* [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only
@ 2026-09-08 9:27 Mike Rapoport
2026-09-08 23:33 ` Nathan Chancellor
` (2 more replies)
0 siblings, 3 replies; 7+ messages in thread
From: Mike Rapoport @ 2026-09-08 9:27 UTC (permalink / raw)
To: Dave Hansen
Cc: Andy Lutomirski, Borislav Petkov, Ingo Molnar, Mike Rapoport,
Nathan Chancellor, H. Peter Anvin, Peter Zijlstra,
Thomas Gleixner, linux-kernel, x86
From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
Nathan Chancellor reports the following warning:
CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xde7/0x1290, CPU#0: swapper/0/0
Modules linked in:
CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1-debug-00006-g453e78594434 #1 PREEMPT(full) 2950d432dd3910251071a66f3134fe0875432786
Hardware name: ASUS System Product Name/PRIME Z590M-PLUS, BIOS 1801 12/26/2022
RIP: 0010:__change_page_attr_set_clr+0xdff/0x1290
Code: 80 7c 24 42 00 0f 85 3a 04 00 00 48 8d 3d 19 8d 79 02 49 89 d9 4c 89 e1 4c 89 d2 4c 89 f6 4d 8d 84 24 ff 0f 00 00 4c 89 14 24 <67> 48 0f b9 3a 4c 8b 14 24 48 8b 0d 81 44 bf 01 41 f6 c2 01
RSP: 0000:ffffffff87003c60 EFLAGS: 00010246
RAX: 0000000000000002 RBX: 0000000000100e00 RCX: ffffffffc0400000
RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff872e50c0
RBP: 8000000100e00123 R08: ffffffffc0400fff R09: 0000000000100e00
R10: 0000000000000123 R11: 0000000000000001 R12: ffffffffc0400000
R13: 0000000100e00123 R14: 8000000000000123 R15: ffffffff87003d58
FS: 0000000000000000(0000) GS:ffff8ad1777a7000(0000) knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
CR2: ffff8ad0a4201000 CR3: 00000007e3022001 CR4: 0000000000770ef0
PKRU: 55555554
Call Trace:
<TASK>
? _vm_unmap_aliases+0x219/0x280
change_page_attr_set_clr+0x161/0x250
? events_sysfs_show+0x5d/0x80
set_memory_x+0x39/0x50
apply_retpolines+0x656/0x6d0
? events_sysfs_show+0x5d/0x80
? events_sysfs_show+0x6c/0x80
? events_sysfs_show+0x62/0x80
alternative_instructions+0x3c/0xd0
arch_cpu_finalize_init+0x130/0x190
start_kernel+0x97d/0xa10
x86_64_start_reservations+0x24/0x30
x86_64_start_kernel+0xda/0xe0
common_startup_64+0x13e/0x151
</TASK>
---[ end trace 0000000000000000 ]---
The warning appears because commit 038176c21617f ("x86/mm/pat: fix
effective RW computation in lookup_address_in_pgd_attr()") fixed the
effective RW checked by verify_rwx() and it exposed that pages used
for ITS trampolines temporarily have RWX permissions.
The permissions are updated in its_fini_core() after all the ITS
trampolines are generated, but since verify_rwx() detects invalid
transitions, it warns when its_alloc() makes RW memory executable.
At the time of alternatives patching the entire kernel text is mapped
RWX, so the warning is bogus anyway.
Skip verification of W^X violations in verify_rwx() when they are
triggered by transitions happening before the kernel text is remapped as
read-only.
Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
arch/x86/mm/pat/set_memory.c | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 226660973d515..2eecb76703bb4 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
if (!(__supported_pte_mask & _PAGE_NX))
return new;
+ /* skip verification until kernel text is set to read only */
+ if (!kernel_set_to_readonly)
+ return new;
+
if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
return new;
base-commit: 038176c21617fcc03ccc1ca43230ffedb712c047
--
2.53.0
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only
2026-09-08 9:27 [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only Mike Rapoport
@ 2026-09-08 23:33 ` Nathan Chancellor
2026-09-09 0:15 ` Dave Hansen
2026-09-09 17:38 ` Ihor Solodrai
2 siblings, 0 replies; 7+ messages in thread
From: Nathan Chancellor @ 2026-09-08 23:33 UTC (permalink / raw)
To: Mike Rapoport
Cc: Dave Hansen, Andy Lutomirski, Borislav Petkov, Ingo Molnar,
H. Peter Anvin, Peter Zijlstra, Thomas Gleixner, linux-kernel,
x86
On Tue, Sep 08, 2026 at 12:27:30PM +0300, Mike Rapoport wrote:
> From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
>
> Nathan Chancellor reports the following warning:
>
> CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
> WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xde7/0x1290, CPU#0: swapper/0/0
> Modules linked in:
> CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1-debug-00006-g453e78594434 #1 PREEMPT(full) 2950d432dd3910251071a66f3134fe0875432786
> Hardware name: ASUS System Product Name/PRIME Z590M-PLUS, BIOS 1801 12/26/2022
> RIP: 0010:__change_page_attr_set_clr+0xdff/0x1290
> Code: 80 7c 24 42 00 0f 85 3a 04 00 00 48 8d 3d 19 8d 79 02 49 89 d9 4c 89 e1 4c 89 d2 4c 89 f6 4d 8d 84 24 ff 0f 00 00 4c 89 14 24 <67> 48 0f b9 3a 4c 8b 14 24 48 8b 0d 81 44 bf 01 41 f6 c2 01
> RSP: 0000:ffffffff87003c60 EFLAGS: 00010246
> RAX: 0000000000000002 RBX: 0000000000100e00 RCX: ffffffffc0400000
> RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff872e50c0
> RBP: 8000000100e00123 R08: ffffffffc0400fff R09: 0000000000100e00
> R10: 0000000000000123 R11: 0000000000000001 R12: ffffffffc0400000
> R13: 0000000100e00123 R14: 8000000000000123 R15: ffffffff87003d58
> FS: 0000000000000000(0000) GS:ffff8ad1777a7000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffff8ad0a4201000 CR3: 00000007e3022001 CR4: 0000000000770ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> ? _vm_unmap_aliases+0x219/0x280
> change_page_attr_set_clr+0x161/0x250
> ? events_sysfs_show+0x5d/0x80
> set_memory_x+0x39/0x50
> apply_retpolines+0x656/0x6d0
> ? events_sysfs_show+0x5d/0x80
> ? events_sysfs_show+0x6c/0x80
> ? events_sysfs_show+0x62/0x80
> alternative_instructions+0x3c/0xd0
> arch_cpu_finalize_init+0x130/0x190
> start_kernel+0x97d/0xa10
> x86_64_start_reservations+0x24/0x30
> x86_64_start_kernel+0xda/0xe0
> common_startup_64+0x13e/0x151
> </TASK>
> ---[ end trace 0000000000000000 ]---
>
> The warning appears because commit 038176c21617f ("x86/mm/pat: fix
> effective RW computation in lookup_address_in_pgd_attr()") fixed the
> effective RW checked by verify_rwx() and it exposed that pages used
> for ITS trampolines temporarily have RWX permissions.
>
> The permissions are updated in its_fini_core() after all the ITS
> trampolines are generated, but since verify_rwx() detects invalid
> transitions, it warns when its_alloc() makes RW memory executable.
>
> At the time of alternatives patching the entire kernel text is mapped
> RWX, so the warning is bogus anyway.
>
> Skip verification of W^X violations in verify_rwx() when they are
> triggered by transitions happening before the kernel text is remapped as
> read-only.
