On Tue, Sep 15, 2026 at 5:26 PM Tina Zhang <[email protected]> wrote: > > > > On 9/15/2026 2:23 AM, Jim Mattson wrote: > > What if __linearize() fails? > > This was also my concern with using __linearize() in v5, which is why I > initially calculated the address directly. I wasn't sure how to handle > its failures when we only need the address for EXITINFO1. > > Simply propagating the error seems questionable, since em_invlpg() > itself skips the invalidation on failure and returns X86EMUL_CONTINUE. > > Would either of these approaches make sense? > Option 1: Factor the address calculation out into a helper shared by > __linearize() and get_invlpg_linear_addr(), leaving the checks in > __linearize(). > > Option 2: Extend the existing flags argument to __linearize() with an > option to calculate the address without performing access checks. > > Both would avoid duplicating the address calculation or modifying > ctxt->exception just to obtain the address for EXITINFO1. > > Do you have a preference, or another approach in mind?
I think a comment should suffice. EXITINFO1 should be the address that INVLPG would have used if it hadn't been intercepted, and the address that INVLPG would have used is exactly what __linearize() computes--even on the 'bad:' path. I know it looks like I asked the exception-return question as a "test," but I actually just realized the additional benefit of my suggestion to use __linearize() here rather than open-coding an alternative: em_invlpg() makes an identical call, so the two must agree. The APM, as usual, doesn't really cover the details of the corner cases, but on the Intel side, the SDM says this about the exit qualification field for INVLPG intercepts: If the INVLPG source operand specifies an unusable segment, the linear address specified in the exit qualification will match the linear address that the INVLPG would have used if no VM exit occurred. This address is not architecturally defined and may be implementation-specific. That's just one of the scenarios that leads to the __linearize() 'bad:' path, but I think the same logic must apply to the other cases.
