From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: (majordomo@vger.kernel.org) by vger.kernel.org via listexpand id S1753107AbdKHTtS (ORCPT ); Wed, 8 Nov 2017 14:49:18 -0500 Received: from mga01.intel.com ([192.55.52.88]:49157 "EHLO mga01.intel.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1752861AbdKHTrn (ORCPT ); Wed, 8 Nov 2017 14:47:43 -0500 X-ExtLoop1: 1 X-IronPort-AV: E=Sophos;i="5.44,365,1505804400"; d="scan'208";a="1241646372" Subject: [PATCH 24/30] x86, kaiser: disable native VSYSCALL To: linux-kernel@vger.kernel.org Cc: linux-mm@kvack.org, dave.hansen@linux.intel.com, moritz.lipp@iaik.tugraz.at, daniel.gruss@iaik.tugraz.at, michael.schwarz@iaik.tugraz.at, richard.fellner@student.tugraz.at, luto@kernel.org, torvalds@linux-foundation.org, keescook@google.com, hughd@google.com, x86@kernel.org From: Dave Hansen Date: Wed, 08 Nov 2017 11:47:31 -0800 References: <20171108194646.907A1942@viggo.jf.intel.com> In-Reply-To: <20171108194646.907A1942@viggo.jf.intel.com> Message-Id: <20171108194731.AB5BDA01@viggo.jf.intel.com> Sender: linux-kernel-owner@vger.kernel.org List-ID: X-Mailing-List: linux-kernel@vger.kernel.org From: Dave Hansen The VSYSCALL page is mapped by kernel page tables at a kernel address. It is troublesome to support with KAISER in place, so disable the native case. Also add some help text about how KAISER might affect the emulation case as well. Signed-off-by: Dave Hansen Cc: Moritz Lipp Cc: Daniel Gruss Cc: Michael Schwarz Cc: Richard Fellner Cc: Andy Lutomirski Cc: Linus Torvalds Cc: Kees Cook Cc: Hugh Dickins Cc: x86@kernel.org --- b/arch/x86/Kconfig | 8 ++++++++ 1 file changed, 8 insertions(+) diff -puN arch/x86/Kconfig~kaiser-no-vsyscall arch/x86/Kconfig --- a/arch/x86/Kconfig~kaiser-no-vsyscall 2017-11-08 10:45:39.157681370 -0800 +++ b/arch/x86/Kconfig 2017-11-08 10:45:39.162681370 -0800 @@ -2231,6 +2231,9 @@ choice config LEGACY_VSYSCALL_NATIVE bool "Native" + # The VSYSCALL page comes from the kernel page tables + # and is not available when KAISER is enabled. + depends on ! KAISER help Actual executable code is located in the fixed vsyscall address mapping, implementing time() efficiently. Since @@ -2248,6 +2251,11 @@ choice exploits. This configuration is recommended when userspace still uses the vsyscall area. + When KAISER is enabled, the vsyscall area will become + unreadable. This emulation option still works, but KAISER + will make it harder to do things like trace code using the + emulation. + config LEGACY_VSYSCALL_NONE bool "None" help _