diff -urp binutils-2.18/bfd/elf-bfd.h binutils-2.18-pax/bfd/elf-bfd.h
--- binutils-2.18/bfd/elf-bfd.h	2007-08-06 21:59:22.000000000 +0200
+++ binutils-2.18-pax/bfd/elf-bfd.h	2008-03-31 15:45:16.000000000 +0200
@@ -1431,6 +1431,9 @@ struct elf_obj_tdata
   /* Should the PT_GNU_RELRO segment be emitted?  */
   bfd_boolean relro;
 
+  /* Segment flags for the PT_PAX_FLAGS segment.  */
+  unsigned int pax_flags;
+
   /* Symbol version definitions in external objects.  */
   Elf_Internal_Verdef *verdef;
 
diff -urp binutils-2.18/bfd/elf.c binutils-2.18-pax/bfd/elf.c
--- binutils-2.18/bfd/elf.c	2007-08-28 19:19:33.000000000 +0200
+++ binutils-2.18-pax/bfd/elf.c	2008-03-31 16:23:06.000000000 +0200
@@ -1085,6 +1085,7 @@ get_segment_type (unsigned int p_type)
     case PT_GNU_EH_FRAME: pt = "EH_FRAME"; break;
     case PT_GNU_STACK: pt = "STACK"; break;
     case PT_GNU_RELRO: pt = "RELRO"; break;
+    case PT_PAX_FLAGS: pt = "PAX_FLAGS"; break;
     default: pt = NULL; break;
     }
   return pt;
@@ -2361,6 +2362,9 @@ bfd_section_from_phdr (bfd *abfd, Elf_In
     case PT_GNU_RELRO:
       return _bfd_elf_make_section_from_phdr (abfd, hdr, index, "relro");
 
+    case PT_PAX_FLAGS:
+      return _bfd_elf_make_section_from_phdr (abfd, hdr, index, "pax_flags");
+
     default:
       /* Check for any processor-specific program segment types.  */
       bed = get_elf_backend_data (abfd);
@@ -3341,6 +3345,11 @@ get_program_header_size (bfd *abfd, stru
       ++segs;
     }
 
+    {
+      /* We need a PT_PAX_FLAGS segment.  */
+      ++segs;
+    }
+
   for (s = abfd->sections; s != NULL; s = s->next)
     {
       if ((s->flags & SEC_LOAD) != 0
@@ -3868,6 +3877,20 @@ _bfd_elf_map_sections_to_segments (bfd *
 	  pm = &m->next;
 	}
 
+    {
+      amt = sizeof (struct elf_segment_map);
+      m = bfd_zalloc (abfd, amt);
+      if (m == NULL)
+	goto error_return;
+      m->next = NULL;
+      m->p_type = PT_PAX_FLAGS;
+      m->p_flags = elf_tdata (abfd)->pax_flags;
+      m->p_flags_valid = 1;
+
+      *pm = m;
+      pm = &m->next;
+    }
+
       free (sections);
       elf_tdata (abfd)->segment_map = mfirst;
     }
@@ -5010,7 +5033,8 @@ rewrite_elf_program_header (bfd *ibfd, b
        6. PT_TLS segment includes only SHF_TLS sections.
        7. SHF_TLS sections are only in PT_TLS or PT_LOAD segments.
        8. PT_DYNAMIC should not contain empty sections at the beginning
-	  (with the possible exception of .dynamic).  */
+	  (with the possible exception of .dynamic).
+       9. PT_PAX_FLAGS segments do not include any sections.  */
 #define IS_SECTION_IN_INPUT_SEGMENT(section, segment, bed)		\
   ((((segment->p_paddr							\
       ? IS_CONTAINED_BY_LMA (section, segment, segment->p_paddr)	\
@@ -5018,6 +5042,7 @@ rewrite_elf_program_header (bfd *ibfd, b
      && (section->flags & SEC_ALLOC) != 0)				\
     || IS_COREFILE_NOTE (segment, section))				\
    && segment->p_type != PT_GNU_STACK					\
+   && segment->p_type != PT_PAX_FLAGS					\
    && (segment->p_type != PT_TLS					\
        || (section->flags & SEC_THREAD_LOCAL))				\
    && (segment->p_type == PT_LOAD					\
diff -urp binutils-2.18/bfd/elflink.c binutils-2.18-pax/bfd/elflink.c
--- binutils-2.18/bfd/elflink.c	2007-08-24 16:01:08.000000000 +0200
+++ binutils-2.18-pax/bfd/elflink.c	2008-03-31 16:42:20.000000000 +0200
@@ -5327,17 +5327,31 @@ bfd_elf_size_dynamic_sections (bfd *outp
     return TRUE;
 
