*action)(struct softirq_action *);
+	void	(*action)(void);
 };
 
 asmlinkage void do_softirq(void);
 asmlinkage void __do_softirq(void);
-extern void open_softirq(int nr, void (*action)(struct softirq_action *));
+extern void open_softirq(int nr, void (*action)(void));
 extern void softirq_init(void);
 #define __raise_softirq_irqoff(nr) do { or_softirq_pending(1UL << (nr)); } while (0)
 extern void raise_softirq_irqoff(unsigned int nr);
diff -uriN linux-2.6.32.43/include/linux/ipc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ipc.h
--- linux-2.6.32.43/include/linux/ipc.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ipc.h	2011-07-15 05:50:11.000000000 -0500
@@ -91,6 +91,7 @@
 	key_t		key;
 	uid_t		uid;
 	gid_t		gid;
+	xid_t		xid;
 	uid_t		cuid;
 	gid_t		cgid;
 	mode_t		mode; 
diff -uriN linux-2.6.32.43/include/linux/irq.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/irq.h
--- linux-2.6.32.43/include/linux/irq.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/irq.h	2011-07-15 05:51:19.000000000 -0500
@@ -438,12 +438,12 @@
 static inline bool alloc_desc_masks(struct irq_desc *desc, int node,
 							bool boot)
 {
+#ifdef CONFIG_CPUMASK_OFFSTACK
 	gfp_t gfp = GFP_ATOMIC;
 
 	if (boot)
 		gfp = GFP_NOWAIT;
 
-#ifdef CONFIG_CPUMASK_OFFSTACK
 	if (!alloc_cpumask_var_node(&desc->affinity, gfp, node))
 		return false;
 
diff -uriN linux-2.6.32.43/include/linux/kallsyms.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kallsyms.h
--- linux-2.6.32.43/include/linux/kallsyms.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kallsyms.h	2011-07-15 05:51:19.000000000 -0500
@@ -15,7 +15,8 @@
 
 struct module;
 
-#ifdef CONFIG_KALLSYMS
+#if !defined(__INCLUDED_BY_HIDESYM) || !defined(CONFIG_KALLSYMS)
+#if defined(CONFIG_KALLSYMS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
 /* Lookup the address for a symbol. Returns 0 if not found. */
 unsigned long kallsyms_lookup_name(const char *name);
 
@@ -92,6 +93,15 @@
 /* Stupid that this does nothing, but I didn't create this mess. */
 #define __print_symbol(fmt, addr)
 #endif /*CONFIG_KALLSYMS*/
+#else /* when included by kallsyms.c, vsnprintf.c, or
+	arch/x86/kernel/dumpstack.c, with HIDESYM enabled */
+extern void __print_symbol(const char *fmt, unsigned long address);
+extern int sprint_symbol(char *buffer, unsigned long address);
+const char *kallsyms_lookup(unsigned long addr,
+			    unsigned long *symbolsize,
+			    unsigned long *offset,
+			    char **modname, char *namebuf);
+#endif
 
 /* This macro allows us to keep printk typechecking */
 static void __check_printsym_format(const char *fmt, ...)
diff -uriN linux-2.6.32.43/include/linux/Kbuild linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/Kbuild
--- linux-2.6.32.43/include/linux/Kbuild	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/Kbuild	2011-07-15 05:50:11.000000000 -0500
@@ -382,5 +382,8 @@
 unifdef-y += xfrm.h
 
 objhdr-y += version.h
+
+header-y += vserver/
 header-y += wimax.h
 header-y += wimax/
+
diff -uriN linux-2.6.32.43/include/linux/kgdb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kgdb.h
--- linux-2.6.32.43/include/linux/kgdb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kgdb.h	2011-07-15 05:51:19.000000000 -0500
@@ -74,8 +74,8 @@
 
 extern int kgdb_connected;
 
-extern atomic_t			kgdb_setting_breakpoint;
-extern atomic_t			kgdb_cpu_doing_single_step;
+extern atomic_unchecked_t	kgdb_setting_breakpoint;
+extern atomic_unchecked_t	kgdb_cpu_doing_single_step;
 
 extern struct task_struct	*kgdb_usethread;
 extern struct task_struct	*kgdb_contthread;
@@ -251,20 +251,20 @@
  */
 struct kgdb_io {
 	const char		*name;
-	int			(*read_char) (void);
-	void			(*write_char) (u8);
-	void			(*flush) (void);
-	int			(*init) (void);
-	void			(*pre_exception) (void);
-	void			(*post_exception) (void);
+	int			(* const read_char) (void);
+	void			(* const write_char) (u8);
+	void			(* const flush) (void);
+	int			(* const init) (void);
+	void			(* const pre_exception) (void);
+	void			(* const post_exception) (void);
 };
 
-extern struct kgdb_arch		arch_kgdb_ops;
+extern const struct kgdb_arch arch_kgdb_ops;
 
 extern unsigned long __weak kgdb_arch_pc(int exception, struct pt_regs *regs);
 
-extern int kgdb_register_io_module(struct kgdb_io *local_kgdb_io_ops);
-extern void kgdb_unregister_io_module(struct kgdb_io *local_kgdb_io_ops);
+extern int kgdb_register_io_module(const struct kgdb_io *local_kgdb_io_ops);
+extern void kgdb_unregister_io_module(const struct kgdb_io *local_kgdb_io_ops);
 
 extern int kgdb_hex2long(char **ptr, unsigned long *long_val);
 extern int kgdb_mem2hex(char *mem, char *buf, int count);
diff -uriN linux-2.6.32.43/include/linux/kmod.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kmod.h
--- linux-2.6.32.43/include/linux/kmod.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kmod.h	2011-07-15 05:51:19.000000000 -0500
@@ -31,6 +31,8 @@
  * usually useless though. */
 extern int __request_module(bool wait, const char *name, ...) \
 	__attribute__((format(printf, 2, 3)));
+extern int ___request_module(bool wait, char *param_name, const char *name, ...) \
+	__attribute__((format(printf, 3, 4)));
 #define request_module(mod...) __request_module(true, mod)
 #define request_module_nowait(mod...) __request_module(false, mod)
 #define try_then_request_module(x, mod...) \
diff -uriN linux-2.6.32.43/include/linux/kobject.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kobject.h
--- linux-2.6.32.43/include/linux/kobject.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kobject.h	2011-07-15 05:51:19.000000000 -0500
@@ -106,7 +106,7 @@
 
 struct kobj_type {
 	void (*release)(struct kobject *kobj);
-	struct sysfs_ops *sysfs_ops;
+	const struct sysfs_ops *sysfs_ops;
 	struct attribute **default_attrs;
 };
 
@@ -118,9 +118,9 @@
 };
 
 struct kset_uevent_ops {
-	int (*filter)(struct kset *kset, struct kobject *kobj);
-	const char *(*name)(struct kset *kset, struct kobject *kobj);
-	int (*uevent)(struct kset *kset, struct kobject *kobj,
+	int (* const filter)(struct kset *kset, struct kobject *kobj);
+	const char *(* const name)(struct kset *kset, struct kobject *kobj);
+	int (* const uevent)(struct kset *kset, struct kobject *kobj,
 		      struct kobj_uevent_env *env);
 };
 
@@ -132,7 +132,7 @@
 			 const char *buf, size_t count);
 };
 
-extern struct sysfs_ops kobj_sysfs_ops;
+extern const struct sysfs_ops kobj_sysfs_ops;
 
 /**
  * struct kset - a set of kobjects of a specific type, belonging to a specific subsystem.
@@ -155,14 +155,14 @@
 	struct list_head list;
 	spinlock_t list_lock;
 	struct kobject kobj;
-	struct kset_uevent_ops *uevent_ops;
+	const struct kset_uevent_ops *uevent_ops;
 };
 
 extern void kset_init(struct kset *kset);
 extern int __must_check kset_register(struct kset *kset);
 extern void kset_unregister(struct kset *kset);
 extern struct kset * __must_check kset_create_and_add(const char *name,
-						struct kset_uevent_ops *u,
+						const struct kset_uevent_ops *u,
 						struct kobject *parent_kobj);
 
 static inline struct kset *to_kset(struct kobject *kobj)
diff -uriN linux-2.6.32.43/include/linux/kvm_host.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kvm_host.h
--- linux-2.6.32.43/include/linux/kvm_host.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/kvm_host.h	2011-07-15 05:51:19.000000000 -0500
@@ -210,7 +210,7 @@
 void vcpu_load(struct kvm_vcpu *vcpu);
 void vcpu_put(struct kvm_vcpu *vcpu);
 
-int kvm_init(void *opaque, unsigned int vcpu_size,
+int kvm_init(const void *opaque, unsigned int vcpu_size,
 		  struct module *module);
 void kvm_exit(void);
 
@@ -316,7 +316,7 @@
 					struct kvm_guest_debug *dbg);
 int kvm_arch_vcpu_ioctl_run(struct kvm_vcpu *vcpu, struct kvm_run *kvm_run);
 
-int kvm_arch_init(void *opaque);
+int kvm_arch_init(const void *opaque);
 void kvm_arch_exit(void);
 
 int kvm_arch_vcpu_init(struct kvm_vcpu *vcpu);
diff -uriN linux-2.6.32.43/include/linux/libata.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/libata.h
--- linux-2.6.32.43/include/linux/libata.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/libata.h	2011-07-15 05:51:19.000000000 -0500
@@ -525,11 +525,11 @@
 
 struct ata_host {
 	spinlock_t		lock;
-	struct device 		*dev;
+	struct device		*dev;
 	void __iomem * const	*iomap;
 	unsigned int		n_ports;
 	void			*private_data;
-	struct ata_port_operations *ops;
+	const struct ata_port_operations *ops;
 	unsigned long		flags;
 #ifdef CONFIG_ATA_ACPI
 	acpi_handle		acpi_handle;
@@ -710,7 +710,7 @@
 
 struct ata_port {
 	struct Scsi_Host	*scsi_host; /* our co-allocated scsi host */
-	struct ata_port_operations *ops;
+	const struct ata_port_operations *ops;
 	spinlock_t		*lock;
 	/* Flags owned by the EH context. Only EH should touch these once the
 	   port is active */
@@ -892,7 +892,7 @@
 	unsigned long		pio_mask;
 	unsigned long		mwdma_mask;
 	unsigned long		udma_mask;
-	struct ata_port_operations *port_ops;
+	const struct ata_port_operations *port_ops;
 	void 			*private_data;
 };
 
@@ -916,7 +916,7 @@
 extern const unsigned long sata_deb_timing_hotplug[];
 extern const unsigned long sata_deb_timing_long[];
 
-extern struct ata_port_operations ata_dummy_port_ops;
+extern const struct ata_port_operations ata_dummy_port_ops;
 extern const struct ata_port_info ata_dummy_port_info;
 
 static inline const unsigned long *
@@ -962,7 +962,7 @@
 			     struct scsi_host_template *sht);
 extern void ata_host_detach(struct ata_host *host);
 extern void ata_host_init(struct ata_host *, struct device *,
-			  unsigned long, struct ata_port_operations *);
+			  unsigned long, const struct ata_port_operations *);
 extern int ata_scsi_detect(struct scsi_host_template *sht);
 extern int ata_scsi_ioctl(struct scsi_device *dev, int cmd, void __user *arg);
 extern int ata_scsi_queuecmd(struct scsi_cmnd *cmd, void (*done)(struct scsi_cmnd *));
diff -uriN linux-2.6.32.43/include/linux/lockd/bind.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/lockd/bind.h
--- linux-2.6.32.43/include/linux/lockd/bind.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/lockd/bind.h	2011-07-15 05:51:19.000000000 -0500
@@ -23,13 +23,13 @@
  * This is the set of functions for lockd->nfsd communication
  */
 struct nlmsvc_binding {
-	__be32			(*fopen)(struct svc_rqst *,
+	__be32			(* const fopen)(struct svc_rqst *,
 						struct nfs_fh *,
 						struct file **);
-	void			(*fclose)(struct file *);
+	void			(* const fclose)(struct file *);
 };
 
-extern struct nlmsvc_binding *	nlmsvc_ops;
+extern const struct nlmsvc_binding *	nlmsvc_ops;
 
 /*
  * Similar to nfs_client_initdata, but without the NFS-specific
diff -uriN linux-2.6.32.43/include/linux/loop.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/loop.h
--- linux-2.6.32.43/include/linux/loop.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/loop.h	2011-07-15 05:50:11.000000000 -0500
@@ -45,6 +45,7 @@
 	struct loop_func_table *lo_encryption;
 	__u32           lo_init[2];
 	uid_t		lo_key_owner;	/* Who set the key */
+	xid_t		lo_xid;
 	int		(*ioctl)(struct loop_device *, int cmd, 
 				 unsigned long arg); 
 
diff -uriN linux-2.6.32.43/include/linux/magic.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/magic.h
--- linux-2.6.32.43/include/linux/magic.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/magic.h	2011-07-15 05:50:11.000000000 -0500
@@ -3,7 +3,7 @@
 
 #define ADFS_SUPER_MAGIC	0xadf5
 #define AFFS_SUPER_MAGIC	0xadff
-#define AFS_SUPER_MAGIC                0x5346414F
+#define AFS_SUPER_MAGIC		0x5346414F
 #define AUTOFS_SUPER_MAGIC	0x0187
 #define CODA_SUPER_MAGIC	0x73757245
 #define CRAMFS_MAGIC		0x28cd3d45	/* some random number */
@@ -38,6 +38,7 @@
 #define NFS_SUPER_MAGIC		0x6969
 #define OPENPROM_SUPER_MAGIC	0x9fa1
 #define PROC_SUPER_MAGIC	0x9fa0
+#define DEVPTS_SUPER_MAGIC	0x1cd1
 #define QNX4_SUPER_MAGIC	0x002f		/* qnx4 fs detection */
 
 #define REISERFS_SUPER_MAGIC	0x52654973	/* used by gcc */
diff -uriN linux-2.6.32.43/include/linux/major.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/major.h
--- linux-2.6.32.43/include/linux/major.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/major.h	2011-07-15 05:50:11.000000000 -0500
@@ -15,6 +15,7 @@
 #define HD_MAJOR		IDE0_MAJOR
 #define PTY_SLAVE_MAJOR		3
 #define TTY_MAJOR		4
+#define VROOT_MAJOR		4
 #define TTYAUX_MAJOR		5
 #define LP_MAJOR		6
 #define VCS_MAJOR		7
diff -uriN linux-2.6.32.43/include/linux/memcontrol.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/memcontrol.h
--- linux-2.6.32.43/include/linux/memcontrol.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/memcontrol.h	2011-07-15 05:50:11.000000000 -0500
@@ -70,6 +70,13 @@
 
 extern struct mem_cgroup *mem_cgroup_from_task(struct task_struct *p);
 
+extern u64 mem_cgroup_res_read_u64(struct mem_cgroup *mem, int member);
+extern u64 mem_cgroup_memsw_read_u64(struct mem_cgroup *mem, int member);
+
+extern s64 mem_cgroup_stat_read_cache(struct mem_cgroup *mem);
+extern s64 mem_cgroup_stat_read_anon(struct mem_cgroup *mem);
+extern s64 mem_cgroup_stat_read_mapped(struct mem_cgroup *mem);
+
 static inline
 int mm_match_cgroup(const struct mm_struct *mm, const struct mem_cgroup *cgroup)
 {
diff -uriN linux-2.6.32.43/include/linux/mm.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mm.h
--- linux-2.6.32.43/include/linux/mm.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mm.h	2011-07-15 05:51:19.000000000 -0500
@@ -106,7 +106,14 @@
 
 #define VM_CAN_NONLINEAR 0x08000000	/* Has ->fault & does nonlinear pages */
 #define VM_MIXEDMAP	0x10000000	/* Can contain "struct page" and pure PFN pages */
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
+#define VM_SAO		0x00000000	/* Strong Access Ordering (powerpc) */
+#define VM_PAGEEXEC	0x20000000	/* vma->vm_page_prot needs special handling */
+#else
 #define VM_SAO		0x20000000	/* Strong Access Ordering (powerpc) */
+#endif
+
 #define VM_PFN_AT_MMAP	0x40000000	/* PFNMAP vma that is fully mapped at mmap time */
 #define VM_MERGEABLE	0x80000000	/* KSM may merge identical pages */
 
@@ -841,12 +848,6 @@
 int set_page_dirty_lock(struct page *page);
 int clear_page_dirty_for_io(struct page *page);
 
-/* Is the vma a continuation of the stack vma above it? */
-static inline int vma_stack_continue(struct vm_area_struct *vma, unsigned long addr)
-{
-	return vma && (vma->vm_end == addr) && (vma->vm_flags & VM_GROWSDOWN);
-}
-
 extern unsigned long move_page_tables(struct vm_area_struct *vma,
 		unsigned long old_addr, struct vm_area_struct *new_vma,
 		unsigned long new_addr, unsigned long len);
@@ -890,6 +891,8 @@
 extern void register_shrinker(struct shrinker *);
 extern void unregister_shrinker(struct shrinker *);
 
+pgprot_t vm_get_page_prot(unsigned long vm_flags);
+
 int vma_wants_writenotify(struct vm_area_struct *vma);
 
 extern pte_t *get_locked_pte(struct mm_struct *mm, unsigned long addr, spinlock_t **ptl);
@@ -1162,6 +1165,7 @@
 }
 
 extern int do_munmap(struct mm_struct *, unsigned long, size_t);
+extern int __do_munmap(struct mm_struct *, unsigned long, size_t);
 
 extern unsigned long do_brk(unsigned long, unsigned long);
 
@@ -1218,6 +1222,10 @@
 extern struct vm_area_struct * find_vma_prev(struct mm_struct * mm, unsigned long addr,
 					     struct vm_area_struct **pprev);
 
+extern struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma);
+extern void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma);
+extern void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl);
+
 /* Look up the first VMA which intersects the interval start_addr..end_addr-1,
    NULL if none.  Assume start_addr < end_addr. */
 static inline struct vm_area_struct * find_vma_intersection(struct mm_struct * mm, unsigned long start_addr, unsigned long end_addr)
@@ -1234,7 +1242,6 @@
 	return (vma->vm_end - vma->vm_start) >> PAGE_SHIFT;
 }
 
-pgprot_t vm_get_page_prot(unsigned long vm_flags);
 struct vm_area_struct *find_extend_vma(struct mm_struct *, unsigned long addr);
 int remap_pfn_range(struct vm_area_struct *, unsigned long addr,
 			unsigned long pfn, unsigned long size, pgprot_t);
@@ -1332,7 +1339,13 @@
 extern int __memory_failure(unsigned long pfn, int trapno, int ref);
 extern int sysctl_memory_failure_early_kill;
 extern int sysctl_memory_failure_recovery;
-extern atomic_long_t mce_bad_pages;
+extern atomic_long_unchecked_t mce_bad_pages;
+
+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
+extern void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot);
+#else
+static inline void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot) {}
+#endif
 
 #endif /* __KERNEL__ */
 #endif /* _LINUX_MM_H */
diff -uriN linux-2.6.32.43/include/linux/mm_types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mm_types.h
--- linux-2.6.32.43/include/linux/mm_types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mm_types.h	2011-07-15 05:51:19.000000000 -0500
@@ -186,6 +186,8 @@
 #ifdef CONFIG_NUMA
 	struct mempolicy *vm_policy;	/* NUMA policy for the VMA */
 #endif
+
+	struct vm_area_struct *vm_mirror;/* PaX: mirror vma or NULL */
 };
 
 struct core_thread {
@@ -246,6 +248,7 @@
 
 	/* Architecture-specific MM context */
 	mm_context_t context;
+	struct vx_info *mm_vx_info;
 
 	/* Swap token stuff */
 	/*
@@ -287,6 +290,24 @@
 #ifdef CONFIG_MMU_NOTIFIER
 	struct mmu_notifier_mm *mmu_notifier_mm;
 #endif
+
+#if defined(CONFIG_PAX_EI_PAX) || defined(CONFIG_PAX_PT_PAX_FLAGS) || defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
+	unsigned long pax_flags;
+#endif
+
+#ifdef CONFIG_PAX_DLRESOLVE
+	unsigned long call_dl_resolve;
+#endif
+
+#if defined(CONFIG_PPC32) && defined(CONFIG_PAX_EMUSIGRT)
+	unsigned long call_syscall;
+#endif
+
+#ifdef CONFIG_PAX_ASLR
+	unsigned long delta_mmap;		/* randomized offset */
+	unsigned long delta_stack;		/* randomized offset */
+#endif
+
 };
 
 /* Future-safe accessor for struct mm_struct's cpu_vm_mask. */
diff -uriN linux-2.6.32.43/include/linux/mmu_notifier.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mmu_notifier.h
--- linux-2.6.32.43/include/linux/mmu_notifier.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mmu_notifier.h	2011-07-15 05:51:19.000000000 -0500
@@ -235,12 +235,12 @@
  */
 #define ptep_clear_flush_notify(__vma, __address, __ptep)		\
 ({									\
-	pte_t __pte;							\
+	pte_t ___pte;							\
 	struct vm_area_struct *___vma = __vma;				\
 	unsigned long ___address = __address;				\
-	__pte = ptep_clear_flush(___vma, ___address, __ptep);		\
+	___pte = ptep_clear_flush(___vma, ___address, __ptep);		\
 	mmu_notifier_invalidate_page(___vma->vm_mm, ___address);	\
-	__pte;								\
+	___pte;								\
 })
 
 #define ptep_clear_flush_young_notify(__vma, __address, __ptep)		\
diff -uriN linux-2.6.32.43/include/linux/mmzone.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mmzone.h
--- linux-2.6.32.43/include/linux/mmzone.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mmzone.h	2011-07-15 05:51:19.000000000 -0500
@@ -350,7 +350,7 @@
 	unsigned long		flags;		   /* zone flags, see below */
 
 	/* Zone statistics */
-	atomic_long_t		vm_stat[NR_VM_ZONE_STAT_ITEMS];
+	atomic_long_unchecked_t		vm_stat[NR_VM_ZONE_STAT_ITEMS];
 
 	/*
 	 * prev_priority holds the scanning priority for this zone.  It is
diff -uriN linux-2.6.32.43/include/linux/mod_devicetable.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mod_devicetable.h
--- linux-2.6.32.43/include/linux/mod_devicetable.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mod_devicetable.h	2011-07-15 05:51:19.000000000 -0500
@@ -12,7 +12,7 @@
 typedef unsigned long kernel_ulong_t;
 #endif
 
-#define PCI_ANY_ID (~0)
+#define PCI_ANY_ID ((__u16)~0)
 
 struct pci_device_id {
 	__u32 vendor, device;		/* Vendor and device ID or PCI_ANY_ID*/
@@ -131,7 +131,7 @@
 #define USB_DEVICE_ID_MATCH_INT_SUBCLASS	0x0100
 #define USB_DEVICE_ID_MATCH_INT_PROTOCOL	0x0200
 
-#define HID_ANY_ID				(~0)
+#define HID_ANY_ID				(~0U)
 
 struct hid_device_id {
 	__u16 bus;
diff -uriN linux-2.6.32.43/include/linux/module.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/module.h
--- linux-2.6.32.43/include/linux/module.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/module.h	2011-07-15 05:51:19.000000000 -0500
@@ -287,16 +287,16 @@
 	int (*init)(void);
 
 	/* If this is non-NULL, vfree after init() returns */
-	void *module_init;
+	void *module_init_rx, *module_init_rw;
 
 	/* Here is the actual code + data, vfree'd on unload. */
-	void *module_core;
+	void *module_core_rx, *module_core_rw;
 
 	/* Here are the sizes of the init and core sections */
-	unsigned int init_size, core_size;
+	unsigned int init_size_rw, core_size_rw;
 
 	/* The size of the executable code in each section.  */
-	unsigned int init_text_size, core_text_size;
+	unsigned int init_size_rx, core_size_rx;
 
 	/* Arch-specific module values */
 	struct mod_arch_specific arch;
@@ -393,16 +393,46 @@
 bool is_module_address(unsigned long addr);
 bool is_module_text_address(unsigned long addr);
 
+static inline int within_module_range(unsigned long addr, void *start, unsigned long size)
+{
+
+#ifdef CONFIG_PAX_KERNEXEC
+	if (ktla_ktva(addr) >= (unsigned long)start &&
+	    ktla_ktva(addr) < (unsigned long)start + size)
+		return 1;
+#endif
+
+	return ((void *)addr >= start && (void *)addr < start + size);
+}
+
+static inline int within_module_core_rx(unsigned long addr, struct module *mod)
+{
+	return within_module_range(addr, mod->module_core_rx, mod->core_size_rx);
+}
+
+static inline int within_module_core_rw(unsigned long addr, struct module *mod)
+{
+	return within_module_range(addr, mod->module_core_rw, mod->core_size_rw);
+}
+
+static inline int within_module_init_rx(unsigned long addr, struct module *mod)
+{
+	return within_module_range(addr, mod->module_init_rx, mod->init_size_rx);
+}
+
+static inline int within_module_init_rw(unsigned long addr, struct module *mod)
+{
+	return within_module_range(addr, mod->module_init_rw, mod->init_size_rw);
+}
+
 static inline int within_module_core(unsigned long addr, struct module *mod)
 {
-	return (unsigned long)mod->module_core <= addr &&
-	       addr < (unsigned long)mod->module_core + mod->core_size;
+	return within_module_core_rx(addr, mod) || within_module_core_rw(addr, mod);
 }
 
 static inline int within_module_init(unsigned long addr, struct module *mod)
 {
-	return (unsigned long)mod->module_init <= addr &&
-	       addr < (unsigned long)mod->module_init + mod->init_size;
+	return within_module_init_rx(addr, mod) || within_module_init_rw(addr, mod);
 }
 
 /* Search for module by name: must hold module_mutex. */
diff -uriN linux-2.6.32.43/include/linux/moduleloader.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/moduleloader.h
--- linux-2.6.32.43/include/linux/moduleloader.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/moduleloader.h	2011-07-15 05:51:19.000000000 -0500
@@ -20,9 +20,21 @@
    sections.  Returns NULL on failure. */
 void *module_alloc(unsigned long size);
 
+#ifdef CONFIG_PAX_KERNEXEC
+void *module_alloc_exec(unsigned long size);
+#else
+#define module_alloc_exec(x) module_alloc(x)
+#endif
+
 /* Free memory returned from module_alloc. */
 void module_free(struct module *mod, void *module_region);
 
+#ifdef CONFIG_PAX_KERNEXEC
+void module_free_exec(struct module *mod, void *module_region);
+#else
+#define module_free_exec(x, y) module_free((x), (y))
+#endif
+
 /* Apply the given relocation to the (simplified) ELF.  Return -error
    or 0. */
 int apply_relocate(Elf_Shdr *sechdrs,
diff -uriN linux-2.6.32.43/include/linux/moduleparam.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/moduleparam.h
--- linux-2.6.32.43/include/linux/moduleparam.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/moduleparam.h	2011-07-15 05:51:19.000000000 -0500
@@ -132,7 +132,7 @@
 
 /* Actually copy string: maxlen param is usually sizeof(string). */
 #define module_param_string(name, string, len, perm)			\
-	static const struct kparam_string __param_string_##name		\
+	static const struct kparam_string __param_string_##name __used	\
 		= { len, string };					\
 	__module_param_call(MODULE_PARAM_PREFIX, name,			\
 			    param_set_copystring, param_get_string,	\
@@ -211,7 +211,7 @@
 
 /* Comma-separated array: *nump is set to number they actually specified. */
 #define module_param_array_named(name, array, type, nump, perm)		\
-	static const struct kparam_array __param_arr_##name		\
+	static const struct kparam_array __param_arr_##name __used	\
 	= { ARRAY_SIZE(array), nump, param_set_##type, param_get_##type,\
 	    sizeof(array[0]), array };					\
 	__module_param_call(MODULE_PARAM_PREFIX, name,			\
diff -uriN linux-2.6.32.43/include/linux/mount.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mount.h
--- linux-2.6.32.43/include/linux/mount.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mount.h	2011-07-15 05:50:11.000000000 -0500
@@ -36,6 +36,9 @@
 #define MNT_UNBINDABLE	0x2000	/* if the vfsmount is a unbindable mount */
 #define MNT_PNODE_MASK	0x3000	/* propagation flag mask */
 
+#define MNT_TAGID	0x10000
+#define MNT_NOTAG	0x20000
+
 struct vfsmount {
 	struct list_head mnt_hash;
 	struct vfsmount *mnt_parent;	/* fs we are mounted on */
@@ -70,6 +73,7 @@
 #else
 	int mnt_writers;
 #endif
+	tag_t mnt_tag;			/* tagging used for vfsmount */
 };
 
 static inline int *get_mnt_writers_ptr(struct vfsmount *mnt)
diff -uriN linux-2.6.32.43/include/linux/mutex.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mutex.h
--- linux-2.6.32.43/include/linux/mutex.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/mutex.h	2011-07-15 05:51:19.000000000 -0500
@@ -51,7 +51,7 @@
 	spinlock_t		wait_lock;
 	struct list_head	wait_list;
 #if defined(CONFIG_DEBUG_MUTEXES) || defined(CONFIG_SMP)
-	struct thread_info	*owner;
+	struct task_struct	*owner;
 #endif
 #ifdef CONFIG_DEBUG_MUTEXES
 	const char 		*name;
diff -uriN linux-2.6.32.43/include/linux/namei.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/namei.h
--- linux-2.6.32.43/include/linux/namei.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/namei.h	2011-07-15 05:51:19.000000000 -0500
@@ -22,7 +22,7 @@
 	unsigned int	flags;
 	int		last_type;
 	unsigned	depth;
-	char *saved_names[MAX_NESTED_LINKS + 1];
+	const char *saved_names[MAX_NESTED_LINKS + 1];
 
 	/* Intent data */
 	union {
@@ -84,12 +84,12 @@
 extern struct dentry *lock_rename(struct dentry *, struct dentry *);
 extern void unlock_rename(struct dentry *, struct dentry *);
 
-static inline void nd_set_link(struct nameidata *nd, char *path)
+static inline void nd_set_link(struct nameidata *nd, const char *path)
 {
 	nd->saved_names[nd->depth] = path;
 }
 
-static inline char *nd_get_link(struct nameidata *nd)
+static inline const char *nd_get_link(const struct nameidata *nd)
 {
 	return nd->saved_names[nd->depth];
 }
diff -uriN linux-2.6.32.43/include/linux/netfilter/xt_gradm.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/netfilter/xt_gradm.h
--- linux-2.6.32.43/include/linux/netfilter/xt_gradm.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/netfilter/xt_gradm.h	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1,9 @@
+#ifndef _LINUX_NETFILTER_XT_GRADM_H
+#define _LINUX_NETFILTER_XT_GRADM_H 1
+
+struct xt_gradm_mtinfo {
+	__u16 flags;
+	__u16 invflags;
+};
+
+#endif
diff -uriN linux-2.6.32.43/include/linux/net.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/net.h
--- linux-2.6.32.43/include/linux/net.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/net.h	2011-07-15 05:50:11.000000000 -0500
@@ -69,6 +69,7 @@
 #define SOCK_NOSPACE		2
 #define SOCK_PASSCRED		3
 #define SOCK_PASSSEC		4
+#define SOCK_USER_SOCKET	5
 
 #ifndef ARCH_HAS_SOCKET_TYPES
 /**
diff -uriN linux-2.6.32.43/include/linux/nfs_mount.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/nfs_mount.h
--- linux-2.6.32.43/include/linux/nfs_mount.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/nfs_mount.h	2011-07-15 05:50:11.000000000 -0500
@@ -63,7 +63,8 @@
 #define NFS_MOUNT_SECFLAVOUR	0x2000	/* 5 */
 #define NFS_MOUNT_NORDIRPLUS	0x4000	/* 5 */
 #define NFS_MOUNT_UNSHARED	0x8000	/* 5 */
-#define NFS_MOUNT_FLAGMASK	0xFFFF
+#define NFS_MOUNT_TAGGED	0x10000	/* context tagging */
+#define NFS_MOUNT_FLAGMASK	0x1FFFF
 
 /* The following are for internal use only */
 #define NFS_MOUNT_LOOKUP_CACHE_NONEG	0x10000
diff -uriN linux-2.6.32.43/include/linux/nodemask.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/nodemask.h
--- linux-2.6.32.43/include/linux/nodemask.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/nodemask.h	2011-07-15 05:51:19.000000000 -0500
@@ -464,11 +464,11 @@
 
 #define any_online_node(mask)			\
 ({						\
-	int node;				\
-	for_each_node_mask(node, (mask))	\
-		if (node_online(node))		\
+	int __node;				\
+	for_each_node_mask(__node, (mask))	\
+		if (node_online(__node))	\
 			break;			\
-	node;					\
+	__node;					\
 })
 
 #define num_online_nodes()	num_node_state(N_ONLINE)
diff -uriN linux-2.6.32.43/include/linux/nsproxy.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/nsproxy.h
--- linux-2.6.32.43/include/linux/nsproxy.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/nsproxy.h	2011-07-15 05:50:11.000000000 -0500
@@ -3,6 +3,7 @@
 
 #include <linux/spinlock.h>
 #include <linux/sched.h>
+#include <linux/vserver/debug.h>
 
 struct mnt_namespace;
 struct uts_namespace;
@@ -63,22 +64,33 @@
 }
 
 int copy_namespaces(unsigned long flags, struct task_struct *tsk);
+struct nsproxy *copy_nsproxy(struct nsproxy *orig);
 void exit_task_namespaces(struct task_struct *tsk);
 void switch_task_namespaces(struct task_struct *tsk, struct nsproxy *new);
 void free_nsproxy(struct nsproxy *ns);
 int unshare_nsproxy_namespaces(unsigned long, struct nsproxy **,
 	struct fs_struct *);
 
-static inline void put_nsproxy(struct nsproxy *ns)
+#define	get_nsproxy(n)	__get_nsproxy(n, __FILE__, __LINE__)
+
+static inline void __get_nsproxy(struct nsproxy *ns,
+	const char *_file, int _line)
 {
-	if (atomic_dec_and_test(&ns->count)) {
-		free_nsproxy(ns);
-	}
+	vxlprintk(VXD_CBIT(space, 0), "get_nsproxy(%p[%u])",
+		ns, atomic_read(&ns->count), _file, _line);
+	atomic_inc(&ns->count);
 }
 
-static inline void get_nsproxy(struct nsproxy *ns)
+#define	put_nsproxy(n)	__put_nsproxy(n, __FILE__, __LINE__)
+
+static inline void __put_nsproxy(struct nsproxy *ns,
+	const char *_file, int _line)
 {
-	atomic_inc(&ns->count);
+	vxlprintk(VXD_CBIT(space, 0), "put_nsproxy(%p[%u])",
+		ns, atomic_read(&ns->count), _file, _line);
+	if (atomic_dec_and_test(&ns->count)) {
+		free_nsproxy(ns);
+	}
 }
 
 #ifdef CONFIG_CGROUP_NS
diff -uriN linux-2.6.32.43/include/linux/oprofile.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/oprofile.h
--- linux-2.6.32.43/include/linux/oprofile.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/oprofile.h	2011-07-15 05:51:19.000000000 -0500
@@ -129,9 +129,9 @@
 int oprofilefs_create_ro_ulong(struct super_block * sb, struct dentry * root,
 	char const * name, ulong * val);
  
-/** Create a file for read-only access to an atomic_t. */
+/** Create a file for read-only access to an atomic_unchecked_t. */
 int oprofilefs_create_ro_atomic(struct super_block * sb, struct dentry * root,
-	char const * name, atomic_t * val);
+	char const * name, atomic_unchecked_t * val);
  
 /** create a directory */
 struct dentry * oprofilefs_mkdir(struct super_block * sb, struct dentry * root,
diff -uriN linux-2.6.32.43/include/linux/perf_event.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/perf_event.h
--- linux-2.6.32.43/include/linux/perf_event.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/perf_event.h	2011-07-15 05:51:19.000000000 -0500
@@ -476,7 +476,7 @@
 			struct hrtimer	hrtimer;
 		};
 	};
-	atomic64_t			prev_count;
+	atomic64_unchecked_t		prev_count;
 	u64				sample_period;
 	u64				last_period;
 	atomic64_t			period_left;
@@ -557,7 +557,7 @@
 	const struct pmu		*pmu;
 
 	enum perf_event_active_state	state;
-	atomic64_t			count;
+	atomic64_unchecked_t		count;
 
 	/*
 	 * These are the total time in nanoseconds that the event
@@ -595,8 +595,8 @@
 	 * These accumulate total time (in nanoseconds) that children
 	 * events have been enabled and running, respectively.
 	 */
-	atomic64_t			child_total_time_enabled;
-	atomic64_t			child_total_time_running;
+	atomic64_unchecked_t		child_total_time_enabled;
+	atomic64_unchecked_t		child_total_time_running;
 
 	/*
 	 * Protect attach/detach and child_list:
diff -uriN linux-2.6.32.43/include/linux/pid.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/pid.h
--- linux-2.6.32.43/include/linux/pid.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/pid.h	2011-07-15 05:50:11.000000000 -0500
@@ -8,7 +8,8 @@
 	PIDTYPE_PID,
 	PIDTYPE_PGID,
 	PIDTYPE_SID,
-	PIDTYPE_MAX
+	PIDTYPE_MAX,
+	PIDTYPE_REALPID
 };
 
 /*
@@ -160,6 +161,7 @@
 }
 
 pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns);
+pid_t pid_unmapped_nr_ns(struct pid *pid, struct pid_namespace *ns);
 pid_t pid_vnr(struct pid *pid);
 
 #define do_each_pid_task(pid, type, task)				\
diff -uriN linux-2.6.32.43/include/linux/pipe_fs_i.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/pipe_fs_i.h
--- linux-2.6.32.43/include/linux/pipe_fs_i.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/pipe_fs_i.h	2011-07-15 05:51:19.000000000 -0500
@@ -46,9 +46,9 @@
 	wait_queue_head_t wait;
 	unsigned int nrbufs, curbuf;
 	struct page *tmp_page;
-	unsigned int readers;
-	unsigned int writers;
-	unsigned int waiting_writers;
+	atomic_t readers;
+	atomic_t writers;
+	atomic_t waiting_writers;
 	unsigned int r_counter;
 	unsigned int w_counter;
 	struct fasync_struct *fasync_readers;
diff -uriN linux-2.6.32.43/include/linux/poison.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/poison.h
--- linux-2.6.32.43/include/linux/poison.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/poison.h	2011-07-15 05:51:19.000000000 -0500
@@ -19,8 +19,8 @@
  * under normal circumstances, used to verify that nobody uses
  * non-initialized list entries.
  */
-#define LIST_POISON1  ((void *) 0x00100100 + POISON_POINTER_DELTA)
-#define LIST_POISON2  ((void *) 0x00200200 + POISON_POINTER_DELTA)
+#define LIST_POISON1  ((void *) (long)0xFFFFFF01)
+#define LIST_POISON2  ((void *) (long)0xFFFFFF02)
 
 /********** include/linux/timer.h **********/
 /*
diff -uriN linux-2.6.32.43/include/linux/proc_fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/proc_fs.h
--- linux-2.6.32.43/include/linux/proc_fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/proc_fs.h	2011-07-15 05:51:19.000000000 -0500
@@ -56,6 +56,7 @@
 	nlink_t nlink;
 	uid_t uid;
 	gid_t gid;
+	int vx_flags;
 	loff_t size;
 	const struct inode_operations *proc_iops;
 	/*
@@ -155,6 +156,19 @@
 	return proc_create_data(name, mode, parent, proc_fops, NULL);
 }
 
+static inline struct proc_dir_entry *proc_create_grsec(const char *name, mode_t mode,
+	struct proc_dir_entry *parent, const struct file_operations *proc_fops)
+{
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+	return proc_create_data(name, S_IRUSR, parent, proc_fops, NULL);
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	return proc_create_data(name, S_IRUSR | S_IRGRP, parent, proc_fops, NULL);
+#else
+	return proc_create_data(name, mode, parent, proc_fops, NULL);
+#endif
+}
+	
+
 static inline struct proc_dir_entry *create_proc_read_entry(const char *name,
 	mode_t mode, struct proc_dir_entry *base, 
 	read_proc_t *read_proc, void * data)
@@ -250,12 +264,18 @@
 extern void kclist_add(struct kcore_list *, void *, size_t, int type);
 #endif
 
+struct vx_info;
+struct nx_info;
+
 union proc_op {
 	int (*proc_get_link)(struct inode *, struct path *);
 	int (*proc_read)(struct task_struct *task, char *page);
 	int (*proc_show)(struct seq_file *m,
 		struct pid_namespace *ns, struct pid *pid,
 		struct task_struct *task);
+	int (*proc_vs_read)(char *page);
+	int (*proc_vxi_read)(struct vx_info *vxi, char *page);
+	int (*proc_nxi_read)(struct nx_info *nxi, char *page);
 };
 
 struct ctl_table_header;
@@ -263,6 +283,7 @@
 
 struct proc_inode {
 	struct pid *pid;
+	int vx_flags;
 	int fd;
 	union proc_op op;
 	struct proc_dir_entry *pde;
diff -uriN linux-2.6.32.43/include/linux/ptrace.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ptrace.h
--- linux-2.6.32.43/include/linux/ptrace.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/ptrace.h	2011-07-15 05:51:19.000000000 -0500
@@ -96,10 +96,10 @@
 extern void exit_ptrace(struct task_struct *tracer);
 #define PTRACE_MODE_READ   1
 #define PTRACE_MODE_ATTACH 2
-/* Returns 0 on success, -errno on denial. */
-extern int __ptrace_may_access(struct task_struct *task, unsigned int mode);
 /* Returns true on success, false on denial. */
 extern bool ptrace_may_access(struct task_struct *task, unsigned int mode);
+/* Returns true on success, false on denial. */
+extern bool ptrace_may_access_log(struct task_struct *task, unsigned int mode);
 
 static inline int ptrace_reparented(struct task_struct *child)
 {
diff -uriN linux-2.6.32.43/include/linux/quotaops.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/quotaops.h
--- linux-2.6.32.43/include/linux/quotaops.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/quotaops.h	2011-07-15 05:50:11.000000000 -0500
@@ -8,6 +8,7 @@
 #define _LINUX_QUOTAOPS_
 
 #include <linux/fs.h>
+#include <linux/vs_dlimit.h>
 
 static inline struct quota_info *sb_dqopt(struct super_block *sb)
 {
@@ -157,10 +158,14 @@
  * a transaction (deadlocks possible otherwise) */
 static inline int vfs_dq_prealloc_space_nodirty(struct inode *inode, qsize_t nr)
 {
+	if (dl_alloc_space(inode, nr))
+		return 1;
 	if (sb_any_quota_active(inode->i_sb)) {
 		/* Used space is updated in alloc_space() */
-		if (inode->i_sb->dq_op->alloc_space(inode, nr, 1) == NO_QUOTA)
+		if (inode->i_sb->dq_op->alloc_space(inode, nr, 1) == NO_QUOTA) {
+			dl_free_space(inode, nr);
 			return 1;
+		}
 	}
 	else
 		inode_add_bytes(inode, nr);
@@ -177,10 +182,14 @@
 
 static inline int vfs_dq_alloc_space_nodirty(struct inode *inode, qsize_t nr)
 {
+	if (dl_alloc_space(inode, nr))
+		return 1;
 	if (sb_any_quota_active(inode->i_sb)) {
 		/* Used space is updated in alloc_space() */
-		if (inode->i_sb->dq_op->alloc_space(inode, nr, 0) == NO_QUOTA)
+		if (inode->i_sb->dq_op->alloc_space(inode, nr, 0) == NO_QUOTA) {
+			dl_free_space(inode, nr);
 			return 1;
+		}
 	}
 	else
 		inode_add_bytes(inode, nr);
@@ -197,10 +206,14 @@
 
 static inline int vfs_dq_reserve_space(struct inode *inode, qsize_t nr)
 {
+	if (dl_reserve_space(inode, nr))
+		return 1;
 	if (sb_any_quota_active(inode->i_sb)) {
 		/* Used space is updated in alloc_space() */
-		if (inode->i_sb->dq_op->reserve_space(inode, nr, 0) == NO_QUOTA)
+		if (inode->i_sb->dq_op->reserve_space(inode, nr, 0) == NO_QUOTA) {
+			dl_release_space(inode, nr);
 			return 1;
+		}
 	}
 	else
 		inode_add_rsv_space(inode, nr);
@@ -209,10 +222,14 @@
 
 static inline int vfs_dq_alloc_inode(struct inode *inode)
 {
+	if (dl_alloc_inode(inode))
+		return 1;
 	if (sb_any_quota_active(inode->i_sb)) {
 		vfs_dq_init(inode);
-		if (inode->i_sb->dq_op->alloc_inode(inode, 1) == NO_QUOTA)
+		if (inode->i_sb->dq_op->alloc_inode(inode, 1) == NO_QUOTA) {
+			dl_free_inode(inode);
 			return 1;
+		}
 	}
 	return 0;
 }
@@ -222,9 +239,13 @@
  */
 static inline int vfs_dq_claim_space(struct inode *inode, qsize_t nr)
 {
+	if (dl_claim_space(inode, nr))
+		return 1;
 	if (sb_any_quota_active(inode->i_sb)) {
-		if (inode->i_sb->dq_op->claim_space(inode, nr) == NO_QUOTA)
+		if (inode->i_sb->dq_op->claim_space(inode, nr) == NO_QUOTA) {
+			dl_release_space(inode, nr);
 			return 1;
+		}
 	} else
 		inode_claim_rsv_space(inode, nr);
 
@@ -242,6 +263,7 @@
 		inode->i_sb->dq_op->release_rsv(inode, nr);
 	else
 		inode_sub_rsv_space(inode, nr);
+	dl_release_space(inode, nr);
 }
 
 static inline void vfs_dq_free_space_nodirty(struct inode *inode, qsize_t nr)
@@ -250,6 +272,7 @@
 		inode->i_sb->dq_op->free_space(inode, nr);
 	else
 		inode_sub_bytes(inode, nr);
+	dl_free_space(inode, nr);
 }
 
 static inline void vfs_dq_free_space(struct inode *inode, qsize_t nr)
@@ -262,6 +285,7 @@
 {
 	if (sb_any_quota_active(inode->i_sb))
 		inode->i_sb->dq_op->free_inode(inode, 1);
+	dl_free_inode(inode);
 }
 
 /* Cannot be called inside a transaction */
@@ -365,6 +389,8 @@
 
 static inline int vfs_dq_prealloc_space_nodirty(struct inode *inode, qsize_t nr)
 {
+	if (dl_alloc_space(inode, nr))
+		return 1;
 	inode_add_bytes(inode, nr);
 	return 0;
 }
@@ -378,6 +404,8 @@
 
 static inline int vfs_dq_alloc_space_nodirty(struct inode *inode, qsize_t nr)
 {
+	if (dl_alloc_space(inode, nr))
+		return 1;
 	inode_add_bytes(inode, nr);
 	return 0;
 }
@@ -391,22 +419,28 @@
 
 static inline int vfs_dq_reserve_space(struct inode *inode, qsize_t nr)
 {
+	if (dl_reserve_space(inode, nr))
+		return 1;
 	return 0;
 }
 
 static inline int vfs_dq_claim_space(struct inode *inode, qsize_t nr)
 {
+	if (dl_claim_space(inode, nr))
+		return 1;
 	return vfs_dq_alloc_space(inode, nr);
 }
 
 static inline
 int vfs_dq_release_reservation_space(struct inode *inode, qsize_t nr)
 {
+	dl_release_space(inode, nr);
 	return 0;
 }
 
 static inline void vfs_dq_free_space_nodirty(struct inode *inode, qsize_t nr)
 {
+	dl_free_space(inode, nr);
 	inode_sub_bytes(inode, nr);
 }
 
diff -uriN linux-2.6.32.43/include/linux/random.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/random.h
--- linux-2.6.32.43/include/linux/random.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/random.h	2011-07-15 05:51:19.000000000 -0500
@@ -74,6 +74,11 @@
 u32 random32(void);
 void srandom32(u32 seed);
 
+static inline unsigned long pax_get_random_long(void)
+{
+	return random32() + (sizeof(long) > 4 ? (unsigned long)random32() << 32 : 0);
+}
+
 #endif /* __KERNEL___ */
 
 #endif /* _LINUX_RANDOM_H */
diff -uriN linux-2.6.32.43/include/linux/reboot.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/reboot.h
--- linux-2.6.32.43/include/linux/reboot.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/reboot.h	2011-07-15 05:51:19.000000000 -0500
@@ -33,6 +33,7 @@
 #define	LINUX_REBOOT_CMD_RESTART2	0xA1B2C3D4
 #define	LINUX_REBOOT_CMD_SW_SUSPEND	0xD000FCE2
 #define	LINUX_REBOOT_CMD_KEXEC		0x45584543
+#define	LINUX_REBOOT_CMD_OOM		0xDEADBEEF
 
 
 #ifdef __KERNEL__
@@ -47,9 +48,9 @@
  * Architecture-specific implementations of sys_reboot commands.
  */
 
-extern void machine_restart(char *cmd);
-extern void machine_halt(void);
-extern void machine_power_off(void);
+extern void machine_restart(char *cmd) __noreturn;
+extern void machine_halt(void) __noreturn;
+extern void machine_power_off(void) __noreturn;
 
 extern void machine_shutdown(void);
 struct pt_regs;
@@ -60,9 +61,9 @@
  */
 
 extern void kernel_restart_prepare(char *cmd);
-extern void kernel_restart(char *cmd);
-extern void kernel_halt(void);
-extern void kernel_power_off(void);
+extern void kernel_restart(char *cmd) __noreturn;
+extern void kernel_halt(void) __noreturn;
+extern void kernel_power_off(void) __noreturn;
 
 void ctrl_alt_del(void);
 
@@ -75,7 +76,7 @@
  * Emergency restart, callable from an interrupt handler.
  */
 
-extern void emergency_restart(void);
+extern void emergency_restart(void) __noreturn;
 #include <asm/emergency-restart.h>
 
 #endif
diff -uriN linux-2.6.32.43/include/linux/reiserfs_fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/reiserfs_fs.h
--- linux-2.6.32.43/include/linux/reiserfs_fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/reiserfs_fs.h	2011-07-15 05:51:19.000000000 -0500
@@ -899,6 +899,11 @@
 #define REISERFS_COMPR_FL     FS_COMPR_FL
 #define REISERFS_NOTAIL_FL    FS_NOTAIL_FL
 
+/* unfortunately reiserfs sdattr is only 16 bit */
+#define REISERFS_IXUNLINK_FL  (FS_IXUNLINK_FL >> 16)
+#define REISERFS_BARRIER_FL   (FS_BARRIER_FL >> 16)
+#define REISERFS_COW_FL       (FS_COW_FL >> 16)
+
 /* persistent flags that file inherits from the parent directory */
 #define REISERFS_INHERIT_MASK ( REISERFS_IMMUTABLE_FL |	\
 				REISERFS_SYNC_FL |	\
@@ -908,6 +913,9 @@
 				REISERFS_COMPR_FL |	\
 				REISERFS_NOTAIL_FL )
 
+#define REISERFS_FL_USER_VISIBLE	0x80FF
+#define REISERFS_FL_USER_MODIFIABLE	0x80FF
+
 /* Stat Data on disk (reiserfs version of UFS disk inode minus the
    address blocks) */
 struct stat_data {
@@ -1326,7 +1334,7 @@
 #define REISERFS_USER_MEM		1	/* reiserfs user memory mode            */
 
 #define fs_generation(s) (REISERFS_SB(s)->s_generation_counter)
-#define get_generation(s) atomic_read (&fs_generation(s))
+#define get_generation(s) atomic_read_unchecked (&fs_generation(s))
 #define FILESYSTEM_CHANGED_TB(tb)  (get_generation((tb)->tb_sb) != (tb)->fs_gen)
 #define __fs_changed(gen,s) (gen != get_generation (s))
 #define fs_changed(gen,s) ({cond_resched(); __fs_changed(gen, s);})
@@ -1534,24 +1542,24 @@
 */
 
 struct item_operations {
-	int (*bytes_number) (struct item_head * ih, int block_size);
-	void (*decrement_key) (struct cpu_key *);
-	int (*is_left_mergeable) (struct reiserfs_key * ih,
+	int (* const bytes_number) (struct item_head * ih, int block_size);
+	void (* const decrement_key) (struct cpu_key *);
+	int (* const is_left_mergeable) (struct reiserfs_key * ih,
 				  unsigned long bsize);
-	void (*print_item) (struct item_head *, char *item);
-	void (*check_item) (struct item_head *, char *item);
+	void (* const print_item) (struct item_head *, char *item);
+	void (* const check_item) (struct item_head *, char *item);
 
-	int (*create_vi) (struct virtual_node * vn, struct virtual_item * vi,
+	int (* const create_vi) (struct virtual_node * vn, struct virtual_item * vi,
 			  int is_affected, int insert_size);
-	int (*check_left) (struct virtual_item * vi, int free,
+	int (* const check_left) (struct virtual_item * vi, int free,
 			   int start_skip, int end_skip);
-	int (*check_right) (struct virtual_item * vi, int free);
-	int (*part_size) (struct virtual_item * vi, int from, int to);
-	int (*unit_num) (struct virtual_item * vi);
-	void (*print_vi) (struct virtual_item * vi);
+	int (* const check_right) (struct virtual_item * vi, int free);
+	int (* const part_size) (struct virtual_item * vi, int from, int to);
+	int (* const unit_num) (struct virtual_item * vi);
+	void (* const print_vi) (struct virtual_item * vi);
 };
 
-extern struct item_operations *item_ops[TYPE_ANY + 1];
+extern const struct item_operations * const item_ops[TYPE_ANY + 1];
 
 #define op_bytes_number(ih,bsize)                    item_ops[le_ih_k_type (ih)]->bytes_number (ih, bsize)
 #define op_is_left_mergeable(key,bsize)              item_ops[le_key_k_type (le_key_version (key), key)]->is_left_mergeable (key, bsize)
@@ -1989,6 +1997,7 @@
 void sd_attrs_to_i_attrs(__u16 sd_attrs, struct inode *inode);
 void i_attrs_to_sd_attrs(struct inode *inode, __u16 * sd_attrs);
 int reiserfs_setattr(struct dentry *dentry, struct iattr *attr);
+int reiserfs_sync_flags(struct inode *inode, int, int);
 
 /* namei.c */
 void set_de_name_and_namelen(struct reiserfs_dir_entry *de);
diff -uriN linux-2.6.32.43/include/linux/reiserfs_fs_sb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/reiserfs_fs_sb.h
--- linux-2.6.32.43/include/linux/reiserfs_fs_sb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/reiserfs_fs_sb.h	2011-07-15 05:51:19.000000000 -0500
@@ -377,7 +377,7 @@
 	/* Comment? -Hans */
 	wait_queue_head_t s_wait;
 	/* To be obsoleted soon by per buffer seals.. -Hans */
-	atomic_t s_generation_counter;	// increased by one every time the
+	atomic_unchecked_t s_generation_counter;	// increased by one every time the
 	// tree gets re-balanced
 	unsigned long s_properties;	/* File system properties. Currently holds
 					   on-disk FS format */
@@ -456,6 +456,7 @@
 	REISERFS_EXPOSE_PRIVROOT,
 	REISERFS_BARRIER_NONE,
 	REISERFS_BARRIER_FLUSH,
+	REISERFS_TAGGED,
 
 	/* Actions on error */
 	REISERFS_ERROR_PANIC,
diff -uriN linux-2.6.32.43/include/linux/sched.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sched.h
--- linux-2.6.32.43/include/linux/sched.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sched.h	2011-07-15 05:51:19.000000000 -0500
@@ -101,6 +101,7 @@
 struct fs_struct;
 struct bts_context;
 struct perf_event_context;
+struct linux_binprm;
 
 /*
  * List of flags we want to share for kernel threads,
@@ -350,7 +351,7 @@
 extern signed long schedule_timeout_uninterruptible(signed long timeout);
 asmlinkage void __schedule(void);
 asmlinkage void schedule(void);
-extern int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner);
+extern int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner);
 
 struct nsproxy;
 struct user_namespace;
@@ -371,9 +372,12 @@
 #define DEFAULT_MAX_MAP_COUNT	(USHORT_MAX - MAPCOUNT_ELF_CORE_MARGIN)
 
 extern int sysctl_max_map_count;
+extern unsigned long sysctl_heap_stack_gap;
 
 #include <linux/aio.h>
 
+extern bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len);
+extern unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len);
 extern unsigned long
 arch_get_unmapped_area(struct file *, unsigned long, unsigned long,
 		       unsigned long, unsigned long);
@@ -389,25 +393,28 @@
  * The mm counters are not protected by its page_table_lock,
  * so must be incremented atomically.
  */
-#define set_mm_counter(mm, member, value) atomic_long_set(&(mm)->_##member, value)
-#define get_mm_counter(mm, member) ((unsigned long)atomic_long_read(&(mm)->_##member))
-#define add_mm_counter(mm, member, value) atomic_long_add(value, &(mm)->_##member)
-#define inc_mm_counter(mm, member) atomic_long_inc(&(mm)->_##member)
-#define dec_mm_counter(mm, member) atomic_long_dec(&(mm)->_##member)
+#define __set_mm_counter(mm, member, value) \
+	atomic_long_set(&(mm)->_##member, value)
+#define get_mm_counter(mm, member) \
+	((unsigned long)atomic_long_read(&(mm)->_##member))
 
 #else  /* !USE_SPLIT_PTLOCKS */
 /*
  * The mm counters are protected by its page_table_lock,
  * so can be incremented directly.
  */
-#define set_mm_counter(mm, member, value) (mm)->_##member = (value)
+#define __set_mm_counter(mm, member, value) (mm)->_##member = (value)
 #define get_mm_counter(mm, member) ((mm)->_##member)
-#define add_mm_counter(mm, member, value) (mm)->_##member += (value)
-#define inc_mm_counter(mm, member) (mm)->_##member++
-#define dec_mm_counter(mm, member) (mm)->_##member--
 
 #endif /* !USE_SPLIT_PTLOCKS */
 
+#define set_mm_counter(mm, member, value) \
+	vx_ ## member ## pages_sub((mm), (get_mm_counter(mm, member) - value))
+#define add_mm_counter(mm, member, value) \
+	vx_ ## member ## pages_add((mm), (value))
+#define inc_mm_counter(mm, member) vx_ ## member ## pages_inc((mm))
+#define dec_mm_counter(mm, member) vx_ ## member ## pages_dec((mm))
+
 #define get_mm_rss(mm)					\
 	(get_mm_counter(mm, file_rss) + get_mm_counter(mm, anon_rss))
 #define update_hiwater_rss(mm)	do {			\
@@ -666,6 +673,16 @@
 	struct tty_audit_buf *tty_audit_buf;
 #endif
 
+#ifdef CONFIG_GRKERNSEC
+	u32 curr_ip;
+	u32 saved_ip;
+	u32 gr_saddr;
+	u32 gr_daddr;
+	u16 gr_sport;
+	u16 gr_dport;
+	u8 used_accept:1;
+#endif
+
 	int oom_adj;	/* OOM kill score adjustment (bit shift) */
 };
 
@@ -723,6 +740,11 @@
 	struct key *session_keyring;	/* UID's default session keyring */
 #endif
 
+#if defined(CONFIG_GRKERNSEC_KERN_LOCKOUT) || defined(CONFIG_GRKERNSEC_BRUTE)
+	unsigned int banned;
+	unsigned long ban_expires;
+#endif
+
 	/* Hash table maintenance information */
 	struct hlist_node uidhash_node;
 	uid_t uid;
@@ -1185,6 +1207,12 @@
 	u64			nr_wakeups_affine_attempts;
 	u64			nr_wakeups_passive;
 	u64			nr_wakeups_idle;
+#ifdef CONFIG_CFS_HARD_LIMITS
+	u64			throttle_start;
+	u64			throttle_max;
+	u64			throttle_count;
+	u64			throttle_sum;
+#endif
 #endif
 
 #ifdef CONFIG_FAIR_GROUP_SCHED
@@ -1328,8 +1356,8 @@
 	struct list_head thread_group;
 
 	struct completion *vfork_done;		/* for vfork() */
-	int __user *set_child_tid;		/* CLONE_CHILD_SETTID */
-	int __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
+	pid_t __user *set_child_tid;		/* CLONE_CHILD_SETTID */
+	pid_t __user *clear_child_tid;		/* CLONE_CHILD_CLEARTID */
 
 	cputime_t utime, stime, utimescaled, stimescaled;
 	cputime_t gtime;
@@ -1343,16 +1371,6 @@
 	struct task_cputime cputime_expires;
 	struct list_head cpu_timers[3];
 
-/* process credentials */
-	const struct cred *real_cred;	/* objective and real subjective task
-					 * credentials (COW) */
-	const struct cred *cred;	/* effective (overridable) subjective task
-					 * credentials (COW) */
-	struct mutex cred_guard_mutex;	/* guard against foreign influences on
-					 * credential calculations
-					 * (notably. ptrace) */
-	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
-
 	char comm[TASK_COMM_LEN]; /* executable name excluding path
 				     - access with [gs]et_task_comm (which lock
 				       it with task_lock())
@@ -1369,6 +1387,10 @@
 #endif
 /* CPU-specific state of this task */
 	struct thread_struct thread;
+/* thread_info moved to task_struct */
+#ifdef CONFIG_X86
+	struct thread_info tinfo;
+#endif
 /* filesystem information */
 	struct fs_struct *fs;
 /* open file information */
@@ -1395,6 +1417,14 @@
 #endif
 	seccomp_t seccomp;
 
+/* vserver context data */
+	struct vx_info *vx_info;
+	struct nx_info *nx_info;
+
+	xid_t xid;
+	nid_t nid;
+	tag_t tag;
+
 /* Thread group tracking */
    	u32 parent_exec_id;
    	u32 self_exec_id;
@@ -1436,6 +1466,15 @@
 	int hardirq_context;
 	int softirq_context;
 #endif
+
+/* process credentials */
+	const struct cred *real_cred;	/* objective and real subjective task
+					 * credentials (COW) */
+	struct mutex cred_guard_mutex;	/* guard against foreign influences on
+					 * credential calculations
+					 * (notably. ptrace) */
+	struct cred *replacement_session_keyring; /* for KEYCTL_SESSION_TO_PARENT */
+
 #ifdef CONFIG_LOCKDEP
 # define MAX_LOCK_DEPTH 48UL
 	u64 curr_chain_key;
@@ -1456,6 +1495,9 @@
 
 	struct backing_dev_info *backing_dev_info;
 
+	const struct cred *cred;	/* effective (overridable) subjective task
+					 * credentials (COW) */
+
 	struct io_context *io_context;
 
 	unsigned long ptrace_message;
@@ -1519,6 +1561,21 @@
 	unsigned long default_timer_slack_ns;
 
 	struct list_head	*scm_work_list;
+
+#ifdef CONFIG_GRKERNSEC
+	/* grsecurity */
+	struct dentry *gr_chroot_dentry;
+	struct acl_subject_label *acl;
+	struct acl_role_label *role;
+	struct file *exec_file;
+	u16 acl_role_id;
+	/* is this the task that authenticated to the special role */
+	u8 acl_sp_role;
+	u8 is_writable;
+	u8 brute;
+	u8 gr_is_chrooted;
+#endif
+
 #ifdef CONFIG_FUNCTION_GRAPH_TRACER
 	/* Index of current stored adress in ret_stack */
 	int curr_ret_stack;
@@ -1542,6 +1599,57 @@
 #endif /* CONFIG_TRACING */
 };
 
+#define MF_PAX_PAGEEXEC		0x01000000	/* Paging based non-executable pages */
+#define MF_PAX_EMUTRAMP		0x02000000	/* Emulate trampolines */
+#define MF_PAX_MPROTECT		0x04000000	/* Restrict mprotect() */
+#define MF_PAX_RANDMMAP		0x08000000	/* Randomize mmap() base */
+/*#define MF_PAX_RANDEXEC		0x10000000*/	/* Randomize ET_EXEC base */
+#define MF_PAX_SEGMEXEC		0x20000000	/* Segmentation based non-executable pages */
+
+#ifdef CONFIG_PAX_SOFTMODE
+extern unsigned int pax_softmode;
+#endif
+
+extern int pax_check_flags(unsigned long *);
+
+/* if tsk != current then task_lock must be held on it */
+#if defined(CONFIG_PAX_NOEXEC) || defined(CONFIG_PAX_ASLR)
+static inline unsigned long pax_get_flags(struct task_struct *tsk)
+{
+	if (likely(tsk->mm))
+		return tsk->mm->pax_flags;
+	else
+		return 0UL;
+}
+
+/* if tsk != current then task_lock must be held on it */
+static inline long pax_set_flags(struct task_struct *tsk, unsigned long flags)
+{
+	if (likely(tsk->mm)) {
+		tsk->mm->pax_flags = flags;
+		return 0;
+	}
+	return -EINVAL;
+}
+#endif
+
+#ifdef CONFIG_PAX_HAVE_ACL_FLAGS
+extern void pax_set_initial_flags(struct linux_binprm *bprm);
+#elif defined(CONFIG_PAX_HOOK_ACL_FLAGS)
+extern void (*pax_set_initial_flags_func)(struct linux_binprm *bprm);
+#endif
+
+extern void pax_report_fault(struct pt_regs *regs, void *pc, void *sp);
+extern void pax_report_insns(void *pc, void *sp);
+extern void pax_report_refcount_overflow(struct pt_regs *regs);
+extern NORET_TYPE void pax_report_usercopy(const void *ptr, unsigned long len, bool to, const char *type) ATTRIB_NORET;
+
+#ifdef CONFIG_PAX_MEMORY_STACKLEAK
+extern void pax_track_stack(void);
+#else
+static inline void pax_track_stack(void) {}
+#endif
+
 /* Future-safe accessor for struct task_struct's cpus_allowed. */
 #define tsk_cpumask(tsk) (&(tsk)->cpus_allowed)
 
@@ -1619,6 +1727,11 @@
 pid_t __task_pid_nr_ns(struct task_struct *task, enum pid_type type,
 			struct pid_namespace *ns);
 
+#include <linux/vserver/base.h>
+#include <linux/vserver/context.h>
+#include <linux/vserver/debug.h>
+#include <linux/vserver/pid.h>
+
 static inline pid_t task_pid_nr(struct task_struct *tsk)
 {
 	return tsk->pid;
@@ -1632,7 +1745,8 @@
 
 static inline pid_t task_pid_vnr(struct task_struct *tsk)
 {
-	return __task_pid_nr_ns(tsk, PIDTYPE_PID, NULL);
+	// return __task_pid_nr_ns(tsk, PIDTYPE_PID, NULL);
+	return vx_map_pid(__task_pid_nr_ns(tsk, PIDTYPE_PID, NULL));
 }
 
 
@@ -1645,7 +1759,7 @@
 
 static inline pid_t task_tgid_vnr(struct task_struct *tsk)
 {
-	return pid_vnr(task_tgid(tsk));
+	return vx_map_tgid(pid_vnr(task_tgid(tsk)));
 }
 
 
@@ -1978,7 +2092,9 @@
 extern struct exec_domain	default_exec_domain;
 
 union thread_union {
+#ifndef CONFIG_X86
 	struct thread_info thread_info;
+#endif
 	unsigned long stack[THREAD_SIZE/sizeof(long)];
 };
 
@@ -2011,6 +2127,7 @@
  */
 
 extern struct task_struct *find_task_by_vpid(pid_t nr);
+extern struct task_struct *find_task_by_vpid_unrestricted(pid_t nr);
 extern struct task_struct *find_task_by_pid_ns(pid_t nr,
 		struct pid_namespace *ns);
 
@@ -2155,7 +2272,7 @@
 extern void exit_itimers(struct signal_struct *);
 extern void flush_itimer_signals(void);
 
-extern NORET_TYPE void do_group_exit(int);
+extern NORET_TYPE void do_group_exit(int) ATTRIB_NORET;
 
 extern void daemonize(const char *, ...);
 extern int allow_signal(int);
@@ -2284,13 +2401,17 @@
 
 #endif
 
-static inline int object_is_on_stack(void *obj)
+static inline int object_starts_on_stack(void *obj)
 {
-	void *stack = task_stack_page(current);
+	const void *stack = task_stack_page(current);
 
 	return (obj >= stack) && (obj < (stack + THREAD_SIZE));
 }
 
+#ifdef CONFIG_PAX_USERCOPY
+extern int object_is_on_stack(const void *obj, unsigned long len);
+#endif
+
 extern void thread_info_cache_init(void);
 
 #ifdef CONFIG_DEBUG_STACK_USAGE
diff -uriN linux-2.6.32.43/include/linux/screen_info.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/screen_info.h
--- linux-2.6.32.43/include/linux/screen_info.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/screen_info.h	2011-07-15 05:51:19.000000000 -0500
@@ -42,7 +42,8 @@
 	__u16 pages;		/* 0x32 */
 	__u16 vesa_attributes;	/* 0x34 */
 	__u32 capabilities;     /* 0x36 */
-	__u8  _reserved[6];	/* 0x3a */
+	__u16 vesapm_size;	/* 0x3a */
+	__u8  _reserved[4];	/* 0x3c */
 } __attribute__((packed));
 
 #define VIDEO_TYPE_MDA		0x10	/* Monochrome Text Display	*/
diff -uriN linux-2.6.32.43/include/linux/security.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/security.h
--- linux-2.6.32.43/include/linux/security.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/security.h	2011-07-15 05:51:19.000000000 -0500
@@ -34,6 +34,7 @@
 #include <linux/key.h>
 #include <linux/xfrm.h>
 #include <linux/gfp.h>
+#include <linux/grsecurity.h>
 #include <net/flow.h>
 
 /* Maximum number of letters for an LSM name string */
diff -uriN linux-2.6.32.43/include/linux/shmem_fs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/shmem_fs.h
--- linux-2.6.32.43/include/linux/shmem_fs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/shmem_fs.h	2011-07-15 05:50:11.000000000 -0500
@@ -8,6 +8,9 @@
 
 #define SHMEM_NR_DIRECT 16
 
+#define TMPFS_SUPER_MAGIC	0x01021994
+
+
 struct shmem_inode_info {
 	spinlock_t		lock;
 	unsigned long		flags;
diff -uriN linux-2.6.32.43/include/linux/shm.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/shm.h
--- linux-2.6.32.43/include/linux/shm.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/shm.h	2011-07-15 05:51:19.000000000 -0500
@@ -95,6 +95,10 @@
 	pid_t			shm_cprid;
 	pid_t			shm_lprid;
 	struct user_struct	*mlock_user;
+#ifdef CONFIG_GRKERNSEC
+	time_t			shm_createtime;
+	pid_t			shm_lapid;
+#endif
 };
 
 /* shm_mode upper byte flags */
diff -uriN linux-2.6.32.43/include/linux/skbuff.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/skbuff.h
--- linux-2.6.32.43/include/linux/skbuff.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/skbuff.h	2011-07-15 05:51:19.000000000 -0500
@@ -544,7 +544,7 @@
  */
 static inline int skb_queue_empty(const struct sk_buff_head *list)
 {
-	return list->next == (struct sk_buff *)list;
+	return list->next == (const struct sk_buff *)list;
 }
 
 /**
@@ -557,7 +557,7 @@
 static inline bool skb_queue_is_last(const struct sk_buff_head *list,
 				     const struct sk_buff *skb)
 {
-	return (skb->next == (struct sk_buff *) list);
+	return (skb->next == (const struct sk_buff *) list);
 }
 
 /**
@@ -570,7 +570,7 @@
 static inline bool skb_queue_is_first(const struct sk_buff_head *list,
 				      const struct sk_buff *skb)
 {
-	return (skb->prev == (struct sk_buff *) list);
+	return (skb->prev == (const struct sk_buff *) list);
 }
 
 /**
@@ -1367,7 +1367,7 @@
  * headroom, you should not reduce this.
  */
 #ifndef NET_SKB_PAD
-#define NET_SKB_PAD	32
+#define NET_SKB_PAD	(_AC(32,UL))
 #endif
 
 extern int ___pskb_trim(struct sk_buff *skb, unsigned int len);
diff -uriN linux-2.6.32.43/include/linux/slab_def.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/slab_def.h
--- linux-2.6.32.43/include/linux/slab_def.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/slab_def.h	2011-07-15 05:51:19.000000000 -0500
@@ -69,10 +69,10 @@
 	unsigned long node_allocs;
 	unsigned long node_frees;
 	unsigned long node_overflow;
-	atomic_t allochit;
-	atomic_t allocmiss;
-	atomic_t freehit;
-	atomic_t freemiss;
+	atomic_unchecked_t allochit;
+	atomic_unchecked_t allocmiss;
+	atomic_unchecked_t freehit;
+	atomic_unchecked_t freemiss;
 
 	/*
 	 * If debugging is enabled, then the allocator can add additional
diff -uriN linux-2.6.32.43/include/linux/slab.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/slab.h
--- linux-2.6.32.43/include/linux/slab.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/slab.h	2011-07-15 05:51:19.000000000 -0500
@@ -11,12 +11,20 @@
 
 #include <linux/gfp.h>
 #include <linux/types.h>
+#include <linux/err.h>
 
 /*
  * Flags to pass to kmem_cache_create().
  * The ones marked DEBUG are only valid if CONFIG_SLAB_DEBUG is set.
  */
 #define SLAB_DEBUG_FREE		0x00000100UL	/* DEBUG: Perform (expensive) checks on free */
+
+#ifdef CONFIG_PAX_USERCOPY
+#define SLAB_USERCOPY		0x00000200UL	/* PaX: Allow copying objs to/from userland */
+#else
+#define SLAB_USERCOPY		0x00000000UL
+#endif
+
 #define SLAB_RED_ZONE		0x00000400UL	/* DEBUG: Red zone objs in a cache */
 #define SLAB_POISON		0x00000800UL	/* DEBUG: Poison objects */
 #define SLAB_HWCACHE_ALIGN	0x00002000UL	/* Align objs on cache lines */
@@ -82,10 +90,13 @@
  * ZERO_SIZE_PTR can be passed to kfree though in the same way that NULL can.
  * Both make kfree a no-op.
  */
-#define ZERO_SIZE_PTR ((void *)16)
+#define ZERO_SIZE_PTR				\
+({						\
+	BUILD_BUG_ON(!(MAX_ERRNO & ~PAGE_MASK));\
+	(void *)(-MAX_ERRNO-1L);		\
+})
 
-#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) <= \
-				(unsigned long)ZERO_SIZE_PTR)
+#define ZERO_OR_NULL_PTR(x) ((unsigned long)(x) - 1 >= (unsigned long)ZERO_SIZE_PTR - 1)
 
 /*
  * struct kmem_cache related prototypes
@@ -138,6 +149,7 @@
 void kfree(const void *);
 void kzfree(const void *);
 size_t ksize(const void *);
+void check_object_size(const void *ptr, unsigned long n, bool to);
 
 /*
  * Allocator specific definitions. These are mainly used to establish optimized
@@ -328,4 +340,37 @@
 
 void __init kmem_cache_init_late(void);
 
+#define kmalloc(x, y)					\
+({							\
+	void *___retval;				\
+	intoverflow_t ___x = (intoverflow_t)x;		\
+	if (WARN(___x > ULONG_MAX, "kmalloc size overflow\n"))\
+		___retval = NULL;			\
+	else						\
+		___retval = kmalloc((size_t)___x, (y));	\
+	___retval;					\
+})
+
+#define kmalloc_node(x, y, z)					\
+({								\
+	void *___retval;					\
+	intoverflow_t ___x = (intoverflow_t)x;			\
+	if (WARN(___x > ULONG_MAX, "kmalloc_node size overflow\n"))\
+		___retval = NULL;				\
+	else							\
+		___retval = kmalloc_node((size_t)___x, (y), (z));\
+	___retval;						\
+})
+
+#define kzalloc(x, y)					\
+({							\
+	void *___retval;				\
+	intoverflow_t ___x = (intoverflow_t)x;		\
+	if (WARN(___x > ULONG_MAX, "kzalloc size overflow\n"))\
+		___retval = NULL;			\
+	else						\
+		___retval = kzalloc((size_t)___x, (y));	\
+	___retval;					\
+})
+
 #endif	/* _LINUX_SLAB_H */
diff -uriN linux-2.6.32.43/include/linux/slub_def.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/slub_def.h
--- linux-2.6.32.43/include/linux/slub_def.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/slub_def.h	2011-07-15 05:51:19.000000000 -0500
@@ -86,7 +86,7 @@
 	struct kmem_cache_order_objects max;
 	struct kmem_cache_order_objects min;
 	gfp_t allocflags;	/* gfp flags to use on each alloc */
-	int refcount;		/* Refcount for slab cache destroy */
+	atomic_t refcount;	/* Refcount for slab cache destroy */
 	void (*ctor)(void *);
 	int inuse;		/* Offset to metadata */
 	int align;		/* Alignment */
diff -uriN linux-2.6.32.43/include/linux/sonet.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sonet.h
--- linux-2.6.32.43/include/linux/sonet.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sonet.h	2011-07-15 05:51:19.000000000 -0500
@@ -61,7 +61,7 @@
 #include <asm/atomic.h>
 
 struct k_sonet_stats {
-#define __HANDLE_ITEM(i) atomic_t i
+#define __HANDLE_ITEM(i) atomic_unchecked_t i
 	__SONET_ITEMS
 #undef __HANDLE_ITEM
 };
diff -uriN linux-2.6.32.43/include/linux/stat.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/stat.h
--- linux-2.6.32.43/include/linux/stat.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/stat.h	2011-07-15 05:50:11.000000000 -0500
@@ -66,6 +66,7 @@
 	unsigned int	nlink;
 	uid_t		uid;
 	gid_t		gid;
+	tag_t		tag;
 	dev_t		rdev;
 	loff_t		size;
 	struct timespec  atime;
diff -uriN linux-2.6.32.43/include/linux/sunrpc/auth.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sunrpc/auth.h
--- linux-2.6.32.43/include/linux/sunrpc/auth.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sunrpc/auth.h	2011-07-15 05:50:11.000000000 -0500
@@ -25,6 +25,7 @@
 struct auth_cred {
 	uid_t	uid;
 	gid_t	gid;
+	tag_t	tag;
 	struct group_info *group_info;
 	unsigned char machine_cred : 1;
 };
diff -uriN linux-2.6.32.43/include/linux/sunrpc/clnt.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sunrpc/clnt.h
--- linux-2.6.32.43/include/linux/sunrpc/clnt.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sunrpc/clnt.h	2011-07-15 05:51:19.000000000 -0500
@@ -49,7 +49,8 @@
 	unsigned int		cl_softrtry : 1,/* soft timeouts */
 				cl_discrtry : 1,/* disconnect before retry */
 				cl_autobind : 1,/* use getport() */
-				cl_chatty   : 1;/* be verbose */
+				cl_chatty   : 1,/* be verbose */
+				cl_tag      : 1;/* context tagging */
 
 	struct rpc_rtt *	cl_rtt;		/* RTO estimator data */
 	const struct rpc_timeout *cl_timeout;	/* Timeout strategy */
@@ -167,9 +168,9 @@
 {
 	switch (sap->sa_family) {
 	case AF_INET:
-		return ntohs(((struct sockaddr_in *)sap)->sin_port);
+		return ntohs(((const struct sockaddr_in *)sap)->sin_port);
 	case AF_INET6:
-		return ntohs(((struct sockaddr_in6 *)sap)->sin6_port);
+		return ntohs(((const struct sockaddr_in6 *)sap)->sin6_port);
 	}
 	return 0;
 }
@@ -202,7 +203,7 @@
 static inline bool __rpc_copy_addr4(struct sockaddr *dst,
 				    const struct sockaddr *src)
 {
-	const struct sockaddr_in *ssin = (struct sockaddr_in *) src;
+	const struct sockaddr_in *ssin = (const struct sockaddr_in *) src;
 	struct sockaddr_in *dsin = (struct sockaddr_in *) dst;
 
 	dsin->sin_family = ssin->sin_family;
@@ -299,7 +300,7 @@
 	if (sa->sa_family != AF_INET6)
 		return 0;
 
-	return ((struct sockaddr_in6 *) sa)->sin6_scope_id;
+	return ((const struct sockaddr_in6 *) sa)->sin6_scope_id;
 }
 
 #endif /* __KERNEL__ */
diff -uriN linux-2.6.32.43/include/linux/sunrpc/svc_rdma.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sunrpc/svc_rdma.h
--- linux-2.6.32.43/include/linux/sunrpc/svc_rdma.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sunrpc/svc_rdma.h	2011-07-15 05:51:19.000000000 -0500
@@ -53,15 +53,15 @@
 extern unsigned int svcrdma_max_requests;
 extern unsigned int svcrdma_max_req_size;
 
-extern atomic_t rdma_stat_recv;
-extern atomic_t rdma_stat_read;
-extern atomic_t rdma_stat_write;
-extern atomic_t rdma_stat_sq_starve;
-extern atomic_t rdma_stat_rq_starve;
-extern atomic_t rdma_stat_rq_poll;
-extern atomic_t rdma_stat_rq_prod;
-extern atomic_t rdma_stat_sq_poll;
-extern atomic_t rdma_stat_sq_prod;
+extern atomic_unchecked_t rdma_stat_recv;
+extern atomic_unchecked_t rdma_stat_read;
+extern atomic_unchecked_t rdma_stat_write;
+extern atomic_unchecked_t rdma_stat_sq_starve;
+extern atomic_unchecked_t rdma_stat_rq_starve;
+extern atomic_unchecked_t rdma_stat_rq_poll;
+extern atomic_unchecked_t rdma_stat_rq_prod;
+extern atomic_unchecked_t rdma_stat_sq_poll;
+extern atomic_unchecked_t rdma_stat_sq_prod;
 
 #define RPCRDMA_VERSION 1
 
diff -uriN linux-2.6.32.43/include/linux/suspend.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/suspend.h
--- linux-2.6.32.43/include/linux/suspend.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/suspend.h	2011-07-15 05:51:19.000000000 -0500
@@ -104,15 +104,15 @@
  *	which require special recovery actions in that situation.
  */
 struct platform_suspend_ops {
-	int (*valid)(suspend_state_t state);
-	int (*begin)(suspend_state_t state);
-	int (*prepare)(void);
-	int (*prepare_late)(void);
-	int (*enter)(suspend_state_t state);
-	void (*wake)(void);
-	void (*finish)(void);
-	void (*end)(void);
-	void (*recover)(void);
+	int (* const valid)(suspend_state_t state);
+	int (* const begin)(suspend_state_t state);
+	int (* const prepare)(void);
+	int (* const prepare_late)(void);
+	int (* const enter)(suspend_state_t state);
+	void (* const wake)(void);
+	void (* const finish)(void);
+	void (* const end)(void);
+	void (* const recover)(void);
 };
 
 #ifdef CONFIG_SUSPEND
@@ -120,7 +120,7 @@
  * suspend_set_ops - set platform dependent suspend operations
  * @ops: The new suspend operations to set.
  */
-extern void suspend_set_ops(struct platform_suspend_ops *ops);
+extern void suspend_set_ops(const struct platform_suspend_ops *ops);
 extern int suspend_valid_only_mem(suspend_state_t state);
 
 /**
@@ -145,7 +145,7 @@
 #else /* !CONFIG_SUSPEND */
 #define suspend_valid_only_mem	NULL
 
-static inline void suspend_set_ops(struct platform_suspend_ops *ops) {}
+static inline void suspend_set_ops(const struct platform_suspend_ops *ops) {}
 static inline int pm_suspend(suspend_state_t state) { return -ENOSYS; }
 #endif /* !CONFIG_SUSPEND */
 
@@ -215,16 +215,16 @@
  *	platforms which require special recovery actions in that situation.
  */
 struct platform_hibernation_ops {
-	int (*begin)(void);
-	void (*end)(void);
-	int (*pre_snapshot)(void);
-	void (*finish)(void);
-	int (*prepare)(void);
-	int (*enter)(void);
-	void (*leave)(void);
-	int (*pre_restore)(void);
-	void (*restore_cleanup)(void);
-	void (*recover)(void);
+	int (* const begin)(void);
+	void (* const end)(void);
+	int (* const pre_snapshot)(void);
+	void (* const finish)(void);
+	int (* const prepare)(void);
+	int (* const enter)(void);
+	void (* const leave)(void);
+	int (* const pre_restore)(void);
+	void (* const restore_cleanup)(void);
+	void (* const recover)(void);
 };
 
 #ifdef CONFIG_HIBERNATION
@@ -243,7 +243,7 @@
 extern void swsusp_unset_page_free(struct page *);
 extern unsigned long get_safe_page(gfp_t gfp_mask);
 
-extern void hibernation_set_ops(struct platform_hibernation_ops *ops);
+extern void hibernation_set_ops(const struct platform_hibernation_ops *ops);
 extern int hibernate(void);
 extern bool system_entering_hibernation(void);
 #else /* CONFIG_HIBERNATION */
@@ -251,7 +251,7 @@
 static inline void swsusp_set_page_free(struct page *p) {}
 static inline void swsusp_unset_page_free(struct page *p) {}
 
-static inline void hibernation_set_ops(struct platform_hibernation_ops *ops) {}
+static inline void hibernation_set_ops(const struct platform_hibernation_ops *ops) {}
 static inline int hibernate(void) { return -ENOSYS; }
 static inline bool system_entering_hibernation(void) { return false; }
 #endif /* CONFIG_HIBERNATION */
diff -uriN linux-2.6.32.43/include/linux/syscalls.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/syscalls.h
--- linux-2.6.32.43/include/linux/syscalls.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/syscalls.h	2011-07-15 05:50:11.000000000 -0500
@@ -548,6 +548,8 @@
 asmlinkage long sys_unlink(const char __user *pathname);
 asmlinkage long sys_rename(const char __user *oldname,
 				const char __user *newname);
+asmlinkage long sys_copyfile(const char __user *from, const char __user *to,
+				umode_t mode);
 asmlinkage long sys_chmod(const char __user *filename, mode_t mode);
 asmlinkage long sys_fchmod(unsigned int fd, mode_t mode);
 
diff -uriN linux-2.6.32.43/include/linux/sysctl.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sysctl.h
--- linux-2.6.32.43/include/linux/sysctl.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sysctl.h	2011-07-15 05:51:19.000000000 -0500
@@ -69,6 +69,7 @@
 	CTL_ABI=9,		/* Binary emulation */
 	CTL_CPU=10,		/* CPU stuff (speed scaling, etc) */
 	CTL_ARLAN=254,		/* arlan wireless driver */
+	CTL_VSERVER=4242,	/* Linux-VServer debug */
 	CTL_S390DBF=5677,	/* s390 debug */
 	CTL_SUNRPC=7249,	/* sunrpc debug */
 	CTL_PM=9899,		/* frv power management */
@@ -103,6 +104,7 @@
 
 	KERN_PANIC=15,		/* int: panic timeout */
 	KERN_REALROOTDEV=16,	/* real root device to mount after initrd */
+	KERN_VSHELPER=17,	/* string: path to vshelper policy agent */
 
 	KERN_SPARC_REBOOT=21,	/* reboot command on Sparc */
 	KERN_CTLALTDEL=22,	/* int: allow ctl-alt-del to reboot */
@@ -164,7 +166,11 @@
 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
 };
 
-
+#ifdef CONFIG_PAX_SOFTMODE
+enum {
+	PAX_SOFTMODE=1		/* PaX: disable/enable soft mode */
+};
+#endif
 
 /* CTL_VM names: */
 enum
@@ -982,6 +988,8 @@
 
 extern int proc_dostring(struct ctl_table *, int,
 			 void __user *, size_t *, loff_t *);
+extern int proc_dostring_modpriv(struct ctl_table *, int,
+			 void __user *, size_t *, loff_t *);
 extern int proc_dointvec(struct ctl_table *, int,
 			 void __user *, size_t *, loff_t *);
 extern int proc_dointvec_minmax(struct ctl_table *, int,
@@ -1003,6 +1011,7 @@
 
 extern ctl_handler sysctl_data;
 extern ctl_handler sysctl_string;
+extern ctl_handler sysctl_string_modpriv;
 extern ctl_handler sysctl_intvec;
 extern ctl_handler sysctl_jiffies;
 extern ctl_handler sysctl_ms_jiffies;
diff -uriN linux-2.6.32.43/include/linux/sysfs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sysfs.h
--- linux-2.6.32.43/include/linux/sysfs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/sysfs.h	2011-07-15 05:51:19.000000000 -0500
@@ -17,6 +17,8 @@
 #include <linux/list.h>
 #include <asm/atomic.h>
 
+#define SYSFS_SUPER_MAGIC	0x62656572
+
 struct kobject;
 struct module;
 
@@ -75,8 +77,8 @@
 };
 
 struct sysfs_ops {
-	ssize_t	(*show)(struct kobject *, struct attribute *,char *);
-	ssize_t	(*store)(struct kobject *,struct attribute *,const char *, size_t);
+	ssize_t	(* const show)(struct kobject *, struct attribute *,char *);
+	ssize_t	(* const store)(struct kobject *,struct attribute *,const char *, size_t);
 };
 
 struct sysfs_dirent;
diff -uriN linux-2.6.32.43/include/linux/thread_info.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/thread_info.h
--- linux-2.6.32.43/include/linux/thread_info.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/thread_info.h	2011-07-15 05:51:19.000000000 -0500
@@ -23,7 +23,7 @@
 		};
 		/* For futex_wait and futex_wait_requeue_pi */
 		struct {
-			u32 *uaddr;
+			u32 __user *uaddr;
 			u32 val;
 			u32 flags;
 			u32 bitset;
diff -uriN linux-2.6.32.43/include/linux/time.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/time.h
--- linux-2.6.32.43/include/linux/time.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/time.h	2011-07-15 05:50:11.000000000 -0500
@@ -238,6 +238,9 @@
 	a->tv_sec += __iter_div_u64_rem(a->tv_nsec + ns, NSEC_PER_SEC, &ns);
 	a->tv_nsec = ns;
 }
+
+#include <linux/vs_time.h>
+
 #endif /* __KERNEL__ */
 
 #define NFDBITS			__NFDBITS
diff -uriN linux-2.6.32.43/include/linux/tty.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/tty.h
--- linux-2.6.32.43/include/linux/tty.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/tty.h	2011-07-15 05:51:19.000000000 -0500
@@ -13,6 +13,7 @@
 #include <linux/tty_driver.h>
 #include <linux/tty_ldisc.h>
 #include <linux/mutex.h>
+#include <linux/poll.h>
 
 #include <asm/system.h>
 
@@ -443,7 +444,6 @@
 extern dev_t tty_devnum(struct tty_struct *tty);
 extern void proc_clear_tty(struct task_struct *p);
 extern struct tty_struct *get_current_tty(void);
-extern void tty_default_fops(struct file_operations *fops);
 extern struct tty_struct *alloc_tty_struct(void);
 extern void free_tty_struct(struct tty_struct *tty);
 extern void initialize_tty_struct(struct tty_struct *tty,
@@ -493,6 +493,18 @@
 /* This last one is just for the tty layer internals and shouldn't be used elsewhere */
 extern void tty_ldisc_enable(struct tty_struct *tty);
 
+/* tty_io.c */
+extern ssize_t tty_read(struct file *, char __user *, size_t, loff_t *);
+extern ssize_t tty_write(struct file *, const char __user *, size_t, loff_t *);
+extern unsigned int tty_poll(struct file *, poll_table *);
+#ifdef CONFIG_COMPAT
+extern long tty_compat_ioctl(struct file *file, unsigned int cmd,
+				unsigned long arg);
+#else
+#define tty_compat_ioctl NULL
+#endif
+extern int tty_release(struct inode *, struct file *);
+extern int tty_fasync(int fd, struct file *filp, int on);
 
 /* n_tty.c */
 extern struct tty_ldisc_ops tty_ldisc_N_TTY;
diff -uriN linux-2.6.32.43/include/linux/tty_ldisc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/tty_ldisc.h
--- linux-2.6.32.43/include/linux/tty_ldisc.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/tty_ldisc.h	2011-07-15 05:51:19.000000000 -0500
@@ -139,7 +139,7 @@
 
 	struct  module *owner;
 	
-	int refcount;
+	atomic_t refcount;
 };
 
 struct tty_ldisc {
diff -uriN linux-2.6.32.43/include/linux/types.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/types.h
--- linux-2.6.32.43/include/linux/types.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/types.h	2011-07-15 05:51:19.000000000 -0500
@@ -37,6 +37,9 @@
 typedef __kernel_gid32_t	gid_t;
 typedef __kernel_uid16_t        uid16_t;
 typedef __kernel_gid16_t        gid16_t;
+typedef unsigned int		xid_t;
+typedef unsigned int		nid_t;
+typedef unsigned int		tag_t;
 
 typedef unsigned long		uintptr_t;
 
@@ -191,10 +194,26 @@
 	volatile int counter;
 } atomic_t;
 
+#ifdef CONFIG_PAX_REFCOUNT
+typedef struct {
+	volatile int counter;
+} atomic_unchecked_t;
+#else
+typedef atomic_t atomic_unchecked_t;
+#endif
+
 #ifdef CONFIG_64BIT
 typedef struct {
 	volatile long counter;
 } atomic64_t;
+
+#ifdef CONFIG_PAX_REFCOUNT
+typedef struct {
+	volatile long counter;
+} atomic64_unchecked_t;
+#else
+typedef atomic64_t atomic64_unchecked_t;
+#endif
 #endif
 
 struct ustat {
diff -uriN linux-2.6.32.43/include/linux/uaccess.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/uaccess.h
--- linux-2.6.32.43/include/linux/uaccess.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/uaccess.h	2011-07-15 05:51:19.000000000 -0500
@@ -76,11 +76,11 @@
 		long ret;				\
 		mm_segment_t old_fs = get_fs();		\
 							\
-		set_fs(KERNEL_DS);			\
 		pagefault_disable();			\
+		set_fs(KERNEL_DS);			\
 		ret = __copy_from_user_inatomic(&(retval), (__force typeof(retval) __user *)(addr), sizeof(retval));		\
-		pagefault_enable();			\
 		set_fs(old_fs);				\
+		pagefault_enable();			\
 		ret;					\
 	})
 
@@ -93,7 +93,7 @@
  * Safely read from address @src to the buffer at @dst.  If a kernel fault
  * happens, handle that and return -EFAULT.
  */
-extern long probe_kernel_read(void *dst, void *src, size_t size);
+extern long probe_kernel_read(void *dst, const void *src, size_t size);
 
 /*
  * probe_kernel_write(): safely attempt to write to a location
@@ -104,6 +104,6 @@
  * Safely write to address @dst from the buffer at @src.  If a kernel fault
  * happens, handle that and return -EFAULT.
  */
-extern long probe_kernel_write(void *dst, void *src, size_t size);
+extern long probe_kernel_write(void *dst, const void *src, size_t size);
 
 #endif		/* __LINUX_UACCESS_H__ */
diff -uriN linux-2.6.32.43/include/linux/unaligned/access_ok.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/unaligned/access_ok.h
--- linux-2.6.32.43/include/linux/unaligned/access_ok.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/unaligned/access_ok.h	2011-07-15 05:51:19.000000000 -0500
@@ -6,32 +6,32 @@
 
 static inline u16 get_unaligned_le16(const void *p)
 {
-	return le16_to_cpup((__le16 *)p);
+	return le16_to_cpup((const __le16 *)p);
 }
 
 static inline u32 get_unaligned_le32(const void *p)
 {
-	return le32_to_cpup((__le32 *)p);
+	return le32_to_cpup((const __le32 *)p);
 }
 
 static inline u64 get_unaligned_le64(const void *p)
 {
-	return le64_to_cpup((__le64 *)p);
+	return le64_to_cpup((const __le64 *)p);
 }
 
 static inline u16 get_unaligned_be16(const void *p)
 {
-	return be16_to_cpup((__be16 *)p);
+	return be16_to_cpup((const __be16 *)p);
 }
 
 static inline u32 get_unaligned_be32(const void *p)
 {
-	return be32_to_cpup((__be32 *)p);
+	return be32_to_cpup((const __be32 *)p);
 }
 
 static inline u64 get_unaligned_be64(const void *p)
 {
-	return be64_to_cpup((__be64 *)p);
+	return be64_to_cpup((const __be64 *)p);
 }
 
 static inline void put_unaligned_le16(u16 val, void *p)
diff -uriN linux-2.6.32.43/include/linux/vmalloc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vmalloc.h
--- linux-2.6.32.43/include/linux/vmalloc.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vmalloc.h	2011-07-15 05:51:19.000000000 -0500
@@ -13,6 +13,11 @@
 #define VM_MAP		0x00000004	/* vmap()ed pages */
 #define VM_USERMAP	0x00000008	/* suitable for remap_vmalloc_range */
 #define VM_VPAGES	0x00000010	/* buffer for pages was vmalloc'ed */
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
+#define VM_KERNEXEC	0x00000020	/* allocate from executable kernel memory range */
+#endif
+
 /* bits [20..32] reserved for arch specific ioremap internals */
 
 /*
@@ -123,4 +128,81 @@
 
 void pcpu_free_vm_areas(struct vm_struct **vms, int nr_vms);
 
+#define vmalloc(x)						\
+({								\
+	void *___retval;					\
+	intoverflow_t ___x = (intoverflow_t)x;			\
+	if (WARN(___x > ULONG_MAX, "vmalloc size overflow\n"))	\
+		___retval = NULL;				\
+	else							\
+		___retval = vmalloc((unsigned long)___x);	\
+	___retval;						\
+})
+
+#define __vmalloc(x, y, z)					\
+({								\
+	void *___retval;					\
+	intoverflow_t ___x = (intoverflow_t)x;			\
+	if (WARN(___x > ULONG_MAX, "__vmalloc size overflow\n"))\
+		___retval = NULL;				\
+	else							\
+		___retval = __vmalloc((unsigned long)___x, (y), (z));\
+	___retval;						\
+})
+
+#define vmalloc_user(x)						\
+({								\
+	void *___retval;					\
+	intoverflow_t ___x = (intoverflow_t)x;			\
+	if (WARN(___x > ULONG_MAX, "vmalloc_user size overflow\n"))\
+		___retval = NULL;				\
+	else							\
+		___retval = vmalloc_user((unsigned long)___x);	\
+	___retval;						\
+})
+
+#define vmalloc_exec(x)						\
+({								\
+	void *___retval;					\
+	intoverflow_t ___x = (intoverflow_t)x;			\
+	if (WARN(___x > ULONG_MAX, "vmalloc_exec size overflow\n"))\
+		___retval = NULL;				\
+	else							\
+		___retval = vmalloc_exec((unsigned long)___x);	\
+	___retval;						\
+})
+
+#define vmalloc_node(x, y)					\
+({								\
+	void *___retval;					\
+	intoverflow_t ___x = (intoverflow_t)x;			\
+	if (WARN(___x > ULONG_MAX, "vmalloc_node size overflow\n"))\
+		___retval = NULL;				\
+	else							\
+		___retval = vmalloc_node((unsigned long)___x, (y));\
+	___retval;						\
+})
+
+#define vmalloc_32(x)						\
+({								\
+	void *___retval;					\
+	intoverflow_t ___x = (intoverflow_t)x;			\
+	if (WARN(___x > ULONG_MAX, "vmalloc_32 size overflow\n"))\
+		___retval = NULL;				\
+	else							\
+		___retval = vmalloc_32((unsigned long)___x);	\
+	___retval;						\
+})
+
+#define vmalloc_32_user(x)					\
+({								\
+	void *___retval;					\
+	intoverflow_t ___x = (intoverflow_t)x;			\
+	if (WARN(___x > ULONG_MAX, "vmalloc_32_user size overflow\n"))\
+		___retval = NULL;				\
+	else							\
+		___retval = vmalloc_32_user((unsigned long)___x);\
+	___retval;						\
+})
+
 #endif /* _LINUX_VMALLOC_H */
diff -uriN linux-2.6.32.43/include/linux/vmstat.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vmstat.h
--- linux-2.6.32.43/include/linux/vmstat.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vmstat.h	2011-07-15 05:51:19.000000000 -0500
@@ -136,18 +136,18 @@
 /*
  * Zone based page accounting with per cpu differentials.
  */
-extern atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
+extern atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
 
 static inline void zone_page_state_add(long x, struct zone *zone,
 				 enum zone_stat_item item)
 {
-	atomic_long_add(x, &zone->vm_stat[item]);
-	atomic_long_add(x, &vm_stat[item]);
+	atomic_long_add_unchecked(x, &zone->vm_stat[item]);
+	atomic_long_add_unchecked(x, &vm_stat[item]);
 }
 
 static inline unsigned long global_page_state(enum zone_stat_item item)
 {
-	long x = atomic_long_read(&vm_stat[item]);
+	long x = atomic_long_read_unchecked(&vm_stat[item]);
 #ifdef CONFIG_SMP
 	if (x < 0)
 		x = 0;
@@ -158,7 +158,7 @@
 static inline unsigned long zone_page_state(struct zone *zone,
 					enum zone_stat_item item)
 {
-	long x = atomic_long_read(&zone->vm_stat[item]);
+	long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
 #ifdef CONFIG_SMP
 	if (x < 0)
 		x = 0;
@@ -175,7 +175,7 @@
 static inline unsigned long zone_page_state_snapshot(struct zone *zone,
 					enum zone_stat_item item)
 {
-	long x = atomic_long_read(&zone->vm_stat[item]);
+	long x = atomic_long_read_unchecked(&zone->vm_stat[item]);
 
 #ifdef CONFIG_SMP
 	int cpu;
@@ -264,8 +264,8 @@
 
 static inline void __inc_zone_state(struct zone *zone, enum zone_stat_item item)
 {
-	atomic_long_inc(&zone->vm_stat[item]);
-	atomic_long_inc(&vm_stat[item]);
+	atomic_long_inc_unchecked(&zone->vm_stat[item]);
+	atomic_long_inc_unchecked(&vm_stat[item]);
 }
 
 static inline void __inc_zone_page_state(struct page *page,
@@ -276,8 +276,8 @@
 
 static inline void __dec_zone_state(struct zone *zone, enum zone_stat_item item)
 {
-	atomic_long_dec(&zone->vm_stat[item]);
-	atomic_long_dec(&vm_stat[item]);
+	atomic_long_dec_unchecked(&zone->vm_stat[item]);
+	atomic_long_dec_unchecked(&vm_stat[item]);
 }
 
