[PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Mike Rapoport]

From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>

Nathan Chancellor reports the following warning:

  CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
  WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xde7/0x1290, CPU#0: swapper/0/0
  Modules linked in:
  CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1-debug-00006-g453e78594434 #1 PREEMPT(full)  2950d432dd3910251071a66f3134fe0875432786
  Hardware name: ASUS System Product Name/PRIME Z590M-PLUS, BIOS 1801 12/26/2022
  RIP: 0010:__change_page_attr_set_clr+0xdff/0x1290
  Code: 80 7c 24 42 00 0f 85 3a 04 00 00 48 8d 3d 19 8d 79 02 49 89 d9 4c 89 e1 4c 89 d2 4c 89 f6 4d 8d 84 24 ff 0f 00 00 4c 89 14 24 <67> 48 0f b9 3a 4c 8b 14 24 48 8b 0d 81 44 bf 01 41 f6 c2 01
  RSP: 0000:ffffffff87003c60 EFLAGS: 00010246
  RAX: 0000000000000002 RBX: 0000000000100e00 RCX: ffffffffc0400000
  RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff872e50c0
  RBP: 8000000100e00123 R08: ffffffffc0400fff R09: 0000000000100e00
  R10: 0000000000000123 R11: 0000000000000001 R12: ffffffffc0400000
  R13: 0000000100e00123 R14: 8000000000000123 R15: ffffffff87003d58
  FS:  0000000000000000(0000) GS:ffff8ad1777a7000(0000) knlGS:0000000000000000
  CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
  CR2: ffff8ad0a4201000 CR3: 00000007e3022001 CR4: 0000000000770ef0
  PKRU: 55555554
  Call Trace:
   <TASK>
   ? _vm_unmap_aliases+0x219/0x280
   change_page_attr_set_clr+0x161/0x250
   ? events_sysfs_show+0x5d/0x80
   set_memory_x+0x39/0x50
   apply_retpolines+0x656/0x6d0
   ? events_sysfs_show+0x5d/0x80
   ? events_sysfs_show+0x6c/0x80
   ? events_sysfs_show+0x62/0x80
   alternative_instructions+0x3c/0xd0
   arch_cpu_finalize_init+0x130/0x190
   start_kernel+0x97d/0xa10
   x86_64_start_reservations+0x24/0x30
   x86_64_start_kernel+0xda/0xe0
   common_startup_64+0x13e/0x151
   </TASK>
  ---[ end trace 0000000000000000 ]---

The warning appears because commit 038176c21617f ("x86/mm/pat: fix
effective RW computation in lookup_address_in_pgd_attr()") fixed the
effective RW checked by verify_rwx() and it exposed that pages used
for ITS trampolines temporarily have RWX permissions.

The permissions are updated in its_fini_core() after all the ITS
trampolines are generated, but since verify_rwx() detects invalid
transitions, it warns when its_alloc() makes RW memory executable.

At the time of alternatives patching the entire kernel text is mapped
RWX, so the warning is bogus anyway.

Skip verification of W^X violations in verify_rwx() when they are
triggered by transitions happening before the kernel text is remapped as
read-only.

Reported-by: Nathan Chancellor <nathan@kernel.org>
Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
---
 arch/x86/mm/pat/set_memory.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
index 226660973d515..2eecb76703bb4 100644
--- a/arch/x86/mm/pat/set_memory.c
+++ b/arch/x86/mm/pat/set_memory.c
@@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
 	if (!(__supported_pte_mask & _PAGE_NX))
 		return new;
 
+	/* skip verification until kernel text is set to read only */
+	if (!kernel_set_to_readonly)
+		return new;
+
 	if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
 		return new;
 

base-commit: 038176c21617fcc03ccc1ca43230ffedb712c047
-- 
2.53.0

Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Nathan Chancellor]

