On Tue, Nov 15, 2022 at 08:03:06PM +0000, Edgecombe, Rick P wrote:

That's right. I think the assumption that needs to be broken in the
readers head is that you can satisfy a read fault with read-only PTE.
This is kind of baked in all over the place with the zero-pfn, COW,
etc. Maybe I should try to start with that.

Maybe something like:

CoW -- pte_wrprotect() -- changes a SS page 'Write=0,Dirty=1' to
'Write=0,Dirty=0,CoW=1' which is a 'regular' RO page. A SS read from RET
will #PF because it expects a SS page. Make sure to break the CoW so it
can be restored to an SS page, as such force the write path and tickle
pte_mkwrite().