On Fri, 2018-09-14 at 13:46 -0700, Dave Hansen wrote:

On 09/14/2018 01:39 PM, Yu-cheng Yu wrote:

quoted

With the updated ptep_set_wrprotect() below, I did MADV_WILLNEED to a shadow
stack of 8 MB, then 10,000 fork()'s, but could not prove it is more or less
efficient than the other.  So can we say this is probably fine in terms of
efficiency?

Well, the first fork() will do all the hard work.  I don't think
subsequent fork()s will be affected.

Are you talking about a recent commit:

    1b2de5d0 mm/cow: don't bother write protecting already write-protected pages

With that, subsequent fork()s will not do all the hard work.
However, I have not done that for shadow stack PTEs (do we want to do that?).
I think the additional benefit for shadow stack is small?

Did you do something to ensure this code was being run?

I would guess that a loop like this:

	for (i = 0; i < 10000; i++) {
		mprotect(addr, len, PROT_READ);
		mprotect(addr, len, PROT_READ|PROT_WRITE);
	}

might show it better.

Would mprotect() do copy_one_pte()?  Otherwise it will not go through
ptep_set_wrprotect()?