Adding -fstack-protector back in, since this ain't workin. Also adding the asm-fixes from #153382 (thanks to nattfodd).

svn path=/; revision=311

10 files changed, 297 insertions, 344 deletions

diff --git a/hardened/dev-lang/ocaml/Manifest b/hardened/dev-lang/ocaml/Manifest
index dc9d635..b8fb286 100644
--- a/hardened/dev-lang/ocaml/Manifest
+++ b/hardened/dev-lang/ocaml/Manifest
@@ -1,40 +1,16 @@
-AUX ocaml-3.08.3-gcc4.patch 710 RMD160 7c7399b1a1aa383815021721b4f4a5261137dc15 SHA1 19482bd2cc736a54645e0b48c82edd9863be0375 SHA256 007606bb38a7d66a003a94c9b45288055faacf5f15334a9ff6c33fdc91504e09
-MD5 c57fc46d92565b5d44c8c4f2a4a072d3 files/ocaml-3.08.3-gcc4.patch 710
-RMD160 7c7399b1a1aa383815021721b4f4a5261137dc15 files/ocaml-3.08.3-gcc4.patch 710
-SHA256 007606bb38a7d66a003a94c9b45288055faacf5f15334a9ff6c33fdc91504e09 files/ocaml-3.08.3-gcc4.patch 710
+AUX ocaml-3.09.3-asm-fixes.patch 8941 RMD160 a0c9d70a3bcb925fbc63e357751659552517459b SHA1 bcdd9334e16c8ab3ddd785b4c8deac8d5de03f88 SHA256 ce6a563cd2f56148f576293b58220faca2e5fa79fe117a14aac42336a6099438
+MD5 1ced405879a193bbc20b72f13dafdae0 files/ocaml-3.09.3-asm-fixes.patch 8941
+RMD160 a0c9d70a3bcb925fbc63e357751659552517459b files/ocaml-3.09.3-asm-fixes.patch 8941
+SHA256 ce6a563cd2f56148f576293b58220faca2e5fa79fe117a14aac42336a6099438 files/ocaml-3.09.3-asm-fixes.patch 8941
 AUX ocaml-rebuild.sh 1361 RMD160 a9c452fbea18de3b38d8240f887f8595e529643e SHA1 2a682ce872c51e66a5ab13160da16b0f6d8bd366 SHA256 a8004cd4bca96ab3fc595fcfd7dbe88903833f9e430149c3d04c9fda84362b64
 MD5 bcc5109143faee7e7b8f7f76bd4726a7 files/ocaml-rebuild.sh 1361
 RMD160 a9c452fbea18de3b38d8240f887f8595e529643e files/ocaml-rebuild.sh 1361
 SHA256 a8004cd4bca96ab3fc595fcfd7dbe88903833f9e430149c3d04c9fda84362b64 files/ocaml-rebuild.sh 1361
-DIST ocaml-3.08.3.tar.bz2 2026597 RMD160 83fcab89371f228c35d826eb204c80e3380ddf27 SHA1 2ebbc72faea2ae8b96a42c489ecbcf34df9dbe76 SHA256 20aca649bacd75728d3566ccb52bd7a2899208fbc6de8aceb3bf19a87894e539
-DIST ocaml-3.08.4.tar.bz2 2054019 RMD160 448ed9af56cacb9c32208d064e1c9732a2086bd2 SHA1 d9eb54611d24f9e1c33736f12c7ba87412057cbb SHA256 8d4322791d0dd424f355636ba50934ac17dbefde269736dad0da0683c8888684
-DIST ocaml-3.09.2.tar.bz2 2036341 RMD160 45edae84e5787775a5beed29a1ad2881f4df8505 SHA1 578c66707532882782735352a3628b78193da5e7 SHA256 2115d6a4e420b5517ed7313c64bd6bd93f610ec208250b7d025595376180b0b1
 DIST ocaml-3.09.3.tar.bz2 2038617 RMD160 fdc124218c556c62c897ee6720970279e2d5426b SHA1 5d63c6e0d13463f85c0d5147d641d2bceef87d6b SHA256 607842b4f4917a759f19541a421370a834f5b948855ca54cef40d22b19a0934f
-EBUILD ocaml-3.08.3.ebuild 2393 RMD160 465bdc1745b3a5b37592b061c67efdb853417c69 SHA1 2e36186fdee021bcd63b343466f6a0641e0979aa SHA256 d069d773499ef4528accd48a4747c358941b67a684dd88b105e3fe4c69a273dc
-MD5 0dc2eca64a466ec82e9f0873ab5843f8 ocaml-3.08.3.ebuild 2393
-RMD160 465bdc1745b3a5b37592b061c67efdb853417c69 ocaml-3.08.3.ebuild 2393
-SHA256 d069d773499ef4528accd48a4747c358941b67a684dd88b105e3fe4c69a273dc ocaml-3.08.3.ebuild 2393
-EBUILD ocaml-3.08.4.ebuild 2600 RMD160 769e4b4c2a956962e8a5dec434abb1fd26e0f1d4 SHA1 0a433efe9aa72d3784df73b16d415dfba91ab09c SHA256 ccc7ba9397be4e9f31e2927dc9f094ad3f8cff19f2534f6e7164264e4b21c151
-MD5 535ce8ca3d1f1ad22c5e9c7cabcc0662 ocaml-3.08.4.ebuild 2600
-RMD160 769e4b4c2a956962e8a5dec434abb1fd26e0f1d4 ocaml-3.08.4.ebuild 2600