   bed = get_elf_backend_data (output_bfd);
+
+  elf_tdata (output_bfd)->pax_flags = PF_NORANDEXEC;
+  if (info->execheap)
+    elf_tdata (output_bfd)->pax_flags |= PF_NOMPROTECT;
+  else if (info->noexecheap)
+    elf_tdata (output_bfd)->pax_flags |= PF_MPROTECT;
+
   elf_tdata (output_bfd)->relro = info->relro;
   if (info->execstack)
-    elf_tdata (output_bfd)->stack_flags = PF_R | PF_W | PF_X;
+    {
+      elf_tdata (output_bfd)->stack_flags = PF_R | PF_W | PF_X;
+      elf_tdata (output_bfd)->pax_flags |= PF_EMUTRAMP;
+    }
   else if (info->noexecstack)
-    elf_tdata (output_bfd)->stack_flags = PF_R | PF_W;
+    {
+      elf_tdata (output_bfd)->stack_flags = PF_R | PF_W;
+      elf_tdata (output_bfd)->pax_flags |= PF_NOEMUTRAMP;
+    }
   else
     {
       bfd *inputobj;
       asection *notesec = NULL;
       int exec = 0;
 
+      elf_tdata (output_bfd)->pax_flags |= PF_NOEMUTRAMP;
       for (inputobj = info->input_bfds;
 	   inputobj;
 	   inputobj = inputobj->link_next)
@@ -5350,7 +5364,11 @@ bfd_elf_size_dynamic_sections (bfd *outp
 	  if (s)
 	    {
 	      if (s->flags & SEC_CODE)
-		exec = PF_X;
+		{
+		  elf_tdata (output_bfd)->pax_flags &= ~PF_NOEMUTRAMP;
+		  elf_tdata (output_bfd)->pax_flags |= PF_EMUTRAMP;
+		  exec = PF_X;
+		}
 	      notesec = s;
 	    }
 	  else if (bed->default_execstack)
diff -urp binutils-2.18/binutils/readelf.c binutils-2.18-pax/binutils/readelf.c
--- binutils-2.18/binutils/readelf.c	2007-08-28 19:19:34.000000000 +0200
+++ binutils-2.18-pax/binutils/readelf.c	2008-03-31 15:45:16.000000000 +0200
@@ -2469,6 +2469,7 @@ get_segment_type (unsigned long p_type)
 			return "GNU_EH_FRAME";
     case PT_GNU_STACK:	return "GNU_STACK";
     case PT_GNU_RELRO:  return "GNU_RELRO";
+    case PT_PAX_FLAGS: return "PAX_FLAGS";
 
     default:
       if ((p_type >= PT_LOPROC) && (p_type <= PT_HIPROC))
diff -urp binutils-2.18/include/bfdlink.h binutils-2.18-pax/include/bfdlink.h
--- binutils-2.18/include/bfdlink.h	2007-08-06 21:59:46.000000000 +0200
+++ binutils-2.18-pax/include/bfdlink.h	2008-03-31 15:45:16.000000000 +0200
@@ -318,6 +318,14 @@ struct bfd_link_info
      flags.  */
   unsigned int noexecstack: 1;
 
