[gentoo-commits] hardened r97 - in hardened-sources/2.6/tags: . 2.6.23-7

[Christian Heim (phreak)]

Author: phreak
Date: 2008-04-30 11:42:53 +0000 (Wed, 30 Apr 2008)
New Revision: 97

Added:
   hardened-sources/2.6/tags/2.6.23-7/
   hardened-sources/2.6/tags/2.6.23-7/4405_alpha-sysctl-uac-for-hardened-extras.patch
   hardened-sources/2.6/tags/2.6.23-7/4430_grsec-2.1.11-2.6.23.15-20080210.patch
   hardened-sources/2.6/tags/2.6.23-7/4435_grsec-2.1.10-mute-warnings.patch
   hardened-sources/2.6/tags/2.6.23-7/4440_grsec-2.1.10-pax_curr_ip-fixes.patch
   hardened-sources/2.6/tags/2.6.23-7/4445_grsec-kconfig-gentoo.patch
   hardened-sources/2.6/tags/2.6.23-7/4450_selinux-avc_audit-log-curr_ip.patch
   hardened-sources/2.6/tags/2.6.23-7/4455_disable-compat_vdso.patch
   hardened-sources/2.6/tags/2.6.23-7/4460_pax-hook-build-error.patch
   hardened-sources/2.6/tags/2.6.23-7/4465_acct_stack_growth-null-deref.patch
   hardened-sources/2.6/tags/2.6.23-7/4470_pax-vma-mirroring-fixes.patch
   hardened-sources/2.6/tags/2.6.23-7/4475_vesafb-pmi-kernexec-fix.patch
   hardened-sources/2.6/tags/2.6.23-7/4480_deselect-kernexec-on-unsupported-arches.patch
   hardened-sources/2.6/tags/2.6.23-7/4485_ia64-modular-kernel-compile-fix.patch
   hardened-sources/2.6/tags/2.6.23-7/4490_grsec-ptrace-recursive-lock-fix.patch
   hardened-sources/2.6/tags/2.6.23-7/4495_grsec-netlink-security-fixes.patch
Log:
Importing patchset for 2.6.23-7 (from hardened-patches-2.6.23-7.extras.tar.bz2).

Added: hardened-sources/2.6/tags/2.6.23-7/4405_alpha-sysctl-uac-for-hardened-extras.patch
===================================================================
--- hardened-sources/2.6/tags/2.6.23-7/4405_alpha-sysctl-uac-for-hardened-extras.patch	                        (rev 0)
+++ hardened-sources/2.6/tags/2.6.23-7/4405_alpha-sysctl-uac-for-hardened-extras.patch	2008-04-30 11:42:53 UTC (rev 97)
@@ -0,0 +1,187 @@
+---
+ arch/alpha/Kconfig        |   26 ++++++++++++++++++++++++
+ arch/alpha/kernel/traps.c |   49 ++++++++++++++++++++++++++++++++++++++++++++++
+ include/linux/sysctl.h    |   14 +++++++++++++
+ kernel/sysctl.c           |   12 ++++++++++-
+ 4 files changed, 100 insertions(+), 1 deletion(-)
+
+--- a/arch/alpha/Kconfig
++++ b/arch/alpha/Kconfig
+@@ -616,6 +616,32 @@ config VERBOSE_MCHECK_ON
+ 
+ 	  Take the default (1) unless you want more control or more info.
+ 
++config ALPHA_UAC_SYSCTL
++	bool "Configure UAC policy via sysctl"
++	depends on SYSCTL
++	default y
++	---help---
++	  Configuring the UAC (unaligned access control) policy on a Linux
++	  system usually involves setting a compile time define. If you say
++	  Y here, you will be able to modify the UAC policy at runtime using
++	  the /proc interface.
++
++	  The UAC policy defines the action Linux should take when an
++	  unaligned memory access occurs. The action can include printing a
++	  warning message (NOPRINT), sending a signal to the offending
++	  program to help developers debug their applications (SIGBUS), or
++	  disabling the transparent fixing (NOFIX).
++
++	  The sysctls will be initialized to the compile-time defined UAC
++	  policy. You can change these manually, or with the sysctl(8)
++	  userspace utility.
++
++	  To disable the warning messages at runtime, you would use
++
++	    echo 1 > /proc/sys/kernel/uac/noprint
++
++	  This is pretty harmless. Say Y if you're not sure.
++
+ source "drivers/pci/Kconfig"
+ source "drivers/eisa/Kconfig"
+ 
+--- a/arch/alpha/kernel/traps.c
++++ b/arch/alpha/kernel/traps.c
+@@ -14,6 +14,7 @@
+ #include <linux/delay.h>
+ #include <linux/smp_lock.h>
+ #include <linux/module.h>
++#include <linux/sysctl.h>
+ #include <linux/init.h>
+ #include <linux/kallsyms.h>
+ 
+@@ -102,6 +103,38 @@ static char * ireg_name[] = {"v0", "t0",
+ 			   "t10", "t11", "ra", "pv", "at", "gp", "sp", "zero"};
+ #endif
+ 
++#ifdef CONFIG_ALPHA_UAC_SYSCTL
++static struct ctl_table_header *uac_sysctl_header;
++
++static int enabled_noprint = 0;
++static int enabled_sigbus = 0;
++static int enabled_nofix = 0;
++
++ctl_table uac_table[] = {
++	{KERN_UAC_NOPRINT, "noprint", &enabled_noprint, sizeof (int), 0644, NULL, NULL, &proc_dointvec},
++	{KERN_UAC_SIGBUS, "sigbus", &enabled_sigbus, sizeof (int), 0644, NULL, NULL, &proc_dointvec},
++	{KERN_UAC_NOFIX, "nofix", &enabled_nofix, sizeof (int), 0644, NULL, NULL, &proc_dointvec},
++        {0}
++};
++
++static int __init init_uac_sysctl(void)
++{
++	/* Initialize sysctls with the #defined UAC policy */
++	enabled_noprint = (test_thread_flag (TIF_UAC_NOPRINT)) ? 1 : 0;
++	enabled_sigbus = (test_thread_flag (TIF_UAC_SIGBUS)) ? 1 : 0;
++	enabled_nofix = (test_thread_flag (TIF_UAC_NOFIX)) ? 1 : 0;
++
++	/* save this for later so we can clean up */
++	uac_sysctl_header = register_sysctl_table(uac_table);
++	return 0;
++}
++
++static void __exit exit_uac_sysctl(void)
++{
++	unregister_sysctl_table(uac_sysctl_header);
++}
++#endif
++
+ static void
+ dik_show_code(unsigned int *pc)
+ {
+@@ -780,7 +813,11 @@ do_entUnaUser(void __user * va, unsigned
+ 	/* Check the UAC bits to decide what the user wants us to do
+ 	   with the unaliged access.  */
+ 
++#ifndef CONFIG_ALPHA_UAC_SYSCTL
+ 	if (!test_thread_flag (TIF_UAC_NOPRINT)) {
++#else  /* CONFIG_ALPHA_UAC_SYSCTL */
++	if (!(enabled_noprint)) {
++#endif /* CONFIG_ALPHA_UAC_SYSCTL */
+ 		if (cnt >= 5 && jiffies - last_time > 5*HZ) {
+ 			cnt = 0;
+ 		}
+@@ -791,10 +828,18 @@ do_entUnaUser(void __user * va, unsigned
+ 		}
+ 		last_time = jiffies;
+ 	}
++#ifndef CONFIG_ALPHA_UAC_SYSCTL
+ 	if (test_thread_flag (TIF_UAC_SIGBUS))
++#else  /* CONFIG_ALPHA_UAC_SYSCTL */
++	if (enabled_sigbus)
++#endif /* CONFIG_ALPHA_UAC_SYSCTL */
+ 		goto give_sigbus;
+ 	/* Not sure why you'd want to use this, but... */
++#ifndef CONFIG_ALPHA_UAC_SYSCTL
+ 	if (test_thread_flag (TIF_UAC_NOFIX))
++#else  /* CONFIG_ALPHA_UAC_SYSCTL */
++	if (enabled_nofix)
++#endif /* CONFIG_ALPHA_UAC_SYSCTL */
+ 		return;
+ 
+ 	/* Don't bother reading ds in the access check since we already
+@@ -1089,3 +1134,7 @@ trap_init(void)
+ 	wrent(entSys, 5);
+ 	wrent(entDbg, 6);
+ }
++
++#ifdef CONFIG_ALPHA_UAC_SYSCTL
++__initcall(init_uac_sysctl);
++#endif
+--- a/include/linux/sysctl.h
++++ b/include/linux/sysctl.h
+@@ -165,6 +165,9 @@ enum
+ 	KERN_MAX_LOCK_DEPTH=74,
+ 	KERN_NMI_WATCHDOG=75, /* int: enable/disable nmi watchdog */
+ 	KERN_PANIC_ON_NMI=76, /* int: whether we will panic on an unrecovered */
++#ifdef CONFIG_ALPHA_UAC_SYSCTL
++	KERN_UAC_POLICY=78,	/* int: Alpha unaligned access control policy flags */
++#endif /* CONFIG_ALPHA_UAC_SYSCTL */
+ };
+ 
+ 
+@@ -258,6 +261,17 @@ enum
+ 	PTY_NR=2
+ };
+ 
++#ifdef CONFIG_ALPHA_UAC_SYSCTL
++/* /proc/sys/kernel/uac */
++enum
++{
++	/* UAC policy on Alpha */
++	KERN_UAC_NOPRINT=1,	/* int: printk() on unaligned access */
++	KERN_UAC_SIGBUS=2,	/* int: send SIGBUS on unaligned access */
++	KERN_UAC_NOFIX=3,	/* int: don't fix the unaligned access */
++};
++#endif /* CONFIG_ALPHA_UAC_SYSCTL */
++
+ /* /proc/sys/bus/isa */
+ enum
+ {
+--- a/kernel/sysctl.c
++++ b/kernel/sysctl.c
+@@ -155,6 +155,9 @@ extern ctl_table pty_table[];
+ #ifdef CONFIG_INOTIFY_USER
+ extern ctl_table inotify_table[];
+ #endif
++#ifdef CONFIG_ALPHA_UAC_SYSCTL
++extern ctl_table uac_table[];
++#endif
+ 
+ #ifdef HAVE_ARCH_PICK_MMAP_LAYOUT
+ int sysctl_legacy_va_layout;
+@@ -208,6 +211,14 @@ static ctl_table root_table[] = {
+  * NOTE: do not add new entries to this table unless you have read
+  * Documentation/sysctl/ctl_unnumbered.txt
+  */
++#ifdef CONFIG_ALPHA_UAC_SYSCTL
++	{
++		.ctl_name	= KERN_UAC_POLICY,
++		.procname	= "uac",
++		.mode		= 0555,
++		.child		= uac_table,
++	},
++#endif /* CONFIG_ALPHA_UAC_SYSCTL */
+ 	{ .ctl_name = 0 }
+ };
+ 

Added: hardened-sources/2.6/tags/2.6.23-7/4430_grsec-2.1.11-2.6.23.15-20080210.patch
===================================================================
--- hardened-sources/2.6/tags/2.6.23-7/4430_grsec-2.1.11-2.6.23.15-20080210.patch	                        (rev 0)
+++ hardened-sources/2.6/tags/2.6.23-7/4430_grsec-2.1.11-2.6.23.15-20080210.patch	2008-04-30 11:42:53 UTC (rev 97)
@@ -0,0 +1,35665 @@
+From: Kerin Millar <kerframil@×××××.com>
+
+grsecurity-2.1.11-2.6.23.14-200801231800 forward ported to 2.6.23.15 for
+the Hardened Gentoo project. Thanks to pipacs for some advice concerning
+mmap.c changes.
+
+diff -Nurp linux-2.6.23.15/Documentation/dontdiff linux-2.6.23.15-grsec/Documentation/dontdiff
+--- linux-2.6.23.15/Documentation/dontdiff	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/Documentation/dontdiff	2008-02-11 10:37:44.000000000 +0000
+@@ -176,14 +176,18 @@ times.h*
+ tkparse
+ trix_boot.h
+ utsrelease.h*
++vdso.lds
+ version.h*
+ vmlinux
+ vmlinux-*
+ vmlinux.aout
++vmlinux.bin.all
+ vmlinux.lds
++vmlinux.relocs
+ vsyscall.lds
+ wanxlfw.inc
+ uImage
+ unifdef
++utsrelease.h
+ zImage*
+ zconf.hash.c
+diff -Nurp linux-2.6.23.15/Makefile linux-2.6.23.15-grsec/Makefile
+--- linux-2.6.23.15/Makefile	2008-02-11 10:36:03.000000000 +0000
++++ linux-2.6.23.15-grsec/Makefile	2008-02-11 10:37:44.000000000 +0000
+@@ -312,7 +312,7 @@ LINUXINCLUDE    := -Iinclude \
+ 
+ CPPFLAGS        := -D__KERNEL__ $(LINUXINCLUDE)
+ 
+-CFLAGS          := -Wall -Wundef -Wstrict-prototypes -Wno-trigraphs \
++CFLAGS          := -Wall -W -Wno-unused -Wno-sign-compare -Wundef -Wstrict-prototypes -Wno-trigraphs \
+ 		   -fno-strict-aliasing -fno-common \
+ 		   -Werror-implicit-function-declaration
+ AFLAGS          := -D__ASSEMBLY__
+@@ -560,7 +560,7 @@ export mod_strip_cmd
+ 
+ 
+ ifeq ($(KBUILD_EXTMOD),)
+-core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/
++core-y		+= kernel/ mm/ fs/ ipc/ security/ crypto/ block/ grsecurity/
+ 
+ vmlinux-dirs	:= $(patsubst %/,%,$(filter %/, $(init-y) $(init-m) \
+ 		     $(core-y) $(core-m) $(drivers-y) $(drivers-m) \
+diff -Nurp linux-2.6.23.15/arch/alpha/kernel/module.c linux-2.6.23.15-grsec/arch/alpha/kernel/module.c
+--- linux-2.6.23.15/arch/alpha/kernel/module.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/alpha/kernel/module.c	2008-02-11 10:37:44.000000000 +0000
+@@ -176,7 +176,7 @@ apply_relocate_add(Elf64_Shdr *sechdrs, 
+ 
+ 	/* The small sections were sorted to the end of the segment.
