On Thu, Mar 17, 2022 at 02:12:02PM +0000, Tong Tiangen wrote: > @@ -628,6 +647,25 @@ static inline unsigned long pmd_page_vaddr(pmd_t pmd) > #define pud_leaf(pud) pud_sect(pud) > #define pud_valid(pud) pte_valid(pud_pte(pud)) > > +#ifdef CONFIG_PAGE_TABLE_CHECK > +static inline bool pte_user_accessible_page(pte_t pte) > +{ > + return (pte_val(pte) & PTE_VALID) && (pte_val(pte) & PTE_USER); > +} There is another class of user mappings, execute-only, that have both PTE_USER and PTE_UXN cleared. So this logic should be: pte_valid(pte) && (pte_user(pte) || pte_user_exec(pte)) with pte_user() as: #define pte_user(pte) (!!(pte_val(pte) & PTE_USER)) Do we care about PROT_NONE mappings here? They have the valid bit cleared but pte_present() is true. > +static inline bool pmd_user_accessible_page(pmd_t pmd) > +{ > + return pmd_leaf(pmd) && (pmd_val(pmd) & PTE_VALID) && > + (pmd_val(pmd) & PTE_USER); > +} pmd_leaf() implies valid, so you can skip it if that's the aim. Similar comment to the pte variant on execute-only and PROT_NONE mappings. -- Catalin