+  /* TRUE if PT_PAX_FLAGS segment should be created with PF_NOMPROTECT
+     flags.  */
+  unsigned int execheap: 1;
+
+  /* TRUE if PT_PAX_FLAGS segment should be created with PF_MPROTECT
+     flags.  */
+  unsigned int noexecheap: 1;
+
   /* TRUE if PT_GNU_RELRO segment should be created.  */
   unsigned int relro: 1;
 
diff -urp binutils-2.18/include/elf/common.h binutils-2.18-pax/include/elf/common.h
--- binutils-2.18/include/elf/common.h	2007-08-28 19:19:40.000000000 +0200
+++ binutils-2.18-pax/include/elf/common.h	2008-03-31 15:45:16.000000000 +0200
@@ -309,12 +309,29 @@
 #define PT_SUNW_EH_FRAME PT_GNU_EH_FRAME      /* Solaris uses the same value */
 #define PT_GNU_STACK	(PT_LOOS + 0x474e551) /* Stack flags */
 #define PT_GNU_RELRO	(PT_LOOS + 0x474e552) /* Read-only after relocation */
+#define PT_PAX_FLAGS	(PT_LOOS + 0x5041580) /* PaX flags */
 
 /* Program segment permissions, in program header p_flags field.  */
 
 #define PF_X		(1 << 0)	/* Segment is executable */
 #define PF_W		(1 << 1)	/* Segment is writable */
 #define PF_R		(1 << 2)	/* Segment is readable */
+
+/* Flags to control PaX behaviour. */
+
+#define PF_PAGEEXEC	(1U << 4)	/* Enable  PAGEEXEC */
+#define PF_NOPAGEEXEC	(1U << 5)	/* Disable PAGEEXEC */
+#define PF_SEGMEXEC	(1U << 6)	/* Enable  SEGMEXEC */
+#define PF_NOSEGMEXEC	(1U << 7)	/* Disable SEGMEXEC */
+#define PF_MPROTECT	(1U << 8)	/* Enable  MPROTECT */
+#define PF_NOMPROTECT	(1U << 9)	/* Disable MPROTECT */
+#define PF_RANDEXEC	(1U << 10)	/* Enable  RANDEXEC */
+#define PF_NORANDEXEC	(1U << 11)	/* Disable RANDEXEC */
+#define PF_EMUTRAMP	(1U << 12)	/* Enable  EMUTRAMP */
+#define PF_NOEMUTRAMP	(1U << 13)	/* Disable EMUTRAMP */
+#define PF_RANDMMAP	(1U << 14)	/* Enable  RANDMMAP */
+#define PF_NORANDMMAP	(1U << 15)	/* Disable RANDMMAP */
+
 /* #define PF_MASKOS	0x0F000000    *//* OS-specific reserved bits */
 #define PF_MASKOS	0x0FF00000	/* New value, Oct 4, 1999 Draft */
 #define PF_MASKPROC	0xF0000000	/* Processor-specific reserved bits */
diff -urp binutils-2.18/ld/emultempl/elf32.em binutils-2.18-pax/ld/emultempl/elf32.em
--- binutils-2.18/ld/emultempl/elf32.em	2007-08-24 16:01:56.000000000 +0200
+++ binutils-2.18-pax/ld/emultempl/elf32.em	2008-03-31 16:26:34.000000000 +0200
@@ -2132,6 +2132,16 @@ fragment <<EOF
 	  link_info.noexecstack = TRUE;
 	  link_info.execstack = FALSE;
 	}
+      else if (strcmp (optarg, "execheap") == 0)
+	{
+	  link_info.execheap = TRUE;
+	  link_info.noexecheap = FALSE;
+	}
+      else if (strcmp (optarg, "noexecheap") == 0)
+	{
+	  link_info.noexecheap = TRUE;
+	  link_info.execheap = FALSE;
+	}
 EOF
 