-SHA256 ccc7ba9397be4e9f31e2927dc9f094ad3f8cff19f2534f6e7164264e4b21c151 ocaml-3.08.4.ebuild 2600
-EBUILD ocaml-3.09.2.ebuild 2453 RMD160 eb53e443373f9f8fd1e741228fafe8e31c9a3f7f SHA1 6f7b60df6274b992278f2db164bcfbbb4c172b59 SHA256 0101b8c80d5bef13a092ab70997d9c46ab73de06fd4173d8760953428aec759e
-MD5 d304e34bb5c0dbb007de07734e12dcb4 ocaml-3.09.2.ebuild 2453
-RMD160 eb53e443373f9f8fd1e741228fafe8e31c9a3f7f ocaml-3.09.2.ebuild 2453
-SHA256 0101b8c80d5bef13a092ab70997d9c46ab73de06fd4173d8760953428aec759e ocaml-3.09.2.ebuild 2453
-EBUILD ocaml-3.09.3.ebuild 2585 RMD160 3bd89d36d2b7d9664c639cca3d61bfdb99228275 SHA1 5b3e774197f07f19f14041f91190754dbdb4d88f SHA256 8a5efdd070784db888d620e5085f7daeb98f94f19223630d7a6f5483de07c004
-MD5 732cd9f85509f16b80767cc44d245ffc ocaml-3.09.3.ebuild 2585
-RMD160 3bd89d36d2b7d9664c639cca3d61bfdb99228275 ocaml-3.09.3.ebuild 2585
-SHA256 8a5efdd070784db888d620e5085f7daeb98f94f19223630d7a6f5483de07c004 ocaml-3.09.3.ebuild 2585
-MD5 32e668c99988d463934c5ead1a603d29 files/digest-ocaml-3.08.3 244
-RMD160 0068922a3d2f5c6172d9dd866a1e1e1e85db8abe files/digest-ocaml-3.08.3 244
-SHA256 dab059cc4714a36ee9d9b3dd15b35dec829ec0fcfc952aed6936a2bd7b9e279b files/digest-ocaml-3.08.3 244
-MD5 616991884ec513ca3018b0505bdb5707 files/digest-ocaml-3.08.4 244
-RMD160 660afa0d675ca64d6bf0e8013af19fc169048733 files/digest-ocaml-3.08.4 244
-SHA256 f2fd468f6c4554ab21e0c0fa7e9a1d1bac5b3760d5184f4ffd53c5fecd90b82e files/digest-ocaml-3.08.4 244
-MD5 ea45ed7daaee5c9ecf53013b90f7a82f files/digest-ocaml-3.09.2 244
-RMD160 01eeb8fd583185a7d8bf4c76f4d13cdd2caad23a files/digest-ocaml-3.09.2 244
-SHA256 4799bbb3279e3ec6a3541cbc418388633fcb7d32dbe0177334675586a8afa029 files/digest-ocaml-3.09.2 244
+EBUILD ocaml-3.09.3.ebuild 2689 RMD160 e47dbdabc8feb9a46fd0e195f45e7de474f3778b SHA1 4392cf89c5e4957a4c7abf373e44c28e6094bf77 SHA256 8b257b0e7063116208f4258fc663e720c0ee4c94e44a9409e513ac7ef63f3744
+MD5 d8b6f81e57919bba76f1701f25c4e071 ocaml-3.09.3.ebuild 2689
+RMD160 e47dbdabc8feb9a46fd0e195f45e7de474f3778b ocaml-3.09.3.ebuild 2689
+SHA256 8b257b0e7063116208f4258fc663e720c0ee4c94e44a9409e513ac7ef63f3744 ocaml-3.09.3.ebuild 2689
 MD5 71f3dc5bc2ee57a403689b56bc1a85c1 files/digest-ocaml-3.09.3 244
 RMD160 e7f0898889b94faae3b1481555bac42e9298b370 files/digest-ocaml-3.09.3 244
 SHA256 19708f759185ed39623e03921462ba20fb6f3533268673d2bcd7dd07cef57350 files/digest-ocaml-3.09.3 244
diff --git a/hardened/dev-lang/ocaml/files/digest-ocaml-3.08.3 b/hardened/dev-lang/ocaml/files/digest-ocaml-3.08.3
deleted file mode 100644
index 40d13b5..0000000
--- a/hardened/dev-lang/ocaml/files/digest-ocaml-3.08.3
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 8b0b238fb4b059890457d3d35b138785 ocaml-3.08.3.tar.bz2 2026597
-RMD160 83fcab89371f228c35d826eb204c80e3380ddf27 ocaml-3.08.3.tar.bz2 2026597
-SHA256 20aca649bacd75728d3566ccb52bd7a2899208fbc6de8aceb3bf19a87894e539 ocaml-3.08.3.tar.bz2 2026597
diff --git a/hardened/dev-lang/ocaml/files/digest-ocaml-3.08.4 b/hardened/dev-lang/ocaml/files/digest-ocaml-3.08.4
deleted file mode 100644
index 14591ce..0000000
--- a/hardened/dev-lang/ocaml/files/digest-ocaml-3.08.4
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 96b8edeb6190d9f15c086c7decd277a9 ocaml-3.08.4.tar.bz2 2054019
-RMD160 448ed9af56cacb9c32208d064e1c9732a2086bd2 ocaml-3.08.4.tar.bz2 2054019