>
> Reported-by: Nathan Chancellor <nathan@kernel.org>
> Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
Tested-by: Nathan Chancellor <nathan@kernel.org>
> ---
> arch/x86/mm/pat/set_memory.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> index 226660973d515..2eecb76703bb4 100644
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
> if (!(__supported_pte_mask & _PAGE_NX))
> return new;
>
> + /* skip verification until kernel text is set to read only */
> + if (!kernel_set_to_readonly)
> + return new;
> +
> if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
> return new;
>
>
> base-commit: 038176c21617fcc03ccc1ca43230ffedb712c047
> --
> 2.53.0
>
--
Cheers,
Nathan
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only
2026-09-08 9:27 [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only Mike Rapoport
2026-09-08 23:33 ` Nathan Chancellor
@ 2026-09-09 0:15 ` Dave Hansen
2026-09-09 9:40 ` Mike Rapoport
2026-09-09 17:38 ` Ihor Solodrai
2 siblings, 1 reply; 7+ messages in thread
From: Dave Hansen @ 2026-09-09 0:15 UTC (permalink / raw)
To: Mike Rapoport, Dave Hansen
Cc: Andy Lutomirski, Borislav Petkov, Ingo Molnar, Nathan Chancellor,
H. Peter Anvin, Peter Zijlstra, Thomas Gleixner, linux-kernel,
x86
On 9/8/26 02:27, Mike Rapoport wrote:
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
> if (!(__supported_pte_mask & _PAGE_NX))
> return new;
>
> + /* skip verification until kernel text is set to read only */
> + if (!kernel_set_to_readonly)
> + return new;
If someone sets up a W+X mapping, such a mapping could persist until
after boot and this would suppress the warning. Right?
Sure, you can _get_ checking with debug_checkwx(). But that's a debug
option and it's kinda weird to shift the burden from an always-on thing
like verify_rwx() to a literal debug option.
That said, I think you're completely on target for thinking that it's
silly for verify_rwx() to even *try* to spew warnings in boot.
How about we add a kernel_strict_rwx() helper:
bool strict_kernel_rwx(void)
{
return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
}
Have verify_rwx() check *that*. Also, make the DEBUG_WX functionality
mandatory for STRICT_KERNEL_RWX (with appropriate renaming) so that it
can be depended upon. I assume all the distros are turning DEBUG_WX on
already (Ubuntu seems to).
Maybe just do the strict_kernel_rwx() to start and then circle back
around to muck with making DEBUG_WX mandatory?
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only
2026-09-09 0:15 ` Dave Hansen
@ 2026-09-09 9:40 ` Mike Rapoport
2026-09-09 14:22 ` Dave Hansen
0 siblings, 1 reply; 7+ messages in thread
From: Mike Rapoport @ 2026-09-09 9:40 UTC (permalink / raw)
To: Dave Hansen
Cc: Dave Hansen, Andy Lutomirski, Borislav Petkov, Ingo Molnar,
Nathan Chancellor, H. Peter Anvin, Peter Zijlstra,
Thomas Gleixner, linux-kernel, x86
On Tue, Sep 08, 2026 at 05:15:46PM -0700, Dave Hansen wrote:
> On 9/8/26 02:27, Mike Rapoport wrote:
> > --- a/arch/x86/mm/pat/set_memory.c
> > +++ b/arch/x86/mm/pat/set_memory.c
> > @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
> > if (!(__supported_pte_mask & _PAGE_NX))
> > return new;
> >
> > + /* skip verification until kernel text is set to read only */
> > + if (!kernel_set_to_readonly)
> > + return new;
>
> If someone sets up a W+X mapping, such a mapping could persist until
> after boot and this would suppress the warning. Right?
>
> Sure, you can _get_ checking with debug_checkwx(). But that's a debug
> option and it's kinda weird to shift the burden from an always-on thing
> like verify_rwx() to a literal debug option.
>
> That said, I think you're completely on target for thinking that it's
> silly for verify_rwx() to even *try* to spew warnings in boot.
>
> How about we add a kernel_strict_rwx() helper:
>
> bool strict_kernel_rwx(void)
> {
> return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
> }
>
> Have verify_rwx() check *that*.
Checking only that will bring the warning about ITS pages back :)
Both CONFIG_STRICT_KERNEL_RWX and rodata_enabled are set before the
alternatives patching.
And rodata_enabled is kinda arm64 specific thingy :)
The check for (!kernel_set_to_readonly) has to stay to actually rule
out the silly checks at boot and it covers your strict_kernel_rwx() because
kernel_set_to_readonly is only set when strict_kernel_rwx() will be true.
> Also, make the DEBUG_WX functionality mandatory for STRICT_KERNEL_RWX
> (with appropriate renaming) so that it can be depended upon. I assume
> all the distros are turning DEBUG_WX on already (Ubuntu seems to).
Just checked my Debian config, it does.