+ 	   The following should definitely cover them.  */
+-	gp = (u64)me->module_core + me->core_size - 0x8000;
++	gp = (u64)me->module_core_rw + me->core_size_rw - 0x8000;
+ 	got = sechdrs[me->arch.gotsecindex].sh_addr;
+ 
+ 	for (i = 0; i < n; i++) {
+diff -Nurp linux-2.6.23.15/arch/alpha/kernel/osf_sys.c linux-2.6.23.15-grsec/arch/alpha/kernel/osf_sys.c
+--- linux-2.6.23.15/arch/alpha/kernel/osf_sys.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/alpha/kernel/osf_sys.c	2008-02-11 10:37:44.000000000 +0000
+@@ -1288,6 +1288,10 @@ arch_get_unmapped_area(struct file *filp
+ 	   merely specific addresses, but regions of memory -- perhaps
+ 	   this feature should be incorporated into all ports?  */
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(current->mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
++#endif
++
+ 	if (addr) {
+ 		addr = arch_get_unmapped_area_1 (PAGE_ALIGN(addr), len, limit);
+ 		if (addr != (unsigned long) -ENOMEM)
+@@ -1295,8 +1299,8 @@ arch_get_unmapped_area(struct file *filp
+ 	}
+ 
+ 	/* Next, try allocating at TASK_UNMAPPED_BASE.  */
+-	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(TASK_UNMAPPED_BASE),
+-					 len, limit);
++	addr = arch_get_unmapped_area_1 (PAGE_ALIGN(current->mm->mmap_base), len, limit);
++
+ 	if (addr != (unsigned long) -ENOMEM)
+ 		return addr;
+ 
+diff -Nurp linux-2.6.23.15/arch/alpha/kernel/ptrace.c linux-2.6.23.15-grsec/arch/alpha/kernel/ptrace.c
+--- linux-2.6.23.15/arch/alpha/kernel/ptrace.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/alpha/kernel/ptrace.c	2008-02-11 10:37:44.000000000 +0000
+@@ -15,6 +15,7 @@
+ #include <linux/slab.h>
+ #include <linux/security.h>
+ #include <linux/signal.h>
++#include <linux/grsecurity.h>
+ 
+ #include <asm/uaccess.h>
+ #include <asm/pgtable.h>
+@@ -283,6 +284,11 @@ do_sys_ptrace(long request, long pid, lo
+ 		goto out_notsk;
+ 	}
+ 
++	if (gr_handle_ptrace(child, request)) {
++		ret = -EPERM;
++		goto out;
++	}
++
+ 	if (request == PTRACE_ATTACH) {
+ 		ret = ptrace_attach(child);
+ 		goto out;
+diff -Nurp linux-2.6.23.15/arch/alpha/mm/fault.c linux-2.6.23.15-grsec/arch/alpha/mm/fault.c
+--- linux-2.6.23.15/arch/alpha/mm/fault.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/alpha/mm/fault.c	2008-02-11 10:37:44.000000000 +0000
+@@ -23,6 +23,7 @@
+ #include <linux/smp.h>
+ #include <linux/interrupt.h>
+ #include <linux/module.h>
++#include <linux/binfmts.h>
+ 
+ #include <asm/system.h>
+ #include <asm/uaccess.h>
+@@ -54,6 +55,124 @@ __load_new_mm_context(struct mm_struct *
+ 	__reload_thread(pcb);
+ }
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++/*
++ * PaX: decide what to do with offenders (regs->pc = fault address)
++ *
++ * returns 1 when task should be killed
++ *         2 when patched PLT trampoline was detected
++ *         3 when unpatched PLT trampoline was detected
++ */
++static int pax_handle_fetch_fault(struct pt_regs *regs)
++{
++
++#ifdef CONFIG_PAX_EMUPLT
++	int err;
++
++	do { /* PaX: patched PLT emulation #1 */
++		unsigned int ldah, ldq, jmp;
++
++		err = get_user(ldah, (unsigned int *)regs->pc);
++		err |= get_user(ldq, (unsigned int *)(regs->pc+4));
++		err |= get_user(jmp, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
++		    (ldq & 0xFFFF0000U) == 0xA77B0000U &&
++		    jmp == 0x6BFB0000U)
++		{
++			unsigned long r27, addr;
++			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
++			unsigned long addrl = ldq | 0xFFFFFFFFFFFF0000UL;
++
++			addr = regs->r27 + ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
++			err = get_user(r27, (unsigned long *)addr);
++			if (err)
++				break;
++
++			regs->r27 = r27;
++			regs->pc = r27;
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: patched PLT emulation #2 */
++		unsigned int ldah, lda, br;
++
++		err = get_user(ldah, (unsigned int *)regs->pc);
++		err |= get_user(lda, (unsigned int *)(regs->pc+4));
++		err |= get_user(br, (unsigned int *)(regs->pc+8));
++
++		if (err)
++			break;
++
++		if ((ldah & 0xFFFF0000U) == 0x277B0000U &&
++		    (lda & 0xFFFF0000U) == 0xA77B0000U &&
++		    (br & 0xFFE00000U) == 0xC3E00000U)
++		{
++			unsigned long addr = br | 0xFFFFFFFFFFE00000UL;
++			unsigned long addrh = (ldah | 0xFFFFFFFFFFFF0000UL) << 16;
++			unsigned long addrl = lda | 0xFFFFFFFFFFFF0000UL;
++
++			regs->r27 += ((addrh ^ 0x80000000UL) + 0x80000000UL) + ((addrl ^ 0x8000UL) + 0x8000UL);
++			regs->pc += 12 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
++			return 2;
++		}
++	} while (0);
++
++	do { /* PaX: unpatched PLT emulation */
++		unsigned int br;
++
++		err = get_user(br, (unsigned int *)regs->pc);
++
++		if (!err && (br & 0xFFE00000U) == 0xC3800000U) {
++			unsigned int br2, ldq, nop, jmp;
++			unsigned long addr = br | 0xFFFFFFFFFFE00000UL, resolver;
++
++			addr = regs->pc + 4 + (((addr ^ 0x00100000UL) + 0x00100000UL) << 2);
++			err = get_user(br2, (unsigned int *)addr);
++			err |= get_user(ldq, (unsigned int *)(addr+4));
++			err |= get_user(nop, (unsigned int *)(addr+8));
++			err |= get_user(jmp, (unsigned int *)(addr+12));
++			err |= get_user(resolver, (unsigned long *)(addr+16));
++
++			if (err)
++				break;
++
++			if (br2 == 0xC3600000U &&
++			    ldq == 0xA77B000CU &&
++			    nop == 0x47FF041FU &&
++			    jmp == 0x6B7B0000U)
++			{
++				regs->r28 = regs->pc+4;
++				regs->r27 = addr+16;
++				regs->pc = resolver;
++				return 3;
++			}
++		}
++	} while (0);
++#endif
++
++	return 1;
++}
++
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 5; i++) {
++		unsigned int c;
++		if (get_user(c, (unsigned int *)pc+i))
++			printk("???????? ");
++		else
++			printk("%08x ", c);
++	}
++	printk("\n");
++}
++#endif
+ 
+ /*
+  * This routine handles page faults.  It determines the address,
+@@ -131,8 +250,29 @@ do_page_fault(unsigned long address, uns
+  good_area:
+ 	si_code = SEGV_ACCERR;
+ 	if (cause < 0) {
+-		if (!(vma->vm_flags & VM_EXEC))
++		if (!(vma->vm_flags & VM_EXEC)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++			if (!(mm->pax_flags & MF_PAX_PAGEEXEC) || address != regs->pc)
++				goto bad_area;
++
++			up_read(&mm->mmap_sem);
++			switch (pax_handle_fetch_fault(regs)) {
++
++#ifdef CONFIG_PAX_EMUPLT
++			case 2:
++			case 3:
++				return;
++#endif
++
++			}
++			pax_report_fault(regs, (void *)regs->pc, (void *)rdusp());
++			do_exit(SIGKILL);
++#else
+ 			goto bad_area;
++#endif
++
++		}
+ 	} else if (!cause) {
+ 		/* Allow reads even for write-only mappings */
+ 		if (!(vma->vm_flags & (VM_READ | VM_WRITE)))
+diff -Nurp linux-2.6.23.15/arch/arm/mm/mmap.c linux-2.6.23.15-grsec/arch/arm/mm/mmap.c
+--- linux-2.6.23.15/arch/arm/mm/mmap.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/arm/mm/mmap.c	2008-02-11 10:37:44.000000000 +0000
+@@ -60,6 +60,10 @@ arch_get_unmapped_area(struct file *filp
+ 	if (len > TASK_SIZE)
+ 		return -ENOMEM;
+ 
++#ifdef CONFIG_PAX_RANDMMAP
++	if (!(mm->pax_flags & MF_PAX_RANDMMAP) || !filp)
++#endif
++
+ 	if (addr) {
+ 		if (do_align)
+ 			addr = COLOUR_ALIGN(addr, pgoff);
+@@ -72,10 +76,10 @@ arch_get_unmapped_area(struct file *filp
+ 			return addr;
+ 	}
+ 	if (len > mm->cached_hole_size) {
+-	        start_addr = addr = mm->free_area_cache;
++		start_addr = addr = mm->free_area_cache;
+ 	} else {
+-	        start_addr = addr = TASK_UNMAPPED_BASE;
+-	        mm->cached_hole_size = 0;
++		start_addr = addr = mm->mmap_base;
++		mm->cached_hole_size = 0;
+ 	}
+ 
+ full_search:
+@@ -91,8 +95,8 @@ full_search:
+ 			 * Start a new search - just in case we missed
+ 			 * some holes.
+ 			 */
+-			if (start_addr != TASK_UNMAPPED_BASE) {
+-				start_addr = addr = TASK_UNMAPPED_BASE;
++			if (start_addr != mm->mmap_base) {
++				start_addr = addr = mm->mmap_base;
+ 				mm->cached_hole_size = 0;
+ 				goto full_search;
+ 			}
+diff -Nurp linux-2.6.23.15/arch/avr32/mm/fault.c linux-2.6.23.15-grsec/arch/avr32/mm/fault.c
+--- linux-2.6.23.15/arch/avr32/mm/fault.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/avr32/mm/fault.c	2008-02-11 10:37:44.000000000 +0000
+@@ -41,6 +41,23 @@ static inline int notify_page_fault(stru
+ 
+ int exception_trace = 1;
+ 
++#ifdef CONFIG_PAX_PAGEEXEC
++void pax_report_insns(void *pc, void *sp)
++{
++	unsigned long i;
++
++	printk(KERN_ERR "PAX: bytes at PC: ");
++	for (i = 0; i < 20; i++) {
++		unsigned char c;
++		if (get_user(c, (unsigned char *)pc+i))
++			printk("???????? ");
++		else
++			printk("%02x ", c);
++	}
++	printk("\n");
++}
++#endif
++
+ /*
+  * This routine handles page faults. It determines the address and the
+  * problem, and then passes it off to one of the appropriate routines.
+@@ -157,6 +174,16 @@ bad_area:
+ 	up_read(&mm->mmap_sem);
+ 
+ 	if (user_mode(regs)) {
++
++#ifdef CONFIG_PAX_PAGEEXEC
++		if (mm->pax_flags & MF_PAX_PAGEEXEC) {
++			if (ecr == ECR_PROTECTION_X || ecr == ECR_TLB_MISS_X) {
++				pax_report_fault(regs, (void *)regs->pc, (void *)regs->sp);
++				do_exit(SIGKILL);
++			}
++		}
++#endif
++
+ 		if (exception_trace && printk_ratelimit())
+ 			printk("%s%s[%d]: segfault at %08lx pc %08lx "
+ 			       "sp %08lx ecr %lu\n",
+diff -Nurp linux-2.6.23.15/arch/i386/Kconfig linux-2.6.23.15-grsec/arch/i386/Kconfig
+--- linux-2.6.23.15/arch/i386/Kconfig	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/Kconfig	2008-02-11 10:37:44.000000000 +0000
+@@ -592,7 +592,7 @@ config PAGE_OFFSET
+ 	hex
+ 	default 0xB0000000 if VMSPLIT_3G_OPT
+ 	default 0x80000000 if VMSPLIT_2G
+-	default 0x78000000 if VMSPLIT_2G_OPT
++	default 0x70000000 if VMSPLIT_2G_OPT
+ 	default 0x40000000 if VMSPLIT_1G
+ 	default 0xC0000000
+ 
+@@ -831,7 +831,7 @@ config CRASH_DUMP
+ config PHYSICAL_START
+ 	hex "Physical address where the kernel is loaded" if (EMBEDDED || CRASH_DUMP)
+ 	default "0x1000000" if X86_NUMAQ
+-	default "0x100000"
++	default "0x200000"
+ 	help
+ 	  This gives the physical address where the kernel is loaded.
+ 
+@@ -916,7 +916,7 @@ config HOTPLUG_CPU
+ 
+ config COMPAT_VDSO
+ 	bool "Compat VDSO support"
+-	default y
++	default n
+ 	help
+ 	  Map the VDSO to the predictable old-style address too.
+ 	---help---
+@@ -1092,7 +1092,7 @@ config PCI
+ choice
+ 	prompt "PCI access mode"
+ 	depends on PCI && !X86_VISWS
+-	default PCI_GOANY
++	default PCI_GODIRECT
+ 	---help---
+ 	  On PCI systems, the BIOS can be used to detect the PCI devices and
+ 	  determine their configuration. However, some old PCI motherboards
+diff -Nurp linux-2.6.23.15/arch/i386/Kconfig.cpu linux-2.6.23.15-grsec/arch/i386/Kconfig.cpu
+--- linux-2.6.23.15/arch/i386/Kconfig.cpu	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/Kconfig.cpu	2008-02-11 10:37:44.000000000 +0000
+@@ -274,7 +274,7 @@ config X86_PPRO_FENCE
+ 
+ config X86_F00F_BUG
+ 	bool
+-	depends on M586MMX || M586TSC || M586 || M486 || M386
++	depends on (M586MMX || M586TSC || M586 || M486 || M386) && !PAX_KERNEXEC
+ 	default y
+ 
+ config X86_WP_WORKS_OK
+@@ -299,7 +299,7 @@ config X86_POPAD_OK
+ 
+ config X86_ALIGNMENT_16
+ 	bool
+-	depends on MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK6 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
++	depends on MWINCHIP3D || MWINCHIP2 || MWINCHIPC6 || MCYRIXIII || X86_ELAN || MK8 || MK7 || MK6 || MPENTIUM4 || MPENTIUMIII || MPENTIUMII || M686 || M586MMX || M586TSC || M586 || M486 || MVIAC3_2 || MGEODEGX1
+ 	default y
+ 
+ config X86_GOOD_APIC
+diff -Nurp linux-2.6.23.15/arch/i386/Kconfig.debug linux-2.6.23.15-grsec/arch/i386/Kconfig.debug
+--- linux-2.6.23.15/arch/i386/Kconfig.debug	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/Kconfig.debug	2008-02-11 10:37:44.000000000 +0000
+@@ -46,16 +46,6 @@ config DEBUG_PAGEALLOC
+ 	  This results in a large slowdown, but helps to find certain types
+ 	  of memory corruptions.