 static inline void __dec_zone_page_state(struct page *page,
diff -uriN linux-2.6.32.43/include/linux/vroot.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vroot.h
--- linux-2.6.32.43/include/linux/vroot.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vroot.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,51 @@
+
+/*
+ * include/linux/vroot.h
+ *
+ * written by Herbert Pötzl, 9/11/2002
+ * ported to 2.6 by Herbert Pötzl, 30/12/2004
+ *
+ * Copyright (C) 2002-2007 by Herbert Pötzl.
+ * Redistribution of this file is permitted under the
+ * GNU General Public License.
+ */
+
+#ifndef _LINUX_VROOT_H
+#define _LINUX_VROOT_H
+
+
+#ifdef __KERNEL__
+
+/* Possible states of device */
+enum {
+	Vr_unbound,
+	Vr_bound,
+};
+
+struct vroot_device {
+	int		vr_number;
+	int		vr_refcnt;
+
+	struct semaphore	vr_ctl_mutex;
+	struct block_device    *vr_device;
+	int			vr_state;
+};
+
+
+typedef struct block_device *(vroot_grb_func)(struct block_device *);
+
+extern int register_vroot_grb(vroot_grb_func *);
+extern int unregister_vroot_grb(vroot_grb_func *);
+
+#endif /* __KERNEL__ */
+
+#define MAX_VROOT_DEFAULT	8
+
+/*
+ * IOCTL commands --- we will commandeer 0x56 ('V')
+ */
+
+#define VROOT_SET_DEV		0x5600
+#define VROOT_CLR_DEV		0x5601
+
+#endif /* _LINUX_VROOT_H */
diff -uriN linux-2.6.32.43/include/linux/vs_base.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_base.h
--- linux-2.6.32.43/include/linux/vs_base.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_base.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,10 @@
+#ifndef _VS_BASE_H
+#define _VS_BASE_H
+
+#include "vserver/base.h"
+#include "vserver/check.h"
+#include "vserver/debug.h"
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_context.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_context.h
--- linux-2.6.32.43/include/linux/vs_context.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_context.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,242 @@
+#ifndef _VS_CONTEXT_H
+#define _VS_CONTEXT_H
+
+#include "vserver/base.h"
+#include "vserver/check.h"
+#include "vserver/context.h"
+#include "vserver/history.h"
+#include "vserver/debug.h"
+
+#include <linux/sched.h>
+
+
+#define get_vx_info(i) __get_vx_info(i, __FILE__, __LINE__, __HERE__)
+
+static inline struct vx_info *__get_vx_info(struct vx_info *vxi,
+	const char *_file, int _line, void *_here)
+{
+	if (!vxi)
+		return NULL;
+
+	vxlprintk(VXD_CBIT(xid, 2), "get_vx_info(%p[#%d.%d])",
+		vxi, vxi ? vxi->vx_id : 0,
+		vxi ? atomic_read(&vxi->vx_usecnt) : 0,
+		_file, _line);
+	__vxh_get_vx_info(vxi, _here);
+
+	atomic_inc(&vxi->vx_usecnt);
+	return vxi;
+}
+
+
+extern void free_vx_info(struct vx_info *);
+
+#define put_vx_info(i) __put_vx_info(i, __FILE__, __LINE__, __HERE__)
+
+static inline void __put_vx_info(struct vx_info *vxi,
+	const char *_file, int _line, void *_here)
+{
+	if (!vxi)
+		return;
+
+	vxlprintk(VXD_CBIT(xid, 2), "put_vx_info(%p[#%d.%d])",
+		vxi, vxi ? vxi->vx_id : 0,
+		vxi ? atomic_read(&vxi->vx_usecnt) : 0,
+		_file, _line);
+	__vxh_put_vx_info(vxi, _here);
+
+	if (atomic_dec_and_test(&vxi->vx_usecnt))
+		free_vx_info(vxi);
+}
+
+
+#define init_vx_info(p, i) \
+	__init_vx_info(p, i, __FILE__, __LINE__, __HERE__)
+
+static inline void __init_vx_info(struct vx_info **vxp, struct vx_info *vxi,
+	const char *_file, int _line, void *_here)
+{
+	if (vxi) {
+		vxlprintk(VXD_CBIT(xid, 3),
+			"init_vx_info(%p[#%d.%d])",
+			vxi, vxi ? vxi->vx_id : 0,
+			vxi ? atomic_read(&vxi->vx_usecnt) : 0,
+			_file, _line);
+		__vxh_init_vx_info(vxi, vxp, _here);
+
+		atomic_inc(&vxi->vx_usecnt);
+	}
+	*vxp = vxi;
+}
+
+
+#define set_vx_info(p, i) \
+	__set_vx_info(p, i, __FILE__, __LINE__, __HERE__)
+
+static inline void __set_vx_info(struct vx_info **vxp, struct vx_info *vxi,
+	const char *_file, int _line, void *_here)
+{
+	struct vx_info *vxo;
+
+	if (!vxi)
+		return;
+
+	vxlprintk(VXD_CBIT(xid, 3), "set_vx_info(%p[#%d.%d])",
+		vxi, vxi ? vxi->vx_id : 0,
+		vxi ? atomic_read(&vxi->vx_usecnt) : 0,
+		_file, _line);
+	__vxh_set_vx_info(vxi, vxp, _here);
+
+	atomic_inc(&vxi->vx_usecnt);
+	vxo = xchg(vxp, vxi);
+	BUG_ON(vxo);
+}
+
+
+#define clr_vx_info(p) __clr_vx_info(p, __FILE__, __LINE__, __HERE__)
+
+static inline void __clr_vx_info(struct vx_info **vxp,
+	const char *_file, int _line, void *_here)
+{
+	struct vx_info *vxo;
+
+	vxo = xchg(vxp, NULL);
+	if (!vxo)
+		return;
+
+	vxlprintk(VXD_CBIT(xid, 3), "clr_vx_info(%p[#%d.%d])",
+		vxo, vxo ? vxo->vx_id : 0,
+		vxo ? atomic_read(&vxo->vx_usecnt) : 0,
+		_file, _line);
+	__vxh_clr_vx_info(vxo, vxp, _here);
+
+	if (atomic_dec_and_test(&vxo->vx_usecnt))
+		free_vx_info(vxo);
+}
+
+
+#define claim_vx_info(v, p) \
+	__claim_vx_info(v, p, __FILE__, __LINE__, __HERE__)
+
+static inline void __claim_vx_info(struct vx_info *vxi,
+	struct task_struct *task,
+	const char *_file, int _line, void *_here)
+{
+	vxlprintk(VXD_CBIT(xid, 3), "claim_vx_info(%p[#%d.%d.%d]) %p",
+		vxi, vxi ? vxi->vx_id : 0,
+		vxi ? atomic_read(&vxi->vx_usecnt) : 0,
+		vxi ? atomic_read(&vxi->vx_tasks) : 0,
+		task, _file, _line);
+	__vxh_claim_vx_info(vxi, task, _here);
+
+	atomic_inc(&vxi->vx_tasks);
+}
+
+
+extern void unhash_vx_info(struct vx_info *);
+
+#define release_vx_info(v, p) \
+	__release_vx_info(v, p, __FILE__, __LINE__, __HERE__)
+
+static inline void __release_vx_info(struct vx_info *vxi,
+	struct task_struct *task,
+	const char *_file, int _line, void *_here)
+{
+	vxlprintk(VXD_CBIT(xid, 3), "release_vx_info(%p[#%d.%d.%d]) %p",
+		vxi, vxi ? vxi->vx_id : 0,
+		vxi ? atomic_read(&vxi->vx_usecnt) : 0,
+		vxi ? atomic_read(&vxi->vx_tasks) : 0,
+		task, _file, _line);
+	__vxh_release_vx_info(vxi, task, _here);
+
+	might_sleep();
+
+	if (atomic_dec_and_test(&vxi->vx_tasks))
+		unhash_vx_info(vxi);
+}
+
+
+#define task_get_vx_info(p) \
+	__task_get_vx_info(p, __FILE__, __LINE__, __HERE__)
+
+static inline struct vx_info *__task_get_vx_info(struct task_struct *p,
+	const char *_file, int _line, void *_here)
+{
+	struct vx_info *vxi;
+
+	task_lock(p);
+	vxlprintk(VXD_CBIT(xid, 5), "task_get_vx_info(%p)",
+		p, _file, _line);
+	vxi = __get_vx_info(p->vx_info, _file, _line, _here);
+	task_unlock(p);
+	return vxi;
+}
+
+
+static inline void __wakeup_vx_info(struct vx_info *vxi)
+{
+	if (waitqueue_active(&vxi->vx_wait))
+		wake_up_interruptible(&vxi->vx_wait);
+}
+
+
+#define enter_vx_info(v, s) __enter_vx_info(v, s, __FILE__, __LINE__)
+
+static inline void __enter_vx_info(struct vx_info *vxi,
+	struct vx_info_save *vxis, const char *_file, int _line)
+{
+	vxlprintk(VXD_CBIT(xid, 5), "enter_vx_info(%p[#%d],%p) %p[#%d,%p]",
+		vxi, vxi ? vxi->vx_id : 0, vxis, current,
+		current->xid, current->vx_info, _file, _line);
+	vxis->vxi = xchg(&current->vx_info, vxi);
+	vxis->xid = current->xid;
+	current->xid = vxi ? vxi->vx_id : 0;
+}
+
+#define leave_vx_info(s) __leave_vx_info(s, __FILE__, __LINE__)
+
+static inline void __leave_vx_info(struct vx_info_save *vxis,
+	const char *_file, int _line)
+{
+	vxlprintk(VXD_CBIT(xid, 5), "leave_vx_info(%p[#%d,%p]) %p[#%d,%p]",
+		vxis, vxis->xid, vxis->vxi, current,
+		current->xid, current->vx_info, _file, _line);
+	(void)xchg(&current->vx_info, vxis->vxi);
+	current->xid = vxis->xid;
+}
+
+
+static inline void __enter_vx_admin(struct vx_info_save *vxis)
+{
+	vxis->vxi = xchg(&current->vx_info, NULL);
+	vxis->xid = xchg(&current->xid, (xid_t)0);
+}
+
+static inline void __leave_vx_admin(struct vx_info_save *vxis)
+{
+	(void)xchg(&current->xid, vxis->xid);
+	(void)xchg(&current->vx_info, vxis->vxi);
+}
+
+#define task_is_init(p) \
+	__task_is_init(p, __FILE__, __LINE__, __HERE__)
+
+static inline int __task_is_init(struct task_struct *p,
+	const char *_file, int _line, void *_here)
+{
+	int is_init = is_global_init(p);
+
+	task_lock(p);
+	if (p->vx_info)
+		is_init = p->vx_info->vx_initpid == p->pid;
+	task_unlock(p);
+	return is_init;
+}
+
+extern void exit_vx_info(struct task_struct *, int);
+extern void exit_vx_info_early(struct task_struct *, int);
+
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_cowbl.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_cowbl.h
--- linux-2.6.32.43/include/linux/vs_cowbl.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_cowbl.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,47 @@
+#ifndef _VS_COWBL_H
+#define _VS_COWBL_H
+
+#include <linux/fs.h>
+#include <linux/dcache.h>
+#include <linux/namei.h>
+
+extern struct dentry *cow_break_link(const char *pathname);
+
+static inline int cow_check_and_break(struct path *path)
+{
+	struct inode *inode = path->dentry->d_inode;
+	int error = 0;
+
+	/* do we need this check? */
+	if (IS_RDONLY(inode))
+		return -EROFS;
+
+	if (IS_COW(inode)) {
+		if (IS_COW_LINK(inode)) {
+			struct dentry *new_dentry, *old_dentry = path->dentry;
+			char *pp, *buf;
+
+			buf = kmalloc(PATH_MAX, GFP_KERNEL);
+			if (!buf) {
+				return -ENOMEM;
+			}
+			pp = d_path(path, buf, PATH_MAX);
+			new_dentry = cow_break_link(pp);
+			kfree(buf);
+			if (!IS_ERR(new_dentry)) {
+				path->dentry = new_dentry;
+				dput(old_dentry);
+			} else
+				error = PTR_ERR(new_dentry);
+		} else {
+			inode->i_flags &= ~(S_IXUNLINK | S_IMMUTABLE);
+			inode->i_ctime = CURRENT_TIME;
+			mark_inode_dirty(inode);
+		}
+	}
+	return error;
+}
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_cvirt.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_cvirt.h
--- linux-2.6.32.43/include/linux/vs_cvirt.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_cvirt.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,50 @@
+#ifndef _VS_CVIRT_H
+#define _VS_CVIRT_H
+
+#include "vserver/cvirt.h"
+#include "vserver/context.h"
+#include "vserver/base.h"
+#include "vserver/check.h"
+#include "vserver/debug.h"
+
+
+static inline void vx_activate_task(struct task_struct *p)
+{
+	struct vx_info *vxi;
+
+	if ((vxi = p->vx_info)) {
+		vx_update_load(vxi);
+		atomic_inc(&vxi->cvirt.nr_running);
+	}
+}
+
+static inline void vx_deactivate_task(struct task_struct *p)
+{
+	struct vx_info *vxi;
+
+	if ((vxi = p->vx_info)) {
+		vx_update_load(vxi);
+		atomic_dec(&vxi->cvirt.nr_running);
+	}
+}
+
+static inline void vx_uninterruptible_inc(struct task_struct *p)
+{
+	struct vx_info *vxi;
+
+	if ((vxi = p->vx_info))
+		atomic_inc(&vxi->cvirt.nr_uninterruptible);
+}
+
+static inline void vx_uninterruptible_dec(struct task_struct *p)
+{
+	struct vx_info *vxi;
+
+	if ((vxi = p->vx_info))
+		atomic_dec(&vxi->cvirt.nr_uninterruptible);
+}
+
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_device.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_device.h
--- linux-2.6.32.43/include/linux/vs_device.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_device.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,45 @@
+#ifndef _VS_DEVICE_H
+#define _VS_DEVICE_H
+
+#include "vserver/base.h"
+#include "vserver/device.h"
+#include "vserver/debug.h"
+
+
+#ifdef CONFIG_VSERVER_DEVICE
+
+int vs_map_device(struct vx_info *, dev_t, dev_t *, umode_t);
+
+#define vs_device_perm(v, d, m, p) \
+	((vs_map_device(current_vx_info(), d, NULL, m) & (p)) == (p))
+
+#else
+
+static inline
+int vs_map_device(struct vx_info *vxi,
+	dev_t device, dev_t *target, umode_t mode)
+{
+	if (target)
+		*target = device;
+	return ~0;
+}
+
+#define vs_device_perm(v, d, m, p) ((p) == (p))
+
+#endif
+
+
+#define vs_map_chrdev(d, t, p) \
+	((vs_map_device(current_vx_info(), d, t, S_IFCHR) & (p)) == (p))
+#define vs_map_blkdev(d, t, p) \
+	((vs_map_device(current_vx_info(), d, t, S_IFBLK) & (p)) == (p))
+
+#define vs_chrdev_perm(d, p) \
+	vs_device_perm(current_vx_info(), d, S_IFCHR, p)
+#define vs_blkdev_perm(d, p) \
+	vs_device_perm(current_vx_info(), d, S_IFBLK, p)
+
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_dlimit.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_dlimit.h
--- linux-2.6.32.43/include/linux/vs_dlimit.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_dlimit.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,215 @@
+#ifndef _VS_DLIMIT_H
+#define _VS_DLIMIT_H
+
+#include <linux/fs.h>
+
+#include "vserver/dlimit.h"
+#include "vserver/base.h"
+#include "vserver/debug.h"
+
+
+#define get_dl_info(i)	__get_dl_info(i, __FILE__, __LINE__)
+
+static inline struct dl_info *__get_dl_info(struct dl_info *dli,
+	const char *_file, int _line)
+{
+	if (!dli)
+		return NULL;
+	vxlprintk(VXD_CBIT(dlim, 4), "get_dl_info(%p[#%d.%d])",
+		dli, dli ? dli->dl_tag : 0,
+		dli ? atomic_read(&dli->dl_usecnt) : 0,
+		_file, _line);
+	atomic_inc(&dli->dl_usecnt);
+	return dli;
+}
+
+
+#define free_dl_info(i) \
+	call_rcu(&(i)->dl_rcu, rcu_free_dl_info)
+
+#define put_dl_info(i)	__put_dl_info(i, __FILE__, __LINE__)
+
+static inline void __put_dl_info(struct dl_info *dli,
+	const char *_file, int _line)
+{
+	if (!dli)
+		return;
+	vxlprintk(VXD_CBIT(dlim, 4), "put_dl_info(%p[#%d.%d])",
+		dli, dli ? dli->dl_tag : 0,
+		dli ? atomic_read(&dli->dl_usecnt) : 0,
+		_file, _line);
+	if (atomic_dec_and_test(&dli->dl_usecnt))
+		free_dl_info(dli);
+}
+
+
+#define __dlimit_char(d)	((d) ? '*' : ' ')
+
+static inline int __dl_alloc_space(struct super_block *sb,
+	tag_t tag, dlsize_t nr, const char *file, int line)
+{
+	struct dl_info *dli = NULL;
+	int ret = 0;
+
+	if (nr == 0)
+		goto out;
+	dli = locate_dl_info(sb, tag);
+	if (!dli)
+		goto out;
+
+	spin_lock(&dli->dl_lock);
+	ret = (dli->dl_space_used + nr > dli->dl_space_total);
+	if (!ret)
+		dli->dl_space_used += nr;
+	spin_unlock(&dli->dl_lock);
+	put_dl_info(dli);
+out:
+	vxlprintk(VXD_CBIT(dlim, 1),
+		"ALLOC (%p,#%d)%c %lld bytes (%d)",
+		sb, tag, __dlimit_char(dli), (long long)nr,
+		ret, file, line);
+	return ret;
+}
+
+static inline void __dl_free_space(struct super_block *sb,
+	tag_t tag, dlsize_t nr, const char *_file, int _line)
+{
+	struct dl_info *dli = NULL;
+
+	if (nr == 0)
+		goto out;
+	dli = locate_dl_info(sb, tag);
+	if (!dli)
+		goto out;
+
+	spin_lock(&dli->dl_lock);
+	if (dli->dl_space_used > nr)
+		dli->dl_space_used -= nr;
+	else
+		dli->dl_space_used = 0;
+	spin_unlock(&dli->dl_lock);
+	put_dl_info(dli);
+out:
+	vxlprintk(VXD_CBIT(dlim, 1),
+		"FREE  (%p,#%d)%c %lld bytes",
+		sb, tag, __dlimit_char(dli), (long long)nr,
+		_file, _line);
+}
+
+static inline int __dl_alloc_inode(struct super_block *sb,
+	tag_t tag, const char *_file, int _line)
+{
+	struct dl_info *dli;
+	int ret = 0;
+
+	dli = locate_dl_info(sb, tag);
+	if (!dli)
+		goto out;
+
+	spin_lock(&dli->dl_lock);
+	dli->dl_inodes_used++;
+	ret = (dli->dl_inodes_used > dli->dl_inodes_total);
+	spin_unlock(&dli->dl_lock);
+	put_dl_info(dli);
+out:
+	vxlprintk(VXD_CBIT(dlim, 0),
+		"ALLOC (%p,#%d)%c inode (%d)",
+		sb, tag, __dlimit_char(dli), ret, _file, _line);
+	return ret;
+}
+
+static inline void __dl_free_inode(struct super_block *sb,
+	tag_t tag, const char *_file, int _line)
+{
+	struct dl_info *dli;
+
+	dli = locate_dl_info(sb, tag);
+	if (!dli)
+		goto out;
+
+	spin_lock(&dli->dl_lock);
+	if (dli->dl_inodes_used > 1)
+		dli->dl_inodes_used--;
+	else
+		dli->dl_inodes_used = 0;
+	spin_unlock(&dli->dl_lock);
+	put_dl_info(dli);
+out:
+	vxlprintk(VXD_CBIT(dlim, 0),
+		"FREE  (%p,#%d)%c inode",
+		sb, tag, __dlimit_char(dli), _file, _line);
+}
+
+static inline void __dl_adjust_block(struct super_block *sb, tag_t tag,
+	unsigned long long *free_blocks, unsigned long long *root_blocks,
+	const char *_file, int _line)
+{
+	struct dl_info *dli;
+	uint64_t broot, bfree;
+
+	dli = locate_dl_info(sb, tag);
+	if (!dli)
+		return;
+
+	spin_lock(&dli->dl_lock);
+	broot = (dli->dl_space_total -
+		(dli->dl_space_total >> 10) * dli->dl_nrlmult)
+		>> sb->s_blocksize_bits;
+	bfree = (dli->dl_space_total - dli->dl_space_used)
+			>> sb->s_blocksize_bits;
+	spin_unlock(&dli->dl_lock);
+
+	vxlprintk(VXD_CBIT(dlim, 2),
+		"ADJUST: %lld,%lld on %lld,%lld [mult=%d]",
+		(long long)bfree, (long long)broot,
+		*free_blocks, *root_blocks, dli->dl_nrlmult,
+		_file, _line);
+	if (free_blocks) {
+		if (*free_blocks > bfree)
+			*free_blocks = bfree;
+	}
+	if (root_blocks) {
+		if (*root_blocks > broot)
+			*root_blocks = broot;
+	}
+	put_dl_info(dli);
+}
+
+#define dl_prealloc_space(in, bytes) \
+	__dl_alloc_space((in)->i_sb, (in)->i_tag, (dlsize_t)(bytes), \
+		__FILE__, __LINE__ )
+
+#define dl_alloc_space(in, bytes) \
+	__dl_alloc_space((in)->i_sb, (in)->i_tag, (dlsize_t)(bytes), \
+		__FILE__, __LINE__ )
+
+#define dl_reserve_space(in, bytes) \
+	__dl_alloc_space((in)->i_sb, (in)->i_tag, (dlsize_t)(bytes), \
+		__FILE__, __LINE__ )
+
+#define dl_claim_space(in, bytes) (0)
+
+#define dl_release_space(in, bytes) \
+	__dl_free_space((in)->i_sb, (in)->i_tag, (dlsize_t)(bytes), \
+		__FILE__, __LINE__ )
+
+#define dl_free_space(in, bytes) \
+	__dl_free_space((in)->i_sb, (in)->i_tag, (dlsize_t)(bytes), \
+		__FILE__, __LINE__ )
+
+
+
+#define dl_alloc_inode(in) \
+	__dl_alloc_inode((in)->i_sb, (in)->i_tag, __FILE__, __LINE__ )
+
+#define dl_free_inode(in) \
+	__dl_free_inode((in)->i_sb, (in)->i_tag, __FILE__, __LINE__ )
+
+
+#define dl_adjust_block(sb, tag, fb, rb) \
+	__dl_adjust_block(sb, tag, fb, rb, __FILE__, __LINE__ )
+
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vserver/base.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/base.h
--- linux-2.6.32.43/include/linux/vserver/base.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/base.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,170 @@
+#ifndef _VX_BASE_H
+#define _VX_BASE_H
+
+
+/* context state changes */
+
+enum {
+	VSC_STARTUP = 1,
+	VSC_SHUTDOWN,
+
+	VSC_NETUP,
+	VSC_NETDOWN,
+};
+
+
+
+#define vx_task_xid(t)	((t)->xid)
+
+#define vx_current_xid() vx_task_xid(current)
+
+#define current_vx_info() (current->vx_info)
+
+
+#define nx_task_nid(t)	((t)->nid)
+
+#define nx_current_nid() nx_task_nid(current)
+
+#define current_nx_info() (current->nx_info)
+
+
+/* generic flag merging */
+
+#define vs_check_flags(v, m, f)	(((v) & (m)) ^ (f))
+
+#define vs_mask_flags(v, f, m)	(((v) & ~(m)) | ((f) & (m)))
+
+#define vs_mask_mask(v, f, m)	(((v) & ~(m)) | ((v) & (f) & (m)))
+
+#define vs_check_bit(v, n)	((v) & (1LL << (n)))
+
+
+/* context flags */
+
+#define __vx_flags(v)	((v) ? (v)->vx_flags : 0)
+
+#define vx_current_flags()	__vx_flags(current_vx_info())
+
+#define vx_info_flags(v, m, f) \
+	vs_check_flags(__vx_flags(v), m, f)
+
+#define task_vx_flags(t, m, f) \
+	((t) && vx_info_flags((t)->vx_info, m, f))
+
+#define vx_flags(m, f)	vx_info_flags(current_vx_info(), m, f)
+
+
+/* context caps */
+
+#define __vx_ccaps(v)	((v) ? (v)->vx_ccaps : 0)
+
+#define vx_current_ccaps()	__vx_ccaps(current_vx_info())
+
+#define vx_info_ccaps(v, c)	(__vx_ccaps(v) & (c))
+
+#define vx_ccaps(c)	vx_info_ccaps(current_vx_info(), (c))
+
+
+
+/* network flags */
+
+#define __nx_flags(n)	((n) ? (n)->nx_flags : 0)
+
+#define nx_current_flags()	__nx_flags(current_nx_info())
+
+#define nx_info_flags(n, m, f) \
+	vs_check_flags(__nx_flags(n), m, f)
+
+#define task_nx_flags(t, m, f) \
+	((t) && nx_info_flags((t)->nx_info, m, f))
+
+#define nx_flags(m, f)	nx_info_flags(current_nx_info(), m, f)
+
+
+/* network caps */
+
+#define __nx_ncaps(n)	((n) ? (n)->nx_ncaps : 0)
+
+#define nx_current_ncaps()	__nx_ncaps(current_nx_info())
+
+#define nx_info_ncaps(n, c)	(__nx_ncaps(n) & (c))
+
+#define nx_ncaps(c)	nx_info_ncaps(current_nx_info(), c)
+
+
+/* context mask capabilities */
+
+#define __vx_mcaps(v)	((v) ? (v)->vx_ccaps >> 32UL : ~0 )
+
+#define vx_info_mcaps(v, c)	(__vx_mcaps(v) & (c))
+
+#define vx_mcaps(c)	vx_info_mcaps(current_vx_info(), c)
+
+
+/* context bcap mask */
+
+#define __vx_bcaps(v)		((v)->vx_bcaps)
+
+#define vx_current_bcaps()	__vx_bcaps(current_vx_info())
+
+
+/* mask given bcaps */
+
+#define vx_info_mbcaps(v, c)	((v) ? cap_intersect(__vx_bcaps(v), c) : c)
+
+#define vx_mbcaps(c)		vx_info_mbcaps(current_vx_info(), c)
+
+
+/* masked cap_bset */
+
+#define vx_info_cap_bset(v)	vx_info_mbcaps(v, current->cap_bset)
+
+#define vx_current_cap_bset()	vx_info_cap_bset(current_vx_info())
+
+#if 0
+#define vx_info_mbcap(v, b) \
+	(!vx_info_flags(v, VXF_STATE_SETUP, 0) ? \
+	vx_info_bcaps(v, b) : (b))
+
+#define task_vx_mbcap(t, b) \
+	vx_info_mbcap((t)->vx_info, (t)->b)
+
+#define vx_mbcap(b)	task_vx_mbcap(current, b)
+#endif
+
+#define vx_cap_raised(v, c, f)	cap_raised(vx_info_mbcaps(v, c), f)
+
+#define vx_capable(b, c) (capable(b) || \
+	(cap_raised(current_cap(), b) && vx_ccaps(c)))
+
+#define nx_capable(b, c) (capable(b) || \
+	(cap_raised(current_cap(), b) && nx_ncaps(c)))
+
+#define vx_task_initpid(t, n) \
+	((t)->vx_info && \
+	((t)->vx_info->vx_initpid == (n)))
+
+#define vx_current_initpid(n)	vx_task_initpid(current, n)
+
+
+/* context unshare mask */
+
+#define __vx_umask(v)		((v)->vx_umask)
+
+#define vx_current_umask()	__vx_umask(current_vx_info())
+
+#define vx_can_unshare(b, f) (capable(b) || \
+	(cap_raised(current_cap(), b) && \
+	!((f) & ~vx_current_umask())))
+
+
+#define __vx_state(v)	((v) ? ((v)->vx_state) : 0)
+
+#define vx_info_state(v, m)	(__vx_state(v) & (m))
+
+
+#define __nx_state(n)	((n) ? ((n)->nx_state) : 0)
+
+#define nx_info_state(n, m)	(__nx_state(n) & (m))
+
+#endif
diff -uriN linux-2.6.32.43/include/linux/vserver/cacct_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cacct_cmd.h
--- linux-2.6.32.43/include/linux/vserver/cacct_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cacct_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,23 @@
+#ifndef _VX_CACCT_CMD_H
+#define _VX_CACCT_CMD_H
+
+
+/* virtual host info name commands */
+
+#define VCMD_sock_stat		VC_CMD(VSTAT, 5, 0)
+
+struct	vcmd_sock_stat_v0 {
+	uint32_t field;
+	uint32_t count[3];
+	uint64_t total[3];
+};
+
+
+#ifdef	__KERNEL__
+
+#include <linux/compiler.h>
+
+extern int vc_sock_stat(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_CACCT_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/cacct_def.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cacct_def.h
--- linux-2.6.32.43/include/linux/vserver/cacct_def.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cacct_def.h	2011-07-15 06:54:21.000000000 -0500
@@ -0,0 +1,43 @@
+#ifndef _VX_CACCT_DEF_H
+#define _VX_CACCT_DEF_H
+
+#include <asm/atomic.h>
+#include <linux/vserver/cacct.h>
+
+
+struct _vx_sock_acc {
+	atomic_long_unchecked_t count;
+	atomic_long_unchecked_t total;
+};
+
+/* context sub struct */
+
+struct _vx_cacct {
+	struct _vx_sock_acc sock[VXA_SOCK_SIZE][3];
+	atomic_unchecked_t slab[8];
+	atomic_unchecked_t page[6][8];
+};
+
+#ifdef CONFIG_VSERVER_DEBUG
+
+static inline void __dump_vx_cacct(struct _vx_cacct *cacct)
+{
+	int i, j;
+
+	printk("\t_vx_cacct:");
+	for (i = 0; i < 6; i++) {
+		struct _vx_sock_acc *ptr = cacct->sock[i];
+
+		printk("\t [%d] =", i);
+		for (j = 0; j < 3; j++) {
+			printk(" [%d] = %8lu, %8lu", j,
+				atomic_long_read_unchecked(&ptr[j].count),
+				atomic_long_read_unchecked(&ptr[j].total));
+		}
+		printk("\n");
+	}
+}
+
+#endif
+
+#endif	/* _VX_CACCT_DEF_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/cacct.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cacct.h
--- linux-2.6.32.43/include/linux/vserver/cacct.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cacct.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,15 @@
+#ifndef _VX_CACCT_H
+#define _VX_CACCT_H
+
+
+enum sock_acc_field {
+	VXA_SOCK_UNSPEC = 0,
+	VXA_SOCK_UNIX,
+	VXA_SOCK_INET,
+	VXA_SOCK_INET6,
+	VXA_SOCK_PACKET,
+	VXA_SOCK_OTHER,
+	VXA_SOCK_SIZE	/* array size */
+};
+
+#endif	/* _VX_CACCT_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/cacct_int.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cacct_int.h
--- linux-2.6.32.43/include/linux/vserver/cacct_int.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cacct_int.h	2011-07-15 06:54:21.000000000 -0500
@@ -0,0 +1,21 @@
+#ifndef _VX_CACCT_INT_H
+#define _VX_CACCT_INT_H
+
+
+#ifdef	__KERNEL__
+
+static inline
+unsigned long vx_sock_count(struct _vx_cacct *cacct, int type, int pos)
+{
+	return atomic_long_read_unchecked(&cacct->sock[type][pos].count);
+}
+
+
+static inline
+unsigned long vx_sock_total(struct _vx_cacct *cacct, int type, int pos)
+{
+	return atomic_long_read_unchecked(&cacct->sock[type][pos].total);
+}
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_CACCT_INT_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/check.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/check.h
--- linux-2.6.32.43/include/linux/vserver/check.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/check.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,89 @@
+#ifndef _VS_CHECK_H
+#define _VS_CHECK_H
+
+
+#define MAX_S_CONTEXT	65535	/* Arbitrary limit */
+
+#ifdef	CONFIG_VSERVER_DYNAMIC_IDS
+#define MIN_D_CONTEXT	49152	/* dynamic contexts start here */
+#else
+#define MIN_D_CONTEXT	65536
+#endif
+
+/* check conditions */
+
+#define VS_ADMIN	0x0001
+#define VS_WATCH	0x0002
+#define VS_HIDE		0x0004
+#define VS_HOSTID	0x0008
+
+#define VS_IDENT	0x0010
+#define VS_EQUIV	0x0020
+#define VS_PARENT	0x0040
+#define VS_CHILD	0x0080
+
+#define VS_ARG_MASK	0x00F0
+
+#define VS_DYNAMIC	0x0100
+#define VS_STATIC	0x0200
+
+#define VS_ATR_MASK	0x0F00
+
+#ifdef	CONFIG_VSERVER_PRIVACY
+#define VS_ADMIN_P	(0)
+#define VS_WATCH_P	(0)
+#else
+#define VS_ADMIN_P	VS_ADMIN
+#define VS_WATCH_P	VS_WATCH
+#endif
+
+#define VS_HARDIRQ	0x1000
+#define VS_SOFTIRQ	0x2000
+#define VS_IRQ		0x4000
+
+#define VS_IRQ_MASK	0xF000
+
+#include <linux/hardirq.h>
+
+/*
+ * check current context for ADMIN/WATCH and
+ * optionally against supplied argument
+ */
+static inline int __vs_check(int cid, int id, unsigned int mode)
+{
+	if (mode & VS_ARG_MASK) {
+		if ((mode & VS_IDENT) && (id == cid))
+			return 1;
+	}
+	if (mode & VS_ATR_MASK) {
+		if ((mode & VS_DYNAMIC) &&
+			(id >= MIN_D_CONTEXT) &&
+			(id <= MAX_S_CONTEXT))
+			return 1;
+		if ((mode & VS_STATIC) &&
+			(id > 1) && (id < MIN_D_CONTEXT))
+			return 1;
+	}
+	if (mode & VS_IRQ_MASK) {
+		if ((mode & VS_IRQ) && unlikely(in_interrupt()))
+			return 1;
+		if ((mode & VS_HARDIRQ) && unlikely(in_irq()))
+			return 1;
+		if ((mode & VS_SOFTIRQ) && unlikely(in_softirq()))
+			return 1;
+	}
+	return (((mode & VS_ADMIN) && (cid == 0)) ||
+		((mode & VS_WATCH) && (cid == 1)) ||
+		((mode & VS_HOSTID) && (id == 0)));
+}
+
+#define vx_check(c, m)	__vs_check(vx_current_xid(), c, (m) | VS_IRQ)
+
+#define vx_weak_check(c, m)	((m) ? vx_check(c, m) : 1)
+
+
+#define nx_check(c, m)	__vs_check(nx_current_nid(), c, m)
+
+#define nx_weak_check(c, m)	((m) ? nx_check(c, m) : 1)
+
+#endif
diff -uriN linux-2.6.32.43/include/linux/vserver/context_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/context_cmd.h
--- linux-2.6.32.43/include/linux/vserver/context_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/context_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,145 @@
+#ifndef _VX_CONTEXT_CMD_H
+#define _VX_CONTEXT_CMD_H
+
+
+/* vinfo commands */
+
+#define VCMD_task_xid		VC_CMD(VINFO, 1, 0)
+
+#ifdef	__KERNEL__
+extern int vc_task_xid(uint32_t);
+
+#endif	/* __KERNEL__ */
+
+#define VCMD_vx_info		VC_CMD(VINFO, 5, 0)
+
+struct	vcmd_vx_info_v0 {
+	uint32_t xid;
+	uint32_t initpid;
+	/* more to come */
+};
+
+#ifdef	__KERNEL__
+extern int vc_vx_info(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+#define VCMD_ctx_stat		VC_CMD(VSTAT, 0, 0)
+
+struct	vcmd_ctx_stat_v0 {
+	uint32_t usecnt;
+	uint32_t tasks;
+	/* more to come */
+};
+
+#ifdef	__KERNEL__
+extern int vc_ctx_stat(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+/* context commands */
+
+#define VCMD_ctx_create_v0	VC_CMD(VPROC, 1, 0)
+#define VCMD_ctx_create		VC_CMD(VPROC, 1, 1)
+
+struct	vcmd_ctx_create {
+	uint64_t flagword;
+};
+
+#define VCMD_ctx_migrate_v0	VC_CMD(PROCMIG, 1, 0)
+#define VCMD_ctx_migrate	VC_CMD(PROCMIG, 1, 1)
+
+struct	vcmd_ctx_migrate {
+	uint64_t flagword;
+};
+
+#ifdef	__KERNEL__
+extern int vc_ctx_create(uint32_t, void __user *);
+extern int vc_ctx_migrate(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+
+/* flag commands */
+
+#define VCMD_get_cflags		VC_CMD(FLAGS, 1, 0)
+#define VCMD_set_cflags		VC_CMD(FLAGS, 2, 0)
+
+struct	vcmd_ctx_flags_v0 {
+	uint64_t flagword;
+	uint64_t mask;
+};
+
+#ifdef	__KERNEL__
+extern int vc_get_cflags(struct vx_info *, void __user *);
+extern int vc_set_cflags(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+
+/* context caps commands */
+
+#define VCMD_get_ccaps		VC_CMD(FLAGS, 3, 1)
+#define VCMD_set_ccaps		VC_CMD(FLAGS, 4, 1)
+
+struct	vcmd_ctx_caps_v1 {
+	uint64_t ccaps;
+	uint64_t cmask;
+};
+
+#ifdef	__KERNEL__
+extern int vc_get_ccaps(struct vx_info *, void __user *);
+extern int vc_set_ccaps(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+
+/* bcaps commands */
+
+#define VCMD_get_bcaps		VC_CMD(FLAGS, 9, 0)
+#define VCMD_set_bcaps		VC_CMD(FLAGS, 10, 0)
+
+struct	vcmd_bcaps {
+	uint64_t bcaps;
+	uint64_t bmask;
+};
+
+#ifdef	__KERNEL__
+extern int vc_get_bcaps(struct vx_info *, void __user *);
+extern int vc_set_bcaps(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+
+/* umask commands */
+
+#define VCMD_get_umask		VC_CMD(FLAGS, 13, 0)
+#define VCMD_set_umask		VC_CMD(FLAGS, 14, 0)
+
+struct	vcmd_umask {
+	uint64_t umask;
+	uint64_t mask;
+};
+
+#ifdef	__KERNEL__
+extern int vc_get_umask(struct vx_info *, void __user *);
+extern int vc_set_umask(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+
+/* OOM badness */
+
+#define VCMD_get_badness	VC_CMD(MEMCTRL, 5, 0)
+#define VCMD_set_badness	VC_CMD(MEMCTRL, 6, 0)
+
+struct	vcmd_badness_v0 {
+	int64_t bias;
+};
+
+#ifdef	__KERNEL__
+extern int vc_get_badness(struct vx_info *, void __user *);
+extern int vc_set_badness(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_CONTEXT_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/context.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/context.h
--- linux-2.6.32.43/include/linux/vserver/context.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/context.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,184 @@
+#ifndef _VX_CONTEXT_H
+#define _VX_CONTEXT_H
+
+#include <linux/types.h>
+#include <linux/capability.h>
+
+
+/* context flags */
+
+#define VXF_INFO_SCHED		0x00000002
+#define VXF_INFO_NPROC		0x00000004
+#define VXF_INFO_PRIVATE	0x00000008
+
+#define VXF_INFO_INIT		0x00000010
+#define VXF_INFO_HIDE		0x00000020
+#define VXF_INFO_ULIMIT		0x00000040
+#define VXF_INFO_NSPACE		0x00000080
+
+#define VXF_SCHED_HARD		0x00000100
+#define VXF_SCHED_PRIO		0x00000200
+#define VXF_SCHED_PAUSE		0x00000400
+
+#define VXF_VIRT_MEM		0x00010000
+#define VXF_VIRT_UPTIME		0x00020000
+#define VXF_VIRT_CPU		0x00040000
+#define VXF_VIRT_LOAD		0x00080000
+#define VXF_VIRT_TIME		0x00100000
+
+#define VXF_HIDE_MOUNT		0x01000000
+/* was	VXF_HIDE_NETIF		0x02000000 */
+#define VXF_HIDE_VINFO		0x04000000
+
+#define VXF_STATE_SETUP		(1ULL << 32)
+#define VXF_STATE_INIT		(1ULL << 33)
+#define VXF_STATE_ADMIN		(1ULL << 34)
+
+#define VXF_SC_HELPER		(1ULL << 36)
+#define VXF_REBOOT_KILL		(1ULL << 37)
+#define VXF_PERSISTENT		(1ULL << 38)
+
+#define VXF_FORK_RSS		(1ULL << 48)
+#define VXF_PROLIFIC		(1ULL << 49)
+
+#define VXF_IGNEG_NICE		(1ULL << 52)
+
+#define VXF_ONE_TIME		(0x0007ULL << 32)
+
+#define VXF_INIT_SET		(VXF_STATE_SETUP | VXF_STATE_INIT | VXF_STATE_ADMIN)
+
+
+/* context migration */
+
+#define VXM_SET_INIT		0x00000001
+#define VXM_SET_REAPER		0x00000002
+
+/* context caps */
+
+#define VXC_CAP_MASK		0x00000000
+
+#define VXC_SET_UTSNAME		0x00000001
+#define VXC_SET_RLIMIT		0x00000002
+#define VXC_FS_SECURITY		0x00000004
+#define VXC_FS_TRUSTED		0x00000008
+#define VXC_TIOCSTI		0x00000010
+
+/* was	VXC_RAW_ICMP		0x00000100 */
+#define VXC_SYSLOG		0x00001000
+#define VXC_OOM_ADJUST		0x00002000
+#define VXC_AUDIT_CONTROL	0x00004000
+
+#define VXC_SECURE_MOUNT	0x00010000
+#define VXC_SECURE_REMOUNT	0x00020000
+#define VXC_BINARY_MOUNT	0x00040000
+
+#define VXC_QUOTA_CTL		0x00100000
+#define VXC_ADMIN_MAPPER	0x00200000
+#define VXC_ADMIN_CLOOP		0x00400000
+
+#define VXC_KTHREAD		0x01000000
+#define VXC_NAMESPACE		0x02000000
+
+
+#ifdef	__KERNEL__
+
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/rcupdate.h>
+
+#include "limit_def.h"
+#include "sched_def.h"
+#include "cvirt_def.h"
+#include "cacct_def.h"
+#include "device_def.h"
+
+#define VX_SPACES	2
+
+struct _vx_info_pc {
+	struct _vx_sched_pc sched_pc;
+	struct _vx_cvirt_pc cvirt_pc;
+};
+
+struct vx_info {
+	struct hlist_node vx_hlist;		/* linked list of contexts */
+	xid_t vx_id;				/* context id */
+	atomic_t vx_usecnt;			/* usage count */
+	atomic_t vx_tasks;			/* tasks count */
+	struct vx_info *vx_parent;		/* parent context */
+	int vx_state;				/* context state */
+
+	unsigned long vx_nsmask[VX_SPACES];	/* assignment mask */
+	struct nsproxy *vx_nsproxy[VX_SPACES];	/* private namespaces */
+	struct fs_struct *vx_fs[VX_SPACES];	/* private namespace fs */
+
+	uint64_t vx_flags;			/* context flags */
+	uint64_t vx_ccaps;			/* context caps (vserver) */
+	kernel_cap_t vx_bcaps;			/* bounding caps (system) */
+	unsigned long vx_umask;			/* unshare mask (guest) */
+
+	struct task_struct *vx_reaper;		/* guest reaper process */
+	pid_t vx_initpid;			/* PID of guest init */
+	int64_t vx_badness_bias;		/* OOM points bias */
+
+	struct _vx_limit limit;			/* vserver limits */
+	struct _vx_sched sched;			/* vserver scheduler */
+	struct _vx_cvirt cvirt;			/* virtual/bias stuff */
+	struct _vx_cacct cacct;			/* context accounting */
+
+	struct _vx_device dmap;			/* default device map targets */
+
+#ifndef CONFIG_SMP
+	struct _vx_info_pc info_pc;		/* per cpu data */
+#else
+	struct _vx_info_pc *ptr_pc;		/* per cpu array */
+#endif
+
+	wait_queue_head_t vx_wait;		/* context exit waitqueue */
+	int reboot_cmd;				/* last sys_reboot() cmd */
+	int exit_code;				/* last process exit code */
+
+	char vx_name[65];			/* vserver name */
+};
+
+#ifndef CONFIG_SMP
+#define	vx_ptr_pc(vxi)		(&(vxi)->info_pc)
+#define	vx_per_cpu(vxi, v, id)	vx_ptr_pc(vxi)->v
+#else
+#define	vx_ptr_pc(vxi)		((vxi)->ptr_pc)
+#define	vx_per_cpu(vxi, v, id)	per_cpu_ptr(vx_ptr_pc(vxi), id)->v
+#endif
+
+#define	vx_cpu(vxi, v)		vx_per_cpu(vxi, v, smp_processor_id())
+
+
+struct vx_info_save {
+	struct vx_info *vxi;
+	xid_t xid;
+};
+
+
+/* status flags */
+
+#define VXS_HASHED	0x0001
+#define VXS_PAUSED	0x0010
+#define VXS_SHUTDOWN	0x0100
+#define VXS_HELPER	0x1000
+#define VXS_RELEASED	0x8000
+
+
+extern void claim_vx_info(struct vx_info *, struct task_struct *);
+extern void release_vx_info(struct vx_info *, struct task_struct *);
+
+extern struct vx_info *lookup_vx_info(int);
+extern struct vx_info *lookup_or_create_vx_info(int);
+
+extern int get_xid_list(int, unsigned int *, int);
+extern int xid_is_hashed(xid_t);
+
+extern int vx_migrate_task(struct task_struct *, struct vx_info *, int);
+
+extern long vs_state_change(struct vx_info *, unsigned int);
+
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_CONTEXT_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/cvirt_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cvirt_cmd.h
--- linux-2.6.32.43/include/linux/vserver/cvirt_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cvirt_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,53 @@
+#ifndef _VX_CVIRT_CMD_H
+#define _VX_CVIRT_CMD_H
+
+
+/* virtual host info name commands */
+
+#define VCMD_set_vhi_name	VC_CMD(VHOST, 1, 0)
+#define VCMD_get_vhi_name	VC_CMD(VHOST, 2, 0)
+
+struct	vcmd_vhi_name_v0 {
+	uint32_t field;
+	char name[65];
+};
+
+
+enum vhi_name_field {
+	VHIN_CONTEXT = 0,
+	VHIN_SYSNAME,
+	VHIN_NODENAME,
+	VHIN_RELEASE,
+	VHIN_VERSION,
+	VHIN_MACHINE,
+	VHIN_DOMAINNAME,
+};
+
+
+#ifdef	__KERNEL__
+
+#include <linux/compiler.h>
+
+extern int vc_set_vhi_name(struct vx_info *, void __user *);
+extern int vc_get_vhi_name(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+#define VCMD_virt_stat		VC_CMD(VSTAT, 3, 0)
+
+struct	vcmd_virt_stat_v0 {
+	uint64_t offset;
+	uint64_t uptime;
+	uint32_t nr_threads;
+	uint32_t nr_running;
+	uint32_t nr_uninterruptible;
+	uint32_t nr_onhold;
+	uint32_t nr_forks;
+	uint32_t load[3];
+};
+
+#ifdef	__KERNEL__
+extern int vc_virt_stat(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_CVIRT_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/cvirt_def.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cvirt_def.h
--- linux-2.6.32.43/include/linux/vserver/cvirt_def.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cvirt_def.h	2011-07-15 06:54:21.000000000 -0500
@@ -0,0 +1,80 @@
+#ifndef _VX_CVIRT_DEF_H
+#define _VX_CVIRT_DEF_H
+
+#include <linux/jiffies.h>
+#include <linux/spinlock.h>
+#include <linux/wait.h>
+#include <linux/time.h>
+#include <asm/atomic.h>
+
+
+struct _vx_usage_stat {
+	uint64_t user;
+	uint64_t nice;
+	uint64_t system;
+	uint64_t softirq;
+	uint64_t irq;
+	uint64_t idle;
+	uint64_t iowait;
+};
+
+struct _vx_syslog {
+	wait_queue_head_t log_wait;
+	spinlock_t logbuf_lock;		/* lock for the log buffer */
+
+	unsigned long log_start;	/* next char to be read by syslog() */
+	unsigned long con_start;	/* next char to be sent to consoles */
+	unsigned long log_end;	/* most-recently-written-char + 1 */
+	unsigned long logged_chars;	/* #chars since last read+clear operation */
+
+	char log_buf[1024];
+};
+
+
+/* context sub struct */
+
+struct _vx_cvirt {
+	atomic_t nr_threads;		/* number of current threads */
+	atomic_t nr_running;		/* number of running threads */
+	atomic_t nr_uninterruptible;	/* number of uninterruptible threads */
+
+	atomic_t nr_onhold;		/* processes on hold */
+	uint32_t onhold_last;		/* jiffies when put on hold */
+
+	struct timeval bias_tv;		/* time offset to the host */
+	struct timespec bias_idle;
+	struct timespec bias_uptime;	/* context creation point */
+	uint64_t bias_clock;		/* offset in clock_t */
+
+	spinlock_t load_lock;		/* lock for the load averages */
+	atomic_unchecked_t load_updates;	/* nr of load updates done so far */
+	uint32_t load_last;		/* last time load was calculated */
+	uint32_t load[3];		/* load averages 1,5,15 */
+
+	atomic_unchecked_t total_forks;	/* number of forks so far */
+
+	struct _vx_syslog syslog;
+};
+
+struct _vx_cvirt_pc {
+	struct _vx_usage_stat cpustat;
+};
+
+
+#ifdef CONFIG_VSERVER_DEBUG
+
+static inline void __dump_vx_cvirt(struct _vx_cvirt *cvirt)
+{
+	printk("\t_vx_cvirt:\n");
+	printk("\t threads: %4d, %4d, %4d, %4d\n",
+		atomic_read(&cvirt->nr_threads),
+		atomic_read(&cvirt->nr_running),
+		atomic_read(&cvirt->nr_uninterruptible),
+		atomic_read(&cvirt->nr_onhold));
+	/* add rest here */
+	printk("\t total_forks = %d\n", atomic_read_unchecked(&cvirt->total_forks));
+}
+
+#endif
+
+#endif	/* _VX_CVIRT_DEF_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/cvirt.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cvirt.h
--- linux-2.6.32.43/include/linux/vserver/cvirt.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/cvirt.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,20 @@
+#ifndef _VX_CVIRT_H
+#define _VX_CVIRT_H
+
+
+#ifdef	__KERNEL__
+
+struct timespec;
+
+void vx_vsi_uptime(struct timespec *, struct timespec *);
+
+
+struct vx_info;
+
+void vx_update_load(struct vx_info *);
+
+
+int vx_do_syslog(int, char __user *, int);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_CVIRT_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/debug_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/debug_cmd.h
--- linux-2.6.32.43/include/linux/vserver/debug_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/debug_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,58 @@
+#ifndef _VX_DEBUG_CMD_H
+#define _VX_DEBUG_CMD_H
+
+
+/* debug commands */
+
+#define VCMD_dump_history	VC_CMD(DEBUG, 1, 0)
+
+#define VCMD_read_history	VC_CMD(DEBUG, 5, 0)
+#define VCMD_read_monitor	VC_CMD(DEBUG, 6, 0)
+
+struct  vcmd_read_history_v0 {
+	uint32_t index;
+	uint32_t count;
+	char __user *data;
+};
+
+struct  vcmd_read_monitor_v0 {
+	uint32_t index;
+	uint32_t count;
+	char __user *data;
+};
+
+
+#ifdef	__KERNEL__
+
+#ifdef	CONFIG_COMPAT
+
+#include <asm/compat.h>
+
+struct	vcmd_read_history_v0_x32 {
+	uint32_t index;
+	uint32_t count;
+	compat_uptr_t data_ptr;
+};
+
+struct	vcmd_read_monitor_v0_x32 {
+	uint32_t index;
+	uint32_t count;
+	compat_uptr_t data_ptr;
+};
+
+#endif  /* CONFIG_COMPAT */
+
+extern int vc_dump_history(uint32_t);
+
+extern int vc_read_history(uint32_t, void __user *);
+extern int vc_read_monitor(uint32_t, void __user *);
+
+#ifdef	CONFIG_COMPAT
+
+extern int vc_read_history_x32(uint32_t, void __user *);
+extern int vc_read_monitor_x32(uint32_t, void __user *);
+
+#endif  /* CONFIG_COMPAT */
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_DEBUG_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/debug.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/debug.h
--- linux-2.6.32.43/include/linux/vserver/debug.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/debug.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,127 @@
+#ifndef _VX_DEBUG_H
+#define _VX_DEBUG_H
+
+
+#define VXD_CBIT(n, m)	(vx_debug_ ## n & (1 << (m)))
+#define VXD_CMIN(n, m)	(vx_debug_ ## n > (m))
+#define VXD_MASK(n, m)	(vx_debug_ ## n & (m))
+
+#define VXD_DEV(d)	(d), (d)->bd_inode->i_ino,		\
+			imajor((d)->bd_inode), iminor((d)->bd_inode)
+#define VXF_DEV		"%p[%lu,%d:%d]"
+
+
+#define vxd_path(p)						\
+	({ static char _buffer[PATH_MAX];			\
+	   d_path(p, _buffer, sizeof(_buffer)); })
+
+#define vxd_cond_path(n)					\
+	((n) ? vxd_path(&(n)->path) : "<null>" )
+
+
+#ifdef	CONFIG_VSERVER_DEBUG
+
+extern unsigned int vx_debug_switch;
+extern unsigned int vx_debug_xid;
+extern unsigned int vx_debug_nid;
+extern unsigned int vx_debug_tag;
+extern unsigned int vx_debug_net;
+extern unsigned int vx_debug_limit;
+extern unsigned int vx_debug_cres;
+extern unsigned int vx_debug_dlim;
+extern unsigned int vx_debug_quota;
+extern unsigned int vx_debug_cvirt;
+extern unsigned int vx_debug_space;
+extern unsigned int vx_debug_misc;
+
+
+#define VX_LOGLEVEL	"vxD: "
+#define VX_PROC_FMT	"%p: "
+#define VX_PROCESS	current
+
+#define vxdprintk(c, f, x...)					\
+	do {							\
+		if (c)						\
+			printk(VX_LOGLEVEL VX_PROC_FMT f "\n",	\
+				VX_PROCESS , ##x);		\
+	} while (0)
+
+#define vxlprintk(c, f, x...)					\
+	do {							\
+		if (c)						\
+			printk(VX_LOGLEVEL f " @%s:%d\n", x);	\
+	} while (0)
+
+#define vxfprintk(c, f, x...)					\
+	do {							\
+		if (c)						\
+			printk(VX_LOGLEVEL f " %s@%s:%d\n", x); \
+	} while (0)
+
+
+struct vx_info;
+
+void dump_vx_info(struct vx_info *, int);
+void dump_vx_info_inactive(int);
+
+#else	/* CONFIG_VSERVER_DEBUG */
+
+#define vx_debug_switch 0
+#define vx_debug_xid	0
+#define vx_debug_nid	0
+#define vx_debug_tag	0
+#define vx_debug_net	0
+#define vx_debug_limit	0
+#define vx_debug_cres	0
+#define vx_debug_dlim	0
+#define vx_debug_cvirt	0
+
+#define vxdprintk(x...) do { } while (0)
+#define vxlprintk(x...) do { } while (0)
+#define vxfprintk(x...) do { } while (0)
+
+#endif	/* CONFIG_VSERVER_DEBUG */
+
+
+#ifdef	CONFIG_VSERVER_WARN
+
+#define VX_WARNLEVEL	KERN_WARNING "vxW: "
+#define VX_WARN_TASK	"[»%s«,%u:#%u|%u|%u] "
+#define VX_WARN_XID	"[xid #%u] "
+#define VX_WARN_NID	"[nid #%u] "
+#define VX_WARN_TAG	"[tag #%u] "
+
+#define vxwprintk(c, f, x...)					\
+	do {							\
+		if (c)						\
+			printk(VX_WARNLEVEL f "\n", ##x);	\
+	} while (0)
+
+#else	/* CONFIG_VSERVER_WARN */
+
+#define vxwprintk(x...) do { } while (0)
+
+#endif	/* CONFIG_VSERVER_WARN */
+
+#define vxwprintk_task(c, f, x...)				\
+	vxwprintk(c, VX_WARN_TASK f,				\
+		current->comm, current->pid,			\
+		current->xid, current->nid, current->tag, ##x)
+#define vxwprintk_xid(c, f, x...)				\
+	vxwprintk(c, VX_WARN_XID f, current->xid, x)
+#define vxwprintk_nid(c, f, x...)				\
+	vxwprintk(c, VX_WARN_NID f, current->nid, x)
+#define vxwprintk_tag(c, f, x...)				\
+	vxwprintk(c, VX_WARN_TAG f, current->tag, x)
+
+#ifdef	CONFIG_VSERVER_DEBUG
+#define vxd_assert_lock(l)	assert_spin_locked(l)
+#define vxd_assert(c, f, x...)	vxlprintk(!(c), \
+	"assertion [" f "] failed.", ##x, __FILE__, __LINE__)
+#else
+#define vxd_assert_lock(l)	do { } while (0)
+#define vxd_assert(c, f, x...)	do { } while (0)
+#endif
+
+
+#endif /* _VX_DEBUG_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/device_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/device_cmd.h
--- linux-2.6.32.43/include/linux/vserver/device_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/device_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,44 @@
+#ifndef _VX_DEVICE_CMD_H
+#define _VX_DEVICE_CMD_H
+
+
+/*  device vserver commands */
+
+#define VCMD_set_mapping	VC_CMD(DEVICE, 1, 0)
+#define VCMD_unset_mapping	VC_CMD(DEVICE, 2, 0)
+
+struct	vcmd_set_mapping_v0 {
+	const char __user *device;
+	const char __user *target;
+	uint32_t flags;
+};
+
+
+#ifdef	__KERNEL__
+
+#ifdef	CONFIG_COMPAT
+
+#include <asm/compat.h>
+
+struct	vcmd_set_mapping_v0_x32 {
+	compat_uptr_t device_ptr;
+	compat_uptr_t target_ptr;
+	uint32_t flags;
+};
+
+#endif	/* CONFIG_COMPAT */
+
+#include <linux/compiler.h>
+
+extern int vc_set_mapping(struct vx_info *, void __user *);
+extern int vc_unset_mapping(struct vx_info *, void __user *);
+
+#ifdef	CONFIG_COMPAT
+
+extern int vc_set_mapping_x32(struct vx_info *, void __user *);
+extern int vc_unset_mapping_x32(struct vx_info *, void __user *);
+
+#endif	/* CONFIG_COMPAT */
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_DEVICE_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/device_def.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/device_def.h
--- linux-2.6.32.43/include/linux/vserver/device_def.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/device_def.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,17 @@
+#ifndef _VX_DEVICE_DEF_H
+#define _VX_DEVICE_DEF_H
+
+#include <linux/types.h>
+
+struct vx_dmap_target {
+	dev_t target;
+	uint32_t flags;
+};
+
+struct _vx_device {
+#ifdef CONFIG_VSERVER_DEVICE
+	struct vx_dmap_target targets[2];
+#endif
+};
+
+#endif	/* _VX_DEVICE_DEF_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/device.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/device.h
--- linux-2.6.32.43/include/linux/vserver/device.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/device.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,15 @@
+#ifndef _VX_DEVICE_H
+#define _VX_DEVICE_H
+
+
+#define DATTR_CREATE	0x00000001
+#define DATTR_OPEN	0x00000002
+
+#define DATTR_REMAP	0x00000010
+
+#define DATTR_MASK	0x00000013
+
+
+#else	/* _VX_DEVICE_H */
+#warning duplicate inclusion
+#endif	/* _VX_DEVICE_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/dlimit_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/dlimit_cmd.h
--- linux-2.6.32.43/include/linux/vserver/dlimit_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/dlimit_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,109 @@
+#ifndef _VX_DLIMIT_CMD_H
+#define _VX_DLIMIT_CMD_H
+
+
+/*  dlimit vserver commands */
+
+#define VCMD_add_dlimit		VC_CMD(DLIMIT, 1, 0)
+#define VCMD_rem_dlimit		VC_CMD(DLIMIT, 2, 0)
+
+#define VCMD_set_dlimit		VC_CMD(DLIMIT, 5, 0)
+#define VCMD_get_dlimit		VC_CMD(DLIMIT, 6, 0)
+
+struct	vcmd_ctx_dlimit_base_v0 {
+	const char __user *name;
+	uint32_t flags;
+};
+
+struct	vcmd_ctx_dlimit_v0 {
+	const char __user *name;
+	uint32_t space_used;			/* used space in kbytes */
+	uint32_t space_total;			/* maximum space in kbytes */
+	uint32_t inodes_used;			/* used inodes */
+	uint32_t inodes_total;			/* maximum inodes */
+	uint32_t reserved;			/* reserved for root in % */
+	uint32_t flags;
+};
+
+#define CDLIM_UNSET		((uint32_t)0UL)
+#define CDLIM_INFINITY		((uint32_t)~0UL)
+#define CDLIM_KEEP		((uint32_t)~1UL)
+
+#define DLIME_UNIT	0
+#define DLIME_KILO	1
+#define DLIME_MEGA	2
+#define DLIME_GIGA	3
+
+#define DLIMF_SHIFT	0x10
+
+#define DLIMS_USED	0
+#define DLIMS_TOTAL	2
+
+static inline
+uint64_t dlimit_space_32to64(uint32_t val, uint32_t flags, int shift)
+{
+	int exp = (flags & DLIMF_SHIFT) ?
+		(flags >> shift) & DLIME_GIGA : DLIME_KILO;
+	return ((uint64_t)val) << (10 * exp);
+}
+
+static inline
+uint32_t dlimit_space_64to32(uint64_t val, uint32_t *flags, int shift)
+{
+	int exp = 0;
+
+	if (*flags & DLIMF_SHIFT) {
+		while (val > (1LL << 32) && (exp < 3)) {
+			val >>= 10;
+			exp++;
+		}
+		*flags &= ~(DLIME_GIGA << shift);
+		*flags |= exp << shift;
+	} else
+		val >>= 10;
+	return val;
+}
+
+#ifdef	__KERNEL__
+
+#ifdef	CONFIG_COMPAT
+
+#include <asm/compat.h>
+
+struct	vcmd_ctx_dlimit_base_v0_x32 {
+	compat_uptr_t name_ptr;
+	uint32_t flags;
+};
+
+struct	vcmd_ctx_dlimit_v0_x32 {
+	compat_uptr_t name_ptr;
+	uint32_t space_used;			/* used space in kbytes */
+	uint32_t space_total;			/* maximum space in kbytes */
+	uint32_t inodes_used;			/* used inodes */
+	uint32_t inodes_total;			/* maximum inodes */
+	uint32_t reserved;			/* reserved for root in % */
+	uint32_t flags;
+};
+
+#endif	/* CONFIG_COMPAT */
+
+#include <linux/compiler.h>
+
+extern int vc_add_dlimit(uint32_t, void __user *);
+extern int vc_rem_dlimit(uint32_t, void __user *);
+
+extern int vc_set_dlimit(uint32_t, void __user *);
+extern int vc_get_dlimit(uint32_t, void __user *);
+
+#ifdef	CONFIG_COMPAT
+
+extern int vc_add_dlimit_x32(uint32_t, void __user *);
+extern int vc_rem_dlimit_x32(uint32_t, void __user *);
+
+extern int vc_set_dlimit_x32(uint32_t, void __user *);
+extern int vc_get_dlimit_x32(uint32_t, void __user *);
+
+#endif	/* CONFIG_COMPAT */
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_DLIMIT_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/dlimit.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/dlimit.h
--- linux-2.6.32.43/include/linux/vserver/dlimit.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/dlimit.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,54 @@
+#ifndef _VX_DLIMIT_H
+#define _VX_DLIMIT_H
+
+#include "switch.h"
+
+
+#ifdef	__KERNEL__
+
+/*      keep in sync with CDLIM_INFINITY	*/
+
+#define DLIM_INFINITY		(~0ULL)
+
+#include <linux/spinlock.h>
+#include <linux/rcupdate.h>
+
+struct super_block;
+
+struct dl_info {
+	struct hlist_node dl_hlist;		/* linked list of contexts */
+	struct rcu_head dl_rcu;			/* the rcu head */
+	tag_t dl_tag;				/* context tag */
+	atomic_t dl_usecnt;			/* usage count */
+	atomic_t dl_refcnt;			/* reference count */
+
+	struct super_block *dl_sb;		/* associated superblock */
+
+	spinlock_t dl_lock;			/* protect the values */
+
+	unsigned long long dl_space_used;	/* used space in bytes */
+	unsigned long long dl_space_total;	/* maximum space in bytes */
+	unsigned long dl_inodes_used;		/* used inodes */
+	unsigned long dl_inodes_total;		/* maximum inodes */
+
+	unsigned int dl_nrlmult;		/* non root limit mult */
+};
+
+struct rcu_head;
+
+extern void rcu_free_dl_info(struct rcu_head *);
+extern void unhash_dl_info(struct dl_info *);
+
+extern struct dl_info *locate_dl_info(struct super_block *, tag_t);
+
+
+struct kstatfs;
+
+extern void vx_vsi_statfs(struct super_block *, struct kstatfs *);
+
+typedef uint64_t dlsize_t;
+
+#endif	/* __KERNEL__ */
+#else	/* _VX_DLIMIT_H */
+#warning duplicate inclusion
+#endif	/* _VX_DLIMIT_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/global.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/global.h
--- linux-2.6.32.43/include/linux/vserver/global.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/global.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,19 @@
+#ifndef _VX_GLOBAL_H
+#define _VX_GLOBAL_H
+
+
+extern atomic_t vx_global_ctotal;
+extern atomic_t vx_global_cactive;
+
+extern atomic_t nx_global_ctotal;
+extern atomic_t nx_global_cactive;
+
+extern atomic_t vs_global_nsproxy;
+extern atomic_t vs_global_fs;
+extern atomic_t vs_global_mnt_ns;
+extern atomic_t vs_global_uts_ns;
+extern atomic_t vs_global_user_ns;
+extern atomic_t vs_global_pid_ns;
+
+
+#endif /* _VX_GLOBAL_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/history.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/history.h
--- linux-2.6.32.43/include/linux/vserver/history.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/history.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,197 @@
+#ifndef _VX_HISTORY_H
+#define _VX_HISTORY_H
+
+
+enum {
+	VXH_UNUSED = 0,
+	VXH_THROW_OOPS = 1,
+
+	VXH_GET_VX_INFO,
+	VXH_PUT_VX_INFO,
+	VXH_INIT_VX_INFO,
+	VXH_SET_VX_INFO,
+	VXH_CLR_VX_INFO,
+	VXH_CLAIM_VX_INFO,
+	VXH_RELEASE_VX_INFO,
+	VXH_ALLOC_VX_INFO,
+	VXH_DEALLOC_VX_INFO,
+	VXH_HASH_VX_INFO,
+	VXH_UNHASH_VX_INFO,
+	VXH_LOC_VX_INFO,
+	VXH_LOOKUP_VX_INFO,
+	VXH_CREATE_VX_INFO,
+};
+
+struct _vxhe_vxi {
+	struct vx_info *ptr;
+	unsigned xid;
+	unsigned usecnt;
+	unsigned tasks;
+};
+
+struct _vxhe_set_clr {
+	void *data;
+};
+
+struct _vxhe_loc_lookup {
+	unsigned arg;
+};
+
+struct _vx_hist_entry {
+	void *loc;
+	unsigned short seq;
+	unsigned short type;
+	struct _vxhe_vxi vxi;
+	union {
+		struct _vxhe_set_clr sc;
+		struct _vxhe_loc_lookup ll;
+	};
+};
+
+#ifdef	CONFIG_VSERVER_HISTORY
+
+extern unsigned volatile int vxh_active;
+
+struct _vx_hist_entry *vxh_advance(void *loc);
+
+
+static inline
+void	__vxh_copy_vxi(struct _vx_hist_entry *entry, struct vx_info *vxi)
+{
+	entry->vxi.ptr = vxi;
+	if (vxi) {
+		entry->vxi.usecnt = atomic_read(&vxi->vx_usecnt);
+		entry->vxi.tasks = atomic_read(&vxi->vx_tasks);
+		entry->vxi.xid = vxi->vx_id;
+	}
+}
+
+
+#define	__HERE__ current_text_addr()
+
+#define __VXH_BODY(__type, __data, __here)	\
+	struct _vx_hist_entry *entry;		\
+						\
+	preempt_disable();			\
+	entry = vxh_advance(__here);		\
+	__data;					\
+	entry->type = __type;			\
+	preempt_enable();
+
+
+	/* pass vxi only */
+
+#define __VXH_SMPL				\
+	__vxh_copy_vxi(entry, vxi)
+
+static inline
+void	__vxh_smpl(struct vx_info *vxi, int __type, void *__here)
+{
+	__VXH_BODY(__type, __VXH_SMPL, __here)
+}
+
+	/* pass vxi and data (void *) */
+
+#define __VXH_DATA				\
+	__vxh_copy_vxi(entry, vxi);		\
+	entry->sc.data = data
+
+static inline
+void	__vxh_data(struct vx_info *vxi, void *data,
+			int __type, void *__here)
+{
+	__VXH_BODY(__type, __VXH_DATA, __here)
+}
+
+	/* pass vxi and arg (long) */
+
+#define __VXH_LONG				\
+	__vxh_copy_vxi(entry, vxi);		\
+	entry->ll.arg = arg
+
+static inline
+void	__vxh_long(struct vx_info *vxi, long arg,
+			int __type, void *__here)
+{
+	__VXH_BODY(__type, __VXH_LONG, __here)
+}
+
+
+static inline
+void	__vxh_throw_oops(void *__here)
+{
+	__VXH_BODY(VXH_THROW_OOPS, {}, __here);
+	/* prevent further acquisition */
+	vxh_active = 0;
+}
+
+
+#define vxh_throw_oops()	__vxh_throw_oops(__HERE__);
+
+#define __vxh_get_vx_info(v, h)	__vxh_smpl(v, VXH_GET_VX_INFO, h);
+#define __vxh_put_vx_info(v, h)	__vxh_smpl(v, VXH_PUT_VX_INFO, h);
+
+#define __vxh_init_vx_info(v, d, h) \
+	__vxh_data(v, d, VXH_INIT_VX_INFO, h);
+#define __vxh_set_vx_info(v, d, h) \
+	__vxh_data(v, d, VXH_SET_VX_INFO, h);
+#define __vxh_clr_vx_info(v, d, h) \
+	__vxh_data(v, d, VXH_CLR_VX_INFO, h);
+
+#define __vxh_claim_vx_info(v, d, h) \
+	__vxh_data(v, d, VXH_CLAIM_VX_INFO, h);
+#define __vxh_release_vx_info(v, d, h) \
+	__vxh_data(v, d, VXH_RELEASE_VX_INFO, h);
+
+#define vxh_alloc_vx_info(v) \
+	__vxh_smpl(v, VXH_ALLOC_VX_INFO, __HERE__);
+#define vxh_dealloc_vx_info(v) \
+	__vxh_smpl(v, VXH_DEALLOC_VX_INFO, __HERE__);
+
+#define vxh_hash_vx_info(v) \
+	__vxh_smpl(v, VXH_HASH_VX_INFO, __HERE__);
+#define vxh_unhash_vx_info(v) \
+	__vxh_smpl(v, VXH_UNHASH_VX_INFO, __HERE__);
+
+#define vxh_loc_vx_info(v, l) \
+	__vxh_long(v, l, VXH_LOC_VX_INFO, __HERE__);
+#define vxh_lookup_vx_info(v, l) \
+	__vxh_long(v, l, VXH_LOOKUP_VX_INFO, __HERE__);
+#define vxh_create_vx_info(v, l) \
+	__vxh_long(v, l, VXH_CREATE_VX_INFO, __HERE__);
+
+extern void vxh_dump_history(void);
+
+
+#else  /* CONFIG_VSERVER_HISTORY */
+
+#define	__HERE__	0
+
+#define vxh_throw_oops()		do { } while (0)
+
+#define __vxh_get_vx_info(v, h)		do { } while (0)
+#define __vxh_put_vx_info(v, h)		do { } while (0)
+
+#define __vxh_init_vx_info(v, d, h)	do { } while (0)
+#define __vxh_set_vx_info(v, d, h)	do { } while (0)
+#define __vxh_clr_vx_info(v, d, h)	do { } while (0)
+
+#define __vxh_claim_vx_info(v, d, h)	do { } while (0)
+#define __vxh_release_vx_info(v, d, h)	do { } while (0)
+
+#define vxh_alloc_vx_info(v)		do { } while (0)
+#define vxh_dealloc_vx_info(v)		do { } while (0)
+
+#define vxh_hash_vx_info(v)		do { } while (0)
+#define vxh_unhash_vx_info(v)		do { } while (0)
+
+#define vxh_loc_vx_info(v, l)		do { } while (0)
+#define vxh_lookup_vx_info(v, l)	do { } while (0)
+#define vxh_create_vx_info(v, l)	do { } while (0)
+
+#define vxh_dump_history()		do { } while (0)
+
+
+#endif /* CONFIG_VSERVER_HISTORY */
+
+#endif /* _VX_HISTORY_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/inode_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/inode_cmd.h
--- linux-2.6.32.43/include/linux/vserver/inode_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/inode_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,59 @@
+#ifndef _VX_INODE_CMD_H
+#define _VX_INODE_CMD_H
+
+
+/*  inode vserver commands */
+
+#define VCMD_get_iattr		VC_CMD(INODE, 1, 1)
+#define VCMD_set_iattr		VC_CMD(INODE, 2, 1)
+
+#define VCMD_fget_iattr		VC_CMD(INODE, 3, 0)
+#define VCMD_fset_iattr		VC_CMD(INODE, 4, 0)
+
+struct	vcmd_ctx_iattr_v1 {
+	const char __user *name;
+	uint32_t tag;
+	uint32_t flags;
+	uint32_t mask;
+};
+
+struct	vcmd_ctx_fiattr_v0 {
+	uint32_t tag;
+	uint32_t flags;
+	uint32_t mask;
+};
+
+
+#ifdef	__KERNEL__
+
+
+#ifdef	CONFIG_COMPAT
+
+#include <asm/compat.h>
+
+struct	vcmd_ctx_iattr_v1_x32 {
+	compat_uptr_t name_ptr;
+	uint32_t tag;
+	uint32_t flags;
+	uint32_t mask;
+};
+
+#endif	/* CONFIG_COMPAT */
+
+#include <linux/compiler.h>
+
+extern int vc_get_iattr(void __user *);
+extern int vc_set_iattr(void __user *);
+
+extern int vc_fget_iattr(uint32_t, void __user *);
+extern int vc_fset_iattr(uint32_t, void __user *);
+
+#ifdef	CONFIG_COMPAT
+
+extern int vc_get_iattr_x32(void __user *);
+extern int vc_set_iattr_x32(void __user *);
+
+#endif	/* CONFIG_COMPAT */
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_INODE_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/inode.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/inode.h
--- linux-2.6.32.43/include/linux/vserver/inode.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/inode.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,39 @@
+#ifndef _VX_INODE_H
+#define _VX_INODE_H
+
+
+#define IATTR_TAG	0x01000000
+
+#define IATTR_ADMIN	0x00000001
+#define IATTR_WATCH	0x00000002
+#define IATTR_HIDE	0x00000004
+#define IATTR_FLAGS	0x00000007
+
+#define IATTR_BARRIER	0x00010000
+#define IATTR_IXUNLINK	0x00020000
+#define IATTR_IMMUTABLE 0x00040000
+#define IATTR_COW	0x00080000
+
+#ifdef	__KERNEL__
+
+
+#ifdef	CONFIG_VSERVER_PROC_SECURE
+#define IATTR_PROC_DEFAULT	( IATTR_ADMIN | IATTR_HIDE )
+#define IATTR_PROC_SYMLINK	( IATTR_ADMIN )
+#else
+#define IATTR_PROC_DEFAULT	( IATTR_ADMIN )
+#define IATTR_PROC_SYMLINK	( IATTR_ADMIN )
+#endif
+
+#define vx_hide_check(c, m)	(((m) & IATTR_HIDE) ? vx_check(c, m) : 1)
+
+#endif	/* __KERNEL__ */
+
+/* inode ioctls */
+
+#define FIOC_GETXFLG	_IOR('x', 5, long)
+#define FIOC_SETXFLG	_IOW('x', 6, long)
+
+#else	/* _VX_INODE_H */
+#warning duplicate inclusion
+#endif	/* _VX_INODE_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/Kbuild linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/Kbuild
--- linux-2.6.32.43/include/linux/vserver/Kbuild	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/Kbuild	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,8 @@
+
+unifdef-y += context_cmd.h network_cmd.h space_cmd.h \
+	cacct_cmd.h cvirt_cmd.h limit_cmd.h dlimit_cmd.h \
+	inode_cmd.h tag_cmd.h sched_cmd.h signal_cmd.h \
+	debug_cmd.h device_cmd.h
+
+unifdef-y += switch.h network.h monitor.h inode.h device.h
+
diff -uriN linux-2.6.32.43/include/linux/vserver/limit_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/limit_cmd.h
--- linux-2.6.32.43/include/linux/vserver/limit_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/limit_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,71 @@
+#ifndef _VX_LIMIT_CMD_H
+#define _VX_LIMIT_CMD_H
+
+
+/*  rlimit vserver commands */
+
+#define VCMD_get_rlimit		VC_CMD(RLIMIT, 1, 0)
+#define VCMD_set_rlimit		VC_CMD(RLIMIT, 2, 0)
+#define VCMD_get_rlimit_mask	VC_CMD(RLIMIT, 3, 0)
+#define VCMD_reset_hits		VC_CMD(RLIMIT, 7, 0)
+#define VCMD_reset_minmax	VC_CMD(RLIMIT, 9, 0)
+
+struct	vcmd_ctx_rlimit_v0 {
+	uint32_t id;
+	uint64_t minimum;
+	uint64_t softlimit;
+	uint64_t maximum;
+};
+
+struct	vcmd_ctx_rlimit_mask_v0 {
+	uint32_t minimum;
+	uint32_t softlimit;
+	uint32_t maximum;
+};
+
+#define VCMD_rlimit_stat	VC_CMD(VSTAT, 1, 0)
+
+struct	vcmd_rlimit_stat_v0 {
+	uint32_t id;
+	uint32_t hits;
+	uint64_t value;
+	uint64_t minimum;
+	uint64_t maximum;
+};
+
+#define CRLIM_UNSET		(0ULL)
+#define CRLIM_INFINITY		(~0ULL)
+#define CRLIM_KEEP		(~1ULL)
+
+#ifdef	__KERNEL__
+
+#ifdef	CONFIG_IA32_EMULATION
+
+struct	vcmd_ctx_rlimit_v0_x32 {
+	uint32_t id;
+	uint64_t minimum;
+	uint64_t softlimit;
+	uint64_t maximum;
+} __attribute__ ((packed));
+
+#endif	/* CONFIG_IA32_EMULATION */
+
+#include <linux/compiler.h>
+
+extern int vc_get_rlimit_mask(uint32_t, void __user *);
+extern int vc_get_rlimit(struct vx_info *, void __user *);
+extern int vc_set_rlimit(struct vx_info *, void __user *);
+extern int vc_reset_hits(struct vx_info *, void __user *);
+extern int vc_reset_minmax(struct vx_info *, void __user *);
+
+extern int vc_rlimit_stat(struct vx_info *, void __user *);
+
+#ifdef	CONFIG_IA32_EMULATION
+
+extern int vc_get_rlimit_x32(struct vx_info *, void __user *);
+extern int vc_set_rlimit_x32(struct vx_info *, void __user *);
+
+#endif	/* CONFIG_IA32_EMULATION */
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_LIMIT_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/limit_def.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/limit_def.h
--- linux-2.6.32.43/include/linux/vserver/limit_def.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/limit_def.h	2011-07-15 06:54:21.000000000 -0500
@@ -0,0 +1,47 @@
+#ifndef _VX_LIMIT_DEF_H
+#define _VX_LIMIT_DEF_H
+
+#include <asm/atomic.h>
+#include <asm/resource.h>
+
+#include "limit.h"
+
+
+struct _vx_res_limit {
+	rlim_t soft;		/* Context soft limit */
+	rlim_t hard;		/* Context hard limit */
+
+	rlim_atomic_t rcur;	/* Current value */
+	rlim_t rmin;		/* Context minimum */
+	rlim_t rmax;		/* Context maximum */
+
+	atomic_unchecked_t lhit; /* Limit hits */
+};
+
+/* context sub struct */
+
+struct _vx_limit {
+	struct _vx_res_limit res[NUM_LIMITS];
+};
+
+#ifdef CONFIG_VSERVER_DEBUG
+
+static inline void __dump_vx_limit(struct _vx_limit *limit)
+{
+	int i;
+
+	printk("\t_vx_limit:");
+	for (i = 0; i < NUM_LIMITS; i++) {
+		printk("\t [%2d] = %8lu %8lu/%8lu, %8ld/%8ld, %8d\n",
+			i, (unsigned long)__rlim_get(limit, i),
+			(unsigned long)__rlim_rmin(limit, i),
+			(unsigned long)__rlim_rmax(limit, i),
+			(long)__rlim_soft(limit, i),
+			(long)__rlim_hard(limit, i),
+			atomic_read_unchecked(&__rlim_lhit(limit, i)));
+	}
+}
+
+#endif
+
+#endif	/* _VX_LIMIT_DEF_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/limit.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/limit.h
--- linux-2.6.32.43/include/linux/vserver/limit.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/limit.h	2011-07-15 06:54:21.000000000 -0500
@@ -0,0 +1,71 @@
+#ifndef _VX_LIMIT_H
+#define _VX_LIMIT_H
+
+#define VLIMIT_NSOCK	16
+#define VLIMIT_OPENFD	17
+#define VLIMIT_ANON	18
+#define VLIMIT_SHMEM	19
+#define VLIMIT_SEMARY	20
+#define VLIMIT_NSEMS	21
+#define VLIMIT_DENTRY	22
+#define VLIMIT_MAPPED	23
+
+
+#ifdef	__KERNEL__
+
+#define	VLIM_NOCHECK	((1L << VLIMIT_DENTRY) | (1L << RLIMIT_RSS))
+
+/*	keep in sync with CRLIM_INFINITY */
+
+#define	VLIM_INFINITY	(~0ULL)
+
+#include <asm/atomic.h>
+#include <asm/resource.h>
+
+#ifndef RLIM_INFINITY
+#warning RLIM_INFINITY is undefined
+#endif
+
+#define __rlim_val(l, r, v)	((l)->res[r].v)
+
+#define __rlim_soft(l, r)	__rlim_val(l, r, soft)
+#define __rlim_hard(l, r)	__rlim_val(l, r, hard)
+
+#define __rlim_rcur(l, r)	__rlim_val(l, r, rcur)
+#define __rlim_rmin(l, r)	__rlim_val(l, r, rmin)
+#define __rlim_rmax(l, r)	__rlim_val(l, r, rmax)
+
+#define __rlim_lhit(l, r)	__rlim_val(l, r, lhit)
+#define __rlim_hit(l, r)	atomic_inc_unchecked(&__rlim_lhit(l, r))
+
+typedef atomic_long_t rlim_atomic_t;
+typedef unsigned long rlim_t;
+
+#define __rlim_get(l, r)	atomic_long_read(&__rlim_rcur(l, r))
+#define __rlim_set(l, r, v)	atomic_long_set(&__rlim_rcur(l, r), v)
+#define __rlim_inc(l, r)	atomic_long_inc(&__rlim_rcur(l, r))
+#define __rlim_dec(l, r)	atomic_long_dec(&__rlim_rcur(l, r))
+#define __rlim_add(l, r, v)	atomic_long_add(v, &__rlim_rcur(l, r))
+#define __rlim_sub(l, r, v)	atomic_long_sub(v, &__rlim_rcur(l, r))
+
+
+#if	(RLIM_INFINITY == VLIM_INFINITY)
+#define	VX_VLIM(r) ((long long)(long)(r))
+#define	VX_RLIM(v) ((rlim_t)(v))
+#else
+#define	VX_VLIM(r) (((r) == RLIM_INFINITY) \
+		? VLIM_INFINITY : (long long)(r))
+#define	VX_RLIM(v) (((v) == VLIM_INFINITY) \
+		? RLIM_INFINITY : (rlim_t)(v))
+#endif
+
+struct sysinfo;
+
+void vx_vsi_meminfo(struct sysinfo *);
+void vx_vsi_swapinfo(struct sysinfo *);
+long vx_vsi_cached(struct sysinfo *);
+
+#define NUM_LIMITS	24
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_LIMIT_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/limit_int.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/limit_int.h
--- linux-2.6.32.43/include/linux/vserver/limit_int.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/limit_int.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,198 @@
+#ifndef _VX_LIMIT_INT_H
+#define _VX_LIMIT_INT_H
+
+#include "context.h"
+
+#ifdef	__KERNEL__
+
+#define VXD_RCRES_COND(r)	VXD_CBIT(cres, r)
+#define VXD_RLIMIT_COND(r)	VXD_CBIT(limit, r)
+
+extern const char *vlimit_name[NUM_LIMITS];
+
+static inline void __vx_acc_cres(struct vx_info *vxi,
+	int res, int dir, void *_data, char *_file, int _line)
+{
+	if (VXD_RCRES_COND(res))
+		vxlprintk(1, "vx_acc_cres[%5d,%s,%2d]: %5ld%s (%p)",
+			(vxi ? vxi->vx_id : -1), vlimit_name[res], res,
+			(vxi ? (long)__rlim_get(&vxi->limit, res) : 0),
+			(dir > 0) ? "++" : "--", _data, _file, _line);
+	if (!vxi)
+		return;
+
+	if (dir > 0)
+		__rlim_inc(&vxi->limit, res);
+	else
+		__rlim_dec(&vxi->limit, res);
+}
+
+static inline void __vx_add_cres(struct vx_info *vxi,
+	int res, int amount, void *_data, char *_file, int _line)
+{
+	if (VXD_RCRES_COND(res))
+		vxlprintk(1, "vx_add_cres[%5d,%s,%2d]: %5ld += %5d (%p)",
+			(vxi ? vxi->vx_id : -1), vlimit_name[res], res,
+			(vxi ? (long)__rlim_get(&vxi->limit, res) : 0),
+			amount, _data, _file, _line);
+	if (amount == 0)
+		return;
+	if (!vxi)
+		return;
+	__rlim_add(&vxi->limit, res, amount);
+}
+
+static inline
+int __vx_cres_adjust_max(struct _vx_limit *limit, int res, rlim_t value)
+{
+	int cond = (value > __rlim_rmax(limit, res));
+
+	if (cond)
+		__rlim_rmax(limit, res) = value;
+	return cond;
+}
+
+static inline
+int __vx_cres_adjust_min(struct _vx_limit *limit, int res, rlim_t value)
+{
+	int cond = (value < __rlim_rmin(limit, res));
+
+	if (cond)
+		__rlim_rmin(limit, res) = value;
+	return cond;
+}
+
+static inline
+void __vx_cres_fixup(struct _vx_limit *limit, int res, rlim_t value)
+{
+	if (!__vx_cres_adjust_max(limit, res, value))
+		__vx_cres_adjust_min(limit, res, value);
+}
+
+
+/*	return values:
+	 +1 ... no limit hit
+	 -1 ... over soft limit
+	  0 ... over hard limit		*/
+
+static inline int __vx_cres_avail(struct vx_info *vxi,
+	int res, int num, char *_file, int _line)
+{
+	struct _vx_limit *limit;
+	rlim_t value;
+
+	if (VXD_RLIMIT_COND(res))
+		vxlprintk(1, "vx_cres_avail[%5d,%s,%2d]: %5ld/%5ld > %5ld + %5d",
+			(vxi ? vxi->vx_id : -1), vlimit_name[res], res,
+			(vxi ? (long)__rlim_soft(&vxi->limit, res) : -1),
+			(vxi ? (long)__rlim_hard(&vxi->limit, res) : -1),
+			(vxi ? (long)__rlim_get(&vxi->limit, res) : 0),
+			num, _file, _line);
+	if (!vxi)
+		return 1;
+
+	limit = &vxi->limit;
+	value = __rlim_get(limit, res);
+
+	if (!__vx_cres_adjust_max(limit, res, value))
+		__vx_cres_adjust_min(limit, res, value);
+
+	if (num == 0)
+		return 1;
+
+	if (__rlim_soft(limit, res) == RLIM_INFINITY)
+		return -1;
+	if (value + num <= __rlim_soft(limit, res))
+		return -1;
+
+	if (__rlim_hard(limit, res) == RLIM_INFINITY)
+		return 1;
+	if (value + num <= __rlim_hard(limit, res))
+		return 1;
+
+	__rlim_hit(limit, res);
+	return 0;
+}
+
+
+static const int VLA_RSS[] = { RLIMIT_RSS, VLIMIT_ANON, VLIMIT_MAPPED, 0 };
+
+static inline
+rlim_t __vx_cres_array_sum(struct _vx_limit *limit, const int *array)
+{
+	rlim_t value, sum = 0;
+	int res;
+
+	while ((res = *array++)) {
+		value = __rlim_get(limit, res);
+		__vx_cres_fixup(limit, res, value);
+		sum += value;
+	}
+	return sum;
+}
+
+static inline
+rlim_t __vx_cres_array_fixup(struct _vx_limit *limit, const int *array)
+{
+	rlim_t value = __vx_cres_array_sum(limit, array + 1);
+	int res = *array;
+
+	if (value == __rlim_get(limit, res))
+		return value;
+
+	__rlim_set(limit, res, value);
+	/* now adjust min/max */
+	if (!__vx_cres_adjust_max(limit, res, value))
+		__vx_cres_adjust_min(limit, res, value);
+
+	return value;
+}
+
+static inline int __vx_cres_array_avail(struct vx_info *vxi,
+	const int *array, int num, char *_file, int _line)
+{
+	struct _vx_limit *limit;
+	rlim_t value = 0;
+	int res;
+
+	if (num == 0)
+		return 1;
+	if (!vxi)
+		return 1;
+
+	limit = &vxi->limit;
+	res = *array;
+	value = __vx_cres_array_sum(limit, array + 1);
+
+	__rlim_set(limit, res, value);
+	__vx_cres_fixup(limit, res, value);
+
+	return __vx_cres_avail(vxi, res, num, _file, _line);
+}
+
+
+static inline void vx_limit_fixup(struct _vx_limit *limit, int id)
+{
+	rlim_t value;
+	int res;
+
+	/* complex resources first */
+	if ((id < 0) || (id == RLIMIT_RSS))
+		__vx_cres_array_fixup(limit, VLA_RSS);
+
+	for (res = 0; res < NUM_LIMITS; res++) {
+		if ((id > 0) && (res != id))
+			continue;
+
+		value = __rlim_get(limit, res);
+		__vx_cres_fixup(limit, res, value);
+
+		/* not supposed to happen, maybe warn? */
+		if (__rlim_rmax(limit, res) > __rlim_hard(limit, res))
+			__rlim_rmax(limit, res) = __rlim_hard(limit, res);
+	}
+}
+
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_LIMIT_INT_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/monitor.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/monitor.h
--- linux-2.6.32.43/include/linux/vserver/monitor.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/monitor.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,96 @@
+#ifndef _VX_MONITOR_H
+#define _VX_MONITOR_H
+
+#include <linux/types.h>
+
+enum {
+	VXM_UNUSED = 0,
+
+	VXM_SYNC = 0x10,
+
+	VXM_UPDATE = 0x20,
+	VXM_UPDATE_1,
+	VXM_UPDATE_2,
+
+	VXM_RQINFO_1 = 0x24,
+	VXM_RQINFO_2,
+
+	VXM_ACTIVATE = 0x40,
+	VXM_DEACTIVATE,
+	VXM_IDLE,
+
+	VXM_HOLD = 0x44,
+	VXM_UNHOLD,
+
+	VXM_MIGRATE = 0x48,
+	VXM_RESCHED,
+
+	/* all other bits are flags */
+	VXM_SCHED = 0x80,
+};
+
+struct _vxm_update_1 {
+	uint32_t tokens_max;
+	uint32_t fill_rate;
+	uint32_t interval;
+};
+
+struct _vxm_update_2 {
+	uint32_t tokens_min;
+	uint32_t fill_rate;
+	uint32_t interval;
+};
+
+struct _vxm_rqinfo_1 {
+	uint16_t running;
+	uint16_t onhold;
+	uint16_t iowait;
+	uint16_t uintr;
+	uint32_t idle_tokens;
+};
+
+struct _vxm_rqinfo_2 {
+	uint32_t norm_time;
+	uint32_t idle_time;
+	uint32_t idle_skip;
+};
+
+struct _vxm_sched {
+	uint32_t tokens;
+	uint32_t norm_time;
+	uint32_t idle_time;
+};
+
+struct _vxm_task {
+	uint16_t pid;
+	uint16_t state;
+};
+
+struct _vxm_event {
+	uint32_t jif;
+	union {
+		uint32_t seq;
+		uint32_t sec;
+	};
+	union {
+		uint32_t tokens;
+		uint32_t nsec;
+		struct _vxm_task tsk;
+	};
+};
+
+struct _vx_mon_entry {
+	uint16_t type;
+	uint16_t xid;
+	union {
+		struct _vxm_event ev;
+		struct _vxm_sched sd;
+		struct _vxm_update_1 u1;
+		struct _vxm_update_2 u2;
+		struct _vxm_rqinfo_1 q1;
+		struct _vxm_rqinfo_2 q2;
+	};
+};
+
+
+#endif /* _VX_MONITOR_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/network_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/network_cmd.h
--- linux-2.6.32.43/include/linux/vserver/network_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/network_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,150 @@
+#ifndef _VX_NETWORK_CMD_H
+#define _VX_NETWORK_CMD_H
+
+
+/* vinfo commands */
+
+#define VCMD_task_nid		VC_CMD(VINFO, 2, 0)
+
+#ifdef	__KERNEL__
+extern int vc_task_nid(uint32_t);
+
+#endif	/* __KERNEL__ */
+
+#define VCMD_nx_info		VC_CMD(VINFO, 6, 0)
+
+struct	vcmd_nx_info_v0 {
+	uint32_t nid;
+	/* more to come */
+};
+
+#ifdef	__KERNEL__
+extern int vc_nx_info(struct nx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+#include <linux/in.h>
+#include <linux/in6.h>
+
+#define VCMD_net_create_v0	VC_CMD(VNET, 1, 0)
+#define VCMD_net_create		VC_CMD(VNET, 1, 1)
+
+struct  vcmd_net_create {
+	uint64_t flagword;
+};
+
+#define VCMD_net_migrate	VC_CMD(NETMIG, 1, 0)
+
+#define VCMD_net_add		VC_CMD(NETALT, 1, 0)
+#define VCMD_net_remove		VC_CMD(NETALT, 2, 0)
+
+struct	vcmd_net_addr_v0 {
+	uint16_t type;
+	uint16_t count;
+	struct in_addr ip[4];
+	struct in_addr mask[4];
+};
+
+#define VCMD_net_add_ipv4	VC_CMD(NETALT, 1, 1)
+#define VCMD_net_remove_ipv4	VC_CMD(NETALT, 2, 1)
+
+struct	vcmd_net_addr_ipv4_v1 {
+	uint16_t type;
+	uint16_t flags;
+	struct in_addr ip;
+	struct in_addr mask;
+};
+
+#define VCMD_net_add_ipv6	VC_CMD(NETALT, 3, 1)
+#define VCMD_net_remove_ipv6	VC_CMD(NETALT, 4, 1)
+
+struct	vcmd_net_addr_ipv6_v1 {
+	uint16_t type;
+	uint16_t flags;
+	uint32_t prefix;
+	struct in6_addr ip;
+	struct in6_addr mask;
+};
+
+#define VCMD_add_match_ipv4	VC_CMD(NETALT, 5, 0)
+#define VCMD_get_match_ipv4	VC_CMD(NETALT, 6, 0)
+
+struct	vcmd_match_ipv4_v0 {
+	uint16_t type;
+	uint16_t flags;
+	uint16_t parent;
+	uint16_t prefix;
+	struct in_addr ip;
+	struct in_addr ip2;
+	struct in_addr mask;
+};
+
+#define VCMD_add_match_ipv6	VC_CMD(NETALT, 7, 0)
+#define VCMD_get_match_ipv6	VC_CMD(NETALT, 8, 0)
+
+struct	vcmd_match_ipv6_v0 {
+	uint16_t type;
+	uint16_t flags;
+	uint16_t parent;
+	uint16_t prefix;
+	struct in6_addr ip;
+	struct in6_addr ip2;
+	struct in6_addr mask;
+};
+
+
+#ifdef	__KERNEL__
+extern int vc_net_create(uint32_t, void __user *);
+extern int vc_net_migrate(struct nx_info *, void __user *);
+
+extern int vc_net_add(struct nx_info *, void __user *);
+extern int vc_net_remove(struct nx_info *, void __user *);
+
+extern int vc_net_add_ipv4(struct nx_info *, void __user *);
+extern int vc_net_remove_ipv4(struct nx_info *, void __user *);
+
+extern int vc_net_add_ipv6(struct nx_info *, void __user *);
+extern int vc_net_remove_ipv6(struct nx_info *, void __user *);
+
+extern int vc_add_match_ipv4(struct nx_info *, void __user *);
+extern int vc_get_match_ipv4(struct nx_info *, void __user *);
+
+extern int vc_add_match_ipv6(struct nx_info *, void __user *);
+extern int vc_get_match_ipv6(struct nx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+
+/* flag commands */
+
+#define VCMD_get_nflags		VC_CMD(FLAGS, 5, 0)
+#define VCMD_set_nflags		VC_CMD(FLAGS, 6, 0)
+
+struct	vcmd_net_flags_v0 {
+	uint64_t flagword;
+	uint64_t mask;
+};
+
+#ifdef	__KERNEL__
+extern int vc_get_nflags(struct nx_info *, void __user *);
+extern int vc_set_nflags(struct nx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+
+/* network caps commands */
+
+#define VCMD_get_ncaps		VC_CMD(FLAGS, 7, 0)
+#define VCMD_set_ncaps		VC_CMD(FLAGS, 8, 0)
+
+struct	vcmd_net_caps_v0 {
+	uint64_t ncaps;
+	uint64_t cmask;
+};
+
+#ifdef	__KERNEL__
+extern int vc_get_ncaps(struct nx_info *, void __user *);
+extern int vc_set_ncaps(struct nx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_CONTEXT_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/network.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/network.h
--- linux-2.6.32.43/include/linux/vserver/network.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/network.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,146 @@
+#ifndef _VX_NETWORK_H
+#define _VX_NETWORK_H
+
+#include <linux/types.h>
+
+
+#define MAX_N_CONTEXT	65535	/* Arbitrary limit */
+
+
+/* network flags */
+
+#define NXF_INFO_PRIVATE	0x00000008
+
+#define NXF_SINGLE_IP		0x00000100
+#define NXF_LBACK_REMAP		0x00000200
+#define NXF_LBACK_ALLOW		0x00000400
+
+#define NXF_HIDE_NETIF		0x02000000
+#define NXF_HIDE_LBACK		0x04000000
+
+#define NXF_STATE_SETUP		(1ULL << 32)
+#define NXF_STATE_ADMIN		(1ULL << 34)
+
+#define NXF_SC_HELPER		(1ULL << 36)
+#define NXF_PERSISTENT		(1ULL << 38)
+
+#define NXF_ONE_TIME		(0x0005ULL << 32)
+
+
+#define	NXF_INIT_SET		(__nxf_init_set())
+
+static inline uint64_t __nxf_init_set(void) {
+	return	  NXF_STATE_ADMIN
+#ifdef	CONFIG_VSERVER_AUTO_LBACK
+		| NXF_LBACK_REMAP
+		| NXF_HIDE_LBACK
+#endif
+#ifdef	CONFIG_VSERVER_AUTO_SINGLE
+		| NXF_SINGLE_IP
+#endif
+		| NXF_HIDE_NETIF;
+}
+
+
+/* network caps */
+
+#define NXC_TUN_CREATE		0x00000001
+
+#define NXC_RAW_ICMP		0x00000100
+
+
+/* address types */
+
+#define NXA_TYPE_IPV4		0x0001
+#define NXA_TYPE_IPV6		0x0002
+
+#define NXA_TYPE_NONE		0x0000
+#define NXA_TYPE_ANY		0x00FF
+
+#define NXA_TYPE_ADDR		0x0010
+#define NXA_TYPE_MASK		0x0020
+#define NXA_TYPE_RANGE		0x0040
+
+#define NXA_MASK_ALL		(NXA_TYPE_ADDR | NXA_TYPE_MASK | NXA_TYPE_RANGE)
+
+#define NXA_MOD_BCAST		0x0100
+#define NXA_MOD_LBACK		0x0200
+
+#define NXA_LOOPBACK		0x1000
+
+#define NXA_MASK_BIND		(NXA_MASK_ALL | NXA_MOD_BCAST | NXA_MOD_LBACK)
+#define NXA_MASK_SHOW		(NXA_MASK_ALL | NXA_LOOPBACK)
+
+#ifdef	__KERNEL__
+
+#include <linux/list.h>
+#include <linux/spinlock.h>
+#include <linux/rcupdate.h>
+#include <linux/in.h>
+#include <linux/in6.h>
+#include <asm/atomic.h>
+
+struct nx_addr_v4 {
+	struct nx_addr_v4 *next;
+	struct in_addr ip[2];
+	struct in_addr mask;
+	uint16_t type;
+	uint16_t flags;
+};
+
+struct nx_addr_v6 {
+	struct nx_addr_v6 *next;
+	struct in6_addr ip;
+	struct in6_addr mask;
+	uint32_t prefix;
+	uint16_t type;
+	uint16_t flags;
+};
+
+struct nx_info {
+	struct hlist_node nx_hlist;	/* linked list of nxinfos */
+	nid_t nx_id;			/* vnet id */
+	atomic_t nx_usecnt;		/* usage count */
+	atomic_t nx_tasks;		/* tasks count */
+	int nx_state;			/* context state */
+
+	uint64_t nx_flags;		/* network flag word */
+	uint64_t nx_ncaps;		/* network capabilities */
+
+	struct in_addr v4_lback;	/* Loopback address */
+	struct in_addr v4_bcast;	/* Broadcast address */
+	struct nx_addr_v4 v4;		/* First/Single ipv4 address */
+#ifdef	CONFIG_IPV6
+	struct nx_addr_v6 v6;		/* First/Single ipv6 address */
+#endif
+	char nx_name[65];		/* network context name */
+};
+
+
+/* status flags */
+
+#define NXS_HASHED      0x0001
+#define NXS_SHUTDOWN    0x0100
+#define NXS_RELEASED    0x8000
+
+extern struct nx_info *lookup_nx_info(int);
+
+extern int get_nid_list(int, unsigned int *, int);
+extern int nid_is_hashed(nid_t);
+
+extern int nx_migrate_task(struct task_struct *, struct nx_info *);
+
+extern long vs_net_change(struct nx_info *, unsigned int);
+
+struct sock;
+
+
+#define NX_IPV4(n)	((n)->v4.type != NXA_TYPE_NONE)
+#ifdef  CONFIG_IPV6
+#define NX_IPV6(n)	((n)->v6.type != NXA_TYPE_NONE)
+#else
+#define NX_IPV6(n)	(0)
+#endif
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_NETWORK_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/percpu.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/percpu.h
--- linux-2.6.32.43/include/linux/vserver/percpu.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/percpu.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,14 @@
+#ifndef _VX_PERCPU_H
+#define _VX_PERCPU_H
+
+#include "cvirt_def.h"
+#include "sched_def.h"
+
+struct	_vx_percpu {
+	struct _vx_cvirt_pc cvirt;
+	struct _vx_sched_pc sched;
+};
+
+#define	PERCPU_PERCTX	(sizeof(struct _vx_percpu))
+
+#endif	/* _VX_PERCPU_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/pid.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/pid.h
--- linux-2.6.32.43/include/linux/vserver/pid.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/pid.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,51 @@
+#ifndef _VSERVER_PID_H
+#define _VSERVER_PID_H
+
+/* pid faking stuff */
+
+#define vx_info_map_pid(v, p) \
+	__vx_info_map_pid((v), (p), __func__, __FILE__, __LINE__)
+#define vx_info_map_tgid(v,p)  vx_info_map_pid(v,p)
+#define vx_map_pid(p) vx_info_map_pid(current_vx_info(), p)
+#define vx_map_tgid(p) vx_map_pid(p)
+
+static inline int __vx_info_map_pid(struct vx_info *vxi, int pid,
+	const char *func, const char *file, int line)
+{
+	if (vx_info_flags(vxi, VXF_INFO_INIT, 0)) {
+		vxfprintk(VXD_CBIT(cvirt, 2),
+			"vx_map_tgid: %p/%llx: %d -> %d",
+			vxi, (long long)vxi->vx_flags, pid,
+			(pid && pid == vxi->vx_initpid) ? 1 : pid,
+			func, file, line);
+		if (pid == 0)
+			return 0;
+		if (pid == vxi->vx_initpid)
+			return 1;
+	}
+	return pid;
+}
+
+#define vx_info_rmap_pid(v, p) \
+	__vx_info_rmap_pid((v), (p), __func__, __FILE__, __LINE__)
+#define vx_rmap_pid(p) vx_info_rmap_pid(current_vx_info(), p)
+#define vx_rmap_tgid(p) vx_rmap_pid(p)
+
+static inline int __vx_info_rmap_pid(struct vx_info *vxi, int pid,
+	const char *func, const char *file, int line)
+{
+	if (vx_info_flags(vxi, VXF_INFO_INIT, 0)) {
+		vxfprintk(VXD_CBIT(cvirt, 2),
+			"vx_rmap_tgid: %p/%llx: %d -> %d",
+			vxi, (long long)vxi->vx_flags, pid,
+			(pid == 1) ? vxi->vx_initpid : pid,
+			func, file, line);
+		if ((pid == 1) && vxi->vx_initpid)
+			return vxi->vx_initpid;
+		if (pid == vxi->vx_initpid)
+			return ~0U;
+	}
+	return pid;
+}
+
+#endif
diff -uriN linux-2.6.32.43/include/linux/vserver/sched_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/sched_cmd.h
--- linux-2.6.32.43/include/linux/vserver/sched_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/sched_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,108 @@
+#ifndef _VX_SCHED_CMD_H
+#define _VX_SCHED_CMD_H
+
+
+/*  sched vserver commands */
+
+#define VCMD_set_sched_v2	VC_CMD(SCHED, 1, 2)
+#define VCMD_set_sched_v3	VC_CMD(SCHED, 1, 3)
+#define VCMD_set_sched_v4	VC_CMD(SCHED, 1, 4)
+
+struct	vcmd_set_sched_v2 {
+	int32_t fill_rate;
+	int32_t interval;
+	int32_t tokens;
+	int32_t tokens_min;
+	int32_t tokens_max;
+	uint64_t cpu_mask;
+};
+
+struct	vcmd_set_sched_v3 {
+	uint32_t set_mask;
+	int32_t fill_rate;
+	int32_t interval;
+	int32_t tokens;
+	int32_t tokens_min;
+	int32_t tokens_max;
+	int32_t priority_bias;
+};
+
+struct	vcmd_set_sched_v4 {
+	uint32_t set_mask;
+	int32_t fill_rate;
+	int32_t interval;
+	int32_t tokens;
+	int32_t tokens_min;
+	int32_t tokens_max;
+	int32_t prio_bias;
+	int32_t cpu_id;
+	int32_t bucket_id;
+};
+
+#define VCMD_set_sched		VC_CMD(SCHED, 1, 5)
+#define VCMD_get_sched		VC_CMD(SCHED, 2, 5)
+
+struct	vcmd_sched_v5 {
+	uint32_t mask;
+	int32_t cpu_id;
+	int32_t bucket_id;
+	int32_t fill_rate[2];
+	int32_t interval[2];
+	int32_t tokens;
+	int32_t tokens_min;
+	int32_t tokens_max;
+	int32_t prio_bias;
+};
+
+#define VXSM_FILL_RATE		0x0001
+#define VXSM_INTERVAL		0x0002
+#define VXSM_FILL_RATE2		0x0004
+#define VXSM_INTERVAL2		0x0008
+#define VXSM_TOKENS		0x0010
+#define VXSM_TOKENS_MIN		0x0020
+#define VXSM_TOKENS_MAX		0x0040
+#define VXSM_PRIO_BIAS		0x0100
+
+#define VXSM_IDLE_TIME		0x0200
+#define VXSM_FORCE		0x0400
+
+#define	VXSM_V3_MASK		0x0173
+#define	VXSM_SET_MASK		0x01FF
+
+#define VXSM_CPU_ID		0x1000
+#define VXSM_BUCKET_ID		0x2000
+
+#define VXSM_MSEC		0x4000
+
+#define SCHED_KEEP		(-2)	/* only for v2 */
+
+#ifdef	__KERNEL__
+
+#include <linux/compiler.h>
+
+extern int vc_set_sched_v2(struct vx_info *, void __user *);
+extern int vc_set_sched_v3(struct vx_info *, void __user *);
+extern int vc_set_sched_v4(struct vx_info *, void __user *);
+extern int vc_set_sched(struct vx_info *, void __user *);
+extern int vc_get_sched(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+#define VCMD_sched_info		VC_CMD(SCHED, 3, 0)
+
+struct	vcmd_sched_info {
+	int32_t cpu_id;
+	int32_t bucket_id;
+	uint64_t user_msec;
+	uint64_t sys_msec;
+	uint64_t hold_msec;
+	uint32_t token_usec;
+	int32_t vavavoom;
+};
+
+#ifdef	__KERNEL__
+
+extern int vc_sched_info(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_SCHED_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/sched_def.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/sched_def.h
--- linux-2.6.32.43/include/linux/vserver/sched_def.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/sched_def.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,68 @@
+#ifndef _VX_SCHED_DEF_H
+#define _VX_SCHED_DEF_H
+
+#include <linux/spinlock.h>
+#include <linux/jiffies.h>
+#include <linux/cpumask.h>
+#include <asm/atomic.h>
+#include <asm/param.h>
+
+
+/* context sub struct */
+
+struct _vx_sched {
+	spinlock_t tokens_lock;		/* lock for token bucket */
+
+	int tokens;			/* number of CPU tokens */
+	int fill_rate[2];		/* Fill rate: add X tokens... */
+	int interval[2];		/* Divisor:   per Y jiffies   */
+	int tokens_min;			/* Limit:     minimum for unhold */
+	int tokens_max;			/* Limit:     no more than N tokens */
+
+	int prio_bias;			/* bias offset for priority */
+
+	unsigned update_mask;		/* which features should be updated */
+	cpumask_t update;		/* CPUs which should update */
+};
+
+struct _vx_sched_pc {
+	int tokens;			/* number of CPU tokens */
+	int flags;			/* bucket flags */
+
+	int fill_rate[2];		/* Fill rate: add X tokens... */
+	int interval[2];		/* Divisor:   per Y jiffies   */
+	int tokens_min;			/* Limit:     minimum for unhold */
+	int tokens_max;			/* Limit:     no more than N tokens */
+
+	int prio_bias;			/* bias offset for priority */
+	int vavavoom;			/* last calculated vavavoom */
+
+	unsigned long norm_time;	/* last time accounted */
+	unsigned long idle_time;	/* non linear time for fair sched */
+	unsigned long token_time;	/* token time for accounting */
+	unsigned long onhold;		/* jiffies when put on hold */
+
+	uint64_t user_ticks;		/* token tick events */
+	uint64_t sys_ticks;		/* token tick events */
+	uint64_t hold_ticks;		/* token ticks paused */
+};
+
+
+#define VXSF_ONHOLD	0x0001
+#define VXSF_IDLE_TIME	0x0100
+
+#ifdef CONFIG_VSERVER_DEBUG
+
+static inline void __dump_vx_sched(struct _vx_sched *sched)
+{
+	printk("\t_vx_sched:\n");
+	printk("\t tokens: %4d/%4d, %4d/%4d, %4d, %4d\n",
+		sched->fill_rate[0], sched->interval[0],
+		sched->fill_rate[1], sched->interval[1],
+		sched->tokens_min, sched->tokens_max);
+	printk("\t priority = %4d\n", sched->prio_bias);
+}
+
+#endif
+
+#endif	/* _VX_SCHED_DEF_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/sched.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/sched.h
--- linux-2.6.32.43/include/linux/vserver/sched.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/sched.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,26 @@
+#ifndef _VX_SCHED_H
+#define _VX_SCHED_H
+
+
+#ifdef	__KERNEL__
+
+struct timespec;
+
+void vx_vsi_uptime(struct timespec *, struct timespec *);
+
+
+struct vx_info;
+
+void vx_update_load(struct vx_info *);
+
+
+int vx_tokens_recalc(struct _vx_sched_pc *,
+	unsigned long *, unsigned long *, int [2]);
+
+void vx_update_sched_param(struct _vx_sched *sched,
+	struct _vx_sched_pc *sched_pc);
+
+#endif	/* __KERNEL__ */
+#else	/* _VX_SCHED_H */
+#warning duplicate inclusion
+#endif	/* _VX_SCHED_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/signal_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/signal_cmd.h
--- linux-2.6.32.43/include/linux/vserver/signal_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/signal_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,43 @@
+#ifndef _VX_SIGNAL_CMD_H
+#define _VX_SIGNAL_CMD_H
+
+
+/*  signalling vserver commands */
+
+#define VCMD_ctx_kill		VC_CMD(PROCTRL, 1, 0)
+#define VCMD_wait_exit		VC_CMD(EVENT, 99, 0)
+
+struct	vcmd_ctx_kill_v0 {
+	int32_t pid;
+	int32_t sig;
+};
+
+struct	vcmd_wait_exit_v0 {
+	int32_t reboot_cmd;
+	int32_t exit_code;
+};
+
+#ifdef	__KERNEL__
+
+extern int vc_ctx_kill(struct vx_info *, void __user *);
+extern int vc_wait_exit(struct vx_info *, void __user *);
+
+#endif	/* __KERNEL__ */
+
+/*  process alteration commands */
+
+#define VCMD_get_pflags		VC_CMD(PROCALT, 5, 0)
+#define VCMD_set_pflags		VC_CMD(PROCALT, 6, 0)
+
+struct	vcmd_pflags_v0 {
+	uint32_t flagword;
+	uint32_t mask;
+};
+
+#ifdef	__KERNEL__
+
+extern int vc_get_pflags(uint32_t pid, void __user *);
+extern int vc_set_pflags(uint32_t pid, void __user *);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_SIGNAL_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/signal.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/signal.h
--- linux-2.6.32.43/include/linux/vserver/signal.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/signal.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,14 @@
+#ifndef _VX_SIGNAL_H
+#define _VX_SIGNAL_H
+
+
+#ifdef	__KERNEL__
+
+struct vx_info;
+
+int vx_info_kill(struct vx_info *, int, int);
+
+#endif	/* __KERNEL__ */
+#else	/* _VX_SIGNAL_H */
+#warning duplicate inclusion
+#endif	/* _VX_SIGNAL_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/space_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/space_cmd.h
--- linux-2.6.32.43/include/linux/vserver/space_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/space_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,38 @@
+#ifndef _VX_SPACE_CMD_H
+#define _VX_SPACE_CMD_H
+
+
+#define VCMD_enter_space_v0	VC_CMD(PROCALT, 1, 0)
+#define VCMD_enter_space_v1	VC_CMD(PROCALT, 1, 1)
+#define VCMD_enter_space	VC_CMD(PROCALT, 1, 2)
+
+#define VCMD_set_space_v0	VC_CMD(PROCALT, 3, 0)
+#define VCMD_set_space_v1	VC_CMD(PROCALT, 3, 1)
+#define VCMD_set_space		VC_CMD(PROCALT, 3, 2)
+
+#define VCMD_get_space_mask_v0	VC_CMD(PROCALT, 4, 0)
+
+#define VCMD_get_space_mask	VC_CMD(VSPACE, 0, 1)
+#define VCMD_get_space_default	VC_CMD(VSPACE, 1, 0)
+
+
+struct	vcmd_space_mask_v1 {
+	uint64_t mask;
+};
+
+struct	vcmd_space_mask_v2 {
+	uint64_t mask;
+	uint32_t index;
+};
+
+
+#ifdef	__KERNEL__
+
+extern int vc_enter_space_v1(struct vx_info *, void __user *);
+extern int vc_set_space_v1(struct vx_info *, void __user *);
+extern int vc_enter_space(struct vx_info *, void __user *);
+extern int vc_set_space(struct vx_info *, void __user *);
+extern int vc_get_space_mask(void __user *, int);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_SPACE_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/space.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/space.h
--- linux-2.6.32.43/include/linux/vserver/space.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/space.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,12 @@
+#ifndef _VX_SPACE_H
+#define _VX_SPACE_H
+
+#include <linux/types.h>
+
+struct vx_info;
+
+int vx_set_space(struct vx_info *vxi, unsigned long mask, unsigned index);
+
+#else	/* _VX_SPACE_H */
+#warning duplicate inclusion
+#endif	/* _VX_SPACE_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/switch.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/switch.h
--- linux-2.6.32.43/include/linux/vserver/switch.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/switch.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,98 @@
+#ifndef _VX_SWITCH_H
+#define _VX_SWITCH_H
+
+#include <linux/types.h>
+
+
+#define VC_CATEGORY(c)		(((c) >> 24) & 0x3F)
+#define VC_COMMAND(c)		(((c) >> 16) & 0xFF)
+#define VC_VERSION(c)		((c) & 0xFFF)
+
+#define VC_CMD(c, i, v)		((((VC_CAT_ ## c) & 0x3F) << 24) \
+				| (((i) & 0xFF) << 16) | ((v) & 0xFFF))
+
+/*
+
+  Syscall Matrix V2.8
+
+	 |VERSION|CREATE |MODIFY |MIGRATE|CONTROL|EXPERIM| |SPECIAL|SPECIAL|
+	 |STATS  |DESTROY|ALTER  |CHANGE |LIMIT  |TEST   | |       |       |
+	 |INFO   |SETUP  |       |MOVE   |       |       | |       |       |
+  -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
+  SYSTEM |VERSION|VSETUP |VHOST  |       |       |       | |DEVICE |       |
+  HOST   |     00|     01|     02|     03|     04|     05| |     06|     07|
+  -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
+  CPU    |       |VPROC  |PROCALT|PROCMIG|PROCTRL|       | |SCHED. |       |
+  PROCESS|     08|     09|     10|     11|     12|     13| |     14|     15|
+  -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
+  MEMORY |       |       |       |       |MEMCTRL|       | |SWAP   |       |
+	 |     16|     17|     18|     19|     20|     21| |     22|     23|
+  -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
+  NETWORK|       |VNET   |NETALT |NETMIG |NETCTL |       | |SERIAL |       |
+	 |     24|     25|     26|     27|     28|     29| |     30|     31|
+  -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
+  DISK   |       |       |       |TAGMIG |DLIMIT |       | |INODE  |       |
+  VFS    |     32|     33|     34|     35|     36|     37| |     38|     39|
+  -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
+  OTHER  |VSTAT  |       |       |       |       |       | |VINFO  |       |
+	 |     40|     41|     42|     43|     44|     45| |     46|     47|
+  =======+=======+=======+=======+=======+=======+=======+ +=======+=======+
+  SPECIAL|EVENT  |       |       |       |FLAGS  |       | |VSPACE |       |
+	 |     48|     49|     50|     51|     52|     53| |     54|     55|
+  -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
+  SPECIAL|DEBUG  |       |       |       |RLIMIT |SYSCALL| |       |COMPAT |
+	 |     56|     57|     58|     59|     60|TEST 61| |     62|     63|
+  -------+-------+-------+-------+-------+-------+-------+ +-------+-------+
+
+*/
+
+#define VC_CAT_VERSION		0
+
+#define VC_CAT_VSETUP		1
+#define VC_CAT_VHOST		2
+
+#define VC_CAT_DEVICE		6
+
+#define VC_CAT_VPROC		9
+#define VC_CAT_PROCALT		10
+#define VC_CAT_PROCMIG		11
+#define VC_CAT_PROCTRL		12
+
+#define VC_CAT_SCHED		14
+#define VC_CAT_MEMCTRL		20
+
+#define VC_CAT_VNET		25
+#define VC_CAT_NETALT		26
+#define VC_CAT_NETMIG		27
+#define VC_CAT_NETCTRL		28
+
+#define VC_CAT_TAGMIG		35
+#define VC_CAT_DLIMIT		36
+#define VC_CAT_INODE		38
+
+#define VC_CAT_VSTAT		40
+#define VC_CAT_VINFO		46
+#define VC_CAT_EVENT		48
+
+#define VC_CAT_FLAGS		52
+#define VC_CAT_VSPACE		54
+#define VC_CAT_DEBUG		56
+#define VC_CAT_RLIMIT		60
+
+#define VC_CAT_SYSTEST		61
+#define VC_CAT_COMPAT		63
+
+/*  query version */
+
+#define VCMD_get_version	VC_CMD(VERSION, 0, 0)
+#define VCMD_get_vci		VC_CMD(VERSION, 1, 0)
+
+
+#ifdef	__KERNEL__
+
+#include <linux/errno.h>
+
+#endif	/* __KERNEL__ */
+
+#endif	/* _VX_SWITCH_H */
+
diff -uriN linux-2.6.32.43/include/linux/vserver/tag_cmd.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/tag_cmd.h
--- linux-2.6.32.43/include/linux/vserver/tag_cmd.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/tag_cmd.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,22 @@
+#ifndef _VX_TAG_CMD_H
+#define _VX_TAG_CMD_H
+
+
+/* vinfo commands */
+
+#define VCMD_task_tag		VC_CMD(VINFO, 3, 0)
+
+#ifdef	__KERNEL__
+extern int vc_task_tag(uint32_t);
+
+#endif	/* __KERNEL__ */
+
+/* context commands */
+
+#define VCMD_tag_migrate	VC_CMD(TAGMIG, 1, 0)
+
+#ifdef	__KERNEL__
+extern int vc_tag_migrate(uint32_t);
+
+#endif	/* __KERNEL__ */
+#endif	/* _VX_TAG_CMD_H */
diff -uriN linux-2.6.32.43/include/linux/vserver/tag.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/tag.h
--- linux-2.6.32.43/include/linux/vserver/tag.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vserver/tag.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,143 @@
+#ifndef _DX_TAG_H
+#define _DX_TAG_H
+
+#include <linux/types.h>
+
+
+#define DX_TAG(in)	(IS_TAGGED(in))
+
+
+#ifdef CONFIG_TAG_NFSD
+#define DX_TAG_NFSD	1
+#else
+#define DX_TAG_NFSD	0
+#endif
+
+
+#ifdef CONFIG_TAGGING_NONE
+
+#define MAX_UID		0xFFFFFFFF
+#define MAX_GID		0xFFFFFFFF
+
+#define INOTAG_TAG(cond, uid, gid, tag)	(0)
+
+#define TAGINO_UID(cond, uid, tag)	(uid)
+#define TAGINO_GID(cond, gid, tag)	(gid)
+
+#endif
+
+
+#ifdef CONFIG_TAGGING_GID16
+
+#define MAX_UID		0xFFFFFFFF
+#define MAX_GID		0x0000FFFF
+
+#define INOTAG_TAG(cond, uid, gid, tag)	\
+	((cond) ? (((gid) >> 16) & 0xFFFF) : 0)
+
+#define TAGINO_UID(cond, uid, tag)	(uid)
+#define TAGINO_GID(cond, gid, tag)	\
+	((cond) ? (((gid) & 0xFFFF) | ((tag) << 16)) : (gid))
+
+#endif
+
+
+#ifdef CONFIG_TAGGING_ID24
+
+#define MAX_UID		0x00FFFFFF
+#define MAX_GID		0x00FFFFFF
+
+#define INOTAG_TAG(cond, uid, gid, tag)	\
+	((cond) ? ((((uid) >> 16) & 0xFF00) | (((gid) >> 24) & 0xFF)) : 0)
+
+#define TAGINO_UID(cond, uid, tag)	\
+	((cond) ? (((uid) & 0xFFFFFF) | (((tag) & 0xFF00) << 16)) : (uid))
+#define TAGINO_GID(cond, gid, tag)	\
+	((cond) ? (((gid) & 0xFFFFFF) | (((tag) & 0x00FF) << 24)) : (gid))
+
+#endif
+
+
+#ifdef CONFIG_TAGGING_UID16
+
+#define MAX_UID		0x0000FFFF
+#define MAX_GID		0xFFFFFFFF
+
+#define INOTAG_TAG(cond, uid, gid, tag)	\
+	((cond) ? (((uid) >> 16) & 0xFFFF) : 0)
+
+#define TAGINO_UID(cond, uid, tag)	\
+	((cond) ? (((uid) & 0xFFFF) | ((tag) << 16)) : (uid))
+#define TAGINO_GID(cond, gid, tag)	(gid)
+
+#endif
+
+
+#ifdef CONFIG_TAGGING_INTERN
+
+#define MAX_UID		0xFFFFFFFF
+#define MAX_GID		0xFFFFFFFF
+
+#define INOTAG_TAG(cond, uid, gid, tag)	\
+	((cond) ? (tag) : 0)
+
+#define TAGINO_UID(cond, uid, tag)	(uid)
+#define TAGINO_GID(cond, gid, tag)	(gid)
+
+#endif
+
+
+#ifndef CONFIG_TAGGING_NONE
+#define dx_current_fstag(sb)	\
+	((sb)->s_flags & MS_TAGGED ? dx_current_tag() : 0)
+#else
+#define dx_current_fstag(sb)	(0)
+#endif
+
+#ifndef CONFIG_TAGGING_INTERN
+#define TAGINO_TAG(cond, tag)	(0)
+#else
+#define TAGINO_TAG(cond, tag)	((cond) ? (tag) : 0)
+#endif
+
+#define INOTAG_UID(cond, uid, gid)	\
+	((cond) ? ((uid) & MAX_UID) : (uid))
+#define INOTAG_GID(cond, uid, gid)	\
+	((cond) ? ((gid) & MAX_GID) : (gid))
+
+
+static inline uid_t dx_map_uid(uid_t uid)
+{
+	if ((uid > MAX_UID) && (uid != -1))
+		uid = -2;
+	return (uid & MAX_UID);
+}
+
+static inline gid_t dx_map_gid(gid_t gid)
+{
+	if ((gid > MAX_GID) && (gid != -1))
+		gid = -2;
+	return (gid & MAX_GID);
+}
+
+struct peer_tag {
+	int32_t xid;
+	int32_t nid;
+};
+
+#define dx_notagcheck(sb) ((sb) && ((sb)->s_flags & MS_NOTAGCHECK))
+
+int dx_parse_tag(char *string, tag_t *tag, int remove, int *mnt_flags,
+		 unsigned long *flags);
+
+#ifdef	CONFIG_PROPAGATE
+
+void __dx_propagate_tag(struct nameidata *nd, struct inode *inode);
+
+#define dx_propagate_tag(n, i)	__dx_propagate_tag(n, i)
+
+#else
+#define dx_propagate_tag(n, i)	do { } while (0)
+#endif
+
+#endif /* _DX_TAG_H */
diff -uriN linux-2.6.32.43/include/linux/vs_inet6.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_inet6.h
--- linux-2.6.32.43/include/linux/vs_inet6.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_inet6.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,246 @@
+#ifndef _VS_INET6_H
+#define _VS_INET6_H
+
+#include "vserver/base.h"
+#include "vserver/network.h"
+#include "vserver/debug.h"
+
+#include <net/ipv6.h>
+
+#define NXAV6(a)	&(a)->ip, &(a)->mask, (a)->prefix, (a)->type
+#define NXAV6_FMT	"[%pI6/%pI6/%d:%04x]"
+
+
+#ifdef	CONFIG_IPV6
+
+static inline
+int v6_addr_match(struct nx_addr_v6 *nxa,
+	const struct in6_addr *addr, uint16_t mask)
+{
+	int ret = 0;
+
+	switch (nxa->type & mask) {
+	case NXA_TYPE_MASK:
+		ret = ipv6_masked_addr_cmp(&nxa->ip, &nxa->mask, addr);
+		break;
+	case NXA_TYPE_ADDR:
+		ret = ipv6_addr_equal(&nxa->ip, addr);
+		break;
+	case NXA_TYPE_ANY:
+		ret = 1;
+		break;
+	}
+	vxdprintk(VXD_CBIT(net, 0),
+		"v6_addr_match(%p" NXAV6_FMT ",%pI6,%04x) = %d",
+		nxa, NXAV6(nxa), addr, mask, ret);
+	return ret;
+}
+
+static inline
+int v6_addr_in_nx_info(struct nx_info *nxi,
+	const struct in6_addr *addr, uint16_t mask)
+{
+	struct nx_addr_v6 *nxa;
+	int ret = 1;
+
+	if (!nxi)
+		goto out;
+	for (nxa = &nxi->v6; nxa; nxa = nxa->next)
+		if (v6_addr_match(nxa, addr, mask))
+			goto out;
+	ret = 0;
+out:
+	vxdprintk(VXD_CBIT(net, 0),
+		"v6_addr_in_nx_info(%p[#%u],%pI6,%04x) = %d",
+		nxi, nxi ? nxi->nx_id : 0, addr, mask, ret);
+	return ret;
+}
+
+static inline
+int v6_nx_addr_match(struct nx_addr_v6 *nxa, struct nx_addr_v6 *addr, uint16_t mask)
+{
+	/* FIXME: needs full range checks */
+	return v6_addr_match(nxa, &addr->ip, mask);
+}
+
+static inline
+int v6_nx_addr_in_nx_info(struct nx_info *nxi, struct nx_addr_v6 *nxa, uint16_t mask)
+{
+	struct nx_addr_v6 *ptr;
+
+	for (ptr = &nxi->v6; ptr; ptr = ptr->next)
+		if (v6_nx_addr_match(ptr, nxa, mask))
+			return 1;
+	return 0;
+}
+
+
+/*
+ *	Check if a given address matches for a socket
+ *
+ *	nxi:		the socket's nx_info if any
+ *	addr:		to be verified address
+ */
+static inline
+int v6_sock_addr_match (
+	struct nx_info *nxi,
+	struct inet_sock *inet,
+	struct in6_addr *addr)
+{
+	struct sock *sk = &inet->sk;
+	struct in6_addr *saddr = inet6_rcv_saddr(sk);
+
+	if (!ipv6_addr_any(addr) &&
+		ipv6_addr_equal(saddr, addr))
+		return 1;
+	if (ipv6_addr_any(saddr))
+		return v6_addr_in_nx_info(nxi, addr, -1);
+	return 0;
+}
+
+/*
+ *	check if address is covered by socket
+ *
+ *	sk:	the socket to check against
+ *	addr:	the address in question (must be != 0)
+ */
+
+static inline
+int __v6_addr_match_socket(const struct sock *sk, struct nx_addr_v6 *nxa)
+{
+	struct nx_info *nxi = sk->sk_nx_info;
+	struct in6_addr *saddr = inet6_rcv_saddr(sk);
+
+	vxdprintk(VXD_CBIT(net, 5),
+		"__v6_addr_in_socket(%p," NXAV6_FMT ") %p:%pI6 %p;%lx",
+		sk, NXAV6(nxa), nxi, saddr, sk->sk_socket,
+		(sk->sk_socket?sk->sk_socket->flags:0));
+
+	if (!ipv6_addr_any(saddr)) {	/* direct address match */
+		return v6_addr_match(nxa, saddr, -1);
+	} else if (nxi) {		/* match against nx_info */
+		return v6_nx_addr_in_nx_info(nxi, nxa, -1);
+	} else {			/* unrestricted any socket */
+		return 1;
+	}
+}
+
+
+/* inet related checks and helpers */
+
+
+struct in_ifaddr;
+struct net_device;
+struct sock;
+
+
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <net/inet_timewait_sock.h>
+
+
+int dev_in_nx_info(struct net_device *, struct nx_info *);
+int v6_dev_in_nx_info(struct net_device *, struct nx_info *);
+int nx_v6_addr_conflict(struct nx_info *, struct nx_info *);
+
+
+
+static inline
+int v6_ifa_in_nx_info(struct inet6_ifaddr *ifa, struct nx_info *nxi)
+{
+	if (!nxi)
+		return 1;
+	if (!ifa)
+		return 0;
+	return v6_addr_in_nx_info(nxi, &ifa->addr, -1);
+}
+
+static inline
+int nx_v6_ifa_visible(struct nx_info *nxi, struct inet6_ifaddr *ifa)
+{
+	vxdprintk(VXD_CBIT(net, 1), "nx_v6_ifa_visible(%p[#%u],%p) %d",
+		nxi, nxi ? nxi->nx_id : 0, ifa,
+		nxi ? v6_ifa_in_nx_info(ifa, nxi) : 0);
+
+	if (!nx_info_flags(nxi, NXF_HIDE_NETIF, 0))
+		return 1;
+	if (v6_ifa_in_nx_info(ifa, nxi))
+		return 1;
+	return 0;
+}
+
+
+struct nx_v6_sock_addr {
+	struct in6_addr saddr;	/* Address used for validation */
+	struct in6_addr baddr;	/* Address used for socket bind */
+};
+
+static inline
+int v6_map_sock_addr(struct inet_sock *inet, struct sockaddr_in6 *addr,
+	struct nx_v6_sock_addr *nsa)
+{
+	// struct sock *sk = &inet->sk;
+	// struct nx_info *nxi = sk->sk_nx_info;
+	struct in6_addr saddr = addr->sin6_addr;
+	struct in6_addr baddr = saddr;
+
+	nsa->saddr = saddr;
+	nsa->baddr = baddr;
+	return 0;
+}
+
+static inline
+void v6_set_sock_addr(struct inet_sock *inet, struct nx_v6_sock_addr *nsa)
+{
+	// struct sock *sk = &inet->sk;
+	// struct in6_addr *saddr = inet6_rcv_saddr(sk);
+
+	// *saddr = nsa->baddr;
+	// inet->saddr = nsa->baddr;
+}
+
+static inline
+int nx_info_has_v6(struct nx_info *nxi)
+{
+	if (!nxi)
+		return 1;
+	if (NX_IPV6(nxi))
+		return 1;
+	return 0;
+}
+
+#else /* CONFIG_IPV6 */
+
+static inline
+int nx_v6_dev_visible(struct nx_info *n, struct net_device *d)
+{
+	return 1;
+}
+
+
+static inline
+int nx_v6_addr_conflict(struct nx_info *n, uint32_t a, const struct sock *s)
+{
+	return 1;
+}
+
+static inline
+int v6_ifa_in_nx_info(struct in_ifaddr *a, struct nx_info *n)
+{
+	return 1;
+}
+
+static inline
+int nx_info_has_v6(struct nx_info *nxi)
+{
+	return 0;
+}
+
+#endif /* CONFIG_IPV6 */
+
+#define current_nx_info_has_v6() \
+	nx_info_has_v6(current_nx_info())
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_inet.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_inet.h
--- linux-2.6.32.43/include/linux/vs_inet.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_inet.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,342 @@
+#ifndef _VS_INET_H
+#define _VS_INET_H
+
+#include "vserver/base.h"
+#include "vserver/network.h"
+#include "vserver/debug.h"
+
+#define IPI_LOOPBACK	htonl(INADDR_LOOPBACK)
+
+#define NXAV4(a)	NIPQUAD((a)->ip[0]), NIPQUAD((a)->ip[1]), \
+			NIPQUAD((a)->mask), (a)->type
+#define NXAV4_FMT	"[" NIPQUAD_FMT "-" NIPQUAD_FMT "/" NIPQUAD_FMT ":%04x]"
+
+
+static inline
+int v4_addr_match(struct nx_addr_v4 *nxa, __be32 addr, uint16_t tmask)
+{
+	__be32 ip = nxa->ip[0].s_addr;
+	__be32 mask = nxa->mask.s_addr;
+	__be32 bcast = ip | ~mask;
+	int ret = 0;
+
+	switch (nxa->type & tmask) {
+	case NXA_TYPE_MASK:
+		ret = (ip == (addr & mask));
+		break;
+	case NXA_TYPE_ADDR:
+		ret = 3;
+		if (addr == ip)
+			break;
+		/* fall through to broadcast */
+	case NXA_MOD_BCAST:
+		ret = ((tmask & NXA_MOD_BCAST) && (addr == bcast));
+		break;
+	case NXA_TYPE_RANGE:
+		ret = ((nxa->ip[0].s_addr <= addr) &&
+			(nxa->ip[1].s_addr > addr));
+		break;
+	case NXA_TYPE_ANY:
+		ret = 2;
+		break;
+	}
+
+	vxdprintk(VXD_CBIT(net, 0),
+		"v4_addr_match(%p" NXAV4_FMT "," NIPQUAD_FMT ",%04x) = %d",
+		nxa, NXAV4(nxa), NIPQUAD(addr), tmask, ret);
+	return ret;
+}
+
+static inline
+int v4_addr_in_nx_info(struct nx_info *nxi, __be32 addr, uint16_t tmask)
+{
+	struct nx_addr_v4 *nxa;
+	int ret = 1;
+
+	if (!nxi)
+		goto out;
+
+	ret = 2;
+	/* allow 127.0.0.1 when remapping lback */
+	if ((tmask & NXA_LOOPBACK) &&
+		(addr == IPI_LOOPBACK) &&
+		nx_info_flags(nxi, NXF_LBACK_REMAP, 0))
+		goto out;
+	ret = 3;
+	/* check for lback address */
+	if ((tmask & NXA_MOD_LBACK) &&
+		(nxi->v4_lback.s_addr == addr))
+		goto out;
+	ret = 4;
+	/* check for broadcast address */
+	if ((tmask & NXA_MOD_BCAST) &&
+		(nxi->v4_bcast.s_addr == addr))
+		goto out;
+	ret = 5;
+	/* check for v4 addresses */
+	for (nxa = &nxi->v4; nxa; nxa = nxa->next)
+		if (v4_addr_match(nxa, addr, tmask))
+			goto out;
+	ret = 0;
+out:
+	vxdprintk(VXD_CBIT(net, 0),
+		"v4_addr_in_nx_info(%p[#%u]," NIPQUAD_FMT ",%04x) = %d",
+		nxi, nxi ? nxi->nx_id : 0, NIPQUAD(addr), tmask, ret);
+	return ret;
+}
+
+static inline
+int v4_nx_addr_match(struct nx_addr_v4 *nxa, struct nx_addr_v4 *addr, uint16_t mask)
+{
+	/* FIXME: needs full range checks */
+	return v4_addr_match(nxa, addr->ip[0].s_addr, mask);
+}
+
+static inline
+int v4_nx_addr_in_nx_info(struct nx_info *nxi, struct nx_addr_v4 *nxa, uint16_t mask)
+{
+	struct nx_addr_v4 *ptr;
+
+	for (ptr = &nxi->v4; ptr; ptr = ptr->next)
+		if (v4_nx_addr_match(ptr, nxa, mask))
+			return 1;
+	return 0;
+}
+
+#include <net/inet_sock.h>
+
+/*
+ *	Check if a given address matches for a socket
+ *
+ *	nxi:		the socket's nx_info if any
+ *	addr:		to be verified address
+ */
+static inline
+int v4_sock_addr_match (
+	struct nx_info *nxi,
+	struct inet_sock *inet,
+	__be32 addr)
+{
+	__be32 saddr = inet->rcv_saddr;
+	__be32 bcast = nxi ? nxi->v4_bcast.s_addr : INADDR_BROADCAST;
+
+	if (addr && (saddr == addr || bcast == addr))
+		return 1;
+	if (!saddr)
+		return v4_addr_in_nx_info(nxi, addr, NXA_MASK_BIND);
+	return 0;
+}
+
+
+/* inet related checks and helpers */
+
+
+struct in_ifaddr;
+struct net_device;
+struct sock;
+
+#ifdef CONFIG_INET
+
+#include <linux/netdevice.h>
+#include <linux/inetdevice.h>
+#include <net/inet_sock.h>
+#include <net/inet_timewait_sock.h>
+
+
+int dev_in_nx_info(struct net_device *, struct nx_info *);
+int v4_dev_in_nx_info(struct net_device *, struct nx_info *);
+int nx_v4_addr_conflict(struct nx_info *, struct nx_info *);
+
+
+/*
+ *	check if address is covered by socket
+ *
+ *	sk:	the socket to check against
+ *	addr:	the address in question (must be != 0)
+ */
+
+static inline
+int __v4_addr_match_socket(const struct sock *sk, struct nx_addr_v4 *nxa)
+{
+	struct nx_info *nxi = sk->sk_nx_info;
+	__be32 saddr = inet_rcv_saddr(sk);
+
+	vxdprintk(VXD_CBIT(net, 5),
+		"__v4_addr_in_socket(%p," NXAV4_FMT ") %p:" NIPQUAD_FMT " %p;%lx",
+		sk, NXAV4(nxa), nxi, NIPQUAD(saddr), sk->sk_socket,
+		(sk->sk_socket?sk->sk_socket->flags:0));
+
+	if (saddr) {		/* direct address match */
+		return v4_addr_match(nxa, saddr, -1);
+	} else if (nxi) {	/* match against nx_info */
+		return v4_nx_addr_in_nx_info(nxi, nxa, -1);
+	} else {		/* unrestricted any socket */
+		return 1;
+	}
+}
+
+
+
+static inline
+int nx_dev_visible(struct nx_info *nxi, struct net_device *dev)
+{
+	vxdprintk(VXD_CBIT(net, 1), "nx_dev_visible(%p[#%u],%p »%s«) %d",
+		nxi, nxi ? nxi->nx_id : 0, dev, dev->name,
+		nxi ? dev_in_nx_info(dev, nxi) : 0);
+
+	if (!nx_info_flags(nxi, NXF_HIDE_NETIF, 0))
+		return 1;
+	if (dev_in_nx_info(dev, nxi))
+		return 1;
+	return 0;
+}
+
+
+static inline
+int v4_ifa_in_nx_info(struct in_ifaddr *ifa, struct nx_info *nxi)
+{
+	if (!nxi)
+		return 1;
+	if (!ifa)
+		return 0;
+	return v4_addr_in_nx_info(nxi, ifa->ifa_local, NXA_MASK_SHOW);
+}
+
+static inline
+int nx_v4_ifa_visible(struct nx_info *nxi, struct in_ifaddr *ifa)
+{
+	vxdprintk(VXD_CBIT(net, 1), "nx_v4_ifa_visible(%p[#%u],%p) %d",
+		nxi, nxi ? nxi->nx_id : 0, ifa,
+		nxi ? v4_ifa_in_nx_info(ifa, nxi) : 0);
+
+	if (!nx_info_flags(nxi, NXF_HIDE_NETIF, 0))
+		return 1;
+	if (v4_ifa_in_nx_info(ifa, nxi))
+		return 1;
+	return 0;
+}
+
+
+struct nx_v4_sock_addr {
+	__be32 saddr;	/* Address used for validation */
+	__be32 baddr;	/* Address used for socket bind */
+};
+
+static inline
+int v4_map_sock_addr(struct inet_sock *inet, struct sockaddr_in *addr,
+	struct nx_v4_sock_addr *nsa)
+{
+	struct sock *sk = &inet->sk;
+	struct nx_info *nxi = sk->sk_nx_info;
+	__be32 saddr = addr->sin_addr.s_addr;
+	__be32 baddr = saddr;
+
+	vxdprintk(VXD_CBIT(net, 3),
+		"inet_bind(%p)* %p,%p;%lx " NIPQUAD_FMT,
+		sk, sk->sk_nx_info, sk->sk_socket,
+		(sk->sk_socket ? sk->sk_socket->flags : 0),
+		NIPQUAD(saddr));
+
+	if (nxi) {
+		if (saddr == INADDR_ANY) {
+			if (nx_info_flags(nxi, NXF_SINGLE_IP, 0))
+				baddr = nxi->v4.ip[0].s_addr;
+		} else if (saddr == IPI_LOOPBACK) {
+			if (nx_info_flags(nxi, NXF_LBACK_REMAP, 0))
+				baddr = nxi->v4_lback.s_addr;
+		} else {	/* normal address bind */
+			if (!v4_addr_in_nx_info(nxi, saddr, NXA_MASK_BIND))
+				return -EADDRNOTAVAIL;
+		}
+	}
+
+	vxdprintk(VXD_CBIT(net, 3),
+		"inet_bind(%p) " NIPQUAD_FMT ", " NIPQUAD_FMT,
+		sk, NIPQUAD(saddr), NIPQUAD(baddr));
+
+	nsa->saddr = saddr;
+	nsa->baddr = baddr;
+	return 0;
+}
+
+static inline
+void v4_set_sock_addr(struct inet_sock *inet, struct nx_v4_sock_addr *nsa)
+{
+	inet->saddr = nsa->baddr;
+	inet->rcv_saddr = nsa->baddr;
+}
+
+
+/*
+ *      helper to simplify inet_lookup_listener
+ *
+ *      nxi:	the socket's nx_info if any
+ *      addr:	to be verified address
+ *      saddr:	socket address
+ */
+static inline int v4_inet_addr_match (
+	struct nx_info *nxi,
+	__be32 addr,
+	__be32 saddr)
+{
+	if (addr && (saddr == addr))
+		return 1;
+	if (!saddr)
+		return nxi ? v4_addr_in_nx_info(nxi, addr, NXA_MASK_BIND) : 1;
+	return 0;
+}
+
+static inline __be32 nx_map_sock_lback(struct nx_info *nxi, __be32 addr)
+{
+	if (nx_info_flags(nxi, NXF_HIDE_LBACK, 0) &&
+		(addr == nxi->v4_lback.s_addr))
+		return IPI_LOOPBACK;
+	return addr;
+}
+
+static inline
+int nx_info_has_v4(struct nx_info *nxi)
+{
+	if (!nxi)
+		return 1;
+	if (NX_IPV4(nxi))
+		return 1;
+	if (nx_info_flags(nxi, NXF_LBACK_REMAP, 0))
+		return 1;
+	return 0;
+}
+
+#else /* CONFIG_INET */
+
+static inline
+int nx_dev_visible(struct nx_info *n, struct net_device *d)
+{
+	return 1;
+}
+
+static inline
+int nx_v4_addr_conflict(struct nx_info *n, uint32_t a, const struct sock *s)
+{
+	return 1;
+}
+
+static inline
+int v4_ifa_in_nx_info(struct in_ifaddr *a, struct nx_info *n)
+{
+	return 1;
+}
+
+static inline
+int nx_info_has_v4(struct nx_info *nxi)
+{
+	return 0;
+}
+
+#endif /* CONFIG_INET */
+
+#define current_nx_info_has_v4() \
+	nx_info_has_v4(current_nx_info())
+
+#else
+// #warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_limit.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_limit.h
--- linux-2.6.32.43/include/linux/vs_limit.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_limit.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,140 @@
+#ifndef _VS_LIMIT_H
+#define _VS_LIMIT_H
+
+#include "vserver/limit.h"
+#include "vserver/base.h"
+#include "vserver/context.h"
+#include "vserver/debug.h"
+#include "vserver/context.h"
+#include "vserver/limit_int.h"
+
+
+#define vx_acc_cres(v, d, p, r) \
+	__vx_acc_cres(v, r, d, p, __FILE__, __LINE__)
+
+#define vx_acc_cres_cond(x, d, p, r) \
+	__vx_acc_cres(((x) == vx_current_xid()) ? current_vx_info() : 0, \
+	r, d, p, __FILE__, __LINE__)
+
+
+#define vx_add_cres(v, a, p, r) \
+	__vx_add_cres(v, r, a, p, __FILE__, __LINE__)
+#define vx_sub_cres(v, a, p, r)		vx_add_cres(v, -(a), p, r)
+
+#define vx_add_cres_cond(x, a, p, r) \
+	__vx_add_cres(((x) == vx_current_xid()) ? current_vx_info() : 0, \
+	r, a, p, __FILE__, __LINE__)
+#define vx_sub_cres_cond(x, a, p, r)	vx_add_cres_cond(x, -(a), p, r)
+
+
+/* process and file limits */
+
+#define vx_nproc_inc(p) \
+	vx_acc_cres((p)->vx_info, 1, p, RLIMIT_NPROC)
+
+#define vx_nproc_dec(p) \
+	vx_acc_cres((p)->vx_info,-1, p, RLIMIT_NPROC)
+
+#define vx_files_inc(f) \
+	vx_acc_cres_cond((f)->f_xid, 1, f, RLIMIT_NOFILE)
+
+#define vx_files_dec(f) \
+	vx_acc_cres_cond((f)->f_xid,-1, f, RLIMIT_NOFILE)
+
+#define vx_locks_inc(l) \
+	vx_acc_cres_cond((l)->fl_xid, 1, l, RLIMIT_LOCKS)
+
+#define vx_locks_dec(l) \
+	vx_acc_cres_cond((l)->fl_xid,-1, l, RLIMIT_LOCKS)
+
+#define vx_openfd_inc(f) \
+	vx_acc_cres(current_vx_info(), 1, (void *)(long)(f), VLIMIT_OPENFD)
+
+#define vx_openfd_dec(f) \
+	vx_acc_cres(current_vx_info(),-1, (void *)(long)(f), VLIMIT_OPENFD)
+
+
+#define vx_cres_avail(v, n, r) \
+	__vx_cres_avail(v, r, n, __FILE__, __LINE__)
+
+
+#define vx_nproc_avail(n) \
+	vx_cres_avail(current_vx_info(), n, RLIMIT_NPROC)
+
+#define vx_files_avail(n) \
+	vx_cres_avail(current_vx_info(), n, RLIMIT_NOFILE)
+
+#define vx_locks_avail(n) \
+	vx_cres_avail(current_vx_info(), n, RLIMIT_LOCKS)
+
+#define vx_openfd_avail(n) \
+	vx_cres_avail(current_vx_info(), n, VLIMIT_OPENFD)
+
+
+/* dentry limits */
+
+#define vx_dentry_inc(d) do {						\
+	if (atomic_read(&d->d_count) == 1)				\
+		vx_acc_cres(current_vx_info(), 1, d, VLIMIT_DENTRY);	\
+	} while (0)
+
+#define vx_dentry_dec(d) do {						\
+	if (atomic_read(&d->d_count) == 0)				\
+		vx_acc_cres(current_vx_info(),-1, d, VLIMIT_DENTRY);	\
+	} while (0)
+
+#define vx_dentry_avail(n) \
+	vx_cres_avail(current_vx_info(), n, VLIMIT_DENTRY)
+
+
+/* socket limits */
+
+#define vx_sock_inc(s) \
+	vx_acc_cres((s)->sk_vx_info, 1, s, VLIMIT_NSOCK)
+
+#define vx_sock_dec(s) \
+	vx_acc_cres((s)->sk_vx_info,-1, s, VLIMIT_NSOCK)
+
+#define vx_sock_avail(n) \
+	vx_cres_avail(current_vx_info(), n, VLIMIT_NSOCK)
+
+
+/* ipc resource limits */
+
+#define vx_ipcmsg_add(v, u, a) \
+	vx_add_cres(v, a, u, RLIMIT_MSGQUEUE)
+
+#define vx_ipcmsg_sub(v, u, a) \
+	vx_sub_cres(v, a, u, RLIMIT_MSGQUEUE)
+
+#define vx_ipcmsg_avail(v, a) \
+	vx_cres_avail(v, a, RLIMIT_MSGQUEUE)
+
+
+#define vx_ipcshm_add(v, k, a) \
+	vx_add_cres(v, a, (void *)(long)(k), VLIMIT_SHMEM)
+
+#define vx_ipcshm_sub(v, k, a) \
+	vx_sub_cres(v, a, (void *)(long)(k), VLIMIT_SHMEM)
+
+#define vx_ipcshm_avail(v, a) \
+	vx_cres_avail(v, a, VLIMIT_SHMEM)
+
+
+#define vx_semary_inc(a) \
+	vx_acc_cres(current_vx_info(), 1, a, VLIMIT_SEMARY)
+
+#define vx_semary_dec(a) \
+	vx_acc_cres(current_vx_info(), -1, a, VLIMIT_SEMARY)
+
+
+#define vx_nsems_add(a,n) \
+	vx_add_cres(current_vx_info(), n, a, VLIMIT_NSEMS)
+
+#define vx_nsems_sub(a,n) \
+	vx_sub_cres(current_vx_info(), n, a, VLIMIT_NSEMS)
+
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_memory.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_memory.h
--- linux-2.6.32.43/include/linux/vs_memory.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_memory.h	2011-07-15 06:54:21.000000000 -0500
@@ -0,0 +1,159 @@
+#ifndef _VS_MEMORY_H
+#define _VS_MEMORY_H
+
+#include "vserver/limit.h"
+#include "vserver/base.h"
+#include "vserver/context.h"
+#include "vserver/debug.h"
+#include "vserver/context.h"
+#include "vserver/limit_int.h"
+
+
+#define __acc_add_long(a, v)	(*(v) += (a))
+#define __acc_inc_long(v)	(++*(v))
+#define __acc_dec_long(v)	(--*(v))
+
+#if	NR_CPUS >= CONFIG_SPLIT_PTLOCK_CPUS
+#define __acc_add_atomic(a, v)	atomic_long_add(a, v)
+#define __acc_inc_atomic(v)	atomic_long_inc(v)
+#define __acc_dec_atomic(v)	atomic_long_dec(v)
+#else  /* NR_CPUS < CONFIG_SPLIT_PTLOCK_CPUS */
+#define __acc_add_atomic(a, v)	__acc_add_long(a, v)
+#define __acc_inc_atomic(v)	__acc_inc_long(v)
+#define __acc_dec_atomic(v)	__acc_dec_long(v)
+#endif /* NR_CPUS < CONFIG_SPLIT_PTLOCK_CPUS */
+
+
+#define vx_acc_page(m, d, v, r) do {					\
+	if ((d) > 0)							\
+		__acc_inc_long(&(m)->v);				\
+	else								\
+		__acc_dec_long(&(m)->v);				\
+	__vx_acc_cres(m->mm_vx_info, r, d, m, __FILE__, __LINE__);	\
+} while (0)
+
+#define vx_acc_page_atomic(m, d, v, r) do {				\
+	if ((d) > 0)							\
+		__acc_inc_atomic(&(m)->v);				\
+	else								\
+		__acc_dec_atomic(&(m)->v);				\
+	__vx_acc_cres(m->mm_vx_info, r, d, m, __FILE__, __LINE__);	\
+} while (0)
+
+
+#define vx_acc_pages(m, p, v, r) do {					\
+	unsigned long __p = (p);					\
+	__acc_add_long(__p, &(m)->v);					\
+	__vx_add_cres(m->mm_vx_info, r, __p, m, __FILE__, __LINE__);	\
+} while (0)
+
+#define vx_acc_pages_atomic(m, p, v, r) do {				\
+	unsigned long __p = (p);					\
+	__acc_add_atomic(__p, &(m)->v);					\
+	__vx_add_cres(m->mm_vx_info, r, __p, m, __FILE__, __LINE__);	\
+} while (0)
+
+
+
+#define vx_acc_vmpage(m, d) \
+	vx_acc_page(m, d, total_vm,  RLIMIT_AS)
+#define vx_acc_vmlpage(m, d) \
+	vx_acc_page(m, d, locked_vm, RLIMIT_MEMLOCK)
+#define vx_acc_file_rsspage(m, d) \
+	vx_acc_page_atomic(m, d, _file_rss, VLIMIT_MAPPED)
+#define vx_acc_anon_rsspage(m, d) \
+	vx_acc_page_atomic(m, d, _anon_rss, VLIMIT_ANON)
+
+#define vx_acc_vmpages(m, p) \
+	vx_acc_pages(m, p, total_vm,  RLIMIT_AS)
+#define vx_acc_vmlpages(m, p) \
+	vx_acc_pages(m, p, locked_vm, RLIMIT_MEMLOCK)
+#define vx_acc_file_rsspages(m, p) \
+	vx_acc_pages_atomic(m, p, _file_rss, VLIMIT_MAPPED)
+#define vx_acc_anon_rsspages(m, p) \
+	vx_acc_pages_atomic(m, p, _anon_rss, VLIMIT_ANON)
+
+#define vx_pages_add(s, r, p)	__vx_add_cres(s, r, p, 0, __FILE__, __LINE__)
+#define vx_pages_sub(s, r, p)	vx_pages_add(s, r, -(p))
+
+#define vx_vmpages_inc(m)		vx_acc_vmpage(m, 1)
+#define vx_vmpages_dec(m)		vx_acc_vmpage(m, -1)
+#define vx_vmpages_add(m, p)		vx_acc_vmpages(m, p)
+#define vx_vmpages_sub(m, p)		vx_acc_vmpages(m, -(p))
+
+#define vx_vmlocked_inc(m)		vx_acc_vmlpage(m, 1)
+#define vx_vmlocked_dec(m)		vx_acc_vmlpage(m, -1)
+#define vx_vmlocked_add(m, p)		vx_acc_vmlpages(m, p)
+#define vx_vmlocked_sub(m, p)		vx_acc_vmlpages(m, -(p))
+
+#define vx_file_rsspages_inc(m)		vx_acc_file_rsspage(m, 1)
+#define vx_file_rsspages_dec(m)		vx_acc_file_rsspage(m, -1)
+#define vx_file_rsspages_add(m, p)	vx_acc_file_rsspages(m, p)
+#define vx_file_rsspages_sub(m, p)	vx_acc_file_rsspages(m, -(p))
+
+#define vx_anon_rsspages_inc(m)		vx_acc_anon_rsspage(m, 1)
+#define vx_anon_rsspages_dec(m)		vx_acc_anon_rsspage(m, -1)
+#define vx_anon_rsspages_add(m, p)	vx_acc_anon_rsspages(m, p)
+#define vx_anon_rsspages_sub(m, p)	vx_acc_anon_rsspages(m, -(p))
+
+
+#define vx_pages_avail(m, p, r) \
+	__vx_cres_avail((m)->mm_vx_info, r, p, __FILE__, __LINE__)
+
+#define vx_vmpages_avail(m, p)	vx_pages_avail(m, p, RLIMIT_AS)
+#define vx_vmlocked_avail(m, p)	vx_pages_avail(m, p, RLIMIT_MEMLOCK)
+#define vx_anon_avail(m, p)	vx_pages_avail(m, p, VLIMIT_ANON)
+#define vx_mapped_avail(m, p)	vx_pages_avail(m, p, VLIMIT_MAPPED)
+
+#define vx_rss_avail(m, p) \
+	__vx_cres_array_avail((m)->mm_vx_info, VLA_RSS, p, __FILE__, __LINE__)
+
+
+enum {
+	VXPT_UNKNOWN = 0,
+	VXPT_ANON,
+	VXPT_NONE,
+	VXPT_FILE,
+	VXPT_SWAP,
+	VXPT_WRITE
+};
+
+#if 0
+#define	vx_page_fault(mm, vma, type, ret)
+#else
+
+static inline
+void __vx_page_fault(struct mm_struct *mm,
+	struct vm_area_struct *vma, int type, int ret)
+{
+	struct vx_info *vxi = mm->mm_vx_info;
+	int what;
+/*
+	static char *page_type[6] =
+		{ "UNKNOWN", "ANON", "NONE", "FILE", "SWAP", "WRITE" };
+	static char *page_what[4] =
+		{ "FAULT_OOM", "FAULT_SIGBUS", "FAULT_MINOR", "FAULT_MAJOR" };
+*/
+
+	if (!vxi)
+		return;
+
+	what = (ret & 0x3);
+
+/*	printk("[%d] page[%d][%d] %2x %s %s\n", vxi->vx_id,
+		type, what, ret, page_type[type], page_what[what]);
+*/
+	if (ret & VM_FAULT_WRITE)
+		what |= 0x4;
+	atomic_inc_unchecked(&vxi->cacct.page[type][what]);
+}
+
+#define	vx_page_fault(mm, vma, type, ret)	__vx_page_fault(mm, vma, type, ret)
+#endif
+
+
+extern unsigned long vx_badness(struct task_struct *task, struct mm_struct *mm);
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_network.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_network.h
--- linux-2.6.32.43/include/linux/vs_network.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_network.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,169 @@
+#ifndef _NX_VS_NETWORK_H
+#define _NX_VS_NETWORK_H
+
+#include "vserver/context.h"
+#include "vserver/network.h"
+#include "vserver/base.h"
+#include "vserver/check.h"
+#include "vserver/debug.h"
+
+#include <linux/sched.h>
+
+
+#define get_nx_info(i) __get_nx_info(i, __FILE__, __LINE__)
+
+static inline struct nx_info *__get_nx_info(struct nx_info *nxi,
+	const char *_file, int _line)
+{
+	if (!nxi)
+		return NULL;
+
+	vxlprintk(VXD_CBIT(nid, 2), "get_nx_info(%p[#%d.%d])",
+		nxi, nxi ? nxi->nx_id : 0,
+		nxi ? atomic_read(&nxi->nx_usecnt) : 0,
+		_file, _line);
+
+	atomic_inc(&nxi->nx_usecnt);
+	return nxi;
+}
+
+
+extern void free_nx_info(struct nx_info *);
+
+#define put_nx_info(i) __put_nx_info(i, __FILE__, __LINE__)
+
+static inline void __put_nx_info(struct nx_info *nxi, const char *_file, int _line)
+{
+	if (!nxi)
+		return;
+
+	vxlprintk(VXD_CBIT(nid, 2), "put_nx_info(%p[#%d.%d])",
+		nxi, nxi ? nxi->nx_id : 0,
+		nxi ? atomic_read(&nxi->nx_usecnt) : 0,
+		_file, _line);
+
+	if (atomic_dec_and_test(&nxi->nx_usecnt))
+		free_nx_info(nxi);
+}
+
+
+#define init_nx_info(p, i) __init_nx_info(p, i, __FILE__, __LINE__)
+
+static inline void __init_nx_info(struct nx_info **nxp, struct nx_info *nxi,
+		const char *_file, int _line)
+{
+	if (nxi) {
+		vxlprintk(VXD_CBIT(nid, 3),
+			"init_nx_info(%p[#%d.%d])",
+			nxi, nxi ? nxi->nx_id : 0,
+			nxi ? atomic_read(&nxi->nx_usecnt) : 0,
+			_file, _line);
+
+		atomic_inc(&nxi->nx_usecnt);
+	}
+	*nxp = nxi;
+}
+
+
+#define set_nx_info(p, i) __set_nx_info(p, i, __FILE__, __LINE__)
+
+static inline void __set_nx_info(struct nx_info **nxp, struct nx_info *nxi,
+	const char *_file, int _line)
+{
+	struct nx_info *nxo;
+
+	if (!nxi)
+		return;
+
+	vxlprintk(VXD_CBIT(nid, 3), "set_nx_info(%p[#%d.%d])",
+		nxi, nxi ? nxi->nx_id : 0,
+		nxi ? atomic_read(&nxi->nx_usecnt) : 0,
+		_file, _line);
+
+	atomic_inc(&nxi->nx_usecnt);
+	nxo = xchg(nxp, nxi);
+	BUG_ON(nxo);
+}
+
+#define clr_nx_info(p) __clr_nx_info(p, __FILE__, __LINE__)
+
+static inline void __clr_nx_info(struct nx_info **nxp,
+	const char *_file, int _line)
+{
+	struct nx_info *nxo;
+
+	nxo = xchg(nxp, NULL);
+	if (!nxo)
+		return;
+
+	vxlprintk(VXD_CBIT(nid, 3), "clr_nx_info(%p[#%d.%d])",
+		nxo, nxo ? nxo->nx_id : 0,
+		nxo ? atomic_read(&nxo->nx_usecnt) : 0,
+		_file, _line);
+
+	if (atomic_dec_and_test(&nxo->nx_usecnt))
+		free_nx_info(nxo);
+}
+
+
+#define claim_nx_info(v, p) __claim_nx_info(v, p, __FILE__, __LINE__)
+
+static inline void __claim_nx_info(struct nx_info *nxi,
+	struct task_struct *task, const char *_file, int _line)
+{
+	vxlprintk(VXD_CBIT(nid, 3), "claim_nx_info(%p[#%d.%d.%d]) %p",
+		nxi, nxi ? nxi->nx_id : 0,
+		nxi?atomic_read(&nxi->nx_usecnt):0,
+		nxi?atomic_read(&nxi->nx_tasks):0,
+		task, _file, _line);
+
+	atomic_inc(&nxi->nx_tasks);
+}
+
+
+extern void unhash_nx_info(struct nx_info *);
+
+#define release_nx_info(v, p) __release_nx_info(v, p, __FILE__, __LINE__)
+
+static inline void __release_nx_info(struct nx_info *nxi,
+	struct task_struct *task, const char *_file, int _line)
+{
+	vxlprintk(VXD_CBIT(nid, 3), "release_nx_info(%p[#%d.%d.%d]) %p",
+		nxi, nxi ? nxi->nx_id : 0,
+		nxi ? atomic_read(&nxi->nx_usecnt) : 0,
+		nxi ? atomic_read(&nxi->nx_tasks) : 0,
+		task, _file, _line);
+
+	might_sleep();
+
+	if (atomic_dec_and_test(&nxi->nx_tasks))
+		unhash_nx_info(nxi);
+}
+
+
+#define task_get_nx_info(i)	__task_get_nx_info(i, __FILE__, __LINE__)
+
+static __inline__ struct nx_info *__task_get_nx_info(struct task_struct *p,
+	const char *_file, int _line)
+{
+	struct nx_info *nxi;
+
+	task_lock(p);
+	vxlprintk(VXD_CBIT(nid, 5), "task_get_nx_info(%p)",
+		p, _file, _line);
+	nxi = __get_nx_info(p->nx_info, _file, _line);
+	task_unlock(p);
+	return nxi;
+}
+
+
+static inline void exit_nx_info(struct task_struct *p)
+{
+	if (p->nx_info)
+		release_nx_info(p->nx_info, p);
+}
+
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_pid.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_pid.h
--- linux-2.6.32.43/include/linux/vs_pid.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_pid.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,50 @@
+#ifndef _VS_PID_H
+#define _VS_PID_H
+
+#include "vserver/base.h"
+#include "vserver/check.h"
+#include "vserver/context.h"
+#include "vserver/debug.h"
+#include "vserver/pid.h"
+#include <linux/pid_namespace.h>
+
+
+#define VXF_FAKE_INIT	(VXF_INFO_INIT | VXF_STATE_INIT)
+
+static inline
+int vx_proc_task_visible(struct task_struct *task)
+{
+	if ((task->pid == 1) &&
+		!vx_flags(VXF_FAKE_INIT, VXF_FAKE_INIT))
+		/* show a blend through init */
+		goto visible;
+	if (vx_check(vx_task_xid(task), VS_WATCH | VS_IDENT))
+		goto visible;
+	return 0;
+visible:
+	return 1;
+}
+
+#define find_task_by_real_pid(pid) find_task_by_pid_ns(pid, &init_pid_ns)
+
+
+static inline
+struct task_struct *vx_get_proc_task(struct inode *inode, struct pid *pid)
+{
+	struct task_struct *task = get_pid_task(pid, PIDTYPE_PID);
+
+	if (task && !vx_proc_task_visible(task)) {
+		vxdprintk(VXD_CBIT(misc, 6),
+			"dropping task (get) %p[#%u,%u] for %p[#%u,%u]",
+			task, task->xid, task->pid,
+			current, current->xid, current->pid);
+		put_task_struct(task);
+		task = NULL;
+	}
+	return task;
+}
+
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_sched.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_sched.h
--- linux-2.6.32.43/include/linux/vs_sched.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_sched.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,110 @@
+#ifndef _VS_SCHED_H
+#define _VS_SCHED_H
+
+#include "vserver/base.h"
+#include "vserver/context.h"
+#include "vserver/sched.h"
+
+
+#define VAVAVOOM_RATIO		 50
+
+#define MAX_PRIO_BIAS		 20
+#define MIN_PRIO_BIAS		-20
+
+
+#ifdef CONFIG_VSERVER_HARDCPU
+
+/*
+ * effective_prio - return the priority that is based on the static
+ * priority but is modified by bonuses/penalties.
+ *
+ * We scale the actual sleep average [0 .... MAX_SLEEP_AVG]
+ * into a -4 ... 0 ... +4 bonus/penalty range.
+ *
+ * Additionally, we scale another amount based on the number of
+ * CPU tokens currently held by the context, if the process is
+ * part of a context (and the appropriate SCHED flag is set).
+ * This ranges from -5 ... 0 ... +15, quadratically.
+ *
+ * So, the total bonus is -9 .. 0 .. +19
+ * We use ~50% of the full 0...39 priority range so that:
+ *
+ * 1) nice +19 interactive tasks do not preempt nice 0 CPU hogs.
+ * 2) nice -20 CPU hogs do not get preempted by nice 0 tasks.
+ *    unless that context is far exceeding its CPU allocation.
+ *
+ * Both properties are important to certain workloads.
+ */
+static inline
+int vx_effective_vavavoom(struct _vx_sched_pc *sched_pc, int max_prio)
+{
+	int vavavoom, max;
+
+	/* lots of tokens = lots of vavavoom
+	 *      no tokens = no vavavoom      */
+	if ((vavavoom = sched_pc->tokens) >= 0) {
+		max = sched_pc->tokens_max;
+		vavavoom = max - vavavoom;
+		max = max * max;
+		vavavoom = max_prio * VAVAVOOM_RATIO / 100
+			* (vavavoom*vavavoom - (max >> 2)) / max;
+		return vavavoom;
+	}
+	return 0;
+}
+
+
+static inline
+int vx_adjust_prio(struct task_struct *p, int prio, int max_user)
+{
+	struct vx_info *vxi = p->vx_info;
+	struct _vx_sched_pc *sched_pc;
+
+	if (!vxi)
+		return prio;
+
+	sched_pc = &vx_cpu(vxi, sched_pc);
+	if (vx_info_flags(vxi, VXF_SCHED_PRIO, 0)) {
+		int vavavoom = vx_effective_vavavoom(sched_pc, max_user);
+
+		sched_pc->vavavoom = vavavoom;
+		prio += vavavoom;
+	}
+	prio += sched_pc->prio_bias;
+	return prio;
+}
+
+#else /* !CONFIG_VSERVER_HARDCPU */
+
+static inline
+int vx_adjust_prio(struct task_struct *p, int prio, int max_user)
+{
+	struct vx_info *vxi = p->vx_info;
+
+	if (vxi)
+		prio += vx_cpu(vxi, sched_pc).prio_bias;
+	return prio;
+}
+
+#endif /* CONFIG_VSERVER_HARDCPU */
+
+
+static inline void vx_account_user(struct vx_info *vxi,
+	cputime_t cputime, int nice)
+{
+	if (!vxi)
+		return;
+	vx_cpu(vxi, sched_pc).user_ticks += cputime;
+}
+
+static inline void vx_account_system(struct vx_info *vxi,
+	cputime_t cputime, int idle)
+{
+	if (!vxi)
+		return;
+	vx_cpu(vxi, sched_pc).sys_ticks += cputime;
+}
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_socket.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_socket.h
--- linux-2.6.32.43/include/linux/vs_socket.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_socket.h	2011-07-15 06:54:21.000000000 -0500
@@ -0,0 +1,67 @@
+#ifndef _VS_SOCKET_H
+#define _VS_SOCKET_H
+
+#include "vserver/debug.h"
+#include "vserver/base.h"
+#include "vserver/cacct.h"
+#include "vserver/context.h"
+#include "vserver/tag.h"
+
+
+/* socket accounting */
+
+#include <linux/socket.h>
+
+static inline int vx_sock_type(int family)
+{
+	switch (family) {
+	case PF_UNSPEC:
+		return VXA_SOCK_UNSPEC;
+	case PF_UNIX:
+		return VXA_SOCK_UNIX;
+	case PF_INET:
+		return VXA_SOCK_INET;
+	case PF_INET6:
+		return VXA_SOCK_INET6;
+	case PF_PACKET:
+		return VXA_SOCK_PACKET;
+	default:
+		return VXA_SOCK_OTHER;
+	}
+}
+
+#define vx_acc_sock(v, f, p, s) \
+	__vx_acc_sock(v, f, p, s, __FILE__, __LINE__)
+
+static inline void __vx_acc_sock(struct vx_info *vxi,
+	int family, int pos, int size, char *file, int line)
+{
+	if (vxi) {
+		int type = vx_sock_type(family);
+
+		atomic_long_inc_unchecked(&vxi->cacct.sock[type][pos].count);
+		atomic_long_add_unchecked(size, &vxi->cacct.sock[type][pos].total);
+	}
+}
+
+#define vx_sock_recv(sk, s) \
+	vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 0, s)
+#define vx_sock_send(sk, s) \
+	vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 1, s)
+#define vx_sock_fail(sk, s) \
+	vx_acc_sock((sk)->sk_vx_info, (sk)->sk_family, 2, s)
+
+
+#define sock_vx_init(s) do {		\
+	(s)->sk_xid = 0;		\
+	(s)->sk_vx_info = NULL;		\
+	} while (0)
+
+#define sock_nx_init(s) do {		\
+	(s)->sk_nid = 0;		\
+	(s)->sk_nx_info = NULL;		\
+	} while (0)
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_tag.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_tag.h
--- linux-2.6.32.43/include/linux/vs_tag.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_tag.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,47 @@
+#ifndef _VS_TAG_H
+#define _VS_TAG_H
+
+#include <linux/vserver/tag.h>
+
+/* check conditions */
+
+#define DX_ADMIN	0x0001
+#define DX_WATCH	0x0002
+#define DX_HOSTID	0x0008
+
+#define DX_IDENT	0x0010
+
+#define DX_ARG_MASK	0x0010
+
+
+#define dx_task_tag(t)	((t)->tag)
+
+#define dx_current_tag() dx_task_tag(current)
+
+#define dx_check(c, m)	__dx_check(dx_current_tag(), c, m)
+
+#define dx_weak_check(c, m)	((m) ? dx_check(c, m) : 1)
+
+
+/*
+ * check current context for ADMIN/WATCH and
+ * optionally against supplied argument
+ */
+static inline int __dx_check(tag_t cid, tag_t id, unsigned int mode)
+{
+	if (mode & DX_ARG_MASK) {
+		if ((mode & DX_IDENT) && (id == cid))
+			return 1;
+	}
+	return (((mode & DX_ADMIN) && (cid == 0)) ||
+		((mode & DX_WATCH) && (cid == 1)) ||
+		((mode & DX_HOSTID) && (id == 0)));
+}
+
+struct inode;
+int dx_permission(const struct inode *inode, int mask);
+
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/linux/vs_time.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_time.h
--- linux-2.6.32.43/include/linux/vs_time.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/linux/vs_time.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,19 @@
+#ifndef _VS_TIME_H
+#define _VS_TIME_H
+
+
+/* time faking stuff */
+
+#ifdef CONFIG_VSERVER_VTIME
+
+extern void vx_gettimeofday(struct timeval *tv);
+extern int vx_settimeofday(struct timespec *ts);
+
+#else
+#define	vx_gettimeofday(t)	do_gettimeofday(t)
+#define	vx_settimeofday(t)	do_settimeofday(t)
+#endif
+
+#else
+#warning duplicate inclusion
+#endif
diff -uriN linux-2.6.32.43/include/media/v4l2-device.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/media/v4l2-device.h
--- linux-2.6.32.43/include/media/v4l2-device.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/media/v4l2-device.h	2011-07-15 05:51:19.000000000 -0500
@@ -71,7 +71,7 @@
    this function returns 0. If the name ends with a digit (e.g. cx18),
    then the name will be set to cx18-0 since cx180 looks really odd. */
 int v4l2_device_set_name(struct v4l2_device *v4l2_dev, const char *basename,
-						atomic_t *instance);
+						atomic_unchecked_t *instance);
 
 /* Set v4l2_dev->dev to NULL. Call when the USB parent disconnects.
    Since the parent disappears this ensures that v4l2_dev doesn't have an
diff -uriN linux-2.6.32.43/include/net/addrconf.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/addrconf.h
--- linux-2.6.32.43/include/net/addrconf.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/addrconf.h	2011-07-15 05:50:11.000000000 -0500
@@ -84,7 +84,8 @@
 					       struct net_device *dev,
 					       const struct in6_addr *daddr,
 					       unsigned int srcprefs,
-					       struct in6_addr *saddr);
+					       struct in6_addr *saddr,
+					       struct nx_info *nxi);
 extern int			ipv6_get_lladdr(struct net_device *dev,
 						struct in6_addr *addr,
 						unsigned char banned_flags);
diff -uriN linux-2.6.32.43/include/net/af_unix.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/af_unix.h
--- linux-2.6.32.43/include/net/af_unix.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/af_unix.h	2011-07-15 05:50:11.000000000 -0500
@@ -4,6 +4,7 @@
 #include <linux/socket.h>
 #include <linux/un.h>
 #include <linux/mutex.h>
+#include <linux/vs_base.h>
 #include <net/sock.h>
 
 extern void unix_inflight(struct file *fp);
diff -uriN linux-2.6.32.43/include/net/flow.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/flow.h
--- linux-2.6.32.43/include/net/flow.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/flow.h	2011-07-15 05:51:19.000000000 -0500
@@ -92,7 +92,7 @@
 extern void *flow_cache_lookup(struct net *net, struct flowi *key, u16 family,
 			       u8 dir, flow_resolve_t resolver);
 extern void flow_cache_flush(void);
-extern atomic_t flow_cache_genid;
+extern atomic_unchecked_t flow_cache_genid;
 
 static inline int flow_cache_uli_match(struct flowi *fl1, struct flowi *fl2)
 {
diff -uriN linux-2.6.32.43/include/net/inetpeer.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/inetpeer.h
--- linux-2.6.32.43/include/net/inetpeer.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/inetpeer.h	2011-07-15 05:51:19.000000000 -0500
@@ -24,7 +24,7 @@
 	__u32			dtime;		/* the time of last use of not
 						 * referenced entries */
 	atomic_t		refcnt;
-	atomic_t		rid;		/* Frag reception counter */
+	atomic_unchecked_t	rid;		/* Frag reception counter */
 	__u32			tcp_ts;
 	unsigned long		tcp_ts_stamp;
 };
diff -uriN linux-2.6.32.43/include/net/inet_timewait_sock.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/inet_timewait_sock.h
--- linux-2.6.32.43/include/net/inet_timewait_sock.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/inet_timewait_sock.h	2011-07-15 05:50:11.000000000 -0500
@@ -117,6 +117,10 @@
 #define tw_hash			__tw_common.skc_hash
 #define tw_prot			__tw_common.skc_prot
 #define tw_net			__tw_common.skc_net
+#define tw_xid			__tw_common.skc_xid
+#define tw_vx_info		__tw_common.skc_vx_info
+#define tw_nid			__tw_common.skc_nid
+#define tw_nx_info		__tw_common.skc_nx_info
 	int			tw_timeout;
 	volatile unsigned char	tw_substate;
 	/* 3 bits hole, try to pack */
diff -uriN linux-2.6.32.43/include/net/ip_vs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/ip_vs.h
--- linux-2.6.32.43/include/net/ip_vs.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/ip_vs.h	2011-07-15 05:51:19.000000000 -0500
@@ -365,7 +365,7 @@
 	struct ip_vs_conn       *control;       /* Master control connection */
 	atomic_t                n_control;      /* Number of controlled ones */
 	struct ip_vs_dest       *dest;          /* real server */
-	atomic_t                in_pkts;        /* incoming packet counter */
+	atomic_unchecked_t      in_pkts;        /* incoming packet counter */
 
 	/* packet transmitter for different forwarding methods.  If it
 	   mangles the packet, it must return NF_DROP or better NF_STOLEN,
@@ -466,7 +466,7 @@
 	union nf_inet_addr	addr;		/* IP address of the server */
 	__be16			port;		/* port number of the server */
 	volatile unsigned	flags;		/* dest status flags */
-	atomic_t		conn_flags;	/* flags to copy to conn */
+	atomic_unchecked_t	conn_flags;	/* flags to copy to conn */
 	atomic_t		weight;		/* server weight */
 
 	atomic_t		refcnt;		/* reference counter */
diff -uriN linux-2.6.32.43/include/net/irda/ircomm_tty.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/irda/ircomm_tty.h
--- linux-2.6.32.43/include/net/irda/ircomm_tty.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/irda/ircomm_tty.h	2011-07-15 05:51:19.000000000 -0500
@@ -35,6 +35,7 @@
 #include <linux/termios.h>
 #include <linux/timer.h>
 #include <linux/tty.h>		/* struct tty_struct */
+#include <asm/local.h>
 
 #include <net/irda/irias_object.h>
 #include <net/irda/ircomm_core.h>
@@ -105,8 +106,8 @@
         unsigned short    close_delay;
         unsigned short    closing_wait; /* time to wait before closing */
 
-	int  open_count;
-	int  blocked_open;	/* # of blocked opens */
+	local_t open_count;
+	local_t blocked_open;	/* # of blocked opens */
 
 	/* Protect concurent access to :
 	 *	o self->open_count
diff -uriN linux-2.6.32.43/include/net/iucv/af_iucv.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/iucv/af_iucv.h
--- linux-2.6.32.43/include/net/iucv/af_iucv.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/iucv/af_iucv.h	2011-07-15 05:51:19.000000000 -0500
@@ -87,7 +87,7 @@
 struct iucv_sock_list {
 	struct hlist_head head;
 	rwlock_t	  lock;
-	atomic_t	  autobind_name;
+	atomic_unchecked_t autobind_name;
 };
 
 unsigned int iucv_sock_poll(struct file *file, struct socket *sock,
diff -uriN linux-2.6.32.43/include/net/neighbour.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/neighbour.h
--- linux-2.6.32.43/include/net/neighbour.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/neighbour.h	2011-07-15 05:51:19.000000000 -0500
@@ -125,12 +125,12 @@
 struct neigh_ops
 {
 	int			family;
-	void			(*solicit)(struct neighbour *, struct sk_buff*);
-	void			(*error_report)(struct neighbour *, struct sk_buff*);
-	int			(*output)(struct sk_buff*);
-	int			(*connected_output)(struct sk_buff*);
-	int			(*hh_output)(struct sk_buff*);
-	int			(*queue_xmit)(struct sk_buff*);
+	void			(* const solicit)(struct neighbour *, struct sk_buff*);
+	void			(* const error_report)(struct neighbour *, struct sk_buff*);
+	int			(* const output)(struct sk_buff*);
+	int			(* const connected_output)(struct sk_buff*);
+	int			(* const hh_output)(struct sk_buff*);
+	int			(* const queue_xmit)(struct sk_buff*);
 };
 
 struct pneigh_entry
diff -uriN linux-2.6.32.43/include/net/netlink.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/netlink.h
--- linux-2.6.32.43/include/net/netlink.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/netlink.h	2011-07-15 05:51:19.000000000 -0500
@@ -558,7 +558,7 @@
 static inline void nlmsg_trim(struct sk_buff *skb, const void *mark)
 {
 	if (mark)
-		skb_trim(skb, (unsigned char *) mark - skb->data);
+		skb_trim(skb, (const unsigned char *) mark - skb->data);
 }
 
 /**
diff -uriN linux-2.6.32.43/include/net/netns/ipv4.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/netns/ipv4.h
--- linux-2.6.32.43/include/net/netns/ipv4.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/netns/ipv4.h	2011-07-15 05:51:19.000000000 -0500
@@ -54,7 +54,7 @@
 	int current_rt_cache_rebuild_count;
 
 	struct timer_list rt_secret_timer;
-	atomic_t rt_genid;
+	atomic_unchecked_t rt_genid;
 
 #ifdef CONFIG_IP_MROUTE
 	struct sock		*mroute_sk;
diff -uriN linux-2.6.32.43/include/net/route.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/route.h
--- linux-2.6.32.43/include/net/route.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/route.h	2011-07-15 05:50:11.000000000 -0500
@@ -135,6 +135,9 @@
 		dst_release(&rt->u.dst);
 }
 
+#include <linux/vs_base.h>
+#include <linux/vs_inet.h>
+
 #define IPTOS_RT_MASK	(IPTOS_TOS_MASK & ~3)
 
 extern const __u8 ip_tos2prio[16];
@@ -144,6 +147,9 @@
 	return ip_tos2prio[IPTOS_TOS(tos)>>1];
 }
 
+extern int ip_v4_find_src(struct net *net, struct nx_info *,
+	struct rtable **, struct flowi *);
+
 static inline int ip_route_connect(struct rtable **rp, __be32 dst,
 				   __be32 src, u32 tos, int oif, u8 protocol,
 				   __be16 sport, __be16 dport, struct sock *sk,
@@ -161,11 +167,24 @@
 
 	int err;
 	struct net *net = sock_net(sk);
+	struct nx_info *nx_info = current_nx_info();
 
 	if (inet_sk(sk)->transparent)
 		fl.flags |= FLOWI_FLAG_ANYSRC;
 
-	if (!dst || !src) {
+	if (sk)
+		nx_info = sk->sk_nx_info;
+
+	vxdprintk(VXD_CBIT(net, 4),
+		"ip_route_connect(%p) %p,%p;%lx",
+		sk, nx_info, sk->sk_socket,
+		(sk->sk_socket?sk->sk_socket->flags:0));
+
+	err = ip_v4_find_src(net, nx_info, rp, &fl);
+	if (err)
+		return err;
+
+	if (!fl.fl4_dst || !fl.fl4_src) {
 		err = __ip_route_output_key(net, rp, &fl);
 		if (err)
 			return err;
diff -uriN linux-2.6.32.43/include/net/sctp/sctp.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/sctp/sctp.h
--- linux-2.6.32.43/include/net/sctp/sctp.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/sctp/sctp.h	2011-07-15 05:51:19.000000000 -0500
@@ -305,8 +305,8 @@
 
 #else	/* SCTP_DEBUG */
 
-#define SCTP_DEBUG_PRINTK(whatever...)
-#define SCTP_DEBUG_PRINTK_IPADDR(whatever...)
+#define SCTP_DEBUG_PRINTK(whatever...) do {} while (0)
+#define SCTP_DEBUG_PRINTK_IPADDR(whatever...) do {} while (0)
 #define SCTP_ENABLE_DEBUG
 #define SCTP_DISABLE_DEBUG
 #define SCTP_ASSERT(expr, str, func)
diff -uriN linux-2.6.32.43/include/net/sock.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/sock.h
--- linux-2.6.32.43/include/net/sock.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/sock.h	2011-07-15 05:51:19.000000000 -0500
@@ -139,6 +139,10 @@
 #ifdef CONFIG_NET_NS
 	struct net	 	*skc_net;
 #endif
+	xid_t			skc_xid;
+	struct vx_info		*skc_vx_info;
+	nid_t			skc_nid;
+	struct nx_info		*skc_nx_info;
 };
 
 /**
@@ -225,6 +229,10 @@
 #define sk_bind_node		__sk_common.skc_bind_node
 #define sk_prot			__sk_common.skc_prot
 #define sk_net			__sk_common.skc_net
+#define sk_xid			__sk_common.skc_xid
+#define sk_vx_info		__sk_common.skc_vx_info
+#define sk_nid			__sk_common.skc_nid
+#define sk_nx_info		__sk_common.skc_nx_info
 	kmemcheck_bitfield_begin(flags);
 	unsigned int		sk_shutdown  : 2,
 				sk_no_check  : 2,
@@ -272,7 +280,7 @@
 	rwlock_t		sk_callback_lock;
 	int			sk_err,
 				sk_err_soft;
-	atomic_t		sk_drops;
+	atomic_unchecked_t	sk_drops;
 	unsigned short		sk_ack_backlog;
 	unsigned short		sk_max_ack_backlog;
 	__u32			sk_priority;
diff -uriN linux-2.6.32.43/include/net/tcp.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/tcp.h
--- linux-2.6.32.43/include/net/tcp.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/tcp.h	2011-07-15 05:51:19.000000000 -0500
@@ -1444,6 +1444,7 @@
 struct tcp_seq_afinfo {
 	char			*name;
 	sa_family_t		family;
+	/* cannot be const */
 	struct file_operations	seq_fops;
 	struct seq_operations	seq_ops;
 };
diff -uriN linux-2.6.32.43/include/net/udp.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/udp.h
--- linux-2.6.32.43/include/net/udp.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/net/udp.h	2011-07-15 05:51:19.000000000 -0500
@@ -187,6 +187,7 @@
 	char			*name;
 	sa_family_t		family;
 	struct udp_table	*udp_table;
+	/* cannot be const */
 	struct file_operations	seq_fops;
 	struct seq_operations	seq_ops;
 };
diff -uriN linux-2.6.32.43/include/scsi/scsi_device.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/scsi/scsi_device.h
--- linux-2.6.32.43/include/scsi/scsi_device.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/scsi/scsi_device.h	2011-07-15 05:51:19.000000000 -0500
@@ -156,9 +156,9 @@
 	unsigned int max_device_blocked; /* what device_blocked counts down from  */
 #define SCSI_DEFAULT_DEVICE_BLOCKED	3
 
-	atomic_t iorequest_cnt;
-	atomic_t iodone_cnt;
-	atomic_t ioerr_cnt;
+	atomic_unchecked_t iorequest_cnt;
+	atomic_unchecked_t iodone_cnt;
+	atomic_unchecked_t ioerr_cnt;
 
 	struct device		sdev_gendev,
 				sdev_dev;
diff -uriN linux-2.6.32.43/include/sound/ac97_codec.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/sound/ac97_codec.h
--- linux-2.6.32.43/include/sound/ac97_codec.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/sound/ac97_codec.h	2011-07-15 05:51:19.000000000 -0500
@@ -419,15 +419,15 @@
 struct snd_ac97;
 
 struct snd_ac97_build_ops {
-	int (*build_3d) (struct snd_ac97 *ac97);
-	int (*build_specific) (struct snd_ac97 *ac97);
-	int (*build_spdif) (struct snd_ac97 *ac97);
-	int (*build_post_spdif) (struct snd_ac97 *ac97);
+	int (* const build_3d) (struct snd_ac97 *ac97);
+	int (* const build_specific) (struct snd_ac97 *ac97);
+	int (* const build_spdif) (struct snd_ac97 *ac97);
+	int (* const build_post_spdif) (struct snd_ac97 *ac97);
 #ifdef CONFIG_PM
-	void (*suspend) (struct snd_ac97 *ac97);
-	void (*resume) (struct snd_ac97 *ac97);
+	void (* const suspend) (struct snd_ac97 *ac97);
+	void (* const resume) (struct snd_ac97 *ac97);
 #endif
-	void (*update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
+	void (* const update_jacks) (struct snd_ac97 *ac97);	/* for jack-sharing */
 };
 
 struct snd_ac97_bus_ops {
@@ -477,7 +477,7 @@
 
 struct snd_ac97 {
 	/* -- lowlevel (hardware) driver specific -- */
-	struct snd_ac97_build_ops * build_ops;
+	const struct snd_ac97_build_ops * build_ops;
 	void *private_data;
 	void (*private_free) (struct snd_ac97 *ac97);
 	/* --- */
diff -uriN linux-2.6.32.43/include/sound/ymfpci.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/sound/ymfpci.h
--- linux-2.6.32.43/include/sound/ymfpci.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/sound/ymfpci.h	2011-07-15 05:51:19.000000000 -0500
@@ -358,7 +358,7 @@
 	spinlock_t reg_lock;
 	spinlock_t voice_lock;
 	wait_queue_head_t interrupt_sleep;
-	atomic_t interrupt_sleep_count;
+	atomic_unchecked_t interrupt_sleep_count;
 	struct snd_info_entry *proc_entry;
 	const struct firmware *dsp_microcode;
 	const struct firmware *controller_microcode;
diff -uriN linux-2.6.32.43/include/trace/events/irq.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/trace/events/irq.h
--- linux-2.6.32.43/include/trace/events/irq.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/trace/events/irq.h	2011-07-15 05:51:19.000000000 -0500
@@ -34,7 +34,7 @@
  */
 TRACE_EVENT(irq_handler_entry,
 
-	TP_PROTO(int irq, struct irqaction *action),
+	TP_PROTO(int irq, const struct irqaction *action),
 
 	TP_ARGS(irq, action),
 
@@ -64,7 +64,7 @@
  */
 TRACE_EVENT(irq_handler_exit,
 
-	TP_PROTO(int irq, struct irqaction *action, int ret),
+	TP_PROTO(int irq, const struct irqaction *action, int ret),
 
 	TP_ARGS(irq, action, ret),
 
@@ -95,7 +95,7 @@
  */
 TRACE_EVENT(softirq_entry,
 
-	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
+	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
 
 	TP_ARGS(h, vec),
 
@@ -124,7 +124,7 @@
  */
 TRACE_EVENT(softirq_exit,
 
-	TP_PROTO(struct softirq_action *h, struct softirq_action *vec),
+	TP_PROTO(const struct softirq_action *h, const struct softirq_action *vec),
 
 	TP_ARGS(h, vec),
 
diff -uriN linux-2.6.32.43/include/video/uvesafb.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/video/uvesafb.h
--- linux-2.6.32.43/include/video/uvesafb.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/include/video/uvesafb.h	2011-07-15 05:51:19.000000000 -0500
@@ -177,6 +177,7 @@
 	u8 ypan;			/* 0 - nothing, 1 - ypan, 2 - ywrap */
 	u8 pmi_setpal;			/* PMI for palette changes */
 	u16 *pmi_base;			/* protected mode interface location */
+	u8 *pmi_code;			/* protected mode code location */
 	void *pmi_start;
 	void *pmi_pal;
 	u8 *vbe_state_orig;		/*
diff -uriN linux-2.6.32.43/init/do_mounts.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/do_mounts.c
--- linux-2.6.32.43/init/do_mounts.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/do_mounts.c	2011-07-15 05:51:19.000000000 -0500
@@ -216,11 +216,11 @@
 
 static int __init do_mount_root(char *name, char *fs, int flags, void *data)
 {
-	int err = sys_mount(name, "/root", fs, flags, data);
+	int err = sys_mount((__force char __user *)name, (__force char __user *)"/root", (__force char __user *)fs, flags, (__force void __user *)data);
 	if (err)
 		return err;
 
-	sys_chdir("/root");
+	sys_chdir((__force const char __user *)"/root");
 	ROOT_DEV = current->fs->pwd.mnt->mnt_sb->s_dev;
 	printk("VFS: Mounted root (%s filesystem)%s on device %u:%u.\n",
 	       current->fs->pwd.mnt->mnt_sb->s_type->name,
@@ -311,18 +311,18 @@
 	va_start(args, fmt);
 	vsprintf(buf, fmt, args);
 	va_end(args);
-	fd = sys_open("/dev/root", O_RDWR | O_NDELAY, 0);
+	fd = sys_open((char __user *)"/dev/root", O_RDWR | O_NDELAY, 0);
 	if (fd >= 0) {
 		sys_ioctl(fd, FDEJECT, 0);
 		sys_close(fd);
 	}
 	printk(KERN_NOTICE "VFS: Insert %s and press ENTER\n", buf);
-	fd = sys_open("/dev/console", O_RDWR, 0);
+	fd = sys_open((char __user *)"/dev/console", O_RDWR, 0);
 	if (fd >= 0) {
 		sys_ioctl(fd, TCGETS, (long)&termios);
 		termios.c_lflag &= ~ICANON;
 		sys_ioctl(fd, TCSETSF, (long)&termios);
-		sys_read(fd, &c, 1);
+		sys_read(fd, (char __user *)&c, 1);
 		termios.c_lflag |= ICANON;
 		sys_ioctl(fd, TCSETSF, (long)&termios);
 		sys_close(fd);
@@ -416,6 +416,6 @@
 	mount_root();
 out:
 	devtmpfs_mount("dev");
-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
-	sys_chroot(".");
+	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
+	sys_chroot((__force char __user *)".");
 }
diff -uriN linux-2.6.32.43/init/do_mounts.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/do_mounts.h
--- linux-2.6.32.43/init/do_mounts.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/do_mounts.h	2011-07-15 05:51:19.000000000 -0500
@@ -15,15 +15,15 @@
 
 static inline int create_dev(char *name, dev_t dev)
 {
-	sys_unlink(name);
-	return sys_mknod(name, S_IFBLK|0600, new_encode_dev(dev));
+	sys_unlink((__force char __user *)name);
+	return sys_mknod((__force char __user *)name, S_IFBLK|0600, new_encode_dev(dev));
 }
 
 #if BITS_PER_LONG == 32
 static inline u32 bstat(char *name)
 {
 	struct stat64 stat;
-	if (sys_stat64(name, &stat) != 0)
+	if (sys_stat64((__force char __user *)name, (__force struct stat64 __user *)&stat) != 0)
 		return 0;
 	if (!S_ISBLK(stat.st_mode))
 		return 0;
diff -uriN linux-2.6.32.43/init/do_mounts_initrd.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/do_mounts_initrd.c
--- linux-2.6.32.43/init/do_mounts_initrd.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/do_mounts_initrd.c	2011-07-15 05:51:19.000000000 -0500
@@ -32,7 +32,7 @@
 	sys_close(old_fd);sys_close(root_fd);
 	sys_close(0);sys_close(1);sys_close(2);
 	sys_setsid();
-	(void) sys_open("/dev/console",O_RDWR,0);
+	(void) sys_open((__force const char __user *)"/dev/console",O_RDWR,0);
 	(void) sys_dup(0);
 	(void) sys_dup(0);
 	return kernel_execve(shell, argv, envp_init);
@@ -47,13 +47,13 @@
 	create_dev("/dev/root.old", Root_RAM0);
 	/* mount initrd on rootfs' /root */
 	mount_block_root("/dev/root.old", root_mountflags & ~MS_RDONLY);
-	sys_mkdir("/old", 0700);
-	root_fd = sys_open("/", 0, 0);
-	old_fd = sys_open("/old", 0, 0);
+	sys_mkdir((__force const char __user *)"/old", 0700);
+	root_fd = sys_open((__force const char __user *)"/", 0, 0);
+	old_fd = sys_open((__force const char __user *)"/old", 0, 0);
 	/* move initrd over / and chdir/chroot in initrd root */
-	sys_chdir("/root");
-	sys_mount(".", "/", NULL, MS_MOVE, NULL);
-	sys_chroot(".");
+	sys_chdir((__force const char __user *)"/root");
+	sys_mount((__force char __user *)".", (__force char __user *)"/", NULL, MS_MOVE, NULL);
+	sys_chroot((__force const char __user *)".");
 
 	/*
 	 * In case that a resume from disk is carried out by linuxrc or one of
@@ -70,15 +70,15 @@
 
 	/* move initrd to rootfs' /old */
 	sys_fchdir(old_fd);
-	sys_mount("/", ".", NULL, MS_MOVE, NULL);
+	sys_mount((__force char __user *)"/", (__force char __user *)".", NULL, MS_MOVE, NULL);
 	/* switch root and cwd back to / of rootfs */
 	sys_fchdir(root_fd);
-	sys_chroot(".");
+	sys_chroot((__force const char __user *)".");
 	sys_close(old_fd);
 	sys_close(root_fd);
 
 	if (new_decode_dev(real_root_dev) == Root_RAM0) {
-		sys_chdir("/old");
+		sys_chdir((__force const char __user *)"/old");
 		return;
 	}
 
@@ -86,17 +86,17 @@
 	mount_root();
 
 	printk(KERN_NOTICE "Trying to move old root to /initrd ... ");
-	error = sys_mount("/old", "/root/initrd", NULL, MS_MOVE, NULL);
+	error = sys_mount((__force char __user *)"/old", (__force char __user *)"/root/initrd", NULL, MS_MOVE, NULL);
 	if (!error)
 		printk("okay\n");
 	else {
-		int fd = sys_open("/dev/root.old", O_RDWR, 0);
+		int fd = sys_open((__force const char __user *)"/dev/root.old", O_RDWR, 0);
 		if (error == -ENOENT)
 			printk("/initrd does not exist. Ignored.\n");
 		else
 			printk("failed\n");
 		printk(KERN_NOTICE "Unmounting old root\n");
-		sys_umount("/old", MNT_DETACH);
+		sys_umount((__force char __user *)"/old", MNT_DETACH);
 		printk(KERN_NOTICE "Trying to free ramdisk memory ... ");
 		if (fd < 0) {
 			error = fd;
@@ -119,11 +119,11 @@
 		 * mounted in the normal path.
 		 */
 		if (rd_load_image("/initrd.image") && ROOT_DEV != Root_RAM0) {
-			sys_unlink("/initrd.image");
+			sys_unlink((__force const char __user *)"/initrd.image");
 			handle_initrd();
 			return 1;
 		}
 	}
-	sys_unlink("/initrd.image");
+	sys_unlink((__force const char __user *)"/initrd.image");
 	return 0;
 }
diff -uriN linux-2.6.32.43/init/do_mounts_md.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/do_mounts_md.c
--- linux-2.6.32.43/init/do_mounts_md.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/do_mounts_md.c	2011-07-15 05:51:19.000000000 -0500
@@ -170,7 +170,7 @@
 			partitioned ? "_d" : "", minor,
 			md_setup_args[ent].device_names);
 
-		fd = sys_open(name, 0, 0);
+		fd = sys_open((__force char __user *)name, 0, 0);
 		if (fd < 0) {
 			printk(KERN_ERR "md: open failed - cannot start "
 					"array %s\n", name);
@@ -233,7 +233,7 @@
 			 * array without it
 			 */
 			sys_close(fd);
-			fd = sys_open(name, 0, 0);
+			fd = sys_open((__force char __user *)name, 0, 0);
 			sys_ioctl(fd, BLKRRPART, 0);
 		}
 		sys_close(fd);
@@ -283,7 +283,7 @@
 
 	wait_for_device_probe();
 
-	fd = sys_open("/dev/md0", 0, 0);
+	fd = sys_open((__force char __user *)"/dev/md0", 0, 0);
 	if (fd >= 0) {
 		sys_ioctl(fd, RAID_AUTORUN, raid_autopart);
 		sys_close(fd);
diff -uriN linux-2.6.32.43/init/initramfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/initramfs.c
--- linux-2.6.32.43/init/initramfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/initramfs.c	2011-07-15 05:51:19.000000000 -0500
@@ -74,7 +74,7 @@
 	}
 }
 
-static long __init do_utime(char __user *filename, time_t mtime)
+static long __init do_utime(__force char __user *filename, time_t mtime)
 {
 	struct timespec t[2];
 
@@ -109,7 +109,7 @@
 	struct dir_entry *de, *tmp;
 	list_for_each_entry_safe(de, tmp, &dir_list, list) {
 		list_del(&de->list);
-		do_utime(de->name, de->mtime);
+		do_utime((__force char __user *)de->name, de->mtime);
 		kfree(de->name);
 		kfree(de);
 	}
@@ -271,7 +271,7 @@
 	if (nlink >= 2) {
 		char *old = find_link(major, minor, ino, mode, collected);
 		if (old)
-			return (sys_link(old, collected) < 0) ? -1 : 1;
+			return (sys_link((__force char __user *)old, (__force char __user *)collected) < 0) ? -1 : 1;
 	}
 	return 0;
 }
@@ -280,11 +280,11 @@
 {
 	struct stat st;
 
-	if (!sys_newlstat(path, &st) && (st.st_mode^mode) & S_IFMT) {
+	if (!sys_newlstat((__force char __user *)path, (__force struct stat __user *)&st) && (st.st_mode^mode) & S_IFMT) {
 		if (S_ISDIR(st.st_mode))
-			sys_rmdir(path);
+			sys_rmdir((__force char __user *)path);
 		else
-			sys_unlink(path);
+			sys_unlink((__force char __user *)path);
 	}
 }
 
@@ -305,7 +305,7 @@
 			int openflags = O_WRONLY|O_CREAT;
 			if (ml != 1)
 				openflags |= O_TRUNC;
-			wfd = sys_open(collected, openflags, mode);
+			wfd = sys_open((__force char __user *)collected, openflags, mode);
 
 			if (wfd >= 0) {
 				sys_fchown(wfd, uid, gid);
@@ -317,17 +317,17 @@
 			}
 		}
 	} else if (S_ISDIR(mode)) {
-		sys_mkdir(collected, mode);
-		sys_chown(collected, uid, gid);
-		sys_chmod(collected, mode);
+		sys_mkdir((__force char __user *)collected, mode);
+		sys_chown((__force char __user *)collected, uid, gid);
+		sys_chmod((__force char __user *)collected, mode);
 		dir_add(collected, mtime);
 	} else if (S_ISBLK(mode) || S_ISCHR(mode) ||
 		   S_ISFIFO(mode) || S_ISSOCK(mode)) {
 		if (maybe_link() == 0) {
-			sys_mknod(collected, mode, rdev);
-			sys_chown(collected, uid, gid);
-			sys_chmod(collected, mode);
-			do_utime(collected, mtime);
+			sys_mknod((__force char __user *)collected, mode, rdev);
+			sys_chown((__force char __user *)collected, uid, gid);
+			sys_chmod((__force char __user *)collected, mode);
+			do_utime((__force char __user *)collected, mtime);
 		}
 	}
 	return 0;
@@ -336,15 +336,15 @@
 static int __init do_copy(void)
 {
 	if (count >= body_len) {
-		sys_write(wfd, victim, body_len);
+		sys_write(wfd, (__force char __user *)victim, body_len);
 		sys_close(wfd);
-		do_utime(vcollected, mtime);
+		do_utime((__force char __user *)vcollected, mtime);
 		kfree(vcollected);
 		eat(body_len);
 		state = SkipIt;
 		return 0;
 	} else {
-		sys_write(wfd, victim, count);
+		sys_write(wfd, (__force char __user *)victim, count);
 		body_len -= count;
 		eat(count);
 		return 1;
@@ -355,9 +355,9 @@
 {
 	collected[N_ALIGN(name_len) + body_len] = '\0';
 	clean_path(collected, 0);
-	sys_symlink(collected + N_ALIGN(name_len), collected);
-	sys_lchown(collected, uid, gid);
-	do_utime(collected, mtime);
+	sys_symlink((__force char __user *)collected + N_ALIGN(name_len), (__force char __user *)collected);
+	sys_lchown((__force char __user *)collected, uid, gid);
+	do_utime((__force char __user *)collected, mtime);
 	state = SkipIt;
 	next_state = Reset;
 	return 0;
diff -uriN linux-2.6.32.43/init/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/Kconfig
--- linux-2.6.32.43/init/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/Kconfig	2011-07-15 05:51:19.000000000 -0500
@@ -426,6 +426,19 @@
 config HAVE_UNSTABLE_SCHED_CLOCK
 	bool
 
+config CFS_HARD_LIMITS
+	bool "Hard Limits for CFS Group Scheduler"
+	depends on EXPERIMENTAL
+	depends on FAIR_GROUP_SCHED && CGROUP_SCHED
+	default n
+	help
+	  This option enables hard limiting of CPU time obtained by
+	  a fair task group. Use this if you want to throttle a group of tasks
+	  based on its CPU usage. For more details refer to
+	  Documentation/scheduler/sched-cfs-hard-limits.txt
+
+	  Say N if unsure.
+
 menuconfig CGROUPS
 	boolean "Control Group support"
 	help
@@ -1004,7 +1017,7 @@
 
 config COMPAT_BRK
 	bool "Disable heap randomization"
-	default y
+	default n
 	help
 	  Randomizing heap placement makes heap exploits harder, but it
 	  also breaks ancient binaries (including anything libc5 based).
diff -uriN linux-2.6.32.43/init/main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/main.c
--- linux-2.6.32.43/init/main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/main.c	2011-07-15 05:51:19.000000000 -0500
@@ -70,6 +70,7 @@
 #include <linux/sfi.h>
 #include <linux/shmem_fs.h>
 #include <trace/boot.h>
+#include <linux/vserver/percpu.h>
 
 #include <asm/io.h>
 #include <asm/bugs.h>
@@ -97,6 +98,7 @@
 #ifdef CONFIG_TC
 extern void tc_init(void);
 #endif
+extern void grsecurity_init(void);
 
 enum system_states system_state __read_mostly;
 EXPORT_SYMBOL(system_state);
@@ -183,6 +185,49 @@
 
 __setup("reset_devices", set_reset_devices);
 
+#if defined(CONFIG_X86_64) && defined(CONFIG_PAX_MEMORY_UDEREF)
+extern char pax_enter_kernel_user[];
+extern char pax_exit_kernel_user[];
+extern pgdval_t clone_pgd_mask;
+#endif
+
+#if defined(CONFIG_X86) && defined(CONFIG_PAX_MEMORY_UDEREF)
+static int __init setup_pax_nouderef(char *str)
+{
+#ifdef CONFIG_X86_32
+	unsigned int cpu;
+	struct desc_struct *gdt;
+
+	for (cpu = 0; cpu < NR_CPUS; cpu++) {
+		gdt = get_cpu_gdt_table(cpu);
+		gdt[GDT_ENTRY_KERNEL_DS].type = 3;
+		gdt[GDT_ENTRY_KERNEL_DS].limit = 0xf;
+		gdt[GDT_ENTRY_DEFAULT_USER_CS].limit = 0xf;
+		gdt[GDT_ENTRY_DEFAULT_USER_DS].limit = 0xf;
+	}
+	asm("mov %0, %%ds; mov %0, %%es; mov %0, %%ss" : : "r" (__KERNEL_DS) : "memory");
+#else
+	memcpy(pax_enter_kernel_user, (unsigned char []){0xc3}, 1);
+	memcpy(pax_exit_kernel_user, (unsigned char []){0xc3}, 1);
+	clone_pgd_mask = ~(pgdval_t)0UL;
+#endif
+
+	return 0;
+}
+early_param("pax_nouderef", setup_pax_nouderef);
+#endif
+
+#ifdef CONFIG_PAX_SOFTMODE
+unsigned int pax_softmode;
+
+static int __init setup_pax_softmode(char *str)
+{
+	get_option(&str, &pax_softmode);
+	return 1;
+}
+__setup("pax_softmode=", setup_pax_softmode);
+#endif
+
 static char * argv_init[MAX_INIT_ARGS+2] = { "init", NULL, };
 char * envp_init[MAX_INIT_ENVS+2] = { "HOME=/", "TERM=linux", NULL, };
 static const char *panic_later, *panic_param;
@@ -705,52 +750,53 @@
 core_param(initcall_debug, initcall_debug, bool, 0644);
 
 static char msgbuf[64];
-static struct boot_trace_call call;
-static struct boot_trace_ret ret;
+static struct boot_trace_call trace_call;
+static struct boot_trace_ret trace_ret;
 
 int do_one_initcall(initcall_t fn)
 {
 	int count = preempt_count();
 	ktime_t calltime, delta, rettime;
+	const char *msg1 = "", *msg2 = "";
 
 	if (initcall_debug) {
-		call.caller = task_pid_nr(current);
-		printk("calling  %pF @ %i\n", fn, call.caller);
+		trace_call.caller = task_pid_nr(current);
+		printk("calling  %pF @ %i\n", fn, trace_call.caller);
 		calltime = ktime_get();
-		trace_boot_call(&call, fn);
+		trace_boot_call(&trace_call, fn);
 		enable_boot_trace();
 	}
 
-	ret.result = fn();
+	trace_ret.result = fn();
 
 	if (initcall_debug) {
 		disable_boot_trace();
 		rettime = ktime_get();
 		delta = ktime_sub(rettime, calltime);
-		ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
-		trace_boot_ret(&ret, fn);
+		trace_ret.duration = (unsigned long long) ktime_to_ns(delta) >> 10;
+		trace_boot_ret(&trace_ret, fn);
 		printk("initcall %pF returned %d after %Ld usecs\n", fn,
-			ret.result, ret.duration);
+			trace_ret.result, trace_ret.duration);
 	}
 
 	msgbuf[0] = 0;
 
-	if (ret.result && ret.result != -ENODEV && initcall_debug)
-		sprintf(msgbuf, "error code %d ", ret.result);
+	if (trace_ret.result && trace_ret.result != -ENODEV && initcall_debug)
+		sprintf(msgbuf, "error code %d ", trace_ret.result);
 
 	if (preempt_count() != count) {
-		strlcat(msgbuf, "preemption imbalance ", sizeof(msgbuf));
+		msg1 = " preemption imbalance";
 		preempt_count() = count;
 	}
 	if (irqs_disabled()) {
-		strlcat(msgbuf, "disabled interrupts ", sizeof(msgbuf));
+		msg2 = " disabled interrupts";
 		local_irq_enable();
 	}
-	if (msgbuf[0]) {
-		printk("initcall %pF returned with %s\n", fn, msgbuf);
+	if (msgbuf[0] || *msg1 || *msg2) {
+		printk("initcall %pF returned with %s%s%s\n", fn, msgbuf, msg1, msg2);
 	}
 
-	return ret.result;
+	return trace_ret.result;
 }
 
 
@@ -893,11 +939,13 @@
 	if (!ramdisk_execute_command)
 		ramdisk_execute_command = "/init";
 
-	if (sys_access((const char __user *) ramdisk_execute_command, 0) != 0) {
+	if (sys_access((__force const char __user *) ramdisk_execute_command, 0) != 0) {
 		ramdisk_execute_command = NULL;
 		prepare_namespace();
 	}
 
+	grsecurity_init();
+
 	/*
 	 * Ok, we have completed the initial bootup, and
 	 * we're essentially up and running. Get rid of the
diff -uriN linux-2.6.32.43/init/noinitramfs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/noinitramfs.c
--- linux-2.6.32.43/init/noinitramfs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/init/noinitramfs.c	2011-07-15 05:51:19.000000000 -0500
@@ -29,7 +29,7 @@
 {
 	int err;
 
-	err = sys_mkdir("/dev", 0755);
+	err = sys_mkdir((const char __user *)"/dev", 0755);
 	if (err < 0)
 		goto out;
 
@@ -39,7 +39,7 @@
 	if (err < 0)
 		goto out;
 
-	err = sys_mkdir("/root", 0700);
+	err = sys_mkdir((const char __user *)"/root", 0700);
 	if (err < 0)
 		goto out;
 
diff -uriN linux-2.6.32.43/ipc/mqueue.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/mqueue.c
--- linux-2.6.32.43/ipc/mqueue.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/mqueue.c	2011-07-15 05:51:19.000000000 -0500
@@ -33,6 +33,8 @@
 #include <linux/pid.h>
 #include <linux/ipc_namespace.h>
 #include <linux/ima.h>
+#include <linux/vs_context.h>
+#include <linux/vs_limit.h>
 
 #include <net/sock.h>
 #include "util.h"
@@ -66,6 +68,7 @@
 	struct sigevent notify;
 	struct pid* notify_owner;
 	struct user_struct *user;	/* user who created, for accounting */
+	struct vx_info *vxi;
 	struct sock *notify_sock;
 	struct sk_buff *notify_cookie;
 
@@ -125,6 +128,7 @@
 		if (S_ISREG(mode)) {
 			struct mqueue_inode_info *info;
 			struct task_struct *p = current;
+			struct vx_info *vxi = p->vx_info;
 			unsigned long mq_bytes, mq_msg_tblsz;
 
 			inode->i_fop = &mqueue_file_operations;
@@ -139,6 +143,7 @@
 			info->notify_owner = NULL;
 			info->qsize = 0;
 			info->user = NULL;	/* set when all is ok */
+			info->vxi = NULL;
 			memset(&info->attr, 0, sizeof(info->attr));
 			info->attr.mq_maxmsg = ipc_ns->mq_msg_max;
 			info->attr.mq_msgsize = ipc_ns->mq_msgsize_max;
@@ -150,25 +155,30 @@
 			mq_bytes = (mq_msg_tblsz +
 				(info->attr.mq_maxmsg * info->attr.mq_msgsize));
 
+			gr_learn_resource(current, RLIMIT_MSGQUEUE, u->mq_bytes + mq_bytes, 1);
 			spin_lock(&mq_lock);
 			if (u->mq_bytes + mq_bytes < u->mq_bytes ||
 		 	    u->mq_bytes + mq_bytes >
-			    p->signal->rlim[RLIMIT_MSGQUEUE].rlim_cur) {
+			    p->signal->rlim[RLIMIT_MSGQUEUE].rlim_cur ||
+			    !vx_ipcmsg_avail(vxi, mq_bytes)) {
 				spin_unlock(&mq_lock);
 				goto out_inode;
 			}
 			u->mq_bytes += mq_bytes;
+			vx_ipcmsg_add(vxi, u, mq_bytes);
 			spin_unlock(&mq_lock);
 
 			info->messages = kmalloc(mq_msg_tblsz, GFP_KERNEL);
 			if (!info->messages) {
 				spin_lock(&mq_lock);
 				u->mq_bytes -= mq_bytes;
+				vx_ipcmsg_sub(vxi, u, mq_bytes);
 				spin_unlock(&mq_lock);
 				goto out_inode;
 			}
 			/* all is ok */
 			info->user = get_uid(u);
+			info->vxi = get_vx_info(vxi);
 		} else if (S_ISDIR(mode)) {
 			inc_nlink(inode);
 			/* Some things misbehave if size == 0 on a directory */
@@ -269,8 +279,11 @@
 		   (info->attr.mq_maxmsg * info->attr.mq_msgsize));
 	user = info->user;
 	if (user) {
+		struct vx_info *vxi = info->vxi;
+
 		spin_lock(&mq_lock);
 		user->mq_bytes -= mq_bytes;
+		vx_ipcmsg_sub(vxi, user, mq_bytes);
 		/*
 		 * get_ns_from_inode() ensures that the
 		 * (ipc_ns = sb->s_fs_info) is either a valid ipc_ns
@@ -280,6 +293,7 @@
 		if (ipc_ns)
 			ipc_ns->mq_queues_count--;
 		spin_unlock(&mq_lock);
+		put_vx_info(vxi);
 		free_uid(user);
 	}
 	if (ipc_ns)
diff -uriN linux-2.6.32.43/ipc/msg.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/msg.c
--- linux-2.6.32.43/ipc/msg.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/msg.c	2011-07-15 05:50:11.000000000 -0500
@@ -38,6 +38,7 @@
 #include <linux/rwsem.h>
 #include <linux/nsproxy.h>
 #include <linux/ipc_namespace.h>
+#include <linux/vs_base.h>
 
 #include <asm/current.h>
 #include <asm/uaccess.h>
@@ -191,6 +192,7 @@
 
 	msq->q_perm.mode = msgflg & S_IRWXUGO;
 	msq->q_perm.key = key;
+	msq->q_perm.xid = vx_current_xid();
 
 	msq->q_perm.security = NULL;
 	retval = security_msg_queue_alloc(msq);
diff -uriN linux-2.6.32.43/ipc/namespace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/namespace.c
--- linux-2.6.32.43/ipc/namespace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/namespace.c	2011-07-15 05:50:11.000000000 -0500
@@ -11,6 +11,8 @@
 #include <linux/slab.h>
 #include <linux/fs.h>
 #include <linux/mount.h>
+#include <linux/vs_base.h>
+#include <linux/vserver/global.h>
 
 #include "util.h"
 
diff -uriN linux-2.6.32.43/ipc/sem.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/sem.c
--- linux-2.6.32.43/ipc/sem.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/sem.c	2011-07-15 05:51:19.000000000 -0500
@@ -83,6 +83,8 @@
 #include <linux/rwsem.h>
 #include <linux/nsproxy.h>
 #include <linux/ipc_namespace.h>
+#include <linux/vs_base.h>
+#include <linux/vs_limit.h>
 
 #include <asm/uaccess.h>
 #include "util.h"
@@ -256,6 +258,7 @@
 
 	sma->sem_perm.mode = (semflg & S_IRWXUGO);
 	sma->sem_perm.key = key;
+	sma->sem_perm.xid = vx_current_xid();
 
 	sma->sem_perm.security = NULL;
 	retval = security_sem_alloc(sma);
@@ -271,6 +274,9 @@
 		return id;
 	}
 	ns->used_sems += nsems;
+	/* FIXME: obsoleted? */
+	vx_semary_inc(sma);
+	vx_nsems_add(sma, nsems);
 
 	sma->sem_base = (struct sem *) &sma[1];
 	INIT_LIST_HEAD(&sma->sem_pending);
@@ -547,6 +553,9 @@
 	sem_unlock(sma);
 
 	ns->used_sems -= sma->sem_nsems;
+	/* FIXME: obsoleted? */
+	vx_nsems_sub(sma, sma->sem_nsems);
+	vx_semary_dec(sma);
 	security_sem_free(sma);
 	ipc_rcu_putref(sma);
 }
@@ -671,6 +680,8 @@
 	ushort* sem_io = fast_sem_io;
 	int nsems;
 