   if test -n "$COMMONPAGESIZE"; then
@@ -2205,6 +2215,7 @@ fragment <<EOF
   fprintf (file, _("  -z combreloc\t\tMerge dynamic relocs into one section and sort\n"));
   fprintf (file, _("  -z defs\t\tReport unresolved symbols in object files.\n"));
   fprintf (file, _("  -z execstack\t\tMark executable as requiring executable stack\n"));
+  fprintf (file, _("  -z execheap\t\tMark executable as requiring executable heap\n"));
   fprintf (file, _("  -z initfirst\t\tMark DSO to be initialized first at runtime\n"));
   fprintf (file, _("  -z interpose\t\tMark object to interpose all DSOs but executable\n"));
   fprintf (file, _("  -z lazy\t\tMark object lazy runtime binding (default)\n"));
@@ -2217,6 +2228,7 @@ fragment <<EOF
   fprintf (file, _("  -z nodlopen\t\tMark DSO not available to dlopen\n"));
   fprintf (file, _("  -z nodump\t\tMark DSO not available to dldump\n"));
   fprintf (file, _("  -z noexecstack\tMark executable as not requiring executable stack\n"));
+  fprintf (file, _("  -z noexecheap\t\tMark executable as not requiring executable heap\n"));
 EOF
 
   if test -n "$COMMONPAGESIZE"; then
diff -urp binutils-2.18/ld/ldgram.y binutils-2.18-pax/ld/ldgram.y
--- binutils-2.18/ld/ldgram.y	2007-08-06 22:00:20.000000000 +0200
+++ binutils-2.18-pax/ld/ldgram.y	2008-03-31 15:45:16.000000000 +0200
@@ -1099,6 +1099,8 @@ phdr_type:
 			    $$ = exp_intop (0x6474e550);
 			  else if (strcmp (s, "PT_GNU_STACK") == 0)
 			    $$ = exp_intop (0x6474e551);
+			  else if (strcmp (s, "PT_PAX_FLAGS") == 0)
+			    $$ = exp_intop (0x65041580);
 			  else
 			    {
 			      einfo (_("\
diff -urp binutils-2.18/ld/testsuite/ld-i386/tlsbin.rd binutils-2.18-pax/ld/testsuite/ld-i386/tlsbin.rd
--- binutils-2.18/ld/testsuite/ld-i386/tlsbin.rd	2006-10-17 15:41:48.000000000 +0200
+++ binutils-2.18-pax/ld/testsuite/ld-i386/tlsbin.rd	2008-03-31 15:45:16.000000000 +0200
@@ -33,7 +33,7 @@ Key to Flags:
 
 Elf file type is EXEC \(Executable file\)
 Entry point 0x8049178
-There are 6 program headers, starting at offset [0-9]+
+There are 7 program headers, starting at offset [0-9]+
 
 Program Headers:
   Type +Offset +VirtAddr +PhysAddr +FileSiz +MemSiz +Flg Align
@@ -44,6 +44,7 @@ Program Headers:
   LOAD.*
   DYNAMIC.*
   TLS +0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x0+60 0x0+a0 R +0x1000
+  PAX_FLAGS +0x000000 0x00000000 0x00000000 0x00000 0x00000 +0x4
 
  Section to Segment mapping:
   Segment Sections...
@@ -53,6 +54,7 @@ Program Headers:
    03 +.tdata .dynamic .got .got.plt *
    04 +.dynamic *
    05 +.tdata .tbss *
+   06 *
 
 Relocation section '.rel.dyn' at offset 0x[0-9a-f]+ contains 9 entries:
  Offset +Info +Type +Sym.Value +Sym. Name
diff -urp binutils-2.18/ld/testsuite/ld-i386/tlsbindesc.rd binutils-2.18-pax/ld/testsuite/ld-i386/tlsbindesc.rd
--- binutils-2.18/ld/testsuite/ld-i386/tlsbindesc.rd	2006-10-17 15:41:48.000000000 +0200
+++ binutils-2.18-pax/ld/testsuite/ld-i386/tlsbindesc.rd	2008-03-31 15:45:16.000000000 +0200
@@ -31,7 +31,7 @@ Key to Flags:
 