+ 
+-config DEBUG_RODATA
+-	bool "Write protect kernel read-only data structures"
+-	depends on DEBUG_KERNEL
+-	help
+-	  Mark the kernel read-only data as write-protected in the pagetables,
+-	  in order to catch accidental (and incorrect) writes to such const
+-	  data. This option may have a slight performance impact because a
+-	  portion of the kernel code won't be covered by a 2MB TLB anymore.
+-	  If in doubt, say "N".
+-
+ config 4KSTACKS
+ 	bool "Use 4Kb for kernel stacks instead of 8Kb"
+ 	depends on DEBUG_KERNEL
+diff -Nurp linux-2.6.23.15/arch/i386/boot/bitops.h linux-2.6.23.15-grsec/arch/i386/boot/bitops.h
+--- linux-2.6.23.15/arch/i386/boot/bitops.h	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/bitops.h	2008-02-11 10:37:44.000000000 +0000
+@@ -28,7 +28,7 @@ static inline int variable_test_bit(int 
+ 	u8 v;
+ 	const u32 *p = (const u32 *)addr;
+ 
+-	asm("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
++	asm volatile("btl %2,%1; setc %0" : "=qm" (v) : "m" (*p), "Ir" (nr));
+ 	return v;
+ }
+ 
+@@ -39,7 +39,7 @@ static inline int variable_test_bit(int 
+ 
+ static inline void set_bit(int nr, void *addr)
+ {
+-	asm("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
++	asm volatile("btsl %1,%0" : "+m" (*(u32 *)addr) : "Ir" (nr));
+ }
+ 
+ #endif /* BOOT_BITOPS_H */
+diff -Nurp linux-2.6.23.15/arch/i386/boot/boot.h linux-2.6.23.15-grsec/arch/i386/boot/boot.h
+--- linux-2.6.23.15/arch/i386/boot/boot.h	2008-02-11 10:36:03.000000000 +0000
++++ linux-2.6.23.15-grsec/arch/i386/boot/boot.h	2008-02-11 10:37:44.000000000 +0000
+@@ -78,7 +78,7 @@ static inline void io_delay(void)
+ static inline u16 ds(void)
+ {
+ 	u16 seg;
+-	asm("movw %%ds,%0" : "=rm" (seg));
++	asm volatile("movw %%ds,%0" : "=rm" (seg));
+ 	return seg;
+ }
+ 
+@@ -174,7 +174,7 @@ static inline void wrgs32(u32 v, addr_t 
+ static inline int memcmp(const void *s1, const void *s2, size_t len)
+ {
+ 	u8 diff;
+-	asm("repe; cmpsb; setnz %0"
++	asm volatile("repe; cmpsb; setnz %0"
+ 	    : "=qm" (diff), "+D" (s1), "+S" (s2), "+c" (len));
+ 	return diff;
+ }
+diff -Nurp linux-2.6.23.15/arch/i386/boot/compressed/head.S linux-2.6.23.15-grsec/arch/i386/boot/compressed/head.S
+--- linux-2.6.23.15/arch/i386/boot/compressed/head.S	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/compressed/head.S	2008-02-11 10:37:44.000000000 +0000
+@@ -159,9 +159,8 @@ relocated:
+  */
+ 
+ 1:	subl $4, %edi
+-	movl 0(%edi), %ecx
+-	testl %ecx, %ecx
+-	jz 2f
++	movl (%edi), %ecx
++	jecxz 2f
+ 	addl %ebx, -__PAGE_OFFSET(%ebx, %ecx)
+ 	jmp 1b
+ 2:
+diff -Nurp linux-2.6.23.15/arch/i386/boot/compressed/relocs.c linux-2.6.23.15-grsec/arch/i386/boot/compressed/relocs.c
+--- linux-2.6.23.15/arch/i386/boot/compressed/relocs.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/compressed/relocs.c	2008-02-11 10:37:44.000000000 +0000
+@@ -10,9 +10,13 @@
+ #define USE_BSD
+ #include <endian.h>
+ 
++#include "../../../../include/linux/autoconf.h"
++
++#define MAX_PHDRS 100
+ #define MAX_SHDRS 100
+ #define ARRAY_SIZE(x) (sizeof(x) / sizeof((x)[0]))
+ static Elf32_Ehdr ehdr;
++static Elf32_Phdr phdr[MAX_PHDRS];
+ static Elf32_Shdr shdr[MAX_SHDRS];
+ static Elf32_Sym  *symtab[MAX_SHDRS];
+ static Elf32_Rel  *reltab[MAX_SHDRS];
+@@ -246,6 +250,34 @@ static void read_ehdr(FILE *fp)
+ 	}
+ }
+ 
++static void read_phdrs(FILE *fp)
++{
++	int i;
++	if (ehdr.e_phnum > MAX_PHDRS) {
++		die("%d program headers supported: %d\n",
++			ehdr.e_phnum, MAX_PHDRS);
++	}
++	if (fseek(fp, ehdr.e_phoff, SEEK_SET) < 0) {
++		die("Seek to %d failed: %s\n",
++			ehdr.e_phoff, strerror(errno));
++	}
++	if (fread(&phdr, sizeof(phdr[0]), ehdr.e_phnum, fp) != ehdr.e_phnum) {
++		die("Cannot read ELF program headers: %s\n",
++			strerror(errno));
++	}
++	for(i = 0; i < ehdr.e_phnum; i++) {
++		phdr[i].p_type      = elf32_to_cpu(phdr[i].p_type);
++		phdr[i].p_offset    = elf32_to_cpu(phdr[i].p_offset);
++		phdr[i].p_vaddr     = elf32_to_cpu(phdr[i].p_vaddr);
++		phdr[i].p_paddr     = elf32_to_cpu(phdr[i].p_paddr);
++		phdr[i].p_filesz    = elf32_to_cpu(phdr[i].p_filesz);
++		phdr[i].p_memsz     = elf32_to_cpu(phdr[i].p_memsz);
++		phdr[i].p_flags     = elf32_to_cpu(phdr[i].p_flags);
++		phdr[i].p_align     = elf32_to_cpu(phdr[i].p_align);
++	}
++
++}
++
+ static void read_shdrs(FILE *fp)
+ {
+ 	int i;
+@@ -332,6 +364,8 @@ static void read_symtabs(FILE *fp)
+ static void read_relocs(FILE *fp)
+ {
+ 	int i,j;
++	uint32_t base;
++
+ 	for(i = 0; i < ehdr.e_shnum; i++) {
+ 		if (shdr[i].sh_type != SHT_REL) {
+ 			continue;
+@@ -349,8 +383,17 @@ static void read_relocs(FILE *fp)
+ 			die("Cannot read symbol table: %s\n",
+ 				strerror(errno));
+ 		}
++		base = 0;
++		for (j = 0; j < ehdr.e_phnum; j++) {
++			if (phdr[j].p_type != PT_LOAD )
++				continue;
++			if (shdr[shdr[i].sh_info].sh_offset < phdr[j].p_offset || shdr[shdr[i].sh_info].sh_offset > phdr[j].p_offset + phdr[j].p_filesz)
++				continue;
++			base = CONFIG_PAGE_OFFSET + phdr[j].p_paddr - phdr[j].p_vaddr;
++			break;
++		}
+ 		for(j = 0; j < shdr[i].sh_size/sizeof(reltab[0][0]); j++) {
+-			reltab[i][j].r_offset = elf32_to_cpu(reltab[i][j].r_offset);
++			reltab[i][j].r_offset = elf32_to_cpu(reltab[i][j].r_offset) + base;
+ 			reltab[i][j].r_info   = elf32_to_cpu(reltab[i][j].r_info);
+ 		}
+ 	}
+@@ -487,6 +530,27 @@ static void walk_relocs(void (*visit)(El
+ 			if (sym->st_shndx == SHN_ABS) {
+ 				continue;
+ 			}
++			/* Don't relocate actual per-cpu variables, they are absolute indices, not addresses */
++			if (!strcmp(sec_name(sym->st_shndx), ".data.percpu") && strncmp(sym_name(sym_strtab, sym), "__per_cpu_", 10)) {
++				continue;
++			}
++#ifdef CONFIG_PAX_KERNEXEC
++			/* Don't relocate actual code, they are relocated implicitly by the base address of KERNEL_CS */
++			if (!strcmp(sec_name(sym->st_shndx), ".init.text")) {
++				continue;
++			}
++			if (!strcmp(sec_name(sym->st_shndx), ".exit.text")) {
++				continue;
++			}
++			if (!strcmp(sec_name(sym->st_shndx), ".text.head"))
++				if (strcmp(sym_name(sym_strtab, sym), "__init_end") &&
++				    strcmp(sym_name(sym_strtab, sym), "KERNEL_TEXT_OFFSET")) {
++				continue;
++			}
++			if (!strcmp(sec_name(sym->st_shndx), ".text")) {
++				continue;
++			}
++#endif
+ 			if (r_type == R_386_PC32) {
+ 				/* PC relative relocations don't need to be adjusted */
+ 			}
+@@ -614,6 +678,7 @@ int main(int argc, char **argv)
+ 			fname, strerror(errno));
+ 	}
+ 	read_ehdr(fp);
++	read_phdrs(fp);
+ 	read_shdrs(fp);
+ 	read_strtabs(fp);
+ 	read_symtabs(fp);
+diff -Nurp linux-2.6.23.15/arch/i386/boot/cpucheck.c linux-2.6.23.15-grsec/arch/i386/boot/cpucheck.c
+--- linux-2.6.23.15/arch/i386/boot/cpucheck.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/cpucheck.c	2008-02-11 10:37:44.000000000 +0000
+@@ -90,7 +90,7 @@ static int has_fpu(void)
+ 	u16 fcw = -1, fsw = -1;
+ 	u32 cr0;
+ 
+-	asm("movl %%cr0,%0" : "=r" (cr0));
++	asm volatile("movl %%cr0,%0" : "=r" (cr0));
+ 	if (cr0 & (X86_CR0_EM|X86_CR0_TS)) {
+ 		cr0 &= ~(X86_CR0_EM|X86_CR0_TS);
+ 		asm volatile("movl %0,%%cr0" : : "r" (cr0));
+@@ -106,7 +106,7 @@ static int has_eflag(u32 mask)
+ {
+ 	u32 f0, f1;
+ 
+-	asm("pushfl ; "
++	asm volatile("pushfl ; "
+ 	    "pushfl ; "
+ 	    "popl %0 ; "
+ 	    "movl %0,%1 ; "
+@@ -131,7 +131,7 @@ static void get_flags(void)
+ 		set_bit(X86_FEATURE_FPU, cpu.flags);
+ 
+ 	if (has_eflag(X86_EFLAGS_ID)) {
+-		asm("cpuid"
++		asm volatile("cpuid"
+ 		    : "=a" (max_intel_level),
+ 		      "=b" (cpu_vendor[0]),
+ 		      "=d" (cpu_vendor[1]),
+@@ -140,7 +140,7 @@ static void get_flags(void)
+ 
+ 		if (max_intel_level >= 0x00000001 &&
+ 		    max_intel_level <= 0x0000ffff) {
+-			asm("cpuid"
++			asm volatile("cpuid"
+ 			    : "=a" (tfms),
+ 			      "=c" (cpu.flags[4]),
+ 			      "=d" (cpu.flags[0])
+@@ -152,7 +152,7 @@ static void get_flags(void)
+ 				cpu.model += ((tfms >> 16) & 0xf) << 4;
+ 		}
+ 
+-		asm("cpuid"
++		asm volatile("cpuid"
+ 		    : "=a" (max_amd_level)
+ 		    : "a" (0x80000000)
+ 		    : "ebx", "ecx", "edx");
+@@ -160,7 +160,7 @@ static void get_flags(void)
+ 		if (max_amd_level >= 0x80000001 &&
+ 		    max_amd_level <= 0x8000ffff) {
+ 			u32 eax = 0x80000001;
+-			asm("cpuid"
++			asm volatile("cpuid"
+ 			    : "+a" (eax),
+ 			      "=c" (cpu.flags[6]),
+ 			      "=d" (cpu.flags[1])
+@@ -219,9 +219,9 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 ecx = MSR_K7_HWCR;
+ 		u32 eax, edx;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+ 		eax &= ~(1 << 15);
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		get_flags();	/* Make sure it really did something */
+ 		err = check_flags();
+@@ -234,9 +234,9 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 ecx = MSR_VIA_FCR;
+ 		u32 eax, edx;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+ 		eax |= (1<<1)|(1<<7);
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		set_bit(X86_FEATURE_CX8, cpu.flags);
+ 		err = check_flags();
+@@ -247,12 +247,12 @@ int check_cpu(int *cpu_level_ptr, int *r
+ 		u32 eax, edx;
+ 		u32 level = 1;
+ 
+-		asm("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
+-		asm("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
+-		asm("cpuid"
++		asm volatile("rdmsr" : "=a" (eax), "=d" (edx) : "c" (ecx));
++		asm volatile("wrmsr" : : "a" (~0), "d" (edx), "c" (ecx));
++		asm volatile("cpuid"
+ 		    : "+a" (level), "=d" (cpu.flags[0])
