* [PATCH v2] x86/mm/pat: use pr_warn() for early W^X warnings
@ 2026-09-11 11:28 Mike Rapoport (Microsoft)
2026-09-12 1:23 ` kernel test robot
2026-09-12 1:23 ` kernel test robot
0 siblings, 2 replies; 3+ messages in thread
From: Mike Rapoport (Microsoft) @ 2026-09-11 11:28 UTC (permalink / raw)
To: Dave Hansen
Cc: Andy Lutomirski, Borislav Petkov, Ihor Solodrai, Ingo Molnar,
Mike Rapoport, Nathan Chancellor, H. Peter Anvin, Peter Zijlstra,
Thomas Gleixner, x86, linux-kernel, linux-mm
Nathan Chancellor reports the following warning:
CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xde7/0x1290, CPU#0: swapper/0/0
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1-debug-00006-g453e78594434 #1 PREEMPT(full) 2950d432dd3910251071a66f3134fe0875432786
Hardware name: ASUS System Product Name/PRIME Z590M-PLUS, BIOS 1801 12/26/2022
RIP: 0010:__change_page_attr_set_clr+0xdff/0x1290
Code: 80 7c 24 42 00 0f 85 3a 04 00 00 48 8d 3d 19 8d 79 02 49 89 d9 4c 89 e1 4c 89 d2 4c 89 f6 4d 8d 84 24 ff 0f 00 00 4c 89 14 24 <67> 48 0f b9 3a 4c 8b 14 24 48 8b 0d 81 44 bf 01 41 f6 c2 01
RSP: 0000:ffffffff87003c60 EFLAGS: 00010246
RAX: 0000000000000002 RBX: 0000000000100e00 RCX: ffffffffc0400000
RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff872e50c0
RBP: 8000000100e00123 R08: ffffffffc0400fff R09: 0000000000100e00
R10: 0000000000000123 R11: 0000000000000001 R12: ffffffffc0400000
R13: 0000000100e00123 R14: 8000000000000123 R15: ffffffff87003d58
FS: 0000000000000000(0000) GS:ffff8ad1777a7000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8ad0a4201000 CR3: 00000007e3022001 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
? _vm_unmap_aliases+0x219/0x280
change_page_attr_set_clr+0x161/0x250
? events_sysfs_show+0x5d/0x80
set_memory_x+0x39/0x50
apply_retpolines+0x656/0x6d0
? events_sysfs_show+0x5d/0x80
? events_sysfs_show+0x6c/0x80
? events_sysfs_show+0x62/0x80
alternative_instructions+0x3c/0xd0
arch_cpu_finalize_init+0x130/0x190
start_kernel+0x97d/0xa10
x86_64_start_reservations+0x24/0x30
x86_64_start_kernel+0xda/0xe0
common_startup_64+0x13e/0x151
</TASK>
---[ end trace 0000000000000000 ]---
The warning appears because commit 038176c21617f ("x86/mm/pat: fix
effective RW computation in lookup_address_in_pgd_attr()") fixed the
effective RW checked by verify_rwx() and it exposed that pages used for ITS
trampolines temporarily have RWX permissions.
The permissions are updated in its_fini_core() after all the ITS
trampolines are generated, but since verify_rwx() detects invalid
transitions, it warns when its_alloc() makes RW memory executable.
At the time of alternatives patching the entire kernel text is mapped
RWX, so the warning is bogus anyway.
Since the verification of the entire page table with debug_checkwx() has to
be enabled explicitly in the kernel configuration, retain the warning even
if it's bogus, but make it scream less loudly: use pr_warn_once() rather
than WARN_ONCE().
The warning can be removed once debug_checkwx() becomes unconditional for
configurations with CONFIG_STRICT_KERNEL_RWX set.
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>
---
Changes in v2:
- Use pr_warn_once() for early violations instad if skipping them
entirely
Link to v1: https://lore.kernel.org/all/20260908092730.4002628-1-rppt@kernel.org/
---
arch/x86/mm/pat/set_memory.c | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index b3060000da8d1..a4f7fe69e6922 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -697,6 +697,21 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
return new;
end = start + npg * PAGE_SIZE - 1;
+
+ /*
+ * If the kernel text is still RWX, gently complain, this could be a
+ * false positive.