-SHA256 8d4322791d0dd424f355636ba50934ac17dbefde269736dad0da0683c8888684 ocaml-3.08.4.tar.bz2 2054019
diff --git a/hardened/dev-lang/ocaml/files/digest-ocaml-3.09.2 b/hardened/dev-lang/ocaml/files/digest-ocaml-3.09.2
deleted file mode 100644
index c866959..0000000
--- a/hardened/dev-lang/ocaml/files/digest-ocaml-3.09.2
+++ /dev/null
@@ -1,3 +0,0 @@
-MD5 63428ce7e114520e8f529c9ca809a1b0 ocaml-3.09.2.tar.bz2 2036341
-RMD160 45edae84e5787775a5beed29a1ad2881f4df8505 ocaml-3.09.2.tar.bz2 2036341
-SHA256 2115d6a4e420b5517ed7313c64bd6bd93f610ec208250b7d025595376180b0b1 ocaml-3.09.2.tar.bz2 2036341
diff --git a/hardened/dev-lang/ocaml/files/ocaml-3.08.3-gcc4.patch b/hardened/dev-lang/ocaml/files/ocaml-3.08.3-gcc4.patch
deleted file mode 100644
index b172ace..0000000
--- a/hardened/dev-lang/ocaml/files/ocaml-3.08.3-gcc4.patch
+++ /dev/null
@@ -1,20 +0,0 @@
---- ocaml-3.08.3/otherlibs/num/bng_ia32.c.x86	2005-05-09 15:24:29.000000000 -0400
-+++ ocaml-3.08.3/otherlibs/num/bng_ia32.c	2005-05-09 22:02:50.000000000 -0400
-@@ -121,7 +121,7 @@
-         "leal 4(%1), %1 \n\t"
-         "decl %2 \n\t"
-         "jnz 1b"
--        : "+&r" (a), "+&r" (b), "+&rm" (blen), "+&r" (out)
-+        : "+&r" (a), "+&r" (b), "+m" (blen), "+&r" (out)
-         : "rm" (d)
-         : "eax", "edx");
-   }
-@@ -164,7 +164,7 @@
-         "leal 4(%1), %1 \n\t"
-         "decl %2 \n\t"
-         "jnz 1b"
--        : "+&r" (a), "+&r" (b), "+&rm" (blen), "+&rm" (out), "=&r" (tmp)
-+        : "+&r" (a), "+&r" (b), "+m" (blen), "+m" (out), "=&r" (tmp)
-         : "rm" (d)
-         : "eax", "edx");
-   }
diff --git a/hardened/dev-lang/ocaml/files/ocaml-3.09.3-asm-fixes.patch b/hardened/dev-lang/ocaml/files/ocaml-3.09.3-asm-fixes.patch
new file mode 100644
index 0000000..3d46d4a
--- /dev/null
+++ b/hardened/dev-lang/ocaml/files/ocaml-3.09.3-asm-fixes.patch
@@ -0,0 +1,281 @@
+--- ocaml-3.09.3/asmrun/alpha.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/alpha.S	2006-11-02 18:53:12.000000000 +0100
+@@ -438,3 +438,7 @@
+         .word   -1              /* negative frame size => use callback link */
+         .word   0               /* no roots here */
+         .align  3
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+--- ocaml-3.09.3/asmrun/amd64.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/amd64.S	2006-11-02 18:53:12.000000000 +0100
+@@ -334,3 +334,7 @@
+         .align  16
+ caml_absf_mask:
+ 	.quad	0x7FFFFFFFFFFFFFFF, 0xFFFFFFFFFFFFFFFF
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+--- ocaml-3.09.3/asmrun/arm.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/arm.S	2006-11-02 18:53:12.000000000 +0100
+@@ -337,3 +337,7 @@
+         .short  -1              /* negative frame size => use callback link */
+         .short  0               /* no roots */
+         .align  2
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+--- ocaml-3.09.3/asmrun/hppa.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/hppa.S	2006-11-02 18:53:12.000000000 +0100
+@@ -532,3 +532,7 @@
+         .long   L104 + 3        /* return address into callback */
+         .short  -1              /* negative frame size => use callback link */
+         .short  0               /* no roots */
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+--- ocaml-3.09.3/asmrun/i386.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/i386.S	2006-11-02 18:53:12.000000000 +0100
