* Andrei Vagin:

quoted

diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index fd2ee9408e91..8eb3bcf2cedf 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c

@@ -174,6 +174,12 @@ bool emulate_vsyscall(unsigned long error_code,

        tsk = current;

+       if (tsk->mm->context.vsyscall_disabled) {
+               warn_bad_vsyscall(KERN_WARNING, regs,
+                                 "vsyscall after lockout (exploit attempt?)");

I don't think that we need this warning message. If we disable
vsyscall, its address range is not differ from other addresses around
and has to be handled the same way. For example, gVisor or any other
sandbox engines may want to emulate vsyscall, but the kernel log will
be full of such messages.

But with vsyscall=none, such messages are already printed.  That's why I
added the warning for the lockout case as well.

quoted

diff --git a/tools/testing/selftests/x86/vsyscall_control.c b/tools/testing/selftests/x86/vsyscall_control.c
new file mode 100644
index 000000000000..ee966f936c89
--- /dev/null
+++ b/tools/testing/selftests/x86/vsyscall_control.c

I would move the test in a separate patch...

I can do that if it simplifies matters.

Thanks,
Florian