+	pax_track_stack();
+
 	sma = sem_lock_check(ns, semid);
 	if (IS_ERR(sma))
 		return PTR_ERR(sma);
@@ -1071,6 +1082,8 @@
 	unsigned long jiffies_left = 0;
 	struct ipc_namespace *ns;
 
+	pax_track_stack();
+
 	ns = current->nsproxy->ipc_ns;
 
 	if (nsops < 1 || semid < 0)
diff -uriN linux-2.6.32.43/ipc/shm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/shm.c
--- linux-2.6.32.43/ipc/shm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/ipc/shm.c	2011-07-15 05:51:19.000000000 -0500
@@ -40,6 +40,8 @@
 #include <linux/mount.h>
 #include <linux/ipc_namespace.h>
 #include <linux/ima.h>
+#include <linux/vs_context.h>
+#include <linux/vs_limit.h>
 
 #include <asm/uaccess.h>
 
@@ -70,6 +72,14 @@
 static int sysvipc_shm_proc_show(struct seq_file *s, void *it);
 #endif
 
+#ifdef CONFIG_GRKERNSEC
+extern int gr_handle_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
+			   const time_t shm_createtime, const uid_t cuid,
+			   const int shmid);
+extern int gr_chroot_shmat(const pid_t shm_cprid, const pid_t shm_lapid,
+			   const time_t shm_createtime);
+#endif
+
 void shm_init_ns(struct ipc_namespace *ns)
 {
 	ns->shm_ctlmax = SHMMAX;
@@ -170,7 +180,12 @@
  */
 static void shm_destroy(struct ipc_namespace *ns, struct shmid_kernel *shp)
 {
-	ns->shm_tot -= (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
+	struct vx_info *vxi = lookup_vx_info(shp->shm_perm.xid);
+	int numpages = (shp->shm_segsz + PAGE_SIZE - 1) >> PAGE_SHIFT;
+
+	vx_ipcshm_sub(vxi, shp, numpages);
+	ns->shm_tot -= numpages;
+
 	shm_rmid(ns, shp);
 	shm_unlock(shp);
 	if (!is_file_hugepages(shp->shm_file))
@@ -180,6 +195,7 @@
 						shp->mlock_user);
 	fput (shp->shm_file);
 	security_shm_free(shp);
+	put_vx_info(vxi);
 	ipc_rcu_putref(shp);
 }
 
@@ -350,11 +366,15 @@
 	if (ns->shm_tot + numpages > ns->shm_ctlall)
 		return -ENOSPC;
 
+	if (!vx_ipcshm_avail(current_vx_info(), numpages))
+		return -ENOSPC;
+
 	shp = ipc_rcu_alloc(sizeof(*shp));
 	if (!shp)
 		return -ENOMEM;
 
 	shp->shm_perm.key = key;
+	shp->shm_perm.xid = vx_current_xid();
 	shp->shm_perm.mode = (shmflg & S_IRWXUGO);
 	shp->mlock_user = NULL;
 
@@ -396,6 +416,14 @@
 	shp->shm_lprid = 0;
 	shp->shm_atim = shp->shm_dtim = 0;
 	shp->shm_ctim = get_seconds();
+#ifdef CONFIG_GRKERNSEC
+	{
+		struct timespec timeval;
+		do_posix_clock_monotonic_gettime(&timeval);
+
+		shp->shm_createtime = timeval.tv_sec;
+	}
+#endif
 	shp->shm_segsz = size;
 	shp->shm_nattch = 0;
 	shp->shm_file = file;
@@ -408,6 +436,7 @@
 	ns->shm_tot += numpages;
 	error = shp->shm_perm.id;
 	shm_unlock(shp);
+	vx_ipcshm_add(current_vx_info(), key, numpages);
 	return error;
 
 no_id:
@@ -880,9 +909,21 @@
 	if (err)
 		goto out_unlock;
 
+#ifdef CONFIG_GRKERNSEC
+	if (!gr_handle_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime,
+			     shp->shm_perm.cuid, shmid) ||
+	    !gr_chroot_shmat(shp->shm_cprid, shp->shm_lapid, shp->shm_createtime)) {
+		err = -EACCES;
+		goto out_unlock;
+	}
+#endif
+
 	path.dentry = dget(shp->shm_file->f_path.dentry);
 	path.mnt    = shp->shm_file->f_path.mnt;
 	shp->shm_nattch++;
+#ifdef CONFIG_GRKERNSEC
+	shp->shm_lapid = current->pid;
+#endif
 	size = i_size_read(path.dentry->d_inode);
 	shm_unlock(shp);
 
diff -uriN linux-2.6.32.43/kernel/acct.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/acct.c
--- linux-2.6.32.43/kernel/acct.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/acct.c	2011-07-15 05:51:19.000000000 -0500
@@ -579,7 +579,7 @@
 	 */
 	flim = current->signal->rlim[RLIMIT_FSIZE].rlim_cur;
 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = RLIM_INFINITY;
-	file->f_op->write(file, (char *)&ac,
+	file->f_op->write(file, (__force char __user *)&ac,
 			       sizeof(acct_t), &file->f_pos);
 	current->signal->rlim[RLIMIT_FSIZE].rlim_cur = flim;
 	set_fs(fs);
diff -uriN linux-2.6.32.43/kernel/audit.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/audit.c
--- linux-2.6.32.43/kernel/audit.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/audit.c	2011-07-15 05:51:19.000000000 -0500
@@ -110,7 +110,7 @@
    3) suppressed due to audit_rate_limit
    4) suppressed due to audit_backlog_limit
 */
-static atomic_t    audit_lost = ATOMIC_INIT(0);
+static atomic_unchecked_t    audit_lost = ATOMIC_INIT(0);
 
 /* The netlink socket. */
 static struct sock *audit_sock;
@@ -232,7 +232,7 @@
 	unsigned long		now;
 	int			print;
 
-	atomic_inc(&audit_lost);
+	atomic_inc_unchecked(&audit_lost);
 
 	print = (audit_failure == AUDIT_FAIL_PANIC || !audit_rate_limit);
 
@@ -251,7 +251,7 @@
 			printk(KERN_WARNING
 				"audit: audit_lost=%d audit_rate_limit=%d "
 				"audit_backlog_limit=%d\n",
-				atomic_read(&audit_lost),
+				atomic_read_unchecked(&audit_lost),
 				audit_rate_limit,
 				audit_backlog_limit);
 		audit_panic(message);
@@ -691,7 +691,7 @@
 		status_set.pid		 = audit_pid;
 		status_set.rate_limit	 = audit_rate_limit;
 		status_set.backlog_limit = audit_backlog_limit;
-		status_set.lost		 = atomic_read(&audit_lost);
+		status_set.lost		 = atomic_read_unchecked(&audit_lost);
 		status_set.backlog	 = skb_queue_len(&audit_skb_queue);
 		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_GET, 0, 0,
 				 &status_set, sizeof(status_set));
@@ -891,8 +891,10 @@
 			spin_unlock_irq(&tsk->sighand->siglock);
 		}
 		read_unlock(&tasklist_lock);
-		audit_send_reply(NETLINK_CB(skb).pid, seq, AUDIT_TTY_GET, 0, 0,
-				 &s, sizeof(s));
+
+		if (!err)
+			audit_send_reply(NETLINK_CB(skb).pid, seq,
+					 AUDIT_TTY_GET, 0, 0, &s, sizeof(s));
 		break;
 	}
 	case AUDIT_TTY_SET: {
diff -uriN linux-2.6.32.43/kernel/auditsc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/auditsc.c
--- linux-2.6.32.43/kernel/auditsc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/auditsc.c	2011-07-15 05:51:19.000000000 -0500
@@ -2113,7 +2113,7 @@
 }
 
 /* global counter which is incremented every time something logs in */
-static atomic_t session_id = ATOMIC_INIT(0);
+static atomic_unchecked_t session_id = ATOMIC_INIT(0);
 
 /**
  * audit_set_loginuid - set a task's audit_context loginuid
@@ -2126,7 +2126,7 @@
  */
 int audit_set_loginuid(struct task_struct *task, uid_t loginuid)
 {
-	unsigned int sessionid = atomic_inc_return(&session_id);
+	unsigned int sessionid = atomic_inc_return_unchecked(&session_id);
 	struct audit_context *context = task->audit_context;
 
 	if (context && context->in_syscall) {
diff -uriN linux-2.6.32.43/kernel/capability.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/capability.c
--- linux-2.6.32.43/kernel/capability.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/capability.c	2011-07-15 06:54:21.000000000 -0500
@@ -14,6 +14,7 @@
 #include <linux/security.h>
 #include <linux/syscalls.h>
 #include <linux/pid_namespace.h>
+#include <linux/vs_context.h>
 #include <asm/uaccess.h>
 
 /*
@@ -121,6 +122,7 @@
 	return 0;
 }
 
+
 /*
  * The only thing that can change the capabilities of the current
  * process is the current process. As such, we can't be in this code
@@ -288,6 +290,8 @@
 	return ret;
 }
 
+#include <linux/vserver/base.h>
+
 /**
  * capable - Determine if the current task has a superior capability in effect
  * @cap: The capability to be tested for
@@ -300,15 +304,37 @@
  */
 int capable(int cap)
 {
+	/* here for now so we don't require task locking */
+	if (vs_check_bit(VXC_CAP_MASK, cap) && !vx_mcaps(1L << cap))
+		return 0;
 	if (unlikely(!cap_valid(cap))) {
 		printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
 		BUG();
 	}
 
-	if (security_capable(cap) == 0) {
+	if (security_capable(cap) == 0 && gr_is_capable(cap)) {
 		current->flags |= PF_SUPERPRIV;
 		return 1;
 	}
 	return 0;
 }
+
+int capable_nolog(int cap)
+{
+	/* here for now so we don't require task locking */
+	if (vs_check_bit(VXC_CAP_MASK, cap) && !vx_mcaps(1L << cap))
+		return 0;
+	if (unlikely(!cap_valid(cap))) {
+		printk(KERN_CRIT "capable() called with invalid cap=%u\n", cap);
+		BUG();
+	}
+
+	if (security_capable(cap) == 0 && gr_is_capable_nolog(cap)) {
+		current->flags |= PF_SUPERPRIV;
+		return 1;
+	}
+	return 0;
+}
+
 EXPORT_SYMBOL(capable);
+EXPORT_SYMBOL(capable_nolog);
diff -uriN linux-2.6.32.43/kernel/cgroup.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/cgroup.c
--- linux-2.6.32.43/kernel/cgroup.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/cgroup.c	2011-07-15 05:51:19.000000000 -0500
@@ -536,6 +536,8 @@
 	struct hlist_head *hhead;
 	struct cg_cgroup_link *link;
 
+	pax_track_stack();
+
 	/* First see if we already have a cgroup group that matches
 	 * the desired set */
 	read_lock(&css_set_lock);
diff -uriN linux-2.6.32.43/kernel/compat.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/compat.c
--- linux-2.6.32.43/kernel/compat.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/compat.c	2011-07-15 05:50:11.000000000 -0500
@@ -900,7 +900,7 @@
 	compat_time_t i;
 	struct timeval tv;
 
-	do_gettimeofday(&tv);
+	vx_gettimeofday(&tv);
 	i = tv.tv_sec;
 
 	if (tloc) {
@@ -925,7 +925,7 @@
 	if (err)
 		return err;
 
-	do_settimeofday(&tv);
+	vx_settimeofday(&tv);
 	return 0;
 }
 
diff -uriN linux-2.6.32.43/kernel/configs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/configs.c
--- linux-2.6.32.43/kernel/configs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/configs.c	2011-07-15 05:51:19.000000000 -0500
@@ -73,8 +73,19 @@
 	struct proc_dir_entry *entry;
 
 	/* create the current config file */
+#if defined(CONFIG_GRKERNSEC_PROC_ADD) || defined(CONFIG_GRKERNSEC_HIDESYM)
+#if defined(CONFIG_GRKERNSEC_PROC_USER) || defined(CONFIG_GRKERNSEC_HIDESYM)
+	entry = proc_create("config.gz", S_IFREG | S_IRUSR, NULL,
+			    &ikconfig_file_ops);
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	entry = proc_create("config.gz", S_IFREG | S_IRUSR | S_IRGRP, NULL,
+			    &ikconfig_file_ops);
+#endif
+#else
 	entry = proc_create("config.gz", S_IFREG | S_IRUGO, NULL,
 			    &ikconfig_file_ops);
+#endif
+
 	if (!entry)
 		return -ENOMEM;
 
diff -uriN linux-2.6.32.43/kernel/cpu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/cpu.c
--- linux-2.6.32.43/kernel/cpu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/cpu.c	2011-07-15 05:51:19.000000000 -0500
@@ -19,7 +19,7 @@
 /* Serializes the updates to cpu_online_mask, cpu_present_mask */
 static DEFINE_MUTEX(cpu_add_remove_lock);
 
-static __cpuinitdata RAW_NOTIFIER_HEAD(cpu_chain);
+static RAW_NOTIFIER_HEAD(cpu_chain);
 
 /* If set, cpu_up and cpu_down will return -EBUSY and do nothing.
  * Should always be manipulated under cpu_add_remove_lock
diff -uriN linux-2.6.32.43/kernel/cred.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/cred.c
--- linux-2.6.32.43/kernel/cred.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/cred.c	2011-07-15 05:51:19.000000000 -0500
@@ -160,6 +160,8 @@
  */
 void __put_cred(struct cred *cred)
 {
+	pax_track_stack();
+
 	kdebug("__put_cred(%p{%d,%d})", cred,
 	       atomic_read(&cred->usage),
 	       read_cred_subscribers(cred));
@@ -184,6 +186,8 @@
 {
 	struct cred *cred;
 
+	pax_track_stack();
+
 	kdebug("exit_creds(%u,%p,%p,{%d,%d})", tsk->pid, tsk->real_cred, tsk->cred,
 	       atomic_read(&tsk->cred->usage),
 	       read_cred_subscribers(tsk->cred));
@@ -222,6 +226,8 @@
 {
 	const struct cred *cred;
 
+	pax_track_stack();
+
 	rcu_read_lock();
 
 	do {
@@ -241,6 +247,8 @@
 {
 	struct cred *new;
 
+	pax_track_stack();
+
 	new = kmem_cache_zalloc(cred_jar, GFP_KERNEL);
 	if (!new)
 		return NULL;
@@ -289,6 +297,8 @@
 	const struct cred *old;
 	struct cred *new;
 
+	pax_track_stack();
+
 	validate_process_creds();
 
 	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
@@ -335,6 +345,8 @@
 	struct thread_group_cred *tgcred = NULL;
 	struct cred *new;
 
+	pax_track_stack();
+
 #ifdef CONFIG_KEYS
 	tgcred = kmalloc(sizeof(*tgcred), GFP_KERNEL);
 	if (!tgcred)
@@ -441,6 +453,8 @@
 	struct cred *new;
 	int ret;
 
+	pax_track_stack();
+
 	mutex_init(&p->cred_guard_mutex);
 
 	if (
@@ -528,6 +542,8 @@
 	struct task_struct *task = current;
 	const struct cred *old = task->real_cred;
 
+	pax_track_stack();
+
 	kdebug("commit_creds(%p{%d,%d})", new,
 	       atomic_read(&new->usage),
 	       read_cred_subscribers(new));
@@ -544,6 +560,8 @@
 
 	get_cred(new); /* we will require a ref for the subj creds too */
 
+	gr_set_role_label(task, new->uid, new->gid);
+
 	/* dumpability changes */
 	if (old->euid != new->euid ||
 	    old->egid != new->egid ||
@@ -606,6 +624,8 @@
  */
 void abort_creds(struct cred *new)
 {
+	pax_track_stack();
+
 	kdebug("abort_creds(%p{%d,%d})", new,
 	       atomic_read(&new->usage),
 	       read_cred_subscribers(new));
@@ -629,6 +649,8 @@
 {
 	const struct cred *old = current->cred;
 
+	pax_track_stack();
+
 	kdebug("override_creds(%p{%d,%d})", new,
 	       atomic_read(&new->usage),
 	       read_cred_subscribers(new));
@@ -658,6 +680,8 @@
 {
 	const struct cred *override = current->cred;
 
+	pax_track_stack();
+
 	kdebug("revert_creds(%p{%d,%d})", old,
 	       atomic_read(&old->usage),
 	       read_cred_subscribers(old));
@@ -704,6 +728,8 @@
 	const struct cred *old;
 	struct cred *new;
 
+	pax_track_stack();
+
 	new = kmem_cache_alloc(cred_jar, GFP_KERNEL);
 	if (!new)
 		return NULL;
@@ -758,6 +784,8 @@
  */
 int set_security_override(struct cred *new, u32 secid)
 {
+	pax_track_stack();
+
 	return security_kernel_act_as(new, secid);
 }
 EXPORT_SYMBOL(set_security_override);
@@ -777,6 +805,8 @@
 	u32 secid;
 	int ret;
 
+	pax_track_stack();
+
 	ret = security_secctx_to_secid(secctx, strlen(secctx), &secid);
 	if (ret < 0)
 		return ret;
diff -uriN linux-2.6.32.43/kernel/exit.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/exit.c
--- linux-2.6.32.43/kernel/exit.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/exit.c	2011-07-15 05:51:19.000000000 -0500
@@ -48,6 +48,10 @@
 #include <linux/fs_struct.h>
 #include <linux/init_task.h>
 #include <linux/perf_event.h>
+#include <linux/vs_limit.h>
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
+#include <linux/vs_pid.h>
 #include <trace/events/sched.h>
 
 #include <asm/uaccess.h>
@@ -55,6 +59,10 @@
 #include <asm/pgtable.h>
 #include <asm/mmu_context.h>
 
+#ifdef CONFIG_GRKERNSEC
+extern rwlock_t grsec_exec_file_lock;
+#endif
+
 static void exit_mm(struct task_struct * tsk);
 
 static void __unhash_process(struct task_struct *p)
@@ -174,6 +182,8 @@
 	struct task_struct *leader;
 	int zap_leader;
 repeat:
+	gr_del_task_from_ip_table(p);
+
 	tracehook_prepare_release_task(p);
 	/* don't need to get the RCU readlock here - the process is dead and
 	 * can't be modifying its own credentials */
@@ -341,11 +351,22 @@
 {
 	write_lock_irq(&tasklist_lock);
 
+#ifdef CONFIG_GRKERNSEC
+	write_lock(&grsec_exec_file_lock);
+	if (current->exec_file) {
+		fput(current->exec_file);
+		current->exec_file = NULL;
+	}
+	write_unlock(&grsec_exec_file_lock);
+#endif
+
 	ptrace_unlink(current);
 	/* Reparent to init */
 	current->real_parent = current->parent = kthreadd_task;
 	list_move_tail(&current->sibling, &current->real_parent->children);
 
+	gr_set_kernel_label(current);
+
 	/* Set the exit signal to SIGCHLD so we signal init on exit */
 	current->exit_signal = SIGCHLD;
 
@@ -397,7 +418,7 @@
 	 * know it'll be handled, so that they don't get converted to
 	 * SIGKILL or just silently dropped.
 	 */
-	current->sighand->action[(sig)-1].sa.sa_handler = (void __user *)2;
+	current->sighand->action[(sig)-1].sa.sa_handler = (__force void __user *)2;
 	recalc_sigpending();
 	spin_unlock_irq(&current->sighand->siglock);
 	return 0;
@@ -433,6 +454,17 @@
 	vsnprintf(current->comm, sizeof(current->comm), name, args);
 	va_end(args);
 
+#ifdef CONFIG_GRKERNSEC
+	write_lock(&grsec_exec_file_lock);
+	if (current->exec_file) {
+		fput(current->exec_file);
+		current->exec_file = NULL;
+	}
+	write_unlock(&grsec_exec_file_lock);
+#endif
+
+	gr_set_kernel_label(current);
+
 	/*
 	 * If we were started as result of loading a module, close all of the
 	 * user space pages.  We don't need them, and if we didn't close them
@@ -495,9 +527,11 @@
 					filp_close(file, files);
 					cond_resched();
 				}
+				vx_openfd_dec(i);
 			}
 			i++;
 			set >>= 1;
+			cond_resched();
 		}
 	}
 }
@@ -897,17 +931,17 @@
 	struct task_struct *tsk = current;
 	int group_dead;
 
-	profile_task_exit(tsk);
-
-	WARN_ON(atomic_read(&tsk->fs_excl));
-
+	/*
+	 * Check this first since set_fs() below depends on
+	 * current_thread_info(), which we better not access when we're in
+	 * interrupt context.  Other than that, we want to do the set_fs()
+	 * as early as possible.
+	 */
 	if (unlikely(in_interrupt()))
 		panic("Aiee, killing interrupt handler!");
-	if (unlikely(!tsk->pid))
-		panic("Attempted to kill the idle task!");
 
 	/*
-	 * If do_exit is called because this processes oopsed, it's possible
+	 * If do_exit is called because this processes Oops'ed, it's possible
 	 * that get_fs() was left as KERNEL_DS, so reset it to USER_DS before
 	 * continuing. Amongst other possible reasons, this is to prevent
 	 * mm_release()->clear_child_tid() from writing to a user-controlled
@@ -915,6 +949,13 @@
 	 */
 	set_fs(USER_DS);
 
+	profile_task_exit(tsk);
+
+	WARN_ON(atomic_read(&tsk->fs_excl));
+
+	if (unlikely(!tsk->pid))
+		panic("Attempted to kill the idle task!");
+
 	tracehook_report_exit(&code);
 
 	validate_creds_for_do_exit(tsk);
@@ -973,6 +1014,9 @@
 	tsk->exit_code = code;
 	taskstats_exit(tsk, group_dead);
 
+	gr_acl_handle_psacct(tsk, code);
+	gr_acl_handle_exit();
+
 	exit_mm(tsk);
 
 	if (group_dead)
@@ -1027,11 +1071,16 @@
 
 	validate_creds_for_do_exit(tsk);
 
+	/* needs to stay after exit_notify() */
+	exit_vx_info(tsk, code);
+	exit_nx_info(tsk);
+
 	preempt_disable();
 	exit_rcu();
 	/* causes final put_task_struct in finish_task_switch(). */
 	tsk->state = TASK_DEAD;
 	schedule();
+	printk("bad task: %p [%lx]\n", current, current->state);
 	BUG();
 	/* Avoid "noreturn function does return".  */
 	for (;;)
@@ -1188,7 +1237,7 @@
 
 	if (unlikely(wo->wo_flags & WNOWAIT)) {
 		int exit_code = p->exit_code;
-		int why, status;
+		int why;
 
 		get_task_struct(p);
 		read_unlock(&tasklist_lock);
diff -uriN linux-2.6.32.43/kernel/fork.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/fork.c
--- linux-2.6.32.43/kernel/fork.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/fork.c	2011-07-15 07:06:03.000000000 -0500
@@ -64,6 +64,10 @@
 #include <linux/magic.h>
 #include <linux/perf_event.h>
 #include <linux/posix-timers.h>
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
+#include <linux/vs_limit.h>
+#include <linux/vs_memory.h>
 
 #include <asm/pgtable.h>
 #include <asm/pgalloc.h>
@@ -151,6 +155,8 @@
 	account_kernel_stack(tsk->stack, -1);
 	free_thread_info(tsk->stack);
 	rt_mutex_debug_task_free(tsk);
+	clr_vx_info(&tsk->vx_info);
+	clr_nx_info(&tsk->nx_info);
 	ftrace_graph_exit_task(tsk);
 	free_task_struct(tsk);
 }
@@ -253,7 +259,7 @@
 	*stackend = STACK_END_MAGIC;	/* for overflow detection */
 
 #ifdef CONFIG_CC_STACKPROTECTOR
-	tsk->stack_canary = get_random_int();
+	tsk->stack_canary = pax_get_random_long();
 #endif
 
 	/* One for us, one for whoever does the "release_task()" (usually parent) */
@@ -293,9 +299,11 @@
 	mm->locked_vm = 0;
 	mm->mmap = NULL;
 	mm->mmap_cache = NULL;
-	mm->free_area_cache = oldmm->mmap_base;
-	mm->cached_hole_size = ~0UL;
+	mm->free_area_cache = oldmm->free_area_cache;
+	mm->cached_hole_size = oldmm->cached_hole_size;
 	mm->map_count = 0;
+	__set_mm_counter(mm, file_rss, 0);
+	__set_mm_counter(mm, anon_rss, 0);
 	cpumask_clear(mm_cpumask(mm));
 	mm->mm_rb = RB_ROOT;
 	rb_link = &mm->mm_rb.rb_node;
@@ -311,7 +319,7 @@
 
 		if (mpnt->vm_flags & VM_DONTCOPY) {
 			long pages = vma_pages(mpnt);
-			mm->total_vm -= pages;
+			vx_vmpages_sub(mm, pages);
 			vm_stat_account(mm, mpnt->vm_flags, mpnt->vm_file,
 								-pages);
 			continue;
@@ -335,6 +343,7 @@
 		tmp->vm_flags &= ~VM_LOCKED;
 		tmp->vm_mm = mm;
 		tmp->vm_next = tmp->vm_prev = NULL;
+		tmp->vm_mirror = NULL;
 		anon_vma_link(tmp);
 		file = tmp->vm_file;
 		if (file) {
@@ -384,6 +393,31 @@
 		if (retval)
 			goto out;
 	}
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (oldmm->pax_flags & MF_PAX_SEGMEXEC) {
+		struct vm_area_struct *mpnt_m;
+
+		for (mpnt = oldmm->mmap, mpnt_m = mm->mmap; mpnt; mpnt = mpnt->vm_next, mpnt_m = mpnt_m->vm_next) {
+			BUG_ON(!mpnt_m || mpnt_m->vm_mirror || mpnt->vm_mm != oldmm || mpnt_m->vm_mm != mm);
+
+			if (!mpnt->vm_mirror)
+				continue;
+
+			if (mpnt->vm_end <= SEGMEXEC_TASK_SIZE) {
+				BUG_ON(mpnt->vm_mirror->vm_mirror != mpnt);
+				mpnt->vm_mirror = mpnt_m;
+			} else {
+				BUG_ON(mpnt->vm_mirror->vm_mirror == mpnt || mpnt->vm_mirror->vm_mirror->vm_mm != mm);
+				mpnt_m->vm_mirror = mpnt->vm_mirror->vm_mirror;
+				mpnt_m->vm_mirror->vm_mirror = mpnt_m;
+				mpnt->vm_mirror->vm_mirror = mpnt;
+			}
+		}
+		BUG_ON(mpnt_m);
+	}
+#endif
+
 	/* a new mm has just been created */
 	arch_dup_mmap(oldmm, mm);
 	retval = 0;
@@ -455,8 +489,8 @@
 		(current->mm->flags & MMF_INIT_MASK) : default_dump_filter;
 	mm->core_state = NULL;
 	mm->nr_ptes = 0;
-	set_mm_counter(mm, file_rss, 0);
-	set_mm_counter(mm, anon_rss, 0);
+	__set_mm_counter(mm, file_rss, 0);
+	__set_mm_counter(mm, anon_rss, 0);
 	spin_lock_init(&mm->page_table_lock);
 	mm->free_area_cache = TASK_UNMAPPED_BASE;
 	mm->cached_hole_size = ~0UL;
@@ -466,6 +500,7 @@
 	if (likely(!mm_alloc_pgd(mm))) {
 		mm->def_flags = 0;
 		mmu_notifier_mm_init(mm);
+		set_vx_info(&mm->mm_vx_info, p->vx_info);
 		return mm;
 	}
 
@@ -499,6 +534,7 @@
 	mm_free_pgd(mm);
 	destroy_context(mm);
 	mmu_notifier_mm_destroy(mm);
+	clr_vx_info(&mm->mm_vx_info);
 	free_mm(mm);
 }
 EXPORT_SYMBOL_GPL(__mmdrop);
@@ -634,6 +670,7 @@
 		goto fail_nomem;
 
 	memcpy(mm, oldmm, sizeof(*mm));
+	mm->mm_vx_info = NULL;
 
 	/* Initializing for Swap token stuff */
 	mm->token_priority = 0;
@@ -672,6 +709,7 @@
 	 * If init_new_context() failed, we cannot use mmput() to free the mm
 	 * because it calls destroy_context()
 	 */
+	clr_vx_info(&mm->mm_vx_info);
 	mm_free_pgd(mm);
 	free_mm(mm);
 	return NULL;
@@ -734,13 +772,14 @@
 			write_unlock(&fs->lock);
 			return -EAGAIN;
 		}
-		fs->users++;
+		atomic_inc(&fs->users);
 		write_unlock(&fs->lock);
 		return 0;
 	}
 	tsk->fs = copy_fs_struct(fs);
 	if (!tsk->fs)
 		return -ENOMEM;
+	gr_set_chroot_entries(tsk, &tsk->fs->root);
 	return 0;
 }
 
@@ -986,6 +1025,8 @@
 	int retval;
 	struct task_struct *p;
 	int cgroup_callbacks_done = 0;
+	struct vx_info *vxi;
+	struct nx_info *nxi;
 
 	if ((clone_flags & (CLONE_NEWNS|CLONE_FS)) == (CLONE_NEWNS|CLONE_FS))
 		return ERR_PTR(-EINVAL);
@@ -1032,12 +1073,32 @@
 	DEBUG_LOCKS_WARN_ON(!p->hardirqs_enabled);
 	DEBUG_LOCKS_WARN_ON(!p->softirqs_enabled);
 #endif
+	init_vx_info(&p->vx_info, current_vx_info());
+	init_nx_info(&p->nx_info, current_nx_info());
+
+	/* check vserver memory */
+	if (p->mm && !(clone_flags & CLONE_VM)) {
+		if (vx_vmpages_avail(p->mm, p->mm->total_vm))
+			vx_pages_add(p->vx_info, RLIMIT_AS, p->mm->total_vm);
+		else
+			goto bad_fork_free;
+	}
+	if (p->mm && vx_flags(VXF_FORK_RSS, 0)) {
+		if (!vx_rss_avail(p->mm, get_mm_counter(p->mm, file_rss)))
+			goto bad_fork_cleanup_vm;
+	}
 	retval = -EAGAIN;
+
+	if (!vx_nproc_avail(1))
+		goto bad_fork_cleanup_vm;
+
+      gr_learn_resource(p, RLIMIT_NPROC, atomic_read(&p->real_cred->user->processes), 0);
+ 
 	if (atomic_read(&p->real_cred->user->processes) >=
 			p->signal->rlim[RLIMIT_NPROC].rlim_cur) {
-		if (!capable(CAP_SYS_ADMIN) && !capable(CAP_SYS_RESOURCE) &&
-		    p->real_cred->user != INIT_USER)
-			goto bad_fork_free;
+		if (p->real_cred->user != INIT_USER &&
+		    !capable(CAP_SYS_RESOURCE) && !capable(CAP_SYS_ADMIN))
+			goto bad_fork_cleanup_vm;
 	}
 
 	retval = copy_creds(p, clone_flags);
@@ -1183,6 +1244,8 @@
 			goto bad_fork_free_pid;
 	}
 
+	gr_copy_label(p);
+
 	p->set_child_tid = (clone_flags & CLONE_CHILD_SETTID) ? child_tidptr : NULL;
 	/*
 	 * Clear TID on mm_release()?
@@ -1289,6 +1352,18 @@
 
 	total_forks++;
 	spin_unlock(&current->sighand->siglock);
+
+	/* p is copy of current */
+	vxi = p->vx_info;
+	if (vxi) {
+		claim_vx_info(vxi, p);
+		atomic_inc(&vxi->cvirt.nr_threads);
+		atomic_inc_unchecked(&vxi->cvirt.total_forks);
+		vx_nproc_inc(p);
+	}
+	nxi = p->nx_info;
+	if (nxi)
+		claim_nx_info(nxi, p);
 	write_unlock_irq(&tasklist_lock);
 	proc_fork_connector(p);
 	cgroup_post_fork(p);
@@ -1330,9 +1405,14 @@
 bad_fork_cleanup_count:
 	atomic_dec(&p->cred->user->processes);
 	exit_creds(p);
+bad_fork_cleanup_vm:
+	if (p->mm && !(clone_flags & CLONE_VM))
+		vx_pages_sub(p->vx_info, RLIMIT_AS, p->mm->total_vm);
 bad_fork_free:
 	free_task(p);
 fork_out:
+	gr_log_forkfail(retval);
+
 	return ERR_PTR(retval);
 }
 
@@ -1426,6 +1506,8 @@
 		if (clone_flags & CLONE_PARENT_SETTID)
 			put_user(nr, parent_tidptr);
 
+		gr_handle_brute_check();
+
 		if (clone_flags & CLONE_VFORK) {
 			p->vfork_done = &vfork;
 			init_completion(&vfork);
@@ -1558,7 +1640,7 @@
 		return 0;
 
 	/* don't need lock here; in the worst case we'll do useless copy */
-	if (fs->users == 1)
+	if (atomic_read(&fs->users) == 1)
 		return 0;
 
 	*new_fsp = copy_fs_struct(fs);
@@ -1681,7 +1763,8 @@
 			fs = current->fs;
 			write_lock(&fs->lock);
 			current->fs = new_fs;
-			if (--fs->users)
+			gr_set_chroot_entries(current, &current->fs->root);
+			if (atomic_dec_return(&fs->users))
 				new_fs = NULL;
 			else
 				new_fs = fs;
diff -uriN linux-2.6.32.43/kernel/futex.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/futex.c
--- linux-2.6.32.43/kernel/futex.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/futex.c	2011-07-15 05:51:19.000000000 -0500
@@ -54,6 +54,7 @@
 #include <linux/mount.h>
 #include <linux/pagemap.h>
 #include <linux/syscalls.h>
+#include <linux/ptrace.h>
 #include <linux/signal.h>
 #include <linux/module.h>
 #include <linux/magic.h>
@@ -221,6 +222,11 @@
 	struct page *page;
 	int err;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && address >= SEGMEXEC_TASK_SIZE)
+		return -EFAULT;
+#endif
+
 	/*
 	 * The futex address must be "naturally" aligned.
 	 */
@@ -1789,6 +1795,8 @@
 	struct futex_q q;
 	int ret;
 
+	pax_track_stack();
+
 	if (!bitset)
 		return -EINVAL;
 
@@ -1841,7 +1849,7 @@
 
 	restart = &current_thread_info()->restart_block;
 	restart->fn = futex_wait_restart;
-	restart->futex.uaddr = (u32 *)uaddr;
+	restart->futex.uaddr = uaddr;
 	restart->futex.val = val;
 	restart->futex.time = abs_time->tv64;
 	restart->futex.bitset = bitset;
@@ -2203,6 +2211,8 @@
 	struct futex_q q;
 	int res, ret;
 
+	pax_track_stack();
+
 	if (!bitset)
 		return -EINVAL;
 
@@ -2377,7 +2387,9 @@
 {
 	struct robust_list_head __user *head;
 	unsigned long ret;
+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
 	const struct cred *cred = current_cred(), *pcred;
+#endif
 
 	if (!futex_cmpxchg_enabled)
 		return -ENOSYS;
@@ -2393,11 +2405,16 @@
 		if (!p)
 			goto err_unlock;
 		ret = -EPERM;
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+		if (!ptrace_may_access(p, PTRACE_MODE_READ))
+			goto err_unlock;
+#else
 		pcred = __task_cred(p);
 		if (cred->euid != pcred->euid &&
 		    cred->euid != pcred->uid &&
 		    !capable(CAP_SYS_PTRACE))
 			goto err_unlock;
+#endif
 		head = p->robust_list;
 		rcu_read_unlock();
 	}
@@ -2459,7 +2476,7 @@
  */
 static inline int fetch_robust_entry(struct robust_list __user **entry,
 				     struct robust_list __user * __user *head,
-				     int *pi)
+				     unsigned int *pi)
 {
 	unsigned long uentry;
 
@@ -2640,6 +2657,7 @@
 {
 	u32 curval;
 	int i;
+	mm_segment_t oldfs;
 
 	/*
 	 * This will fail and we want it. Some arch implementations do
@@ -2651,7 +2669,10 @@
 	 * implementation, the non functional ones will return
 	 * -ENOSYS.
 	 */
+	oldfs = get_fs();
+	set_fs(USER_DS);
 	curval = cmpxchg_futex_value_locked(NULL, 0, 0);
+	set_fs(oldfs);
 	if (curval == -EFAULT)
 		futex_cmpxchg_enabled = 1;
 
diff -uriN linux-2.6.32.43/kernel/futex_compat.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/futex_compat.c
--- linux-2.6.32.43/kernel/futex_compat.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/futex_compat.c	2011-07-15 05:51:19.000000000 -0500
@@ -10,6 +10,7 @@
 #include <linux/compat.h>
 #include <linux/nsproxy.h>
 #include <linux/futex.h>
+#include <linux/ptrace.h>
 
 #include <asm/uaccess.h>
 
@@ -135,7 +136,10 @@
 {
 	struct compat_robust_list_head __user *head;
 	unsigned long ret;
-	const struct cred *cred = current_cred(), *pcred;
+#ifndef CONFIG_GRKERNSEC_PROC_MEMMAP
+	const struct cred *cred = current_cred();
+	const struct cred *pcred;
+#endif
 
 	if (!futex_cmpxchg_enabled)
 		return -ENOSYS;
@@ -151,11 +155,16 @@
 		if (!p)
 			goto err_unlock;
 		ret = -EPERM;
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+		if (!ptrace_may_access(p, PTRACE_MODE_READ))
+			goto err_unlock;
+#else
 		pcred = __task_cred(p);
 		if (cred->euid != pcred->euid &&
 		    cred->euid != pcred->uid &&
 		    !capable(CAP_SYS_PTRACE))
 			goto err_unlock;
+#endif
 		head = p->compat_robust_list;
 		read_unlock(&tasklist_lock);
 	}
diff -uriN linux-2.6.32.43/kernel/gcov/base.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/gcov/base.c
--- linux-2.6.32.43/kernel/gcov/base.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/gcov/base.c	2011-07-15 05:51:19.000000000 -0500
@@ -102,11 +102,6 @@
 }
 
 #ifdef CONFIG_MODULES
-static inline int within(void *addr, void *start, unsigned long size)
-{
-	return ((addr >= start) && (addr < start + size));
-}
-
 /* Update list and generate events when modules are unloaded. */
 static int gcov_module_notifier(struct notifier_block *nb, unsigned long event,
 				void *data)
@@ -121,7 +116,7 @@
 	prev = NULL;
 	/* Remove entries located in module from linked list. */
 	for (info = gcov_info_head; info; info = info->next) {
-		if (within(info, mod->module_core, mod->core_size)) {
+		if (within_module_core_rw((unsigned long)info, mod)) {
 			if (prev)
 				prev->next = info->next;
 			else
diff -uriN linux-2.6.32.43/kernel/hrtimer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/hrtimer.c
--- linux-2.6.32.43/kernel/hrtimer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/hrtimer.c	2011-07-15 05:51:19.000000000 -0500
@@ -1391,7 +1391,7 @@
 	local_irq_restore(flags);
 }
 
-static void run_hrtimer_softirq(struct softirq_action *h)
+static void run_hrtimer_softirq(void)
 {
 	hrtimer_peek_ahead_timers();
 }
diff -uriN linux-2.6.32.43/kernel/kallsyms.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kallsyms.c
--- linux-2.6.32.43/kernel/kallsyms.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kallsyms.c	2011-07-15 05:51:19.000000000 -0500
@@ -11,6 +11,9 @@
  *      Changed the compression method from stem compression to "table lookup"
  *      compression (see scripts/kallsyms.c for a more complete description)
  */
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+#define __INCLUDED_BY_HIDESYM 1
+#endif
 #include <linux/kallsyms.h>
 #include <linux/module.h>
 #include <linux/init.h>
@@ -51,12 +54,33 @@
 
 static inline int is_kernel_inittext(unsigned long addr)
 {
+	if (system_state != SYSTEM_BOOTING)
+		return 0;
+
 	if (addr >= (unsigned long)_sinittext
 	    && addr <= (unsigned long)_einittext)
 		return 1;
 	return 0;
 }
 
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+#ifdef CONFIG_MODULES
+static inline int is_module_text(unsigned long addr)
+{
+	if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END)
+		return 1;
+
+	addr = ktla_ktva(addr);
+	return (unsigned long)MODULES_EXEC_VADDR <= addr && addr <= (unsigned long)MODULES_EXEC_END;
+}
+#else
+static inline int is_module_text(unsigned long addr)
+{
+	return 0;
+}
+#endif
+#endif
+
 static inline int is_kernel_text(unsigned long addr)
 {
 	if ((addr >= (unsigned long)_stext && addr <= (unsigned long)_etext) ||
@@ -67,13 +91,28 @@
 
 static inline int is_kernel(unsigned long addr)
 {
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+	if (is_kernel_text(addr) || is_kernel_inittext(addr))
+		return 1;
+
+	if (ktla_ktva((unsigned long)_text) <= addr && addr < (unsigned long)_end)
+#else
 	if (addr >= (unsigned long)_stext && addr <= (unsigned long)_end)
+#endif
+
 		return 1;
 	return in_gate_area_no_task(addr);
 }
 
 static int is_ksym_addr(unsigned long addr)
 {
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+	if (is_module_text(addr))
+		return 0;
+#endif
+
 	if (all_var)
 		return is_kernel(addr);
 
@@ -413,7 +452,6 @@
 
 static void reset_iter(struct kallsym_iter *iter, loff_t new_pos)
 {
-	iter->name[0] = '\0';
 	iter->nameoff = get_symbol_offset(new_pos);
 	iter->pos = new_pos;
 }
@@ -461,6 +499,11 @@
 {
 	struct kallsym_iter *iter = m->private;
 
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	if (current_uid())
+		return 0;
+#endif
+
 	/* Some debugging symbols have no name.  Ignore them. */
 	if (!iter->name[0])
 		return 0;
@@ -501,7 +544,7 @@
 	struct kallsym_iter *iter;
 	int ret;
 
-	iter = kmalloc(sizeof(*iter), GFP_KERNEL);
+	iter = kzalloc(sizeof(*iter), GFP_KERNEL);
 	if (!iter)
 		return -ENOMEM;
 	reset_iter(iter, 0);
diff -uriN linux-2.6.32.43/kernel/kgdb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kgdb.c
--- linux-2.6.32.43/kernel/kgdb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kgdb.c	2011-07-15 05:51:19.000000000 -0500
@@ -86,7 +86,7 @@
 /* Guard for recursive entry */
 static int			exception_level;
 
-static struct kgdb_io		*kgdb_io_ops;
+static const struct kgdb_io	*kgdb_io_ops;
 static DEFINE_SPINLOCK(kgdb_registration_lock);
 
 /* kgdb console driver is loaded */
@@ -123,7 +123,7 @@
  */
 static atomic_t			passive_cpu_wait[NR_CPUS];
 static atomic_t			cpu_in_kgdb[NR_CPUS];
-atomic_t			kgdb_setting_breakpoint;
+atomic_unchecked_t		kgdb_setting_breakpoint;
 
 struct task_struct		*kgdb_usethread;
 struct task_struct		*kgdb_contthread;
@@ -140,7 +140,7 @@
 					sizeof(unsigned long)];
 
 /* to keep track of the CPU which is doing the single stepping*/
-atomic_t			kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
+atomic_unchecked_t		kgdb_cpu_doing_single_step = ATOMIC_INIT(-1);
 
 /*
  * If you are debugging a problem where roundup (the collection of
@@ -815,7 +815,7 @@
 		return 0;
 	if (kgdb_connected)
 		return 1;
-	if (atomic_read(&kgdb_setting_breakpoint))
+	if (atomic_read_unchecked(&kgdb_setting_breakpoint))
 		return 1;
 	if (print_wait)
 		printk(KERN_CRIT "KGDB: Waiting for remote debugger\n");
@@ -1426,8 +1426,8 @@
 	 * instance of the exception handler wanted to come into the
 	 * debugger on a different CPU via a single step
 	 */
-	if (atomic_read(&kgdb_cpu_doing_single_step) != -1 &&
-	    atomic_read(&kgdb_cpu_doing_single_step) != cpu) {
+	if (atomic_read_unchecked(&kgdb_cpu_doing_single_step) != -1 &&
+	    atomic_read_unchecked(&kgdb_cpu_doing_single_step) != cpu) {
 
 		atomic_set(&kgdb_active, -1);
 		touch_softlockup_watchdog();
@@ -1634,7 +1634,7 @@
  *
  *	Register it with the KGDB core.
  */
-int kgdb_register_io_module(struct kgdb_io *new_kgdb_io_ops)
+int kgdb_register_io_module(const struct kgdb_io *new_kgdb_io_ops)
 {
 	int err;
 
@@ -1679,7 +1679,7 @@
  *
  *	Unregister it with the KGDB core.
  */
-void kgdb_unregister_io_module(struct kgdb_io *old_kgdb_io_ops)
+void kgdb_unregister_io_module(const struct kgdb_io *old_kgdb_io_ops)
 {
 	BUG_ON(kgdb_connected);
 
@@ -1712,11 +1712,11 @@
  */
 void kgdb_breakpoint(void)
 {
-	atomic_set(&kgdb_setting_breakpoint, 1);
+	atomic_set_unchecked(&kgdb_setting_breakpoint, 1);
 	wmb(); /* Sync point before breakpoint */
 	arch_kgdb_breakpoint();
 	wmb(); /* Sync point after breakpoint */
-	atomic_set(&kgdb_setting_breakpoint, 0);
+	atomic_set_unchecked(&kgdb_setting_breakpoint, 0);
 }
 EXPORT_SYMBOL_GPL(kgdb_breakpoint);
 
diff -uriN linux-2.6.32.43/kernel/kmod.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kmod.c
--- linux-2.6.32.43/kernel/kmod.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kmod.c	2011-07-15 05:51:19.000000000 -0500
@@ -65,13 +65,12 @@
  * If module auto-loading support is disabled then this function
  * becomes a no-operation.
  */
-int __request_module(bool wait, const char *fmt, ...)
+static int ____request_module(bool wait, char *module_param, const char *fmt, va_list ap)
 {
-	va_list args;
 	char module_name[MODULE_NAME_LEN];
 	unsigned int max_modprobes;
 	int ret;
-	char *argv[] = { modprobe_path, "-q", "--", module_name, NULL };
+	char *argv[] = { modprobe_path, "-q", "--", module_name, module_param, NULL };
 	static char *envp[] = { "HOME=/",
 				"TERM=linux",
 				"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
@@ -84,12 +83,24 @@
 	if (ret)
 		return ret;
 
-	va_start(args, fmt);
-	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, args);
-	va_end(args);
+	ret = vsnprintf(module_name, MODULE_NAME_LEN, fmt, ap);
 	if (ret >= MODULE_NAME_LEN)
 		return -ENAMETOOLONG;
 
+#ifdef CONFIG_GRKERNSEC_MODHARDEN
+	if (!current_uid()) {
+		/* hack to workaround consolekit/udisks stupidity */
+		read_lock(&tasklist_lock);
+		if (!strcmp(current->comm, "mount") &&
+		    current->real_parent && !strncmp(current->real_parent->comm, "udisk", 5)) {
+			read_unlock(&tasklist_lock);
+			printk(KERN_ALERT "grsec: denied attempt to auto-load fs module %.64s by udisks\n", module_name);
+			return -EPERM;
+		}
+		read_unlock(&tasklist_lock);
+	}
+#endif
+
 	/* If modprobe needs a service that is in a module, we get a recursive
 	 * loop.  Limit the number of running kmod threads to max_threads/2 or
 	 * MAX_KMOD_CONCURRENT, whichever is the smaller.  A cleaner method
@@ -121,6 +132,48 @@
 	atomic_dec(&kmod_concurrent);
 	return ret;
 }
+
+int ___request_module(bool wait, char *module_param, const char *fmt, ...)
+{
+	va_list args;
+	int ret;
+
+	va_start(args, fmt);
+	ret = ____request_module(wait, module_param, fmt, args);
+	va_end(args);
+
+	return ret;
+}
+
+int __request_module(bool wait, const char *fmt, ...)
+{
+	va_list args;
+	int ret;
+
+#ifdef CONFIG_GRKERNSEC_MODHARDEN
+	if (current_uid()) {
+		char module_param[MODULE_NAME_LEN];
+
+		memset(module_param, 0, sizeof(module_param));
+
+		snprintf(module_param, sizeof(module_param) - 1, "grsec_modharden_normal%u_", current_uid());
+
+		va_start(args, fmt);
+		ret = ____request_module(wait, module_param, fmt, args);
+		va_end(args);
+
+		return ret;
+	}
+#endif
+
+	va_start(args, fmt);
+	ret = ____request_module(wait, NULL, fmt, args);
+	va_end(args);
+
+	return ret;
+}
+
+
 EXPORT_SYMBOL(__request_module);
 #endif /* CONFIG_MODULES */
 
diff -uriN linux-2.6.32.43/kernel/kprobes.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kprobes.c
--- linux-2.6.32.43/kernel/kprobes.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kprobes.c	2011-07-15 05:51:19.000000000 -0500
@@ -183,7 +183,7 @@
 	 * kernel image and loaded module images reside. This is required
 	 * so x86_64 can correctly handle the %rip-relative fixups.
 	 */
-	kip->insns = module_alloc(PAGE_SIZE);
+	kip->insns = module_alloc_exec(PAGE_SIZE);
 	if (!kip->insns) {
 		kfree(kip);
 		return NULL;
@@ -220,7 +220,7 @@
 		 */
 		if (!list_is_singular(&kprobe_insn_pages)) {
 			list_del(&kip->list);
-			module_free(NULL, kip->insns);
+			module_free_exec(NULL, kip->insns);
 			kfree(kip);
 		}
 		return 1;
@@ -1189,7 +1189,7 @@
 {
 	int i, err = 0;
 	unsigned long offset = 0, size = 0;
-	char *modname, namebuf[128];
+	char *modname, namebuf[KSYM_NAME_LEN];
 	const char *symbol_name;
 	void *addr;
 	struct kprobe_blackpoint *kb;
@@ -1304,7 +1304,7 @@
 	const char *sym = NULL;
 	unsigned int i = *(loff_t *) v;
 	unsigned long offset = 0;
-	char *modname, namebuf[128];
+	char *modname, namebuf[KSYM_NAME_LEN];
 
 	head = &kprobe_table[i];
 	preempt_disable();
diff -uriN linux-2.6.32.43/kernel/kthread.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kthread.c
--- linux-2.6.32.43/kernel/kthread.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/kthread.c	2011-07-15 05:50:11.000000000 -0500
@@ -14,6 +14,7 @@
 #include <linux/file.h>
 #include <linux/module.h>
 #include <linux/mutex.h>
+#include <linux/vs_pid.h>
 #include <trace/events/sched.h>
 
 static DEFINE_SPINLOCK(kthread_create_lock);
diff -uriN linux-2.6.32.43/kernel/lockdep.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/lockdep.c
--- linux-2.6.32.43/kernel/lockdep.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/lockdep.c	2011-07-15 05:51:19.000000000 -0500
@@ -421,20 +421,20 @@
 /*
  * Various lockdep statistics:
  */
-atomic_t chain_lookup_hits;
-atomic_t chain_lookup_misses;
-atomic_t hardirqs_on_events;
-atomic_t hardirqs_off_events;
-atomic_t redundant_hardirqs_on;
-atomic_t redundant_hardirqs_off;
-atomic_t softirqs_on_events;
-atomic_t softirqs_off_events;
-atomic_t redundant_softirqs_on;
-atomic_t redundant_softirqs_off;
-atomic_t nr_unused_locks;
-atomic_t nr_cyclic_checks;
-atomic_t nr_find_usage_forwards_checks;
-atomic_t nr_find_usage_backwards_checks;
+atomic_unchecked_t chain_lookup_hits;
+atomic_unchecked_t chain_lookup_misses;
+atomic_unchecked_t hardirqs_on_events;
+atomic_unchecked_t hardirqs_off_events;
+atomic_unchecked_t redundant_hardirqs_on;
+atomic_unchecked_t redundant_hardirqs_off;
+atomic_unchecked_t softirqs_on_events;
+atomic_unchecked_t softirqs_off_events;
+atomic_unchecked_t redundant_softirqs_on;
+atomic_unchecked_t redundant_softirqs_off;
+atomic_unchecked_t nr_unused_locks;
+atomic_unchecked_t nr_cyclic_checks;
+atomic_unchecked_t nr_find_usage_forwards_checks;
+atomic_unchecked_t nr_find_usage_backwards_checks;
 #endif
 
 /*
@@ -577,6 +577,10 @@
 	int i;
 #endif
 
+#ifdef CONFIG_PAX_KERNEXEC
+	start = ktla_ktva(start);
+#endif
+
 	/*
 	 * static variable?
 	 */
@@ -592,8 +596,7 @@
 	 */
 	for_each_possible_cpu(i) {
 		start = (unsigned long) &__per_cpu_start + per_cpu_offset(i);
-		end   = (unsigned long) &__per_cpu_start + PERCPU_ENOUGH_ROOM
-					+ per_cpu_offset(i);
+		end   = start + PERCPU_ENOUGH_ROOM;
 
 		if ((addr >= start) && (addr < end))
 			return 1;
@@ -710,6 +713,7 @@
 	if (!static_obj(lock->key)) {
 		debug_locks_off();
 		printk("INFO: trying to register non-static key.\n");
+		printk("lock:%pS key:%pS.\n", lock, lock->key);
 		printk("the code is fine but needs lockdep annotation.\n");
 		printk("turning off the locking correctness validator.\n");
 		dump_stack();
@@ -2751,7 +2755,7 @@
 		if (!class)
 			return 0;
 	}
-	debug_atomic_inc((atomic_t *)&class->ops);
+	debug_atomic_inc((atomic_unchecked_t *)&class->ops);
 	if (very_verbose(class)) {
 		printk("\nacquire class [%p] %s", class->key, class->name);
 		if (class->name_version > 1)
diff -uriN linux-2.6.32.43/kernel/lockdep_internals.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/lockdep_internals.h
--- linux-2.6.32.43/kernel/lockdep_internals.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/lockdep_internals.h	2011-07-15 05:51:19.000000000 -0500
@@ -113,26 +113,26 @@
 /*
  * Various lockdep statistics:
  */
-extern atomic_t chain_lookup_hits;
-extern atomic_t chain_lookup_misses;
-extern atomic_t hardirqs_on_events;
-extern atomic_t hardirqs_off_events;
-extern atomic_t redundant_hardirqs_on;
-extern atomic_t redundant_hardirqs_off;
-extern atomic_t softirqs_on_events;
-extern atomic_t softirqs_off_events;
-extern atomic_t redundant_softirqs_on;
-extern atomic_t redundant_softirqs_off;
-extern atomic_t nr_unused_locks;
-extern atomic_t nr_cyclic_checks;
-extern atomic_t nr_cyclic_check_recursions;
-extern atomic_t nr_find_usage_forwards_checks;
-extern atomic_t nr_find_usage_forwards_recursions;
-extern atomic_t nr_find_usage_backwards_checks;
-extern atomic_t nr_find_usage_backwards_recursions;
-# define debug_atomic_inc(ptr)		atomic_inc(ptr)
-# define debug_atomic_dec(ptr)		atomic_dec(ptr)
-# define debug_atomic_read(ptr)		atomic_read(ptr)
+extern atomic_unchecked_t chain_lookup_hits;
+extern atomic_unchecked_t chain_lookup_misses;
+extern atomic_unchecked_t hardirqs_on_events;
+extern atomic_unchecked_t hardirqs_off_events;
+extern atomic_unchecked_t redundant_hardirqs_on;
+extern atomic_unchecked_t redundant_hardirqs_off;
+extern atomic_unchecked_t softirqs_on_events;
+extern atomic_unchecked_t softirqs_off_events;
+extern atomic_unchecked_t redundant_softirqs_on;
+extern atomic_unchecked_t redundant_softirqs_off;
+extern atomic_unchecked_t nr_unused_locks;
+extern atomic_unchecked_t nr_cyclic_checks;
+extern atomic_unchecked_t nr_cyclic_check_recursions;
+extern atomic_unchecked_t nr_find_usage_forwards_checks;
+extern atomic_unchecked_t nr_find_usage_forwards_recursions;
+extern atomic_unchecked_t nr_find_usage_backwards_checks;
+extern atomic_unchecked_t nr_find_usage_backwards_recursions;
+# define debug_atomic_inc(ptr)		atomic_inc_unchecked(ptr)
+# define debug_atomic_dec(ptr)		atomic_dec_unchecked(ptr)
+# define debug_atomic_read(ptr)		atomic_read_unchecked(ptr)
 #else
 # define debug_atomic_inc(ptr)		do { } while (0)
 # define debug_atomic_dec(ptr)		do { } while (0)
diff -uriN linux-2.6.32.43/kernel/lockdep_proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/lockdep_proc.c
--- linux-2.6.32.43/kernel/lockdep_proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/lockdep_proc.c	2011-07-15 05:51:19.000000000 -0500
@@ -39,7 +39,7 @@
 
 static void print_name(struct seq_file *m, struct lock_class *class)
 {
-	char str[128];
+	char str[KSYM_NAME_LEN];
 	const char *name = class->name;
 
 	if (!name) {
diff -uriN linux-2.6.32.43/kernel/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/Makefile
--- linux-2.6.32.43/kernel/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/Makefile	2011-07-15 05:50:11.000000000 -0500
@@ -23,6 +23,7 @@
 CFLAGS_REMOVE_sched_clock.o = -pg
 endif
 
+obj-y += vserver/
 obj-$(CONFIG_FREEZER) += freezer.o
 obj-$(CONFIG_PROFILING) += profile.o
 obj-$(CONFIG_SYSCTL_SYSCALL_CHECK) += sysctl_check.o
diff -uriN linux-2.6.32.43/kernel/module.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/module.c
--- linux-2.6.32.43/kernel/module.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/module.c	2011-07-15 05:51:19.000000000 -0500
@@ -55,6 +55,7 @@
 #include <linux/async.h>
 #include <linux/percpu.h>
 #include <linux/kmemleak.h>
+#include <linux/grsecurity.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/module.h>
@@ -89,7 +90,8 @@
 static BLOCKING_NOTIFIER_HEAD(module_notify_list);
 
 /* Bounds of module allocation, for speeding __module_address */
-static unsigned long module_addr_min = -1UL, module_addr_max = 0;
+static unsigned long module_addr_min_rw = -1UL, module_addr_max_rw = 0;
+static unsigned long module_addr_min_rx = -1UL, module_addr_max_rx = 0;
 
 int register_module_notifier(struct notifier_block * nb)
 {
@@ -245,7 +247,7 @@
 		return true;
 
 	list_for_each_entry_rcu(mod, &modules, list) {
-		struct symsearch arr[] = {
+		struct symsearch modarr[] = {
 			{ mod->syms, mod->syms + mod->num_syms, mod->crcs,
 			  NOT_GPL_ONLY, false },
 			{ mod->gpl_syms, mod->gpl_syms + mod->num_gpl_syms,
@@ -267,7 +269,7 @@
 #endif
 		};
 
-		if (each_symbol_in_section(arr, ARRAY_SIZE(arr), mod, fn, data))
+		if (each_symbol_in_section(modarr, ARRAY_SIZE(modarr), mod, fn, data))
 			return true;
 	}
 	return false;
@@ -442,7 +444,7 @@
 	void *ptr;
 	int cpu;
 
-	if (align > PAGE_SIZE) {
+	if (align-1 >= PAGE_SIZE) {
 		printk(KERN_WARNING "%s: per-cpu alignment %li > %li\n",
 		       name, align, PAGE_SIZE);
 		align = PAGE_SIZE;
@@ -1158,7 +1160,7 @@
  * /sys/module/foo/sections stuff
  * J. Corbet <corbet@lwn.net>
  */
-#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS)
+#if defined(CONFIG_KALLSYMS) && defined(CONFIG_SYSFS) && !defined(CONFIG_GRKERNSEC_HIDESYM)
 
 static inline bool sect_empty(const Elf_Shdr *sect)
 {
@@ -1545,7 +1547,8 @@
 	destroy_params(mod->kp, mod->num_kp);
 
 	/* This may be NULL, but that's OK */
-	module_free(mod, mod->module_init);
+	module_free(mod, mod->module_init_rw);
+	module_free_exec(mod, mod->module_init_rx);
 	kfree(mod->args);
 	if (mod->percpu)
 		percpu_modfree(mod->percpu);
@@ -1554,10 +1557,12 @@
 		percpu_modfree(mod->refptr);
 #endif
 	/* Free lock-classes: */
-	lockdep_free_key_range(mod->module_core, mod->core_size);
+	lockdep_free_key_range(mod->module_core_rx, mod->core_size_rx);
+	lockdep_free_key_range(mod->module_core_rw, mod->core_size_rw);
 
 	/* Finally, free the core (containing the module structure) */
-	module_free(mod, mod->module_core);
+	module_free_exec(mod, mod->module_core_rx);
+	module_free(mod, mod->module_core_rw);
 
 #ifdef CONFIG_MPU
 	update_protections(current->mm);
@@ -1628,8 +1633,32 @@
 	unsigned int i, n = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
 	int ret = 0;
 	const struct kernel_symbol *ksym;
+#ifdef CONFIG_GRKERNSEC_MODHARDEN
+	int is_fs_load = 0;
+	int register_filesystem_found = 0;
+	char *p;
+
+	p = strstr(mod->args, "grsec_modharden_fs");
+
+	if (p) {
+		char *endptr = p + strlen("grsec_modharden_fs");
+		/* copy \0 as well */
+		memmove(p, endptr, strlen(mod->args) - (unsigned int)(endptr - mod->args) + 1);
+		is_fs_load = 1;
+	}
+#endif
+
 
 	for (i = 1; i < n; i++) {
+#ifdef CONFIG_GRKERNSEC_MODHARDEN
+		const char *name = strtab + sym[i].st_name;
+
+		/* it's a real shame this will never get ripped and copied
+		   upstream! ;(
+		*/
+		if (is_fs_load && !strcmp(name, "register_filesystem"))
+			register_filesystem_found = 1;
+#endif
 		switch (sym[i].st_shndx) {
 		case SHN_COMMON:
 			/* We compiled with -fno-common.  These are not
@@ -1651,7 +1680,9 @@
 					      strtab + sym[i].st_name, mod);
 			/* Ok if resolved.  */
 			if (ksym) {
+				pax_open_kernel();
 				sym[i].st_value = ksym->value;
+				pax_close_kernel();
 				break;
 			}
 
@@ -1670,11 +1701,20 @@
 				secbase = (unsigned long)mod->percpu;
 			else
 				secbase = sechdrs[sym[i].st_shndx].sh_addr;
+			pax_open_kernel();
 			sym[i].st_value += secbase;
+			pax_close_kernel();
 			break;
 		}
 	}
 
+#ifdef CONFIG_GRKERNSEC_MODHARDEN
+	if (is_fs_load && !register_filesystem_found) {
+		printk(KERN_ALERT "grsec: Denied attempt to load non-fs module %.64s through mount\n", mod->name);
+		ret = -EPERM;
+	}
+#endif
+
 	return ret;
 }
 
@@ -1731,11 +1771,12 @@
 			    || s->sh_entsize != ~0UL
 			    || strstarts(secstrings + s->sh_name, ".init"))
 				continue;
-			s->sh_entsize = get_offset(mod, &mod->core_size, s, i);
+			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
+				s->sh_entsize = get_offset(mod, &mod->core_size_rw, s, i);
+			else
+				s->sh_entsize = get_offset(mod, &mod->core_size_rx, s, i);
 			DEBUGP("\t%s\n", secstrings + s->sh_name);
 		}
-		if (m == 0)
-			mod->core_text_size = mod->core_size;
 	}
 
 	DEBUGP("Init section allocation order:\n");
@@ -1748,12 +1789,13 @@
 			    || s->sh_entsize != ~0UL
 			    || !strstarts(secstrings + s->sh_name, ".init"))
 				continue;
-			s->sh_entsize = (get_offset(mod, &mod->init_size, s, i)
-					 | INIT_OFFSET_MASK);
+			if ((s->sh_flags & SHF_WRITE) || !(s->sh_flags & SHF_ALLOC))
+				s->sh_entsize = get_offset(mod, &mod->init_size_rw, s, i);
+			else
+				s->sh_entsize = get_offset(mod, &mod->init_size_rx, s, i);
+			s->sh_entsize |= INIT_OFFSET_MASK;
 			DEBUGP("\t%s\n", secstrings + s->sh_name);
 		}
-		if (m == 0)
-			mod->init_text_size = mod->init_size;
 	}
 }
 
@@ -1857,9 +1899,8 @@
 
 /* As per nm */
 static char elf_type(const Elf_Sym *sym,
-		     Elf_Shdr *sechdrs,
-		     const char *secstrings,
-		     struct module *mod)
+		     const Elf_Shdr *sechdrs,
+		     const char *secstrings)
 {
 	if (ELF_ST_BIND(sym->st_info) == STB_WEAK) {
 		if (ELF_ST_TYPE(sym->st_info) == STT_OBJECT)
@@ -1934,7 +1975,7 @@
 
 	/* Put symbol section at end of init part of module. */
 	symsect->sh_flags |= SHF_ALLOC;
-	symsect->sh_entsize = get_offset(mod, &mod->init_size, symsect,
+	symsect->sh_entsize = get_offset(mod, &mod->init_size_rx, symsect,
 					 symindex) | INIT_OFFSET_MASK;
 	DEBUGP("\t%s\n", secstrings + symsect->sh_name);
 
@@ -1951,19 +1992,19 @@
 		}
 
 	/* Append room for core symbols at end of core part. */
-	symoffs = ALIGN(mod->core_size, symsect->sh_addralign ?: 1);
-	mod->core_size = symoffs + ndst * sizeof(Elf_Sym);
+	symoffs = ALIGN(mod->core_size_rx, symsect->sh_addralign ?: 1);
+	mod->core_size_rx = symoffs + ndst * sizeof(Elf_Sym);
 
 	/* Put string table section at end of init part of module. */
 	strsect->sh_flags |= SHF_ALLOC;
-	strsect->sh_entsize = get_offset(mod, &mod->init_size, strsect,
+	strsect->sh_entsize = get_offset(mod, &mod->init_size_rx, strsect,
 					 strindex) | INIT_OFFSET_MASK;
 	DEBUGP("\t%s\n", secstrings + strsect->sh_name);
 
 	/* Append room for core symbols' strings at end of core part. */
-	*pstroffs = mod->core_size;
+	*pstroffs = mod->core_size_rx;
 	__set_bit(0, strmap);
-	mod->core_size += bitmap_weight(strmap, strsect->sh_size);
+	mod->core_size_rx += bitmap_weight(strmap, strsect->sh_size);
 
 	return symoffs;
 }
@@ -1987,12 +2028,14 @@
 	mod->num_symtab = sechdrs[symindex].sh_size / sizeof(Elf_Sym);
 	mod->strtab = (void *)sechdrs[strindex].sh_addr;
 
+	pax_open_kernel();
+
 	/* Set types up while we still have access to sections. */
 	for (i = 0; i < mod->num_symtab; i++)
 		mod->symtab[i].st_info
-			= elf_type(&mod->symtab[i], sechdrs, secstrings, mod);
+			= elf_type(&mod->symtab[i], sechdrs, secstrings);
 
-	mod->core_symtab = dst = mod->module_core + symoffs;
+	mod->core_symtab = dst = mod->module_core_rx + symoffs;
 	src = mod->symtab;
 	*dst = *src;
 	for (ndst = i = 1; i < mod->num_symtab; ++i, ++src) {
@@ -2004,10 +2047,12 @@
 	}
 	mod->core_num_syms = ndst;
 
-	mod->core_strtab = s = mod->module_core + stroffs;
+	mod->core_strtab = s = mod->module_core_rx + stroffs;
 	for (*s = 0, i = 1; i < sechdrs[strindex].sh_size; ++i)
 		if (test_bit(i, strmap))
 			*++s = mod->strtab[i];
+
+	pax_close_kernel();
 }
 #else
 static inline unsigned long layout_symtab(struct module *mod,
@@ -2044,16 +2089,30 @@
 #endif
 }
 
-static void *module_alloc_update_bounds(unsigned long size)
+static void *module_alloc_update_bounds_rw(unsigned long size)
 {
 	void *ret = module_alloc(size);
 
 	if (ret) {
 		/* Update module bounds. */
-		if ((unsigned long)ret < module_addr_min)
-			module_addr_min = (unsigned long)ret;
-		if ((unsigned long)ret + size > module_addr_max)
-			module_addr_max = (unsigned long)ret + size;
+		if ((unsigned long)ret < module_addr_min_rw)
+			module_addr_min_rw = (unsigned long)ret;
+		if ((unsigned long)ret + size > module_addr_max_rw)
+			module_addr_max_rw = (unsigned long)ret + size;
+	}
+	return ret;
+}
+
+static void *module_alloc_update_bounds_rx(unsigned long size)
+{
+	void *ret = module_alloc_exec(size);
+
+	if (ret) {
+		/* Update module bounds. */
+		if ((unsigned long)ret < module_addr_min_rx)
+			module_addr_min_rx = (unsigned long)ret;
+		if ((unsigned long)ret + size > module_addr_max_rx)
+			module_addr_max_rx = (unsigned long)ret + size;
 	}
 	return ret;
 }
@@ -2065,8 +2124,8 @@
 	unsigned int i;
 
 	/* only scan the sections containing data */
-	kmemleak_scan_area(mod->module_core, (unsigned long)mod -
-			   (unsigned long)mod->module_core,
+	kmemleak_scan_area(mod->module_core_rw, (unsigned long)mod -
+			   (unsigned long)mod->module_core_rw,
 			   sizeof(struct module), GFP_KERNEL);
 
 	for (i = 1; i < hdr->e_shnum; i++) {
@@ -2076,8 +2135,8 @@
 		    && strncmp(secstrings + sechdrs[i].sh_name, ".bss", 4) != 0)
 			continue;
 
-		kmemleak_scan_area(mod->module_core, sechdrs[i].sh_addr -
-				   (unsigned long)mod->module_core,
+		kmemleak_scan_area(mod->module_core_rw, sechdrs[i].sh_addr -
+				   (unsigned long)mod->module_core_rw,
 				   sechdrs[i].sh_size, GFP_KERNEL);
 	}
 }
@@ -2263,7 +2322,7 @@
 				secstrings, &stroffs, strmap);
 
 	/* Do the allocs. */
-	ptr = module_alloc_update_bounds(mod->core_size);
+	ptr = module_alloc_update_bounds_rw(mod->core_size_rw);
 	/*
 	 * The pointer to this block is stored in the module structure
 	 * which is inside the block. Just mark it as not being a
@@ -2274,23 +2333,47 @@
 		err = -ENOMEM;
 		goto free_percpu;
 	}
-	memset(ptr, 0, mod->core_size);
-	mod->module_core = ptr;
+	memset(ptr, 0, mod->core_size_rw);
+	mod->module_core_rw = ptr;
 
-	ptr = module_alloc_update_bounds(mod->init_size);
+	ptr = module_alloc_update_bounds_rw(mod->init_size_rw);
 	/*
 	 * The pointer to this block is stored in the module structure
 	 * which is inside the block. This block doesn't need to be
 	 * scanned as it contains data and code that will be freed
 	 * after the module is initialized.
 	 */
-	kmemleak_ignore(ptr);
-	if (!ptr && mod->init_size) {
+	kmemleak_not_leak(ptr);
+	if (!ptr && mod->init_size_rw) {
+		err = -ENOMEM;
+		goto free_core_rw;
+	}
+	memset(ptr, 0, mod->init_size_rw);
+	mod->module_init_rw = ptr;
+
+	ptr = module_alloc_update_bounds_rx(mod->core_size_rx);
+	kmemleak_not_leak(ptr);
+	if (!ptr) {
 		err = -ENOMEM;
-		goto free_core;
+		goto free_init_rw;
 	}
-	memset(ptr, 0, mod->init_size);
-	mod->module_init = ptr;
+
+	pax_open_kernel();
+	memset(ptr, 0, mod->core_size_rx);
+	pax_close_kernel();
+	mod->module_core_rx = ptr;
+
+	ptr = module_alloc_update_bounds_rx(mod->init_size_rx);
+	kmemleak_not_leak(ptr);
+	if (!ptr && mod->init_size_rx) {
+		err = -ENOMEM;
+		goto free_core_rx;
+	}
+
+	pax_open_kernel();
+	memset(ptr, 0, mod->init_size_rx);
+	pax_close_kernel();
+	mod->module_init_rx = ptr;
 
 	/* Transfer each section which specifies SHF_ALLOC */
 	DEBUGP("final section addresses:\n");
@@ -2300,17 +2383,45 @@
 		if (!(sechdrs[i].sh_flags & SHF_ALLOC))
 			continue;
 
-		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK)
-			dest = mod->module_init
-				+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
-		else
-			dest = mod->module_core + sechdrs[i].sh_entsize;
+		if (sechdrs[i].sh_entsize & INIT_OFFSET_MASK) {
+			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
+				dest = mod->module_init_rw
+					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
+			else
+				dest = mod->module_init_rx
+					+ (sechdrs[i].sh_entsize & ~INIT_OFFSET_MASK);
+		} else {
+			if ((sechdrs[i].sh_flags & SHF_WRITE) || !(sechdrs[i].sh_flags & SHF_ALLOC))
+				dest = mod->module_core_rw + sechdrs[i].sh_entsize;
+			else
+				dest = mod->module_core_rx + sechdrs[i].sh_entsize;
+		}
+
+		if (sechdrs[i].sh_type != SHT_NOBITS) {
 
-		if (sechdrs[i].sh_type != SHT_NOBITS)
-			memcpy(dest, (void *)sechdrs[i].sh_addr,
-			       sechdrs[i].sh_size);
+#ifdef CONFIG_PAX_KERNEXEC
+#ifdef CONFIG_X86_64
+			if ((sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_EXECINSTR))
+				set_memory_x((unsigned long)dest, (sechdrs[i].sh_size + PAGE_SIZE) >> PAGE_SHIFT);
+#endif
+			if (!(sechdrs[i].sh_flags & SHF_WRITE) && (sechdrs[i].sh_flags & SHF_ALLOC)) {
+				pax_open_kernel();
+				memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
+				pax_close_kernel();
+			} else
+#endif
+
+			memcpy(dest, (void *)sechdrs[i].sh_addr, sechdrs[i].sh_size);
+		}
 		/* Update sh_addr to point to copy in image. */
-		sechdrs[i].sh_addr = (unsigned long)dest;
+
+#ifdef CONFIG_PAX_KERNEXEC
+		if (sechdrs[i].sh_flags & SHF_EXECINSTR)
+			sechdrs[i].sh_addr = ktva_ktla((unsigned long)dest);
+		else
+#endif
+
+			sechdrs[i].sh_addr = (unsigned long)dest;
 		DEBUGP("\t0x%lx %s\n", sechdrs[i].sh_addr, secstrings + sechdrs[i].sh_name);
 	}
 	/* Module has been moved. */
@@ -2322,7 +2433,7 @@
 				      mod->name);
 	if (!mod->refptr) {
 		err = -ENOMEM;
-		goto free_init;
+		goto free_init_rx;
 	}
 #endif
 	/* Now we've moved module, initialize linked lists, etc. */
@@ -2351,6 +2462,31 @@
 	/* Set up MODINFO_ATTR fields */
 	setup_modinfo(mod, sechdrs, infoindex);
 
+	mod->args = args;
+
+#ifdef CONFIG_GRKERNSEC_MODHARDEN
+	{
+		char *p, *p2;
+
+		if (strstr(mod->args, "grsec_modharden_netdev")) {
+			printk(KERN_ALERT "grsec: denied auto-loading kernel module for a network device with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%.64s instead.", mod->name);
+			err = -EPERM;
+			goto cleanup;
+		} else if ((p = strstr(mod->args, "grsec_modharden_normal"))) {
+			p += strlen("grsec_modharden_normal");
+			p2 = strstr(p, "_");
+			if (p2) {
+				*p2 = '\0';
+				printk(KERN_ALERT "grsec: denied kernel module auto-load of %.64s by uid %.9s\n", mod->name, p);
+				*p2 = '_';
+			}
+			err = -EPERM;
+			goto cleanup;
+		}
+	}
+#endif
+
+
 	/* Fix up syms, so that st_value is a pointer to location. */
 	err = simplify_symbols(sechdrs, symindex, strtab, versindex, pcpuindex,
 			       mod);
@@ -2431,8 +2567,8 @@
 
 	/* Now do relocations. */
 	for (i = 1; i < hdr->e_shnum; i++) {
-		const char *strtab = (char *)sechdrs[strindex].sh_addr;
 		unsigned int info = sechdrs[i].sh_info;
+		strtab = (char *)sechdrs[strindex].sh_addr;
 
 		/* Not a valid relocation section? */
 		if (info >= hdr->e_shnum)
@@ -2493,16 +2629,15 @@
 	 * Do it before processing of module parameters, so the module
 	 * can provide parameter accessor functions of its own.
 	 */
-	if (mod->module_init)
-		flush_icache_range((unsigned long)mod->module_init,
-				   (unsigned long)mod->module_init
-				   + mod->init_size);
-	flush_icache_range((unsigned long)mod->module_core,
-			   (unsigned long)mod->module_core + mod->core_size);
+	if (mod->module_init_rx)
+		flush_icache_range((unsigned long)mod->module_init_rx,
+				   (unsigned long)mod->module_init_rx
+				   + mod->init_size_rx);
+	flush_icache_range((unsigned long)mod->module_core_rx,
+			   (unsigned long)mod->module_core_rx + mod->core_size_rx);
 
 	set_fs(old_fs);
 
-	mod->args = args;
 	if (section_addr(hdr, sechdrs, secstrings, "__obsparm"))
 		printk(KERN_WARNING "%s: Ignoring obsolete parameters\n",
 		       mod->name);
@@ -2546,12 +2681,16 @@
  free_unload:
 	module_unload_free(mod);
 #if defined(CONFIG_MODULE_UNLOAD) && defined(CONFIG_SMP)
+ free_init_rx:
 	percpu_modfree(mod->refptr);
- free_init:
 #endif
-	module_free(mod, mod->module_init);
- free_core:
-	module_free(mod, mod->module_core);
+	module_free_exec(mod, mod->module_init_rx);
+ free_core_rx:
+	module_free_exec(mod, mod->module_core_rx);
+ free_init_rw:
+	module_free(mod, mod->module_init_rw);
+ free_core_rw:
+	module_free(mod, mod->module_core_rw);
 	/* mod will be freed with core. Don't access it beyond this line! */
  free_percpu:
 	if (percpu)
@@ -2653,10 +2792,12 @@
 	mod->symtab = mod->core_symtab;
 	mod->strtab = mod->core_strtab;
 #endif
-	module_free(mod, mod->module_init);
-	mod->module_init = NULL;
-	mod->init_size = 0;
-	mod->init_text_size = 0;
+	module_free(mod, mod->module_init_rw);
+	module_free_exec(mod, mod->module_init_rx);
+	mod->module_init_rw = NULL;
+	mod->module_init_rx = NULL;
+	mod->init_size_rw = 0;
+	mod->init_size_rx = 0;
 	mutex_unlock(&module_mutex);
 
 	return 0;
@@ -2687,10 +2828,16 @@
 	unsigned long nextval;
 
 	/* At worse, next value is at end of module */
-	if (within_module_init(addr, mod))
-		nextval = (unsigned long)mod->module_init+mod->init_text_size;
+	if (within_module_init_rx(addr, mod))
+		nextval = (unsigned long)mod->module_init_rx+mod->init_size_rx;
+	else if (within_module_init_rw(addr, mod))
+		nextval = (unsigned long)mod->module_init_rw+mod->init_size_rw;
+	else if (within_module_core_rx(addr, mod))
+		nextval = (unsigned long)mod->module_core_rx+mod->core_size_rx;
+	else if (within_module_core_rw(addr, mod))
+		nextval = (unsigned long)mod->module_core_rw+mod->core_size_rw;
 	else
-		nextval = (unsigned long)mod->module_core+mod->core_text_size;
+		return NULL;
 
 	/* Scan for closest preceeding symbol, and next symbol. (ELF
 	   starts real symbols at 1). */
@@ -2936,7 +3083,7 @@
 	char buf[8];
 
 	seq_printf(m, "%s %u",
-		   mod->name, mod->init_size + mod->core_size);
+		   mod->name, mod->init_size_rx + mod->init_size_rw + mod->core_size_rx + mod->core_size_rw);
 	print_unload_info(m, mod);
 
 	/* Informative for users. */
@@ -2945,7 +3092,7 @@
 		   mod->state == MODULE_STATE_COMING ? "Loading":
 		   "Live");
 	/* Used by oprofile and other similar tools. */
-	seq_printf(m, " 0x%p", mod->module_core);
+	seq_printf(m, " 0x%p 0x%p", mod->module_core_rx, mod->module_core_rw);
 
 	/* Taints info */
 	if (mod->taints)
@@ -2981,7 +3128,17 @@
 
 static int __init proc_modules_init(void)
 {
+#ifndef CONFIG_GRKERNSEC_HIDESYM
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	proc_create("modules", S_IRUSR | S_IRGRP, NULL, &proc_modules_operations);
+#else
 	proc_create("modules", 0, NULL, &proc_modules_operations);
+#endif
+#else
+	proc_create("modules", S_IRUSR, NULL, &proc_modules_operations);
+#endif
 	return 0;
 }
 module_init(proc_modules_init);
@@ -3040,12 +3197,12 @@
 {
 	struct module *mod;
 
-	if (addr < module_addr_min || addr > module_addr_max)
+	if ((addr < module_addr_min_rx || addr > module_addr_max_rx) &&
+	    (addr < module_addr_min_rw || addr > module_addr_max_rw))
 		return NULL;
 
 	list_for_each_entry_rcu(mod, &modules, list)
-		if (within_module_core(addr, mod)
-		    || within_module_init(addr, mod))
+		if (within_module_init(addr, mod) || within_module_core(addr, mod))
 			return mod;
 	return NULL;
 }
@@ -3079,11 +3236,20 @@
  */
 struct module *__module_text_address(unsigned long addr)
 {
-	struct module *mod = __module_address(addr);
+	struct module *mod;
+
+#ifdef CONFIG_X86_32
+	addr = ktla_ktva(addr);
+#endif
+
+	if (addr < module_addr_min_rx || addr > module_addr_max_rx)
+		return NULL;
+
+	mod = __module_address(addr);
+
 	if (mod) {
 		/* Make sure it's within the text section. */
-		if (!within(addr, mod->module_init, mod->init_text_size)
-		    && !within(addr, mod->module_core, mod->core_text_size))
+		if (!within_module_init_rx(addr, mod) && !within_module_core_rx(addr, mod))
 			mod = NULL;
 	}
 	return mod;
diff -uriN linux-2.6.32.43/kernel/mutex.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/mutex.c
--- linux-2.6.32.43/kernel/mutex.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/mutex.c	2011-07-15 05:51:19.000000000 -0500
@@ -169,7 +169,7 @@
 	 */
 
 	for (;;) {
-		struct thread_info *owner;
+		struct task_struct *owner;
 
 		/*
 		 * If we own the BKL, then don't spin. The owner of
@@ -214,7 +214,7 @@
 	spin_lock_mutex(&lock->wait_lock, flags);
 
 	debug_mutex_lock_common(lock, &waiter);
-	debug_mutex_add_waiter(lock, &waiter, task_thread_info(task));
+	debug_mutex_add_waiter(lock, &waiter, task);
 
 	/* add waiting tasks to the end of the waitqueue (FIFO): */
 	list_add_tail(&waiter.list, &lock->wait_list);
@@ -243,8 +243,7 @@
 		 * TASK_UNINTERRUPTIBLE case.)
 		 */
 		if (unlikely(signal_pending_state(state, task))) {
-			mutex_remove_waiter(lock, &waiter,
-					    task_thread_info(task));
+			mutex_remove_waiter(lock, &waiter, task);
 			mutex_release(&lock->dep_map, 1, ip);
 			spin_unlock_mutex(&lock->wait_lock, flags);
 
@@ -265,7 +264,7 @@
 done:
 	lock_acquired(&lock->dep_map, ip);
 	/* got the lock - rejoice! */
-	mutex_remove_waiter(lock, &waiter, current_thread_info());
+	mutex_remove_waiter(lock, &waiter, task);
 	mutex_set_owner(lock);
 
 	/* set it to 0 if there are no waiters left: */
diff -uriN linux-2.6.32.43/kernel/mutex-debug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/mutex-debug.c
--- linux-2.6.32.43/kernel/mutex-debug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/mutex-debug.c	2011-07-15 05:51:19.000000000 -0500
@@ -49,21 +49,21 @@
 }
 
 void debug_mutex_add_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-			    struct thread_info *ti)
+			    struct task_struct *task)
 {
 	SMP_DEBUG_LOCKS_WARN_ON(!spin_is_locked(&lock->wait_lock));
 
 	/* Mark the current thread as blocked on the lock: */
-	ti->task->blocked_on = waiter;
+	task->blocked_on = waiter;
 }
 
 void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-			 struct thread_info *ti)
+			 struct task_struct *task)
 {
 	DEBUG_LOCKS_WARN_ON(list_empty(&waiter->list));
-	DEBUG_LOCKS_WARN_ON(waiter->task != ti->task);
-	DEBUG_LOCKS_WARN_ON(ti->task->blocked_on != waiter);
-	ti->task->blocked_on = NULL;
+	DEBUG_LOCKS_WARN_ON(waiter->task != task);
+	DEBUG_LOCKS_WARN_ON(task->blocked_on != waiter);
+	task->blocked_on = NULL;
 
 	list_del_init(&waiter->list);
 	waiter->task = NULL;
@@ -75,7 +75,7 @@
 		return;
 
 	DEBUG_LOCKS_WARN_ON(lock->magic != lock);
-	DEBUG_LOCKS_WARN_ON(lock->owner != current_thread_info());
+	DEBUG_LOCKS_WARN_ON(lock->owner != current);
 	DEBUG_LOCKS_WARN_ON(!lock->wait_list.prev && !lock->wait_list.next);
 	mutex_clear_owner(lock);
 }
diff -uriN linux-2.6.32.43/kernel/mutex-debug.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/mutex-debug.h
--- linux-2.6.32.43/kernel/mutex-debug.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/mutex-debug.h	2011-07-15 05:51:19.000000000 -0500
@@ -20,16 +20,16 @@
 extern void debug_mutex_free_waiter(struct mutex_waiter *waiter);
 extern void debug_mutex_add_waiter(struct mutex *lock,
 				   struct mutex_waiter *waiter,
-				   struct thread_info *ti);
+				   struct task_struct *task);
 extern void mutex_remove_waiter(struct mutex *lock, struct mutex_waiter *waiter,
-				struct thread_info *ti);
+				struct task_struct *task);
 extern void debug_mutex_unlock(struct mutex *lock);
 extern void debug_mutex_init(struct mutex *lock, const char *name,
 			     struct lock_class_key *key);
 
 static inline void mutex_set_owner(struct mutex *lock)
 {
-	lock->owner = current_thread_info();
+	lock->owner = current;
 }
 
 static inline void mutex_clear_owner(struct mutex *lock)
diff -uriN linux-2.6.32.43/kernel/mutex.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/mutex.h
--- linux-2.6.32.43/kernel/mutex.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/mutex.h	2011-07-15 05:51:19.000000000 -0500
@@ -19,7 +19,7 @@
 #ifdef CONFIG_SMP
 static inline void mutex_set_owner(struct mutex *lock)
 {
-	lock->owner = current_thread_info();
+	lock->owner = current;
 }
 
 static inline void mutex_clear_owner(struct mutex *lock)
diff -uriN linux-2.6.32.43/kernel/nsproxy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/nsproxy.c
--- linux-2.6.32.43/kernel/nsproxy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/nsproxy.c	2011-07-15 05:50:11.000000000 -0500
@@ -19,6 +19,8 @@
 #include <linux/mnt_namespace.h>
 #include <linux/utsname.h>
 #include <linux/pid_namespace.h>
+#include <linux/vserver/global.h>
+#include <linux/vserver/debug.h>
 #include <net/net_namespace.h>
 #include <linux/ipc_namespace.h>
 
@@ -31,8 +33,11 @@
 	struct nsproxy *nsproxy;
 
 	nsproxy = kmem_cache_alloc(nsproxy_cachep, GFP_KERNEL);
-	if (nsproxy)
+	if (nsproxy) {
 		atomic_set(&nsproxy->count, 1);
+		atomic_inc(&vs_global_nsproxy);
+	}
+	vxdprintk(VXD_CBIT(space, 2), "create_nsproxy = %p[1]", nsproxy);
 	return nsproxy;
 }
 
@@ -41,41 +46,52 @@
  * Return the newly created nsproxy.  Do not attach this to the task,
  * leave it to the caller to do proper locking and attach it to task.
  */
-static struct nsproxy *create_new_namespaces(unsigned long flags,
-			struct task_struct *tsk, struct fs_struct *new_fs)
+static struct nsproxy *unshare_namespaces(unsigned long flags,
+			struct nsproxy *orig, struct fs_struct *new_fs)
 {
 	struct nsproxy *new_nsp;
 	int err;
 
+	vxdprintk(VXD_CBIT(space, 4),
+		"unshare_namespaces(0x%08lx,%p,%p)",
+		flags, orig, new_fs);
+
 	new_nsp = create_nsproxy();
 	if (!new_nsp)
 		return ERR_PTR(-ENOMEM);
 
-	new_nsp->mnt_ns = copy_mnt_ns(flags, tsk->nsproxy->mnt_ns, new_fs);
+	new_nsp->mnt_ns = copy_mnt_ns(flags, orig->mnt_ns, new_fs);
 	if (IS_ERR(new_nsp->mnt_ns)) {
 		err = PTR_ERR(new_nsp->mnt_ns);
 		goto out_ns;
 	}
 
-	new_nsp->uts_ns = copy_utsname(flags, tsk->nsproxy->uts_ns);
+	new_nsp->uts_ns = copy_utsname(flags, orig->uts_ns);
 	if (IS_ERR(new_nsp->uts_ns)) {
 		err = PTR_ERR(new_nsp->uts_ns);
 		goto out_uts;
 	}
 
-	new_nsp->ipc_ns = copy_ipcs(flags, tsk->nsproxy->ipc_ns);
+	new_nsp->ipc_ns = copy_ipcs(flags, orig->ipc_ns);
 	if (IS_ERR(new_nsp->ipc_ns)) {
 		err = PTR_ERR(new_nsp->ipc_ns);
 		goto out_ipc;
 	}
 
-	new_nsp->pid_ns = copy_pid_ns(flags, task_active_pid_ns(tsk));
+	new_nsp->pid_ns = copy_pid_ns(flags, orig->pid_ns);
 	if (IS_ERR(new_nsp->pid_ns)) {
 		err = PTR_ERR(new_nsp->pid_ns);
 		goto out_pid;
 	}
 
-	new_nsp->net_ns = copy_net_ns(flags, tsk->nsproxy->net_ns);
+	/* disabled now?
+	new_nsp->user_ns = copy_user_ns(flags, orig->user_ns);
+	if (IS_ERR(new_nsp->user_ns)) {
+		err = PTR_ERR(new_nsp->user_ns);
+		goto out_user;
+	} */
+
+	new_nsp->net_ns = copy_net_ns(flags, orig->net_ns);
 	if (IS_ERR(new_nsp->net_ns)) {
 		err = PTR_ERR(new_nsp->net_ns);
 		goto out_net;
@@ -100,6 +116,38 @@
 	return ERR_PTR(err);
 }
 
+static struct nsproxy *create_new_namespaces(int flags, struct task_struct *tsk,
+			struct fs_struct *new_fs)
+{
+	return unshare_namespaces(flags, tsk->nsproxy, new_fs);
+}
+
+/*
+ * copies the nsproxy, setting refcount to 1, and grabbing a
+ * reference to all contained namespaces.
+ */
+struct nsproxy *copy_nsproxy(struct nsproxy *orig)
+{
+	struct nsproxy *ns = create_nsproxy();
+
+	if (ns) {
+		memcpy(ns, orig, sizeof(struct nsproxy));
+		atomic_set(&ns->count, 1);
+
+		if (ns->mnt_ns)
+			get_mnt_ns(ns->mnt_ns);
+		if (ns->uts_ns)
+			get_uts_ns(ns->uts_ns);
+		if (ns->ipc_ns)
+			get_ipc_ns(ns->ipc_ns);
+		if (ns->pid_ns)
+			get_pid_ns(ns->pid_ns);
+		if (ns->net_ns)
+			get_net(ns->net_ns);
+	}
+	return ns;
+}
+
 /*
  * called from clone.  This now handles copy for nsproxy and all
  * namespaces therein.
@@ -107,9 +155,12 @@
 int copy_namespaces(unsigned long flags, struct task_struct *tsk)
 {
 	struct nsproxy *old_ns = tsk->nsproxy;
-	struct nsproxy *new_ns;
+	struct nsproxy *new_ns = NULL;
 	int err = 0;
 
+	vxdprintk(VXD_CBIT(space, 7), "copy_namespaces(0x%08lx,%p[%p])",
+		flags, tsk, old_ns);
+
 	if (!old_ns)
 		return 0;
 
@@ -119,7 +170,7 @@
 				CLONE_NEWPID | CLONE_NEWNET)))
 		return 0;
 
-	if (!capable(CAP_SYS_ADMIN)) {
+	if (!vx_can_unshare(CAP_SYS_ADMIN, flags)) {
 		err = -EPERM;
 		goto out;
 	}
@@ -146,6 +197,9 @@
 
 out:
 	put_nsproxy(old_ns);
+	vxdprintk(VXD_CBIT(space, 3),
+		"copy_namespaces(0x%08lx,%p[%p]) = %d [%p]",
+		flags, tsk, old_ns, err, new_ns);
 	return err;
 }
 
@@ -159,7 +213,9 @@
 		put_ipc_ns(ns->ipc_ns);
 	if (ns->pid_ns)
 		put_pid_ns(ns->pid_ns);
-	put_net(ns->net_ns);
+	if (ns->net_ns)
+		put_net(ns->net_ns);
+	atomic_dec(&vs_global_nsproxy);
 	kmem_cache_free(nsproxy_cachep, ns);
 }
 
@@ -172,11 +228,15 @@
 {
 	int err = 0;
 
+	vxdprintk(VXD_CBIT(space, 4),
+		"unshare_nsproxy_namespaces(0x%08lx,[%p])",
+		unshare_flags, current->nsproxy);
+
 	if (!(unshare_flags & (CLONE_NEWNS | CLONE_NEWUTS | CLONE_NEWIPC |
 			       CLONE_NEWNET)))
 		return 0;
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!vx_can_unshare(CAP_SYS_ADMIN, unshare_flags))
 		return -EPERM;
 
 	*new_nsp = create_new_namespaces(unshare_flags, current,
diff -uriN linux-2.6.32.43/kernel/panic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/panic.c
--- linux-2.6.32.43/kernel/panic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/panic.c	2011-07-15 05:51:19.000000000 -0500
@@ -352,7 +352,7 @@
 	const char *board;
 
 	printk(KERN_WARNING "------------[ cut here ]------------\n");
-	printk(KERN_WARNING "WARNING: at %s:%d %pS()\n", file, line, caller);
+	printk(KERN_WARNING "WARNING: at %s:%d %pA()\n", file, line, caller);
 	board = dmi_get_system_info(DMI_PRODUCT_NAME);
 	if (board)
 		printk(KERN_WARNING "Hardware name: %s\n", board);
@@ -392,7 +392,8 @@
  */
 void __stack_chk_fail(void)
 {
-	panic("stack-protector: Kernel stack is corrupted in: %p\n",
+	dump_stack();
+	panic("stack-protector: Kernel stack is corrupted in: %pA\n",
 		__builtin_return_address(0));
 }
 EXPORT_SYMBOL(__stack_chk_fail);
diff -uriN linux-2.6.32.43/kernel/params.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/params.c
--- linux-2.6.32.43/kernel/params.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/params.c	2011-07-15 05:51:19.000000000 -0500
@@ -725,7 +725,7 @@
 	return ret;
 }
 
-static struct sysfs_ops module_sysfs_ops = {
+static const struct sysfs_ops module_sysfs_ops = {
 	.show = module_attr_show,
 	.store = module_attr_store,
 };
@@ -739,7 +739,7 @@
 	return 0;
 }
 
-static struct kset_uevent_ops module_uevent_ops = {
+static const struct kset_uevent_ops module_uevent_ops = {
 	.filter = uevent_filter,
 };
 
diff -uriN linux-2.6.32.43/kernel/perf_event.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/perf_event.c
--- linux-2.6.32.43/kernel/perf_event.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/perf_event.c	2011-07-15 05:51:19.000000000 -0500
@@ -77,7 +77,7 @@
  */
 int sysctl_perf_event_sample_rate __read_mostly = 100000;
 
-static atomic64_t perf_event_id;
+static atomic64_unchecked_t perf_event_id;
 
 /*
  * Lock for (sysadmin-configurable) event reservations:
@@ -1094,9 +1094,9 @@
 	 * In order to keep per-task stats reliable we need to flip the event
 	 * values when we flip the contexts.
 	 */
-	value = atomic64_read(&next_event->count);
-	value = atomic64_xchg(&event->count, value);
-	atomic64_set(&next_event->count, value);
+	value = atomic64_read_unchecked(&next_event->count);
+	value = atomic64_xchg_unchecked(&event->count, value);
+	atomic64_set_unchecked(&next_event->count, value);
 
 	swap(event->total_time_enabled, next_event->total_time_enabled);
 	swap(event->total_time_running, next_event->total_time_running);
@@ -1552,7 +1552,7 @@
 		update_event_times(event);
 	}
 
-	return atomic64_read(&event->count);
+	return atomic64_read_unchecked(&event->count);
 }
 
 /*
@@ -1790,11 +1790,11 @@
 	values[n++] = 1 + leader->nr_siblings;
 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
 		values[n++] = leader->total_time_enabled +
-			atomic64_read(&leader->child_total_time_enabled);
+			atomic64_read_unchecked(&leader->child_total_time_enabled);
 	}
 	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
 		values[n++] = leader->total_time_running +
-			atomic64_read(&leader->child_total_time_running);
+			atomic64_read_unchecked(&leader->child_total_time_running);
 	}
 
 	size = n * sizeof(u64);
@@ -1829,11 +1829,11 @@
 	values[n++] = perf_event_read_value(event);
 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
 		values[n++] = event->total_time_enabled +
-			atomic64_read(&event->child_total_time_enabled);
+			atomic64_read_unchecked(&event->child_total_time_enabled);
 	}
 	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
 		values[n++] = event->total_time_running +
-			atomic64_read(&event->child_total_time_running);
+			atomic64_read_unchecked(&event->child_total_time_running);
 	}
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(event);
@@ -1903,7 +1903,7 @@
 static void perf_event_reset(struct perf_event *event)
 {
 	(void)perf_event_read(event);
-	atomic64_set(&event->count, 0);
+	atomic64_set_unchecked(&event->count, 0);
 	perf_event_update_userpage(event);
 }
 
@@ -2079,15 +2079,15 @@
 	++userpg->lock;
 	barrier();
 	userpg->index = perf_event_index(event);
-	userpg->offset = atomic64_read(&event->count);
+	userpg->offset = atomic64_read_unchecked(&event->count);
 	if (event->state == PERF_EVENT_STATE_ACTIVE)
-		userpg->offset -= atomic64_read(&event->hw.prev_count);
+		userpg->offset -= atomic64_read_unchecked(&event->hw.prev_count);
 
 	userpg->time_enabled = event->total_time_enabled +
-			atomic64_read(&event->child_total_time_enabled);
+			atomic64_read_unchecked(&event->child_total_time_enabled);
 
 	userpg->time_running = event->total_time_running +
-			atomic64_read(&event->child_total_time_running);
+			atomic64_read_unchecked(&event->child_total_time_running);
 
 	barrier();
 	++userpg->lock;
@@ -2903,14 +2903,14 @@
 	u64 values[4];
 	int n = 0;
 
-	values[n++] = atomic64_read(&event->count);
+	values[n++] = atomic64_read_unchecked(&event->count);
 	if (read_format & PERF_FORMAT_TOTAL_TIME_ENABLED) {
 		values[n++] = event->total_time_enabled +
-			atomic64_read(&event->child_total_time_enabled);
+			atomic64_read_unchecked(&event->child_total_time_enabled);
 	}
 	if (read_format & PERF_FORMAT_TOTAL_TIME_RUNNING) {
 		values[n++] = event->total_time_running +
-			atomic64_read(&event->child_total_time_running);
+			atomic64_read_unchecked(&event->child_total_time_running);
 	}
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(event);
@@ -2940,7 +2940,7 @@
 	if (leader != event)
 		leader->pmu->read(leader);
 
-	values[n++] = atomic64_read(&leader->count);
+	values[n++] = atomic64_read_unchecked(&leader->count);
 	if (read_format & PERF_FORMAT_ID)
 		values[n++] = primary_event_id(leader);
 
@@ -2952,7 +2952,7 @@
 		if (sub != event)
 			sub->pmu->read(sub);
 
-		values[n++] = atomic64_read(&sub->count);
+		values[n++] = atomic64_read_unchecked(&sub->count);
 		if (read_format & PERF_FORMAT_ID)
 			values[n++] = primary_event_id(sub);
 
@@ -3787,7 +3787,7 @@
 {
 	struct hw_perf_event *hwc = &event->hw;
 
-	atomic64_add(nr, &event->count);
+	atomic64_add_unchecked(nr, &event->count);
 
 	if (!hwc->sample_period)
 		return;
@@ -4044,9 +4044,9 @@
 	u64 now;
 
 	now = cpu_clock(cpu);
-	prev = atomic64_read(&event->hw.prev_count);
-	atomic64_set(&event->hw.prev_count, now);
-	atomic64_add(now - prev, &event->count);
+	prev = atomic64_read_unchecked(&event->hw.prev_count);
+	atomic64_set_unchecked(&event->hw.prev_count, now);
+	atomic64_add_unchecked(now - prev, &event->count);
 }
 
 static int cpu_clock_perf_event_enable(struct perf_event *event)
@@ -4054,7 +4054,7 @@
 	struct hw_perf_event *hwc = &event->hw;
 	int cpu = raw_smp_processor_id();
 
-	atomic64_set(&hwc->prev_count, cpu_clock(cpu));
+	atomic64_set_unchecked(&hwc->prev_count, cpu_clock(cpu));
 	perf_swevent_start_hrtimer(event);
 
 	return 0;
@@ -4086,9 +4086,9 @@
 	u64 prev;
 	s64 delta;
 
-	prev = atomic64_xchg(&event->hw.prev_count, now);
+	prev = atomic64_xchg_unchecked(&event->hw.prev_count, now);
 	delta = now - prev;
-	atomic64_add(delta, &event->count);
+	atomic64_add_unchecked(delta, &event->count);
 }
 
 static int task_clock_perf_event_enable(struct perf_event *event)
@@ -4098,7 +4098,7 @@
 
 	now = event->ctx->time;
 
-	atomic64_set(&hwc->prev_count, now);
+	atomic64_set_unchecked(&hwc->prev_count, now);
 
 	perf_swevent_start_hrtimer(event);
 
@@ -4293,7 +4293,7 @@
 	event->parent		= parent_event;
 
 	event->ns		= get_pid_ns(current->nsproxy->pid_ns);
-	event->id		= atomic64_inc_return(&perf_event_id);
+	event->id		= atomic64_inc_return_unchecked(&perf_event_id);
 
 	event->state		= PERF_EVENT_STATE_INACTIVE;
 
@@ -4724,15 +4724,15 @@
 	if (child_event->attr.inherit_stat)
 		perf_event_read_event(child_event, child);
 
-	child_val = atomic64_read(&child_event->count);
+	child_val = atomic64_read_unchecked(&child_event->count);
 
 	/*
 	 * Add back the child's count to the parent's count:
 	 */
-	atomic64_add(child_val, &parent_event->count);
-	atomic64_add(child_event->total_time_enabled,
+	atomic64_add_unchecked(child_val, &parent_event->count);
+	atomic64_add_unchecked(child_event->total_time_enabled,
 		     &parent_event->child_total_time_enabled);
-	atomic64_add(child_event->total_time_running,
+	atomic64_add_unchecked(child_event->total_time_running,
 		     &parent_event->child_total_time_running);
 
 	/*
diff -uriN linux-2.6.32.43/kernel/pid.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/pid.c
--- linux-2.6.32.43/kernel/pid.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/pid.c	2011-07-15 07:07:36.000000000 -0500
@@ -33,9 +33,11 @@
 #include <linux/rculist.h>
 #include <linux/bootmem.h>
 #include <linux/hash.h>
+#include <linux/security.h>
 #include <linux/pid_namespace.h>
 #include <linux/init_task.h>
 #include <linux/syscalls.h>
+#include <linux/vs_pid.h>
 
 #define pid_hashfn(nr, ns)	\
 	hash_long((unsigned long)nr + (unsigned long)ns, pidhash_shift)
@@ -45,7 +47,7 @@
 
 int pid_max = PID_MAX_DEFAULT;
 
-#define RESERVED_PIDS		300
+#define RESERVED_PIDS		500
 
 int pid_max_min = RESERVED_PIDS + 1;
 int pid_max_max = PID_MAX_LIMIT;
@@ -308,7 +310,7 @@
 
 struct pid *find_vpid(int nr)
 {
-	return find_pid_ns(nr, current->nsproxy->pid_ns);
+	return find_pid_ns(vx_rmap_pid(nr), current->nsproxy->pid_ns);
 }
 EXPORT_SYMBOL_GPL(find_vpid);
 
@@ -368,6 +370,9 @@
 struct task_struct *pid_task(struct pid *pid, enum pid_type type)
 {
 	struct task_struct *result = NULL;
+
+	if (type == PIDTYPE_REALPID)
+		type = PIDTYPE_PID;
 	if (pid) {
 		struct hlist_node *first;
 		first = rcu_dereference(pid->tasks[type].first);
@@ -383,7 +388,14 @@
  */
 struct task_struct *find_task_by_pid_ns(pid_t nr, struct pid_namespace *ns)
 {
-	return pid_task(find_pid_ns(nr, ns), PIDTYPE_PID);
+	struct task_struct *task;
+	
+	task = pid_task(find_pid_ns(vx_rmap_pid(nr), ns), PIDTYPE_PID);
+
+	if (gr_pid_is_chrooted(task))
+		return NULL;
+
+	return task;
 }
 
 struct task_struct *find_task_by_vpid(pid_t vnr)
@@ -391,6 +403,13 @@
 	return find_task_by_pid_ns(vnr, current->nsproxy->pid_ns);
 }
 
+struct task_struct *find_task_by_vpid_unrestricted(pid_t vnr)
+{
+	struct task_struct *task;
+	
+	return pid_task(find_pid_ns(vnr, current->nsproxy->pid_ns), PIDTYPE_PID);
+}
+
 struct pid *get_task_pid(struct task_struct *task, enum pid_type type)
 {
 	struct pid *pid;
@@ -425,7 +444,7 @@
 }
 EXPORT_SYMBOL_GPL(find_get_pid);
 
-pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)
+pid_t pid_unmapped_nr_ns(struct pid *pid, struct pid_namespace *ns)
 {
 	struct upid *upid;
 	pid_t nr = 0;
@@ -438,6 +457,11 @@
 	return nr;
 }
 
+pid_t pid_nr_ns(struct pid *pid, struct pid_namespace *ns)
+{
+	return vx_map_pid(pid_unmapped_nr_ns(pid, ns));
+}
+
 pid_t pid_vnr(struct pid *pid)
 {
 	return pid_nr_ns(pid, current->nsproxy->pid_ns);
diff -uriN linux-2.6.32.43/kernel/pid_namespace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/pid_namespace.c
--- linux-2.6.32.43/kernel/pid_namespace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/pid_namespace.c	2011-07-15 05:50:11.000000000 -0500
@@ -13,6 +13,7 @@
 #include <linux/syscalls.h>
 #include <linux/err.h>
 #include <linux/acct.h>
+#include <linux/vserver/global.h>
 
 #define BITS_PER_PAGE		(PAGE_SIZE*8)
 
@@ -86,6 +87,7 @@
 		goto out_free_map;
 
 	kref_init(&ns->kref);
+	atomic_inc(&vs_global_pid_ns);
 	ns->level = level;
 	ns->parent = get_pid_ns(parent_pid_ns);
 
@@ -111,6 +113,7 @@
 
 	for (i = 0; i < PIDMAP_ENTRIES; i++)
 		kfree(ns->pidmap[i].page);
+	atomic_dec(&vs_global_pid_ns);
 	kmem_cache_free(pid_ns_cachep, ns);
 }
 
diff -uriN linux-2.6.32.43/kernel/posix-cpu-timers.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/posix-cpu-timers.c
--- linux-2.6.32.43/kernel/posix-cpu-timers.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/posix-cpu-timers.c	2011-07-15 05:51:19.000000000 -0500
@@ -6,6 +6,7 @@
 #include <linux/posix-timers.h>
 #include <linux/errno.h>
 #include <linux/math64.h>
+#include <linux/security.h>
 #include <asm/uaccess.h>
 #include <linux/kernel_stat.h>
 #include <trace/events/timer.h>
diff -uriN linux-2.6.32.43/kernel/posix-timers.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/posix-timers.c
--- linux-2.6.32.43/kernel/posix-timers.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/posix-timers.c	2011-07-15 05:51:19.000000000 -0500
@@ -42,10 +42,12 @@
 #include <linux/compiler.h>
 #include <linux/idr.h>
 #include <linux/posix-timers.h>
+#include <linux/grsecurity.h>
 #include <linux/syscalls.h>
 #include <linux/wait.h>
 #include <linux/workqueue.h>
 #include <linux/module.h>
+#include <linux/vs_context.h>
 
 /*
  * Management arrays for POSIX timers.	 Timers are kept in slab memory
@@ -296,6 +298,8 @@
 		.nsleep = no_nsleep,
 	};
 
+	pax_track_stack();
+
 	register_posix_clock(CLOCK_REALTIME, &clock_realtime);
 	register_posix_clock(CLOCK_MONOTONIC, &clock_monotonic);
 	register_posix_clock(CLOCK_MONOTONIC_RAW, &clock_monotonic_raw);
@@ -363,6 +367,7 @@
 {
 	struct task_struct *task;
 	int shared, ret = -1;
+
 	/*
 	 * FIXME: if ->sigq is queued we can race with
 	 * dequeue_signal()->do_schedule_next_timer().
@@ -379,10 +384,18 @@
 	rcu_read_lock();
 	task = pid_task(timr->it_pid, PIDTYPE_PID);
 	if (task) {
+		struct vx_info_save vxis;
+		struct vx_info *vxi;
+
+		vxi = get_vx_info(task->vx_info);
+		enter_vx_info(vxi, &vxis);
 		shared = !(timr->it_sigev_notify & SIGEV_THREAD_ID);
 		ret = send_sigqueue(timr->sigq, task, shared);
+		leave_vx_info(&vxis);
+		put_vx_info(vxi);
 	}
 	rcu_read_unlock();
+
 	/* If we failed to send the signal the timer stops. */
 	return ret > 0;
 }
@@ -948,6 +961,13 @@
 	if (copy_from_user(&new_tp, tp, sizeof (*tp)))
 		return -EFAULT;
 
+	/* only the CLOCK_REALTIME clock can be set, all other clocks
+	   have their clock_set fptr set to a nosettime dummy function
+	   CLOCK_REALTIME has a NULL clock_set fptr which causes it to
+	   call common_clock_set, which calls do_sys_settimeofday, which
+	   we hook
+	*/
+
 	return CLOCK_DISPATCH(which_clock, clock_set, (which_clock, &new_tp));
 }
 
diff -uriN linux-2.6.32.43/kernel/power/hibernate.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/power/hibernate.c
--- linux-2.6.32.43/kernel/power/hibernate.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/power/hibernate.c	2011-07-15 05:51:19.000000000 -0500
@@ -48,14 +48,14 @@
 
 static int hibernation_mode = HIBERNATION_SHUTDOWN;
 
-static struct platform_hibernation_ops *hibernation_ops;
+static const struct platform_hibernation_ops *hibernation_ops;
 
 /**
  * hibernation_set_ops - set the global hibernate operations
  * @ops: the hibernation operations to use in subsequent hibernation transitions
  */
 
-void hibernation_set_ops(struct platform_hibernation_ops *ops)
+void hibernation_set_ops(const struct platform_hibernation_ops *ops)
 {
 	if (ops && !(ops->begin && ops->end &&  ops->pre_snapshot
 	    && ops->prepare && ops->finish && ops->enter && ops->pre_restore
diff -uriN linux-2.6.32.43/kernel/power/poweroff.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/power/poweroff.c
--- linux-2.6.32.43/kernel/power/poweroff.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/power/poweroff.c	2011-07-15 05:51:19.000000000 -0500
@@ -37,7 +37,7 @@
 	.enable_mask	= SYSRQ_ENABLE_BOOT,
 };
 
-static int pm_sysrq_init(void)
+static int __init pm_sysrq_init(void)
 {
 	register_sysrq_key('o', &sysrq_poweroff_op);
 	return 0;
diff -uriN linux-2.6.32.43/kernel/power/process.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/power/process.c
--- linux-2.6.32.43/kernel/power/process.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/power/process.c	2011-07-15 05:51:19.000000000 -0500
@@ -37,12 +37,15 @@
 	struct timeval start, end;
 	u64 elapsed_csecs64;
 	unsigned int elapsed_csecs;
+	bool timedout = false;
 
 	do_gettimeofday(&start);
 
 	end_time = jiffies + TIMEOUT;
 	do {
 		todo = 0;
+		if (time_after(jiffies, end_time))
+			timedout = true;
 		read_lock(&tasklist_lock);
 		do_each_thread(g, p) {
 			if (frozen(p) || !freezeable(p))
@@ -57,15 +60,17 @@
 			 * It is "frozen enough".  If the task does wake
 			 * up, it will immediately call try_to_freeze.
 			 */
-			if (!task_is_stopped_or_traced(p) &&
-			    !freezer_should_skip(p))
+			if (!task_is_stopped_or_traced(p) && !freezer_should_skip(p)) {
 				todo++;
+				if (timedout) {
+					printk(KERN_ERR "Task refusing to freeze:\n");
+					sched_show_task(p);
+				}
+			}
 		} while_each_thread(g, p);
 		read_unlock(&tasklist_lock);
 		yield();			/* Yield is okay here */
-		if (time_after(jiffies, end_time))
-			break;
-	} while (todo);
+	} while (todo && !timedout);
 
 	do_gettimeofday(&end);
 	elapsed_csecs64 = timeval_to_ns(&end) - timeval_to_ns(&start);
diff -uriN linux-2.6.32.43/kernel/power/suspend.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/power/suspend.c
--- linux-2.6.32.43/kernel/power/suspend.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/power/suspend.c	2011-07-15 05:51:19.000000000 -0500
@@ -23,13 +23,13 @@
 	[PM_SUSPEND_MEM]	= "mem",
 };
 
-static struct platform_suspend_ops *suspend_ops;
+static const struct platform_suspend_ops *suspend_ops;
 
 /**
  *	suspend_set_ops - Set the global suspend method table.
  *	@ops:	Pointer to ops structure.
  */
-void suspend_set_ops(struct platform_suspend_ops *ops)
+void suspend_set_ops(const struct platform_suspend_ops *ops)
 {
 	mutex_lock(&pm_mutex);
 	suspend_ops = ops;
diff -uriN linux-2.6.32.43/kernel/printk.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/printk.c
--- linux-2.6.32.43/kernel/printk.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/printk.c	2011-07-15 05:51:19.000000000 -0500
@@ -33,6 +33,7 @@
 #include <linux/bootmem.h>
 #include <linux/syscalls.h>
 #include <linux/kexec.h>
+#include <linux/vs_cvirt.h>
 
 #include <asm/uaccess.h>
 
@@ -276,18 +277,18 @@
 	unsigned i, j, limit, count;
 	int do_clear = 0;
 	char c;
-	int error = 0;
+	int error;
+
+#ifdef CONFIG_GRKERNSEC_DMESG
+	if (grsec_enable_dmesg && !capable(CAP_SYS_ADMIN))
+		return -EPERM;
+#endif
 
 	error = security_syslog(type);
 	if (error)
 		return error;
 
-	switch (type) {
-	case 0:		/* Close log */
-		break;
-	case 1:		/* Open log */
-		break;
-	case 2:		/* Read from log */
+	if ((type >= 2) && (type <= 4)) {
 		error = -EINVAL;
 		if (!buf || len < 0)
 			goto out;
@@ -298,6 +299,16 @@
 			error = -EFAULT;
 			goto out;
 		}
+	}
+	if (!vx_check(0, VS_ADMIN|VS_WATCH))
+		return vx_do_syslog(type, buf, len);
+
+	switch (type) {
+	case 0:		/* Close log */
+		break;
+	case 1:		/* Open log */
+		break;
+	case 2:		/* Read from log */
 		error = wait_event_interruptible(log_wait,
 							(log_start - log_end));
 		if (error)
@@ -322,16 +333,6 @@
 		do_clear = 1;
 		/* FALL THRU */
 	case 3:		/* Read last kernel messages */
-		error = -EINVAL;
-		if (!buf || len < 0)
-			goto out;
-		error = 0;
-		if (!len)
-			goto out;
-		if (!access_ok(VERIFY_WRITE, buf, len)) {
-			error = -EFAULT;
-			goto out;
-		}
 		count = len;
 		if (count > log_buf_len)
 			count = log_buf_len;
diff -uriN linux-2.6.32.43/kernel/profile.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/profile.c
--- linux-2.6.32.43/kernel/profile.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/profile.c	2011-07-15 05:51:19.000000000 -0500
@@ -39,7 +39,7 @@
 /* Oprofile timer tick hook */
 static int (*timer_hook)(struct pt_regs *) __read_mostly;
 
-static atomic_t *prof_buffer;
+static atomic_unchecked_t *prof_buffer;
 static unsigned long prof_len, prof_shift;
 
 int prof_on __read_mostly;
@@ -283,7 +283,7 @@
 					hits[i].pc = 0;
 				continue;
 			}
-			atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
+			atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
 			hits[i].hits = hits[i].pc = 0;
 		}
 	}
@@ -346,9 +346,9 @@
 	 * Add the current hit(s) and flush the write-queue out
 	 * to the global buffer:
 	 */
-	atomic_add(nr_hits, &prof_buffer[pc]);
+	atomic_add_unchecked(nr_hits, &prof_buffer[pc]);
 	for (i = 0; i < NR_PROFILE_HIT; ++i) {
-		atomic_add(hits[i].hits, &prof_buffer[hits[i].pc]);
+		atomic_add_unchecked(hits[i].hits, &prof_buffer[hits[i].pc]);
 		hits[i].pc = hits[i].hits = 0;
 	}
 out:
@@ -426,7 +426,7 @@
 	if (prof_on != type || !prof_buffer)
 		return;
 	pc = ((unsigned long)__pc - (unsigned long)_stext) >> prof_shift;
-	atomic_add(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
+	atomic_add_unchecked(nr_hits, &prof_buffer[min(pc, prof_len - 1)]);
 }
 #endif /* !CONFIG_SMP */
 EXPORT_SYMBOL_GPL(profile_hits);
@@ -517,7 +517,7 @@
 			return -EFAULT;
 		buf++; p++; count--; read++;
 	}
-	pnt = (char *)prof_buffer + p - sizeof(atomic_t);
+	pnt = (char *)prof_buffer + p - sizeof(atomic_unchecked_t);
 	if (copy_to_user(buf, (void *)pnt, count))
 		return -EFAULT;
 	read += count;
@@ -548,7 +548,7 @@
 	}
 #endif
 	profile_discard_flip_buffers();
-	memset(prof_buffer, 0, prof_len * sizeof(atomic_t));
+	memset(prof_buffer, 0, prof_len * sizeof(atomic_unchecked_t));
 	return count;
 }
 
diff -uriN linux-2.6.32.43/kernel/ptrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/ptrace.c
--- linux-2.6.32.43/kernel/ptrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/ptrace.c	2011-07-15 07:03:57.000000000 -0500
@@ -22,6 +22,7 @@
 #include <linux/pid_namespace.h>
 #include <linux/syscalls.h>
 #include <linux/uaccess.h>
+#include <linux/vs_context.h>
 
 
 /*
@@ -117,7 +118,8 @@
 	return ret;
 }
 
-int __ptrace_may_access(struct task_struct *task, unsigned int mode)
+static int __ptrace_may_access(struct task_struct *task, unsigned int mode,
+			       unsigned int log)
 {
 	const struct cred *cred = current_cred(), *tcred;
 
@@ -141,7 +143,9 @@
 	     cred->gid != tcred->egid ||
 	     cred->gid != tcred->sgid ||
 	     cred->gid != tcred->gid) &&
-	    !capable(CAP_SYS_PTRACE)) {
+	     ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
+	      (log && !capable(CAP_SYS_PTRACE)))
+	) {
 		rcu_read_unlock();
 		return -EPERM;
 	}
@@ -149,8 +153,15 @@
 	smp_rmb();
 	if (task->mm)
 		dumpable = get_dumpable(task->mm);
-	if (!dumpable && !capable(CAP_SYS_PTRACE))
+	if (!dumpable &&
+	     ((!log && !capable_nolog(CAP_SYS_PTRACE)) ||
+	      (log && !capable(CAP_SYS_PTRACE))))
 		return -EPERM;
+	if (!vx_check(task->xid, VS_ADMIN_P|VS_IDENT))
+		return -EPERM;
+	if (!vx_check(task->xid, VS_IDENT) &&
+		!task_vx_flags(task, VXF_STATE_ADMIN, 0))
+		return -EACCES;
 
 	return security_ptrace_access_check(task, mode);
 }
@@ -159,7 +170,16 @@
 {
 	int err;
 	task_lock(task);
-	err = __ptrace_may_access(task, mode);
+	err = __ptrace_may_access(task, mode, 0);
+	task_unlock(task);
+	return !err;
+}
+
+bool ptrace_may_access_log(struct task_struct *task, unsigned int mode)
+{
+	int err;
+	task_lock(task);
+	err = __ptrace_may_access(task, mode, 1);
 	task_unlock(task);
 	return !err;
 }
@@ -186,7 +206,7 @@
 		goto out;
 
 	task_lock(task);
-	retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH);
+	retval = __ptrace_may_access(task, PTRACE_MODE_ATTACH, 1);
 	task_unlock(task);
 	if (retval)
 		goto unlock_creds;
@@ -199,7 +219,7 @@
 		goto unlock_tasklist;
 
 	task->ptrace = PT_PTRACED;
-	if (capable(CAP_SYS_PTRACE))
+	if (capable_nolog(CAP_SYS_PTRACE))
 		task->ptrace |= PT_PTRACE_CAP;
 
 	__ptrace_link(task, current);
@@ -351,6 +371,8 @@
 {
 	int copied = 0;
 
+	pax_track_stack();
+
 	while (len > 0) {
 		char buf[128];
 		int this_len, retval;
@@ -376,6 +398,8 @@
 {
 	int copied = 0;
 
+	pax_track_stack();
+
 	while (len > 0) {
 		char buf[128];
 		int this_len, retval;
@@ -517,6 +541,8 @@
 	int ret = -EIO;
 	siginfo_t siginfo;
 
+	pax_track_stack();
+
 	switch (request) {
 	case PTRACE_PEEKTEXT:
 	case PTRACE_PEEKDATA:
@@ -532,18 +558,18 @@
 		ret = ptrace_setoptions(child, data);
 		break;
 	case PTRACE_GETEVENTMSG:
-		ret = put_user(child->ptrace_message, (unsigned long __user *) data);
+		ret = put_user(child->ptrace_message, (__force unsigned long __user *) data);
 		break;
 
 	case PTRACE_GETSIGINFO:
 		ret = ptrace_getsiginfo(child, &siginfo);
 		if (!ret)
-			ret = copy_siginfo_to_user((siginfo_t __user *) data,
+			ret = copy_siginfo_to_user((__force siginfo_t __user *) data,
 						   &siginfo);
 		break;
 
 	case PTRACE_SETSIGINFO:
-		if (copy_from_user(&siginfo, (siginfo_t __user *) data,
+		if (copy_from_user(&siginfo, (__force siginfo_t __user *) data,
 				   sizeof siginfo))
 			ret = -EFAULT;
 		else
@@ -621,14 +647,21 @@
 		goto out;
 	}
 
+	if (gr_handle_ptrace(child, request)) {
+		ret = -EPERM;
+		goto out_put_task_struct;
+	}
+
 	if (request == PTRACE_ATTACH) {
 		ret = ptrace_attach(child);
 		/*
 		 * Some architectures need to do book-keeping after
 		 * a ptrace attach.
 		 */
-		if (!ret)
+		if (!ret) {
 			arch_ptrace_attach(child);
+			gr_audit_ptrace(child);
+		}
 		goto out_put_task_struct;
 	}
 
@@ -653,7 +686,7 @@
 	copied = access_process_vm(tsk, addr, &tmp, sizeof(tmp), 0);
 	if (copied != sizeof(tmp))
 		return -EIO;
-	return put_user(tmp, (unsigned long __user *)data);
+	return put_user(tmp, (__force unsigned long __user *)data);
 }
 
 int generic_ptrace_pokedata(struct task_struct *tsk, long addr, long data)
@@ -675,6 +708,8 @@
 	siginfo_t siginfo;
 	int ret;
 
+	pax_track_stack();
+
 	switch (request) {
 	case PTRACE_PEEKTEXT:
 	case PTRACE_PEEKDATA:
@@ -740,14 +775,22 @@
 		goto out;
 	}
 
+	if (gr_handle_ptrace(child, request)) {
+		ret = -EPERM;
+		if (!vx_check(vx_task_xid(child), VS_WATCH_P | VS_IDENT))
+			goto out_put_task_struct;
+	}
+
 	if (request == PTRACE_ATTACH) {
 		ret = ptrace_attach(child);
 		/*
 		 * Some architectures need to do book-keeping after
 		 * a ptrace attach.
 		 */
-		if (!ret)
+		if (!ret) {
 			arch_ptrace_attach(child);
+			gr_audit_ptrace(child);
+		}
 		goto out_put_task_struct;
 	}
 
diff -uriN linux-2.6.32.43/kernel/rcutorture.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rcutorture.c
--- linux-2.6.32.43/kernel/rcutorture.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rcutorture.c	2011-07-15 05:51:19.000000000 -0500
@@ -118,12 +118,12 @@
 	{ 0 };
 static DEFINE_PER_CPU(long [RCU_TORTURE_PIPE_LEN + 1], rcu_torture_batch) =
 	{ 0 };
-static atomic_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
-static atomic_t n_rcu_torture_alloc;
-static atomic_t n_rcu_torture_alloc_fail;
-static atomic_t n_rcu_torture_free;
-static atomic_t n_rcu_torture_mberror;
-static atomic_t n_rcu_torture_error;
+static atomic_unchecked_t rcu_torture_wcount[RCU_TORTURE_PIPE_LEN + 1];
+static atomic_unchecked_t n_rcu_torture_alloc;
+static atomic_unchecked_t n_rcu_torture_alloc_fail;
+static atomic_unchecked_t n_rcu_torture_free;
+static atomic_unchecked_t n_rcu_torture_mberror;
+static atomic_unchecked_t n_rcu_torture_error;
 static long n_rcu_torture_timers;
 static struct list_head rcu_torture_removed;
 static cpumask_var_t shuffle_tmp_mask;
@@ -187,11 +187,11 @@
 
 	spin_lock_bh(&rcu_torture_lock);
 	if (list_empty(&rcu_torture_freelist)) {
-		atomic_inc(&n_rcu_torture_alloc_fail);
+		atomic_inc_unchecked(&n_rcu_torture_alloc_fail);
 		spin_unlock_bh(&rcu_torture_lock);
 		return NULL;
 	}
-	atomic_inc(&n_rcu_torture_alloc);
+	atomic_inc_unchecked(&n_rcu_torture_alloc);
 	p = rcu_torture_freelist.next;
 	list_del_init(p);
 	spin_unlock_bh(&rcu_torture_lock);
@@ -204,7 +204,7 @@
 static void
 rcu_torture_free(struct rcu_torture *p)
 {
-	atomic_inc(&n_rcu_torture_free);
+	atomic_inc_unchecked(&n_rcu_torture_free);
 	spin_lock_bh(&rcu_torture_lock);
 	list_add_tail(&p->rtort_free, &rcu_torture_freelist);
 	spin_unlock_bh(&rcu_torture_lock);
@@ -319,7 +319,7 @@
 	i = rp->rtort_pipe_count;
 	if (i > RCU_TORTURE_PIPE_LEN)
 		i = RCU_TORTURE_PIPE_LEN;
-	atomic_inc(&rcu_torture_wcount[i]);
+	atomic_inc_unchecked(&rcu_torture_wcount[i]);
 	if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
 		rp->rtort_mbtest = 0;
 		rcu_torture_free(rp);
@@ -359,7 +359,7 @@
 		i = rp->rtort_pipe_count;
 		if (i > RCU_TORTURE_PIPE_LEN)
 			i = RCU_TORTURE_PIPE_LEN;
-		atomic_inc(&rcu_torture_wcount[i]);
+		atomic_inc_unchecked(&rcu_torture_wcount[i]);
 		if (++rp->rtort_pipe_count >= RCU_TORTURE_PIPE_LEN) {
 			rp->rtort_mbtest = 0;
 			list_del(&rp->rtort_free);
@@ -653,7 +653,7 @@
 			i = old_rp->rtort_pipe_count;
 			if (i > RCU_TORTURE_PIPE_LEN)
 				i = RCU_TORTURE_PIPE_LEN;
-			atomic_inc(&rcu_torture_wcount[i]);
+			atomic_inc_unchecked(&rcu_torture_wcount[i]);
 			old_rp->rtort_pipe_count++;
 			cur_ops->deferred_free(old_rp);
 		}
@@ -718,7 +718,7 @@
 		return;
 	}
 	if (p->rtort_mbtest == 0)
-		atomic_inc(&n_rcu_torture_mberror);
+		atomic_inc_unchecked(&n_rcu_torture_mberror);
 	spin_lock(&rand_lock);
 	cur_ops->read_delay(&rand);
 	n_rcu_torture_timers++;
@@ -776,7 +776,7 @@
 			continue;
 		}
 		if (p->rtort_mbtest == 0)
-			atomic_inc(&n_rcu_torture_mberror);
+			atomic_inc_unchecked(&n_rcu_torture_mberror);
 		cur_ops->read_delay(&rand);
 		preempt_disable();
 		pipe_count = p->rtort_pipe_count;
@@ -834,17 +834,17 @@
 		       rcu_torture_current,
 		       rcu_torture_current_version,
 		       list_empty(&rcu_torture_freelist),
-		       atomic_read(&n_rcu_torture_alloc),
-		       atomic_read(&n_rcu_torture_alloc_fail),
-		       atomic_read(&n_rcu_torture_free),
-		       atomic_read(&n_rcu_torture_mberror),
+		       atomic_read_unchecked(&n_rcu_torture_alloc),
+		       atomic_read_unchecked(&n_rcu_torture_alloc_fail),
+		       atomic_read_unchecked(&n_rcu_torture_free),
+		       atomic_read_unchecked(&n_rcu_torture_mberror),
 		       n_rcu_torture_timers);
-	if (atomic_read(&n_rcu_torture_mberror) != 0)
+	if (atomic_read_unchecked(&n_rcu_torture_mberror) != 0)
 		cnt += sprintf(&page[cnt], " !!!");
 	cnt += sprintf(&page[cnt], "\n%s%s ", torture_type, TORTURE_FLAG);
 	if (i > 1) {
 		cnt += sprintf(&page[cnt], "!!! ");
-		atomic_inc(&n_rcu_torture_error);
+		atomic_inc_unchecked(&n_rcu_torture_error);
 		WARN_ON_ONCE(1);
 	}
 	cnt += sprintf(&page[cnt], "Reader Pipe: ");
@@ -858,7 +858,7 @@
 	cnt += sprintf(&page[cnt], "Free-Block Circulation: ");
 	for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
 		cnt += sprintf(&page[cnt], " %d",
-			       atomic_read(&rcu_torture_wcount[i]));
+			       atomic_read_unchecked(&rcu_torture_wcount[i]));
 	}
 	cnt += sprintf(&page[cnt], "\n");
 	if (cur_ops->stats)
@@ -1084,7 +1084,7 @@
 
 	if (cur_ops->cleanup)
 		cur_ops->cleanup();
-	if (atomic_read(&n_rcu_torture_error))
+	if (atomic_read_unchecked(&n_rcu_torture_error))
 		rcu_torture_print_module_parms("End of test: FAILURE");
 	else
 		rcu_torture_print_module_parms("End of test: SUCCESS");
@@ -1138,13 +1138,13 @@
 
 	rcu_torture_current = NULL;
 	rcu_torture_current_version = 0;
-	atomic_set(&n_rcu_torture_alloc, 0);
-	atomic_set(&n_rcu_torture_alloc_fail, 0);
-	atomic_set(&n_rcu_torture_free, 0);
-	atomic_set(&n_rcu_torture_mberror, 0);
-	atomic_set(&n_rcu_torture_error, 0);
+	atomic_set_unchecked(&n_rcu_torture_alloc, 0);
+	atomic_set_unchecked(&n_rcu_torture_alloc_fail, 0);
+	atomic_set_unchecked(&n_rcu_torture_free, 0);
+	atomic_set_unchecked(&n_rcu_torture_mberror, 0);
+	atomic_set_unchecked(&n_rcu_torture_error, 0);
 	for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++)
-		atomic_set(&rcu_torture_wcount[i], 0);
+		atomic_set_unchecked(&rcu_torture_wcount[i], 0);
 	for_each_possible_cpu(cpu) {
 		for (i = 0; i < RCU_TORTURE_PIPE_LEN + 1; i++) {
 			per_cpu(rcu_torture_count, cpu)[i] = 0;
diff -uriN linux-2.6.32.43/kernel/rcutree.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rcutree.c
--- linux-2.6.32.43/kernel/rcutree.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rcutree.c	2011-07-15 05:51:19.000000000 -0500
@@ -1303,7 +1303,7 @@
 /*
  * Do softirq processing for the current CPU.
  */
-static void rcu_process_callbacks(struct softirq_action *unused)
+static void rcu_process_callbacks(void)
 {
 	/*
 	 * Memory references from any prior RCU read-side critical sections
diff -uriN linux-2.6.32.43/kernel/rcutree_plugin.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rcutree_plugin.h
--- linux-2.6.32.43/kernel/rcutree_plugin.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rcutree_plugin.h	2011-07-15 05:51:19.000000000 -0500
@@ -145,7 +145,7 @@
  */
 void __rcu_read_lock(void)
 {
-	ACCESS_ONCE(current->rcu_read_lock_nesting)++;
+	ACCESS_ONCE_RW(current->rcu_read_lock_nesting)++;
 	barrier();  /* needed if we ever invoke rcu_read_lock in rcutree.c */
 }
 EXPORT_SYMBOL_GPL(__rcu_read_lock);
@@ -251,7 +251,7 @@
 	struct task_struct *t = current;
 
 	barrier();  /* needed if we ever invoke rcu_read_unlock in rcutree.c */
-	if (--ACCESS_ONCE(t->rcu_read_lock_nesting) == 0 &&
+	if (--ACCESS_ONCE_RW(t->rcu_read_lock_nesting) == 0 &&
 	    unlikely(ACCESS_ONCE(t->rcu_read_unlock_special)))
 		rcu_read_unlock_special(t);
 }
diff -uriN linux-2.6.32.43/kernel/relay.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/relay.c
--- linux-2.6.32.43/kernel/relay.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/relay.c	2011-07-15 05:51:19.000000000 -0500
@@ -1222,7 +1222,7 @@
 			       unsigned int flags,
 			       int *nonpad_ret)
 {
-	unsigned int pidx, poff, total_len, subbuf_pages, nr_pages, ret;
+	unsigned int pidx, poff, total_len, subbuf_pages, nr_pages;
 	struct rchan_buf *rbuf = in->private_data;
 	unsigned int subbuf_size = rbuf->chan->subbuf_size;
 	uint64_t pos = (uint64_t) *ppos;
@@ -1241,6 +1241,9 @@
 		.ops = &relay_pipe_buf_ops,
 		.spd_release = relay_page_release,
 	};
+	ssize_t ret;
+
+	pax_track_stack();
 
 	if (rbuf->subbufs_produced == rbuf->subbufs_consumed)
 		return 0;
diff -uriN linux-2.6.32.43/kernel/resource.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/resource.c
--- linux-2.6.32.43/kernel/resource.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/resource.c	2011-07-15 05:51:19.000000000 -0500
@@ -132,8 +132,18 @@
 
 static int __init ioresources_init(void)
 {
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+#ifdef CONFIG_GRKERNSEC_PROC_USER
+	proc_create("ioports", S_IRUSR, NULL, &proc_ioports_operations);
+	proc_create("iomem", S_IRUSR, NULL, &proc_iomem_operations);
+#elif defined(CONFIG_GRKERNSEC_PROC_USERGROUP)
+	proc_create("ioports", S_IRUSR | S_IRGRP, NULL, &proc_ioports_operations);
+	proc_create("iomem", S_IRUSR | S_IRGRP, NULL, &proc_iomem_operations);
+#endif
+#else
 	proc_create("ioports", 0, NULL, &proc_ioports_operations);
 	proc_create("iomem", 0, NULL, &proc_iomem_operations);
+#endif
 	return 0;
 }
 __initcall(ioresources_init);
diff -uriN linux-2.6.32.43/kernel/rtmutex.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rtmutex.c
--- linux-2.6.32.43/kernel/rtmutex.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rtmutex.c	2011-07-15 05:51:19.000000000 -0500
@@ -511,7 +511,7 @@
 	 */
 	spin_lock_irqsave(&pendowner->pi_lock, flags);
 
-	WARN_ON(!pendowner->pi_blocked_on);
+	BUG_ON(!pendowner->pi_blocked_on);
 	WARN_ON(pendowner->pi_blocked_on != waiter);
 	WARN_ON(pendowner->pi_blocked_on->lock != lock);
 
diff -uriN linux-2.6.32.43/kernel/rtmutex-tester.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rtmutex-tester.c
--- linux-2.6.32.43/kernel/rtmutex-tester.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/rtmutex-tester.c	2011-07-15 05:51:19.000000000 -0500
@@ -21,7 +21,7 @@
 #define MAX_RT_TEST_MUTEXES	8
 
 static spinlock_t rttest_lock;
-static atomic_t rttest_event;
+static atomic_unchecked_t rttest_event;
 
 struct test_thread_data {
 	int			opcode;
@@ -64,7 +64,7 @@
 
 	case RTTEST_LOCKCONT:
 		td->mutexes[td->opdata] = 1;
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		return 0;
 
 	case RTTEST_RESET:
@@ -82,7 +82,7 @@
 		return 0;
 
 	case RTTEST_RESETEVENT:
-		atomic_set(&rttest_event, 0);
+		atomic_set_unchecked(&rttest_event, 0);
 		return 0;
 
 	default:
@@ -99,9 +99,9 @@
 			return ret;
 
 		td->mutexes[id] = 1;
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		rt_mutex_lock(&mutexes[id]);
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		td->mutexes[id] = 4;
 		return 0;
 
@@ -112,9 +112,9 @@
 			return ret;
 
 		td->mutexes[id] = 1;
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		ret = rt_mutex_lock_interruptible(&mutexes[id], 0);
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		td->mutexes[id] = ret ? 0 : 4;
 		return ret ? -EINTR : 0;
 
@@ -123,9 +123,9 @@
 		if (id < 0 || id >= MAX_RT_TEST_MUTEXES || td->mutexes[id] != 4)
 			return ret;
 
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		rt_mutex_unlock(&mutexes[id]);
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		td->mutexes[id] = 0;
 		return 0;
 
@@ -187,7 +187,7 @@
 			break;
 
 		td->mutexes[dat] = 2;
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		break;
 
 	case RTTEST_LOCKBKL:
@@ -208,7 +208,7 @@
 			return;
 
 		td->mutexes[dat] = 3;
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		break;
 
 	case RTTEST_LOCKNOWAIT:
@@ -220,7 +220,7 @@
 			return;
 
 		td->mutexes[dat] = 1;
-		td->event = atomic_add_return(1, &rttest_event);
+		td->event = atomic_add_return_unchecked(1, &rttest_event);
 		return;
 
 	case RTTEST_LOCKBKL:
diff -uriN linux-2.6.32.43/kernel/sched.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sched.c
--- linux-2.6.32.43/kernel/sched.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sched.c	2011-07-15 06:45:28.000000000 -0500
@@ -71,6 +71,8 @@
 #include <linux/debugfs.h>
 #include <linux/ctype.h>
 #include <linux/ftrace.h>
+#include <linux/vs_sched.h>
+#include <linux/vs_cvirt.h>
 
 #include <asm/tlb.h>
 #include <asm/irq_regs.h>
@@ -237,6 +239,15 @@
 
 #include <linux/cgroup.h>
 
+#if defined(CONFIG_FAIR_GROUP_SCHED) && defined(CONFIG_CFS_HARD_LIMITS)
+struct cfs_bandwidth {
+	spinlock_t		cfs_runtime_lock;
+	ktime_t			cfs_period;
+	u64			cfs_runtime;
+	struct hrtimer		cfs_period_timer;
+};
+#endif
+
 struct cfs_rq;
 
 static LIST_HEAD(task_groups);
@@ -251,6 +262,9 @@
 	/* runqueue "owned" by this group on each cpu */
 	struct cfs_rq **cfs_rq;
 	unsigned long shares;
+#ifdef CONFIG_CFS_HARD_LIMITS
+	struct cfs_bandwidth cfs_bandwidth;
+#endif
 #endif
 
 #ifdef CONFIG_RT_GROUP_SCHED
@@ -404,6 +418,19 @@
 	unsigned long rq_weight;
 #endif
 #endif
+#ifdef CONFIG_CFS_HARD_LIMITS
+	/* set when the group is throttled  on this cpu */
+	int cfs_throttled;
+
+	/* runtime currently consumed by the group on this rq */
+	u64 cfs_time;
+
+	/* runtime available to the group on this rq */
+	u64 cfs_runtime;
+
+	/* Protects the cfs runtime related fields of this cfs_rq */
+	spinlock_t cfs_runtime_lock;
+#endif
 };
 
 /* Real-Time classes' related field in a runqueue: */
@@ -1586,6 +1613,7 @@
 	}
 }
 
+static inline int cfs_rq_throttled(struct cfs_rq *cfs_rq);
 /*
  * Re-compute the task group their per cpu shares over the given domain.
  * This needs to be done in a bottom-up fashion because the rq weight of a
@@ -1614,8 +1642,10 @@
 		 * If there are currently no tasks on the cpu pretend there
 		 * is one of average load so that when a new task gets to
 		 * run here it will not get delayed by group starvation.
+		 * Also if the group is throttled on this cpu, pretend that
+		 * it has no tasks.
 		 */
-		if (!weight)
+		if (!weight || cfs_rq_throttled(tg->cfs_rq[i]))
 			weight = NICE_0_LOAD;
 
 		sum_weight += weight;
@@ -1792,6 +1822,175 @@
 static void calc_load_account_active(struct rq *this_rq);
 static void update_sysctl(void);
 
+
+#if defined(CONFIG_RT_GROUP_SCHED) || defined(CONFIG_FAIR_GROUP_SCHED)
+
+#ifdef CONFIG_SMP
+static inline const struct cpumask *sched_bw_period_mask(void)
+{
+	return cpu_rq(smp_processor_id())->rd->span;
+}
+#else /* !CONFIG_SMP */
+static inline const struct cpumask *sched_bw_period_mask(void)
+{
+	return cpu_online_mask;
+}
+#endif /* CONFIG_SMP */
+
+#else
+static inline const struct cpumask *sched_bw_period_mask(void)
+{
+	return cpu_online_mask;
+}
+
+#endif
+
+#ifdef CONFIG_FAIR_GROUP_SCHED
+#ifdef CONFIG_CFS_HARD_LIMITS
+
+/*
+ * Runtime allowed for a cfs group before it is hard limited.
+ * default: Infinite which means no hard limiting.
+ */
+u64 sched_cfs_runtime = RUNTIME_INF;
+
+/*
+ * period over which we hard limit the cfs group's bandwidth.
+ * default: 0.5s
+ */
+u64 sched_cfs_period = 500000;
+
+static inline u64 global_cfs_period(void)
+{
+	return sched_cfs_period * NSEC_PER_USEC;
+}
+
+static inline u64 global_cfs_runtime(void)
+{
+	return RUNTIME_INF;
+}
+
+void do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b);
+
+static inline void cfs_rq_runtime_lock(struct cfs_rq *cfs_rq)
+{
+	spin_lock(&cfs_rq->cfs_runtime_lock);
+}
+
+static inline void cfs_rq_runtime_unlock(struct cfs_rq *cfs_rq)
+{
+	spin_unlock(&cfs_rq->cfs_runtime_lock);
+}
+
+/*
+ * Refresh the runtimes of the throttled groups.
+ * But nothing much to do now, will populate this in later patches.
+ */
+static enum hrtimer_restart sched_cfs_period_timer(struct hrtimer *timer)
+{
+	struct cfs_bandwidth *cfs_b =
+		container_of(timer, struct cfs_bandwidth, cfs_period_timer);
+
+	do_sched_cfs_period_timer(cfs_b);
+	hrtimer_add_expires_ns(timer, ktime_to_ns(cfs_b->cfs_period));
+	return HRTIMER_RESTART;
+}
+
+/*
+ * TODO: Check if this kind of timer setup is sufficient for cfs or
+ * should we do what rt is doing.
+ */
+static void start_cfs_bandwidth(struct task_group *tg)
+{
+	struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
+
+	/*
+	 * Timer isn't setup for groups with infinite runtime
+	 */
+	if (cfs_b->cfs_runtime == RUNTIME_INF)
+		return;
+
+	if (hrtimer_active(&cfs_b->cfs_period_timer))
+		return;
+
+	hrtimer_start_range_ns(&cfs_b->cfs_period_timer, cfs_b->cfs_period,
+			0, HRTIMER_MODE_REL);
+}
+
+static void init_cfs_bandwidth(struct task_group *tg)
+{
+	struct cfs_bandwidth *cfs_b = &tg->cfs_bandwidth;
+
+	cfs_b->cfs_period = ns_to_ktime(global_cfs_period());
+	cfs_b->cfs_runtime = global_cfs_runtime();
+
+	spin_lock_init(&cfs_b->cfs_runtime_lock);
+
+	hrtimer_init(&cfs_b->cfs_period_timer,
+			CLOCK_MONOTONIC, HRTIMER_MODE_REL);
+	cfs_b->cfs_period_timer.function = &sched_cfs_period_timer;
+}
+
+static inline void destroy_cfs_bandwidth(struct task_group *tg)
+{
+	hrtimer_cancel(&tg->cfs_bandwidth.cfs_period_timer);
+}
+
+static void init_cfs_hard_limits(struct cfs_rq *cfs_rq, struct task_group *tg)
+{
+	cfs_rq->cfs_time = 0;
+	cfs_rq->cfs_throttled = 0;
+	cfs_rq->cfs_runtime = tg->cfs_bandwidth.cfs_runtime;
+	spin_lock_init(&cfs_rq->cfs_runtime_lock);
+}
+
+#else /* !CONFIG_CFS_HARD_LIMITS */
+
+static void init_cfs_bandwidth(struct task_group *tg)
+{
+	return;
+}
+
+static inline void destroy_cfs_bandwidth(struct task_group *tg)
+{
+	return;
+}
+
+static void init_cfs_hard_limits(struct cfs_rq *cfs_rq, struct task_group *tg)
+{
+	return;
+}
+
+static inline void cfs_rq_runtime_lock(struct cfs_rq *cfs_rq)
+{
+	return;
+}
+
+static inline void cfs_rq_runtime_unlock(struct cfs_rq *cfs_rq)
+{
+	return;
+}
+
+#endif /* CONFIG_CFS_HARD_LIMITS */
+#else /* !CONFIG_FAIR_GROUP_SCHED */
+
+static inline void cfs_rq_runtime_lock(struct cfs_rq *cfs_rq)
+{
+	return;
+}
+
+static inline void cfs_rq_runtime_unlock(struct cfs_rq *cfs_rq)
+{
+	return;
+}
+
+static inline int cfs_rq_throttled(struct cfs_rq *cfs_rq)
+{
+	return 0;
+}
+
+#endif /* CONFIG_FAIR_GROUP_SCHED */
+
 static inline void __set_task_cpu(struct task_struct *p, unsigned int cpu)
 {
 	set_task_rq(p, cpu);
@@ -3129,9 +3328,17 @@
  */
 void get_avenrun(unsigned long *loads, unsigned long offset, int shift)
 {
-	loads[0] = (avenrun[0] + offset) << shift;
-	loads[1] = (avenrun[1] + offset) << shift;
-	loads[2] = (avenrun[2] + offset) << shift;
+	if (vx_flags(VXF_VIRT_LOAD, 0)) {
+		struct vx_info *vxi = current_vx_info();
+
+		loads[0] = (vxi->cvirt.load[0] + offset) << shift;
+		loads[1] = (vxi->cvirt.load[1] + offset) << shift;
+		loads[2] = (vxi->cvirt.load[2] + offset) << shift;
+	} else {
+		loads[0] = (avenrun[0] + offset) << shift;
+		loads[1] = (avenrun[1] + offset) << shift;
+		loads[2] = (avenrun[2] + offset) << shift;
+	}
 }
 
 static unsigned long
@@ -5043,7 +5250,7 @@
  * In CONFIG_NO_HZ case, the idle load balance owner will do the
  * rebalancing for all the cpus for whom scheduler ticks are stopped.
  */
-static void run_rebalance_domains(struct softirq_action *h)
+static void run_rebalance_domains(void)
 {
 	int this_cpu = smp_processor_id();
 	struct rq *this_rq = cpu_rq(this_cpu);
@@ -5245,16 +5452,19 @@
 		       cputime_t cputime_scaled)
 {
 	struct cpu_usage_stat *cpustat = &kstat_this_cpu.cpustat;
+	struct vx_info *vxi = p->vx_info;  /* p is _always_ current */
 	cputime64_t tmp;
+	int nice = (TASK_NICE(p) > 0);
 
 	/* Add user time to process. */
 	p->utime = cputime_add(p->utime, cputime);
 	p->utimescaled = cputime_add(p->utimescaled, cputime_scaled);
+	vx_account_user(vxi, cputime, nice);
 	account_group_user_time(p, cputime);
 
 	/* Add user time to cpustat. */
 	tmp = cputime_to_cputime64(cputime);
-	if (TASK_NICE(p) > 0)
+	if (nice)
 		cpustat->nice = cputime64_add(cpustat->nice, tmp);
 	else
 		cpustat->user = cputime64_add(cpustat->user, tmp);
@@ -5300,6 +5510,7 @@
 			 cputime_t cputime, cputime_t cputime_scaled)
 {
 	struct cpu_usage_stat *cpustat = &kstat_this_cpu.cpustat;
+	struct vx_info *vxi = p->vx_info;  /* p is _always_ current */
 	cputime64_t tmp;
 
 	if ((p->flags & PF_VCPU) && (irq_count() - hardirq_offset == 0)) {
@@ -5310,6 +5521,7 @@
 	/* Add system time to process. */
 	p->stime = cputime_add(p->stime, cputime);
 	p->stimescaled = cputime_add(p->stimescaled, cputime_scaled);
+	vx_account_system(vxi, cputime, 0 /* do we have idle time? */);
 	account_group_system_time(p, cputime);
 
 	/* Add system time to cpustat. */
@@ -5700,6 +5912,8 @@
 	struct rq *rq;
 	int cpu;
 
+	pax_track_stack();
+
 need_resched:
 	preempt_disable();
 	cpu = smp_processor_id();
@@ -5770,7 +5984,7 @@
  * Look out! "owner" is an entirely speculative pointer
  * access and not reliable.
  */
-int mutex_spin_on_owner(struct mutex *lock, struct thread_info *owner)
+int mutex_spin_on_owner(struct mutex *lock, struct task_struct *owner)
 {
 	unsigned int cpu;
 	struct rq *rq;
@@ -5784,10 +5998,10 @@
 	 * DEBUG_PAGEALLOC could have unmapped it if
 	 * the mutex owner just released it and exited.
 	 */
-	if (probe_kernel_address(&owner->cpu, cpu))
+	if (probe_kernel_address(&task_thread_info(owner)->cpu, cpu))
 		return 0;
 #else
-	cpu = owner->cpu;
+	cpu = task_thread_info(owner)->cpu;
 #endif
 
 	/*
@@ -5816,7 +6030,7 @@
 		/*
 		 * Is that owner really running on that cpu?
 		 */
-		if (task_thread_info(rq->curr) != owner || need_resched())
+		if (rq->curr != owner || need_resched())
 			return 0;
 
 		cpu_relax();
@@ -6359,6 +6573,8 @@
 	/* convert nice value [19,-20] to rlimit style value [1,40] */
 	int nice_rlim = 20 - nice;
 
+	gr_learn_resource(p, RLIMIT_NICE, nice_rlim, 1);
+
 	return (nice_rlim <= p->signal->rlim[RLIMIT_NICE].rlim_cur ||
 		capable(CAP_SYS_NICE));
 }
@@ -6392,8 +6608,9 @@
 	if (nice > 19)
 		nice = 19;
 
-	if (increment < 0 && !can_nice(current, nice))
-		return -EPERM;
+	if (increment < 0 && (!can_nice(current, nice) ||
+			      gr_handle_chroot_nice()))
+		return vx_flags(VXF_IGNEG_NICE, 0) ? 0 : -EPERM;
 
 	retval = security_task_setnice(current, nice);
 	if (retval)
@@ -8774,7 +8991,7 @@
 	long power;
 	int weight;
 
-	WARN_ON(!sd || !sd->groups);
+	BUG_ON(!sd || !sd->groups);
 
 	if (cpu != group_first_cpu(sd->groups))
 		return;
@@ -9470,6 +9687,32 @@
 }
 #endif
 
+#ifdef CONFIG_SMP
+static void disable_runtime(struct rq *rq)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&rq->lock, flags);
+#if defined(CONFIG_FAIR_GROUP_SCHED) && defined(CONFIG_CFS_HARD_LIMITS)
+	disable_runtime_cfs(rq);
+#endif
+	disable_runtime_rt(rq);
+	spin_unlock_irqrestore(&rq->lock, flags);
+}
+
+static void enable_runtime(struct rq *rq)
+{
+	unsigned long flags;
+
+	spin_lock_irqsave(&rq->lock, flags);
+#if defined(CONFIG_FAIR_GROUP_SCHED) && defined(CONFIG_CFS_HARD_LIMITS)
+	enable_runtime_cfs(rq);
+#endif
+	enable_runtime_rt(rq);
+	spin_unlock_irqrestore(&rq->lock, flags);
+}
+#endif
+
 static int update_runtime(struct notifier_block *nfb,
 				unsigned long action, void *hcpu)
 {
@@ -9602,6 +9845,7 @@
 	struct rq *rq = cpu_rq(cpu);
 	tg->cfs_rq[cpu] = cfs_rq;
 	init_cfs_rq(cfs_rq, rq);
+	init_cfs_hard_limits(cfs_rq, tg);
 	cfs_rq->tg = tg;
 	if (add)
 		list_add(&cfs_rq->leaf_cfs_rq_list, &rq->leaf_cfs_rq_list);
@@ -9710,6 +9954,10 @@
 			global_rt_period(), global_rt_runtime());
 #endif /* CONFIG_RT_GROUP_SCHED */
 
+#ifdef CONFIG_FAIR_GROUP_SCHED
+	init_cfs_bandwidth(&init_task_group);
+#endif
+
 #ifdef CONFIG_CGROUP_SCHED
 	list_add(&init_task_group.list, &task_groups);
 	INIT_LIST_HEAD(&init_task_group.children);
@@ -9731,6 +9979,7 @@
 		init_cfs_rq(&rq->cfs, rq);
 		init_rt_rq(&rq->rt, rq);
 #ifdef CONFIG_FAIR_GROUP_SCHED
+		init_cfs_hard_limits(&rq->cfs, &init_task_group);
 		init_task_group.shares = init_task_group_load;
 		INIT_LIST_HEAD(&rq->leaf_cfs_rq_list);
 #ifdef CONFIG_CGROUP_SCHED
@@ -9992,6 +10241,7 @@
 {
 	int i;
 
+	destroy_cfs_bandwidth(tg);
 	for_each_possible_cpu(i) {
 		if (tg->cfs_rq)
 			kfree(tg->cfs_rq[i]);
@@ -10018,6 +10268,7 @@
 	if (!tg->se)
 		goto err;
 
+	init_cfs_bandwidth(tg);
 	tg->shares = NICE_0_LOAD;
 
 	for_each_possible_cpu(i) {
@@ -10734,6 +10985,100 @@
 
 	return (u64) tg->shares;
 }
+
+#ifdef CONFIG_CFS_HARD_LIMITS
+
+static int tg_set_cfs_bandwidth(struct task_group *tg,
+		u64 cfs_period, u64 cfs_runtime)
+{
+	int i;
+
+	spin_lock_irq(&tg->cfs_bandwidth.cfs_runtime_lock);
+	tg->cfs_bandwidth.cfs_period = ns_to_ktime(cfs_period);
+	tg->cfs_bandwidth.cfs_runtime = cfs_runtime;
+
+	for_each_possible_cpu(i) {
+		struct cfs_rq *cfs_rq = tg->cfs_rq[i];
+
+		cfs_rq_runtime_lock(cfs_rq);
+		cfs_rq->cfs_runtime = cfs_runtime;
+		cfs_rq_runtime_unlock(cfs_rq);
+	}
+
+	start_cfs_bandwidth(tg);
+	spin_unlock_irq(&tg->cfs_bandwidth.cfs_runtime_lock);
+	return 0;
+}
+
+int tg_set_cfs_runtime(struct task_group *tg, long cfs_runtime_us)
+{
+	u64 cfs_runtime, cfs_period;
+
+	cfs_period = ktime_to_ns(tg->cfs_bandwidth.cfs_period);
+	cfs_runtime = (u64)cfs_runtime_us * NSEC_PER_USEC;
+	if (cfs_runtime_us < 0)
+		cfs_runtime = RUNTIME_INF;
+
+	return tg_set_cfs_bandwidth(tg, cfs_period, cfs_runtime);
+}
+
+long tg_get_cfs_runtime(struct task_group *tg)
+{
+	u64 cfs_runtime_us;
+
+	if (tg->cfs_bandwidth.cfs_runtime == RUNTIME_INF)
+		return -1;
+
+	cfs_runtime_us = tg->cfs_bandwidth.cfs_runtime;
+	do_div(cfs_runtime_us, NSEC_PER_USEC);
+	return cfs_runtime_us;
+}
+
+int tg_set_cfs_period(struct task_group *tg, long cfs_period_us)
+{
+	u64 cfs_runtime, cfs_period;
+
+	cfs_period = (u64)cfs_period_us * NSEC_PER_USEC;
+	cfs_runtime = tg->cfs_bandwidth.cfs_runtime;
+
+	if (cfs_period == 0)
+		return -EINVAL;
+
+	return tg_set_cfs_bandwidth(tg, cfs_period, cfs_runtime);
+}
+
+long tg_get_cfs_period(struct task_group *tg)
+{
+	u64 cfs_period_us;
+
+	cfs_period_us = ktime_to_ns(tg->cfs_bandwidth.cfs_period);
+	do_div(cfs_period_us, NSEC_PER_USEC);
+	return cfs_period_us;
+}
+
+static s64 cpu_cfs_runtime_read_s64(struct cgroup *cgrp, struct cftype *cft)
+{
+	return tg_get_cfs_runtime(cgroup_tg(cgrp));
+}
+
+static int cpu_cfs_runtime_write_s64(struct cgroup *cgrp, struct cftype *cftype,
+				s64 cfs_runtime_us)
+{
+	return tg_set_cfs_runtime(cgroup_tg(cgrp), cfs_runtime_us);
+}
+
+static u64 cpu_cfs_period_read_u64(struct cgroup *cgrp, struct cftype *cft)
+{
+	return tg_get_cfs_period(cgroup_tg(cgrp));
+}
+
+static int cpu_cfs_period_write_u64(struct cgroup *cgrp, struct cftype *cftype,
+				u64 cfs_period_us)
+{
+	return tg_set_cfs_period(cgroup_tg(cgrp), cfs_period_us);
+}
+
+#endif /* CONFIG_CFS_HARD_LIMITS */
 #endif /* CONFIG_FAIR_GROUP_SCHED */
 