+@@ -371,3 +371,7 @@
+ #ifdef __ELF__
+ 	.section .note.GNU-stack,"",%progbits
+ #endif
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+--- ocaml-3.09.3/asmrun/ia64.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/ia64.S	2006-11-02 18:53:12.000000000 +0100
+@@ -528,3 +528,7 @@
+ 
+         .common caml_saved_bsp#, 8, 8
+         .common caml_saved_rnat#, 8, 8
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+--- ocaml-3.09.3/asmrun/m68k.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/m68k.S	2006-11-02 18:53:12.000000000 +0100
+@@ -242,3 +242,7 @@
+         .long   L107            | return address into callback
+         .word   -1              | negative frame size => use callback link
+         .word   0               | no roots here
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+--- ocaml-3.09.3/asmrun/power-elf.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/power-elf.S	2006-11-02 18:53:12.000000000 +0100
+@@ -419,3 +419,7 @@
+         .short  -1              /* negative size count => use callback link */
+         .short  0               /* no roots here */
+ 
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+--- ocaml-3.09.3/asmrun/sparc.S.old	2006-11-02 18:53:12.000000000 +0100
++++ ocaml-3.09.3/asmrun/sparc.S	2006-11-02 18:53:12.000000000 +0100
+@@ -405,3 +405,7 @@
+         .type Caml_raise_exception, #function
+ 	.type Caml_system__frametable, #object
+ #endif
++#ifdef __ELF__
++.section .note.GNU-stack,"",%progbits
++#endif
++
+diff -ru ../ref/ocaml-3.09.3/asmcomp/alpha/emit.mlp ocaml-3.09.3/asmcomp/alpha/emit.mlp
+--- ../ref/ocaml-3.09.3/asmcomp/alpha/emit.mlp	2006-03-29 16:49:19.000000000 +0200
++++ ocaml-3.09.3/asmcomp/alpha/emit.mlp	2006-11-03 10:35:40.000000000 +0100
+@@ -811,6 +811,12 @@
+   `	.data\n`;
+   List.iter emit_item l
+ 
++(* Mark stack as non executable *)
++let nx_stack() =
++  if Config.system = "linux" then
++    `	.section .note.GNU-stack,\"\",%progbits\n`
++
++
+ (* Beginning / end of an assembly file *)
+ 
+ let begin_assembly() =
+@@ -843,6 +849,7 @@
+   `{emit_symbol lbl_begin}:\n`
+ 
+ let end_assembly () =
++  nx_stack();
+   let lbl_end = Compilenv.make_symbol (Some "code_end") in
+   `	.text\n`;
+   `	.globl	{emit_symbol lbl_end}\n`;
+diff -ru ../ref/ocaml-3.09.3/asmcomp/amd64/emit.mlp ocaml-3.09.3/asmcomp/amd64/emit.mlp
+--- ../ref/ocaml-3.09.3/asmcomp/amd64/emit.mlp	2006-03-29 16:49:19.000000000 +0200
++++ ocaml-3.09.3/asmcomp/amd64/emit.mlp	2006-11-03 10:35:48.000000000 +0100
+@@ -658,6 +658,12 @@
+   `	.data\n`;
+   List.iter emit_item l
+ 
++(* Mark stack as non executable *)
++let nx_stack() =
++  if Config.system = "linux" then
++    `	.section .note.GNU-stack,\"\",%progbits\n`
++
++
+ (* Beginning / end of an assembly file *)
+ 
+ let begin_assembly() =
+@@ -671,6 +677,7 @@
+   `{emit_symbol lbl_begin}:\n`
+ 
+ let end_assembly() =
++  nx_stack();
+   let lbl_end = Compilenv.make_symbol (Some "code_end") in
+   `	.text\n`;
+   `	.globl	{emit_symbol lbl_end}\n`;
+diff -ru ../ref/ocaml-3.09.3/asmcomp/arm/emit.mlp ocaml-3.09.3/asmcomp/arm/emit.mlp
+--- ../ref/ocaml-3.09.3/asmcomp/arm/emit.mlp	2004-05-03 14:46:50.000000000 +0200
++++ ocaml-3.09.3/asmcomp/arm/emit.mlp	2006-11-03 10:35:55.000000000 +0100
+@@ -642,6 +642,12 @@
