On Mon, Aug 3, 2026 at 5:18 PM David Hildenbrand (Arm) <[email protected]> wrote: > >>> Handling this in fixup_user_fault() is problematic: the information > >>> about the presence of *_mkwrite is only recorded in vma->vm_page_prot, > >>> which is an opaque pgprot_t, therefore only follow_pfnmap_start() > >>> knows how to retrieve it. > >> > >> How is mprotect() supposed to work in that case? > > > I was wondering about the following: > > mprotect(PROT_READ) > > followed by > > mprotect(PROT_READ | PROT_WRITE) > > You'd similarly end up without the writable bit in the PTE, and apparently > there is not really a way > to recover from this.
Why not? mprotect_fixup() calls vma_set_page_prot(), the PTE as you say lacks the writable bit (unless pte_dirty(pte)), and then the next fault calls .pfn_mkwrite(). Paolo