+ * Once debug_checkwx() becomes mandatory for CONFIG_STRICT_KERNEL_RWX,
+ * the warning can be removed completely.
+ */
+ if (!kernel_set_to_readonly) {
+ pr_warn_once(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
+ (unsigned long long)pgprot_val(old),
+ (unsigned long long)pgprot_val(new),
+ start, end, pfn);
+ return new;
+ }
+
WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
(unsigned long long)pgprot_val(old),
(unsigned long long)pgprot_val(new),
---
base-commit: ebaf7c9bbb1e16523d7036e7e1225ad2dfcc6482
change-id: 20260910-fixes-verify-rwx-044841b76a38
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] x86/mm/pat: use pr_warn() for early W^X warnings
2026-09-11 11:28 [PATCH v2] x86/mm/pat: use pr_warn() for early W^X warnings Mike Rapoport (Microsoft)
@ 2026-09-12 1:23 ` kernel test robot
2026-09-12 1:23 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-09-12 1:23 UTC (permalink / raw)
To: Mike Rapoport (Microsoft), Dave Hansen
Cc: llvm, oe-kbuild-all, Andy Lutomirski, Borislav Petkov,
Ihor Solodrai, Ingo Molnar, Mike Rapoport, Nathan Chancellor,
H. Peter Anvin, Peter Zijlstra, Thomas Gleixner, x86,
linux-kernel, linux-mm
Hi Mike,
kernel test robot noticed the following build errors:
[auto build test ERROR on ebaf7c9bbb1e16523d7036e7e1225ad2dfcc6482]
url: https://github.com/intel-lab-lkp/linux/commits/Mike-Rapoport-Microsoft/x86-mm-pat-use-pr_warn-for-early-W-X-warnings/20260911-142843
base: ebaf7c9bbb1e16523d7036e7e1225ad2dfcc6482
patch link: https://lore.kernel.org/r/20260911-fixes-verify-rwx-v2-1-e2cde39b6693%40kernel.org
patch subject: [PATCH v2] x86/mm/pat: use pr_warn() for early W^X warnings
config: x86_64-allnoconfig (https://download.01.org/0day-ci/archive/20260912/202609120952.vcYnJp5p-lkp@intel.com/config)
compiler: clang version 22.1.3 (https://github.com/llvm/llvm-project e9846648fd6183ee6d8cbdb4502213fcf902a211)
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260912/202609120952.vcYnJp5p-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609120952.vcYnJp5p-lkp@intel.com/
All errors (new ones prefixed by >>):
>> arch/x86/mm/pat/set_memory.c:708:16: error: expected ')'
708 | pr_warn_once(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
| ^
arch/x86/mm/pat/set_memory.c:708:3: note: to match this '('
708 | pr_warn_once(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
| ^
include/linux/printk.h:669:2: note: expanded from macro 'pr_warn_once'
669 | printk_once(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
| ^
include/linux/printk.h:650:15: note: expanded from macro 'printk_once'
650 | DO_ONCE_LITE(printk, fmt, ##__VA_ARGS__)
| ^
1 error generated.
vim +708 arch/x86/mm/pat/set_memory.c
667
668 /*
669 * Validate strict W^X semantics.
670 */
671 static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long start,
672 unsigned long pfn, unsigned long npg,
673 bool nx, bool rw)
674 {
675 unsigned long end;
676
677 /*
678 * 32-bit has some unfixable W+X issues, like EFI code
679 * and writeable data being in the same page. Disable
680 * detection and enforcement there.
681 */
682 if (IS_ENABLED(CONFIG_X86_32))
683 return new;
684
685 /* Only verify when NX is supported: */
686 if (!(__supported_pte_mask & _PAGE_NX))
687 return new;
688
689 if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
690 return new;
691
692 if ((pgprot_val(new) & (_PAGE_RW | _PAGE_NX)) != _PAGE_RW)
693 return new;
694
695 /* Non-leaf translation entries can disable writing or execution. */
696 if (!rw || nx)
697 return new;
698
699 end = start + npg * PAGE_SIZE - 1;
700
701 /*
702 * If the kernel text is still RWX, gently complain, this could be a
703 * false positive.
704 * Once debug_checkwx() becomes mandatory for CONFIG_STRICT_KERNEL_RWX,
705 * the warning can be removed completely.