+   `	.data\n`;
+   List.iter emit_item l
+ 
++(* Mark stack as non executable *)
++let nx_stack() =
++  if Config.system = "linux" then
++    `	.section .note.GNU-stack,\"\",%progbits\n`
++
++
+ (* Beginning / end of an assembly file *)
+ 
+ let begin_assembly() =
+@@ -661,6 +667,7 @@
+   `{emit_symbol lbl_begin}:\n`
+ 
+ let end_assembly () =
++  nx_stack();
+   let lbl_end = Compilenv.make_symbol (Some "code_end") in
+   `	.text\n`;
+   `	.global	{emit_symbol lbl_end}\n`;
+diff -ru ../ref/ocaml-3.09.3/asmcomp/hppa/emit.mlp ocaml-3.09.3/asmcomp/hppa/emit.mlp
+--- ../ref/ocaml-3.09.3/asmcomp/hppa/emit.mlp	2006-03-29 16:49:19.000000000 +0200
++++ ocaml-3.09.3/asmcomp/hppa/emit.mlp	2006-11-03 10:36:03.000000000 +0100
+@@ -994,6 +994,12 @@
+   `	.data\n`;
+   List.iter emit_item l
+ 
++(* Mark stack as non executable *)
++let nx_stack() =
++  if Config.system = "linux" then
++    `	.section .note.GNU-stack,\"\",%progbits\n`
++
++
+ (* Beginning / end of an assembly file *)
+ 
+ let begin_assembly() =
+@@ -1022,6 +1028,7 @@
+ 
+ 
+ let end_assembly() =
++  nx_stack();
+   `	.code\n`;
+   let lbl_end = Compilenv.make_symbol (Some "code_end") in
+   declare_global lbl_end;
+diff -ru ../ref/ocaml-3.09.3/asmcomp/i386/emit.mlp ocaml-3.09.3/asmcomp/i386/emit.mlp
+--- ../ref/ocaml-3.09.3/asmcomp/i386/emit.mlp	2006-03-29 16:49:19.000000000 +0200
++++ ocaml-3.09.3/asmcomp/i386/emit.mlp	2006-11-03 10:21:41.000000000 +0100
+@@ -914,6 +914,11 @@
+   `	.data\n`;
+   List.iter emit_item l
+ 
++(* Mark stack as non executable *)
++let nx_stack() =
++  if Config.system = "linux_elf" then
++    `	.section .note.GNU-stack,\"\",%progbits\n`
++
+ (* Beginning / end of an assembly file *)
+ 
+ let begin_assembly() =
+@@ -927,6 +932,7 @@
+   `{emit_symbol lbl_begin}:\n`
+ 
+ let end_assembly() =
++  nx_stack();
+   let lbl_end = Compilenv.make_symbol (Some "code_end") in
+   `	.text\n`;
+   `	.globl	{emit_symbol lbl_end}\n`;
+diff -ru ../ref/ocaml-3.09.3/asmcomp/ia64/emit.mlp ocaml-3.09.3/asmcomp/ia64/emit.mlp
+--- ../ref/ocaml-3.09.3/asmcomp/ia64/emit.mlp	2004-07-13 14:18:53.000000000 +0200
++++ ocaml-3.09.3/asmcomp/ia64/emit.mlp	2006-11-03 10:36:13.000000000 +0100
+@@ -1306,6 +1306,12 @@
+   `	.align 8\n`;
+   List.iter emit_item l
+ 
++(* Mark stack as non executable *)
++let nx_stack() =
++  if Config.system = "linux" then
++    `	.section .note.GNU-stack,\"\",%progbits\n`
++
++
+ (* Beginning / end of an assembly file *)
+ 
+ let begin_assembly() =
+@@ -1315,6 +1321,7 @@
+   emit_define_symbol (Compilenv.make_symbol (Some "code_begin"))
+ 
+ let end_assembly () =
++  nx_stack();
+   `	.data\n`;
+   emit_define_symbol (Compilenv.make_symbol (Some "data_end"));
+   `	.text\n`;
+diff -ru ../ref/ocaml-3.09.3/asmcomp/power/emit.mlp ocaml-3.09.3/asmcomp/power/emit.mlp
+--- ../ref/ocaml-3.09.3/asmcomp/power/emit.mlp	2004-06-19 19:39:34.000000000 +0200
++++ ocaml-3.09.3/asmcomp/power/emit.mlp	2006-11-03 10:36:29.000000000 +0100
+@@ -879,6 +879,12 @@
+   emit_string data_space;
+   List.iter emit_item l
+ 
++(* Mark stack as non executable *)
++let nx_stack() =
++  if Config.system = "elf" then
++    `	.section .note.GNU-stack,\"\",%progbits\n`
++
++
+ (* Beginning / end of an assembly file *)
+ 
+ let begin_assembly() =
+@@ -898,6 +904,7 @@
+   `{emit_symbol lbl_begin}:\n`
+ 
+ let end_assembly() =
