Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Dave Hansen]

On 9/9/26 02:40, Mike Rapoport wrote:
> On Tue, Sep 08, 2026 at 05:15:46PM -0700, Dave Hansen wrote:
...
>> How about we add a kernel_strict_rwx() helper:
>>
>> bool strict_kernel_rwx(void)
>> {
>> 	return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
>> }
>>
>> Have verify_rwx() check *that*.
> 
> Checking only that will bring the warning about ITS pages back :)
> 
> Both CONFIG_STRICT_KERNEL_RWX and rodata_enabled are set before the
> alternatives patching. 
> 
> And rodata_enabled is kinda arm64 specific thingy :)

I think I was confusing rodata_enabled and kernel_set_to_readonly as I
read through things.

But either way, I really don't like the idea of checking some random
state bit. It's generally fragile.

> The check for (!kernel_set_to_readonly) has to stay to actually rule
> out the silly checks at boot and it covers your strict_kernel_rwx() because
> kernel_set_to_readonly is only set when strict_kernel_rwx() will be true.

Could we do something slightly more generic?

mark_readonly() is awfully close to setting SYSTEM_RUNNING:

        mark_readonly();
        pti_finalize();
        system_state = SYSTEM_RUNNING;

What if we (eventually) did something like:

/*
 * Get the kernel page tables ready to run userspace.
 * There should be no page table manipulation between this and
 * settings SYSTEM_RUNNING.
 */
void boot_finalize_page_tables(void)
{
	WARN_ON(system_state >= SYSTEM_RUNNING);

	mark_readonly();

	/*
         * Kernel mappings are now finalized - update
	 * the userspace page-able to finalize PTI.
	 */
	pti_finalize();

	/* Ensure the final kernel mappings have no W+X issues: */
	debug_checkwx();
}

and then verify_rwx() can just check system_state?

>> Also, make the DEBUG_WX functionality mandatory for STRICT_KERNEL_RWX
>> (with appropriate renaming) so that it can be depended upon.  I assume
>> all the distros are turning DEBUG_WX on already (Ubuntu seems to).
> 
> Just checked my Debian config, it does.
>  
>> Maybe just do the strict_kernel_rwx() to start and then circle back
>> around to muck with making DEBUG_WX mandatory?
> 
> I though about making DEBUG_WX mandatory right away, but that's surely not a
> oneliner, so I kept it for later. Maybe should have mentioned in the
> changelog, though.

Yes, please. It would be nice to mention that the fix is a bit exposed
without DEBUG_WX. It could honestly even pr_info_once() about it to make
it less likely it somehow gets forgotten.