+ 		    : : "ecx", "ebx");
+-		asm("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
++		asm volatile("wrmsr" : : "a" (eax), "d" (edx), "c" (ecx));
+ 
+ 		err = check_flags();
+ 	}
+diff -Nurp linux-2.6.23.15/arch/i386/boot/edd.c linux-2.6.23.15-grsec/arch/i386/boot/edd.c
+--- linux-2.6.23.15/arch/i386/boot/edd.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/edd.c	2008-02-11 10:37:44.000000000 +0000
+@@ -78,7 +78,7 @@ static int get_edd_info(u8 devno, struct
+ 	ax = 0x4100;
+ 	bx = EDDMAGIC1;
+ 	dx = devno;
+-	asm("pushfl; stc; int $0x13; setc %%al; popfl"
++	asm volatile("pushfl; stc; int $0x13; setc %%al; popfl"
+ 	    : "+a" (ax), "+b" (bx), "=c" (cx), "+d" (dx)
+ 	    : : "esi", "edi");
+ 
+@@ -97,7 +97,7 @@ static int get_edd_info(u8 devno, struct
+ 	ei->params.length = sizeof(ei->params);
+ 	ax = 0x4800;
+ 	dx = devno;
+-	asm("pushfl; int $0x13; popfl"
++	asm volatile("pushfl; int $0x13; popfl"
+ 	    : "+a" (ax), "+d" (dx), "=m" (ei->params)
+ 	    : "S" (&ei->params)
+ 	    : "ebx", "ecx", "edi");
+@@ -108,7 +108,7 @@ static int get_edd_info(u8 devno, struct
+ 	ax = 0x0800;
+ 	dx = devno;
+ 	di = 0;
+-	asm("pushw %%es; "
++	asm volatile("pushw %%es; "
+ 	    "movw %%di,%%es; "
+ 	    "pushfl; stc; int $0x13; setc %%al; popfl; "
+ 	    "popw %%es"
+diff -Nurp linux-2.6.23.15/arch/i386/boot/main.c linux-2.6.23.15-grsec/arch/i386/boot/main.c
+--- linux-2.6.23.15/arch/i386/boot/main.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/main.c	2008-02-11 10:37:44.000000000 +0000
+@@ -77,7 +77,7 @@ static void keyboard_set_repeat(void)
+  */
+ static void query_ist(void)
+ {
+-	asm("int $0x15"
++	asm volatile("int $0x15"
+ 	    : "=a" (boot_params.ist_info.signature),
+ 	      "=b" (boot_params.ist_info.command),
+ 	      "=c" (boot_params.ist_info.event),
+diff -Nurp linux-2.6.23.15/arch/i386/boot/mca.c linux-2.6.23.15-grsec/arch/i386/boot/mca.c
+--- linux-2.6.23.15/arch/i386/boot/mca.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/mca.c	2008-02-11 10:37:44.000000000 +0000
+@@ -21,7 +21,7 @@ int query_mca(void)
+ 	u8 err;
+ 	u16 es, bx, len;
+ 
+-	asm("pushw %%es ; "
++	asm volatile("pushw %%es ; "
+ 	    "int $0x15 ; "
+ 	    "setc %0 ; "
+ 	    "movw %%es, %1 ; "
+diff -Nurp linux-2.6.23.15/arch/i386/boot/memory.c linux-2.6.23.15-grsec/arch/i386/boot/memory.c
+--- linux-2.6.23.15/arch/i386/boot/memory.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/memory.c	2008-02-11 10:37:44.000000000 +0000
+@@ -32,7 +32,7 @@ static int detect_memory_e820(void)
+ 		/* Important: %edx is clobbered by some BIOSes,
+ 		   so it must be either used for the error output
+ 		   or explicitly marked clobbered. */
+-		asm("int $0x15; setc %0"
++		asm volatile("int $0x15; setc %0"
+ 		    : "=d" (err), "+b" (next), "=a" (id), "+c" (size),
+ 		      "=m" (*desc)
+ 		    : "D" (desc), "d" (SMAP), "a" (0xe820));
+@@ -64,7 +64,7 @@ static int detect_memory_e801(void)
+ 
+ 	bx = cx = dx = 0;
+ 	ax = 0xe801;
+-	asm("stc; int $0x15; setc %0"
++	asm volatile("stc; int $0x15; setc %0"
+ 	    : "=m" (err), "+a" (ax), "+b" (bx), "+c" (cx), "+d" (dx));
+ 
+ 	if (err)
+@@ -94,7 +94,7 @@ static int detect_memory_88(void)
+ 	u8 err;
+ 
+ 	ax = 0x8800;
+-	asm("stc; int $0x15; setc %0" : "=bcdm" (err), "+a" (ax));
++	asm volatile("stc; int $0x15; setc %0" : "=bcdm" (err), "+a" (ax));
+ 
+ 	boot_params.screen_info.ext_mem_k = ax;
+ 
+diff -Nurp linux-2.6.23.15/arch/i386/boot/video-vesa.c linux-2.6.23.15-grsec/arch/i386/boot/video-vesa.c
+--- linux-2.6.23.15/arch/i386/boot/video-vesa.c	2008-02-11 10:36:03.000000000 +0000
++++ linux-2.6.23.15-grsec/arch/i386/boot/video-vesa.c	2008-02-11 10:37:44.000000000 +0000
+@@ -41,7 +41,7 @@ static int vesa_probe(void)
+ 
+ 	ax = 0x4f00;
+ 	di = (size_t)&vginfo;
+-	asm(INT10
++	asm volatile(INT10
+ 	    : "+a" (ax), "+D" (di), "=m" (vginfo)
+ 	    : : "ebx", "ecx", "edx", "esi");
+ 
+@@ -68,7 +68,7 @@ static int vesa_probe(void)
+ 		ax = 0x4f01;
+ 		cx = mode;
+ 		di = (size_t)&vminfo;
+-		asm(INT10
++		asm volatile(INT10
+ 		    : "+a" (ax), "+c" (cx), "+D" (di), "=m" (vminfo)
+ 		    : : "ebx", "edx", "esi");
+ 
+@@ -115,7 +115,7 @@ static int vesa_set_mode(struct mode_inf
+ 	ax = 0x4f01;
+ 	cx = vesa_mode;
+ 	di = (size_t)&vminfo;
+-	asm(INT10
++	asm volatile(INT10
+ 	    : "+a" (ax), "+c" (cx), "+D" (di), "=m" (vminfo)
+ 	    : : "ebx", "edx", "esi");
+ 
+@@ -193,19 +193,20 @@ static void vesa_dac_set_8bits(void)
+ /* Save the VESA protected mode info */
+ static void vesa_store_pm_info(void)
+ {
+-	u16 ax, bx, di, es;
++	u16 ax, bx, cx, di, es;
+ 
+ 	ax = 0x4f0a;
+-	bx = di = 0;
+-	asm("pushw %%es; "INT10"; movw %%es,%0; popw %%es"
+-	    : "=d" (es), "+a" (ax), "+b" (bx), "+D" (di)
+-	    : : "ecx", "esi");
++	bx = cx = di = 0;
++	asm volatile("pushw %%es; "INT10"; movw %%es,%0; popw %%es"
++	    : "=d" (es), "+a" (ax), "+b" (bx), "+c" (cx), "+D" (di)
++	    : : "esi");
+ 
+ 	if (ax != 0x004f)
+ 		return;
+ 
+ 	boot_params.screen_info.vesapm_seg = es;
+ 	boot_params.screen_info.vesapm_off = di;
++	boot_params.screen_info.vesapm_size = cx;
+ }
+ 
+ /*
+@@ -259,7 +260,7 @@ void vesa_store_edid(void)
+ 	/* Note: The VBE DDC spec is different from the main VESA spec;
+ 	   we genuinely have to assume all registers are destroyed here. */
+ 
+-	asm("pushw %%es; movw %2,%%es; "INT10"; popw %%es"
++	asm volatile("pushw %%es; movw %2,%%es; "INT10"; popw %%es"
+ 	    : "+a" (ax), "+b" (bx)
+ 	    :  "c" (cx), "D" (di)
+ 	    : "esi");
+@@ -275,7 +276,7 @@ void vesa_store_edid(void)
+ 	cx = 0;			/* Controller 0 */
+ 	dx = 0;			/* EDID block number */
+ 	di =(size_t) &boot_params.edid_info; /* (ES:)Pointer to block */
+-	asm(INT10
++	asm volatile(INT10
+ 	    : "+a" (ax), "+b" (bx), "+d" (dx), "=m" (boot_params.edid_info)
+ 	    : "c" (cx), "D" (di)
+ 	    : "esi");
+diff -Nurp linux-2.6.23.15/arch/i386/boot/video-vga.c linux-2.6.23.15-grsec/arch/i386/boot/video-vga.c
+--- linux-2.6.23.15/arch/i386/boot/video-vga.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/video-vga.c	2008-02-11 10:37:44.000000000 +0000
+@@ -225,7 +225,7 @@ static int vga_probe(void)
+ 	};
+ 	u8 vga_flag;
+ 
+-	asm(INT10
++	asm volatile(INT10
+ 	    : "=b" (boot_params.screen_info.orig_video_ega_bx)
+ 	    : "a" (0x1200), "b" (0x10) /* Check EGA/VGA */
+ 	    : "ecx", "edx", "esi", "edi");
+@@ -233,7 +233,7 @@ static int vga_probe(void)
+ 	/* If we have MDA/CGA/HGC then BL will be unchanged at 0x10 */
+ 	if ((u8)boot_params.screen_info.orig_video_ega_bx != 0x10) {
+ 		/* EGA/VGA */
+-		asm(INT10
++		asm volatile(INT10
+ 		    : "=a" (vga_flag)
+ 		    : "a" (0x1a00)
+ 		    : "ebx", "ecx", "edx", "esi", "edi");
+diff -Nurp linux-2.6.23.15/arch/i386/boot/video.c linux-2.6.23.15-grsec/arch/i386/boot/video.c
+--- linux-2.6.23.15/arch/i386/boot/video.c	2008-02-11 10:36:03.000000000 +0000
++++ linux-2.6.23.15-grsec/arch/i386/boot/video.c	2008-02-11 10:37:44.000000000 +0000
+@@ -40,7 +40,7 @@ static void store_cursor_position(void)
+ 
+ 	ax = 0x0300;
+ 	bx = 0;
+-	asm(INT10
++	asm volatile(INT10
+ 	    : "=d" (curpos), "+a" (ax), "+b" (bx)
+ 	    : : "ecx", "esi", "edi");
+ 
+@@ -55,7 +55,7 @@ static void store_video_mode(void)
+ 	/* N.B.: the saving of the video page here is a bit silly,
+ 	   since we pretty much assume page 0 everywhere. */
+ 	ax = 0x0f00;
+-	asm(INT10
++	asm volatile(INT10
+ 	    : "+a" (ax), "=b" (page)
+ 	    : : "ecx", "edx", "esi", "edi");
+ 
+diff -Nurp linux-2.6.23.15/arch/i386/boot/voyager.c linux-2.6.23.15-grsec/arch/i386/boot/voyager.c
+--- linux-2.6.23.15/arch/i386/boot/voyager.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/boot/voyager.c	2008-02-11 10:37:44.000000000 +0000
+@@ -27,7 +27,7 @@ int query_voyager(void)
+ 
+ 	data_ptr[0] = 0xff;	/* Flag on config not found(?) */
+ 
+-	asm("pushw %%es ; "
++	asm volatile("pushw %%es ; "
+ 	    "int $0x15 ; "
+ 	    "setc %0 ; "
+ 	    "movw %%es, %1 ; "
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/acpi/boot.c linux-2.6.23.15-grsec/arch/i386/kernel/acpi/boot.c
+--- linux-2.6.23.15/arch/i386/kernel/acpi/boot.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/acpi/boot.c	2008-02-11 10:37:44.000000000 +0000
+@@ -1123,7 +1123,7 @@ static struct dmi_system_id __initdata a
+ 		     DMI_MATCH(DMI_PRODUCT_NAME, "TravelMate 360"),
+ 		     },
+ 	 },
+-	{}
++	{ NULL, NULL, {{0, NULL}}, NULL}
+ };
+ 
+ #endif				/* __i386__ */
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/acpi/sleep.c linux-2.6.23.15-grsec/arch/i386/kernel/acpi/sleep.c
+--- linux-2.6.23.15/arch/i386/kernel/acpi/sleep.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/acpi/sleep.c	2008-02-11 10:37:44.000000000 +0000
+@@ -98,7 +98,7 @@ static __initdata struct dmi_system_id a
+ 		     DMI_MATCH(DMI_PRODUCT_NAME, "S4030CDT/4.3"),
+ 		     },
+ 	 },
+-	{}
++	{ NULL, NULL, {{0, NULL}}, NULL}
+ };
+ 
+ static int __init acpisleep_dmi_init(void)
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/acpi/wakeup.S linux-2.6.23.15-grsec/arch/i386/kernel/acpi/wakeup.S
+--- linux-2.6.23.15/arch/i386/kernel/acpi/wakeup.S	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/acpi/wakeup.S	2008-02-11 10:37:44.000000000 +0000
+@@ -2,6 +2,7 @@
+ #include <linux/linkage.h>
+ #include <asm/segment.h>
+ #include <asm/page.h>
++#include <asm/msr-index.h>
+ 
+ #
+ # wakeup_code runs in real mode, and at unknown address (determined at run-time).