++  nx_stack();
+   (* Emit the jump table *)
+   if !num_jumptbl_entries > 0 then begin
+     emit_string code_space;
+diff -ru ../ref/ocaml-3.09.3/asmcomp/sparc/emit.mlp ocaml-3.09.3/asmcomp/sparc/emit.mlp
+--- ../ref/ocaml-3.09.3/asmcomp/sparc/emit.mlp	2006-03-29 16:49:19.000000000 +0200
++++ ocaml-3.09.3/asmcomp/sparc/emit.mlp	2006-11-03 10:36:36.000000000 +0100
+@@ -741,6 +741,12 @@
+   `	.data\n`;
+   List.iter emit_item l
+ 
++(* Mark stack as non executable *)
++let nx_stack() =
++  if Config.system = "linux" then
++    `	.section .note.GNU-stack,\"\",%progbits\n`
++
++
+ (* Beginning / end of an assembly file *)
+ 
+ let begin_assembly() =
+@@ -754,6 +760,7 @@
+   `{emit_symbol lbl_begin}:\n`
+ 
+ let end_assembly() =
++  nx_stack();
+   `	.text\n`;
+   let lbl_end = Compilenv.make_symbol (Some "code_end") in
+   `	.global	{emit_symbol lbl_end}\n`;
diff --git a/hardened/dev-lang/ocaml/ocaml-3.08.3.ebuild b/hardened/dev-lang/ocaml/ocaml-3.08.3.ebuild
deleted file mode 100644
index 3963f9b..0000000
--- a/hardened/dev-lang/ocaml/ocaml-3.08.3.ebuild
+++ /dev/null
@@ -1,95 +0,0 @@
-# Copyright 1999-2007 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/ocaml/ocaml-3.08.3.ebuild,v 1.16 2007/02/17 19:16:10 grobian Exp $
-
-inherit flag-o-matic eutils multilib toolchain-funcs
-
-DESCRIPTION="fast modern type-inferring functional programming language descended from the ML (Meta Language) family"
-HOMEPAGE="http://www.ocaml.org/"
-
-SRC_URI="http://caml.inria.fr/distrib/ocaml-3.08/${P}.tar.bz2"
-
-LICENSE="QPL-1.0 LGPL-2"
-SLOT="0"
-KEYWORDS="alpha ~amd64 hppa ia64 ppc ppc64 sparc x86"
-IUSE="tk latex"
-
-DEPEND="virtual/libc
-	tk? ( >=dev-lang/tk-3.3.3 )"
-
-pkg_setup() {
-	ewarn
-	ewarn "Building ocaml with unsafe CFLAGS can have unexpected results"
-	ewarn "Please retry building with safer CFLAGS before reporting bugs"
-	ewarn
-}
-
-src_unpack() {
-	unpack ${A}
-	cd ${S}
-
-	#GCC4 patch
-	epatch ${FILESDIR}/${P}-gcc4.patch
-}
-
-src_compile() {
-	gcc-specs-pie && append-flags -nopie
-	filter-flags -pie
-	replace-flags "-O?" -O2
-
-	local myconf
-	use tk || myconf="-no-tk"
-
-	# Fix for bug #23767.
-	if [ "${ARCH}" = "sparc" ]; then
-		myconf="${myconf} -host sparc-unknown-linux-gnu"
-	fi
-
-	# Fix for bug #46703
-	export LC_ALL=C
-
-	./configure -prefix /usr \
-		-bindir /usr/bin \
-		-libdir /usr/$(get_libdir)/ocaml \
-		-mandir /usr/share/man \
-		--with-pthread ${myconf} || die
-
-	sed -i -e "s/\(BYTECCCOMPOPTS=.*\)/\1 ${CFLAGS}/" config/Makefile
-	sed -i -e "s/\(NATIVECCCOMPOPTS=.*\)/\1 ${CFLAGS}/" config/Makefile
-
-	make world || die
-
-	# Native code generation unsupported on some archs
-	if ! use ppc64 ; then
-		make opt || die
-		make opt.opt || die
-	fi
-}
-
-src_install() {
-	make BINDIR=${D}/usr/bin \
-		LIBDIR=${D}/usr/$(get_libdir)/ocaml \
-		MANDIR=${D}/usr/share/man \
-		install || die
-
-	# silly, silly makefiles
-	dosed "s:${D}::g" /usr/$(get_libdir)/ocaml/ld.conf
-
-	# documentation
-	dodoc Changes INSTALL LICENSE README Upgrading
-}
-
-pkg_postinst() {
-	if use latex; then
-		echo "TEXINPUTS=/usr/$(get_libdir)/ocaml/ocamldoc:" > /etc/env.d/99ocamldoc
-	fi
-
-	echo
-	elog "OCaml is not binary compatible from version to version,"
-	elog "so you (may) need to rebuild all packages depending on it that"
-	elog "are actually installed on your system."