 Elf file type is EXEC \(Executable file\)
 Entry point 0x8049158
-There are 6 program headers, starting at offset [0-9]+
+There are 7 program headers, starting at offset [0-9]+
 
 Program Headers:
   Type +Offset +VirtAddr +PhysAddr +FileSiz +MemSiz +Flg Align
@@ -42,6 +42,7 @@ Program Headers:
   LOAD.*
   DYNAMIC.*
   TLS +0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x0+60 0x0+a0 R +0x1000
+  PAX_FLAGS +0x000000 0x00000000 0x00000000 0x00000 0x00000 +0x4
 
  Section to Segment mapping:
   Segment Sections...
@@ -51,6 +52,7 @@ Program Headers:
    03 +.tdata .dynamic .got .got.plt *
    04 +.dynamic *
    05 +.tdata .tbss *
+   06 *
 
 Relocation section '.rel.dyn' at offset 0x[0-9a-f]+ contains 9 entries:
  Offset +Info +Type +Sym.Value +Sym. Name
diff -urp binutils-2.18/ld/testsuite/ld-i386/tlsdesc.rd binutils-2.18-pax/ld/testsuite/ld-i386/tlsdesc.rd
--- binutils-2.18/ld/testsuite/ld-i386/tlsdesc.rd	2006-10-17 15:41:48.000000000 +0200
+++ binutils-2.18-pax/ld/testsuite/ld-i386/tlsdesc.rd	2008-03-31 15:45:16.000000000 +0200
@@ -39,6 +39,7 @@ Program Headers:
   LOAD.*
   DYNAMIC.*
   TLS +0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x0+60 0x0+80 R +0x1
+  PAX_FLAGS +0x000000 0x00000000 0x00000000 0x00000 0x00000 +0x4
 
  Section to Segment mapping:
   Segment Sections...
@@ -46,6 +47,7 @@ Program Headers:
    01 +.tdata .dynamic .got .got.plt *
    02 +.dynamic *
    03 +.tdata .tbss *
+   04 *
 
 Relocation section '.rel.dyn' at offset 0x[0-9a-f]+ contains 20 entries:
  Offset +Info +Type +Sym.Value +Sym. Name
diff -urp binutils-2.18/ld/testsuite/ld-i386/tlsdesc.sd binutils-2.18-pax/ld/testsuite/ld-i386/tlsdesc.sd
--- binutils-2.18/ld/testsuite/ld-i386/tlsdesc.sd	2006-10-17 15:41:48.000000000 +0200
+++ binutils-2.18-pax/ld/testsuite/ld-i386/tlsdesc.sd	2008-03-31 16:49:26.000000000 +0200
@@ -14,7 +14,7 @@ Contents of section \.got:
  [0-9a-f]+ 6c000000 b4ffffff 4c000000 68000000  .*
  [0-9a-f]+ 50000000 70000000 00000000 bcffffff  .*
 Contents of section \.got\.plt:
- [0-9a-f]+ b0150000 00000000 00000000 00000000  .*
+ [0-9a-f]+ d0150000 00000000 00000000 00000000  .*
  [0-9a-f]+ 20000000 00000000 60000000 00000000  .*
  [0-9a-f]+ 00000000 00000000 00000000 00000000  .*
  [0-9a-f]+ 40000000 +.*
diff -urp binutils-2.18/ld/testsuite/ld-i386/tlsgdesc.rd binutils-2.18-pax/ld/testsuite/ld-i386/tlsgdesc.rd
--- binutils-2.18/ld/testsuite/ld-i386/tlsgdesc.rd	2006-10-17 15:41:48.000000000 +0200
+++ binutils-2.18-pax/ld/testsuite/ld-i386/tlsgdesc.rd	2008-03-31 15:45:16.000000000 +0200
@@ -36,12 +36,14 @@ Program Headers:
   LOAD.*
   LOAD.*
   DYNAMIC.*
+  PAX_FLAGS +0x000000 0x00000000 0x00000000 0x00000 0x00000 +0x4
 