+@@ -84,7 +85,7 @@ wakeup_code:
+ 	# restore efer setting
+ 	movl	real_save_efer_edx - wakeup_code, %edx
+ 	movl	real_save_efer_eax - wakeup_code, %eax
+-	mov     $0xc0000080, %ecx
++	mov     $MSR_EFER, %ecx
+ 	wrmsr
+ 4:
+ 	# make sure %cr4 is set correctly (features, etc)
+@@ -209,13 +210,11 @@ wakeup_pmode_return:
+ 	# and restore the stack ... but you need gdt for this to work
+ 	movl	saved_context_esp, %esp
+ 
+-	movl	%cs:saved_magic, %eax
+-	cmpl	$0x12345678, %eax
++	cmpl	$0x12345678, saved_magic
+ 	jne	bogus_magic
+ 
+ 	# jump to place where we left off
+-	movl	saved_eip,%eax
+-	jmp	*%eax
++	jmp	*(saved_eip)
+ 
+ bogus_magic:
+ 	movw	$0x0e00 + 'B', 0xb8018
+@@ -247,7 +246,7 @@ ENTRY(acpi_copy_wakeup_routine)
+ 	# save efer setting
+ 	pushl	%eax
+ 	movl	%eax, %ebx
+-	mov     $0xc0000080, %ecx
++	mov     $MSR_EFER, %ecx
+ 	rdmsr
+ 	movl	%edx, real_save_efer_edx - wakeup_start (%ebx)
+ 	movl	%eax, real_save_efer_eax - wakeup_start (%ebx)
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/alternative.c linux-2.6.23.15-grsec/arch/i386/kernel/alternative.c
+--- linux-2.6.23.15/arch/i386/kernel/alternative.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/alternative.c	2008-02-11 10:37:44.000000000 +0000
+@@ -443,7 +443,20 @@ void __init alternative_instructions(voi
+  */
+ void __kprobes text_poke(void *addr, unsigned char *opcode, int len)
+ {
++
++#ifdef CONFIG_PAX_KERNEXEC
++	unsigned long cr0;
++
++	pax_open_kernel(cr0);
++#endif
++
++	addr += __KERNEL_TEXT_OFFSET;
+ 	memcpy(addr, opcode, len);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_close_kernel(cr0);
++#endif
++
+ 	sync_core();
+ 	/* Could also do a CLFLUSH here to speed up CPU recovery; but
+ 	   that causes hangs on some VIA CPUs. */
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/apm.c linux-2.6.23.15-grsec/arch/i386/kernel/apm.c
+--- linux-2.6.23.15/arch/i386/kernel/apm.c	2008-02-11 10:36:03.000000000 +0000
++++ linux-2.6.23.15-grsec/arch/i386/kernel/apm.c	2008-02-11 10:37:44.000000000 +0000
+@@ -407,7 +407,7 @@ static DECLARE_WAIT_QUEUE_HEAD(apm_waitq
+ static DECLARE_WAIT_QUEUE_HEAD(apm_suspend_waitqueue);
+ static struct apm_user *	user_list;
+ static DEFINE_SPINLOCK(user_list_lock);
+-static const struct desc_struct	bad_bios_desc = { 0, 0x00409200 };
++static const struct desc_struct	bad_bios_desc = { 0, 0x00409300 };
+ 
+ static const char		driver_version[] = "1.16ac";	/* no spaces */
+ 
+@@ -601,19 +601,42 @@ static u8 apm_bios_call(u32 func, u32 eb
+ 	struct desc_struct	save_desc_40;
+ 	struct desc_struct	*gdt;
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	unsigned long		cr0;
++#endif
++
+ 	cpus = apm_save_cpus();
+ 	
+ 	cpu = get_cpu();
+ 	gdt = get_cpu_gdt_table(cpu);
+ 	save_desc_40 = gdt[0x40 / 8];
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_open_kernel(cr0);
++#endif
++
+ 	gdt[0x40 / 8] = bad_bios_desc;
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_close_kernel(cr0);
++#endif
++
+ 	apm_irq_save(flags);
+ 	APM_DO_SAVE_SEGS;
+ 	apm_bios_call_asm(func, ebx_in, ecx_in, eax, ebx, ecx, edx, esi);
+ 	APM_DO_RESTORE_SEGS;
+ 	apm_irq_restore(flags);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_open_kernel(cr0);
++#endif
++
+ 	gdt[0x40 / 8] = save_desc_40;
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_close_kernel(cr0);
++#endif
++
+ 	put_cpu();
+ 	apm_restore_cpus(cpus);
+ 	
+@@ -644,19 +667,42 @@ static u8 apm_bios_call_simple(u32 func,
+ 	struct desc_struct	save_desc_40;
+ 	struct desc_struct	*gdt;
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	unsigned long		cr0;
++#endif
++
+ 	cpus = apm_save_cpus();
+ 	
+ 	cpu = get_cpu();
+ 	gdt = get_cpu_gdt_table(cpu);
+ 	save_desc_40 = gdt[0x40 / 8];
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_open_kernel(cr0);
++#endif
++
+ 	gdt[0x40 / 8] = bad_bios_desc;
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_close_kernel(cr0);
++#endif
++
+ 	apm_irq_save(flags);
+ 	APM_DO_SAVE_SEGS;
+ 	error = apm_bios_call_simple_asm(func, ebx_in, ecx_in, eax);
+ 	APM_DO_RESTORE_SEGS;
+ 	apm_irq_restore(flags);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_open_kernel(cr0);
++#endif
++
+ 	gdt[0x40 / 8] = save_desc_40;
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_close_kernel(cr0);
++#endif
++
+ 	put_cpu();
+ 	apm_restore_cpus(cpus);
+ 	return error;
+@@ -924,7 +970,7 @@ recalc:
+  
+ static void apm_power_off(void)
+ {
+-	unsigned char	po_bios_call[] = {
++	const unsigned char	po_bios_call[] = {
+ 		0xb8, 0x00, 0x10,	/* movw  $0x1000,ax  */
+ 		0x8e, 0xd0,		/* movw  ax,ss       */
+ 		0xbc, 0x00, 0xf0,	/* movw  $0xf000,sp  */
+@@ -1864,7 +1910,10 @@ static const struct file_operations apm_
+ static struct miscdevice apm_device = {
+ 	APM_MINOR_DEV,
+ 	"apm_bios",
+-	&apm_bios_fops
++	&apm_bios_fops,
++	{NULL, NULL},
++	NULL,
++	NULL
+ };
+ 
+ 
+@@ -1974,210 +2023,210 @@ static struct dmi_system_id __initdata a
+ 		print_if_true,
+ 		KERN_WARNING "IBM T23 - BIOS 1.03b+ and controller firmware 1.02+ may be needed for Linux APM.",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"),
+-			DMI_MATCH(DMI_BIOS_VERSION, "1AET38WW (1.01b)"), },
++			DMI_MATCH(DMI_BIOS_VERSION, "1AET38WW (1.01b)"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on the C600 */
+ 		broken_ps2_resume, "Dell Latitude C600",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "Dell"),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude C600"), },
++			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude C600"), }, NULL
+ 	},
+ 	{	/* Allow interrupts during suspend on Dell Latitude laptops*/
+ 		set_apm_ints, "Dell Latitude",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude C510"), }
++			DMI_MATCH(DMI_PRODUCT_NAME, "Latitude C510"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked, "Dell Inspiron 2500",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 2500"),
+ 			DMI_MATCH(DMI_BIOS_VENDOR,"Phoenix Technologies LTD"),
+-			DMI_MATCH(DMI_BIOS_VERSION,"A11"), },
++			DMI_MATCH(DMI_BIOS_VERSION,"A11"), }, NULL
+ 	},
+ 	{	/* Allow interrupts during suspend on Dell Inspiron laptops*/
+ 		set_apm_ints, "Dell Inspiron", {
+ 			DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 4000"), },
++			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 4000"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Inspiron 5000e */
+ 		broken_apm_power, "Dell Inspiron 5000e",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "A04"),
+-			DMI_MATCH(DMI_BIOS_DATE, "08/24/2000"), },
++			DMI_MATCH(DMI_BIOS_DATE, "08/24/2000"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Inspiron 2500 */
+ 		broken_apm_power, "Dell Inspiron 2500",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "A12"),
+-			DMI_MATCH(DMI_BIOS_DATE, "02/04/2002"), },
++			DMI_MATCH(DMI_BIOS_DATE, "02/04/2002"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked, "Dell Dimension 4100",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "XPS-Z"),
+ 			DMI_MATCH(DMI_BIOS_VENDOR,"Intel Corp."),
+-			DMI_MATCH(DMI_BIOS_VERSION,"A11"), },
++			DMI_MATCH(DMI_BIOS_VERSION,"A11"), }, NULL
+ 	},
+ 	{	/* Allow interrupts during suspend on Compaq Laptops*/
+ 		set_apm_ints, "Compaq 12XL125",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "Compaq"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Compaq PC"),
+ 			DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+-			DMI_MATCH(DMI_BIOS_VERSION,"4.06"), },
++			DMI_MATCH(DMI_BIOS_VERSION,"4.06"), }, NULL
+ 	},
+ 	{	/* Allow interrupts during APM or the clock goes slow */
+ 		set_apm_ints, "ASUSTeK",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "ASUSTeK Computer Inc."),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "L8400K series Notebook PC"), },
++			DMI_MATCH(DMI_PRODUCT_NAME, "L8400K series Notebook PC"), }, NULL
+ 	},
+ 	{	/* APM blows on shutdown */
+ 		apm_is_horked, "ABIT KX7-333[R]",
+ 		{	DMI_MATCH(DMI_BOARD_VENDOR, "ABIT"),
+-			DMI_MATCH(DMI_BOARD_NAME, "VT8367-8233A (KX7-333[R])"), },
++			DMI_MATCH(DMI_BOARD_NAME, "VT8367-8233A (KX7-333[R])"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked, "Trigem Delhi3",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "TriGem Computer, Inc"),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "Delhi3"), },
++			DMI_MATCH(DMI_PRODUCT_NAME, "Delhi3"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked, "Fujitsu-Siemens",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "hoenix/FUJITSU SIEMENS"),
+-			DMI_MATCH(DMI_BIOS_VERSION, "Version1.01"), },
++			DMI_MATCH(DMI_BIOS_VERSION, "Version1.01"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked_d850md, "Intel D850MD",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Intel Corp."),
+-			DMI_MATCH(DMI_BIOS_VERSION, "MV85010A.86A.0016.P07.0201251536"), },
++			DMI_MATCH(DMI_BIOS_VERSION, "MV85010A.86A.0016.P07.0201251536"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked, "Intel D810EMO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Intel Corp."),
+-			DMI_MATCH(DMI_BIOS_VERSION, "MO81010A.86A.0008.P04.0004170800"), },
++			DMI_MATCH(DMI_BIOS_VERSION, "MO81010A.86A.0008.P04.0004170800"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked, "Dell XPS-Z",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Intel Corp."),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "A11"),
+-			DMI_MATCH(DMI_PRODUCT_NAME, "XPS-Z"), },
++			DMI_MATCH(DMI_PRODUCT_NAME, "XPS-Z"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked, "Sharp PC-PJ/AX",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "SHARP"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "PC-PJ/AX"),
+ 			DMI_MATCH(DMI_BIOS_VENDOR,"SystemSoft"),
+-			DMI_MATCH(DMI_BIOS_VERSION,"Version R2.08"), },
++			DMI_MATCH(DMI_BIOS_VERSION,"Version R2.08"), }, NULL
+ 	},
+ 	{	/* APM crashes */
+ 		apm_is_horked, "Dell Inspiron 2500",
+ 		{	DMI_MATCH(DMI_SYS_VENDOR, "Dell Computer Corporation"),
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "Inspiron 2500"),
+ 			DMI_MATCH(DMI_BIOS_VENDOR,"Phoenix Technologies LTD"),
+-			DMI_MATCH(DMI_BIOS_VERSION,"A11"), },
++			DMI_MATCH(DMI_BIOS_VERSION,"A11"), }, NULL
+ 	},
+ 	{	/* APM idle hangs */
+ 		apm_likes_to_melt, "Jabil AMD",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
+-			DMI_MATCH(DMI_BIOS_VERSION, "0AASNP06"), },
++			DMI_MATCH(DMI_BIOS_VERSION, "0AASNP06"), }, NULL
+ 	},
+ 	{	/* APM idle hangs */
+ 		apm_likes_to_melt, "AMI Bios",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "American Megatrends Inc."),
+-			DMI_MATCH(DMI_BIOS_VERSION, "0AASNP05"), },
++			DMI_MATCH(DMI_BIOS_VERSION, "0AASNP05"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-N505X(DE) */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0206H"),
+-			DMI_MATCH(DMI_BIOS_DATE, "08/23/99"), },
++			DMI_MATCH(DMI_BIOS_DATE, "08/23/99"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-N505VX */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "W2K06H0"),
+-			DMI_MATCH(DMI_BIOS_DATE, "02/03/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "02/03/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-XG29 */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0117A0"),
+-			DMI_MATCH(DMI_BIOS_DATE, "04/25/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "04/25/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-Z600NE */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0121Z1"),
+-			DMI_MATCH(DMI_BIOS_DATE, "05/11/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "05/11/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-Z600NE */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "WME01Z1"),
+-			DMI_MATCH(DMI_BIOS_DATE, "08/11/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "08/11/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-Z600LEK(DE) */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0206Z3"),
+-			DMI_MATCH(DMI_BIOS_DATE, "12/25/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "12/25/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-Z505LS */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0203D0"),
+-			DMI_MATCH(DMI_BIOS_DATE, "05/12/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "05/12/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-Z505LS */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0203Z3"),
+-			DMI_MATCH(DMI_BIOS_DATE, "08/25/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "08/25/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-Z505LS (with updated BIOS) */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0209Z3"),
+-			DMI_MATCH(DMI_BIOS_DATE, "05/12/01"), },
++			DMI_MATCH(DMI_BIOS_DATE, "05/12/01"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-F104K */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0204K2"),
+-			DMI_MATCH(DMI_BIOS_DATE, "08/28/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "08/28/00"), }, NULL
+ 	},
+ 
+ 	{	/* Handle problems with APM on Sony Vaio PCG-C1VN/C1VE */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0208P1"),
+-			DMI_MATCH(DMI_BIOS_DATE, "11/09/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "11/09/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-C1VE */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "R0204P1"),
+-			DMI_MATCH(DMI_BIOS_DATE, "09/12/00"), },
++			DMI_MATCH(DMI_BIOS_DATE, "09/12/00"), }, NULL
+ 	},
+ 	{	/* Handle problems with APM on Sony Vaio PCG-C1VE */
+ 		swab_apm_power_in_minutes, "Sony VAIO",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Phoenix Technologies LTD"),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "WXPO1Z3"),
+-			DMI_MATCH(DMI_BIOS_DATE, "10/26/01"), },
++			DMI_MATCH(DMI_BIOS_DATE, "10/26/01"), }, NULL
+ 	},
+ 	{	/* broken PM poweroff bios */
+ 		set_realmode_power_off, "Award Software v4.60 PGMA",
+ 		{	DMI_MATCH(DMI_BIOS_VENDOR, "Award Software International, Inc."),
+ 			DMI_MATCH(DMI_BIOS_VERSION, "4.60 PGMA"),
+-			DMI_MATCH(DMI_BIOS_DATE, "134526184"), },
++			DMI_MATCH(DMI_BIOS_DATE, "134526184"), }, NULL
+ 	},
+ 
+ 	/* Generic per vendor APM settings  */
+ 
+ 	{	/* Allow interrupts during suspend on IBM laptops */
+ 		set_apm_ints, "IBM",
+-		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), },
++		{	DMI_MATCH(DMI_SYS_VENDOR, "IBM"), }, NULL
+ 	},
+ 
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, NULL)}, NULL}
+ };
+ 
+ /*
+@@ -2196,6 +2245,10 @@ static int __init apm_init(void)
+ 	struct desc_struct *gdt;
+ 	int err;
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	unsigned long cr0;
++#endif
++
+ 	dmi_check_system(apm_dmi_table);
+ 
+ 	if (apm_info.bios.version == 0 || paravirt_enabled()) {
+@@ -2269,9 +2322,18 @@ static int __init apm_init(void)
+ 	 * This is for buggy BIOS's that refer to (real mode) segment 0x40
+ 	 * even though they are called in protected mode.