-	elog "To do so, you can run: "
-	elog "sh ${FILESDIR}/ocaml-rebuild.sh [-h | emerge options]"
-	elog "Which will call emerge on all old packages with the given options"
-	echo
-}
diff --git a/hardened/dev-lang/ocaml/ocaml-3.08.4.ebuild b/hardened/dev-lang/ocaml/ocaml-3.08.4.ebuild
deleted file mode 100644
index fbbdbce..0000000
--- a/hardened/dev-lang/ocaml/ocaml-3.08.4.ebuild
+++ /dev/null
@@ -1,96 +0,0 @@
-# Copyright 1999-2007 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/ocaml/ocaml-3.08.4.ebuild,v 1.14 2007/02/17 19:16:10 grobian Exp $
-
-inherit flag-o-matic eutils multilib toolchain-funcs
-
-DESCRIPTION="fast modern type-inferring functional programming language descended from the ML (Meta Language) family"
-HOMEPAGE="http://www.ocaml.org/"
-
-SRC_URI="http://caml.inria.fr/distrib/ocaml-3.08/${P}.tar.bz2"
-
-LICENSE="QPL-1.0 LGPL-2"
-SLOT="0"
-KEYWORDS="alpha amd64 arm hppa ia64 ~ppc ~ppc64 -s390 sparc ~x86"
-IUSE="tk latex"
-
-DEPEND="virtual/libc
-	tk? ( >=dev-lang/tk-3.3.3 )"
-
-pkg_setup() {
-	ewarn
-	ewarn "Building ocaml with unsafe CFLAGS can have unexpected results"
-	ewarn "Please retry building with safer CFLAGS before reporting bugs"
-	ewarn "Likewise, building with a hardened gcc is not possible."
-	ewarn
-}
-
-src_compile() {
-	gcc-specs-pie && append-flags -nopie
-	filter-flags -pie
-	replace-flags "-O?" -O2
-
-	local myconf
-	use tk || myconf="-no-tk"
-
-	# Fix for bug #23767.
-	if [ "${ARCH}" = "sparc" ]; then
-		myconf="${myconf} -host sparc-unknown-linux-gnu"
-	fi
-
-	# Fix for bug #46703
-	export LC_ALL=C
-
-	./configure -prefix /usr \
-		-bindir /usr/bin \
-		-libdir /usr/$(get_libdir)/ocaml \
-		-mandir /usr/share/man \
-		--with-pthread ${myconf} || die
-
-	sed -i -e "s/\(BYTECCCOMPOPTS=.*\)/\1 ${CFLAGS}/" config/Makefile
-	sed -i -e "s/\(NATIVECCCOMPOPTS=.*\)/\1 ${CFLAGS}/" config/Makefile
-
-	make world || die
-	# Native code generation unsupported on some archs
-	if ! use ppc64 ; then
-		make opt || die
-		make opt.opt || die
-	fi
-}
-
-src_install() {
-	make BINDIR=${D}/usr/bin \
-		LIBDIR=${D}/usr/$(get_libdir)/ocaml \
-		MANDIR=${D}/usr/share/man \
-		install || die
-
-	# compiler libs
-	dodir /usr/lib/ocaml/compiler-libs
-	insinto /usr/lib/ocaml/compiler-libs
-	doins {utils,typing,parsing}/*.{mli,cmi,cmo,cmx,o}
-
-	# headers
-	dodir /usr/include
-	dosym /usr/include/caml /usr/lib/ocaml/caml
-
-	# silly, silly makefiles
-	dosed "s:${D}::g" /usr/$(get_libdir)/ocaml/ld.conf
-
-	# documentation
-	dodoc Changes INSTALL LICENSE README Upgrading
-}
-
-pkg_postinst() {
-	if use latex; then
-		echo "TEXINPUTS=/usr/$(get_libdir)/ocaml/ocamldoc:" > /etc/env.d/99ocamldoc
-	fi
-
-	echo
-	elog "OCaml is not binary compatible from version to version,"
-	elog "so you (may) need to rebuild all packages depending on it that"
-	elog "are actually installed on your system."