> Maybe just do the strict_kernel_rwx() to start and then circle back
> around to muck with making DEBUG_WX mandatory?
I though about making DEBUG_WX mandatory right away, but that's surely not a
oneliner, so I kept it for later. Maybe should have mentioned in the
changelog, though.
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only
2026-09-09 9:40 ` Mike Rapoport
@ 2026-09-09 14:22 ` Dave Hansen
2026-09-09 17:45 ` Mike Rapoport
0 siblings, 1 reply; 7+ messages in thread
From: Dave Hansen @ 2026-09-09 14:22 UTC (permalink / raw)
To: Mike Rapoport
Cc: Dave Hansen, Andy Lutomirski, Borislav Petkov, Ingo Molnar,
Nathan Chancellor, H. Peter Anvin, Peter Zijlstra,
Thomas Gleixner, linux-kernel, x86
On 9/9/26 02:40, Mike Rapoport wrote:
> On Tue, Sep 08, 2026 at 05:15:46PM -0700, Dave Hansen wrote:
...
>> How about we add a kernel_strict_rwx() helper:
>>
>> bool strict_kernel_rwx(void)
>> {
>> return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
>> }
>>
>> Have verify_rwx() check *that*.
>
> Checking only that will bring the warning about ITS pages back :)
>
> Both CONFIG_STRICT_KERNEL_RWX and rodata_enabled are set before the
> alternatives patching.
>
> And rodata_enabled is kinda arm64 specific thingy :)
I think I was confusing rodata_enabled and kernel_set_to_readonly as I
read through things.
But either way, I really don't like the idea of checking some random
state bit. It's generally fragile.
> The check for (!kernel_set_to_readonly) has to stay to actually rule
> out the silly checks at boot and it covers your strict_kernel_rwx() because
> kernel_set_to_readonly is only set when strict_kernel_rwx() will be true.
Could we do something slightly more generic?
mark_readonly() is awfully close to setting SYSTEM_RUNNING:
mark_readonly();
pti_finalize();
system_state = SYSTEM_RUNNING;
What if we (eventually) did something like:
/*
* Get the kernel page tables ready to run userspace.
* There should be no page table manipulation between this and
* settings SYSTEM_RUNNING.
*/
void boot_finalize_page_tables(void)
{
WARN_ON(system_state >= SYSTEM_RUNNING);
mark_readonly();
/*
* Kernel mappings are now finalized - update
* the userspace page-able to finalize PTI.
*/
pti_finalize();
/* Ensure the final kernel mappings have no W+X issues: */
debug_checkwx();
}
and then verify_rwx() can just check system_state?
>> Also, make the DEBUG_WX functionality mandatory for STRICT_KERNEL_RWX
>> (with appropriate renaming) so that it can be depended upon. I assume
>> all the distros are turning DEBUG_WX on already (Ubuntu seems to).
>
> Just checked my Debian config, it does.
>
>> Maybe just do the strict_kernel_rwx() to start and then circle back
>> around to muck with making DEBUG_WX mandatory?
>
> I though about making DEBUG_WX mandatory right away, but that's surely not a
> oneliner, so I kept it for later. Maybe should have mentioned in the
> changelog, though.
Yes, please. It would be nice to mention that the fix is a bit exposed
without DEBUG_WX. It could honestly even pr_info_once() about it to make
it less likely it somehow gets forgotten.
