diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/asan/asan_allocator.h llvm-3.5.1.src/projects/compiler-rt/lib/asan/asan_allocator.h
--- llvm-3.5.1.src/projects/compiler-rt/lib/asan/asan_allocator.h	2014-04-15 15:30:32.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/asan/asan_allocator.h	2015-01-23 22:35:32.942925788 +0100
@@ -103,8 +103,13 @@
 const uptr kAllocatorSpace =  0xa0000000000ULL;
 const uptr kAllocatorSize  =  0x20000000000ULL;  // 2T.
 # else
+#  ifdef SANITIZER_PAX
+const uptr kAllocatorSpace = 0x018000000000ULL;
+const uptr kAllocatorSize  =  0x04000000000ULL; // 256G.
+#  else
 const uptr kAllocatorSpace = 0x600000000000ULL;
 const uptr kAllocatorSize  =  0x40000000000ULL;  // 4T.
+#  endif
 # endif
 typedef DefaultSizeClassMap SizeClassMap;
 typedef SizeClassAllocator64<kAllocatorSpace, kAllocatorSize, 0 /*metadata*/,
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/asan/asan_mapping.h llvm-3.5.1.src/projects/compiler-rt/lib/asan/asan_mapping.h
--- llvm-3.5.1.src/projects/compiler-rt/lib/asan/asan_mapping.h	2014-05-30 10:52:03.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/asan/asan_mapping.h	2015-01-23 22:35:32.942925788 +0100
@@ -84,7 +84,11 @@
 static const u64 kDefaultShadowOffset32 = 1ULL << 29;  // 0x20000000
 static const u64 kIosShadowOffset32 = 1ULL << 30;  // 0x40000000
 static const u64 kDefaultShadowOffset64 = 1ULL << 44;
+#ifdef SANITIZER_PAX
+static const u64 kDefaultShort64bitShadowOffset = 1ULL << 40;
+#else
 static const u64 kDefaultShort64bitShadowOffset = 0x7FFF8000;  // < 2G.
+#endif
 static const u64 kAArch64_ShadowOffset64 = 1ULL << 36;
 static const u64 kMIPS32_ShadowOffset32 = 0x0aaa8000;
 static const u64 kPPC64_ShadowOffset64 = 1ULL << 41;
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/lsan/lsan_allocator.cc llvm-3.5.1.src/projects/compiler-rt/lib/lsan/lsan_allocator.cc
--- llvm-3.5.1.src/projects/compiler-rt/lib/lsan/lsan_allocator.cc	2014-01-10 11:48:01.000000000 +0100
+++ llvm-3.5.1.src/projects/compiler-rt/lib/lsan/lsan_allocator.cc	2015-01-23 22:35:32.942925788 +0100
@@ -25,8 +25,13 @@
 namespace __lsan {
 
 static const uptr kMaxAllowedMallocSize = 8UL << 30;
+#ifdef SANITIZER_PAX
+static const uptr kAllocatorSpace = 0x018000000000ULL;
+static const uptr kAllocatorSize  =  0x04000000000ULL; // 256G.
+#else
 static const uptr kAllocatorSpace = 0x600000000000ULL;
 static const uptr kAllocatorSize  =  0x40000000000ULL;  // 4T.
+#endif
 
 struct ChunkMetadata {
   bool allocated : 8;  // Must be first.
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan_allocator.cc llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan_allocator.cc
--- llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan_allocator.cc	2014-07-07 19:39:31.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan_allocator.cc	2015-01-23 22:35:32.942925788 +0100
@@ -40,8 +40,13 @@
   }
 };
 
+#ifdef SANITIZER_PAX
+static const uptr kAllocatorSpace = kAllocMemBeg;
+static const uptr kAllocatorSize   = kAllocSize;
+#else
 static const uptr kAllocatorSpace = 0x600000000000ULL;
 static const uptr kAllocatorSize   = 0x80000000000;  // 8T.
+#endif
 static const uptr kMetadataSize  = sizeof(Metadata);
 static const uptr kMaxAllowedMallocSize = 8UL << 30;
 
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan.h llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan.h
--- llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan.h	2014-07-07 19:39:31.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan.h	2015-01-24 09:52:31.010608781 +0100
@@ -25,6 +25,57 @@
 # define MSAN_REPLACE_OPERATORS_NEW_AND_DELETE 1
 #endif
 