-	elog "To do so, you can run: "
-	elog "sh ${FILESDIR}/ocaml-rebuild.sh [-h | emerge options]"
-	elog "Which will call emerge on all old packages with the given options"
-	echo
-}
diff --git a/hardened/dev-lang/ocaml/ocaml-3.09.2.ebuild b/hardened/dev-lang/ocaml/ocaml-3.09.2.ebuild
deleted file mode 100644
index 442cf13..0000000
--- a/hardened/dev-lang/ocaml/ocaml-3.09.2.ebuild
+++ /dev/null
@@ -1,91 +0,0 @@
-# Copyright 1999-2007 Gentoo Foundation
-# Distributed under the terms of the GNU General Public License v2
-# $Header: /var/cvsroot/gentoo-x86/dev-lang/ocaml/ocaml-3.09.2.ebuild,v 1.11 2007/02/06 08:26:45 genone Exp $
-
-inherit flag-o-matic eutils multilib toolchain-funcs
-
-DESCRIPTION="fast modern type-inferring functional programming language descended from the ML (Meta Language) family"
-HOMEPAGE="http://www.ocaml.org/"
-
-SRC_URI="http://caml.inria.fr/distrib/ocaml-3.09/${P}.tar.bz2"
-
-LICENSE="QPL-1.0 LGPL-2"
-SLOT="0"
-KEYWORDS="amd64 ppc ppc64 sparc x86"
-IUSE="tk latex"
-
-DEPEND="virtual/libc
-	tk? ( >=dev-lang/tk-3.3.3 )"
-
-pkg_setup() {
-	ewarn
-	ewarn "Building ocaml with unsafe CFLAGS can have unexpected results"
-	ewarn "Please retry building with safer CFLAGS before reporting bugs"
-	ewarn "Likewise, building with a hardened gcc is not possible."
-	ewarn
-}
-
-src_compile() {
-	gcc-specs-pie && append-flags -nopie
-	filter-flags -pie
-	replace-flags "-O?" -O2
-
-	local myconf
-	use tk || myconf="-no-tk"
-
-	# Fix for bug #46703
-	export LC_ALL=C
-
-	./configure -prefix /usr \
-		-bindir /usr/bin \
-		-libdir /usr/$(get_libdir)/ocaml \
-		-mandir /usr/share/man \
-		--with-pthread ${myconf} || die
-
-	sed -i -e "s/\(BYTECCCOMPOPTS=.*\)/\1 ${CFLAGS}/" config/Makefile
-	sed -i -e "s/\(NATIVECCCOMPOPTS=.*\)/\1 ${CFLAGS}/" config/Makefile
-
-	make world || die
-	# Native code generation unsupported on some archs
-	if ! use ppc64 ; then
-		make opt || die
-		make opt.opt || die
-	fi
-}
-
-src_install() {
-	make BINDIR=${D}/usr/bin \
-		LIBDIR=${D}/usr/$(get_libdir)/ocaml \
-		MANDIR=${D}/usr/share/man \
-		install || die
-
-	# compiler libs
-	dodir /usr/lib/ocaml/compiler-libs
-	insinto /usr/lib/ocaml/compiler-libs
-	doins {utils,typing,parsing}/*.{mli,cmi,cmo,cmx,o}
-
-	# headers
-	dodir /usr/include
-	dosym /usr/lib/ocaml/caml /usr/include/
-
-	# silly, silly makefiles
-	dosed "s:${D}::g" /usr/$(get_libdir)/ocaml/ld.conf
-
-	# documentation
-	dodoc Changes INSTALL LICENSE README Upgrading
-}
-
-pkg_postinst() {
-	if use latex; then
-		echo "TEXINPUTS=/usr/$(get_libdir)/ocaml/ocamldoc:" > /etc/env.d/99ocamldoc
-	fi
-
-	echo
-	elog "OCaml is not binary compatible from version to version,"
-	elog "so you (may) need to rebuild all packages depending on it that"
-	elog "are actually installed on your system."
-	elog "To do so, you can run: "
-	elog "sh ${FILESDIR}/ocaml-rebuild.sh [-h | emerge options]"
-	elog "Which will call emerge on all old packages with the given options"
-	echo
-}
diff --git a/hardened/dev-lang/ocaml/ocaml-3.09.3.ebuild b/hardened/dev-lang/ocaml/ocaml-3.09.3.ebuild
index c809985..de6bd64 100644
--- a/hardened/dev-lang/ocaml/ocaml-3.09.3.ebuild
+++ b/hardened/dev-lang/ocaml/ocaml-3.09.3.ebuild
@@ -25,9 +25,16 @@ pkg_setup() {
 	ewarn
 }
 
+src_unpack() {
+	unpack ${A}
+	cd "${S}"
+
+	epatch "${FILESDIR}"/${P}-asm-fixes.patch
+}
+
 src_compile() {
 	gcc-specs-pie && append-flags -nopie
-	filter-flags -pie
+	filter-flags -pie -fstack-protector
 	replace-flags "-O?" -O2
 
 	local myconf