My understanding is that system calls can currently only be made from -w+x regions; attempting otherwise results in the process being killed. The idea is to ex

My understanding is that system calls can currently only be made from -w+x regions; attempting otherwise results in the process being killed. The idea is to extend this protection to only allow system calls from expected address ranges, so that a successful exploit can't simply make raw calls but instead has to track down an existing authorized one (and thus contend with ASLR). To that end, the new call-once syscall msyscall(2) is added. The linker uses it to register libc.so with the kernel after randomly mapping it into the current process.