 #ifdef CONFIG_RT_GROUP_SCHED
@@ -10767,6 +11112,18 @@
 		.read_u64 = cpu_shares_read_u64,
 		.write_u64 = cpu_shares_write_u64,
 	},
+#ifdef CONFIG_CFS_HARD_LIMITS
+	{
+		.name = "cfs_runtime_us",
+		.read_s64 = cpu_cfs_runtime_read_s64,
+		.write_s64 = cpu_cfs_runtime_write_s64,
+	},
+	{
+		.name = "cfs_period_us",
+		.read_u64 = cpu_cfs_period_read_u64,
+		.write_u64 = cpu_cfs_period_write_u64,
+	},
+#endif /* CONFIG_CFS_HARD_LIMITS */
 #endif
 #ifdef CONFIG_RT_GROUP_SCHED
 	{
diff -uriN linux-2.6.32.43/kernel/sched_debug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sched_debug.c
--- linux-2.6.32.43/kernel/sched_debug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sched_debug.c	2011-07-15 05:50:11.000000000 -0500
@@ -80,6 +80,11 @@
 	PN(se->wait_max);
 	PN(se->wait_sum);
 	P(se->wait_count);
+#ifdef CONFIG_CFS_HARD_LIMITS
+	PN(se->throttle_max);
+	PN(se->throttle_sum);
+	P(se->throttle_count);
+#endif
 #endif
 	P(se->load.weight);
 #undef PN
@@ -209,6 +214,16 @@
 #ifdef CONFIG_SMP
 	SEQ_printf(m, "  .%-30s: %lu\n", "shares", cfs_rq->shares);
 #endif
+#ifdef CONFIG_CFS_HARD_LIMITS
+	spin_lock_irqsave(&rq->lock, flags);
+	SEQ_printf(m, "  .%-30s: %d\n", "cfs_throttled",
+			cfs_rq->cfs_throttled);
+	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "cfs_time",
+			SPLIT_NS(cfs_rq->cfs_time));
+	SEQ_printf(m, "  .%-30s: %Ld.%06ld\n", "cfs_runtime",
+			SPLIT_NS(cfs_rq->cfs_runtime));
+	spin_unlock_irqrestore(&rq->lock, flags);
+#endif /* CONFIG_CFS_HARD_LIMITS */
 	print_cfs_group_stats(m, cpu, cfs_rq->tg);
 #endif
 }
@@ -309,7 +324,7 @@
 	u64 now = ktime_to_ns(ktime_get());
 	int cpu;
 
-	SEQ_printf(m, "Sched Debug Version: v0.09, %s %.*s\n",
+	SEQ_printf(m, "Sched Debug Version: v0.10, %s %.*s\n",
 		init_utsname()->release,
 		(int)strcspn(init_utsname()->version, " "),
 		init_utsname()->version);
diff -uriN linux-2.6.32.43/kernel/sched_fair.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sched_fair.c
--- linux-2.6.32.43/kernel/sched_fair.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sched_fair.c	2011-07-15 05:50:11.000000000 -0500
@@ -192,7 +192,308 @@
 	}
 }
 
-#else	/* !CONFIG_FAIR_GROUP_SCHED */
+#ifdef CONFIG_CFS_HARD_LIMITS
+
+static inline void update_stats_throttle_start(struct cfs_rq *cfs_rq,
+			struct sched_entity *se)
+{
+	schedstat_set(se->throttle_start, rq_of(cfs_rq)->clock);
+}
+
+static inline void update_stats_throttle_end(struct cfs_rq *cfs_rq,
+			struct sched_entity *se)
+{
+	schedstat_set(se->throttle_max, max(se->throttle_max,
+			rq_of(cfs_rq)->clock - se->throttle_start));
+	schedstat_set(se->throttle_count, se->throttle_count + 1);
+	schedstat_set(se->throttle_sum, se->throttle_sum +
+			rq_of(cfs_rq)->clock - se->throttle_start);
+	schedstat_set(se->throttle_start, 0);
+}
+
+static inline
+struct cfs_rq *sched_cfs_period_cfs_rq(struct cfs_bandwidth *cfs_b, int cpu)
+{
+	return container_of(cfs_b, struct task_group,
+			cfs_bandwidth)->cfs_rq[cpu];
+}
+
+static inline int cfs_rq_throttled(struct cfs_rq *cfs_rq)
+{
+	return cfs_rq->cfs_throttled;
+}
+
+#ifdef CONFIG_SMP
+/*
+ * Ensure this RQ takes back all the runtime it lend to its neighbours.
+ */
+static void disable_runtime_cfs(struct rq *rq)
+{
+	struct root_domain *rd = rq->rd;
+	struct cfs_rq *cfs_rq;
+
+	if (unlikely(!scheduler_running))
+		return;
+
+	for_each_leaf_cfs_rq(rq, cfs_rq) {
+		struct cfs_bandwidth *cfs_b = &cfs_rq->tg->cfs_bandwidth;
+		s64 want;
+		int i;
+
+		spin_lock(&cfs_b->cfs_runtime_lock);
+		spin_lock(&cfs_rq->cfs_runtime_lock);
+
+		/*
+		 * Either we're all are infinity and nobody needs to borrow,
+		 * or we're already disabled and this have nothing to do, or
+		 * we have exactly the right amount of runtime to take out.
+		 */
+		 if (cfs_rq->cfs_runtime == RUNTIME_INF ||
+				cfs_rq->cfs_runtime == cfs_b->cfs_runtime)
+			goto balanced;
+		spin_unlock(&cfs_rq->cfs_runtime_lock);
+
+		/*
+		 * Calculate the difference between what we started out with
+		 * and what we current have, that's the amount of runtime
+		 * we lend and now have to reclaim.
+		 */
+		 want = cfs_b->cfs_runtime - cfs_rq->cfs_runtime;
+
+		/*
+		 * Greedy reclaim, take back as much as possible.
+		 */
+		for_each_cpu(i, rd->span) {
+			struct cfs_rq *iter = sched_cfs_period_cfs_rq(cfs_b, i);
+			s64 diff;
+
+			/*
+			 * Can't reclaim from ourselves or disabled runqueues.
+			 */
+			if (iter == cfs_rq || iter->cfs_runtime == RUNTIME_INF)
+				continue;
+
+			spin_lock(&iter->cfs_runtime_lock);
+			if (want > 0) {
+				diff = min_t(s64, iter->cfs_runtime, want);
+				iter->cfs_runtime -= diff;
+				want -= diff;
+			} else {
+				iter->cfs_runtime -= want;
+				want -= want;
+			}
+
+			spin_unlock(&iter->cfs_runtime_lock);
+			if (!want)
+				break;
+		}
+
+		spin_lock(&cfs_rq->cfs_runtime_lock);
+		/*
+		 * We cannot be left wanting - that would mean some
+		 * runtime leaked out of the system.
+		 */
+		BUG_ON(want);
+balanced:
+		/*
+		 * Disable all the borrow logic by pretending we have infinite
+		 * runtime - in which case borrowing doesn't make sense.
+		 */
+		 cfs_rq->cfs_runtime = RUNTIME_INF;
+		 spin_unlock(&cfs_rq->cfs_runtime_lock);
+		 spin_unlock(&cfs_b->cfs_runtime_lock);
+	}
+}
+
+static void enable_runtime_cfs(struct rq *rq)
+{
+	struct cfs_rq *cfs_rq;
+
+	if (unlikely(!scheduler_running))
+		return;
+
+	/*
+	 * Reset each runqueue's bandwidth settings
+	 */
+	for_each_leaf_cfs_rq(rq, cfs_rq) {
+		struct cfs_bandwidth *cfs_b = &cfs_rq->tg->cfs_bandwidth;
+
+		spin_lock(&cfs_b->cfs_runtime_lock);
+		spin_lock(&cfs_rq->cfs_runtime_lock);
+		cfs_rq->cfs_runtime = cfs_b->cfs_runtime;
+		cfs_rq->cfs_time = 0;
+		cfs_rq->cfs_throttled = 0;
+		spin_unlock(&cfs_rq->cfs_runtime_lock);
+		spin_unlock(&cfs_b->cfs_runtime_lock);
+	}
+}
+
+/*
+ * Ran out of runtime, check if we can borrow some from others
+ * instead of getting throttled right away.
+ */
+static void do_cfs_balance_runtime(struct cfs_rq *cfs_rq)
+{
+	struct cfs_bandwidth *cfs_b = &cfs_rq->tg->cfs_bandwidth;
+	const struct cpumask *span = sched_bw_period_mask();
+	int i, weight;
+	u64 cfs_period;
+
+	weight = cpumask_weight(span);
+	spin_lock(&cfs_b->cfs_runtime_lock);
+	cfs_period = ktime_to_ns(cfs_b->cfs_period);
+
+	for_each_cpu(i, span) {
+		struct cfs_rq *borrow_cfs_rq =
+				sched_cfs_period_cfs_rq(cfs_b, i);
+		s64 diff;
+
+		if (borrow_cfs_rq == cfs_rq)
+			continue;
+
+		cfs_rq_runtime_lock(borrow_cfs_rq);
+		if (borrow_cfs_rq->cfs_runtime == RUNTIME_INF) {
+			cfs_rq_runtime_unlock(borrow_cfs_rq);
+			continue;
+		}
+
+		diff = borrow_cfs_rq->cfs_runtime - borrow_cfs_rq->cfs_time;
+		if (diff > 0) {
+			diff = div_u64((u64)diff, weight);
+			if (cfs_rq->cfs_runtime + diff > cfs_period)
+				diff = cfs_period - cfs_rq->cfs_runtime;
+			borrow_cfs_rq->cfs_runtime -= diff;
+			cfs_rq->cfs_runtime += diff;
+			if (cfs_rq->cfs_runtime == cfs_period) {
+				cfs_rq_runtime_unlock(borrow_cfs_rq);
+				break;
+			}
+		}
+		cfs_rq_runtime_unlock(borrow_cfs_rq);
+	}
+	spin_unlock(&cfs_b->cfs_runtime_lock);
+}
+
+/*
+ * Called with rq->runtime_lock held.
+ */
+static void cfs_balance_runtime(struct cfs_rq *cfs_rq)
+{
+	cfs_rq_runtime_unlock(cfs_rq);
+	do_cfs_balance_runtime(cfs_rq);
+	cfs_rq_runtime_lock(cfs_rq);
+}
+
+#else /* !CONFIG_SMP */
+
+static void cfs_balance_runtime(struct cfs_rq *cfs_rq)
+{
+	return;
+}
+#endif /* CONFIG_SMP */
+
+/*
+ * Check if group entity exceeded its runtime. If so, mark the cfs_rq as
+ * throttled mark the current task for reschedling.
+ */
+static void sched_cfs_runtime_exceeded(struct sched_entity *se,
+	struct task_struct *tsk_curr, unsigned long delta_exec)
+{
+	struct cfs_rq *cfs_rq;
+
+	cfs_rq = group_cfs_rq(se);
+
+	if (cfs_rq->cfs_runtime == RUNTIME_INF)
+		return;
+
+	cfs_rq->cfs_time += delta_exec;
+
+	if (cfs_rq_throttled(cfs_rq))
+		return;
+
+	if (cfs_rq->cfs_time > cfs_rq->cfs_runtime)
+		cfs_balance_runtime(cfs_rq);
+
+	if (cfs_rq->cfs_time > cfs_rq->cfs_runtime) {
+		cfs_rq->cfs_throttled = 1;
+		update_stats_throttle_start(cfs_rq, se);
+		resched_task(tsk_curr);
+	}
+}
+
+static inline void update_curr_group(struct sched_entity *curr,
+		unsigned long delta_exec, struct task_struct *tsk_curr)
+{
+	sched_cfs_runtime_exceeded(curr, tsk_curr, delta_exec);
+}
+
+static void enqueue_entity_locked(struct cfs_rq *cfs_rq,
+		struct sched_entity *se, int flags);
+
+static void enqueue_throttled_entity(struct rq *rq, struct sched_entity *se)
+{
+	for_each_sched_entity(se) {
+		struct cfs_rq *gcfs_rq = group_cfs_rq(se);
+
+		if (se->on_rq || cfs_rq_throttled(gcfs_rq) ||
+				!gcfs_rq->nr_running)
+			break;
+		enqueue_entity_locked(cfs_rq_of(se), se, 0);
+	}
+}
+
+/*
+ * Refresh runtimes of all cfs_rqs in this group, i,e.,
+ * refresh runtimes of the representative cfs_rq of this
+ * tg on all cpus. Enqueue any throttled entity back.
+ */
+void do_sched_cfs_period_timer(struct cfs_bandwidth *cfs_b)
+{
+	int i;
+	const struct cpumask *span = sched_bw_period_mask();
+	unsigned long flags;
+
+	for_each_cpu(i, span) {
+		struct rq *rq = cpu_rq(i);
+		struct cfs_rq *cfs_rq = sched_cfs_period_cfs_rq(cfs_b, i);
+		struct sched_entity *se = cfs_rq->tg->se[i];
+
+		spin_lock_irqsave(&rq->lock, flags);
+		cfs_rq_runtime_lock(cfs_rq);
+		cfs_rq->cfs_time = 0;
+		if (cfs_rq_throttled(cfs_rq)) {
+			update_rq_clock(rq);
+			update_stats_throttle_end(cfs_rq, se);
+			cfs_rq->cfs_throttled = 0;
+			enqueue_throttled_entity(rq, se);
+		}
+		cfs_rq_runtime_unlock(cfs_rq);
+		spin_unlock_irqrestore(&rq->lock, flags);
+	}
+}
+
+#else
+
+static inline void update_curr_group(struct sched_entity *curr,
+		unsigned long delta_exec, struct task_struct *tsk_curr)
+{
+	return;
+}
+
+static inline int cfs_rq_throttled(struct cfs_rq *cfs_rq)
+{
+	return 0;
+}
+
+#endif /* CONFIG_CFS_HARD_LIMITS */
+
+#else	/* CONFIG_FAIR_GROUP_SCHED */
+
+static inline void update_curr_group(struct sched_entity *curr,
+		unsigned long delta_exec, struct task_struct *tsk_curr)
+{
+	return;
+}
 
 static inline struct task_struct *task_of(struct sched_entity *se)
 {
@@ -254,7 +555,6 @@
 
 #endif	/* CONFIG_FAIR_GROUP_SCHED */
 
-
 /**************************************************************
  * Scheduling class tree data structure manipulation methods:
  */
@@ -493,14 +793,25 @@
 	update_min_vruntime(cfs_rq);
 }
 
-static void update_curr(struct cfs_rq *cfs_rq)
+static void update_curr_task(struct sched_entity *curr,
+		unsigned long delta_exec)
+{
+	struct task_struct *curtask = task_of(curr);
+
+	trace_sched_stat_runtime(curtask, delta_exec, curr->vruntime);
+	cpuacct_charge(curtask, delta_exec);
+	account_group_exec_runtime(curtask, delta_exec);
+}
+
+static int update_curr_common(struct cfs_rq *cfs_rq, unsigned long *delta)
 {
 	struct sched_entity *curr = cfs_rq->curr;
-	u64 now = rq_of(cfs_rq)->clock_task;
+	struct rq *rq = rq_of(cfs_rq);
+	u64 now = rq->clock_task;
 	unsigned long delta_exec;
 
 	if (unlikely(!curr))
-		return;
+		return 1;
 
 	/*
 	 * Get the amount of time the current task was running
@@ -509,17 +820,29 @@
 	 */
 	delta_exec = (unsigned long)(now - curr->exec_start);
 	if (!delta_exec)
-		return;
+		return 1;
 
 	__update_curr(cfs_rq, curr, delta_exec);
 	curr->exec_start = now;
+	*delta = delta_exec;
+	return 0;
+}
 
-	if (entity_is_task(curr)) {
-		struct task_struct *curtask = task_of(curr);
+static void update_curr(struct cfs_rq *cfs_rq)
+{
+	struct sched_entity *curr = cfs_rq->curr;
+	struct rq *rq = rq_of(cfs_rq);
+	unsigned long delta_exec;
+
+	if (update_curr_common(cfs_rq, &delta_exec))
+		return ;
 
-		trace_sched_stat_runtime(curtask, delta_exec, curr->vruntime);
-		cpuacct_charge(curtask, delta_exec);
-		account_group_exec_runtime(curtask, delta_exec);
+	if (entity_is_task(curr))
+		update_curr_task(curr, delta_exec);
+	else {
+		cfs_rq_runtime_lock(group_cfs_rq(curr));
+		update_curr_group(curr, delta_exec, rq->curr);
+		cfs_rq_runtime_unlock(group_cfs_rq(curr));
 	}
 }
 
@@ -748,6 +1071,25 @@
 #define ENQUEUE_MIGRATE 2
 
 static void
+enqueue_entity_common(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
+{
+	account_entity_enqueue(cfs_rq, se);
+
+	if (flags & ENQUEUE_WAKEUP) {
+		place_entity(cfs_rq, se, 0);
+		enqueue_sleeper(cfs_rq, se);
+	}
+
+	update_stats_enqueue(cfs_rq, se);
+	check_spread(cfs_rq, se);
+	if (se != cfs_rq->curr)
+		__enqueue_entity(cfs_rq, se);
+
+	if (entity_is_task(se))
+		vx_activate_task(task_of(se));
+}
+
+static void
 enqueue_entity(struct cfs_rq *cfs_rq, struct sched_entity *se, int flags)
 {
 	/*
@@ -761,17 +1103,17 @@
 	 * Update run-time statistics of the 'current'.
 	 */
 	update_curr(cfs_rq);
-	account_entity_enqueue(cfs_rq, se);
-
-	if (flags & ENQUEUE_WAKEUP) {
-		place_entity(cfs_rq, se, 0);
-		enqueue_sleeper(cfs_rq, se);
-	}
+	enqueue_entity_common(cfs_rq, se, flags);
+}
 
-	update_stats_enqueue(cfs_rq, se);
-	check_spread(cfs_rq, se);
-	if (se != cfs_rq->curr)
-		__enqueue_entity(cfs_rq, se);
+static void enqueue_entity_locked(struct cfs_rq *cfs_rq,
+		struct sched_entity *se, int flags)
+{
+	/*
+	 * Update run-time statistics of the 'current'.
+	 */
+	// update_curr_locked(cfs_rq);
+	enqueue_entity_common(cfs_rq, se, flags);
 }
 
 static void __clear_buddies(struct cfs_rq *cfs_rq, struct sched_entity *se)
@@ -815,6 +1157,8 @@
 
 	if (se != cfs_rq->curr)
 		__dequeue_entity(cfs_rq, se);
+	if (entity_is_task(se))
+		vx_deactivate_task(task_of(se));
 	account_entity_dequeue(cfs_rq, se);
 	update_min_vruntime(cfs_rq);
 
@@ -919,6 +1263,32 @@
 	return se;
 }
 
+/*
+ * Called from put_prev_entity()
+ * If a group entity (@se) is found to be throttled, it will not be put back
+ * on @cfs_rq, which is equivalent to dequeing it.
+ */
+static int dequeue_throttled_entity(struct cfs_rq *cfs_rq,
+		struct sched_entity *se)
+{
+	struct cfs_rq *gcfs_rq = group_cfs_rq(se);
+
+	if (entity_is_task(se))
+		return 0;
+
+	cfs_rq_runtime_lock(gcfs_rq);
+	if (!cfs_rq_throttled(gcfs_rq) && gcfs_rq->nr_running) {
+		cfs_rq_runtime_unlock(gcfs_rq);
+		return 0;
+	}
+
+	__clear_buddies(cfs_rq, se);
+	account_entity_dequeue(cfs_rq, se);
+	cfs_rq->curr = NULL;
+	cfs_rq_runtime_unlock(gcfs_rq);
+	return 1;
+}
+
 static void put_prev_entity(struct cfs_rq *cfs_rq, struct sched_entity *prev)
 {
 	/*
@@ -930,6 +1300,8 @@
 
 	check_spread(cfs_rq, prev);
 	if (prev->on_rq) {
+		if (dequeue_throttled_entity(cfs_rq, prev))
+			return;
 		update_stats_wait_start(cfs_rq, prev);
 		/* Put 'current' back into the tree. */
 		__enqueue_entity(cfs_rq, prev);
@@ -1026,10 +1398,28 @@
 }
 #endif
 
+static int enqueue_group_entity(struct cfs_rq *cfs_rq, struct sched_entity *se,
+		 int flags)
+{
+	struct cfs_rq *gcfs_rq = group_cfs_rq(se);
+	int ret = 0;
+
+	cfs_rq_runtime_lock(gcfs_rq);
+	if (cfs_rq_throttled(gcfs_rq)) {
+		ret = 1;
+		goto out;
+	}
+	enqueue_entity_locked(cfs_rq, se, flags);
+out:
+	cfs_rq_runtime_unlock(gcfs_rq);
+	return ret;
+}
+
 /*
  * The enqueue_task method is called before nr_running is
  * increased. Here we update the fair scheduling stats and
  * then put the task into the rbtree:
+ * Don't enqueue a throttled entity further into the hierarchy.
  */
 static void
 enqueue_task_fair(struct rq *rq, struct task_struct *p, int wakeup, bool head)
@@ -1046,11 +1436,15 @@
 	for_each_sched_entity(se) {
 		if (se->on_rq)
 			break;
+
 		cfs_rq = cfs_rq_of(se);
-		enqueue_entity(cfs_rq, se, flags);
+		if (entity_is_task(se))
+			enqueue_entity(cfs_rq, se, flags);
+		else
+			if (enqueue_group_entity(cfs_rq, se, flags))
+				break;
 		flags = ENQUEUE_WAKEUP;
 	}
-
 	hrtick_update(rq);
 }
 
@@ -1070,6 +1464,17 @@
 		/* Don't dequeue parent if it has other entities besides us */
 		if (cfs_rq->load.weight)
 			break;
+
+		/*
+		 * If this cfs_rq is throttled, then it is already
+		 * dequeued.
+		 */
+		cfs_rq_runtime_lock(cfs_rq);
+		if (cfs_rq_throttled(cfs_rq)) {
+			cfs_rq_runtime_unlock(cfs_rq);
+			break;
+		}
+		cfs_rq_runtime_unlock(cfs_rq);
 		sleep = 1;
 	}
 
@@ -1896,9 +2301,10 @@
 		u64 rem_load, moved_load;
 
 		/*
-		 * empty group
+		 * empty group or throttled group
 		 */
-		if (!busiest_cfs_rq->task_weight)
+		if (!busiest_cfs_rq->task_weight ||
+				cfs_rq_throttled(busiest_cfs_rq))
 			continue;
 
 		rem_load = (u64)rem_load_move * busiest_weight;
@@ -1947,6 +2353,12 @@
 
 	for_each_leaf_cfs_rq(busiest, busy_cfs_rq) {
 		/*
+		 * Don't move task from a throttled cfs_rq
+		 */
+		if (cfs_rq_throttled(busy_cfs_rq))
+			continue;
+
+		/*
 		 * pass busy_cfs_rq argument into
 		 * load_balance_[start|next]_fair iterators
 		 */
diff -uriN linux-2.6.32.43/kernel/sched_rt.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sched_rt.c
--- linux-2.6.32.43/kernel/sched_rt.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sched_rt.c	2011-07-15 05:50:11.000000000 -0500
@@ -235,18 +235,6 @@
 	return p->prio != p->normal_prio;
 }
 
-#ifdef CONFIG_SMP
-static inline const struct cpumask *sched_rt_period_mask(void)
-{
-	return cpu_rq(smp_processor_id())->rd->span;
-}
-#else
-static inline const struct cpumask *sched_rt_period_mask(void)
-{
-	return cpu_online_mask;
-}
-#endif
-
 static inline
 struct rt_rq *sched_rt_period_rt_rq(struct rt_bandwidth *rt_b, int cpu)
 {
@@ -296,11 +284,6 @@
 	return rt_rq->rt_throttled;
 }
 
-static inline const struct cpumask *sched_rt_period_mask(void)
-{
-	return cpu_online_mask;
-}
-
 static inline
 struct rt_rq *sched_rt_period_rt_rq(struct rt_bandwidth *rt_b, int cpu)
 {
@@ -373,7 +356,7 @@
 /*
  * Ensure this RQ takes back all the runtime it lend to its neighbours.
  */
-static void __disable_runtime(struct rq *rq)
+static void disable_runtime_rt(struct rq *rq)
 {
 	struct root_domain *rd = rq->rd;
 	struct rt_rq *rt_rq;
@@ -450,16 +433,7 @@
 	}
 }
 
-static void disable_runtime(struct rq *rq)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&rq->lock, flags);
-	__disable_runtime(rq);
-	spin_unlock_irqrestore(&rq->lock, flags);
-}
-
-static void __enable_runtime(struct rq *rq)
+static void enable_runtime_rt(struct rq *rq)
 {
 	struct rt_rq *rt_rq;
 
@@ -482,15 +456,6 @@
 	}
 }
 
-static void enable_runtime(struct rq *rq)
-{
-	unsigned long flags;
-
-	spin_lock_irqsave(&rq->lock, flags);
-	__enable_runtime(rq);
-	spin_unlock_irqrestore(&rq->lock, flags);
-}
-
 static int balance_runtime(struct rt_rq *rt_rq)
 {
 	int more = 0;
@@ -518,7 +483,7 @@
 	if (!rt_bandwidth_enabled() || rt_b->rt_runtime == RUNTIME_INF)
 		return 1;
 
-	span = sched_rt_period_mask();
+	span = sched_bw_period_mask();
 	for_each_cpu(i, span) {
 		int enqueue = 0;
 		struct rt_rq *rt_rq = sched_rt_period_rt_rq(rt_b, i);
@@ -1571,7 +1536,7 @@
 	if (rq->rt.overloaded)
 		rt_set_overload(rq);
 
-	__enable_runtime(rq);
+	enable_runtime_rt(rq);
 
 	cpupri_set(&rq->rd->cpupri, rq->cpu, rq->rt.highest_prio.curr);
 }
@@ -1582,7 +1547,7 @@
 	if (rq->rt.overloaded)
 		rt_clear_overload(rq);
 
-	__disable_runtime(rq);
+	disable_runtime_rt(rq);
 
 	cpupri_set(&rq->rd->cpupri, rq->cpu, CPUPRI_INVALID);
 }
diff -uriN linux-2.6.32.43/kernel/signal.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/signal.c
--- linux-2.6.32.43/kernel/signal.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/signal.c	2011-07-15 06:52:50.000000000 -0500
@@ -27,6 +27,8 @@
 #include <linux/freezer.h>
 #include <linux/pid_namespace.h>
 #include <linux/nsproxy.h>
+#include <linux/vs_context.h>
+#include <linux/vs_pid.h>
 #include <trace/events/sched.h>
 
 #include <asm/param.h>
@@ -41,12 +43,12 @@
 
 static struct kmem_cache *sigqueue_cachep;
 
-static void __user *sig_handler(struct task_struct *t, int sig)
+static __sighandler_t sig_handler(struct task_struct *t, int sig)
 {
 	return t->sighand->action[sig - 1].sa.sa_handler;
 }
 
-static int sig_handler_ignored(void __user *handler, int sig)
+static int sig_handler_ignored(__sighandler_t handler, int sig)
 {
 	/* Is it explicitly or implicitly ignored? */
 	return handler == SIG_IGN ||
@@ -56,7 +58,7 @@
 static int sig_task_ignored(struct task_struct *t, int sig,
 		int from_ancestor_ns)
 {
-	void __user *handler;
+	__sighandler_t handler;
 
 	handler = sig_handler(t, sig);
 
@@ -207,6 +209,9 @@
 	 */
 	user = get_uid(__task_cred(t)->user);
 	atomic_inc(&user->sigpending);
+
+	if (!override_rlimit)
+		gr_learn_resource(t, RLIMIT_SIGPENDING, atomic_read(&user->sigpending), 1);
 	if (override_rlimit ||
 	    atomic_read(&user->sigpending) <=
 			t->signal->rlim[RLIMIT_SIGPENDING].rlim_cur)
@@ -327,7 +332,7 @@
 
 int unhandled_signal(struct task_struct *tsk, int sig)
 {
-	void __user *handler = tsk->sighand->action[sig-1].sa.sa_handler;
+	__sighandler_t handler = tsk->sighand->action[sig-1].sa.sa_handler;
 	if (is_global_init(tsk))
 		return 1;
 	if (handler != SIG_IGN && handler != SIG_DFL)
@@ -598,6 +603,14 @@
 	if (!valid_signal(sig))
 		return -EINVAL;
 
+	if ((info != SEND_SIG_NOINFO) &&
+		(is_si_special(info) || !SI_FROMUSER(info)))
+		goto skip;
+
+	vxdprintk(VXD_CBIT(misc, 7),
+		"check_kill_permission(%d,%p,%p[#%u,%u])",
+		sig, info, t, vx_task_xid(t), t->pid);
+
 	if (info != SEND_SIG_NOINFO && (is_si_special(info) || SI_FROMKERNEL(info)))
 		return 0;
 
@@ -627,6 +640,26 @@
 		}
 	}
 
+	/* allow glibc communication via tgkill to other threads in our
+	   thread group */
+	if ((info->si_code != SI_TKILL || sig != (SIGRTMIN+1) ||
+	    task_tgid_vnr(t) != info->si_pid) && gr_handle_signal(t, sig))
+		return -EPERM;
+
+	error = -EPERM;
+	if (t->pid == 1 && current->xid)
+		return error;
+
+	error = -ESRCH;
+	/* FIXME: we shouldn't return ESRCH ever, to avoid
+		  loops, maybe ENOENT or EACCES? */
+	if (!vx_check(vx_task_xid(t), VS_WATCH_P | VS_IDENT)) {
+		vxdprintk(current->xid || VXD_CBIT(misc, 7),
+			"signal %d[%p] xid mismatch %p[#%u,%u] xid=#%u",
+			sig, info, t, vx_task_xid(t), t->pid, current->xid);
+		return error;
+	}
+skip:
 	return security_task_kill(t, info, sig, 0);
 }
 
@@ -968,7 +1001,7 @@
 	return send_signal(sig, info, p, 1);
 }
 
-static int
+int
 specific_send_sig_info(int sig, struct siginfo *info, struct task_struct *t)
 {
 	return send_signal(sig, info, t, 0);
@@ -1005,6 +1038,7 @@
 	unsigned long int flags;
 	int ret, blocked, ignored;
 	struct k_sigaction *action;
+	int is_unhandled = 0;
 
 	spin_lock_irqsave(&t->sighand->siglock, flags);
 	action = &t->sighand->action[sig-1];
@@ -1019,9 +1053,18 @@
 	}
 	if (action->sa.sa_handler == SIG_DFL)
 		t->signal->flags &= ~SIGNAL_UNKILLABLE;
+	if (action->sa.sa_handler == SIG_IGN || action->sa.sa_handler == SIG_DFL)
+		is_unhandled = 1;
 	ret = specific_send_sig_info(sig, info, t);
 	spin_unlock_irqrestore(&t->sighand->siglock, flags);
 
+	/* only deal with unhandled signals, java etc trigger SIGSEGV during
+	   normal operation */
+	if (is_unhandled) {
+		gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, t);
+		gr_handle_crash(t, sig);
+	}
+
 	return ret;
 }
 
@@ -1081,8 +1124,11 @@
 {
 	int ret = check_kill_permission(sig, info, p);
 
-	if (!ret && sig)
+	if (!ret && sig) {
 		ret = do_send_sig_info(sig, info, p, true);
+		if (!ret)
+			gr_log_signal(sig, !is_si_special(info) ? info->si_addr : NULL, p);
+	}
 
 	return ret;
 }
@@ -1115,7 +1161,7 @@
 	rcu_read_lock();
 retry:
 	p = pid_task(pid, PIDTYPE_PID);
-	if (p) {
+	if (p && vx_check(vx_task_xid(p), VS_IDENT)) {
 		error = group_send_sig_info(sig, info, p);
 		if (unlikely(error == -ESRCH))
 			/*
@@ -1154,7 +1200,7 @@
 
 	read_lock(&tasklist_lock);
 	p = pid_task(pid, PIDTYPE_PID);
-	if (!p) {
+	if (!p || !vx_check(vx_task_xid(p), VS_IDENT)) {
 		ret = -ESRCH;
 		goto out_unlock;
 	}
@@ -1208,8 +1254,10 @@
 		struct task_struct * p;
 
 		for_each_process(p) {
-			if (task_pid_vnr(p) > 1 &&
-					!same_thread_group(p, current)) {
+			if (vx_check(vx_task_xid(p), VS_ADMIN|VS_IDENT) &&
+				task_pid_vnr(p) > 1 &&
+				!same_thread_group(p, current) &&
+				!vx_current_initpid(p->pid)) {
 				int err = group_send_sig_info(sig, info, p);
 				++count;
 				if (err != -EPERM)
@@ -1644,6 +1692,8 @@
 {
 	siginfo_t info;
 
+	pax_track_stack();
+
 	BUG_ON((exit_code & (0x7f | ~0xffff)) != SIGTRAP);
 
 	memset(&info, 0, sizeof info);
@@ -1874,6 +1924,11 @@
 				!sig_kernel_only(signr))
 			continue;
 
+		/* virtual init is protected against user signals */
+		if ((info->si_code == SI_USER) &&
+			vx_current_initpid(current->pid))
+			continue;
+
 		if (sig_kernel_stop(signr)) {
 			/*
 			 * The default action is to stop all threads in
@@ -2275,7 +2330,15 @@
 	int error = -ESRCH;
 
 	rcu_read_lock();
-	p = find_task_by_vpid(pid);
+#ifdef CONFIG_GRKERNSEC_CHROOT_FINDTASK
+	/* allow glibc communication via tgkill to other threads in our
+	   thread group */
+	if (grsec_enable_chroot_findtask && info->si_code == SI_TKILL &&
+	    sig == (SIGRTMIN+1) && tgid == info->si_pid)	    
+		p = find_task_by_vpid_unrestricted(pid);
+	else
+#endif
+		p = find_task_by_vpid(pid);
 	if (p && (tgid <= 0 || task_tgid_vnr(p) == tgid)) {
 		error = check_kill_permission(sig, info, p);
 		/*
diff -uriN linux-2.6.32.43/kernel/smp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/smp.c
--- linux-2.6.32.43/kernel/smp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/smp.c	2011-07-15 05:51:19.000000000 -0500
@@ -522,22 +522,22 @@
 }
 EXPORT_SYMBOL(smp_call_function);
 
-void ipi_call_lock(void)
+void ipi_call_lock(void) __acquires(call_function.lock)
 {
 	spin_lock(&call_function.lock);
 }
 
-void ipi_call_unlock(void)
+void ipi_call_unlock(void) __releases(call_function.lock)
 {
 	spin_unlock(&call_function.lock);
 }
 
-void ipi_call_lock_irq(void)
+void ipi_call_lock_irq(void) __acquires(call_function.lock)
 {
 	spin_lock_irq(&call_function.lock);
 }
 
-void ipi_call_unlock_irq(void)
+void ipi_call_unlock_irq(void) __releases(call_function.lock)
 {
 	spin_unlock_irq(&call_function.lock);
 }
diff -uriN linux-2.6.32.43/kernel/softirq.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/softirq.c
--- linux-2.6.32.43/kernel/softirq.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/softirq.c	2011-07-15 05:51:19.000000000 -0500
@@ -24,6 +24,7 @@
 #include <linux/ftrace.h>
 #include <linux/smp.h>
 #include <linux/tick.h>
+#include <linux/vs_context.h>
 
 #define CREATE_TRACE_POINTS
 #include <trace/events/irq.h>
@@ -56,7 +57,7 @@
 
 static DEFINE_PER_CPU(struct task_struct *, ksoftirqd);
 
-char *softirq_to_name[NR_SOFTIRQS] = {
+const char * const softirq_to_name[NR_SOFTIRQS] = {
 	"HI", "TIMER", "NET_TX", "NET_RX", "BLOCK", "BLOCK_IOPOLL",
 	"TASKLET", "SCHED", "HRTIMER",	"RCU"
 };
@@ -206,7 +207,7 @@
 
 asmlinkage void __do_softirq(void)
 {
-	struct softirq_action *h;
+	const struct softirq_action *h;
 	__u32 pending;
 	int max_restart = MAX_SOFTIRQ_RESTART;
 	int cpu;
@@ -233,7 +234,7 @@
 			kstat_incr_softirqs_this_cpu(h - softirq_vec);
 
 			trace_softirq_entry(h, softirq_vec);
-			h->action(h);
+			h->action();
 			trace_softirq_exit(h, softirq_vec);
 			if (unlikely(prev_count != preempt_count())) {
 				printk(KERN_ERR "huh, entered softirq %td %s %p"
@@ -363,7 +364,7 @@
 	local_irq_restore(flags);
 }
 
-void open_softirq(int nr, void (*action)(struct softirq_action *))
+void open_softirq(int nr, void (*action)(void))
 {
 	softirq_vec[nr].action = action;
 }
@@ -419,7 +420,7 @@
 
 EXPORT_SYMBOL(__tasklet_hi_schedule_first);
 
-static void tasklet_action(struct softirq_action *a)
+static void tasklet_action(void)
 {
 	struct tasklet_struct *list;
 
@@ -454,7 +455,7 @@
 	}
 }
 
-static void tasklet_hi_action(struct softirq_action *a)
+static void tasklet_hi_action(void)
 {
 	struct tasklet_struct *list;
 
diff -uriN linux-2.6.32.43/kernel/sys.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sys.c
--- linux-2.6.32.43/kernel/sys.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sys.c	2011-07-15 05:51:19.000000000 -0500
@@ -41,6 +41,7 @@
 #include <linux/syscalls.h>
 #include <linux/kprobes.h>
 #include <linux/user_namespace.h>
+#include <linux/vs_pid.h>
 
 #include <asm/uaccess.h>
 #include <asm/io.h>
@@ -130,9 +131,18 @@
 		goto out;
 	}
 	if (niceval < task_nice(p) && !can_nice(p, niceval)) {
+		if (vx_flags(VXF_IGNEG_NICE, 0))
+			error = 0;
+		else
+			error = -EACCES;
+		goto out;
+	}
+
+	if (gr_handle_chroot_setpriority(p, niceval)) {
 		error = -EACCES;
 		goto out;
 	}
+
 	no_nice = security_task_setnice(p, niceval);
 	if (no_nice) {
 		error = no_nice;
@@ -179,6 +189,8 @@
 			else
 				pgrp = task_pgrp(current);
 			do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
+				if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
+					continue;
 				error = set_one_prio(p, niceval, error);
 			} while_each_pid_thread(pgrp, PIDTYPE_PGID, p);
 			break;
@@ -190,10 +202,10 @@
 				 !(user = find_user(who)))
 				goto out_unlock;	/* No processes for this user */
 
-			do_each_thread(g, p)
+			do_each_thread(g, p) {
 				if (__task_cred(p)->uid == who)
 					error = set_one_prio(p, niceval, error);
-			while_each_thread(g, p);
+			} while_each_thread(g, p);
 			if (who != cred->uid)
 				free_uid(user);		/* For find_user() */
 			break;
@@ -240,6 +252,8 @@
 			else
 				pgrp = task_pgrp(current);
 			do_each_pid_thread(pgrp, PIDTYPE_PGID, p) {
+				if (!vx_check(p->xid, VS_ADMIN_P | VS_IDENT))
+					continue;
 				niceval = 20 - task_nice(p);
 				if (niceval > retval)
 					retval = niceval;
@@ -253,13 +267,13 @@
 				 !(user = find_user(who)))
 				goto out_unlock;	/* No processes for this user */
 
-			do_each_thread(g, p)
+			do_each_thread(g, p) {
 				if (__task_cred(p)->uid == who) {
 					niceval = 20 - task_nice(p);
 					if (niceval > retval)
 						retval = niceval;
 				}
-			while_each_thread(g, p);
+			} while_each_thread(g, p);
 			if (who != cred->uid)
 				free_uid(user);		/* for find_user() */
 			break;
@@ -349,6 +363,9 @@
 	machine_power_off();
 }
 EXPORT_SYMBOL_GPL(kernel_power_off);
+
+long vs_reboot(unsigned int, void __user *);
+
 /*
  * Reboot system call: for obvious reasons only root may call it,
  * and even root needs to set up some magic numbers in the registers
@@ -381,6 +398,9 @@
 	if ((cmd == LINUX_REBOOT_CMD_POWER_OFF) && !pm_power_off)
 		cmd = LINUX_REBOOT_CMD_HALT;
 
+	if (!vx_check(0, VS_ADMIN|VS_WATCH))
+		return vs_reboot(cmd, arg);
+
 	lock_kernel();
 	switch (cmd) {
 	case LINUX_REBOOT_CMD_RESTART:
@@ -509,6 +529,9 @@
 			goto error;
 	}
 
+	if (gr_check_group_change(new->gid, new->egid, -1))
+		goto error;
+
 	if (rgid != (gid_t) -1 ||
 	    (egid != (gid_t) -1 && egid != old->gid))
 		new->sgid = new->egid;
@@ -542,6 +565,10 @@
 		goto error;
 
 	retval = -EPERM;
+
+	if (gr_check_group_change(gid, gid, gid))
+		goto error;
+
 	if (capable(CAP_SETGID))
 		new->gid = new->egid = new->sgid = new->fsgid = gid;
 	else if (gid == old->gid || gid == old->sgid)
@@ -627,6 +654,9 @@
 			goto error;
 	}
 
+	if (gr_check_user_change(new->uid, new->euid, -1))
+		goto error;
+
 	if (new->uid != old->uid) {
 		retval = set_user(new);
 		if (retval < 0)
@@ -675,6 +705,12 @@
 		goto error;
 
 	retval = -EPERM;
+
+	if (gr_check_crash_uid(uid))
+		goto error;
+	if (gr_check_user_change(uid, uid, uid))
+		goto error;
+
 	if (capable(CAP_SETUID)) {
 		new->suid = new->uid = uid;
 		if (uid != old->uid) {
@@ -732,6 +768,9 @@
 			goto error;
 	}
 
+	if (gr_check_user_change(ruid, euid, -1))
+		goto error;
+
 	if (ruid != (uid_t) -1) {
 		new->uid = ruid;
 		if (ruid != old->uid) {
@@ -800,6 +839,9 @@
 			goto error;
 	}
 
+	if (gr_check_group_change(rgid, egid, -1))
+		goto error;
+
 	if (rgid != (gid_t) -1)
 		new->gid = rgid;
 	if (egid != (gid_t) -1)
@@ -849,6 +891,9 @@
 	if (security_task_setuid(uid, (uid_t)-1, (uid_t)-1, LSM_SETID_FS) < 0)
 		goto error;
 
+	if (gr_check_user_change(-1, -1, uid))
+		goto error;
+
 	if (uid == old->uid  || uid == old->euid  ||
 	    uid == old->suid || uid == old->fsuid ||
 	    capable(CAP_SETUID)) {
@@ -889,6 +934,9 @@
 	if (gid == old->gid  || gid == old->egid  ||
 	    gid == old->sgid || gid == old->fsgid ||
 	    capable(CAP_SETGID)) {
+		if (gr_check_group_change(-1, -1, gid))
+			goto error;
+
 		if (gid != old_fsgid) {
 			new->fsgid = gid;
 			goto change_okay;
@@ -1129,7 +1177,7 @@
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_SET_UTSNAME))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
 		return -EINVAL;
@@ -1178,7 +1226,7 @@
 	int errno;
 	char tmp[__NEW_UTS_LEN];
 
-	if (!capable(CAP_SYS_ADMIN))
+	if (!vx_capable(CAP_SYS_ADMIN, VXC_SET_UTSNAME))
 		return -EPERM;
 	if (len < 0 || len > __NEW_UTS_LEN)
 		return -EINVAL;
@@ -1247,7 +1295,7 @@
 		return -EINVAL;
 	old_rlim = current->signal->rlim + resource;
 	if ((new_rlim.rlim_max > old_rlim->rlim_max) &&
-	    !capable(CAP_SYS_RESOURCE))
+	    !vx_capable(CAP_SYS_RESOURCE, VXC_SET_RLIMIT))
 		return -EPERM;
 	if (resource == RLIMIT_NOFILE && new_rlim.rlim_max > sysctl_nr_open)
 		return -EPERM;
@@ -1454,7 +1502,7 @@
 			error = get_dumpable(me->mm);
 			break;
 		case PR_SET_DUMPABLE:
-			if (arg2 < 0 || arg2 > 1) {
+			if (arg2 > 1) {
 				error = -EINVAL;
 				break;
 			}
diff -uriN linux-2.6.32.43/kernel/sysctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sysctl.c
--- linux-2.6.32.43/kernel/sysctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sysctl.c	2011-07-15 05:51:19.000000000 -0500
@@ -63,6 +63,13 @@
 static int deprecated_sysctl_warning(struct __sysctl_args *args);
 
 #if defined(CONFIG_SYSCTL)
+#include <linux/grsecurity.h>
+#include <linux/grinternal.h>
+
+extern __u32 gr_handle_sysctl(const ctl_table *table, const int op);
+extern int gr_handle_sysctl_mod(const char *dirname, const char *name,
+				const int op);
+extern int gr_handle_chroot_sysctl(const int op);
 
 /* External variables not in a header file. */
 extern int C_A_D;
@@ -124,6 +131,7 @@
 extern char modprobe_path[];
 extern int modules_disabled;
 #endif
+extern char vshelper_path[];
 #ifdef CONFIG_CHR_DEV_SG
 extern int sg_big_buff;
 #endif
@@ -168,6 +176,7 @@
 static int proc_taint(struct ctl_table *table, int write,
 			       void __user *buffer, size_t *lenp, loff_t *ppos);
 #endif
+extern ctl_table grsecurity_table[];
 
 static struct ctl_table root_table[];
 static struct ctl_table_root sysctl_table_root;
@@ -200,6 +209,21 @@
 int sysctl_legacy_va_layout;
 #endif
 
+#ifdef CONFIG_PAX_SOFTMODE
+static ctl_table pax_table[] = {
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "softmode",
+		.data		= &pax_softmode,
+		.maxlen		= sizeof(unsigned int),
+		.mode		= 0600,
+		.proc_handler	= &proc_dointvec,
+	},
+
+	{ .ctl_name = 0 }
+};
+#endif
+
 extern int prove_locking;
 extern int lock_stat;
 
@@ -251,6 +275,24 @@
 #endif
 
 static struct ctl_table kern_table[] = {
+#if defined(CONFIG_GRKERNSEC_SYSCTL) || defined(CONFIG_GRKERNSEC_ROFS)
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "grsecurity",
+		.mode		= 0500,
+		.child		= grsecurity_table,
+	},
+#endif
+
+#ifdef CONFIG_PAX_SOFTMODE
+	{
+		.ctl_name	= CTL_UNNUMBERED,
+		.procname	= "pax",
+		.mode		= 0500,
+		.child		= pax_table,
+	},
+#endif
+
 	{
 		.ctl_name	= CTL_UNNUMBERED,
 		.procname	= "sched_child_runs_first",
@@ -567,8 +609,8 @@
 		.data		= &modprobe_path,
 		.maxlen		= KMOD_PATH_LEN,
 		.mode		= 0644,
-		.proc_handler	= &proc_dostring,
-		.strategy	= &sysctl_string,
+		.proc_handler	= &proc_dostring_modpriv,
+		.strategy	= &sysctl_string_modpriv,
 	},
 	{
 		.ctl_name	= CTL_UNNUMBERED,
@@ -593,6 +635,15 @@
 		.strategy	= &sysctl_string,
 	},
 #endif
+	{
+		.ctl_name	= KERN_VSHELPER,
+		.procname	= "vshelper",
+		.data		= &vshelper_path,
+		.maxlen		= 256,
+		.mode		= 0644,
+		.proc_handler	= &proc_dostring,
+		.strategy	= &sysctl_string,
+	},
 #ifdef CONFIG_CHR_DEV_SG
 	{
 		.ctl_name	= KERN_SG_BIG_BUFF,
@@ -1247,6 +1298,13 @@
 		.mode		= 0644,
 		.proc_handler	= &proc_dointvec
 	},
+	{
+		.procname	= "heap_stack_gap",
+		.data		= &sysctl_heap_stack_gap,
+		.maxlen		= sizeof(sysctl_heap_stack_gap),
+		.mode		= 0644,
+		.proc_handler	= proc_doulongvec_minmax,
+	},
 #else
 	{
 		.ctl_name	= CTL_UNNUMBERED,
@@ -1803,6 +1861,8 @@
 	return 0;
 }
 
+static int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op);
+
 static int parse_table(int __user *name, int nlen,
 		       void __user *oldval, size_t __user *oldlenp,
 		       void __user *newval, size_t newlen,
@@ -1821,7 +1881,7 @@
 		if (n == table->ctl_name) {
 			int error;
 			if (table->child) {
-				if (sysctl_perm(root, table, MAY_EXEC))
+				if (sysctl_perm_nochk(root, table, MAY_EXEC))
 					return -EPERM;
 				name++;
 				nlen--;
@@ -1906,6 +1966,33 @@
 	int error;
 	int mode;
 
+	if (table->parent != NULL && table->parent->procname != NULL &&
+	   table->procname != NULL &&
+	    gr_handle_sysctl_mod(table->parent->procname, table->procname, op))
+		return -EACCES;
+	if (gr_handle_chroot_sysctl(op))
+		return -EACCES;
+	error = gr_handle_sysctl(table, op);
+	if (error)
+		return error;
+
+	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
+	if (error)
+		return error;
+
+	if (root->permissions)
+		mode = root->permissions(root, current->nsproxy, table);
+	else
+		mode = table->mode;
+
+	return test_perm(mode, op);
+}
+
+int sysctl_perm_nochk(struct ctl_table_root *root, struct ctl_table *table, int op)
+{
+	int error;
+	int mode;
+
 	error = security_sysctl(table, op & (MAY_READ | MAY_WRITE | MAY_EXEC));
 	if (error)
 		return error;
@@ -2335,6 +2422,16 @@
 			       buffer, lenp, ppos);
 }
 
+int proc_dostring_modpriv(struct ctl_table *table, int write,
+		  void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	if (write && !capable(CAP_SYS_MODULE))
+		return -EPERM;
+
+	return _proc_do_string(table->data, table->maxlen, write,
+			       buffer, lenp, ppos);
+}
+
 
 static int do_proc_dointvec_conv(int *negp, unsigned long *lvalp,
 				 int *valp,
@@ -2609,7 +2706,7 @@
 	vleft = table->maxlen / sizeof(unsigned long);
 	left = *lenp;
 	
-	for (; left && vleft--; i++, min++, max++, first=0) {
+	for (; left && vleft--; i++, first=0) {
 		if (write) {
 			while (left) {
 				char c;
@@ -2910,6 +3007,12 @@
 	return -ENOSYS;
 }
 
+int proc_dostring_modpriv(struct ctl_table *table, int write,
+		  void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	return -ENOSYS;
+}
+
 int proc_dointvec(struct ctl_table *table, int write,
 		  void __user *buffer, size_t *lenp, loff_t *ppos)
 {
@@ -3038,6 +3141,16 @@
 	return 1;
 }
 
+int sysctl_string_modpriv(struct ctl_table *table,
+		  void __user *oldval, size_t __user *oldlenp,
+		  void __user *newval, size_t newlen)
+{
+	if (newval && newlen && !capable(CAP_SYS_MODULE))
+		return -EPERM;
+
+	return sysctl_string(table, oldval, oldlenp, newval, newlen);
+}
+
 /*
  * This function makes sure that all of the integers in the vector
  * are between the minimum and maximum values given in the arrays
@@ -3182,6 +3295,13 @@
 	return -ENOSYS;
 }
 
+int sysctl_string_modpriv(struct ctl_table *table,
+		  void __user *oldval, size_t __user *oldlenp,
+		  void __user *newval, size_t newlen)
+{
+	return -ENOSYS;
+}
+
 int sysctl_intvec(struct ctl_table *table,
 		void __user *oldval, size_t __user *oldlenp,
 		void __user *newval, size_t newlen)
@@ -3246,6 +3366,7 @@
 EXPORT_SYMBOL(proc_dointvec_userhz_jiffies);
 EXPORT_SYMBOL(proc_dointvec_ms_jiffies);
 EXPORT_SYMBOL(proc_dostring);
+EXPORT_SYMBOL(proc_dostring_modpriv);
 EXPORT_SYMBOL(proc_doulongvec_minmax);
 EXPORT_SYMBOL(proc_doulongvec_ms_jiffies_minmax);
 EXPORT_SYMBOL(register_sysctl_table);
@@ -3254,5 +3375,6 @@
 EXPORT_SYMBOL(sysctl_jiffies);
 EXPORT_SYMBOL(sysctl_ms_jiffies);
 EXPORT_SYMBOL(sysctl_string);
+EXPORT_SYMBOL(sysctl_string_modpriv);
 EXPORT_SYMBOL(sysctl_data);
 EXPORT_SYMBOL(unregister_sysctl_table);
diff -uriN linux-2.6.32.43/kernel/sysctl_check.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sysctl_check.c
--- linux-2.6.32.43/kernel/sysctl_check.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/sysctl_check.c	2011-07-15 05:51:19.000000000 -0500
@@ -39,6 +39,7 @@
 
 	{ KERN_PANIC,			"panic" },
 	{ KERN_REALROOTDEV,		"real-root-dev" },
+	{ KERN_VSHELPER,		"vshelper", },
 
 	{ KERN_SPARC_REBOOT,		"reboot-cmd" },
 	{ KERN_CTLALTDEL,		"ctrl-alt-del" },
@@ -1218,6 +1219,22 @@
 	{}
 };
 
+static struct trans_ctl_table trans_vserver_table[] = {
+	{ 1,	"debug_switch" },
+	{ 2,	"debug_xid" },
+	{ 3,	"debug_nid" },
+	{ 4,	"debug_tag" },
+	{ 5,	"debug_net" },
+	{ 6,	"debug_limit" },
+	{ 7,	"debug_cres" },
+	{ 8,	"debug_dlim" },
+	{ 9,	"debug_quota" },
+	{ 10,	"debug_cvirt" },
+	{ 11,	"debug_space" },
+	{ 12,	"debug_misc" },
+	{}
+};
+
 static const struct trans_ctl_table trans_root_table[] = {
 	{ CTL_KERN,	"kernel",	trans_kern_table },
 	{ CTL_VM,	"vm",		trans_vm_table },
@@ -1234,6 +1251,7 @@
 	{ CTL_SUNRPC,	"sunrpc",	trans_sunrpc_table },
 	{ CTL_PM,	"pm",		trans_pm_table },
 	{ CTL_FRV,	"frv",		trans_frv_table },
+	{ CTL_VSERVER,	"vserver",	trans_vserver_table },
 	{}
 };
 
@@ -1489,10 +1507,12 @@
 		} else {
 			if ((table->strategy == sysctl_data) ||
 			    (table->strategy == sysctl_string) ||
+			    (table->strategy == sysctl_string_modpriv) ||
 			    (table->strategy == sysctl_intvec) ||
 			    (table->strategy == sysctl_jiffies) ||
 			    (table->strategy == sysctl_ms_jiffies) ||
 			    (table->proc_handler == proc_dostring) ||
+			    (table->proc_handler == proc_dostring_modpriv) ||
 			    (table->proc_handler == proc_dointvec) ||
 			    (table->proc_handler == proc_dointvec_minmax) ||
 			    (table->proc_handler == proc_dointvec_jiffies) ||
diff -uriN linux-2.6.32.43/kernel/taskstats.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/taskstats.c
--- linux-2.6.32.43/kernel/taskstats.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/taskstats.c	2011-07-15 05:51:19.000000000 -0500
@@ -26,9 +26,12 @@
 #include <linux/cgroup.h>
 #include <linux/fs.h>
 #include <linux/file.h>
+#include <linux/grsecurity.h>
 #include <net/genetlink.h>
 #include <asm/atomic.h>
 
+extern int gr_is_taskstats_denied(int pid);
+
 /*
  * Maximum length of a cpumask that can be specified in
  * the TASKSTATS_CMD_ATTR_REGISTER/DEREGISTER_CPUMASK attribute
@@ -442,6 +445,9 @@
 	size_t size;
 	cpumask_var_t mask;
 
+	if (gr_is_taskstats_denied(current->pid))
+		return -EACCES;
+
 	if (!alloc_cpumask_var(&mask, GFP_KERNEL))
 		return -ENOMEM;
 
diff -uriN linux-2.6.32.43/kernel/time/tick-broadcast.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time/tick-broadcast.c
--- linux-2.6.32.43/kernel/time/tick-broadcast.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time/tick-broadcast.c	2011-07-15 05:51:19.000000000 -0500
@@ -116,7 +116,7 @@
 		 * then clear the broadcast bit.
 		 */
 		if (!(dev->features & CLOCK_EVT_FEAT_C3STOP)) {
-			int cpu = smp_processor_id();
+			cpu = smp_processor_id();
 
 			cpumask_clear_cpu(cpu, tick_get_broadcast_mask());
 			tick_broadcast_clear_oneshot(cpu);
diff -uriN linux-2.6.32.43/kernel/time/timekeeping.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time/timekeeping.c
--- linux-2.6.32.43/kernel/time/timekeeping.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time/timekeeping.c	2011-07-15 05:51:19.000000000 -0500
@@ -14,6 +14,7 @@
 #include <linux/init.h>
 #include <linux/mm.h>
 #include <linux/sched.h>
+#include <linux/grsecurity.h>
 #include <linux/sysdev.h>
 #include <linux/clocksource.h>
 #include <linux/jiffies.h>
@@ -180,7 +181,7 @@
 	 */
 	struct timespec ts = xtime;
 	timespec_add_ns(&ts, nsec);
-	ACCESS_ONCE(xtime_cache) = ts;
+	ACCESS_ONCE_RW(xtime_cache) = ts;
 }
 
 /* must hold xtime_lock */
@@ -333,6 +334,8 @@
 	if ((unsigned long)tv->tv_nsec >= NSEC_PER_SEC)
 		return -EINVAL;
 
+	gr_log_timechange();
+
 	write_seqlock_irqsave(&xtime_lock, flags);
 
 	timekeeping_forward_now();
diff -uriN linux-2.6.32.43/kernel/time/timer_list.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time/timer_list.c
--- linux-2.6.32.43/kernel/time/timer_list.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time/timer_list.c	2011-07-15 05:51:19.000000000 -0500
@@ -38,12 +38,16 @@
 
 static void print_name_offset(struct seq_file *m, void *sym)
 {
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	SEQ_printf(m, "<%p>", NULL);
+#else
 	char symname[KSYM_NAME_LEN];
 
 	if (lookup_symbol_name((unsigned long)sym, symname) < 0)
 		SEQ_printf(m, "<%p>", sym);
 	else
 		SEQ_printf(m, "%s", symname);
+#endif
 }
 
 static void
@@ -112,7 +116,11 @@
 static void
 print_base(struct seq_file *m, struct hrtimer_clock_base *base, u64 now)
 {
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	SEQ_printf(m, "  .base:       %p\n", NULL);
+#else
 	SEQ_printf(m, "  .base:       %p\n", base);
+#endif
 	SEQ_printf(m, "  .index:      %d\n",
 			base->index);
 	SEQ_printf(m, "  .resolution: %Lu nsecs\n",
@@ -289,7 +297,11 @@
 {
 	struct proc_dir_entry *pe;
 
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+	pe = proc_create("timer_list", 0400, NULL, &timer_list_fops);
+#else
 	pe = proc_create("timer_list", 0444, NULL, &timer_list_fops);
+#endif
 	if (!pe)
 		return -ENOMEM;
 	return 0;
diff -uriN linux-2.6.32.43/kernel/time/timer_stats.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time/timer_stats.c
--- linux-2.6.32.43/kernel/time/timer_stats.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time/timer_stats.c	2011-07-15 05:51:19.000000000 -0500
@@ -116,7 +116,7 @@
 static unsigned long nr_entries;
 static struct entry entries[MAX_ENTRIES];
 
-static atomic_t overflow_count;
+static atomic_unchecked_t overflow_count;
 
 /*
  * The entries are in a hash-table, for fast lookup:
@@ -140,7 +140,7 @@
 	nr_entries = 0;
 	memset(entries, 0, sizeof(entries));
 	memset(tstat_hash_table, 0, sizeof(tstat_hash_table));
-	atomic_set(&overflow_count, 0);
+	atomic_set_unchecked(&overflow_count, 0);
 }
 
 static struct entry *alloc_entry(void)
@@ -261,7 +261,7 @@
 	if (likely(entry))
 		entry->count++;
 	else
-		atomic_inc(&overflow_count);
+		atomic_inc_unchecked(&overflow_count);
 
  out_unlock:
 	spin_unlock_irqrestore(lock, flags);
@@ -269,12 +269,16 @@
 
 static void print_name_offset(struct seq_file *m, unsigned long addr)
 {
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	seq_printf(m, "<%p>", NULL);
+#else
 	char symname[KSYM_NAME_LEN];
 
 	if (lookup_symbol_name(addr, symname) < 0)
 		seq_printf(m, "<%p>", (void *)addr);
 	else
 		seq_printf(m, "%s", symname);
+#endif
 }
 
 static int tstats_show(struct seq_file *m, void *v)
@@ -300,9 +304,9 @@
 
 	seq_puts(m, "Timer Stats Version: v0.2\n");
 	seq_printf(m, "Sample period: %ld.%03ld s\n", period.tv_sec, ms);
-	if (atomic_read(&overflow_count))
+	if (atomic_read_unchecked(&overflow_count))
 		seq_printf(m, "Overflow: %d entries\n",
-			atomic_read(&overflow_count));
+			atomic_read_unchecked(&overflow_count));
 
 	for (i = 0; i < nr_entries; i++) {
 		entry = entries + i;
@@ -415,7 +419,11 @@
 {
 	struct proc_dir_entry *pe;
 
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+	pe = proc_create("timer_stats", 0600, NULL, &tstats_fops);
+#else
 	pe = proc_create("timer_stats", 0644, NULL, &tstats_fops);
+#endif
 	if (!pe)
 		return -ENOMEM;
 	return 0;
diff -uriN linux-2.6.32.43/kernel/time.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time.c
--- linux-2.6.32.43/kernel/time.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/time.c	2011-07-15 06:54:26.000000000 -0500
@@ -63,6 +63,7 @@
 SYSCALL_DEFINE1(time, time_t __user *, tloc)
 {
 	time_t i = get_seconds();
+/*	FIXME: do_gettimeofday(&tv) -> vx_gettimeofday(&tv) */
 
 	if (tloc) {
 		if (put_user(i,tloc))
@@ -93,7 +94,7 @@
 	if (err)
 		return err;
 
-	do_settimeofday(&tv);
+	vx_settimeofday(&tv);
 	return 0;
 }
 
@@ -104,7 +105,7 @@
 {
 	if (likely(tv != NULL)) {
 		struct timeval ktv;
-		do_gettimeofday(&ktv);
+		vx_gettimeofday(&ktv);
 		if (copy_to_user(tv, &ktv, sizeof(ktv)))
 			return -EFAULT;
 	}
@@ -165,6 +166,11 @@
 		return error;
 
 	if (tz) {
+		/* we log in vx_settimeofday called below, so don't log twice
+		*/
+		if (!tv)
+			gr_log_timechange();
+
 		/* SMP safe, global irq locking makes it work. */
 		sys_tz = *tz;
 		update_vsyscall_tz();
@@ -179,7 +185,7 @@
 		/* SMP safe, again the code in arch/foo/time.c should
 		 * globally block out interrupts when it runs.
 		 */
-		return do_settimeofday(tv);
+		return vx_settimeofday(tv);
 	}
 	return 0;
 }
@@ -240,7 +246,7 @@
  * Avoid unnecessary multiplications/divisions in the
  * two most common HZ cases:
  */
-unsigned int inline jiffies_to_msecs(const unsigned long j)
+inline unsigned int jiffies_to_msecs(const unsigned long j)
 {
 #if HZ <= MSEC_PER_SEC && !(MSEC_PER_SEC % HZ)
 	return (MSEC_PER_SEC / HZ) * j;
@@ -256,7 +262,7 @@
 }
 EXPORT_SYMBOL(jiffies_to_msecs);
 
-unsigned int inline jiffies_to_usecs(const unsigned long j)
+inline unsigned int jiffies_to_usecs(const unsigned long j)
 {
 #if HZ <= USEC_PER_SEC && !(USEC_PER_SEC % HZ)
 	return (USEC_PER_SEC / HZ) * j;
@@ -311,7 +317,7 @@
 {
 	struct timeval x;
 
-	do_gettimeofday(&x);
+	vx_gettimeofday(&x);
 	tv->tv_sec = x.tv_sec;
 	tv->tv_nsec = x.tv_usec * NSEC_PER_USEC;
 }
diff -uriN linux-2.6.32.43/kernel/timer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/timer.c
--- linux-2.6.32.43/kernel/timer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/timer.c	2011-07-15 05:51:19.000000000 -0500
@@ -39,6 +39,10 @@
 #include <linux/kallsyms.h>
 #include <linux/perf_event.h>
 #include <linux/sched.h>
+#include <linux/vs_base.h>
+#include <linux/vs_cvirt.h>
+#include <linux/vs_pid.h>
+#include <linux/vserver/sched.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -1213,7 +1217,7 @@
 /*
  * This function runs timers and the timer-tq in bottom half context.
  */
-static void run_timer_softirq(struct softirq_action *h)
+static void run_timer_softirq(void)
 {
 	struct tvec_base *base = __get_cpu_var(tvec_bases);
 
@@ -1261,12 +1265,6 @@
 
 #endif
 
-#ifndef __alpha__
-
-/*
- * The Alpha uses getxpid, getxuid, and getxgid instead.  Maybe this
- * should be moved into arch/i386 instead?
- */
 
 /**
  * sys_getpid - return the thread group id of the current process
@@ -1295,10 +1293,23 @@
 	rcu_read_lock();
 	pid = task_tgid_vnr(current->real_parent);
 	rcu_read_unlock();
+	return vx_map_pid(pid);
+}
+
+#ifdef __alpha__
 
-	return pid;
+/*
+ * The Alpha uses getxpid, getxuid, and getxgid instead.
+ */
+
+asmlinkage long do_getxpid(long *ppid)
+{
+	*ppid = sys_getppid();
+	return sys_getpid();
 }
 
+#else /* _alpha_ */
+
 SYSCALL_DEFINE0(getuid)
 {
 	/* Only we change this so SMP safe */
diff -uriN linux-2.6.32.43/kernel/trace/blktrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/blktrace.c
--- linux-2.6.32.43/kernel/trace/blktrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/blktrace.c	2011-07-15 05:51:19.000000000 -0500
@@ -313,7 +313,7 @@
 	struct blk_trace *bt = filp->private_data;
 	char buf[16];
 
-	snprintf(buf, sizeof(buf), "%u\n", atomic_read(&bt->dropped));
+	snprintf(buf, sizeof(buf), "%u\n", atomic_read_unchecked(&bt->dropped));
 
 	return simple_read_from_buffer(buffer, count, ppos, buf, strlen(buf));
 }
@@ -376,7 +376,7 @@
 		return 1;
 
 	bt = buf->chan->private_data;
-	atomic_inc(&bt->dropped);
+	atomic_inc_unchecked(&bt->dropped);
 	return 0;
 }
 
@@ -477,7 +477,7 @@
 
 	bt->dir = dir;
 	bt->dev = dev;
-	atomic_set(&bt->dropped, 0);
+	atomic_set_unchecked(&bt->dropped, 0);
 
 	ret = -EIO;
 	bt->dropped_file = debugfs_create_file("dropped", 0444, dir, bt,
diff -uriN linux-2.6.32.43/kernel/trace/ftrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/ftrace.c
--- linux-2.6.32.43/kernel/trace/ftrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/ftrace.c	2011-07-15 05:51:19.000000000 -0500
@@ -1100,13 +1100,18 @@
 
 	ip = rec->ip;
 
+	ret = ftrace_arch_code_modify_prepare();
+	FTRACE_WARN_ON(ret);
+	if (ret)
+		return 0;
+
 	ret = ftrace_make_nop(mod, rec, MCOUNT_ADDR);
+	FTRACE_WARN_ON(ftrace_arch_code_modify_post_process());
 	if (ret) {
 		ftrace_bug(ret, ip);
 		rec->flags |= FTRACE_FL_FAILED;
-		return 0;
 	}
-	return 1;
+	return ret ? 0 : 1;
 }
 
 /*
diff -uriN linux-2.6.32.43/kernel/trace/ring_buffer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/ring_buffer.c
--- linux-2.6.32.43/kernel/trace/ring_buffer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/ring_buffer.c	2011-07-15 05:51:19.000000000 -0500
@@ -606,7 +606,7 @@
  * the reader page). But if the next page is a header page,
  * its flags will be non zero.
  */
-static int inline
+static inline int
 rb_is_head_page(struct ring_buffer_per_cpu *cpu_buffer,
 		struct buffer_page *page, struct list_head *list)
 {
diff -uriN linux-2.6.32.43/kernel/trace/trace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace.c
--- linux-2.6.32.43/kernel/trace/trace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace.c	2011-07-15 05:51:19.000000000 -0500
@@ -3193,6 +3193,8 @@
 	size_t rem;
 	unsigned int i;
 
+	pax_track_stack();
+
 	/* copy the tracer to avoid using a global lock all around */
 	mutex_lock(&trace_types_lock);
 	if (unlikely(old_tracer != current_trace && current_trace)) {
@@ -3659,6 +3661,8 @@
 	int entries, size, i;
 	size_t ret;
 
+	pax_track_stack();
+
 	if (*ppos & (PAGE_SIZE - 1)) {
 		WARN_ONCE(1, "Ftrace: previous read must page-align\n");
 		return -EINVAL;
@@ -3816,10 +3820,9 @@
 };
 #endif
 
-static struct dentry *d_tracer;
-
 struct dentry *tracing_init_dentry(void)
 {
+	static struct dentry *d_tracer;
 	static int once;
 
 	if (d_tracer)
@@ -3839,10 +3842,9 @@
 	return d_tracer;
 }
 
-static struct dentry *d_percpu;
-
 struct dentry *tracing_dentry_percpu(void)
 {
+	static struct dentry *d_percpu;
 	static int once;
 	struct dentry *d_tracer;
 
diff -uriN linux-2.6.32.43/kernel/trace/trace_events.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_events.c
--- linux-2.6.32.43/kernel/trace/trace_events.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_events.c	2011-07-15 05:51:19.000000000 -0500
@@ -951,6 +951,8 @@
  * Modules must own their file_operations to keep up with
  * reference counting.
  */
+
+/* cannot be const */
 struct ftrace_module_file_ops {
 	struct list_head		list;
 	struct module			*mod;
diff -uriN linux-2.6.32.43/kernel/trace/trace_mmiotrace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_mmiotrace.c
--- linux-2.6.32.43/kernel/trace/trace_mmiotrace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_mmiotrace.c	2011-07-15 05:51:19.000000000 -0500
@@ -23,7 +23,7 @@
 static struct trace_array *mmio_trace_array;
 static bool overrun_detected;
 static unsigned long prev_overruns;
-static atomic_t dropped_count;
+static atomic_unchecked_t dropped_count;
 
 static void mmio_reset_data(struct trace_array *tr)
 {
@@ -126,7 +126,7 @@
 
 static unsigned long count_overruns(struct trace_iterator *iter)
 {
-	unsigned long cnt = atomic_xchg(&dropped_count, 0);
+	unsigned long cnt = atomic_xchg_unchecked(&dropped_count, 0);
 	unsigned long over = ring_buffer_overruns(iter->tr->buffer);
 
 	if (over > prev_overruns)
@@ -316,7 +316,7 @@
 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_RW,
 					  sizeof(*entry), 0, pc);
 	if (!event) {
-		atomic_inc(&dropped_count);
+		atomic_inc_unchecked(&dropped_count);
 		return;
 	}
 	entry	= ring_buffer_event_data(event);
@@ -346,7 +346,7 @@
 	event = trace_buffer_lock_reserve(buffer, TRACE_MMIO_MAP,
 					  sizeof(*entry), 0, pc);
 	if (!event) {
-		atomic_inc(&dropped_count);
+		atomic_inc_unchecked(&dropped_count);
 		return;
 	}
 	entry	= ring_buffer_event_data(event);
diff -uriN linux-2.6.32.43/kernel/trace/trace_output.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_output.c
--- linux-2.6.32.43/kernel/trace/trace_output.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_output.c	2011-07-15 05:51:19.000000000 -0500
@@ -237,7 +237,7 @@
 		return 0;
 	p = d_path(path, s->buffer + s->len, PAGE_SIZE - s->len);
 	if (!IS_ERR(p)) {
-		p = mangle_path(s->buffer + s->len, p, "\n");
+		p = mangle_path(s->buffer + s->len, p, "\n\\");
 		if (p) {
 			s->len = p - s->buffer;
 			return 1;
diff -uriN linux-2.6.32.43/kernel/trace/trace_stack.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_stack.c
--- linux-2.6.32.43/kernel/trace/trace_stack.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_stack.c	2011-07-15 05:51:19.000000000 -0500
@@ -50,7 +50,7 @@
 		return;
 
 	/* we do not handle interrupt stacks yet */
-	if (!object_is_on_stack(&this_size))
+	if (!object_starts_on_stack(&this_size))
 		return;
 
 	local_irq_save(flags);
diff -uriN linux-2.6.32.43/kernel/trace/trace_workqueue.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_workqueue.c
--- linux-2.6.32.43/kernel/trace/trace_workqueue.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/trace/trace_workqueue.c	2011-07-15 05:51:19.000000000 -0500
@@ -21,7 +21,7 @@
 	int		            cpu;
 	pid_t			    pid;
 /* Can be inserted from interrupt or user context, need to be atomic */
-	atomic_t	            inserted;
+	atomic_unchecked_t	    inserted;
 /*
  *  Don't need to be atomic, works are serialized in a single workqueue thread
  *  on a single CPU.
@@ -58,7 +58,7 @@
 	spin_lock_irqsave(&workqueue_cpu_stat(cpu)->lock, flags);
 	list_for_each_entry(node, &workqueue_cpu_stat(cpu)->list, list) {
 		if (node->pid == wq_thread->pid) {
-			atomic_inc(&node->inserted);
+			atomic_inc_unchecked(&node->inserted);
 			goto found;
 		}
 	}
@@ -205,7 +205,7 @@
 		tsk = get_pid_task(pid, PIDTYPE_PID);
 		if (tsk) {
 			seq_printf(s, "%3d %6d     %6u       %s\n", cws->cpu,
-				   atomic_read(&cws->inserted), cws->executed,
+				   atomic_read_unchecked(&cws->inserted), cws->executed,
 				   tsk->comm);
 			put_task_struct(tsk);
 		}
diff -uriN linux-2.6.32.43/kernel/user.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/user.c
--- linux-2.6.32.43/kernel/user.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/user.c	2011-07-15 05:51:19.000000000 -0500
@@ -159,6 +159,7 @@
 		spin_lock_irq(&uidhash_lock);
 		up = uid_hash_find(uid, hashent);
 		if (up) {
+			put_user_ns(ns);
 			key_put(new->uid_keyring);
 			key_put(new->session_keyring);
 			kmem_cache_free(uid_cachep, new);
diff -uriN linux-2.6.32.43/kernel/user_namespace.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/user_namespace.c
--- linux-2.6.32.43/kernel/user_namespace.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/user_namespace.c	2011-07-15 05:50:11.000000000 -0500
@@ -10,6 +10,7 @@
 #include <linux/slab.h>
 #include <linux/user_namespace.h>
 #include <linux/cred.h>
+#include <linux/vserver/global.h>
 
 /*
  * Create a new user namespace, deriving the creator from the user in the
@@ -30,6 +31,7 @@
 		return -ENOMEM;
 
 	kref_init(&ns->kref);
+	atomic_inc(&vs_global_user_ns);
 
 	for (n = 0; n < UIDHASH_SZ; ++n)
 		INIT_HLIST_HEAD(ns->uidhash_table + n);
@@ -78,6 +80,8 @@
 	struct user_namespace *ns =
 		container_of(kref, struct user_namespace, kref);
 
+	/* FIXME: maybe move into destroyer? */
+	atomic_dec(&vs_global_user_ns);
 	INIT_WORK(&ns->destroyer, free_user_ns_work);
 	schedule_work(&ns->destroyer);
 }
diff -uriN linux-2.6.32.43/kernel/utsname.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/utsname.c
--- linux-2.6.32.43/kernel/utsname.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/utsname.c	2011-07-15 05:50:11.000000000 -0500
@@ -14,14 +14,17 @@
 #include <linux/utsname.h>
 #include <linux/err.h>
 #include <linux/slab.h>
+#include <linux/vserver/global.h>
 
 static struct uts_namespace *create_uts_ns(void)
 {
 	struct uts_namespace *uts_ns;
 
 	uts_ns = kmalloc(sizeof(struct uts_namespace), GFP_KERNEL);
-	if (uts_ns)
+	if (uts_ns) {
 		kref_init(&uts_ns->kref);
+		atomic_inc(&vs_global_uts_ns);
+	}
 	return uts_ns;
 }
 
@@ -71,5 +74,6 @@
 	struct uts_namespace *ns;
 
