diff -urN llvm-3.5.1.src/include/llvm/Transforms/Instrumentation.h llvm-3.5.1.src/include/llvm/Transforms/Instrumentation.h
--- llvm-3.5.1.src/include/llvm/Transforms/Instrumentation.h    2014-07-08 02:50:49.000000000 +0200
+++ llvm-3.5.1.src/include/llvm/Transforms/Instrumentation.h        2015-01-24 14:21:08.727981878 +0100
@@ -14,6 +14,9 @@
 #ifndef LLVM_TRANSFORMS_INSTRUMENTATION_H
 #define LLVM_TRANSFORMS_INSTRUMENTATION_H
 
+// Enable PaX-specific memory ranges:
+#define SANITIZER_PAX
+
 #include "llvm/ADT/StringRef.h"
 
 #if defined(__GNUC__) && defined(__linux__) && !defined(ANDROID)
diff -urN llvm-3.5.1.src/lib/Transforms/Instrumentation/AddressSanitizer.cpp llvm-3.5.1.src/lib/Transforms/Instrumentation/AddressSanitizer.cpp
--- llvm-3.5.1.src/lib/Transforms/Instrumentation/AddressSanitizer.cpp	2014-07-17 20:48:12.000000000 +0200
+++ llvm-3.5.1.src/lib/Transforms/Instrumentation/AddressSanitizer.cpp	2015-01-23 22:35:32.983924751 +0100
@@ -57,7 +57,11 @@
 static const uint64_t kDefaultShadowOffset32 = 1ULL << 29;
 static const uint64_t kIOSShadowOffset32 = 1ULL << 30;
 static const uint64_t kDefaultShadowOffset64 = 1ULL << 44;
+#ifdef SANITIZER_PAX
+static const uint64_t kSmallX86_64ShadowOffset = 1ULL << 40;
+#else
 static const uint64_t kSmallX86_64ShadowOffset = 0x7FFF8000;  // < 2G.
+#endif
 static const uint64_t kPPC64_ShadowOffset64 = 1ULL << 41;
 static const uint64_t kMIPS32_ShadowOffset32 = 0x0aaa8000;
 static const uint64_t kFreeBSD_ShadowOffset32 = 1ULL << 30;
diff -urN llvm-3.5.1.src/lib/Transforms/Instrumentation/MemorySanitizer.cpp llvm-3.5.1.src/lib/Transforms/Instrumentation/MemorySanitizer.cpp
--- llvm-3.5.1.src/lib/Transforms/Instrumentation/MemorySanitizer.cpp	2014-07-17 11:10:37.000000000 +0200
+++ llvm-3.5.1.src/lib/Transforms/Instrumentation/MemorySanitizer.cpp	2015-01-24 09:54:17.048915384 +0100
@@ -120,10 +120,18 @@
 
 #define DEBUG_TYPE "msan"
 
+#ifdef SANITIZER_PAX
+static const uint64_t kAppShadowMemBeg     = 0x000010000000ULL;
+static const uint64_t kModShadowMemBeg     = 0x008010000000ULL;
+static const uint64_t kOriginOffset        = 0x014010000000ULL - kAppShadowMemBeg;
+static const uint64_t kAppMemBeg           = 0x02aaaaaaa000ULL;
+static const uint64_t kModMemBeg           = 0x034000000000ULL;
+#else
 static const uint64_t kShadowMask32 = 1ULL << 31;
 static const uint64_t kShadowMask64 = 1ULL << 46;
 static const uint64_t kOriginOffset32 = 1ULL << 30;
 static const uint64_t kOriginOffset64 = 1ULL << 45;
+#endif
 static const unsigned kMinOriginAlignment = 4;
 static const unsigned kShadowTLSAlignment = 8;
 
@@ -263,9 +271,11 @@
   /// \brief MSan runtime replacements for memmove, memcpy and memset.
   Value *MemmoveFn, *MemcpyFn, *MemsetFn;
 
+#ifndef SANITIZER_PAX
   /// \brief Address mask used in application-to-shadow address calculation.
   /// ShadowAddr is computed as ApplicationAddr & ~ShadowMask.
   uint64_t ShadowMask;
+#endif
   /// \brief Offset of the origin shadow from the "normal" shadow.
   /// OriginAddr is computed as (ShadowAddr + OriginOffset) & ~3ULL
   uint64_t OriginOffset;
@@ -418,6 +428,9 @@
   DL = &DLP->getDataLayout();
 
   C = &(M.getContext());
+#ifdef SANITIZER_PAX
+  OriginOffset = kOriginOffset;
+#else
   unsigned PtrSize = DL->getPointerSizeInBits(/* AddressSpace */0);
   switch (PtrSize) {
     case 64:
@@ -432,6 +445,7 @@
       report_fatal_error("unsupported pointer size");
       break;
   }
+#endif
 
   IRBuilder<> IRB(*C);
   IntptrTy = IRB.getIntPtrTy(DL);
@@ -792,13 +806,26 @@
 
   /// \brief Compute the shadow address that corresponds to a given application
   /// address.
-  ///
-  /// Shadow = Addr & ~ShadowMask.
+  Value *getShadowLong(Value *Addr, IRBuilder<> &IRB) {
+#ifdef SANITIZER_PAX
+    /// Shadow = Addr - ((Addr >= kModMemBeg) ? (kModMemBeg - kModShadowMemBeg) : kAppMemBeg - kAppShadowMemBeg)
+    Value *Cond =
+      IRB.CreateICmpUGE(IRB.CreatePointerCast(Addr, MS.IntptrTy),
+                        ConstantInt::get(MS.IntptrTy, kModMemBeg));
+    Value *ShadowOffset =
+      IRB.CreateSelect(Cond, ConstantInt::get(MS.IntptrTy, kModMemBeg - kModShadowMemBeg),
+                       ConstantInt::get(MS.IntptrTy, kAppMemBeg - kAppShadowMemBeg));
+    return IRB.CreateSub(IRB.CreatePointerCast(Addr, MS.IntptrTy), ShadowOffset);
+#else
+    /// Shadow = Addr & ~ShadowMask.
+    return IRB.CreateAnd(IRB.CreatePointerCast(Addr, MS.IntptrTy),
+                         ConstantInt::get(MS.IntptrTy, ~MS.ShadowMask));
+#endif
+  }
+
   Value *getShadowPtr(Value *Addr, Type *ShadowTy,
                       IRBuilder<> &IRB) {
-    Value *ShadowLong =
-      IRB.CreateAnd(IRB.CreatePointerCast(Addr, MS.IntptrTy),
-                    ConstantInt::get(MS.IntptrTy, ~MS.ShadowMask));
+    Value *ShadowLong = getShadowLong(Addr, IRB);
     return IRB.CreateIntToPtr(ShadowLong, PointerType::get(ShadowTy, 0));
   }
 
@@ -807,9 +834,7 @@
   ///
   /// OriginAddr = (ShadowAddr + OriginOffset) & ~3ULL
   Value *getOriginPtr(Value *Addr, IRBuilder<> &IRB) {
-    Value *ShadowLong =
-      IRB.CreateAnd(IRB.CreatePointerCast(Addr, MS.IntptrTy),
-                    ConstantInt::get(MS.IntptrTy, ~MS.ShadowMask));
+    Value *ShadowLong = getShadowLong(Addr, IRB);
     Value *Add =
       IRB.CreateAdd(ShadowLong,
                     ConstantInt::get(MS.IntptrTy, MS.OriginOffset));
