On Wed, 2018-07-11 at 11:10 +0200, Peter Zijlstra wrote:

On Tue, Jul 10, 2018 at 03:26:26PM -0700, Yu-cheng Yu wrote:

quoted

diff --git a/mm/memory.c b/mm/memory.c
index a2695dbc0418..f7c46d61eaea 100644
--- a/mm/memory.c
+++ b/mm/memory.c

@@ -4108,7 +4108,13 @@ static int __handle_mm_fault(struct

vm_area_struct *vma, unsigned long address,
 			if (pmd_protnone(orig_pmd) &&
vma_is_accessible(vma))
 				return do_huge_pmd_numa_page(&vmf,
orig_pmd);
 
-			if (dirty && !pmd_write(orig_pmd)) {
+			/*
+			 * Shadow stack trans huge PMDs are copy-
on-access,
+			 * so wp_huge_pmd() on them no mater if we
have a
+			 * write fault or not.
+			 */
+			if (is_shstk_mapping(vma->vm_flags) ||
+			    (dirty && !pmd_write(orig_pmd))) {
 				ret = wp_huge_pmd(&vmf, orig_pmd);
 				if (!(ret & VM_FAULT_FALLBACK))
 					return ret;

Can't we do this (and the do_wp_page thing) by setting
FAULT_FLAG_WRITE
in the arch fault handler on shadow stack faults?

This can work.  I don't know if that will create other issues.
Let me think about that.

Yu-cheng