 	ns = container_of(kref, struct uts_namespace, kref);
+	atomic_dec(&vs_global_uts_ns);
 	kfree(ns);
 }
diff -uriN linux-2.6.32.43/kernel/vserver/cacct.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cacct.c
--- linux-2.6.32.43/kernel/vserver/cacct.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cacct.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,42 @@
+/*
+ *  linux/kernel/vserver/cacct.c
+ *
+ *  Virtual Server: Context Accounting
+ *
+ *  Copyright (C) 2006-2007 Herbert Pötzl
+ *
+ *  V0.01  added accounting stats
+ *
+ */
+
+#include <linux/types.h>
+#include <linux/vs_context.h>
+#include <linux/vserver/cacct_cmd.h>
+#include <linux/vserver/cacct_int.h>
+
+#include <asm/errno.h>
+#include <asm/uaccess.h>
+
+
+int vc_sock_stat(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_sock_stat_v0 vc_data;
+	int j, field;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	field = vc_data.field;
+	if ((field < 0) || (field >= VXA_SOCK_SIZE))
+		return -EINVAL;
+
+	for (j = 0; j < 3; j++) {
+		vc_data.count[j] = vx_sock_count(&vxi->cacct, field, j);
+		vc_data.total[j] = vx_sock_total(&vxi->cacct, field, j);
+	}
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/cacct_init.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cacct_init.h
--- linux-2.6.32.43/kernel/vserver/cacct_init.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cacct_init.h	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,25 @@
+
+
+static inline void vx_info_init_cacct(struct _vx_cacct *cacct)
+{
+	int i, j;
+
+
+	for (i = 0; i < VXA_SOCK_SIZE; i++) {
+		for (j = 0; j < 3; j++) {
+			atomic_long_set_unchecked(&cacct->sock[i][j].count, 0);
+			atomic_long_set_unchecked(&cacct->sock[i][j].total, 0);
+		}
+	}
+	for (i = 0; i < 8; i++)
+		atomic_set_unchecked(&cacct->slab[i], 0);
+	for (i = 0; i < 5; i++)
+		for (j = 0; j < 4; j++)
+			atomic_set_unchecked(&cacct->page[i][j], 0);
+}
+
+static inline void vx_info_exit_cacct(struct _vx_cacct *cacct)
+{
+	return;
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/cacct_proc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cacct_proc.h
--- linux-2.6.32.43/kernel/vserver/cacct_proc.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cacct_proc.h	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,53 @@
+#ifndef _VX_CACCT_PROC_H
+#define _VX_CACCT_PROC_H
+
+#include <linux/vserver/cacct_int.h>
+
+
+#define VX_SOCKA_TOP	\
+	"Type\t    recv #/bytes\t\t   send #/bytes\t\t    fail #/bytes\n"
+
+static inline int vx_info_proc_cacct(struct _vx_cacct *cacct, char *buffer)
+{
+	int i, j, length = 0;
+	static char *type[VXA_SOCK_SIZE] = {
+		"UNSPEC", "UNIX", "INET", "INET6", "PACKET", "OTHER"
+	};
+
+	length += sprintf(buffer + length, VX_SOCKA_TOP);
+	for (i = 0; i < VXA_SOCK_SIZE; i++) {
+		length += sprintf(buffer + length, "%s:", type[i]);
+		for (j = 0; j < 3; j++) {
+			length += sprintf(buffer + length,
+				"\t%10lu/%-10lu",
+				vx_sock_count(cacct, i, j),
+				vx_sock_total(cacct, i, j));
+		}
+		buffer[length++] = '\n';
+	}
+
+	length += sprintf(buffer + length, "\n");
+	length += sprintf(buffer + length,
+		"slab:\t %8u %8u %8u %8u\n",
+		atomic_read_unchecked(&cacct->slab[1]),
+		atomic_read_unchecked(&cacct->slab[4]),
+		atomic_read_unchecked(&cacct->slab[0]),
+		atomic_read_unchecked(&cacct->slab[2]));
+
+	length += sprintf(buffer + length, "\n");
+	for (i = 0; i < 5; i++) {
+		length += sprintf(buffer + length,
+			"page[%d]: %8u %8u %8u %8u\t %8u %8u %8u %8u\n", i,
+			atomic_read_unchecked(&cacct->page[i][0]),
+			atomic_read_unchecked(&cacct->page[i][1]),
+			atomic_read_unchecked(&cacct->page[i][2]),
+			atomic_read_unchecked(&cacct->page[i][3]),
+			atomic_read_unchecked(&cacct->page[i][4]),
+			atomic_read_unchecked(&cacct->page[i][5]),
+			atomic_read_unchecked(&cacct->page[i][6]),
+			atomic_read_unchecked(&cacct->page[i][7]));
+	}
+	return length;
+}
+
+#endif	/* _VX_CACCT_PROC_H */
diff -uriN linux-2.6.32.43/kernel/vserver/context.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/context.c
--- linux-2.6.32.43/kernel/vserver/context.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/context.c	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,1058 @@
+/*
+ *  linux/kernel/vserver/context.c
+ *
+ *  Virtual Server: Context Support
+ *
+ *  Copyright (C) 2003-2007  Herbert Pötzl
+ *
+ *  V0.01  context helper
+ *  V0.02  vx_ctx_kill syscall command
+ *  V0.03  replaced context_info calls
+ *  V0.04  redesign of struct (de)alloc
+ *  V0.05  rlimit basic implementation
+ *  V0.06  task_xid and info commands
+ *  V0.07  context flags and caps
+ *  V0.08  switch to RCU based hash
+ *  V0.09  revert to non RCU for now
+ *  V0.10  and back to working RCU hash
+ *  V0.11  and back to locking again
+ *  V0.12  referenced context store
+ *  V0.13  separate per cpu data
+ *  V0.14  changed vcmds to vxi arg
+ *  V0.15  added context stat
+ *  V0.16  have __create claim() the vxi
+ *  V0.17  removed older and legacy stuff
+ *
+ */
+
+#include <linux/slab.h>
+#include <linux/types.h>
+#include <linux/security.h>
+#include <linux/pid_namespace.h>
+
+#include <linux/vserver/context.h>
+#include <linux/vserver/network.h>
+#include <linux/vserver/debug.h>
+#include <linux/vserver/limit.h>
+#include <linux/vserver/limit_int.h>
+#include <linux/vserver/space.h>
+#include <linux/init_task.h>
+#include <linux/fs_struct.h>
+
+#include <linux/vs_context.h>
+#include <linux/vs_limit.h>
+#include <linux/vs_pid.h>
+#include <linux/vserver/context_cmd.h>
+
+#include "cvirt_init.h"
+#include "cacct_init.h"
+#include "limit_init.h"
+#include "sched_init.h"
+
+
+atomic_t vx_global_ctotal	= ATOMIC_INIT(0);
+atomic_t vx_global_cactive	= ATOMIC_INIT(0);
+
+
+/*	now inactive context structures */
+
+static struct hlist_head vx_info_inactive = HLIST_HEAD_INIT;
+
+static spinlock_t vx_info_inactive_lock = SPIN_LOCK_UNLOCKED;
+
+
+/*	__alloc_vx_info()
+
+	* allocate an initialized vx_info struct
+	* doesn't make it visible (hash)			*/
+
+static struct vx_info *__alloc_vx_info(xid_t xid)
+{
+	struct vx_info *new = NULL;
+	int cpu, index;
+
+	vxdprintk(VXD_CBIT(xid, 0), "alloc_vx_info(%d)*", xid);
+
+	/* would this benefit from a slab cache? */
+	new = kmalloc(sizeof(struct vx_info), GFP_KERNEL);
+	if (!new)
+		return 0;
+
+	memset(new, 0, sizeof(struct vx_info));
+#ifdef CONFIG_SMP
+	new->ptr_pc = alloc_percpu(struct _vx_info_pc);
+	if (!new->ptr_pc)
+		goto error;
+#endif
+	new->vx_id = xid;
+	INIT_HLIST_NODE(&new->vx_hlist);
+	atomic_set(&new->vx_usecnt, 0);
+	atomic_set(&new->vx_tasks, 0);
+	new->vx_parent = NULL;
+	new->vx_state = 0;
+	init_waitqueue_head(&new->vx_wait);
+
+	/* prepare reaper */
+	get_task_struct(init_pid_ns.child_reaper);
+	new->vx_reaper = init_pid_ns.child_reaper;
+	new->vx_badness_bias = 0;
+
+	/* rest of init goes here */
+	vx_info_init_limit(&new->limit);
+	vx_info_init_sched(&new->sched);
+	vx_info_init_cvirt(&new->cvirt);
+	vx_info_init_cacct(&new->cacct);
+
+	/* per cpu data structures */
+	for_each_possible_cpu(cpu) {
+		vx_info_init_sched_pc(
+			&vx_per_cpu(new, sched_pc, cpu), cpu);
+		vx_info_init_cvirt_pc(
+			&vx_per_cpu(new, cvirt_pc, cpu), cpu);
+	}
+
+	new->vx_flags = VXF_INIT_SET;
+	cap_set_init_eff(new->vx_bcaps);
+	new->vx_ccaps = 0;
+	new->vx_umask = 0;
+
+	new->reboot_cmd = 0;
+	new->exit_code = 0;
+
+	// preconfig fs entries
+	for (index = 0; index < VX_SPACES; index++) {
+		write_lock(&init_fs.lock);
+		atomic_inc(&init_fs.users);
+		write_unlock(&init_fs.lock);
+		new->vx_fs[index] = &init_fs;
+	}
+
+	vxdprintk(VXD_CBIT(xid, 0),
+		"alloc_vx_info(%d) = %p", xid, new);
+	vxh_alloc_vx_info(new);
+	atomic_inc(&vx_global_ctotal);
+	return new;
+#ifdef CONFIG_SMP
+error:
+	kfree(new);
+	return 0;
+#endif
+}
+
+/*	__dealloc_vx_info()
+
+	* final disposal of vx_info				*/
+
+static void __dealloc_vx_info(struct vx_info *vxi)
+{
+#ifdef	CONFIG_VSERVER_WARN
+	struct vx_info_save vxis;
+	int cpu;
+#endif
+	vxdprintk(VXD_CBIT(xid, 0),
+		"dealloc_vx_info(%p)", vxi);
+	vxh_dealloc_vx_info(vxi);
+
+#ifdef	CONFIG_VSERVER_WARN
+	enter_vx_info(vxi, &vxis);
+	vx_info_exit_limit(&vxi->limit);
+	vx_info_exit_sched(&vxi->sched);
+	vx_info_exit_cvirt(&vxi->cvirt);
+	vx_info_exit_cacct(&vxi->cacct);
+
+	for_each_possible_cpu(cpu) {
+		vx_info_exit_sched_pc(
+			&vx_per_cpu(vxi, sched_pc, cpu), cpu);
+		vx_info_exit_cvirt_pc(
+			&vx_per_cpu(vxi, cvirt_pc, cpu), cpu);
+	}
+	leave_vx_info(&vxis);
+#endif
+
+	vxi->vx_id = -1;
+	vxi->vx_state |= VXS_RELEASED;
+
+#ifdef CONFIG_SMP
+	free_percpu(vxi->ptr_pc);
+#endif
+	kfree(vxi);
+	atomic_dec(&vx_global_ctotal);
+}
+
+static void __shutdown_vx_info(struct vx_info *vxi)
+{
+	struct nsproxy *nsproxy;
+	struct fs_struct *fs;
+	int index, kill;
+
+	might_sleep();
+
+	vxi->vx_state |= VXS_SHUTDOWN;
+	vs_state_change(vxi, VSC_SHUTDOWN);
+
+	for (index = 0; index < VX_SPACES; index++) {
+		nsproxy = xchg(&vxi->vx_nsproxy[index], NULL);
+		if (nsproxy)
+			put_nsproxy(nsproxy);
+
+		fs = xchg(&vxi->vx_fs[index], NULL);
+		write_lock(&fs->lock);
+		kill = atomic_dec_and_test(&fs->users);
+		write_unlock(&fs->lock);
+		if (kill)
+			free_fs_struct(fs);
+	}
+}
+
+/* exported stuff */
+
+void free_vx_info(struct vx_info *vxi)
+{
+	unsigned long flags;
+	unsigned index;
+
+	/* check for reference counts first */
+	BUG_ON(atomic_read(&vxi->vx_usecnt));
+	BUG_ON(atomic_read(&vxi->vx_tasks));
+
+	/* context must not be hashed */
+	BUG_ON(vx_info_state(vxi, VXS_HASHED));
+
+	/* context shutdown is mandatory */
+	BUG_ON(!vx_info_state(vxi, VXS_SHUTDOWN));
+
+	/* nsproxy and fs check */
+	for (index = 0; index < VX_SPACES; index++) {
+		BUG_ON(vxi->vx_nsproxy[index]);
+		BUG_ON(vxi->vx_fs[index]);
+	}
+
+	spin_lock_irqsave(&vx_info_inactive_lock, flags);
+	hlist_del(&vxi->vx_hlist);
+	spin_unlock_irqrestore(&vx_info_inactive_lock, flags);
+
+	__dealloc_vx_info(vxi);
+}
+
+
+/*	hash table for vx_info hash */
+
+#define VX_HASH_SIZE	13
+
+static struct hlist_head vx_info_hash[VX_HASH_SIZE] =
+	{ [0 ... VX_HASH_SIZE-1] = HLIST_HEAD_INIT };
+
+static spinlock_t vx_info_hash_lock = SPIN_LOCK_UNLOCKED;
+
+
+static inline unsigned int __hashval(xid_t xid)
+{
+	return (xid % VX_HASH_SIZE);
+}
+
+
+
+/*	__hash_vx_info()
+
+	* add the vxi to the global hash table
+	* requires the hash_lock to be held			*/
+
+static inline void __hash_vx_info(struct vx_info *vxi)
+{
+	struct hlist_head *head;
+
+	vxd_assert_lock(&vx_info_hash_lock);
+	vxdprintk(VXD_CBIT(xid, 4),
+		"__hash_vx_info: %p[#%d]", vxi, vxi->vx_id);
+	vxh_hash_vx_info(vxi);
+
+	/* context must not be hashed */
+	BUG_ON(vx_info_state(vxi, VXS_HASHED));
+
+	vxi->vx_state |= VXS_HASHED;
+	head = &vx_info_hash[__hashval(vxi->vx_id)];
+	hlist_add_head(&vxi->vx_hlist, head);
+	atomic_inc(&vx_global_cactive);
+}
+
+/*	__unhash_vx_info()
+
+	* remove the vxi from the global hash table
+	* requires the hash_lock to be held			*/
+
+static inline void __unhash_vx_info(struct vx_info *vxi)
+{
+	unsigned long flags;
+
+	vxd_assert_lock(&vx_info_hash_lock);
+	vxdprintk(VXD_CBIT(xid, 4),
+		"__unhash_vx_info: %p[#%d.%d.%d]", vxi, vxi->vx_id,
+		atomic_read(&vxi->vx_usecnt), atomic_read(&vxi->vx_tasks));
+	vxh_unhash_vx_info(vxi);
+
+	/* context must be hashed */
+	BUG_ON(!vx_info_state(vxi, VXS_HASHED));
+	/* but without tasks */
+	BUG_ON(atomic_read(&vxi->vx_tasks));
+
+	vxi->vx_state &= ~VXS_HASHED;
+	hlist_del_init(&vxi->vx_hlist);
+	spin_lock_irqsave(&vx_info_inactive_lock, flags);
+	hlist_add_head(&vxi->vx_hlist, &vx_info_inactive);
+	spin_unlock_irqrestore(&vx_info_inactive_lock, flags);
+	atomic_dec(&vx_global_cactive);
+}
+
+
+/*	__lookup_vx_info()
+
+	* requires the hash_lock to be held
+	* doesn't increment the vx_refcnt			*/
+
+static inline struct vx_info *__lookup_vx_info(xid_t xid)
+{
+	struct hlist_head *head = &vx_info_hash[__hashval(xid)];
+	struct hlist_node *pos;
+	struct vx_info *vxi;
+
+	vxd_assert_lock(&vx_info_hash_lock);
+	hlist_for_each(pos, head) {
+		vxi = hlist_entry(pos, struct vx_info, vx_hlist);
+
+		if (vxi->vx_id == xid)
+			goto found;
+	}
+	vxi = NULL;
+found:
+	vxdprintk(VXD_CBIT(xid, 0),
+		"__lookup_vx_info(#%u): %p[#%u]",
+		xid, vxi, vxi ? vxi->vx_id : 0);
+	vxh_lookup_vx_info(vxi, xid);
+	return vxi;
+}
+
+
+/*	__create_vx_info()
+
+	* create the requested context
+	* get(), claim() and hash it				*/
+
+static struct vx_info *__create_vx_info(int id)
+{
+	struct vx_info *new, *vxi = NULL;
+
+	vxdprintk(VXD_CBIT(xid, 1), "create_vx_info(%d)*", id);
+
+	if (!(new = __alloc_vx_info(id)))
+		return ERR_PTR(-ENOMEM);
+
+	/* required to make dynamic xids unique */
+	spin_lock(&vx_info_hash_lock);
+
+	/* static context requested */
+	if ((vxi = __lookup_vx_info(id))) {
+		vxdprintk(VXD_CBIT(xid, 0),
+			"create_vx_info(%d) = %p (already there)", id, vxi);
+		if (vx_info_flags(vxi, VXF_STATE_SETUP, 0))
+			vxi = ERR_PTR(-EBUSY);
+		else
+			vxi = ERR_PTR(-EEXIST);
+		goto out_unlock;
+	}
+	/* new context */
+	vxdprintk(VXD_CBIT(xid, 0),
+		"create_vx_info(%d) = %p (new)", id, new);
+	claim_vx_info(new, NULL);
+	__hash_vx_info(get_vx_info(new));
+	vxi = new, new = NULL;
+
+out_unlock:
+	spin_unlock(&vx_info_hash_lock);
+	vxh_create_vx_info(IS_ERR(vxi) ? NULL : vxi, id);
+	if (new)
+		__dealloc_vx_info(new);
+	return vxi;
+}
+
+
+/*	exported stuff						*/
+
+
+void unhash_vx_info(struct vx_info *vxi)
+{
+	spin_lock(&vx_info_hash_lock);
+	__unhash_vx_info(vxi);
+	spin_unlock(&vx_info_hash_lock);
+	__shutdown_vx_info(vxi);
+	__wakeup_vx_info(vxi);
+}
+
+
+/*	lookup_vx_info()
+
+	* search for a vx_info and get() it
+	* negative id means current				*/
+
+struct vx_info *lookup_vx_info(int id)
+{
+	struct vx_info *vxi = NULL;
+
+	if (id < 0) {
+		vxi = get_vx_info(current_vx_info());
+	} else if (id > 1) {
+		spin_lock(&vx_info_hash_lock);
+		vxi = get_vx_info(__lookup_vx_info(id));
+		spin_unlock(&vx_info_hash_lock);
+	}
+	return vxi;
+}
+
+/*	xid_is_hashed()
+
+	* verify that xid is still hashed			*/
+
+int xid_is_hashed(xid_t xid)
+{
+	int hashed;
+
+	spin_lock(&vx_info_hash_lock);
+	hashed = (__lookup_vx_info(xid) != NULL);
+	spin_unlock(&vx_info_hash_lock);
+	return hashed;
+}
+
+#ifdef	CONFIG_PROC_FS
+
+/*	get_xid_list()
+
+	* get a subset of hashed xids for proc
+	* assumes size is at least one				*/
+
+int get_xid_list(int index, unsigned int *xids, int size)
+{
+	int hindex, nr_xids = 0;
+
+	/* only show current and children */
+	if (!vx_check(0, VS_ADMIN | VS_WATCH)) {
+		if (index > 0)
+			return 0;
+		xids[nr_xids] = vx_current_xid();
+		return 1;
+	}
+
+	for (hindex = 0; hindex < VX_HASH_SIZE; hindex++) {
+		struct hlist_head *head = &vx_info_hash[hindex];
+		struct hlist_node *pos;
+
+		spin_lock(&vx_info_hash_lock);
+		hlist_for_each(pos, head) {
+			struct vx_info *vxi;
+
+			if (--index > 0)
+				continue;
+
+			vxi = hlist_entry(pos, struct vx_info, vx_hlist);
+			xids[nr_xids] = vxi->vx_id;
+			if (++nr_xids >= size) {
+				spin_unlock(&vx_info_hash_lock);
+				goto out;
+			}
+		}
+		/* keep the lock time short */
+		spin_unlock(&vx_info_hash_lock);
+	}
+out:
+	return nr_xids;
+}
+#endif
+
+#ifdef	CONFIG_VSERVER_DEBUG
+
+void	dump_vx_info_inactive(int level)
+{
+	struct hlist_node *entry, *next;
+
+	hlist_for_each_safe(entry, next, &vx_info_inactive) {
+		struct vx_info *vxi =
+			list_entry(entry, struct vx_info, vx_hlist);
+
+		dump_vx_info(vxi, level);
+	}
+}
+
+#endif
+
+#if 0
+int vx_migrate_user(struct task_struct *p, struct vx_info *vxi)
+{
+	struct user_struct *new_user, *old_user;
+
+	if (!p || !vxi)
+		BUG();
+
+	if (vx_info_flags(vxi, VXF_INFO_PRIVATE, 0))
+		return -EACCES;
+
+	new_user = alloc_uid(vxi->vx_id, p->uid);
+	if (!new_user)
+		return -ENOMEM;
+
+	old_user = p->user;
+	if (new_user != old_user) {
+		atomic_inc(&new_user->processes);
+		atomic_dec(&old_user->processes);
+		p->user = new_user;
+	}
+	free_uid(old_user);
+	return 0;
+}
+#endif
+
+#if 0
+void vx_mask_cap_bset(struct vx_info *vxi, struct task_struct *p)
+{
+	// p->cap_effective &= vxi->vx_cap_bset;
+	p->cap_effective =
+		cap_intersect(p->cap_effective, vxi->cap_bset);
+	// p->cap_inheritable &= vxi->vx_cap_bset;
+	p->cap_inheritable =
+		cap_intersect(p->cap_inheritable, vxi->cap_bset);
+	// p->cap_permitted &= vxi->vx_cap_bset;
+	p->cap_permitted =
+		cap_intersect(p->cap_permitted, vxi->cap_bset);
+}
+#endif
+
+
+#include <linux/file.h>
+#include <linux/fdtable.h>
+
+static int vx_openfd_task(struct task_struct *tsk)
+{
+	struct files_struct *files = tsk->files;
+	struct fdtable *fdt;
+	const unsigned long *bptr;
+	int count, total;
+
+	/* no rcu_read_lock() because of spin_lock() */
+	spin_lock(&files->file_lock);
+	fdt = files_fdtable(files);
+	bptr = fdt->open_fds->fds_bits;
+	count = fdt->max_fds / (sizeof(unsigned long) * 8);
+	for (total = 0; count > 0; count--) {
+		if (*bptr)
+			total += hweight_long(*bptr);
+		bptr++;
+	}
+	spin_unlock(&files->file_lock);
+	return total;
+}
+
+
+/*	for *space compatibility */
+
+asmlinkage long sys_unshare(unsigned long);
+
+/*
+ *	migrate task to new context
+ *	gets vxi, puts old_vxi on change
+ *	optionally unshares namespaces (hack)
+ */
+
+int vx_migrate_task(struct task_struct *p, struct vx_info *vxi, int unshare)
+{
+	struct vx_info *old_vxi;
+	int ret = 0;
+
+	if (!p || !vxi)
+		BUG();
+
+	vxdprintk(VXD_CBIT(xid, 5),
+		"vx_migrate_task(%p,%p[#%d.%d])", p, vxi,
+		vxi->vx_id, atomic_read(&vxi->vx_usecnt));
+
+	if (vx_info_flags(vxi, VXF_INFO_PRIVATE, 0) &&
+		!vx_info_flags(vxi, VXF_STATE_SETUP, 0))
+		return -EACCES;
+
+	if (vx_info_state(vxi, VXS_SHUTDOWN))
+		return -EFAULT;
+
+	old_vxi = task_get_vx_info(p);
+	if (old_vxi == vxi)
+		goto out;
+
+//	if (!(ret = vx_migrate_user(p, vxi))) {
+	{
+		int openfd;
+
+		task_lock(p);
+		openfd = vx_openfd_task(p);
+
+		if (old_vxi) {
+			atomic_dec(&old_vxi->cvirt.nr_threads);
+			atomic_dec(&old_vxi->cvirt.nr_running);
+			__rlim_dec(&old_vxi->limit, RLIMIT_NPROC);
+			/* FIXME: what about the struct files here? */
+			__rlim_sub(&old_vxi->limit, VLIMIT_OPENFD, openfd);
+			/* account for the executable */
+			__rlim_dec(&old_vxi->limit, VLIMIT_DENTRY);
+		}
+		atomic_inc(&vxi->cvirt.nr_threads);
+		atomic_inc(&vxi->cvirt.nr_running);
+		__rlim_inc(&vxi->limit, RLIMIT_NPROC);
+		/* FIXME: what about the struct files here? */
+		__rlim_add(&vxi->limit, VLIMIT_OPENFD, openfd);
+		/* account for the executable */
+		__rlim_inc(&vxi->limit, VLIMIT_DENTRY);
+
+		if (old_vxi) {
+			release_vx_info(old_vxi, p);
+			clr_vx_info(&p->vx_info);
+		}
+		claim_vx_info(vxi, p);
+		set_vx_info(&p->vx_info, vxi);
+		p->xid = vxi->vx_id;
+
+		vxdprintk(VXD_CBIT(xid, 5),
+			"moved task %p into vxi:%p[#%d]",
+			p, vxi, vxi->vx_id);
+
+		// vx_mask_cap_bset(vxi, p);
+		task_unlock(p);
+
+		/* hack for *spaces to provide compatibility */
+		if (unshare) {
+			struct nsproxy *old_nsp, *new_nsp;
+
+			ret = unshare_nsproxy_namespaces(
+				CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER,
+				&new_nsp, NULL);
+			if (ret)
+				goto out;
+
+			old_nsp = xchg(&p->nsproxy, new_nsp);
+			vx_set_space(vxi,
+				CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER, 0);
+			put_nsproxy(old_nsp);
+		}
+	}
+out:
+	put_vx_info(old_vxi);
+	return ret;
+}
+
+int vx_set_reaper(struct vx_info *vxi, struct task_struct *p)
+{
+	struct task_struct *old_reaper;
+
+	if (!vxi)
+		return -EINVAL;
+
+	vxdprintk(VXD_CBIT(xid, 6),
+		"vx_set_reaper(%p[#%d],%p[#%d,%d])",
+		vxi, vxi->vx_id, p, p->xid, p->pid);
+
+	old_reaper = vxi->vx_reaper;
+	if (old_reaper == p)
+		return 0;
+
+	/* set new child reaper */
+	get_task_struct(p);
+	vxi->vx_reaper = p;
+	put_task_struct(old_reaper);
+	return 0;
+}
+
+int vx_set_init(struct vx_info *vxi, struct task_struct *p)
+{
+	if (!vxi)
+		return -EINVAL;
+
+	vxdprintk(VXD_CBIT(xid, 6),
+		"vx_set_init(%p[#%d],%p[#%d,%d,%d])",
+		vxi, vxi->vx_id, p, p->xid, p->pid, p->tgid);
+
+	vxi->vx_flags &= ~VXF_STATE_INIT;
+	// vxi->vx_initpid = p->tgid;
+	vxi->vx_initpid = p->pid;
+	return 0;
+}
+
+void vx_exit_init(struct vx_info *vxi, struct task_struct *p, int code)
+{
+	vxdprintk(VXD_CBIT(xid, 6),
+		"vx_exit_init(%p[#%d],%p[#%d,%d,%d])",
+		vxi, vxi->vx_id, p, p->xid, p->pid, p->tgid);
+
+	vxi->exit_code = code;
+	vxi->vx_initpid = 0;
+}
+
+
+void vx_set_persistent(struct vx_info *vxi)
+{
+	vxdprintk(VXD_CBIT(xid, 6),
+		"vx_set_persistent(%p[#%d])", vxi, vxi->vx_id);
+
+	get_vx_info(vxi);
+	claim_vx_info(vxi, NULL);
+}
+
+void vx_clear_persistent(struct vx_info *vxi)
+{
+	vxdprintk(VXD_CBIT(xid, 6),
+		"vx_clear_persistent(%p[#%d])", vxi, vxi->vx_id);
+
+	release_vx_info(vxi, NULL);
+	put_vx_info(vxi);
+}
+
+void vx_update_persistent(struct vx_info *vxi)
+{
+	if (vx_info_flags(vxi, VXF_PERSISTENT, 0))
+		vx_set_persistent(vxi);
+	else
+		vx_clear_persistent(vxi);
+}
+
+
+/*	task must be current or locked		*/
+
+void	exit_vx_info(struct task_struct *p, int code)
+{
+	struct vx_info *vxi = p->vx_info;
+
+	if (vxi) {
+		atomic_dec(&vxi->cvirt.nr_threads);
+		vx_nproc_dec(p);
+
+		vxi->exit_code = code;
+		release_vx_info(vxi, p);
+	}
+}
+
+void	exit_vx_info_early(struct task_struct *p, int code)
+{
+	struct vx_info *vxi = p->vx_info;
+
+	if (vxi) {
+		if (vxi->vx_initpid == p->pid)
+			vx_exit_init(vxi, p, code);
+		if (vxi->vx_reaper == p)
+			vx_set_reaper(vxi, init_pid_ns.child_reaper);
+	}
+}
+
+
+/* vserver syscall commands below here */
+
+/* taks xid and vx_info functions */
+
+#include <asm/uaccess.h>
+
+
+int vc_task_xid(uint32_t id)
+{
+	xid_t xid;
+
+	if (id) {
+		struct task_struct *tsk;
+
+		read_lock(&tasklist_lock);
+		tsk = find_task_by_real_pid(id);
+		xid = (tsk) ? tsk->xid : -ESRCH;
+		read_unlock(&tasklist_lock);
+	} else
+		xid = vx_current_xid();
+	return xid;
+}
+
+
+int vc_vx_info(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_vx_info_v0 vc_data;
+
+	vc_data.xid = vxi->vx_id;
+	vc_data.initpid = vxi->vx_initpid;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+
+int vc_ctx_stat(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_stat_v0 vc_data;
+
+	vc_data.usecnt = atomic_read(&vxi->vx_usecnt);
+	vc_data.tasks = atomic_read(&vxi->vx_tasks);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+
+/* context functions */
+
+int vc_ctx_create(uint32_t xid, void __user *data)
+{
+	struct vcmd_ctx_create vc_data = { .flagword = VXF_INIT_SET };
+	struct vx_info *new_vxi;
+	int ret;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	if ((xid > MAX_S_CONTEXT) || (xid < 2))
+		return -EINVAL;
+
+	new_vxi = __create_vx_info(xid);
+	if (IS_ERR(new_vxi))
+		return PTR_ERR(new_vxi);
+
+	/* initial flags */
+	new_vxi->vx_flags = vc_data.flagword;
+
+	ret = -ENOEXEC;
+	if (vs_state_change(new_vxi, VSC_STARTUP))
+		goto out;
+
+	ret = vx_migrate_task(current, new_vxi, (!data));
+	if (ret)
+		goto out;
+
+	/* return context id on success */
+	ret = new_vxi->vx_id;
+
+	/* get a reference for persistent contexts */
+	if ((vc_data.flagword & VXF_PERSISTENT))
+		vx_set_persistent(new_vxi);
+out:
+	release_vx_info(new_vxi, NULL);
+	put_vx_info(new_vxi);
+	return ret;
+}
+
+
+int vc_ctx_migrate(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_migrate vc_data = { .flagword = 0 };
+	int ret;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = vx_migrate_task(current, vxi, 0);
+	if (ret)
+		return ret;
+	if (vc_data.flagword & VXM_SET_INIT)
+		ret = vx_set_init(vxi, current);
+	if (ret)
+		return ret;
+	if (vc_data.flagword & VXM_SET_REAPER)
+		ret = vx_set_reaper(vxi, current);
+	return ret;
+}
+
+
+int vc_get_cflags(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_flags_v0 vc_data;
+
+	vc_data.flagword = vxi->vx_flags;
+
+	/* special STATE flag handling */
+	vc_data.mask = vs_mask_flags(~0ULL, vxi->vx_flags, VXF_ONE_TIME);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+int vc_set_cflags(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_flags_v0 vc_data;
+	uint64_t mask, trigger;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	/* special STATE flag handling */
+	mask = vs_mask_mask(vc_data.mask, vxi->vx_flags, VXF_ONE_TIME);
+	trigger = (mask & vxi->vx_flags) ^ (mask & vc_data.flagword);
+
+	if (vxi == current_vx_info()) {
+		/* if (trigger & VXF_STATE_SETUP)
+			vx_mask_cap_bset(vxi, current); */
+		if (trigger & VXF_STATE_INIT) {
+			int ret;
+
+			ret = vx_set_init(vxi, current);
+			if (ret)
+				return ret;
+			ret = vx_set_reaper(vxi, current);
+			if (ret)
+				return ret;
+		}
+	}
+
+	vxi->vx_flags = vs_mask_flags(vxi->vx_flags,
+		vc_data.flagword, mask);
+	if (trigger & VXF_PERSISTENT)
+		vx_update_persistent(vxi);
+
+	return 0;
+}
+
+
+static inline uint64_t caps_from_cap_t(kernel_cap_t c)
+{
+	uint64_t v = c.cap[0] | ((uint64_t)c.cap[1] << 32);
+
+	// printk("caps_from_cap_t(%08x:%08x) = %016llx\n", c.cap[1], c.cap[0], v);
+	return v;
+}
+
+static inline kernel_cap_t cap_t_from_caps(uint64_t v)
+{
+	kernel_cap_t c = __cap_empty_set;
+
+	c.cap[0] = v & 0xFFFFFFFF;
+	c.cap[1] = (v >> 32) & 0xFFFFFFFF;
+
+	// printk("cap_t_from_caps(%016llx) = %08x:%08x\n", v, c.cap[1], c.cap[0]);
+	return c;
+}
+
+
+static int do_get_caps(struct vx_info *vxi, uint64_t *bcaps, uint64_t *ccaps)
+{
+	if (bcaps)
+		*bcaps = caps_from_cap_t(vxi->vx_bcaps);
+	if (ccaps)
+		*ccaps = vxi->vx_ccaps;
+
+	return 0;
+}
+
+int vc_get_ccaps(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_caps_v1 vc_data;
+	int ret;
+
+	ret = do_get_caps(vxi, NULL, &vc_data.ccaps);
+	if (ret)
+		return ret;
+	vc_data.cmask = ~0ULL;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+static int do_set_caps(struct vx_info *vxi,
+	uint64_t bcaps, uint64_t bmask, uint64_t ccaps, uint64_t cmask)
+{
+	uint64_t bcold = caps_from_cap_t(vxi->vx_bcaps);
+
+#if 0
+	printk("do_set_caps(%16llx, %16llx, %16llx, %16llx)\n",
+		bcaps, bmask, ccaps, cmask);
+#endif
+	vxi->vx_bcaps = cap_t_from_caps(
+		vs_mask_flags(bcold, bcaps, bmask));
+	vxi->vx_ccaps = vs_mask_flags(vxi->vx_ccaps, ccaps, cmask);
+
+	return 0;
+}
+
+int vc_set_ccaps(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_caps_v1 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_set_caps(vxi, 0, 0, vc_data.ccaps, vc_data.cmask);
+}
+
+int vc_get_bcaps(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_bcaps vc_data;
+	int ret;
+
+	ret = do_get_caps(vxi, &vc_data.bcaps, NULL);
+	if (ret)
+		return ret;
+	vc_data.bmask = ~0ULL;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+int vc_set_bcaps(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_bcaps vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_set_caps(vxi, vc_data.bcaps, vc_data.bmask, 0, 0);
+}
+
+
+int vc_get_umask(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_umask vc_data;
+
+	vc_data.umask = vxi->vx_umask;
+	vc_data.mask = ~0ULL;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+int vc_set_umask(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_umask vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	vxi->vx_umask = vs_mask_flags(vxi->vx_umask,
+		vc_data.umask, vc_data.mask);
+	return 0;
+}
+
+
+int vc_get_badness(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_badness_v0 vc_data;
+
+	vc_data.bias = vxi->vx_badness_bias;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+int vc_set_badness(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_badness_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	vxi->vx_badness_bias = vc_data.bias;
+	return 0;
+}
+
+#include <linux/module.h>
+
+EXPORT_SYMBOL_GPL(free_vx_info);
+
diff -uriN linux-2.6.32.43/kernel/vserver/cvirt.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cvirt.c
--- linux-2.6.32.43/kernel/vserver/cvirt.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cvirt.c	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,304 @@
+/*
+ *  linux/kernel/vserver/cvirt.c
+ *
+ *  Virtual Server: Context Virtualization
+ *
+ *  Copyright (C) 2004-2007  Herbert Pötzl
+ *
+ *  V0.01  broken out from limit.c
+ *  V0.02  added utsname stuff
+ *  V0.03  changed vcmds to vxi arg
+ *
+ */
+
+#include <linux/types.h>
+#include <linux/utsname.h>
+#include <linux/vs_cvirt.h>
+#include <linux/vserver/switch.h>
+#include <linux/vserver/cvirt_cmd.h>
+
+#include <asm/uaccess.h>
+
+
+void vx_vsi_uptime(struct timespec *uptime, struct timespec *idle)
+{
+	struct vx_info *vxi = current_vx_info();
+
+	set_normalized_timespec(uptime,
+		uptime->tv_sec - vxi->cvirt.bias_uptime.tv_sec,
+		uptime->tv_nsec - vxi->cvirt.bias_uptime.tv_nsec);
+	if (!idle)
+		return;
+	set_normalized_timespec(idle,
+		idle->tv_sec - vxi->cvirt.bias_idle.tv_sec,
+		idle->tv_nsec - vxi->cvirt.bias_idle.tv_nsec);
+	return;
+}
+
+uint64_t vx_idle_jiffies(void)
+{
+	return init_task.utime + init_task.stime;
+}
+
+
+
+static inline uint32_t __update_loadavg(uint32_t load,
+	int wsize, int delta, int n)
+{
+	unsigned long long calc, prev;
+
+	/* just set it to n */
+	if (unlikely(delta >= wsize))
+		return (n << FSHIFT);
+
+	calc = delta * n;
+	calc <<= FSHIFT;
+	prev = (wsize - delta);
+	prev *= load;
+	calc += prev;
+	do_div(calc, wsize);
+	return calc;
+}
+
+
+void vx_update_load(struct vx_info *vxi)
+{
+	uint32_t now, last, delta;
+	unsigned int nr_running, nr_uninterruptible;
+	unsigned int total;
+	unsigned long flags;
+
+	spin_lock_irqsave(&vxi->cvirt.load_lock, flags);
+
+	now = jiffies;
+	last = vxi->cvirt.load_last;
+	delta = now - last;
+
+	if (delta < 5*HZ)
+		goto out;
+
+	nr_running = atomic_read(&vxi->cvirt.nr_running);
+	nr_uninterruptible = atomic_read(&vxi->cvirt.nr_uninterruptible);
+	total = nr_running + nr_uninterruptible;
+
+	vxi->cvirt.load[0] = __update_loadavg(vxi->cvirt.load[0],
+		60*HZ, delta, total);
+	vxi->cvirt.load[1] = __update_loadavg(vxi->cvirt.load[1],
+		5*60*HZ, delta, total);
+	vxi->cvirt.load[2] = __update_loadavg(vxi->cvirt.load[2],
+		15*60*HZ, delta, total);
+
+	vxi->cvirt.load_last = now;
+out:
+	atomic_inc_unchecked(&vxi->cvirt.load_updates);
+	spin_unlock_irqrestore(&vxi->cvirt.load_lock, flags);
+}
+
+
+/*
+ * Commands to do_syslog:
+ *
+ *      0 -- Close the log.  Currently a NOP.
+ *      1 -- Open the log. Currently a NOP.
+ *      2 -- Read from the log.
+ *      3 -- Read all messages remaining in the ring buffer.
+ *      4 -- Read and clear all messages remaining in the ring buffer
+ *      5 -- Clear ring buffer.
+ *      6 -- Disable printk's to console
+ *      7 -- Enable printk's to console
+ *      8 -- Set level of messages printed to console
+ *      9 -- Return number of unread characters in the log buffer
+ *     10 -- Return size of the log buffer
+ */
+int vx_do_syslog(int type, char __user *buf, int len)
+{
+	int error = 0;
+	int do_clear = 0;
+	struct vx_info *vxi = current_vx_info();
+	struct _vx_syslog *log;
+
+	if (!vxi)
+		return -EINVAL;
+	log = &vxi->cvirt.syslog;
+
+	switch (type) {
+	case 0:		/* Close log */
+	case 1:		/* Open log */
+		break;
+	case 2:		/* Read from log */
+		error = wait_event_interruptible(log->log_wait,
+			(log->log_start - log->log_end));
+		if (error)
+			break;
+		spin_lock_irq(&log->logbuf_lock);
+		spin_unlock_irq(&log->logbuf_lock);
+		break;
+	case 4:		/* Read/clear last kernel messages */
+		do_clear = 1;
+		/* fall through */
+	case 3:		/* Read last kernel messages */
+		return 0;
+
+	case 5:		/* Clear ring buffer */
+		return 0;
+
+	case 6:		/* Disable logging to console */
+	case 7:		/* Enable logging to console */
+	case 8:		/* Set level of messages printed to console */
+		break;
+
+	case 9:		/* Number of chars in the log buffer */
+		return 0;
+	case 10:	/* Size of the log buffer */
+		return 0;
+	default:
+		error = -EINVAL;
+		break;
+	}
+	return error;
+}
+
+
+/* virtual host info names */
+
+static char *vx_vhi_name(struct vx_info *vxi, int id)
+{
+	struct nsproxy *nsproxy;
+	struct uts_namespace *uts;
+
+	if (id == VHIN_CONTEXT)
+		return vxi->vx_name;
+
+	nsproxy = vxi->vx_nsproxy[0];
+	if (!nsproxy)
+		return NULL;
+
+	uts = nsproxy->uts_ns;
+	if (!uts)
+		return NULL;
+
+	switch (id) {
+	case VHIN_SYSNAME:
+		return uts->name.sysname;
+	case VHIN_NODENAME:
+		return uts->name.nodename;
+	case VHIN_RELEASE:
+		return uts->name.release;
+	case VHIN_VERSION:
+		return uts->name.version;
+	case VHIN_MACHINE:
+		return uts->name.machine;
+	case VHIN_DOMAINNAME:
+		return uts->name.domainname;
+	default:
+		return NULL;
+	}
+	return NULL;
+}
+
+int vc_set_vhi_name(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_vhi_name_v0 vc_data;
+	char *name;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	name = vx_vhi_name(vxi, vc_data.field);
+	if (!name)
+		return -EINVAL;
+
+	memcpy(name, vc_data.name, 65);
+	return 0;
+}
+
+int vc_get_vhi_name(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_vhi_name_v0 vc_data;
+	char *name;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	name = vx_vhi_name(vxi, vc_data.field);
+	if (!name)
+		return -EINVAL;
+
+	memcpy(vc_data.name, name, 65);
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+
+int vc_virt_stat(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_virt_stat_v0 vc_data;
+	struct _vx_cvirt *cvirt = &vxi->cvirt;
+	struct timespec uptime;
+
+	do_posix_clock_monotonic_gettime(&uptime);
+	set_normalized_timespec(&uptime,
+		uptime.tv_sec - cvirt->bias_uptime.tv_sec,
+		uptime.tv_nsec - cvirt->bias_uptime.tv_nsec);
+
+	vc_data.offset = timeval_to_ns(&cvirt->bias_tv);
+	vc_data.uptime = timespec_to_ns(&uptime);
+	vc_data.nr_threads = atomic_read(&cvirt->nr_threads);
+	vc_data.nr_running = atomic_read(&cvirt->nr_running);
+	vc_data.nr_uninterruptible = atomic_read(&cvirt->nr_uninterruptible);
+	vc_data.nr_onhold = atomic_read(&cvirt->nr_onhold);
+	vc_data.nr_forks = atomic_read_unchecked(&cvirt->total_forks);
+	vc_data.load[0] = cvirt->load[0];
+	vc_data.load[1] = cvirt->load[1];
+	vc_data.load[2] = cvirt->load[2];
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+
+#ifdef CONFIG_VSERVER_VTIME
+
+/* virtualized time base */
+
+void vx_gettimeofday(struct timeval *tv)
+{
+	struct vx_info *vxi;
+
+	do_gettimeofday(tv);
+	if (!vx_flags(VXF_VIRT_TIME, 0))
+		return;
+
+	vxi = current_vx_info();
+	tv->tv_sec += vxi->cvirt.bias_tv.tv_sec;
+	tv->tv_usec += vxi->cvirt.bias_tv.tv_usec;
+
+	if (tv->tv_usec >= USEC_PER_SEC) {
+		tv->tv_sec++;
+		tv->tv_usec -= USEC_PER_SEC;
+	} else if (tv->tv_usec < 0) {
+		tv->tv_sec--;
+		tv->tv_usec += USEC_PER_SEC;
+	}
+}
+
+int vx_settimeofday(struct timespec *ts)
+{
+	struct timeval tv;
+	struct vx_info *vxi;
+
+	if (!vx_flags(VXF_VIRT_TIME, 0))
+		return do_settimeofday(ts);
+
+	do_gettimeofday(&tv);
+	vxi = current_vx_info();
+	vxi->cvirt.bias_tv.tv_sec = ts->tv_sec - tv.tv_sec;
+	vxi->cvirt.bias_tv.tv_usec =
+		(ts->tv_nsec/NSEC_PER_USEC) - tv.tv_usec;
+	return 0;
+}
+
+#endif
+
diff -uriN linux-2.6.32.43/kernel/vserver/cvirt_init.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cvirt_init.h
--- linux-2.6.32.43/kernel/vserver/cvirt_init.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cvirt_init.h	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,69 @@
+
+
+extern uint64_t vx_idle_jiffies(void);
+
+static inline void vx_info_init_cvirt(struct _vx_cvirt *cvirt)
+{
+	uint64_t idle_jiffies = vx_idle_jiffies();
+	uint64_t nsuptime;
+
+	do_posix_clock_monotonic_gettime(&cvirt->bias_uptime);
+	nsuptime = (unsigned long long)cvirt->bias_uptime.tv_sec
+		* NSEC_PER_SEC + cvirt->bias_uptime.tv_nsec;
+	cvirt->bias_clock = nsec_to_clock_t(nsuptime);
+	cvirt->bias_tv.tv_sec = 0;
+	cvirt->bias_tv.tv_usec = 0;
+
+	jiffies_to_timespec(idle_jiffies, &cvirt->bias_idle);
+	atomic_set(&cvirt->nr_threads, 0);
+	atomic_set(&cvirt->nr_running, 0);
+	atomic_set(&cvirt->nr_uninterruptible, 0);
+	atomic_set(&cvirt->nr_onhold, 0);
+
+	spin_lock_init(&cvirt->load_lock);
+	cvirt->load_last = jiffies;
+	atomic_set_unchecked(&cvirt->load_updates, 0);
+	cvirt->load[0] = 0;
+	cvirt->load[1] = 0;
+	cvirt->load[2] = 0;
+	atomic_set_unchecked(&cvirt->total_forks, 0);
+
+	spin_lock_init(&cvirt->syslog.logbuf_lock);
+	init_waitqueue_head(&cvirt->syslog.log_wait);
+	cvirt->syslog.log_start = 0;
+	cvirt->syslog.log_end = 0;
+	cvirt->syslog.con_start = 0;
+	cvirt->syslog.logged_chars = 0;
+}
+
+static inline
+void vx_info_init_cvirt_pc(struct _vx_cvirt_pc *cvirt_pc, int cpu)
+{
+	// cvirt_pc->cpustat = { 0 };
+}
+
+static inline void vx_info_exit_cvirt(struct _vx_cvirt *cvirt)
+{
+	int value;
+
+	vxwprintk_xid((value = atomic_read(&cvirt->nr_threads)),
+		"!!! cvirt: %p[nr_threads] = %d on exit.",
+		cvirt, value);
+	vxwprintk_xid((value = atomic_read(&cvirt->nr_running)),
+		"!!! cvirt: %p[nr_running] = %d on exit.",
+		cvirt, value);
+	vxwprintk_xid((value = atomic_read(&cvirt->nr_uninterruptible)),
+		"!!! cvirt: %p[nr_uninterruptible] = %d on exit.",
+		cvirt, value);
+	vxwprintk_xid((value = atomic_read(&cvirt->nr_onhold)),
+		"!!! cvirt: %p[nr_onhold] = %d on exit.",
+		cvirt, value);
+	return;
+}
+
+static inline
+void vx_info_exit_cvirt_pc(struct _vx_cvirt_pc *cvirt_pc, int cpu)
+{
+	return;
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/cvirt_proc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cvirt_proc.h
--- linux-2.6.32.43/kernel/vserver/cvirt_proc.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/cvirt_proc.h	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,135 @@
+#ifndef _VX_CVIRT_PROC_H
+#define _VX_CVIRT_PROC_H
+
+#include <linux/nsproxy.h>
+#include <linux/mnt_namespace.h>
+#include <linux/ipc_namespace.h>
+#include <linux/utsname.h>
+#include <linux/ipc.h>
+
+
+static inline
+int vx_info_proc_nsproxy(struct nsproxy *nsproxy, char *buffer)
+{
+	struct mnt_namespace *ns;
+	struct uts_namespace *uts;
+	struct ipc_namespace *ipc;
+	struct path path;
+	char *pstr, *root;
+	int length = 0;
+
+	if (!nsproxy)
+		goto out;
+
+	length += sprintf(buffer + length,
+		"NSProxy:\t%p [%p,%p,%p]\n",
+		nsproxy, nsproxy->mnt_ns,
+		nsproxy->uts_ns, nsproxy->ipc_ns);
+
+	ns = nsproxy->mnt_ns;
+	if (!ns)
+		goto skip_ns;
+
+	pstr = kmalloc(PATH_MAX, GFP_KERNEL);
+	if (!pstr)
+		goto skip_ns;
+
+	path.mnt = ns->root;
+	path.dentry = ns->root->mnt_root;
+	root = d_path(&path, pstr, PATH_MAX - 2);
+	length += sprintf(buffer + length,
+		"Namespace:\t%p [#%u]\n"
+		"RootPath:\t%s\n",
+		ns, atomic_read(&ns->count),
+		root);
+	kfree(pstr);
+skip_ns:
+
+	uts = nsproxy->uts_ns;
+	if (!uts)
+		goto skip_uts;
+
+	length += sprintf(buffer + length,
+		"SysName:\t%.*s\n"
+		"NodeName:\t%.*s\n"
+		"Release:\t%.*s\n"
+		"Version:\t%.*s\n"
+		"Machine:\t%.*s\n"
+		"DomainName:\t%.*s\n",
+		__NEW_UTS_LEN, uts->name.sysname,
+		__NEW_UTS_LEN, uts->name.nodename,
+		__NEW_UTS_LEN, uts->name.release,
+		__NEW_UTS_LEN, uts->name.version,
+		__NEW_UTS_LEN, uts->name.machine,
+		__NEW_UTS_LEN, uts->name.domainname);
+skip_uts:
+
+	ipc = nsproxy->ipc_ns;
+	if (!ipc)
+		goto skip_ipc;
+
+	length += sprintf(buffer + length,
+		"SEMS:\t\t%d %d %d %d  %d\n"
+		"MSG:\t\t%d %d %d\n"
+		"SHM:\t\t%lu %lu  %d %d\n",
+		ipc->sem_ctls[0], ipc->sem_ctls[1],
+		ipc->sem_ctls[2], ipc->sem_ctls[3],
+		ipc->used_sems,
+		ipc->msg_ctlmax, ipc->msg_ctlmnb, ipc->msg_ctlmni,
+		(unsigned long)ipc->shm_ctlmax,
+		(unsigned long)ipc->shm_ctlall,
+		ipc->shm_ctlmni, ipc->shm_tot);
+skip_ipc:
+out:
+	return length;
+}
+
+
+#include <linux/sched.h>
+
+#define LOAD_INT(x) ((x) >> FSHIFT)
+#define LOAD_FRAC(x) LOAD_INT(((x) & (FIXED_1 - 1)) * 100)
+
+static inline
+int vx_info_proc_cvirt(struct _vx_cvirt *cvirt, char *buffer)
+{
+	int length = 0;
+	int a, b, c;
+
+	length += sprintf(buffer + length,
+		"BiasUptime:\t%lu.%02lu\n",
+		(unsigned long)cvirt->bias_uptime.tv_sec,
+		(cvirt->bias_uptime.tv_nsec / (NSEC_PER_SEC / 100)));
+
+	a = cvirt->load[0] + (FIXED_1 / 200);
+	b = cvirt->load[1] + (FIXED_1 / 200);
+	c = cvirt->load[2] + (FIXED_1 / 200);
+	length += sprintf(buffer + length,
+		"nr_threads:\t%d\n"
+		"nr_running:\t%d\n"
+		"nr_unintr:\t%d\n"
+		"nr_onhold:\t%d\n"
+		"load_updates:\t%d\n"
+		"loadavg:\t%d.%02d %d.%02d %d.%02d\n"
+		"total_forks:\t%d\n",
+		atomic_read(&cvirt->nr_threads),
+		atomic_read(&cvirt->nr_running),
+		atomic_read(&cvirt->nr_uninterruptible),
+		atomic_read(&cvirt->nr_onhold),
+		atomic_read_unchecked(&cvirt->load_updates),
+		LOAD_INT(a), LOAD_FRAC(a),
+		LOAD_INT(b), LOAD_FRAC(b),
+		LOAD_INT(c), LOAD_FRAC(c),
+		atomic_read_unchecked(&cvirt->total_forks));
+	return length;
+}
+
+static inline
+int vx_info_proc_cvirt_pc(struct _vx_cvirt_pc *cvirt_pc,
+	char *buffer, int cpu)
+{
+	int length = 0;
+	return length;
+}
+
+#endif	/* _VX_CVIRT_PROC_H */
diff -uriN linux-2.6.32.43/kernel/vserver/debug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/debug.c
--- linux-2.6.32.43/kernel/vserver/debug.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/debug.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,32 @@
+/*
+ *  kernel/vserver/debug.c
+ *
+ *  Copyright (C) 2005-2007 Herbert Pötzl
+ *
+ *  V0.01  vx_info dump support
+ *
+ */
+
+#include <linux/module.h>
+
+#include <linux/vserver/context.h>
+
+
+void	dump_vx_info(struct vx_info *vxi, int level)
+{
+	printk("vx_info %p[#%d, %d.%d, %4x]\n", vxi, vxi->vx_id,
+		atomic_read(&vxi->vx_usecnt),
+		atomic_read(&vxi->vx_tasks),
+		vxi->vx_state);
+	if (level > 0) {
+		__dump_vx_limit(&vxi->limit);
+		__dump_vx_sched(&vxi->sched);
+		__dump_vx_cvirt(&vxi->cvirt);
+		__dump_vx_cacct(&vxi->cacct);
+	}
+	printk("---\n");
+}
+
+
+EXPORT_SYMBOL_GPL(dump_vx_info);
+
diff -uriN linux-2.6.32.43/kernel/vserver/device.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/device.c
--- linux-2.6.32.43/kernel/vserver/device.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/device.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,443 @@
+/*
+ *  linux/kernel/vserver/device.c
+ *
+ *  Linux-VServer: Device Support
+ *
+ *  Copyright (C) 2006  Herbert Pötzl
+ *  Copyright (C) 2007  Daniel Hokka Zakrisson
+ *
+ *  V0.01  device mapping basics
+ *  V0.02  added defaults
+ *
+ */
+
+#include <linux/slab.h>
+#include <linux/rcupdate.h>
+#include <linux/fs.h>
+#include <linux/namei.h>
+#include <linux/hash.h>
+
+#include <asm/errno.h>
+#include <asm/uaccess.h>
+#include <linux/vserver/base.h>
+#include <linux/vserver/debug.h>
+#include <linux/vserver/context.h>
+#include <linux/vserver/device.h>
+#include <linux/vserver/device_cmd.h>
+
+
+#define DMAP_HASH_BITS	4
+
+
+struct vs_mapping {
+	union {
+		struct hlist_node hlist;
+		struct list_head list;
+	} u;
+#define dm_hlist	u.hlist
+#define dm_list		u.list
+	xid_t xid;
+	dev_t device;
+	struct vx_dmap_target target;
+};
+
+
+static struct hlist_head dmap_main_hash[1 << DMAP_HASH_BITS];
+
+static spinlock_t dmap_main_hash_lock = SPIN_LOCK_UNLOCKED;
+
+static struct vx_dmap_target dmap_defaults[2] = {
+	{ .flags = DATTR_OPEN },
+	{ .flags = DATTR_OPEN },
+};
+
+
+struct kmem_cache *dmap_cachep __read_mostly;
+
+int __init dmap_cache_init(void)
+{
+	dmap_cachep = kmem_cache_create("dmap_cache",
+		sizeof(struct vs_mapping), 0,
+		SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+	return 0;
+}
+
+__initcall(dmap_cache_init);
+
+
+static inline unsigned int __hashval(dev_t dev, int bits)
+{
+	return hash_long((unsigned long)dev, bits);
+}
+
+
+/*	__hash_mapping()
+ *	add the mapping to the hash table
+ */
+static inline void __hash_mapping(struct vx_info *vxi, struct vs_mapping *vdm)
+{
+	spinlock_t *hash_lock = &dmap_main_hash_lock;
+	struct hlist_head *head, *hash = dmap_main_hash;
+	int device = vdm->device;
+
+	spin_lock(hash_lock);
+	vxdprintk(VXD_CBIT(misc, 8), "__hash_mapping: %p[#%d] %08x:%08x",
+		vxi, vxi ? vxi->vx_id : 0, device, vdm->target.target);
+
+	head = &hash[__hashval(device, DMAP_HASH_BITS)];
+	hlist_add_head(&vdm->dm_hlist, head);
+	spin_unlock(hash_lock);
+}
+
+
+static inline int __mode_to_default(umode_t mode)
+{
+	switch (mode) {
+	case S_IFBLK:
+		return 0;
+	case S_IFCHR:
+		return 1;
+	default:
+		BUG();
+	}
+}
+
+
+/*	__set_default()
+ *	set a default
+ */
+static inline void __set_default(struct vx_info *vxi, umode_t mode,
+	struct vx_dmap_target *vdmt)
+{
+	spinlock_t *hash_lock = &dmap_main_hash_lock;
+	spin_lock(hash_lock);
+
+	if (vxi)
+		vxi->dmap.targets[__mode_to_default(mode)] = *vdmt;
+	else
+		dmap_defaults[__mode_to_default(mode)] = *vdmt;
+
+
+	spin_unlock(hash_lock);
+
+	vxdprintk(VXD_CBIT(misc, 8), "__set_default: %p[#%u] %08x %04x",
+		  vxi, vxi ? vxi->vx_id : 0, vdmt->target, vdmt->flags);
+}
+
+
+/*	__remove_default()
+ *	remove a default
+ */
+static inline int __remove_default(struct vx_info *vxi, umode_t mode)
+{
+	spinlock_t *hash_lock = &dmap_main_hash_lock;
+	spin_lock(hash_lock);
+
+	if (vxi)
+		vxi->dmap.targets[__mode_to_default(mode)].flags = 0;
+	else	/* remove == reset */
+		dmap_defaults[__mode_to_default(mode)].flags = DATTR_OPEN | mode;
+
+	spin_unlock(hash_lock);
+	return 0;
+}
+
+
+/*	__find_mapping()
+ *	find a mapping in the hash table
+ *
+ *	caller must hold hash_lock
+ */
+static inline int __find_mapping(xid_t xid, dev_t device, umode_t mode,
+	struct vs_mapping **local, struct vs_mapping **global)
+{
+	struct hlist_head *hash = dmap_main_hash;
+	struct hlist_head *head = &hash[__hashval(device, DMAP_HASH_BITS)];
+	struct hlist_node *pos;
+	struct vs_mapping *vdm;
+
+	*local = NULL;
+	if (global)
+		*global = NULL;
+
+	hlist_for_each(pos, head) {
+		vdm = hlist_entry(pos, struct vs_mapping, dm_hlist);
+
+		if ((vdm->device == device) &&
+			!((vdm->target.flags ^ mode) & S_IFMT)) {
+			if (vdm->xid == xid) {
+				*local = vdm;
+				return 1;
+			} else if (global && vdm->xid == 0)
+				*global = vdm;
+		}
+	}
+
+	if (global && *global)
+		return 0;
+	else
+		return -ENOENT;
+}
+
+
+/*	__lookup_mapping()
+ *	find a mapping and store the result in target and flags
+ */
+static inline int __lookup_mapping(struct vx_info *vxi,
+	dev_t device, dev_t *target, int *flags, umode_t mode)
+{
+	spinlock_t *hash_lock = &dmap_main_hash_lock;
+	struct vs_mapping *vdm, *global;
+	struct vx_dmap_target *vdmt;
+	int ret = 0;
+	xid_t xid = vxi->vx_id;
+	int index;
+
+	spin_lock(hash_lock);
+	if (__find_mapping(xid, device, mode, &vdm, &global) > 0) {
+		ret = 1;
+		vdmt = &vdm->target;
+		goto found;
+	}
+
+	index = __mode_to_default(mode);
+	if (vxi && vxi->dmap.targets[index].flags) {
+		ret = 2;
+		vdmt = &vxi->dmap.targets[index];
+	} else if (global) {
+		ret = 3;
+		vdmt = &global->target;
+		goto found;
+	} else {
+		ret = 4;
+		vdmt = &dmap_defaults[index];
+	}
+
+found:
+	if (target && (vdmt->flags & DATTR_REMAP))
+		*target = vdmt->target;
+	else if (target)
+		*target = device;
+	if (flags)
+		*flags = vdmt->flags;
+
+	spin_unlock(hash_lock);
+
+	return ret;
+}
+
+
+/*	__remove_mapping()
+ *	remove a mapping from the hash table
+ */
+static inline int __remove_mapping(struct vx_info *vxi, dev_t device,
+	umode_t mode)
+{
+	spinlock_t *hash_lock = &dmap_main_hash_lock;
+	struct vs_mapping *vdm = NULL;
+	int ret = 0;
+
+	spin_lock(hash_lock);
+
+	ret = __find_mapping((vxi ? vxi->vx_id : 0), device, mode, &vdm,
+		NULL);
+	vxdprintk(VXD_CBIT(misc, 8), "__remove_mapping: %p[#%d] %08x %04x",
+		vxi, vxi ? vxi->vx_id : 0, device, mode);
+	if (ret < 0)
+		goto out;
+	hlist_del(&vdm->dm_hlist);
+
+out:
+	spin_unlock(hash_lock);
+	if (vdm)
+		kmem_cache_free(dmap_cachep, vdm);
+	return ret;
+}
+
+
+
+int vs_map_device(struct vx_info *vxi,
+	dev_t device, dev_t *target, umode_t mode)
+{
+	int ret, flags = DATTR_MASK;
+
+	if (!vxi) {
+		if (target)
+			*target = device;
+		goto out;
+	}
+	ret = __lookup_mapping(vxi, device, target, &flags, mode);
+	vxdprintk(VXD_CBIT(misc, 8), "vs_map_device: %08x target: %08x flags: %04x mode: %04x mapped=%d",
+		device, target ? *target : 0, flags, mode, ret);
+out:
+	return (flags & DATTR_MASK);
+}
+
+
+
+static int do_set_mapping(struct vx_info *vxi,
+	dev_t device, dev_t target, int flags, umode_t mode)
+{
+	if (device) {
+		struct vs_mapping *new;
+
+		new = kmem_cache_alloc(dmap_cachep, GFP_KERNEL);
+		if (!new)
+			return -ENOMEM;
+
+		INIT_HLIST_NODE(&new->dm_hlist);
+		new->device = device;
+		new->target.target = target;
+		new->target.flags = flags | mode;
+		new->xid = (vxi ? vxi->vx_id : 0);
+
+		vxdprintk(VXD_CBIT(misc, 8), "do_set_mapping: %08x target: %08x flags: %04x", device, target, flags);
+		__hash_mapping(vxi, new);
+	} else {
+		struct vx_dmap_target new = {
+			.target = target,
+			.flags = flags | mode,
+		};
+		__set_default(vxi, mode, &new);
+	}
+	return 0;
+}
+
+
+static int do_unset_mapping(struct vx_info *vxi,
+	dev_t device, dev_t target, int flags, umode_t mode)
+{
+	int ret = -EINVAL;
+
+	if (device) {
+		ret = __remove_mapping(vxi, device, mode);
+		if (ret < 0)
+			goto out;
+	} else {
+		ret = __remove_default(vxi, mode);
+		if (ret < 0)
+			goto out;
+	}
+
+out:
+	return ret;
+}
+
+
+static inline int __user_device(const char __user *name, dev_t *dev,
+	umode_t *mode)
+{
+	struct nameidata nd;
+	int ret;
+
+	if (!name) {
+		*dev = 0;
+		return 0;
+	}
+	ret = user_lpath(name, &nd.path);
+	if (ret)
+		return ret;
+	if (nd.path.dentry->d_inode) {
+		*dev = nd.path.dentry->d_inode->i_rdev;
+		*mode = nd.path.dentry->d_inode->i_mode;
+	}
+	path_put(&nd.path);
+	return 0;
+}
+
+static inline int __mapping_mode(dev_t device, dev_t target,
+	umode_t device_mode, umode_t target_mode, umode_t *mode)
+{
+	if (device)
+		*mode = device_mode & S_IFMT;
+	else if (target)
+		*mode = target_mode & S_IFMT;
+	else
+		return -EINVAL;
+
+	/* if both given, device and target mode have to match */
+	if (device && target &&
+		((device_mode ^ target_mode) & S_IFMT))
+		return -EINVAL;
+	return 0;
+}
+
+
+static inline int do_mapping(struct vx_info *vxi, const char __user *device_path,
+	const char __user *target_path, int flags, int set)
+{
+	dev_t device = ~0, target = ~0;
+	umode_t device_mode = 0, target_mode = 0, mode;
+	int ret;
+
+	ret = __user_device(device_path, &device, &device_mode);
+	if (ret)
+		return ret;
+	ret = __user_device(target_path, &target, &target_mode);
+	if (ret)
+		return ret;
+
+	ret = __mapping_mode(device, target,
+		device_mode, target_mode, &mode);
+	if (ret)
+		return ret;
+
+	if (set)
+		return do_set_mapping(vxi, device, target,
+			flags, mode);
+	else
+		return do_unset_mapping(vxi, device, target,
+			flags, mode);
+}
+
+
+int vc_set_mapping(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_set_mapping_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_mapping(vxi, vc_data.device, vc_data.target,
+		vc_data.flags, 1);
+}
+
+int vc_unset_mapping(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_set_mapping_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_mapping(vxi, vc_data.device, vc_data.target,
+		vc_data.flags, 0);
+}
+
+
+#ifdef	CONFIG_COMPAT
+
+int vc_set_mapping_x32(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_set_mapping_v0_x32 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_mapping(vxi, compat_ptr(vc_data.device_ptr),
+		compat_ptr(vc_data.target_ptr), vc_data.flags, 1);
+}
+
+int vc_unset_mapping_x32(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_set_mapping_v0_x32 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_mapping(vxi, compat_ptr(vc_data.device_ptr),
+		compat_ptr(vc_data.target_ptr), vc_data.flags, 0);
+}
+
+#endif	/* CONFIG_COMPAT */
+
+
diff -uriN linux-2.6.32.43/kernel/vserver/dlimit.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/dlimit.c
--- linux-2.6.32.43/kernel/vserver/dlimit.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/dlimit.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,529 @@
+/*
+ *  linux/kernel/vserver/dlimit.c
+ *
+ *  Virtual Server: Context Disk Limits
+ *
+ *  Copyright (C) 2004-2009  Herbert Pötzl
+ *
+ *  V0.01  initial version
+ *  V0.02  compat32 splitup
+ *  V0.03  extended interface
+ *
+ */
+
+#include <linux/statfs.h>
+#include <linux/sched.h>
+#include <linux/namei.h>
+#include <linux/vs_tag.h>
+#include <linux/vs_dlimit.h>
+#include <linux/vserver/dlimit_cmd.h>
+
+#include <asm/uaccess.h>
+
+/*	__alloc_dl_info()
+
+	* allocate an initialized dl_info struct
+	* doesn't make it visible (hash)			*/
+
+static struct dl_info *__alloc_dl_info(struct super_block *sb, tag_t tag)
+{
+	struct dl_info *new = NULL;
+
+	vxdprintk(VXD_CBIT(dlim, 5),
+		"alloc_dl_info(%p,%d)*", sb, tag);
+
+	/* would this benefit from a slab cache? */
+	new = kmalloc(sizeof(struct dl_info), GFP_KERNEL);
+	if (!new)
+		return 0;
+
+	memset(new, 0, sizeof(struct dl_info));
+	new->dl_tag = tag;
+	new->dl_sb = sb;
+	INIT_RCU_HEAD(&new->dl_rcu);
+	INIT_HLIST_NODE(&new->dl_hlist);
+	spin_lock_init(&new->dl_lock);
+	atomic_set(&new->dl_refcnt, 0);
+	atomic_set(&new->dl_usecnt, 0);
+
+	/* rest of init goes here */
+
+	vxdprintk(VXD_CBIT(dlim, 4),
+		"alloc_dl_info(%p,%d) = %p", sb, tag, new);
+	return new;
+}
+
+/*	__dealloc_dl_info()
+
+	* final disposal of dl_info				*/
+
+static void __dealloc_dl_info(struct dl_info *dli)
+{
+	vxdprintk(VXD_CBIT(dlim, 4),
+		"dealloc_dl_info(%p)", dli);
+
+	dli->dl_hlist.next = LIST_POISON1;
+	dli->dl_tag = -1;
+	dli->dl_sb = 0;
+
+	BUG_ON(atomic_read(&dli->dl_usecnt));
+	BUG_ON(atomic_read(&dli->dl_refcnt));
+
+	kfree(dli);
+}
+
+
+/*	hash table for dl_info hash */
+
+#define DL_HASH_SIZE	13
+
+struct hlist_head dl_info_hash[DL_HASH_SIZE];
+
+static spinlock_t dl_info_hash_lock = SPIN_LOCK_UNLOCKED;
+
+
+static inline unsigned int __hashval(struct super_block *sb, tag_t tag)
+{
+	return ((tag ^ (unsigned long)sb) % DL_HASH_SIZE);
+}
+
+
+
+/*	__hash_dl_info()
+
+	* add the dli to the global hash table
+	* requires the hash_lock to be held			*/
+
+static inline void __hash_dl_info(struct dl_info *dli)
+{
+	struct hlist_head *head;
+
+	vxdprintk(VXD_CBIT(dlim, 6),
+		"__hash_dl_info: %p[#%d]", dli, dli->dl_tag);
+	get_dl_info(dli);
+	head = &dl_info_hash[__hashval(dli->dl_sb, dli->dl_tag)];
+	hlist_add_head_rcu(&dli->dl_hlist, head);
+}
+
+/*	__unhash_dl_info()
+
+	* remove the dli from the global hash table
+	* requires the hash_lock to be held			*/
+
+static inline void __unhash_dl_info(struct dl_info *dli)
+{
+	vxdprintk(VXD_CBIT(dlim, 6),
+		"__unhash_dl_info: %p[#%d]", dli, dli->dl_tag);
+	hlist_del_rcu(&dli->dl_hlist);
+	put_dl_info(dli);
+}
+
+
+/*	__lookup_dl_info()
+
+	* requires the rcu_read_lock()
+	* doesn't increment the dl_refcnt			*/
+
+static inline struct dl_info *__lookup_dl_info(struct super_block *sb, tag_t tag)
+{
+	struct hlist_head *head = &dl_info_hash[__hashval(sb, tag)];
+	struct hlist_node *pos;
+	struct dl_info *dli;
+
+	hlist_for_each_entry_rcu(dli, pos, head, dl_hlist) {
+
+		if (dli->dl_tag == tag && dli->dl_sb == sb) {
+			return dli;
+		}
+	}
+	return NULL;
+}
+
+
+struct dl_info *locate_dl_info(struct super_block *sb, tag_t tag)
+{
+	struct dl_info *dli;
+
+	rcu_read_lock();
+	dli = get_dl_info(__lookup_dl_info(sb, tag));
+	vxdprintk(VXD_CBIT(dlim, 7),
+		"locate_dl_info(%p,#%d) = %p", sb, tag, dli);
+	rcu_read_unlock();
+	return dli;
+}
+
+void rcu_free_dl_info(struct rcu_head *head)
+{
+	struct dl_info *dli = container_of(head, struct dl_info, dl_rcu);
+	int usecnt, refcnt;
+
+	BUG_ON(!dli || !head);
+
+	usecnt = atomic_read(&dli->dl_usecnt);
+	BUG_ON(usecnt < 0);
+
+	refcnt = atomic_read(&dli->dl_refcnt);
+	BUG_ON(refcnt < 0);
+
+	vxdprintk(VXD_CBIT(dlim, 3),
+		"rcu_free_dl_info(%p)", dli);
+	if (!usecnt)
+		__dealloc_dl_info(dli);
+	else
+		printk("!!! rcu didn't free\n");
+}
+
+
+
+
+static int do_addrem_dlimit(uint32_t id, const char __user *name,
+	uint32_t flags, int add)
+{
+	struct path path;
+	int ret;
+
+	ret = user_lpath(name, &path);
+	if (!ret) {
+		struct super_block *sb;
+		struct dl_info *dli;
+
+		ret = -EINVAL;
+		if (!path.dentry->d_inode)
+			goto out_release;
+		if (!(sb = path.dentry->d_inode->i_sb))
+			goto out_release;
+
+		if (add) {
+			dli = __alloc_dl_info(sb, id);
+			spin_lock(&dl_info_hash_lock);
+
+			ret = -EEXIST;
+			if (__lookup_dl_info(sb, id))
+				goto out_unlock;
+			__hash_dl_info(dli);
+			dli = NULL;
+		} else {
+			spin_lock(&dl_info_hash_lock);
+			dli = __lookup_dl_info(sb, id);
+
+			ret = -ESRCH;
+			if (!dli)
+				goto out_unlock;
+			__unhash_dl_info(dli);
+		}
+		ret = 0;
+	out_unlock:
+		spin_unlock(&dl_info_hash_lock);
+		if (add && dli)
+			__dealloc_dl_info(dli);
+	out_release:
+		path_put(&path);
+	}
+	return ret;
+}
+
+int vc_add_dlimit(uint32_t id, void __user *data)
+{
+	struct vcmd_ctx_dlimit_base_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_addrem_dlimit(id, vc_data.name, vc_data.flags, 1);
+}
+
+int vc_rem_dlimit(uint32_t id, void __user *data)
+{
+	struct vcmd_ctx_dlimit_base_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_addrem_dlimit(id, vc_data.name, vc_data.flags, 0);
+}
+
+#ifdef	CONFIG_COMPAT
+
+int vc_add_dlimit_x32(uint32_t id, void __user *data)
+{
+	struct vcmd_ctx_dlimit_base_v0_x32 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_addrem_dlimit(id,
+		compat_ptr(vc_data.name_ptr), vc_data.flags, 1);
+}
+
+int vc_rem_dlimit_x32(uint32_t id, void __user *data)
+{
+	struct vcmd_ctx_dlimit_base_v0_x32 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_addrem_dlimit(id,
+		compat_ptr(vc_data.name_ptr), vc_data.flags, 0);
+}
+
+#endif	/* CONFIG_COMPAT */
+
+
+static inline
+int do_set_dlimit(uint32_t id, const char __user *name,
+	uint32_t space_used, uint32_t space_total,
+	uint32_t inodes_used, uint32_t inodes_total,
+	uint32_t reserved, uint32_t flags)
+{
+	struct path path;
+	int ret;
+
+	ret = user_lpath(name, &path);
+	if (!ret) {
+		struct super_block *sb;
+		struct dl_info *dli;
+
+		ret = -EINVAL;
+		if (!path.dentry->d_inode)
+			goto out_release;
+		if (!(sb = path.dentry->d_inode->i_sb))
+			goto out_release;
+
+		/* sanity checks */
+		if ((reserved != CDLIM_KEEP &&
+			reserved > 100) ||
+			(inodes_used != CDLIM_KEEP &&
+			inodes_used > inodes_total) ||
+			(space_used != CDLIM_KEEP &&
+			space_used > space_total))
+			goto out_release;
+
+		ret = -ESRCH;
+		dli = locate_dl_info(sb, id);
+		if (!dli)
+			goto out_release;
+
+		spin_lock(&dli->dl_lock);
+
+		if (inodes_used != CDLIM_KEEP)
+			dli->dl_inodes_used = inodes_used;
+		if (inodes_total != CDLIM_KEEP)
+			dli->dl_inodes_total = inodes_total;
+		if (space_used != CDLIM_KEEP)
+			dli->dl_space_used = dlimit_space_32to64(
+				space_used, flags, DLIMS_USED);
+
+		if (space_total == CDLIM_INFINITY)
+			dli->dl_space_total = DLIM_INFINITY;
+		else if (space_total != CDLIM_KEEP)
+			dli->dl_space_total = dlimit_space_32to64(
+				space_total, flags, DLIMS_TOTAL);
+
+		if (reserved != CDLIM_KEEP)
+			dli->dl_nrlmult = (1 << 10) * (100 - reserved) / 100;
+
+		spin_unlock(&dli->dl_lock);
+
+		put_dl_info(dli);
+		ret = 0;
+
+	out_release:
+		path_put(&path);
+	}
+	return ret;
+}
+
+int vc_set_dlimit(uint32_t id, void __user *data)
+{
+	struct vcmd_ctx_dlimit_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_set_dlimit(id, vc_data.name,
+		vc_data.space_used, vc_data.space_total,
+		vc_data.inodes_used, vc_data.inodes_total,
+		vc_data.reserved, vc_data.flags);
+}
+
+#ifdef	CONFIG_COMPAT
+
+int vc_set_dlimit_x32(uint32_t id, void __user *data)
+{
+	struct vcmd_ctx_dlimit_v0_x32 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_set_dlimit(id, compat_ptr(vc_data.name_ptr),
+		vc_data.space_used, vc_data.space_total,
+		vc_data.inodes_used, vc_data.inodes_total,
+		vc_data.reserved, vc_data.flags);
+}
+
+#endif	/* CONFIG_COMPAT */
+
+
+static inline
+int do_get_dlimit(uint32_t id, const char __user *name,
+	uint32_t *space_used, uint32_t *space_total,
+	uint32_t *inodes_used, uint32_t *inodes_total,
+	uint32_t *reserved, uint32_t *flags)
+{
+	struct path path;
+	int ret;
+
+	ret = user_lpath(name, &path);
+	if (!ret) {
+		struct super_block *sb;
+		struct dl_info *dli;
+
+		ret = -EINVAL;
+		if (!path.dentry->d_inode)
+			goto out_release;
+		if (!(sb = path.dentry->d_inode->i_sb))
+			goto out_release;
+
+		ret = -ESRCH;
+		dli = locate_dl_info(sb, id);
+		if (!dli)
+			goto out_release;
+
+		spin_lock(&dli->dl_lock);
+		*inodes_used = dli->dl_inodes_used;
+		*inodes_total = dli->dl_inodes_total;
+
+		*space_used = dlimit_space_64to32(
+			dli->dl_space_used, flags, DLIMS_USED);
+
+		if (dli->dl_space_total == DLIM_INFINITY)
+			*space_total = CDLIM_INFINITY;
+		else
+			*space_total = dlimit_space_64to32(
+				dli->dl_space_total, flags, DLIMS_TOTAL);
+
+		*reserved = 100 - ((dli->dl_nrlmult * 100 + 512) >> 10);
+		spin_unlock(&dli->dl_lock);
+
+		put_dl_info(dli);
+		ret = -EFAULT;
+
+		ret = 0;
+	out_release:
+		path_put(&path);
+	}
+	return ret;
+}
+
+
+int vc_get_dlimit(uint32_t id, void __user *data)
+{
+	struct vcmd_ctx_dlimit_v0 vc_data;
+	int ret;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = do_get_dlimit(id, vc_data.name,
+		&vc_data.space_used, &vc_data.space_total,
+		&vc_data.inodes_used, &vc_data.inodes_total,
+		&vc_data.reserved, &vc_data.flags);
+	if (ret)
+		return ret;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+#ifdef	CONFIG_COMPAT
+
+int vc_get_dlimit_x32(uint32_t id, void __user *data)
+{
+	struct vcmd_ctx_dlimit_v0_x32 vc_data;
+	int ret;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = do_get_dlimit(id, compat_ptr(vc_data.name_ptr),
+		&vc_data.space_used, &vc_data.space_total,
+		&vc_data.inodes_used, &vc_data.inodes_total,
+		&vc_data.reserved, &vc_data.flags);
+	if (ret)
+		return ret;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+#endif	/* CONFIG_COMPAT */
+
+
+void vx_vsi_statfs(struct super_block *sb, struct kstatfs *buf)
+{
+	struct dl_info *dli;
+	__u64 blimit, bfree, bavail;
+	__u32 ifree;
+
+	dli = locate_dl_info(sb, dx_current_tag());
+	if (!dli)
+		return;
+
+	spin_lock(&dli->dl_lock);
+	if (dli->dl_inodes_total == (unsigned long)DLIM_INFINITY)
+		goto no_ilim;
+
+	/* reduce max inodes available to limit */
+	if (buf->f_files > dli->dl_inodes_total)
+		buf->f_files = dli->dl_inodes_total;
+
+	ifree = dli->dl_inodes_total - dli->dl_inodes_used;
+	/* reduce free inodes to min */
+	if (ifree < buf->f_ffree)
+		buf->f_ffree = ifree;
+
+no_ilim:
+	if (dli->dl_space_total == DLIM_INFINITY)
+		goto no_blim;
+
+	blimit = dli->dl_space_total >> sb->s_blocksize_bits;
+
+	if (dli->dl_space_total < dli->dl_space_used)
+		bfree = 0;
+	else
+		bfree = (dli->dl_space_total - dli->dl_space_used)
+			>> sb->s_blocksize_bits;
+
+	bavail = ((dli->dl_space_total >> 10) * dli->dl_nrlmult);
+	if (bavail < dli->dl_space_used)
+		bavail = 0;
+	else
+		bavail = (bavail - dli->dl_space_used)
+			>> sb->s_blocksize_bits;
+
+	/* reduce max space available to limit */
+	if (buf->f_blocks > blimit)
+		buf->f_blocks = blimit;
+
+	/* reduce free space to min */
+	if (bfree < buf->f_bfree)
+		buf->f_bfree = bfree;
+
+	/* reduce avail space to min */
+	if (bavail < buf->f_bavail)
+		buf->f_bavail = bavail;
+
+no_blim:
+	spin_unlock(&dli->dl_lock);
+	put_dl_info(dli);
+
+	return;
+}
+
+#include <linux/module.h>
+
+EXPORT_SYMBOL_GPL(locate_dl_info);
+EXPORT_SYMBOL_GPL(rcu_free_dl_info);
+
diff -uriN linux-2.6.32.43/kernel/vserver/helper.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/helper.c
--- linux-2.6.32.43/kernel/vserver/helper.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/helper.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,223 @@
+/*
+ *  linux/kernel/vserver/helper.c
+ *
+ *  Virtual Context Support
+ *
+ *  Copyright (C) 2004-2007  Herbert Pötzl
+ *
+ *  V0.01  basic helper
+ *
+ */
+
+#include <linux/kmod.h>
+#include <linux/reboot.h>
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
+#include <linux/vserver/signal.h>
+
+
+char vshelper_path[255] = "/sbin/vshelper";
+
+
+static int do_vshelper(char *name, char *argv[], char *envp[], int sync)
+{
+	int ret;
+
+	if ((ret = call_usermodehelper(name, argv, envp, sync))) {
+		printk(	KERN_WARNING
+			"%s: (%s %s) returned %s with %d\n",
+			name, argv[1], argv[2],
+			sync ? "sync" : "async", ret);
+	}
+	vxdprintk(VXD_CBIT(switch, 4),
+		"%s: (%s %s) returned %s with %d",
+		name, argv[1], argv[2], sync ? "sync" : "async", ret);
+	return ret;
+}
+
+/*
+ *      vshelper path is set via /proc/sys
+ *      invoked by vserver sys_reboot(), with
+ *      the following arguments
+ *
+ *      argv [0] = vshelper_path;
+ *      argv [1] = action: "restart", "halt", "poweroff", ...
+ *      argv [2] = context identifier
+ *
+ *      envp [*] = type-specific parameters
+ */
+
+long vs_reboot_helper(struct vx_info *vxi, int cmd, void __user *arg)
+{
+	char id_buf[8], cmd_buf[16];
+	char uid_buf[16], pid_buf[16];
+	int ret;
+
+	char *argv[] = {vshelper_path, NULL, id_buf, 0};
+	char *envp[] = {"HOME=/", "TERM=linux",
+			"PATH=/sbin:/usr/sbin:/bin:/usr/bin",
+			uid_buf, pid_buf, cmd_buf, 0};
+
+	if (vx_info_state(vxi, VXS_HELPER))
+		return -EAGAIN;
+	vxi->vx_state |= VXS_HELPER;
+
+	snprintf(id_buf, sizeof(id_buf)-1, "%d", vxi->vx_id);
+
+	snprintf(cmd_buf, sizeof(cmd_buf)-1, "VS_CMD=%08x", cmd);
+	snprintf(uid_buf, sizeof(uid_buf)-1, "VS_UID=%d", current_uid());
+	snprintf(pid_buf, sizeof(pid_buf)-1, "VS_PID=%d", current->pid);
+
+	switch (cmd) {
+	case LINUX_REBOOT_CMD_RESTART:
+		argv[1] = "restart";
+		break;
+
+	case LINUX_REBOOT_CMD_HALT:
+		argv[1] = "halt";
+		break;
+
+	case LINUX_REBOOT_CMD_POWER_OFF:
+		argv[1] = "poweroff";
+		break;
+
+	case LINUX_REBOOT_CMD_SW_SUSPEND:
+		argv[1] = "swsusp";
+		break;
+
+	case LINUX_REBOOT_CMD_OOM:
+		argv[1] = "oom";
+		break;
+
+	default:
+		vxi->vx_state &= ~VXS_HELPER;
+		return 0;
+	}
+
+	ret = do_vshelper(vshelper_path, argv, envp, 0);
+	vxi->vx_state &= ~VXS_HELPER;
+	__wakeup_vx_info(vxi);
+	return (ret) ? -EPERM : 0;
+}
+
+
+long vs_reboot(unsigned int cmd, void __user *arg)
+{
+	struct vx_info *vxi = current_vx_info();
+	long ret = 0;
+
+	vxdprintk(VXD_CBIT(misc, 5),
+		"vs_reboot(%p[#%d],%u)",
+		vxi, vxi ? vxi->vx_id : 0, cmd);
+
+	ret = vs_reboot_helper(vxi, cmd, arg);
+	if (ret)
+		return ret;
+
+	vxi->reboot_cmd = cmd;
+	if (vx_info_flags(vxi, VXF_REBOOT_KILL, 0)) {
+		switch (cmd) {
+		case LINUX_REBOOT_CMD_RESTART:
+		case LINUX_REBOOT_CMD_HALT:
+		case LINUX_REBOOT_CMD_POWER_OFF:
+			vx_info_kill(vxi, 0, SIGKILL);
+			vx_info_kill(vxi, 1, SIGKILL);
+		default:
+			break;
+		}
+	}
+	return 0;
+}
+
+long vs_oom_action(unsigned int cmd)
+{
+	struct vx_info *vxi = current_vx_info();
+	long ret = 0;
+
+	vxdprintk(VXD_CBIT(misc, 5),
+		"vs_oom_action(%p[#%d],%u)",
+		vxi, vxi ? vxi->vx_id : 0, cmd);
+
+	ret = vs_reboot_helper(vxi, cmd, NULL);
+	if (ret)
+		return ret;
+
+	vxi->reboot_cmd = cmd;
+	if (vx_info_flags(vxi, VXF_REBOOT_KILL, 0)) {
+		vx_info_kill(vxi, 0, SIGKILL);
+		vx_info_kill(vxi, 1, SIGKILL);
+	}
+	return 0;
+}
+
+/*
+ *      argv [0] = vshelper_path;
+ *      argv [1] = action: "startup", "shutdown"
+ *      argv [2] = context identifier
+ *
+ *      envp [*] = type-specific parameters
+ */
+
+long vs_state_change(struct vx_info *vxi, unsigned int cmd)
+{
+	char id_buf[8], cmd_buf[16];
+	char *argv[] = {vshelper_path, NULL, id_buf, 0};
+	char *envp[] = {"HOME=/", "TERM=linux",
+			"PATH=/sbin:/usr/sbin:/bin:/usr/bin", cmd_buf, 0};
+
+	if (!vx_info_flags(vxi, VXF_SC_HELPER, 0))
+		return 0;
+
+	snprintf(id_buf, sizeof(id_buf)-1, "%d", vxi->vx_id);
+	snprintf(cmd_buf, sizeof(cmd_buf)-1, "VS_CMD=%08x", cmd);
+
+	switch (cmd) {
+	case VSC_STARTUP:
+		argv[1] = "startup";
+		break;
+	case VSC_SHUTDOWN:
+		argv[1] = "shutdown";
+		break;
+	default:
+		return 0;
+	}
+
+	return do_vshelper(vshelper_path, argv, envp, 1);
+}
+
+
+/*
+ *      argv [0] = vshelper_path;
+ *      argv [1] = action: "netup", "netdown"
+ *      argv [2] = context identifier
+ *
+ *      envp [*] = type-specific parameters
+ */
+
+long vs_net_change(struct nx_info *nxi, unsigned int cmd)
+{
+	char id_buf[8], cmd_buf[16];
+	char *argv[] = {vshelper_path, NULL, id_buf, 0};
+	char *envp[] = {"HOME=/", "TERM=linux",
+			"PATH=/sbin:/usr/sbin:/bin:/usr/bin", cmd_buf, 0};
+
+	if (!nx_info_flags(nxi, NXF_SC_HELPER, 0))
+		return 0;
+
+	snprintf(id_buf, sizeof(id_buf)-1, "%d", nxi->nx_id);
+	snprintf(cmd_buf, sizeof(cmd_buf)-1, "VS_CMD=%08x", cmd);
+
+	switch (cmd) {
+	case VSC_NETUP:
+		argv[1] = "netup";
+		break;
+	case VSC_NETDOWN:
+		argv[1] = "netdown";
+		break;
+	default:
+		return 0;
+	}
+
+	return do_vshelper(vshelper_path, argv, envp, 1);
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/history.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/history.c
--- linux-2.6.32.43/kernel/vserver/history.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/history.c	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,258 @@
+/*
+ *  kernel/vserver/history.c
+ *
+ *  Virtual Context History Backtrace
+ *
+ *  Copyright (C) 2004-2007  Herbert Pötzl
+ *
+ *  V0.01  basic structure
+ *  V0.02  hash/unhash and trace
+ *  V0.03  preemption fixes
+ *
+ */
+
+#include <linux/module.h>
+#include <asm/uaccess.h>
+
+#include <linux/vserver/context.h>
+#include <linux/vserver/debug.h>
+#include <linux/vserver/debug_cmd.h>
+#include <linux/vserver/history.h>
+
+
+#ifdef	CONFIG_VSERVER_HISTORY
+#define VXH_SIZE	CONFIG_VSERVER_HISTORY_SIZE
+#else
+#define VXH_SIZE	64
+#endif
+
+struct _vx_history {
+	unsigned int counter;
+
+	struct _vx_hist_entry entry[VXH_SIZE + 1];
+};
+
+
+DEFINE_PER_CPU(struct _vx_history, vx_history_buffer);
+
+unsigned volatile int vxh_active = 1;
+
+static atomic_unchecked_t sequence = ATOMIC_INIT(0);
+
+
+/*	vxh_advance()
+
+	* requires disabled preemption				*/
+
+struct _vx_hist_entry *vxh_advance(void *loc)
+{
+	unsigned int cpu = smp_processor_id();
+	struct _vx_history *hist = &per_cpu(vx_history_buffer, cpu);
+	struct _vx_hist_entry *entry;
+	unsigned int index;
+
+	index = vxh_active ? (hist->counter++ % VXH_SIZE) : VXH_SIZE;
+	entry = &hist->entry[index];
+
+	entry->seq = atomic_inc_return_unchecked(&sequence);
+	entry->loc = loc;
+	return entry;
+}
+
+EXPORT_SYMBOL_GPL(vxh_advance);
+
+
+#define VXH_LOC_FMTS	"(#%04x,*%d):%p"
+
+#define VXH_LOC_ARGS(e)	(e)->seq, cpu, (e)->loc
+
+
+#define VXH_VXI_FMTS	"%p[#%d,%d.%d]"
+
+#define VXH_VXI_ARGS(e)	(e)->vxi.ptr,				\
+			(e)->vxi.ptr ? (e)->vxi.xid : 0,	\
+			(e)->vxi.ptr ? (e)->vxi.usecnt : 0,	\
+			(e)->vxi.ptr ? (e)->vxi.tasks : 0
+
+void	vxh_dump_entry(struct _vx_hist_entry *e, unsigned cpu)
+{
+	switch (e->type) {
+	case VXH_THROW_OOPS:
+		printk( VXH_LOC_FMTS " oops \n", VXH_LOC_ARGS(e));
+		break;
+
+	case VXH_GET_VX_INFO:
+	case VXH_PUT_VX_INFO:
+		printk( VXH_LOC_FMTS " %s_vx_info " VXH_VXI_FMTS "\n",
+			VXH_LOC_ARGS(e),
+			(e->type == VXH_GET_VX_INFO) ? "get" : "put",
+			VXH_VXI_ARGS(e));
+		break;
+
+	case VXH_INIT_VX_INFO:
+	case VXH_SET_VX_INFO:
+	case VXH_CLR_VX_INFO:
+		printk( VXH_LOC_FMTS " %s_vx_info " VXH_VXI_FMTS " @%p\n",
+			VXH_LOC_ARGS(e),
+			(e->type == VXH_INIT_VX_INFO) ? "init" :
+			((e->type == VXH_SET_VX_INFO) ? "set" : "clr"),
+			VXH_VXI_ARGS(e), e->sc.data);
+		break;
+
+	case VXH_CLAIM_VX_INFO:
+	case VXH_RELEASE_VX_INFO:
+		printk( VXH_LOC_FMTS " %s_vx_info " VXH_VXI_FMTS " @%p\n",
+			VXH_LOC_ARGS(e),
+			(e->type == VXH_CLAIM_VX_INFO) ? "claim" : "release",
+			VXH_VXI_ARGS(e), e->sc.data);
+		break;
+
+	case VXH_ALLOC_VX_INFO:
+	case VXH_DEALLOC_VX_INFO:
+		printk( VXH_LOC_FMTS " %s_vx_info " VXH_VXI_FMTS "\n",
+			VXH_LOC_ARGS(e),
+			(e->type == VXH_ALLOC_VX_INFO) ? "alloc" : "dealloc",
+			VXH_VXI_ARGS(e));
+		break;
+
+	case VXH_HASH_VX_INFO:
+	case VXH_UNHASH_VX_INFO:
+		printk( VXH_LOC_FMTS " __%s_vx_info " VXH_VXI_FMTS "\n",
+			VXH_LOC_ARGS(e),
+			(e->type == VXH_HASH_VX_INFO) ? "hash" : "unhash",
+			VXH_VXI_ARGS(e));
+		break;
+
+	case VXH_LOC_VX_INFO:
+	case VXH_LOOKUP_VX_INFO:
+	case VXH_CREATE_VX_INFO:
+		printk( VXH_LOC_FMTS " __%s_vx_info [#%d] -> " VXH_VXI_FMTS "\n",
+			VXH_LOC_ARGS(e),
+			(e->type == VXH_CREATE_VX_INFO) ? "create" :
+			((e->type == VXH_LOC_VX_INFO) ? "loc" : "lookup"),
+			e->ll.arg, VXH_VXI_ARGS(e));
+		break;
+	}
+}
+
+static void __vxh_dump_history(void)
+{
+	unsigned int i, cpu;
+
+	printk("History:\tSEQ: %8x\tNR_CPUS: %d\n",
+		atomic_read_unchecked(&sequence), NR_CPUS);
+
+	for (i = 0; i < VXH_SIZE; i++) {
+		for_each_online_cpu(cpu) {
+			struct _vx_history *hist =
+				&per_cpu(vx_history_buffer, cpu);
+			unsigned int index = (hist->counter - i) % VXH_SIZE;
+			struct _vx_hist_entry *entry = &hist->entry[index];
+
+			vxh_dump_entry(entry, cpu);
+		}
+	}
+}
+
+void	vxh_dump_history(void)
+{
+	vxh_active = 0;
+#ifdef CONFIG_SMP
+	local_irq_enable();
+	smp_send_stop();
+	local_irq_disable();
+#endif
+	__vxh_dump_history();
+}
+
+
+/* vserver syscall commands below here */
+
+
+int vc_dump_history(uint32_t id)
+{
+	vxh_active = 0;
+	__vxh_dump_history();
+	vxh_active = 1;
+
+	return 0;
+}
+
+
+int do_read_history(struct __user _vx_hist_entry *data,
+	int cpu, uint32_t *index, uint32_t *count)
+{
+	int pos, ret = 0;
+	struct _vx_history *hist = &per_cpu(vx_history_buffer, cpu);
+	int end = hist->counter;
+	int start = end - VXH_SIZE + 2;
+	int idx = *index;
+
+	/* special case: get current pos */
+	if (!*count) {
+		*index = end;
+		return 0;
+	}
+
+	/* have we lost some data? */
+	if (idx < start)
+		idx = start;
+
+	for (pos = 0; (pos < *count) && (idx < end); pos++, idx++) {
+		struct _vx_hist_entry *entry =
+			&hist->entry[idx % VXH_SIZE];
+
+		/* send entry to userspace */
+		ret = copy_to_user(&data[pos], entry, sizeof(*entry));
+		if (ret)
+			break;
+	}
+	/* save new index and count */
+	*index = idx;
+	*count = pos;
+	return ret ? ret : (*index < end);
+}
+
+int vc_read_history(uint32_t id, void __user *data)
+{
+	struct vcmd_read_history_v0 vc_data;
+	int ret;
+
+	if (id >= NR_CPUS)
+		return -EINVAL;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = do_read_history((struct __user _vx_hist_entry *)vc_data.data,
+		id, &vc_data.index, &vc_data.count);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return ret;
+}
+
+#ifdef	CONFIG_COMPAT
+
+int vc_read_history_x32(uint32_t id, void __user *data)
+{
+	struct vcmd_read_history_v0_x32 vc_data;
+	int ret;
+
+	if (id >= NR_CPUS)
+		return -EINVAL;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = do_read_history((struct __user _vx_hist_entry *)
+		compat_ptr(vc_data.data_ptr),
+		id, &vc_data.index, &vc_data.count);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return ret;
+}
+
+#endif	/* CONFIG_COMPAT */
+
diff -uriN linux-2.6.32.43/kernel/vserver/inet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/inet.c
--- linux-2.6.32.43/kernel/vserver/inet.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/inet.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,225 @@
+
+#include <linux/in.h>
+#include <linux/inetdevice.h>
+#include <linux/vs_inet.h>
+#include <linux/vs_inet6.h>
+#include <linux/vserver/debug.h>
+#include <net/route.h>
+#include <net/addrconf.h>
+
+
+int nx_v4_addr_conflict(struct nx_info *nxi1, struct nx_info *nxi2)
+{
+	int ret = 0;
+
+	if (!nxi1 || !nxi2 || nxi1 == nxi2)
+		ret = 1;
+	else {
+		struct nx_addr_v4 *ptr;
+
+		for (ptr = &nxi1->v4; ptr; ptr = ptr->next) {
+			if (v4_nx_addr_in_nx_info(nxi2, ptr, -1)) {
+				ret = 1;
+				break;
+			}
+		}
+	}
+
+	vxdprintk(VXD_CBIT(net, 2),
+		"nx_v4_addr_conflict(%p,%p): %d",
+		nxi1, nxi2, ret);
+
+	return ret;
+}
+
+
+#ifdef	CONFIG_IPV6
+
+int nx_v6_addr_conflict(struct nx_info *nxi1, struct nx_info *nxi2)
+{
+	int ret = 0;
+
+	if (!nxi1 || !nxi2 || nxi1 == nxi2)
+		ret = 1;
+	else {
+		struct nx_addr_v6 *ptr;
+
+		for (ptr = &nxi1->v6; ptr; ptr = ptr->next) {
+			if (v6_nx_addr_in_nx_info(nxi2, ptr, -1)) {
+				ret = 1;
+				break;
+			}
+		}
+	}
+
+	vxdprintk(VXD_CBIT(net, 2),
+		"nx_v6_addr_conflict(%p,%p): %d",
+		nxi1, nxi2, ret);
+
+	return ret;
+}
+
+#endif
+
+int v4_dev_in_nx_info(struct net_device *dev, struct nx_info *nxi)
+{
+	struct in_device *in_dev;
+	struct in_ifaddr **ifap;
+	struct in_ifaddr *ifa;
+	int ret = 0;
+
+	if (!dev)
+		goto out;
+	in_dev = in_dev_get(dev);
+	if (!in_dev)
+		goto out;
+
+	for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
+		ifap = &ifa->ifa_next) {
+		if (v4_addr_in_nx_info(nxi, ifa->ifa_local, NXA_MASK_SHOW)) {
+			ret = 1;
+			break;
+		}
+	}
+	in_dev_put(in_dev);
+out:
+	return ret;
+}
+
+
+#ifdef	CONFIG_IPV6
+
+int v6_dev_in_nx_info(struct net_device *dev, struct nx_info *nxi)
+{
+	struct inet6_dev *in_dev;
+	struct inet6_ifaddr **ifap;
+	struct inet6_ifaddr *ifa;
+	int ret = 0;
+
+	if (!dev)
+		goto out;
+	in_dev = in6_dev_get(dev);
+	if (!in_dev)
+		goto out;
+
+	for (ifap = &in_dev->addr_list; (ifa = *ifap) != NULL;
+		ifap = &ifa->if_next) {
+		if (v6_addr_in_nx_info(nxi, &ifa->addr, -1)) {
+			ret = 1;
+			break;
+		}
+	}
+	in6_dev_put(in_dev);
+out:
+	return ret;
+}
+
+#endif
+
+int dev_in_nx_info(struct net_device *dev, struct nx_info *nxi)
+{
+	int ret = 1;
+
+	if (!nxi)
+		goto out;
+	if (nxi->v4.type && v4_dev_in_nx_info(dev, nxi))
+		goto out;
+#ifdef	CONFIG_IPV6
+	ret = 2;
+	if (nxi->v6.type && v6_dev_in_nx_info(dev, nxi))
+		goto out;
+#endif
+	ret = 0;
+out:
+	vxdprintk(VXD_CBIT(net, 3),
+		"dev_in_nx_info(%p,%p[#%d]) = %d",
+		dev, nxi, nxi ? nxi->nx_id : 0, ret);
+	return ret;
+}
+
+int ip_v4_find_src(struct net *net, struct nx_info *nxi,
+	struct rtable **rp, struct flowi *fl)
+{
+	if (!nxi)
+		return 0;
+
+	/* FIXME: handle lback only case */
+	if (!NX_IPV4(nxi))
+		return -EPERM;
+
+	vxdprintk(VXD_CBIT(net, 4),
+		"ip_v4_find_src(%p[#%u]) " NIPQUAD_FMT " -> " NIPQUAD_FMT,
+		nxi, nxi ? nxi->nx_id : 0,
+		NIPQUAD(fl->fl4_src), NIPQUAD(fl->fl4_dst));
+
+	/* single IP is unconditional */
+	if (nx_info_flags(nxi, NXF_SINGLE_IP, 0) &&
+		(fl->fl4_src == INADDR_ANY))
+		fl->fl4_src = nxi->v4.ip[0].s_addr;
+
+	if (fl->fl4_src == INADDR_ANY) {
+		struct nx_addr_v4 *ptr;
+		__be32 found = 0;
+		int err;
+
+		err = __ip_route_output_key(net, rp, fl);
+		if (!err) {
+			found = (*rp)->rt_src;
+			ip_rt_put(*rp);
+			vxdprintk(VXD_CBIT(net, 4),
+				"ip_v4_find_src(%p[#%u]) rok[%u]: " NIPQUAD_FMT,
+				nxi, nxi ? nxi->nx_id : 0, fl->oif, NIPQUAD(found));
+			if (v4_addr_in_nx_info(nxi, found, NXA_MASK_BIND))
+				goto found;
+		}
+
+		for (ptr = &nxi->v4; ptr; ptr = ptr->next) {
+			__be32 primary = ptr->ip[0].s_addr;
+			__be32 mask = ptr->mask.s_addr;
+			__be32 neta = primary & mask;
+
+			vxdprintk(VXD_CBIT(net, 4), "ip_v4_find_src(%p[#%u]) chk: "
+				NIPQUAD_FMT "/" NIPQUAD_FMT "/" NIPQUAD_FMT,
+				nxi, nxi ? nxi->nx_id : 0, NIPQUAD(primary),
+				NIPQUAD(mask), NIPQUAD(neta));
+			if ((found & mask) != neta)
+				continue;
+
+			fl->fl4_src = primary;
+			err = __ip_route_output_key(net, rp, fl);
+			vxdprintk(VXD_CBIT(net, 4),
+				"ip_v4_find_src(%p[#%u]) rok[%u]: " NIPQUAD_FMT,
+				nxi, nxi ? nxi->nx_id : 0, fl->oif, NIPQUAD(primary));
+			if (!err) {
+				found = (*rp)->rt_src;
+				ip_rt_put(*rp);
+				if (found == primary)
+					goto found;
+			}
+		}
+		/* still no source ip? */
+		found = ipv4_is_loopback(fl->fl4_dst)
+			? IPI_LOOPBACK : nxi->v4.ip[0].s_addr;
+	found:
+		/* assign src ip to flow */
+		fl->fl4_src = found;
+
+	} else {
+		if (!v4_addr_in_nx_info(nxi, fl->fl4_src, NXA_MASK_BIND))
+			return -EPERM;
+	}
+
+	if (nx_info_flags(nxi, NXF_LBACK_REMAP, 0)) {
+		if (ipv4_is_loopback(fl->fl4_dst))
+			fl->fl4_dst = nxi->v4_lback.s_addr;
+		if (ipv4_is_loopback(fl->fl4_src))
+			fl->fl4_src = nxi->v4_lback.s_addr;
+	} else if (ipv4_is_loopback(fl->fl4_dst) &&
+		!nx_info_flags(nxi, NXF_LBACK_ALLOW, 0))
+		return -EPERM;
+
+	return 0;
+}
+
+EXPORT_SYMBOL_GPL(ip_v4_find_src);
+
diff -uriN linux-2.6.32.43/kernel/vserver/init.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/init.c
--- linux-2.6.32.43/kernel/vserver/init.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/init.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,45 @@
+/*
+ *  linux/kernel/init.c
+ *
+ *  Virtual Server Init
+ *
+ *  Copyright (C) 2004-2007  Herbert Pötzl
+ *
+ *  V0.01  basic structure
+ *
+ */
+
+#include <linux/init.h>
+
+int	vserver_register_sysctl(void);
+void	vserver_unregister_sysctl(void);
+
+
+static int __init init_vserver(void)
+{
+	int ret = 0;
+
+#ifdef	CONFIG_VSERVER_DEBUG
+	vserver_register_sysctl();
+#endif
+	return ret;
+}
+
+
+static void __exit exit_vserver(void)
+{
+
+#ifdef	CONFIG_VSERVER_DEBUG
+	vserver_unregister_sysctl();
+#endif
+	return;
+}
+
+/* FIXME: GFP_ZONETYPES gone
+long vx_slab[GFP_ZONETYPES]; */
+long vx_area;
+
+
+module_init(init_vserver);
+module_exit(exit_vserver);
+
diff -uriN linux-2.6.32.43/kernel/vserver/inode.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/inode.c
--- linux-2.6.32.43/kernel/vserver/inode.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/inode.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,433 @@
+/*
+ *  linux/kernel/vserver/inode.c
+ *
+ *  Virtual Server: File System Support
+ *
+ *  Copyright (C) 2004-2007  Herbert Pötzl
+ *
+ *  V0.01  separated from vcontext V0.05
+ *  V0.02  moved to tag (instead of xid)
+ *
+ */
+
+#include <linux/tty.h>
+#include <linux/proc_fs.h>
+#include <linux/devpts_fs.h>
+#include <linux/fs.h>
+#include <linux/file.h>
+#include <linux/mount.h>
+#include <linux/parser.h>
+#include <linux/namei.h>
+#include <linux/vserver/inode.h>
+#include <linux/vserver/inode_cmd.h>
+#include <linux/vs_base.h>
+#include <linux/vs_tag.h>
+
+#include <asm/uaccess.h>
+
+
+static int __vc_get_iattr(struct inode *in, uint32_t *tag, uint32_t *flags, uint32_t *mask)
+{
+	struct proc_dir_entry *entry;
+
+	if (!in || !in->i_sb)
+		return -ESRCH;
+
+	*flags = IATTR_TAG
+		| (IS_IMMUTABLE(in) ? IATTR_IMMUTABLE : 0)
+		| (IS_IXUNLINK(in) ? IATTR_IXUNLINK : 0)
+		| (IS_BARRIER(in) ? IATTR_BARRIER : 0)
+		| (IS_COW(in) ? IATTR_COW : 0);
+	*mask = IATTR_IXUNLINK | IATTR_IMMUTABLE | IATTR_COW;
+
+	if (S_ISDIR(in->i_mode))
+		*mask |= IATTR_BARRIER;
+
+	if (IS_TAGGED(in)) {
+		*tag = in->i_tag;
+		*mask |= IATTR_TAG;
+	}
+
+	switch (in->i_sb->s_magic) {
+	case PROC_SUPER_MAGIC:
+		entry = PROC_I(in)->pde;
+
+		/* check for specific inodes? */
+		if (entry)
+			*mask |= IATTR_FLAGS;
+		if (entry)
+			*flags |= (entry->vx_flags & IATTR_FLAGS);
+		else
+			*flags |= (PROC_I(in)->vx_flags & IATTR_FLAGS);
+		break;
+
+	case DEVPTS_SUPER_MAGIC:
+		*tag = in->i_tag;
+		*mask |= IATTR_TAG;
+		break;
+
+	default:
+		break;
+	}
+	return 0;
+}
+
+int vc_get_iattr(void __user *data)
+{
+	struct path path;
+	struct vcmd_ctx_iattr_v1 vc_data = { .tag = -1 };
+	int ret;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = user_lpath(vc_data.name, &path);
+	if (!ret) {
+		ret = __vc_get_iattr(path.dentry->d_inode,
+			&vc_data.tag, &vc_data.flags, &vc_data.mask);
+		path_put(&path);
+	}
+	if (ret)
+		return ret;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		ret = -EFAULT;
+	return ret;
+}
+
+#ifdef	CONFIG_COMPAT
+
+int vc_get_iattr_x32(void __user *data)
+{
+	struct path path;
+	struct vcmd_ctx_iattr_v1_x32 vc_data = { .tag = -1 };
+	int ret;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = user_lpath(compat_ptr(vc_data.name_ptr), &path);
+	if (!ret) {
+		ret = __vc_get_iattr(path.dentry->d_inode,
+			&vc_data.tag, &vc_data.flags, &vc_data.mask);
+		path_put(&path);
+	}
+	if (ret)
+		return ret;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		ret = -EFAULT;
+	return ret;
+}
+
+#endif	/* CONFIG_COMPAT */
+
+
+int vc_fget_iattr(uint32_t fd, void __user *data)
+{
+	struct file *filp;
+	struct vcmd_ctx_fiattr_v0 vc_data = { .tag = -1 };
+	int ret;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	filp = fget(fd);
+	if (!filp || !filp->f_dentry || !filp->f_dentry->d_inode)
+		return -EBADF;
+
+	ret = __vc_get_iattr(filp->f_dentry->d_inode,
+		&vc_data.tag, &vc_data.flags, &vc_data.mask);
+
+	fput(filp);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		ret = -EFAULT;
+	return ret;
+}
+
+
+static int __vc_set_iattr(struct dentry *de, uint32_t *tag, uint32_t *flags, uint32_t *mask)
+{
+	struct inode *in = de->d_inode;
+	int error = 0, is_proc = 0, has_tag = 0;
+	struct iattr attr = { 0 };
+
+	if (!in || !in->i_sb)
+		return -ESRCH;
+
+	is_proc = (in->i_sb->s_magic == PROC_SUPER_MAGIC);
+	if ((*mask & IATTR_FLAGS) && !is_proc)
+		return -EINVAL;
+
+	has_tag = IS_TAGGED(in) ||
+		(in->i_sb->s_magic == DEVPTS_SUPER_MAGIC);
+	if ((*mask & IATTR_TAG) && !has_tag)
+		return -EINVAL;
+
+	mutex_lock(&in->i_mutex);
+	if (*mask & IATTR_TAG) {
+		attr.ia_tag = *tag;
+		attr.ia_valid |= ATTR_TAG;
+	}
+
+	if (*mask & IATTR_FLAGS) {
+		struct proc_dir_entry *entry = PROC_I(in)->pde;
+		unsigned int iflags = PROC_I(in)->vx_flags;
+
+		iflags = (iflags & ~(*mask & IATTR_FLAGS))
+			| (*flags & IATTR_FLAGS);
+		PROC_I(in)->vx_flags = iflags;
+		if (entry)
+			entry->vx_flags = iflags;
+	}
+
+	if (*mask & (IATTR_IMMUTABLE | IATTR_IXUNLINK |
+		IATTR_BARRIER | IATTR_COW)) {
+		int iflags = in->i_flags;
+		int vflags = in->i_vflags;
+
+		if (*mask & IATTR_IMMUTABLE) {
+			if (*flags & IATTR_IMMUTABLE)
+				iflags |= S_IMMUTABLE;
+			else
+				iflags &= ~S_IMMUTABLE;
+		}
+		if (*mask & IATTR_IXUNLINK) {
+			if (*flags & IATTR_IXUNLINK)
+				iflags |= S_IXUNLINK;
+			else
+				iflags &= ~S_IXUNLINK;
+		}
+		if (S_ISDIR(in->i_mode) && (*mask & IATTR_BARRIER)) {
+			if (*flags & IATTR_BARRIER)
+				vflags |= V_BARRIER;
+			else
+				vflags &= ~V_BARRIER;
+		}
+		if (S_ISREG(in->i_mode) && (*mask & IATTR_COW)) {
+			if (*flags & IATTR_COW)
+				vflags |= V_COW;
+			else
+				vflags &= ~V_COW;
+		}
+		if (in->i_op && in->i_op->sync_flags) {
+			error = in->i_op->sync_flags(in, iflags, vflags);
+			if (error)
+				goto out;
+		}
+	}
+
+	if (attr.ia_valid) {
+		if (in->i_op && in->i_op->setattr)
+			error = in->i_op->setattr(de, &attr);
+		else {
+			error = inode_change_ok(in, &attr);
+			if (!error)
+				error = inode_setattr(in, &attr);
+		}
+	}
+
+out:
+	mutex_unlock(&in->i_mutex);
+	return error;
+}
+
+int vc_set_iattr(void __user *data)
+{
+	struct path path;
+	struct vcmd_ctx_iattr_v1 vc_data;
+	int ret;
+
+	if (!capable(CAP_LINUX_IMMUTABLE))
+		return -EPERM;
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = user_lpath(vc_data.name, &path);
+	if (!ret) {
+		ret = __vc_set_iattr(path.dentry,
+			&vc_data.tag, &vc_data.flags, &vc_data.mask);
+		path_put(&path);
+	}
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		ret = -EFAULT;
+	return ret;
+}
+
+#ifdef	CONFIG_COMPAT
+
+int vc_set_iattr_x32(void __user *data)
+{
+	struct path path;
+	struct vcmd_ctx_iattr_v1_x32 vc_data;
+	int ret;
+
+	if (!capable(CAP_LINUX_IMMUTABLE))
+		return -EPERM;
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = user_lpath(compat_ptr(vc_data.name_ptr), &path);
+	if (!ret) {
+		ret = __vc_set_iattr(path.dentry,
+			&vc_data.tag, &vc_data.flags, &vc_data.mask);
+		path_put(&path);
+	}
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		ret = -EFAULT;
+	return ret;
+}
+
+#endif	/* CONFIG_COMPAT */
+
+int vc_fset_iattr(uint32_t fd, void __user *data)
+{
+	struct file *filp;
+	struct vcmd_ctx_fiattr_v0 vc_data;
+	int ret;
+
+	if (!capable(CAP_LINUX_IMMUTABLE))
+		return -EPERM;
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	filp = fget(fd);
+	if (!filp || !filp->f_dentry || !filp->f_dentry->d_inode)
+		return -EBADF;
+
+	ret = __vc_set_iattr(filp->f_dentry, &vc_data.tag,
+		&vc_data.flags, &vc_data.mask);
+
+	fput(filp);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return ret;
+}
+
+
+enum { Opt_notagcheck, Opt_tag, Opt_notag, Opt_tagid, Opt_err };
+
+static match_table_t tokens = {
+	{Opt_notagcheck, "notagcheck"},
+#ifdef	CONFIG_PROPAGATE
+	{Opt_notag, "notag"},
+	{Opt_tag, "tag"},
+	{Opt_tagid, "tagid=%u"},
+#endif
+	{Opt_err, NULL}
+};
+
+
+static void __dx_parse_remove(char *string, char *opt)
+{
+	char *p = strstr(string, opt);
+	char *q = p;
+
+	if (p) {
+		while (*q != '\0' && *q != ',')
+			q++;
+		while (*q)
+			*p++ = *q++;
+		while (*p)
+			*p++ = '\0';
+	}
+}
+
+int dx_parse_tag(char *string, tag_t *tag, int remove, int *mnt_flags,
+		 unsigned long *flags)
+{
+	int set = 0;
+	substring_t args[MAX_OPT_ARGS];
+	int token, option = 0;
+	char *s, *p, *opts;
+
+	if (!string)
+		return 0;
+	s = kstrdup(string, GFP_KERNEL | GFP_ATOMIC);
+	if (!s)
+		return 0;
+
+	opts = s;
+	while ((p = strsep(&opts, ",")) != NULL) {
+		token = match_token(p, tokens, args);
+
+		vxdprintk(VXD_CBIT(tag, 7),
+			"dx_parse_tag(»%s«): %d:#%d",
+			p, token, option);
+
+		switch (token) {
+#ifdef CONFIG_PROPAGATE
+		case Opt_tag:
+			if (tag)
+				*tag = 0;
+			if (remove)
+				__dx_parse_remove(s, "tag");
+			*mnt_flags |= MNT_TAGID;
+			set |= MNT_TAGID;
+			break;
+		case Opt_notag:
+			if (remove)
+				__dx_parse_remove(s, "notag");
+			*mnt_flags |= MNT_NOTAG;
+			set |= MNT_NOTAG;
+			break;
+		case Opt_tagid:
+			if (tag && !match_int(args, &option))
+				*tag = option;
+			if (remove)
+				__dx_parse_remove(s, "tagid");
+			*mnt_flags |= MNT_TAGID;
+			set |= MNT_TAGID;
+			break;
+#endif
+		case Opt_notagcheck:
+			if (remove)
+				__dx_parse_remove(s, "notagcheck");
+			*flags |= MS_NOTAGCHECK;
+			set |= MS_NOTAGCHECK;
+			break;
+		}
+	}
+	if (set)
+		strcpy(string, s);
+	kfree(s);
+	return set;
+}
+
+#ifdef	CONFIG_PROPAGATE
+
+void __dx_propagate_tag(struct nameidata *nd, struct inode *inode)
+{
+	tag_t new_tag = 0;
+	struct vfsmount *mnt;
+	int propagate;
+
+	if (!nd)
+		return;
+	mnt = nd->path.mnt;
+	if (!mnt)
+		return;
+
+	propagate = (mnt->mnt_flags & MNT_TAGID);
+	if (propagate)
+		new_tag = mnt->mnt_tag;
+
+	vxdprintk(VXD_CBIT(tag, 7),
+		"dx_propagate_tag(%p[#%lu.%d]): %d,%d",
+		inode, inode->i_ino, inode->i_tag,
+		new_tag, (propagate) ? 1 : 0);
+
+	if (propagate)
+		inode->i_tag = new_tag;
+}
+
+#include <linux/module.h>
+
+EXPORT_SYMBOL_GPL(__dx_propagate_tag);
+
+#endif	/* CONFIG_PROPAGATE */
+
diff -uriN linux-2.6.32.43/kernel/vserver/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/Kconfig
--- linux-2.6.32.43/kernel/vserver/Kconfig	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,251 @@
+#
+# Linux VServer configuration
+#
+
+menu "Linux VServer"
+
+config	VSERVER_AUTO_LBACK
+	bool    "Automatically Assign Loopback IP"
+	default y
+	help
+	  Automatically assign a guest specific loopback
+	  IP and add it to the kernel network stack on
+	  startup.
+
+config	VSERVER_AUTO_SINGLE
+	bool	"Automatic Single IP Special Casing"
+	depends on EXPERIMENTAL
+	default y
+	help
+	  This allows network contexts with a single IP to
+	  automatically remap 0.0.0.0 bindings to that IP,
+	  avoiding further network checks and improving
+	  performance.
+
+	  (note: such guests do not allow to change the ip
+	   on the fly and do not show loopback addresses)
+
+config	VSERVER_COWBL
+	bool	"Enable COW Immutable Link Breaking"
+	default y
+	help
+	  This enables the COW (Copy-On-Write) link break code.
+	  It allows you to treat unified files like normal files
+	  when writing to them (which will implicitely break the
+	  link and create a copy of the unified file)
+
+config	VSERVER_VTIME
+	bool	"Enable Virtualized Guest Time"
+	depends on EXPERIMENTAL
+	default n
+	help
+	  This enables per guest time offsets to allow for
+	  adjusting the system clock individually per guest.
+	  this adds some overhead to the time functions and
+	  therefore should not be enabled without good reason.
+
+config	VSERVER_DEVICE
+	bool	"Enable Guest Device Mapping"
+	depends on EXPERIMENTAL
+	default n
+	help
+	  This enables generic device remapping.
+
+config	VSERVER_PROC_SECURE
+	bool	"Enable Proc Security"
+	depends on PROC_FS
+	default y
+	help
+	  This configures ProcFS security to initially hide
+	  non-process entries for all contexts except the main and
+	  spectator context (i.e. for all guests), which is a secure
+	  default.
+
+	  (note: on 1.2x the entries were visible by default)
+
+config	VSERVER_HARDCPU
+	bool	"Enable Hard CPU Limits"
+	default y
+	help
+	  Activate the Hard CPU Limits
+
+	  This will compile in code that allows the Token Bucket
+	  Scheduler to put processes on hold when a context's
+	  tokens are depleted (provided that its per-context
+	  sched_hard flag is set).
+
+	  Processes belonging to that context will not be able
+	  to consume CPU resources again until a per-context
+	  configured minimum of tokens has been reached.
+
+config	VSERVER_IDLETIME
+	bool	"Avoid idle CPUs by skipping Time"
+	depends on VSERVER_HARDCPU
+	default y
+	help
+	  This option allows the scheduler to artificially
+	  advance time (per cpu) when otherwise the idle
+	  task would be scheduled, thus keeping the cpu
+	  busy and sharing the available resources among
+	  certain contexts.
+
+config	VSERVER_IDLELIMIT
+	bool	"Limit the IDLE task"
+	depends on VSERVER_HARDCPU
+	default n
+	help
+	  Limit the idle slices, so the the next context
+	  will be scheduled as soon as possible.
+
+	  This might improve interactivity and latency, but
+	  will also marginally increase scheduling overhead.
+
+choice
+	prompt	"Persistent Inode Tagging"
+	default	TAGGING_ID24
+	help
+	  This adds persistent context information to filesystems
+	  mounted with the tagxid option. Tagging is a requirement
+	  for per-context disk limits and per-context quota.
+
+
+config	TAGGING_NONE
+	bool	"Disabled"
+	help
+	  do not store per-context information in inodes.
+
+config	TAGGING_UID16
+	bool	"UID16/GID32"
+	help
+	  reduces UID to 16 bit, but leaves GID at 32 bit.
+
+config	TAGGING_GID16
+	bool	"UID32/GID16"
+	help
+	  reduces GID to 16 bit, but leaves UID at 32 bit.
+
+config	TAGGING_ID24
+	bool	"UID24/GID24"
+	help
+	  uses the upper 8bit from UID and GID for XID tagging
+	  which leaves 24bit for UID/GID each, which should be
+	  more than sufficient for normal use.
+
+config	TAGGING_INTERN
+	bool	"UID32/GID32"
+	help
+	  this uses otherwise reserved inode fields in the on
+	  disk representation, which limits the use to a few
+	  filesystems (currently ext2 and ext3)
+
+endchoice
+
+config	TAG_NFSD
+	bool	"Tag NFSD User Auth and Files"
+	default n
+	help
+	  Enable this if you do want the in-kernel NFS
+	  Server to use the tagging specified above.
+	  (will require patched clients too)
+
+config	VSERVER_PRIVACY
+	bool	"Honor Privacy Aspects of Guests"
+	default n
+	help
+	  When enabled, most context checks will disallow
+	  access to structures assigned to a specific context,
+	  like ptys or loop devices.
+
+config	VSERVER_CONTEXTS
+	int	"Maximum number of Contexts (1-65533)"	if EMBEDDED
+	range 1 65533
+	default "768"	if 64BIT
+	default "256"
+	help
+	  This setting will optimize certain data structures
+	  and memory allocations according to the expected
+	  maximum.
+
+	  note: this is not a strict upper limit.
+
+config	VSERVER_WARN
+	bool	"VServer Warnings"
+	default y
+	help
+	  This enables various runtime warnings, which will
+	  notify about potential manipulation attempts or
+	  resource shortage. It is generally considered to
+	  be a good idea to have that enabled.
+
+config	VSERVER_DEBUG
+	bool	"VServer Debugging Code"
+	default n
+	help
+	  Set this to yes if you want to be able to activate
+	  debugging output at runtime. It adds a very small
+	  overhead to all vserver related functions and
+	  increases the kernel size by about 20k.
+
+config	VSERVER_HISTORY
+	bool	"VServer History Tracing"
+	depends on VSERVER_DEBUG
+	default n
+	help
+	  Set this to yes if you want to record the history of
+	  linux-vserver activities, so they can be replayed in
+	  the event of a kernel panic or oops.
+
+config	VSERVER_HISTORY_SIZE
+	int	"Per-CPU History Size (32-65536)"
+	depends on VSERVER_HISTORY
+	range 32 65536
+	default 64
+	help
+	  This allows you to specify the number of entries in
+	  the per-CPU history buffer.
+
+config	VSERVER_MONITOR
+	bool	"VServer Scheduling Monitor"
+	depends on VSERVER_DISABLED
+	default n
+	help
+	  Set this to yes if you want to record the scheduling
+	  decisions, so that they can be relayed to userspace
+	  for detailed analysis.
+
+config	VSERVER_MONITOR_SIZE
+	int	"Per-CPU Monitor Queue Size (32-65536)"
+	depends on VSERVER_MONITOR
+	range 32 65536
+	default 1024
+	help
+	  This allows you to specify the number of entries in
+	  the per-CPU scheduling monitor buffer.
+
+config	VSERVER_MONITOR_SYNC
+	int	"Per-CPU Monitor Sync Interval (0-65536)"
+	depends on VSERVER_MONITOR
+	range 0 65536
+	default 256
+	help
+	  This allows you to specify the interval in ticks
+	  when a time sync entry is inserted.
+
+endmenu
+
+
+config	VSERVER
+	bool
+	default y
+	select NAMESPACES
+	select UTS_NS
+	select IPC_NS
+	select USER_NS
+	select SYSVIPC
+
+config	VSERVER_SECURITY
+	bool
+	depends on SECURITY
+	default y
+	select SECURITY_CAPABILITIES
+
diff -uriN linux-2.6.32.43/kernel/vserver/limit.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/limit.c
--- linux-2.6.32.43/kernel/vserver/limit.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/limit.c	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,392 @@
+/*
+ *  linux/kernel/vserver/limit.c
+ *
+ *  Virtual Server: Context Limits
+ *
+ *  Copyright (C) 2004-2010  Herbert Pötzl
+ *
+ *  V0.01  broken out from vcontext V0.05
+ *  V0.02  changed vcmds to vxi arg
+ *  V0.03  added memory cgroup support
+ *
+ */
+
+#include <linux/sched.h>
+#include <linux/module.h>
+#include <linux/memcontrol.h>
+#include <linux/res_counter.h>
+#include <linux/vs_limit.h>
+#include <linux/vserver/limit.h>
+#include <linux/vserver/limit_cmd.h>
+
+#include <asm/uaccess.h>
+
+
+const char *vlimit_name[NUM_LIMITS] = {
+	[RLIMIT_CPU]		= "CPU",
+	[RLIMIT_RSS]		= "RSS",
+	[RLIMIT_NPROC]		= "NPROC",
+	[RLIMIT_NOFILE]		= "NOFILE",
+	[RLIMIT_MEMLOCK]	= "VML",
+	[RLIMIT_AS]		= "VM",
+	[RLIMIT_LOCKS]		= "LOCKS",
+	[RLIMIT_SIGPENDING]	= "SIGP",
+	[RLIMIT_MSGQUEUE]	= "MSGQ",
+
+	[VLIMIT_NSOCK]		= "NSOCK",
+	[VLIMIT_OPENFD]		= "OPENFD",
+	[VLIMIT_ANON]		= "ANON",
+	[VLIMIT_SHMEM]		= "SHMEM",
+	[VLIMIT_DENTRY]		= "DENTRY",
+};
+
+EXPORT_SYMBOL_GPL(vlimit_name);
+
+#define MASK_ENTRY(x)	(1 << (x))
+
+const struct vcmd_ctx_rlimit_mask_v0 vlimit_mask = {
+		/* minimum */
+	0
+	,	/* softlimit */
+	MASK_ENTRY( RLIMIT_RSS		) |
+	MASK_ENTRY( VLIMIT_ANON		) |
+	0
+	,       /* maximum */
+	MASK_ENTRY( RLIMIT_RSS		) |
+	MASK_ENTRY( RLIMIT_NPROC	) |
+	MASK_ENTRY( RLIMIT_NOFILE	) |
+	MASK_ENTRY( RLIMIT_MEMLOCK	) |
+	MASK_ENTRY( RLIMIT_AS		) |
+	MASK_ENTRY( RLIMIT_LOCKS	) |
+	MASK_ENTRY( RLIMIT_MSGQUEUE	) |
+
+	MASK_ENTRY( VLIMIT_NSOCK	) |
+	MASK_ENTRY( VLIMIT_OPENFD	) |
+	MASK_ENTRY( VLIMIT_ANON		) |
+	MASK_ENTRY( VLIMIT_SHMEM	) |
+	MASK_ENTRY( VLIMIT_DENTRY	) |
+	0
+};
+		/* accounting only */
+uint32_t account_mask =
+	MASK_ENTRY( VLIMIT_SEMARY	) |
+	MASK_ENTRY( VLIMIT_NSEMS	) |
+	MASK_ENTRY( VLIMIT_MAPPED	) |
+	0;
+
+
+static int is_valid_vlimit(int id)
+{
+	uint32_t mask = vlimit_mask.minimum |
+		vlimit_mask.softlimit | vlimit_mask.maximum;
+	return mask & (1 << id);
+}
+
+static int is_accounted_vlimit(int id)
+{
+	if (is_valid_vlimit(id))
+		return 1;
+	return account_mask & (1 << id);
+}
+
+
+static inline uint64_t vc_get_soft(struct vx_info *vxi, int id)
+{
+	rlim_t limit = __rlim_soft(&vxi->limit, id);
+	return VX_VLIM(limit);
+}
+
+static inline uint64_t vc_get_hard(struct vx_info *vxi, int id)
+{
+	rlim_t limit = __rlim_hard(&vxi->limit, id);
+	return VX_VLIM(limit);
+}
+
+static int do_get_rlimit(struct vx_info *vxi, uint32_t id,
+	uint64_t *minimum, uint64_t *softlimit, uint64_t *maximum)
+{
+	if (!is_valid_vlimit(id))
+		return -EINVAL;
+
+	if (minimum)
+		*minimum = CRLIM_UNSET;
+	if (softlimit)
+		*softlimit = vc_get_soft(vxi, id);
+	if (maximum)
+		*maximum = vc_get_hard(vxi, id);
+	return 0;
+}
+
+int vc_get_rlimit(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_rlimit_v0 vc_data;
+	int ret;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = do_get_rlimit(vxi, vc_data.id,
+		&vc_data.minimum, &vc_data.softlimit, &vc_data.maximum);
+	if (ret)
+		return ret;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+static int do_set_rlimit(struct vx_info *vxi, uint32_t id,
+	uint64_t minimum, uint64_t softlimit, uint64_t maximum)
+{
+	if (!is_valid_vlimit(id))
+		return -EINVAL;
+
+	if (maximum != CRLIM_KEEP)
+		__rlim_hard(&vxi->limit, id) = VX_RLIM(maximum);
+	if (softlimit != CRLIM_KEEP)
+		__rlim_soft(&vxi->limit, id) = VX_RLIM(softlimit);
+
+	/* clamp soft limit */
+	if (__rlim_soft(&vxi->limit, id) > __rlim_hard(&vxi->limit, id))
+		__rlim_soft(&vxi->limit, id) = __rlim_hard(&vxi->limit, id);
+
+	return 0;
+}
+
+int vc_set_rlimit(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_rlimit_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_set_rlimit(vxi, vc_data.id,
+		vc_data.minimum, vc_data.softlimit, vc_data.maximum);
+}
+
+#ifdef	CONFIG_IA32_EMULATION
+
+int vc_set_rlimit_x32(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_rlimit_v0_x32 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_set_rlimit(vxi, vc_data.id,
+		vc_data.minimum, vc_data.softlimit, vc_data.maximum);
+}
+
+int vc_get_rlimit_x32(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_rlimit_v0_x32 vc_data;
+	int ret;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = do_get_rlimit(vxi, vc_data.id,
+		&vc_data.minimum, &vc_data.softlimit, &vc_data.maximum);
+	if (ret)
+		return ret;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+#endif	/* CONFIG_IA32_EMULATION */
+
+
+int vc_get_rlimit_mask(uint32_t id, void __user *data)
+{
+	if (copy_to_user(data, &vlimit_mask, sizeof(vlimit_mask)))
+		return -EFAULT;
+	return 0;
+}
+
+
+static inline void vx_reset_hits(struct _vx_limit *limit)
+{
+	int lim;
+
+	for (lim = 0; lim < NUM_LIMITS; lim++) {
+		atomic_set_unchecked(&__rlim_lhit(limit, lim), 0);
+	}
+}
+
+int vc_reset_hits(struct vx_info *vxi, void __user *data)
+{
+	vx_reset_hits(&vxi->limit);
+	return 0;
+}
+
+static inline void vx_reset_minmax(struct _vx_limit *limit)
+{
+	rlim_t value;
+	int lim;
+
+	for (lim = 0; lim < NUM_LIMITS; lim++) {
+		value = __rlim_get(limit, lim);
+		__rlim_rmax(limit, lim) = value;
+		__rlim_rmin(limit, lim) = value;
+	}
+}
+
+int vc_reset_minmax(struct vx_info *vxi, void __user *data)
+{
+	vx_reset_minmax(&vxi->limit);
+	return 0;
+}
+
+
+int vc_rlimit_stat(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_rlimit_stat_v0 vc_data;
+	struct _vx_limit *limit = &vxi->limit;
+	int id;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	id = vc_data.id;
+	if (!is_accounted_vlimit(id))
+		return -EINVAL;
+
+	vx_limit_fixup(limit, id);
+	vc_data.hits = atomic_read_unchecked(&__rlim_lhit(limit, id));
+	vc_data.value = __rlim_get(limit, id);
+	vc_data.minimum = __rlim_rmin(limit, id);
+	vc_data.maximum = __rlim_rmax(limit, id);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+
+void vx_vsi_meminfo(struct sysinfo *val)
+{
+#ifdef	CONFIG_CGROUP_MEM_RES_CTLR
+	struct mem_cgroup *mcg = mem_cgroup_from_task(current);
+	u64 res_limit, res_usage;
+
+	if (!mcg)
+		return;
+
+	res_limit = mem_cgroup_res_read_u64(mcg, RES_LIMIT);
+	res_usage = mem_cgroup_res_read_u64(mcg, RES_USAGE);
+
+	if (res_limit != RESOURCE_MAX)
+		val->totalram = (res_limit >> PAGE_SHIFT);
+	val->freeram = val->totalram - (res_usage >> PAGE_SHIFT);
+	val->bufferram = 0;
+#else	/* !CONFIG_CGROUP_MEM_RES_CTLR */
+	struct vx_info *vxi = current_vx_info();
+	unsigned long totalram, freeram;
+	rlim_t v;
+
+	/* we blindly accept the max */
+	v = __rlim_soft(&vxi->limit, RLIMIT_RSS);
+	totalram = (v != RLIM_INFINITY) ? v : val->totalram;
+
+	/* total minus used equals free */
+	v = __vx_cres_array_fixup(&vxi->limit, VLA_RSS);
+	freeram = (v < totalram) ? totalram - v : 0;
+
+	val->totalram = totalram;
+	val->freeram = freeram;
+#endif	/* CONFIG_CGROUP_MEM_RES_CTLR */
+	val->totalhigh = 0;
+	val->freehigh = 0;
+	return;
+}
+
+void vx_vsi_swapinfo(struct sysinfo *val)
+{
+#ifdef	CONFIG_CGROUP_MEM_RES_CTLR
+#ifdef	CONFIG_CGROUP_MEM_RES_CTLR_SWAP
+	struct mem_cgroup *mcg = mem_cgroup_from_task(current);
+	u64 res_limit, res_usage, memsw_limit, memsw_usage;
+	s64 swap_limit, swap_usage;
+
+	if (!mcg)
+		return;
+
+	res_limit = mem_cgroup_res_read_u64(mcg, RES_LIMIT);
+	res_usage = mem_cgroup_res_read_u64(mcg, RES_USAGE);
+	memsw_limit = mem_cgroup_memsw_read_u64(mcg, RES_LIMIT);
+	memsw_usage = mem_cgroup_memsw_read_u64(mcg, RES_USAGE);
+
+	if (res_limit == RESOURCE_MAX)
+		return;
+
+	swap_limit = memsw_limit - res_limit;
+	if (memsw_limit != RESOURCE_MAX)
+		val->totalswap = swap_limit >> PAGE_SHIFT;
+
+	swap_usage = memsw_usage - res_usage;
+	val->freeswap = (swap_usage < swap_limit) ?
+		val->totalswap - (swap_usage >> PAGE_SHIFT) : 0;
+#else	/* !CONFIG_CGROUP_MEM_RES_CTLR_SWAP */
+	val->totalswap = 0;
+	val->freeswap = 0;
+#endif	/* !CONFIG_CGROUP_MEM_RES_CTLR_SWAP */
+#else	/* !CONFIG_CGROUP_MEM_RES_CTLR */
+	struct vx_info *vxi = current_vx_info();
+	unsigned long totalswap, freeswap;
+	rlim_t v, w;
+
+	v = __rlim_soft(&vxi->limit, RLIMIT_RSS);
+	if (v == RLIM_INFINITY) {
+		val->freeswap = val->totalswap;
+		return;
+	}
+
+	/* we blindly accept the max */
+	w = __rlim_hard(&vxi->limit, RLIMIT_RSS);
+	totalswap = (w != RLIM_INFINITY) ? (w - v) : val->totalswap;
+
+	/* currently 'used' swap */
+	w = __vx_cres_array_fixup(&vxi->limit, VLA_RSS);
+	w -= (w > v) ? v : w;
+
+	/* total minus used equals free */
+	freeswap = (w < totalswap) ? totalswap - w : 0;
+
+	val->totalswap = totalswap;
+	val->freeswap = freeswap;
+#endif	/* CONFIG_CGROUP_MEM_RES_CTLR */
+	return;
+}
+
+long vx_vsi_cached(struct sysinfo *val)
+{
+#ifdef	CONFIG_CGROUP_MEM_RES_CTLR
+	struct mem_cgroup *mcg = mem_cgroup_from_task(current);
+
+	return mem_cgroup_stat_read_cache(mcg);
+#else
+	return 0;
+#endif
+}
+
+
+unsigned long vx_badness(struct task_struct *task, struct mm_struct *mm)
+{
+	struct vx_info *vxi = mm->mm_vx_info;
+	unsigned long points;
+	rlim_t v, w;
+
+	if (!vxi)
+		return 0;
+
+	points = vxi->vx_badness_bias;
+
+	v = __vx_cres_array_fixup(&vxi->limit, VLA_RSS);
+	w = __rlim_soft(&vxi->limit, RLIMIT_RSS);
+	points += (v > w) ? (v - w) : 0;
+
+	return points;
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/limit_init.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/limit_init.h
--- linux-2.6.32.43/kernel/vserver/limit_init.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/limit_init.h	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,31 @@
+
+
+static inline void vx_info_init_limit(struct _vx_limit *limit)
+{
+	int lim;
+
+	for (lim = 0; lim < NUM_LIMITS; lim++) {
+		__rlim_soft(limit, lim) = RLIM_INFINITY;
+		__rlim_hard(limit, lim) = RLIM_INFINITY;
+		__rlim_set(limit, lim, 0);
+		atomic_set_unchecked(&__rlim_lhit(limit, lim), 0);
+		__rlim_rmin(limit, lim) = 0;
+		__rlim_rmax(limit, lim) = 0;
+	}
+}
+
+static inline void vx_info_exit_limit(struct _vx_limit *limit)
+{
+	rlim_t value;
+	int lim;
+
+	for (lim = 0; lim < NUM_LIMITS; lim++) {
+		if ((1 << lim) & VLIM_NOCHECK)
+			continue;
+		value = __rlim_get(limit, lim);
+		vxwprintk_xid(value,
+			"!!! limit: %p[%s,%d] = %ld on exit.",
+			limit, vlimit_name[lim], lim, (long)value);
+	}
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/limit_proc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/limit_proc.h
--- linux-2.6.32.43/kernel/vserver/limit_proc.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/limit_proc.h	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,57 @@
+#ifndef _VX_LIMIT_PROC_H
+#define _VX_LIMIT_PROC_H
+
+#include <linux/vserver/limit_int.h>
+
+
+#define VX_LIMIT_FMT	":\t%8ld\t%8ld/%8ld\t%8lld/%8lld\t%6d\n"
+#define VX_LIMIT_TOP	\
+	"Limit\t current\t     min/max\t\t    soft/hard\t\thits\n"
+
+#define VX_LIMIT_ARG(r)				\
+	(unsigned long)__rlim_get(limit, r),	\
+	(unsigned long)__rlim_rmin(limit, r),	\
+	(unsigned long)__rlim_rmax(limit, r),	\
+	VX_VLIM(__rlim_soft(limit, r)),		\
+	VX_VLIM(__rlim_hard(limit, r)),		\
+	atomic_read_unchecked(&__rlim_lhit(limit, r))
+
+static inline int vx_info_proc_limit(struct _vx_limit *limit, char *buffer)
+{
+	vx_limit_fixup(limit, -1);
+	return sprintf(buffer, VX_LIMIT_TOP
+		"PROC"	VX_LIMIT_FMT
+		"VM"	VX_LIMIT_FMT
+		"VML"	VX_LIMIT_FMT
+		"RSS"	VX_LIMIT_FMT
+		"ANON"	VX_LIMIT_FMT
+		"RMAP"	VX_LIMIT_FMT
+		"FILES" VX_LIMIT_FMT
+		"OFD"	VX_LIMIT_FMT
+		"LOCKS" VX_LIMIT_FMT
+		"SOCK"	VX_LIMIT_FMT
+		"MSGQ"	VX_LIMIT_FMT
+		"SHM"	VX_LIMIT_FMT
+		"SEMA"	VX_LIMIT_FMT
+		"SEMS"	VX_LIMIT_FMT
+		"DENT"	VX_LIMIT_FMT,
+		VX_LIMIT_ARG(RLIMIT_NPROC),
+		VX_LIMIT_ARG(RLIMIT_AS),
+		VX_LIMIT_ARG(RLIMIT_MEMLOCK),
+		VX_LIMIT_ARG(RLIMIT_RSS),
+		VX_LIMIT_ARG(VLIMIT_ANON),
+		VX_LIMIT_ARG(VLIMIT_MAPPED),
+		VX_LIMIT_ARG(RLIMIT_NOFILE),
+		VX_LIMIT_ARG(VLIMIT_OPENFD),
+		VX_LIMIT_ARG(RLIMIT_LOCKS),
+		VX_LIMIT_ARG(VLIMIT_NSOCK),
+		VX_LIMIT_ARG(RLIMIT_MSGQUEUE),
+		VX_LIMIT_ARG(VLIMIT_SHMEM),
+		VX_LIMIT_ARG(VLIMIT_SEMARY),
+		VX_LIMIT_ARG(VLIMIT_NSEMS),
+		VX_LIMIT_ARG(VLIMIT_DENTRY));
+}
+
+#endif	/* _VX_LIMIT_PROC_H */
+
+
diff -uriN linux-2.6.32.43/kernel/vserver/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/Makefile
--- linux-2.6.32.43/kernel/vserver/Makefile	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/Makefile	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,18 @@
+#
+# Makefile for the Linux vserver routines.
+#
+
+
+obj-y		+= vserver.o
+
+vserver-y	:= switch.o context.o space.o sched.o network.o inode.o \
+		   limit.o cvirt.o cacct.o signal.o helper.o init.o \
+		   dlimit.o tag.o
+
+vserver-$(CONFIG_INET) += inet.o
+vserver-$(CONFIG_PROC_FS) += proc.o
+vserver-$(CONFIG_VSERVER_DEBUG) += sysctl.o debug.o
+vserver-$(CONFIG_VSERVER_HISTORY) += history.o
+vserver-$(CONFIG_VSERVER_MONITOR) += monitor.o
+vserver-$(CONFIG_VSERVER_DEVICE) += device.o
+
diff -uriN linux-2.6.32.43/kernel/vserver/monitor.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/monitor.c
--- linux-2.6.32.43/kernel/vserver/monitor.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/monitor.c	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,138 @@
+/*
+ *  kernel/vserver/monitor.c
+ *
+ *  Virtual Context Scheduler Monitor
+ *
+ *  Copyright (C) 2006-2007 Herbert Pötzl
+ *
+ *  V0.01  basic design
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/jiffies.h>
+#include <asm/uaccess.h>
+#include <asm/atomic.h>
+
+#include <linux/vserver/monitor.h>
+#include <linux/vserver/debug_cmd.h>
+
+
+#ifdef	CONFIG_VSERVER_MONITOR
+#define VXM_SIZE	CONFIG_VSERVER_MONITOR_SIZE
+#else
+#define VXM_SIZE	64
+#endif
+
+struct _vx_monitor {
+	unsigned int counter;
+
+	struct _vx_mon_entry entry[VXM_SIZE+1];
+};
+
+
+DEFINE_PER_CPU(struct _vx_monitor, vx_monitor_buffer);
+
+unsigned volatile int vxm_active = 1;
+
+static atomic_unchecked_t sequence = ATOMIC_INIT(0);
+
+
+/*	vxm_advance()
+
+	* requires disabled preemption				*/
+
+struct _vx_mon_entry *vxm_advance(int cpu)
+{
+	struct _vx_monitor *mon = &per_cpu(vx_monitor_buffer, cpu);
+	struct _vx_mon_entry *entry;
+	unsigned int index;
+
+	index = vxm_active ? (mon->counter++ % VXM_SIZE) : VXM_SIZE;
+	entry = &mon->entry[index];
+
+	entry->ev.seq = atomic_inc_return_unchecked(&sequence);
+	entry->ev.jif = jiffies;
+	return entry;
+}
+
+EXPORT_SYMBOL_GPL(vxm_advance);
+
+
+int do_read_monitor(struct __user _vx_mon_entry *data,
+	int cpu, uint32_t *index, uint32_t *count)
+{
+	int pos, ret = 0;
+	struct _vx_monitor *mon = &per_cpu(vx_monitor_buffer, cpu);
+	int end = mon->counter;
+	int start = end - VXM_SIZE + 2;
+	int idx = *index;
+
+	/* special case: get current pos */
+	if (!*count) {
+		*index = end;
+		return 0;
+	}
+
+	/* have we lost some data? */
+	if (idx < start)
+		idx = start;
+
+	for (pos = 0; (pos < *count) && (idx < end); pos++, idx++) {
+		struct _vx_mon_entry *entry =
+			&mon->entry[idx % VXM_SIZE];
+
+		/* send entry to userspace */
+		ret = copy_to_user(&data[pos], entry, sizeof(*entry));
+		if (ret)
+			break;
+	}
+	/* save new index and count */
+	*index = idx;
+	*count = pos;
+	return ret ? ret : (*index < end);
+}
+
+int vc_read_monitor(uint32_t id, void __user *data)
+{
+	struct vcmd_read_monitor_v0 vc_data;
+	int ret;
+
+	if (id >= NR_CPUS)
+		return -EINVAL;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = do_read_monitor((struct __user _vx_mon_entry *)vc_data.data,
+		id, &vc_data.index, &vc_data.count);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return ret;
+}
+
+#ifdef	CONFIG_COMPAT
+
+int vc_read_monitor_x32(uint32_t id, void __user *data)
+{
+	struct vcmd_read_monitor_v0_x32 vc_data;
+	int ret;
+
+	if (id >= NR_CPUS)
+		return -EINVAL;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	ret = do_read_monitor((struct __user _vx_mon_entry *)
+		compat_ptr(vc_data.data_ptr),
+		id, &vc_data.index, &vc_data.count);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return ret;
+}
+
+#endif	/* CONFIG_COMPAT */
+
diff -uriN linux-2.6.32.43/kernel/vserver/network.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/network.c
--- linux-2.6.32.43/kernel/vserver/network.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/network.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,864 @@
+/*
+ *  linux/kernel/vserver/network.c
+ *
+ *  Virtual Server: Network Support
+ *
+ *  Copyright (C) 2003-2007  Herbert Pötzl
+ *
+ *  V0.01  broken out from vcontext V0.05
+ *  V0.02  cleaned up implementation
+ *  V0.03  added equiv nx commands
+ *  V0.04  switch to RCU based hash
+ *  V0.05  and back to locking again
+ *  V0.06  changed vcmds to nxi arg
+ *  V0.07  have __create claim() the nxi
+ *
+ */
+
+#include <linux/err.h>
+#include <linux/slab.h>
+#include <linux/rcupdate.h>
+
+#include <linux/vs_network.h>
+#include <linux/vs_pid.h>
+#include <linux/vserver/network_cmd.h>
+
+
+atomic_t nx_global_ctotal	= ATOMIC_INIT(0);
+atomic_t nx_global_cactive	= ATOMIC_INIT(0);
+
+static struct kmem_cache *nx_addr_v4_cachep = NULL;
+static struct kmem_cache *nx_addr_v6_cachep = NULL;
+
+
+static int __init init_network(void)
+{
+	nx_addr_v4_cachep = kmem_cache_create("nx_v4_addr_cache",
+		sizeof(struct nx_addr_v4), 0,
+		SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+	nx_addr_v6_cachep = kmem_cache_create("nx_v6_addr_cache",
+		sizeof(struct nx_addr_v6), 0,
+		SLAB_HWCACHE_ALIGN|SLAB_PANIC, NULL);
+	return 0;
+}
+
+
+/*	__alloc_nx_addr_v4()					*/
+
+static inline struct nx_addr_v4 *__alloc_nx_addr_v4(void)
+{
+	struct nx_addr_v4 *nxa = kmem_cache_alloc(
+		nx_addr_v4_cachep, GFP_KERNEL);
+
+	if (!IS_ERR(nxa))
+		memset(nxa, 0, sizeof(*nxa));
+	return nxa;
+}
+
+/*	__dealloc_nx_addr_v4()					*/
+
+static inline void __dealloc_nx_addr_v4(struct nx_addr_v4 *nxa)
+{
+	kmem_cache_free(nx_addr_v4_cachep, nxa);
+}
+
+/*	__dealloc_nx_addr_v4_all()				*/
+
+static inline void __dealloc_nx_addr_v4_all(struct nx_addr_v4 *nxa)
+{
+	while (nxa) {
+		struct nx_addr_v4 *next = nxa->next;
+
+		__dealloc_nx_addr_v4(nxa);
+		nxa = next;
+	}
+}
+
+
+#ifdef CONFIG_IPV6
+
+/*	__alloc_nx_addr_v6()					*/
+
+static inline struct nx_addr_v6 *__alloc_nx_addr_v6(void)
+{
+	struct nx_addr_v6 *nxa = kmem_cache_alloc(
+		nx_addr_v6_cachep, GFP_KERNEL);
+
+	if (!IS_ERR(nxa))
+		memset(nxa, 0, sizeof(*nxa));
+	return nxa;
+}
+
+/*	__dealloc_nx_addr_v6()					*/
+
+static inline void __dealloc_nx_addr_v6(struct nx_addr_v6 *nxa)
+{
+	kmem_cache_free(nx_addr_v6_cachep, nxa);
+}
+
+/*	__dealloc_nx_addr_v6_all()				*/
+
+static inline void __dealloc_nx_addr_v6_all(struct nx_addr_v6 *nxa)
+{
+	while (nxa) {
+		struct nx_addr_v6 *next = nxa->next;
+
+		__dealloc_nx_addr_v6(nxa);
+		nxa = next;
+	}
+}
+
+#endif	/* CONFIG_IPV6 */
+
+/*	__alloc_nx_info()
+
+	* allocate an initialized nx_info struct
+	* doesn't make it visible (hash)			*/
+
+static struct nx_info *__alloc_nx_info(nid_t nid)
+{
+	struct nx_info *new = NULL;
+
+	vxdprintk(VXD_CBIT(nid, 1), "alloc_nx_info(%d)*", nid);
+
+	/* would this benefit from a slab cache? */
+	new = kmalloc(sizeof(struct nx_info), GFP_KERNEL);
+	if (!new)
+		return 0;
+
+	memset(new, 0, sizeof(struct nx_info));
+	new->nx_id = nid;
+	INIT_HLIST_NODE(&new->nx_hlist);
+	atomic_set(&new->nx_usecnt, 0);
+	atomic_set(&new->nx_tasks, 0);
+	new->nx_state = 0;
+
+	new->nx_flags = NXF_INIT_SET;
+
+	/* rest of init goes here */
+
+	new->v4_lback.s_addr = htonl(INADDR_LOOPBACK);
+	new->v4_bcast.s_addr = htonl(INADDR_BROADCAST);
+
+	vxdprintk(VXD_CBIT(nid, 0),
+		"alloc_nx_info(%d) = %p", nid, new);
+	atomic_inc(&nx_global_ctotal);
+	return new;
+}
+
+/*	__dealloc_nx_info()
+
+	* final disposal of nx_info				*/
+
+static void __dealloc_nx_info(struct nx_info *nxi)
+{
+	vxdprintk(VXD_CBIT(nid, 0),
+		"dealloc_nx_info(%p)", nxi);
+
+	nxi->nx_hlist.next = LIST_POISON1;
+	nxi->nx_id = -1;
+
+	BUG_ON(atomic_read(&nxi->nx_usecnt));
+	BUG_ON(atomic_read(&nxi->nx_tasks));
+
+	__dealloc_nx_addr_v4_all(nxi->v4.next);
+
+	nxi->nx_state |= NXS_RELEASED;
+	kfree(nxi);
+	atomic_dec(&nx_global_ctotal);
+}
+
+static void __shutdown_nx_info(struct nx_info *nxi)
+{
+	nxi->nx_state |= NXS_SHUTDOWN;
+	vs_net_change(nxi, VSC_NETDOWN);
+}
+
+/*	exported stuff						*/
+
+void free_nx_info(struct nx_info *nxi)
+{
+	/* context shutdown is mandatory */
+	BUG_ON(nxi->nx_state != NXS_SHUTDOWN);
+
+	/* context must not be hashed */
+	BUG_ON(nxi->nx_state & NXS_HASHED);
+
+	BUG_ON(atomic_read(&nxi->nx_usecnt));
+	BUG_ON(atomic_read(&nxi->nx_tasks));
+
+	__dealloc_nx_info(nxi);
+}
+
+
+void __nx_set_lback(struct nx_info *nxi)
+{
+	int nid = nxi->nx_id;
+	__be32 lback = htonl(INADDR_LOOPBACK ^ ((nid & 0xFFFF) << 8));
+
+	nxi->v4_lback.s_addr = lback;
+}
+
+extern int __nx_inet_add_lback(__be32 addr);
+extern int __nx_inet_del_lback(__be32 addr);
+
+
+/*	hash table for nx_info hash */
+
+#define NX_HASH_SIZE	13
+
+struct hlist_head nx_info_hash[NX_HASH_SIZE];
+
+static spinlock_t nx_info_hash_lock = SPIN_LOCK_UNLOCKED;
+
+
+static inline unsigned int __hashval(nid_t nid)
+{
+	return (nid % NX_HASH_SIZE);
+}
+
+
+
+/*	__hash_nx_info()
+
+	* add the nxi to the global hash table
+	* requires the hash_lock to be held			*/
+
+static inline void __hash_nx_info(struct nx_info *nxi)
+{
+	struct hlist_head *head;
+
+	vxd_assert_lock(&nx_info_hash_lock);
+	vxdprintk(VXD_CBIT(nid, 4),
+		"__hash_nx_info: %p[#%d]", nxi, nxi->nx_id);
+
+	/* context must not be hashed */
+	BUG_ON(nx_info_state(nxi, NXS_HASHED));
+
+	nxi->nx_state |= NXS_HASHED;
+	head = &nx_info_hash[__hashval(nxi->nx_id)];
+	hlist_add_head(&nxi->nx_hlist, head);
+	atomic_inc(&nx_global_cactive);
+}
+
+/*	__unhash_nx_info()
+
+	* remove the nxi from the global hash table
+	* requires the hash_lock to be held			*/
+
+static inline void __unhash_nx_info(struct nx_info *nxi)
+{
+	vxd_assert_lock(&nx_info_hash_lock);
+	vxdprintk(VXD_CBIT(nid, 4),
+		"__unhash_nx_info: %p[#%d.%d.%d]", nxi, nxi->nx_id,
+		atomic_read(&nxi->nx_usecnt), atomic_read(&nxi->nx_tasks));
+
+	/* context must be hashed */
+	BUG_ON(!nx_info_state(nxi, NXS_HASHED));
+	/* but without tasks */
+	BUG_ON(atomic_read(&nxi->nx_tasks));
+
+	nxi->nx_state &= ~NXS_HASHED;
+	hlist_del(&nxi->nx_hlist);
+	atomic_dec(&nx_global_cactive);
+}
+
+
+/*	__lookup_nx_info()
+
+	* requires the hash_lock to be held
+	* doesn't increment the nx_refcnt			*/
+
+static inline struct nx_info *__lookup_nx_info(nid_t nid)
+{
+	struct hlist_head *head = &nx_info_hash[__hashval(nid)];
+	struct hlist_node *pos;
+	struct nx_info *nxi;
+
+	vxd_assert_lock(&nx_info_hash_lock);
+	hlist_for_each(pos, head) {
+		nxi = hlist_entry(pos, struct nx_info, nx_hlist);
+
+		if (nxi->nx_id == nid)
+			goto found;
+	}
+	nxi = NULL;
+found:
+	vxdprintk(VXD_CBIT(nid, 0),
+		"__lookup_nx_info(#%u): %p[#%u]",
+		nid, nxi, nxi ? nxi->nx_id : 0);
+	return nxi;
+}
+
+
+/*	__create_nx_info()
+
+	* create the requested context
+	* get(), claim() and hash it				*/
+
+static struct nx_info *__create_nx_info(int id)
+{
+	struct nx_info *new, *nxi = NULL;
+
+	vxdprintk(VXD_CBIT(nid, 1), "create_nx_info(%d)*", id);
+
+	if (!(new = __alloc_nx_info(id)))
+		return ERR_PTR(-ENOMEM);
+
+	/* required to make dynamic xids unique */
+	spin_lock(&nx_info_hash_lock);
+
+	/* static context requested */
+	if ((nxi = __lookup_nx_info(id))) {
+		vxdprintk(VXD_CBIT(nid, 0),
+			"create_nx_info(%d) = %p (already there)", id, nxi);
+		if (nx_info_flags(nxi, NXF_STATE_SETUP, 0))
+			nxi = ERR_PTR(-EBUSY);
+		else
+			nxi = ERR_PTR(-EEXIST);
+		goto out_unlock;
+	}
+	/* new context */
+	vxdprintk(VXD_CBIT(nid, 0),
+		"create_nx_info(%d) = %p (new)", id, new);
+	claim_nx_info(new, NULL);
+	__nx_set_lback(new);
+	__hash_nx_info(get_nx_info(new));
+	nxi = new, new = NULL;
+
+out_unlock:
+	spin_unlock(&nx_info_hash_lock);
+	if (new)
+		__dealloc_nx_info(new);
+	return nxi;
+}
+
+
+
+/*	exported stuff						*/
+
+
+void unhash_nx_info(struct nx_info *nxi)
+{
+	__shutdown_nx_info(nxi);
+	spin_lock(&nx_info_hash_lock);
+	__unhash_nx_info(nxi);
+	spin_unlock(&nx_info_hash_lock);
+}
+
+/*	lookup_nx_info()
+
+	* search for a nx_info and get() it
+	* negative id means current				*/
+
+struct nx_info *lookup_nx_info(int id)
+{
+	struct nx_info *nxi = NULL;
+
+	if (id < 0) {
+		nxi = get_nx_info(current_nx_info());
+	} else if (id > 1) {
+		spin_lock(&nx_info_hash_lock);
+		nxi = get_nx_info(__lookup_nx_info(id));
+		spin_unlock(&nx_info_hash_lock);
+	}
+	return nxi;
+}
+
+/*	nid_is_hashed()
+
+	* verify that nid is still hashed			*/
+
+int nid_is_hashed(nid_t nid)
+{
+	int hashed;
+
+	spin_lock(&nx_info_hash_lock);
+	hashed = (__lookup_nx_info(nid) != NULL);
+	spin_unlock(&nx_info_hash_lock);
+	return hashed;
+}
+
+
+#ifdef	CONFIG_PROC_FS
+
+/*	get_nid_list()
+
+	* get a subset of hashed nids for proc
+	* assumes size is at least one				*/
+
+int get_nid_list(int index, unsigned int *nids, int size)
+{
+	int hindex, nr_nids = 0;
+
+	/* only show current and children */
+	if (!nx_check(0, VS_ADMIN | VS_WATCH)) {
+		if (index > 0)
+			return 0;
+		nids[nr_nids] = nx_current_nid();
+		return 1;
+	}
+
+	for (hindex = 0; hindex < NX_HASH_SIZE; hindex++) {
+		struct hlist_head *head = &nx_info_hash[hindex];
+		struct hlist_node *pos;
+
+		spin_lock(&nx_info_hash_lock);
+		hlist_for_each(pos, head) {
+			struct nx_info *nxi;
+
+			if (--index > 0)
+				continue;
+
+			nxi = hlist_entry(pos, struct nx_info, nx_hlist);
+			nids[nr_nids] = nxi->nx_id;
+			if (++nr_nids >= size) {
+				spin_unlock(&nx_info_hash_lock);
+				goto out;
+			}
+		}
+		/* keep the lock time short */
+		spin_unlock(&nx_info_hash_lock);
+	}
+out:
+	return nr_nids;
+}
+#endif
+
+
+/*
+ *	migrate task to new network
+ *	gets nxi, puts old_nxi on change
+ */
+
+int nx_migrate_task(struct task_struct *p, struct nx_info *nxi)
+{
+	struct nx_info *old_nxi;
+	int ret = 0;
+
+	if (!p || !nxi)
+		BUG();
+
+	vxdprintk(VXD_CBIT(nid, 5),
+		"nx_migrate_task(%p,%p[#%d.%d.%d])",
+		p, nxi, nxi->nx_id,
+		atomic_read(&nxi->nx_usecnt),
+		atomic_read(&nxi->nx_tasks));
+
+	if (nx_info_flags(nxi, NXF_INFO_PRIVATE, 0) &&
+		!nx_info_flags(nxi, NXF_STATE_SETUP, 0))
+		return -EACCES;
+
+	if (nx_info_state(nxi, NXS_SHUTDOWN))
+		return -EFAULT;
+
+	/* maybe disallow this completely? */
+	old_nxi = task_get_nx_info(p);
+	if (old_nxi == nxi)
+		goto out;
+
+	task_lock(p);
+	if (old_nxi)
+		clr_nx_info(&p->nx_info);
+	claim_nx_info(nxi, p);
+	set_nx_info(&p->nx_info, nxi);
+	p->nid = nxi->nx_id;
+	task_unlock(p);
+
+	vxdprintk(VXD_CBIT(nid, 5),
+		"moved task %p into nxi:%p[#%d]",
+		p, nxi, nxi->nx_id);
+
+	if (old_nxi)
+		release_nx_info(old_nxi, p);
+	ret = 0;
+out:
+	put_nx_info(old_nxi);
+	return ret;
+}
+
+
+void nx_set_persistent(struct nx_info *nxi)
+{
+	vxdprintk(VXD_CBIT(nid, 6),
+		"nx_set_persistent(%p[#%d])", nxi, nxi->nx_id);
+
+	get_nx_info(nxi);
+	claim_nx_info(nxi, NULL);
+}
+
+void nx_clear_persistent(struct nx_info *nxi)
+{
+	vxdprintk(VXD_CBIT(nid, 6),
+		"nx_clear_persistent(%p[#%d])", nxi, nxi->nx_id);
+
+	release_nx_info(nxi, NULL);
+	put_nx_info(nxi);
+}
+
+void nx_update_persistent(struct nx_info *nxi)
+{
+	if (nx_info_flags(nxi, NXF_PERSISTENT, 0))
+		nx_set_persistent(nxi);
+	else
+		nx_clear_persistent(nxi);
+}
+
+/* vserver syscall commands below here */
+
+/* taks nid and nx_info functions */
+
+#include <asm/uaccess.h>
+
+
+int vc_task_nid(uint32_t id)
+{
+	nid_t nid;
+
+	if (id) {
+		struct task_struct *tsk;
+
+		read_lock(&tasklist_lock);
+		tsk = find_task_by_real_pid(id);
+		nid = (tsk) ? tsk->nid : -ESRCH;
+		read_unlock(&tasklist_lock);
+	} else
+		nid = nx_current_nid();
+	return nid;
+}
+
+
+int vc_nx_info(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_nx_info_v0 vc_data;
+
+	vc_data.nid = nxi->nx_id;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+
+/* network functions */
+
+int vc_net_create(uint32_t nid, void __user *data)
+{
+	struct vcmd_net_create vc_data = { .flagword = NXF_INIT_SET };
+	struct nx_info *new_nxi;
+	int ret;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	if ((nid > MAX_S_CONTEXT) || (nid < 2))
+		return -EINVAL;
+
+	new_nxi = __create_nx_info(nid);
+	if (IS_ERR(new_nxi))
+		return PTR_ERR(new_nxi);
+
+	/* initial flags */
+	new_nxi->nx_flags = vc_data.flagword;
+
+	ret = -ENOEXEC;
+	if (vs_net_change(new_nxi, VSC_NETUP))
+		goto out;
+
+	ret = nx_migrate_task(current, new_nxi);
+	if (ret)
+		goto out;
+
+	/* return context id on success */
+	ret = new_nxi->nx_id;
+
+	/* get a reference for persistent contexts */
+	if ((vc_data.flagword & NXF_PERSISTENT))
+		nx_set_persistent(new_nxi);
+out:
+	release_nx_info(new_nxi, NULL);
+	put_nx_info(new_nxi);
+	return ret;
+}
+
+
+int vc_net_migrate(struct nx_info *nxi, void __user *data)
+{
+	return nx_migrate_task(current, nxi);
+}
+
+
+
+int do_add_v4_addr(struct nx_info *nxi, __be32 ip, __be32 ip2, __be32 mask,
+	uint16_t type, uint16_t flags)
+{
+	struct nx_addr_v4 *nxa = &nxi->v4;
+
+	if (NX_IPV4(nxi)) {
+		/* locate last entry */
+		for (; nxa->next; nxa = nxa->next);
+		nxa->next = __alloc_nx_addr_v4();
+		nxa = nxa->next;
+
+		if (IS_ERR(nxa))
+			return PTR_ERR(nxa);
+	}
+
+	if (nxi->v4.next)
+		/* remove single ip for ip list */
+		nxi->nx_flags &= ~NXF_SINGLE_IP;
+
+	nxa->ip[0].s_addr = ip;
+	nxa->ip[1].s_addr = ip2;
+	nxa->mask.s_addr = mask;
+	nxa->type = type;
+	nxa->flags = flags;
+	return 0;
+}
+
+
+int vc_net_add(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_addr_v0 vc_data;
+	int index, ret = 0;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	switch (vc_data.type) {
+	case NXA_TYPE_IPV4:
+		if ((vc_data.count < 1) || (vc_data.count > 4))
+			return -EINVAL;
+
+		index = 0;
+		while (index < vc_data.count) {
+			ret = do_add_v4_addr(nxi, vc_data.ip[index].s_addr, 0,
+				vc_data.mask[index].s_addr, NXA_TYPE_ADDR, 0);
+			if (ret)
+				return ret;
+			index++;
+		}
+		ret = index;
+		break;
+
+	case NXA_TYPE_IPV4|NXA_MOD_BCAST:
+		nxi->v4_bcast = vc_data.ip[0];
+		ret = 1;
+		break;
+
+	case NXA_TYPE_IPV4|NXA_MOD_LBACK:
+		nxi->v4_lback = vc_data.ip[0];
+		ret = 1;
+		break;
+
+	default:
+		ret = -EINVAL;
+		break;
+	}
+	return ret;
+}
+
+int vc_net_remove(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_addr_v0 vc_data;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	switch (vc_data.type) {
+	case NXA_TYPE_ANY:
+		__dealloc_nx_addr_v4_all(xchg(&nxi->v4.next, NULL));
+		memset(&nxi->v4, 0, sizeof(nxi->v4));
+		break;
+
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+
+int vc_net_add_ipv4(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_addr_ipv4_v1 vc_data;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	switch (vc_data.type) {
+	case NXA_TYPE_ADDR:
+	case NXA_TYPE_RANGE:
+	case NXA_TYPE_MASK:
+		return do_add_v4_addr(nxi, vc_data.ip.s_addr, 0,
+			vc_data.mask.s_addr, vc_data.type, vc_data.flags);
+
+	case NXA_TYPE_ADDR | NXA_MOD_BCAST:
+		nxi->v4_bcast = vc_data.ip;
+		break;
+
+	case NXA_TYPE_ADDR | NXA_MOD_LBACK:
+		nxi->v4_lback = vc_data.ip;
+		break;
+
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int vc_net_remove_ipv4(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_addr_ipv4_v1 vc_data;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	switch (vc_data.type) {
+/*	case NXA_TYPE_ADDR:
+		break;		*/
+
+	case NXA_TYPE_ANY:
+		__dealloc_nx_addr_v4_all(xchg(&nxi->v4.next, NULL));
+		memset(&nxi->v4, 0, sizeof(nxi->v4));
+		break;
+
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+
+#ifdef CONFIG_IPV6
+
+int do_add_v6_addr(struct nx_info *nxi,
+	struct in6_addr *ip, struct in6_addr *mask,
+	uint32_t prefix, uint16_t type, uint16_t flags)
+{
+	struct nx_addr_v6 *nxa = &nxi->v6;
+
+	if (NX_IPV6(nxi)) {
+		/* locate last entry */
+		for (; nxa->next; nxa = nxa->next);
+		nxa->next = __alloc_nx_addr_v6();
+		nxa = nxa->next;
+
+		if (IS_ERR(nxa))
+			return PTR_ERR(nxa);
+	}
+
+	nxa->ip = *ip;
+	nxa->mask = *mask;
+	nxa->prefix = prefix;
+	nxa->type = type;
+	nxa->flags = flags;
+	return 0;
+}
+
+
+int vc_net_add_ipv6(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_addr_ipv6_v1 vc_data;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	switch (vc_data.type) {
+	case NXA_TYPE_ADDR:
+	case NXA_TYPE_MASK:
+		return do_add_v6_addr(nxi, &vc_data.ip, &vc_data.mask,
+			vc_data.prefix, vc_data.type, vc_data.flags);
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+int vc_net_remove_ipv6(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_addr_ipv6_v1 vc_data;
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	switch (vc_data.type) {
+	case NXA_TYPE_ANY:
+		__dealloc_nx_addr_v6_all(xchg(&nxi->v6.next, NULL));
+		memset(&nxi->v6, 0, sizeof(nxi->v6));
+		break;
+
+	default:
+		return -EINVAL;
+	}
+	return 0;
+}
+
+#endif	/* CONFIG_IPV6 */
+
+
+int vc_get_nflags(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_flags_v0 vc_data;
+
+	vc_data.flagword = nxi->nx_flags;
+
+	/* special STATE flag handling */
+	vc_data.mask = vs_mask_flags(~0ULL, nxi->nx_flags, NXF_ONE_TIME);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+int vc_set_nflags(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_flags_v0 vc_data;
+	uint64_t mask, trigger;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	/* special STATE flag handling */
+	mask = vs_mask_mask(vc_data.mask, nxi->nx_flags, NXF_ONE_TIME);
+	trigger = (mask & nxi->nx_flags) ^ (mask & vc_data.flagword);
+
+	nxi->nx_flags = vs_mask_flags(nxi->nx_flags,
+		vc_data.flagword, mask);
+	if (trigger & NXF_PERSISTENT)
+		nx_update_persistent(nxi);
+
+	return 0;
+}
+
+int vc_get_ncaps(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_caps_v0 vc_data;
+
+	vc_data.ncaps = nxi->nx_ncaps;
+	vc_data.cmask = ~0ULL;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+int vc_set_ncaps(struct nx_info *nxi, void __user *data)
+{
+	struct vcmd_net_caps_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	nxi->nx_ncaps = vs_mask_flags(nxi->nx_ncaps,
+		vc_data.ncaps, vc_data.cmask);
+	return 0;
+}
+
+
+#include <linux/module.h>
+
+module_init(init_network);
+
+EXPORT_SYMBOL_GPL(free_nx_info);
+EXPORT_SYMBOL_GPL(unhash_nx_info);
+
diff -uriN linux-2.6.32.43/kernel/vserver/proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/proc.c
--- linux-2.6.32.43/kernel/vserver/proc.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/proc.c	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,1098 @@
+/*
+ *  linux/kernel/vserver/proc.c
+ *
+ *  Virtual Context Support
+ *
+ *  Copyright (C) 2003-2007  Herbert Pötzl
+ *
+ *  V0.01  basic structure
+ *  V0.02  adaptation vs1.3.0
+ *  V0.03  proc permissions
+ *  V0.04  locking/generic
+ *  V0.05  next generation procfs
+ *  V0.06  inode validation
+ *  V0.07  generic rewrite vid
+ *  V0.08  remove inode type
+ *
+ */
+
+#include <linux/proc_fs.h>
+#include <linux/fs_struct.h>
+#include <linux/mount.h>
+#include <asm/unistd.h>
+
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
+#include <linux/vs_cvirt.h>
+
+#include <linux/in.h>
+#include <linux/inetdevice.h>
+#include <linux/vs_inet.h>
+#include <linux/vs_inet6.h>
+
+#include <linux/vserver/global.h>
+
+#include "cvirt_proc.h"
+#include "cacct_proc.h"
+#include "limit_proc.h"
+#include "sched_proc.h"
+#include "vci_config.h"
+
+
+static inline char *print_cap_t(char *buffer, kernel_cap_t *c)
+{
+	unsigned __capi;
+
+	CAP_FOR_EACH_U32(__capi) {
+		buffer += sprintf(buffer, "%08x",
+			c->cap[(_KERNEL_CAPABILITY_U32S-1) - __capi]);
+	}
+	return buffer;
+}
+
+
+static struct proc_dir_entry *proc_virtual;
+
+static struct proc_dir_entry *proc_virtnet;
+
+
+/* first the actual feeds */
+
+
+static int proc_vci(char *buffer)
+{
+	return sprintf(buffer,
+		"VCIVersion:\t%04x:%04x\n"
+		"VCISyscall:\t%d\n"
+		"VCIKernel:\t%08x\n",
+		VCI_VERSION >> 16,
+		VCI_VERSION & 0xFFFF,
+		__NR_vserver,
+		vci_kernel_config());
+}
+
+static int proc_virtual_info(char *buffer)
+{
+	return proc_vci(buffer);
+}
+
+static int proc_virtual_status(char *buffer)
+{
+	return sprintf(buffer,
+		"#CTotal:\t%d\n"
+		"#CActive:\t%d\n"
+		"#NSProxy:\t%d\t%d %d %d %d %d %d\n"
+		"#InitTask:\t%d\t%d %d\n",
+		atomic_read(&vx_global_ctotal),
+		atomic_read(&vx_global_cactive),
+		atomic_read(&vs_global_nsproxy),
+		atomic_read(&vs_global_fs),
+		atomic_read(&vs_global_mnt_ns),
+		atomic_read(&vs_global_uts_ns),
+		atomic_read(&nr_ipc_ns),
+		atomic_read(&vs_global_user_ns),
+		atomic_read(&vs_global_pid_ns),
+		atomic_read(&init_task.usage),
+		atomic_read(&init_task.nsproxy->count),
+		atomic_read(&init_task.fs->users));
+}
+
+
+int proc_vxi_info(struct vx_info *vxi, char *buffer)
+{
+	int length;
+
+	length = sprintf(buffer,
+		"ID:\t%d\n"
+		"Info:\t%p\n"
+		"Init:\t%d\n"
+		"OOM:\t%lld\n",
+		vxi->vx_id,
+		vxi,
+		vxi->vx_initpid,
+		vxi->vx_badness_bias);
+	return length;
+}
+
+int proc_vxi_status(struct vx_info *vxi, char *buffer)
+{
+	char *orig = buffer;
+
+	buffer += sprintf(buffer,
+		"UseCnt:\t%d\n"
+		"Tasks:\t%d\n"
+		"Flags:\t%016llx\n",
+		atomic_read(&vxi->vx_usecnt),
+		atomic_read(&vxi->vx_tasks),
+		(unsigned long long)vxi->vx_flags);
+
+	buffer += sprintf(buffer, "BCaps:\t");
+	buffer = print_cap_t(buffer, &vxi->vx_bcaps);
+	buffer += sprintf(buffer, "\n");
+
+	buffer += sprintf(buffer,
+		"CCaps:\t%016llx\n"
+		"Spaces:\t%08lx %08lx\n",
+		(unsigned long long)vxi->vx_ccaps,
+		vxi->vx_nsmask[0], vxi->vx_nsmask[1]);
+	return buffer - orig;
+}
+
+int proc_vxi_limit(struct vx_info *vxi, char *buffer)
+{
+	return vx_info_proc_limit(&vxi->limit, buffer);
+}
+
+int proc_vxi_sched(struct vx_info *vxi, char *buffer)
+{
+	int cpu, length;
+
+	length = vx_info_proc_sched(&vxi->sched, buffer);
+	for_each_online_cpu(cpu) {
+		length += vx_info_proc_sched_pc(
+			&vx_per_cpu(vxi, sched_pc, cpu),
+			buffer + length, cpu);
+	}
+	return length;
+}
+
+int proc_vxi_nsproxy0(struct vx_info *vxi, char *buffer)
+{
+	return vx_info_proc_nsproxy(vxi->vx_nsproxy[0], buffer);
+}
+
+int proc_vxi_nsproxy1(struct vx_info *vxi, char *buffer)
+{
+	return vx_info_proc_nsproxy(vxi->vx_nsproxy[1], buffer);
+}
+
+int proc_vxi_cvirt(struct vx_info *vxi, char *buffer)
+{
+	int cpu, length;
+
+	vx_update_load(vxi);
+	length = vx_info_proc_cvirt(&vxi->cvirt, buffer);
+	for_each_online_cpu(cpu) {
+		length += vx_info_proc_cvirt_pc(
+			&vx_per_cpu(vxi, cvirt_pc, cpu),
+			buffer + length, cpu);
+	}
+	return length;
+}
+
+int proc_vxi_cacct(struct vx_info *vxi, char *buffer)
+{
+	return vx_info_proc_cacct(&vxi->cacct, buffer);
+}
+
+
+static int proc_virtnet_info(char *buffer)
+{
+	return proc_vci(buffer);
+}
+
+static int proc_virtnet_status(char *buffer)
+{
+	return sprintf(buffer,
+		"#CTotal:\t%d\n"
+		"#CActive:\t%d\n",
+		atomic_read(&nx_global_ctotal),
+		atomic_read(&nx_global_cactive));
+}
+
+int proc_nxi_info(struct nx_info *nxi, char *buffer)
+{
+	struct nx_addr_v4 *v4a;
+#ifdef	CONFIG_IPV6
+	struct nx_addr_v6 *v6a;
+#endif
+	int length, i;
+
+	length = sprintf(buffer,
+		"ID:\t%d\n"
+		"Info:\t%p\n"
+		"Bcast:\t" NIPQUAD_FMT "\n"
+		"Lback:\t" NIPQUAD_FMT "\n",
+		nxi->nx_id,
+		nxi,
+		NIPQUAD(nxi->v4_bcast.s_addr),
+		NIPQUAD(nxi->v4_lback.s_addr));
+
+	if (!NX_IPV4(nxi))
+		goto skip_v4;
+	for (i = 0, v4a = &nxi->v4; v4a; i++, v4a = v4a->next)
+		length += sprintf(buffer + length, "%d:\t" NXAV4_FMT "\n",
+			i, NXAV4(v4a));
+skip_v4:
+#ifdef	CONFIG_IPV6
+	if (!NX_IPV6(nxi))
+		goto skip_v6;
+	for (i = 0, v6a = &nxi->v6; v6a; i++, v6a = v6a->next)
+		length += sprintf(buffer + length, "%d:\t" NXAV6_FMT "\n",
+			i, NXAV6(v6a));
+skip_v6:
+#endif
+	return length;
+}
+
+int proc_nxi_status(struct nx_info *nxi, char *buffer)
+{
+	int length;
+
+	length = sprintf(buffer,
+		"UseCnt:\t%d\n"
+		"Tasks:\t%d\n"
+		"Flags:\t%016llx\n"
+		"NCaps:\t%016llx\n",
+		atomic_read(&nxi->nx_usecnt),
+		atomic_read(&nxi->nx_tasks),
+		(unsigned long long)nxi->nx_flags,
+		(unsigned long long)nxi->nx_ncaps);
+	return length;
+}
+
+
+
+/* here the inode helpers */
+
+struct vs_entry {
+	int len;
+	char *name;
+	mode_t mode;
+	struct inode_operations *iop;
+	struct file_operations *fop;
+	union proc_op op;
+};
+
+static struct inode *vs_proc_make_inode(struct super_block *sb, struct vs_entry *p)
+{
+	struct inode *inode = new_inode(sb);
+
+	if (!inode)
+		goto out;
+
+	inode->i_mode = p->mode;
+	if (p->iop)
+		inode->i_op = p->iop;
+	if (p->fop)
+		inode->i_fop = p->fop;
+
+	inode->i_nlink = (p->mode & S_IFDIR) ? 2 : 1;
+	inode->i_flags |= S_IMMUTABLE;
+
+	inode->i_mtime = inode->i_atime = inode->i_ctime = CURRENT_TIME;
+
+	inode->i_uid = 0;
+	inode->i_gid = 0;
+	inode->i_tag = 0;
+out:
+	return inode;
+}
+
+static struct dentry *vs_proc_instantiate(struct inode *dir,
+	struct dentry *dentry, int id, void *ptr)
+{
+	struct vs_entry *p = ptr;
+	struct inode *inode = vs_proc_make_inode(dir->i_sb, p);
+	struct dentry *error = ERR_PTR(-EINVAL);
+
+	if (!inode)
+		goto out;
+
+	PROC_I(inode)->op = p->op;
+	PROC_I(inode)->fd = id;
+	d_add(dentry, inode);
+	error = NULL;
+out:
+	return error;
+}
+
+/* Lookups */
+
+typedef struct dentry *instantiate_t(struct inode *, struct dentry *, int, void *);
+
+/*
+ * Fill a directory entry.
+ *
+ * If possible create the dcache entry and derive our inode number and
+ * file type from dcache entry.
+ *
+ * Since all of the proc inode numbers are dynamically generated, the inode
+ * numbers do not exist until the inode is cache.  This means creating the
+ * the dcache entry in readdir is necessary to keep the inode numbers
+ * reported by readdir in sync with the inode numbers reported
+ * by stat.
+ */
+static int proc_fill_cache(struct file *filp, void *dirent, filldir_t filldir,
+	char *name, int len, instantiate_t instantiate, int id, void *ptr)
+{
+	struct dentry *child, *dir = filp->f_dentry;
+	struct inode *inode;
+	struct qstr qname;
+	ino_t ino = 0;
+	unsigned type = DT_UNKNOWN;
+
+	qname.name = name;
+	qname.len  = len;
+	qname.hash = full_name_hash(name, len);
+
+	child = d_lookup(dir, &qname);
+	if (!child) {
+		struct dentry *new;
+		new = d_alloc(dir, &qname);
+		if (new) {
+			child = instantiate(dir->d_inode, new, id, ptr);
+			if (child)
+				dput(new);
+			else
+				child = new;
+		}
+	}
+	if (!child || IS_ERR(child) || !child->d_inode)
+		goto end_instantiate;
+	inode = child->d_inode;
+	if (inode) {
+		ino = inode->i_ino;
+		type = inode->i_mode >> 12;
+	}
+	dput(child);
+end_instantiate:
+	if (!ino)
+		ino = find_inode_number(dir, &qname);
+	if (!ino)
+		ino = 1;
+	return filldir(dirent, name, len, filp->f_pos, ino, type);
+}
+
+
+
+/* get and revalidate vx_info/xid */
+
+static inline
+struct vx_info *get_proc_vx_info(struct inode *inode)
+{
+	return lookup_vx_info(PROC_I(inode)->fd);
+}
+
+static int proc_xid_revalidate(struct dentry *dentry, struct nameidata *nd)
+{
+	struct inode *inode = dentry->d_inode;
+	xid_t xid = PROC_I(inode)->fd;
+
+	if (!xid || xid_is_hashed(xid))
+		return 1;
+	d_drop(dentry);
+	return 0;
+}
+
+
+/* get and revalidate nx_info/nid */
+
+static int proc_nid_revalidate(struct dentry *dentry, struct nameidata *nd)
+{
+	struct inode *inode = dentry->d_inode;
+	nid_t nid = PROC_I(inode)->fd;
+
+	if (!nid || nid_is_hashed(nid))
+		return 1;
+	d_drop(dentry);
+	return 0;
+}
+
+
+
+#define PROC_BLOCK_SIZE (PAGE_SIZE - 1024)
+
+static ssize_t proc_vs_info_read(struct file *file, char __user *buf,
+			  size_t count, loff_t *ppos)
+{
+	struct inode *inode = file->f_dentry->d_inode;
+	unsigned long page;
+	ssize_t length = 0;
+
+	if (count > PROC_BLOCK_SIZE)
+		count = PROC_BLOCK_SIZE;
+
+	/* fade that out as soon as stable */
+	WARN_ON(PROC_I(inode)->fd);
+
+	if (!(page = __get_free_page(GFP_KERNEL)))
+		return -ENOMEM;
+
+	BUG_ON(!PROC_I(inode)->op.proc_vs_read);
+	length = PROC_I(inode)->op.proc_vs_read((char *)page);
+
+	if (length >= 0)
+		length = simple_read_from_buffer(buf, count, ppos,
+			(char *)page, length);
+
+	free_page(page);
+	return length;
+}
+
+static ssize_t proc_vx_info_read(struct file *file, char __user *buf,
+			  size_t count, loff_t *ppos)
+{
+	struct inode *inode = file->f_dentry->d_inode;
+	struct vx_info *vxi = NULL;
+	xid_t xid = PROC_I(inode)->fd;
+	unsigned long page;
+	ssize_t length = 0;
+
+	if (count > PROC_BLOCK_SIZE)
+		count = PROC_BLOCK_SIZE;
+
+	/* fade that out as soon as stable */
+	WARN_ON(!xid);
+	vxi = lookup_vx_info(xid);
+	if (!vxi)
+		goto out;
+
+	length = -ENOMEM;
+	if (!(page = __get_free_page(GFP_KERNEL)))
+		goto out_put;
+
+	BUG_ON(!PROC_I(inode)->op.proc_vxi_read);
+	length = PROC_I(inode)->op.proc_vxi_read(vxi, (char *)page);
+
+	if (length >= 0)
+		length = simple_read_from_buffer(buf, count, ppos,
+			(char *)page, length);
+
+	free_page(page);
+out_put:
+	put_vx_info(vxi);
+out:
+	return length;
+}
+
+static ssize_t proc_nx_info_read(struct file *file, char __user *buf,
+			  size_t count, loff_t *ppos)
+{
+	struct inode *inode = file->f_dentry->d_inode;
+	struct nx_info *nxi = NULL;
+	nid_t nid = PROC_I(inode)->fd;
+	unsigned long page;
+	ssize_t length = 0;
+
+	if (count > PROC_BLOCK_SIZE)
+		count = PROC_BLOCK_SIZE;
+
+	/* fade that out as soon as stable */
+	WARN_ON(!nid);
+	nxi = lookup_nx_info(nid);
+	if (!nxi)
+		goto out;
+
+	length = -ENOMEM;
+	if (!(page = __get_free_page(GFP_KERNEL)))
+		goto out_put;
+
+	BUG_ON(!PROC_I(inode)->op.proc_nxi_read);
+	length = PROC_I(inode)->op.proc_nxi_read(nxi, (char *)page);
+
+	if (length >= 0)
+		length = simple_read_from_buffer(buf, count, ppos,
+			(char *)page, length);
+
+	free_page(page);
+out_put:
+	put_nx_info(nxi);
+out:
+	return length;
+}
+
+
+
+/* here comes the lower level */
+
+
+#define NOD(NAME, MODE, IOP, FOP, OP) {	\
+	.len  = sizeof(NAME) - 1,	\
+	.name = (NAME),			\
+	.mode = MODE,			\
+	.iop  = IOP,			\
+	.fop  = FOP,			\
+	.op   = OP,			\
+}
+
+
+#define DIR(NAME, MODE, OTYPE)				\
+	NOD(NAME, (S_IFDIR | (MODE)),			\
+		&proc_ ## OTYPE ## _inode_operations,	\
+		&proc_ ## OTYPE ## _file_operations, { } )
+
+#define INF(NAME, MODE, OTYPE)				\
+	NOD(NAME, (S_IFREG | (MODE)), NULL,		\
+		&proc_vs_info_file_operations,		\
+		{ .proc_vs_read = &proc_##OTYPE } )
+
+#define VINF(NAME, MODE, OTYPE)				\
+	NOD(NAME, (S_IFREG | (MODE)), NULL,		\
+		&proc_vx_info_file_operations,		\
+		{ .proc_vxi_read = &proc_##OTYPE } )
+
+#define NINF(NAME, MODE, OTYPE)				\
+	NOD(NAME, (S_IFREG | (MODE)), NULL,		\
+		&proc_nx_info_file_operations,		\
+		{ .proc_nxi_read = &proc_##OTYPE } )
+
+
+static struct file_operations proc_vs_info_file_operations = {
+	.read =		proc_vs_info_read,
+};
+
+static struct file_operations proc_vx_info_file_operations = {
+	.read =		proc_vx_info_read,
+};
+
+static struct dentry_operations proc_xid_dentry_operations = {
+	.d_revalidate =	proc_xid_revalidate,
+};
+
+static struct vs_entry vx_base_stuff[] = {
+	VINF("info",	S_IRUGO, vxi_info),
+	VINF("status",	S_IRUGO, vxi_status),
+	VINF("limit",	S_IRUGO, vxi_limit),
+	VINF("sched",	S_IRUGO, vxi_sched),
+	VINF("nsproxy",	S_IRUGO, vxi_nsproxy0),
+	VINF("nsproxy1",S_IRUGO, vxi_nsproxy1),
+	VINF("cvirt",	S_IRUGO, vxi_cvirt),
+	VINF("cacct",	S_IRUGO, vxi_cacct),
+	{}
+};
+
+
+
+
+static struct dentry *proc_xid_instantiate(struct inode *dir,
+	struct dentry *dentry, int id, void *ptr)
+{
+	dentry->d_op = &proc_xid_dentry_operations;
+	return vs_proc_instantiate(dir, dentry, id, ptr);
+}
+
+static struct dentry *proc_xid_lookup(struct inode *dir,
+	struct dentry *dentry, struct nameidata *nd)
+{
+	struct vs_entry *p = vx_base_stuff;
+	struct dentry *error = ERR_PTR(-ENOENT);
+
+	for (; p->name; p++) {
+		if (p->len != dentry->d_name.len)
+			continue;
+		if (!memcmp(dentry->d_name.name, p->name, p->len))
+			break;
+	}
+	if (!p->name)
+		goto out;
+
+	error = proc_xid_instantiate(dir, dentry, PROC_I(dir)->fd, p);
+out:
+	return error;
+}
+
+static int proc_xid_readdir(struct file *filp,
+	void *dirent, filldir_t filldir)
+{
+	struct dentry *dentry = filp->f_dentry;
+	struct inode *inode = dentry->d_inode;
+	struct vs_entry *p = vx_base_stuff;
+	int size = sizeof(vx_base_stuff) / sizeof(struct vs_entry);
+	int pos, index;
+	u64 ino;
+
+	pos = filp->f_pos;
+	switch (pos) {
+	case 0:
+		ino = inode->i_ino;
+		if (filldir(dirent, ".", 1, pos, ino, DT_DIR) < 0)
+			goto out;
+		pos++;
+		/* fall through */
+	case 1:
+		ino = parent_ino(dentry);
+		if (filldir(dirent, "..", 2, pos, ino, DT_DIR) < 0)
+			goto out;
+		pos++;
+		/* fall through */
+	default:
+		index = pos - 2;
+		if (index >= size)
+			goto out;
+		for (p += index; p->name; p++) {
+			if (proc_fill_cache(filp, dirent, filldir, p->name, p->len,
+				vs_proc_instantiate, PROC_I(inode)->fd, p))
+				goto out;
+			pos++;
+		}
+	}
+out:
+	filp->f_pos = pos;
+	return 1;
+}
+
+
+
+static struct file_operations proc_nx_info_file_operations = {
+	.read =		proc_nx_info_read,
+};
+
+static struct dentry_operations proc_nid_dentry_operations = {
+	.d_revalidate =	proc_nid_revalidate,
+};
+
+static struct vs_entry nx_base_stuff[] = {
+	NINF("info",	S_IRUGO, nxi_info),
+	NINF("status",	S_IRUGO, nxi_status),
+	{}
+};
+
+
+static struct dentry *proc_nid_instantiate(struct inode *dir,
+	struct dentry *dentry, int id, void *ptr)
+{
+	dentry->d_op = &proc_nid_dentry_operations;
+	return vs_proc_instantiate(dir, dentry, id, ptr);
+}
+
+static struct dentry *proc_nid_lookup(struct inode *dir,
+	struct dentry *dentry, struct nameidata *nd)
+{
+	struct vs_entry *p = nx_base_stuff;
+	struct dentry *error = ERR_PTR(-ENOENT);
+
+	for (; p->name; p++) {
+		if (p->len != dentry->d_name.len)
+			continue;
+		if (!memcmp(dentry->d_name.name, p->name, p->len))
+			break;
+	}
+	if (!p->name)
+		goto out;
+
+	error = proc_nid_instantiate(dir, dentry, PROC_I(dir)->fd, p);
+out:
+	return error;
+}
+
+static int proc_nid_readdir(struct file *filp,
+	void *dirent, filldir_t filldir)
+{
+	struct dentry *dentry = filp->f_dentry;
+	struct inode *inode = dentry->d_inode;
+	struct vs_entry *p = nx_base_stuff;
+	int size = sizeof(nx_base_stuff) / sizeof(struct vs_entry);
+	int pos, index;
+	u64 ino;
+
+	pos = filp->f_pos;
+	switch (pos) {
+	case 0:
+		ino = inode->i_ino;
+		if (filldir(dirent, ".", 1, pos, ino, DT_DIR) < 0)
+			goto out;
+		pos++;
+		/* fall through */
+	case 1:
+		ino = parent_ino(dentry);
+		if (filldir(dirent, "..", 2, pos, ino, DT_DIR) < 0)
+			goto out;
+		pos++;
+		/* fall through */
+	default:
+		index = pos - 2;
+		if (index >= size)
+			goto out;
+		for (p += index; p->name; p++) {
+			if (proc_fill_cache(filp, dirent, filldir, p->name, p->len,
+				vs_proc_instantiate, PROC_I(inode)->fd, p))
+				goto out;
+			pos++;
+		}
+	}
+out:
+	filp->f_pos = pos;
+	return 1;
+}
+
+
+#define MAX_MULBY10	((~0U - 9) / 10)
+
+static inline int atovid(const char *str, int len)
+{
+	int vid, c;
+
+	vid = 0;
+	while (len-- > 0) {
+		c = *str - '0';
+		str++;
+		if (c > 9)
+			return -1;
+		if (vid >= MAX_MULBY10)
+			return -1;
+		vid *= 10;
+		vid += c;
+		if (!vid)
+			return -1;
+	}
+	return vid;
+}
+
+/* now the upper level (virtual) */
+
+
+static struct file_operations proc_xid_file_operations = {
+	.read =		generic_read_dir,
+	.readdir =	proc_xid_readdir,
+};
+
+static struct inode_operations proc_xid_inode_operations = {
+	.lookup =	proc_xid_lookup,
+};
+
+static struct vs_entry vx_virtual_stuff[] = {
+	INF("info",	S_IRUGO, virtual_info),
+	INF("status",	S_IRUGO, virtual_status),
+	DIR(NULL,	S_IRUGO | S_IXUGO, xid),
+};
+
+
+static struct dentry *proc_virtual_lookup(struct inode *dir,
+	struct dentry *dentry, struct nameidata *nd)
+{
+	struct vs_entry *p = vx_virtual_stuff;
+	struct dentry *error = ERR_PTR(-ENOENT);
+	int id = 0;
+
+	for (; p->name; p++) {
+		if (p->len != dentry->d_name.len)
+			continue;
+		if (!memcmp(dentry->d_name.name, p->name, p->len))
+			break;
+	}
+	if (p->name)
+		goto instantiate;
+
+	id = atovid(dentry->d_name.name, dentry->d_name.len);
+	if ((id < 0) || !xid_is_hashed(id))
+		goto out;
+
+instantiate:
+	error = proc_xid_instantiate(dir, dentry, id, p);
+out:
+	return error;
+}
+
+static struct file_operations proc_nid_file_operations = {
+	.read =		generic_read_dir,
+	.readdir =	proc_nid_readdir,
+};
+
+static struct inode_operations proc_nid_inode_operations = {
+	.lookup =	proc_nid_lookup,
+};
+
+static struct vs_entry nx_virtnet_stuff[] = {
+	INF("info",	S_IRUGO, virtnet_info),
+	INF("status",	S_IRUGO, virtnet_status),
+	DIR(NULL,	S_IRUGO | S_IXUGO, nid),
+};
+
+
+static struct dentry *proc_virtnet_lookup(struct inode *dir,
+	struct dentry *dentry, struct nameidata *nd)
+{
+	struct vs_entry *p = nx_virtnet_stuff;
+	struct dentry *error = ERR_PTR(-ENOENT);
+	int id = 0;
+
+	for (; p->name; p++) {
+		if (p->len != dentry->d_name.len)
+			continue;
+		if (!memcmp(dentry->d_name.name, p->name, p->len))
+			break;
+	}
+	if (p->name)
+		goto instantiate;
+
+	id = atovid(dentry->d_name.name, dentry->d_name.len);
+	if ((id < 0) || !nid_is_hashed(id))
+		goto out;
+
+instantiate:
+	error = proc_nid_instantiate(dir, dentry, id, p);
+out:
+	return error;
+}
+
+
+#define PROC_MAXVIDS 32
+
+int proc_virtual_readdir(struct file *filp,
+	void *dirent, filldir_t filldir)
+{
+	struct dentry *dentry = filp->f_dentry;
+	struct inode *inode = dentry->d_inode;
+	struct vs_entry *p = vx_virtual_stuff;
+	int size = sizeof(vx_virtual_stuff) / sizeof(struct vs_entry);
+	int pos, index;
+	unsigned int xid_array[PROC_MAXVIDS];
+	char buf[PROC_NUMBUF];
+	unsigned int nr_xids, i;
+	u64 ino;
+
+	pos = filp->f_pos;
+	switch (pos) {
+	case 0:
+		ino = inode->i_ino;
+		if (filldir(dirent, ".", 1, pos, ino, DT_DIR) < 0)
+			goto out;
+		pos++;
+		/* fall through */
+	case 1:
+		ino = parent_ino(dentry);
+		if (filldir(dirent, "..", 2, pos, ino, DT_DIR) < 0)
+			goto out;
+		pos++;
+		/* fall through */
+	default:
+		index = pos - 2;
+		if (index >= size)
+			goto entries;
+		for (p += index; p->name; p++) {
+			if (proc_fill_cache(filp, dirent, filldir, p->name, p->len,
+				vs_proc_instantiate, 0, p))
+				goto out;
+			pos++;
+		}
+	entries:
+		index = pos - size;
+		p = &vx_virtual_stuff[size - 1];
+		nr_xids = get_xid_list(index, xid_array, PROC_MAXVIDS);
+		for (i = 0; i < nr_xids; i++) {
+			int n, xid = xid_array[i];
+			unsigned int j = PROC_NUMBUF;
+
+			n = xid;
+			do
+				buf[--j] = '0' + (n % 10);
+			while (n /= 10);
+
+			if (proc_fill_cache(filp, dirent, filldir,
+				buf + j, PROC_NUMBUF - j,
+				vs_proc_instantiate, xid, p))
+				goto out;
+			pos++;
+		}
+	}
+out:
+	filp->f_pos = pos;
+	return 0;
+}
+
+static int proc_virtual_getattr(struct vfsmount *mnt,
+	struct dentry *dentry, struct kstat *stat)
+{
+	struct inode *inode = dentry->d_inode;
+
+	generic_fillattr(inode, stat);
+	stat->nlink = 2 + atomic_read(&vx_global_cactive);
+	return 0;
+}
+
+static struct file_operations proc_virtual_dir_operations = {
+	.read =		generic_read_dir,
+	.readdir =	proc_virtual_readdir,
+};
+
+static struct inode_operations proc_virtual_dir_inode_operations = {
+	.getattr =	proc_virtual_getattr,
+	.lookup =	proc_virtual_lookup,
+};
+
+
+
+
+
+int proc_virtnet_readdir(struct file *filp,
+	void *dirent, filldir_t filldir)
+{
+	struct dentry *dentry = filp->f_dentry;
+	struct inode *inode = dentry->d_inode;
+	struct vs_entry *p = nx_virtnet_stuff;
+	int size = sizeof(nx_virtnet_stuff) / sizeof(struct vs_entry);
+	int pos, index;
+	unsigned int nid_array[PROC_MAXVIDS];
+	char buf[PROC_NUMBUF];
+	unsigned int nr_nids, i;
+	u64 ino;
+
+	pos = filp->f_pos;
+	switch (pos) {
+	case 0:
+		ino = inode->i_ino;
+		if (filldir(dirent, ".", 1, pos, ino, DT_DIR) < 0)
+			goto out;
+		pos++;
+		/* fall through */
+	case 1:
+		ino = parent_ino(dentry);
+		if (filldir(dirent, "..", 2, pos, ino, DT_DIR) < 0)
+			goto out;
+		pos++;
+		/* fall through */
+	default:
+		index = pos - 2;
+		if (index >= size)
+			goto entries;
+		for (p += index; p->name; p++) {
+			if (proc_fill_cache(filp, dirent, filldir, p->name, p->len,
+				vs_proc_instantiate, 0, p))
+				goto out;
+			pos++;
+		}
+	entries:
+		index = pos - size;
+		p = &nx_virtnet_stuff[size - 1];
+		nr_nids = get_nid_list(index, nid_array, PROC_MAXVIDS);
+		for (i = 0; i < nr_nids; i++) {
+			int n, nid = nid_array[i];
+			unsigned int j = PROC_NUMBUF;
+
+			n = nid;
+			do
+				buf[--j] = '0' + (n % 10);
+			while (n /= 10);
+
+			if (proc_fill_cache(filp, dirent, filldir,
+				buf + j, PROC_NUMBUF - j,
+				vs_proc_instantiate, nid, p))
+				goto out;
+			pos++;
+		}
+	}
+out:
+	filp->f_pos = pos;
+	return 0;
+}
+
+static int proc_virtnet_getattr(struct vfsmount *mnt,
+	struct dentry *dentry, struct kstat *stat)
+{
+	struct inode *inode = dentry->d_inode;
+
+	generic_fillattr(inode, stat);
+	stat->nlink = 2 + atomic_read(&nx_global_cactive);
+	return 0;
+}
+
+static struct file_operations proc_virtnet_dir_operations = {
+	.read =		generic_read_dir,
+	.readdir =	proc_virtnet_readdir,
+};
+
+static struct inode_operations proc_virtnet_dir_inode_operations = {
+	.getattr =	proc_virtnet_getattr,
+	.lookup =	proc_virtnet_lookup,
+};
+
+
+
+void proc_vx_init(void)
+{
+	struct proc_dir_entry *ent;
+
+	ent = proc_mkdir("virtual", 0);
+	if (ent) {
+		ent->proc_fops = &proc_virtual_dir_operations;
+		ent->proc_iops = &proc_virtual_dir_inode_operations;
+	}
+	proc_virtual = ent;
+
+	ent = proc_mkdir("virtnet", 0);
+	if (ent) {
+		ent->proc_fops = &proc_virtnet_dir_operations;
+		ent->proc_iops = &proc_virtnet_dir_inode_operations;
+	}
+	proc_virtnet = ent;
+}
+
+
+
+
+/* per pid info */
+
+
+int proc_pid_vx_info(struct task_struct *p, char *buffer)
+{
+	struct vx_info *vxi;
+	char *orig = buffer;
+
+	buffer += sprintf(buffer, "XID:\t%d\n", vx_task_xid(p));
+
+	vxi = task_get_vx_info(p);
+	if (!vxi)
+		goto out;
+
+	buffer += sprintf(buffer, "BCaps:\t");
+	buffer = print_cap_t(buffer, &vxi->vx_bcaps);
+	buffer += sprintf(buffer, "\n");
+	buffer += sprintf(buffer, "CCaps:\t%016llx\n",
+		(unsigned long long)vxi->vx_ccaps);
+	buffer += sprintf(buffer, "CFlags:\t%016llx\n",
+		(unsigned long long)vxi->vx_flags);
+	buffer += sprintf(buffer, "CIPid:\t%d\n", vxi->vx_initpid);
+
+	put_vx_info(vxi);
+out:
+	return buffer - orig;
+}
+
+
+int proc_pid_nx_info(struct task_struct *p, char *buffer)
+{
+	struct nx_info *nxi;
+	struct nx_addr_v4 *v4a;
+#ifdef	CONFIG_IPV6
+	struct nx_addr_v6 *v6a;
+#endif
+	char *orig = buffer;
+	int i;
+
+	buffer += sprintf(buffer, "NID:\t%d\n", nx_task_nid(p));
+
+	nxi = task_get_nx_info(p);
+	if (!nxi)
+		goto out;
+
+	buffer += sprintf(buffer, "NCaps:\t%016llx\n",
+		(unsigned long long)nxi->nx_ncaps);
+	buffer += sprintf(buffer, "NFlags:\t%016llx\n",
+		(unsigned long long)nxi->nx_flags);
+
+	buffer += sprintf(buffer,
+		"V4Root[bcast]:\t" NIPQUAD_FMT "\n",
+		NIPQUAD(nxi->v4_bcast.s_addr));
+	buffer += sprintf (buffer,
+		"V4Root[lback]:\t" NIPQUAD_FMT "\n",
+		NIPQUAD(nxi->v4_lback.s_addr));
+	if (!NX_IPV4(nxi))
+		goto skip_v4;
+	for (i = 0, v4a = &nxi->v4; v4a; i++, v4a = v4a->next)
+		buffer += sprintf(buffer, "V4Root[%d]:\t" NXAV4_FMT "\n",
+			i, NXAV4(v4a));
+skip_v4:
+#ifdef	CONFIG_IPV6
+	if (!NX_IPV6(nxi))
+		goto skip_v6;
+	for (i = 0, v6a = &nxi->v6; v6a; i++, v6a = v6a->next)
+		buffer += sprintf(buffer, "V6Root[%d]:\t" NXAV6_FMT "\n",
+			i, NXAV6(v6a));
+skip_v6:
+#endif
+	put_nx_info(nxi);
+out:
+	return buffer - orig;
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/sched.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/sched.c
--- linux-2.6.32.43/kernel/vserver/sched.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/sched.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,414 @@
+/*
+ *  linux/kernel/vserver/sched.c
+ *
+ *  Virtual Server: Scheduler Support
+ *
+ *  Copyright (C) 2004-2007  Herbert Pötzl
+ *
+ *  V0.01  adapted Sam Vilains version to 2.6.3
+ *  V0.02  removed legacy interface
+ *  V0.03  changed vcmds to vxi arg
+ *  V0.04  removed older and legacy interfaces
+ *
+ */
+
+#include <linux/vs_context.h>
+#include <linux/vs_sched.h>
+#include <linux/vserver/sched_cmd.h>
+
+#include <asm/uaccess.h>
+
+
+#define vxd_check_range(val, min, max) do {		\
+	vxlprintk((val < min) || (val > max),		\
+		"check_range(%ld,%ld,%ld)",		\
+		(long)val, (long)min, (long)max,	\
+		__FILE__, __LINE__);			\
+	} while (0)
+
+
+void vx_update_sched_param(struct _vx_sched *sched,
+	struct _vx_sched_pc *sched_pc)
+{
+	unsigned int set_mask = sched->update_mask;
+
+	if (set_mask & VXSM_FILL_RATE)
+		sched_pc->fill_rate[0] = sched->fill_rate[0];
+	if (set_mask & VXSM_INTERVAL)
+		sched_pc->interval[0] = sched->interval[0];
+	if (set_mask & VXSM_FILL_RATE2)
+		sched_pc->fill_rate[1] = sched->fill_rate[1];
+	if (set_mask & VXSM_INTERVAL2)
+		sched_pc->interval[1] = sched->interval[1];
+	if (set_mask & VXSM_TOKENS)
+		sched_pc->tokens = sched->tokens;
+	if (set_mask & VXSM_TOKENS_MIN)
+		sched_pc->tokens_min = sched->tokens_min;
+	if (set_mask & VXSM_TOKENS_MAX)
+		sched_pc->tokens_max = sched->tokens_max;
+	if (set_mask & VXSM_PRIO_BIAS)
+		sched_pc->prio_bias = sched->prio_bias;
+
+	if (set_mask & VXSM_IDLE_TIME)
+		sched_pc->flags |= VXSF_IDLE_TIME;
+	else
+		sched_pc->flags &= ~VXSF_IDLE_TIME;
+
+	/* reset time */
+	sched_pc->norm_time = jiffies;
+}
+
+
+/*
+ * recalculate the context's scheduling tokens
+ *
+ * ret > 0 : number of tokens available
+ * ret < 0 : on hold, check delta_min[]
+ *	     -1 only jiffies
+ *	     -2 also idle time
+ *
+ */
+int vx_tokens_recalc(struct _vx_sched_pc *sched_pc,
+	unsigned long *norm_time, unsigned long *idle_time, int delta_min[2])
+{
+	long delta;
+	long tokens = 0;
+	int flags = sched_pc->flags;
+
+	/* how much time did pass? */
+	delta = *norm_time - sched_pc->norm_time;
+	// printk("@ %ld, %ld, %ld\n", *norm_time, sched_pc->norm_time, jiffies);
+	vxd_check_range(delta, 0, INT_MAX);
+
+	if (delta >= sched_pc->interval[0]) {
+		long tokens, integral;
+
+		/* calc integral token part */
+		tokens = delta / sched_pc->interval[0];
+		integral = tokens * sched_pc->interval[0];
+		tokens *= sched_pc->fill_rate[0];
+#ifdef	CONFIG_VSERVER_HARDCPU
+		delta_min[0] = delta - integral;
+		vxd_check_range(delta_min[0], 0, sched_pc->interval[0]);
+#endif
+		/* advance time */
+		sched_pc->norm_time += delta;
+
+		/* add tokens */
+		sched_pc->tokens += tokens;
+		sched_pc->token_time += tokens;
+	} else
+		delta_min[0] = delta;
+
+#ifdef	CONFIG_VSERVER_IDLETIME
+	if (!(flags & VXSF_IDLE_TIME))
+		goto skip_idle;
+
+	/* how much was the idle skip? */
+	delta = *idle_time - sched_pc->idle_time;
+	vxd_check_range(delta, 0, INT_MAX);
+
+	if (delta >= sched_pc->interval[1]) {
+		long tokens, integral;
+
+		/* calc fair share token part */
+		tokens = delta / sched_pc->interval[1];
+		integral = tokens * sched_pc->interval[1];
+		tokens *= sched_pc->fill_rate[1];
+		delta_min[1] = delta - integral;
+		vxd_check_range(delta_min[1], 0, sched_pc->interval[1]);
+
+		/* advance idle time */
+		sched_pc->idle_time += integral;
+
+		/* add tokens */
+		sched_pc->tokens += tokens;
+		sched_pc->token_time += tokens;
+	} else
+		delta_min[1] = delta;
+skip_idle:
+#endif
+
+	/* clip at maximum */
+	if (sched_pc->tokens > sched_pc->tokens_max)
+		sched_pc->tokens = sched_pc->tokens_max;
+	tokens = sched_pc->tokens;
+
+	if ((flags & VXSF_ONHOLD)) {
+		/* can we unhold? */
+		if (tokens >= sched_pc->tokens_min) {
+			flags &= ~VXSF_ONHOLD;
+			sched_pc->hold_ticks +=
+				*norm_time - sched_pc->onhold;
+		} else
+			goto on_hold;
+	} else {
+		/* put on hold? */
+		if (tokens <= 0) {
+			flags |= VXSF_ONHOLD;
+			sched_pc->onhold = *norm_time;
+			goto on_hold;
+		}
+	}
+	sched_pc->flags = flags;
+	return tokens;
+
+on_hold:
+	tokens = sched_pc->tokens_min - tokens;
+	sched_pc->flags = flags;
+	// BUG_ON(tokens < 0); probably doesn't hold anymore
+
+#ifdef	CONFIG_VSERVER_HARDCPU
+	/* next interval? */
+	if (!sched_pc->fill_rate[0])
+		delta_min[0] = HZ;
+	else if (tokens > sched_pc->fill_rate[0])
+		delta_min[0] += sched_pc->interval[0] *
+			tokens / sched_pc->fill_rate[0];
+	else
+		delta_min[0] = sched_pc->interval[0] - delta_min[0];
+	vxd_check_range(delta_min[0], 0, INT_MAX);
+
+#ifdef	CONFIG_VSERVER_IDLETIME
+	if (!(flags & VXSF_IDLE_TIME))
+		return -1;
+
+	/* next interval? */
+	if (!sched_pc->fill_rate[1])
+		delta_min[1] = HZ;
+	else if (tokens > sched_pc->fill_rate[1])
+		delta_min[1] += sched_pc->interval[1] *
+			tokens / sched_pc->fill_rate[1];
+	else
+		delta_min[1] = sched_pc->interval[1] - delta_min[1];
+	vxd_check_range(delta_min[1], 0, INT_MAX);
+
+	return -2;
+#else
+	return -1;
+#endif /* CONFIG_VSERVER_IDLETIME */
+#else
+	return 0;
+#endif /* CONFIG_VSERVER_HARDCPU */
+}
+
+static inline unsigned long msec_to_ticks(unsigned long msec)
+{
+	return msecs_to_jiffies(msec);
+}
+
+static inline unsigned long ticks_to_msec(unsigned long ticks)
+{
+	return jiffies_to_msecs(ticks);
+}
+
+static inline unsigned long ticks_to_usec(unsigned long ticks)
+{
+	return jiffies_to_usecs(ticks);
+}
+
+
+static int do_set_sched(struct vx_info *vxi, struct vcmd_sched_v5 *data)
+{
+	unsigned int set_mask = data->mask;
+	unsigned int update_mask;
+	int i, cpu;
+
+	/* Sanity check data values */
+	if (data->tokens_max <= 0)
+		data->tokens_max = HZ;
+	if (data->tokens_min < 0)
+		data->tokens_min = HZ / 3;
+	if (data->tokens_min >= data->tokens_max)
+		data->tokens_min = data->tokens_max;
+
+	if (data->prio_bias > MAX_PRIO_BIAS)
+		data->prio_bias = MAX_PRIO_BIAS;
+	if (data->prio_bias < MIN_PRIO_BIAS)
+		data->prio_bias = MIN_PRIO_BIAS;
+
+	spin_lock(&vxi->sched.tokens_lock);
+
+	/* sync up on delayed updates */
+	for_each_cpu_mask(cpu, vxi->sched.update)
+		vx_update_sched_param(&vxi->sched,
+			&vx_per_cpu(vxi, sched_pc, cpu));
+
+	if (set_mask & VXSM_FILL_RATE)
+		vxi->sched.fill_rate[0] = data->fill_rate[0];
+	if (set_mask & VXSM_FILL_RATE2)
+		vxi->sched.fill_rate[1] = data->fill_rate[1];
+	if (set_mask & VXSM_INTERVAL)
+		vxi->sched.interval[0] = (set_mask & VXSM_MSEC) ?
+			msec_to_ticks(data->interval[0]) : data->interval[0];
+	if (set_mask & VXSM_INTERVAL2)
+		vxi->sched.interval[1] = (set_mask & VXSM_MSEC) ?
+			msec_to_ticks(data->interval[1]) : data->interval[1];
+	if (set_mask & VXSM_TOKENS)
+		vxi->sched.tokens = data->tokens;
+	if (set_mask & VXSM_TOKENS_MIN)
+		vxi->sched.tokens_min = data->tokens_min;
+	if (set_mask & VXSM_TOKENS_MAX)
+		vxi->sched.tokens_max = data->tokens_max;
+	if (set_mask & VXSM_PRIO_BIAS)
+		vxi->sched.prio_bias = data->prio_bias;
+
+	/* Sanity check rate/interval */
+	for (i = 0; i < 2; i++) {
+		if (data->fill_rate[i] < 0)
+			data->fill_rate[i] = 0;
+		if (data->interval[i] <= 0)
+			data->interval[i] = HZ;
+	}
+
+	update_mask = vxi->sched.update_mask & VXSM_SET_MASK;
+	update_mask |= (set_mask & (VXSM_SET_MASK | VXSM_IDLE_TIME));
+	vxi->sched.update_mask = update_mask;
+
+#ifdef	CONFIG_SMP
+	rmb();
+	if (set_mask & VXSM_CPU_ID) {
+		vxi->sched.update = cpumask_of_cpu(data->cpu_id);
+		cpus_and(vxi->sched.update, cpu_online_map,
+			vxi->sched.update);
+	} else
+		vxi->sched.update = cpu_online_map;
+
+	/* forced reload? */
+	if (set_mask & VXSM_FORCE) {
+		for_each_cpu_mask(cpu, vxi->sched.update)
+			vx_update_sched_param(&vxi->sched,
+				&vx_per_cpu(vxi, sched_pc, cpu));
+		vxi->sched.update = CPU_MASK_NONE;
+	}
+#else
+	/* on UP we update immediately */
+	vx_update_sched_param(&vxi->sched,
+		&vx_per_cpu(vxi, sched_pc, 0));
+#endif
+
+	spin_unlock(&vxi->sched.tokens_lock);
+	return 0;
+}
+
+
+#define COPY_IDS(C) C(cpu_id); C(bucket_id)
+#define COPY_PRI(C) C(prio_bias)
+#define COPY_TOK(C) C(tokens); C(tokens_min); C(tokens_max)
+#define COPY_FRI(C) C(fill_rate[0]); C(interval[0]);	\
+		    C(fill_rate[1]); C(interval[1]);
+
+#define COPY_VALUE(name) vc_data.name = data->name
+
+static int do_set_sched_v4(struct vx_info *vxi, struct vcmd_set_sched_v4 *data)
+{
+	struct vcmd_sched_v5 vc_data;
+
+	vc_data.mask = data->set_mask;
+	COPY_IDS(COPY_VALUE);
+	COPY_PRI(COPY_VALUE);
+	COPY_TOK(COPY_VALUE);
+	vc_data.fill_rate[0] = vc_data.fill_rate[1] = data->fill_rate;
+	vc_data.interval[0] = vc_data.interval[1] = data->interval;
+	return do_set_sched(vxi, &vc_data);
+}
+
+int vc_set_sched_v4(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_set_sched_v4 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_set_sched_v4(vxi, &vc_data);
+}
+
+	/* latest interface is v5 */
+
+int vc_set_sched(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_sched_v5 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return do_set_sched(vxi, &vc_data);
+}
+
+
+#define COPY_PRI(C) C(prio_bias)
+#define COPY_TOK(C) C(tokens); C(tokens_min); C(tokens_max)
+#define COPY_FRI(C) C(fill_rate[0]); C(interval[0]);    \
+		    C(fill_rate[1]); C(interval[1]);
+
+#define COPY_VALUE(name) vc_data.name = data->name
+
+
+int vc_get_sched(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_sched_v5 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	if (vc_data.mask & VXSM_CPU_ID) {
+		int cpu = vc_data.cpu_id;
+		struct _vx_sched_pc *data;
+
+		if (!cpu_possible(cpu))
+			return -EINVAL;
+
+		data = &vx_per_cpu(vxi, sched_pc, cpu);
+		COPY_TOK(COPY_VALUE);
+		COPY_PRI(COPY_VALUE);
+		COPY_FRI(COPY_VALUE);
+
+		if (data->flags & VXSF_IDLE_TIME)
+			vc_data.mask |= VXSM_IDLE_TIME;
+	} else {
+		struct _vx_sched *data = &vxi->sched;
+
+		COPY_TOK(COPY_VALUE);
+		COPY_PRI(COPY_VALUE);
+		COPY_FRI(COPY_VALUE);
+	}
+
+	if (vc_data.mask & VXSM_MSEC) {
+		vc_data.interval[0] = ticks_to_msec(vc_data.interval[0]);
+		vc_data.interval[1] = ticks_to_msec(vc_data.interval[1]);
+	}
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
+
+int vc_sched_info(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_sched_info vc_data;
+	int cpu;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	cpu = vc_data.cpu_id;
+	if (!cpu_possible(cpu))
+		return -EINVAL;
+
+	if (vxi) {
+		struct _vx_sched_pc *sched_pc =
+			&vx_per_cpu(vxi, sched_pc, cpu);
+
+		vc_data.user_msec = ticks_to_msec(sched_pc->user_ticks);
+		vc_data.sys_msec = ticks_to_msec(sched_pc->sys_ticks);
+		vc_data.hold_msec = ticks_to_msec(sched_pc->hold_ticks);
+		vc_data.vavavoom = sched_pc->vavavoom;
+	}
+	vc_data.token_usec = ticks_to_usec(1);
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		return -EFAULT;
+	return 0;
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/sched_init.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/sched_init.h
--- linux-2.6.32.43/kernel/vserver/sched_init.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/sched_init.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,50 @@
+
+static inline void vx_info_init_sched(struct _vx_sched *sched)
+{
+	static struct lock_class_key tokens_lock_key;
+
+	/* scheduling; hard code starting values as constants */
+	sched->fill_rate[0]	= 1;
+	sched->interval[0]	= 4;
+	sched->fill_rate[1]	= 1;
+	sched->interval[1]	= 8;
+	sched->tokens		= HZ >> 2;
+	sched->tokens_min	= HZ >> 4;
+	sched->tokens_max	= HZ >> 1;
+	sched->tokens_lock	= SPIN_LOCK_UNLOCKED;
+	sched->prio_bias	= 0;
+
+	lockdep_set_class(&sched->tokens_lock, &tokens_lock_key);
+}
+
+static inline
+void vx_info_init_sched_pc(struct _vx_sched_pc *sched_pc, int cpu)
+{
+	sched_pc->fill_rate[0]	= 1;
+	sched_pc->interval[0]	= 4;
+	sched_pc->fill_rate[1]	= 1;
+	sched_pc->interval[1]	= 8;
+	sched_pc->tokens	= HZ >> 2;
+	sched_pc->tokens_min	= HZ >> 4;
+	sched_pc->tokens_max	= HZ >> 1;
+	sched_pc->prio_bias	= 0;
+	sched_pc->vavavoom	= 0;
+	sched_pc->token_time	= 0;
+	sched_pc->idle_time	= 0;
+	sched_pc->norm_time	= jiffies;
+
+	sched_pc->user_ticks = 0;
+	sched_pc->sys_ticks = 0;
+	sched_pc->hold_ticks = 0;
+}
+
+static inline void vx_info_exit_sched(struct _vx_sched *sched)
+{
+	return;
+}
+
+static inline
+void vx_info_exit_sched_pc(struct _vx_sched_pc *sched_pc, int cpu)
+{
+	return;
+}
diff -uriN linux-2.6.32.43/kernel/vserver/sched_proc.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/sched_proc.h
--- linux-2.6.32.43/kernel/vserver/sched_proc.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/sched_proc.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,57 @@
+#ifndef _VX_SCHED_PROC_H
+#define _VX_SCHED_PROC_H
+
+
+static inline
+int vx_info_proc_sched(struct _vx_sched *sched, char *buffer)
+{
+	int length = 0;
+
+	length += sprintf(buffer,
+		"FillRate:\t%8d,%d\n"
+		"Interval:\t%8d,%d\n"
+		"TokensMin:\t%8d\n"
+		"TokensMax:\t%8d\n"
+		"PrioBias:\t%8d\n",
+		sched->fill_rate[0],
+		sched->fill_rate[1],
+		sched->interval[0],
+		sched->interval[1],
+		sched->tokens_min,
+		sched->tokens_max,
+		sched->prio_bias);
+	return length;
+}
+
+static inline
+int vx_info_proc_sched_pc(struct _vx_sched_pc *sched_pc,
+	char *buffer, int cpu)
+{
+	int length = 0;
+
+	length += sprintf(buffer + length,
+		"cpu %d: %lld %lld %lld %ld %ld", cpu,
+		(unsigned long long)sched_pc->user_ticks,
+		(unsigned long long)sched_pc->sys_ticks,
+		(unsigned long long)sched_pc->hold_ticks,
+		sched_pc->token_time,
+		sched_pc->idle_time);
+	length += sprintf(buffer + length,
+		" %c%c %d %d %d %d/%d %d/%d",
+		(sched_pc->flags & VXSF_ONHOLD) ? 'H' : 'R',
+		(sched_pc->flags & VXSF_IDLE_TIME) ? 'I' : '-',
+		sched_pc->tokens,
+		sched_pc->tokens_min,
+		sched_pc->tokens_max,
+		sched_pc->fill_rate[0],
+		sched_pc->interval[0],
+		sched_pc->fill_rate[1],
+		sched_pc->interval[1]);
+	length += sprintf(buffer + length,
+		" %d %d\n",
+		sched_pc->prio_bias,
+		sched_pc->vavavoom);
+	return length;
+}
+
+#endif	/* _VX_SCHED_PROC_H */
diff -uriN linux-2.6.32.43/kernel/vserver/signal.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/signal.c
--- linux-2.6.32.43/kernel/vserver/signal.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/signal.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,132 @@
+/*
+ *  linux/kernel/vserver/signal.c
+ *
+ *  Virtual Server: Signal Support
+ *
+ *  Copyright (C) 2003-2007  Herbert Pötzl
+ *
+ *  V0.01  broken out from vcontext V0.05
+ *  V0.02  changed vcmds to vxi arg
+ *  V0.03  adjusted siginfo for kill
+ *
+ */
+
+#include <asm/uaccess.h>
+
+#include <linux/vs_context.h>
+#include <linux/vs_pid.h>
+#include <linux/vserver/signal_cmd.h>
+
+
+int vx_info_kill(struct vx_info *vxi, int pid, int sig)
+{
+	int retval, count = 0;
+	struct task_struct *p;
+	struct siginfo *sip = SEND_SIG_PRIV;
+
+	retval = -ESRCH;
+	vxdprintk(VXD_CBIT(misc, 4),
+		"vx_info_kill(%p[#%d],%d,%d)*",
+		vxi, vxi->vx_id, pid, sig);
+	read_lock(&tasklist_lock);
+	switch (pid) {
+	case  0:
+	case -1:
+		for_each_process(p) {
+			int err = 0;
+
+			if (vx_task_xid(p) != vxi->vx_id || p->pid <= 1 ||
+				(pid && vxi->vx_initpid == p->pid))
+				continue;
+
+			err = group_send_sig_info(sig, sip, p);
+			++count;
+			if (err != -EPERM)
+				retval = err;
+		}
+		break;
+
+	case 1:
+		if (vxi->vx_initpid) {
+			pid = vxi->vx_initpid;
+			/* for now, only SIGINT to private init ... */
+			if (!vx_info_flags(vxi, VXF_STATE_ADMIN, 0) &&
+				/* ... as long as there are tasks left */
+				(atomic_read(&vxi->vx_tasks) > 1))
+				sig = SIGINT;
+		}
+		/* fallthrough */
+	default:
+		p = find_task_by_real_pid(pid);
+		if (p) {
+			if (vx_task_xid(p) == vxi->vx_id)
+				retval = group_send_sig_info(sig, sip, p);
+		}
+		break;
+	}
+	read_unlock(&tasklist_lock);
+	vxdprintk(VXD_CBIT(misc, 4),
+		"vx_info_kill(%p[#%d],%d,%d,%ld) = %d",
+		vxi, vxi->vx_id, pid, sig, (long)sip, retval);
+	return retval;
+}
+
+int vc_ctx_kill(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_ctx_kill_v0 vc_data;
+
+	if (copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	/* special check to allow guest shutdown */
+	if (!vx_info_flags(vxi, VXF_STATE_ADMIN, 0) &&
+		/* forbid killall pid=0 when init is present */
+		(((vc_data.pid < 1) && vxi->vx_initpid) ||
+		(vc_data.pid > 1)))
+		return -EACCES;
+
+	return vx_info_kill(vxi, vc_data.pid, vc_data.sig);
+}
+
+
+static int __wait_exit(struct vx_info *vxi)
+{
+	DECLARE_WAITQUEUE(wait, current);
+	int ret = 0;
+
+	add_wait_queue(&vxi->vx_wait, &wait);
+	set_current_state(TASK_INTERRUPTIBLE);
+
+wait:
+	if (vx_info_state(vxi,
+		VXS_SHUTDOWN | VXS_HASHED | VXS_HELPER) == VXS_SHUTDOWN)
+		goto out;
+	if (signal_pending(current)) {
+		ret = -ERESTARTSYS;
+		goto out;
+	}
+	schedule();
+	goto wait;
+
+out:
+	set_current_state(TASK_RUNNING);
+	remove_wait_queue(&vxi->vx_wait, &wait);
+	return ret;
+}
+
+
+
+int vc_wait_exit(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_wait_exit_v0 vc_data;
+	int ret;
+
+	ret = __wait_exit(vxi);
+	vc_data.reboot_cmd = vxi->reboot_cmd;
+	vc_data.exit_code = vxi->exit_code;
+
+	if (copy_to_user(data, &vc_data, sizeof(vc_data)))
+		ret = -EFAULT;
+	return ret;
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/space.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/space.c
--- linux-2.6.32.43/kernel/vserver/space.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/space.c	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,375 @@
+/*
+ *  linux/kernel/vserver/space.c
+ *
+ *  Virtual Server: Context Space Support
+ *
+ *  Copyright (C) 2003-2007  Herbert Pötzl
+ *
+ *  V0.01  broken out from context.c 0.07
+ *  V0.02  added task locking for namespace
+ *  V0.03  broken out vx_enter_namespace
+ *  V0.04  added *space support and commands
+ *
+ */
+
+#include <linux/utsname.h>
+#include <linux/nsproxy.h>
+#include <linux/err.h>
+#include <linux/fs_struct.h>
+#include <asm/uaccess.h>
+
+#include <linux/vs_context.h>
+#include <linux/vserver/space.h>
+#include <linux/vserver/space_cmd.h>
+
+atomic_t vs_global_nsproxy	= ATOMIC_INIT(0);
+atomic_t vs_global_fs		= ATOMIC_INIT(0);
+atomic_t vs_global_mnt_ns	= ATOMIC_INIT(0);
+atomic_t vs_global_uts_ns	= ATOMIC_INIT(0);
+atomic_t vs_global_user_ns	= ATOMIC_INIT(0);
+atomic_t vs_global_pid_ns	= ATOMIC_INIT(0);
+
+
+/* namespace functions */
+
+#include <linux/mnt_namespace.h>
+#include <linux/user_namespace.h>
+#include <linux/pid_namespace.h>
+#include <linux/ipc_namespace.h>
+#include <net/net_namespace.h>
+
+
+static const struct vcmd_space_mask_v1 space_mask_v0 = {
+	.mask = CLONE_FS |
+		CLONE_NEWNS |
+		CLONE_NEWUTS |
+		CLONE_NEWIPC |
+		CLONE_NEWUSER |
+		0
+};
+
+static const struct vcmd_space_mask_v1 space_mask = {
+	.mask = CLONE_FS |
+		CLONE_NEWNS |
+		CLONE_NEWUTS |
+		CLONE_NEWIPC |
+		CLONE_NEWUSER |
+#ifdef	CONFIG_PID_NS
+		CLONE_NEWPID |
+#endif
+#ifdef	CONFIG_NET_NS
+		CLONE_NEWNET |
+#endif
+		0
+};
+
+static const struct vcmd_space_mask_v1 default_space_mask = {
+	.mask = CLONE_FS |
+		CLONE_NEWNS |
+		CLONE_NEWUTS |
+		CLONE_NEWIPC |
+		CLONE_NEWUSER |
+#ifdef	CONFIG_PID_NS
+//		CLONE_NEWPID |
+#endif
+		0
+};
+
+/*
+ *	build a new nsproxy mix
+ *      assumes that both proxies are 'const'
+ *	does not touch nsproxy refcounts
+ *	will hold a reference on the result.
+ */
+
+struct nsproxy *vs_mix_nsproxy(struct nsproxy *old_nsproxy,
+	struct nsproxy *new_nsproxy, unsigned long mask)
+{
+	struct mnt_namespace *old_ns;
+	struct uts_namespace *old_uts;
+	struct ipc_namespace *old_ipc;
+#ifdef	CONFIG_PID_NS
+	struct pid_namespace *old_pid;
+#endif
+#ifdef	CONFIG_NET_NS
+	struct net *old_net;
+#endif
+	struct nsproxy *nsproxy;
+
+	nsproxy = copy_nsproxy(old_nsproxy);
+	if (!nsproxy)
+		goto out;
+
+	if (mask & CLONE_NEWNS) {
+		old_ns = nsproxy->mnt_ns;
+		nsproxy->mnt_ns = new_nsproxy->mnt_ns;
+		if (nsproxy->mnt_ns)
+			get_mnt_ns(nsproxy->mnt_ns);
+	} else
+		old_ns = NULL;
+
+	if (mask & CLONE_NEWUTS) {
+		old_uts = nsproxy->uts_ns;
+		nsproxy->uts_ns = new_nsproxy->uts_ns;
+		if (nsproxy->uts_ns)
+			get_uts_ns(nsproxy->uts_ns);
+	} else
+		old_uts = NULL;
+
+	if (mask & CLONE_NEWIPC) {
+		old_ipc = nsproxy->ipc_ns;
+		nsproxy->ipc_ns = new_nsproxy->ipc_ns;
+		if (nsproxy->ipc_ns)
+			get_ipc_ns(nsproxy->ipc_ns);
+	} else
+		old_ipc = NULL;
+
+#ifdef	CONFIG_PID_NS
+	if (mask & CLONE_NEWPID) {
+		old_pid = nsproxy->pid_ns;
+		nsproxy->pid_ns = new_nsproxy->pid_ns;
+		if (nsproxy->pid_ns)
+			get_pid_ns(nsproxy->pid_ns);
+	} else
+		old_pid = NULL;
+#endif
+#ifdef	CONFIG_NET_NS
+	if (mask & CLONE_NEWNET) {
+		old_net = nsproxy->net_ns;
+		nsproxy->net_ns = new_nsproxy->net_ns;
+		if (nsproxy->net_ns)
+			get_net(nsproxy->net_ns);
+	} else
+		old_net = NULL;
+#endif
+	if (old_ns)
+		put_mnt_ns(old_ns);
+	if (old_uts)
+		put_uts_ns(old_uts);
+	if (old_ipc)
+		put_ipc_ns(old_ipc);
+#ifdef	CONFIG_PID_NS
+	if (old_pid)
+		put_pid_ns(old_pid);
+#endif
+#ifdef	CONFIG_NET_NS
+	if (old_net)
+		put_net(old_net);
+#endif
+out:
+	return nsproxy;
+}
+
+
+/*
+ *	merge two nsproxy structs into a new one.
+ *	will hold a reference on the result.
+ */
+
+static inline
+struct nsproxy *__vs_merge_nsproxy(struct nsproxy *old,
+	struct nsproxy *proxy, unsigned long mask)
+{
+	struct nsproxy null_proxy = { .mnt_ns = NULL };
+
+	if (!proxy)
+		return NULL;
+
+	if (mask) {
+		/* vs_mix_nsproxy returns with reference */
+		return vs_mix_nsproxy(old ? old : &null_proxy,
+			proxy, mask);
+	}
+	get_nsproxy(proxy);
+	return proxy;
+}
+
+
+int vx_enter_space(struct vx_info *vxi, unsigned long mask, unsigned index)
+{
+	struct nsproxy *proxy, *proxy_cur, *proxy_new;
+	struct fs_struct *fs_cur, *fs = NULL;
+	int ret, kill = 0;
+
+	vxdprintk(VXD_CBIT(space, 8), "vx_enter_space(%p[#%u],0x%08lx,%d)",
+		vxi, vxi->vx_id, mask, index);
+
+	if (vx_info_flags(vxi, VXF_INFO_PRIVATE, 0))
+		return -EACCES;
+
+	if (!mask)
+		mask = vxi->vx_nsmask[index];
+
+	if ((mask & vxi->vx_nsmask[index]) != mask)
+		return -EINVAL;
+
+	if (mask & CLONE_FS) {
+		fs = copy_fs_struct(vxi->vx_fs[index]);
+		if (!fs)
+			return -ENOMEM;
+	}
+	proxy = vxi->vx_nsproxy[index];
+
+	vxdprintk(VXD_CBIT(space, 9),
+		"vx_enter_space(%p[#%u],0x%08lx,%d) -> (%p,%p)",
+		vxi, vxi->vx_id, mask, index, proxy, fs);
+
+	task_lock(current);
+	fs_cur = current->fs;
+
+	if (mask & CLONE_FS) {
+		write_lock(&fs_cur->lock);
+		current->fs = fs;
+		kill = atomic_dec_and_test(&fs_cur->users);
+		write_unlock(&fs_cur->lock);
+	}
+
+	proxy_cur = current->nsproxy;
+	get_nsproxy(proxy_cur);
+	task_unlock(current);
+
+	if (kill)
+		free_fs_struct(fs_cur);
+
+	proxy_new = __vs_merge_nsproxy(proxy_cur, proxy, mask);
+	if (IS_ERR(proxy_new)) {
+		ret = PTR_ERR(proxy_new);
+		goto out_put;
+	}
+
+	proxy_new = xchg(&current->nsproxy, proxy_new);
+	ret = 0;
+
+	if (proxy_new)
+		put_nsproxy(proxy_new);
+out_put:
+	if (proxy_cur)
+		put_nsproxy(proxy_cur);
+	return ret;
+}
+
+
+int vx_set_space(struct vx_info *vxi, unsigned long mask, unsigned index)
+{
+	struct nsproxy *proxy_vxi, *proxy_cur, *proxy_new;
+	struct fs_struct *fs_vxi, *fs;
+	int ret, kill = 0;
+
+	vxdprintk(VXD_CBIT(space, 8), "vx_set_space(%p[#%u],0x%08lx,%d)",
+		vxi, vxi->vx_id, mask, index);
+#if 0
+	if (!mask)
+		mask = default_space_mask.mask;
+#endif
+	if ((mask & space_mask.mask) != mask)
+		return -EINVAL;
+
+	proxy_vxi = vxi->vx_nsproxy[index];
+	fs_vxi = vxi->vx_fs[index];
+
+	if (mask & CLONE_FS) {
+		fs = copy_fs_struct(current->fs);
+		if (!fs)
+			return -ENOMEM;
+	}
+
+	task_lock(current);
+
+	if (mask & CLONE_FS) {
+		write_lock(&fs_vxi->lock);
+		vxi->vx_fs[index] = fs;
+		kill = atomic_dec_and_test(&fs_vxi->users);
+		write_unlock(&fs_vxi->lock);
+	}
+
+	proxy_cur = current->nsproxy;
+	get_nsproxy(proxy_cur);
+	task_unlock(current);
+
+	if (kill)
+		free_fs_struct(fs_vxi);
+
+	proxy_new = __vs_merge_nsproxy(proxy_vxi, proxy_cur, mask);
+	if (IS_ERR(proxy_new)) {
+		ret = PTR_ERR(proxy_new);
+		goto out_put;
+	}
+
+	proxy_new = xchg(&vxi->vx_nsproxy[index], proxy_new);
+	vxi->vx_nsmask[index] |= mask;
+	ret = 0;
+
+	if (proxy_new)
+		put_nsproxy(proxy_new);
+out_put:
+	if (proxy_cur)
+		put_nsproxy(proxy_cur);
+	return ret;
+}
+
+
+int vc_enter_space_v1(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_space_mask_v1 vc_data = { .mask = 0 };
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return vx_enter_space(vxi, vc_data.mask, 0);
+}
+
+int vc_enter_space(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_space_mask_v2 vc_data = { .mask = 0 };
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	if (vc_data.index >= VX_SPACES)
+		return -EINVAL;
+
+	return vx_enter_space(vxi, vc_data.mask, vc_data.index);
+}
+
+int vc_set_space_v1(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_space_mask_v1 vc_data = { .mask = 0 };
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	return vx_set_space(vxi, vc_data.mask, 0);
+}
+
+int vc_set_space(struct vx_info *vxi, void __user *data)
+{
+	struct vcmd_space_mask_v2 vc_data = { .mask = 0 };
+
+	if (data && copy_from_user(&vc_data, data, sizeof(vc_data)))
+		return -EFAULT;
+
+	if (vc_data.index >= VX_SPACES)
+		return -EINVAL;
+
+	return vx_set_space(vxi, vc_data.mask, vc_data.index);
+}
+
+int vc_get_space_mask(void __user *data, int type)
+{
+	const struct vcmd_space_mask_v1 *mask;
+
+	if (type == 0)
+		mask = &space_mask_v0;
+	else if (type == 1)
+		mask = &space_mask;
+	else
+		mask = &default_space_mask;
+
+	vxdprintk(VXD_CBIT(space, 10),
+		"vc_get_space_mask(%d) = %08llx", type, mask->mask);
+
+	if (copy_to_user(data, mask, sizeof(*mask)))
+		return -EFAULT;
+	return 0;
+}
+
diff -uriN linux-2.6.32.43/kernel/vserver/switch.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/switch.c
--- linux-2.6.32.43/kernel/vserver/switch.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/switch.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,546 @@
+/*
+ *  linux/kernel/vserver/switch.c
+ *
+ *  Virtual Server: Syscall Switch
+ *
+ *  Copyright (C) 2003-2007  Herbert Pötzl
+ *
+ *  V0.01  syscall switch
+ *  V0.02  added signal to context
+ *  V0.03  added rlimit functions
+ *  V0.04  added iattr, task/xid functions
+ *  V0.05  added debug/history stuff
+ *  V0.06  added compat32 layer
+ *  V0.07  vcmd args and perms
+ *  V0.08  added status commands
+ *  V0.09  added tag commands
+ *  V0.10  added oom bias
+ *  V0.11  added device commands
+ *
+ */
+
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
+#include <linux/vserver/switch.h>
+
+#include "vci_config.h"
+
+
+static inline
+int vc_get_version(uint32_t id)
+{
+	return VCI_VERSION;
+}
+
+static inline
+int vc_get_vci(uint32_t id)
+{
+	return vci_kernel_config();
+}
+
+#include <linux/vserver/context_cmd.h>
+#include <linux/vserver/cvirt_cmd.h>
+#include <linux/vserver/cacct_cmd.h>
+#include <linux/vserver/limit_cmd.h>
+#include <linux/vserver/network_cmd.h>
+#include <linux/vserver/sched_cmd.h>
+#include <linux/vserver/debug_cmd.h>
+#include <linux/vserver/inode_cmd.h>
+#include <linux/vserver/dlimit_cmd.h>
+#include <linux/vserver/signal_cmd.h>
+#include <linux/vserver/space_cmd.h>
+#include <linux/vserver/tag_cmd.h>
+#include <linux/vserver/device_cmd.h>
+
+#include <linux/vserver/inode.h>
+#include <linux/vserver/dlimit.h>
+
+
+#ifdef	CONFIG_COMPAT
+#define __COMPAT(name, id, data, compat)	\
+	(compat) ? name ## _x32(id, data) : name(id, data)
+#define __COMPAT_NO_ID(name, data, compat)	\
+	(compat) ? name ## _x32(data) : name(data)
+#else
+#define __COMPAT(name, id, data, compat)	\
+	name(id, data)
+#define __COMPAT_NO_ID(name, data, compat)	\
+	name(data)
+#endif
+
+
+static inline
+long do_vcmd(uint32_t cmd, uint32_t id,
+	struct vx_info *vxi, struct nx_info *nxi,
+	void __user *data, int compat)
+{
+	switch (cmd) {
+
+	case VCMD_get_version:
+		return vc_get_version(id);
+	case VCMD_get_vci:
+		return vc_get_vci(id);
+
+	case VCMD_task_xid:
+		return vc_task_xid(id);
+	case VCMD_vx_info:
+		return vc_vx_info(vxi, data);
+
+	case VCMD_task_nid:
+		return vc_task_nid(id);
+	case VCMD_nx_info:
+		return vc_nx_info(nxi, data);
+
+	case VCMD_task_tag:
+		return vc_task_tag(id);
+
+	case VCMD_set_space_v1:
+		return vc_set_space_v1(vxi, data);
+	/* this is version 2 */
+	case VCMD_set_space:
+		return vc_set_space(vxi, data);
+
+	case VCMD_get_space_mask_v0:
+		return vc_get_space_mask(data, 0);
+	/* this is version 1 */
+	case VCMD_get_space_mask:
+		return vc_get_space_mask(data, 1);
+
+	case VCMD_get_space_default:
+		return vc_get_space_mask(data, -1);
+
+#ifdef	CONFIG_IA32_EMULATION
+	case VCMD_get_rlimit:
+		return __COMPAT(vc_get_rlimit, vxi, data, compat);
+	case VCMD_set_rlimit:
+		return __COMPAT(vc_set_rlimit, vxi, data, compat);
+#else
+	case VCMD_get_rlimit:
+		return vc_get_rlimit(vxi, data);
+	case VCMD_set_rlimit:
+		return vc_set_rlimit(vxi, data);
+#endif
+	case VCMD_get_rlimit_mask:
+		return vc_get_rlimit_mask(id, data);
+	case VCMD_reset_hits:
+		return vc_reset_hits(vxi, data);
+	case VCMD_reset_minmax:
+		return vc_reset_minmax(vxi, data);
+
+	case VCMD_get_vhi_name:
+		return vc_get_vhi_name(vxi, data);
+	case VCMD_set_vhi_name:
+		return vc_set_vhi_name(vxi, data);
+
+	case VCMD_ctx_stat:
+		return vc_ctx_stat(vxi, data);
+	case VCMD_virt_stat:
+		return vc_virt_stat(vxi, data);
+	case VCMD_sock_stat:
+		return vc_sock_stat(vxi, data);
+	case VCMD_rlimit_stat:
+		return vc_rlimit_stat(vxi, data);
+
+	case VCMD_set_cflags:
+		return vc_set_cflags(vxi, data);
+	case VCMD_get_cflags:
+		return vc_get_cflags(vxi, data);
+
+	/* this is version 1 */
+	case VCMD_set_ccaps:
+		return vc_set_ccaps(vxi, data);
+	/* this is version 1 */
+	case VCMD_get_ccaps:
+		return vc_get_ccaps(vxi, data);
+	case VCMD_set_bcaps:
+		return vc_set_bcaps(vxi, data);
+	case VCMD_get_bcaps:
+		return vc_get_bcaps(vxi, data);
+
+	case VCMD_set_badness:
+		return vc_set_badness(vxi, data);
+	case VCMD_get_badness:
+		return vc_get_badness(vxi, data);
+
+	case VCMD_set_nflags:
+		return vc_set_nflags(nxi, data);
+	case VCMD_get_nflags:
+		return vc_get_nflags(nxi, data);
+
+	case VCMD_set_ncaps:
+		return vc_set_ncaps(nxi, data);
+	case VCMD_get_ncaps:
+		return vc_get_ncaps(nxi, data);
+
+	case VCMD_set_sched_v4:
+		return vc_set_sched_v4(vxi, data);
+	/* this is version 5 */
+	case VCMD_set_sched:
+		return vc_set_sched(vxi, data);
+	case VCMD_get_sched:
+		return vc_get_sched(vxi, data);
+	case VCMD_sched_info:
+		return vc_sched_info(vxi, data);
+
+	case VCMD_add_dlimit:
+		return __COMPAT(vc_add_dlimit, id, data, compat);
+	case VCMD_rem_dlimit:
+		return __COMPAT(vc_rem_dlimit, id, data, compat);
+	case VCMD_set_dlimit:
+		return __COMPAT(vc_set_dlimit, id, data, compat);
+	case VCMD_get_dlimit:
+		return __COMPAT(vc_get_dlimit, id, data, compat);
+
+	case VCMD_ctx_kill:
+		return vc_ctx_kill(vxi, data);
+
+	case VCMD_wait_exit:
+		return vc_wait_exit(vxi, data);
+
+	case VCMD_get_iattr:
+		return __COMPAT_NO_ID(vc_get_iattr, data, compat);
+	case VCMD_set_iattr:
+		return __COMPAT_NO_ID(vc_set_iattr, data, compat);
+
+	case VCMD_fget_iattr:
+		return vc_fget_iattr(id, data);
+	case VCMD_fset_iattr:
+		return vc_fset_iattr(id, data);
+
+	case VCMD_enter_space_v0:
+		return vc_enter_space_v1(vxi, NULL);
+	case VCMD_enter_space_v1:
+		return vc_enter_space_v1(vxi, data);
+	/* this is version 2 */
+	case VCMD_enter_space:
+		return vc_enter_space(vxi, data);
+
+	case VCMD_ctx_create_v0:
+		return vc_ctx_create(id, NULL);
+	case VCMD_ctx_create:
+		return vc_ctx_create(id, data);
+	case VCMD_ctx_migrate_v0:
+		return vc_ctx_migrate(vxi, NULL);
+	case VCMD_ctx_migrate:
+		return vc_ctx_migrate(vxi, data);
+
+	case VCMD_net_create_v0:
+		return vc_net_create(id, NULL);
+	case VCMD_net_create:
+		return vc_net_create(id, data);
+	case VCMD_net_migrate:
+		return vc_net_migrate(nxi, data);
+
+	case VCMD_tag_migrate:
+		return vc_tag_migrate(id);
+
+	case VCMD_net_add:
+		return vc_net_add(nxi, data);
+	case VCMD_net_remove:
+		return vc_net_remove(nxi, data);
+
+	case VCMD_net_add_ipv4:
+		return vc_net_add_ipv4(nxi, data);
+	case VCMD_net_remove_ipv4:
+		return vc_net_remove_ipv4(nxi, data);
+#ifdef	CONFIG_IPV6
+	case VCMD_net_add_ipv6:
+		return vc_net_add_ipv6(nxi, data);
+	case VCMD_net_remove_ipv6:
+		return vc_net_remove_ipv6(nxi, data);
+#endif
+/*	case VCMD_add_match_ipv4:
+		return vc_add_match_ipv4(nxi, data);
+	case VCMD_get_match_ipv4:
+		return vc_get_match_ipv4(nxi, data);
+#ifdef	CONFIG_IPV6
+	case VCMD_add_match_ipv6:
+		return vc_add_match_ipv6(nxi, data);
+	case VCMD_get_match_ipv6:
+		return vc_get_match_ipv6(nxi, data);
+#endif	*/
+
+#ifdef	CONFIG_VSERVER_DEVICE
+	case VCMD_set_mapping:
+		return __COMPAT(vc_set_mapping, vxi, data, compat);
+	case VCMD_unset_mapping:
+		return __COMPAT(vc_unset_mapping, vxi, data, compat);
+#endif
+#ifdef	CONFIG_VSERVER_HISTORY
+	case VCMD_dump_history:
+		return vc_dump_history(id);
+	case VCMD_read_history:
+		return __COMPAT(vc_read_history, id, data, compat);
+#endif
+#ifdef	CONFIG_VSERVER_MONITOR
+	case VCMD_read_monitor:
+		return __COMPAT(vc_read_monitor, id, data, compat);
+#endif
+	default:
+		vxwprintk_task(1, "unimplemented VCMD_%02d_%d[%d]",
+			VC_CATEGORY(cmd), VC_COMMAND(cmd), VC_VERSION(cmd));
+	}
+	return -ENOSYS;
+}
+
+
+#define	__VCMD(vcmd, _perm, _args, _flags)		\
+	case VCMD_ ## vcmd: perm = _perm;		\
+		args = _args; flags = _flags; break
+
+
+#define VCA_NONE	0x00
+#define VCA_VXI		0x01
+#define VCA_NXI		0x02
+
+#define VCF_NONE	0x00
+#define VCF_INFO	0x01
+#define VCF_ADMIN	0x02
+#define VCF_ARES	0x06	/* includes admin */
+#define VCF_SETUP	0x08
+
+#define VCF_ZIDOK	0x10	/* zero id okay */
+
+
+static inline
+long do_vserver(uint32_t cmd, uint32_t id, void __user *data, int compat)
+{
+	long ret;
+	int permit = -1, state = 0;
+	int perm = -1, args = 0, flags = 0;
+	struct vx_info *vxi = NULL;
+	struct nx_info *nxi = NULL;
+
+	switch (cmd) {
+	/* unpriviledged commands */
+	__VCMD(get_version,	 0, VCA_NONE,	0);
+	__VCMD(get_vci,		 0, VCA_NONE,	0);
+	__VCMD(get_rlimit_mask,	 0, VCA_NONE,	0);
+	__VCMD(get_space_mask_v0,0, VCA_NONE,   0);
+	__VCMD(get_space_mask,	 0, VCA_NONE,   0);
+	__VCMD(get_space_default,0, VCA_NONE,   0);
+
+	/* info commands */
+	__VCMD(task_xid,	 2, VCA_NONE,	0);
+	__VCMD(reset_hits,	 2, VCA_VXI,	0);
+	__VCMD(reset_minmax,	 2, VCA_VXI,	0);
+	__VCMD(vx_info,		 3, VCA_VXI,	VCF_INFO);
+	__VCMD(get_bcaps,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(get_ccaps,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(get_cflags,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(get_badness,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(get_vhi_name,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(get_rlimit,	 3, VCA_VXI,	VCF_INFO);
+
+	__VCMD(ctx_stat,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(virt_stat,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(sock_stat,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(rlimit_stat,	 3, VCA_VXI,	VCF_INFO);
+
+	__VCMD(task_nid,	 2, VCA_NONE,	0);
+	__VCMD(nx_info,		 3, VCA_NXI,	VCF_INFO);
+	__VCMD(get_ncaps,	 3, VCA_NXI,	VCF_INFO);
+	__VCMD(get_nflags,	 3, VCA_NXI,	VCF_INFO);
+
+	__VCMD(task_tag,	 2, VCA_NONE,	0);
+
+	__VCMD(get_iattr,	 2, VCA_NONE,	0);
+	__VCMD(fget_iattr,	 2, VCA_NONE,	0);
+	__VCMD(get_dlimit,	 3, VCA_NONE,	VCF_INFO);
+	__VCMD(get_sched,	 3, VCA_VXI,	VCF_INFO);
+	__VCMD(sched_info,	 3, VCA_VXI,	VCF_INFO | VCF_ZIDOK);
+
+	/* lower admin commands */
+	__VCMD(wait_exit,	 4, VCA_VXI,	VCF_INFO);
+	__VCMD(ctx_create_v0,	 5, VCA_NONE,	0);
+	__VCMD(ctx_create,	 5, VCA_NONE,	0);
+	__VCMD(ctx_migrate_v0,	 5, VCA_VXI,	VCF_ADMIN);
+	__VCMD(ctx_migrate,	 5, VCA_VXI,	VCF_ADMIN);
+	__VCMD(enter_space_v0,	 5, VCA_VXI,	VCF_ADMIN);
+	__VCMD(enter_space_v1,	 5, VCA_VXI,	VCF_ADMIN);
+	__VCMD(enter_space,	 5, VCA_VXI,	VCF_ADMIN);
+
+	__VCMD(net_create_v0,	 5, VCA_NONE,	0);
+	__VCMD(net_create,	 5, VCA_NONE,	0);
+	__VCMD(net_migrate,	 5, VCA_NXI,	VCF_ADMIN);
+
+	__VCMD(tag_migrate,	 5, VCA_NONE,	VCF_ADMIN);
+
+	/* higher admin commands */
+	__VCMD(ctx_kill,	 6, VCA_VXI,	VCF_ARES);
+	__VCMD(set_space_v1,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(set_space,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+
+	__VCMD(set_ccaps,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(set_bcaps,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(set_cflags,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(set_badness,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+
+	__VCMD(set_vhi_name,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(set_rlimit,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(set_sched,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(set_sched_v4,	 7, VCA_VXI,	VCF_ARES | VCF_SETUP);
+
+	__VCMD(set_ncaps,	 7, VCA_NXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(set_nflags,	 7, VCA_NXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(net_add,		 8, VCA_NXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(net_remove,	 8, VCA_NXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(net_add_ipv4,	 8, VCA_NXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(net_remove_ipv4,	 8, VCA_NXI,	VCF_ARES | VCF_SETUP);
+#ifdef	CONFIG_IPV6
+	__VCMD(net_add_ipv6,	 8, VCA_NXI,	VCF_ARES | VCF_SETUP);
+	__VCMD(net_remove_ipv6,	 8, VCA_NXI,	VCF_ARES | VCF_SETUP);
+#endif
+	__VCMD(set_iattr,	 7, VCA_NONE,	0);
+	__VCMD(fset_iattr,	 7, VCA_NONE,	0);
+	__VCMD(set_dlimit,	 7, VCA_NONE,	VCF_ARES);
+	__VCMD(add_dlimit,	 8, VCA_NONE,	VCF_ARES);
+	__VCMD(rem_dlimit,	 8, VCA_NONE,	VCF_ARES);
+
+#ifdef	CONFIG_VSERVER_DEVICE
+	__VCMD(set_mapping,	 8, VCA_VXI,    VCF_ARES|VCF_ZIDOK);
+	__VCMD(unset_mapping,	 8, VCA_VXI,	VCF_ARES|VCF_ZIDOK);
+#endif
+	/* debug level admin commands */
+#ifdef	CONFIG_VSERVER_HISTORY
+	__VCMD(dump_history,	 9, VCA_NONE,	0);
+	__VCMD(read_history,	 9, VCA_NONE,	0);
+#endif
+#ifdef	CONFIG_VSERVER_MONITOR
+	__VCMD(read_monitor,	 9, VCA_NONE,	0);
+#endif
+
+	default:
+		perm = -1;
+	}
+
+	vxdprintk(VXD_CBIT(switch, 0),
+		"vc: VCMD_%02d_%d[%d], %d,%p [%d,%d,%x,%x]",
+		VC_CATEGORY(cmd), VC_COMMAND(cmd),
+		VC_VERSION(cmd), id, data, compat,
+		perm, args, flags);
+
+	ret = -ENOSYS;
+	if (perm < 0)
+		goto out;
+
+	state = 1;
+	if (!capable(CAP_CONTEXT))
+		goto out;
+
+	state = 2;
+	/* moved here from the individual commands */
+	ret = -EPERM;
+	if ((perm > 1) && !capable(CAP_SYS_ADMIN))
+		goto out;
+
+	state = 3;
+	/* vcmd involves resource management  */
+	ret = -EPERM;
+	if ((flags & VCF_ARES) && !capable(CAP_SYS_RESOURCE))
+		goto out;
+
+	state = 4;
+	/* various legacy exceptions */
+	switch (cmd) {
+	/* will go away when spectator is a cap */
+	case VCMD_ctx_migrate_v0:
+	case VCMD_ctx_migrate:
+		if (id == 1) {
+			current->xid = 1;
+			ret = 1;
+			goto out;
+		}
+		break;
+
+	/* will go away when spectator is a cap */
+	case VCMD_net_migrate:
+		if (id == 1) {
+			current->nid = 1;
+			ret = 1;
+			goto out;
+		}
+		break;
+	}
+
+	/* vcmds are fine by default */
+	permit = 1;
+
+	/* admin type vcmds require admin ... */
+	if (flags & VCF_ADMIN)
+		permit = vx_check(0, VS_ADMIN) ? 1 : 0;
+
+	/* ... but setup type vcmds override that */
+	if (!permit && (flags & VCF_SETUP))
+		permit = vx_flags(VXF_STATE_SETUP, 0) ? 2 : 0;
+
+	state = 5;
+	ret = -EPERM;
+	if (!permit)
+		goto out;
+
+	state = 6;
+	if (!id && (flags & VCF_ZIDOK))
+		goto skip_id;
+
+	ret = -ESRCH;
+	if (args & VCA_VXI) {
+		vxi = lookup_vx_info(id);
+		if (!vxi)
+			goto out;
+
+		if ((flags & VCF_ADMIN) &&
+			/* special case kill for shutdown */
+			(cmd != VCMD_ctx_kill) &&
+			/* can context be administrated? */
+			!vx_info_flags(vxi, VXF_STATE_ADMIN, 0)) {
+			ret = -EACCES;
+			goto out_vxi;
+		}
+	}
+	state = 7;
+	if (args & VCA_NXI) {
+		nxi = lookup_nx_info(id);
+		if (!nxi)
+			goto out_vxi;
+
+		if ((flags & VCF_ADMIN) &&
+			/* can context be administrated? */
+			!nx_info_flags(nxi, NXF_STATE_ADMIN, 0)) {
+			ret = -EACCES;
+			goto out_nxi;
+		}
+	}
+skip_id:
+	state = 8;
+	ret = do_vcmd(cmd, id, vxi, nxi, data, compat);
+
+out_nxi:
+	if ((args & VCA_NXI) && nxi)
+		put_nx_info(nxi);
+out_vxi:
+	if ((args & VCA_VXI) && vxi)
+		put_vx_info(vxi);
+out:
+	vxdprintk(VXD_CBIT(switch, 1),
+		"vc: VCMD_%02d_%d[%d] = %08lx(%ld) [%d,%d]",
+		VC_CATEGORY(cmd), VC_COMMAND(cmd),
+		VC_VERSION(cmd), ret, ret, state, permit);
+	return ret;
+}
+
+asmlinkage long
+sys_vserver(uint32_t cmd, uint32_t id, void __user *data)
+{
+	return do_vserver(cmd, id, data, 0);
+}
+
+#ifdef	CONFIG_COMPAT
+
+asmlinkage long
+sys32_vserver(uint32_t cmd, uint32_t id, void __user *data)
+{
+	return do_vserver(cmd, id, data, 1);
+}
+
+#endif	/* CONFIG_COMPAT */
diff -uriN linux-2.6.32.43/kernel/vserver/sysctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/sysctl.c
--- linux-2.6.32.43/kernel/vserver/sysctl.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/sysctl.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,245 @@
+/*
+ *  kernel/vserver/sysctl.c
+ *
+ *  Virtual Context Support
+ *
+ *  Copyright (C) 2004-2007  Herbert Pötzl
+ *
+ *  V0.01  basic structure
+ *
+ */
+
+#include <linux/module.h>
+#include <linux/ctype.h>
+#include <linux/sysctl.h>
+#include <linux/parser.h>
+#include <asm/uaccess.h>
+
+
+enum {
+	CTL_DEBUG_ERROR		= 0,
+	CTL_DEBUG_SWITCH	= 1,
+	CTL_DEBUG_XID,
+	CTL_DEBUG_NID,
+	CTL_DEBUG_TAG,
+	CTL_DEBUG_NET,
+	CTL_DEBUG_LIMIT,
+	CTL_DEBUG_CRES,
+	CTL_DEBUG_DLIM,
+	CTL_DEBUG_QUOTA,
+	CTL_DEBUG_CVIRT,
+	CTL_DEBUG_SPACE,
+	CTL_DEBUG_MISC,
+};
+
+
+unsigned int vx_debug_switch	= 0;
+unsigned int vx_debug_xid	= 0;
+unsigned int vx_debug_nid	= 0;
+unsigned int vx_debug_tag	= 0;
+unsigned int vx_debug_net	= 0;
+unsigned int vx_debug_limit	= 0;
+unsigned int vx_debug_cres	= 0;
+unsigned int vx_debug_dlim	= 0;
+unsigned int vx_debug_quota	= 0;
+unsigned int vx_debug_cvirt	= 0;
+unsigned int vx_debug_space	= 0;
+unsigned int vx_debug_misc	= 0;
+
+
+static struct ctl_table_header *vserver_table_header;
+static ctl_table vserver_root_table[];
+
+
+void vserver_register_sysctl(void)
+{
+	if (!vserver_table_header) {
+		vserver_table_header = register_sysctl_table(vserver_root_table);
+	}
+
+}
+
+void vserver_unregister_sysctl(void)
+{
+	if (vserver_table_header) {
+		unregister_sysctl_table(vserver_table_header);
+		vserver_table_header = NULL;
+	}
+}
+
+
+static int proc_dodebug(ctl_table *table, int write,
+	void __user *buffer, size_t *lenp, loff_t *ppos)
+{
+	char		tmpbuf[20], *p, c;
+	unsigned int	value;
+	size_t		left, len;
+
+	if ((*ppos && !write) || !*lenp) {
+		*lenp = 0;
+		return 0;
+	}
+
+	left = *lenp;
+
+	if (write) {
+		if (!access_ok(VERIFY_READ, buffer, left))
+			return -EFAULT;
+		p = (char *)buffer;
+		while (left && __get_user(c, p) >= 0 && isspace(c))
+			left--, p++;
+		if (!left)
+			goto done;
+
+		if (left > sizeof(tmpbuf) - 1)
+			return -EINVAL;
+		if (copy_from_user(tmpbuf, p, left))
+			return -EFAULT;
+		tmpbuf[left] = '\0';
+
+		for (p = tmpbuf, value = 0; '0' <= *p && *p <= '9'; p++, left--)
+			value = 10 * value + (*p - '0');
+		if (*p && !isspace(*p))
+			return -EINVAL;
+		while (left && isspace(*p))
+			left--, p++;
+		*(unsigned int *)table->data = value;
+	} else {
+		if (!access_ok(VERIFY_WRITE, buffer, left))
+			return -EFAULT;
+		len = sprintf(tmpbuf, "%d", *(unsigned int *)table->data);
+		if (len > left)
+			len = left;
+		if (__copy_to_user(buffer, tmpbuf, len))
+			return -EFAULT;
+		if ((left -= len) > 0) {
+			if (put_user('\n', (char *)buffer + len))
+				return -EFAULT;
+			left--;
+		}
+	}
+
+done:
+	*lenp -= left;
+	*ppos += *lenp;
+	return 0;
+}
+
+static int zero;
+
+#define	CTL_ENTRY(ctl, name)				\
+	{						\
+		.ctl_name	= ctl,			\
+		.procname	= #name,		\
+		.data		= &vx_ ## name,		\
+		.maxlen		= sizeof(int),		\
+		.mode		= 0644,			\
+		.proc_handler	= &proc_dodebug,	\
+		.strategy	= &sysctl_intvec,	\
+		.extra1		= &zero,		\
+		.extra2		= &zero,		\
+	}
+
+static ctl_table vserver_debug_table[] = {
+	CTL_ENTRY(CTL_DEBUG_SWITCH,	debug_switch),
+	CTL_ENTRY(CTL_DEBUG_XID,	debug_xid),
+	CTL_ENTRY(CTL_DEBUG_NID,	debug_nid),
+	CTL_ENTRY(CTL_DEBUG_TAG,	debug_tag),
+	CTL_ENTRY(CTL_DEBUG_NET,	debug_net),
+	CTL_ENTRY(CTL_DEBUG_LIMIT,	debug_limit),
+	CTL_ENTRY(CTL_DEBUG_CRES,	debug_cres),
+	CTL_ENTRY(CTL_DEBUG_DLIM,	debug_dlim),
+	CTL_ENTRY(CTL_DEBUG_QUOTA,	debug_quota),
+	CTL_ENTRY(CTL_DEBUG_CVIRT,	debug_cvirt),
+	CTL_ENTRY(CTL_DEBUG_SPACE,	debug_space),
+	CTL_ENTRY(CTL_DEBUG_MISC,	debug_misc),
+	{ .ctl_name = 0 }
+};
+
+static ctl_table vserver_root_table[] = {
+	{
+		.ctl_name	= CTL_VSERVER,
+		.procname	= "vserver",
+		.mode		= 0555,
+		.child		= vserver_debug_table
+	},
+	{ .ctl_name = 0 }
+};
+
+
+static match_table_t tokens = {
+	{ CTL_DEBUG_SWITCH,	"switch=%x"	},
+	{ CTL_DEBUG_XID,	"xid=%x"	},
+	{ CTL_DEBUG_NID,	"nid=%x"	},
+	{ CTL_DEBUG_TAG,	"tag=%x"	},
+	{ CTL_DEBUG_NET,	"net=%x"	},
+	{ CTL_DEBUG_LIMIT,	"limit=%x"	},
+	{ CTL_DEBUG_CRES,	"cres=%x"	},
+	{ CTL_DEBUG_DLIM,	"dlim=%x"	},
+	{ CTL_DEBUG_QUOTA,	"quota=%x"	},
+	{ CTL_DEBUG_CVIRT,	"cvirt=%x"	},
+	{ CTL_DEBUG_SPACE,	"space=%x"	},
+	{ CTL_DEBUG_MISC,	"misc=%x"	},
+	{ CTL_DEBUG_ERROR,	NULL		}
+};
+
+#define	HANDLE_CASE(id, name, val)				\
+	case CTL_DEBUG_ ## id:					\
+		vx_debug_ ## name = val;			\
+		printk("vs_debug_" #name "=0x%x\n", val);	\
+		break
+
+
+static int __init vs_debug_setup(char *str)
+{
+	char *p;
+	int token;
+
+	printk("vs_debug_setup(%s)\n", str);
+	while ((p = strsep(&str, ",")) != NULL) {
+		substring_t args[MAX_OPT_ARGS];
+		unsigned int value;
+
+		if (!*p)
+			continue;
+
+		token = match_token(p, tokens, args);
+		value = (token > 0) ? simple_strtoul(args[0].from, NULL, 0) : 0;
+
+		switch (token) {
+		HANDLE_CASE(SWITCH, switch, value);
+		HANDLE_CASE(XID,    xid,    value);
+		HANDLE_CASE(NID,    nid,    value);
+		HANDLE_CASE(TAG,    tag,    value);
+		HANDLE_CASE(NET,    net,    value);
+		HANDLE_CASE(LIMIT,  limit,  value);
+		HANDLE_CASE(CRES,   cres,   value);
+		HANDLE_CASE(DLIM,   dlim,   value);
+		HANDLE_CASE(QUOTA,  quota,  value);
+		HANDLE_CASE(CVIRT,  cvirt,  value);
+		HANDLE_CASE(SPACE,  space,  value);
+		HANDLE_CASE(MISC,   misc,   value);
+		default:
+			return -EINVAL;
+			break;
+		}
+	}
+	return 1;
+}
+
+__setup("vsdebug=", vs_debug_setup);
+
+
+
+EXPORT_SYMBOL_GPL(vx_debug_switch);
+EXPORT_SYMBOL_GPL(vx_debug_xid);
+EXPORT_SYMBOL_GPL(vx_debug_nid);
+EXPORT_SYMBOL_GPL(vx_debug_net);
+EXPORT_SYMBOL_GPL(vx_debug_limit);
+EXPORT_SYMBOL_GPL(vx_debug_cres);
+EXPORT_SYMBOL_GPL(vx_debug_dlim);
+EXPORT_SYMBOL_GPL(vx_debug_quota);
+EXPORT_SYMBOL_GPL(vx_debug_cvirt);
+EXPORT_SYMBOL_GPL(vx_debug_space);
+EXPORT_SYMBOL_GPL(vx_debug_misc);
+
diff -uriN linux-2.6.32.43/kernel/vserver/tag.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/tag.c
--- linux-2.6.32.43/kernel/vserver/tag.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/tag.c	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,63 @@
+/*
+ *  linux/kernel/vserver/tag.c
+ *
+ *  Virtual Server: Shallow Tag Space
+ *
+ *  Copyright (C) 2007  Herbert Pötzl
+ *
+ *  V0.01  basic implementation
+ *
+ */
+
+#include <linux/sched.h>
+#include <linux/vserver/debug.h>
+#include <linux/vs_pid.h>
+#include <linux/vs_tag.h>
+
+#include <linux/vserver/tag_cmd.h>
+
+
+int dx_migrate_task(struct task_struct *p, tag_t tag)
+{
+	if (!p)
+		BUG();
+
+	vxdprintk(VXD_CBIT(tag, 5),
+		"dx_migrate_task(%p[#%d],#%d)", p, p->tag, tag);
+
+	task_lock(p);
+	p->tag = tag;
+	task_unlock(p);
+
+	vxdprintk(VXD_CBIT(tag, 5),
+		"moved task %p into [#%d]", p, tag);
+	return 0;
+}
+
+/* vserver syscall commands below here */
+
+/* taks xid and vx_info functions */
+
+
+int vc_task_tag(uint32_t id)
+{
+	tag_t tag;
+
+	if (id) {
+		struct task_struct *tsk;
+		read_lock(&tasklist_lock);
+		tsk = find_task_by_real_pid(id);
+		tag = (tsk) ? tsk->tag : -ESRCH;
+		read_unlock(&tasklist_lock);
+	} else
+		tag = dx_current_tag();
+	return tag;
+}
+
+
+int vc_tag_migrate(uint32_t tag)
+{
+	return dx_migrate_task(current, tag & 0xFFFF);
+}
+
+
diff -uriN linux-2.6.32.43/kernel/vserver/vci_config.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/vci_config.h
--- linux-2.6.32.43/kernel/vserver/vci_config.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/kernel/vserver/vci_config.h	2011-07-15 05:50:11.000000000 -0500
@@ -0,0 +1,81 @@
+
+/*  interface version */
+
+#define VCI_VERSION		0x00020305
+
+
+enum {
+	VCI_KCBIT_NO_DYNAMIC = 0,
+
+	VCI_KCBIT_PROC_SECURE = 4,
+	VCI_KCBIT_HARDCPU = 5,
+	VCI_KCBIT_IDLELIMIT = 6,
+	VCI_KCBIT_IDLETIME = 7,
+
+	VCI_KCBIT_COWBL = 8,
+	VCI_KCBIT_FULLCOWBL = 9,
+	VCI_KCBIT_SPACES = 10,
+	VCI_KCBIT_NETV2 = 11,
+
+	VCI_KCBIT_DEBUG = 16,
+	VCI_KCBIT_HISTORY = 20,
+	VCI_KCBIT_TAGGED = 24,
+	VCI_KCBIT_PPTAG = 28,
+
+	VCI_KCBIT_MORE = 31,
+};
+
+
+static inline uint32_t vci_kernel_config(void)
+{
+	return
+	(1 << VCI_KCBIT_NO_DYNAMIC) |
+
+	/* configured features */
+#ifdef	CONFIG_VSERVER_PROC_SECURE
+	(1 << VCI_KCBIT_PROC_SECURE) |
+#endif
+#ifdef	CONFIG_VSERVER_HARDCPU
+	(1 << VCI_KCBIT_HARDCPU) |
+#endif
+#ifdef	CONFIG_VSERVER_IDLELIMIT
+	(1 << VCI_KCBIT_IDLELIMIT) |
+#endif
+#ifdef	CONFIG_VSERVER_IDLETIME
+	(1 << VCI_KCBIT_IDLETIME) |
+#endif
+#ifdef	CONFIG_VSERVER_COWBL
+	(1 << VCI_KCBIT_COWBL) |
+	(1 << VCI_KCBIT_FULLCOWBL) |
+#endif
+	(1 << VCI_KCBIT_SPACES) |
+	(1 << VCI_KCBIT_NETV2) |
+
+	/* debug options */
+#ifdef	CONFIG_VSERVER_DEBUG
+	(1 << VCI_KCBIT_DEBUG) |
+#endif
+#ifdef	CONFIG_VSERVER_HISTORY
+	(1 << VCI_KCBIT_HISTORY) |
+#endif
+
+	/* inode context tagging */
+#if	defined(CONFIG_TAGGING_NONE)
+	(0 << VCI_KCBIT_TAGGED) |
+#elif	defined(CONFIG_TAGGING_UID16)
+	(1 << VCI_KCBIT_TAGGED) |
+#elif	defined(CONFIG_TAGGING_GID16)
+	(2 << VCI_KCBIT_TAGGED) |
+#elif	defined(CONFIG_TAGGING_ID24)
+	(3 << VCI_KCBIT_TAGGED) |
+#elif	defined(CONFIG_TAGGING_INTERN)
+	(4 << VCI_KCBIT_TAGGED) |
+#elif	defined(CONFIG_TAGGING_RUNTIME)
+	(5 << VCI_KCBIT_TAGGED) |
+#else
+	(7 << VCI_KCBIT_TAGGED) |
+#endif
+	(1 << VCI_KCBIT_PPTAG) |
+	0;
+}
+
diff -uriN linux-2.6.32.43/lib/bug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/bug.c
--- linux-2.6.32.43/lib/bug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/bug.c	2011-07-15 05:51:19.000000000 -0500
@@ -135,6 +135,8 @@
 		return BUG_TRAP_TYPE_NONE;
 