+#ifdef SANITIZER_PAX
+
+// C++ linux memory layout with PaX (RANDMMAP & ASLR disabled):
+// 0000 0000 0000 - 0000 1000 0000: protected (256M)
+// 0000 1000 0000 - 0080 1000 0000: shadow for main application and heap (512G)
+// 0080 1000 0000 - 0140 1000 0000: shadow for allocator, modules and main thread stack (768G)
+// 0140 1000 0000 - 01c0 1000 0000: origin for main application and heap (512G)
+// 01c0 1000 0000 - 0280 1000 0000: origin for allocator, modules and main thread stack (768G)
+// 0280 1000 0000 - 02aa aaaa a000: - (~170G)
+// 02aa aaaa a000 - 032a aaaa a000: main application and heap (512G)
+// 032a aaaa a000 - 0340 0000 0000: - (~85G)
+// 0340 0000 0000 - 03ff ffff ffff: allocator, modules and main thread stack (768G)
+
+static const uptr kAppShadowMemBeg     = 0x000010000000ULL;
+static const uptr kModShadowMemBeg     = 0x008010000000ULL;
+static const uptr kOriginOffset        = 0x014010000000ULL - kAppShadowMemBeg;
+static const uptr kAppMemBeg           = 0x02aaaaaaa000ULL;
+static const uptr kAppMemEnd           = 0x032aaaaa9fffULL;
+static const uptr kModMemBeg           = 0x034000000000ULL;
+static const uptr kAllocMemBeg         = kModMemBeg;
+static const uptr kAllocSize           = 0x004000000000ULL;
+static const uptr kModMemEnd           = 0x03ffffffffffULL;
+
+#define MEM_TO_SHADOW(mem) \
+    (((uptr)mem) - \
+     (((uptr)mem) >= kModMemBeg ? \
+      kModMemBeg - kModShadowMemBeg : \
+      kAppMemBeg - kAppShadowMemBeg))
+
+#define SHADOW_TO_ORIGIN(shadow) \
+    (((uptr)shadow) + kOriginOffset)
+
+#define MEM_TO_ORIGIN(mem) \
+    (SHADOW_TO_ORIGIN(MEM_TO_SHADOW(mem)))
+
+#define MEM_IS_APP(mem) \
+    ((((uptr)mem) >= kAppMemBeg && ((uptr)mem) <= kAppMemEnd) || \
+     (((uptr)mem) >= kModMemBeg && ((uptr)mem) <= kModMemEnd))
+
+ #define MEM_IS_SHADOW(mem) \
+    (((uptr)mem) >= kAppShadowMemBeg && ((uptr)mem) <= kModMemShadowEnd)
+
+COMPILER_CHECK(MEM_TO_SHADOW(kAppMemBeg) == kAppShadowMemBeg);
+COMPILER_CHECK(MEM_TO_SHADOW(kAppMemEnd) == kModShadowMemBeg - 1);
+COMPILER_CHECK(MEM_TO_SHADOW(kModMemBeg) == kModShadowMemBeg);
+COMPILER_CHECK(MEM_TO_SHADOW(kModMemEnd) == kAppShadowMemBeg + kOriginOffset - 1);
+COMPILER_CHECK(MEM_TO_ORIGIN(kAppMemBeg) == kAppShadowMemBeg + kOriginOffset);
+COMPILER_CHECK(MEM_TO_ORIGIN(kModMemEnd) < kAppMemBeg);
+
+#else
+
 #define MEM_TO_SHADOW(mem)       (((uptr)mem) & ~0x400000000000ULL)
 #define SHADOW_TO_ORIGIN(shadow) (((uptr)shadow) + 0x200000000000ULL)
 #define MEM_TO_ORIGIN(mem)       (SHADOW_TO_ORIGIN(MEM_TO_SHADOW(mem)))
@@ -32,6 +83,8 @@
 #define MEM_IS_SHADOW(mem) \
   ((uptr)mem >= 0x200000000000ULL && (uptr)mem <= 0x400000000000ULL)
 
+#endif
+
 const int kMsanParamTlsSizeInWords = 100;
 const int kMsanRetvalTlsSizeInWords = 100;
 
