On 6/20/25 06:53, Kirill A. Shutemov wrote: > +bool emulate_vsyscall_pf(unsigned long error_code, struct pt_regs *regs, > + unsigned long address) > +{ > + /* Write faults or kernel-privilege faults never get fixed up. */ > + if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER) > + return false; > + > + if (!(error_code & X86_PF_INSTR)) { > + /* Failed vsyscall read */ > + if (vsyscall_mode == EMULATE) > + return false; > + > + /* > + * User code tried and failed to read the vsyscall page. > + */ > + warn_bad_vsyscall(KERN_INFO, regs, > + "vsyscall read attempt denied -- look up the vsyscall kernel parameter if you need a workaround"); > + return false; > + } > + > + return __emulate_vsyscall(regs, address); > +} For this patch that just moves the code: Acked-by: Dave Hansen <dave.hansen@xxxxxxxxxxxxxxx> But, the resulting code is wonky. It needs to do something more like this: if ((error_code & (X86_PF_WRITE | X86_PF_USER)) != X86_PF_USER) return false; if (error_code & X86_PF_INSTR)) return __emulate_vsyscall(regs, address); /* Failed vsyscall read */ if (vsyscall_mode == EMULATE) return false; /* * User code tried and failed to read the vsyscall page. */ warn_bad_vsyscall(KERN_INFO, regs, ... return false; That's much more linear to read.