 	bug = find_bug(bugaddr);
+	if (!bug)
+		return BUG_TRAP_TYPE_NONE;
 
 	printk(KERN_EMERG "------------[ cut here ]------------\n");
 
diff -uriN linux-2.6.32.43/lib/debugobjects.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/debugobjects.c
--- linux-2.6.32.43/lib/debugobjects.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/debugobjects.c	2011-07-15 05:51:19.000000000 -0500
@@ -277,7 +277,7 @@
 	if (limit > 4)
 		return;
 
-	is_on_stack = object_is_on_stack(addr);
+	is_on_stack = object_starts_on_stack(addr);
 	if (is_on_stack == onstack)
 		return;
 
diff -uriN linux-2.6.32.43/lib/dma-debug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/dma-debug.c
--- linux-2.6.32.43/lib/dma-debug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/dma-debug.c	2011-07-15 05:51:19.000000000 -0500
@@ -861,7 +861,7 @@
 
 static void check_for_stack(struct device *dev, void *addr)
 {
-	if (object_is_on_stack(addr))
+	if (object_starts_on_stack(addr))
 		err_printk(dev, NULL, "DMA-API: device driver maps memory from"
 				"stack [addr=%p]\n", addr);
 }
diff -uriN linux-2.6.32.43/lib/idr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/idr.c
--- linux-2.6.32.43/lib/idr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/idr.c	2011-07-15 05:51:19.000000000 -0500
@@ -156,7 +156,7 @@
 			id = (id | ((1 << (IDR_BITS * l)) - 1)) + 1;
 
 			/* if already at the top layer, we need to grow */
-			if (id >= 1 << (idp->layers * IDR_BITS)) {
+			if (id >= (1 << (idp->layers * IDR_BITS))) {
 				*starting_id = id;
 				return IDR_NEED_TO_GROW;
 			}
diff -uriN linux-2.6.32.43/lib/inflate.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/inflate.c
--- linux-2.6.32.43/lib/inflate.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/inflate.c	2011-07-15 05:51:19.000000000 -0500
@@ -266,7 +266,7 @@
 		malloc_ptr = free_mem_ptr;
 }
 #else
-#define malloc(a) kmalloc(a, GFP_KERNEL)
+#define malloc(a) kmalloc((a), GFP_KERNEL)
 #define free(a) kfree(a)
 #endif
 
diff -uriN linux-2.6.32.43/lib/Kconfig.debug linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/Kconfig.debug
--- linux-2.6.32.43/lib/Kconfig.debug	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/Kconfig.debug	2011-07-15 05:51:19.000000000 -0500
@@ -905,7 +905,7 @@
 	select STACKTRACE
 	select SCHEDSTATS
 	select SCHED_DEBUG
-	depends on HAVE_LATENCYTOP_SUPPORT
+	depends on HAVE_LATENCYTOP_SUPPORT && !GRKERNSEC_HIDESYM
 	help
 	  Enable this option if you want to use the LatencyTOP tool
 	  to find out which userspace is blocking on what kernel operations.
diff -uriN linux-2.6.32.43/lib/kobject.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/kobject.c
--- linux-2.6.32.43/lib/kobject.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/kobject.c	2011-07-15 05:51:19.000000000 -0500
@@ -700,7 +700,7 @@
 	return ret;
 }
 
-struct sysfs_ops kobj_sysfs_ops = {
+const struct sysfs_ops kobj_sysfs_ops = {
 	.show	= kobj_attr_show,
 	.store	= kobj_attr_store,
 };
@@ -789,7 +789,7 @@
  * If the kset was not able to be created, NULL will be returned.
  */
 static struct kset *kset_create(const char *name,
-				struct kset_uevent_ops *uevent_ops,
+				const struct kset_uevent_ops *uevent_ops,
 				struct kobject *parent_kobj)
 {
 	struct kset *kset;
@@ -832,7 +832,7 @@
  * If the kset was not able to be created, NULL will be returned.
  */
 struct kset *kset_create_and_add(const char *name,
-				 struct kset_uevent_ops *uevent_ops,
+				 const struct kset_uevent_ops *uevent_ops,
 				 struct kobject *parent_kobj)
 {
 	struct kset *kset;
diff -uriN linux-2.6.32.43/lib/kobject_uevent.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/kobject_uevent.c
--- linux-2.6.32.43/lib/kobject_uevent.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/kobject_uevent.c	2011-07-15 05:51:19.000000000 -0500
@@ -95,7 +95,7 @@
 	const char *subsystem;
 	struct kobject *top_kobj;
 	struct kset *kset;
-	struct kset_uevent_ops *uevent_ops;
+	const struct kset_uevent_ops *uevent_ops;
 	u64 seq;
 	int i = 0;
 	int retval = 0;
diff -uriN linux-2.6.32.43/lib/kref.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/kref.c
--- linux-2.6.32.43/lib/kref.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/kref.c	2011-07-15 05:51:19.000000000 -0500
@@ -61,7 +61,7 @@
  */
 int kref_put(struct kref *kref, void (*release)(struct kref *kref))
 {
-	WARN_ON(release == NULL);
+	BUG_ON(release == NULL);
 	WARN_ON(release == (void (*)(struct kref *))kfree);
 
 	if (atomic_dec_and_test(&kref->refcount)) {
diff -uriN linux-2.6.32.43/lib/parser.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/parser.c
--- linux-2.6.32.43/lib/parser.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/parser.c	2011-07-15 05:51:19.000000000 -0500
@@ -126,7 +126,7 @@
 	char *buf;
 	int ret;
 
-	buf = kmalloc(s->to - s->from + 1, GFP_KERNEL);
+	buf = kmalloc((s->to - s->from) + 1, GFP_KERNEL);
 	if (!buf)
 		return -ENOMEM;
 	memcpy(buf, s->from, s->to - s->from);
diff -uriN linux-2.6.32.43/lib/radix-tree.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/radix-tree.c
--- linux-2.6.32.43/lib/radix-tree.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/radix-tree.c	2011-07-15 05:51:19.000000000 -0500
@@ -81,7 +81,7 @@
 	int nr;
 	struct radix_tree_node *nodes[RADIX_TREE_MAX_PATH];
 };
-static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads) = { 0, };
+static DEFINE_PER_CPU(struct radix_tree_preload, radix_tree_preloads);
 
 static inline gfp_t root_gfp_mask(struct radix_tree_root *root)
 {
diff -uriN linux-2.6.32.43/lib/random32.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/random32.c
--- linux-2.6.32.43/lib/random32.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/random32.c	2011-07-15 05:51:19.000000000 -0500
@@ -61,7 +61,7 @@
  */
 static inline u32 __seed(u32 x, u32 m)
 {
-	return (x < m) ? x + m : x;
+	return (x <= m) ? x + m + 1 : x;
 }
 
 /**
diff -uriN linux-2.6.32.43/lib/vsprintf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/vsprintf.c
--- linux-2.6.32.43/lib/vsprintf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/lib/vsprintf.c	2011-07-15 05:51:19.000000000 -0500
@@ -16,6 +16,9 @@
  * - scnprintf and vscnprintf
  */
 
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+#define __INCLUDED_BY_HIDESYM 1
+#endif
 #include <stdarg.h>
 #include <linux/module.h>
 #include <linux/types.h>
@@ -546,12 +549,12 @@
 	return buf;
 }
 
-static char *string(char *buf, char *end, char *s, struct printf_spec spec)
+static char *string(char *buf, char *end, const char *s, struct printf_spec spec)
 {
 	int len, i;
 
 	if ((unsigned long)s < PAGE_SIZE)
-		s = "<NULL>";
+		s = "(null)";
 
 	len = strnlen(s, spec.precision);
 
@@ -581,7 +584,7 @@
 	unsigned long value = (unsigned long) ptr;
 #ifdef CONFIG_KALLSYMS
 	char sym[KSYM_SYMBOL_LEN];
-	if (ext != 'f' && ext != 's')
+	if (ext != 'f' && ext != 's' && ext != 'a')
 		sprint_symbol(sym, value);
 	else
 		kallsyms_lookup(value, NULL, NULL, NULL, sym);
@@ -801,6 +804,8 @@
  * - 'f' For simple symbolic function names without offset
  * - 'S' For symbolic direct pointers with offset
  * - 's' For symbolic direct pointers without offset
+ * - 'A' For symbolic direct pointers with offset approved for use with GRKERNSEC_HIDESYM
+ * - 'a' For symbolic direct pointers without offset approved for use with GRKERNSEC_HIDESYM
  * - 'R' For a struct resource pointer, it prints the range of
  *       addresses (not the name nor the flags)
  * - 'M' For a 6-byte MAC address, it prints the address in the
@@ -822,7 +827,7 @@
 			struct printf_spec spec)
 {
 	if (!ptr)
-		return string(buf, end, "(null)", spec);
+		return string(buf, end, "(nil)", spec);
 
 	switch (*fmt) {
 	case 'F':
@@ -831,6 +836,14 @@
 	case 's':
 		/* Fallthrough */
 	case 'S':
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		break;
+#else
+		return symbol_string(buf, end, ptr, spec, *fmt);
+#endif
+	case 'a':
+		/* Fallthrough */
+	case 'A':
 		return symbol_string(buf, end, ptr, spec, *fmt);
 	case 'R':
 		return resource_string(buf, end, ptr, spec);
@@ -1445,7 +1458,7 @@
 			size_t len;
 			if ((unsigned long)save_str > (unsigned long)-PAGE_SIZE
 					|| (unsigned long)save_str < PAGE_SIZE)
-				save_str = "<NULL>";
+				save_str = "(null)";
 			len = strlen(save_str);
 			if (str + len + 1 < end)
 				memcpy(str, save_str, len + 1);
@@ -1555,11 +1568,11 @@
 	typeof(type) value;						\
 	if (sizeof(type) == 8) {					\
 		args = PTR_ALIGN(args, sizeof(u32));			\
-		*(u32 *)&value = *(u32 *)args;				\
-		*((u32 *)&value + 1) = *(u32 *)(args + 4);		\
+		*(u32 *)&value = *(const u32 *)args;			\
+		*((u32 *)&value + 1) = *(const u32 *)(args + 4);	\
 	} else {							\
 		args = PTR_ALIGN(args, sizeof(type));			\
-		value = *(typeof(type) *)args;				\
+		value = *(const typeof(type) *)args;			\
 	}								\
 	args += sizeof(type);						\
 	value;								\
@@ -1622,7 +1635,7 @@
 			const char *str_arg = args;
 			size_t len = strlen(str_arg);
 			args += len + 1;
-			str = string(str, end, (char *)str_arg, spec);
+			str = string(str, end, str_arg, spec);
 			break;
 		}
 
diff -uriN linux-2.6.32.43/localversion-grsec linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/localversion-grsec
--- linux-2.6.32.43/localversion-grsec	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/localversion-grsec	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1 @@
+-grsec
diff -uriN linux-2.6.32.43/localversion-vserver linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/localversion-vserver
--- linux-2.6.32.43/localversion-vserver	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/localversion-vserver	2011-07-15 05:50:30.000000000 -0500
@@ -0,0 +1 @@
+-vs2.3.0.36.29.7
diff -uriN linux-2.6.32.43/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Makefile
--- linux-2.6.32.43/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/Makefile	2011-07-15 05:51:19.000000000 -0500
@@ -221,8 +221,9 @@
 
 HOSTCC       = gcc
 HOSTCXX      = g++
-HOSTCFLAGS   = -Wall -Wmissing-prototypes -Wstrict-prototypes -O2 -fomit-frame-pointer
-HOSTCXXFLAGS = -O2
+HOSTCFLAGS   = -Wall -W -Wmissing-prototypes -Wstrict-prototypes -Wno-unused-parameter -Wno-missing-field-initializers -O2 -fomit-frame-pointer -fno-delete-null-pointer-checks
+HOSTCFLAGS  += $(call cc-option, -Wno-empty-body)
+HOSTCXXFLAGS = -O2 -fno-delete-null-pointer-checks
 
 # Decide whether to build built-in, modular, or both.
 # Normally, just do built-in.
@@ -342,10 +343,12 @@
 KBUILD_CPPFLAGS := -D__KERNEL__
 
 KBUILD_CFLAGS   := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
+		   -W -Wno-unused-parameter -Wno-missing-field-initializers \
 		   -fno-strict-aliasing -fno-common \
 		   -Werror-implicit-function-declaration \
 		   -Wno-format-security \
 		   -fno-delete-null-pointer-checks
+KBUILD_CFLAGS	+= $(call cc-option, -Wno-empty-body)
 KBUILD_AFLAGS   := -D__ASSEMBLY__
 
 # Read KERNELRELEASE from include/config/kernel.release (if it exists)
@@ -376,8 +379,8 @@
 # Rules shared between *config targets and build targets
 
 # Basic helpers built in scripts/
-PHONY += scripts_basic
-scripts_basic:
+PHONY += scripts_basic pax-plugin
+scripts_basic: pax-plugin
 	$(Q)$(MAKE) $(build)=scripts/basic
 
 # To avoid any implicit rule to kick in, define an empty command.
@@ -403,7 +406,7 @@
 # of make so .config is not included in this case either (for *config).
 
 no-dot-config-targets := clean mrproper distclean \
-			 cscope TAGS tags help %docs check% \
+			 cscope gtags TAGS tags help %docs check% \
 			 include/linux/version.h headers_% \
 			 kernelrelease kernelversion
 
@@ -528,6 +531,18 @@
 
 include $(srctree)/arch/$(SRCARCH)/Makefile
 
+ifeq ($(CONFIG_PAX_MEMORY_STACKLEAK),y)
+KBUILD_CFLAGS += $(call cc-ifversion, -ge, 0405, -fplugin=$(objtree)/tools/gcc/pax_plugin.so -fplugin-arg-pax_plugin-track-lowest-sp=100)
+endif
+pax-plugin:
+ifneq (,$(findstring pax_plugin, $(KBUILD_CFLAGS)))
+	$(Q)$(MAKE) $(build)=tools/gcc
+else
+ifeq ($(CONFIG_PAX_MEMORY_STACKLEAK),y)
+	$(Q)echo "warning, your gcc does not support plugins, PAX_MEMORY_STACKLEAK will be less secure"
+endif
+endif
+
 ifneq ($(CONFIG_FRAME_WARN),0)
 KBUILD_CFLAGS += $(call cc-option,-Wframe-larger-than=${CONFIG_FRAME_WARN})
 endif
@@ -644,7 +659,7 @@
 
 
 ifeq ($(KBUILD_EXTMOD),)
-core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
+core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
 
 vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
@@ -970,7 +985,7 @@
 endif
 
 # prepare2 creates a makefile if using a separate output directory
-prepare2: prepare3 outputmakefile
+prepare2: prepare3 outputmakefile pax-plugin
 
 prepare1: prepare2 include/linux/version.h include/linux/utsrelease.h \
                    include/asm include/config/auto.conf
@@ -1198,7 +1213,7 @@
                   include/linux/autoconf.h include/linux/version.h      \
                   include/linux/utsrelease.h                            \
                   include/linux/bounds.h include/asm*/asm-offsets.h     \
-		  Module.symvers Module.markers tags TAGS cscope*
+		  Module.symvers Module.markers tags TAGS cscope* GPATH GTAGS GRTAGS GSYMS
 
 # clean - Delete most, but leave enough to build external modules
 #
@@ -1289,6 +1304,7 @@
 	@echo  '  modules_prepare - Set up for building external modules'
 	@echo  '  tags/TAGS	  - Generate tags file for editors'
 	@echo  '  cscope	  - Generate cscope index'
+	@echo  '  gtags           - Generate GNU GLOBAL index'
 	@echo  '  kernelrelease	  - Output the release version string'
 	@echo  '  kernelversion	  - Output the version stored in Makefile'
 	@echo  '  headers_install - Install sanitised kernel headers to INSTALL_HDR_PATH'; \
@@ -1421,7 +1437,7 @@
 	$(call cmd,rmdirs)
 	$(call cmd,rmfiles)
 	@find $(KBUILD_EXTMOD) $(RCS_FIND_IGNORE) \
-		\( -name '*.[oas]' -o -name '*.ko' -o -name '.*.cmd' \
+		\( -name '*.[oas]' -o -name '*.[ks]o' -o -name '.*.cmd' \
 		-o -name '.*.d' -o -name '.*.tmp' -o -name '*.mod.c' \
 		-o -name '*.gcno' \) -type f -print | xargs rm -f
 
@@ -1445,7 +1461,7 @@
 quiet_cmd_tags = GEN     $@
       cmd_tags = $(CONFIG_SHELL) $(srctree)/scripts/tags.sh $@
 
-tags TAGS cscope: FORCE
+tags TAGS cscope gtags: FORCE
 	$(call cmd,tags)
 
 # Scripts to check various things for consistency
diff -uriN linux-2.6.32.43/mm/allocpercpu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/allocpercpu.c
--- linux-2.6.32.43/mm/allocpercpu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/allocpercpu.c	2011-07-15 05:50:11.000000000 -0500
@@ -160,12 +160,14 @@
 
 void __init setup_per_cpu_areas(void)
 {
-	unsigned long size, i;
+	unsigned long size, vspc, i;
 	char *ptr;
 	unsigned long nr_possible_cpus = num_possible_cpus();
 
+	vspc = PERCPU_PERCTX * CONFIG_VSERVER_CONTEXTS;
+
 	/* Copy section for each CPU (we discard the original) */
-	size = ALIGN(PERCPU_ENOUGH_ROOM, PAGE_SIZE);
+	size = ALIGN(PERCPU_ENOUGH_ROOM + vspc, PAGE_SIZE);
 	ptr = alloc_bootmem_pages(size * nr_possible_cpus);
 
 	for_each_possible_cpu(i) {
diff -uriN linux-2.6.32.43/mm/backing-dev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/backing-dev.c
--- linux-2.6.32.43/mm/backing-dev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/backing-dev.c	2011-07-15 05:51:19.000000000 -0500
@@ -484,7 +484,7 @@
  * Add the default flusher task that gets created for any bdi
  * that has dirty data pending writeout
  */
-void static bdi_add_default_flusher_task(struct backing_dev_info *bdi)
+static void bdi_add_default_flusher_task(struct backing_dev_info *bdi)
 {
 	if (!bdi_cap_writeback_dirty(bdi))
 		return;
diff -uriN linux-2.6.32.43/mm/filemap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/filemap.c
--- linux-2.6.32.43/mm/filemap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/filemap.c	2011-07-15 05:51:19.000000000 -0500
@@ -1631,7 +1631,7 @@
 	struct address_space *mapping = file->f_mapping;
 
 	if (!mapping->a_ops->readpage)
-		return -ENOEXEC;
+		return -ENODEV;
 	file_accessed(file);
 	vma->vm_ops = &generic_file_vm_ops;
 	vma->vm_flags |= VM_CAN_NONLINEAR;
@@ -2027,6 +2027,7 @@
                         *pos = i_size_read(inode);
 
 		if (limit != RLIM_INFINITY) {
+			gr_learn_resource(current, RLIMIT_FSIZE,*pos, 0);
 			if (*pos >= limit) {
 				send_sig(SIGXFSZ, current, 0);
 				return -EFBIG;
diff -uriN linux-2.6.32.43/mm/filemap_xip.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/filemap_xip.c
--- linux-2.6.32.43/mm/filemap_xip.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/filemap_xip.c	2011-07-15 05:50:11.000000000 -0500
@@ -17,6 +17,7 @@
 #include <linux/sched.h>
 #include <linux/seqlock.h>
 #include <linux/mutex.h>
+#include <linux/vs_memory.h>
 #include <asm/tlbflush.h>
 #include <asm/io.h>
 
diff -uriN linux-2.6.32.43/mm/fremap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/fremap.c
--- linux-2.6.32.43/mm/fremap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/fremap.c	2011-07-15 05:51:19.000000000 -0500
@@ -16,6 +16,7 @@
 #include <linux/module.h>
 #include <linux/syscalls.h>
 #include <linux/mmu_notifier.h>
+#include <linux/vs_memory.h>
 
 #include <asm/mmu_context.h>
 #include <asm/cacheflush.h>
@@ -153,6 +154,11 @@
  retry:
 	vma = find_vma(mm, start);
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (vma && (mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_MAYEXEC))
+		goto out;
+#endif
+
 	/*
 	 * Make sure the vma is shared, that it supports prefaulting,
 	 * and that the remapped range is valid and fully within
@@ -221,7 +227,7 @@
 		/*
 		 * drop PG_Mlocked flag for over-mapped range
 		 */
-		unsigned int saved_flags = vma->vm_flags;
+		unsigned long saved_flags = vma->vm_flags;
 		munlock_vma_pages_range(vma, start, start + size);
 		vma->vm_flags = saved_flags;
 	}
diff -uriN linux-2.6.32.43/mm/highmem.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/highmem.c
--- linux-2.6.32.43/mm/highmem.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/highmem.c	2011-07-15 05:51:19.000000000 -0500
@@ -116,9 +116,10 @@
 		 * So no dangers, even with speculative execution.
 		 */
 		page = pte_page(pkmap_page_table[i]);
+		pax_open_kernel();
 		pte_clear(&init_mm, (unsigned long)page_address(page),
 			  &pkmap_page_table[i]);
-
+		pax_close_kernel();
 		set_page_address(page, NULL);
 		need_flush = 1;
 	}
@@ -177,9 +178,11 @@
 		}
 	}
 	vaddr = PKMAP_ADDR(last_pkmap_nr);
+
+	pax_open_kernel();
 	set_pte_at(&init_mm, vaddr,
 		   &(pkmap_page_table[last_pkmap_nr]), mk_pte(page, kmap_prot));
-
+	pax_close_kernel();
 	pkmap_count[last_pkmap_nr] = 1;
 	set_page_address(page, (void *)vaddr);
 
diff -uriN linux-2.6.32.43/mm/hugetlb.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/hugetlb.c
--- linux-2.6.32.43/mm/hugetlb.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/hugetlb.c	2011-07-15 05:51:19.000000000 -0500
@@ -24,6 +24,7 @@
 #include <asm/io.h>
 
 #include <linux/hugetlb.h>
+#include <linux/vs_memory.h>
 #include "internal.h"
 
 const unsigned long hugetlb_zero = 0, hugetlb_infinity = ~0UL;
@@ -1933,6 +1934,26 @@
 	return 1;
 }
 
+#ifdef CONFIG_PAX_SEGMEXEC
+static void pax_mirror_huge_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m)
+{
+	struct mm_struct *mm = vma->vm_mm;
+	struct vm_area_struct *vma_m;
+	unsigned long address_m;
+	pte_t *ptep_m;
+
+	vma_m = pax_find_mirror_vma(vma);
+	if (!vma_m)
+		return;
+
+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
+	address_m = address + SEGMEXEC_TASK_SIZE;
+	ptep_m = huge_pte_offset(mm, address_m & HPAGE_MASK);
+	get_page(page_m);
+	set_huge_pte_at(mm, address_m, ptep_m, make_huge_pte(vma_m, page_m, 0));
+}
+#endif
+
 static int hugetlb_cow(struct mm_struct *mm, struct vm_area_struct *vma,
 			unsigned long address, pte_t *ptep, pte_t pte,
 			struct page *pagecache_page)
@@ -2004,6 +2025,11 @@
 		huge_ptep_clear_flush(vma, address, ptep);
 		set_huge_pte_at(mm, address, ptep,
 				make_huge_pte(vma, new_page, 1));
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		pax_mirror_huge_pte(vma, address, new_page);
+#endif
+
 		/* Make the old page be freed below */
 		new_page = old_page;
 	}
@@ -2135,6 +2161,10 @@
 				&& (vma->vm_flags & VM_SHARED)));
 	set_huge_pte_at(mm, address, ptep, new_pte);
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	pax_mirror_huge_pte(vma, address, page);
+#endif
+
 	if ((flags & FAULT_FLAG_WRITE) && !(vma->vm_flags & VM_SHARED)) {
 		/* Optimization, do the COW without a second fault */
 		ret = hugetlb_cow(mm, vma, address, ptep, new_pte, page);
@@ -2163,6 +2193,28 @@
 	static DEFINE_MUTEX(hugetlb_instantiation_mutex);
 	struct hstate *h = hstate_vma(vma);
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m;
+
+	vma_m = pax_find_mirror_vma(vma);
+	if (vma_m) {
+		unsigned long address_m;
+
+		if (vma->vm_start > vma_m->vm_start) {
+			address_m = address;
+			address -= SEGMEXEC_TASK_SIZE;
+			vma = vma_m;
+			h = hstate_vma(vma);
+		} else
+			address_m = address + SEGMEXEC_TASK_SIZE;
+
+		if (!huge_pte_alloc(mm, address_m, huge_page_size(h)))
+			return VM_FAULT_OOM;
+		address_m &= HPAGE_MASK;
+		unmap_hugepage_range(vma, address_m, address_m + HPAGE_SIZE, NULL);
+	}
+#endif
+
 	ptep = huge_pte_alloc(mm, address, huge_page_size(h));
 	if (!ptep)
 		return VM_FAULT_OOM;
diff -uriN linux-2.6.32.43/mm/internal.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/internal.h
--- linux-2.6.32.43/mm/internal.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/internal.h	2011-07-15 05:51:19.000000000 -0500
@@ -49,6 +49,7 @@
  * in mm/page_alloc.c
  */
 extern void __free_pages_bootmem(struct page *page, unsigned int order);
+extern void free_compound_page(struct page *page);
 extern void prep_compound_page(struct page *page, unsigned long order);
 
 
diff -uriN linux-2.6.32.43/mm/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/Kconfig
--- linux-2.6.32.43/mm/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/Kconfig	2011-07-15 05:51:19.000000000 -0500
@@ -228,7 +228,7 @@
 config DEFAULT_MMAP_MIN_ADDR
         int "Low address space to protect from user allocation"
 	depends on MMU
-        default 4096
+        default 65536
         help
 	  This is the portion of low virtual memory which should be protected
 	  from userspace allocation.  Keeping a user from writing to low pages
diff -uriN linux-2.6.32.43/mm/kmemleak.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/kmemleak.c
--- linux-2.6.32.43/mm/kmemleak.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/kmemleak.c	2011-07-15 05:51:19.000000000 -0500
@@ -358,7 +358,7 @@
 
 	for (i = 0; i < object->trace_len; i++) {
 		void *ptr = (void *)object->trace[i];
-		seq_printf(seq, "    [<%p>] %pS\n", ptr, ptr);
+		seq_printf(seq, "    [<%p>] %pA\n", ptr, ptr);
 	}
 }
 
diff -uriN linux-2.6.32.43/mm/maccess.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/maccess.c
--- linux-2.6.32.43/mm/maccess.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/maccess.c	2011-07-15 05:51:19.000000000 -0500
@@ -14,7 +14,7 @@
  * Safely read from address @src to the buffer at @dst.  If a kernel fault
  * happens, handle that and return -EFAULT.
  */
-long probe_kernel_read(void *dst, void *src, size_t size)
+long probe_kernel_read(void *dst, const void *src, size_t size)
 {
 	long ret;
 	mm_segment_t old_fs = get_fs();
@@ -39,7 +39,7 @@
  * Safely write to address @dst from the buffer at @src.  If a kernel fault
  * happens, handle that and return -EFAULT.
  */
-long notrace __weak probe_kernel_write(void *dst, void *src, size_t size)
+long notrace __weak probe_kernel_write(void *dst, const void *src, size_t size)
 {
 	long ret;
 	mm_segment_t old_fs = get_fs();
diff -uriN linux-2.6.32.43/mm/madvise.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/madvise.c
--- linux-2.6.32.43/mm/madvise.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/madvise.c	2011-07-15 05:51:19.000000000 -0500
@@ -44,6 +44,10 @@
 	pgoff_t pgoff;
 	unsigned long new_flags = vma->vm_flags;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m;
+#endif
+
 	switch (behavior) {
 	case MADV_NORMAL:
 		new_flags = new_flags & ~VM_RAND_READ & ~VM_SEQ_READ;
@@ -103,6 +107,13 @@
 	/*
 	 * vm_flags is protected by the mmap_sem held in write mode.
 	 */
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	vma_m = pax_find_mirror_vma(vma);
+	if (vma_m)
+		vma_m->vm_flags = new_flags & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT);
+#endif
+
 	vma->vm_flags = new_flags;
 
 out:
@@ -161,6 +172,11 @@
 			     struct vm_area_struct ** prev,
 			     unsigned long start, unsigned long end)
 {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m;
+#endif
+
 	*prev = vma;
 	if (vma->vm_flags & (VM_LOCKED|VM_HUGETLB|VM_PFNMAP))
 		return -EINVAL;
@@ -173,6 +189,21 @@
 		zap_page_range(vma, start, end - start, &details);
 	} else
 		zap_page_range(vma, start, end - start, NULL);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	vma_m = pax_find_mirror_vma(vma);
+	if (vma_m) {
+		if (unlikely(vma->vm_flags & VM_NONLINEAR)) {
+			struct zap_details details = {
+				.nonlinear_vma = vma_m,
+				.last_index = ULONG_MAX,
+			};
+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, &details);
+		} else
+			zap_page_range(vma, start + SEGMEXEC_TASK_SIZE, end - start, NULL);
+	}
+#endif
+
 	return 0;
 }
 
@@ -359,6 +390,16 @@
 	if (end < start)
 		goto out;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
+		if (end > SEGMEXEC_TASK_SIZE)
+			goto out;
+	} else
+#endif
+
+	if (end > TASK_SIZE)
+		goto out;
+
 	error = 0;
 	if (end == start)
 		goto out;
diff -uriN linux-2.6.32.43/mm/memcontrol.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/memcontrol.c
--- linux-2.6.32.43/mm/memcontrol.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/memcontrol.c	2011-07-15 05:50:11.000000000 -0500
@@ -549,6 +549,31 @@
 				struct mem_cgroup, css);
 }
 
+u64 mem_cgroup_res_read_u64(struct mem_cgroup *mem, int member)
+{
+	return res_counter_read_u64(&mem->res, member);
+}
+
+u64 mem_cgroup_memsw_read_u64(struct mem_cgroup *mem, int member)
+{
+	return res_counter_read_u64(&mem->memsw, member);
+}
+
+s64 mem_cgroup_stat_read_cache(struct mem_cgroup *mem)
+{
+	return mem_cgroup_read_stat(&mem->stat, MEM_CGROUP_STAT_CACHE);
+}
+
+s64 mem_cgroup_stat_read_anon(struct mem_cgroup *mem)
+{
+	return mem_cgroup_read_stat(&mem->stat, MEM_CGROUP_STAT_RSS);
+}
+
+s64 mem_cgroup_stat_read_mapped(struct mem_cgroup *mem)
+{
+	return mem_cgroup_read_stat(&mem->stat, MEM_CGROUP_STAT_MAPPED_FILE);
+}
+
 static struct mem_cgroup *try_get_mem_cgroup_from_mm(struct mm_struct *mm)
 {
 	struct mem_cgroup *mem = NULL;
diff -uriN linux-2.6.32.43/mm/memory.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/memory.c
--- linux-2.6.32.43/mm/memory.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/memory.c	2011-07-15 06:22:31.000000000 -0500
@@ -56,6 +56,7 @@
 #include <linux/kallsyms.h>
 #include <linux/swapops.h>
 #include <linux/elf.h>
+// #include <linux/vs_memory.h>
 
 #include <asm/io.h>
 #include <asm/pgalloc.h>
@@ -187,8 +188,12 @@
 		return;
 
 	pmd = pmd_offset(pud, start);
+
+#if !defined(CONFIG_X86_32) || !defined(CONFIG_PAX_PER_CPU_PGD)
 	pud_clear(pud);
 	pmd_free_tlb(tlb, pmd, start);
+#endif
+
 }
 
 static inline void free_pud_range(struct mmu_gather *tlb, pgd_t *pgd,
@@ -219,9 +224,12 @@
 	if (end - 1 > ceiling - 1)
 		return;
 
+#if !defined(CONFIG_X86_64) || !defined(CONFIG_PAX_PER_CPU_PGD)
 	pud = pud_offset(pgd, start);
 	pgd_clear(pgd);
 	pud_free_tlb(tlb, pud, start);
+#endif
+
 }
 
 /*
@@ -647,6 +655,9 @@
 	int progress = 0;
 	int rss[2];
 
+	if (!vx_rss_avail(dst_mm, ((end - addr)/PAGE_SIZE + 1)))
+		return -ENOMEM;
+
 again:
 	rss[1] = rss[0] = 0;
 	dst_pte = pte_alloc_map_lock(dst_mm, dst_pmd, addr, &dst_ptl);
@@ -1251,10 +1262,10 @@
 			(VM_MAYREAD | VM_MAYWRITE) : (VM_READ | VM_WRITE);
 	i = 0;
 
-	do {
+	while (nr_pages) {
 		struct vm_area_struct *vma;
 
-		vma = find_extend_vma(mm, start);
+		vma = find_vma(mm, start);
 		if (!vma && in_gate_area(tsk, start)) {
 			unsigned long pg = start & PAGE_MASK;
 			struct vm_area_struct *gate_vma = get_gate_vma(tsk);
@@ -1306,7 +1317,7 @@
 			continue;
 		}
 
-		if (!vma ||
+		if (!vma || start < vma->vm_start ||
 		    (vma->vm_flags & (VM_IO | VM_PFNMAP)) ||
 		    !(vm_flags & vma->vm_flags))
 			return i ? : -EFAULT;
@@ -1381,7 +1392,7 @@
 			start += PAGE_SIZE;
 			nr_pages--;
 		} while (nr_pages && start < vma->vm_end);
-	} while (nr_pages);
+	}
 	return i;
 }
 
@@ -1526,6 +1537,10 @@
 	page_add_file_rmap(page);
 	set_pte_at(mm, addr, pte, mk_pte(page, prot));
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	pax_mirror_file_pte(vma, addr, page, ptl);
+#endif
+
 	retval = 0;
 	pte_unmap_unlock(pte, ptl);
 	return retval;
@@ -1560,10 +1575,22 @@
 int vm_insert_page(struct vm_area_struct *vma, unsigned long addr,
 			struct page *page)
 {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m;
+#endif
+
 	if (addr < vma->vm_start || addr >= vma->vm_end)
 		return -EFAULT;
 	if (!page_count(page))
 		return -EINVAL;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	vma_m = pax_find_mirror_vma(vma);
+	if (vma_m)
+		vma_m->vm_flags |= VM_INSERTPAGE;
+#endif
+
 	vma->vm_flags |= VM_INSERTPAGE;
 	return insert_page(vma, addr, page, vma->vm_page_prot);
 }
@@ -1649,6 +1676,7 @@
 			unsigned long pfn)
 {
 	BUG_ON(!(vma->vm_flags & VM_MIXEDMAP));
+	BUG_ON(vma->vm_mirror);
 
 	if (addr < vma->vm_start || addr >= vma->vm_end)
 		return -EFAULT;
@@ -1977,6 +2005,186 @@
 		copy_user_highpage(dst, src, va, vma);
 }
 
+#ifdef CONFIG_PAX_SEGMEXEC
+static void pax_unmap_mirror_pte(struct vm_area_struct *vma, unsigned long address, pmd_t *pmd)
+{
+	struct mm_struct *mm = vma->vm_mm;
+	spinlock_t *ptl;
+	pte_t *pte, entry;
+
+	pte = pte_offset_map_lock(mm, pmd, address, &ptl);
+	entry = *pte;
+	if (!pte_present(entry)) {
+		if (!pte_none(entry)) {
+			BUG_ON(pte_file(entry));
+			free_swap_and_cache(pte_to_swp_entry(entry));
+			pte_clear_not_present_full(mm, address, pte, 0);
+		}
+	} else {
+		struct page *page;
+
+		flush_cache_page(vma, address, pte_pfn(entry));
+		entry = ptep_clear_flush(vma, address, pte);
+		BUG_ON(pte_dirty(entry));
+		page = vm_normal_page(vma, address, entry);
+		if (page) {
+			update_hiwater_rss(mm);
+			if (PageAnon(page))
+				dec_mm_counter(mm, anon_rss);
+			else
+				dec_mm_counter(mm, file_rss);
+			page_remove_rmap(page);
+			page_cache_release(page);
+		}
+	}
+	pte_unmap_unlock(pte, ptl);
+}
+
+/* PaX: if vma is mirrored, synchronize the mirror's PTE
+ *
+ * the ptl of the lower mapped page is held on entry and is not released on exit
+ * or inside to ensure atomic changes to the PTE states (swapout, mremap, munmap, etc)
+ */
+static void pax_mirror_anon_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
+{
+	struct mm_struct *mm = vma->vm_mm;
+	unsigned long address_m;
+	spinlock_t *ptl_m;
+	struct vm_area_struct *vma_m;
+	pmd_t *pmd_m;
+	pte_t *pte_m, entry_m;
+
+	BUG_ON(!page_m || !PageAnon(page_m));
+
+	vma_m = pax_find_mirror_vma(vma);
+	if (!vma_m)
+		return;
+
+	BUG_ON(!PageLocked(page_m));
+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
+	address_m = address + SEGMEXEC_TASK_SIZE;
+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
+	pte_m = pte_offset_map_nested(pmd_m, address_m);
+	ptl_m = pte_lockptr(mm, pmd_m);
+	if (ptl != ptl_m) {
+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
+		if (!pte_none(*pte_m))
+			goto out;
+	}
+
+	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
+	page_cache_get(page_m);
+	page_add_anon_rmap(page_m, vma_m, address_m);
+	inc_mm_counter(mm, anon_rss);
+	set_pte_at(mm, address_m, pte_m, entry_m);
+	update_mmu_cache(vma_m, address_m, entry_m);
+out:
+	if (ptl != ptl_m)
+		spin_unlock(ptl_m);
+	pte_unmap_nested(pte_m);
+	unlock_page(page_m);
+}
+
+void pax_mirror_file_pte(struct vm_area_struct *vma, unsigned long address, struct page *page_m, spinlock_t *ptl)
+{
+	struct mm_struct *mm = vma->vm_mm;
+	unsigned long address_m;
+	spinlock_t *ptl_m;
+	struct vm_area_struct *vma_m;
+	pmd_t *pmd_m;
+	pte_t *pte_m, entry_m;
+
+	BUG_ON(!page_m || PageAnon(page_m));
+
+	vma_m = pax_find_mirror_vma(vma);
+	if (!vma_m)
+		return;
+
+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
+	address_m = address + SEGMEXEC_TASK_SIZE;
+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
+	pte_m = pte_offset_map_nested(pmd_m, address_m);
+	ptl_m = pte_lockptr(mm, pmd_m);
+	if (ptl != ptl_m) {
+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
+		if (!pte_none(*pte_m))
+			goto out;
+	}
+
+	entry_m = pfn_pte(page_to_pfn(page_m), vma_m->vm_page_prot);
+	page_cache_get(page_m);
+	page_add_file_rmap(page_m);
+	inc_mm_counter(mm, file_rss);
+	set_pte_at(mm, address_m, pte_m, entry_m);
+	update_mmu_cache(vma_m, address_m, entry_m);
+out:
+	if (ptl != ptl_m)
+		spin_unlock(ptl_m);
+	pte_unmap_nested(pte_m);
+}
+
+static void pax_mirror_pfn_pte(struct vm_area_struct *vma, unsigned long address, unsigned long pfn_m, spinlock_t *ptl)
+{
+	struct mm_struct *mm = vma->vm_mm;
+	unsigned long address_m;
+	spinlock_t *ptl_m;
+	struct vm_area_struct *vma_m;
+	pmd_t *pmd_m;
+	pte_t *pte_m, entry_m;
+
+	vma_m = pax_find_mirror_vma(vma);
+	if (!vma_m)
+		return;
+
+	BUG_ON(address >= SEGMEXEC_TASK_SIZE);
+	address_m = address + SEGMEXEC_TASK_SIZE;
+	pmd_m = pmd_offset(pud_offset(pgd_offset(mm, address_m), address_m), address_m);
+	pte_m = pte_offset_map_nested(pmd_m, address_m);
+	ptl_m = pte_lockptr(mm, pmd_m);
+	if (ptl != ptl_m) {
+		spin_lock_nested(ptl_m, SINGLE_DEPTH_NESTING);
+		if (!pte_none(*pte_m))
+			goto out;
+	}
+
+	entry_m = pfn_pte(pfn_m, vma_m->vm_page_prot);
+	set_pte_at(mm, address_m, pte_m, entry_m);
+out:
+	if (ptl != ptl_m)
+		spin_unlock(ptl_m);
+	pte_unmap_nested(pte_m);
+}
+
+static void pax_mirror_pte(struct vm_area_struct *vma, unsigned long address, pte_t *pte, pmd_t *pmd, spinlock_t *ptl)
+{
+	struct page *page_m;
+	pte_t entry;
+
+	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC))
+		goto out;
+
+	entry = *pte;
+	page_m  = vm_normal_page(vma, address, entry);
+	if (!page_m)
+		pax_mirror_pfn_pte(vma, address, pte_pfn(entry), ptl);
+	else if (PageAnon(page_m)) {
+		if (pax_find_mirror_vma(vma)) {
+			pte_unmap_unlock(pte, ptl);
+			lock_page(page_m);
+			pte = pte_offset_map_lock(vma->vm_mm, pmd, address, &ptl);
+			if (pte_same(entry, *pte))
+				pax_mirror_anon_pte(vma, address, page_m, ptl);
+			else
+				unlock_page(page_m);
+		}
+	} else
+		pax_mirror_file_pte(vma, address, page_m, ptl);
+
+out:
+	pte_unmap_unlock(pte, ptl);
+}
+#endif
+
 /*
  * This routine handles present pages, when users try to write
  * to a shared page. It is done by copying the page to a new address
@@ -2156,6 +2364,12 @@
 	 */
 	page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
 	if (likely(pte_same(*page_table, orig_pte))) {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		if (pax_find_mirror_vma(vma))
+			BUG_ON(!trylock_page(new_page));
+#endif
+
 		if (old_page) {
 			if (!PageAnon(old_page)) {
 				dec_mm_counter(mm, file_rss);
@@ -2207,6 +2421,10 @@
 			page_remove_rmap(old_page);
 		}
 
+#ifdef CONFIG_PAX_SEGMEXEC
+		pax_mirror_anon_pte(vma, address, new_page, ptl);
+#endif
+
 		/* Free the old page.. */
 		new_page = old_page;
 		ret |= VM_FAULT_WRITE;
@@ -2606,6 +2824,11 @@
 	swap_free(entry);
 	if (vm_swap_full() || (vma->vm_flags & VM_LOCKED) || PageMlocked(page))
 		try_to_free_swap(page);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((flags & FAULT_FLAG_WRITE) || !pax_find_mirror_vma(vma))
+#endif
+
 	unlock_page(page);
 
 	if (flags & FAULT_FLAG_WRITE) {
@@ -2617,6 +2840,11 @@
 
 	/* No need to invalidate - it was non-present before */
 	update_mmu_cache(vma, address, pte);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	pax_mirror_anon_pte(vma, address, page, ptl);
+#endif
+
 unlock:
 	pte_unmap_unlock(page_table, ptl);
 out:
@@ -2632,40 +2860,6 @@
 }
 
 /*
- * This is like a special single-page "expand_{down|up}wards()",
- * except we must first make sure that 'address{-|+}PAGE_SIZE'
- * doesn't hit another vma.
- */
-static inline int check_stack_guard_page(struct vm_area_struct *vma, unsigned long address)
-{
-	address &= PAGE_MASK;
-	if ((vma->vm_flags & VM_GROWSDOWN) && address == vma->vm_start) {
-		struct vm_area_struct *prev = vma->vm_prev;
-
-		/*
-		 * Is there a mapping abutting this one below?
-		 *
-		 * That's only ok if it's the same stack mapping
-		 * that has gotten split..
-		 */
-		if (prev && prev->vm_end == address)
-			return prev->vm_flags & VM_GROWSDOWN ? 0 : -ENOMEM;
-
-		expand_stack(vma, address - PAGE_SIZE);
-	}
-	if ((vma->vm_flags & VM_GROWSUP) && address + PAGE_SIZE == vma->vm_end) {
-		struct vm_area_struct *next = vma->vm_next;
-
-		/* As VM_GROWSDOWN but s/below/above/ */
-		if (next && next->vm_start == address + PAGE_SIZE)
-			return next->vm_flags & VM_GROWSUP ? 0 : -ENOMEM;
-
-		expand_upwards(vma, address + PAGE_SIZE);
-	}
-	return 0;
-}
-
-/*
  * We enter with non-exclusive mmap_sem (to exclude vma changes,
  * but allow concurrent faults), and pte mapped but not yet locked.
  * We return with mmap_sem still held, but pte unmapped and unlocked.
@@ -2674,27 +2868,26 @@
 		unsigned long address, pte_t *page_table, pmd_t *pmd,
 		unsigned int flags)
 {
-	struct page *page;
+	struct page *page = NULL;
 	spinlock_t *ptl;
 	pte_t entry;
 
-	pte_unmap(page_table);
-
-	/* Check if we need to add a guard page to the stack */
-	if (check_stack_guard_page(vma, address) < 0)
-		return VM_FAULT_SIGBUS;
+	if (!vx_rss_avail(mm, 1))
+		goto oom;
 
-	/* Use the zero-page for reads */
 	if (!(flags & FAULT_FLAG_WRITE)) {
 		entry = pte_mkspecial(pfn_pte(my_zero_pfn(address),
 						vma->vm_page_prot));
-		page_table = pte_offset_map_lock(mm, pmd, address, &ptl);
+		ptl = pte_lockptr(mm, pmd);
+		spin_lock(ptl);
 		if (!pte_none(*page_table))
 			goto unlock;
 		goto setpte;
 	}
 
 	/* Allocate our own private page. */
+	pte_unmap(page_table);
+
 	if (unlikely(anon_vma_prepare(vma)))
 		goto oom;
 	page = alloc_zeroed_user_highpage_movable(vma, address);
@@ -2713,6 +2906,11 @@
 	if (!pte_none(*page_table))
 		goto release;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (pax_find_mirror_vma(vma))
+		BUG_ON(!trylock_page(page));
+#endif
+
 	inc_mm_counter(mm, anon_rss);
 	page_add_new_anon_rmap(page, vma, address);
 setpte:
@@ -2720,6 +2918,12 @@
 
 	/* No need to invalidate - it was non-present before */
 	update_mmu_cache(vma, address, entry);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (page)
+		pax_mirror_anon_pte(vma, address, page, ptl);
+#endif
+
 unlock:
 	pte_unmap_unlock(page_table, ptl);
 	return 0;
@@ -2862,6 +3066,12 @@
 	 */
 	/* Only go through if we didn't race with anybody else... */
 	if (likely(pte_same(*page_table, orig_pte))) {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		if (anon && pax_find_mirror_vma(vma))
+			BUG_ON(!trylock_page(page));
+#endif
+
 		flush_icache_page(vma, page);
 		entry = mk_pte(page, vma->vm_page_prot);
 		if (flags & FAULT_FLAG_WRITE)
@@ -2881,6 +3091,14 @@
 
 		/* no need to invalidate: a not-present page won't be cached */
 		update_mmu_cache(vma, address, entry);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		if (anon)
+			pax_mirror_anon_pte(vma, address, page, ptl);
+		else
+			pax_mirror_file_pte(vma, address, page, ptl);
+#endif
+
 	} else {
 		if (charged)
 			mem_cgroup_uncharge_page(page);
@@ -2986,6 +3204,7 @@
 {
 	pte_t entry;
 	spinlock_t *ptl;
+	int ret = 0, type = VXPT_UNKNOWN;
 
 	entry = *pte;
 	if (!pte_present(entry)) {
@@ -3010,9 +3229,12 @@
 	if (unlikely(!pte_same(*pte, entry)))
 		goto unlock;
 	if (flags & FAULT_FLAG_WRITE) {
-		if (!pte_write(entry))
-			return do_wp_page(mm, vma, address,
+		if (!pte_write(entry)) {
+			ret = do_wp_page(mm, vma, address,
 					pte, pmd, ptl, entry);
+			type = VXPT_WRITE;
+			goto out;
+		}
 		entry = pte_mkdirty(entry);
 	}
 	entry = pte_mkyoung(entry);
@@ -3028,9 +3250,18 @@
 		if (flags & FAULT_FLAG_WRITE)
 			flush_tlb_page(vma, address);
 	}
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	pax_mirror_pte(vma, address, pte, pmd, ptl);
+	return 0;
+#endif
+
 unlock:
 	pte_unmap_unlock(pte, ptl);
-	return 0;
+	ret = 0;
+out:
+	vx_page_fault(mm, vma, type, ret);
+	return ret;
 }
 
 /*
@@ -3044,6 +3275,10 @@
 	pmd_t *pmd;
 	pte_t *pte;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m;
+#endif
+
 	__set_current_state(TASK_RUNNING);
 
 	count_vm_event(PGFAULT);
@@ -3051,6 +3286,34 @@
 	if (unlikely(is_vm_hugetlb_page(vma)))
 		return hugetlb_fault(mm, vma, address, flags);
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	vma_m = pax_find_mirror_vma(vma);
+	if (vma_m) {
+		unsigned long address_m;
+		pgd_t *pgd_m;
+		pud_t *pud_m;
+		pmd_t *pmd_m;
+
+		if (vma->vm_start > vma_m->vm_start) {
+			address_m = address;
+			address -= SEGMEXEC_TASK_SIZE;
+			vma = vma_m;
+		} else
+			address_m = address + SEGMEXEC_TASK_SIZE;
+
+		pgd_m = pgd_offset(mm, address_m);
+		pud_m = pud_alloc(mm, pgd_m, address_m);
+		if (!pud_m)
+			return VM_FAULT_OOM;
+		pmd_m = pmd_alloc(mm, pud_m, address_m);
+		if (!pmd_m)
+			return VM_FAULT_OOM;
+		if (!pmd_present(*pmd_m) && __pte_alloc(mm, pmd_m, address_m))
+			return VM_FAULT_OOM;
+		pax_unmap_mirror_pte(vma_m, address_m, pmd_m);
+	}
+#endif
+
 	pgd = pgd_offset(mm, address);
 	pud = pud_alloc(mm, pgd, address);
 	if (!pud)
@@ -3148,7 +3411,7 @@
 	gate_vma.vm_start = FIXADDR_USER_START;
 	gate_vma.vm_end = FIXADDR_USER_END;
 	gate_vma.vm_flags = VM_READ | VM_MAYREAD | VM_EXEC | VM_MAYEXEC;
-	gate_vma.vm_page_prot = __P101;
+	gate_vma.vm_page_prot = vm_get_page_prot(gate_vma.vm_flags);
 	/*
 	 * Make sure the vDSO gets into every core dump.
 	 * Dumping its contents makes post-mortem fully interpretable later
diff -uriN linux-2.6.32.43/mm/memory-failure.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/memory-failure.c
--- linux-2.6.32.43/mm/memory-failure.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/memory-failure.c	2011-07-15 05:51:19.000000000 -0500
@@ -46,7 +46,7 @@
 
 int sysctl_memory_failure_recovery __read_mostly = 1;
 
-atomic_long_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
+atomic_long_unchecked_t mce_bad_pages __read_mostly = ATOMIC_LONG_INIT(0);
 
 /*
  * Send all the processes who have the page mapped an ``action optional''
@@ -745,7 +745,7 @@
 		return 0;
 	}
 
-	atomic_long_add(1, &mce_bad_pages);
+	atomic_long_add_unchecked(1, &mce_bad_pages);
 
 	/*
 	 * We need/can do nothing about count=0 pages.
diff -uriN linux-2.6.32.43/mm/mempolicy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mempolicy.c
--- linux-2.6.32.43/mm/mempolicy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mempolicy.c	2011-07-15 05:51:19.000000000 -0500
@@ -573,6 +573,10 @@
 	struct vm_area_struct *next;
 	int err;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m;
+#endif
+
 	err = 0;
 	for (; vma && vma->vm_start < end; vma = next) {
 		next = vma->vm_next;
@@ -584,6 +588,16 @@
 			err = policy_vma(vma, new);
 		if (err)
 			break;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		vma_m = pax_find_mirror_vma(vma);
+		if (vma_m) {
+			err = policy_vma(vma_m, new);
+			if (err)
+				break;
+		}
+#endif
+
 	}
 	return err;
 }
@@ -1002,6 +1016,17 @@
 
 	if (end < start)
 		return -EINVAL;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
+		if (end > SEGMEXEC_TASK_SIZE)
+			return -EINVAL;
+	} else
+#endif
+
+	if (end > TASK_SIZE)
+		return -EINVAL;
+
 	if (end == start)
 		return 0;
 
@@ -1207,6 +1232,14 @@
 	if (!mm)
 		return -EINVAL;
 
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+	if (mm != current->mm &&
+	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
+		err = -EPERM;
+		goto out;
+	}
+#endif
+
 	/*
 	 * Check if this process has the right to modify the specified
 	 * process. The right exists if the process has administrative
@@ -1216,8 +1249,7 @@
 	rcu_read_lock();
 	tcred = __task_cred(task);
 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
-	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
-	    !capable(CAP_SYS_NICE)) {
+	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
 		rcu_read_unlock();
 		err = -EPERM;
 		goto out;
@@ -2396,7 +2428,7 @@
 
 	if (file) {
 		seq_printf(m, " file=");
-		seq_path(m, &file->f_path, "\n\t= ");
+		seq_path(m, &file->f_path, "\n\t\\= ");
 	} else if (vma->vm_start <= mm->brk && vma->vm_end >= mm->start_brk) {
 		seq_printf(m, " heap");
 	} else if (vma->vm_start <= mm->start_stack &&
diff -uriN linux-2.6.32.43/mm/migrate.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/migrate.c
--- linux-2.6.32.43/mm/migrate.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/migrate.c	2011-07-15 05:51:19.000000000 -0500
@@ -916,6 +916,8 @@
 	unsigned long chunk_start;
 	int err;
 
+	pax_track_stack();
+
 	task_nodes = cpuset_mems_allowed(task);
 
 	err = -ENOMEM;
@@ -1106,6 +1108,14 @@
 	if (!mm)
 		return -EINVAL;
 
+#ifdef CONFIG_GRKERNSEC_PROC_MEMMAP
+	if (mm != current->mm &&
+	    (mm->pax_flags & MF_PAX_RANDMMAP || mm->pax_flags & MF_PAX_SEGMEXEC)) {
+		err = -EPERM;
+		goto out;
+	}
+#endif
+
 	/*
 	 * Check if this process has the right to modify the specified
 	 * process. The right exists if the process has administrative
@@ -1115,8 +1125,7 @@
 	rcu_read_lock();
 	tcred = __task_cred(task);
 	if (cred->euid != tcred->suid && cred->euid != tcred->uid &&
-	    cred->uid  != tcred->suid && cred->uid  != tcred->uid &&
-	    !capable(CAP_SYS_NICE)) {
+	    cred->uid  != tcred->suid && !capable(CAP_SYS_NICE)) {
 		rcu_read_unlock();
 		err = -EPERM;
 		goto out;
diff -uriN linux-2.6.32.43/mm/mlock.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mlock.c
--- linux-2.6.32.43/mm/mlock.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mlock.c	2011-07-15 06:54:26.000000000 -0500
@@ -13,11 +13,13 @@
 #include <linux/pagemap.h>
 #include <linux/mempolicy.h>
 #include <linux/syscalls.h>
+#include <linux/security.h>
 #include <linux/sched.h>
 #include <linux/module.h>
 #include <linux/rmap.h>
 #include <linux/mmzone.h>
 #include <linux/hugetlb.h>
+#include <linux/vs_memory.h>
 
 #include "internal.h"
 
@@ -138,13 +140,6 @@
 	}
 }
 
-static inline int stack_guard_page(struct vm_area_struct *vma, unsigned long addr)
-{
-	return (vma->vm_flags & VM_GROWSDOWN) &&
-		(vma->vm_start == addr) &&
-		!vma_stack_continue(vma->vm_prev, addr);
-}
-
 /**
  * __mlock_vma_pages_range() -  mlock a range of pages in the vma.
  * @vma:   target vma
@@ -177,12 +172,6 @@
 	if (vma->vm_flags & VM_WRITE)
 		gup_flags |= FOLL_WRITE;
 
-	/* We don't try to access the guard page of a stack vma */
-	if (stack_guard_page(vma, start)) {
-		addr += PAGE_SIZE;
-		nr_pages--;
-	}
-
 	while (nr_pages > 0) {
 		int i;
 
@@ -414,7 +403,7 @@
 	nr_pages = (end - start) >> PAGE_SHIFT;
 	if (!lock)
 		nr_pages = -nr_pages;
-	mm->locked_vm += nr_pages;
+	vx_vmlocked_add(mm, nr_pages);
 
 	/*
 	 * vm_flags is protected by the mmap_sem held in write mode.
@@ -440,7 +429,7 @@
 {
 	unsigned long nstart, end, tmp;
 	struct vm_area_struct * vma, * prev;
-	int error;
+	int error = -EINVAL;
 
 	len = PAGE_ALIGN(len);
 	end = start + len;
@@ -448,6 +437,9 @@
 		return -EINVAL;
 	if (end == start)
 		return 0;
+	if (end > TASK_SIZE)
+		return -EINVAL;
+
 	vma = find_vma_prev(current->mm, start, &prev);
 	if (!vma || vma->vm_start > start)
 		return -ENOMEM;
@@ -458,6 +450,11 @@
 	for (nstart = start ; ; ) {
 		unsigned int newflags;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
+			break;
+#endif
+
 		/* Here we know that  vma->vm_start <= nstart < vma->vm_end. */
 
 		newflags = vma->vm_flags | VM_LOCKED;
@@ -487,7 +484,7 @@
 
 SYSCALL_DEFINE2(mlock, unsigned long, start, size_t, len)
 {
-	unsigned long locked;
+	unsigned long locked, grow;
 	unsigned long lock_limit;
 	int error = -ENOMEM;
 
@@ -500,15 +497,19 @@
 	len = PAGE_ALIGN(len + (start & ~PAGE_MASK));
 	start &= PAGE_MASK;
 
-	locked = len >> PAGE_SHIFT;
-	locked += current->mm->locked_vm;
+	grow = len >> PAGE_SHIFT;
+	if (!vx_vmlocked_avail(current->mm, grow))
+		goto out;
+	locked = current->mm->locked_vm + grow;
 
 	lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
 	lock_limit >>= PAGE_SHIFT;
 
 	/* check against resource limits */
+	gr_learn_resource(current, RLIMIT_MEMLOCK, (current->mm->locked_vm << PAGE_SHIFT) + len, 1);
 	if ((locked <= lock_limit) || capable(CAP_IPC_LOCK))
 		error = do_mlock(start, len, 1);
+out:
 	up_write(&current->mm->mmap_sem);
 	return error;
 }
@@ -528,17 +529,23 @@
 static int do_mlockall(int flags)
 {
 	struct vm_area_struct * vma, * prev = NULL;
-	unsigned int def_flags = 0;
 
 	if (flags & MCL_FUTURE)
-		def_flags = VM_LOCKED;
-	current->mm->def_flags = def_flags;
+		current->mm->def_flags |= VM_LOCKED;
+	else
+		current->mm->def_flags &= ~VM_LOCKED;
 	if (flags == MCL_FUTURE)
 		goto out;
 
 	for (vma = current->mm->mmap; vma ; vma = prev->vm_next) {
-		unsigned int newflags;
+		unsigned long newflags;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+		if ((current->mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE))
+			break;
+#endif
+
+		BUG_ON(vma->vm_end > TASK_SIZE);
 		newflags = vma->vm_flags | VM_LOCKED;
 		if (!(flags & MCL_CURRENT))
 			newflags &= ~VM_LOCKED;
@@ -570,6 +577,9 @@
 	lock_limit >>= PAGE_SHIFT;
 
 	ret = -ENOMEM;
+	gr_learn_resource(current, RLIMIT_MEMLOCK, current->mm->total_vm << PAGE_SHIFT, 1);
+	if (!vx_vmlocked_avail(current->mm, current->mm->total_vm))
+		goto out;
 	if (!(flags & MCL_CURRENT) || (current->mm->total_vm <= lock_limit) ||
 	    capable(CAP_IPC_LOCK))
 		ret = do_mlockall(flags);
@@ -644,8 +654,10 @@
 	if (lim < vm)
 		goto out;
 
-	mm->total_vm  += pgsz;
-	mm->locked_vm += pgsz;
+	// mm->total_vm  += pgsz;
+	vx_vmpages_add(mm, pgsz);
+	// mm->locked_vm += pgsz;
+	vx_vmlocked_add(mm, pgsz);
 
 	error = 0;
  out:
@@ -659,8 +671,10 @@
 
 	down_write(&mm->mmap_sem);
 
-	mm->total_vm  -= pgsz;
-	mm->locked_vm -= pgsz;
+	// mm->total_vm  -= pgsz;
+	vx_vmpages_sub(mm, pgsz);
+	// mm->locked_vm -= pgsz;
+	vx_vmlocked_sub(mm, pgsz);
 
 	up_write(&mm->mmap_sem);
 }
diff -uriN linux-2.6.32.43/mm/mmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mmap.c
--- linux-2.6.32.43/mm/mmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mmap.c	2011-07-15 07:00:12.000000000 -0500
@@ -45,6 +45,16 @@
 #define arch_rebalance_pgtables(addr, len)		(addr)
 #endif
 
+static inline void verify_mm_writelocked(struct mm_struct *mm)
+{
+#if defined(CONFIG_DEBUG_VM) || defined(CONFIG_PAX)
+	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
+		up_read(&mm->mmap_sem);
+		BUG();
+	}
+#endif
+}
+
 static void unmap_region(struct mm_struct *mm,
 		struct vm_area_struct *vma, struct vm_area_struct *prev,
 		unsigned long start, unsigned long end);
@@ -70,22 +80,32 @@
  *		x: (no) no	x: (no) yes	x: (no) yes	x: (yes) yes
  *
  */
-pgprot_t protection_map[16] = {
+pgprot_t protection_map[16] __read_only = {
 	__P000, __P001, __P010, __P011, __P100, __P101, __P110, __P111,
 	__S000, __S001, __S010, __S011, __S100, __S101, __S110, __S111
 };
 
 pgprot_t vm_get_page_prot(unsigned long vm_flags)
 {
-	return __pgprot(pgprot_val(protection_map[vm_flags &
+	pgprot_t prot = __pgprot(pgprot_val(protection_map[vm_flags &
 				(VM_READ|VM_WRITE|VM_EXEC|VM_SHARED)]) |
 			pgprot_val(arch_vm_get_page_prot(vm_flags)));
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
+	if (!nx_enabled &&
+	    (vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC &&
+	    (vm_flags & (VM_READ | VM_WRITE)))
+		prot = __pgprot(pte_val(pte_exprotect(__pte(pgprot_val(prot)))));
+#endif
+
+	return prot;
 }
 EXPORT_SYMBOL(vm_get_page_prot);
 
 int sysctl_overcommit_memory = OVERCOMMIT_GUESS;  /* heuristic overcommit */
 int sysctl_overcommit_ratio = 50;	/* default is 50% */
 int sysctl_max_map_count __read_mostly = DEFAULT_MAX_MAP_COUNT;
+unsigned long sysctl_heap_stack_gap __read_mostly = 64*1024;
 struct percpu_counter vm_committed_as;
 
 /*
@@ -231,6 +251,7 @@
 	struct vm_area_struct *next = vma->vm_next;
 
 	might_sleep();
+	BUG_ON(vma->vm_mirror);
 	if (vma->vm_ops && vma->vm_ops->close)
 		vma->vm_ops->close(vma);
 	if (vma->vm_file) {
@@ -267,6 +288,7 @@
 	 * not page aligned -Ram Gupta
 	 */
 	rlim = current->signal->rlim[RLIMIT_DATA].rlim_cur;
+	gr_learn_resource(current, RLIMIT_DATA, (brk - mm->start_brk) + (mm->end_data - mm->start_data), 1);
 	if (rlim < RLIM_INFINITY && (brk - mm->start_brk) +
 			(mm->end_data - mm->start_data) > rlim)
 		goto out;
@@ -704,6 +726,12 @@
 can_vma_merge_before(struct vm_area_struct *vma, unsigned long vm_flags,
 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
 {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_start == SEGMEXEC_TASK_SIZE)
+		return 0;
+#endif
+
 	if (is_mergeable_vma(vma, file, vm_flags) &&
 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
 		if (vma->vm_pgoff == vm_pgoff)
@@ -723,6 +751,12 @@
 can_vma_merge_after(struct vm_area_struct *vma, unsigned long vm_flags,
 	struct anon_vma *anon_vma, struct file *file, pgoff_t vm_pgoff)
 {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) && vma->vm_end == SEGMEXEC_TASK_SIZE)
+		return 0;
+#endif
+
 	if (is_mergeable_vma(vma, file, vm_flags) &&
 	    is_mergeable_anon_vma(anon_vma, vma->anon_vma)) {
 		pgoff_t vm_pglen;
@@ -765,12 +799,19 @@
 struct vm_area_struct *vma_merge(struct mm_struct *mm,
 			struct vm_area_struct *prev, unsigned long addr,
 			unsigned long end, unsigned long vm_flags,
-		     	struct anon_vma *anon_vma, struct file *file,
+			struct anon_vma *anon_vma, struct file *file,
 			pgoff_t pgoff, struct mempolicy *policy)
 {
 	pgoff_t pglen = (end - addr) >> PAGE_SHIFT;
 	struct vm_area_struct *area, *next;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE, end_m = end + SEGMEXEC_TASK_SIZE;
+	struct vm_area_struct *area_m = NULL, *next_m = NULL, *prev_m = NULL;
+
+	BUG_ON((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE < end);
+#endif
+
 	/*
 	 * We later require that vma->vm_flags == vm_flags,
 	 * so this tests vma->vm_flags & VM_SPECIAL, too.
@@ -786,6 +827,15 @@
 	if (next && next->vm_end == end)		/* cases 6, 7, 8 */
 		next = next->vm_next;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (prev)
+		prev_m = pax_find_mirror_vma(prev);
+	if (area)
+		area_m = pax_find_mirror_vma(area);
+	if (next)
+		next_m = pax_find_mirror_vma(next);
+#endif
+
 	/*
 	 * Can it merge with the predecessor?
 	 */
@@ -805,9 +855,24 @@
 							/* cases 1, 6 */
 			vma_adjust(prev, prev->vm_start,
 				next->vm_end, prev->vm_pgoff, NULL);
-		} else					/* cases 2, 5, 7 */
+
+#ifdef CONFIG_PAX_SEGMEXEC
+			if (prev_m)
+				vma_adjust(prev_m, prev_m->vm_start,
+					next_m->vm_end, prev_m->vm_pgoff, NULL);
+#endif
+
+		} else {				/* cases 2, 5, 7 */
 			vma_adjust(prev, prev->vm_start,
 				end, prev->vm_pgoff, NULL);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+			if (prev_m)
+				vma_adjust(prev_m, prev_m->vm_start,
+					end_m, prev_m->vm_pgoff, NULL);
+#endif
+
+		}
 		return prev;
 	}
 
@@ -818,12 +883,27 @@
  			mpol_equal(policy, vma_policy(next)) &&
 			can_vma_merge_before(next, vm_flags,
 					anon_vma, file, pgoff+pglen)) {
-		if (prev && addr < prev->vm_end)	/* case 4 */
+		if (prev && addr < prev->vm_end) {	/* case 4 */
 			vma_adjust(prev, prev->vm_start,
 				addr, prev->vm_pgoff, NULL);
-		else					/* cases 3, 8 */
+
+#ifdef CONFIG_PAX_SEGMEXEC
+			if (prev_m)
+				vma_adjust(prev_m, prev_m->vm_start,
+					addr_m, prev_m->vm_pgoff, NULL);
+#endif
+
+		} else {				/* cases 3, 8 */
 			vma_adjust(area, addr, next->vm_end,
 				next->vm_pgoff - pglen, NULL);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+			if (area_m)
+				vma_adjust(area_m, addr_m, next_m->vm_end,
+					next_m->vm_pgoff - pglen, NULL);
+#endif
+
+		}
 		return area;
 	}
 
@@ -898,14 +978,11 @@
 void vm_stat_account(struct mm_struct *mm, unsigned long flags,
 						struct file *file, long pages)
 {
-	const unsigned long stack_flags
-		= VM_STACK_FLAGS & (VM_GROWSUP|VM_GROWSDOWN);
-
 	if (file) {
 		mm->shared_vm += pages;
 		if ((flags & (VM_EXEC|VM_WRITE)) == VM_EXEC)
 			mm->exec_vm += pages;
-	} else if (flags & stack_flags)
+	} else if (flags & (VM_GROWSUP|VM_GROWSDOWN))
 		mm->stack_vm += pages;
 	if (flags & (VM_RESERVED|VM_IO))
 		mm->reserved_vm += pages;
@@ -932,7 +1009,7 @@
 	 * (the exception is when the underlying filesystem is noexec
 	 *  mounted, in which case we dont add PROT_EXEC.)
 	 */
-	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
+	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
 		if (!(file && (file->f_path.mnt->mnt_flags & MNT_NOEXEC)))
 			prot |= PROT_EXEC;
 
@@ -958,7 +1035,7 @@
 	/* Obtain the address to map to. we verify (or select) it and ensure
 	 * that it represents a valid section of the address space.
 	 */
-	addr = get_unmapped_area(file, addr, len, pgoff, flags);
+	addr = get_unmapped_area(file, addr, len, pgoff, flags | ((prot & PROT_EXEC) ? MAP_EXECUTABLE : 0));
 	if (addr & ~PAGE_MASK)
 		return addr;
 
@@ -969,6 +1046,36 @@
 	vm_flags = calc_vm_prot_bits(prot) | calc_vm_flag_bits(flags) |
 			mm->def_flags | VM_MAYREAD | VM_MAYWRITE | VM_MAYEXEC;
 
+#ifdef CONFIG_PAX_MPROTECT
+	if (mm->pax_flags & MF_PAX_MPROTECT) {
+#ifndef CONFIG_PAX_MPROTECT_COMPAT
+		if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC)) {
+			gr_log_rwxmmap(file);
+
+#ifdef CONFIG_PAX_EMUPLT
+			vm_flags &= ~VM_EXEC;
+#else
+			return -EPERM;
+#endif
+
+		}
+
+		if (!(vm_flags & VM_EXEC))
+			vm_flags &= ~VM_MAYEXEC;
+#else
+		if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
+			vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
+#endif
+		else
+			vm_flags &= ~VM_MAYWRITE;
+	}
+#endif
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
+	if ((mm->pax_flags & MF_PAX_PAGEEXEC) && file)
+		vm_flags &= ~VM_PAGEEXEC;
+#endif
+
 	if (flags & MAP_LOCKED)
 		if (!can_do_mlock())
 			return -EPERM;
@@ -980,6 +1087,7 @@
 		locked += mm->locked_vm;
 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
 		lock_limit >>= PAGE_SHIFT;
+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
 			return -EAGAIN;
 	}
@@ -1053,6 +1161,9 @@
 	if (error)
 		return error;
 
+	if (!gr_acl_handle_mmap(file, prot))
+		return -EACCES;
+
 	return mmap_region(file, addr, len, flags, vm_flags, pgoff);
 }
 EXPORT_SYMBOL(do_mmap_pgoff);
@@ -1065,10 +1176,10 @@
  */
 int vma_wants_writenotify(struct vm_area_struct *vma)
 {
-	unsigned int vm_flags = vma->vm_flags;
+	unsigned long vm_flags = vma->vm_flags;
 
 	/* If it was private or non-writable, the write bit is already clear */
-	if ((vm_flags & (VM_WRITE|VM_SHARED)) != ((VM_WRITE|VM_SHARED)))
+	if ((vm_flags & (VM_WRITE|VM_SHARED)) != (VM_WRITE|VM_SHARED))
 		return 0;
 
 	/* The backer wishes to know when pages are first written to? */
@@ -1117,14 +1228,24 @@
 	unsigned long charged = 0;
 	struct inode *inode =  file ? file->f_path.dentry->d_inode : NULL;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m = NULL;
+#endif
+
+	/*
+	 * mm->mmap_sem is required to protect against another thread
+	 * changing the mappings in case we sleep.
+	 */
+	verify_mm_writelocked(mm);
+
 	/* Clear old maps */
 	error = -ENOMEM;
-munmap_back:
 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
 	if (vma && vma->vm_start < addr + len) {
 		if (do_munmap(mm, addr, len))
 			return -ENOMEM;
-		goto munmap_back;
+		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+		BUG_ON(vma && vma->vm_start < addr + len);
 	}
 
 	/* Check against address space limit. */
@@ -1173,6 +1294,16 @@
 		goto unacct_error;
 	}
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vm_flags & VM_EXEC)) {
+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+		if (!vma_m) {
+			error = -ENOMEM;
+			goto free_vma;
+		}
+	}
+#endif
+
 	vma->vm_mm = mm;
 	vma->vm_start = addr;
 	vma->vm_end = addr + len;
@@ -1195,6 +1326,19 @@
 		error = file->f_op->mmap(file, vma);
 		if (error)
 			goto unmap_and_free_vma;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		if (vma_m && (vm_flags & VM_EXECUTABLE))
+			added_exe_file_vma(mm);
+#endif
+
+#if defined(CONFIG_PAX_PAGEEXEC) && defined(CONFIG_X86_32)
+		if ((mm->pax_flags & MF_PAX_PAGEEXEC) && !(vma->vm_flags & VM_SPECIAL)) {
+			vma->vm_flags |= VM_PAGEEXEC;
+			vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
+		}
+#endif
+
 		if (vm_flags & VM_EXECUTABLE)
 			added_exe_file_vma(mm);
 
@@ -1218,14 +1362,21 @@
 	vma_link(mm, vma, prev, rb_link, rb_parent);
 	file = vma->vm_file;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (vma_m)
+		pax_mirror_vma(vma_m, vma);
+#endif
+
 	/* Once vma denies write, undo our temporary denial count */
 	if (correct_wcount)
 		atomic_inc(&inode->i_writecount);
 out:
 	perf_event_mmap(vma);
 
-	mm->total_vm += len >> PAGE_SHIFT;
+	// mm->total_vm += len >> PAGE_SHIFT;
+	vx_vmpages_add(mm, len >> PAGE_SHIFT);
 	vm_stat_account(mm, vm_flags, file, len >> PAGE_SHIFT);
+	track_exec_limit(mm, addr, addr + len, vm_flags);
 	if (vm_flags & VM_LOCKED) {
 		/*
 		 * makes pages present; downgrades, drops, reacquires mmap_sem
@@ -1233,7 +1384,8 @@
 		long nr_pages = mlock_vma_pages_range(vma, addr, addr + len);
 		if (nr_pages < 0)
 			return nr_pages;	/* vma gone! */
-		mm->locked_vm += (len >> PAGE_SHIFT) - nr_pages;
+		// mm->locked_vm += (len >> PAGE_SHIFT) - nr_pages;
+		vx_vmlocked_add(mm, (len >> PAGE_SHIFT) - nr_pages);
 	} else if ((flags & MAP_POPULATE) && !(flags & MAP_NONBLOCK))
 		make_pages_present(addr, addr + len);
 	return addr;
@@ -1248,6 +1400,12 @@
 	unmap_region(mm, vma, prev, vma->vm_start, vma->vm_end);
 	charged = 0;
 free_vma:
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (vma_m)
+		kmem_cache_free(vm_area_cachep, vma_m);
+#endif
+
 	kmem_cache_free(vm_area_cachep, vma);
 unacct_error:
 	if (charged)
@@ -1255,6 +1413,44 @@
 	return error;
 }
 
+bool check_heap_stack_gap(const struct vm_area_struct *vma, unsigned long addr, unsigned long len)
+{
+	if (!vma) {
+#ifdef CONFIG_STACK_GROWSUP
+		if (addr > sysctl_heap_stack_gap)
+			vma = find_vma(current->mm, addr - sysctl_heap_stack_gap);
+		else
+			vma = find_vma(current->mm, 0);
+		if (vma && (vma->vm_flags & VM_GROWSUP))
+			return false;
+#endif
+		return true;
+	}
+
+	if (addr + len > vma->vm_start)
+		return false;
+
+	if (vma->vm_flags & VM_GROWSDOWN)
+		return sysctl_heap_stack_gap <= vma->vm_start - addr - len;
+#ifdef CONFIG_STACK_GROWSUP
+	else if (vma->vm_prev && (vma->vm_prev->vm_flags & VM_GROWSUP))
+		return addr - vma->vm_prev->vm_end <= sysctl_heap_stack_gap;
+#endif
+
+	return true;
+}
+
+unsigned long skip_heap_stack_gap(const struct vm_area_struct *vma, unsigned long len)
+{
+	if (vma->vm_start < len)
+		return -ENOMEM;
+	if (!(vma->vm_flags & VM_GROWSDOWN))
+		return vma->vm_start - len;
+	if (sysctl_heap_stack_gap <= vma->vm_start - len)
+		return vma->vm_start - len - sysctl_heap_stack_gap;
+	return -ENOMEM;
+}
+
 /* Get an address range which is currently unmapped.
  * For shmat() with addr=0.
  *
@@ -1281,18 +1477,23 @@
 	if (flags & MAP_FIXED)
 		return addr;
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
-		if (TASK_SIZE - len >= addr &&
-		    (!vma || addr + len <= vma->vm_start))
-			return addr;
+		if (TASK_SIZE - len >= addr) {
+			vma = find_vma(mm, addr);
+			if (check_heap_stack_gap(vma, addr, len))
+				return addr;
+		}
 	}
 	if (len > mm->cached_hole_size) {
-	        start_addr = addr = mm->free_area_cache;
+		start_addr = addr = mm->free_area_cache;
 	} else {
-	        start_addr = addr = TASK_UNMAPPED_BASE;
-	        mm->cached_hole_size = 0;
+		start_addr = addr = mm->mmap_base;
+		mm->cached_hole_size = 0;
 	}
 
 full_search:
@@ -1303,34 +1504,40 @@
 			 * Start a new search - just in case we missed
 			 * some holes.
 			 */
-			if (start_addr != TASK_UNMAPPED_BASE) {
-				addr = TASK_UNMAPPED_BASE;
-			        start_addr = addr;
+			if (start_addr != mm->mmap_base) {
+				start_addr = addr = mm->mmap_base;
 				mm->cached_hole_size = 0;
 				goto full_search;
 			}
 			return -ENOMEM;
 		}
-		if (!vma || addr + len <= vma->vm_start) {
-			/*
-			 * Remember the place where we stopped the search:
-			 */
-			mm->free_area_cache = addr + len;
-			return addr;
-		}
+		if (check_heap_stack_gap(vma, addr, len))
+			break;
 		if (addr + mm->cached_hole_size < vma->vm_start)
 		        mm->cached_hole_size = vma->vm_start - addr;
 		addr = vma->vm_end;
 	}
+
+	/*
+	 * Remember the place where we stopped the search:
+	 */
+	mm->free_area_cache = addr + len;
+	return addr;
 }
 #endif	
 
 void arch_unmap_area(struct mm_struct *mm, unsigned long addr)
 {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
+		return;
+#endif
+
 	/*
 	 * Is this a new hole at the lowest possible address?
 	 */
-	if (addr >= TASK_UNMAPPED_BASE && addr < mm->free_area_cache) {
+	if (addr >= mm->mmap_base && addr < mm->free_area_cache) {
 		mm->free_area_cache = addr;
 		mm->cached_hole_size = ~0UL;
 	}
@@ -1348,7 +1555,7 @@
 {
 	struct vm_area_struct *vma;
 	struct mm_struct *mm = current->mm;
-	unsigned long addr = addr0;
+	unsigned long base = mm->mmap_base, addr = addr0;
 
 	/* requested length too big for entire address space */
 	if (len > TASK_SIZE)
@@ -1357,13 +1564,18 @@
 	if (flags & MAP_FIXED)
 		return addr;
 
+#ifdef CONFIG_PAX_RANDMMAP
+	if (!(mm->pax_flags & MF_PAX_RANDMMAP))
+#endif
+
 	/* requesting a specific address */
 	if (addr) {
 		addr = PAGE_ALIGN(addr);
-		vma = find_vma(mm, addr);
-		if (TASK_SIZE - len >= addr &&
-				(!vma || addr + len <= vma->vm_start))
-			return addr;
+		if (TASK_SIZE - len >= addr) {
+			vma = find_vma(mm, addr);
+			if (check_heap_stack_gap(vma, addr, len))
+				return addr;
+		}
 	}
 
 	/* check if free_area_cache is useful for us */
@@ -1378,7 +1590,7 @@
 	/* make sure it can fit in the remaining address space */
 	if (addr > len) {
 		vma = find_vma(mm, addr-len);
-		if (!vma || addr <= vma->vm_start)
+		if (check_heap_stack_gap(vma, addr - len, len))
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr-len);
 	}
@@ -1395,7 +1607,7 @@
 		 * return with success:
 		 */
 		vma = find_vma(mm, addr);
-		if (!vma || addr+len <= vma->vm_start)
+		if (check_heap_stack_gap(vma, addr, len))
 			/* remember the address as a hint for next time */
 			return (mm->free_area_cache = addr);
 
@@ -1404,8 +1616,8 @@
  		        mm->cached_hole_size = vma->vm_start - addr;
 
 		/* try just below the current vma->vm_start */
-		addr = vma->vm_start-len;
-	} while (len < vma->vm_start);
+		addr = skip_heap_stack_gap(vma, len);
+	} while (!IS_ERR_VALUE(addr));
 
 bottomup:
 	/*
@@ -1414,13 +1626,21 @@
 	 * can happen with large stack limits and large mmap()
 	 * allocations.
 	 */
+	mm->mmap_base = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (mm->pax_flags & MF_PAX_RANDMMAP)
+		mm->mmap_base += mm->delta_mmap;
+#endif
+
+	mm->free_area_cache = mm->mmap_base;
 	mm->cached_hole_size = ~0UL;
-  	mm->free_area_cache = TASK_UNMAPPED_BASE;
 	addr = arch_get_unmapped_area(filp, addr0, len, pgoff, flags);
 	/*
 	 * Restore the topdown base:
 	 */
-	mm->free_area_cache = mm->mmap_base;
+	mm->mmap_base = base;
+	mm->free_area_cache = base;
 	mm->cached_hole_size = ~0UL;
 
 	return addr;
@@ -1429,6 +1649,12 @@
 
 void arch_unmap_area_topdown(struct mm_struct *mm, unsigned long addr)
 {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && SEGMEXEC_TASK_SIZE <= addr)
+		return;
+#endif
+
 	/*
 	 * Is this a new hole at the highest possible address?
 	 */
@@ -1436,8 +1662,10 @@
 		mm->free_area_cache = addr;
 
 	/* dont allow allocations above current base */
-	if (mm->free_area_cache > mm->mmap_base)
+	if (mm->free_area_cache > mm->mmap_base) {
 		mm->free_area_cache = mm->mmap_base;
+		mm->cached_hole_size = ~0UL;
+	}
 }
 
 unsigned long
@@ -1545,6 +1773,27 @@
 	return prev ? prev->vm_next : vma;
 }
 
+#ifdef CONFIG_PAX_SEGMEXEC
+struct vm_area_struct *pax_find_mirror_vma(struct vm_area_struct *vma)
+{
+	struct vm_area_struct *vma_m;
+
+	BUG_ON(!vma || vma->vm_start >= vma->vm_end);
+	if (!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC)) {
+		BUG_ON(vma->vm_mirror);
+		return NULL;
+	}
+	BUG_ON(vma->vm_start < SEGMEXEC_TASK_SIZE && SEGMEXEC_TASK_SIZE < vma->vm_end);
+	vma_m = vma->vm_mirror;
+	BUG_ON(!vma_m || vma_m->vm_mirror != vma);
+	BUG_ON(vma->vm_file != vma_m->vm_file);
+	BUG_ON(vma->vm_end - vma->vm_start != vma_m->vm_end - vma_m->vm_start);
+	BUG_ON(vma->vm_pgoff != vma_m->vm_pgoff || vma->anon_vma != vma_m->anon_vma);
+	BUG_ON((vma->vm_flags ^ vma_m->vm_flags) & ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED | VM_RESERVED));
+	return vma_m;
+}
+#endif
+
 /*
  * Verify that the stack growth is acceptable and
  * update accounting. This is shared with both the
@@ -1561,6 +1810,7 @@
 		return -ENOMEM;
 
 	/* Stack limit test */
+	gr_learn_resource(current, RLIMIT_STACK, size, 1);
 	if (size > rlim[RLIMIT_STACK].rlim_cur)
 		return -ENOMEM;
 
@@ -1570,6 +1820,7 @@
 		unsigned long limit;
 		locked = mm->locked_vm + grow;
 		limit = rlim[RLIMIT_MEMLOCK].rlim_cur >> PAGE_SHIFT;
+		gr_learn_resource(current, RLIMIT_MEMLOCK, locked << PAGE_SHIFT, 1);
 		if (locked > limit && !capable(CAP_IPC_LOCK))
 			return -ENOMEM;
 	}
@@ -1588,9 +1839,9 @@
 		return -ENOMEM;
 
 	/* Ok, everything looks good - let it rip */
-	mm->total_vm += grow;
+	vx_vmpages_add(mm, grow);
 	if (vma->vm_flags & VM_LOCKED)
-		mm->locked_vm += grow;
+		vx_vmlocked_add(mm, grow);
 	vm_stat_account(mm, vma->vm_flags, vma->vm_file, grow);
 	return 0;
 }
@@ -1600,37 +1851,48 @@
  * PA-RISC uses this for its stack; IA64 for its Register Backing Store.
  * vma is the last one with address > vma->vm_end.  Have to extend vma.
  */
+#ifndef CONFIG_IA64
+static
+#endif
 int expand_upwards(struct vm_area_struct *vma, unsigned long address)
 {
 	int error;
+	bool locknext;
 
 	if (!(vma->vm_flags & VM_GROWSUP))
 		return -EFAULT;
 
+	/* Also guard against wrapping around to address 0. */
+	if (address < PAGE_ALIGN(address+1))
+		address = PAGE_ALIGN(address+1);
+	else
+		return -ENOMEM;
+
 	/*
 	 * We must make sure the anon_vma is allocated
 	 * so that the anon_vma locking is not a noop.
 	 */
 	if (unlikely(anon_vma_prepare(vma)))
 		return -ENOMEM;
+	locknext = vma->vm_next && (vma->vm_next->vm_flags & VM_GROWSDOWN);
+	if (locknext && anon_vma_prepare(vma->vm_next))
+		return -ENOMEM;
 	anon_vma_lock(vma);
+	if (locknext)
+		anon_vma_lock(vma->vm_next);
 
 	/*
 	 * vma->vm_start/vm_end cannot change under us because the caller
 	 * is required to hold the mmap_sem in read mode.  We need the
-	 * anon_vma lock to serialize against concurrent expand_stacks.
-	 * Also guard against wrapping around to address 0.
+	 * anon_vma locks to serialize against concurrent expand_stacks
+	 * and expand_upwards.
 	 */
-	if (address < PAGE_ALIGN(address+4))
-		address = PAGE_ALIGN(address+4);
-	else {
-		anon_vma_unlock(vma);
-		return -ENOMEM;
-	}
 	error = 0;
 
 	/* Somebody else might have raced and expanded it already */
-	if (address > vma->vm_end) {
+	if (vma->vm_next && (vma->vm_next->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && vma->vm_next->vm_start - address < sysctl_heap_stack_gap)
+		error = -ENOMEM;
+	else if (address > vma->vm_end && (!locknext || vma->vm_next->vm_start >= address)) {
 		unsigned long size, grow;
 
 		size = address - vma->vm_start;
@@ -1640,6 +1902,8 @@
 		if (!error)
 			vma->vm_end = address;
 	}
+	if (locknext)
+		anon_vma_unlock(vma->vm_next);
 	anon_vma_unlock(vma);
 	return error;
 }
@@ -1652,6 +1916,8 @@
 				   unsigned long address)
 {
 	int error;
+	bool lockprev = false;
+	struct vm_area_struct *prev;
 
 	/*
 	 * We must make sure the anon_vma is allocated
@@ -1665,6 +1931,15 @@
 	if (error)
 		return error;
 
+	prev = vma->vm_prev;
+#if defined(CONFIG_STACK_GROWSUP) || defined(CONFIG_IA64)
+	lockprev = prev && (prev->vm_flags & VM_GROWSUP);
+#endif
+	if (lockprev && anon_vma_prepare(prev))
+		return -ENOMEM;
+	if (lockprev)
+		anon_vma_lock(prev);
+
 	anon_vma_lock(vma);
 
 	/*
@@ -1674,9 +1949,17 @@
 	 */
 
 	/* Somebody else might have raced and expanded it already */
-	if (address < vma->vm_start) {
+	if (prev && (prev->vm_flags & (VM_READ | VM_WRITE | VM_EXEC)) && address - prev->vm_end < sysctl_heap_stack_gap)
+		error = -ENOMEM;
+	else if (address < vma->vm_start && (!lockprev || prev->vm_end <= address)) {
 		unsigned long size, grow;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+		struct vm_area_struct *vma_m;
+
+		vma_m = pax_find_mirror_vma(vma);
+#endif
+
 		size = vma->vm_end - address;
 		grow = (vma->vm_start - address) >> PAGE_SHIFT;
 
@@ -1684,9 +1967,20 @@
 		if (!error) {
 			vma->vm_start = address;
 			vma->vm_pgoff -= grow;
+			track_exec_limit(vma->vm_mm, vma->vm_start, vma->vm_end, vma->vm_flags);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+			if (vma_m) {
+				vma_m->vm_start -= grow << PAGE_SHIFT;
+				vma_m->vm_pgoff -= grow;
+			}
+#endif
+
 		}
 	}
 	anon_vma_unlock(vma);
+	if (lockprev)
+		anon_vma_unlock(prev);
 	return error;
 }
 
@@ -1762,7 +2056,15 @@
 	do {
 		long nrpages = vma_pages(vma);
 
-		mm->total_vm -= nrpages;
+#ifdef CONFIG_PAX_SEGMEXEC
+		if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_start >= SEGMEXEC_TASK_SIZE)) {
+			vma = remove_vma(vma);
+			continue;
+		}
+#endif
+
+		// mm->total_vm -= nrpages;
+		vx_vmpages_sub(mm, nrpages);
 		vm_stat_account(mm, vma->vm_flags, vma->vm_file, -nrpages);
 		vma = remove_vma(vma);
 	} while (vma);
@@ -1807,6 +2109,16 @@
 	insertion_point = (prev ? &prev->vm_next : &mm->mmap);
 	vma->vm_prev = NULL;
 	do {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		if (vma->vm_mirror) {
+			BUG_ON(!vma->vm_mirror->vm_mirror || vma->vm_mirror->vm_mirror != vma);
+			vma->vm_mirror->vm_mirror = NULL;
+			vma->vm_mirror->vm_flags &= ~VM_EXEC;
+			vma->vm_mirror = NULL;
+		}
+#endif
+
 		rb_erase(&vma->vm_rb, &mm->mm_rb);
 		mm->map_count--;
 		tail_vma = vma;
@@ -1834,10 +2146,25 @@
 	struct mempolicy *pol;
 	struct vm_area_struct *new;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m, *new_m = NULL;
+	unsigned long addr_m = addr + SEGMEXEC_TASK_SIZE;
+#endif
+
 	if (is_vm_hugetlb_page(vma) && (addr &
 					~(huge_page_mask(hstate_vma(vma)))))
 		return -EINVAL;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	vma_m = pax_find_mirror_vma(vma);
+
+	if (mm->pax_flags & MF_PAX_SEGMEXEC) {
+		BUG_ON(vma->vm_end > SEGMEXEC_TASK_SIZE);
+		if (mm->map_count >= sysctl_max_map_count-1)
+			return -ENOMEM;
+	} else
+#endif
+
 	if (mm->map_count >= sysctl_max_map_count)
 		return -ENOMEM;
 
@@ -1845,6 +2172,16 @@
 	if (!new)
 		return -ENOMEM;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (vma_m) {
+		new_m = kmem_cache_alloc(vm_area_cachep, GFP_KERNEL);
+		if (!new_m) {
+			kmem_cache_free(vm_area_cachep, new);
+			return -ENOMEM;
+		}
+	}
+#endif
+
 	/* most fields are the same, copy all, and then fixup */
 	*new = *vma;
 
@@ -1855,8 +2192,29 @@
 		new->vm_pgoff += ((addr - vma->vm_start) >> PAGE_SHIFT);
 	}
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (vma_m) {
+		*new_m = *vma_m;
+		new_m->vm_mirror = new;
+		new->vm_mirror = new_m;
+
+		if (new_below)
+			new_m->vm_end = addr_m;
+		else {
+			new_m->vm_start = addr_m;
+			new_m->vm_pgoff += ((addr_m - vma_m->vm_start) >> PAGE_SHIFT);
+		}
+	}
+#endif
+
 	pol = mpol_dup(vma_policy(vma));
 	if (IS_ERR(pol)) {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+		if (new_m)
+			kmem_cache_free(vm_area_cachep, new_m);
+#endif
+
 		kmem_cache_free(vm_area_cachep, new);
 		return PTR_ERR(pol);
 	}
@@ -1877,6 +2235,28 @@
 	else
 		vma_adjust(vma, vma->vm_start, addr, vma->vm_pgoff, new);
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (vma_m) {
+		mpol_get(pol);
+		vma_set_policy(new_m, pol);
+
+		if (new_m->vm_file) {
+			get_file(new_m->vm_file);
+			if (vma_m->vm_flags & VM_EXECUTABLE)
+				added_exe_file_vma(mm);
+		}
+
+		if (new_m->vm_ops && new_m->vm_ops->open)
+			new_m->vm_ops->open(new_m);
+
+		if (new_below)
+			vma_adjust(vma_m, addr_m, vma_m->vm_end, vma_m->vm_pgoff +
+				((addr_m - new_m->vm_start) >> PAGE_SHIFT), new_m);
+		else
+			vma_adjust(vma_m, vma_m->vm_start, addr_m, vma_m->vm_pgoff, new_m);
+	}
+#endif
+
 	return 0;
 }
 
@@ -1885,11 +2265,30 @@
  * work.  This now handles partial unmappings.
  * Jeremy Fitzhardinge <jeremy@goop.org>
  */
+#ifdef CONFIG_PAX_SEGMEXEC
+int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+{
+	int ret = __do_munmap(mm, start, len);
+	if (ret || !(mm->pax_flags & MF_PAX_SEGMEXEC))
+		return ret;
+
+	return __do_munmap(mm, start + SEGMEXEC_TASK_SIZE, len);
+}
+
+int __do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+#else
 int do_munmap(struct mm_struct *mm, unsigned long start, size_t len)
+#endif
 {
 	unsigned long end;
 	struct vm_area_struct *vma, *prev, *last;
 
+	/*
+	 * mm->mmap_sem is required to protect against another thread
+	 * changing the mappings in case we sleep.
+	 */
+	verify_mm_writelocked(mm);
+
 	if ((start & ~PAGE_MASK) || start > TASK_SIZE || len > TASK_SIZE-start)
 		return -EINVAL;
 
@@ -1937,7 +2336,8 @@
 		struct vm_area_struct *tmp = vma;
 		while (tmp && tmp->vm_start < end) {
 			if (tmp->vm_flags & VM_LOCKED) {
-				mm->locked_vm -= vma_pages(tmp);
+				// mm->locked_vm -= vma_pages(tmp);
+				vx_vmlocked_sub(mm, vma_pages(tmp));
 				munlock_vma_pages_all(tmp);
 			}
 			tmp = tmp->vm_next;
@@ -1953,6 +2353,8 @@
 	/* Fix up all other VM information */
 	remove_vma_list(mm, vma);
 
+	track_exec_limit(mm, start, end, 0UL);
+
 	return 0;
 }
 
@@ -1965,22 +2367,18 @@
 
 	profile_munmap(addr);
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) &&
+	    (len > SEGMEXEC_TASK_SIZE || addr > SEGMEXEC_TASK_SIZE-len))
+		return -EINVAL;
+#endif
+
 	down_write(&mm->mmap_sem);
 	ret = do_munmap(mm, addr, len);
 	up_write(&mm->mmap_sem);
 	return ret;
 }
 
-static inline void verify_mm_writelocked(struct mm_struct *mm)
-{
-#ifdef CONFIG_DEBUG_VM
-	if (unlikely(down_read_trylock(&mm->mmap_sem))) {
-		WARN_ON(1);
-		up_read(&mm->mmap_sem);
-	}
-#endif
-}
-
 /*
  *  this is really a simplified "do_mmap".  it only handles
  *  anonymous maps.  eventually we may be able to do some
@@ -1994,6 +2392,7 @@
 	struct rb_node ** rb_link, * rb_parent;
 	pgoff_t pgoff = addr >> PAGE_SHIFT;
 	int error;
+	unsigned long charged;
 
 	len = PAGE_ALIGN(len);
 	if (!len)
@@ -2005,21 +2404,37 @@
 
 	flags = VM_DATA_DEFAULT_FLAGS | VM_ACCOUNT | mm->def_flags;
 
+#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC)
+	if (mm->pax_flags & (MF_PAX_PAGEEXEC | MF_PAX_SEGMEXEC)) {
+		flags &= ~VM_EXEC;
+
+#ifdef CONFIG_PAX_MPROTECT
+		if (mm->pax_flags & MF_PAX_MPROTECT)
+			flags &= ~VM_MAYEXEC;
+#endif
+
+	}
+#endif
+
 	error = get_unmapped_area(NULL, addr, len, 0, MAP_FIXED);
 	if (error & ~PAGE_MASK)
 		return error;
 
+	charged = len >> PAGE_SHIFT;
+
 	/*
 	 * mlock MCL_FUTURE?
 	 */
 	if (mm->def_flags & VM_LOCKED) {
 		unsigned long locked, lock_limit;
-		locked = len >> PAGE_SHIFT;
+		locked = charged;
 		locked += mm->locked_vm;
 		lock_limit = current->signal->rlim[RLIMIT_MEMLOCK].rlim_cur;
 		lock_limit >>= PAGE_SHIFT;
 		if (locked > lock_limit && !capable(CAP_IPC_LOCK))
 			return -EAGAIN;
+		if (!vx_vmlocked_avail(mm, charged))
+			return -ENOMEM;
 	}
 
 	/*
@@ -2031,22 +2446,23 @@
 	/*
 	 * Clear old maps.  this also does some error checking for us
 	 */
- munmap_back:
 	vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
 	if (vma && vma->vm_start < addr + len) {
 		if (do_munmap(mm, addr, len))
 			return -ENOMEM;
-		goto munmap_back;
+		vma = find_vma_prepare(mm, addr, &prev, &rb_link, &rb_parent);
+		BUG_ON(vma && vma->vm_start < addr + len);
 	}
 
 	/* Check against address space limits *after* clearing old maps... */
-	if (!may_expand_vm(mm, len >> PAGE_SHIFT))
+	if (!may_expand_vm(mm, charged))
 		return -ENOMEM;
 
 	if (mm->map_count > sysctl_max_map_count)
 		return -ENOMEM;
 
-	if (security_vm_enough_memory(len >> PAGE_SHIFT))
+	if (security_vm_enough_memory(charged) ||
+		!vx_vmpages_avail(mm, charged))
 		return -ENOMEM;
 
 	/* Can we just expand an old private anonymous mapping? */
@@ -2060,7 +2476,7 @@
 	 */
 	vma = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
 	if (!vma) {
-		vm_unacct_memory(len >> PAGE_SHIFT);
+		vm_unacct_memory(charged);
 		return -ENOMEM;
 	}
 
@@ -2072,11 +2488,15 @@
 	vma->vm_page_prot = vm_get_page_prot(flags);
 	vma_link(mm, vma, prev, rb_link, rb_parent);
 out:
-	mm->total_vm += len >> PAGE_SHIFT;
+	// mm->total_vm += charged;
+	vx_vmpages_add(mm, charged);
+
 	if (flags & VM_LOCKED) {
 		if (!mlock_vma_pages_range(vma, addr, addr + len))
-			mm->locked_vm += (len >> PAGE_SHIFT);
+			// mm->locked_vm += (charged);
+			vx_vmlocked_add(mm, charged);
 	}
+	track_exec_limit(mm, addr, addr + len, flags);
 	return addr;
 }
 
@@ -2119,12 +2539,19 @@
 	free_pgtables(tlb, vma, FIRST_USER_ADDRESS, 0);
 	tlb_finish_mmu(tlb, 0, end);
 
+	set_mm_counter(mm, file_rss, 0);
+	set_mm_counter(mm, anon_rss, 0);
+	vx_vmpages_sub(mm, mm->total_vm);
+	vx_vmlocked_sub(mm, mm->locked_vm);
+
 	/*
 	 * Walk the list again, actually closing and freeing it,
 	 * with preemption enabled, without holding any MM locks.
 	 */
-	while (vma)
+	while (vma) {
+		vma->vm_mirror = NULL;
 		vma = remove_vma(vma);
+	}
 
 	BUG_ON(mm->nr_ptes > (FIRST_USER_ADDRESS+PMD_SIZE-1)>>PMD_SHIFT);
 }
@@ -2138,6 +2565,10 @@
 	struct vm_area_struct * __vma, * prev;
 	struct rb_node ** rb_link, * rb_parent;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m = NULL;
+#endif
+
 	/*
 	 * The vm_pgoff of a purely anonymous vma should be irrelevant
 	 * until its first write fault, when page's anon_vma and index
@@ -2158,9 +2589,25 @@
 	if (__vma && __vma->vm_start < vma->vm_end)
 		return -ENOMEM;
 	if ((vma->vm_flags & VM_ACCOUNT) &&
-	     security_vm_enough_memory_mm(mm, vma_pages(vma)))
+		(security_vm_enough_memory_mm(mm, vma_pages(vma)) ||
+		!vx_vmpages_avail(mm, vma_pages(vma))))
 		return -ENOMEM;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (vma->vm_flags & VM_EXEC)) {
+		vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+		if (!vma_m)
+			return -ENOMEM;
+	}
+#endif
+
 	vma_link(mm, vma, prev, rb_link, rb_parent);
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (vma_m)
+		pax_mirror_vma(vma_m, vma);
+#endif
+
 	return 0;
 }
 
@@ -2178,6 +2625,8 @@
 	struct rb_node **rb_link, *rb_parent;
 	struct mempolicy *pol;
 
+	BUG_ON(vma->vm_mirror);
+
 	/*
 	 * If anonymous vma has not yet been faulted, update new pgoff
 	 * to match new location, to increase its chance of merging.
@@ -2221,6 +2670,35 @@
 	return new_vma;
 }
 
+#ifdef CONFIG_PAX_SEGMEXEC
+void pax_mirror_vma(struct vm_area_struct *vma_m, struct vm_area_struct *vma)
+{
+	struct vm_area_struct *prev_m;
+	struct rb_node **rb_link_m, *rb_parent_m;
+	struct mempolicy *pol_m;
+
+	BUG_ON(!(vma->vm_mm->pax_flags & MF_PAX_SEGMEXEC) || !(vma->vm_flags & VM_EXEC));
+	BUG_ON(vma->vm_mirror || vma_m->vm_mirror);
+	BUG_ON(!mpol_equal(vma_policy(vma), vma_policy(vma_m)));
+	*vma_m = *vma;
+	pol_m = vma_policy(vma_m);
+	mpol_get(pol_m);
+	vma_set_policy(vma_m, pol_m);
+	vma_m->vm_start += SEGMEXEC_TASK_SIZE;
+	vma_m->vm_end += SEGMEXEC_TASK_SIZE;
+	vma_m->vm_flags &= ~(VM_WRITE | VM_MAYWRITE | VM_ACCOUNT | VM_LOCKED);
+	vma_m->vm_page_prot = vm_get_page_prot(vma_m->vm_flags);
+	if (vma_m->vm_file)
+		get_file(vma_m->vm_file);
+	if (vma_m->vm_ops && vma_m->vm_ops->open)
+		vma_m->vm_ops->open(vma_m);
+	find_vma_prepare(vma->vm_mm, vma_m->vm_start, &prev_m, &rb_link_m, &rb_parent_m);
+	vma_link(vma->vm_mm, vma_m, prev_m, rb_link_m, rb_parent_m);
+	vma_m->vm_mirror = vma;
+	vma->vm_mirror = vma_m;
+}
+#endif
+
 /*
  * Return true if the calling process may expand its vm space by the passed
  * number of pages
@@ -2231,9 +2709,11 @@
 	unsigned long lim;
 
 	lim = current->signal->rlim[RLIMIT_AS].rlim_cur >> PAGE_SHIFT;
-
+	gr_learn_resource(current, RLIMIT_AS, (cur + npages) << PAGE_SHIFT, 1);
 	if (cur + npages > lim)
 		return 0;
+	if (!vx_vmpages_avail(mm, npages))
+		return 0;
 	return 1;
 }
 
@@ -2301,6 +2781,22 @@
 	vma->vm_start = addr;
 	vma->vm_end = addr + len;
 
+#ifdef CONFIG_PAX_MPROTECT
+	if (mm->pax_flags & MF_PAX_MPROTECT) {
+#ifndef CONFIG_PAX_MPROTECT_COMPAT
+		if ((vm_flags & (VM_WRITE | VM_EXEC)) == (VM_WRITE | VM_EXEC))
+			return -EPERM;
+		if (!(vm_flags & VM_EXEC))
+			vm_flags &= ~VM_MAYEXEC;
+#else
+		if ((vm_flags & (VM_WRITE | VM_EXEC)) != VM_EXEC)
+			vm_flags &= ~(VM_EXEC | VM_MAYEXEC);
+#endif
+		else
+			vm_flags &= ~VM_MAYWRITE;
+	}
+#endif
+
 	vma->vm_flags = vm_flags | mm->def_flags | VM_DONTEXPAND;
 	vma->vm_page_prot = vm_get_page_prot(vma->vm_flags);
 
@@ -2315,7 +2811,7 @@
 	if (ret)
 		goto out;
 
-	mm->total_vm += len >> PAGE_SHIFT;
+	vx_vmpages_add(mm, len >> PAGE_SHIFT);
 
 	perf_event_mmap(vma);
 
diff -uriN linux-2.6.32.43/mm/mprotect.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mprotect.c
--- linux-2.6.32.43/mm/mprotect.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mprotect.c	2011-07-15 05:51:19.000000000 -0500
@@ -24,10 +24,16 @@
 #include <linux/mmu_notifier.h>
 #include <linux/migrate.h>
 #include <linux/perf_event.h>
+
+#ifdef CONFIG_PAX_MPROTECT
+#include <linux/elf.h>
+#endif
+
 #include <asm/uaccess.h>
 #include <asm/pgtable.h>
 #include <asm/cacheflush.h>
 #include <asm/tlbflush.h>
+#include <asm/mmu_context.h>
 
 #ifndef pgprot_modify
 static inline pgprot_t pgprot_modify(pgprot_t oldprot, pgprot_t newprot)
@@ -132,6 +138,48 @@
 	flush_tlb_range(vma, start, end);
 }
 
+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
+/* called while holding the mmap semaphor for writing except stack expansion */
+void track_exec_limit(struct mm_struct *mm, unsigned long start, unsigned long end, unsigned long prot)
+{
+	unsigned long oldlimit, newlimit = 0UL;
+
+	if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || nx_enabled)
+		return;
+
+	spin_lock(&mm->page_table_lock);
+	oldlimit = mm->context.user_cs_limit;
+	if ((prot & VM_EXEC) && oldlimit < end)
+		/* USER_CS limit moved up */
+		newlimit = end;
+	else if (!(prot & VM_EXEC) && start < oldlimit && oldlimit <= end)
+		/* USER_CS limit moved down */
+		newlimit = start;
+
+	if (newlimit) {
+		mm->context.user_cs_limit = newlimit;
+
+#ifdef CONFIG_SMP
+		wmb();
+		cpus_clear(mm->context.cpu_user_cs_mask);
+		cpu_set(smp_processor_id(), mm->context.cpu_user_cs_mask);
+#endif
+
+		set_user_cs(mm->context.user_cs_base, mm->context.user_cs_limit, smp_processor_id());
+	}
+	spin_unlock(&mm->page_table_lock);
+	if (newlimit == end) {
+		struct vm_area_struct *vma = find_vma(mm, oldlimit);
+
+		for (; vma && vma->vm_start < end; vma = vma->vm_next)
+			if (is_vm_hugetlb_page(vma))
+				hugetlb_change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot);
+			else
+				change_protection(vma, vma->vm_start, vma->vm_end, vma->vm_page_prot, vma_wants_writenotify(vma));
+	}
+}
+#endif
+
 int
 mprotect_fixup(struct vm_area_struct *vma, struct vm_area_struct **pprev,
 	unsigned long start, unsigned long end, unsigned long newflags)
@@ -144,11 +192,29 @@
 	int error;
 	int dirty_accountable = 0;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	struct vm_area_struct *vma_m = NULL;
+	unsigned long start_m, end_m;
+
+	start_m = start + SEGMEXEC_TASK_SIZE;
+	end_m = end + SEGMEXEC_TASK_SIZE;
+#endif
+
 	if (newflags == oldflags) {
 		*pprev = vma;
 		return 0;
 	}
 
+	if (newflags & (VM_READ | VM_WRITE | VM_EXEC)) {
+		struct vm_area_struct *prev = vma->vm_prev, *next = vma->vm_next;
+
+		if (next && (next->vm_flags & VM_GROWSDOWN) && sysctl_heap_stack_gap > next->vm_start - end)
+			return -ENOMEM;
+
+		if (prev && (prev->vm_flags & VM_GROWSUP) && sysctl_heap_stack_gap > start - prev->vm_end)
+			return -ENOMEM;
+	}
+
 	/*
 	 * If we make a private mapping writable we increase our commit;
 	 * but (without finer accounting) cannot reduce our commit if we
@@ -165,6 +231,38 @@
 		}
 	}
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && ((oldflags ^ newflags) & VM_EXEC)) {
+		if (start != vma->vm_start) {
+			error = split_vma(mm, vma, start, 1);
+			if (error)
+				goto fail;
+			BUG_ON(!*pprev || (*pprev)->vm_next == vma);
+			*pprev = (*pprev)->vm_next;
+		}
+
+		if (end != vma->vm_end) {
+			error = split_vma(mm, vma, end, 0);
+			if (error)
+				goto fail;
+		}
+
+		if (pax_find_mirror_vma(vma)) {
+			error = __do_munmap(mm, start_m, end_m - start_m);
+			if (error)
+				goto fail;
+		} else {
+			vma_m = kmem_cache_zalloc(vm_area_cachep, GFP_KERNEL);
+			if (!vma_m) {
+				error = -ENOMEM;
+				goto fail;
+			}
+			vma->vm_flags = newflags;
+			pax_mirror_vma(vma_m, vma);
+		}
+	}
+#endif
+
 	/*
 	 * First try to merge with previous and/or next vma.
 	 */
@@ -195,9 +293,21 @@
 	 * vm_flags and vm_page_prot are protected by the mmap_sem
 	 * held in write mode.
 	 */
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if ((mm->pax_flags & MF_PAX_SEGMEXEC) && (newflags & VM_EXEC) && ((vma->vm_flags ^ newflags) & VM_READ))
+		pax_find_mirror_vma(vma)->vm_flags ^= VM_READ;
+#endif
+
 	vma->vm_flags = newflags;
+
+#ifdef CONFIG_PAX_MPROTECT
+	if (mm->binfmt && mm->binfmt->handle_mprotect)
+		mm->binfmt->handle_mprotect(vma, newflags);
+#endif
+
 	vma->vm_page_prot = pgprot_modify(vma->vm_page_prot,
-					  vm_get_page_prot(newflags));
+					  vm_get_page_prot(vma->vm_flags));
 
 	if (vma_wants_writenotify(vma)) {
 		vma->vm_page_prot = vm_get_page_prot(newflags & ~VM_SHARED);
@@ -239,6 +349,17 @@
 	end = start + len;
 	if (end <= start)
 		return -ENOMEM;
+
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (current->mm->pax_flags & MF_PAX_SEGMEXEC) {
+		if (end > SEGMEXEC_TASK_SIZE)
+			return -EINVAL;
+	} else
+#endif
+
+	if (end > TASK_SIZE)
+		return -EINVAL;
+
 	if (!arch_validate_prot(prot))
 		return -EINVAL;
 
@@ -246,7 +367,7 @@
 	/*
 	 * Does the application expect PROT_READ to imply PROT_EXEC:
 	 */
-	if ((prot & PROT_READ) && (current->personality & READ_IMPLIES_EXEC))
+	if ((prot & (PROT_READ | PROT_WRITE)) && (current->personality & READ_IMPLIES_EXEC))
 		prot |= PROT_EXEC;
 
 	vm_flags = calc_vm_prot_bits(prot);
@@ -278,6 +399,11 @@
 	if (start > vma->vm_start)
 		prev = vma;
 
+#ifdef CONFIG_PAX_MPROTECT
+	if (current->mm->binfmt && current->mm->binfmt->handle_mprotect)
+		current->mm->binfmt->handle_mprotect(vma, vm_flags);
+#endif
+
 	for (nstart = start ; ; ) {
 		unsigned long newflags;
 
@@ -287,6 +413,14 @@
 
 		/* newflags >> 4 shift VM_MAY% in place of VM_% */
 		if ((newflags & ~(newflags >> 4)) & (VM_READ | VM_WRITE | VM_EXEC)) {
+			if (prot & (PROT_WRITE | PROT_EXEC))
+				gr_log_rwxmprotect(vma->vm_file);
+
+			error = -EACCES;
+			goto out;
+		}
+
+		if (!gr_acl_handle_mprotect(vma->vm_file, prot)) {
 			error = -EACCES;
 			goto out;
 		}
@@ -301,6 +435,9 @@
 		error = mprotect_fixup(vma, &prev, nstart, tmp, newflags);
 		if (error)
 			goto out;
+
+		track_exec_limit(current->mm, nstart, tmp, vm_flags);
+
 		nstart = tmp;
 
 		if (nstart < prev->vm_end)
diff -uriN linux-2.6.32.43/mm/mremap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mremap.c
--- linux-2.6.32.43/mm/mremap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/mremap.c	2011-07-15 05:51:19.000000000 -0500
@@ -20,6 +20,7 @@
 #include <linux/security.h>
 #include <linux/syscalls.h>
 #include <linux/mmu_notifier.h>
+#include <linux/vs_memory.h>
 
 #include <asm/uaccess.h>
 #include <asm/cacheflush.h>
@@ -112,6 +113,12 @@
 			continue;
 		pte = ptep_clear_flush(vma, old_addr, old_pte);
 		pte = move_pte(pte, new_vma->vm_page_prot, old_addr, new_addr);
+
+#ifdef CONFIG_ARCH_TRACK_EXEC_LIMIT
+		if (!nx_enabled && (new_vma->vm_flags & (VM_PAGEEXEC | VM_EXEC)) == VM_PAGEEXEC)
+			pte = pte_exprotect(pte);
+#endif
+
 		set_pte_at(mm, new_addr, new_pte, pte);
 	}
 
@@ -232,7 +239,7 @@
 	 * If this were a serious issue, we'd add a flag to do_munmap().
 	 */
 	hiwater_vm = mm->hiwater_vm;
-	mm->total_vm += new_len >> PAGE_SHIFT;
+	vx_vmpages_add(mm, new_len >> PAGE_SHIFT);
 	vm_stat_account(mm, vma->vm_flags, vma->vm_file, new_len>>PAGE_SHIFT);
 
 	if (do_munmap(mm, old_addr, old_len) < 0) {
@@ -250,7 +257,7 @@
 	}
 
 	if (vm_flags & VM_LOCKED) {
-		mm->locked_vm += new_len >> PAGE_SHIFT;
+		vx_vmlocked_add(mm, new_len >> PAGE_SHIFT);
 		if (new_len > old_len)
 			mlock_vma_pages_range(new_vma, new_addr + old_len,
 						       new_addr + new_len);
@@ -271,6 +278,11 @@
 	if (is_vm_hugetlb_page(vma))
 		goto Einval;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (pax_find_mirror_vma(vma))
+		goto Einval;
+#endif
+
 	/* We can't remap across vm area boundaries */
 	if (old_len > vma->vm_end - addr)
 		goto Efault;
@@ -327,20 +339,25 @@
 	unsigned long ret = -EINVAL;
 	unsigned long charged = 0;
 	unsigned long map_flags;
+	unsigned long pax_task_size = TASK_SIZE;
 
 	if (new_addr & ~PAGE_MASK)
 		goto out;
 
-	if (new_len > TASK_SIZE || new_addr > TASK_SIZE - new_len)
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
+	pax_task_size -= PAGE_SIZE;
+
+	if (new_len > TASK_SIZE || new_addr > pax_task_size - new_len)
 		goto out;
 
 	/* Check if the location we're moving into overlaps the
 	 * old location at all, and fail if it does.
 	 */
-	if ((new_addr <= addr) && (new_addr+new_len) > addr)
-		goto out;
-
-	if ((addr <= new_addr) && (addr+old_len) > new_addr)
+	if (addr + old_len > new_addr && new_addr + new_len > addr)
 		goto out;
 
 	ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
@@ -412,6 +429,7 @@
 	struct vm_area_struct *vma;
 	unsigned long ret = -EINVAL;
 	unsigned long charged = 0;
+	unsigned long pax_task_size = TASK_SIZE;
 
 	if (flags & ~(MREMAP_FIXED | MREMAP_MAYMOVE))
 		goto out;
@@ -430,6 +448,17 @@
 	if (!new_len)
 		goto out;
 
+#ifdef CONFIG_PAX_SEGMEXEC
+	if (mm->pax_flags & MF_PAX_SEGMEXEC)
+		pax_task_size = SEGMEXEC_TASK_SIZE;
+#endif
+
+	pax_task_size -= PAGE_SIZE;
+
+	if (new_len > pax_task_size || addr > pax_task_size-new_len ||
+	    old_len > pax_task_size || addr > pax_task_size-old_len)
+		goto out;
+
 	if (flags & MREMAP_FIXED) {
 		if (flags & MREMAP_MAYMOVE)
 			ret = mremap_to(addr, old_len, new_addr, new_len);
@@ -468,14 +497,17 @@
 			vma_adjust(vma, vma->vm_start,
 				addr + new_len, vma->vm_pgoff, NULL);
 
-			mm->total_vm += pages;
+			// mm->total_vm += pages;
+			vx_vmpages_add(mm, pages);
 			vm_stat_account(mm, vma->vm_flags, vma->vm_file, pages);
 			if (vma->vm_flags & VM_LOCKED) {
-				mm->locked_vm += pages;
+				// mm->locked_vm += pages;
+				vx_vmlocked_add(mm, pages);
 				mlock_vma_pages_range(vma, addr + old_len,
 						   addr + new_len);
 			}
 			ret = addr;
+			track_exec_limit(vma->vm_mm, vma->vm_start, addr + new_len, vma->vm_flags);
 			goto out;
 		}
 	}
@@ -502,7 +534,13 @@
 		ret = security_file_mmap(NULL, 0, 0, 0, new_addr, 1);
 		if (ret)
 			goto out;
+
+		map_flags = vma->vm_flags;
 		ret = move_vma(vma, addr, old_len, new_len, new_addr);
+		if (!(ret & ~PAGE_MASK)) {
+			track_exec_limit(current->mm, addr, addr + old_len, 0UL);
+			track_exec_limit(current->mm, new_addr, new_addr + new_len, map_flags);
+		}
 	}
 out:
 	if (ret & ~PAGE_MASK)
diff -uriN linux-2.6.32.43/mm/nommu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/nommu.c
--- linux-2.6.32.43/mm/nommu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/nommu.c	2011-07-15 05:51:19.000000000 -0500
@@ -67,7 +67,6 @@
 int sysctl_overcommit_ratio = 50; /* default is 50% */
 int sysctl_max_map_count = DEFAULT_MAX_MAP_COUNT;
 int sysctl_nr_trim_pages = CONFIG_NOMMU_INITIAL_TRIM_EXCESS;
-int heap_stack_gap = 0;
 
 atomic_long_t mmap_pages_allocated;
 
@@ -761,15 +760,6 @@
 EXPORT_SYMBOL(find_vma);
 
 /*
- * find a VMA
- * - we don't extend stack VMAs under NOMMU conditions
- */
-struct vm_area_struct *find_extend_vma(struct mm_struct *mm, unsigned long addr)
-{
-	return find_vma(mm, addr);
-}
-
-/*
  * expand a stack to a given address
  * - not supported under NOMMU conditions
  */
@@ -1349,7 +1339,7 @@
 	/* okay... we have a mapping; now we have to register it */
 	result = vma->vm_start;
 
-	current->mm->total_vm += len >> PAGE_SHIFT;
+	vx_vmpages_add(current->mm, len >> PAGE_SHIFT);
 
 share:
 	add_vma_to_mm(current->mm, vma);
@@ -1609,7 +1599,7 @@
 
 	kenter("");
 
-	mm->total_vm = 0;
+	vx_vmpages_sub(mm, mm->total_vm);
 
 	while ((vma = mm->mmap)) {
 		mm->mmap = vma->vm_next;
diff -uriN linux-2.6.32.43/mm/oom_kill.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/oom_kill.c
--- linux-2.6.32.43/mm/oom_kill.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/oom_kill.c	2011-07-15 05:50:11.000000000 -0500
@@ -27,6 +27,9 @@
 #include <linux/notifier.h>
 #include <linux/memcontrol.h>
 #include <linux/security.h>
+#include <linux/reboot.h>
+#include <linux/vs_memory.h>
+#include <linux/vs_context.h>
 
 int sysctl_panic_on_oom;
 int sysctl_oom_kill_allocating_task;
@@ -186,9 +189,21 @@
 			points >>= -(oom_adj);
 	}
 
+	/*
+	 * add points for context badness and
+	 * reduce badness for processes belonging to
+	 * a different context
+	 */
+
+	points += vx_badness(p, mm);
+
+	if ((vx_current_xid() > 1) &&
+		vx_current_xid() != vx_task_xid(p))
+		points /= 16;
+
 #ifdef DEBUG
-	printk(KERN_DEBUG "OOMkill: task %d (%s) got %lu points\n",
-	p->pid, p->comm, points);
+	printk(KERN_DEBUG "OOMkill: task %d:#%u (%s) got %d points\n",
+		task_pid_nr(p), p->xid, p->comm, points);
 #endif
 	return points;
 }
@@ -230,6 +245,7 @@
 	struct task_struct *p;
 	struct task_struct *chosen = NULL;
 	struct timespec uptime;
+	unsigned xid = vx_current_xid();
 	*ppoints = 0;
 
 	do_posix_clock_monotonic_gettime(&uptime);
@@ -242,11 +258,14 @@
 		 */
 		if (!p->mm)
 			continue;
-		/* skip the init task */
-		if (is_global_init(p))
+		/* skip the init task, global and per guest */
+		if (task_is_init(p))
 			continue;
 		if (mem && !task_in_mem_cgroup(p, mem))
 			continue;
+		/* skip other guest and host processes if oom in guest */
+		if (xid && vx_task_xid(p) != xid)
+			continue;
 
 		/*
 		 * This task already has access to memory reserves and is
@@ -357,8 +376,8 @@
 	}
 
 	if (verbose)
-		printk(KERN_ERR "Killed process %d (%s)\n",
-				task_pid_nr(p), p->comm);
+		printk(KERN_ERR "Killed process %s(%d:#%u)\n",
+			p->comm, task_pid_nr(p), p->xid);
 
 	/*
 	 * We give our sacrificial lamb high priority and access to
@@ -419,8 +438,8 @@
 		return 0;
 	}
 
-	printk(KERN_ERR "%s: kill process %d (%s) score %li or a child\n",
-					message, task_pid_nr(p), p->comm, points);
+	printk(KERN_ERR "%s: kill process %s(%d:#%u) score %li or a child\n",
+		message, p->comm, task_pid_nr(p), p->xid, points);
 
 	/* Try to kill a child first */
 	list_for_each_entry(c, &p->children, sibling) {
@@ -521,6 +540,8 @@
 	spin_unlock(&zone_scan_lock);
 }
 
+long vs_oom_action(unsigned int);
+
 /*
  * Must be called with tasklist_lock held for read.
  */
@@ -546,7 +567,11 @@
 	/* Found nothing?!?! Either we hang forever, or we panic. */
 	if (!p) {
 		read_unlock(&tasklist_lock);
-		panic("Out of memory and no killable processes...\n");
+		/* avoid panic for guest OOM */
+		if (current->xid)
+			vs_oom_action(LINUX_REBOOT_CMD_OOM);
+		else
+			panic("Out of memory and no killable processes...\n");
 	}
 
 	if (oom_kill_process(p, gfp_mask, order, points, NULL,
diff -uriN linux-2.6.32.43/mm/page_alloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/page_alloc.c
--- linux-2.6.32.43/mm/page_alloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/page_alloc.c	2011-07-15 05:51:19.000000000 -0500
@@ -48,6 +48,8 @@
 #include <linux/page_cgroup.h>
 #include <linux/debugobjects.h>
 #include <linux/kmemleak.h>
+#include <linux/vs_base.h>
+#include <linux/vs_limit.h>
 #include <trace/events/kmem.h>
 
 #include <asm/tlbflush.h>
@@ -289,7 +291,7 @@
  * This usage means that zero-order pages may not be compound.
  */
 
-static void free_compound_page(struct page *page)
+void free_compound_page(struct page *page)
 {
 	__free_pages_ok(page, compound_order(page));
 }
@@ -587,6 +589,10 @@
 	int bad = 0;
 	int wasMlocked = __TestClearPageMlocked(page);
 
+#ifdef CONFIG_PAX_MEMORY_SANITIZE
+	unsigned long index = 1UL << order;
+#endif
+
 	kmemcheck_free_shadow(page, order);
 
 	for (i = 0 ; i < (1 << order) ; ++i)
@@ -599,6 +605,12 @@
 		debug_check_no_obj_freed(page_address(page),
 					   PAGE_SIZE << order);
 	}
+
+#ifdef CONFIG_PAX_MEMORY_SANITIZE
+	for (; index; --index)
+		sanitize_highpage(page + index - 1);
+#endif
+
 	arch_free_page(page, order);
 	kernel_map_pages(page, 1 << order, 0);
 
@@ -702,8 +714,10 @@
 	arch_alloc_page(page, order);
 	kernel_map_pages(page, 1 << order, 1);
 
+#ifndef CONFIG_PAX_MEMORY_SANITIZE
 	if (gfp_flags & __GFP_ZERO)
 		prep_zero_page(page, order, gfp_flags);
+#endif
 
 	if (order && (gfp_flags & __GFP_COMP))
 		prep_compound_page(page, order);
@@ -1097,6 +1111,11 @@
 		debug_check_no_locks_freed(page_address(page), PAGE_SIZE);
 		debug_check_no_obj_freed(page_address(page), PAGE_SIZE);
 	}
+
+#ifdef CONFIG_PAX_MEMORY_SANITIZE
+	sanitize_highpage(page);
+#endif
+
 	arch_free_page(page, 0);
 	kernel_map_pages(page, 1, 0);
 
@@ -2144,6 +2163,9 @@
 	val->totalhigh = totalhigh_pages;
 	val->freehigh = nr_free_highpages();
 	val->mem_unit = PAGE_SIZE;
+
+	if (vx_flags(VXF_VIRT_MEM, 0))
+		vx_vsi_meminfo(val);
 }
 
 EXPORT_SYMBOL(si_meminfo);
@@ -2164,6 +2186,9 @@
 	val->freehigh = 0;
 #endif
 	val->mem_unit = PAGE_SIZE;
+
+	if (vx_flags(VXF_VIRT_MEM, 0))
+		vx_vsi_meminfo(val);
 }
 #endif
 
@@ -2179,6 +2204,8 @@
 	int cpu;
 	struct zone *zone;
 
+	pax_track_stack();
+
 	for_each_populated_zone(zone) {
 		show_node(zone);
 		printk("%s per-cpu:\n", zone->name);
@@ -3736,7 +3763,7 @@
 		zone->pageblock_flags = alloc_bootmem_node(pgdat, usemapsize);
 }
 #else
-static void inline setup_usemap(struct pglist_data *pgdat,
+static inline void setup_usemap(struct pglist_data *pgdat,
 				struct zone *zone, unsigned long zonesize) {}
 #endif /* CONFIG_SPARSEMEM */
 
diff -uriN linux-2.6.32.43/mm/percpu.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/percpu.c
--- linux-2.6.32.43/mm/percpu.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/percpu.c	2011-07-15 05:51:19.000000000 -0500
@@ -115,7 +115,7 @@
 static unsigned int pcpu_last_unit_cpu __read_mostly;
 
