PaX, PowerPC and BATs

[AngelicLiar]

Hey all,

I'm still adventuring in PowerPC-land and trying to get PaX (or grsec) to work on my crappy 6xx board. Background - this processor has no NX bit, and prefers mapping memory using BATs (Block Address Translation registers) and not pages, which naturally makes NX-pages impossible (BTW, paxtest still reports that the kernel isn't vulnerable to some attacks, which is strange since it is supposed to be vulnerable IMO)
The BATs can be disabled with a boot argument, but...

* 2.6.27.10 with pax doesn't boot without BATs. It Oopses (2 lines after "Calibrating delay loop"), then gets a kernel page fault, then complains it tried to kill init.

* 2.6.32.10 without grsec or pax DOES work without BATs

* 2.6.32.10 with grsec doesn't work without BATs -OR- with BATs, even if I disable grsec in menuconfig!

I am totally stumped by this. Does anyone have any idea why:
* 2.6.27 doesn't work without BATs
* 2.6.32 doesn't work with grsec even if it's disabled in menuconfig?