Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Mike Rapoport]

On Tue, Sep 08, 2026 at 05:15:46PM -0700, Dave Hansen wrote:
> On 9/8/26 02:27, Mike Rapoport wrote:
> > --- a/arch/x86/mm/pat/set_memory.c
> > +++ b/arch/x86/mm/pat/set_memory.c
> > @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
> >  	if (!(__supported_pte_mask & _PAGE_NX))
> >  		return new;
> >  
> > +	/* skip verification until kernel text is set to read only */
> > +	if (!kernel_set_to_readonly)
> > +		return new;
> 
> If someone sets up a W+X mapping, such a mapping could persist until
> after boot and this would suppress the warning. Right?
> 
> Sure, you can _get_ checking with debug_checkwx(). But that's a debug
> option and it's kinda weird to shift the burden from an always-on thing
> like verify_rwx() to a literal debug option.
> 
> That said, I think you're completely on target for thinking that it's
> silly for verify_rwx() to even *try* to spew warnings in boot.
> 
> How about we add a kernel_strict_rwx() helper:
> 
> bool strict_kernel_rwx(void)
> {
> 	return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
> }
>
> Have verify_rwx() check *that*.

Checking only that will bring the warning about ITS pages back :)

Both CONFIG_STRICT_KERNEL_RWX and rodata_enabled are set before the
alternatives patching. 

And rodata_enabled is kinda arm64 specific thingy :)

The check for (!kernel_set_to_readonly) has to stay to actually rule
out the silly checks at boot and it covers your strict_kernel_rwx() because
kernel_set_to_readonly is only set when strict_kernel_rwx() will be true.

> Also, make the DEBUG_WX functionality mandatory for STRICT_KERNEL_RWX
> (with appropriate renaming) so that it can be depended upon.  I assume
> all the distros are turning DEBUG_WX on already (Ubuntu seems to).

Just checked my Debian config, it does.
 
> Maybe just do the strict_kernel_rwx() to start and then circle back
> around to muck with making DEBUG_WX mandatory?

I though about making DEBUG_WX mandatory right away, but that's surely not a
oneliner, so I kept it for later. Maybe should have mentioned in the
changelog, though.

-- 
Sincerely yours,
Mike.