+ 	 */
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_open_kernel(cr0);
++#endif
++
+ 	set_base(bad_bios_desc, __va((unsigned long)0x40 << 4));
+ 	_set_limit((char *)&bad_bios_desc, 4095 - (0x40 << 4));
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_close_kernel(cr0);
++#endif
++
+ 	/*
+ 	 * Set up the long jump entry point to the APM BIOS, which is called
+ 	 * from inline assembly.
+@@ -2290,6 +2352,11 @@ static int __init apm_init(void)
+ 	 * code to that CPU.
+ 	 */
+ 	gdt = get_cpu_gdt_table(0);
++
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_open_kernel(cr0);
++#endif
++
+ 	set_base(gdt[APM_CS >> 3],
+ 		 __va((unsigned long)apm_info.bios.cseg << 4));
+ 	set_base(gdt[APM_CS_16 >> 3],
+@@ -2297,6 +2364,10 @@ static int __init apm_init(void)
+ 	set_base(gdt[APM_DS >> 3],
+ 		 __va((unsigned long)apm_info.bios.dseg << 4));
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++	pax_close_kernel(cr0);
++#endif
++
+ 	apm_proc = create_proc_entry("apm", 0, NULL);
+ 	if (apm_proc)
+ 		apm_proc->proc_fops = &apm_file_ops;
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/asm-offsets.c linux-2.6.23.15-grsec/arch/i386/kernel/asm-offsets.c
+--- linux-2.6.23.15/arch/i386/kernel/asm-offsets.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/asm-offsets.c	2008-02-11 10:37:44.000000000 +0000
+@@ -109,6 +109,7 @@ void foo(void)
+ 	DEFINE(PTRS_PER_PTE, PTRS_PER_PTE);
+ 	DEFINE(PTRS_PER_PMD, PTRS_PER_PMD);
+ 	DEFINE(PTRS_PER_PGD, PTRS_PER_PGD);
++	DEFINE(PERCPU_MODULE_RESERVE, PERCPU_MODULE_RESERVE);
+ 
+ 	DEFINE(VDSO_PRELINK_asm, VDSO_PRELINK);
+ 
+@@ -122,6 +123,7 @@ void foo(void)
+ 	OFFSET(PARAVIRT_irq_enable_sysexit, paravirt_ops, irq_enable_sysexit);
+ 	OFFSET(PARAVIRT_iret, paravirt_ops, iret);
+ 	OFFSET(PARAVIRT_read_cr0, paravirt_ops, read_cr0);
++	OFFSET(PARAVIRT_write_cr0, paravirt_ops, write_cr0);
+ #endif
+ 
+ #ifdef CONFIG_XEN
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/cpu/common.c linux-2.6.23.15-grsec/arch/i386/kernel/cpu/common.c
+--- linux-2.6.23.15/arch/i386/kernel/cpu/common.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/cpu/common.c	2008-02-11 10:37:44.000000000 +0000
+@@ -4,7 +4,6 @@
+ #include <linux/smp.h>
+ #include <linux/module.h>
+ #include <linux/percpu.h>
+-#include <linux/bootmem.h>
+ #include <asm/semaphore.h>
+ #include <asm/processor.h>
+ #include <asm/i387.h>
+@@ -21,39 +20,15 @@
+ 
+ #include "cpu.h"
+ 
+-DEFINE_PER_CPU(struct gdt_page, gdt_page) = { .gdt = {
+-	[GDT_ENTRY_KERNEL_CS] = { 0x0000ffff, 0x00cf9a00 },
+-	[GDT_ENTRY_KERNEL_DS] = { 0x0000ffff, 0x00cf9200 },
+-	[GDT_ENTRY_DEFAULT_USER_CS] = { 0x0000ffff, 0x00cffa00 },
+-	[GDT_ENTRY_DEFAULT_USER_DS] = { 0x0000ffff, 0x00cff200 },
+-	/*
+-	 * Segments used for calling PnP BIOS have byte granularity.
+-	 * They code segments and data segments have fixed 64k limits,
+-	 * the transfer segment sizes are set at run time.
+-	 */
+-	[GDT_ENTRY_PNPBIOS_CS32] = { 0x0000ffff, 0x00409a00 },/* 32-bit code */
+-	[GDT_ENTRY_PNPBIOS_CS16] = { 0x0000ffff, 0x00009a00 },/* 16-bit code */
+-	[GDT_ENTRY_PNPBIOS_DS] = { 0x0000ffff, 0x00009200 }, /* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_TS1] = { 0x00000000, 0x00009200 },/* 16-bit data */
+-	[GDT_ENTRY_PNPBIOS_TS2] = { 0x00000000, 0x00009200 },/* 16-bit data */
+-	/*
+-	 * The APM segments have byte granularity and their bases
+-	 * are set at run time.  All have 64k limits.
+-	 */
+-	[GDT_ENTRY_APMBIOS_BASE] = { 0x0000ffff, 0x00409a00 },/* 32-bit code */
+-	/* 16-bit code */
+-	[GDT_ENTRY_APMBIOS_BASE+1] = { 0x0000ffff, 0x00009a00 },
+-	[GDT_ENTRY_APMBIOS_BASE+2] = { 0x0000ffff, 0x00409200 }, /* data */
+-
+-	[GDT_ENTRY_ESPFIX_SS] = { 0x00000000, 0x00c09200 },
+-	[GDT_ENTRY_PERCPU] = { 0x00000000, 0x00000000 },
+-} };
+-EXPORT_PER_CPU_SYMBOL_GPL(gdt_page);
+-
+ static int cachesize_override __cpuinitdata = -1;
+ static int disable_x86_fxsr __cpuinitdata;
+ static int disable_x86_serial_nr __cpuinitdata = 1;
+-static int disable_x86_sep __cpuinitdata;
++
++#if defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_KERNEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
++int disable_x86_sep __cpuinitdata = 1;
++#else
++int disable_x86_sep __cpuinitdata;
++#endif
+ 
+ struct cpu_dev * cpu_devs[X86_VENDOR_NUM] = {};
+ 
+@@ -261,10 +236,10 @@ static int __cpuinit have_cpuid_p(void)
+ void __init cpu_detect(struct cpuinfo_x86 *c)
+ {
+ 	/* Get vendor name */
+-	cpuid(0x00000000, &c->cpuid_level,
+-	      (int *)&c->x86_vendor_id[0],
+-	      (int *)&c->x86_vendor_id[8],
+-	      (int *)&c->x86_vendor_id[4]);
++	cpuid(0x00000000, (unsigned int *)&c->cpuid_level,
++	      (unsigned int *)&c->x86_vendor_id[0],
++	      (unsigned int *)&c->x86_vendor_id[8],
++	      (unsigned int *)&c->x86_vendor_id[4]);
+ 
+ 	c->x86 = 4;
+ 	if (c->cpuid_level >= 0x00000001) {
+@@ -304,15 +279,14 @@ static void __init early_cpu_detect(void
+ 
+ static void __cpuinit generic_identify(struct cpuinfo_x86 * c)
+ {
+-	u32 tfms, xlvl;
+-	int ebx;
++	u32 tfms, xlvl, ebx;
+ 
+ 	if (have_cpuid_p()) {
+ 		/* Get vendor name */
+-		cpuid(0x00000000, &c->cpuid_level,
+-		      (int *)&c->x86_vendor_id[0],
+-		      (int *)&c->x86_vendor_id[8],
+-		      (int *)&c->x86_vendor_id[4]);
++		cpuid(0x00000000, (unsigned int *)&c->cpuid_level,
++		      (unsigned int *)&c->x86_vendor_id[0],
++		      (unsigned int *)&c->x86_vendor_id[8],
++		      (unsigned int *)&c->x86_vendor_id[4]);
+ 		
+ 		get_cpu_vendor(c, 0);
+ 		/* Initialize the standard set of capabilities */
+@@ -644,7 +618,7 @@ void switch_to_new_gdt(void)
+ {
+ 	struct Xgt_desc_struct gdt_descr;
+ 
+-	gdt_descr.address = (long)get_cpu_gdt_table(smp_processor_id());
++	gdt_descr.address = get_cpu_gdt_table(smp_processor_id());
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+ 	asm("mov %0, %%fs" : : "r" (__KERNEL_PERCPU) : "memory");
+@@ -660,7 +634,7 @@ void __cpuinit cpu_init(void)
+ {
+ 	int cpu = smp_processor_id();
+ 	struct task_struct *curr = current;
+-	struct tss_struct * t = &per_cpu(init_tss, cpu);
++	struct tss_struct *t = init_tss + cpu;
+ 	struct thread_struct *thread = &curr->thread;
+ 
+ 	if (cpu_test_and_set(cpu, cpu_initialized)) {
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c linux-2.6.23.15-grsec/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c
+--- linux-2.6.23.15/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/cpu/cpufreq/acpi-cpufreq.c	2008-02-11 10:37:44.000000000 +0000
+@@ -549,7 +549,7 @@ static struct dmi_system_id sw_any_bug_d
+ 			DMI_MATCH(DMI_PRODUCT_NAME, "X6DLP"),
+ 		},
+ 	},
+-	{ }
++	{ NULL, NULL, {DMI_MATCH(DMI_NONE, NULL)}, NULL }
+ };
+ #endif
+ 
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/cpu/cpufreq/speedstep-centrino.c linux-2.6.23.15-grsec/arch/i386/kernel/cpu/cpufreq/speedstep-centrino.c
+--- linux-2.6.23.15/arch/i386/kernel/cpu/cpufreq/speedstep-centrino.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/cpu/cpufreq/speedstep-centrino.c	2008-02-11 10:37:44.000000000 +0000
+@@ -223,7 +223,7 @@ static struct cpu_model models[] =
+ 	{ &cpu_ids[CPU_MP4HT_D0], NULL, 0, NULL },
+ 	{ &cpu_ids[CPU_MP4HT_E0], NULL, 0, NULL },
+ 
+-	{ NULL, }
++	{ NULL, NULL, 0, NULL}
+ };
+ #undef _BANIAS
+ #undef BANIAS
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/cpu/intel_cacheinfo.c linux-2.6.23.15-grsec/arch/i386/kernel/cpu/intel_cacheinfo.c
+--- linux-2.6.23.15/arch/i386/kernel/cpu/intel_cacheinfo.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/cpu/intel_cacheinfo.c	2008-02-11 10:37:44.000000000 +0000
+@@ -351,8 +351,8 @@ unsigned int __cpuinit init_intel_cachei
+ 	 */
+ 	if ((num_cache_leaves == 0 || c->x86 == 15) && c->cpuid_level > 1) {
+ 		/* supports eax=2  call */
+-		int i, j, n;
+-		int regs[4];
++		int j, n;
++		unsigned int regs[4];
+ 		unsigned char *dp = (unsigned char *)regs;
+ 		int only_trace = 0;
+ 
+@@ -367,7 +367,7 @@ unsigned int __cpuinit init_intel_cachei
+ 
+ 			/* If bit 31 is set, this is an unknown format */
+ 			for ( j = 0 ; j < 3 ; j++ ) {
+-				if ( regs[j] < 0 ) regs[j] = 0;
++				if ( (int)regs[j] < 0 ) regs[j] = 0;
+ 			}
+ 
+ 			/* Byte 0 is level count, not a descriptor */
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/cpu/mcheck/therm_throt.c linux-2.6.23.15-grsec/arch/i386/kernel/cpu/mcheck/therm_throt.c
+--- linux-2.6.23.15/arch/i386/kernel/cpu/mcheck/therm_throt.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/cpu/mcheck/therm_throt.c	2008-02-11 10:37:44.000000000 +0000
+@@ -152,7 +152,7 @@ static __cpuinit int thermal_throttle_cp
+ 	return NOTIFY_OK;
+ }
+ 
+-static struct notifier_block thermal_throttle_cpu_notifier =
++static __cpuinitdata struct notifier_block thermal_throttle_cpu_notifier =
+ {
+ 	.notifier_call = thermal_throttle_cpu_callback,
+ };
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/cpu/mtrr/generic.c linux-2.6.23.15-grsec/arch/i386/kernel/cpu/mtrr/generic.c
+--- linux-2.6.23.15/arch/i386/kernel/cpu/mtrr/generic.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/cpu/mtrr/generic.c	2008-02-11 10:37:44.000000000 +0000
+@@ -29,11 +29,11 @@ static struct fixed_range_block fixed_ra
+ 	{ MTRRfix64K_00000_MSR, 1 }, /* one  64k MTRR  */
+ 	{ MTRRfix16K_80000_MSR, 2 }, /* two  16k MTRRs */
+ 	{ MTRRfix4K_C0000_MSR,  8 }, /* eight 4k MTRRs */
+-	{}
++	{ 0, 0 }
+ };
+ 
+ static unsigned long smp_changes_mask;
+-static struct mtrr_state mtrr_state = {};
++static struct mtrr_state mtrr_state;
+ 
+ #undef MODULE_PARAM_PREFIX
+ #define MODULE_PARAM_PREFIX "mtrr."
