On 2/4/21 12:19 PM, Kees Cook wrote: >> (e) A page where the processor observed a Write=1 PTE, started a write, set >> Dirty=1, but then observed a Write=0 PTE. That's possible today, but >> will not happen on processors that support shadow stack. > What happens for "e" with/without CET? It sounds like direct writes to > such pages will be (correctly) rejected by the MMU? A page fault would be generated regardless of CET support. If CET were not around, the fault would be reported as a present, write fault. If this happened and CET were around (which shouldn't happen in practice, it means we have a hardware issue) a page fault exception is generated. Yu-cheng, I'm not sure there's enough debugging around to tell us if this happens. Would we even notice?