[PATCH 0/5] vsyscall xonly mode

From: Andy Lutomirski
Date: Mon Jun 10 2019 - 16:30:03 EST

Hi all-

This adds a new "xonly" mode for vsyscalls and makes it the default.
xonly is a bit more secure -- Kees knows about an exploit that relied on
read access to the vsyscall page. It's also nicer from a paging
perspective, as it doesn't require user access to any of the kernel
address space as far as the CPU is concerned. This would, for example,
allow a much simpler implementation of per-process vsyscall disabling.

Andy Lutomirski (5):
x86/vsyscall: Remove the vsyscall=native documentation
x86/vsyscall: Add a new vsyscall=xonly mode
x86/vsyscall: Document odd #PF's error code for vsyscalls
selftests/x86/vsyscall: Verify that vsyscall=none blocks execution
x86/vsyscall: Change the default vsyscall mode to xonly

.../admin-guide/kernel-parameters.txt | 11 ++-
arch/x86/Kconfig | 32 ++++---
arch/x86/entry/vsyscall/vsyscall_64.c | 19 ++++-
arch/x86/mm/fault.c | 7 ++
tools/testing/selftests/x86/test_vsyscall.c | 83 +++++++++++++------
5 files changed, 107 insertions(+), 45 deletions(-)