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only
2026-09-08 9:27 [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only Mike Rapoport
2026-09-08 23:33 ` Nathan Chancellor
2026-09-09 0:15 ` Dave Hansen
@ 2026-09-09 17:38 ` Ihor Solodrai
2 siblings, 0 replies; 7+ messages in thread
From: Ihor Solodrai @ 2026-09-09 17:38 UTC (permalink / raw)
To: Mike Rapoport, Dave Hansen
Cc: Andy Lutomirski, Borislav Petkov, Ingo Molnar, Nathan Chancellor,
H. Peter Anvin, Peter Zijlstra, Thomas Gleixner, linux-kernel,
x86, bpf
On 9/8/26 2:27 AM, Mike Rapoport wrote:
> From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
>
> Nathan Chancellor reports the following warning:
>
> CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
> WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xde7/0x1290, CPU#0: swapper/0/0
> Modules linked in:
> CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1-debug-00006-g453e78594434 #1 PREEMPT(full) 2950d432dd3910251071a66f3134fe0875432786
> Hardware name: ASUS System Product Name/PRIME Z590M-PLUS, BIOS 1801 12/26/2022
> RIP: 0010:__change_page_attr_set_clr+0xdff/0x1290
> Code: 80 7c 24 42 00 0f 85 3a 04 00 00 48 8d 3d 19 8d 79 02 49 89 d9 4c 89 e1 4c 89 d2 4c 89 f6 4d 8d 84 24 ff 0f 00 00 4c 89 14 24 <67> 48 0f b9 3a 4c 8b 14 24 48 8b 0d 81 44 bf 01 41 f6 c2 01
> RSP: 0000:ffffffff87003c60 EFLAGS: 00010246
> RAX: 0000000000000002 RBX: 0000000000100e00 RCX: ffffffffc0400000
> RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff872e50c0
> RBP: 8000000100e00123 R08: ffffffffc0400fff R09: 0000000000100e00
> R10: 0000000000000123 R11: 0000000000000001 R12: ffffffffc0400000
> R13: 0000000100e00123 R14: 8000000000000123 R15: ffffffff87003d58
> FS: 0000000000000000(0000) GS:ffff8ad1777a7000(0000) knlGS:0000000000000000
> CS: 0010 DS: 0000 ES: 0000 CR0: 0000000080050033
> CR2: ffff8ad0a4201000 CR3: 00000007e3022001 CR4: 0000000000770ef0
> PKRU: 55555554
> Call Trace:
> <TASK>
> ? _vm_unmap_aliases+0x219/0x280
> change_page_attr_set_clr+0x161/0x250
> ? events_sysfs_show+0x5d/0x80
> set_memory_x+0x39/0x50
> apply_retpolines+0x656/0x6d0
> ? events_sysfs_show+0x5d/0x80
> ? events_sysfs_show+0x6c/0x80
> ? events_sysfs_show+0x62/0x80
> alternative_instructions+0x3c/0xd0
> arch_cpu_finalize_init+0x130/0x190
> start_kernel+0x97d/0xa10
> x86_64_start_reservations+0x24/0x30
> x86_64_start_kernel+0xda/0xe0
> common_startup_64+0x13e/0x151
> </TASK>
> ---[ end trace 0000000000000000 ]---
BPF CI has caught similar splats on linux-next [1].
The patch fixes it [2][3].
Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>
Thanks!
[1] https://github.com/kernel-patches/bpf/actions/runs/33918575854/job/101174705812
[2] https://github.com/kernel-patches/vmtest/pull/523
[3] https://github.com/kernel-patches/bpf/actions/runs/34279792157
>
> The warning appears because commit 038176c21617f ("x86/mm/pat: fix
> effective RW computation in lookup_address_in_pgd_attr()") fixed the
> effective RW checked by verify_rwx() and it exposed that pages used
> for ITS trampolines temporarily have RWX permissions.
>
> The permissions are updated in its_fini_core() after all the ITS
> trampolines are generated, but since verify_rwx() detects invalid
> transitions, it warns when its_alloc() makes RW memory executable.
>
> At the time of alternatives patching the entire kernel text is mapped
> RWX, so the warning is bogus anyway.
>
> Skip verification of W^X violations in verify_rwx() when they are
> triggered by transitions happening before the kernel text is remapped as
> read-only.
>
> Reported-by: Nathan Chancellor <nathan@kernel.org>
> Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
> ---
> arch/x86/mm/pat/set_memory.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> index 226660973d515..2eecb76703bb4 100644
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
> if (!(__supported_pte_mask & _PAGE_NX))
> return new;
>
> + /* skip verification until kernel text is set to read only */
> + if (!kernel_set_to_readonly)
> + return new;
> +
> if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
> return new;
>
>
> base-commit: 038176c21617fcc03ccc1ca43230ffedb712c047
^ permalink raw reply [flat|nested] 7+ messages in thread
* Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only
2026-09-09 14:22 ` Dave Hansen
@ 2026-09-09 17:45 ` Mike Rapoport
0 siblings, 0 replies; 7+ messages in thread
From: Mike Rapoport @ 2026-09-09 17:45 UTC (permalink / raw)
To: Dave Hansen
Cc: Dave Hansen, Andy Lutomirski, Borislav Petkov, Ingo Molnar,
Nathan Chancellor, H. Peter Anvin, Peter Zijlstra,
Thomas Gleixner, linux-kernel, x86
On Wed, Sep 09, 2026 at 07:22:31AM -0700, Dave Hansen wrote:
> On 9/9/26 02:40, Mike Rapoport wrote:
> > On Tue, Sep 08, 2026 at 05:15:46PM -0700, Dave Hansen wrote:
> ...