706 */
707 if (!kernel_set_to_readonly) {
> 708 pr_warn_once(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
709 (unsigned long long)pgprot_val(old),
710 (unsigned long long)pgprot_val(new),
711 start, end, pfn);
712 return new;
713 }
714
715 WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
716 (unsigned long long)pgprot_val(old),
717 (unsigned long long)pgprot_val(new),
718 start, end, pfn);
719
720 /*
721 * For now, allow all permission change attempts by returning the
722 * attempted permissions. This can 'return old' to actively
723 * refuse the permission change at a later time.
724 */
725 return new;
726 }
727
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH v2] x86/mm/pat: use pr_warn() for early W^X warnings
2026-09-11 11:28 [PATCH v2] x86/mm/pat: use pr_warn() for early W^X warnings Mike Rapoport (Microsoft)
2026-09-12 1:23 ` kernel test robot
@ 2026-09-12 1:23 ` kernel test robot
1 sibling, 0 replies; 3+ messages in thread
From: kernel test robot @ 2026-09-12 1:23 UTC (permalink / raw)
To: Mike Rapoport (Microsoft), Dave Hansen
Cc: oe-kbuild-all, Andy Lutomirski, Borislav Petkov, Ihor Solodrai,
Ingo Molnar, Mike Rapoport, Nathan Chancellor, H. Peter Anvin,
Peter Zijlstra, Thomas Gleixner, x86, linux-kernel, linux-mm
Hi Mike,
kernel test robot noticed the following build errors:
[auto build test ERROR on ebaf7c9bbb1e16523d7036e7e1225ad2dfcc6482]
url: https://github.com/intel-lab-lkp/linux/commits/Mike-Rapoport-Microsoft/x86-mm-pat-use-pr_warn-for-early-W-X-warnings/20260911-142843
base: ebaf7c9bbb1e16523d7036e7e1225ad2dfcc6482
patch link: https://lore.kernel.org/r/20260911-fixes-verify-rwx-v2-1-e2cde39b6693%40kernel.org
patch subject: [PATCH v2] x86/mm/pat: use pr_warn() for early W^X warnings
config: i386-allnoconfig (https://download.01.org/0day-ci/archive/20260912/202609120931.Bo3Gyiqu-lkp@intel.com/config)
compiler: gcc-14 (Debian 14.2.0-19) 14.2.0
reproduce (this is a W=1 build): (https://download.01.org/0day-ci/archive/20260912/202609120931.Bo3Gyiqu-lkp@intel.com/reproduce)
If you fix the issue in a separate patch/commit (i.e. not just a new version of
the same patch/commit), kindly add following tags
| Reported-by: kernel test robot <lkp@intel.com>
| Closes: https://lore.kernel.org/oe-kbuild-all/202609120931.Bo3Gyiqu-lkp@intel.com/
All errors (new ones prefixed by >>):
In file included from include/asm-generic/bug.h:31,
from arch/x86/include/asm/bug.h:195,
from arch/x86/include/asm/alternative.h:9,
from arch/x86/include/asm/barrier.h:5,
from include/asm-generic/bitops/generic-non-atomic.h:7,
from include/linux/bitops.h:28,
from include/linux/log2.h:12,
from arch/x86/include/asm/div64.h:8,
from include/linux/math.h:6,
from include/linux/math64.h:6,
from include/linux/time.h:6,
from include/linux/stat.h:19,
from include/linux/fs_dirent.h:5,
from include/linux/fs/super_types.h:5,
from include/linux/fs/super.h:5,
from include/linux/fs.h:5,
from include/linux/highmem.h:5,
from arch/x86/mm/pat/set_memory.c:6:
arch/x86/mm/pat/set_memory.c: In function 'verify_rwx':
>> arch/x86/mm/pat/set_memory.c:708:30: error: expected ')' before numeric constant
708 | pr_warn_once(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
| ^
include/linux/printk.h:483:25: note: in definition of macro 'printk_index_wrap'
483 | _p_func(_fmt, ##__VA_ARGS__); \
| ^~~~
include/linux/once_lite.h:31:25: note: in expansion of macro 'printk'
31 | func(__VA_ARGS__); \
| ^~~~
include/linux/once_lite.h:11:9: note: in expansion of macro 'DO_ONCE_LITE_IF'
11 | DO_ONCE_LITE_IF(true, func, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~
include/linux/printk.h:650:9: note: in expansion of macro 'DO_ONCE_LITE'