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan_linux.cc llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan_linux.cc
--- llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan_linux.cc	2014-06-24 11:04:06.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/msan/msan_linux.cc	2015-01-24 09:21:52.286432234 +0100
@@ -35,12 +35,19 @@
 
 namespace __msan {
 
+#ifdef SANITIZER_PAX
+static const uptr kMemBeg     = kAppMemBeg;
+static const uptr kMemEnd     = kModMemEnd;
+#else
 static const uptr kMemBeg     = 0x600000000000;
 static const uptr kMemEnd     = 0x7fffffffffff;
+#endif
 static const uptr kShadowBeg  = MEM_TO_SHADOW(kMemBeg);
 static const uptr kShadowEnd  = MEM_TO_SHADOW(kMemEnd);
+#ifndef SANITIZER_PAX
 static const uptr kBad1Beg    = 0;
 static const uptr kBad1End    = kShadowBeg - 1;
+#endif
 static const uptr kBad2Beg    = kShadowEnd + 1;
 static const uptr kBad2End    = kMemBeg - 1;
 static const uptr kOriginsBeg = kBad2Beg;
@@ -58,18 +65,24 @@
   VPrintf(1, "Bad2     : %p %p\n", kBad2Beg, kBad2End);
   VPrintf(1, "Origins  : %p %p\n", kOriginsBeg, kOriginsEnd);
   VPrintf(1, "Shadow   : %p %p\n", kShadowBeg, kShadowEnd);
+#ifndef SANITIZER_PAX
   VPrintf(1, "Bad1     : %p %p\n", kBad1Beg, kBad1End);
+#endif
 
   if (!MemoryRangeIsAvailable(kShadowBeg,
                               init_origins ? kOriginsEnd : kShadowEnd) ||
+#ifndef SANITIZER_PAX
       (prot1 && !MemoryRangeIsAvailable(kBad1Beg, kBad1End)) ||
+#endif
       (prot2 && !MemoryRangeIsAvailable(kBad2Beg, kBad2End))) {
     Printf("FATAL: Shadow memory range is not available.\n");
     return false;
   }
 
+#ifndef SANITIZER_PAX
   if (prot1 && !Mprotect(kBad1Beg, kBad1End - kBad1Beg))
     return false;
+#endif
   if (prot2 && !Mprotect(kBad2Beg, kBad2End - kBad2Beg))
     return false;
   if (map_shadow) {
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_platform.h llvm-3.5.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_platform.h
--- llvm-3.5.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_platform.h	2014-05-21 10:01:44.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_platform.h	2015-01-23 22:35:32.943925762 +0100
@@ -13,6 +13,9 @@
 #ifndef SANITIZER_PLATFORM_H
 #define SANITIZER_PLATFORM_H
 
+// Enable PaX-specific memory ranges:
+#define SANITIZER_PAX
+
 #if !defined(__linux__) && !defined(__FreeBSD__) && \
   !defined(__APPLE__) && !defined(_WIN32)
 # error "This operating system is not supported"
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc llvm-3.5.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc
--- llvm-3.5.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc	2014-05-27 14:37:52.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/sanitizer_common/sanitizer_posix.cc	2015-01-23 22:35:32.943925762 +0100
@@ -88,7 +88,11 @@
 # elif defined(__aarch64__)
   return (1ULL << 39) - 1;
 # else
+#  ifdef SANITIZER_PAX
+  return (1ULL << 42) - 1;  // 0x000003ffffffffffUL;
+#  else
   return (1ULL << 47) - 1;  // 0x00007fffffffffffUL;
+#  endif
 # endif
 #else  // SANITIZER_WORDSIZE == 32
   uptr res = (1ULL << 32) - 1;  // 0xffffffff;
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_platform.h llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_platform.h
--- llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_platform.h	2014-07-15 11:31:29.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_platform.h	2015-01-24 09:51:19.693420256 +0100
@@ -56,6 +56,105 @@
 #if defined(__LP64__) || defined(_WIN64)
 namespace __tsan {
 