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/crash.c linux-2.6.23.15-grsec/arch/i386/kernel/crash.c
+--- linux-2.6.23.15/arch/i386/kernel/crash.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/crash.c	2008-02-11 10:37:44.000000000 +0000
+@@ -55,7 +55,7 @@ static int crash_nmi_callback(struct not
+ 		return NOTIFY_STOP;
+ 	local_irq_disable();
+ 
+-	if (!user_mode_vm(regs)) {
++	if (!user_mode(regs)) {
+ 		crash_fixup_ss_esp(&fixed_regs, regs);
+ 		regs = &fixed_regs;
+ 	}
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/doublefault.c linux-2.6.23.15-grsec/arch/i386/kernel/doublefault.c
+--- linux-2.6.23.15/arch/i386/kernel/doublefault.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/doublefault.c	2008-02-11 10:37:44.000000000 +0000
+@@ -11,17 +11,17 @@
+ 
+ #define DOUBLEFAULT_STACKSIZE (1024)
+ static unsigned long doublefault_stack[DOUBLEFAULT_STACKSIZE];
+-#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE)
++#define STACK_START (unsigned long)(doublefault_stack+DOUBLEFAULT_STACKSIZE-2)
+ 
+ #define ptr_ok(x) ((x) > PAGE_OFFSET && (x) < PAGE_OFFSET + MAXMEM)
+ 
+ static void doublefault_fn(void)
+ {
+-	struct Xgt_desc_struct gdt_desc = {0, 0};
++	struct Xgt_desc_struct gdt_desc = {0, NULL, 0};
+ 	unsigned long gdt, tss;
+ 
+ 	store_gdt(&gdt_desc);
+-	gdt = gdt_desc.address;
++	gdt = (unsigned long)gdt_desc.address;
+ 
+ 	printk(KERN_EMERG "PANIC: double fault, gdt at %08lx [%d bytes]\n", gdt, gdt_desc.size);
+ 
+@@ -59,10 +59,10 @@ struct tss_struct doublefault_tss __cach
+ 		/* 0x2 bit is always set */
+ 		.eflags		= X86_EFLAGS_SF | 0x2,
+ 		.esp		= STACK_START,
+-		.es		= __USER_DS,
++		.es		= __KERNEL_DS,
+ 		.cs		= __KERNEL_CS,
+ 		.ss		= __KERNEL_DS,
+-		.ds		= __USER_DS,
++		.ds		= __KERNEL_DS,
+ 		.fs		= __KERNEL_PERCPU,
+ 
+ 		.__cr3		= __pa(swapper_pg_dir)
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/efi.c linux-2.6.23.15-grsec/arch/i386/kernel/efi.c
+--- linux-2.6.23.15/arch/i386/kernel/efi.c	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/efi.c	2008-02-11 10:37:44.000000000 +0000
+@@ -63,45 +63,23 @@ extern void * boot_ioremap(unsigned long
+ 
+ static unsigned long efi_rt_eflags;
+ static DEFINE_SPINLOCK(efi_rt_lock);
+-static pgd_t efi_bak_pg_dir_pointer[2];
++static pgd_t __initdata efi_bak_pg_dir_pointer[KERNEL_PGD_PTRS] __attribute__ ((aligned (4096)));
+ 
+ static void efi_call_phys_prelog(void) __acquires(efi_rt_lock)
+ {
+-	unsigned long cr4;
+-	unsigned long temp;
+ 	struct Xgt_desc_struct gdt_descr;
+ 
+ 	spin_lock(&efi_rt_lock);
+ 	local_irq_save(efi_rt_eflags);
+ 
+-	/*
+-	 * If I don't have PSE, I should just duplicate two entries in page
+-	 * directory. If I have PSE, I just need to duplicate one entry in
+-	 * page directory.
+-	 */
+-	cr4 = read_cr4();
+-
+-	if (cr4 & X86_CR4_PSE) {
+-		efi_bak_pg_dir_pointer[0].pgd =
+-		    swapper_pg_dir[pgd_index(0)].pgd;
+-		swapper_pg_dir[0].pgd =
+-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
+-	} else {
+-		efi_bak_pg_dir_pointer[0].pgd =
+-		    swapper_pg_dir[pgd_index(0)].pgd;
+-		efi_bak_pg_dir_pointer[1].pgd =
+-		    swapper_pg_dir[pgd_index(0x400000)].pgd;
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    swapper_pg_dir[pgd_index(PAGE_OFFSET)].pgd;
+-		temp = PAGE_OFFSET + 0x400000;
+-		swapper_pg_dir[pgd_index(0x400000)].pgd =
+-		    swapper_pg_dir[pgd_index(temp)].pgd;
+-	}
++	clone_pgd_range(efi_bak_pg_dir_pointer, swapper_pg_dir, KERNEL_PGD_PTRS);
++	clone_pgd_range(swapper_pg_dir, swapper_pg_dir + USER_PGD_PTRS,
++			min_t(unsigned long, KERNEL_PGD_PTRS, USER_PGD_PTRS));
+ 
+ 	/*
+ 	 * After the lock is released, the original page table is restored.
+ 	 */
+-	local_flush_tlb();
++	__flush_tlb_all();
+ 
+ 	gdt_descr.address = __pa(get_cpu_gdt_table(0));
+ 	gdt_descr.size = GDT_SIZE - 1;
+@@ -110,35 +88,23 @@ static void efi_call_phys_prelog(void) _
+ 
+ static void efi_call_phys_epilog(void) __releases(efi_rt_lock)
+ {
+-	unsigned long cr4;
+ 	struct Xgt_desc_struct gdt_descr;
+ 
+-	gdt_descr.address = (unsigned long)get_cpu_gdt_table(0);
++	gdt_descr.address = get_cpu_gdt_table(0);
+ 	gdt_descr.size = GDT_SIZE - 1;
+ 	load_gdt(&gdt_descr);
+-
+-	cr4 = read_cr4();
+-
+-	if (cr4 & X86_CR4_PSE) {
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    efi_bak_pg_dir_pointer[0].pgd;
+-	} else {
+-		swapper_pg_dir[pgd_index(0)].pgd =
+-		    efi_bak_pg_dir_pointer[0].pgd;
+-		swapper_pg_dir[pgd_index(0x400000)].pgd =
+-		    efi_bak_pg_dir_pointer[1].pgd;
+-	}
++	clone_pgd_range(swapper_pg_dir, efi_bak_pg_dir_pointer, KERNEL_PGD_PTRS);
+ 
+ 	/*
+ 	 * After the lock is released, the original page table is restored.
+ 	 */
+-	local_flush_tlb();
++	__flush_tlb_all();
+ 
+ 	local_irq_restore(efi_rt_eflags);
+ 	spin_unlock(&efi_rt_lock);
+ }
+ 
+-static efi_status_t
++static efi_status_t __init
+ phys_efi_set_virtual_address_map(unsigned long memory_map_size,
+ 				 unsigned long descriptor_size,
+ 				 u32 descriptor_version,
+@@ -154,7 +120,7 @@ phys_efi_set_virtual_address_map(unsigne
+ 	return status;
+ }
+ 
+-static efi_status_t
++static efi_status_t __init
+ phys_efi_get_time(efi_time_t *tm, efi_time_cap_t *tc)
+ {
+ 	efi_status_t status;
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/efi_stub.S linux-2.6.23.15-grsec/arch/i386/kernel/efi_stub.S
+--- linux-2.6.23.15/arch/i386/kernel/efi_stub.S	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/efi_stub.S	2008-02-11 10:37:44.000000000 +0000
+@@ -6,6 +6,7 @@
+  */
+ 
+ #include <linux/linkage.h>
++#include <linux/init.h>
+ #include <asm/page.h>
+ 
+ /*
+@@ -20,7 +21,7 @@
+  * service functions will comply with gcc calling convention, too.
+  */
+ 
+-.text
++__INIT
+ ENTRY(efi_call_phys)
+ 	/*
+ 	 * 0. The function can only be called in Linux kernel. So CS has been
+@@ -36,9 +37,7 @@ ENTRY(efi_call_phys)
+ 	 * The mapping of lower virtual memory has been created in prelog and
+ 	 * epilog.
+ 	 */
+-	movl	$1f, %edx
+-	subl	$__PAGE_OFFSET, %edx
+-	jmp	*%edx
++	jmp	1f-__PAGE_OFFSET
+ 1:
+ 
+ 	/*
+@@ -47,14 +46,8 @@ ENTRY(efi_call_phys)
+ 	 * parameter 2, ..., param n. To make things easy, we save the return
+ 	 * address of efi_call_phys in a global variable.
+ 	 */
+-	popl	%edx
+-	movl	%edx, saved_return_addr
+-	/* get the function pointer into ECX*/
+-	popl	%ecx
+-	movl	%ecx, efi_rt_function_ptr
+-	movl	$2f, %edx
+-	subl	$__PAGE_OFFSET, %edx
+-	pushl	%edx
++	popl	(saved_return_addr)
++	popl	(efi_rt_function_ptr)
+ 
+ 	/*
+ 	 * 3. Clear PG bit in %CR0.
+@@ -73,9 +66,8 @@ ENTRY(efi_call_phys)
+ 	/*
+ 	 * 5. Call the physical function.
+ 	 */
+-	jmp	*%ecx
++	call	*(efi_rt_function_ptr-__PAGE_OFFSET)
+ 
+-2:
+ 	/*
+ 	 * 6. After EFI runtime service returns, control will return to
+ 	 * following instruction. We'd better readjust stack pointer first.
+@@ -88,34 +80,27 @@ ENTRY(efi_call_phys)
+ 	movl	%cr0, %edx
+ 	orl	$0x80000000, %edx
+ 	movl	%edx, %cr0
+-	jmp	1f
+-1:
++
+ 	/*
+ 	 * 8. Now restore the virtual mode from flat mode by
+ 	 * adding EIP with PAGE_OFFSET.
+ 	 */
+-	movl	$1f, %edx
+-	jmp	*%edx
++	jmp	1f+__PAGE_OFFSET
+ 1:
+ 
+ 	/*
+ 	 * 9. Balance the stack. And because EAX contain the return value,
+ 	 * we'd better not clobber it.
+ 	 */
+-	leal	efi_rt_function_ptr, %edx
+-	movl	(%edx), %ecx
+-	pushl	%ecx
++	pushl	(efi_rt_function_ptr)
+ 
+ 	/*
+-	 * 10. Push the saved return address onto the stack and return.
++	 * 10. Return to the saved return address.
+ 	 */
+-	leal	saved_return_addr, %edx
+-	movl	(%edx), %ecx
+-	pushl	%ecx
+-	ret
++	jmpl	*(saved_return_addr)
+ .previous
+ 
+-.data
++__INITDATA
+ saved_return_addr:
+ 	.long 0
+ efi_rt_function_ptr:
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/entry.S linux-2.6.23.15-grsec/arch/i386/kernel/entry.S
+--- linux-2.6.23.15/arch/i386/kernel/entry.S	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/entry.S	2008-02-11 10:37:44.000000000 +0000
+@@ -97,7 +97,7 @@ VM_MASK		= 0x00020000
+ #define resume_userspace_sig	resume_userspace
+ #endif
+ 
+-#define SAVE_ALL \
++#define __SAVE_ALL(_DS) \
+ 	cld; \
+ 	pushl %fs; \
+ 	CFI_ADJUST_CFA_OFFSET 4;\
+@@ -129,12 +129,26 @@ VM_MASK		= 0x00020000
+ 	pushl %ebx; \
+ 	CFI_ADJUST_CFA_OFFSET 4;\
+ 	CFI_REL_OFFSET ebx, 0;\
+-	movl $(__USER_DS), %edx; \
++	movl $(_DS), %edx; \
+ 	movl %edx, %ds; \
+ 	movl %edx, %es; \
+ 	movl $(__KERNEL_PERCPU), %edx; \
+ 	movl %edx, %fs
+ 
++#ifdef CONFIG_PAX_KERNEXEC
++#define SAVE_ALL \
++	__SAVE_ALL(__KERNEL_DS); \
++	GET_CR0_INTO_EDX; \
++	movl %edx, %esi; \
++	orl $X86_CR0_WP, %edx; \
++	xorl %edx, %esi; \
++	SET_CR0_FROM_EDX
++#elif defined(CONFIG_PAX_PAGEEXEC) || defined(CONFIG_PAX_SEGMEXEC) || defined(CONFIG_PAX_MEMORY_UDEREF)
++#define SAVE_ALL __SAVE_ALL(__KERNEL_DS)
++#else
++#define SAVE_ALL __SAVE_ALL(__USER_DS)
++#endif
++
+ #define RESTORE_INT_REGS \
+ 	popl %ebx;	\
+ 	CFI_ADJUST_CFA_OFFSET -4;\
+@@ -248,7 +262,17 @@ check_userspace:
+ 	movb PT_CS(%esp), %al
+ 	andl $(VM_MASK | SEGMENT_RPL_MASK), %eax
+ 	cmpl $USER_RPL, %eax
++
++#ifdef CONFIG_PAX_KERNEXEC
++	jae resume_userspace
++
++	GET_CR0_INTO_EDX
++	xorl %esi, %edx
++	SET_CR0_FROM_EDX
++	jmp resume_kernel
++#else
+ 	jb resume_kernel		# not returning to v8086 or userspace
++#endif
+ 
+ ENTRY(resume_userspace)
+  	DISABLE_INTERRUPTS(CLBR_ANY)	# make sure we don't miss an interrupt
+@@ -307,10 +331,9 @@ sysenter_past_esp:
+ 	/*CFI_REL_OFFSET cs, 0*/
+ 	/*
+ 	 * Push current_thread_info()->sysenter_return to the stack.
+-	 * A tiny bit of offset fixup is necessary - 4*4 means the 4 words
+-	 * pushed above; +8 corresponds to copy_thread's esp0 setting.
+ 	 */
+-	pushl (TI_sysenter_return-THREAD_SIZE+8+4*4)(%esp)
++	GET_THREAD_INFO(%ebp)
++	pushl TI_sysenter_return(%ebp)
+ 	CFI_ADJUST_CFA_OFFSET 4
+ 	CFI_REL_OFFSET eip, 0
+ 
+@@ -318,9 +341,17 @@ sysenter_past_esp:
+  * Load the potential sixth argument from user stack.
+  * Careful about security.