650 | DO_ONCE_LITE(printk, fmt, ##__VA_ARGS__)
| ^~~~~~~~~~~~
include/linux/printk.h:669:9: note: in expansion of macro 'printk_once'
669 | printk_once(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
include/linux/printk.h:669:34: note: in expansion of macro 'pr_fmt'
669 | printk_once(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~
arch/x86/mm/pat/set_memory.c:708:17: note: in expansion of macro 'pr_warn_once'
708 | pr_warn_once(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
| ^~~~~~~~~~~~
include/linux/printk.h:483:24: note: to match this '('
483 | _p_func(_fmt, ##__VA_ARGS__); \
| ^
include/linux/printk.h:511:26: note: in expansion of macro 'printk_index_wrap'
511 | #define printk(fmt, ...) printk_index_wrap(_printk, fmt, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~~~
include/linux/once_lite.h:31:25: note: in expansion of macro 'printk'
31 | func(__VA_ARGS__); \
| ^~~~
include/linux/once_lite.h:11:9: note: in expansion of macro 'DO_ONCE_LITE_IF'
11 | DO_ONCE_LITE_IF(true, func, ##__VA_ARGS__)
| ^~~~~~~~~~~~~~~
include/linux/printk.h:650:9: note: in expansion of macro 'DO_ONCE_LITE'
650 | DO_ONCE_LITE(printk, fmt, ##__VA_ARGS__)
| ^~~~~~~~~~~~
include/linux/printk.h:669:9: note: in expansion of macro 'printk_once'
669 | printk_once(KERN_WARNING pr_fmt(fmt), ##__VA_ARGS__)
| ^~~~~~~~~~~
arch/x86/mm/pat/set_memory.c:708:17: note: in expansion of macro 'pr_warn_once'
708 | pr_warn_once(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
| ^~~~~~~~~~~~
vim +708 arch/x86/mm/pat/set_memory.c
667
668 /*
669 * Validate strict W^X semantics.
670 */
671 static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long start,
672 unsigned long pfn, unsigned long npg,
673 bool nx, bool rw)
674 {
675 unsigned long end;
676
677 /*
678 * 32-bit has some unfixable W+X issues, like EFI code
679 * and writeable data being in the same page. Disable
680 * detection and enforcement there.
681 */
682 if (IS_ENABLED(CONFIG_X86_32))
683 return new;
684
685 /* Only verify when NX is supported: */
686 if (!(__supported_pte_mask & _PAGE_NX))
687 return new;
688
689 if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
690 return new;
691
692 if ((pgprot_val(new) & (_PAGE_RW | _PAGE_NX)) != _PAGE_RW)
693 return new;
694
695 /* Non-leaf translation entries can disable writing or execution. */
696 if (!rw || nx)
697 return new;
698
699 end = start + npg * PAGE_SIZE - 1;
700
701 /*
702 * If the kernel text is still RWX, gently complain, this could be a
703 * false positive.
704 * Once debug_checkwx() becomes mandatory for CONFIG_STRICT_KERNEL_RWX,
705 * the warning can be removed completely.
706 */
707 if (!kernel_set_to_readonly) {
> 708 pr_warn_once(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
709 (unsigned long long)pgprot_val(old),
710 (unsigned long long)pgprot_val(new),
711 start, end, pfn);
712 return new;
713 }
714
715 WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
716 (unsigned long long)pgprot_val(old),
717 (unsigned long long)pgprot_val(new),
718 start, end, pfn);
719
720 /*
721 * For now, allow all permission change attempts by returning the
722 * attempted permissions. This can 'return old' to actively
723 * refuse the permission change at a later time.
724 */
725 return new;
726 }
727
--
0-DAY CI Kernel Test Service
https://github.com/intel/lkp-tests/wiki
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2026-09-12 1:25 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-11 11:28 [PATCH v2] x86/mm/pat: use pr_warn() for early W^X warnings Mike Rapoport (Microsoft)
2026-09-12 1:23 ` kernel test robot
2026-09-12 1:23 ` kernel test robot
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®