Re: [PATCH 5/9] x86/mm/pat: don't warn about W^X violations before mark_rodata_ro()

[Salvatore Bonaccorso <carnil@debian.org>]

Hi Mike,

On Sun, Nov 15, 2026 at 08:25:13AM +0200, Mike Rapoport wrote:
> Hi Salvatore,
> 
> On Thu, Nov 12, 2026 at 10:46:03PM +0100, Salvatore Bonaccorso wrote:
> > Hi Mike,
> > 
> > On Thu, Nov 12, 2026 at 06:31:10PM +0200, Mike Rapoport (Microsoft) wrote:
> > > The kernel text is mapped RWX until mark_rodata_ro(), so W^X violations
> > > that verify_rwx() detects before that can be false positives.
> > > 
> > > CHECK_WX is enabled by default with STRICT_KERNEL_RWX and it reports
> > > mappings that remain W+X after mark_rodata_ro().
> > > 
> > > Drop the warning about W^X violations before mark_rodata_ro().
> > > 
> > > Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
> > > ---
> > >  arch/x86/mm/pat/set_memory.c | 18 ++++++------------
> > >  1 file changed, 6 insertions(+), 12 deletions(-)
> > > 
> > > diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> > > index a1bea16a3c3bb..a674433850dc9 100644
> > > --- a/arch/x86/mm/pat/set_memory.c
> > > +++ b/arch/x86/mm/pat/set_memory.c
> > > @@ -718,21 +718,15 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
> > >  	if (!rw || nx)
> > >  		return new;
> > >  
> > > -	end = start + npg * PAGE_SIZE - 1;
> > > -
> > >  	/*
> > > -	 * If the kernel text is still RWX, gently complain, this could be a
> > > -	 * false positive.
> > > -	 * Once debug_checkwx() becomes mandatory for CONFIG_STRICT_KERNEL_RWX,
> > > -	 * the warning can be removed completely.
> > > +	 * The kernel text is RWX until mark_rodata_ro() and the entire kernel
> > > +	 * page table is verified after the text is protected, so there is no
> > > +	 * need to warn.
> > >  	 */
> > > -	if (!kernel_set_to_readonly) {
> > > -		pr_warn_once("CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
> > > -		  (unsigned long long)pgprot_val(old),
> > > -		  (unsigned long long)pgprot_val(new),
> > > -		  start, end, pfn);
> > > +	if (!kernel_set_to_readonly)
> > >  		return new;
> > > -	}
> > > +
> > > +	end = start + npg * PAGE_SIZE - 1;
> > >  
> > >  	WARN_ONCE(1, "CPA detected W^X violation: %016llx -> %016llx range: 0x%016lx - 0x%016lx PFN %lx\n",
> > >  		  (unsigned long long)pgprot_val(old),
> > > 
> > > -- 
> > > 2.53.0
> > 
> > Does this need to carry a 
> > 
> > Fixes: ea6fd393cb9e ("x86/mm/pat: Use pr_warn() for early W^X warnings")
> 
> No, that commit actually relaxes how W^X violations are reported during
> early boot.
> 
> And this patch removes the warning only because there is an earlier commit
> that forces the check of W^X consistency that was optional previously.

yes, please take my apologies for the noise here (you have already
probably quite too much).

Regards,
Salvatore