On Tue, Nov 15, 2022 at 08:03:06PM +0000, Edgecombe, Rick P wrote: > That's right. I think the assumption that needs to be broken in the > readers head is that you can satisfy a read fault with read-only PTE. > This is kind of baked in all over the place with the zero-pfn, COW, > etc. Maybe I should try to start with that. Maybe something like: CoW -- pte_wrprotect() -- changes a SS page 'Write=0,Dirty=1' to 'Write=0,Dirty=0,CoW=1' which is a 'regular' RO page. A SS read from RET will #PF because it expects a SS page. Make sure to break the CoW so it can be restored to an SS page, as such force the write path and tickle pte_mkwrite().