  Section to Segment mapping:
   Segment Sections...
    00 +.hash .dynsym .dynstr .rel.dyn .rel.plt .plt .text *
    01 +.dynamic .got .got.plt *
    02 +.dynamic *
+   03 *
 
 Relocation section '.rel.dyn' at offset 0x[0-9a-f]+ contains 8 entries:
  Offset +Info +Type +Sym.Value +Sym. Name
diff -urp binutils-2.18/ld/testsuite/ld-i386/tlsnopic.rd binutils-2.18-pax/ld/testsuite/ld-i386/tlsnopic.rd
--- binutils-2.18/ld/testsuite/ld-i386/tlsnopic.rd	2006-10-17 15:41:48.000000000 +0200
+++ binutils-2.18-pax/ld/testsuite/ld-i386/tlsnopic.rd	2008-03-31 15:45:16.000000000 +0200
@@ -29,7 +29,7 @@ Key to Flags:
 
 Elf file type is DYN \(Shared object file\)
 Entry point 0x1000
-There are 4 program headers, starting at offset [0-9]+
+There are 5 program headers, starting at offset [0-9]+
 
 Program Headers:
   Type +Offset +VirtAddr +PhysAddr +FileSiz +MemSiz +Flg Align
@@ -37,6 +37,7 @@ Program Headers:
   LOAD.*
   DYNAMIC.*
   TLS +0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x0+ 0x0+24 R +0x1
+  PAX_FLAGS +0x000000 0x00000000 0x00000000 0x00000 0x00000 +0x4
 
  Section to Segment mapping:
   Segment Sections...
@@ -44,6 +45,7 @@ Program Headers:
    01 +.dynamic .got .got.plt *
    02 +.dynamic *
    03 +.tbss *
+   04 *
 
 Relocation section '.rel.dyn' at offset 0x[0-9a-f]+ contains 20 entries:
  Offset +Info +Type +Sym.Value +Sym. Name
diff -urp binutils-2.18/ld/testsuite/ld-i386/tlspic.rd binutils-2.18-pax/ld/testsuite/ld-i386/tlspic.rd
--- binutils-2.18/ld/testsuite/ld-i386/tlspic.rd	2006-10-17 15:41:48.000000000 +0200
+++ binutils-2.18-pax/ld/testsuite/ld-i386/tlspic.rd	2008-03-31 15:45:16.000000000 +0200
@@ -40,6 +40,7 @@ Program Headers:
   LOAD.*
   DYNAMIC.*
   TLS +0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x0+60 0x0+80 R +0x1
+  PAX_FLAGS +0x000000 0x00000000 0x00000000 0x00000 0x00000 +0x4
 
  Section to Segment mapping:
   Segment Sections...
@@ -47,6 +48,7 @@ Program Headers:
    01 +.tdata .dynamic .got .got.plt *
    02 +.dynamic *
    03 +.tdata .tbss *
+   04 *
 
 Relocation section '.rel.dyn' at offset 0x[0-9a-f]+ contains 26 entries:
  Offset +Info +Type +Sym.Value +Sym. Name
diff -urp binutils-2.18/ld/testsuite/ld-scripts/empty-aligned.d binutils-2.18-pax/ld/testsuite/ld-scripts/empty-aligned.d
--- binutils-2.18/ld/testsuite/ld-scripts/empty-aligned.d	2005-08-18 09:51:07.000000000 +0200
+++ binutils-2.18-pax/ld/testsuite/ld-scripts/empty-aligned.d	2008-03-31 15:45:16.000000000 +0200
@@ -7,7 +7,9 @@
 Program Headers:
  +Type +Offset +VirtAddr +PhysAddr +FileSiz +MemSiz +Flg +Align
  +LOAD +0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ 0x[0-9a-f]+ [RWE ]+ +0x[0-9a-f]+
+ +PAX_FLAGS +0x000000 0x00000000 0x00000000 0x00000 0x00000 +0x4
 
  Section to Segment mapping:
  +Segment Sections\.\.\.
  +00 +.text 
+ +01 +