+#if defined(SANITIZER_PAX)
+
+// C++ linux memory layout with PaX (RANDMMAP & ASLR disabled):
+// 0000 0000 0000 - 0000 1000 0000: protected (256M)
+// 0000 1000 0000 - 00a0 1000 0000: shadow for main application and heap (640G)
+// 00a0 1000 0000 - 02a0 1000 0000: shadow for allocator, modules and main thread stack (2T)
+// 02a0 1000 0000 - 02aa aaaa a000: - (~42G)
+// 02aa aaaa a000 - 02d2 aaaa a000: main application and heap (160G)
+// 02d2 aaaa a000 - 0326 aaaa a000: metainfo (336G)
+// 0326 aaaa a000 - 0330 0000 0000: - (~37G)
+// 0330 0000 0000 - 0380 0000 0000: traces (320G)
+// 0380 0000 0000 - 03ff ffff ffff: allocator, modules and main thread stack (512G)
+
+static const uptr kLinuxShadowBeg = 0x000010000000ULL;
+static const uptr kHighShadowBeg  = 0x00a010000000ULL;
+static const uptr kLinuxShadowEnd = 0x02a00fffffffULL;
+static const uptr kLinuxAppMemBeg = 0x02aaaaaaa000ULL;
+static const uptr kLinuxAppMemEnd = 0x02d2aaaa9fffULL;
+static const uptr kMetaShadow     = 0x02d2aaaaa000ULL;
+static const uptr kHighMetaOff    = 0x001400000000ULL;
+static const uptr kHighMetaMemBeg = kMetaShadow + kHighMetaOff;
+static const uptr kMetaSize       = 0x005400000000ULL;
+static const uptr kTraceMemBegin  = 0x033000000000ULL;
+static const uptr kTraceMemSize   = 0x005000000000ULL;
+static const uptr kLinuxModMemBeg = 0x038000000000ULL;
+static const uptr kAllocMemBeg    = kLinuxModMemBeg;
+static const uptr kAllocMemSize   = 0x004000000000ULL;
+static const uptr kLinuxModMemEnd = 0x03ffffffffffULL;
+
+// This has to be a macro to allow constant initialization of constants below.
+#define MemToShadowOffset(addr) \
+    (((uptr)addr >= kLinuxModMemBeg) ? \
+     kLinuxModMemBeg - kHighShadowBeg / kShadowCnt : \
+     kLinuxAppMemBeg - kLinuxShadowBeg / kShadowCnt)
+
+#define ShadowToMemOffset(addr) \
+    (((uptr)addr >= kHighShadowBeg) ? \
+     kLinuxModMemBeg - kHighShadowBeg / kShadowCnt : \
+     kLinuxAppMemBeg - kLinuxShadowBeg / kShadowCnt)
+
+#define MetaShadowOffset(addr) \
+    (((uptr)addr >= kLinuxModMemBeg) ? \
+     kLinuxModMemBeg - kHighMetaMemBeg * kMetaShadowCell / kMetaShadowSize : \
+     kLinuxAppMemBeg - kMetaShadow * kMetaShadowCell / kMetaShadowSize)
+
+#define MemToShadow(addr) \
+    ((((uptr)addr - MemToShadowOffset(addr)) & ~(kShadowCell - 1)) * kShadowCnt)
+
+#define MemToMeta(addr) \
+    (u32*)((((uptr)addr - MetaShadowOffset(addr)) & ~(kMetaShadowCell - 1)) / kMetaShadowCell * kMetaShadowSize)
+
+// The layout above makes sense only for the following size constants:
+COMPILER_CHECK(kShadowCnt == 4);
+COMPILER_CHECK(kMetaShadowCell == 8);
+COMPILER_CHECK(kMetaShadowSize == 4);
+
+// When both RANDMMAP and ASLR are disabled, PaX puts application at this address,
+// so make sure our range covers it.
+COMPILER_CHECK(kLinuxAppMemBeg <= 0x2aaaaaaa000ULL && 0x2aaaaaaa000ULL + 0x02000000000ULL < kLinuxAppMemEnd);
+
+// PaX doesn't allow to mmap some regions below this threshold,
+// so make sure we're not trying to mmap it.
+COMPILER_CHECK(MemToShadow(0x2aaaaaaa000ULL) >= 0x800000ULL);
+
+// Given the constants above, the layout must satisfy the following relations:
+COMPILER_CHECK(4 * (kLinuxAppMemEnd - kLinuxAppMemBeg + 1) == kHighShadowBeg - kLinuxShadowBeg);
+COMPILER_CHECK(4 * (kLinuxModMemEnd - kLinuxModMemBeg + 1) == kLinuxShadowEnd - kHighShadowBeg + 1);
+COMPILER_CHECK(kHighMetaOff == (kLinuxAppMemEnd - kLinuxAppMemBeg + 1) / 2);
+COMPILER_CHECK(kMetaSize == (kLinuxAppMemEnd - kLinuxAppMemBeg + 1 + kLinuxModMemEnd - kLinuxModMemBeg + 1) / 2);
+COMPILER_CHECK(kMetaShadow + kMetaSize <= kTraceMemBegin);
+COMPILER_CHECK(kTraceMemBegin + kTraceMemSize == kAllocMemBeg);
+
+COMPILER_CHECK(MemToShadow(kLinuxAppMemBeg) == kLinuxShadowBeg);
+COMPILER_CHECK(MemToShadow(kLinuxAppMemEnd) == kHighShadowBeg - 32);
+COMPILER_CHECK(MemToShadow(kLinuxModMemBeg) == kHighShadowBeg);
+COMPILER_CHECK(MemToShadow(kLinuxModMemEnd) == kLinuxShadowEnd - 31);
+
+COMPILER_CHECK((uptr)MemToMeta(kLinuxAppMemBeg) == kMetaShadow);
+COMPILER_CHECK((uptr)MemToMeta(kLinuxAppMemEnd) == kMetaShadow + kHighMetaOff - 4);
+COMPILER_CHECK((uptr)MemToMeta(kLinuxModMemBeg) == kMetaShadow + kHighMetaOff);
+COMPILER_CHECK((uptr)MemToMeta(kLinuxModMemEnd) == kMetaShadow + kMetaSize - 4);
+
+
+static inline bool IsAppMem(uptr mem) {
+  return (mem >= kLinuxAppMemBeg && mem <= kLinuxAppMemEnd) ||
+      (mem >= kLinuxModMemBeg && mem <= kLinuxModMemEnd);
+}
+
+static inline bool IsShadowMem(uptr mem) {
+  return mem >= kLinuxShadowBeg && mem <= kLinuxShadowEnd;
+}
+
+static inline uptr ShadowToMem(uptr shadow) {
+  CHECK(IsShadowMem(shadow));
+  return (shadow / kShadowCnt) + ShadowToMemOffset(shadow);
+}
+
+#else // defined(SANITIZER_PAX)
+
 #if defined(TSAN_GO)
 static const uptr kLinuxAppMemBeg = 0x000000000000ULL;
 static const uptr kLinuxAppMemEnd = 0x04dfffffffffULL;
@@ -124,6 +223,8 @@
 #endif
 }
 