+  */
++	movl 12(%esp),%ebp
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	mov 16(%esp),%ds
++1:	movl %ds:(%ebp),%ebp
++#else
+ 	cmpl $__PAGE_OFFSET-3,%ebp
+ 	jae syscall_fault
+ 1:	movl (%ebp),%ebp
++#endif
++
+ .section __ex_table,"a"
+ 	.align 4
+ 	.long 1b,syscall_fault
+@@ -343,20 +374,37 @@ sysenter_past_esp:
+ 	movl TI_flags(%ebp), %ecx
+ 	testw $_TIF_ALLWORK_MASK, %cx
+ 	jne syscall_exit_work
++
++#ifdef CONFIG_PAX_RANDKSTACK
++	pushl %eax
++	CFI_ADJUST_CFA_OFFSET 4
++	call pax_randomize_kstack
++	popl %eax
++	CFI_ADJUST_CFA_OFFSET -4
++#endif
++
+ /* if something modifies registers it must also disable sysexit */
+ 	movl PT_EIP(%esp), %edx
+ 	movl PT_OLDESP(%esp), %ecx
+ 	xorl %ebp,%ebp
+ 	TRACE_IRQS_ON
+ 1:	mov  PT_FS(%esp), %fs
++2:	mov  PT_DS(%esp), %ds
++3:	mov  PT_ES(%esp), %es
+ 	ENABLE_INTERRUPTS_SYSEXIT
+ 	CFI_ENDPROC
+ .pushsection .fixup,"ax"
+-2:	movl $0,PT_FS(%esp)
++4:	movl $0,PT_FS(%esp)
+ 	jmp 1b
++5:	movl $0,PT_DS(%esp)
++	jmp 2b
++6:	movl $0,PT_ES(%esp)
++	jmp 3b
+ .section __ex_table,"a"
+ 	.align 4
+-	.long 1b,2b
++	.long 1b,4b
++	.long 2b,5b
++	.long 3b,6b
+ .popsection
+ ENDPROC(sysenter_entry)
+ 
+@@ -389,6 +437,10 @@ no_singlestep:
+ 	testw $_TIF_ALLWORK_MASK, %cx	# current->work
+ 	jne syscall_exit_work
+ 
++#ifdef CONFIG_PAX_RANDKSTACK
++	call pax_randomize_kstack
++#endif
++
+ restore_all:
+ 	movl PT_EFLAGS(%esp), %eax	# mix EFLAGS, SS and CS
+ 	# Warning: PT_OLDSS(%esp) contains the wrong/random values if we
+@@ -552,17 +604,24 @@ syscall_badsys:
+ END(syscall_badsys)
+ 	CFI_ENDPROC
+ 
+-#define FIXUP_ESPFIX_STACK \
+-	/* since we are on a wrong stack, we cant make it a C code :( */ \
+-	PER_CPU(gdt_page, %ebx); \
+-	GET_DESC_BASE(GDT_ENTRY_ESPFIX_SS, %ebx, %eax, %ax, %al, %ah); \
+-	addl %esp, %eax; \
+-	pushl $__KERNEL_DS; \
+-	CFI_ADJUST_CFA_OFFSET 4; \
+-	pushl %eax; \
+-	CFI_ADJUST_CFA_OFFSET 4; \
+-	lss (%esp), %esp; \
++.macro FIXUP_ESPFIX_STACK
++	/* since we are on a wrong stack, we cant make it a C code :( */
++#ifdef CONFIG_SMP
++	movl PER_CPU_VAR(cpu_number), %ebx;
++	shll $PAGE_SHIFT_asm, %ebx;
++	addl $cpu_gdt_table, %ebx;
++#else
++	movl $cpu_gdt_table, %ebx;
++#endif
++	GET_DESC_BASE(GDT_ENTRY_ESPFIX_SS, %ebx, %eax, %ax, %al, %ah);
++	addl %esp, %eax;
++	pushl $__KERNEL_DS;
++	CFI_ADJUST_CFA_OFFSET 4;
++	pushl %eax;
++	CFI_ADJUST_CFA_OFFSET 4;
++	lss (%esp), %esp;
+ 	CFI_ADJUST_CFA_OFFSET -8;
++.endm
+ #define UNWIND_ESPFIX_STACK \
+ 	movl %ss, %eax; \
+ 	/* see if on espfix stack */ \
+@@ -579,7 +638,7 @@ END(syscall_badsys)
+  * Build the entry stubs and pointer table with
+  * some assembler magic.
+  */
+-.data
++.section .rodata,"a",@progbits
+ ENTRY(interrupt)
+ .text
+ 
+@@ -679,12 +738,21 @@ error_code:
+ 	popl %ecx
+ 	CFI_ADJUST_CFA_OFFSET -4
+ 	/*CFI_REGISTER es, ecx*/
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_EDX
++	movl %edx, %esi
++	orl $X86_CR0_WP, %edx
++	xorl %edx, %esi
++	SET_CR0_FROM_EDX
++#endif
++
+ 	movl PT_FS(%esp), %edi		# get the function address
+ 	movl PT_ORIG_EAX(%esp), %edx	# get the error code
+ 	movl $-1, PT_ORIG_EAX(%esp)	# no syscall to restart
+ 	mov  %ecx, PT_FS(%esp)
+ 	/*CFI_REL_OFFSET fs, ES*/
+-	movl $(__USER_DS), %ecx
++	movl $(__KERNEL_DS), %ecx
+ 	movl %ecx, %ds
+ 	movl %ecx, %es
+ 	movl %esp,%eax			# pt_regs pointer
+@@ -818,6 +886,13 @@ nmi_stack_correct:
+ 	xorl %edx,%edx		# zero error code
+ 	movl %esp,%eax		# pt_regs pointer
+ 	call do_nmi
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_EDX
++	xorl %esi, %edx
++	SET_CR0_FROM_EDX
++#endif
++
+ 	jmp restore_nocheck_notrace
+ 	CFI_ENDPROC
+ 
+@@ -858,6 +933,13 @@ nmi_espfix_stack:
+ 	FIXUP_ESPFIX_STACK		# %eax == %esp
+ 	xorl %edx,%edx			# zero error code
+ 	call do_nmi
++
++#ifdef CONFIG_PAX_KERNEXEC
++	GET_CR0_INTO_EDX
++	xorl %esi, %edx
++	SET_CR0_FROM_EDX
++#endif
++
+ 	RESTORE_REGS
+ 	lss 12+4(%esp), %esp		# back to espfix stack
+ 	CFI_ADJUST_CFA_OFFSET -24
+@@ -1106,7 +1188,6 @@ ENDPROC(xen_failsafe_callback)
+ 
+ #endif	/* CONFIG_XEN */
+ 
+-.section .rodata,"a"
+ #include "syscall_table.S"
+ 
+ syscall_table_size=(.-sys_call_table)
+diff -Nurp linux-2.6.23.15/arch/i386/kernel/head.S linux-2.6.23.15-grsec/arch/i386/kernel/head.S
+--- linux-2.6.23.15/arch/i386/kernel/head.S	2007-10-09 21:31:38.000000000 +0100
++++ linux-2.6.23.15-grsec/arch/i386/kernel/head.S	2008-02-11 10:37:44.000000000 +0000
+@@ -18,6 +18,7 @@
+ #include <asm/thread_info.h>
+ #include <asm/asm-offsets.h>
+ #include <asm/setup.h>
++#include <asm/msr-index.h>
+ 
+ /*
+  * References to members of the new_cpu_data structure.
+@@ -51,17 +52,22 @@
+  */
+ LOW_PAGES = 1<<(32-PAGE_SHIFT_asm)
+ 
+-#if PTRS_PER_PMD > 1
+-PAGE_TABLE_SIZE = (LOW_PAGES / PTRS_PER_PMD) + PTRS_PER_PGD
+-#else
+-PAGE_TABLE_SIZE = (LOW_PAGES / PTRS_PER_PGD)
+-#endif
++PAGE_TABLE_SIZE = (LOW_PAGES / PTRS_PER_PTE)
+ BOOTBITMAP_SIZE = LOW_PAGES / 8
+ ALLOCATOR_SLOP = 4
+ 
+ INIT_MAP_BEYOND_END = BOOTBITMAP_SIZE + (PAGE_TABLE_SIZE + ALLOCATOR_SLOP)*PAGE_SIZE_asm
+ 
+ /*
++ * Real beginning of normal "text" segment
++ */
++ENTRY(stext)
++ENTRY(_stext)
++
++.section .text.startup,"ax",@progbits
++	ljmp $(__BOOT_CS),$phys_startup_32
++
++/*
+  * 32-bit kernel entrypoint; only used by the boot CPU.  On entry,
+  * %esi points to the real-mode code as a 32-bit pointer.
+  * CS and DS must be 4 GB flat segments, but we don't depend on
+@@ -69,6 +75,12 @@ INIT_MAP_BEYOND_END = BOOTBITMAP_SIZE + 
+  * can.
+  */
+ .section .text.head,"ax",@progbits
++
++#ifdef CONFIG_PAX_KERNEXEC
++/* PaX: fill first page in .text with int3 to catch NULL derefs in kernel mode */
++.fill 4096,1,0xcc
++#endif
++
+ ENTRY(startup_32)
+ 
+ /*
+@@ -82,6 +94,43 @@ ENTRY(startup_32)
+ 	movl %eax,%fs
+ 	movl %eax,%gs
+ 
++	movl $__per_cpu_start,%eax
++	movw %ax,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_PERCPU + 2)
++	rorl $16,%eax
++	movb %al,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_PERCPU + 4)
++	movb %ah,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_PERCPU + 7)
++	movl $__per_cpu_end + PERCPU_MODULE_RESERVE,%eax
++	subl $__per_cpu_start,%eax
++	movw %ax,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_PERCPU + 0)
++
++#ifdef CONFIG_PAX_MEMORY_UDEREF
++	/* check for VMware */
++	movl $0x564d5868,%eax
++	xorl %ebx,%ebx
++	movl $0xa,%ecx
++	movl $0x5658,%edx
++	in (%dx),%eax
++	cmpl $0x564d5868,%ebx
++	jz 1f
++
++	movl $((((__PAGE_OFFSET-1) & 0xf0000000) >> 12) | 0x00c09700),%eax
++	movl %eax,(cpu_gdt_table - __PAGE_OFFSET + GDT_ENTRY_KERNEL_DS * 8 + 4)
++1:
++#endif
++
++#ifdef CONFIG_PAX_KERNEXEC
++	movl $KERNEL_TEXT_OFFSET,%eax
++	movw %ax,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_CS + 2)
++	rorl $16,%eax
++	movb %al,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_CS + 4)
++	movb %ah,(cpu_gdt_table - __PAGE_OFFSET + __KERNEL_CS + 7)
++
++	movb %al,(boot_gdt - __PAGE_OFFSET + __BOOT_CS + 4)
++	movb %ah,(boot_gdt - __PAGE_OFFSET + __BOOT_CS + 7)
++	rorl $16,%eax
++	movw %ax,(boot_gdt - __PAGE_OFFSET + __BOOT_CS + 2)
++#endif
++
+ /*
+  * Clear BSS first so that there are no surprises...
+  * No need to cld as DF is already clear from cld above...
+@@ -129,24 +178,42 @@ ENTRY(startup_32)
+  * Warning: don't use %esi or the stack in this code.  However, %esp
+  * can be used as a GPR if you really need it...
+  */
+-page_pde_offset = (__PAGE_OFFSET >> 20);
+-
++#ifdef CONFIG_X86_PAE
++page_pde_offset = ((__PAGE_OFFSET >> 21) * (PAGE_SIZE_asm / PTRS_PER_PTE));
++#else
++page_pde_offset = ((__PAGE_OFFSET >> 22) * (PAGE_SIZE_asm / PTRS_PER_PTE));
++#endif
+ 	movl $(pg0 - __PAGE_OFFSET), %edi
++#ifdef CONFIG_X86_PAE
++	movl $(swapper_pm_dir - __PAGE_OFFSET), %edx
++#else
+ 	movl $(swapper_pg_dir - __PAGE_OFFSET), %edx
+-	movl $0x007, %eax			/* 0x007 = PRESENT+RW+USER */
++#endif
++	movl $0x063, %eax			/* 0x063 = PRESENT+RW+ACCESSED+DIRTY */
+ 10:
+-	leal 0x007(%edi),%ecx			/* Create PDE entry */
++	leal 0x063(%edi),%ecx			/* Create PDE entry */
+ 	movl %ecx,(%edx)			/* Store identity PDE entry */
+ 	movl %ecx,page_pde_offset(%edx)		/* Store kernel PDE entry */
++#ifdef CONFIG_X86_PAE
++	movl $0,4(%edx)
++	movl $0,page_pde_offset+4(%edx)
++	addl $8,%edx
++	movl $512, %ecx
++#else
+ 	addl $4,%edx
+ 	movl $1024, %ecx
++#endif
+ 11:
+ 	stosl
++#ifdef CONFIG_X86_PAE
++	movl $0,(%edi)
++	addl $4,%edi
++#endif
+ 	addl $0x1000,%eax
+ 	loop 11b
+ 	/* End condition: we must map up to and including INIT_MAP_BEYOND_END */
+-	/* bytes beyond the end of our own page tables; the +0x007 is the attribute bits */
+-	leal (INIT_MAP_BEYOND_END+0x007)(%edi),%ebp
++	/* bytes beyond the end of our own page tables; the +0x063 is the attribute bits */
++	leal (INIT_MAP_BEYOND_END+0x063)(%edi),%ebp
+ 	cmpl %ebp,%eax
+ 	jb 10b
+ 	movl %edi,(init_pg_tables_end - __PAGE_OFFSET)
+@@ -167,10 +234,12 @@ page_pde_offset = (__PAGE_OFFSET >> 20);
+ #endif
+ 
+ 	/* Do an early initialization of the fixmap area */
+-	movl $(swapper_pg_dir - __PAGE_OFFSET), %edx
+-	movl $(swapper_pg_pmd - __PAGE_OFFSET), %eax
+-	addl $0x007, %eax			/* 0x007 = PRESENT+RW+USER */
+-	movl %eax, 4092(%edx)
++	/* 0x067 = PRESENT+RW+USER+ACCESSED+DIRTY */
++#ifdef CONFIG_X86_PAE
++	movl $(swapper_pg_pmd - __PAGE_OFFSET + 0x067), (swapper_pm_dir - __PAGE_OFFSET + 4096 - 8)
++#else
++	movl $(swapper_pg_pmd - __PAGE_OFFSET + 0x067), (swapper_pg_dir - __PAGE_OFFSET + 4096 - 4)
++#endif
+ 
+ #ifdef CONFIG_SMP
+ ENTRY(startup_32_smp)
+@@ -181,6 +250,11 @@ ENTRY(startup_32_smp)
+ 	movl %eax,%fs
+ 	movl %eax,%gs
+ 
++	/* This is a secondary processor (AP) */
++	xorl %ebx,%ebx
++	incl %ebx
++#endif /* CONFIG_SMP */
++
+ /*
+  *	New page tables may be in 4Mbyte page mode and may
+  *	be using the global pages. 
+@@ -196,42 +270,47 @@ ENTRY(startup_32_smp)
+  *	not yet offset PAGE_OFFSET..
+  */
+ #define cr4_bits mmu_cr4_features-__PAGE_OFFSET
++3:
+ 	movl cr4_bits,%edx
+ 	andl %edx,%edx
+-	jz 6f
++	jz 5f
+ 	movl %cr4,%eax		# Turn on paging options (PSE,PAE,..)
+ 	orl %edx,%eax
+ 	movl %eax,%cr4
+ 
+-	btl $5, %eax		# check if PAE is enabled
+-	jnc 6f
++#ifdef CONFIG_X86_PAE
++	movl %ebx,%edi
+ 
+ 	/* Check if extended functions are implemented */