[RFC PATCH 1/2] x86/vsyscall: Avoid vsyscall emulation when X86_PF_INSTR is not set

From: Sohil Mehta

Date: Fri Mar 13 2026 - 15:26:00 EST


On systems that support X86_FEATURE_NX, X86_PF_INSTR is expected to be
set in the PFEC when a #PF is triggered due to an instruction fetch on a
vsyscall page.

Commit 8ba38a7a9a69 ("x86/vsyscall: Do not require X86_PF_INSTR to
emulate vsyscall") changed the requirement for X86_PF_INSTR to be set
because X86_FEATURE_NX may not be available on some platforms. Vsyscall
emulation now relies on the fact that, in the case of a #PF due to an
instruction fetch, the RIP will always match the vsyscall fault address
reported via CR2.

The kernel still issues a warning if X86_PF_INSTR is not set when
X86_FEATURE_NX is enabled. However, this warning is almost impossible to
trigger unless something is very wrong. Instead of continuing, avoid
vsyscall emulation in this extremely unlikely situation.

Suggested-by: H. Peter Anvin (Intel) <hpa@xxxxxxxxx>
Signed-off-by: Sohil Mehta <sohil.mehta@xxxxxxxxx>
---
arch/x86/entry/vsyscall/vsyscall_64.c | 5 +++--
1 file changed, 3 insertions(+), 2 deletions(-)

diff --git a/arch/x86/entry/vsyscall/vsyscall_64.c b/arch/x86/entry/vsyscall/vsyscall_64.c
index ea36de9fa864..b1f8f8a57b02 100644
--- a/arch/x86/entry/vsyscall/vsyscall_64.c
+++ b/arch/x86/entry/vsyscall/vsyscall_64.c
@@ -282,8 +282,9 @@ bool emulate_vsyscall_pf(unsigned long error_code, struct pt_regs *regs,
* available, use it to double-check that the emulation code
* is only being used for instruction fetches:
*/
- if (cpu_feature_enabled(X86_FEATURE_NX))
- WARN_ON_ONCE(!(error_code & X86_PF_INSTR));
+ if (cpu_feature_enabled(X86_FEATURE_NX) &&
+ WARN_ON_ONCE(!(error_code & X86_PF_INSTR)))
+ return false;

return __emulate_vsyscall(regs, address);
}
--
2.43.0