 /* the address of the first chunk which starts with the kernel static area */
-void *pcpu_base_addr __read_mostly;
+void *pcpu_base_addr __read_only;
 EXPORT_SYMBOL_GPL(pcpu_base_addr);
 
 static const int *pcpu_unit_map __read_mostly;		/* cpu -> unit */
diff -uriN linux-2.6.32.43/mm/rmap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/rmap.c
--- linux-2.6.32.43/mm/rmap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/rmap.c	2011-07-15 05:51:19.000000000 -0500
@@ -55,6 +55,7 @@
 #include <linux/memcontrol.h>
 #include <linux/mmu_notifier.h>
 #include <linux/migrate.h>
+#include <linux/vs_memory.h>
 
 #include <asm/tlbflush.h>
 
@@ -121,6 +122,17 @@
 		/* page_table_lock to protect against threads */
 		spin_lock(&mm->page_table_lock);
 		if (likely(!vma->anon_vma)) {
+
+#ifdef CONFIG_PAX_SEGMEXEC
+			struct vm_area_struct *vma_m = pax_find_mirror_vma(vma);
+
+			if (vma_m) {
+				BUG_ON(vma_m->anon_vma);
+				vma_m->anon_vma = anon_vma;
+				list_add_tail(&vma_m->anon_vma_node, &anon_vma->head);
+			}
+#endif
+
 			vma->anon_vma = anon_vma;
 			list_add_tail(&vma->anon_vma_node, &anon_vma->head);
 			allocated = NULL;
diff -uriN linux-2.6.32.43/mm/shmem.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/shmem.c
--- linux-2.6.32.43/mm/shmem.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/shmem.c	2011-07-15 05:51:19.000000000 -0500
@@ -31,7 +31,7 @@
 #include <linux/swap.h>
 #include <linux/ima.h>
 
-static struct vfsmount *shm_mnt;
+struct vfsmount *shm_mnt;
 
 #ifdef CONFIG_SHMEM
 /*
@@ -1061,6 +1061,8 @@
 		goto unlock;
 	}
 	entry = shmem_swp_entry(info, index, NULL);
+	if (!entry)
+		goto unlock;
 	if (entry->val) {
 		/*
 		 * The more uptodate page coming down from a stacked
@@ -1144,6 +1146,8 @@
 	struct vm_area_struct pvma;
 	struct page *page;
 
+	pax_track_stack();
+
 	spol = mpol_cond_copy(&mpol,
 				mpol_shared_policy_lookup(&info->policy, idx));
 
@@ -1781,7 +1785,7 @@
 {
 	struct shmem_sb_info *sbinfo = SHMEM_SB(dentry->d_sb);
 
-	buf->f_type = TMPFS_MAGIC;
+	buf->f_type = TMPFS_SUPER_MAGIC;
 	buf->f_bsize = PAGE_CACHE_SIZE;
 	buf->f_namelen = NAME_MAX;
 	spin_lock(&sbinfo->stat_lock);
@@ -1962,7 +1966,7 @@
 
 	info = SHMEM_I(inode);
 	inode->i_size = len-1;
-	if (len <= (char *)inode - (char *)info) {
+	if (len <= (char *)inode - (char *)info && len <= 64) {
 		/* do it inline */
 		memcpy(info, symname, len);
 		inode->i_op = &shmem_symlink_inline_operations;
@@ -2310,8 +2314,7 @@
 	int err = -ENOMEM;
 
 	/* Round up to L1_CACHE_BYTES to resist false sharing */
-	sbinfo = kzalloc(max((int)sizeof(struct shmem_sb_info),
-				L1_CACHE_BYTES), GFP_KERNEL);
+	sbinfo = kzalloc(max(sizeof(struct shmem_sb_info), L1_CACHE_BYTES), GFP_KERNEL);
 	if (!sbinfo)
 		return -ENOMEM;
 
@@ -2346,7 +2349,7 @@
 	sb->s_maxbytes = SHMEM_MAX_BYTES;
 	sb->s_blocksize = PAGE_CACHE_SIZE;
 	sb->s_blocksize_bits = PAGE_CACHE_SHIFT;
-	sb->s_magic = TMPFS_MAGIC;
+	sb->s_magic = TMPFS_SUPER_MAGIC;
 	sb->s_op = &shmem_ops;
 	sb->s_time_gran = 1;
 #ifdef CONFIG_TMPFS_POSIX_ACL
diff -uriN linux-2.6.32.43/mm/slab.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/slab.c
--- linux-2.6.32.43/mm/slab.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/slab.c	2011-07-15 05:51:19.000000000 -0500
@@ -174,7 +174,7 @@
 
 /* Legal flag mask for kmem_cache_create(). */
 #if DEBUG
-# define CREATE_MASK	(SLAB_RED_ZONE | \
+# define CREATE_MASK	(SLAB_USERCOPY | SLAB_RED_ZONE | \
 			 SLAB_POISON | SLAB_HWCACHE_ALIGN | \
 			 SLAB_CACHE_DMA | \
 			 SLAB_STORE_USER | \
@@ -182,7 +182,7 @@
 			 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
 			 SLAB_DEBUG_OBJECTS | SLAB_NOLEAKTRACE | SLAB_NOTRACK)
 #else
-# define CREATE_MASK	(SLAB_HWCACHE_ALIGN | \
+# define CREATE_MASK	(SLAB_USERCOPY | SLAB_HWCACHE_ALIGN | \
 			 SLAB_CACHE_DMA | \
 			 SLAB_RECLAIM_ACCOUNT | SLAB_PANIC | \
 			 SLAB_DESTROY_BY_RCU | SLAB_MEM_SPREAD | \
@@ -308,7 +308,7 @@
  * Need this for bootstrapping a per node allocator.
  */
 #define NUM_INIT_LISTS (3 * MAX_NUMNODES)
-struct kmem_list3 __initdata initkmem_list3[NUM_INIT_LISTS];
+struct kmem_list3 initkmem_list3[NUM_INIT_LISTS];
 #define	CACHE_CACHE 0
 #define	SIZE_AC MAX_NUMNODES
 #define	SIZE_L3 (2 * MAX_NUMNODES)
@@ -409,10 +409,10 @@
 		if ((x)->max_freeable < i)				\
 			(x)->max_freeable = i;				\
 	} while (0)
-#define STATS_INC_ALLOCHIT(x)	atomic_inc(&(x)->allochit)
-#define STATS_INC_ALLOCMISS(x)	atomic_inc(&(x)->allocmiss)
-#define STATS_INC_FREEHIT(x)	atomic_inc(&(x)->freehit)
-#define STATS_INC_FREEMISS(x)	atomic_inc(&(x)->freemiss)
+#define STATS_INC_ALLOCHIT(x)	atomic_inc_unchecked(&(x)->allochit)
+#define STATS_INC_ALLOCMISS(x)	atomic_inc_unchecked(&(x)->allocmiss)
+#define STATS_INC_FREEHIT(x)	atomic_inc_unchecked(&(x)->freehit)
+#define STATS_INC_FREEMISS(x)	atomic_inc_unchecked(&(x)->freemiss)
 #else
 #define	STATS_INC_ACTIVE(x)	do { } while (0)
 #define	STATS_DEC_ACTIVE(x)	do { } while (0)
@@ -431,6 +431,8 @@
 #define STATS_INC_FREEMISS(x)	do { } while (0)
 #endif
 
+#include "slab_vs.h"
+
 #if DEBUG
 
 /*
@@ -558,7 +560,7 @@
  *   reciprocal_divide(offset, cache->reciprocal_buffer_size)
  */
 static inline unsigned int obj_to_index(const struct kmem_cache *cache,
-					const struct slab *slab, void *obj)
+					const struct slab *slab, const void *obj)
 {
 	u32 offset = (obj - slab->s_mem);
 	return reciprocal_divide(offset, cache->reciprocal_buffer_size);
@@ -1453,7 +1455,7 @@
 	sizes[INDEX_AC].cs_cachep = kmem_cache_create(names[INDEX_AC].name,
 					sizes[INDEX_AC].cs_size,
 					ARCH_KMALLOC_MINALIGN,
-					ARCH_KMALLOC_FLAGS|SLAB_PANIC,
+					ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
 					NULL);
 
 	if (INDEX_AC != INDEX_L3) {
@@ -1461,7 +1463,7 @@
 			kmem_cache_create(names[INDEX_L3].name,
 				sizes[INDEX_L3].cs_size,
 				ARCH_KMALLOC_MINALIGN,
-				ARCH_KMALLOC_FLAGS|SLAB_PANIC,
+				ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
 				NULL);
 	}
 
@@ -1479,7 +1481,7 @@
 			sizes->cs_cachep = kmem_cache_create(names->name,
 					sizes->cs_size,
 					ARCH_KMALLOC_MINALIGN,
-					ARCH_KMALLOC_FLAGS|SLAB_PANIC,
+					ARCH_KMALLOC_FLAGS|SLAB_PANIC|SLAB_USERCOPY,
 					NULL);
 		}
 #ifdef CONFIG_ZONE_DMA
@@ -3251,6 +3253,7 @@
 
 	obj = slab_get_obj(cachep, slabp, nodeid);
 	check_slabp(cachep, slabp);
+	vx_slab_alloc(cachep, flags);
 	l3->free_objects--;
 	/* move slabp to correct slabp list: */
 	list_del(&slabp->list);
@@ -3327,6 +3330,7 @@
 	/* ___cache_alloc_node can fall back to other nodes */
 	ptr = ____cache_alloc_node(cachep, flags, nodeid);
   out:
+	vx_slab_alloc(cachep, flags);
 	local_irq_restore(save_flags);
 	ptr = cache_alloc_debugcheck_after(cachep, flags, ptr, caller);
 	kmemleak_alloc_recursive(ptr, obj_size(cachep), 1, cachep->flags,
@@ -3513,6 +3517,7 @@
 	check_irq_off();
 	kmemleak_free_recursive(objp, cachep->flags);
 	objp = cache_free_debugcheck(cachep, objp, __builtin_return_address(0));
+	vx_slab_free(cachep);
 
 	kmemcheck_slab_free(cachep, objp, obj_size(cachep));
 
@@ -4211,10 +4216,10 @@
 	}
 	/* cpu stats */
 	{
-		unsigned long allochit = atomic_read(&cachep->allochit);
-		unsigned long allocmiss = atomic_read(&cachep->allocmiss);
-		unsigned long freehit = atomic_read(&cachep->freehit);
-		unsigned long freemiss = atomic_read(&cachep->freemiss);
+		unsigned long allochit = atomic_read_unchecked(&cachep->allochit);
+		unsigned long allocmiss = atomic_read_unchecked(&cachep->allocmiss);
+		unsigned long freehit = atomic_read_unchecked(&cachep->freehit);
+		unsigned long freemiss = atomic_read_unchecked(&cachep->freemiss);
 
 		seq_printf(m, " : cpustat %6lu %6lu %6lu %6lu",
 			   allochit, allocmiss, freehit, freemiss);
@@ -4471,15 +4476,66 @@
 
 static int __init slab_proc_init(void)
 {
-	proc_create("slabinfo",S_IWUSR|S_IRUGO,NULL,&proc_slabinfo_operations);
+	mode_t gr_mode = S_IRUGO;
+
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+	gr_mode = S_IRUSR;
+#endif
+
+	proc_create("slabinfo",S_IWUSR|gr_mode,NULL,&proc_slabinfo_operations);
 #ifdef CONFIG_DEBUG_SLAB_LEAK
-	proc_create("slab_allocators", 0, NULL, &proc_slabstats_operations);
+	proc_create("slab_allocators", gr_mode, NULL, &proc_slabstats_operations);
 #endif
 	return 0;
 }
 module_init(slab_proc_init);
 #endif
 
+void check_object_size(const void *ptr, unsigned long n, bool to)
+{
+
+#ifdef CONFIG_PAX_USERCOPY
+	struct page *page;
+	struct kmem_cache *cachep = NULL;
+	struct slab *slabp;
+	unsigned int objnr;
+	unsigned long offset;
+
+	if (!n)
+		return;
+
+	if (ZERO_OR_NULL_PTR(ptr))
+		goto report;
+
+	if (!virt_addr_valid(ptr))
+		return;
+
+	page = virt_to_head_page(ptr);
+
+	if (!PageSlab(page)) {
+		if (object_is_on_stack(ptr, n) == -1)
+			goto report;
+		return;
+	}
+
+	cachep = page_get_cache(page);
+	if (!(cachep->flags & SLAB_USERCOPY))
+		goto report;
+
+	slabp = page_get_slab(page);
+	objnr = obj_to_index(cachep, slabp, ptr);
+	BUG_ON(objnr >= cachep->num);
+	offset = ptr - index_to_obj(cachep, slabp, objnr) - obj_offset(cachep);
+	if (offset <= obj_size(cachep) && n <= obj_size(cachep) - offset)
+		return;
+
+report:
+	pax_report_usercopy(ptr, n, to, cachep ? cachep->name : NULL);
+#endif
+
+}
+EXPORT_SYMBOL(check_object_size);
+
 /**
  * ksize - get the actual amount of memory allocated for a given object
  * @objp: Pointer to the object
diff -uriN linux-2.6.32.43/mm/slab_vs.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/slab_vs.h
--- linux-2.6.32.43/mm/slab_vs.h	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/slab_vs.h	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,29 @@
+
+#include <linux/vserver/context.h>
+
+#include <linux/vs_context.h>
+
+static inline
+void vx_slab_alloc(struct kmem_cache *cachep, gfp_t flags)
+{
+	int what = gfp_zone(cachep->gfpflags);
+	struct vx_info *vxi = current_vx_info();
+
+	if (!vxi)
+		return;
+
+	atomic_add_unchecked(cachep->buffer_size, &vxi->cacct.slab[what]);
+}
+
+static inline
+void vx_slab_free(struct kmem_cache *cachep)
+{
+	int what = gfp_zone(cachep->gfpflags);
+	struct vx_info *vxi = current_vx_info();
+
+	if (!vxi)
+		return;
+
+	atomic_sub_unchecked(cachep->buffer_size, &vxi->cacct.slab[what]);
+}
+
diff -uriN linux-2.6.32.43/mm/slob.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/slob.c
--- linux-2.6.32.43/mm/slob.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/slob.c	2011-07-15 05:51:19.000000000 -0500
@@ -29,7 +29,7 @@
  * If kmalloc is asked for objects of PAGE_SIZE or larger, it calls
  * alloc_pages() directly, allocating compound pages so the page order
  * does not have to be separately tracked, and also stores the exact
- * allocation size in page->private so that it can be used to accurately
+ * allocation size in slob_page->size so that it can be used to accurately
  * provide ksize(). These objects are detected in kfree() because slob_page()
  * is false for them.
  *
@@ -58,6 +58,7 @@
  */
 
 #include <linux/kernel.h>
+#include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/mm.h>
 #include <linux/swap.h> /* struct reclaim_state */
@@ -100,7 +101,8 @@
 			unsigned long flags;	/* mandatory */
 			atomic_t _count;	/* mandatory */
 			slobidx_t units;	/* free units left in page */
-			unsigned long pad[2];
+			unsigned long pad[1];
+			unsigned long size;	/* size when >=PAGE_SIZE */
 			slob_t *free;		/* first free slob_t in page */
 			struct list_head list;	/* linked list of free pages */
 		};
@@ -133,7 +135,7 @@
  */
 static inline int is_slob_page(struct slob_page *sp)
 {
-	return PageSlab((struct page *)sp);
+	return PageSlab((struct page *)sp) && !sp->size;
 }
 
 static inline void set_slob_page(struct slob_page *sp)
@@ -148,7 +150,7 @@
 
 static inline struct slob_page *slob_page(const void *addr)
 {
-	return (struct slob_page *)virt_to_page(addr);
+	return (struct slob_page *)virt_to_head_page(addr);
 }
 
 /*
@@ -208,7 +210,7 @@
 /*
  * Return the size of a slob block.
  */
-static slobidx_t slob_units(slob_t *s)
+static slobidx_t slob_units(const slob_t *s)
 {
 	if (s->units > 0)
 		return s->units;
@@ -218,7 +220,7 @@
 /*
  * Return the next free slob block pointer after this one.
  */
-static slob_t *slob_next(slob_t *s)
+static slob_t *slob_next(const slob_t *s)
 {
 	slob_t *base = (slob_t *)((unsigned long)s & PAGE_MASK);
 	slobidx_t next;
@@ -233,7 +235,7 @@
 /*
  * Returns true if s is the last free block in its page.
  */
-static int slob_last(slob_t *s)
+static int slob_last(const slob_t *s)
 {
 	return !((unsigned long)slob_next(s) & ~PAGE_MASK);
 }
@@ -252,6 +254,7 @@
 	if (!page)
 		return NULL;
 
+	set_slob_page(page);
 	return page_address(page);
 }
 
@@ -368,11 +371,11 @@
 		if (!b)
 			return NULL;
 		sp = slob_page(b);
-		set_slob_page(sp);
 
 		spin_lock_irqsave(&slob_lock, flags);
 		sp->units = SLOB_UNITS(PAGE_SIZE);
 		sp->free = b;
+		sp->size = 0;
 		INIT_LIST_HEAD(&sp->list);
 		set_slob(b, SLOB_UNITS(PAGE_SIZE), b + SLOB_UNITS(PAGE_SIZE));
 		set_slob_page_free(sp, slob_list);
@@ -475,10 +478,9 @@
 #define ARCH_SLAB_MINALIGN __alignof__(unsigned long)
 #endif
 
-void *__kmalloc_node(size_t size, gfp_t gfp, int node)
+static void *__kmalloc_node_align(size_t size, gfp_t gfp, int node, int align)
 {
-	unsigned int *m;
-	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+	slob_t *m;
 	void *ret;
 
 	lockdep_trace_alloc(gfp);
@@ -491,7 +493,10 @@
 
 		if (!m)
 			return NULL;
-		*m = size;
+		BUILD_BUG_ON(ARCH_KMALLOC_MINALIGN < 2 * SLOB_UNIT);
+		BUILD_BUG_ON(ARCH_SLAB_MINALIGN < 2 * SLOB_UNIT);
+		m[0].units = size;
+		m[1].units = align;
 		ret = (void *)m + align;
 
 		trace_kmalloc_node(_RET_IP_, ret,
@@ -501,16 +506,25 @@
 
 		ret = slob_new_pages(gfp | __GFP_COMP, get_order(size), node);
 		if (ret) {
-			struct page *page;
-			page = virt_to_page(ret);
-			page->private = size;
+			struct slob_page *sp;
+			sp = slob_page(ret);
+			sp->size = size;
 		}
 
 		trace_kmalloc_node(_RET_IP_, ret,
 				   size, PAGE_SIZE << order, gfp, node);
 	}
 
-	kmemleak_alloc(ret, size, 1, gfp);
+	return ret;
+}
+
+void *__kmalloc_node(size_t size, gfp_t gfp, int node)
+{
+	int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
+	void *ret = __kmalloc_node_align(size, gfp, node, align);
+
+	if (!ZERO_OR_NULL_PTR(ret))
+		kmemleak_alloc(ret, size, 1, gfp);
 	return ret;
 }
 EXPORT_SYMBOL(__kmalloc_node);
@@ -528,13 +542,88 @@
 	sp = slob_page(block);
 	if (is_slob_page(sp)) {
 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-		unsigned int *m = (unsigned int *)(block - align);
-		slob_free(m, *m + align);
-	} else
+		slob_t *m = (slob_t *)(block - align);
+		slob_free(m, m[0].units + align);
+	} else {
+		clear_slob_page(sp);
+		free_slob_page(sp);
+		sp->size = 0;
 		put_page(&sp->page);
+	}
 }
 EXPORT_SYMBOL(kfree);
 
+void check_object_size(const void *ptr, unsigned long n, bool to)
+{
+
+#ifdef CONFIG_PAX_USERCOPY
+	struct slob_page *sp;
+	const slob_t *free;
+	const void *base;
+	unsigned long flags;
+
+	if (!n)
+		return;
+
+	if (ZERO_OR_NULL_PTR(ptr))
+		goto report;
+
+	if (!virt_addr_valid(ptr))
+		return;
+
+	sp = slob_page(ptr);
+	if (!PageSlab((struct page*)sp)) {
+		if (object_is_on_stack(ptr, n) == -1)
+			goto report;
+		return;
+	}
+
+	if (sp->size) {
+		base = page_address(&sp->page);
+		if (base <= ptr && n <= sp->size - (ptr - base))
+			return;
+		goto report;
+	}
+
+	/* some tricky double walking to find the chunk */
+	spin_lock_irqsave(&slob_lock, flags);
+	base = (void *)((unsigned long)ptr & PAGE_MASK);
+	free = sp->free;
+
+	while (!slob_last(free) && (void *)free <= ptr) {
+		base = free + slob_units(free);
+		free = slob_next(free);
+	}
+
+	while (base < (void *)free) {
+		slobidx_t m = ((slob_t *)base)[0].units, align = ((slob_t *)base)[1].units;
+		int size = SLOB_UNIT * SLOB_UNITS(m + align);
+		int offset;
+
+		if (ptr < base + align)
+			break;
+
+		offset = ptr - base - align;
+		if (offset >= m) {
+			base += size;
+			continue;
+		}
+
+		if (n > m - offset)
+			break;
+
+		spin_unlock_irqrestore(&slob_lock, flags);
+		return;
+	}
+
+	spin_unlock_irqrestore(&slob_lock, flags);
+report:
+	pax_report_usercopy(ptr, n, to, NULL);
+#endif
+
+}
+EXPORT_SYMBOL(check_object_size);
+
 /* can't use ksize for kmem_cache_alloc memory, only kmalloc */
 size_t ksize(const void *block)
 {
@@ -547,10 +636,10 @@
 	sp = slob_page(block);
 	if (is_slob_page(sp)) {
 		int align = max(ARCH_KMALLOC_MINALIGN, ARCH_SLAB_MINALIGN);
-		unsigned int *m = (unsigned int *)(block - align);
-		return SLOB_UNITS(*m) * SLOB_UNIT;
+		slob_t *m = (slob_t *)(block - align);
+		return SLOB_UNITS(m[0].units) * SLOB_UNIT;
 	} else
-		return sp->page.private;
+		return sp->size;
 }
 EXPORT_SYMBOL(ksize);
 
@@ -566,8 +655,13 @@
 {
 	struct kmem_cache *c;
 
+#ifdef CONFIG_PAX_USERCOPY
+	c = __kmalloc_node_align(sizeof(struct kmem_cache),
+		GFP_KERNEL, -1, ARCH_KMALLOC_MINALIGN);
+#else
 	c = slob_alloc(sizeof(struct kmem_cache),
 		GFP_KERNEL, ARCH_KMALLOC_MINALIGN, -1);
+#endif
 
 	if (c) {
 		c->name = name;
@@ -605,17 +699,25 @@
 {
 	void *b;
 
+#ifdef CONFIG_PAX_USERCOPY
+	b = __kmalloc_node_align(c->size, flags, node, c->align);
+#else
 	if (c->size < PAGE_SIZE) {
 		b = slob_alloc(c->size, flags, c->align, node);
 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
 					    SLOB_UNITS(c->size) * SLOB_UNIT,
 					    flags, node);
 	} else {
+		struct slob_page *sp;
+
 		b = slob_new_pages(flags, get_order(c->size), node);
+		sp = slob_page(b);
+		sp->size = c->size;
 		trace_kmem_cache_alloc_node(_RET_IP_, b, c->size,
 					    PAGE_SIZE << get_order(c->size),
 					    flags, node);
 	}
+#endif
 
 	if (c->ctor)
 		c->ctor(b);
@@ -627,10 +729,16 @@
 
 static void __kmem_cache_free(void *b, int size)
 {
-	if (size < PAGE_SIZE)
+	struct slob_page *sp = slob_page(b);
+
+	if (is_slob_page(sp))
 		slob_free(b, size);
-	else
+	else {
+		clear_slob_page(sp);
+		free_slob_page(sp);
+		sp->size = 0;
 		slob_free_pages(b, get_order(size));
+	}
 }
 
 static void kmem_rcu_free(struct rcu_head *head)
@@ -643,18 +751,32 @@
 
 void kmem_cache_free(struct kmem_cache *c, void *b)
 {
+	int size = c->size;
+
+#ifdef CONFIG_PAX_USERCOPY
+	if (size + c->align < PAGE_SIZE) {
+		size += c->align;
+		b -= c->align;
+	}
+#endif
+
 	kmemleak_free_recursive(b, c->flags);
 	if (unlikely(c->flags & SLAB_DESTROY_BY_RCU)) {
 		struct slob_rcu *slob_rcu;
-		slob_rcu = b + (c->size - sizeof(struct slob_rcu));
+		slob_rcu = b + (size - sizeof(struct slob_rcu));
 		INIT_RCU_HEAD(&slob_rcu->head);
-		slob_rcu->size = c->size;
+		slob_rcu->size = size;
 		call_rcu(&slob_rcu->head, kmem_rcu_free);
 	} else {
-		__kmem_cache_free(b, c->size);
+		__kmem_cache_free(b, size);
 	}
 
+#ifdef CONFIG_PAX_USERCOPY
+	trace_kfree(_RET_IP_, b);
+#else
 	trace_kmem_cache_free(_RET_IP_, b);
+#endif
+
 }
 EXPORT_SYMBOL(kmem_cache_free);
 
diff -uriN linux-2.6.32.43/mm/slub.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/slub.c
--- linux-2.6.32.43/mm/slub.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/slub.c	2011-07-15 05:51:19.000000000 -0500
@@ -410,7 +410,7 @@
 	if (!t->addr)
 		return;
 
-	printk(KERN_ERR "INFO: %s in %pS age=%lu cpu=%u pid=%d\n",
+	printk(KERN_ERR "INFO: %s in %pA age=%lu cpu=%u pid=%d\n",
 		s, (void *)t->addr, jiffies - t->when, t->cpu, t->pid);
 }
 
@@ -1893,6 +1893,8 @@
 
 	page = virt_to_head_page(x);
 
+	BUG_ON(!PageSlab(page));
+
 	slab_free(s, page, x, _RET_IP_);
 
 	trace_kmem_cache_free(_RET_IP_, x);
@@ -1937,7 +1939,7 @@
  * Merge control. If this is set then no merging of slab caches will occur.
  * (Could be removed. This was introduced to pacify the merge skeptics.)
  */
-static int slub_nomerge;
+static int slub_nomerge = 1;
 
 /*
  * Calculate the order of allocation given an slab object size.
@@ -2493,7 +2495,7 @@
 	 * list to avoid pounding the page allocator excessively.
 	 */
 	set_min_partial(s, ilog2(s->size));
-	s->refcount = 1;
+	atomic_set(&s->refcount, 1);
 #ifdef CONFIG_NUMA
 	s->remote_node_defrag_ratio = 1000;
 #endif
@@ -2630,8 +2632,7 @@
 void kmem_cache_destroy(struct kmem_cache *s)
 {
 	down_write(&slub_lock);
-	s->refcount--;
-	if (!s->refcount) {
+	if (atomic_dec_and_test(&s->refcount)) {
 		list_del(&s->list);
 		up_write(&slub_lock);
 		if (kmem_cache_close(s)) {
@@ -2691,12 +2692,10 @@
 __setup("slub_nomerge", setup_slub_nomerge);
 
 static struct kmem_cache *create_kmalloc_cache(struct kmem_cache *s,
-		const char *name, int size, gfp_t gfp_flags)
+		const char *name, int size, gfp_t gfp_flags, unsigned int flags)
 {
-	unsigned int flags = 0;
-
 	if (gfp_flags & SLUB_DMA)
-		flags = SLAB_CACHE_DMA;
+		flags |= SLAB_CACHE_DMA;
 
 	/*
 	 * This function is called with IRQs disabled during early-boot on
@@ -2915,6 +2914,46 @@
 EXPORT_SYMBOL(__kmalloc_node);
 #endif
 
+void check_object_size(const void *ptr, unsigned long n, bool to)
+{
+
+#ifdef CONFIG_PAX_USERCOPY
+	struct page *page;
+	struct kmem_cache *s = NULL;
+	unsigned long offset;
+
+	if (!n)
+		return;
+
+	if (ZERO_OR_NULL_PTR(ptr))
+		goto report;
+
+	if (!virt_addr_valid(ptr))
+		return;
+
+	page = get_object_page(ptr);
+
+	if (!page) {
+		if (object_is_on_stack(ptr, n) == -1)
+			goto report;
+		return;
+	}
+
+	s = page->slab;
+	if (!(s->flags & SLAB_USERCOPY))
+		goto report;
+
+	offset = (ptr - page_address(page)) % s->size;
+	if (offset <= s->objsize && n <= s->objsize - offset)
+		return;
+
+report:
+	pax_report_usercopy(ptr, n, to, s ? s->name : NULL);
+#endif
+
+}
+EXPORT_SYMBOL(check_object_size);
+
 size_t ksize(const void *object)
 {
 	struct page *page;
@@ -3185,8 +3224,8 @@
 	 * kmem_cache_open for slab_state == DOWN.
 	 */
 	create_kmalloc_cache(&kmalloc_caches[0], "kmem_cache_node",
-		sizeof(struct kmem_cache_node), GFP_NOWAIT);
-	kmalloc_caches[0].refcount = -1;
+		sizeof(struct kmem_cache_node), GFP_NOWAIT, 0);
+	atomic_set(&kmalloc_caches[0].refcount, -1);
 	caches++;
 
 	hotplug_memory_notifier(slab_memory_callback, SLAB_CALLBACK_PRI);
@@ -3198,18 +3237,18 @@
 	/* Caches that are not of the two-to-the-power-of size */
 	if (KMALLOC_MIN_SIZE <= 32) {
 		create_kmalloc_cache(&kmalloc_caches[1],
-				"kmalloc-96", 96, GFP_NOWAIT);
+				"kmalloc-96", 96, GFP_NOWAIT, SLAB_USERCOPY);
 		caches++;
 	}
 	if (KMALLOC_MIN_SIZE <= 64) {
 		create_kmalloc_cache(&kmalloc_caches[2],
-				"kmalloc-192", 192, GFP_NOWAIT);
+				"kmalloc-192", 192, GFP_NOWAIT, SLAB_USERCOPY);
 		caches++;
 	}
 
 	for (i = KMALLOC_SHIFT_LOW; i < SLUB_PAGE_SHIFT; i++) {
 		create_kmalloc_cache(&kmalloc_caches[i],
-			"kmalloc", 1 << i, GFP_NOWAIT);
+			"kmalloc", 1 << i, GFP_NOWAIT, SLAB_USERCOPY);
 		caches++;
 	}
 
@@ -3293,7 +3332,7 @@
 	/*
 	 * We may have set a slab to be unmergeable during bootstrap.
 	 */
-	if (s->refcount < 0)
+	if (atomic_read(&s->refcount) < 0)
 		return 1;
 
 	return 0;
@@ -3353,7 +3392,7 @@
 	if (s) {
 		int cpu;
 
-		s->refcount++;
+		atomic_inc(&s->refcount);
 		/*
 		 * Adjust the object sizes so that we clear
 		 * the complete object on kzalloc.
@@ -3372,7 +3411,7 @@
 
 		if (sysfs_slab_alias(s, name)) {
 			down_write(&slub_lock);
-			s->refcount--;
+			atomic_dec(&s->refcount);
 			up_write(&slub_lock);
 			goto err;
 		}
@@ -4101,7 +4140,7 @@
 
 static ssize_t aliases_show(struct kmem_cache *s, char *buf)
 {
-	return sprintf(buf, "%d\n", s->refcount - 1);
+	return sprintf(buf, "%d\n", atomic_read(&s->refcount) - 1);
 }
 SLAB_ATTR_RO(aliases);
 
@@ -4503,7 +4542,7 @@
 	kfree(s);
 }
 
-static struct sysfs_ops slab_sysfs_ops = {
+static const struct sysfs_ops slab_sysfs_ops = {
 	.show = slab_attr_show,
 	.store = slab_attr_store,
 };
@@ -4522,7 +4561,7 @@
 	return 0;
 }
 
-static struct kset_uevent_ops slab_uevent_ops = {
+static const struct kset_uevent_ops slab_uevent_ops = {
 	.filter = uevent_filter,
 };
 
@@ -4785,7 +4824,13 @@
 
 static int __init slab_proc_init(void)
 {
-	proc_create("slabinfo", S_IRUGO, NULL, &proc_slabinfo_operations);
+	mode_t gr_mode = S_IRUGO;
+
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+	gr_mode = S_IRUSR;
+#endif
+
+	proc_create("slabinfo", gr_mode, NULL, &proc_slabinfo_operations);
 	return 0;
 }
 module_init(slab_proc_init);
diff -uriN linux-2.6.32.43/mm/swap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/swap.c
--- linux-2.6.32.43/mm/swap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/swap.c	2011-07-15 05:51:19.000000000 -0500
@@ -30,6 +30,7 @@
 #include <linux/notifier.h>
 #include <linux/backing-dev.h>
 #include <linux/memcontrol.h>
+#include <linux/hugetlb.h>
 
 #include "internal.h"
 
@@ -65,6 +66,8 @@
 		compound_page_dtor *dtor;
 
 		dtor = get_compound_page_dtor(page);
+		if (!PageHuge(page))
+			BUG_ON(dtor != free_compound_page);
 		(*dtor)(page);
 	}
 }
diff -uriN linux-2.6.32.43/mm/swapfile.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/swapfile.c
--- linux-2.6.32.43/mm/swapfile.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/swapfile.c	2011-07-15 05:50:11.000000000 -0500
@@ -34,6 +34,8 @@
 #include <asm/tlbflush.h>
 #include <linux/swapops.h>
 #include <linux/page_cgroup.h>
+#include <linux/vs_base.h>
+#include <linux/vs_memory.h>
 
 static DEFINE_SPINLOCK(swap_lock);
 static unsigned int nr_swapfiles;
@@ -1682,6 +1684,8 @@
 	if (v == SEQ_START_TOKEN)
 		ptr = swap_info;
 	else {
+		if (vx_flags(VXF_VIRT_MEM, 0))
+			return NULL;
 		ptr = v;
 		ptr++;
 	}
@@ -1709,6 +1713,16 @@
 
 	if (ptr == SEQ_START_TOKEN) {
 		seq_puts(swap,"Filename\t\t\t\tType\t\tSize\tUsed\tPriority\n");
+		if (vx_flags(VXF_VIRT_MEM, 0)) {
+			struct sysinfo si;
+
+			vx_vsi_swapinfo(&si);
+			if (si.totalswap < (1 << 10))
+				return 0;
+			seq_printf(swap, "%s\t\t\t\t\t%s\t%lu\t%lu\t%d\n",
+				"hdv0", "partition", si.totalswap >> 10,
+				(si.totalswap - si.freeswap) >> 10, -1);
+		}
 		return 0;
 	}
 
@@ -2066,6 +2080,8 @@
 	val->freeswap = nr_swap_pages + nr_to_be_unused;
 	val->totalswap = total_swap_pages + nr_to_be_unused;
 	spin_unlock(&swap_lock);
+	if (vx_flags(VXF_VIRT_MEM, 0))
+		vx_vsi_swapinfo(val);
 }
 
 /*
diff -uriN linux-2.6.32.43/mm/util.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/util.c
--- linux-2.6.32.43/mm/util.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/util.c	2011-07-15 05:51:19.000000000 -0500
@@ -228,6 +228,12 @@
 void arch_pick_mmap_layout(struct mm_struct *mm)
 {
 	mm->mmap_base = TASK_UNMAPPED_BASE;
+
+#ifdef CONFIG_PAX_RANDMMAP
+	if (mm->pax_flags & MF_PAX_RANDMMAP)
+		mm->mmap_base += mm->delta_mmap;
+#endif
+
 	mm->get_unmapped_area = arch_get_unmapped_area;
 	mm->unmap_area = arch_unmap_area;
 }
diff -uriN linux-2.6.32.43/mm/vmalloc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/vmalloc.c
--- linux-2.6.32.43/mm/vmalloc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/vmalloc.c	2011-07-15 05:51:19.000000000 -0500
@@ -40,8 +40,19 @@
 
 	pte = pte_offset_kernel(pmd, addr);
 	do {
-		pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
-		WARN_ON(!pte_none(ptent) && !pte_present(ptent));
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+		if ((unsigned long)MODULES_EXEC_VADDR <= addr && addr < (unsigned long)MODULES_EXEC_END) {
+			BUG_ON(!pte_exec(*pte));
+			set_pte_at(&init_mm, addr, pte, pfn_pte(__pa(addr) >> PAGE_SHIFT, PAGE_KERNEL_EXEC));
+			continue;
+		}
+#endif
+
+		{
+			pte_t ptent = ptep_get_and_clear(&init_mm, addr, pte);
+			WARN_ON(!pte_none(ptent) && !pte_present(ptent));
+		}
 	} while (pte++, addr += PAGE_SIZE, addr != end);
 }
 
@@ -92,6 +103,7 @@
 		unsigned long end, pgprot_t prot, struct page **pages, int *nr)
 {
 	pte_t *pte;
+	int ret = -ENOMEM;
 
 	/*
 	 * nr is a running index into the array which helps higher level
@@ -101,17 +113,32 @@
 	pte = pte_alloc_kernel(pmd, addr);
 	if (!pte)
 		return -ENOMEM;
+
+	pax_open_kernel();
 	do {
 		struct page *page = pages[*nr];
 
-		if (WARN_ON(!pte_none(*pte)))
-			return -EBUSY;
-		if (WARN_ON(!page))
-			return -ENOMEM;
+#if defined(CONFIG_MODULES) && defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+		if (!(pgprot_val(prot) & _PAGE_NX))
+			BUG_ON(!pte_exec(*pte) || pte_pfn(*pte) != __pa(addr) >> PAGE_SHIFT);
+		else
+#endif
+
+		if (WARN_ON(!pte_none(*pte))) {
+			ret = -EBUSY;
+			goto out;
+		}
+		if (WARN_ON(!page)) {
+			ret = -ENOMEM;
+			goto out;
+		}
 		set_pte_at(&init_mm, addr, pte, mk_pte(page, prot));
 		(*nr)++;
 	} while (pte++, addr += PAGE_SIZE, addr != end);
-	return 0;
+	ret = 0;
+out:
+	pax_close_kernel();
+	return ret;
 }
 
 static int vmap_pmd_range(pud_t *pud, unsigned long addr,
@@ -192,11 +219,20 @@
 	 * and fall back on vmalloc() if that fails. Others
 	 * just put it in the vmalloc space.
 	 */
-#if defined(CONFIG_MODULES) && defined(MODULES_VADDR)
+#ifdef CONFIG_MODULES
+#ifdef MODULES_VADDR
 	unsigned long addr = (unsigned long)x;
 	if (addr >= MODULES_VADDR && addr < MODULES_END)
 		return 1;
 #endif
+
+#if defined(CONFIG_X86_32) && defined(CONFIG_PAX_KERNEXEC)
+	if (x >= (const void *)MODULES_EXEC_VADDR && x < (const void *)MODULES_EXEC_END)
+		return 1;
+#endif
+
+#endif
+
 	return is_vmalloc_addr(x);
 }
 
@@ -217,8 +253,14 @@
 
 	if (!pgd_none(*pgd)) {
 		pud_t *pud = pud_offset(pgd, addr);
+#ifdef CONFIG_X86
+		if (!pud_large(*pud))
+#endif
 		if (!pud_none(*pud)) {
 			pmd_t *pmd = pmd_offset(pud, addr);
+#ifdef CONFIG_X86
+			if (!pmd_large(*pmd))
+#endif
 			if (!pmd_none(*pmd)) {
 				pte_t *ptep, pte;
 
@@ -292,13 +334,13 @@
 	struct rb_node *tmp;
 
 	while (*p) {
-		struct vmap_area *tmp;
+		struct vmap_area *varea;
 
 		parent = *p;
-		tmp = rb_entry(parent, struct vmap_area, rb_node);
-		if (va->va_start < tmp->va_end)
+		varea = rb_entry(parent, struct vmap_area, rb_node);
+		if (va->va_start < varea->va_end)
 			p = &(*p)->rb_left;
-		else if (va->va_end > tmp->va_start)
+		else if (va->va_end > varea->va_start)
 			p = &(*p)->rb_right;
 		else
 			BUG();
@@ -1232,6 +1274,16 @@
 	struct vm_struct *area;
 
 	BUG_ON(in_interrupt());
+
+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
+	if (flags & VM_KERNEXEC) {
+		if (start != VMALLOC_START || end != VMALLOC_END)
+			return NULL;
+		start = (unsigned long)MODULES_EXEC_VADDR;
+		end = (unsigned long)MODULES_EXEC_END;
+	}
+#endif
+
 	if (flags & VM_IOREMAP) {
 		int bit = fls(size);
 
@@ -1457,6 +1509,11 @@
 	if (count > totalram_pages)
 		return NULL;
 
+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
+	if (!(pgprot_val(prot) & _PAGE_NX))
+		flags |= VM_KERNEXEC;
+#endif
+
 	area = get_vm_area_caller((count << PAGE_SHIFT), flags,
 					__builtin_return_address(0));
 	if (!area)
@@ -1567,6 +1624,13 @@
 	if (!size || (size >> PAGE_SHIFT) > totalram_pages)
 		return NULL;
 
+#if defined(CONFIG_MODULES) && defined(CONFIG_X86) && defined(CONFIG_PAX_KERNEXEC)
+	if (!(pgprot_val(prot) & _PAGE_NX))
+		area = __get_vm_area_node(size, align, VM_ALLOC | VM_KERNEXEC, VMALLOC_START, VMALLOC_END,
+						node, gfp_mask, caller);
+	else
+#endif
+
 	area = __get_vm_area_node(size, align, VM_ALLOC, VMALLOC_START,
 				  VMALLOC_END, node, gfp_mask, caller);
 
@@ -1585,6 +1649,7 @@
 	return addr;
 }
 
+#undef __vmalloc
 void *__vmalloc(unsigned long size, gfp_t gfp_mask, pgprot_t prot)
 {
 	return __vmalloc_node(size, 1, gfp_mask, prot, -1,
@@ -1601,6 +1666,7 @@
  *	For tight control over page level allocator and protection flags
  *	use __vmalloc() instead.
  */
+#undef vmalloc
 void *vmalloc(unsigned long size)
 {
 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
@@ -1615,6 +1681,7 @@
  * The resulting memory area is zeroed so it can be mapped to userspace
  * without leaking data.
  */
+#undef vmalloc_user
 void *vmalloc_user(unsigned long size)
 {
 	struct vm_struct *area;
@@ -1642,6 +1709,7 @@
  *	For tight control over page level allocator and protection flags
  *	use __vmalloc() instead.
  */
+#undef vmalloc_node
 void *vmalloc_node(unsigned long size, int node)
 {
 	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL,
@@ -1664,10 +1732,10 @@
  *	For tight control over page level allocator and protection flags
  *	use __vmalloc() instead.
  */
-
+#undef vmalloc_exec
 void *vmalloc_exec(unsigned long size)
 {
-	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM, PAGE_KERNEL_EXEC,
+	return __vmalloc_node(size, 1, GFP_KERNEL | __GFP_HIGHMEM | __GFP_ZERO, PAGE_KERNEL_EXEC,
 			      -1, __builtin_return_address(0));
 }
 
@@ -1686,6 +1754,7 @@
  *	Allocate enough 32bit PA addressable pages to cover @size from the
  *	page level allocator and map them into contiguous kernel virtual space.
  */
+#undef vmalloc_32
 void *vmalloc_32(unsigned long size)
 {
 	return __vmalloc_node(size, 1, GFP_VMALLOC32, PAGE_KERNEL,
@@ -1700,6 +1769,7 @@
  * The resulting memory area is 32bit addressable and zeroed so it can be
  * mapped to userspace without leaking data.
  */
+#undef vmalloc_32_user
 void *vmalloc_32_user(unsigned long size)
 {
 	struct vm_struct *area;
@@ -1964,6 +2034,8 @@
 	unsigned long uaddr = vma->vm_start;
 	unsigned long usize = vma->vm_end - vma->vm_start;
 
+	BUG_ON(vma->vm_mirror);
+
 	if ((PAGE_SIZE-1) & (unsigned long)addr)
 		return -EINVAL;
 
diff -uriN linux-2.6.32.43/mm/vmstat.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/vmstat.c
--- linux-2.6.32.43/mm/vmstat.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/mm/vmstat.c	2011-07-15 05:51:19.000000000 -0500
@@ -74,7 +74,7 @@
  *
  * vm_stat contains the global counters
  */
-atomic_long_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
+atomic_long_unchecked_t vm_stat[NR_VM_ZONE_STAT_ITEMS];
 EXPORT_SYMBOL(vm_stat);
 
 #ifdef CONFIG_SMP
@@ -324,7 +324,7 @@
 				v = p->vm_stat_diff[i];
 				p->vm_stat_diff[i] = 0;
 				local_irq_restore(flags);
-				atomic_long_add(v, &zone->vm_stat[i]);
+				atomic_long_add_unchecked(v, &zone->vm_stat[i]);
 				global_diff[i] += v;
 #ifdef CONFIG_NUMA
 				/* 3 seconds idle till flush */
@@ -362,7 +362,7 @@
 
 	for (i = 0; i < NR_VM_ZONE_STAT_ITEMS; i++)
 		if (global_diff[i])
-			atomic_long_add(global_diff[i], &vm_stat[i]);
+			atomic_long_add_unchecked(global_diff[i], &vm_stat[i]);
 }
 
 #endif
@@ -953,10 +953,20 @@
 		start_cpu_timer(cpu);
 #endif
 #ifdef CONFIG_PROC_FS
-	proc_create("buddyinfo", S_IRUGO, NULL, &fragmentation_file_operations);
-	proc_create("pagetypeinfo", S_IRUGO, NULL, &pagetypeinfo_file_ops);
-	proc_create("vmstat", S_IRUGO, NULL, &proc_vmstat_file_operations);
-	proc_create("zoneinfo", S_IRUGO, NULL, &proc_zoneinfo_file_operations);
+	{
+		mode_t gr_mode = S_IRUGO;
+#ifdef CONFIG_GRKERNSEC_PROC_ADD
+		gr_mode = S_IRUSR;
+#endif
+		proc_create("buddyinfo", gr_mode, NULL, &fragmentation_file_operations);
+		proc_create("pagetypeinfo", gr_mode, NULL, &pagetypeinfo_file_ops);
+#ifdef CONFIG_GRKERNSEC_PROC_USERGROUP
+		proc_create("vmstat", gr_mode | S_IRGRP, NULL, &proc_vmstat_file_operations);
+#else
+		proc_create("vmstat", gr_mode, NULL, &proc_vmstat_file_operations);
+#endif
+		proc_create("zoneinfo", gr_mode, NULL, &proc_zoneinfo_file_operations);
+	}
 #endif
 	return 0;
 }
diff -uriN linux-2.6.32.43/net/8021q/vlan.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/8021q/vlan.c
--- linux-2.6.32.43/net/8021q/vlan.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/8021q/vlan.c	2011-07-15 05:51:19.000000000 -0500
@@ -622,8 +622,7 @@
 		err = -EPERM;
 		if (!capable(CAP_NET_ADMIN))
 			break;
-		if ((args.u.name_type >= 0) &&
-		    (args.u.name_type < VLAN_NAME_TYPE_HIGHEST)) {
+		if (args.u.name_type < VLAN_NAME_TYPE_HIGHEST) {
 			struct vlan_net *vn;
 
 			vn = net_generic(net, vlan_net_id);
diff -uriN linux-2.6.32.43/net/atm/atm_misc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/atm/atm_misc.c
--- linux-2.6.32.43/net/atm/atm_misc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/atm/atm_misc.c	2011-07-15 05:51:19.000000000 -0500
@@ -19,7 +19,7 @@
 	if (atomic_read(&sk_atm(vcc)->sk_rmem_alloc) <= sk_atm(vcc)->sk_rcvbuf)
 		return 1;
 	atm_return(vcc,truesize);
-	atomic_inc(&vcc->stats->rx_drop);
+	atomic_inc_unchecked(&vcc->stats->rx_drop);
 	return 0;
 }
 
@@ -41,7 +41,7 @@
 		}
 	}
 	atm_return(vcc,guess);
-	atomic_inc(&vcc->stats->rx_drop);
+	atomic_inc_unchecked(&vcc->stats->rx_drop);
 	return NULL;
 }
 
@@ -88,7 +88,7 @@
 
 void sonet_copy_stats(struct k_sonet_stats *from,struct sonet_stats *to)
 {
-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
 	__SONET_ITEMS
 #undef __HANDLE_ITEM
 }
@@ -96,7 +96,7 @@
 
 void sonet_subtract_stats(struct k_sonet_stats *from,struct sonet_stats *to)
 {
-#define __HANDLE_ITEM(i) atomic_sub(to->i,&from->i)
+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i,&from->i)
 	__SONET_ITEMS
 #undef __HANDLE_ITEM
 }
diff -uriN linux-2.6.32.43/net/atm/mpoa_caches.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/atm/mpoa_caches.c
--- linux-2.6.32.43/net/atm/mpoa_caches.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/atm/mpoa_caches.c	2011-07-15 05:51:19.000000000 -0500
@@ -498,6 +498,8 @@
 	struct timeval now;
 	struct k_message msg;
 
+	pax_track_stack();
+
 	do_gettimeofday(&now);
 
 	write_lock_irq(&client->egress_lock);
diff -uriN linux-2.6.32.43/net/atm/proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/atm/proc.c
--- linux-2.6.32.43/net/atm/proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/atm/proc.c	2011-07-15 05:51:19.000000000 -0500
@@ -43,9 +43,9 @@
   const struct k_atm_aal_stats *stats)
 {
 	seq_printf(seq, "%s ( %d %d %d %d %d )", aal,
-	    atomic_read(&stats->tx),atomic_read(&stats->tx_err),
-	    atomic_read(&stats->rx),atomic_read(&stats->rx_err),
-	    atomic_read(&stats->rx_drop));
+	    atomic_read_unchecked(&stats->tx),atomic_read_unchecked(&stats->tx_err),
+	    atomic_read_unchecked(&stats->rx),atomic_read_unchecked(&stats->rx_err),
+	    atomic_read_unchecked(&stats->rx_drop));
 }
 
 static void atm_dev_info(struct seq_file *seq, const struct atm_dev *dev)
@@ -188,7 +188,12 @@
 {
 	struct sock *sk = sk_atm(vcc);
 
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	seq_printf(seq, "%p ", NULL);
+#else
 	seq_printf(seq, "%p ", vcc);
+#endif
+
 	if (!vcc->dev)
 		seq_printf(seq, "Unassigned    ");
 	else
@@ -214,7 +219,11 @@
 {
 	if (!vcc->dev)
 		seq_printf(seq, sizeof(void *) == 4 ?
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			   "N/A@%p%10s" : "N/A@%p%2s", NULL, "");
+#else
 			   "N/A@%p%10s" : "N/A@%p%2s", vcc, "");
+#endif
 	else
 		seq_printf(seq, "%3d %3d %5d         ",
 			   vcc->dev->number, vcc->vpi, vcc->vci);
diff -uriN linux-2.6.32.43/net/atm/resources.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/atm/resources.c
--- linux-2.6.32.43/net/atm/resources.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/atm/resources.c	2011-07-15 05:51:19.000000000 -0500
@@ -161,7 +161,7 @@
 static void copy_aal_stats(struct k_atm_aal_stats *from,
     struct atm_aal_stats *to)
 {
-#define __HANDLE_ITEM(i) to->i = atomic_read(&from->i)
+#define __HANDLE_ITEM(i) to->i = atomic_read_unchecked(&from->i)
 	__AAL_STAT_ITEMS
 #undef __HANDLE_ITEM
 }
@@ -170,7 +170,7 @@
 static void subtract_aal_stats(struct k_atm_aal_stats *from,
     struct atm_aal_stats *to)
 {
-#define __HANDLE_ITEM(i) atomic_sub(to->i, &from->i)
+#define __HANDLE_ITEM(i) atomic_sub_unchecked(to->i, &from->i)
 	__AAL_STAT_ITEMS
 #undef __HANDLE_ITEM
 }
diff -uriN linux-2.6.32.43/net/bluetooth/l2cap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bluetooth/l2cap.c
--- linux-2.6.32.43/net/bluetooth/l2cap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bluetooth/l2cap.c	2011-07-15 05:51:19.000000000 -0500
@@ -1885,7 +1885,7 @@
 			err = -ENOTCONN;
 			break;
 		}
-
+		memset(&cinfo, 0, sizeof(cinfo));
 		cinfo.hci_handle = l2cap_pi(sk)->conn->hcon->handle;
 		memcpy(cinfo.dev_class, l2cap_pi(sk)->conn->hcon->dev_class, 3);
 
@@ -2719,7 +2719,7 @@
 
 	/* Reject if config buffer is too small. */
 	len = cmd_len - sizeof(*req);
-	if (l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
+	if (len < 0 || l2cap_pi(sk)->conf_len + len > sizeof(l2cap_pi(sk)->conf_req)) {
 		l2cap_send_cmd(conn, cmd->ident, L2CAP_CONF_RSP,
 				l2cap_build_conf_rsp(sk, rsp,
 					L2CAP_CONF_REJECT, flags), rsp);
diff -uriN linux-2.6.32.43/net/bluetooth/rfcomm/sock.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bluetooth/rfcomm/sock.c
--- linux-2.6.32.43/net/bluetooth/rfcomm/sock.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bluetooth/rfcomm/sock.c	2011-07-15 05:51:19.000000000 -0500
@@ -878,6 +878,7 @@
 
 		l2cap_sk = rfcomm_pi(sk)->dlc->session->sock->sk;
 
+		memset(&cinfo, 0, sizeof(cinfo));
 		cinfo.hci_handle = l2cap_pi(l2cap_sk)->conn->hcon->handle;
 		memcpy(cinfo.dev_class, l2cap_pi(l2cap_sk)->conn->hcon->dev_class, 3);
 
diff -uriN linux-2.6.32.43/net/bridge/br_private.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bridge/br_private.h
--- linux-2.6.32.43/net/bridge/br_private.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bridge/br_private.h	2011-07-15 05:51:19.000000000 -0500
@@ -254,7 +254,7 @@
 
 #ifdef CONFIG_SYSFS
 /* br_sysfs_if.c */
-extern struct sysfs_ops brport_sysfs_ops;
+extern const struct sysfs_ops brport_sysfs_ops;
 extern int br_sysfs_addif(struct net_bridge_port *p);
 
 /* br_sysfs_br.c */
diff -uriN linux-2.6.32.43/net/bridge/br_stp_if.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bridge/br_stp_if.c
--- linux-2.6.32.43/net/bridge/br_stp_if.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bridge/br_stp_if.c	2011-07-15 05:51:19.000000000 -0500
@@ -146,7 +146,7 @@
 	char *envp[] = { NULL };
 
 	if (br->stp_enabled == BR_USER_STP) {
-		r = call_usermodehelper(BR_STP_PROG, argv, envp, 1);
+		r = call_usermodehelper(BR_STP_PROG, argv, envp, UMH_WAIT_PROC);
 		printk(KERN_INFO "%s: userspace STP stopped, return code %d\n",
 			br->dev->name, r);
 
diff -uriN linux-2.6.32.43/net/bridge/br_sysfs_if.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bridge/br_sysfs_if.c
--- linux-2.6.32.43/net/bridge/br_sysfs_if.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bridge/br_sysfs_if.c	2011-07-15 05:51:19.000000000 -0500
@@ -220,7 +220,7 @@
 	return ret;
 }
 
-struct sysfs_ops brport_sysfs_ops = {
+const struct sysfs_ops brport_sysfs_ops = {
 	.show = brport_show,
 	.store = brport_store,
 };
diff -uriN linux-2.6.32.43/net/bridge/netfilter/ebtables.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bridge/netfilter/ebtables.c
--- linux-2.6.32.43/net/bridge/netfilter/ebtables.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/bridge/netfilter/ebtables.c	2011-07-15 05:51:19.000000000 -0500
@@ -1337,6 +1337,8 @@
 	unsigned int entries_size, nentries;
 	char *entries;
 
+	pax_track_stack();
+
 	if (cmd == EBT_SO_GET_ENTRIES) {
 		entries_size = t->private->entries_size;
 		nentries = t->private->nentries;
diff -uriN linux-2.6.32.43/net/can/bcm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/can/bcm.c
--- linux-2.6.32.43/net/can/bcm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/can/bcm.c	2011-07-15 05:51:19.000000000 -0500
@@ -164,9 +164,15 @@
 	struct bcm_sock *bo = bcm_sk(sk);
 	struct bcm_op *op;
 
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	seq_printf(m, ">>> socket %p", NULL);
+	seq_printf(m, " / sk %p", NULL);
+	seq_printf(m, " / bo %p", NULL);
+#else
 	seq_printf(m, ">>> socket %p", sk->sk_socket);
 	seq_printf(m, " / sk %p", sk);
 	seq_printf(m, " / bo %p", bo);
+#endif
 	seq_printf(m, " / dropped %lu", bo->dropped_usr_msgs);
 	seq_printf(m, " / bound %s", bcm_proc_getifname(ifname, bo->ifindex));
 	seq_printf(m, " <<<\n");
diff -uriN linux-2.6.32.43/net/core/dev.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/dev.c
--- linux-2.6.32.43/net/core/dev.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/dev.c	2011-07-15 05:51:19.000000000 -0500
@@ -126,6 +126,7 @@
 #include <linux/in.h>
 #include <linux/jhash.h>
 #include <linux/random.h>
+#include <linux/vs_inet.h>
 #include <trace/events/napi.h>
 
 #include "net-sysfs.h"
@@ -591,7 +592,8 @@
 	hlist_for_each(p, dev_name_hash(net, name)) {
 		struct net_device *dev
 			= hlist_entry(p, struct net_device, name_hlist);
-		if (!strncmp(dev->name, name, IFNAMSIZ))
+		if (!strncmp(dev->name, name, IFNAMSIZ) &&
+		    nx_dev_visible(current_nx_info(), dev))
 			return dev;
 	}
 	return NULL;
@@ -642,7 +644,8 @@
 	hlist_for_each(p, dev_index_hash(net, ifindex)) {
 		struct net_device *dev
 			= hlist_entry(p, struct net_device, index_hlist);
-		if (dev->ifindex == ifindex)
+		if ((dev->ifindex == ifindex) &&
+		    nx_dev_visible(current_nx_info(), dev))
 			return dev;
 	}
 	return NULL;
@@ -695,10 +698,12 @@
 
 	ASSERT_RTNL();
 
-	for_each_netdev(net, dev)
+	for_each_netdev(net, dev) {
 		if (dev->type == type &&
-		    !memcmp(dev->dev_addr, ha, dev->addr_len))
+		    !memcmp(dev->dev_addr, ha, dev->addr_len) &&
+		    nx_dev_visible(current_nx_info(), dev))
 			return dev;
+	}
 
 	return NULL;
 }
@@ -709,9 +714,11 @@
 	struct net_device *dev;
 
 	ASSERT_RTNL();
-	for_each_netdev(net, dev)
-		if (dev->type == type)
+	for_each_netdev(net, dev) {
+		if ((dev->type == type) &&
+		    nx_dev_visible(current_nx_info(), dev))
 			return dev;
+	}
 
 	return NULL;
 }
@@ -830,6 +837,8 @@
 				continue;
 			if (i < 0 || i >= max_netdevices)
 				continue;
+			if (!nx_dev_visible(current_nx_info(), d))
+				continue;
 
 			/*  avoid cases where sscanf is not exact inverse of printf */
 			snprintf(buf, IFNAMSIZ, name, i);
@@ -1047,10 +1056,14 @@
 	if (no_module && capable(CAP_NET_ADMIN))
 		no_module = request_module("netdev-%s", name);
 	if (no_module && capable(CAP_SYS_MODULE)) {
+#ifdef CONFIG_GRKERNSEC_MODHARDEN
+		___request_module(true, "grsec_modharden_netdev", "%s", name);
+#else
 		if (!request_module("%s", name))
 			pr_err("Loading kernel module for a network device "
 "with CAP_SYS_MODULE (deprecated).  Use CAP_NET_ADMIN and alias netdev-%s "
 "instead\n", name);
+#endif
 	}
 }
 EXPORT_SYMBOL(dev_load);
@@ -2063,7 +2076,7 @@
 }
 EXPORT_SYMBOL(netif_rx_ni);
 
-static void net_tx_action(struct softirq_action *h)
+static void net_tx_action(void)
 {
 	struct softnet_data *sd = &__get_cpu_var(softnet_data);
 
@@ -2826,7 +2839,7 @@
 EXPORT_SYMBOL(netif_napi_del);
 
 
-static void net_rx_action(struct softirq_action *h)
+static void net_rx_action(void)
 {
 	struct list_head *list = &__get_cpu_var(softnet_data).poll_list;
 	unsigned long time_limit = jiffies + 2;
@@ -3002,6 +3015,8 @@
 
 	total = 0;
 	for_each_netdev(net, dev) {
+		if (!nx_dev_visible(current_nx_info(), dev))
+			continue;
 		for (i = 0; i < NPROTO; i++) {
 			if (gifconf_list[i]) {
 				int done;
@@ -3070,6 +3085,9 @@
 {
 	const struct net_device_stats *stats = dev_get_stats(dev);
 
+	if (!nx_dev_visible(current_nx_info(), dev))
+		return;
+
 	seq_printf(seq, "%6s:%8lu %7lu %4lu %4lu %4lu %5lu %10lu %9lu "
 		   "%8lu %7lu %4lu %4lu %4lu %5lu %7lu %10lu\n",
 		   dev->name, stats->rx_bytes, stats->rx_packets,
@@ -5335,7 +5353,6 @@
 	if (dev->dev.parent)
 		goto out;
 #endif
-
 	/* Ensure the device has been registrered */
 	err = -EINVAL;
 	if (dev->reg_state != NETREG_REGISTERED)
diff -uriN linux-2.6.32.43/net/core/flow.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/flow.c
--- linux-2.6.32.43/net/core/flow.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/flow.c	2011-07-15 05:51:19.000000000 -0500
@@ -35,11 +35,11 @@
 	atomic_t		*object_ref;
 };
 
-atomic_t flow_cache_genid = ATOMIC_INIT(0);
+atomic_unchecked_t flow_cache_genid = ATOMIC_INIT(0);
 
 static u32 flow_hash_shift;
 #define flow_hash_size	(1 << flow_hash_shift)
-static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables) = { NULL };
+static DEFINE_PER_CPU(struct flow_cache_entry **, flow_tables);
 
 #define flow_table(cpu) (per_cpu(flow_tables, cpu))
 
@@ -52,7 +52,7 @@
 	u32 hash_rnd;
 	int count;
 };
-static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info) = { 0 };
+static DEFINE_PER_CPU(struct flow_percpu_info, flow_hash_info);
 
 #define flow_hash_rnd_recalc(cpu) \
 	(per_cpu(flow_hash_info, cpu).hash_rnd_recalc)
@@ -69,7 +69,7 @@
 	atomic_t cpuleft;
 	struct completion completion;
 };
-static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets) = { NULL };
+static DEFINE_PER_CPU(struct tasklet_struct, flow_flush_tasklets);
 
 #define flow_flush_tasklet(cpu) (&per_cpu(flow_flush_tasklets, cpu))
 
@@ -190,7 +190,7 @@
 		if (fle->family == family &&
 		    fle->dir == dir &&
 		    flow_key_compare(key, &fle->key) == 0) {
-			if (fle->genid == atomic_read(&flow_cache_genid)) {
+			if (fle->genid == atomic_read_unchecked(&flow_cache_genid)) {
 				void *ret = fle->object;
 
 				if (ret)
@@ -228,7 +228,7 @@
 		err = resolver(net, key, family, dir, &obj, &obj_ref);
 
 		if (fle && !err) {
-			fle->genid = atomic_read(&flow_cache_genid);
+			fle->genid = atomic_read_unchecked(&flow_cache_genid);
 
 			if (fle->object)
 				atomic_dec(fle->object_ref);
@@ -258,7 +258,7 @@
 
 		fle = flow_table(cpu)[i];
 		for (; fle; fle = fle->next) {
-			unsigned genid = atomic_read(&flow_cache_genid);
+			unsigned genid = atomic_read_unchecked(&flow_cache_genid);
 
 			if (!fle->object || fle->genid == genid)
 				continue;
diff -uriN linux-2.6.32.43/net/core/rtnetlink.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/rtnetlink.c
--- linux-2.6.32.43/net/core/rtnetlink.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/rtnetlink.c	2011-07-15 05:50:11.000000000 -0500
@@ -688,6 +688,8 @@
 
 	idx = 0;
 	for_each_netdev(net, dev) {
+		if (!nx_dev_visible(skb->sk->sk_nx_info, dev))
+			continue;
 		if (idx < s_idx)
 			goto cont;
 		if (rtnl_fill_ifinfo(skb, dev, RTM_NEWLINK,
@@ -1222,6 +1224,9 @@
 	struct sk_buff *skb;
 	int err = -ENOBUFS;
 
+	if (!nx_dev_visible(current_nx_info(), dev))
+		return;
+
 	skb = nlmsg_new(if_nlmsg_size(dev), GFP_KERNEL);
 	if (skb == NULL)
 		goto errout;
diff -uriN linux-2.6.32.43/net/core/skbuff.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/skbuff.c
--- linux-2.6.32.43/net/core/skbuff.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/skbuff.c	2011-07-15 05:51:19.000000000 -0500
@@ -1544,6 +1544,8 @@
 	struct sk_buff *frag_iter;
 	struct sock *sk = skb->sk;
 
+	pax_track_stack();
+
 	/*
 	 * __skb_splice_bits() only fails if the output has no room left,
 	 * so no point in going over the frag_list for the error case.
diff -uriN linux-2.6.32.43/net/core/sock.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/sock.c
--- linux-2.6.32.43/net/core/sock.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/core/sock.c	2011-07-15 05:51:19.000000000 -0500
@@ -125,6 +125,10 @@
 #include <linux/ipsec.h>
 
 #include <linux/filter.h>
+#include <linux/vs_socket.h>
+#include <linux/vs_limit.h>
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
 
 #ifdef CONFIG_INET
 #include <net/tcp.h>
@@ -864,11 +868,15 @@
 		break;
 
 	case SO_PEERCRED:
+	{
+		struct ucred peercred;
 		if (len > sizeof(sk->sk_peercred))
 			len = sizeof(sk->sk_peercred);
-		if (copy_to_user(optval, &sk->sk_peercred, len))
+		peercred = sk->sk_peercred;
+		if (copy_to_user(optval, &peercred, len))
 			return -EFAULT;
 		goto lenout;
+	}
 
 	case SO_PEERNAME:
 	{
@@ -984,6 +992,8 @@
 		if (!try_module_get(prot->owner))
 			goto out_free_sec;
 	}
+		sock_vx_init(sk);
+		sock_nx_init(sk);
 
 	return sk;
 
@@ -1063,6 +1073,11 @@
 		       __func__, atomic_read(&sk->sk_omem_alloc));
 
 	put_net(sock_net(sk));
+	vx_sock_dec(sk);
+	clr_vx_info(&sk->sk_vx_info);
+	sk->sk_xid = -1;
+	clr_nx_info(&sk->sk_nx_info);
+	sk->sk_nid = -1;
 	sk_prot_free(sk->sk_prot_creator, sk);
 }
 
@@ -1110,6 +1125,8 @@
 
 		/* SANITY */
 		get_net(sock_net(newsk));
+		sock_vx_init(newsk);
+		sock_nx_init(newsk);
 		sk_node_init(&newsk->sk_node);
 		sock_lock_init(newsk);
 		bh_lock_sock(newsk);
@@ -1164,6 +1181,12 @@
 		smp_wmb();
 		atomic_set(&newsk->sk_refcnt, 2);
 
+		set_vx_info(&newsk->sk_vx_info, sk->sk_vx_info);
+		newsk->sk_xid = sk->sk_xid;
+		vx_sock_inc(newsk);
+		set_nx_info(&newsk->sk_nx_info, sk->sk_nx_info);
+		newsk->sk_nid = sk->sk_nid;
+
 		/*
 		 * Increment the counter in the same struct proto as the master
 		 * sock (sk_refcnt_debug_inc uses newsk->sk_prot->socks, that
@@ -1886,13 +1909,19 @@
 
 	sk->sk_stamp = ktime_set(-1L, 0);
 
+	set_vx_info(&sk->sk_vx_info, current_vx_info());
+	sk->sk_xid = vx_current_xid();
+	vx_sock_inc(sk);
+	set_nx_info(&sk->sk_nx_info, current_nx_info());
+	sk->sk_nid = nx_current_nid();
+
 	/*
 	 * Before updating sk_refcnt, we must commit prior changes to memory
 	 * (Documentation/RCU/rculist_nulls.txt for details)
 	 */
 	smp_wmb();
 	atomic_set(&sk->sk_refcnt, 1);
-	atomic_set(&sk->sk_drops, 0);
+	atomic_set_unchecked(&sk->sk_drops, 0);
 }
 EXPORT_SYMBOL(sock_init_data);
 
diff -uriN linux-2.6.32.43/net/decnet/sysctl_net_decnet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/decnet/sysctl_net_decnet.c
--- linux-2.6.32.43/net/decnet/sysctl_net_decnet.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/decnet/sysctl_net_decnet.c	2011-07-15 05:51:19.000000000 -0500
@@ -206,7 +206,7 @@
 
 	if (len > *lenp) len = *lenp;
 
-	if (copy_to_user(buffer, addr, len))
+	if (len > sizeof addr || copy_to_user(buffer, addr, len))
 		return -EFAULT;
 
 	*lenp = len;
@@ -327,7 +327,7 @@
 
 	if (len > *lenp) len = *lenp;
 
-	if (copy_to_user(buffer, devname, len))
+	if (len > sizeof devname || copy_to_user(buffer, devname, len))
 		return -EFAULT;
 
 	*lenp = len;
diff -uriN linux-2.6.32.43/net/econet/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/econet/Kconfig
--- linux-2.6.32.43/net/econet/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/econet/Kconfig	2011-07-15 05:51:19.000000000 -0500
@@ -4,7 +4,7 @@
 
 config ECONET
 	tristate "Acorn Econet/AUN protocols (EXPERIMENTAL)"
-	depends on EXPERIMENTAL && INET
+	depends on EXPERIMENTAL && INET && BROKEN
 	---help---
 	  Econet is a fairly old and slow networking protocol mainly used by
 	  Acorn computers to access file and print servers. It uses native
diff -uriN linux-2.6.32.43/net/ieee802154/dgram.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ieee802154/dgram.c
--- linux-2.6.32.43/net/ieee802154/dgram.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ieee802154/dgram.c	2011-07-15 05:51:19.000000000 -0500
@@ -318,7 +318,7 @@
 static int dgram_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
 	if (sock_queue_rcv_skb(sk, skb) < 0) {
-		atomic_inc(&sk->sk_drops);
+		atomic_inc_unchecked(&sk->sk_drops);
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
diff -uriN linux-2.6.32.43/net/ieee802154/raw.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ieee802154/raw.c
--- linux-2.6.32.43/net/ieee802154/raw.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ieee802154/raw.c	2011-07-15 05:51:19.000000000 -0500
@@ -206,7 +206,7 @@
 static int raw_rcv_skb(struct sock *sk, struct sk_buff *skb)
 {
 	if (sock_queue_rcv_skb(sk, skb) < 0) {
-		atomic_inc(&sk->sk_drops);
+		atomic_inc_unchecked(&sk->sk_drops);
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
diff -uriN linux-2.6.32.43/net/ipv4/af_inet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/af_inet.c
--- linux-2.6.32.43/net/ipv4/af_inet.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/af_inet.c	2011-07-15 05:50:11.000000000 -0500
@@ -115,6 +115,7 @@
 #ifdef CONFIG_IP_MROUTE
 #include <linux/mroute.h>
 #endif
+#include <linux/vs_limit.h>
 
 
 /* The inetsw table contains everything that inet_create needs to
@@ -325,9 +326,12 @@
 	}
 
 	err = -EPERM;
+	if ((protocol == IPPROTO_ICMP) &&
+		nx_capable(answer->capability, NXC_RAW_ICMP))
+		goto override;
 	if (answer->capability > 0 && !capable(answer->capability))
 		goto out_rcu_unlock;
-
+override:
 	err = -EAFNOSUPPORT;
 	if (!inet_netns_ok(net, protocol))
 		goto out_rcu_unlock;
@@ -447,6 +451,7 @@
 	struct sockaddr_in *addr = (struct sockaddr_in *)uaddr;
 	struct sock *sk = sock->sk;
 	struct inet_sock *inet = inet_sk(sk);
+	struct nx_v4_sock_addr nsa;
 	unsigned short snum;
 	int chk_addr_ret;
 	int err;
@@ -463,7 +468,11 @@
 	if (addr->sin_family != AF_INET)
 		goto out;
 
-	chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
+	err = v4_map_sock_addr(inet, addr, &nsa);
+	if (err)
+		goto out;
+
+	chk_addr_ret = inet_addr_type(sock_net(sk), nsa.saddr);
 
 	/* Not specified by any standard per-se, however it breaks too
 	 * many applications when removed.  It is unfortunate since
@@ -475,7 +484,7 @@
 	err = -EADDRNOTAVAIL;
 	if (!sysctl_ip_nonlocal_bind &&
 	    !(inet->freebind || inet->transparent) &&
-	    addr->sin_addr.s_addr != htonl(INADDR_ANY) &&
+	    nsa.saddr != htonl(INADDR_ANY) &&
 	    chk_addr_ret != RTN_LOCAL &&
 	    chk_addr_ret != RTN_MULTICAST &&
 	    chk_addr_ret != RTN_BROADCAST)
@@ -500,7 +509,7 @@
 	if (sk->sk_state != TCP_CLOSE || inet->num)
 		goto out_release_sock;
 
-	inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+	v4_set_sock_addr(inet, &nsa);
 	if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
 		inet->saddr = 0;  /* Use device */
 
@@ -697,11 +706,13 @@
 		     peer == 1))
 			return -ENOTCONN;
 		sin->sin_port = inet->dport;
-		sin->sin_addr.s_addr = inet->daddr;
+		sin->sin_addr.s_addr =
+			nx_map_sock_lback(sk->sk_nx_info, inet->daddr);
 	} else {
 		__be32 addr = inet->rcv_saddr;
 		if (!addr)
 			addr = inet->saddr;
+		addr = nx_map_sock_lback(sk->sk_nx_info, addr);
 		sin->sin_port = inet->sport;
 		sin->sin_addr.s_addr = addr;
 	}
diff -uriN linux-2.6.32.43/net/ipv4/devinet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/devinet.c
--- linux-2.6.32.43/net/ipv4/devinet.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/devinet.c	2011-07-15 05:50:11.000000000 -0500
@@ -413,6 +413,7 @@
 	return in_dev;
 }
 
+
 /* Called only from RTNL semaphored context. No locks. */
 
 struct in_ifaddr *inet_ifa_byprefix(struct in_device *in_dev, __be32 prefix,
@@ -653,6 +654,8 @@
 		*colon = ':';
 
 	if ((in_dev = __in_dev_get_rtnl(dev)) != NULL) {
+		struct nx_info *nxi = current_nx_info();
+
 		if (tryaddrmatch) {
 			/* Matthias Andree */
 			/* compare label and address (4.4BSD style) */
@@ -661,6 +664,8 @@
 			   This is checked above. */
 			for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
 			     ifap = &ifa->ifa_next) {
+				if (!nx_v4_ifa_visible(nxi, ifa))
+					continue;
 				if (!strcmp(ifr.ifr_name, ifa->ifa_label) &&
 				    sin_orig.sin_addr.s_addr ==
 							ifa->ifa_address) {
@@ -673,9 +678,12 @@
 		   comparing just the label */
 		if (!ifa) {
 			for (ifap = &in_dev->ifa_list; (ifa = *ifap) != NULL;
-			     ifap = &ifa->ifa_next)
+			     ifap = &ifa->ifa_next) {
+				if (!nx_v4_ifa_visible(nxi, ifa))
+					continue;
 				if (!strcmp(ifr.ifr_name, ifa->ifa_label))
 					break;
+			}
 		}
 	}
 
@@ -826,6 +834,8 @@
 		goto out;
 
 	for (; ifa; ifa = ifa->ifa_next) {
+		if (!nx_v4_ifa_visible(current_nx_info(), ifa))
+			continue;
 		if (!buf) {
 			done += sizeof(ifr);
 			continue;
@@ -1185,6 +1195,7 @@
 	struct net_device *dev;
 	struct in_device *in_dev;
 	struct in_ifaddr *ifa;
+	struct sock *sk = skb->sk;
 	int s_ip_idx, s_idx = cb->args[0];
 
 	s_ip_idx = ip_idx = cb->args[1];
@@ -1199,6 +1210,8 @@
 
 		for (ifa = in_dev->ifa_list, ip_idx = 0; ifa;
 		     ifa = ifa->ifa_next, ip_idx++) {
+			if (sk && !nx_v4_ifa_visible(sk->sk_nx_info, ifa))
+				continue;
 			if (ip_idx < s_ip_idx)
 				continue;
 			if (inet_fill_ifaddr(skb, ifa, NETLINK_CB(cb->skb).pid,
diff -uriN linux-2.6.32.43/net/ipv4/fib_hash.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/fib_hash.c
--- linux-2.6.32.43/net/ipv4/fib_hash.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/fib_hash.c	2011-07-15 05:50:11.000000000 -0500
@@ -1021,7 +1021,7 @@
 	prefix	= f->fn_key;
 	mask	= FZ_MASK(iter->zone);
 	flags	= fib_flag_trans(fa->fa_type, mask, fi);
-	if (fi)
+	if (fi && nx_dev_visible(current_nx_info(), fi->fib_dev))
 		seq_printf(seq,
 			 "%s\t%08X\t%08X\t%04X\t%d\t%u\t%d\t%08X\t%d\t%u\t%u%n",
 			 fi->fib_dev ? fi->fib_dev->name : "*", prefix,
diff -uriN linux-2.6.32.43/net/ipv4/inet_connection_sock.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/inet_connection_sock.c
--- linux-2.6.32.43/net/ipv4/inet_connection_sock.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/inet_connection_sock.c	2011-07-15 05:50:11.000000000 -0500
@@ -49,10 +49,40 @@
 }
 EXPORT_SYMBOL(inet_get_local_port_range);
 
+int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
+{
+	__be32	sk1_rcv_saddr = inet_rcv_saddr(sk1),
+		sk2_rcv_saddr = inet_rcv_saddr(sk2);
+
+	if (inet_v6_ipv6only(sk2))
+		return 0;
+
+	if (sk1_rcv_saddr &&
+	    sk2_rcv_saddr &&
+	    sk1_rcv_saddr == sk2_rcv_saddr)
+		return 1;
+
+	if (sk1_rcv_saddr &&
+	    !sk2_rcv_saddr &&
+	    v4_addr_in_nx_info(sk2->sk_nx_info, sk1_rcv_saddr, NXA_MASK_BIND))
+		return 1;
+
+	if (sk2_rcv_saddr &&
+	    !sk1_rcv_saddr &&
+	    v4_addr_in_nx_info(sk1->sk_nx_info, sk2_rcv_saddr, NXA_MASK_BIND))
+		return 1;
+
+	if (!sk1_rcv_saddr &&
+	    !sk2_rcv_saddr &&
+	    nx_v4_addr_conflict(sk1->sk_nx_info, sk2->sk_nx_info))
+		return 1;
+
+	return 0;
+}
+
 int inet_csk_bind_conflict(const struct sock *sk,
 			   const struct inet_bind_bucket *tb)
 {
-	const __be32 sk_rcv_saddr = inet_rcv_saddr(sk);
 	struct sock *sk2;
 	struct hlist_node *node;
 	int reuse = sk->sk_reuse;
@@ -72,9 +102,7 @@
 		     sk->sk_bound_dev_if == sk2->sk_bound_dev_if)) {
 			if (!reuse || !sk2->sk_reuse ||
 			    sk2->sk_state == TCP_LISTEN) {
-				const __be32 sk2_rcv_saddr = inet_rcv_saddr(sk2);
-				if (!sk2_rcv_saddr || !sk_rcv_saddr ||
-				    sk2_rcv_saddr == sk_rcv_saddr)
+				if (ipv4_rcv_saddr_equal(sk, sk2))
 					break;
 			}
 		}
diff -uriN linux-2.6.32.43/net/ipv4/inet_diag.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/inet_diag.c
--- linux-2.6.32.43/net/ipv4/inet_diag.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/inet_diag.c	2011-07-15 05:51:19.000000000 -0500
@@ -32,6 +32,8 @@
 #include <linux/stddef.h>
 
 #include <linux/inet_diag.h>
+#include <linux/vs_network.h>
+#include <linux/vs_inet.h>
 
 static const struct inet_diag_handler **inet_diag_table;
 
@@ -113,13 +115,18 @@
 	r->idiag_retrans = 0;
 
 	r->id.idiag_if = sk->sk_bound_dev_if;
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	r->id.idiag_cookie[0] = 0;
+	r->id.idiag_cookie[1] = 0;
+#else
 	r->id.idiag_cookie[0] = (u32)(unsigned long)sk;
 	r->id.idiag_cookie[1] = (u32)(((unsigned long)sk >> 31) >> 1);
+#endif
 
 	r->id.idiag_sport = inet->sport;
 	r->id.idiag_dport = inet->dport;
-	r->id.idiag_src[0] = inet->rcv_saddr;
-	r->id.idiag_dst[0] = inet->daddr;
+	r->id.idiag_src[0] = nx_map_sock_lback(sk->sk_nx_info, inet->rcv_saddr);
+	r->id.idiag_dst[0] = nx_map_sock_lback(sk->sk_nx_info, inet->daddr);
 
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 	if (r->idiag_family == AF_INET6) {
@@ -200,12 +207,19 @@
 	r->idiag_family	      = tw->tw_family;
 	r->idiag_retrans      = 0;
 	r->id.idiag_if	      = tw->tw_bound_dev_if;
+
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	r->id.idiag_cookie[0] = 0;
+	r->id.idiag_cookie[1] = 0;
+#else
 	r->id.idiag_cookie[0] = (u32)(unsigned long)tw;
 	r->id.idiag_cookie[1] = (u32)(((unsigned long)tw >> 31) >> 1);
+#endif
+
 	r->id.idiag_sport     = tw->tw_sport;
 	r->id.idiag_dport     = tw->tw_dport;
-	r->id.idiag_src[0]    = tw->tw_rcv_saddr;
-	r->id.idiag_dst[0]    = tw->tw_daddr;
+	r->id.idiag_src[0]    = nx_map_sock_lback(tw->tw_nx_info, tw->tw_rcv_saddr);
+	r->id.idiag_dst[0]    = nx_map_sock_lback(tw->tw_nx_info, tw->tw_daddr);
 	r->idiag_state	      = tw->tw_substate;
 	r->idiag_timer	      = 3;
 	r->idiag_expires      = DIV_ROUND_UP(tmo * 1000, HZ);
@@ -262,6 +276,7 @@
 	err = -EINVAL;
 
 	if (req->idiag_family == AF_INET) {
+		/* TODO: lback */
 		sk = inet_lookup(&init_net, hashinfo, req->id.idiag_dst[0],
 				 req->id.idiag_dport, req->id.idiag_src[0],
 				 req->id.idiag_sport, req->id.idiag_if);
@@ -284,12 +299,14 @@
 	if (sk == NULL)
 		goto unlock;
 
+#ifndef CONFIG_GRKERNSEC_HIDESYM
 	err = -ESTALE;
 	if ((req->id.idiag_cookie[0] != INET_DIAG_NOCOOKIE ||
 	     req->id.idiag_cookie[1] != INET_DIAG_NOCOOKIE) &&
 	    ((u32)(unsigned long)sk != req->id.idiag_cookie[0] ||
 	     (u32)((((unsigned long)sk) >> 31) >> 1) != req->id.idiag_cookie[1]))
 		goto out;
+#endif
 
 	err = -ENOMEM;
 	rep = alloc_skb(NLMSG_SPACE((sizeof(struct inet_diag_msg) +
@@ -504,6 +521,7 @@
 		} else
 #endif
 		{
+			/* TODO: lback */
 			entry.saddr = &inet->rcv_saddr;
 			entry.daddr = &inet->daddr;
 		}
@@ -542,6 +560,7 @@
 		} else
 #endif
 		{
+			/* TODO: lback */
 			entry.saddr = &tw->tw_rcv_saddr;
 			entry.daddr = &tw->tw_daddr;
 		}
@@ -579,8 +598,14 @@
 	r->idiag_retrans = req->retrans;
 
 	r->id.idiag_if = sk->sk_bound_dev_if;
+
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+	r->id.idiag_cookie[0] = 0;
+	r->id.idiag_cookie[1] = 0;
+#else
 	r->id.idiag_cookie[0] = (u32)(unsigned long)req;
 	r->id.idiag_cookie[1] = (u32)(((unsigned long)req >> 31) >> 1);
+#endif
 
 	tmo = req->expires - jiffies;
 	if (tmo < 0)
@@ -588,8 +613,8 @@
 
 	r->id.idiag_sport = inet->sport;
 	r->id.idiag_dport = ireq->rmt_port;
-	r->id.idiag_src[0] = ireq->loc_addr;
-	r->id.idiag_dst[0] = ireq->rmt_addr;
+	r->id.idiag_src[0] = nx_map_sock_lback(sk->sk_nx_info, ireq->loc_addr);
+	r->id.idiag_dst[0] = nx_map_sock_lback(sk->sk_nx_info, ireq->rmt_addr);
 	r->idiag_expires = jiffies_to_msecs(tmo);
 	r->idiag_rqueue = 0;
 	r->idiag_wqueue = 0;
@@ -660,6 +685,7 @@
 				continue;
 
 			if (bc) {
+				/* TODO: lback */
 				entry.saddr =
 #if defined(CONFIG_IPV6) || defined (CONFIG_IPV6_MODULE)
 					(entry.family == AF_INET6) ?
@@ -730,6 +756,8 @@
 			sk_nulls_for_each(sk, node, &ilb->head) {
 				struct inet_sock *inet = inet_sk(sk);
 
+				if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
+					continue;
 				if (num < s_num) {
 					num++;
 					continue;
@@ -796,6 +824,8 @@
 		sk_nulls_for_each(sk, node, &head->chain) {
 			struct inet_sock *inet = inet_sk(sk);
 
+			if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
+				continue;
 			if (num < s_num)
 				goto next_normal;
 			if (!(r->idiag_states & (1 << sk->sk_state)))
@@ -820,6 +850,8 @@
 			inet_twsk_for_each(tw, node,
 				    &head->twchain) {
 
+				if (!nx_check(tw->tw_nid, VS_WATCH_P | VS_IDENT))
+					continue;
 				if (num < s_num)
 					goto next_dying;
 				if (r->id.idiag_sport != tw->tw_sport &&
diff -uriN linux-2.6.32.43/net/ipv4/inet_hashtables.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/inet_hashtables.c
--- linux-2.6.32.43/net/ipv4/inet_hashtables.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/inet_hashtables.c	2011-07-15 06:36:02.000000000 -0500
@@ -18,11 +18,15 @@
 #include <linux/sched.h>
 #include <linux/slab.h>
 #include <linux/wait.h>
+#include <linux/security.h>
 
 #include <net/inet_connection_sock.h>
 #include <net/inet_hashtables.h>
+#include <net/route.h>
 #include <net/ip.h>
 
+extern void gr_update_task_in_ip_table(struct task_struct *task, const struct inet_sock *inet);
+
 /*
  * Allocate and initialize a new local port bind bucket.
  * The bindhash mutex for snum's hash chain must be held here.
@@ -134,6 +138,11 @@
 			if (rcv_saddr != daddr)
 				return -1;
 			score += 2;
+		} else {
+			/* block non nx_info ips */
+			if (!v4_addr_in_nx_info(sk->sk_nx_info,
+				daddr, NXA_MASK_BIND))
+				return -1;
 		}
 		if (sk->sk_bound_dev_if) {
 			if (sk->sk_bound_dev_if != dif)
@@ -151,7 +160,6 @@
  * wildcarded during the search since they can never be otherwise.
  */
 
-
 struct sock *__inet_lookup_listener(struct net *net,
 				    struct inet_hashinfo *hashinfo,
 				    const __be32 daddr, const unsigned short hnum,
@@ -174,6 +182,7 @@
 			hiscore = score;
 		}
 	}
+
 	/*
 	 * if the nulls value we got at the end of this lookup is
 	 * not the expected one, we must restart lookup.
@@ -490,6 +499,8 @@
 		}
 		spin_unlock(&head->lock);
 
+		gr_update_task_in_ip_table(current, inet_sk(sk));
+
 		if (tw) {
 			inet_twsk_deschedule(tw, death_row);
 			inet_twsk_put(tw);
diff -uriN linux-2.6.32.43/net/ipv4/inetpeer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/inetpeer.c
--- linux-2.6.32.43/net/ipv4/inetpeer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/inetpeer.c	2011-07-15 05:51:19.000000000 -0500
@@ -366,6 +366,8 @@
 	struct inet_peer *p, *n;
 	struct inet_peer **stack[PEER_MAXDEPTH], ***stackptr;
 
+	pax_track_stack();
+
 	/* Look up for the address quickly. */
 	read_lock_bh(&peer_pool_lock);
 	p = lookup(daddr, NULL);
@@ -389,7 +391,7 @@
 		return NULL;
 	n->v4daddr = daddr;
 	atomic_set(&n->refcnt, 1);
-	atomic_set(&n->rid, 0);
+	atomic_set_unchecked(&n->rid, 0);
 	n->ip_id_count = secure_ip_id(daddr);
 	n->tcp_ts_stamp = 0;
 
diff -uriN linux-2.6.32.43/net/ipv4/ip_fragment.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/ip_fragment.c
--- linux-2.6.32.43/net/ipv4/ip_fragment.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/ip_fragment.c	2011-07-15 05:51:19.000000000 -0500
@@ -255,7 +255,7 @@
 		return 0;
 
 	start = qp->rid;
-	end = atomic_inc_return(&peer->rid);
+	end = atomic_inc_return_unchecked(&peer->rid);
 	qp->rid = end;
 
 	rc = qp->q.fragments && (end - start) > max;
diff -uriN linux-2.6.32.43/net/ipv4/ip_sockglue.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/ip_sockglue.c
--- linux-2.6.32.43/net/ipv4/ip_sockglue.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/ip_sockglue.c	2011-07-15 05:51:19.000000000 -0500
@@ -1015,6 +1015,8 @@
 	int val;
 	int len;
 
+	pax_track_stack();
+
 	if (level != SOL_IP)
 		return -EOPNOTSUPP;
 
diff -uriN linux-2.6.32.43/net/ipv4/netfilter/arp_tables.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter/arp_tables.c
--- linux-2.6.32.43/net/ipv4/netfilter/arp_tables.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter/arp_tables.c	2011-07-15 05:51:19.000000000 -0500
@@ -934,6 +934,7 @@
 			private = &tmp;
 		}
 #endif
+		memset(&info, 0, sizeof(info));
 		info.valid_hooks = t->valid_hooks;
 		memcpy(info.hook_entry, private->hook_entry,
 		       sizeof(info.hook_entry));
diff -uriN linux-2.6.32.43/net/ipv4/netfilter/ip_tables.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter/ip_tables.c
--- linux-2.6.32.43/net/ipv4/netfilter/ip_tables.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter/ip_tables.c	2011-07-15 05:51:19.000000000 -0500
@@ -1141,6 +1141,7 @@
 			private = &tmp;
 		}
 #endif
+		memset(&info, 0, sizeof(info));
 		info.valid_hooks = t->valid_hooks;
 		memcpy(info.hook_entry, private->hook_entry,
 		       sizeof(info.hook_entry));
diff -uriN linux-2.6.32.43/net/ipv4/netfilter/nf_nat_helper.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter/nf_nat_helper.c
--- linux-2.6.32.43/net/ipv4/netfilter/nf_nat_helper.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter/nf_nat_helper.c	2011-07-15 05:50:11.000000000 -0500
@@ -19,6 +19,7 @@
 #include <net/route.h>
 
 #include <linux/netfilter_ipv4.h>
+#include <net/route.h>
 #include <net/netfilter/nf_conntrack.h>
 #include <net/netfilter/nf_conntrack_helper.h>
 #include <net/netfilter/nf_conntrack_ecache.h>
diff -uriN linux-2.6.32.43/net/ipv4/netfilter/nf_nat_snmp_basic.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter/nf_nat_snmp_basic.c
--- linux-2.6.32.43/net/ipv4/netfilter/nf_nat_snmp_basic.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter/nf_nat_snmp_basic.c	2011-07-15 05:51:19.000000000 -0500
@@ -397,7 +397,7 @@
 
 	*len = 0;
 
-	*octets = kmalloc(eoc - ctx->pointer, GFP_ATOMIC);
+	*octets = kmalloc((eoc - ctx->pointer), GFP_ATOMIC);
 	if (*octets == NULL) {
 		if (net_ratelimit())
 			printk("OOM in bsalg (%d)\n", __LINE__);
diff -uriN linux-2.6.32.43/net/ipv4/netfilter.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter.c
--- linux-2.6.32.43/net/ipv4/netfilter.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/netfilter.c	2011-07-15 05:50:11.000000000 -0500
@@ -4,7 +4,7 @@
 #include <linux/netfilter_ipv4.h>
 #include <linux/ip.h>
 #include <linux/skbuff.h>
-#include <net/route.h>
+// #include <net/route.h>
 #include <net/xfrm.h>
 #include <net/ip.h>
 #include <net/netfilter/nf_queue.h>
diff -uriN linux-2.6.32.43/net/ipv4/raw.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/raw.c
--- linux-2.6.32.43/net/ipv4/raw.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/raw.c	2011-07-15 05:51:19.000000000 -0500
@@ -117,7 +117,7 @@
 
 		if (net_eq(sock_net(sk), net) && inet->num == num	&&
 		    !(inet->daddr && inet->daddr != raddr) 		&&
-		    !(inet->rcv_saddr && inet->rcv_saddr != laddr)	&&
+		    v4_sock_addr_match(sk->sk_nx_info, inet, laddr)	&&
 		    !(sk->sk_bound_dev_if && sk->sk_bound_dev_if != dif))
 			goto found; /* gotcha */
 	}
@@ -292,7 +292,7 @@
 	/* Charge it to the socket. */
 
 	if (sock_queue_rcv_skb(sk, skb) < 0) {
-		atomic_inc(&sk->sk_drops);
+		atomic_inc_unchecked(&sk->sk_drops);
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
@@ -303,7 +303,7 @@
 int raw_rcv(struct sock *sk, struct sk_buff *skb)
 {
 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb)) {
-		atomic_inc(&sk->sk_drops);
+		atomic_inc_unchecked(&sk->sk_drops);
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
@@ -383,6 +383,12 @@
 		icmp_out_count(net, ((struct icmphdr *)
 			skb_transport_header(skb))->type);
 
+	err = -EPERM;
+	if (!nx_check(0, VS_ADMIN) && !capable(CAP_NET_RAW) &&
+		sk->sk_nx_info &&
+		!v4_addr_in_nx_info(sk->sk_nx_info, iph->saddr, NXA_MASK_BIND))
+		goto error_free;
+
 	err = NF_HOOK(PF_INET, NF_INET_LOCAL_OUT, skb, NULL, rt->u.dst.dev,
 		      dst_output);
 	if (err > 0)
@@ -563,6 +569,13 @@
 		}
 
 		security_sk_classify_flow(sk, &fl);
+		if (sk->sk_nx_info) {
+			err = ip_v4_find_src(sock_net(sk),
+				sk->sk_nx_info, &rt, &fl);
+
+			if (err)
+				goto done;
+		}
 		err = ip_route_output_flow(sock_net(sk), &rt, &fl, sk, 1);
 	}
 	if (err)
@@ -635,17 +648,19 @@
 {
 	struct inet_sock *inet = inet_sk(sk);
 	struct sockaddr_in *addr = (struct sockaddr_in *) uaddr;
+	struct nx_v4_sock_addr nsa = { 0 };
 	int ret = -EINVAL;
 	int chk_addr_ret;
 
 	if (sk->sk_state != TCP_CLOSE || addr_len < sizeof(struct sockaddr_in))
 		goto out;
-	chk_addr_ret = inet_addr_type(sock_net(sk), addr->sin_addr.s_addr);
+	v4_map_sock_addr(inet, addr, &nsa);
+	chk_addr_ret = inet_addr_type(sock_net(sk), nsa.saddr);
 	ret = -EADDRNOTAVAIL;
-	if (addr->sin_addr.s_addr && chk_addr_ret != RTN_LOCAL &&
+	if (nsa.saddr && chk_addr_ret != RTN_LOCAL &&
 	    chk_addr_ret != RTN_MULTICAST && chk_addr_ret != RTN_BROADCAST)
 		goto out;
-	inet->rcv_saddr = inet->saddr = addr->sin_addr.s_addr;
+	v4_set_sock_addr(inet, &nsa);
 	if (chk_addr_ret == RTN_MULTICAST || chk_addr_ret == RTN_BROADCAST)
 		inet->saddr = 0;  /* Use device */
 	sk_dst_reset(sk);
@@ -697,7 +712,8 @@
 	/* Copy the address. */
 	if (sin) {
 		sin->sin_family = AF_INET;
-		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+		sin->sin_addr.s_addr =
+			nx_map_sock_lback(sk->sk_nx_info, ip_hdr(skb)->saddr);
 		sin->sin_port = 0;
 		memset(&sin->sin_zero, 0, sizeof(sin->sin_zero));
 	}
@@ -724,15 +740,22 @@
 
 static int raw_seticmpfilter(struct sock *sk, char __user *optval, int optlen)
 {
+	struct icmp_filter filter;
+
+	if (optlen < 0)
+		return -EINVAL;
 	if (optlen > sizeof(struct icmp_filter))
 		optlen = sizeof(struct icmp_filter);
-	if (copy_from_user(&raw_sk(sk)->filter, optval, optlen))
+	if (copy_from_user(&filter, optval, optlen))
 		return -EFAULT;
+	memcpy(&raw_sk(sk)->filter, &filter, optlen);
+
 	return 0;
 }
 
 static int raw_geticmpfilter(struct sock *sk, char __user *optval, int __user *optlen)
 {
+	struct icmp_filter filter;
 	int len, ret = -EFAULT;
 
 	if (get_user(len, optlen))
@@ -743,8 +766,9 @@
 	if (len > sizeof(struct icmp_filter))
 		len = sizeof(struct icmp_filter);
 	ret = -EFAULT;
+	memcpy(&filter, &raw_sk(sk)->filter, len);
 	if (put_user(len, optlen) ||
-	    copy_to_user(optval, &raw_sk(sk)->filter, len))
+	    copy_to_user(optval, &filter, len))
 		goto out;
 	ret = 0;
 out:	return ret;
@@ -875,7 +899,8 @@
 		struct hlist_node *node;
 
 		sk_for_each(sk, node, &state->h->ht[state->bucket])
-			if (sock_net(sk) == seq_file_net(seq))
+			if ((sock_net(sk) == seq_file_net(seq)) &&
+				nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
 				goto found;
 	}
 	sk = NULL;
@@ -891,7 +916,8 @@
 		sk = sk_next(sk);
 try_again:
 		;
-	} while (sk && sock_net(sk) != seq_file_net(seq));
+	} while (sk && ((sock_net(sk) != seq_file_net(seq)) ||
+		!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT)));
 
 	if (!sk && ++state->bucket < RAW_HTABLE_SIZE) {
 		sk = sk_head(&state->h->ht[state->bucket]);
@@ -950,11 +976,20 @@
 
 	seq_printf(seq, "%4d: %08X:%04X %08X:%04X"
 		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d\n",
-		i, src, srcp, dest, destp, sp->sk_state,
+		i,
+		nx_map_sock_lback(current_nx_info(), src), srcp,
+		nx_map_sock_lback(current_nx_info(), dest), destp,
+		sp->sk_state,
 		sk_wmem_alloc_get(sp),
 		sk_rmem_alloc_get(sp),
 		0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-		atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
+		atomic_read(&sp->sk_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		NULL,
+#else
+		sp,
+#endif
+		atomic_read_unchecked(&sp->sk_drops));
 }
 
 static int raw_seq_show(struct seq_file *seq, void *v)
diff -uriN linux-2.6.32.43/net/ipv4/route.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/route.c
--- linux-2.6.32.43/net/ipv4/route.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/route.c	2011-07-15 05:51:19.000000000 -0500
@@ -268,7 +268,7 @@
 
 static inline int rt_genid(struct net *net)
 {
-	return atomic_read(&net->ipv4.rt_genid);
+	return atomic_read_unchecked(&net->ipv4.rt_genid);
 }
 
 #ifdef CONFIG_PROC_FS
@@ -888,7 +888,7 @@
 	unsigned char shuffle;
 
 	get_random_bytes(&shuffle, sizeof(shuffle));
-	atomic_add(shuffle + 1U, &net->ipv4.rt_genid);
+	atomic_add_unchecked(shuffle + 1U, &net->ipv4.rt_genid);
 }
 
 /*
@@ -3356,7 +3356,7 @@
 
 static __net_init int rt_secret_timer_init(struct net *net)
 {
-	atomic_set(&net->ipv4.rt_genid,
+	atomic_set_unchecked(&net->ipv4.rt_genid,
 			(int) ((num_physpages ^ (num_physpages>>8)) ^
 			(jiffies ^ (jiffies >> 7))));
 
diff -uriN linux-2.6.32.43/net/ipv4/tcp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp.c
--- linux-2.6.32.43/net/ipv4/tcp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp.c	2011-07-15 05:51:19.000000000 -0500
@@ -264,6 +264,7 @@
 #include <linux/cache.h>
 #include <linux/err.h>
 #include <linux/crypto.h>
+#include <linux/in.h>
 
 #include <net/icmp.h>
 #include <net/tcp.h>
@@ -2085,6 +2086,8 @@
 	int val;
 	int err = 0;
 
+	pax_track_stack();
+
 	/* This is a string value all the others are int's */
 	if (optname == TCP_CONGESTION) {
 		char name[TCP_CA_NAME_MAX];
@@ -2355,6 +2358,8 @@
 	struct tcp_sock *tp = tcp_sk(sk);
 	int val, len;
 
+	pax_track_stack();
+
 	if (get_user(len, optlen))
 		return -EFAULT;
 
diff -uriN linux-2.6.32.43/net/ipv4/tcp_ipv4.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_ipv4.c
--- linux-2.6.32.43/net/ipv4/tcp_ipv4.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_ipv4.c	2011-07-15 05:51:19.000000000 -0500
@@ -84,6 +84,9 @@
 int sysctl_tcp_tw_reuse __read_mostly;
 int sysctl_tcp_low_latency __read_mostly;
 
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+extern int grsec_enable_blackhole;
+#endif
 
 #ifdef CONFIG_TCP_MD5SIG
 static struct tcp_md5sig_key *tcp_v4_md5_do_lookup(struct sock *sk,
@@ -1542,6 +1545,9 @@
 	return 0;
 
 reset:
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+	if (!grsec_enable_blackhole)
+#endif
 	tcp_v4_send_reset(rsk, skb);
 discard:
 	kfree_skb(skb);
@@ -1603,12 +1609,20 @@
 	TCP_SKB_CB(skb)->sacked	 = 0;
 
 	sk = __inet_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
-	if (!sk)
+	if (!sk) {
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+		ret = 1;
+#endif
 		goto no_tcp_socket;
+	}
 
 process:
-	if (sk->sk_state == TCP_TIME_WAIT)
+	if (sk->sk_state == TCP_TIME_WAIT) {
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+		ret = 2;
+#endif
 		goto do_time_wait;
+	}
 
 	if (!xfrm4_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_and_relse;
@@ -1650,6 +1664,10 @@
 bad_packet:
 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
 	} else {
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+		if (!grsec_enable_blackhole || (ret == 1 &&
+		    (skb->dev->flags & IFF_LOOPBACK)))
+#endif
 		tcp_v4_send_reset(NULL, skb);
 	}
 
@@ -1925,6 +1943,12 @@
 		req = req->dl_next;
 		while (1) {
 			while (req) {
+				vxdprintk(VXD_CBIT(net, 6),
+					"sk,req: %p [#%d] (from %d)", req->sk,
+					(req->sk)?req->sk->sk_nid:0, nx_current_nid());
+				if (req->sk &&
+					!nx_check(req->sk->sk_nid, VS_WATCH_P | VS_IDENT))
+					continue;
 				if (req->rsk_ops->family == st->family) {
 					cur = req;
 					goto out;
@@ -1949,6 +1973,10 @@
 	}
 get_sk:
 	sk_nulls_for_each_from(sk, node) {
+		vxdprintk(VXD_CBIT(net, 6), "sk: %p [#%d] (from %d)",
+			sk, sk->sk_nid, nx_current_nid());
+		if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
+			continue;
 		if (sk->sk_family == st->family && net_eq(sock_net(sk), net)) {
 			cur = sk;
 			goto out;
@@ -2012,6 +2040,11 @@
 
 		spin_lock_bh(lock);
 		sk_nulls_for_each(sk, node, &tcp_hashinfo.ehash[st->bucket].chain) {
+			vxdprintk(VXD_CBIT(net, 6),
+				"sk,egf: %p [#%d] (from %d)",
+				sk, sk->sk_nid, nx_current_nid());
+			if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
+				continue;
 			if (sk->sk_family != st->family ||
 			    !net_eq(sock_net(sk), net)) {
 				continue;
@@ -2022,6 +2055,11 @@
 		st->state = TCP_SEQ_STATE_TIME_WAIT;
 		inet_twsk_for_each(tw, node,
 				   &tcp_hashinfo.ehash[st->bucket].twchain) {
+			vxdprintk(VXD_CBIT(net, 6),
+				"tw: %p [#%d] (from %d)",
+				tw, tw->tw_nid, nx_current_nid());
+			if (!nx_check(tw->tw_nid, VS_WATCH_P | VS_IDENT))
+				continue;
 			if (tw->tw_family != st->family ||
 			    !net_eq(twsk_net(tw), net)) {
 				continue;
@@ -2050,7 +2088,9 @@
 		tw = cur;
 		tw = tw_next(tw);
 get_tw:
-		while (tw && (tw->tw_family != st->family || !net_eq(twsk_net(tw), net))) {
+		while (tw && (tw->tw_family != st->family ||
+			!net_eq(twsk_net(tw), net) ||
+			!nx_check(tw->tw_nid, VS_WATCH_P | VS_IDENT))) {
 			tw = tw_next(tw);
 		}
 		if (tw) {
@@ -2073,6 +2113,11 @@
 		sk = sk_nulls_next(sk);
 
 	sk_nulls_for_each_from(sk, node) {
+		vxdprintk(VXD_CBIT(net, 6),
+			"sk,egn: %p [#%d] (from %d)",
+			sk, sk->sk_nid, nx_current_nid());
+		if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
+			continue;
 		if (sk->sk_family == st->family && net_eq(sock_net(sk), net))
 			goto found;
 	}
@@ -2224,9 +2269,9 @@
 	seq_printf(f, "%4d: %08X:%04X %08X:%04X"
 		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %u %d %p%n",
 		i,
-		ireq->loc_addr,
+		nx_map_sock_lback(current_nx_info(), ireq->loc_addr),
 		ntohs(inet_sk(sk)->sport),
-		ireq->rmt_addr,
+		nx_map_sock_lback(current_nx_info(), ireq->rmt_addr),
 		ntohs(ireq->rmt_port),
 		TCP_SYN_RECV,
 		0, 0, /* could print option size, but that is af dependent. */
@@ -2237,7 +2282,11 @@
 		0,  /* non standard timer */
 		0, /* open_requests have no inode */
 		atomic_read(&sk->sk_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		NULL,
+#else
 		req,
+#endif
 		len);
 }
 
@@ -2269,7 +2318,10 @@
 
 	seq_printf(f, "%4d: %08X:%04X %08X:%04X %02X %08X:%08X %02X:%08lX "
 			"%08X %5d %8d %lu %d %p %lu %lu %u %u %d%n",
-		i, src, srcp, dest, destp, sk->sk_state,
+		i,
+		nx_map_sock_lback(current_nx_info(), src), srcp,
+		nx_map_sock_lback(current_nx_info(), dest), destp,
+		sk->sk_state,
 		tp->write_seq - tp->snd_una,
 		sk->sk_state == TCP_LISTEN ? sk->sk_ack_backlog :
 					     (tp->rcv_nxt - tp->copied_seq),
@@ -2279,7 +2331,12 @@
 		sock_i_uid(sk),
 		icsk->icsk_probes_out,
 		sock_i_ino(sk),
-		atomic_read(&sk->sk_refcnt), sk,
+		atomic_read(&sk->sk_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		NULL,
+#else
+		sk,
+#endif
 		jiffies_to_clock_t(icsk->icsk_rto),
 		jiffies_to_clock_t(icsk->icsk_ack.ato),
 		(icsk->icsk_ack.quick << 1) | icsk->icsk_ack.pingpong,
@@ -2305,9 +2362,18 @@
 
 	seq_printf(f, "%4d: %08X:%04X %08X:%04X"
 		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %d %d %p%n",
-		i, src, srcp, dest, destp, tw->tw_substate, 0, 0,
+		i,
+		nx_map_sock_lback(current_nx_info(), src), srcp,
+		nx_map_sock_lback(current_nx_info(), dest), destp,
+		tw->tw_substate, 0, 0,
 		3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-		atomic_read(&tw->tw_refcnt), tw, len);
+		atomic_read(&tw->tw_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		NULL,
+#else
+		tw,
+#endif
+		len);
 }
 
 #define TMPSZ 150
diff -uriN linux-2.6.32.43/net/ipv4/tcp_minisocks.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_minisocks.c
--- linux-2.6.32.43/net/ipv4/tcp_minisocks.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_minisocks.c	2011-07-15 05:51:19.000000000 -0500
@@ -26,6 +26,14 @@
 #include <net/inet_common.h>
 #include <net/xfrm.h>
 
+#include <linux/vs_limit.h>
+#include <linux/vs_socket.h>
+#include <linux/vs_context.h>
+
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+extern int grsec_enable_blackhole;
+#endif
+
 #ifdef CONFIG_SYSCTL
 #define SYNC_INIT 0 /* let the user enable it */
 #else
@@ -294,6 +302,11 @@
 		tcptw->tw_ts_recent	= tp->rx_opt.ts_recent;
 		tcptw->tw_ts_recent_stamp = tp->rx_opt.ts_recent_stamp;
 
+		tw->tw_xid		= sk->sk_xid;
+		tw->tw_vx_info		= NULL;
+		tw->tw_nid		= sk->sk_nid;
+		tw->tw_nx_info		= NULL;
+
 #if defined(CONFIG_IPV6) || defined(CONFIG_IPV6_MODULE)
 		if (tw->tw_family == PF_INET6) {
 			struct ipv6_pinfo *np = inet6_sk(sk);
@@ -672,6 +685,10 @@
 
 embryonic_reset:
 	NET_INC_STATS_BH(sock_net(sk), LINUX_MIB_EMBRYONICRSTS);
+
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+	if (!grsec_enable_blackhole)
+#endif
 	if (!(flg & TCP_FLAG_RST))
 		req->rsk_ops->send_reset(sk, skb);
 
diff -uriN linux-2.6.32.43/net/ipv4/tcp_output.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_output.c
--- linux-2.6.32.43/net/ipv4/tcp_output.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_output.c	2011-07-15 05:51:19.000000000 -0500
@@ -2234,6 +2234,8 @@
 	__u8 *md5_hash_location;
 	int mss;
 
+	pax_track_stack();
+
 	skb = sock_wmalloc(sk, MAX_TCP_HEADER + 15, 1, GFP_ATOMIC);
 	if (skb == NULL)
 		return NULL;
diff -uriN linux-2.6.32.43/net/ipv4/tcp_probe.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_probe.c
--- linux-2.6.32.43/net/ipv4/tcp_probe.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_probe.c	2011-07-15 05:51:19.000000000 -0500
@@ -200,7 +200,7 @@
 		if (cnt + width >= len)
 			break;
 
-		if (copy_to_user(buf + cnt, tbuf, width))
+		if (width > sizeof tbuf || copy_to_user(buf + cnt, tbuf, width))
 			return -EFAULT;
 		cnt += width;
 	}
diff -uriN linux-2.6.32.43/net/ipv4/tcp_timer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_timer.c
--- linux-2.6.32.43/net/ipv4/tcp_timer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/tcp_timer.c	2011-07-15 05:51:19.000000000 -0500
@@ -21,6 +21,10 @@
 #include <linux/module.h>
 #include <net/tcp.h>
 
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+extern int grsec_lastack_retries;
+#endif
+
 int sysctl_tcp_syn_retries __read_mostly = TCP_SYN_RETRIES;
 int sysctl_tcp_synack_retries __read_mostly = TCP_SYNACK_RETRIES;
 int sysctl_tcp_keepalive_time __read_mostly = TCP_KEEPALIVE_TIME;
@@ -164,6 +168,13 @@
 		}
 	}
 
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+	if ((sk->sk_state == TCP_LAST_ACK) &&
+	    (grsec_lastack_retries > 0) &&
+	    (grsec_lastack_retries < retry_until))
+		retry_until = grsec_lastack_retries;
+#endif
+
 	if (retransmits_timed_out(sk, retry_until)) {
 		/* Has it gone just too far? */
 		tcp_write_err(sk);
diff -uriN linux-2.6.32.43/net/ipv4/udp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/udp.c
--- linux-2.6.32.43/net/ipv4/udp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv4/udp.c	2011-07-15 05:51:19.000000000 -0500
@@ -86,6 +86,7 @@
 #include <linux/types.h>
 #include <linux/fcntl.h>
 #include <linux/module.h>
+#include <linux/security.h>
 #include <linux/socket.h>
 #include <linux/sockios.h>
 #include <linux/igmp.h>
@@ -106,6 +107,10 @@
 #include <net/xfrm.h>
 #include "udp_impl.h"
 
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+extern int grsec_enable_blackhole;
+#endif
+
 struct udp_table udp_table;
 EXPORT_SYMBOL(udp_table);
 
@@ -224,14 +229,7 @@
 }
 EXPORT_SYMBOL(udp_lib_get_port);
 
-static int ipv4_rcv_saddr_equal(const struct sock *sk1, const struct sock *sk2)
-{
-	struct inet_sock *inet1 = inet_sk(sk1), *inet2 = inet_sk(sk2);
-
-	return 	(!ipv6_only_sock(sk2)  &&
-		 (!inet1->rcv_saddr || !inet2->rcv_saddr ||
-		   inet1->rcv_saddr == inet2->rcv_saddr));
-}
+extern int ipv4_rcv_saddr_equal(const struct sock *, const struct sock *);
 
 int udp_v4_get_port(struct sock *sk, unsigned short snum)
 {
@@ -253,6 +251,11 @@
 			if (inet->rcv_saddr != daddr)
 				return -1;
 			score += 2;
+		} else {
+			/* block non nx_info ips */
+			if (!v4_addr_in_nx_info(sk->sk_nx_info,
+				daddr, NXA_MASK_BIND))
+				return -1;
 		}
 		if (inet->daddr) {
 			if (inet->daddr != saddr)
@@ -273,6 +276,7 @@
 	return score;
 }
 
+
 /* UDP is nearly always wildcards out the wazoo, it makes no sense to try
  * harder than this. -DaveM
  */
@@ -294,6 +298,11 @@
 	sk_nulls_for_each_rcu(sk, node, &hslot->head) {
 		score = compute_score(sk, net, saddr, hnum, sport,
 				      daddr, dport, dif);
+		/* FIXME: disabled?
+		if (score == 9) {
+			result = sk;
+			break;
+		} else */
 		if (score > badness) {
 			result = sk;
 			badness = score;
@@ -307,6 +316,7 @@
 	if (get_nulls_value(node) != hash)
 		goto begin;
 
+
 	if (result) {
 		if (unlikely(!atomic_inc_not_zero(&result->sk_refcnt)))
 			result = NULL;
@@ -316,6 +326,7 @@
 			goto begin;
 		}
 	}
+
 	rcu_read_unlock();
 	return result;
 }
@@ -358,7 +369,7 @@
 		    s->sk_hash != hnum					||
 		    (inet->daddr && inet->daddr != rmt_addr)		||
 		    (inet->dport != rmt_port && inet->dport)		||
-		    (inet->rcv_saddr && inet->rcv_saddr != loc_addr)	||
+		    !v4_sock_addr_match(sk->sk_nx_info, inet, loc_addr)	||
 		    ipv6_only_sock(s)					||
 		    (s->sk_bound_dev_if && s->sk_bound_dev_if != dif))
 			continue;
@@ -371,6 +382,9 @@
 	return s;
 }
 
+extern int gr_search_udp_recvmsg(struct sock *sk, const struct sk_buff *skb);
+extern int gr_search_udp_sendmsg(struct sock *sk, struct sockaddr_in *addr);
+
 /*
  * This routine is called by the ICMP module when it gets some
  * sort of error condition.  If err < 0 then the socket should
@@ -639,9 +653,18 @@
 		dport = usin->sin_port;
 		if (dport == 0)
 			return -EINVAL;
+
+		err = gr_search_udp_sendmsg(sk, usin);
+		if (err)
+			return err;
 	} else {
 		if (sk->sk_state != TCP_ESTABLISHED)
 			return -EDESTADDRREQ;
+
+		err = gr_search_udp_sendmsg(sk, NULL);
+		if (err)
+			return err;
+
 		daddr = inet->daddr;
 		dport = inet->dport;
 		/* Open fast path for connected socket.
@@ -707,8 +730,13 @@
 					       { .sport = inet->sport,
 						 .dport = dport } } };
 		struct net *net = sock_net(sk);
+		struct nx_info *nxi = sk->sk_nx_info;
 
 		security_sk_classify_flow(sk, &fl);
+		err = ip_v4_find_src(net, nxi, &rt, &fl);
+		if (err)
+			goto out;
+
 		err = ip_route_output_flow(net, &rt, &fl, sk, 1);
 		if (err) {
 			if (err == -ENETUNREACH)
@@ -945,6 +973,10 @@
 	if (!skb)
 		goto out;
 
+	err = gr_search_udp_recvmsg(sk, skb);
+	if (err)
+		goto out_free;
+
 	ulen = skb->len - sizeof(struct udphdr);
 	copied = len;
 	if (copied > ulen)
@@ -988,7 +1020,8 @@
 	if (sin) {
 		sin->sin_family = AF_INET;
 		sin->sin_port = udp_hdr(skb)->source;
-		sin->sin_addr.s_addr = ip_hdr(skb)->saddr;
+		sin->sin_addr.s_addr = nx_map_sock_lback(
+			skb->sk->sk_nx_info, ip_hdr(skb)->saddr);
 		memset(sin->sin_zero, 0, sizeof(sin->sin_zero));
 	}
 	if (inet->cmsg_flags)
@@ -1068,7 +1101,7 @@
 		if (rc == -ENOMEM) {
 			UDP_INC_STATS_BH(sock_net(sk), UDP_MIB_RCVBUFERRORS,
 					 is_udplite);
-			atomic_inc(&sk->sk_drops);
+			atomic_inc_unchecked(&sk->sk_drops);
 		}
 		goto drop;
 	}
@@ -1338,6 +1371,9 @@
 		goto csum_error;
 
 	UDP_INC_STATS_BH(net, UDP_MIB_NOPORTS, proto == IPPROTO_UDPLITE);
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+	if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
+#endif
 	icmp_send(skb, ICMP_DEST_UNREACH, ICMP_PORT_UNREACH, 0);
 
 	/*
@@ -1630,6 +1666,8 @@
 		sk_nulls_for_each(sk, node, &hslot->head) {
 			if (!net_eq(sock_net(sk), net))
 				continue;
+			if (!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT))
+				continue;
 			if (sk->sk_family == state->family)
 				goto found;
 		}
@@ -1647,7 +1685,9 @@
 
 	do {
 		sk = sk_nulls_next(sk);
-	} while (sk && (!net_eq(sock_net(sk), net) || sk->sk_family != state->family));
+	} while (sk && (!net_eq(sock_net(sk), net) ||
+		sk->sk_family != state->family ||
+		!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT)));
 
 	if (!sk) {
 		if (state->bucket < UDP_HTABLE_SIZE)
@@ -1754,12 +1794,20 @@
 
 	seq_printf(f, "%4d: %08X:%04X %08X:%04X"
 		" %02X %08X:%08X %02X:%08lX %08X %5d %8d %lu %d %p %d%n",
-		bucket, src, srcp, dest, destp, sp->sk_state,
+		bucket,
+		nx_map_sock_lback(current_nx_info(), src), srcp,
+		nx_map_sock_lback(current_nx_info(), dest), destp,
+		sp->sk_state,
 		sk_wmem_alloc_get(sp),
 		sk_rmem_alloc_get(sp),
 		0, 0L, 0, sock_i_uid(sp), 0, sock_i_ino(sp),
-		atomic_read(&sp->sk_refcnt), sp,
-		atomic_read(&sp->sk_drops), len);
+		atomic_read(&sp->sk_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		NULL,
+#else
+		sp,
+#endif
+		atomic_read_unchecked(&sp->sk_drops), len);
 }
 
 int udp4_seq_show(struct seq_file *seq, void *v)
diff -uriN linux-2.6.32.43/net/ipv6/addrconf.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/addrconf.c
--- linux-2.6.32.43/net/ipv6/addrconf.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/addrconf.c	2011-07-15 05:50:11.000000000 -0500
@@ -86,6 +86,8 @@
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/vs_network.h>
+#include <linux/vs_inet6.h>
 
 /* Set to 3 to get tracing... */
 #define ACONF_DEBUG 2
@@ -1119,7 +1121,7 @@
 
 int ipv6_dev_get_saddr(struct net *net, struct net_device *dst_dev,
 		       const struct in6_addr *daddr, unsigned int prefs,
-		       struct in6_addr *saddr)
+		       struct in6_addr *saddr, struct nx_info *nxi)
 {
 	struct ipv6_saddr_score scores[2],
 				*score = &scores[0], *hiscore = &scores[1];
@@ -1192,6 +1194,8 @@
 					       dev->name);
 				continue;
 			}
+			if (!v6_addr_in_nx_info(nxi, &score->ifa->addr, -1))
+				continue;
 
 			score->rule = -1;
 			bitmap_zero(score->scorebits, IPV6_SADDR_RULE_MAX);
@@ -3000,7 +3004,10 @@
 static int if6_seq_show(struct seq_file *seq, void *v)
 {
 	struct inet6_ifaddr *ifp = (struct inet6_ifaddr *)v;
-	seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
+
+	if (nx_check(0, VS_ADMIN|VS_WATCH) ||
+	    v6_addr_in_nx_info(current_nx_info(), &ifp->addr, -1))
+		seq_printf(seq, "%pi6 %02x %02x %02x %02x %8s\n",
 		   &ifp->addr,
 		   ifp->idev->dev->ifindex,
 		   ifp->prefix_len,
@@ -3497,6 +3504,12 @@
 	struct ifmcaddr6 *ifmca;
 	struct ifacaddr6 *ifaca;
 	struct net *net = sock_net(skb->sk);
+	struct nx_info *nxi = skb->sk ? skb->sk->sk_nx_info : NULL;
+
+	/* disable ipv6 on non v6 guests */
+	if (nxi && !nx_info_has_v6(nxi))
+		return skb->len;
+
 
 	s_idx = cb->args[0];
 	s_ip_idx = ip_idx = cb->args[1];
@@ -3518,6 +3531,8 @@
 			     ifa = ifa->if_next, ip_idx++) {
 				if (ip_idx < s_ip_idx)
 					continue;
+				if (!v6_addr_in_nx_info(nxi, &ifa->addr, -1))
+					continue;
 				err = inet6_fill_ifaddr(skb, ifa,
 							NETLINK_CB(cb->skb).pid,
 							cb->nlh->nlmsg_seq,
@@ -3531,6 +3546,8 @@
 			     ifmca = ifmca->next, ip_idx++) {
 				if (ip_idx < s_ip_idx)
 					continue;
+				if (!v6_addr_in_nx_info(nxi, &ifmca->mca_addr, -1))
+					continue;
 				err = inet6_fill_ifmcaddr(skb, ifmca,
 							  NETLINK_CB(cb->skb).pid,
 							  cb->nlh->nlmsg_seq,
@@ -3544,6 +3561,8 @@
 			     ifaca = ifaca->aca_next, ip_idx++) {
 				if (ip_idx < s_ip_idx)
 					continue;
+				if (!v6_addr_in_nx_info(nxi, &ifaca->aca_addr, -1))
+					continue;
 				err = inet6_fill_ifacaddr(skb, ifaca,
 							  NETLINK_CB(cb->skb).pid,
 							  cb->nlh->nlmsg_seq,
@@ -3830,12 +3849,19 @@
 	int s_idx = cb->args[0];
 	struct net_device *dev;
 	struct inet6_dev *idev;
+	struct nx_info *nxi = skb->sk ? skb->sk->sk_nx_info : NULL;
+
+	/* FIXME: maybe disable ipv6 on non v6 guests?
+	if (skb->sk && skb->sk->sk_vx_info)
+		return skb->len; */
 
 	read_lock(&dev_base_lock);
 	idx = 0;
 	for_each_netdev(net, dev) {
 		if (idx < s_idx)
 			goto cont;
+		if (!v6_dev_in_nx_info(dev, nxi))
+			goto cont;
 		if ((idev = in6_dev_get(dev)) == NULL)
 			goto cont;
 		err = inet6_fill_ifinfo(skb, idev, NETLINK_CB(cb->skb).pid,
diff -uriN linux-2.6.32.43/net/ipv6/af_inet6.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/af_inet6.c
--- linux-2.6.32.43/net/ipv6/af_inet6.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/af_inet6.c	2011-07-15 05:50:11.000000000 -0500
@@ -41,6 +41,8 @@
 #include <linux/netdevice.h>
 #include <linux/icmpv6.h>
 #include <linux/netfilter_ipv6.h>
+#include <linux/vs_inet.h>
+#include <linux/vs_inet6.h>
 
 #include <net/ip.h>
 #include <net/ipv6.h>
@@ -158,9 +160,12 @@
 	}
 
 	err = -EPERM;
+	if ((protocol == IPPROTO_ICMPV6) &&
+		nx_capable(answer->capability, NXC_RAW_ICMP))
+		goto override;
 	if (answer->capability > 0 && !capable(answer->capability))
 		goto out_rcu_unlock;
-
+override:
 	sock->ops = answer->ops;
 	answer_prot = answer->prot;
 	answer_no_check = answer->no_check;
@@ -259,6 +264,7 @@
 	struct inet_sock *inet = inet_sk(sk);
 	struct ipv6_pinfo *np = inet6_sk(sk);
 	struct net *net = sock_net(sk);
+	struct nx_v6_sock_addr nsa;
 	__be32 v4addr = 0;
 	unsigned short snum;
 	int addr_type = 0;
@@ -270,6 +276,11 @@
 
 	if (addr_len < SIN6_LEN_RFC2133)
 		return -EINVAL;
+
+	err = v6_map_sock_addr(inet, addr, &nsa);
+	if (err)
+		return err;
+
 	addr_type = ipv6_addr_type(&addr->sin6_addr);
 	if ((addr_type & IPV6_ADDR_MULTICAST) && sock->type == SOCK_STREAM)
 		return -EINVAL;
@@ -301,6 +312,7 @@
 		/* Reproduce AF_INET checks to make the bindings consitant */
 		v4addr = addr->sin6_addr.s6_addr32[3];
 		chk_addr_ret = inet_addr_type(net, v4addr);
+
 		if (!sysctl_ip_nonlocal_bind &&
 		    !(inet->freebind || inet->transparent) &&
 		    v4addr != htonl(INADDR_ANY) &&
@@ -310,6 +322,10 @@
 			err = -EADDRNOTAVAIL;
 			goto out;
 		}
+		if (!v4_addr_in_nx_info(sk->sk_nx_info, v4addr, NXA_MASK_BIND)) {
+			err = -EADDRNOTAVAIL;
+			goto out;
+		}
 	} else {
 		if (addr_type != IPV6_ADDR_ANY) {
 			struct net_device *dev = NULL;
@@ -335,6 +351,11 @@
 				}
 			}
 
+			if (!v6_addr_in_nx_info(sk->sk_nx_info, &addr->sin6_addr, -1)) {
+				err = -EADDRNOTAVAIL;
+				goto out;
+			}
+
 			/* ipv4 addr of the socket is invalid.  Only the
 			 * unspecified and mapped address have a v4 equivalent.
 			 */
@@ -353,6 +374,8 @@
 		}
 	}
 
+	v6_set_sock_addr(inet, &nsa);
+
 	inet->rcv_saddr = v4addr;
 	inet->saddr = v4addr;
 
@@ -448,9 +471,11 @@
 			return -ENOTCONN;
 		sin->sin6_port = inet->dport;
 		ipv6_addr_copy(&sin->sin6_addr, &np->daddr);
+		/* FIXME: remap lback? */
 		if (np->sndflow)
 			sin->sin6_flowinfo = np->flow_label;
 	} else {
+		/* FIXME: remap lback? */
 		if (ipv6_addr_any(&np->rcv_saddr))
 			ipv6_addr_copy(&sin->sin6_addr, &np->saddr);
 		else
diff -uriN linux-2.6.32.43/net/ipv6/fib6_rules.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/fib6_rules.c
--- linux-2.6.32.43/net/ipv6/fib6_rules.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/fib6_rules.c	2011-07-15 05:50:11.000000000 -0500
@@ -96,7 +96,7 @@
 			if (ipv6_dev_get_saddr(net,
 					       ip6_dst_idev(&rt->u.dst)->dev,
 					       &flp->fl6_dst, srcprefs,
-					       &saddr))
+					       &saddr, NULL))
 				goto again;
 			if (!ipv6_prefix_equal(&saddr, &r->src.addr,
 					       r->src.plen))
diff -uriN linux-2.6.32.43/net/ipv6/inet6_connection_sock.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/inet6_connection_sock.c
--- linux-2.6.32.43/net/ipv6/inet6_connection_sock.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/inet6_connection_sock.c	2011-07-15 05:51:19.000000000 -0500
@@ -152,7 +152,7 @@
 #ifdef CONFIG_XFRM
 	{
 		struct rt6_info *rt = (struct rt6_info  *)dst;
-		rt->rt6i_flow_cache_genid = atomic_read(&flow_cache_genid);
+		rt->rt6i_flow_cache_genid = atomic_read_unchecked(&flow_cache_genid);
 	}
 #endif
 }
@@ -167,7 +167,7 @@
 #ifdef CONFIG_XFRM
 	if (dst) {
 		struct rt6_info *rt = (struct rt6_info *)dst;
-		if (rt->rt6i_flow_cache_genid != atomic_read(&flow_cache_genid)) {
+		if (rt->rt6i_flow_cache_genid != atomic_read_unchecked(&flow_cache_genid)) {
 			sk->sk_dst_cache = NULL;
 			dst_release(dst);
 			dst = NULL;
diff -uriN linux-2.6.32.43/net/ipv6/inet6_hashtables.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/inet6_hashtables.c
--- linux-2.6.32.43/net/ipv6/inet6_hashtables.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/inet6_hashtables.c	2011-07-15 05:51:19.000000000 -0500
@@ -16,6 +16,7 @@
 
 #include <linux/module.h>
 #include <linux/random.h>
+#include <linux/vs_inet6.h>
 
 #include <net/inet_connection_sock.h>
 #include <net/inet_hashtables.h>
@@ -76,7 +77,6 @@
 	unsigned int slot = hash & (hashinfo->ehash_size - 1);
 	struct inet_ehash_bucket *head = &hashinfo->ehash[slot];
 
-
 	rcu_read_lock();
 begin:
 	sk_nulls_for_each_rcu(sk, node, &head->chain) {
@@ -88,7 +88,7 @@
 				sock_put(sk);
 				goto begin;
 			}
-		goto out;
+			goto out;
 		}
 	}
 	if (get_nulls_value(node) != slot)
@@ -118,7 +118,7 @@
 }
 EXPORT_SYMBOL(__inet6_lookup_established);
 
-static int inline compute_score(struct sock *sk, struct net *net,
+static inline int compute_score(struct sock *sk, struct net *net,
 				const unsigned short hnum,
 				const struct in6_addr *daddr,
 				const int dif)
@@ -134,6 +134,9 @@
 			if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
 				return -1;
 			score++;
+		} else {
+			if (!v6_addr_in_nx_info(sk->sk_nx_info, daddr, -1))
+				return -1;
 		}
 		if (sk->sk_bound_dev_if) {
 			if (sk->sk_bound_dev_if != dif)
diff -uriN linux-2.6.32.43/net/ipv6/ip6_output.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/ip6_output.c
--- linux-2.6.32.43/net/ipv6/ip6_output.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/ip6_output.c	2011-07-15 05:50:11.000000000 -0500
@@ -942,7 +942,7 @@
 		err = ipv6_dev_get_saddr(net, ip6_dst_idev(*dst)->dev,
 					 &fl->fl6_dst,
 					 sk ? inet6_sk(sk)->srcprefs : 0,
-					 &fl->fl6_src);
+					 &fl->fl6_src, sk->sk_nx_info);
 		if (err)
 			goto out_err_release;
 	}
diff -uriN linux-2.6.32.43/net/ipv6/ipv6_sockglue.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/ipv6_sockglue.c
--- linux-2.6.32.43/net/ipv6/ipv6_sockglue.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/ipv6_sockglue.c	2011-07-15 05:51:19.000000000 -0500
@@ -130,6 +130,8 @@
 	int val, valbool;
 	int retv = -ENOPROTOOPT;
 
+	pax_track_stack();
+
 	if (optval == NULL)
 		val=0;
 	else {
@@ -881,6 +883,8 @@
 	int len;
 	int val;
 
+	pax_track_stack();
+
 	if (ip6_mroute_opt(optname))
 		return ip6_mroute_getsockopt(sk, optname, optval, optlen);
 
diff -uriN linux-2.6.32.43/net/ipv6/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/Kconfig
--- linux-2.6.32.43/net/ipv6/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/Kconfig	2011-07-15 05:50:11.000000000 -0500
@@ -4,8 +4,8 @@
 
 #   IPv6 as module will cause a CRASH if you try to unload it
 menuconfig IPV6
-	tristate "The IPv6 protocol"
-	default m
+	bool "The IPv6 protocol"
+	default n
 	---help---
 	  This is complemental support for the IP version 6.
 	  You will still be able to do traditional IPv4 networking as well.
diff -uriN linux-2.6.32.43/net/ipv6/ndisc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/ndisc.c
--- linux-2.6.32.43/net/ipv6/ndisc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/ndisc.c	2011-07-15 05:50:11.000000000 -0500
@@ -589,7 +589,7 @@
 	} else {
 		if (ipv6_dev_get_saddr(dev_net(dev), dev, daddr,
 				       inet6_sk(dev_net(dev)->ipv6.ndisc_sk)->srcprefs,
-				       &tmpaddr))
+				       &tmpaddr, NULL /* FIXME: ? */ ))
 			return;
 		src_addr = &tmpaddr;
 	}
diff -uriN linux-2.6.32.43/net/ipv6/netfilter/ip6_tables.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/netfilter/ip6_tables.c
--- linux-2.6.32.43/net/ipv6/netfilter/ip6_tables.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/netfilter/ip6_tables.c	2011-07-15 05:51:19.000000000 -0500
@@ -1173,6 +1173,7 @@
 			private = &tmp;
 		}
 #endif
+		memset(&info, 0, sizeof(info));
 		info.valid_hooks = t->valid_hooks;
 		memcpy(info.hook_entry, private->hook_entry,
 		       sizeof(info.hook_entry));
diff -uriN linux-2.6.32.43/net/ipv6/raw.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/raw.c
--- linux-2.6.32.43/net/ipv6/raw.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/raw.c	2011-07-15 05:51:19.000000000 -0500
@@ -29,6 +29,7 @@
 #include <linux/icmpv6.h>
 #include <linux/netfilter.h>
 #include <linux/netfilter_ipv6.h>
+#include <linux/vs_inet6.h>
 #include <linux/skbuff.h>
 #include <asm/uaccess.h>
 #include <asm/ioctls.h>
@@ -281,6 +282,13 @@
 			}
 		}
 
+		if (!v6_addr_in_nx_info(sk->sk_nx_info, &addr->sin6_addr, -1)) {
+			err = -EADDRNOTAVAIL;
+			if (dev)
+				dev_put(dev);
+			goto out;
+		}
+
 		/* ipv4 addr of the socket is invalid.  Only the
 		 * unspecified and mapped address have a v4 equivalent.
 		 */
@@ -375,14 +383,14 @@
 {
 	if ((raw6_sk(sk)->checksum || sk->sk_filter) &&
 	    skb_checksum_complete(skb)) {
-		atomic_inc(&sk->sk_drops);
+		atomic_inc_unchecked(&sk->sk_drops);
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
 
 	/* Charge it to the socket. */
 	if (sock_queue_rcv_skb(sk,skb)<0) {
-		atomic_inc(&sk->sk_drops);
+		atomic_inc_unchecked(&sk->sk_drops);
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
@@ -403,7 +411,7 @@
 	struct raw6_sock *rp = raw6_sk(sk);
 
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb)) {
-		atomic_inc(&sk->sk_drops);
+		atomic_inc_unchecked(&sk->sk_drops);
 		kfree_skb(skb);
 		return NET_RX_DROP;
 	}
@@ -427,7 +435,7 @@
 
 	if (inet->hdrincl) {
 		if (skb_checksum_complete(skb)) {
-			atomic_inc(&sk->sk_drops);
+			atomic_inc_unchecked(&sk->sk_drops);
 			kfree_skb(skb);
 			return NET_RX_DROP;
 		}
@@ -518,7 +526,7 @@
 	   as some normal condition.
 	 */
 	err = (flags&MSG_DONTWAIT) ? -EAGAIN : -EHOSTUNREACH;
-	atomic_inc(&sk->sk_drops);
+	atomic_inc_unchecked(&sk->sk_drops);
 	goto out;
 }
 
@@ -600,7 +608,7 @@
 	return err;
 }
 
-static int rawv6_send_hdrinc(struct sock *sk, void *from, int length,
+static int rawv6_send_hdrinc(struct sock *sk, void *from, unsigned int length,
 			struct flowi *fl, struct rt6_info *rt,
 			unsigned int flags)
 {
@@ -738,6 +746,8 @@
 	u16 proto;
 	int err;
 
+	pax_track_stack();
+
 	/* Rough check on arithmetic overflow,
 	   better check is made in ip6_append_data().
 	 */
@@ -916,12 +926,17 @@
 static int rawv6_seticmpfilter(struct sock *sk, int level, int optname,
 			       char __user *optval, int optlen)
 {
+	struct icmp6_filter filter;
+
 	switch (optname) {
 	case ICMPV6_FILTER:
+		if (optlen < 0)
+			return -EINVAL;
 		if (optlen > sizeof(struct icmp6_filter))
 			optlen = sizeof(struct icmp6_filter);
-		if (copy_from_user(&raw6_sk(sk)->filter, optval, optlen))
+		if (copy_from_user(&filter, optval, optlen))
 			return -EFAULT;
+		memcpy(&raw6_sk(sk)->filter, &filter, optlen);
 		return 0;
 	default:
 		return -ENOPROTOOPT;
@@ -933,6 +948,7 @@
 static int rawv6_geticmpfilter(struct sock *sk, int level, int optname,
 			       char __user *optval, int __user *optlen)
 {
+	struct icmp6_filter filter;
 	int len;
 
 	switch (optname) {
@@ -945,7 +961,8 @@
 			len = sizeof(struct icmp6_filter);
 		if (put_user(len, optlen))
 			return -EFAULT;
-		if (copy_to_user(optval, &raw6_sk(sk)->filter, len))
+		memcpy(&filter, &raw6_sk(sk)->filter, len);
+		if (copy_to_user(optval, &filter, len))
 			return -EFAULT;
 		return 0;
 	default:
@@ -1241,7 +1258,13 @@
 		   0, 0L, 0,
 		   sock_i_uid(sp), 0,
 		   sock_i_ino(sp),
-		   atomic_read(&sp->sk_refcnt), sp, atomic_read(&sp->sk_drops));
+		   atomic_read(&sp->sk_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		   NULL,
+#else
+		   sp,
+#endif
+		   atomic_read_unchecked(&sp->sk_drops));
 }
 
 static int raw6_seq_show(struct seq_file *seq, void *v)
diff -uriN linux-2.6.32.43/net/ipv6/route.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/route.c
--- linux-2.6.32.43/net/ipv6/route.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/route.c	2011-07-15 05:50:11.000000000 -0500
@@ -2277,7 +2277,8 @@
 		struct inet6_dev *idev = ip6_dst_idev(&rt->u.dst);
 		struct in6_addr saddr_buf;
 		if (ipv6_dev_get_saddr(net, idev ? idev->dev : NULL,
-				       dst, 0, &saddr_buf) == 0)
+			dst, 0, &saddr_buf,
+			(skb->sk ? skb->sk->sk_nx_info : NULL)) == 0)
 			NLA_PUT(skb, RTA_PREFSRC, 16, &saddr_buf);
 	}
 
diff -uriN linux-2.6.32.43/net/ipv6/tcp_ipv6.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/tcp_ipv6.c
--- linux-2.6.32.43/net/ipv6/tcp_ipv6.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/tcp_ipv6.c	2011-07-15 05:51:19.000000000 -0500
@@ -68,6 +68,7 @@
 
 #include <linux/crypto.h>
 #include <linux/scatterlist.h>
+#include <linux/vs_inet6.h>
 
 static void	tcp_v6_send_reset(struct sock *sk, struct sk_buff *skb);
 static void	tcp_v6_reqsk_send_ack(struct sock *sk, struct sk_buff *skb,
@@ -88,6 +89,10 @@
 }
 #endif
 
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+extern int grsec_enable_blackhole;
+#endif
+
 static void tcp_v6_hash(struct sock *sk)
 {
 	if (sk->sk_state != TCP_CLOSE) {
@@ -156,8 +161,15 @@
 	 *	connect() to INADDR_ANY means loopback (BSD'ism).
 	 */
 
-	if(ipv6_addr_any(&usin->sin6_addr))
-		usin->sin6_addr.s6_addr[15] = 0x1;
+	if(ipv6_addr_any(&usin->sin6_addr)) {
+		struct nx_info *nxi =  sk->sk_nx_info;
+
+		if (nxi && nx_info_has_v6(nxi))
+			/* FIXME: remap lback? */
+			usin->sin6_addr = nxi->v6.ip;
+		else
+			usin->sin6_addr.s6_addr[15] = 0x1;
+	}
 
 	addr_type = ipv6_addr_type(&usin->sin6_addr);
 
@@ -1578,6 +1590,9 @@
 	return 0;
 
 reset:
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+	if (!grsec_enable_blackhole)
+#endif
 	tcp_v6_send_reset(sk, skb);
 discard:
 	if (opt_skb)
@@ -1655,12 +1670,20 @@
 	TCP_SKB_CB(skb)->sacked = 0;
 
 	sk = __inet6_lookup_skb(&tcp_hashinfo, skb, th->source, th->dest);
-	if (!sk)
+	if (!sk) {
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+		ret = 1;
+#endif
 		goto no_tcp_socket;
+	}
 
 process:
-	if (sk->sk_state == TCP_TIME_WAIT)
+	if (sk->sk_state == TCP_TIME_WAIT) {
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+		ret = 2;
+#endif
 		goto do_time_wait;
+	}
 
 	if (!xfrm6_policy_check(sk, XFRM_POLICY_IN, skb))
 		goto discard_and_relse;
@@ -1700,6 +1723,10 @@
 bad_packet:
 		TCP_INC_STATS_BH(net, TCP_MIB_INERRS);
 	} else {
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+		if (!grsec_enable_blackhole || (ret == 1 &&
+		    (skb->dev->flags & IFF_LOOPBACK)))
+#endif
 		tcp_v6_send_reset(NULL, skb);
 	}
 
@@ -1915,7 +1942,13 @@
 		   uid,
 		   0,  /* non standard timer */
 		   0, /* open_requests have no inode */
-		   0, req);
+		   0,
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		   NULL
+#else
+		   req
+#endif
+		   );
 }
 
 static void get_tcp6_sock(struct seq_file *seq, struct sock *sp, int i)
@@ -1965,7 +1998,12 @@
 		   sock_i_uid(sp),
 		   icsk->icsk_probes_out,
 		   sock_i_ino(sp),
-		   atomic_read(&sp->sk_refcnt), sp,
+		   atomic_read(&sp->sk_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		   NULL,
+#else
+		   sp,
+#endif
 		   jiffies_to_clock_t(icsk->icsk_rto),
 		   jiffies_to_clock_t(icsk->icsk_ack.ato),
 		   (icsk->icsk_ack.quick << 1 ) | icsk->icsk_ack.pingpong,
@@ -2000,7 +2038,13 @@
 		   dest->s6_addr32[2], dest->s6_addr32[3], destp,
 		   tw->tw_substate, 0, 0,
 		   3, jiffies_to_clock_t(ttd), 0, 0, 0, 0,
-		   atomic_read(&tw->tw_refcnt), tw);
+		   atomic_read(&tw->tw_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		   NULL
+#else
+		   tw
+#endif
+		   );
 }
 
 static int tcp6_seq_show(struct seq_file *seq, void *v)
diff -uriN linux-2.6.32.43/net/ipv6/udp.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/udp.c
--- linux-2.6.32.43/net/ipv6/udp.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/udp.c	2011-07-15 05:51:19.000000000 -0500
@@ -47,8 +47,13 @@
 
 #include <linux/proc_fs.h>
 #include <linux/seq_file.h>
+#include <linux/vs_inet6.h>
 #include "udp_impl.h"
 
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+extern int grsec_enable_blackhole;
+#endif
+
 int ipv6_rcv_saddr_equal(const struct sock *sk, const struct sock *sk2)
 {
 	const struct in6_addr *sk_rcv_saddr6 = &inet6_sk(sk)->rcv_saddr;
@@ -61,24 +66,49 @@
 	int addr_type2 = sk2_rcv_saddr6 ? ipv6_addr_type(sk2_rcv_saddr6) : IPV6_ADDR_MAPPED;
 
 	/* if both are mapped, treat as IPv4 */
-	if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED)
-		return (!sk2_ipv6only &&
+	if (addr_type == IPV6_ADDR_MAPPED && addr_type2 == IPV6_ADDR_MAPPED) {
+		if (!sk2_ipv6only &&
 			(!sk_rcv_saddr || !sk2_rcv_saddr ||
-			  sk_rcv_saddr == sk2_rcv_saddr));
+			  sk_rcv_saddr == sk2_rcv_saddr))
+			goto vs_v4;
+		else
+			return 0;
+	}
 
 	if (addr_type2 == IPV6_ADDR_ANY &&
 	    !(sk2_ipv6only && addr_type == IPV6_ADDR_MAPPED))
-		return 1;
+		goto vs;
 
 	if (addr_type == IPV6_ADDR_ANY &&
 	    !(sk_ipv6only && addr_type2 == IPV6_ADDR_MAPPED))
-		return 1;
+		goto vs;
 
 	if (sk2_rcv_saddr6 &&
 	    ipv6_addr_equal(sk_rcv_saddr6, sk2_rcv_saddr6))
-		return 1;
+		goto vs;
 
 	return 0;
+
+vs_v4:
+	if (!sk_rcv_saddr && !sk2_rcv_saddr)
+		return nx_v4_addr_conflict(sk->sk_nx_info, sk2->sk_nx_info);
+	if (!sk2_rcv_saddr)
+		return v4_addr_in_nx_info(sk->sk_nx_info, sk2_rcv_saddr, -1);
+	if (!sk_rcv_saddr)
+		return v4_addr_in_nx_info(sk2->sk_nx_info, sk_rcv_saddr, -1);
+	return 1;
+vs:
+	if (addr_type2 == IPV6_ADDR_ANY && addr_type == IPV6_ADDR_ANY)
+		return nx_v6_addr_conflict(sk->sk_nx_info, sk2->sk_nx_info);
+	else if (addr_type2 == IPV6_ADDR_ANY)
+		return v6_addr_in_nx_info(sk2->sk_nx_info, sk_rcv_saddr6, -1);
+	else if (addr_type == IPV6_ADDR_ANY) {
+		if (addr_type2 == IPV6_ADDR_MAPPED)
+			return nx_v4_addr_conflict(sk->sk_nx_info, sk2->sk_nx_info);
+		else
+			return v6_addr_in_nx_info(sk->sk_nx_info, sk2_rcv_saddr6, -1);
+	}
+	return 1;
 }
 
 int udp_v6_get_port(struct sock *sk, unsigned short snum)
@@ -109,6 +139,10 @@
 			if (!ipv6_addr_equal(&np->rcv_saddr, daddr))
 				return -1;
 			score++;
+		} else {
+			/* block non nx_info ips */
+			if (!v6_addr_in_nx_info(sk->sk_nx_info, daddr, -1))
+				return -1;
 		}
 		if (!ipv6_addr_any(&np->daddr)) {
 			if (!ipv6_addr_equal(&np->daddr, saddr))
@@ -391,7 +425,7 @@
 		if (rc == -ENOMEM) {
 			UDP6_INC_STATS_BH(sock_net(sk),
 					UDP_MIB_RCVBUFERRORS, is_udplite);
-			atomic_inc(&sk->sk_drops);
+			atomic_inc_unchecked(&sk->sk_drops);
 		}
 		goto drop;
 	}
@@ -590,6 +624,9 @@
 		UDP6_INC_STATS_BH(net, UDP_MIB_NOPORTS,
 				proto == IPPROTO_UDPLITE);
 
+#ifdef CONFIG_GRKERNSEC_BLACKHOLE
+		if (!grsec_enable_blackhole || (skb->dev->flags & IFF_LOOPBACK))
+#endif
 		icmpv6_send(skb, ICMPV6_DEST_UNREACH, ICMPV6_PORT_UNREACH, 0, dev);
 
 		kfree_skb(skb);
@@ -1209,8 +1246,13 @@
 		   0, 0L, 0,
 		   sock_i_uid(sp), 0,
 		   sock_i_ino(sp),
-		   atomic_read(&sp->sk_refcnt), sp,
-		   atomic_read(&sp->sk_drops));
+		   atomic_read(&sp->sk_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+		   NULL,
+#else
+		   sp,
+#endif
+		   atomic_read_unchecked(&sp->sk_drops));
 }
 
 int udp6_seq_show(struct seq_file *seq, void *v)
diff -uriN linux-2.6.32.43/net/ipv6/xfrm6_policy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/xfrm6_policy.c
--- linux-2.6.32.43/net/ipv6/xfrm6_policy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/ipv6/xfrm6_policy.c	2011-07-15 05:50:11.000000000 -0500
@@ -63,7 +63,7 @@
 	dev = ip6_dst_idev(dst)->dev;
 	ipv6_dev_get_saddr(dev_net(dev), dev,
 			   (struct in6_addr *)&daddr->a6, 0,
-			   (struct in6_addr *)&saddr->a6);
+			   (struct in6_addr *)&saddr->a6, NULL);
 	dst_release(dst);
 	return 0;
 }
diff -uriN linux-2.6.32.43/net/irda/ircomm/ircomm_tty.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/irda/ircomm/ircomm_tty.c
--- linux-2.6.32.43/net/irda/ircomm/ircomm_tty.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/irda/ircomm/ircomm_tty.c	2011-07-15 05:51:19.000000000 -0500
@@ -280,16 +280,16 @@
 	add_wait_queue(&self->open_wait, &wait);
 
 	IRDA_DEBUG(2, "%s(%d):block_til_ready before block on %s open_count=%d\n",
-	      __FILE__,__LINE__, tty->driver->name, self->open_count );
+	      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
 
 	/* As far as I can see, we protect open_count - Jean II */
 	spin_lock_irqsave(&self->spinlock, flags);
 	if (!tty_hung_up_p(filp)) {
 		extra_count = 1;
-		self->open_count--;
+		local_dec(&self->open_count);
 	}
 	spin_unlock_irqrestore(&self->spinlock, flags);
-	self->blocked_open++;
+	local_inc(&self->blocked_open);
 
 	while (1) {
 		if (tty->termios->c_cflag & CBAUD) {
@@ -329,7 +329,7 @@
 		}
 
 		IRDA_DEBUG(1, "%s(%d):block_til_ready blocking on %s open_count=%d\n",
-		      __FILE__,__LINE__, tty->driver->name, self->open_count );
+		      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count) );
 
 		schedule();
 	}
@@ -340,13 +340,13 @@
 	if (extra_count) {
 		/* ++ is not atomic, so this should be protected - Jean II */
 		spin_lock_irqsave(&self->spinlock, flags);
-		self->open_count++;
+		local_inc(&self->open_count);
 		spin_unlock_irqrestore(&self->spinlock, flags);
 	}
-	self->blocked_open--;
+	local_dec(&self->blocked_open);
 
 	IRDA_DEBUG(1, "%s(%d):block_til_ready after blocking on %s open_count=%d\n",
-	      __FILE__,__LINE__, tty->driver->name, self->open_count);
+	      __FILE__,__LINE__, tty->driver->name, local_read(&self->open_count));
 
 	if (!retval)
 		self->flags |= ASYNC_NORMAL_ACTIVE;
@@ -415,14 +415,14 @@
 	}
 	/* ++ is not atomic, so this should be protected - Jean II */
 	spin_lock_irqsave(&self->spinlock, flags);
-	self->open_count++;
+	local_inc(&self->open_count);
 
 	tty->driver_data = self;
 	self->tty = tty;
 	spin_unlock_irqrestore(&self->spinlock, flags);
 
 	IRDA_DEBUG(1, "%s(), %s%d, count = %d\n", __func__ , tty->driver->name,
-		   self->line, self->open_count);
+		   self->line, local_read(&self->open_count));
 
 	/* Not really used by us, but lets do it anyway */
 	self->tty->low_latency = (self->flags & ASYNC_LOW_LATENCY) ? 1 : 0;
@@ -511,7 +511,7 @@
 		return;
 	}
 
-	if ((tty->count == 1) && (self->open_count != 1)) {
+	if ((tty->count == 1) && (local_read(&self->open_count) != 1)) {
 		/*
 		 * Uh, oh.  tty->count is 1, which means that the tty
 		 * structure will be freed.  state->count should always
@@ -521,16 +521,16 @@
 		 */
 		IRDA_DEBUG(0, "%s(), bad serial port count; "
 			   "tty->count is 1, state->count is %d\n", __func__ ,
-			   self->open_count);
-		self->open_count = 1;
+			   local_read(&self->open_count));
+		local_set(&self->open_count, 1);
 	}
 
-	if (--self->open_count < 0) {
+	if (local_dec_return(&self->open_count) < 0) {
 		IRDA_ERROR("%s(), bad serial port count for ttys%d: %d\n",
-			   __func__, self->line, self->open_count);
-		self->open_count = 0;
+			   __func__, self->line, local_read(&self->open_count));
+		local_set(&self->open_count, 0);
 	}
-	if (self->open_count) {
+	if (local_read(&self->open_count)) {
 		spin_unlock_irqrestore(&self->spinlock, flags);
 
 		IRDA_DEBUG(0, "%s(), open count > 0\n", __func__ );
@@ -562,7 +562,7 @@
 	tty->closing = 0;
 	self->tty = NULL;
 
-	if (self->blocked_open) {
+	if (local_read(&self->blocked_open)) {
 		if (self->close_delay)
 			schedule_timeout_interruptible(self->close_delay);
 		wake_up_interruptible(&self->open_wait);
@@ -1017,7 +1017,7 @@
 	spin_lock_irqsave(&self->spinlock, flags);
 	self->flags &= ~ASYNC_NORMAL_ACTIVE;
 	self->tty = NULL;
-	self->open_count = 0;
+	local_set(&self->open_count, 0);
 	spin_unlock_irqrestore(&self->spinlock, flags);
 
 	wake_up_interruptible(&self->open_wait);
@@ -1369,7 +1369,7 @@
 	seq_putc(m, '\n');
 
 	seq_printf(m, "Role: %s\n", self->client ? "client" : "server");
-	seq_printf(m, "Open count: %d\n", self->open_count);
+	seq_printf(m, "Open count: %d\n", local_read(&self->open_count));
 	seq_printf(m, "Max data size: %d\n", self->max_data_size);
 	seq_printf(m, "Max header size: %d\n", self->max_header_size);
 
diff -uriN linux-2.6.32.43/net/iucv/af_iucv.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/iucv/af_iucv.c
--- linux-2.6.32.43/net/iucv/af_iucv.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/iucv/af_iucv.c	2011-07-15 05:51:19.000000000 -0500
@@ -651,10 +651,10 @@
 
 	write_lock_bh(&iucv_sk_list.lock);
 
-	sprintf(name, "%08x", atomic_inc_return(&iucv_sk_list.autobind_name));
+	sprintf(name, "%08x", atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
 	while (__iucv_get_sock_by_name(name)) {
 		sprintf(name, "%08x",
-			atomic_inc_return(&iucv_sk_list.autobind_name));
+			atomic_inc_return_unchecked(&iucv_sk_list.autobind_name));
 	}
 
 	write_unlock_bh(&iucv_sk_list.lock);
diff -uriN linux-2.6.32.43/net/key/af_key.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/key/af_key.c
--- linux-2.6.32.43/net/key/af_key.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/key/af_key.c	2011-07-15 05:51:19.000000000 -0500
@@ -2489,6 +2489,8 @@
 	struct xfrm_migrate m[XFRM_MAX_DEPTH];
 	struct xfrm_kmaddress k;
 
+	pax_track_stack();
+
 	if (!present_and_same_family(ext_hdrs[SADB_EXT_ADDRESS_SRC - 1],
 				     ext_hdrs[SADB_EXT_ADDRESS_DST - 1]) ||
 	    !ext_hdrs[SADB_X_EXT_POLICY - 1]) {
@@ -3660,7 +3662,11 @@
 		seq_printf(f ,"sk       RefCnt Rmem   Wmem   User   Inode\n");
 	else
 		seq_printf(f ,"%p %-6d %-6u %-6u %-6u %-6lu\n",
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			       NULL,
+#else
 			       s,
+#endif
 			       atomic_read(&s->sk_refcnt),
 			       sk_rmem_alloc_get(s),
 			       sk_wmem_alloc_get(s),
diff -uriN linux-2.6.32.43/net/mac80211/cfg.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/cfg.c
--- linux-2.6.32.43/net/mac80211/cfg.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/cfg.c	2011-07-15 05:51:19.000000000 -0500
@@ -1369,7 +1369,7 @@
 	return err;
 }
 
-struct cfg80211_ops mac80211_config_ops = {
+const struct cfg80211_ops mac80211_config_ops = {
 	.add_virtual_intf = ieee80211_add_iface,
 	.del_virtual_intf = ieee80211_del_iface,
 	.change_virtual_intf = ieee80211_change_iface,
diff -uriN linux-2.6.32.43/net/mac80211/cfg.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/cfg.h
--- linux-2.6.32.43/net/mac80211/cfg.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/cfg.h	2011-07-15 05:51:19.000000000 -0500
@@ -4,6 +4,6 @@
 #ifndef __CFG_H
 #define __CFG_H
 
-extern struct cfg80211_ops mac80211_config_ops;
+extern const struct cfg80211_ops mac80211_config_ops;
 
 #endif /* __CFG_H */
diff -uriN linux-2.6.32.43/net/mac80211/debugfs_key.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/debugfs_key.c
--- linux-2.6.32.43/net/mac80211/debugfs_key.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/debugfs_key.c	2011-07-15 05:51:19.000000000 -0500
@@ -211,9 +211,13 @@
 			    size_t count, loff_t *ppos)
 {
 	struct ieee80211_key *key = file->private_data;
-	int i, res, bufsize = 2 * key->conf.keylen + 2;
+	int i, bufsize = 2 * key->conf.keylen + 2;
 	char *buf = kmalloc(bufsize, GFP_KERNEL);
 	char *p = buf;
+	ssize_t res;
+
+	if (buf == NULL)
+		return -ENOMEM;
 
 	for (i = 0; i < key->conf.keylen; i++)
 		p += scnprintf(p, bufsize + buf - p, "%02x", key->conf.key[i]);
diff -uriN linux-2.6.32.43/net/mac80211/debugfs_sta.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/debugfs_sta.c
--- linux-2.6.32.43/net/mac80211/debugfs_sta.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/debugfs_sta.c	2011-07-15 05:51:19.000000000 -0500
@@ -124,6 +124,8 @@
 	int i;
 	struct sta_info *sta = file->private_data;
 
+	pax_track_stack();
+
 	spin_lock_bh(&sta->lock);
 	p += scnprintf(p, sizeof(buf)+buf-p, "next dialog_token is %#02x\n",
 			sta->ampdu_mlme.dialog_token_allocator + 1);
diff -uriN linux-2.6.32.43/net/mac80211/ieee80211_i.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/ieee80211_i.h
--- linux-2.6.32.43/net/mac80211/ieee80211_i.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/ieee80211_i.h	2011-07-15 05:51:19.000000000 -0500
@@ -25,6 +25,7 @@
 #include <linux/etherdevice.h>
 #include <net/cfg80211.h>
 #include <net/mac80211.h>
+#include <asm/local.h>
 #include "key.h"
 #include "sta_info.h"
 
@@ -635,7 +636,7 @@
 	/* also used to protect ampdu_ac_queue and amdpu_ac_stop_refcnt */
 	spinlock_t queue_stop_reason_lock;
 
-	int open_count;
+	local_t open_count;
 	int monitors, cooked_mntrs;
 	/* number of interfaces with corresponding FIF_ flags */
 	int fif_fcsfail, fif_plcpfail, fif_control, fif_other_bss, fif_pspoll;
diff -uriN linux-2.6.32.43/net/mac80211/iface.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/iface.c
--- linux-2.6.32.43/net/mac80211/iface.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/iface.c	2011-07-15 05:51:19.000000000 -0500
@@ -166,7 +166,7 @@
 		break;
 	}
 
-	if (local->open_count == 0) {
+	if (local_read(&local->open_count) == 0) {
 		res = drv_start(local);
 		if (res)
 			goto err_del_bss;
@@ -196,7 +196,7 @@
 	 * Validate the MAC address for this device.
 	 */
 	if (!is_valid_ether_addr(dev->dev_addr)) {
-		if (!local->open_count)
+		if (!local_read(&local->open_count))
 			drv_stop(local);
 		return -EADDRNOTAVAIL;
 	}
@@ -292,7 +292,7 @@
 
 	hw_reconf_flags |= __ieee80211_recalc_idle(local);
 
-	local->open_count++;
+	local_inc(&local->open_count);
 	if (hw_reconf_flags) {
 		ieee80211_hw_config(local, hw_reconf_flags);
 		/*
@@ -320,7 +320,7 @@
  err_del_interface:
 	drv_remove_interface(local, &conf);
  err_stop:
-	if (!local->open_count)
+	if (!local_read(&local->open_count))
 		drv_stop(local);
  err_del_bss:
 	sdata->bss = NULL;
@@ -420,7 +420,7 @@
 		WARN_ON(!list_empty(&sdata->u.ap.vlans));
 	}
 
-	local->open_count--;
+	local_dec(&local->open_count);
 
 	switch (sdata->vif.type) {
 	case NL80211_IFTYPE_AP_VLAN:
@@ -526,7 +526,7 @@
 
 	ieee80211_recalc_ps(local, -1);
 
-	if (local->open_count == 0) {
+	if (local_read(&local->open_count) == 0) {
 		ieee80211_clear_tx_pending(local);
 		ieee80211_stop_device(local);
 
diff -uriN linux-2.6.32.43/net/mac80211/main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/main.c
--- linux-2.6.32.43/net/mac80211/main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/main.c	2011-07-15 05:51:19.000000000 -0500
@@ -145,7 +145,7 @@
 		local->hw.conf.power_level = power;
 	}
 
-	if (changed && local->open_count) {
+	if (changed && local_read(&local->open_count)) {
 		ret = drv_config(local, changed);
 		/*
 		 * Goal:
diff -uriN linux-2.6.32.43/net/mac80211/mlme.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/mlme.c
--- linux-2.6.32.43/net/mac80211/mlme.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/mlme.c	2011-07-15 05:51:19.000000000 -0500
@@ -1438,6 +1438,8 @@
 	bool have_higher_than_11mbit = false, newsta = false;
 	u16 ap_ht_cap_flags;
 
+	pax_track_stack();
+
 	/*
 	 * AssocResp and ReassocResp have identical structure, so process both
 	 * of them in this function.
diff -uriN linux-2.6.32.43/net/mac80211/pm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/pm.c
--- linux-2.6.32.43/net/mac80211/pm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/pm.c	2011-07-15 05:51:19.000000000 -0500
@@ -107,7 +107,7 @@
 	}
 
 	/* stop hardware - this must stop RX */
-	if (local->open_count)
+	if (local_read(&local->open_count))
 		ieee80211_stop_device(local);
 
 	local->suspended = true;
diff -uriN linux-2.6.32.43/net/mac80211/rate.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/rate.c
--- linux-2.6.32.43/net/mac80211/rate.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/rate.c	2011-07-15 05:51:19.000000000 -0500
@@ -287,7 +287,7 @@
 	struct rate_control_ref *ref, *old;
 
 	ASSERT_RTNL();
-	if (local->open_count)
+	if (local_read(&local->open_count))
 		return -EBUSY;
 
 	ref = rate_control_alloc(name, local);
diff -uriN linux-2.6.32.43/net/mac80211/tx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/tx.c
--- linux-2.6.32.43/net/mac80211/tx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/tx.c	2011-07-15 05:51:19.000000000 -0500
@@ -173,7 +173,7 @@
 	return cpu_to_le16(dur);
 }
 
-static int inline is_ieee80211_device(struct ieee80211_local *local,
+static inline int is_ieee80211_device(struct ieee80211_local *local,
 				      struct net_device *dev)
 {
 	return local == wdev_priv(dev->ieee80211_ptr);
diff -uriN linux-2.6.32.43/net/mac80211/util.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/util.c
--- linux-2.6.32.43/net/mac80211/util.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/mac80211/util.c	2011-07-15 05:51:19.000000000 -0500
@@ -1042,7 +1042,7 @@
 		local->resuming = true;
 
 	/* restart hardware */
-	if (local->open_count) {
+	if (local_read(&local->open_count)) {
 		/*
 		 * Upon resume hardware can sometimes be goofy due to
 		 * various platform / driver / bus issues, so restarting
diff -uriN linux-2.6.32.43/net/netfilter/ipvs/ip_vs_app.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_app.c
--- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_app.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_app.c	2011-07-15 05:51:19.000000000 -0500
@@ -564,7 +564,7 @@
 	.open	 = ip_vs_app_open,
 	.read	 = seq_read,
 	.llseek  = seq_lseek,
-	.release = seq_release,
+	.release = seq_release_net,
 };
 #endif
 
diff -uriN linux-2.6.32.43/net/netfilter/ipvs/ip_vs_conn.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_conn.c
--- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_conn.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_conn.c	2011-07-15 05:51:19.000000000 -0500
@@ -453,10 +453,10 @@
 		/* if the connection is not template and is created
 		 * by sync, preserve the activity flag.
 		 */
-		cp->flags |= atomic_read(&dest->conn_flags) &
+		cp->flags |= atomic_read_unchecked(&dest->conn_flags) &
 			     (~IP_VS_CONN_F_INACTIVE);
 	else
-		cp->flags |= atomic_read(&dest->conn_flags);
+		cp->flags |= atomic_read_unchecked(&dest->conn_flags);
 	cp->dest = dest;
 
 	IP_VS_DBG_BUF(7, "Bind-dest %s c:%s:%d v:%s:%d "
@@ -723,7 +723,7 @@
 	atomic_set(&cp->refcnt, 1);
 
 	atomic_set(&cp->n_control, 0);
-	atomic_set(&cp->in_pkts, 0);
+	atomic_set_unchecked(&cp->in_pkts, 0);
 
 	atomic_inc(&ip_vs_conn_count);
 	if (flags & IP_VS_CONN_F_NO_CPORT)
@@ -871,7 +871,7 @@
 	.open    = ip_vs_conn_open,
 	.read    = seq_read,
 	.llseek  = seq_lseek,
-	.release = seq_release,
+	.release = seq_release_net,
 };
 
 static const char *ip_vs_origin_name(unsigned flags)
@@ -934,7 +934,7 @@
 	.open    = ip_vs_conn_sync_open,
 	.read    = seq_read,
 	.llseek  = seq_lseek,
-	.release = seq_release,
+	.release = seq_release_net,
 };
 
 #endif
@@ -961,7 +961,7 @@
 
 	/* Don't drop the entry if its number of incoming packets is not
 	   located in [0, 8] */
-	i = atomic_read(&cp->in_pkts);
+	i = atomic_read_unchecked(&cp->in_pkts);
 	if (i > 8 || i < 0) return 0;
 
 	if (!todrop_rate[i]) return 0;
diff -uriN linux-2.6.32.43/net/netfilter/ipvs/ip_vs_core.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_core.c
--- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_core.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_core.c	2011-07-15 05:51:19.000000000 -0500
@@ -485,7 +485,7 @@
 		ret = cp->packet_xmit(skb, cp, pp);
 		/* do not touch skb anymore */
 
-		atomic_inc(&cp->in_pkts);
+		atomic_inc_unchecked(&cp->in_pkts);
 		ip_vs_conn_put(cp);
 		return ret;
 	}
@@ -1357,7 +1357,7 @@
 	 * Sync connection if it is about to close to
 	 * encorage the standby servers to update the connections timeout
 	 */
-	pkts = atomic_add_return(1, &cp->in_pkts);
+	pkts = atomic_add_return_unchecked(1, &cp->in_pkts);
 	if (af == AF_INET &&
 	    (ip_vs_sync_state & IP_VS_STATE_MASTER) &&
 	    (((cp->protocol != IPPROTO_TCP ||
diff -uriN linux-2.6.32.43/net/netfilter/ipvs/ip_vs_ctl.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_ctl.c
--- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_ctl.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_ctl.c	2011-07-15 05:51:19.000000000 -0500
@@ -792,7 +792,7 @@
 		ip_vs_rs_hash(dest);
 		write_unlock_bh(&__ip_vs_rs_lock);
 	}
-	atomic_set(&dest->conn_flags, conn_flags);
+	atomic_set_unchecked(&dest->conn_flags, conn_flags);
 
 	/* bind the service */
 	if (!dest->svc) {
@@ -1888,7 +1888,7 @@
 					   "      %-7s %-6d %-10d %-10d\n",
 					   &dest->addr.in6,
 					   ntohs(dest->port),
-					   ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
+					   ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
 					   atomic_read(&dest->weight),
 					   atomic_read(&dest->activeconns),
 					   atomic_read(&dest->inactconns));
@@ -1899,7 +1899,7 @@
 					   "%-7s %-6d %-10d %-10d\n",
 					   ntohl(dest->addr.ip),
 					   ntohs(dest->port),
-					   ip_vs_fwd_name(atomic_read(&dest->conn_flags)),
+					   ip_vs_fwd_name(atomic_read_unchecked(&dest->conn_flags)),
 					   atomic_read(&dest->weight),
 					   atomic_read(&dest->activeconns),
 					   atomic_read(&dest->inactconns));
@@ -1927,7 +1927,7 @@
 	.open    = ip_vs_info_open,
 	.read    = seq_read,
 	.llseek  = seq_lseek,
-	.release = seq_release_private,
+	.release = seq_release_net,
 };
 
 #endif
@@ -1976,7 +1976,7 @@
 	.open = ip_vs_stats_seq_open,
 	.read = seq_read,
 	.llseek = seq_lseek,
-	.release = single_release,
+	.release = single_release_net,
 };
 
 #endif
@@ -2292,7 +2292,7 @@
 
 			entry.addr = dest->addr.ip;
 			entry.port = dest->port;
-			entry.conn_flags = atomic_read(&dest->conn_flags);
+			entry.conn_flags = atomic_read_unchecked(&dest->conn_flags);
 			entry.weight = atomic_read(&dest->weight);
 			entry.u_threshold = dest->u_threshold;
 			entry.l_threshold = dest->l_threshold;
@@ -2353,6 +2353,8 @@
 	unsigned char arg[128];
 	int ret = 0;
 
+	pax_track_stack();
+
 	if (!capable(CAP_NET_ADMIN))
 		return -EPERM;
 
@@ -2802,7 +2804,7 @@
 	NLA_PUT_U16(skb, IPVS_DEST_ATTR_PORT, dest->port);
 
 	NLA_PUT_U32(skb, IPVS_DEST_ATTR_FWD_METHOD,
-		    atomic_read(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
+		    atomic_read_unchecked(&dest->conn_flags) & IP_VS_CONN_F_FWD_MASK);
 	NLA_PUT_U32(skb, IPVS_DEST_ATTR_WEIGHT, atomic_read(&dest->weight));
 	NLA_PUT_U32(skb, IPVS_DEST_ATTR_U_THRESH, dest->u_threshold);
 	NLA_PUT_U32(skb, IPVS_DEST_ATTR_L_THRESH, dest->l_threshold);
diff -uriN linux-2.6.32.43/net/netfilter/ipvs/ip_vs_sync.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_sync.c
--- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_sync.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_sync.c	2011-07-15 05:51:19.000000000 -0500
@@ -438,7 +438,7 @@
 
 		if (opt)
 			memcpy(&cp->in_seq, opt, sizeof(*opt));
-		atomic_set(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
+		atomic_set_unchecked(&cp->in_pkts, sysctl_ip_vs_sync_threshold[0]);
 		cp->state = state;
 		cp->old_state = cp->state;
 		/*
diff -uriN linux-2.6.32.43/net/netfilter/ipvs/ip_vs_xmit.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_xmit.c
--- linux-2.6.32.43/net/netfilter/ipvs/ip_vs_xmit.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/ipvs/ip_vs_xmit.c	2011-07-15 05:51:19.000000000 -0500
@@ -875,7 +875,7 @@
 		else
 			rc = NF_ACCEPT;
 		/* do not touch skb anymore */
-		atomic_inc(&cp->in_pkts);
+		atomic_inc_unchecked(&cp->in_pkts);
 		goto out;
 	}
 
@@ -949,7 +949,7 @@
 		else
 			rc = NF_ACCEPT;
 		/* do not touch skb anymore */
-		atomic_inc(&cp->in_pkts);
+		atomic_inc_unchecked(&cp->in_pkts);
 		goto out;
 	}
 
diff -uriN linux-2.6.32.43/net/netfilter/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/Kconfig
--- linux-2.6.32.43/net/netfilter/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/Kconfig	2011-07-15 05:51:19.000000000 -0500
@@ -635,6 +635,16 @@
 
 	  To compile it as a module, choose M here.  If unsure, say N.
 
