On 12/10/2020 9:41 AM, Borislav Petkov wrote:
On Tue, Dec 08, 2020 at 11:24:16AM -0800, Yu, Yu-cheng wrote:
Case (a) is a normal writable data page that has gone through fork(). So it
Writable >
has W=0, D=1. But here, the software chooses not to use the D bit, and
But it has W=0. So not writable?
Maybe I will change to: A page in a writable vma, has been modified and
gone through fork().
instead, W=0, COW=1.
So the "new" way of denoting that the page is modified is COW=1
*when* on CET hw. The D=1 bit is still used on the rest thus the two
_PAGE_DIRTY_BITS.
Am I close?
COW=1 is only used in copy-on-write situation (when CET is enabled). If
W=1, D bit is used.
Case (b) is a normal read-only data page. Since it is read-only, fork()
won't affect it. In __get_user_pages(), a copy of the read-only page is
needed, and the page is duplicated. The software sets COW=1 for the new
copy.
That makes more sense.
Thread-A is writing to a writable page, and the page's PTE is becoming W=1,
D=1. In the middle of it, Thread-B is changing the PTE to W=0.
Yah, add that to the explanation pls.
Sure.