> >> How about we add a kernel_strict_rwx() helper:
> >>
> >> bool strict_kernel_rwx(void)
> >> {
> >> return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
> >> }
> >>
> >> Have verify_rwx() check *that*.
> >
> > Checking only that will bring the warning about ITS pages back :)
> >
> > Both CONFIG_STRICT_KERNEL_RWX and rodata_enabled are set before the
> > alternatives patching.
> >
> > And rodata_enabled is kinda arm64 specific thingy :)
>
> I think I was confusing rodata_enabled and kernel_set_to_readonly as I
> read through things.
>
> But either way, I really don't like the idea of checking some random
> state bit. It's generally fragile.
>
> > The check for (!kernel_set_to_readonly) has to stay to actually rule
> > out the silly checks at boot and it covers your strict_kernel_rwx() because
> > kernel_set_to_readonly is only set when strict_kernel_rwx() will be true.
>
> Could we do something slightly more generic?
>
> mark_readonly() is awfully close to setting SYSTEM_RUNNING:
>
> mark_readonly();
> pti_finalize();
> system_state = SYSTEM_RUNNING;
We could check SYSTEM_RUNNING, but OTOH using kernel_set_to_readonly is
consistent with the existing checks in protect_rodata() and
protect_kernel_text_ro() in the same file.
I think that it's better to use the consistent kernel_set_to_readonly now
and flipping them all to SYSTEM_RUNNING ...
> What if we (eventually) did something like:
... when something like this materializes.
> /*
> * Get the kernel page tables ready to run userspace.
> * There should be no page table manipulation between this and
> * settings SYSTEM_RUNNING.
> */
> void boot_finalize_page_tables(void)
> {
> WARN_ON(system_state >= SYSTEM_RUNNING);
>
> mark_readonly();
>
> /*
> * Kernel mappings are now finalized - update
> * the userspace page-able to finalize PTI.
> */
> pti_finalize();
>
> /* Ensure the final kernel mappings have no W+X issues: */
> debug_checkwx();
> }
>
> and then verify_rwx() can just check system_state?
and protect_rodata() and protect_kernel_text_ro() :)
> >> Also, make the DEBUG_WX functionality mandatory for STRICT_KERNEL_RWX
> >> (with appropriate renaming) so that it can be depended upon. I assume
> >> all the distros are turning DEBUG_WX on already (Ubuntu seems to).
> >
> > Just checked my Debian config, it does.
> >
> >> Maybe just do the strict_kernel_rwx() to start and then circle back
> >> around to muck with making DEBUG_WX mandatory?
> >
> > I though about making DEBUG_WX mandatory right away, but that's surely not a
> > oneliner, so I kept it for later. Maybe should have mentioned in the
> > changelog, though.
>
> Yes, please. It would be nice to mention that the fix is a bit exposed
> without DEBUG_WX. It could honestly even pr_info_once() about it to make
> it less likely it somehow gets forgotten.
I like the pr_info_once() idea, will add it in v2.
--
Sincerely yours,
Mike.
^ permalink raw reply [flat|nested] 7+ messages in thread
end of thread, other threads:[~2026-09-09 17:45 UTC | newest]
Thread overview: 7+ messages (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2026-09-08 9:27 [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only Mike Rapoport
2026-09-08 23:33 ` Nathan Chancellor
2026-09-09 0:15 ` Dave Hansen
2026-09-09 9:40 ` Mike Rapoport
2026-09-09 14:22 ` Dave Hansen
2026-09-09 17:45 ` Mike Rapoport
2026-09-09 17:38 ` Ihor Solodrai
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®