+config NETFILTER_XT_MATCH_GRADM
+	tristate '"gradm" match support'
+	depends on NETFILTER_XTABLES && NETFILTER_ADVANCED
+	depends on GRKERNSEC && !GRKERNSEC_NO_RBAC
+	---help---
+	  The gradm match allows to match on grsecurity RBAC being enabled.
+	  It is useful when iptables rules are applied early on bootup to
+	  prevent connections to the machine (except from a trusted host)
+	  while the RBAC system is disabled.    
+
 config NETFILTER_XT_MATCH_HASHLIMIT
 	tristate '"hashlimit" match support'
 	depends on (IP6_NF_IPTABLES || IP6_NF_IPTABLES=n)
diff -uriN linux-2.6.32.43/net/netfilter/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/Makefile
--- linux-2.6.32.43/net/netfilter/Makefile	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/Makefile	2011-07-15 05:51:19.000000000 -0500
@@ -68,6 +68,7 @@
 obj-$(CONFIG_NETFILTER_XT_MATCH_DCCP) += xt_dccp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_DSCP) += xt_dscp.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_ESP) += xt_esp.o
+obj-$(CONFIG_NETFILTER_XT_MATCH_GRADM) += xt_gradm.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HASHLIMIT) += xt_hashlimit.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HELPER) += xt_helper.o
 obj-$(CONFIG_NETFILTER_XT_MATCH_HL) += xt_hl.o
diff -uriN linux-2.6.32.43/net/netfilter/nf_conntrack_netlink.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/nf_conntrack_netlink.c
--- linux-2.6.32.43/net/netfilter/nf_conntrack_netlink.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/nf_conntrack_netlink.c	2011-07-15 05:51:19.000000000 -0500
@@ -706,7 +706,7 @@
 static int
 ctnetlink_parse_tuple(const struct nlattr * const cda[],
 		      struct nf_conntrack_tuple *tuple,
-		      enum ctattr_tuple type, u_int8_t l3num)
+		      enum ctattr_type type, u_int8_t l3num)
 {
 	struct nlattr *tb[CTA_TUPLE_MAX+1];
 	int err;
diff -uriN linux-2.6.32.43/net/netfilter/nfnetlink_log.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/nfnetlink_log.c
--- linux-2.6.32.43/net/netfilter/nfnetlink_log.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/nfnetlink_log.c	2011-07-15 05:51:19.000000000 -0500
@@ -68,7 +68,7 @@
 };
 
 static DEFINE_RWLOCK(instances_lock);
-static atomic_t global_seq;
+static atomic_unchecked_t global_seq;
 
 #define INSTANCE_BUCKETS	16
 static struct hlist_head instance_table[INSTANCE_BUCKETS];
@@ -493,7 +493,7 @@
 	/* global sequence number */
 	if (inst->flags & NFULNL_CFG_F_SEQ_GLOBAL)
 		NLA_PUT_BE32(inst->skb, NFULA_SEQ_GLOBAL,
-			     htonl(atomic_inc_return(&global_seq)));
+			     htonl(atomic_inc_return_unchecked(&global_seq)));
 
 	if (data_len) {
 		struct nlattr *nla;
diff -uriN linux-2.6.32.43/net/netfilter/xt_gradm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/xt_gradm.c
--- linux-2.6.32.43/net/netfilter/xt_gradm.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netfilter/xt_gradm.c	2011-07-15 05:51:19.000000000 -0500
@@ -0,0 +1,51 @@
+/*
+ *	gradm match for netfilter
+ *	Copyright © Zbigniew Krzystolik, 2010
+ *
+ *	This program is free software; you can redistribute it and/or modify
+ *	it under the terms of the GNU General Public License; either version
+ *	2 or 3 as published by the Free Software Foundation.
+ */
+#include <linux/module.h>
+#include <linux/moduleparam.h>
+#include <linux/skbuff.h>
+#include <linux/netfilter/x_tables.h>
+#include <linux/grsecurity.h>
+#include <linux/netfilter/xt_gradm.h>
+
+static bool
+gradm_mt(const struct sk_buff *skb, const struct xt_match_param *par)
+{
+	const struct xt_gradm_mtinfo *info = par->matchinfo;
+	bool retval = false;
+	if (gr_acl_is_enabled())
+		retval = true;
+	return retval ^ info->invflags;
+}
+
+static struct xt_match gradm_mt_reg __read_mostly = {
+		.name       = "gradm",
+		.revision   = 0,
+		.family     = NFPROTO_UNSPEC,
+		.match      = gradm_mt,
+		.matchsize  = XT_ALIGN(sizeof(struct xt_gradm_mtinfo)),
+		.me         = THIS_MODULE,
+};
+
+static int __init gradm_mt_init(void)
+{       
+	        return xt_register_match(&gradm_mt_reg);
+}
+
+static void __exit gradm_mt_exit(void)
+{       
+	        xt_unregister_match(&gradm_mt_reg);
+}
+
+module_init(gradm_mt_init);
+module_exit(gradm_mt_exit);
+MODULE_AUTHOR("Zbigniew Krzystolik <zbyniu@destrukcja.pl>");
+MODULE_DESCRIPTION("Xtables: Grsecurity RBAC match");
+MODULE_LICENSE("GPL");
+MODULE_ALIAS("ipt_gradm");
+MODULE_ALIAS("ip6t_gradm");
diff -uriN linux-2.6.32.43/net/netlink/af_netlink.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netlink/af_netlink.c
--- linux-2.6.32.43/net/netlink/af_netlink.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netlink/af_netlink.c	2011-07-15 05:51:19.000000000 -0500
@@ -55,6 +55,9 @@
 #include <linux/types.h>
 #include <linux/audit.h>
 #include <linux/mutex.h>
+#include <linux/vs_context.h>
+#include <linux/vs_network.h>
+#include <linux/vs_limit.h>
 
 #include <net/net_namespace.h>
 #include <net/sock.h>
@@ -733,7 +736,7 @@
 			sk->sk_error_report(sk);
 		}
 	}
-	atomic_inc(&sk->sk_drops);
+	atomic_inc_unchecked(&sk->sk_drops);
 }
 
 static struct sock *netlink_getsockbypid(struct sock *ssk, u32 pid)
@@ -1885,6 +1888,8 @@
 			sk_for_each(s, node, &hash->table[j]) {
 				if (sock_net(s) != seq_file_net(seq))
 					continue;
+				if (!nx_check(s->sk_nid, VS_WATCH_P | VS_IDENT))
+					continue;
 				if (off == pos) {
 					iter->link = i;
 					iter->hash_idx = j;
@@ -1919,7 +1924,8 @@
 	s = v;
 	do {
 		s = sk_next(s);
-	} while (s && sock_net(s) != seq_file_net(seq));
+	} while (s && (sock_net(s) != seq_file_net(seq) ||
+		!nx_check(s->sk_nid, VS_WATCH_P | VS_IDENT)));
 	if (s)
 		return s;
 
@@ -1931,7 +1937,8 @@
 
 		for (; j <= hash->mask; j++) {
 			s = sk_head(&hash->table[j]);
-			while (s && sock_net(s) != seq_file_net(seq))
+			while (s && (sock_net(s) != seq_file_net(seq) ||
+				!nx_check(s->sk_nid, VS_WATCH_P | VS_IDENT)))
 				s = sk_next(s);
 			if (s) {
 				iter->link = i;
@@ -1964,15 +1971,23 @@
 		struct netlink_sock *nlk = nlk_sk(s);
 
 		seq_printf(seq, "%p %-3d %-6d %08x %-8d %-8d %p %-8d %-8d\n",
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			   NULL,
+#else
 			   s,
+#endif
 			   s->sk_protocol,
 			   nlk->pid,
 			   nlk->groups ? (u32)nlk->groups[0] : 0,
 			   sk_rmem_alloc_get(s),
 			   sk_wmem_alloc_get(s),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			   NULL,
+#else
 			   nlk->cb,
+#endif
 			   atomic_read(&s->sk_refcnt),
-			   atomic_read(&s->sk_drops)
+			   atomic_read_unchecked(&s->sk_drops)
 			);
 
 	}
diff -uriN linux-2.6.32.43/net/netrom/af_netrom.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netrom/af_netrom.c
--- linux-2.6.32.43/net/netrom/af_netrom.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/netrom/af_netrom.c	2011-07-15 05:51:19.000000000 -0500
@@ -838,6 +838,7 @@
 	struct sock *sk = sock->sk;
 	struct nr_sock *nr = nr_sk(sk);
 
+	memset(sax, 0, sizeof(*sax));
 	lock_sock(sk);
 	if (peer != 0) {
 		if (sk->sk_state != TCP_ESTABLISHED) {
@@ -852,7 +853,6 @@
 		*uaddr_len = sizeof(struct full_sockaddr_ax25);
 	} else {
 		sax->fsa_ax25.sax25_family = AF_NETROM;
-		sax->fsa_ax25.sax25_ndigis = 0;
 		sax->fsa_ax25.sax25_call   = nr->source_addr;
 		*uaddr_len = sizeof(struct sockaddr_ax25);
 	}
diff -uriN linux-2.6.32.43/net/packet/af_packet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/packet/af_packet.c
--- linux-2.6.32.43/net/packet/af_packet.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/packet/af_packet.c	2011-07-15 05:51:19.000000000 -0500
@@ -2429,7 +2429,11 @@
 
 		seq_printf(seq,
 			   "%p %-6d %-4d %04x   %-5d %1d %-6u %-6u %-6lu\n",
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			   NULL,
+#else
 			   s,
+#endif
 			   atomic_read(&s->sk_refcnt),
 			   s->sk_type,
 			   ntohs(po->num),
diff -uriN linux-2.6.32.43/net/phonet/af_phonet.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/phonet/af_phonet.c
--- linux-2.6.32.43/net/phonet/af_phonet.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/phonet/af_phonet.c	2011-07-15 05:51:19.000000000 -0500
@@ -41,7 +41,7 @@
 {
 	struct phonet_protocol *pp;
 
-	if (protocol >= PHONET_NPROTO)
+	if (protocol < 0 || protocol >= PHONET_NPROTO)
 		return NULL;
 
 	spin_lock(&proto_tab_lock);
@@ -402,7 +402,7 @@
 {
 	int err = 0;
 
-	if (protocol >= PHONET_NPROTO)
+	if (protocol < 0 || protocol >= PHONET_NPROTO)
 		return -EINVAL;
 
 	err = proto_register(pp->prot, 1);
diff -uriN linux-2.6.32.43/net/phonet/datagram.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/phonet/datagram.c
--- linux-2.6.32.43/net/phonet/datagram.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/phonet/datagram.c	2011-07-15 05:51:19.000000000 -0500
@@ -162,7 +162,7 @@
 	if (err < 0) {
 		kfree_skb(skb);
 		if (err == -ENOMEM)
-			atomic_inc(&sk->sk_drops);
+			atomic_inc_unchecked(&sk->sk_drops);
 	}
 	return err ? NET_RX_DROP : NET_RX_SUCCESS;
 }
diff -uriN linux-2.6.32.43/net/phonet/pep.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/phonet/pep.c
--- linux-2.6.32.43/net/phonet/pep.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/phonet/pep.c	2011-07-15 05:51:19.000000000 -0500
@@ -348,7 +348,7 @@
 
 	case PNS_PEP_CTRL_REQ:
 		if (skb_queue_len(&pn->ctrlreq_queue) >= PNPIPE_CTRLREQ_MAX) {
-			atomic_inc(&sk->sk_drops);
+			atomic_inc_unchecked(&sk->sk_drops);
 			break;
 		}
 		__skb_pull(skb, 4);
@@ -362,12 +362,12 @@
 			if (!err)
 				return 0;
 			if (err == -ENOMEM)
-				atomic_inc(&sk->sk_drops);
+				atomic_inc_unchecked(&sk->sk_drops);
 			break;
 		}
 
 		if (pn->rx_credits == 0) {
-			atomic_inc(&sk->sk_drops);
+			atomic_inc_unchecked(&sk->sk_drops);
 			err = -ENOBUFS;
 			break;
 		}
diff -uriN linux-2.6.32.43/net/phonet/socket.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/phonet/socket.c
--- linux-2.6.32.43/net/phonet/socket.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/phonet/socket.c	2011-07-15 05:51:19.000000000 -0500
@@ -482,8 +482,13 @@
 			sk->sk_state,
 			sk_wmem_alloc_get(sk), sk_rmem_alloc_get(sk),
 			sock_i_uid(sk), sock_i_ino(sk),
-			atomic_read(&sk->sk_refcnt), sk,
-			atomic_read(&sk->sk_drops), &len);
+			atomic_read(&sk->sk_refcnt),
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			NULL,
+#else
+			sk,
+#endif
+			atomic_read_unchecked(&sk->sk_drops), &len);
 	}
 	seq_printf(seq, "%*s\n", 127 - len, "");
 	return 0;
diff -uriN linux-2.6.32.43/net/rds/cong.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rds/cong.c
--- linux-2.6.32.43/net/rds/cong.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rds/cong.c	2011-07-15 05:51:19.000000000 -0500
@@ -77,7 +77,7 @@
  * finds that the saved generation number is smaller than the global generation
  * number, it wakes up the process.
  */
-static atomic_t		rds_cong_generation = ATOMIC_INIT(0);
+static atomic_unchecked_t		rds_cong_generation = ATOMIC_INIT(0);
 
 /*
  * Congestion monitoring
@@ -232,7 +232,7 @@
 	rdsdebug("waking map %p for %pI4\n",
 	  map, &map->m_addr);
 	rds_stats_inc(s_cong_update_received);
-	atomic_inc(&rds_cong_generation);
+	atomic_inc_unchecked(&rds_cong_generation);
 	if (waitqueue_active(&map->m_waitq))
 		wake_up(&map->m_waitq);
 	if (waitqueue_active(&rds_poll_waitq))
@@ -258,7 +258,7 @@
 
 int rds_cong_updated_since(unsigned long *recent)
 {
-	unsigned long gen = atomic_read(&rds_cong_generation);
+	unsigned long gen = atomic_read_unchecked(&rds_cong_generation);
 
 	if (likely(*recent == gen))
 		return 0;
diff -uriN linux-2.6.32.43/net/rds/iw_rdma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rds/iw_rdma.c
--- linux-2.6.32.43/net/rds/iw_rdma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rds/iw_rdma.c	2011-07-15 05:51:19.000000000 -0500
@@ -181,6 +181,8 @@
 	struct rdma_cm_id *pcm_id;
 	int rc;
 
+	pax_track_stack();
+
 	src_addr = (struct sockaddr_in *)&cm_id->route.addr.src_addr;
 	dst_addr = (struct sockaddr_in *)&cm_id->route.addr.dst_addr;
 
diff -uriN linux-2.6.32.43/net/rds/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rds/Kconfig
--- linux-2.6.32.43/net/rds/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rds/Kconfig	2011-07-15 05:51:19.000000000 -0500
@@ -1,7 +1,7 @@
 
 config RDS
 	tristate "The RDS Protocol (EXPERIMENTAL)"
-	depends on INET && EXPERIMENTAL
+	depends on INET && EXPERIMENTAL && BROKEN
 	---help---
 	  The RDS (Reliable Datagram Sockets) protocol provides reliable,
 	  sequenced delivery of datagrams over Infiniband, iWARP,
diff -uriN linux-2.6.32.43/net/rxrpc/af_rxrpc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/af_rxrpc.c
--- linux-2.6.32.43/net/rxrpc/af_rxrpc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/af_rxrpc.c	2011-07-15 05:51:19.000000000 -0500
@@ -38,7 +38,7 @@
 __be32 rxrpc_epoch;
 
 /* current debugging ID */
-atomic_t rxrpc_debug_id;
+atomic_unchecked_t rxrpc_debug_id;
 
 /* count of skbs currently in use */
 atomic_t rxrpc_n_skbs;
diff -uriN linux-2.6.32.43/net/rxrpc/ar-ack.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-ack.c
--- linux-2.6.32.43/net/rxrpc/ar-ack.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-ack.c	2011-07-15 05:51:19.000000000 -0500
@@ -174,7 +174,7 @@
 
 	_enter("{%d,%d,%d,%d},",
 	       call->acks_hard, call->acks_unacked,
-	       atomic_read(&call->sequence),
+	       atomic_read_unchecked(&call->sequence),
 	       CIRC_CNT(call->acks_head, call->acks_tail, call->acks_winsz));
 
 	stop = 0;
@@ -198,7 +198,7 @@
 
 			/* each Tx packet has a new serial number */
 			sp->hdr.serial =
-				htonl(atomic_inc_return(&call->conn->serial));
+				htonl(atomic_inc_return_unchecked(&call->conn->serial));
 
 			hdr = (struct rxrpc_header *) txb->head;
 			hdr->serial = sp->hdr.serial;
@@ -401,7 +401,7 @@
  */
 static void rxrpc_clear_tx_window(struct rxrpc_call *call)
 {
-	rxrpc_rotate_tx_window(call, atomic_read(&call->sequence));
+	rxrpc_rotate_tx_window(call, atomic_read_unchecked(&call->sequence));
 }
 
 /*
@@ -627,7 +627,7 @@
 
 		latest = ntohl(sp->hdr.serial);
 		hard = ntohl(ack.firstPacket);
-		tx = atomic_read(&call->sequence);
+		tx = atomic_read_unchecked(&call->sequence);
 
 		_proto("Rx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
 		       latest,
@@ -840,6 +840,8 @@
 	u32 abort_code = RX_PROTOCOL_ERROR;
 	u8 *acks = NULL;
 
+	pax_track_stack();
+
 	//printk("\n--------------------\n");
 	_enter("{%d,%s,%lx} [%lu]",
 	       call->debug_id, rxrpc_call_states[call->state], call->events,
@@ -1159,7 +1161,7 @@
 	goto maybe_reschedule;
 
 send_ACK_with_skew:
-	ack.maxSkew = htons(atomic_read(&call->conn->hi_serial) -
+	ack.maxSkew = htons(atomic_read_unchecked(&call->conn->hi_serial) -
 			    ntohl(ack.serial));
 send_ACK:
 	mtu = call->conn->trans->peer->if_mtu;
@@ -1171,7 +1173,7 @@
 	ackinfo.rxMTU	= htonl(5692);
 	ackinfo.jumbo_max = htonl(4);
 
-	hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
+	hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
 	_proto("Tx ACK %%%u { m=%hu f=#%u p=#%u s=%%%u r=%s n=%u }",
 	       ntohl(hdr.serial),
 	       ntohs(ack.maxSkew),
@@ -1189,7 +1191,7 @@
 send_message:
 	_debug("send message");
 
-	hdr.serial = htonl(atomic_inc_return(&call->conn->serial));
+	hdr.serial = htonl(atomic_inc_return_unchecked(&call->conn->serial));
 	_proto("Tx %s %%%u", rxrpc_pkts[hdr.type], ntohl(hdr.serial));
 send_message_2:
 
diff -uriN linux-2.6.32.43/net/rxrpc/ar-call.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-call.c
--- linux-2.6.32.43/net/rxrpc/ar-call.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-call.c	2011-07-15 05:51:19.000000000 -0500
@@ -82,7 +82,7 @@
 	spin_lock_init(&call->lock);
 	rwlock_init(&call->state_lock);
 	atomic_set(&call->usage, 1);
-	call->debug_id = atomic_inc_return(&rxrpc_debug_id);
+	call->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
 	call->state = RXRPC_CALL_CLIENT_SEND_REQUEST;
 
 	memset(&call->sock_node, 0xed, sizeof(call->sock_node));
diff -uriN linux-2.6.32.43/net/rxrpc/ar-connection.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-connection.c
--- linux-2.6.32.43/net/rxrpc/ar-connection.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-connection.c	2011-07-15 05:51:19.000000000 -0500
@@ -205,7 +205,7 @@
 		rwlock_init(&conn->lock);
 		spin_lock_init(&conn->state_lock);
 		atomic_set(&conn->usage, 1);
-		conn->debug_id = atomic_inc_return(&rxrpc_debug_id);
+		conn->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
 		conn->avail_calls = RXRPC_MAXCALLS;
 		conn->size_align = 4;
 		conn->header_size = sizeof(struct rxrpc_header);
diff -uriN linux-2.6.32.43/net/rxrpc/ar-connevent.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-connevent.c
--- linux-2.6.32.43/net/rxrpc/ar-connevent.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-connevent.c	2011-07-15 05:51:19.000000000 -0500
@@ -109,7 +109,7 @@
 
 	len = iov[0].iov_len + iov[1].iov_len;
 
-	hdr.serial = htonl(atomic_inc_return(&conn->serial));
+	hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
 	_proto("Tx CONN ABORT %%%u { %d }", ntohl(hdr.serial), abort_code);
 
 	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
diff -uriN linux-2.6.32.43/net/rxrpc/ar-input.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-input.c
--- linux-2.6.32.43/net/rxrpc/ar-input.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-input.c	2011-07-15 05:51:19.000000000 -0500
@@ -339,9 +339,9 @@
 	/* track the latest serial number on this connection for ACK packet
 	 * information */
 	serial = ntohl(sp->hdr.serial);
-	hi_serial = atomic_read(&call->conn->hi_serial);
+	hi_serial = atomic_read_unchecked(&call->conn->hi_serial);
 	while (serial > hi_serial)
-		hi_serial = atomic_cmpxchg(&call->conn->hi_serial, hi_serial,
+		hi_serial = atomic_cmpxchg_unchecked(&call->conn->hi_serial, hi_serial,
 					   serial);
 
 	/* request ACK generation for any ACK or DATA packet that requests
diff -uriN linux-2.6.32.43/net/rxrpc/ar-internal.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-internal.h
--- linux-2.6.32.43/net/rxrpc/ar-internal.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-internal.h	2011-07-15 05:51:19.000000000 -0500
@@ -272,8 +272,8 @@
 	int			error;		/* error code for local abort */
 	int			debug_id;	/* debug ID for printks */
 	unsigned		call_counter;	/* call ID counter */
-	atomic_t		serial;		/* packet serial number counter */
-	atomic_t		hi_serial;	/* highest serial number received */
+	atomic_unchecked_t	serial;		/* packet serial number counter */
+	atomic_unchecked_t	hi_serial;	/* highest serial number received */
 	u8			avail_calls;	/* number of calls available */
 	u8			size_align;	/* data size alignment (for security) */
 	u8			header_size;	/* rxrpc + security header size */
@@ -346,7 +346,7 @@
 	spinlock_t		lock;
 	rwlock_t		state_lock;	/* lock for state transition */
 	atomic_t		usage;
-	atomic_t		sequence;	/* Tx data packet sequence counter */
+	atomic_unchecked_t	sequence;	/* Tx data packet sequence counter */
 	u32			abort_code;	/* local/remote abort code */
 	enum {					/* current state of call */
 		RXRPC_CALL_CLIENT_SEND_REQUEST,	/* - client sending request phase */
@@ -420,7 +420,7 @@
  */
 extern atomic_t rxrpc_n_skbs;
 extern __be32 rxrpc_epoch;
-extern atomic_t rxrpc_debug_id;
+extern atomic_unchecked_t rxrpc_debug_id;
 extern struct workqueue_struct *rxrpc_workqueue;
 
 /*
diff -uriN linux-2.6.32.43/net/rxrpc/ar-key.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-key.c
--- linux-2.6.32.43/net/rxrpc/ar-key.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-key.c	2011-07-15 05:51:19.000000000 -0500
@@ -88,11 +88,11 @@
 		return ret;
 
 	plen -= sizeof(*token);
-	token = kmalloc(sizeof(*token), GFP_KERNEL);
+	token = kzalloc(sizeof(*token), GFP_KERNEL);
 	if (!token)
 		return -ENOMEM;
 
-	token->kad = kmalloc(plen, GFP_KERNEL);
+	token->kad = kzalloc(plen, GFP_KERNEL);
 	if (!token->kad) {
 		kfree(token);
 		return -ENOMEM;
@@ -730,10 +730,10 @@
 		goto error;
 
 	ret = -ENOMEM;
-	token = kmalloc(sizeof(*token), GFP_KERNEL);
+	token = kzalloc(sizeof(*token), GFP_KERNEL);
 	if (!token)
 		goto error;
-	token->kad = kmalloc(plen, GFP_KERNEL);
+	token->kad = kzalloc(plen, GFP_KERNEL);
 	if (!token->kad)
 		goto error_free;
 
diff -uriN linux-2.6.32.43/net/rxrpc/ar-local.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-local.c
--- linux-2.6.32.43/net/rxrpc/ar-local.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-local.c	2011-07-15 05:51:19.000000000 -0500
@@ -44,7 +44,7 @@
 		spin_lock_init(&local->lock);
 		rwlock_init(&local->services_lock);
 		atomic_set(&local->usage, 1);
-		local->debug_id = atomic_inc_return(&rxrpc_debug_id);
+		local->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
 		memcpy(&local->srx, srx, sizeof(*srx));
 	}
 
diff -uriN linux-2.6.32.43/net/rxrpc/ar-output.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-output.c
--- linux-2.6.32.43/net/rxrpc/ar-output.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-output.c	2011-07-15 05:51:19.000000000 -0500
@@ -680,9 +680,9 @@
 			sp->hdr.cid = call->cid;
 			sp->hdr.callNumber = call->call_id;
 			sp->hdr.seq =
-				htonl(atomic_inc_return(&call->sequence));
+				htonl(atomic_inc_return_unchecked(&call->sequence));
 			sp->hdr.serial =
-				htonl(atomic_inc_return(&conn->serial));
+				htonl(atomic_inc_return_unchecked(&conn->serial));
 			sp->hdr.type = RXRPC_PACKET_TYPE_DATA;
 			sp->hdr.userStatus = 0;
 			sp->hdr.securityIndex = conn->security_ix;
diff -uriN linux-2.6.32.43/net/rxrpc/ar-peer.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-peer.c
--- linux-2.6.32.43/net/rxrpc/ar-peer.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-peer.c	2011-07-15 05:51:19.000000000 -0500
@@ -86,7 +86,7 @@
 		INIT_LIST_HEAD(&peer->error_targets);
 		spin_lock_init(&peer->lock);
 		atomic_set(&peer->usage, 1);
-		peer->debug_id = atomic_inc_return(&rxrpc_debug_id);
+		peer->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
 		memcpy(&peer->srx, srx, sizeof(*srx));
 
 		rxrpc_assess_MTU_size(peer);
diff -uriN linux-2.6.32.43/net/rxrpc/ar-proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-proc.c
--- linux-2.6.32.43/net/rxrpc/ar-proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-proc.c	2011-07-15 05:51:19.000000000 -0500
@@ -164,8 +164,8 @@
 		   atomic_read(&conn->usage),
 		   rxrpc_conn_states[conn->state],
 		   key_serial(conn->key),
-		   atomic_read(&conn->serial),
-		   atomic_read(&conn->hi_serial));
+		   atomic_read_unchecked(&conn->serial),
+		   atomic_read_unchecked(&conn->hi_serial));
 
 	return 0;
 }
diff -uriN linux-2.6.32.43/net/rxrpc/ar-transport.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-transport.c
--- linux-2.6.32.43/net/rxrpc/ar-transport.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/ar-transport.c	2011-07-15 05:51:19.000000000 -0500
@@ -46,7 +46,7 @@
 		spin_lock_init(&trans->client_lock);
 		rwlock_init(&trans->conn_lock);
 		atomic_set(&trans->usage, 1);
-		trans->debug_id = atomic_inc_return(&rxrpc_debug_id);
+		trans->debug_id = atomic_inc_return_unchecked(&rxrpc_debug_id);
 
 		if (peer->srx.transport.family == AF_INET) {
 			switch (peer->srx.transport_type) {
diff -uriN linux-2.6.32.43/net/rxrpc/rxkad.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/rxkad.c
--- linux-2.6.32.43/net/rxrpc/rxkad.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/rxrpc/rxkad.c	2011-07-15 05:51:19.000000000 -0500
@@ -210,6 +210,8 @@
 	u16 check;
 	int nsg;
 
+	pax_track_stack();
+
 	sp = rxrpc_skb(skb);
 
 	_enter("");
@@ -337,6 +339,8 @@
 	u16 check;
 	int nsg;
 
+	pax_track_stack();
+
 	_enter("");
 
 	sp = rxrpc_skb(skb);
@@ -609,7 +613,7 @@
 
 	len = iov[0].iov_len + iov[1].iov_len;
 
-	hdr.serial = htonl(atomic_inc_return(&conn->serial));
+	hdr.serial = htonl(atomic_inc_return_unchecked(&conn->serial));
 	_proto("Tx CHALLENGE %%%u", ntohl(hdr.serial));
 
 	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 2, len);
@@ -659,7 +663,7 @@
 
 	len = iov[0].iov_len + iov[1].iov_len + iov[2].iov_len;
 
-	hdr->serial = htonl(atomic_inc_return(&conn->serial));
+	hdr->serial = htonl(atomic_inc_return_unchecked(&conn->serial));
 	_proto("Tx RESPONSE %%%u", ntohl(hdr->serial));
 
 	ret = kernel_sendmsg(conn->trans->local->socket, &msg, iov, 3, len);
diff -uriN linux-2.6.32.43/net/sctp/ipv6.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sctp/ipv6.c
--- linux-2.6.32.43/net/sctp/ipv6.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sctp/ipv6.c	2011-07-15 05:50:11.000000000 -0500
@@ -316,7 +316,8 @@
 				   dst ? ip6_dst_idev(dst)->dev : NULL,
 				   &daddr->v6.sin6_addr,
 				   inet6_sk(&sk->inet.sk)->srcprefs,
-				   &saddr->v6.sin6_addr);
+				   &saddr->v6.sin6_addr,
+				   asoc->base.sk->sk_nx_info);
 		SCTP_DEBUG_PRINTK("saddr from ipv6_get_saddr: %pI6\n",
 				  &saddr->v6.sin6_addr);
 		return;
diff -uriN linux-2.6.32.43/net/sctp/proc.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sctp/proc.c
--- linux-2.6.32.43/net/sctp/proc.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sctp/proc.c	2011-07-15 05:51:19.000000000 -0500
@@ -213,7 +213,12 @@
 	sctp_for_each_hentry(epb, node, &head->chain) {
 		ep = sctp_ep(epb);
 		sk = epb->sk;
-		seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ", ep, sk,
+		seq_printf(seq, "%8p %8p %-3d %-3d %-4d %-5d %5d %5lu ",
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			   NULL, NULL,
+#else
+			   ep, sk,
+#endif
 			   sctp_sk(sk)->type, sk->sk_state, hash,
 			   epb->bind_addr.port,
 			   sock_i_uid(sk), sock_i_ino(sk));
@@ -320,7 +325,12 @@
 		seq_printf(seq,
 			   "%8p %8p %-3d %-3d %-2d %-4d "
 			   "%4d %8d %8d %7d %5lu %-5d %5d ",
-			   assoc, sk, sctp_sk(sk)->type, sk->sk_state,
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			   NULL, NULL,
+#else
+			   assoc, sk,
+#endif
+			   sctp_sk(sk)->type, sk->sk_state,
 			   assoc->state, hash,
 			   assoc->assoc_id,
 			   assoc->sndbuf_used,
diff -uriN linux-2.6.32.43/net/sctp/socket.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sctp/socket.c
--- linux-2.6.32.43/net/sctp/socket.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sctp/socket.c	2011-07-15 05:51:19.000000000 -0500
@@ -5802,7 +5802,6 @@
 		 */
 		int reuse = sk->sk_reuse;
 		struct sock *sk2;
-		struct hlist_node *node;
 
 		SCTP_DEBUG_PRINTK("sctp_get_port() found a possible match\n");
 		if (pp->fastreuse && sk->sk_reuse &&
diff -uriN linux-2.6.32.43/net/socket.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/socket.c
--- linux-2.6.32.43/net/socket.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/socket.c	2011-07-15 05:51:19.000000000 -0500
@@ -87,6 +87,7 @@
 #include <linux/wireless.h>
 #include <linux/nsproxy.h>
 #include <linux/magic.h>
+#include <linux/in.h>
 
 #include <asm/uaccess.h>
 #include <asm/unistd.h>
@@ -96,6 +97,25 @@
 
 #include <net/sock.h>
 #include <linux/netfilter.h>
+#include <linux/vs_base.h>
+#include <linux/vs_socket.h>
+#include <linux/vs_inet.h>
+#include <linux/vs_inet6.h>
+
+extern void gr_attach_curr_ip(const struct sock *sk);
+extern int gr_handle_sock_all(const int family, const int type,
+			      const int protocol);
+extern int gr_handle_sock_server(const struct sockaddr *sck);
+extern int gr_handle_sock_server_other(const struct sock *sck);
+extern int gr_handle_sock_client(const struct sockaddr *sck);
+extern int gr_search_connect(struct socket * sock,
+			     struct sockaddr_in * addr);
+extern int gr_search_bind(struct socket * sock,
+			  struct sockaddr_in * addr);
+extern int gr_search_listen(struct socket * sock);
+extern int gr_search_accept(struct socket * sock);
+extern int gr_search_socket(const int domain, const int type,
+			    const int protocol);
 
 static int sock_no_open(struct inode *irrelevant, struct file *dontcare);
 static ssize_t sock_aio_read(struct kiocb *iocb, const struct iovec *iov,
@@ -298,7 +318,7 @@
 			     mnt);
 }
 
-static struct vfsmount *sock_mnt __read_mostly;
+struct vfsmount *sock_mnt __read_mostly;
 
 static struct file_system_type sock_fs_type = {
 	.name =		"sockfs",
@@ -559,7 +579,7 @@
 				 struct msghdr *msg, size_t size)
 {
 	struct sock_iocb *si = kiocb_to_siocb(iocb);
-	int err;
+	int err, len;
 
 	si->sock = sock;
 	si->scm = NULL;
@@ -570,7 +590,22 @@
 	if (err)
 		return err;
 
-	return sock->ops->sendmsg(iocb, sock, msg, size);
+	len = sock->ops->sendmsg(iocb, sock, msg, size);
+	if (sock->sk) {
+		if (len == size)
+			vx_sock_send(sock->sk, size);
+		else
+			vx_sock_fail(sock->sk, size);
+	}
+	vxdprintk(VXD_CBIT(net, 7),
+		"__sock_sendmsg: %p[%p,%p,%p;%d/%d]:%d/%d",
+		sock, sock->sk,
+		(sock->sk)?sock->sk->sk_nx_info:0,
+		(sock->sk)?sock->sk->sk_vx_info:0,
+		(sock->sk)?sock->sk->sk_xid:0,
+		(sock->sk)?sock->sk->sk_nid:0,
+		(unsigned int)size, len);
+	return len;
 }
 
 int sock_sendmsg(struct socket *sock, struct msghdr *msg, size_t size)
@@ -671,7 +706,7 @@
 static inline int __sock_recvmsg(struct kiocb *iocb, struct socket *sock,
 				 struct msghdr *msg, size_t size, int flags)
 {
-	int err;
+	int err, len;
 	struct sock_iocb *si = kiocb_to_siocb(iocb);
 
 	si->sock = sock;
@@ -684,7 +719,18 @@
 	if (err)
 		return err;
 
-	return sock->ops->recvmsg(iocb, sock, msg, size, flags);
+	len = sock->ops->recvmsg(iocb, sock, msg, size, flags);
+	if ((len >= 0) && sock->sk)
+		vx_sock_recv(sock->sk, len);
+	vxdprintk(VXD_CBIT(net, 7),
+		"__sock_recvmsg: %p[%p,%p,%p;%d/%d]:%d/%d",
+		sock, sock->sk,
+		(sock->sk)?sock->sk->sk_nx_info:0,
+		(sock->sk)?sock->sk->sk_vx_info:0,
+		(sock->sk)?sock->sk->sk_xid:0,
+		(sock->sk)?sock->sk->sk_nid:0,
+		(unsigned int)size, len);
+	return len;
 }
 
 int sock_recvmsg(struct socket *sock, struct msghdr *msg,
@@ -1154,6 +1200,15 @@
 		return -EAFNOSUPPORT;
 	if (type < 0 || type >= SOCK_MAX)
 		return -EINVAL;
+	if (protocol < 0)
+		return -EINVAL;
+
+	if (!nx_check(0, VS_ADMIN)) {
+		if (family == PF_INET && !current_nx_info_has_v4())
+			return -EAFNOSUPPORT;
+		if (family == PF_INET6 && !current_nx_info_has_v6())
+			return -EAFNOSUPPORT;
+	}
 
 	/* Compatibility.
 
@@ -1283,10 +1338,21 @@
 	if (SOCK_NONBLOCK != O_NONBLOCK && (flags & SOCK_NONBLOCK))
 		flags = (flags & ~SOCK_NONBLOCK) | O_NONBLOCK;
 
+	if(!gr_search_socket(family, type, protocol)) {
+		retval = -EACCES;
+		goto out;
+	}
+
+	if (gr_handle_sock_all(family, type, protocol)) {
+		retval = -EACCES;
+		goto out;
+	}
+
 	retval = sock_create(family, type, protocol, &sock);
 	if (retval < 0)
 		goto out;
 
+	set_bit(SOCK_USER_SOCKET, &sock->flags);
 	retval = sock_map_fd(sock, flags & (O_CLOEXEC | O_NONBLOCK));
 	if (retval < 0)
 		goto out_release;
@@ -1328,10 +1394,12 @@
 	err = sock_create(family, type, protocol, &sock1);
 	if (err < 0)
 		goto out;
+	set_bit(SOCK_USER_SOCKET, &sock1->flags);
 
 	err = sock_create(family, type, protocol, &sock2);
 	if (err < 0)
 		goto out_release_1;
+	set_bit(SOCK_USER_SOCKET, &sock2->flags);
 
 	err = sock1->ops->socketpair(sock1, sock2);
 	if (err < 0)
@@ -1415,6 +1483,14 @@
 	if (sock) {
 		err = move_addr_to_kernel(umyaddr, addrlen, (struct sockaddr *)&address);
 		if (err >= 0) {
+			if (gr_handle_sock_server((struct sockaddr *)&address)) {
+				err = -EACCES;
+				goto error;
+			}
+			err = gr_search_bind(sock, (struct sockaddr_in *)&address);
+			if (err)
+				goto error;
+
 			err = security_socket_bind(sock,
 						   (struct sockaddr *)&address,
 						   addrlen);
@@ -1423,6 +1499,7 @@
 						      (struct sockaddr *)
 						      &address, addrlen);
 		}
+error:
 		fput_light(sock->file, fput_needed);
 	}
 	return err;
@@ -1446,10 +1523,20 @@
 		if ((unsigned)backlog > somaxconn)
 			backlog = somaxconn;
 
+		if (gr_handle_sock_server_other(sock->sk)) {
+			err = -EPERM;
+			goto error;
+		}
+
+		err = gr_search_listen(sock);
+		if (err)
+			goto error;
+
 		err = security_socket_listen(sock, backlog);
 		if (!err)
 			err = sock->ops->listen(sock, backlog);
 
+error:
 		fput_light(sock->file, fput_needed);
 	}
 	return err;
@@ -1492,6 +1579,18 @@
 	newsock->type = sock->type;
 	newsock->ops = sock->ops;
 
+	if (gr_handle_sock_server_other(sock->sk)) {
+		err = -EPERM;
+		sock_release(newsock);
+		goto out_put;
+	}
+
+	err = gr_search_accept(sock);
+	if (err) {
+		sock_release(newsock);
+		goto out_put;
+	}
+
 	/*
 	 * We don't need try_module_get here, as the listening socket (sock)
 	 * has the protocol module (sock->ops->owner) held.
@@ -1534,6 +1633,8 @@
 	fd_install(newfd, newfile);
 	err = newfd;
 
+	gr_attach_curr_ip(newsock->sk);
+
 out_put:
 	fput_light(sock->file, fput_needed);
 out:
@@ -1571,6 +1672,7 @@
 		int, addrlen)
 {
 	struct socket *sock;
+	struct sockaddr *sck;
 	struct sockaddr_storage address;
 	int err, fput_needed;
 
@@ -1581,6 +1683,17 @@
 	if (err < 0)
 		goto out_put;
 
+	sck = (struct sockaddr *)&address;
+
+	if (gr_handle_sock_client(sck)) {
+		err = -EACCES;
+		goto out_put;
+	}
+
+	err = gr_search_connect(sock, (struct sockaddr_in *)sck);
+	if (err)
+		goto out_put;
+
 	err =
 	    security_socket_connect(sock, (struct sockaddr *)&address, addrlen);
 	if (err)
@@ -1882,6 +1995,8 @@
 	int err, ctl_len, iov_size, total_len;
 	int fput_needed;
 
+	pax_track_stack();
+
 	err = -EFAULT;
 	if (MSG_CMSG_COMPAT & flags) {
 		if (get_compat_msghdr(&msg_sys, msg_compat))
diff -uriN linux-2.6.32.43/net/sunrpc/auth.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/auth.c
--- linux-2.6.32.43/net/sunrpc/auth.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/auth.c	2011-07-15 05:50:11.000000000 -0500
@@ -14,6 +14,7 @@
 #include <linux/hash.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/spinlock.h>
+#include <linux/vs_tag.h>
 
 #ifdef RPC_DEBUG
 # define RPCDBG_FACILITY	RPCDBG_AUTH
@@ -360,6 +361,7 @@
 	memset(&acred, 0, sizeof(acred));
 	acred.uid = cred->fsuid;
 	acred.gid = cred->fsgid;
+	acred.tag = dx_current_tag();
 	acred.group_info = get_group_info(((struct cred *)cred)->group_info);
 
 	ret = auth->au_ops->lookup_cred(auth, &acred, flags);
@@ -400,6 +402,7 @@
 	struct auth_cred acred = {
 		.uid = 0,
 		.gid = 0,
+		.tag = dx_current_tag(),
 	};
 	struct rpc_cred *ret;
 
diff -uriN linux-2.6.32.43/net/sunrpc/auth_unix.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/auth_unix.c
--- linux-2.6.32.43/net/sunrpc/auth_unix.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/auth_unix.c	2011-07-15 05:50:11.000000000 -0500
@@ -11,12 +11,14 @@
 #include <linux/module.h>
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/auth.h>
+#include <linux/vs_tag.h>
 
 #define NFS_NGROUPS	16
 
 struct unx_cred {
 	struct rpc_cred		uc_base;
 	gid_t			uc_gid;
+	tag_t			uc_tag;
 	gid_t			uc_gids[NFS_NGROUPS];
 };
 #define uc_uid			uc_base.cr_uid
@@ -78,6 +80,7 @@
 		groups = NFS_NGROUPS;
 
 	cred->uc_gid = acred->gid;
+	cred->uc_tag = acred->tag;
 	for (i = 0; i < groups; i++)
 		cred->uc_gids[i] = GROUP_AT(acred->group_info, i);
 	if (i < NFS_NGROUPS)
@@ -119,7 +122,9 @@
 	unsigned int i;
 
 
-	if (cred->uc_uid != acred->uid || cred->uc_gid != acred->gid)
+	if (cred->uc_uid != acred->uid ||
+		cred->uc_gid != acred->gid ||
+		cred->uc_tag != acred->tag)
 		return 0;
 
 	if (acred->group_info != NULL)
@@ -142,7 +147,7 @@
 	struct rpc_clnt	*clnt = task->tk_client;
 	struct unx_cred	*cred = container_of(task->tk_msg.rpc_cred, struct unx_cred, uc_base);
 	__be32		*base, *hold;
-	int		i;
+	int		i, tag;
 
 	*p++ = htonl(RPC_AUTH_UNIX);
 	base = p++;
@@ -152,9 +157,12 @@
 	 * Copy the UTS nodename captured when the client was created.
 	 */
 	p = xdr_encode_array(p, clnt->cl_nodename, clnt->cl_nodelen);
+	tag = task->tk_client->cl_tag;
 
-	*p++ = htonl((u32) cred->uc_uid);
-	*p++ = htonl((u32) cred->uc_gid);
+	*p++ = htonl((u32) TAGINO_UID(tag,
+		cred->uc_uid, cred->uc_tag));
+	*p++ = htonl((u32) TAGINO_GID(tag,
+		cred->uc_gid, cred->uc_tag));
 	hold = p++;
 	for (i = 0; i < 16 && cred->uc_gids[i] != (gid_t) NOGROUP; i++)
 		*p++ = htonl((u32) cred->uc_gids[i]);
diff -uriN linux-2.6.32.43/net/sunrpc/clnt.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/clnt.c
--- linux-2.6.32.43/net/sunrpc/clnt.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/clnt.c	2011-07-15 05:50:11.000000000 -0500
@@ -33,6 +33,7 @@
 #include <linux/utsname.h>
 #include <linux/workqueue.h>
 #include <linux/in6.h>
+#include <linux/vs_cvirt.h>
 
 #include <linux/sunrpc/clnt.h>
 #include <linux/sunrpc/rpc_pipe_fs.h>
@@ -358,6 +359,9 @@
 	if (!(args->flags & RPC_CLNT_CREATE_QUIET))
 		clnt->cl_chatty = 1;
 
+	/* TODO: handle RPC_CLNT_CREATE_TAGGED
+	if (args->flags & RPC_CLNT_CREATE_TAGGED)
+		clnt->cl_tag = 1; */
 	return clnt;
 }
 EXPORT_SYMBOL_GPL(rpc_create);
diff -uriN linux-2.6.32.43/net/sunrpc/sched.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/sched.c
--- linux-2.6.32.43/net/sunrpc/sched.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/sched.c	2011-07-15 05:51:19.000000000 -0500
@@ -234,10 +234,10 @@
 #ifdef RPC_DEBUG
 static void rpc_task_set_debuginfo(struct rpc_task *task)
 {
-	static atomic_t rpc_pid;
+	static atomic_unchecked_t rpc_pid;
 
 	task->tk_magic = RPC_TASK_MAGIC_ID;
-	task->tk_pid = atomic_inc_return(&rpc_pid);
+	task->tk_pid = atomic_inc_return_unchecked(&rpc_pid);
 }
 #else
 static inline void rpc_task_set_debuginfo(struct rpc_task *task)
diff -uriN linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/xprtrdma/svc_rdma.c
--- linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/xprtrdma/svc_rdma.c	2011-07-15 05:51:19.000000000 -0500
@@ -59,15 +59,15 @@
 static unsigned int min_max_inline = 4096;
 static unsigned int max_max_inline = 65536;
 
-atomic_t rdma_stat_recv;
-atomic_t rdma_stat_read;
-atomic_t rdma_stat_write;
-atomic_t rdma_stat_sq_starve;
-atomic_t rdma_stat_rq_starve;
-atomic_t rdma_stat_rq_poll;
-atomic_t rdma_stat_rq_prod;
-atomic_t rdma_stat_sq_poll;
-atomic_t rdma_stat_sq_prod;
+atomic_unchecked_t rdma_stat_recv;
+atomic_unchecked_t rdma_stat_read;
+atomic_unchecked_t rdma_stat_write;
+atomic_unchecked_t rdma_stat_sq_starve;
+atomic_unchecked_t rdma_stat_rq_starve;
+atomic_unchecked_t rdma_stat_rq_poll;
+atomic_unchecked_t rdma_stat_rq_prod;
+atomic_unchecked_t rdma_stat_sq_poll;
+atomic_unchecked_t rdma_stat_sq_prod;
 
 /* Temporary NFS request map and context caches */
 struct kmem_cache *svc_rdma_map_cachep;
@@ -105,7 +105,7 @@
 		len -= *ppos;
 		if (len > *lenp)
 			len = *lenp;
-		if (len && copy_to_user(buffer, str_buf, len))
+		if (len > sizeof str_buf || (len && copy_to_user(buffer, str_buf, len)))
 			return -EFAULT;
 		*lenp = len;
 		*ppos += len;
@@ -149,63 +149,63 @@
 	{
 		.procname	= "rdma_stat_read",
 		.data		= &rdma_stat_read,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
 	{
 		.procname	= "rdma_stat_recv",
 		.data		= &rdma_stat_recv,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
 	{
 		.procname	= "rdma_stat_write",
 		.data		= &rdma_stat_write,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
 	{
 		.procname	= "rdma_stat_sq_starve",
 		.data		= &rdma_stat_sq_starve,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
 	{
 		.procname	= "rdma_stat_rq_starve",
 		.data		= &rdma_stat_rq_starve,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
 	{
 		.procname	= "rdma_stat_rq_poll",
 		.data		= &rdma_stat_rq_poll,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
 	{
 		.procname	= "rdma_stat_rq_prod",
 		.data		= &rdma_stat_rq_prod,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
 	{
 		.procname	= "rdma_stat_sq_poll",
 		.data		= &rdma_stat_sq_poll,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
 	{
 		.procname	= "rdma_stat_sq_prod",
 		.data		= &rdma_stat_sq_prod,
-		.maxlen		= sizeof(atomic_t),
+		.maxlen		= sizeof(atomic_unchecked_t),
 		.mode		= 0644,
 		.proc_handler	= &read_reset_stat,
 	},
diff -uriN linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c
--- linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/xprtrdma/svc_rdma_recvfrom.c	2011-07-15 05:51:19.000000000 -0500
@@ -495,7 +495,7 @@
 			svc_rdma_put_context(ctxt, 0);
 			goto out;
 		}
-		atomic_inc(&rdma_stat_read);
+		atomic_inc_unchecked(&rdma_stat_read);
 
 		if (read_wr.num_sge < chl_map->ch[ch_no].count) {
 			chl_map->ch[ch_no].count -= read_wr.num_sge;
@@ -606,7 +606,7 @@
 				  dto_q);
 		list_del_init(&ctxt->dto_q);
 	} else {
-		atomic_inc(&rdma_stat_rq_starve);
+		atomic_inc_unchecked(&rdma_stat_rq_starve);
 		clear_bit(XPT_DATA, &xprt->xpt_flags);
 		ctxt = NULL;
 	}
@@ -626,7 +626,7 @@
 	dprintk("svcrdma: processing ctxt=%p on xprt=%p, rqstp=%p, status=%d\n",
 		ctxt, rdma_xprt, rqstp, ctxt->wc_status);
 	BUG_ON(ctxt->wc_status != IB_WC_SUCCESS);
-	atomic_inc(&rdma_stat_recv);
+	atomic_inc_unchecked(&rdma_stat_recv);
 
 	/* Build up the XDR from the receive buffers. */
 	rdma_build_arg_xdr(rqstp, ctxt, ctxt->byte_len);
diff -uriN linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_sendto.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/xprtrdma/svc_rdma_sendto.c
--- linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_sendto.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/xprtrdma/svc_rdma_sendto.c	2011-07-15 05:51:19.000000000 -0500
@@ -328,7 +328,7 @@
 	write_wr.wr.rdma.remote_addr = to;
 
 	/* Post It */
-	atomic_inc(&rdma_stat_write);
+	atomic_inc_unchecked(&rdma_stat_write);
 	if (svc_rdma_send(xprt, &write_wr))
 		goto err;
 	return 0;
diff -uriN linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_transport.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/xprtrdma/svc_rdma_transport.c
--- linux-2.6.32.43/net/sunrpc/xprtrdma/svc_rdma_transport.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sunrpc/xprtrdma/svc_rdma_transport.c	2011-07-15 05:51:19.000000000 -0500
@@ -292,7 +292,7 @@
 		return;
 
 	ib_req_notify_cq(xprt->sc_rq_cq, IB_CQ_NEXT_COMP);
-	atomic_inc(&rdma_stat_rq_poll);
+	atomic_inc_unchecked(&rdma_stat_rq_poll);
 
 	while ((ret = ib_poll_cq(xprt->sc_rq_cq, 1, &wc)) > 0) {
 		ctxt = (struct svc_rdma_op_ctxt *)(unsigned long)wc.wr_id;
@@ -314,7 +314,7 @@
 	}
 
 	if (ctxt)
-		atomic_inc(&rdma_stat_rq_prod);
+		atomic_inc_unchecked(&rdma_stat_rq_prod);
 
 	set_bit(XPT_DATA, &xprt->sc_xprt.xpt_flags);
 	/*
@@ -386,7 +386,7 @@
 		return;
 
 	ib_req_notify_cq(xprt->sc_sq_cq, IB_CQ_NEXT_COMP);
-	atomic_inc(&rdma_stat_sq_poll);
+	atomic_inc_unchecked(&rdma_stat_sq_poll);
 	while ((ret = ib_poll_cq(cq, 1, &wc)) > 0) {
 		if (wc.status != IB_WC_SUCCESS)
 			/* Close the transport */
@@ -404,7 +404,7 @@
 	}
 
 	if (ctxt)
-		atomic_inc(&rdma_stat_sq_prod);
+		atomic_inc_unchecked(&rdma_stat_sq_prod);
 }
 
 static void sq_comp_handler(struct ib_cq *cq, void *cq_context)
@@ -1260,7 +1260,7 @@
 		spin_lock_bh(&xprt->sc_lock);
 		if (xprt->sc_sq_depth < atomic_read(&xprt->sc_sq_count) + wr_count) {
 			spin_unlock_bh(&xprt->sc_lock);
-			atomic_inc(&rdma_stat_sq_starve);
+			atomic_inc_unchecked(&rdma_stat_sq_starve);
 
 			/* See if we can opportunistically reap SQ WR to make room */
 			sq_cq_reap(xprt);
diff -uriN linux-2.6.32.43/net/sysctl_net.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sysctl_net.c
--- linux-2.6.32.43/net/sysctl_net.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/sysctl_net.c	2011-07-15 05:51:19.000000000 -0500
@@ -46,7 +46,7 @@
 			       struct ctl_table *table)
 {
 	/* Allow network administrator to have same access as root. */
-	if (capable(CAP_NET_ADMIN)) {
+	if (capable_nolog(CAP_NET_ADMIN)) {
 		int mode = (table->mode >> 6) & 7;
 		return (mode << 6) | (mode << 3) | mode;
 	}
diff -uriN linux-2.6.32.43/net/unix/af_unix.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/unix/af_unix.c
--- linux-2.6.32.43/net/unix/af_unix.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/unix/af_unix.c	2011-07-15 05:51:19.000000000 -0500
@@ -114,6 +114,8 @@
 #include <linux/mount.h>
 #include <net/checksum.h>
 #include <linux/security.h>
+#include <linux/vs_context.h>
+#include <linux/vs_limit.h>
 
 static struct hlist_head unix_socket_table[UNIX_HASH_SIZE + 1];
 static DEFINE_SPINLOCK(unix_table_lock);
@@ -258,6 +260,8 @@
 		if (!net_eq(sock_net(s), net))
 			continue;
 
+		if (!nx_check(s->sk_nid, VS_WATCH_P | VS_IDENT))
+			continue;
 		if (u->addr->len == len &&
 		    !memcmp(u->addr->name, sunname, len))
 			goto found;
@@ -745,6 +749,12 @@
 		err = -ECONNREFUSED;
 		if (!S_ISSOCK(inode->i_mode))
 			goto put_fail;
+
+		if (!gr_acl_handle_unix(path.dentry, path.mnt)) {
+			err = -EACCES;
+			goto put_fail;
+		}
+
 		u = unix_find_socket_byinode(net, inode);
 		if (!u)
 			goto put_fail;
@@ -765,6 +775,13 @@
 		if (u) {
 			struct dentry *dentry;
 			dentry = unix_sk(u)->dentry;
+
+			if (!gr_handle_chroot_unix(u->sk_peercred.pid)) {
+				err = -EPERM;
+				sock_put(u);
+				goto fail;
+			}
+
 			if (dentry)
 				touch_atime(unix_sk(u)->mnt, dentry);
 		} else
@@ -850,11 +867,18 @@
 		err = security_path_mknod(&nd.path, dentry, mode, 0);
 		if (err)
 			goto out_mknod_drop_write;
+		if (!gr_acl_handle_mknod(dentry, nd.path.dentry, nd.path.mnt, mode)) {
+			err = -EACCES;
+			goto out_mknod_drop_write;
+		}
 		err = vfs_mknod(nd.path.dentry->d_inode, dentry, mode, 0);
 out_mknod_drop_write:
 		mnt_drop_write(nd.path.mnt);
 		if (err)
 			goto out_mknod_dput;
+
+		gr_handle_create(dentry, nd.path.mnt);
+
 		mutex_unlock(&nd.path.dentry->d_inode->i_mutex);
 		dput(nd.path.dentry);
 		nd.path.dentry = dentry;
@@ -872,6 +896,10 @@
 			goto out_unlock;
 		}
 
+#ifdef CONFIG_GRKERNSEC_CHROOT_UNIX
+		sk->sk_peercred.pid = current->pid;
+#endif
+
 		list = &unix_socket_table[addr->hash];
 	} else {
 		list = &unix_socket_table[dentry->d_inode->i_ino & (UNIX_HASH_SIZE-1)];
@@ -2164,6 +2192,8 @@
 	for (s = first_unix_socket(&iter->i); s; s = next_unix_socket(&iter->i, s)) {
 		if (sock_net(s) != seq_file_net(seq))
 			continue;
+		if (!nx_check(s->sk_nid, VS_WATCH_P | VS_IDENT))
+			continue;
 		if (off == pos)
 			return s;
 		++off;
@@ -2188,7 +2218,8 @@
 		sk = first_unix_socket(&iter->i);
 	else
 		sk = next_unix_socket(&iter->i, sk);
-	while (sk && (sock_net(sk) != seq_file_net(seq)))
+	while (sk && (sock_net(sk) != seq_file_net(seq) ||
+		!nx_check(sk->sk_nid, VS_WATCH_P | VS_IDENT)))
 		sk = next_unix_socket(&iter->i, sk);
 	return sk;
 }
@@ -2211,7 +2242,11 @@
 		unix_state_lock(s);
 
 		seq_printf(seq, "%p: %08X %08X %08X %04X %02X %5lu",
+#ifdef CONFIG_GRKERNSEC_HIDESYM
+			NULL,
+#else
 			s,
+#endif
 			atomic_read(&s->sk_refcnt),
 			0,
 			s->sk_state == TCP_LISTEN ? __SO_ACCEPTCON : 0,
diff -uriN linux-2.6.32.43/net/wireless/wext.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/wireless/wext.c
--- linux-2.6.32.43/net/wireless/wext.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/wireless/wext.c	2011-07-15 05:51:19.000000000 -0500
@@ -816,8 +816,7 @@
 		 */
 
 		/* Support for very large requests */
-		if ((descr->flags & IW_DESCR_FLAG_NOMAX) &&
-		    (user_length > descr->max_tokens)) {
+		if (user_length > descr->max_tokens) {
 			/* Allow userspace to GET more than max so
 			 * we can support any size GET requests.
 			 * There is still a limit : -ENOMEM.
@@ -854,22 +853,6 @@
 		}
 	}
 
-	if (IW_IS_GET(cmd) && !(descr->flags & IW_DESCR_FLAG_NOMAX)) {
-		/*
-		 * If this is a GET, but not NOMAX, it means that the extra
-		 * data is not bounded by userspace, but by max_tokens. Thus
-		 * set the length to max_tokens. This matches the extra data
-		 * allocation.
-		 * The driver should fill it with the number of tokens it
-		 * provided, and it may check iwp->length rather than having
-		 * knowledge of max_tokens. If the driver doesn't change the
-		 * iwp->length, this ioctl just copies back max_token tokens
-		 * filled with zeroes. Hopefully the driver isn't claiming
-		 * them to be valid data.
-		 */
-		iwp->length = descr->max_tokens;
-	}
-
 	err = handler(dev, info, (union iwreq_data *) iwp, extra);
 
 	iwp->length += essid_compat;
diff -uriN linux-2.6.32.43/net/xfrm/xfrm_policy.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/xfrm/xfrm_policy.c
--- linux-2.6.32.43/net/xfrm/xfrm_policy.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/xfrm/xfrm_policy.c	2011-07-15 05:51:19.000000000 -0500
@@ -586,7 +586,7 @@
 		hlist_add_head(&policy->bydst, chain);
 	xfrm_pol_hold(policy);
 	net->xfrm.policy_count[dir]++;
-	atomic_inc(&flow_cache_genid);
+	atomic_inc_unchecked(&flow_cache_genid);
 	if (delpol)
 		__xfrm_policy_unlink(delpol, dir);
 	policy->index = delpol ? delpol->index : xfrm_gen_index(net, dir);
@@ -669,7 +669,7 @@
 	write_unlock_bh(&xfrm_policy_lock);
 
 	if (ret && delete) {
-		atomic_inc(&flow_cache_genid);
+		atomic_inc_unchecked(&flow_cache_genid);
 		xfrm_policy_kill(ret);
 	}
 	return ret;
@@ -710,7 +710,7 @@
 	write_unlock_bh(&xfrm_policy_lock);
 
 	if (ret && delete) {
-		atomic_inc(&flow_cache_genid);
+		atomic_inc_unchecked(&flow_cache_genid);
 		xfrm_policy_kill(ret);
 	}
 	return ret;
@@ -824,7 +824,7 @@
 		}
 
 	}
-	atomic_inc(&flow_cache_genid);
+	atomic_inc_unchecked(&flow_cache_genid);
 out:
 	write_unlock_bh(&xfrm_policy_lock);
 	return err;
@@ -1088,7 +1088,7 @@
 	write_unlock_bh(&xfrm_policy_lock);
 	if (pol) {
 		if (dir < XFRM_POLICY_MAX)
-			atomic_inc(&flow_cache_genid);
+			atomic_inc_unchecked(&flow_cache_genid);
 		xfrm_policy_kill(pol);
 		return 0;
 	}
@@ -1477,7 +1477,7 @@
 	goto out;
 }
 
-static int inline
+static inline int
 xfrm_dst_alloc_copy(void **target, void *src, int size)
 {
 	if (!*target) {
@@ -1489,7 +1489,7 @@
 	return 0;
 }
 
-static int inline
+static inline int
 xfrm_dst_update_parent(struct dst_entry *dst, struct xfrm_selector *sel)
 {
 #ifdef CONFIG_XFRM_SUB_POLICY
@@ -1501,7 +1501,7 @@
 #endif
 }
 
-static int inline
+static inline int
 xfrm_dst_update_origin(struct dst_entry *dst, struct flowi *fl)
 {
 #ifdef CONFIG_XFRM_SUB_POLICY
@@ -1537,7 +1537,7 @@
 	u8 dir = policy_to_flow_dir(XFRM_POLICY_OUT);
 
 restart:
-	genid = atomic_read(&flow_cache_genid);
+	genid = atomic_read_unchecked(&flow_cache_genid);
 	policy = NULL;
 	for (pi = 0; pi < ARRAY_SIZE(pols); pi++)
 		pols[pi] = NULL;
@@ -1680,7 +1680,7 @@
 					goto error;
 				}
 				if (nx == -EAGAIN ||
-				    genid != atomic_read(&flow_cache_genid)) {
+				    genid != atomic_read_unchecked(&flow_cache_genid)) {
 					xfrm_pols_put(pols, npols);
 					goto restart;
 				}
diff -uriN linux-2.6.32.43/net/xfrm/xfrm_user.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/xfrm/xfrm_user.c
--- linux-2.6.32.43/net/xfrm/xfrm_user.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/net/xfrm/xfrm_user.c	2011-07-15 05:51:19.000000000 -0500
@@ -1169,6 +1169,8 @@
 	struct xfrm_user_tmpl vec[XFRM_MAX_DEPTH];
 	int i;
 
+	pax_track_stack();
+
 	if (xp->xfrm_nr == 0)
 		return 0;
 
@@ -1784,6 +1786,8 @@
 	int err;
 	int n = 0;
 
+	pax_track_stack();
+
 	if (attrs[XFRMA_MIGRATE] == NULL)
 		return -EINVAL;
 
diff -uriN linux-2.6.32.43/patches linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/patches
--- linux-2.6.32.43/patches	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/patches	2011-07-15 06:54:26.000000000 -0500
@@ -0,0 +1,2 @@
+grsecurity-2.2.0-2.6.32.22-201009241805.patch
+patch-2.6.32.22-vs2.3.0.36.29.6.diff
diff -uriN linux-2.6.32.43/samples/kobject/kset-example.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/samples/kobject/kset-example.c
--- linux-2.6.32.43/samples/kobject/kset-example.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/samples/kobject/kset-example.c	2011-07-15 05:51:19.000000000 -0500
@@ -87,7 +87,7 @@
 }
 
 /* Our custom sysfs_ops that we will associate with our ktype later on */
-static struct sysfs_ops foo_sysfs_ops = {
+static const struct sysfs_ops foo_sysfs_ops = {
 	.show = foo_attr_show,
 	.store = foo_attr_store,
 };
diff -uriN linux-2.6.32.43/scripts/basic/fixdep.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/basic/fixdep.c
--- linux-2.6.32.43/scripts/basic/fixdep.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/basic/fixdep.c	2011-07-15 05:51:19.000000000 -0500
@@ -222,9 +222,9 @@
 
 static void parse_config_file(char *map, size_t len)
 {
-	int *end = (int *) (map + len);
+	unsigned int *end = (unsigned int *) (map + len);
 	/* start at +1, so that p can never be < map */
-	int *m   = (int *) map + 1;
+	unsigned int *m   = (unsigned int *) map + 1;
 	char *p, *q;
 
 	for (; m < end; m++) {
@@ -371,7 +371,7 @@
 static void traps(void)
 {
 	static char test[] __attribute__((aligned(sizeof(int)))) = "CONF";
-	int *p = (int *)test;
+	unsigned int *p = (unsigned int *)test;
 
 	if (*p != INT_CONF) {
 		fprintf(stderr, "fixdep: sizeof(int) != 4 or wrong endianess? %#x\n",
diff -uriN linux-2.6.32.43/scripts/checksyscalls.sh linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/checksyscalls.sh
--- linux-2.6.32.43/scripts/checksyscalls.sh	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/checksyscalls.sh	2011-07-15 05:50:11.000000000 -0500
@@ -194,7 +194,6 @@
 #define __IGNORE_afs_syscall
 #define __IGNORE_getpmsg
 #define __IGNORE_putpmsg
-#define __IGNORE_vserver
 EOF
 }
 
diff -uriN linux-2.6.32.43/scripts/Makefile.build linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/Makefile.build
--- linux-2.6.32.43/scripts/Makefile.build	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/Makefile.build	2011-07-15 05:51:19.000000000 -0500
@@ -59,7 +59,7 @@
 endif
 
 # Do not include host rules unless needed
-ifneq ($(hostprogs-y)$(hostprogs-m),)
+ifneq ($(hostprogs-y)$(hostprogs-m)$(hostlibs-y)$(hostlibs-m),)
 include scripts/Makefile.host
 endif
 
diff -uriN linux-2.6.32.43/scripts/Makefile.clean linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/Makefile.clean
--- linux-2.6.32.43/scripts/Makefile.clean	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/Makefile.clean	2011-07-15 05:51:19.000000000 -0500
@@ -43,7 +43,8 @@
 __clean-files	:= $(extra-y) $(always)                  \
 		   $(targets) $(clean-files)             \
 		   $(host-progs)                         \
-		   $(hostprogs-y) $(hostprogs-m) $(hostprogs-)
+		   $(hostprogs-y) $(hostprogs-m) $(hostprogs-) \
+		   $(hostlibs-y) $(hostlibs-m) $(hostlibs-)
 
 # as clean-files is given relative to the current directory, this adds
 # a $(obj) prefix, except for absolute paths
diff -uriN linux-2.6.32.43/scripts/Makefile.host linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/Makefile.host
--- linux-2.6.32.43/scripts/Makefile.host	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/Makefile.host	2011-07-15 05:51:19.000000000 -0500
@@ -31,6 +31,7 @@
 # Note: Shared libraries consisting of C++ files are not supported
 
 __hostprogs := $(sort $(hostprogs-y) $(hostprogs-m))
+__hostlibs := $(sort $(hostlibs-y) $(hostlibs-m))
 
 # C code
 # Executables compiled from a single .c file
@@ -54,6 +55,7 @@
 # Shared libaries (only .c supported)
 # Shared libraries (.so) - all .so files referenced in "xxx-objs"
 host-cshlib	:= $(sort $(filter %.so, $(host-cobjs)))
+host-cshlib	+= $(sort $(filter %.so, $(__hostlibs)))
 # Remove .so files from "xxx-objs"
 host-cobjs	:= $(filter-out %.so,$(host-cobjs))
 
diff -uriN linux-2.6.32.43/scripts/mod/file2alias.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/mod/file2alias.c
--- linux-2.6.32.43/scripts/mod/file2alias.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/mod/file2alias.c	2011-07-15 05:51:19.000000000 -0500
@@ -72,7 +72,7 @@
 			    unsigned long size, unsigned long id_size,
 			    void *symval)
 {
-	int i;
+	unsigned int i;
 
 	if (size % id_size || size < id_size) {
 		if (cross_build != 0)
@@ -102,7 +102,7 @@
 /* USB is special because the bcdDevice can be matched against a numeric range */
 /* Looks like "usb:vNpNdNdcNdscNdpNicNiscNipN" */
 static void do_usb_entry(struct usb_device_id *id,
-			 unsigned int bcdDevice_initial, int bcdDevice_initial_digits,
+			 unsigned int bcdDevice_initial, unsigned int bcdDevice_initial_digits,
 			 unsigned char range_lo, unsigned char range_hi,
 			 struct module *mod)
 {
@@ -368,7 +368,7 @@
 	for (i = 0; i < count; i++) {
 		const char *id = (char *)devs[i].id;
 		char acpi_id[sizeof(devs[0].id)];
-		int j;
+		unsigned int j;
 
 		buf_printf(&mod->dev_table_buf,
 			   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
@@ -398,7 +398,7 @@
 
 		for (j = 0; j < PNP_MAX_DEVICES; j++) {
 			const char *id = (char *)card->devs[j].id;
-			int i2, j2;
+			unsigned int i2, j2;
 			int dup = 0;
 
 			if (!id[0])
@@ -424,7 +424,7 @@
 			/* add an individual alias for every device entry */
 			if (!dup) {
 				char acpi_id[sizeof(card->devs[0].id)];
-				int k;
+				unsigned int k;
 
 				buf_printf(&mod->dev_table_buf,
 					   "MODULE_ALIAS(\"pnp:d%s*\");\n", id);
@@ -699,7 +699,7 @@
 static int do_dmi_entry(const char *filename, struct dmi_system_id *id,
 			char *alias)
 {
-	int i, j;
+	unsigned int i, j;
 
 	sprintf(alias, "dmi*");
 
diff -uriN linux-2.6.32.43/scripts/mod/modpost.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/mod/modpost.c
--- linux-2.6.32.43/scripts/mod/modpost.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/mod/modpost.c	2011-07-15 05:51:19.000000000 -0500
@@ -835,6 +835,7 @@
 	INIT_TO_EXIT,
 	EXIT_TO_INIT,
 	EXPORT_TO_INIT_EXIT,
+	DATA_TO_TEXT
 };
 
 struct sectioncheck {
@@ -920,6 +921,12 @@
 	.fromsec = { "__ksymtab*", NULL },
 	.tosec   = { INIT_SECTIONS, EXIT_SECTIONS, NULL },
 	.mismatch = EXPORT_TO_INIT_EXIT
+},
+/* Do not reference code from writable data */
+{
+	.fromsec = { DATA_SECTIONS, NULL },
+	.tosec   = { TEXT_SECTIONS, NULL },
+	.mismatch = DATA_TO_TEXT
 }
 };
 
@@ -1024,10 +1031,10 @@
 			continue;
 		if (ELF_ST_TYPE(sym->st_info) == STT_SECTION)
 			continue;
-		if (sym->st_value == addr)
-			return sym;
 		/* Find a symbol nearby - addr are maybe negative */
 		d = sym->st_value - addr;
+		if (d == 0)
+			return sym;
 		if (d < 0)
 			d = addr - sym->st_value;
 		if (d < distance) {
@@ -1268,6 +1275,14 @@
 		"Fix this by removing the %sannotation of %s "
 		"or drop the export.\n",
 		tosym, sec2annotation(tosec), sec2annotation(tosec), tosym);
+	case DATA_TO_TEXT:
+/*
+		fprintf(stderr,
+		"The variable %s references\n"
+		"the %s %s%s%s\n",
+		fromsym, to, sec2annotation(tosec), tosym, to_p);
+*/
+		break;
 	case NO_MISMATCH:
 		/* To get warnings on missing members */
 		break;
@@ -1495,7 +1510,7 @@
 static void check_sec_ref(struct module *mod, const char *modname,
                           struct elf_info *elf)
 {
-	int i;
+	unsigned int i;
 	Elf_Shdr *sechdrs = elf->sechdrs;
 
 	/* Walk through all sections */
@@ -1651,7 +1666,7 @@
 	va_end(ap);
 }
 
-void buf_write(struct buffer *buf, const char *s, int len)
+void buf_write(struct buffer *buf, const char *s, unsigned int len)
 {
 	if (buf->size - buf->pos < len) {
 		buf->size += len + SZ;
@@ -1863,7 +1878,7 @@
 	if (fstat(fileno(file), &st) < 0)
 		goto close_write;
 
-	if (st.st_size != b->pos)
+	if (st.st_size != (off_t)b->pos)
 		goto close_write;
 
 	tmp = NOFAIL(malloc(b->pos));
diff -uriN linux-2.6.32.43/scripts/mod/modpost.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/mod/modpost.h
--- linux-2.6.32.43/scripts/mod/modpost.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/mod/modpost.h	2011-07-15 05:51:19.000000000 -0500
@@ -92,15 +92,15 @@
 
 struct buffer {
 	char *p;
-	int pos;
-	int size;
+	unsigned int pos;
+	unsigned int size;
 };
 
 void __attribute__((format(printf, 2, 3)))
 buf_printf(struct buffer *buf, const char *fmt, ...);
 
 void
-buf_write(struct buffer *buf, const char *s, int len);
+buf_write(struct buffer *buf, const char *s, unsigned int len);
 
 struct module {
 	struct module *next;
diff -uriN linux-2.6.32.43/scripts/mod/sumversion.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/mod/sumversion.c
--- linux-2.6.32.43/scripts/mod/sumversion.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/mod/sumversion.c	2011-07-15 05:51:19.000000000 -0500
@@ -455,7 +455,7 @@
 		goto out;
 	}
 
-	if (write(fd, sum, strlen(sum)+1) != strlen(sum)+1) {
+	if (write(fd, sum, strlen(sum)+1) != (ssize_t)strlen(sum)+1) {
 		warn("writing sum in %s failed: %s\n",
 			filename, strerror(errno));
 		goto out;
diff -uriN linux-2.6.32.43/scripts/pnmtologo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/pnmtologo.c
--- linux-2.6.32.43/scripts/pnmtologo.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/pnmtologo.c	2011-07-15 05:51:19.000000000 -0500
@@ -237,14 +237,14 @@
     fprintf(out, " *  Linux logo %s\n", logoname);
     fputs(" */\n\n", out);
     fputs("#include <linux/linux_logo.h>\n\n", out);
-    fprintf(out, "static unsigned char %s_data[] __initdata = {\n",
+    fprintf(out, "static unsigned char %s_data[] = {\n",
 	    logoname);
 }
 
 static void write_footer(void)
 {
     fputs("\n};\n\n", out);
-    fprintf(out, "const struct linux_logo %s __initconst = {\n", logoname);
+    fprintf(out, "const struct linux_logo %s = {\n", logoname);
     fprintf(out, "\t.type\t\t= %s,\n", logo_types[logo_type]);
     fprintf(out, "\t.width\t\t= %d,\n", logo_width);
     fprintf(out, "\t.height\t\t= %d,\n", logo_height);
@@ -374,7 +374,7 @@
     fputs("\n};\n\n", out);
 
     /* write logo clut */
-    fprintf(out, "static unsigned char %s_clut[] __initdata = {\n",
+    fprintf(out, "static unsigned char %s_clut[] = {\n",
 	    logoname);
     write_hex_cnt = 0;
     for (i = 0; i < logo_clutsize; i++) {
diff -uriN linux-2.6.32.43/scripts/tags.sh linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/tags.sh
--- linux-2.6.32.43/scripts/tags.sh	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/scripts/tags.sh	2011-07-15 05:51:19.000000000 -0500
@@ -93,6 +93,11 @@
 	cscope -b -f cscope.out
 }
 
+dogtags()
+{
+	all_sources | gtags -f -
+}
+
 exuberant()
 {
 	all_sources | xargs $1 -a                               \
@@ -164,6 +169,10 @@
 		docscope
 		;;
 
+	"gtags")
+		dogtags
+		;;
+
 	"tags")
 		rm -f tags
 		xtags ctags
diff -uriN linux-2.6.32.43/security/capability.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/capability.c
--- linux-2.6.32.43/security/capability.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/capability.c	2011-07-15 05:51:19.000000000 -0500
@@ -890,7 +890,7 @@
 }
 #endif /* CONFIG_AUDIT */
 
-struct security_operations default_security_ops = {
+struct security_operations default_security_ops __read_only = {
 	.name	= "default",
 };
 
diff -uriN linux-2.6.32.43/security/commoncap.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/commoncap.c
--- linux-2.6.32.43/security/commoncap.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/commoncap.c	2011-07-15 06:54:26.000000000 -0500
@@ -27,6 +27,9 @@
 #include <linux/sched.h>
 #include <linux/prctl.h>
 #include <linux/securebits.h>
+#include <linux/vs_context.h>
+#include <net/sock.h>
+#include <linux/vs_context.h>
 
 /*
  * If a non-root user executes a setuid-root binary in
@@ -50,9 +53,11 @@
 	}
 }
 
+extern kernel_cap_t gr_cap_rtnetlink(struct sock *sk);
+
 int cap_netlink_send(struct sock *sk, struct sk_buff *skb)
 {
-	NETLINK_CB(skb).eff_cap = current_cap();
+	NETLINK_CB(skb).eff_cap = vx_mbcaps(gr_cap_rtnetlink(sk));
 	return 0;
 }
 
@@ -62,6 +67,7 @@
 		return -EPERM;
 	return 0;
 }
+
 EXPORT_SYMBOL(cap_netlink_recv);
 
 /**
@@ -82,7 +88,22 @@
 int cap_capable(struct task_struct *tsk, const struct cred *cred, int cap,
 		int audit)
 {
-	return cap_raised(cred->cap_effective, cap) ? 0 : -EPERM;
+	struct vx_info *vxi = tsk->vx_info;
+
+#if 0
+	printk("cap_capable() VXF_STATE_SETUP = %llx, raised = %x, eff = %08x:%08x\n",
+		vx_info_flags(vxi, VXF_STATE_SETUP, 0),
+		cap_raised(tsk->cap_effective, cap),
+		tsk->cap_effective.cap[1], tsk->cap_effective.cap[0]);
+#endif
+
+	/* special case SETUP */
+	if (vx_info_flags(vxi, VXF_STATE_SETUP, 0) &&
+		/* FIXME: maybe use cred instead? */
+		cap_raised(tsk->cred->cap_effective, cap))
+		return 0;
+
+	return vx_cap_raised(vxi, cred->cap_effective, cap) ? 0 : -EPERM;
 }
 
 /**
@@ -582,6 +603,9 @@
 {
 	const struct cred *cred = current_cred();
 
+	if (gr_acl_enable_at_secure())
+		return 1;
+
 	if (cred->uid != 0) {
 		if (bprm->cap_effective)
 			return 1;
@@ -618,7 +642,7 @@
 
 	if (!strncmp(name, XATTR_SECURITY_PREFIX,
 		     sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
-	    !capable(CAP_SYS_ADMIN))
+		!vx_capable(CAP_SYS_ADMIN, VXC_FS_SECURITY))
 		return -EPERM;
 	return 0;
 }
@@ -644,7 +668,7 @@
 
 	if (!strncmp(name, XATTR_SECURITY_PREFIX,
 		     sizeof(XATTR_SECURITY_PREFIX) - 1)  &&
-	    !capable(CAP_SYS_ADMIN))
+		!vx_capable(CAP_SYS_ADMIN, VXC_FS_SECURITY))
 		return -EPERM;
 	return 0;
 }
@@ -962,7 +986,8 @@
  */
 int cap_syslog(int type)
 {
-	if ((type != 3 && type != 10) && !capable(CAP_SYS_ADMIN))
+	if ((type != 3 && type != 10) &&
+		!vx_capable(CAP_SYS_ADMIN, VXC_SYSLOG))
 		return -EPERM;
 	return 0;
 }
diff -uriN linux-2.6.32.43/security/integrity/ima/ima_api.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/integrity/ima/ima_api.c
--- linux-2.6.32.43/security/integrity/ima/ima_api.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/integrity/ima/ima_api.c	2011-07-15 05:51:19.000000000 -0500
@@ -74,7 +74,7 @@
 	int result;
 
 	/* can overflow, only indicator */
-	atomic_long_inc(&ima_htable.violations);
+	atomic_long_inc_unchecked(&ima_htable.violations);
 
 	entry = kmalloc(sizeof(*entry), GFP_KERNEL);
 	if (!entry) {
diff -uriN linux-2.6.32.43/security/integrity/ima/ima_fs.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/integrity/ima/ima_fs.c
--- linux-2.6.32.43/security/integrity/ima/ima_fs.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/integrity/ima/ima_fs.c	2011-07-15 05:51:19.000000000 -0500
@@ -27,12 +27,12 @@
 static int valid_policy = 1;
 #define TMPBUFLEN 12
 static ssize_t ima_show_htable_value(char __user *buf, size_t count,
-				     loff_t *ppos, atomic_long_t *val)
+				     loff_t *ppos, atomic_long_unchecked_t *val)
 {
 	char tmpbuf[TMPBUFLEN];
 	ssize_t len;
 
-	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read(val));
+	len = scnprintf(tmpbuf, TMPBUFLEN, "%li\n", atomic_long_read_unchecked(val));
 	return simple_read_from_buffer(buf, count, ppos, tmpbuf, len);
 }
 
diff -uriN linux-2.6.32.43/security/integrity/ima/ima.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/integrity/ima/ima.h
--- linux-2.6.32.43/security/integrity/ima/ima.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/integrity/ima/ima.h	2011-07-15 05:51:19.000000000 -0500
@@ -84,8 +84,8 @@
 extern spinlock_t ima_queue_lock;
 
 struct ima_h_table {
-	atomic_long_t len;	/* number of stored measurements in the list */
-	atomic_long_t violations;
+	atomic_long_unchecked_t len;	/* number of stored measurements in the list */
+	atomic_long_unchecked_t violations;
 	struct hlist_head queue[IMA_MEASURE_HTABLE_SIZE];
 };
 extern struct ima_h_table ima_htable;
diff -uriN linux-2.6.32.43/security/integrity/ima/ima_queue.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/integrity/ima/ima_queue.c
--- linux-2.6.32.43/security/integrity/ima/ima_queue.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/integrity/ima/ima_queue.c	2011-07-15 05:51:19.000000000 -0500
@@ -78,7 +78,7 @@
 	INIT_LIST_HEAD(&qe->later);
 	list_add_tail_rcu(&qe->later, &ima_measurements);
 
-	atomic_long_inc(&ima_htable.len);
+	atomic_long_inc_unchecked(&ima_htable.len);
 	key = ima_hash_key(entry->digest);
 	hlist_add_head_rcu(&qe->hnext, &ima_htable.queue[key]);
 	return 0;
diff -uriN linux-2.6.32.43/security/Kconfig linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/Kconfig
--- linux-2.6.32.43/security/Kconfig	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/Kconfig	2011-07-15 05:51:19.000000000 -0500
@@ -4,6 +4,555 @@
 
 menu "Security options"
 
+source grsecurity/Kconfig
+
+menu "PaX"
+
+	config ARCH_TRACK_EXEC_LIMIT
+	bool
+
+	config PAX_PER_CPU_PGD
+	bool
+
+	config TASK_SIZE_MAX_SHIFT
+	int
+	depends on X86_64
+	default 47 if !PAX_PER_CPU_PGD
+	default 42 if PAX_PER_CPU_PGD
+
+	config PAX_ENABLE_PAE
+	bool
+	default y if (X86_32 && (MPENTIUM4 || MK8 || MPSC || MCORE2 || MATOM))
+	
+config PAX
+	bool "Enable various PaX features"
+	depends on GRKERNSEC && (ALPHA || ARM || AVR32 || IA64 || MIPS || PARISC || PPC || SPARC || X86)
+	help
+	  This allows you to enable various PaX features.  PaX adds
+	  intrusion prevention mechanisms to the kernel that reduce
+	  the risks posed by exploitable memory corruption bugs.
+
+menu "PaX Control"
+	depends on PAX
+
+config PAX_SOFTMODE
+	bool 'Support soft mode'
+	select PAX_PT_PAX_FLAGS
+	help
+	  Enabling this option will allow you to run PaX in soft mode, that
+	  is, PaX features will not be enforced by default, only on executables
+	  marked explicitly.  You must also enable PT_PAX_FLAGS support as it
+	  is the only way to mark executables for soft mode use.
+
+	  Soft mode can be activated by using the "pax_softmode=1" kernel command
+	  line option on boot.  Furthermore you can control various PaX features
+	  at runtime via the entries in /proc/sys/kernel/pax.
+
+config PAX_EI_PAX
+	bool 'Use legacy ELF header marking'
+	help
+	  Enabling this option will allow you to control PaX features on
+	  a per executable basis via the 'chpax' utility available at
+	  http://pax.grsecurity.net/.  The control flags will be read from
+	  an otherwise reserved part of the ELF header.  This marking has
+	  numerous drawbacks (no support for soft-mode, toolchain does not
+	  know about the non-standard use of the ELF header) therefore it
+	  has been deprecated in favour of PT_PAX_FLAGS support.
+
+	  Note that if you enable PT_PAX_FLAGS marking support as well,
+	  the PT_PAX_FLAG marks will override the legacy EI_PAX marks.
+
+config PAX_PT_PAX_FLAGS
+	bool 'Use ELF program header marking'
+	help
+	  Enabling this option will allow you to control PaX features on
+	  a per executable basis via the 'paxctl' utility available at
+	  http://pax.grsecurity.net/.  The control flags will be read from
+	  a PaX specific ELF program header (PT_PAX_FLAGS).  This marking
+	  has the benefits of supporting both soft mode and being fully
+	  integrated into the toolchain (the binutils patch is available
+	  from http://pax.grsecurity.net).
+
+	  If your toolchain does not support PT_PAX_FLAGS markings,
+	  you can create one in most cases with 'paxctl -C'.
+
+	  Note that if you enable the legacy EI_PAX marking support as well,
+	  the EI_PAX marks will be overridden by the PT_PAX_FLAGS marks.
+
+choice
+	prompt 'MAC system integration'
+	default PAX_HAVE_ACL_FLAGS
+	help
+	  Mandatory Access Control systems have the option of controlling
+	  PaX flags on a per executable basis, choose the method supported
+	  by your particular system.
+
+	  - "none": if your MAC system does not interact with PaX,
+	  - "direct": if your MAC system defines pax_set_initial_flags() itself,
+	  - "hook": if your MAC system uses the pax_set_initial_flags_func callback.
+
+	  NOTE: this option is for developers/integrators only.
+
+	config PAX_NO_ACL_FLAGS
+		bool 'none'
+
+	config PAX_HAVE_ACL_FLAGS
+		bool 'direct'
+
+	config PAX_HOOK_ACL_FLAGS
+		bool 'hook'
+endchoice
+
+endmenu
+
+menu "Non-executable pages"
+	depends on PAX
+
+config PAX_NOEXEC
+	bool "Enforce non-executable pages"
+	depends on (PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS) && (ALPHA || (ARM && (CPU_V6 || CPU_V7)) || IA64 || MIPS || PARISC || PPC || S390 || SPARC || X86)
+	help
+	  By design some architectures do not allow for protecting memory
+	  pages against execution or even if they do, Linux does not make
+	  use of this feature.  In practice this means that if a page is
+	  readable (such as the stack or heap) it is also executable.
+
+	  There is a well known exploit technique that makes use of this
+	  fact and a common programming mistake where an attacker can
+	  introduce code of his choice somewhere in the attacked program's
+	  memory (typically the stack or the heap) and then execute it.
+
+	  If the attacked program was running with different (typically
+	  higher) privileges than that of the attacker, then he can elevate
+	  his own privilege level (e.g. get a root shell, write to files for
+	  which he does not have write access to, etc).
+
+	  Enabling this option will let you choose from various features
+	  that prevent the injection and execution of 'foreign' code in
+	  a program.
+
+	  This will also break programs that rely on the old behaviour and
+	  expect that dynamically allocated memory via the malloc() family
+	  of functions is executable (which it is not).  Notable examples
+	  are the XFree86 4.x server, the java runtime and wine.
+
+config PAX_PAGEEXEC
+	bool "Paging based non-executable pages"
+	depends on PAX_NOEXEC && (!X86_32 || M586 || M586TSC || M586MMX || M686 || MPENTIUMII || MPENTIUMIII || MPENTIUMM || MCORE2 || MATOM || MPENTIUM4 || MPSC || MK7 || MK8 || MWINCHIPC6 || MWINCHIP2 || MWINCHIP3D || MVIAC3_2 || MVIAC7)
+	select S390_SWITCH_AMODE if S390
+	select S390_EXEC_PROTECT if S390
+	select ARCH_TRACK_EXEC_LIMIT if X86_32
+	help
+	  This implementation is based on the paging feature of the CPU.
+	  On i386 without hardware non-executable bit support there is a
+	  variable but usually low performance impact, however on Intel's
+	  P4 core based CPUs it is very high so you should not enable this
+	  for kernels meant to be used on such CPUs.
+
+	  On alpha, avr32, ia64, parisc, sparc, sparc64, x86_64 and i386
+	  with hardware non-executable bit support there is no performance
+	  impact, on ppc the impact is negligible.
+
+	  Note that several architectures require various emulations due to
+	  badly designed userland ABIs, this will cause a performance impact
+	  but will disappear as soon as userland is fixed. For example, ppc
+	  userland MUST have been built with secure-plt by a recent toolchain.
+
+config PAX_SEGMEXEC
+	bool "Segmentation based non-executable pages"
+	depends on PAX_NOEXEC && X86_32
+	help
+	  This implementation is based on the segmentation feature of the
+	  CPU and has a very small performance impact, however applications
+	  will be limited to a 1.5 GB address space instead of the normal
+	  3 GB.
+
+config PAX_EMUTRAMP
+	bool "Emulate trampolines" if (PAX_PAGEEXEC || PAX_SEGMEXEC) && (PARISC || X86)
+	default y if PARISC
+	help
+	  There are some programs and libraries that for one reason or
+	  another attempt to execute special small code snippets from
+	  non-executable memory pages.  Most notable examples are the
+	  signal handler return code generated by the kernel itself and
+	  the GCC trampolines.
+
+	  If you enabled CONFIG_PAX_PAGEEXEC or CONFIG_PAX_SEGMEXEC then
+	  such programs will no longer work under your kernel.
+
+	  As a remedy you can say Y here and use the 'chpax' or 'paxctl'
+	  utilities to enable trampoline emulation for the affected programs
+	  yet still have the protection provided by the non-executable pages.
+
+	  On parisc you MUST enable this option and EMUSIGRT as well, otherwise
+	  your system will not even boot.
+
+	  Alternatively you can say N here and use the 'chpax' or 'paxctl'
+	  utilities to disable CONFIG_PAX_PAGEEXEC and CONFIG_PAX_SEGMEXEC
+	  for the affected files.
+
+	  NOTE: enabling this feature *may* open up a loophole in the
+	  protection provided by non-executable pages that an attacker
+	  could abuse.  Therefore the best solution is to not have any
+	  files on your system that would require this option.  This can
+	  be achieved by not using libc5 (which relies on the kernel
+	  signal handler return code) and not using or rewriting programs
+	  that make use of the nested function implementation of GCC.
+	  Skilled users can just fix GCC itself so that it implements
+	  nested function calls in a way that does not interfere with PaX.
+
+config PAX_EMUSIGRT
+	bool "Automatically emulate sigreturn trampolines"
+	depends on PAX_EMUTRAMP && PARISC
+	default y
+	help
+	  Enabling this option will have the kernel automatically detect
+	  and emulate signal return trampolines executing on the stack
+	  that would otherwise lead to task termination.
+
+	  This solution is intended as a temporary one for users with
+	  legacy versions of libc (libc5, glibc 2.0, uClibc before 0.9.17,
+	  Modula-3 runtime, etc) or executables linked to such, basically
+	  everything that does not specify its own SA_RESTORER function in
+	  normal executable memory like glibc 2.1+ does.
+
+	  On parisc you MUST enable this option, otherwise your system will
+	  not even boot.
+
+	  NOTE: this feature cannot be disabled on a per executable basis
+	  and since it *does* open up a loophole in the protection provided
+	  by non-executable pages, the best solution is to not have any
+	  files on your system that would require this option.
+
+config PAX_MPROTECT
+	bool "Restrict mprotect()"
+	depends on (PAX_PAGEEXEC || PAX_SEGMEXEC)
+	help
+	  Enabling this option will prevent programs from
+	   - changing the executable status of memory pages that were
+	     not originally created as executable,
+	   - making read-only executable pages writable again,
+	   - creating executable pages from anonymous memory,
+	   - making read-only-after-relocations (RELRO) data pages writable again.
+
+	  You should say Y here to complete the protection provided by
+	  the enforcement of non-executable pages.
+
+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
+	  this feature on a per file basis.
+
+config PAX_MPROTECT_COMPAT
+	bool "Use legacy/compat protection demoting (read help)"
+	depends on PAX_MPROTECT
+	default n
+	help
+	  The current implementation of PAX_MPROTECT denies RWX allocations/mprotects
+	  by sending the proper error code to the application.  For some broken
+	  userland, this can cause problems with Python or other applications.  The
+	  current implementation however allows for applications like clamav to
+	  detect if JIT compilation/execution is allowed and to fall back gracefully
+	  to an interpreter-based mode if it does not.  While we encourage everyone
+	  to use the current implementation as-is and push upstream to fix broken
+	  userland (note that the RWX logging option can assist with this), in some
+	  environments this may not be possible.  Having to disable MPROTECT
+	  completely on certain binaries reduces the security benefit of PaX,
+	  so this option is provided for those environments to revert to the old
+	  behavior.
+
+config PAX_ELFRELOCS
+	bool "Allow ELF text relocations (read help)"
+	depends on PAX_MPROTECT
+	default n
+	help
+	  Non-executable pages and mprotect() restrictions are effective
+	  in preventing the introduction of new executable code into an
+	  attacked task's address space.  There remain only two venues
+	  for this kind of attack: if the attacker can execute already
+	  existing code in the attacked task then he can either have it
+	  create and mmap() a file containing his code or have it mmap()
+	  an already existing ELF library that does not have position
+	  independent code in it and use mprotect() on it to make it
+	  writable and copy his code there.  While protecting against
+	  the former approach is beyond PaX, the latter can be prevented
+	  by having only PIC ELF libraries on one's system (which do not
+	  need to relocate their code).  If you are sure this is your case,
+	  as is the case with all modern Linux distributions, then leave
+	  this option disabled.  You should say 'n' here.
+
+config PAX_ETEXECRELOCS
+	bool "Allow ELF ET_EXEC text relocations"
+	depends on PAX_MPROTECT && (ALPHA || IA64 || PARISC)
+	select PAX_ELFRELOCS
+	default y
+	help
+	  On some architectures there are incorrectly created applications
+	  that require text relocations and would not work without enabling
+	  this option.  If you are an alpha, ia64 or parisc user, you should
+	  enable this option and disable it once you have made sure that
+	  none of your applications need it.
+
+config PAX_EMUPLT
+	bool "Automatically emulate ELF PLT"
+	depends on PAX_MPROTECT && (ALPHA || PARISC || SPARC)
+	default y
+	help
+	  Enabling this option will have the kernel automatically detect
+	  and emulate the Procedure Linkage Table entries in ELF files.
+	  On some architectures such entries are in writable memory, and
+	  become non-executable leading to task termination.  Therefore
+	  it is mandatory that you enable this option on alpha, parisc,
+	  sparc and sparc64, otherwise your system would not even boot.
+
+	  NOTE: this feature *does* open up a loophole in the protection
+	  provided by the non-executable pages, therefore the proper
+	  solution is to modify the toolchain to produce a PLT that does
+	  not need to be writable.
+
+config PAX_DLRESOLVE
+	bool 'Emulate old glibc resolver stub'
+	depends on PAX_EMUPLT && SPARC
+	default n
+	help
+	  This option is needed if userland has an old glibc (before 2.4)
+	  that puts a 'save' instruction into the runtime generated resolver
+	  stub that needs special emulation.
+
+config PAX_KERNEXEC
+	bool "Enforce non-executable kernel pages"
+	depends on PAX_NOEXEC && (PPC || X86) && (!X86_32 || X86_WP_WORKS_OK) && !XEN
+	select PAX_PER_CPU_PGD if X86_64 || (X86_32 && X86_PAE)
+	help
+	  This is the kernel land equivalent of PAGEEXEC and MPROTECT,
+	  that is, enabling this option will make it harder to inject
+	  and execute 'foreign' code in kernel memory itself.
+
+	  Note that on x86_64 kernels there is a known regression when
+	  this feature and KVM/VMX are both enabled in the host kernel.
+
+config PAX_KERNEXEC_MODULE_TEXT
+	int "Minimum amount of memory reserved for module code"
+	default "4"
+	depends on PAX_KERNEXEC && X86_32 && MODULES
+	help
+	  Due to implementation details the kernel must reserve a fixed
+	  amount of memory for module code at compile time that cannot be
+	  changed at runtime.  Here you can specify the minimum amount
+	  in MB that will be reserved.  Due to the same implementation
+	  details this size will always be rounded up to the next 2/4 MB
+	  boundary (depends on PAE) so the actually available memory for
+	  module code will usually be more than this minimum.
+
+	  The default 4 MB should be enough for most users but if you have
+	  an excessive number of modules (e.g., most distribution configs
+	  compile many drivers as modules) or use huge modules such as
+	  nvidia's kernel driver, you will need to adjust this amount.
+	  A good rule of thumb is to look at your currently loaded kernel
+	  modules and add up their sizes.
+
+endmenu
+
+menu "Address Space Layout Randomization"
+	depends on PAX
+
+config PAX_ASLR
+	bool "Address Space Layout Randomization"
+	depends on PAX_EI_PAX || PAX_PT_PAX_FLAGS || PAX_HAVE_ACL_FLAGS || PAX_HOOK_ACL_FLAGS
+	help
+	  Many if not most exploit techniques rely on the knowledge of
+	  certain addresses in the attacked program.  The following options
+	  will allow the kernel to apply a certain amount of randomization
+	  to specific parts of the program thereby forcing an attacker to
+	  guess them in most cases.  Any failed guess will most likely crash
+	  the attacked program which allows the kernel to detect such attempts
+	  and react on them.  PaX itself provides no reaction mechanisms,
+	  instead it is strongly encouraged that you make use of Nergal's
+	  segvguard (ftp://ftp.pl.openwall.com/misc/segvguard/) or grsecurity's
+	  (http://www.grsecurity.net/) built-in crash detection features or
+	  develop one yourself.
+
+	  By saying Y here you can choose to randomize the following areas:
+	   - top of the task's kernel stack
+	   - top of the task's userland stack
+	   - base address for mmap() requests that do not specify one
+	     (this includes all libraries)
+	   - base address of the main executable
+
+	  It is strongly recommended to say Y here as address space layout
+	  randomization has negligible impact on performance yet it provides
+	  a very effective protection.
+
+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control
+	  this feature on a per file basis.
+
+config PAX_RANDKSTACK
+	bool "Randomize kernel stack base"
+	depends on PAX_ASLR && X86_TSC && X86
+	help
+	  By saying Y here the kernel will randomize every task's kernel
+	  stack on every system call.  This will not only force an attacker
+	  to guess it but also prevent him from making use of possible
+	  leaked information about it.
+
+	  Since the kernel stack is a rather scarce resource, randomization
+	  may cause unexpected stack overflows, therefore you should very
+	  carefully test your system.  Note that once enabled in the kernel
+	  configuration, this feature cannot be disabled on a per file basis.
+
+config PAX_RANDUSTACK
+	bool "Randomize user stack base"
+	depends on PAX_ASLR
+	help
+	  By saying Y here the kernel will randomize every task's userland
+	  stack.  The randomization is done in two steps where the second
+	  one may apply a big amount of shift to the top of the stack and
+	  cause problems for programs that want to use lots of memory (more
+	  than 2.5 GB if SEGMEXEC is not active, or 1.25 GB when it is).
+	  For this reason the second step can be controlled by 'chpax' or
+	  'paxctl' on a per file basis.
+
+config PAX_RANDMMAP
+	bool "Randomize mmap() base"
+	depends on PAX_ASLR
+	help
+	  By saying Y here the kernel will use a randomized base address for
+	  mmap() requests that do not specify one themselves.  As a result
+	  all dynamically loaded libraries will appear at random addresses
+	  and therefore be harder to exploit by a technique where an attacker
+	  attempts to execute library code for his purposes (e.g. spawn a
+	  shell from an exploited program that is running at an elevated
+	  privilege level).
+
+	  Furthermore, if a program is relinked as a dynamic ELF file, its
+	  base address will be randomized as well, completing the full
+	  randomization of the address space layout.  Attacking such programs
+	  becomes a guess game.  You can find an example of doing this at
+	  http://pax.grsecurity.net/et_dyn.tar.gz and practical samples at
+	  http://www.grsecurity.net/grsec-gcc-specs.tar.gz .
+
+	  NOTE: you can use the 'chpax' or 'paxctl' utilities to control this
+	  feature on a per file basis.
+
+endmenu
+
+menu "Miscellaneous hardening features"
+
+config PAX_MEMORY_SANITIZE
+	bool "Sanitize all freed memory"
+	help
+	  By saying Y here the kernel will erase memory pages as soon as they
+	  are freed.  This in turn reduces the lifetime of data stored in the
+	  pages, making it less likely that sensitive information such as
+	  passwords, cryptographic secrets, etc stay in memory for too long.
+
+	  This is especially useful for programs whose runtime is short, long
+	  lived processes and the kernel itself benefit from this as long as
+	  they operate on whole memory pages and ensure timely freeing of pages
+	  that may hold sensitive information.
+
+	  The tradeoff is performance impact, on a single CPU system kernel
+	  compilation sees a 3% slowdown, other systems and workloads may vary
+	  and you are advised to test this feature on your expected workload
+	  before deploying it.
+
+	  Note that this feature does not protect data stored in live pages,
+	  e.g., process memory swapped to disk may stay there for a long time.
+
+config PAX_MEMORY_STACKLEAK
+	bool "Sanitize kernel stack"
+	depends on X86
+	help
+	  By saying Y here the kernel will erase the kernel stack before it
+	  returns from a system call.  This in turn reduces the information
+	  that a kernel stack leak bug can reveal.
+
+	  Note that such a bug can still leak information that was put on
+	  the stack by the current system call (the one eventually triggering
+	  the bug) but traces of earlier system calls on the kernel stack
+	  cannot leak anymore.
+
+	  The tradeoff is performance impact, on a single CPU system kernel
+	  compilation sees a 1% slowdown, other systems and workloads may vary
+	  and you are advised to test this feature on your expected workload
+	  before deploying it.
+
+	  Note: full support for this feature requires gcc with plugin support
+	  so make sure your compiler is at least gcc 4.5.0 (cross compilation
+	  is not supported).  Using older gcc versions means that functions
+	  with large enough stack frames may leave uninitialized memory behind
+	  that may be exposed to a later syscall leaking the stack.
+
+config PAX_MEMORY_UDEREF
+	bool "Prevent invalid userland pointer dereference"
+	depends on X86 && !UML_X86 && !XEN
+	select PAX_PER_CPU_PGD if X86_64
+	help
+	  By saying Y here the kernel will be prevented from dereferencing
+	  userland pointers in contexts where the kernel expects only kernel
+	  pointers.  This is both a useful runtime debugging feature and a
+	  security measure that prevents exploiting a class of kernel bugs.
+
+	  The tradeoff is that some virtualization solutions may experience
+	  a huge slowdown and therefore you should not enable this feature
+	  for kernels meant to run in such environments.  Whether a given VM
+	  solution is affected or not is best determined by simply trying it
+	  out, the performance impact will be obvious right on boot as this
+	  mechanism engages from very early on.  A good rule of thumb is that
+	  VMs running on CPUs without hardware virtualization support (i.e.,
+	  the majority of IA-32 CPUs) will likely experience the slowdown.
+
+config PAX_REFCOUNT
+	bool "Prevent various kernel object reference counter overflows"
+	depends on GRKERNSEC && (X86 || SPARC64)
+	help
+	  By saying Y here the kernel will detect and prevent overflowing
+	  various (but not all) kinds of object reference counters.  Such
+	  overflows can normally occur due to bugs only and are often, if
+	  not always, exploitable.
+
+	  The tradeoff is that data structures protected by an overflowed
+	  refcount will never be freed and therefore will leak memory.  Note
+	  that this leak also happens even without this protection but in
+	  that case the overflow can eventually trigger the freeing of the
+	  data structure while it is still being used elsewhere, resulting
+	  in the exploitable situation that this feature prevents.
+
+	  Since this has a negligible performance impact, you should enable
+	  this feature.
+
+config PAX_USERCOPY
+	bool "Harden heap object copies between kernel and userland"
+	depends on X86 || PPC || SPARC || ARM
+	depends on GRKERNSEC && (SLAB || SLUB || SLOB)
+	help
+	  By saying Y here the kernel will enforce the size of heap objects
+	  when they are copied in either direction between the kernel and
+	  userland, even if only a part of the heap object is copied.
+
+	  Specifically, this checking prevents information leaking from the
+	  kernel heap during kernel to userland copies (if the kernel heap
+	  object is otherwise fully initialized) and prevents kernel heap
+	  overflows during userland to kernel copies.
+
+	  Note that the current implementation provides the strictest bounds
+	  checks for the SLUB allocator.
+
+	  Enabling this option also enables per-slab cache protection against
+	  data in a given cache being copied into/out of via userland
+	  accessors.  Though the whitelist of regions will be reduced over
+	  time, it notably protects important data structures like task structs.
+
+
+	  If frame pointers are enabled on x86, this option will also
+	  restrict copies into and out of the kernel stack to local variables
+	  within a single frame.
+
+	  Since this has a negligible performance impact, you should enable
+	  this feature.
+
+endmenu
+
+endmenu
+
 config KEYS
 	bool "Enable access key retention support"
 	help
@@ -146,7 +695,7 @@
 config LSM_MMAP_MIN_ADDR
 	int "Low address space for LSM to protect from user allocation"
 	depends on SECURITY && SECURITY_SELINUX
-	default 65536
+	default 32768
 	help
 	  This is the portion of low virtual memory which should be protected
 	  from userspace allocation.  Keeping a user from writing to low pages
diff -uriN linux-2.6.32.43/security/keys/keyring.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/keys/keyring.c
--- linux-2.6.32.43/security/keys/keyring.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/keys/keyring.c	2011-07-15 05:51:19.000000000 -0500
@@ -214,15 +214,15 @@
 			ret = -EFAULT;
 
 			for (loop = 0; loop < klist->nkeys; loop++) {
+				key_serial_t serial;
 				key = klist->keys[loop];
+				serial = key->serial;
 
 				tmp = sizeof(key_serial_t);
 				if (tmp > buflen)
 					tmp = buflen;
 
-				if (copy_to_user(buffer,
-						 &key->serial,
-						 tmp) != 0)
+				if (copy_to_user(buffer, &serial, tmp))
 					goto error;
 
 				buflen -= tmp;
diff -uriN linux-2.6.32.43/security/min_addr.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/min_addr.c
--- linux-2.6.32.43/security/min_addr.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/min_addr.c	2011-07-15 05:51:19.000000000 -0500
@@ -14,6 +14,7 @@
  */
 static void update_mmap_min_addr(void)
 {
+#ifndef SPARC
 #ifdef CONFIG_LSM_MMAP_MIN_ADDR
 	if (dac_mmap_min_addr > CONFIG_LSM_MMAP_MIN_ADDR)
 		mmap_min_addr = dac_mmap_min_addr;
@@ -22,6 +23,7 @@
 #else
 	mmap_min_addr = dac_mmap_min_addr;
 #endif
+#endif
 }
 
 /*
diff -uriN linux-2.6.32.43/security/root_plug.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/root_plug.c
--- linux-2.6.32.43/security/root_plug.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/root_plug.c	2011-07-15 05:51:19.000000000 -0500
@@ -70,7 +70,7 @@
 	return 0;
 }
 
-static struct security_operations rootplug_security_ops = {
+static struct security_operations rootplug_security_ops __read_only = {
 	.bprm_check_security =		rootplug_bprm_check_security,
 };
 
diff -uriN linux-2.6.32.43/security/security.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/security.c
--- linux-2.6.32.43/security/security.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/security.c	2011-07-15 05:51:19.000000000 -0500
@@ -24,7 +24,7 @@
 extern struct security_operations default_security_ops;
 extern void security_fixup_ops(struct security_operations *ops);
 
-struct security_operations *security_ops;	/* Initialized to NULL */
+struct security_operations *security_ops __read_only; /* Initialized to NULL */
 
 static inline int verify(struct security_operations *ops)
 {
@@ -106,7 +106,7 @@
  * If there is already a security module registered with the kernel,
  * an error will be returned.  Otherwise %0 is returned on success.
  */
-int register_security(struct security_operations *ops)
+int __init register_security(struct security_operations *ops)
 {
 	if (verify(ops)) {
 		printk(KERN_DEBUG "%s could not verify "
diff -uriN linux-2.6.32.43/security/selinux/hooks.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/hooks.c
--- linux-2.6.32.43/security/selinux/hooks.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/hooks.c	2011-07-15 05:51:19.000000000 -0500
@@ -64,7 +64,6 @@
 #include <linux/dccp.h>
 #include <linux/quota.h>
 #include <linux/un.h>		/* for Unix socket types */
-#include <net/af_unix.h>	/* for Unix socket types */
 #include <linux/parser.h>
 #include <linux/nfs_mount.h>
 #include <net/ipv6.h>
@@ -131,7 +130,7 @@
  * Minimal support for a secondary security module,
  * just to allow the use of the capability module.
  */
-static struct security_operations *secondary_ops;
+static struct security_operations *secondary_ops __read_only;
 
 /* Lists of inode and superblock security structures initialized
    before the policy was loaded. */
@@ -5457,7 +5456,7 @@
 
 #endif
 
-static struct security_operations selinux_ops = {
+static struct security_operations selinux_ops __read_only = {
 	.name =				"selinux",
 
 	.ptrace_access_check =		selinux_ptrace_access_check,
@@ -5841,7 +5840,9 @@
 	avc_disable();
 
 	/* Reset security_ops to the secondary module, dummy or capability. */
+	pax_open_kernel();
 	security_ops = secondary_ops;
+	pax_close_kernel();
 
 	/* Unregister netfilter hooks. */
 	selinux_nf_ip_exit();
diff -uriN linux-2.6.32.43/security/selinux/include/av_permissions.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/include/av_permissions.h
--- linux-2.6.32.43/security/selinux/include/av_permissions.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/include/av_permissions.h	2011-07-15 05:50:11.000000000 -0500
@@ -565,6 +565,7 @@
 #define CAPABILITY__SETFCAP                       0x80000000UL
 #define CAPABILITY2__MAC_OVERRIDE                 0x00000001UL
 #define CAPABILITY2__MAC_ADMIN                    0x00000002UL
+#define CAPABILITY2__CONTEXT                      0x00000004UL
 #define NETLINK_ROUTE_SOCKET__IOCTL               0x00000001UL
 #define NETLINK_ROUTE_SOCKET__READ                0x00000002UL
 #define NETLINK_ROUTE_SOCKET__WRITE               0x00000004UL
diff -uriN linux-2.6.32.43/security/selinux/include/av_perm_to_string.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/include/av_perm_to_string.h
--- linux-2.6.32.43/security/selinux/include/av_perm_to_string.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/include/av_perm_to_string.h	2011-07-15 05:50:11.000000000 -0500
@@ -142,6 +142,7 @@
    S_(SECCLASS_CAPABILITY, CAPABILITY__SETFCAP, "setfcap")
    S_(SECCLASS_CAPABILITY2, CAPABILITY2__MAC_OVERRIDE, "mac_override")
    S_(SECCLASS_CAPABILITY2, CAPABILITY2__MAC_ADMIN, "mac_admin")
+   S_(SECCLASS_CAPABILITY2, CAPABILITY2__CONTEXT, "context")
    S_(SECCLASS_NETLINK_ROUTE_SOCKET, NETLINK_ROUTE_SOCKET__NLMSG_READ, "nlmsg_read")
    S_(SECCLASS_NETLINK_ROUTE_SOCKET, NETLINK_ROUTE_SOCKET__NLMSG_WRITE, "nlmsg_write")
    S_(SECCLASS_NETLINK_FIREWALL_SOCKET, NETLINK_FIREWALL_SOCKET__NLMSG_READ, "nlmsg_read")
diff -uriN linux-2.6.32.43/security/selinux/include/xfrm.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/include/xfrm.h
--- linux-2.6.32.43/security/selinux/include/xfrm.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/include/xfrm.h	2011-07-15 05:51:19.000000000 -0500
@@ -48,7 +48,7 @@
 
 static inline void selinux_xfrm_notify_policyload(void)
 {
-	atomic_inc(&flow_cache_genid);
+	atomic_inc_unchecked(&flow_cache_genid);
 }
 #else
 static inline int selinux_xfrm_enabled(void)
diff -uriN linux-2.6.32.43/security/selinux/ss/services.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/ss/services.c
--- linux-2.6.32.43/security/selinux/ss/services.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/selinux/ss/services.c	2011-07-15 05:51:19.000000000 -0500
@@ -1715,6 +1715,8 @@
 	int rc = 0;
 	struct policy_file file = { data, len }, *fp = &file;
 
+	pax_track_stack();
+
 	if (!ss_initialized) {
 		avtab_cache_init();
 		if (policydb_read(&policydb, fp)) {
diff -uriN linux-2.6.32.43/security/smack/smack_lsm.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/smack/smack_lsm.c
--- linux-2.6.32.43/security/smack/smack_lsm.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/smack/smack_lsm.c	2011-07-15 05:51:19.000000000 -0500
@@ -3073,7 +3073,7 @@
 	return 0;
 }
 
-struct security_operations smack_ops = {
+struct security_operations smack_ops __read_only = {
 	.name =				"smack",
 
 	.ptrace_access_check =		smack_ptrace_access_check,
diff -uriN linux-2.6.32.43/security/tomoyo/tomoyo.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/tomoyo/tomoyo.c
--- linux-2.6.32.43/security/tomoyo/tomoyo.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/security/tomoyo/tomoyo.c	2011-07-15 05:51:19.000000000 -0500
@@ -275,7 +275,7 @@
  * tomoyo_security_ops is a "struct security_operations" which is used for
  * registering TOMOYO.
  */
-static struct security_operations tomoyo_security_ops = {
+static struct security_operations tomoyo_security_ops __read_only = {
 	.name                = "tomoyo",
 	.cred_alloc_blank    = tomoyo_cred_alloc_blank,
 	.cred_prepare        = tomoyo_cred_prepare,
diff -uriN linux-2.6.32.43/sound/aoa/codecs/onyx.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/aoa/codecs/onyx.c
--- linux-2.6.32.43/sound/aoa/codecs/onyx.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/aoa/codecs/onyx.c	2011-07-15 05:51:19.000000000 -0500
@@ -53,7 +53,7 @@
 				spdif_locked:1,
 				analog_locked:1,
 				original_mute:2;
-	int			open_count;
+	local_t			open_count;
 	struct codec_info	*codec_info;
 
 	/* mutex serializes concurrent access to the device
@@ -752,7 +752,7 @@
 	struct onyx *onyx = cii->codec_data;
 
 	mutex_lock(&onyx->mutex);
-	onyx->open_count++;
+	local_inc(&onyx->open_count);
 	mutex_unlock(&onyx->mutex);
 
 	return 0;
@@ -764,8 +764,7 @@
 	struct onyx *onyx = cii->codec_data;
 
 	mutex_lock(&onyx->mutex);
-	onyx->open_count--;
-	if (!onyx->open_count)
+	if (local_dec_and_test(&onyx->open_count))
 		onyx->spdif_locked = onyx->analog_locked = 0;
 	mutex_unlock(&onyx->mutex);
 
diff -uriN linux-2.6.32.43/sound/aoa/codecs/onyx.h linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/aoa/codecs/onyx.h
--- linux-2.6.32.43/sound/aoa/codecs/onyx.h	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/aoa/codecs/onyx.h	2011-07-15 05:51:19.000000000 -0500
@@ -11,6 +11,7 @@
 #include <linux/i2c.h>
 #include <asm/pmac_low_i2c.h>
 #include <asm/prom.h>
+#include <asm/local.h>
 
 /* PCM3052 register definitions */
 
diff -uriN linux-2.6.32.43/sound/drivers/mts64.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/drivers/mts64.c
--- linux-2.6.32.43/sound/drivers/mts64.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/drivers/mts64.c	2011-07-15 05:51:19.000000000 -0500
@@ -27,6 +27,7 @@
 #include <sound/initval.h>
 #include <sound/rawmidi.h>
 #include <sound/control.h>
+#include <asm/local.h>
 
 #define CARD_NAME "Miditerminal 4140"
 #define DRIVER_NAME "MTS64"
@@ -65,7 +66,7 @@
 	struct pardevice *pardev;
 	int pardev_claimed;
 
-	int open_count;
+	local_t open_count;
 	int current_midi_output_port;
 	int current_midi_input_port;
 	u8 mode[MTS64_NUM_INPUT_PORTS];
@@ -695,7 +696,7 @@
 {
 	struct mts64 *mts = substream->rmidi->private_data;
 
-	if (mts->open_count == 0) {
+	if (local_read(&mts->open_count) == 0) {
 		/* We don't need a spinlock here, because this is just called 
 		   if the device has not been opened before. 
 		   So there aren't any IRQs from the device */
@@ -703,7 +704,7 @@
 
 		msleep(50);
 	}
-	++(mts->open_count);
+	local_inc(&mts->open_count);
 
 	return 0;
 }
@@ -713,8 +714,7 @@
 	struct mts64 *mts = substream->rmidi->private_data;
 	unsigned long flags;
 
-	--(mts->open_count);
-	if (mts->open_count == 0) {
+	if (local_dec_return(&mts->open_count) == 0) {
 		/* We need the spinlock_irqsave here because we can still
 		   have IRQs at this point */
 		spin_lock_irqsave(&mts->lock, flags);
@@ -723,8 +723,8 @@
 
 		msleep(500);
 
-	} else if (mts->open_count < 0)
-		mts->open_count = 0;
+	} else if (local_read(&mts->open_count) < 0)
+		local_set(&mts->open_count, 0);
 
 	return 0;
 }
diff -uriN linux-2.6.32.43/sound/drivers/portman2x4.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/drivers/portman2x4.c
--- linux-2.6.32.43/sound/drivers/portman2x4.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/drivers/portman2x4.c	2011-07-15 05:51:19.000000000 -0500
@@ -46,6 +46,7 @@
 #include <sound/initval.h>
 #include <sound/rawmidi.h>
 #include <sound/control.h>
+#include <asm/local.h>
 
 #define CARD_NAME "Portman 2x4"
 #define DRIVER_NAME "portman"
@@ -83,7 +84,7 @@
 	struct pardevice *pardev;
 	int pardev_claimed;
 
-	int open_count;
+	local_t open_count;
 	int mode[PORTMAN_NUM_INPUT_PORTS];
 	struct snd_rawmidi_substream *midi_input[PORTMAN_NUM_INPUT_PORTS];
 };
diff -uriN linux-2.6.32.43/sound/oss/sb_audio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/oss/sb_audio.c
--- linux-2.6.32.43/sound/oss/sb_audio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/oss/sb_audio.c	2011-07-15 05:51:19.000000000 -0500
@@ -901,7 +901,7 @@
 		buf16 = (signed short *)(localbuf + localoffs);
 		while (c)
 		{
-			locallen = (c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
+			locallen = ((unsigned)c >= LBUFCOPYSIZE ? LBUFCOPYSIZE : c);
 			if (copy_from_user(lbuf8,
 					   userbuf+useroffs + p,
 					   locallen))
diff -uriN linux-2.6.32.43/sound/oss/swarm_cs4297a.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/oss/swarm_cs4297a.c
--- linux-2.6.32.43/sound/oss/swarm_cs4297a.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/oss/swarm_cs4297a.c	2011-07-15 05:51:19.000000000 -0500
@@ -2577,7 +2577,6 @@
 {
 	struct cs4297a_state *s;
 	u32 pwr, id;
-	mm_segment_t fs;
 	int rval;
 #ifndef CONFIG_BCM_CS4297A_CSWARM
 	u64 cfg;
@@ -2667,22 +2666,23 @@
         if (!rval) {
 		char *sb1250_duart_present;
 
+#if 0
+                mm_segment_t fs;
                 fs = get_fs();
                 set_fs(KERNEL_DS);
-#if 0
                 val = SOUND_MASK_LINE;
                 mixer_ioctl(s, SOUND_MIXER_WRITE_RECSRC, (unsigned long) &val);
                 for (i = 0; i < ARRAY_SIZE(initvol); i++) {
                         val = initvol[i].vol;
                         mixer_ioctl(s, initvol[i].mixch, (unsigned long) &val);
                 }
+                set_fs(fs);
 //                cs4297a_write_ac97(s, 0x18, 0x0808);
 #else
                 //                cs4297a_write_ac97(s, 0x5e, 0x180);
                 cs4297a_write_ac97(s, 0x02, 0x0808);
                 cs4297a_write_ac97(s, 0x18, 0x0808);
 #endif
-                set_fs(fs);
 
                 list_add(&s->list, &cs4297a_devs);
 
diff -uriN linux-2.6.32.43/sound/pci/ac97/ac97_codec.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/ac97/ac97_codec.c
--- linux-2.6.32.43/sound/pci/ac97/ac97_codec.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/ac97/ac97_codec.c	2011-07-15 05:51:19.000000000 -0500
@@ -1952,7 +1952,7 @@
 }
 
 /* build_ops to do nothing */
-static struct snd_ac97_build_ops null_build_ops;
+static const struct snd_ac97_build_ops null_build_ops;
 
 #ifdef CONFIG_SND_AC97_POWER_SAVE
 static void do_update_power(struct work_struct *work)
diff -uriN linux-2.6.32.43/sound/pci/ac97/ac97_patch.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/ac97/ac97_patch.c
--- linux-2.6.32.43/sound/pci/ac97/ac97_patch.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/ac97/ac97_patch.c	2011-07-15 05:51:19.000000000 -0500
@@ -371,7 +371,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
+static const struct snd_ac97_build_ops patch_yamaha_ymf743_ops = {
 	.build_spdif	= patch_yamaha_ymf743_build_spdif,
 	.build_3d	= patch_yamaha_ymf7x3_3d,
 };
@@ -455,7 +455,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
+static const struct snd_ac97_build_ops patch_yamaha_ymf753_ops = {
 	.build_3d	= patch_yamaha_ymf7x3_3d,
 	.build_post_spdif = patch_yamaha_ymf753_post_spdif
 };
@@ -502,7 +502,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
+static const struct snd_ac97_build_ops patch_wolfson_wm9703_ops = {
 	.build_specific = patch_wolfson_wm9703_specific,
 };
 
@@ -533,7 +533,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
+static const struct snd_ac97_build_ops patch_wolfson_wm9704_ops = {
 	.build_specific = patch_wolfson_wm9704_specific,
 };
 
@@ -555,7 +555,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
+static const struct snd_ac97_build_ops patch_wolfson_wm9705_ops = {
 	.build_specific = patch_wolfson_wm9705_specific,
 };
 
@@ -692,7 +692,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
+static const struct snd_ac97_build_ops patch_wolfson_wm9711_ops = {
 	.build_specific = patch_wolfson_wm9711_specific,
 };
 
@@ -886,7 +886,7 @@
 }
 #endif
 
-static struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
+static const struct snd_ac97_build_ops patch_wolfson_wm9713_ops = {
 	.build_specific = patch_wolfson_wm9713_specific,
 	.build_3d = patch_wolfson_wm9713_3d,
 #ifdef CONFIG_PM	
@@ -991,7 +991,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
+static const struct snd_ac97_build_ops patch_sigmatel_stac9700_ops = {
 	.build_3d	= patch_sigmatel_stac9700_3d,
 	.build_specific	= patch_sigmatel_stac97xx_specific
 };
@@ -1038,7 +1038,7 @@
 	return patch_sigmatel_stac97xx_specific(ac97);
 }
 
-static struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
+static const struct snd_ac97_build_ops patch_sigmatel_stac9708_ops = {
 	.build_3d	= patch_sigmatel_stac9708_3d,
 	.build_specific	= patch_sigmatel_stac9708_specific
 };
@@ -1267,7 +1267,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
+static const struct snd_ac97_build_ops patch_sigmatel_stac9758_ops = {
 	.build_3d	= patch_sigmatel_stac9700_3d,
 	.build_specific	= patch_sigmatel_stac9758_specific
 };
@@ -1342,7 +1342,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_cirrus_ops = {
+static const struct snd_ac97_build_ops patch_cirrus_ops = {
 	.build_spdif = patch_cirrus_build_spdif
 };
 
@@ -1399,7 +1399,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_conexant_ops = {
+static const struct snd_ac97_build_ops patch_conexant_ops = {
 	.build_spdif = patch_conexant_build_spdif
 };
 
@@ -1575,7 +1575,7 @@
 	}
 }
 
-static struct snd_ac97_build_ops patch_ad1881_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1881_build_ops = {
 #ifdef CONFIG_PM
 	.resume = ad18xx_resume
 #endif
@@ -1662,7 +1662,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_ad1885_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1885_build_ops = {
 	.build_specific = &patch_ad1885_specific,
 #ifdef CONFIG_PM
 	.resume = ad18xx_resume
@@ -1689,7 +1689,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_ad1886_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1886_build_ops = {
 	.build_specific = &patch_ad1886_specific,
 #ifdef CONFIG_PM
 	.resume = ad18xx_resume
@@ -1896,7 +1896,7 @@
 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
 }
 
-static struct snd_ac97_build_ops patch_ad1981a_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1981a_build_ops = {
 	.build_post_spdif = patch_ad198x_post_spdif,
 	.build_specific = patch_ad1981a_specific,
 #ifdef CONFIG_PM
@@ -1951,7 +1951,7 @@
 				    ARRAY_SIZE(snd_ac97_ad1981x_jack_sense));
 }
 
-static struct snd_ac97_build_ops patch_ad1981b_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1981b_build_ops = {
 	.build_post_spdif = patch_ad198x_post_spdif,
 	.build_specific = patch_ad1981b_specific,
 #ifdef CONFIG_PM
@@ -2090,7 +2090,7 @@
 	return patch_build_controls(ac97, snd_ac97_ad1888_controls, ARRAY_SIZE(snd_ac97_ad1888_controls));
 }
 
-static struct snd_ac97_build_ops patch_ad1888_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1888_build_ops = {
 	.build_post_spdif = patch_ad198x_post_spdif,
 	.build_specific = patch_ad1888_specific,
 #ifdef CONFIG_PM
@@ -2139,7 +2139,7 @@
 	return patch_build_controls(ac97, &snd_ac97_ad198x_2cmic, 1);
 }
 
-static struct snd_ac97_build_ops patch_ad1980_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1980_build_ops = {
 	.build_post_spdif = patch_ad198x_post_spdif,
 	.build_specific = patch_ad1980_specific,
 #ifdef CONFIG_PM
@@ -2254,7 +2254,7 @@
 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
 }
 
-static struct snd_ac97_build_ops patch_ad1985_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1985_build_ops = {
 	.build_post_spdif = patch_ad198x_post_spdif,
 	.build_specific = patch_ad1985_specific,
 #ifdef CONFIG_PM
@@ -2546,7 +2546,7 @@
 				    ARRAY_SIZE(snd_ac97_ad1985_controls));
 }
 
-static struct snd_ac97_build_ops patch_ad1986_build_ops = {
+static const struct snd_ac97_build_ops patch_ad1986_build_ops = {
 	.build_post_spdif = patch_ad198x_post_spdif,
 	.build_specific = patch_ad1986_specific,
 #ifdef CONFIG_PM
@@ -2651,7 +2651,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_alc650_ops = {
+static const struct snd_ac97_build_ops patch_alc650_ops = {
 	.build_specific	= patch_alc650_specific,
 	.update_jacks = alc650_update_jacks
 };
@@ -2803,7 +2803,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_alc655_ops = {
+static const struct snd_ac97_build_ops patch_alc655_ops = {
 	.build_specific	= patch_alc655_specific,
 	.update_jacks = alc655_update_jacks
 };
@@ -2915,7 +2915,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_alc850_ops = {
+static const struct snd_ac97_build_ops patch_alc850_ops = {
 	.build_specific	= patch_alc850_specific,
 	.update_jacks = alc850_update_jacks
 };
@@ -2977,7 +2977,7 @@
 	return patch_build_controls(ac97, snd_ac97_cm9738_controls, ARRAY_SIZE(snd_ac97_cm9738_controls));
 }
 
-static struct snd_ac97_build_ops patch_cm9738_ops = {
+static const struct snd_ac97_build_ops patch_cm9738_ops = {
 	.build_specific	= patch_cm9738_specific,
 	.update_jacks = cm9738_update_jacks
 };
@@ -3068,7 +3068,7 @@
 	return patch_build_controls(ac97, snd_ac97_cm9739_controls_spdif, ARRAY_SIZE(snd_ac97_cm9739_controls_spdif));
 }
 
-static struct snd_ac97_build_ops patch_cm9739_ops = {
+static const struct snd_ac97_build_ops patch_cm9739_ops = {
 	.build_specific	= patch_cm9739_specific,
 	.build_post_spdif = patch_cm9739_post_spdif,
 	.update_jacks = cm9739_update_jacks
@@ -3242,7 +3242,7 @@
 	return patch_build_controls(ac97, snd_ac97_cm9761_controls, ARRAY_SIZE(snd_ac97_cm9761_controls));
 }
 
-static struct snd_ac97_build_ops patch_cm9761_ops = {
+static const struct snd_ac97_build_ops patch_cm9761_ops = {
 	.build_specific	= patch_cm9761_specific,
 	.build_post_spdif = patch_cm9761_post_spdif,
 	.update_jacks = cm9761_update_jacks
@@ -3338,7 +3338,7 @@
 	return patch_build_controls(ac97, cm9780_controls, ARRAY_SIZE(cm9780_controls));
 }
 
-static struct snd_ac97_build_ops patch_cm9780_ops = {
+static const struct snd_ac97_build_ops patch_cm9780_ops = {
 	.build_specific	= patch_cm9780_specific,
 	.build_post_spdif = patch_cm9761_post_spdif	/* identical with CM9761 */
 };
@@ -3458,7 +3458,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_vt1616_ops = {
+static const struct snd_ac97_build_ops patch_vt1616_ops = {
 	.build_specific	= patch_vt1616_specific
 };
 
@@ -3812,7 +3812,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_it2646_ops = {
+static const struct snd_ac97_build_ops patch_it2646_ops = {
 	.build_specific	= patch_it2646_specific,
 	.update_jacks = it2646_update_jacks
 };
@@ -3846,7 +3846,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_si3036_ops = {
+static const struct snd_ac97_build_ops patch_si3036_ops = {
 	.build_specific	= patch_si3036_specific,
 };
 
@@ -3913,7 +3913,7 @@
 	return 0;
 }
 
-static struct snd_ac97_build_ops patch_ucb1400_ops = {
+static const struct snd_ac97_build_ops patch_ucb1400_ops = {
 	.build_specific	= patch_ucb1400_specific,
 };
 
diff -uriN linux-2.6.32.43/sound/pci/hda/patch_intelhdmi.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/hda/patch_intelhdmi.c
--- linux-2.6.32.43/sound/pci/hda/patch_intelhdmi.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/hda/patch_intelhdmi.c	2011-07-15 05:51:19.000000000 -0500
@@ -511,10 +511,10 @@
 		cp_ready);
 
 	/* TODO */
-	if (cp_state)
-		;
-	if (cp_ready)
-		;
+	if (cp_state) {
+	}
+	if (cp_ready) {
+	}
 }
 
 
diff -uriN linux-2.6.32.43/sound/pci/intel8x0m.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/intel8x0m.c
--- linux-2.6.32.43/sound/pci/intel8x0m.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/intel8x0m.c	2011-07-15 05:51:19.000000000 -0500
@@ -1264,7 +1264,7 @@
 	{ 0x5455, "ALi M5455" },
 	{ 0x746d, "AMD AMD8111" },
 #endif
-	{ 0 },
+	{ 0, },
 };
 
 static int __devinit snd_intel8x0m_probe(struct pci_dev *pci,
diff -uriN linux-2.6.32.43/sound/pci/ymfpci/ymfpci_main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/ymfpci/ymfpci_main.c
--- linux-2.6.32.43/sound/pci/ymfpci/ymfpci_main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/sound/pci/ymfpci/ymfpci_main.c	2011-07-15 05:51:26.000000000 -0500
@@ -202,8 +202,8 @@
 		if ((snd_ymfpci_readl(chip, YDSXGR_STATUS) & 2) == 0)
 			break;
 	}
-	if (atomic_read(&chip->interrupt_sleep_count)) {
-		atomic_set(&chip->interrupt_sleep_count, 0);
+	if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
+		atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
 		wake_up(&chip->interrupt_sleep);
 	}
       __end:
@@ -787,7 +787,7 @@
 		 	continue;
 		init_waitqueue_entry(&wait, current);
 		add_wait_queue(&chip->interrupt_sleep, &wait);
-		atomic_inc(&chip->interrupt_sleep_count);
+		atomic_inc_unchecked(&chip->interrupt_sleep_count);
 		schedule_timeout_uninterruptible(msecs_to_jiffies(50));
 		remove_wait_queue(&chip->interrupt_sleep, &wait);
 	}
@@ -825,8 +825,8 @@
 		snd_ymfpci_writel(chip, YDSXGR_MODE, mode);
 		spin_unlock(&chip->reg_lock);
 
-		if (atomic_read(&chip->interrupt_sleep_count)) {
-			atomic_set(&chip->interrupt_sleep_count, 0);
+		if (atomic_read_unchecked(&chip->interrupt_sleep_count)) {
+			atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
 			wake_up(&chip->interrupt_sleep);
 		}
 	}
@@ -2369,7 +2369,7 @@
 	spin_lock_init(&chip->reg_lock);
 	spin_lock_init(&chip->voice_lock);
 	init_waitqueue_head(&chip->interrupt_sleep);
-	atomic_set(&chip->interrupt_sleep_count, 0);
+	atomic_set_unchecked(&chip->interrupt_sleep_count, 0);
 	chip->card = card;
 	chip->pci = pci;
 	chip->irq = -1;
diff -uriN linux-2.6.32.43/tools/gcc/Makefile linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/tools/gcc/Makefile
--- linux-2.6.32.43/tools/gcc/Makefile	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/tools/gcc/Makefile	2011-07-15 05:51:26.000000000 -0500
@@ -0,0 +1,11 @@
+#CC := gcc
+#PLUGIN_SOURCE_FILES := pax_plugin.c
+#PLUGIN_OBJECT_FILES := $(patsubst %.c,%.o,$(PLUGIN_SOURCE_FILES))
+GCCPLUGINS_DIR := $(shell $(HOSTCC) -print-file-name=plugin)
+#CFLAGS += -I$(GCCPLUGINS_DIR)/include -fPIC -O2 -Wall -W
+
+HOST_EXTRACFLAGS += -I$(GCCPLUGINS_DIR)/include
+
+hostlibs-y := pax_plugin.so
+always := $(hostlibs-y)
+pax_plugin-objs := pax_plugin.o
diff -uriN linux-2.6.32.43/tools/gcc/pax_plugin.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/tools/gcc/pax_plugin.c
--- linux-2.6.32.43/tools/gcc/pax_plugin.c	1969-12-31 18:00:00.000000000 -0600
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/tools/gcc/pax_plugin.c	2011-07-15 05:51:26.000000000 -0500
@@ -0,0 +1,243 @@
+/*
+ * Copyright 2011 by the PaX Team <pageexec@freemail.hu>
+ * Licensed under the GPL v2
+ *
+ * Note: the choice of the license means that the compilation process is
+ *       NOT 'eligible' as defined by gcc's library exception to the GPL v3,
+ *       but for the kernel it doesn't matter since it doesn't link against
+ *       any of the gcc libraries
+ *
+ * gcc plugin to help implement various PaX features
+ *
+ * - track lowest stack pointer
+ *
+ * TODO:
+ * - initialize all local variables
+ *
+ * BUGS:
+ * - cloned functions are instrumented twice
+ */
+#include "gcc-plugin.h"
+#include "plugin-version.h"
+#include "config.h"
+#include "system.h"
+#include "coretypes.h"
+#include "tm.h"
+#include "toplev.h"
+#include "basic-block.h"
+#include "gimple.h"
+//#include "expr.h" where are you...
+#include "diagnostic.h"
+#include "rtl.h"
+#include "emit-rtl.h"
+#include "function.h"
+#include "tree.h"
+#include "tree-pass.h"
+#include "intl.h"
+
+int plugin_is_GPL_compatible;
+
+static int track_frame_size = -1;
+static const char track_function[] = "pax_track_stack";
+static bool init_locals;
+
+static struct plugin_info pax_plugin_info = {
+	.version	= "201106030000",
+	.help		= "track-lowest-sp=nn\ttrack sp in functions whose frame size is at least nn bytes\n"
+//			  "initialize-locals\t\tforcibly initialize all stack frames\n"
+};
+
+static bool gate_pax_track_stack(void);
+static unsigned int execute_pax_tree_instrument(void);
+static unsigned int execute_pax_final(void);
+
+static struct gimple_opt_pass pax_tree_instrument_pass = {
+	.pass = {
+		.type			= GIMPLE_PASS,
+		.name			= "pax_tree_instrument",
+		.gate			= gate_pax_track_stack,
+		.execute		= execute_pax_tree_instrument,
+		.sub			= NULL,
+		.next			= NULL,
+		.static_pass_number	= 0,
+		.tv_id			= TV_NONE,
+		.properties_required	= PROP_gimple_leh | PROP_cfg,
+		.properties_provided	= 0,
+		.properties_destroyed	= 0,
+		.todo_flags_start	= 0, //TODO_verify_ssa | TODO_verify_flow | TODO_verify_stmts,
+		.todo_flags_finish	= TODO_verify_stmts // | TODO_dump_func
+	}
+};
+
+static struct rtl_opt_pass pax_final_rtl_opt_pass = {
+	.pass = {
+		.type			= RTL_PASS,
+		.name			= "pax_final",
+		.gate			= gate_pax_track_stack,
+		.execute		= execute_pax_final,
+		.sub			= NULL,
+		.next			= NULL,
+		.static_pass_number	= 0,
+		.tv_id			= TV_NONE,
+		.properties_required	= 0,
+		.properties_provided	= 0,
+		.properties_destroyed	= 0,
+		.todo_flags_start	= 0,
+		.todo_flags_finish	= 0
+	}
+};
+
+static bool gate_pax_track_stack(void)
+{
+	return track_frame_size >= 0;
+}
+
+static void pax_add_instrumentation(gimple_stmt_iterator *gsi, bool before)
+{
+	gimple call;
+	tree decl, type;
+
+	// insert call to void pax_track_stack(void)
+	type = build_function_type_list(void_type_node, NULL_TREE);
+	decl = build_fn_decl(track_function, type);
+	DECL_ASSEMBLER_NAME(decl); // for LTO
+	call = gimple_build_call(decl, 0);
+	if (before)
+		gsi_insert_before(gsi, call, GSI_CONTINUE_LINKING);
+	else
+		gsi_insert_after(gsi, call, GSI_CONTINUE_LINKING);
+}
+
+static unsigned int execute_pax_tree_instrument(void)
+{
+	basic_block bb;
+	gimple_stmt_iterator gsi;
+
+	// 1. loop through BBs and GIMPLE statements
+	FOR_EACH_BB(bb) {
+		for (gsi = gsi_start_bb(bb); !gsi_end_p(gsi); gsi_next(&gsi)) {
+			// gimple match: align 8 built-in BUILT_IN_NORMAL:BUILT_IN_ALLOCA attributes <tree_list 0xb7576450>
+			tree decl;
+			gimple stmt = gsi_stmt(gsi);
+
+			if (!is_gimple_call(stmt))
+				continue;
+			decl = gimple_call_fndecl(stmt);
+			if (!decl)
+				continue;
+			if (TREE_CODE(decl) != FUNCTION_DECL)
+				continue;
+			if (!DECL_BUILT_IN(decl))
+				continue;
+			if (DECL_BUILT_IN_CLASS(decl) != BUILT_IN_NORMAL)
+				continue;
+			if (DECL_FUNCTION_CODE(decl) != BUILT_IN_ALLOCA)
+				continue;
+
+			// 2. insert track call after each __builtin_alloca call
+			pax_add_instrumentation(&gsi, false);
+//			print_node(stderr, "pax", decl, 4);
+		}
+	}
+
+	// 3. insert track call at the beginning
+	bb = ENTRY_BLOCK_PTR_FOR_FUNCTION(cfun)->next_bb;
+	gsi = gsi_start_bb(bb);
+	pax_add_instrumentation(&gsi, true);
+
+	return 0;
+}
+
+static unsigned int execute_pax_final(void)
+{
+	rtx insn;
+
+	if (cfun->calls_alloca)
+		return 0;
+
+	// 1. find pax_track_stack calls
+	for (insn = get_insns(); insn; insn = NEXT_INSN(insn)) {
+		// rtl match: (call_insn 8 7 9 3 (call (mem (symbol_ref ("pax_track_stack") [flags 0x41] <function_decl 0xb7470e80 pax_track_stack>) [0 S1 A8]) (4)) -1 (nil) (nil))
+		rtx body;
+
+		if (!CALL_P(insn))
+			continue;
+		body = PATTERN(insn);
+		if (GET_CODE(body) != CALL)
+			continue;
+		body = XEXP(body, 0);
+		if (GET_CODE(body) != MEM)
+			continue;
+		body = XEXP(body, 0);
+		if (GET_CODE(body) != SYMBOL_REF)
+			continue;
+		if (strcmp(XSTR(body, 0), track_function))
+			continue;
+//		warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
+		// 2. delete call if function frame is not big enough
+		if (get_frame_size() >= track_frame_size)
+			continue;
+		delete_insn_and_edges(insn);
+	}
+
+//	print_simple_rtl(stderr, get_insns());
+//	print_rtl(stderr, get_insns());
+//	warning(0, "track_frame_size: %d %ld %d", cfun->calls_alloca, get_frame_size(), track_frame_size);
+
+	return 0;
+}
+
+int plugin_init(struct plugin_name_args *plugin_info, struct plugin_gcc_version *version)
+{
+	const char * const plugin_name = plugin_info->base_name;
+	const int argc = plugin_info->argc;
+	const struct plugin_argument * const argv = plugin_info->argv;
+	int i;
+	struct register_pass_info pax_tree_instrument_pass_info = {
+		.pass				= &pax_tree_instrument_pass.pass,
+//		.reference_pass_name		= "tree_profile",
+		.reference_pass_name		= "optimized",
+		.ref_pass_instance_number	= 0,
+		.pos_op 			= PASS_POS_INSERT_AFTER
+	};
+	struct register_pass_info pax_final_pass_info = {
+		.pass				= &pax_final_rtl_opt_pass.pass,
+		.reference_pass_name		= "final",
+		.ref_pass_instance_number	= 0,
+		.pos_op 			= PASS_POS_INSERT_BEFORE
+	};
+
+	if (!plugin_default_version_check(version, &gcc_version)) {
+		error(G_("incompatible gcc/plugin versions"));
+		return 1;
+	}
+
+	register_callback(plugin_name, PLUGIN_INFO, NULL, &pax_plugin_info);
+
+	for (i = 0; i < argc; ++i) {
+		if (!strcmp(argv[i].key, "track-lowest-sp")) {
+			if (!argv[i].value) {
+				error(G_("no value supplied for option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
+				continue;
+			}
+			track_frame_size = atoi(argv[i].value);
+			if (argv[i].value[0] < '0' || argv[i].value[0] > '9' || track_frame_size < 0)
+				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
+			continue;
+		}
+		if (!strcmp(argv[i].key, "initialize-locals")) {
+			if (argv[i].value) {
+				error(G_("invalid option argument '-fplugin-arg-%s-%s=%s'"), plugin_name, argv[i].key, argv[i].value);
+				continue;
+			}
+			init_locals = true;
+			continue;
+		}
+		error(G_("unkown option '-fplugin-arg-%s-%s'"), plugin_name, argv[i].key);
+	}
+
+	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &pax_tree_instrument_pass_info);
+	register_callback(plugin_name, PLUGIN_PASS_MANAGER_SETUP, NULL, &pax_final_pass_info);
+
+	return 0;
+}
diff -uriN linux-2.6.32.43/usr/gen_init_cpio.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/usr/gen_init_cpio.c
--- linux-2.6.32.43/usr/gen_init_cpio.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/usr/gen_init_cpio.c	2011-07-15 05:51:26.000000000 -0500
@@ -299,7 +299,7 @@
 	int retval;
 	int rc = -1;
 	int namesize;
-	int i;
+	unsigned int i;
 
 	mode |= S_IFREG;
 
@@ -383,9 +383,10 @@
                        *env_var = *expanded = '\0';
                        strncat(env_var, start + 2, end - start - 2);
                        strncat(expanded, new_location, start - new_location);
-                       strncat(expanded, getenv(env_var), PATH_MAX);
-                       strncat(expanded, end + 1, PATH_MAX);
+                       strncat(expanded, getenv(env_var), PATH_MAX - strlen(expanded));
+                       strncat(expanded, end + 1, PATH_MAX - strlen(expanded));
                        strncpy(new_location, expanded, PATH_MAX);
+                       new_location[PATH_MAX] = 0;
                } else
                        break;
        }
diff -uriN linux-2.6.32.43/virt/kvm/kvm_main.c linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/virt/kvm/kvm_main.c
--- linux-2.6.32.43/virt/kvm/kvm_main.c	2011-07-12 22:29:43.000000000 -0500
+++ linux-2.6.32.43-vs2.3.0.36.29.7-grsec-2.2.2-201107142110/virt/kvm/kvm_main.c	2011-07-15 05:51:26.000000000 -0500
@@ -1748,6 +1748,7 @@
 	return 0;
 }
 
+/* cannot be const */
 static struct file_operations kvm_vcpu_fops = {
 	.release        = kvm_vcpu_release,
 	.unlocked_ioctl = kvm_vcpu_ioctl,
@@ -2344,6 +2345,7 @@
 	return 0;
 }
 
+/* cannot be const */
 static struct file_operations kvm_vm_fops = {
 	.release        = kvm_vm_release,
 	.unlocked_ioctl = kvm_vm_ioctl,
@@ -2431,6 +2433,7 @@
 	return r;
 }
 
+/* cannot be const */
 static struct file_operations kvm_chardev_ops = {
 	.unlocked_ioctl = kvm_dev_ioctl,
 	.compat_ioctl   = kvm_dev_ioctl,
@@ -2494,7 +2497,7 @@
 	if (kvm_rebooting)
 		/* spin while reset goes on */
 		while (true)
-			;
+			cpu_relax();
 	/* Fault while not rebooting.  We want the trace. */
 	BUG();
 }
@@ -2714,7 +2717,7 @@
 	kvm_arch_vcpu_put(vcpu);
 }
 
-int kvm_init(void *opaque, unsigned int vcpu_size,
+int kvm_init(const void *opaque, unsigned int vcpu_size,
 		  struct module *module)
 {
 	int r;
@@ -2767,7 +2770,7 @@
 	/* A kmem cache lets us meet the alignment requirements of fx_save. */
 	kvm_vcpu_cache = kmem_cache_create("kvm_vcpu", vcpu_size,
 					   __alignof__(struct kvm_vcpu),
-					   0, NULL);
+					   SLAB_USERCOPY, NULL);
 	if (!kvm_vcpu_cache) {
 		r = -ENOMEM;
 		goto out_free_5;