+#endif // defined(SANITIZER_PAX)
+
 void FlushShadowMemory();
 void WriteMemoryProfile(char *buf, uptr buf_size, uptr nthread, uptr nlive);
 uptr GetRSS();
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_platform_linux.cc llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_platform_linux.cc
--- llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_platform_linux.cc	2014-06-21 00:51:18.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_platform_linux.cc	2015-01-23 22:35:32.944925737 +0100
@@ -129,6 +129,8 @@
 }
 
 #ifndef TSAN_GO
+
+#ifndef SANITIZER_PAX
 static void ProtectRange(uptr beg, uptr end) {
   CHECK_LE(beg, end);
   if (beg == end)
@@ -139,6 +141,7 @@
     Die();
   }
 }
+#endif
 
 // Mark shadow for .rodata sections with the special kShadowRodata marker.
 // Accesses to .rodata can't race, so this saves time, memory and trace space.
@@ -232,6 +235,7 @@
   DPrintf("meta shadow: %zx-%zx (%zuGB)\n",
       kMetaShadow, kMetaShadow + kMetaSize, kMetaSize >> 30);
 
+#ifndef SANITIZER_PAX
   // Protect gaps.
   const uptr kClosedLowBeg  = 0x200000;
   const uptr kClosedLowEnd  = kLinuxShadowBeg - 1;
@@ -245,6 +249,7 @@
       kClosedLowBeg, kClosedLowEnd, (kClosedLowEnd - kClosedLowBeg) >> 30);
   VPrintf(2, "kClosedMid   %zx-%zx (%zuGB)\n",
       kClosedMidBeg, kClosedMidEnd, (kClosedMidEnd - kClosedMidBeg) >> 30);
+#endif
   VPrintf(2, "app mem: %zx-%zx (%zuGB)\n",
       kLinuxAppMemBeg, kLinuxAppMemEnd,
       (kLinuxAppMemEnd - kLinuxAppMemBeg) >> 30);
diff -urN llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_rtl.h llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_rtl.h
--- llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_rtl.h	2014-07-15 11:31:29.000000000 +0200
+++ llvm-3.5.1.src/projects/compiler-rt/lib/tsan/rtl/tsan_rtl.h	2015-01-23 22:35:32.944925737 +0100
@@ -53,8 +53,14 @@
 namespace __tsan {
 
 #ifndef TSAN_GO
+
+#ifdef SANITIZER_PAX
+const uptr kAllocatorSpace = kAllocMemBeg;
+const uptr kAllocatorSize  = kAllocMemSize;
+#else
 const uptr kAllocatorSpace = 0x7d0000000000ULL;
 const uptr kAllocatorSize  =  0x10000000000ULL;  // 1T.
+#endif
 
 struct MapUnmapCallback;
 typedef SizeClassAllocator64<kAllocatorSpace, kAllocatorSize, 0,