On Tue, Sep 08, 2026 at 12:27:30PM +0300, Mike Rapoport wrote:
> From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
> 
> Nathan Chancellor reports the following warning:
> 
>   CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
>   WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xde7/0x1290, CPU#0: swapper/0/0
>   Modules linked in:
>   CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1-debug-00006-g453e78594434 #1 PREEMPT(full)  2950d432dd3910251071a66f3134fe0875432786
>   Hardware name: ASUS System Product Name/PRIME Z590M-PLUS, BIOS 1801 12/26/2022
>   RIP: 0010:__change_page_attr_set_clr+0xdff/0x1290
>   Code: 80 7c 24 42 00 0f 85 3a 04 00 00 48 8d 3d 19 8d 79 02 49 89 d9 4c 89 e1 4c 89 d2 4c 89 f6 4d 8d 84 24 ff 0f 00 00 4c 89 14 24 <67> 48 0f b9 3a 4c 8b 14 24 48 8b 0d 81 44 bf 01 41 f6 c2 01
>   RSP: 0000:ffffffff87003c60 EFLAGS: 00010246
>   RAX: 0000000000000002 RBX: 0000000000100e00 RCX: ffffffffc0400000
>   RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff872e50c0
>   RBP: 8000000100e00123 R08: ffffffffc0400fff R09: 0000000000100e00
>   R10: 0000000000000123 R11: 0000000000000001 R12: ffffffffc0400000
>   R13: 0000000100e00123 R14: 8000000000000123 R15: ffffffff87003d58
>   FS:  0000000000000000(0000) GS:ffff8ad1777a7000(0000) knlGS:0000000000000000
>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>   CR2: ffff8ad0a4201000 CR3: 00000007e3022001 CR4: 0000000000770ef0
>   PKRU: 55555554
>   Call Trace:
>    <TASK>
>    ? _vm_unmap_aliases+0x219/0x280
>    change_page_attr_set_clr+0x161/0x250
>    ? events_sysfs_show+0x5d/0x80
>    set_memory_x+0x39/0x50
>    apply_retpolines+0x656/0x6d0
>    ? events_sysfs_show+0x5d/0x80
>    ? events_sysfs_show+0x6c/0x80
>    ? events_sysfs_show+0x62/0x80
>    alternative_instructions+0x3c/0xd0
>    arch_cpu_finalize_init+0x130/0x190
>    start_kernel+0x97d/0xa10
>    x86_64_start_reservations+0x24/0x30
>    x86_64_start_kernel+0xda/0xe0
>    common_startup_64+0x13e/0x151
>    </TASK>
>   ---[ end trace 0000000000000000 ]---
> 
> The warning appears because commit 038176c21617f ("x86/mm/pat: fix
> effective RW computation in lookup_address_in_pgd_attr()") fixed the
> effective RW checked by verify_rwx() and it exposed that pages used
> for ITS trampolines temporarily have RWX permissions.
> 
> The permissions are updated in its_fini_core() after all the ITS
> trampolines are generated, but since verify_rwx() detects invalid
> transitions, it warns when its_alloc() makes RW memory executable.
> 
> At the time of alternatives patching the entire kernel text is mapped
> RWX, so the warning is bogus anyway.
> 
> Skip verification of W^X violations in verify_rwx() when they are
> triggered by transitions happening before the kernel text is remapped as
> read-only.
> 
> Reported-by: Nathan Chancellor <nathan@kernel.org>
> Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>

Tested-by: Nathan Chancellor <nathan@kernel.org>

> ---
>  arch/x86/mm/pat/set_memory.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> index 226660973d515..2eecb76703bb4 100644
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
>  	if (!(__supported_pte_mask & _PAGE_NX))
>  		return new;
>  
> +	/* skip verification until kernel text is set to read only */
> +	if (!kernel_set_to_readonly)
> +		return new;
> +
>  	if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
>  		return new;
>  
> 
> base-commit: 038176c21617fcc03ccc1ca43230ffedb712c047
> -- 
> 2.53.0
> 

-- 
Cheers,
Nathan

Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Dave Hansen]

On 9/8/26 02:27, Mike Rapoport wrote:
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
>  	if (!(__supported_pte_mask & _PAGE_NX))
>  		return new;
>  
> +	/* skip verification until kernel text is set to read only */
> +	if (!kernel_set_to_readonly)
> +		return new;

If someone sets up a W+X mapping, such a mapping could persist until
after boot and this would suppress the warning. Right?

Sure, you can _get_ checking with debug_checkwx(). But that's a debug
option and it's kinda weird to shift the burden from an always-on thing
like verify_rwx() to a literal debug option.

That said, I think you're completely on target for thinking that it's
silly for verify_rwx() to even *try* to spew warnings in boot.

How about we add a kernel_strict_rwx() helper:

bool strict_kernel_rwx(void)
{
	return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
}

Have verify_rwx() check *that*. Also, make the DEBUG_WX functionality
mandatory for STRICT_KERNEL_RWX (with appropriate renaming) so that it
can be depended upon. I assume all the distros are turning DEBUG_WX on
already (Ubuntu seems to).

Maybe just do the strict_kernel_rwx() to start and then circle back
around to muck with making DEBUG_WX mandatory?

Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Mike Rapoport]

On Tue, Sep 08, 2026 at 05:15:46PM -0700, Dave Hansen wrote:
> On 9/8/26 02:27, Mike Rapoport wrote:
> > --- a/arch/x86/mm/pat/set_memory.c
> > +++ b/arch/x86/mm/pat/set_memory.c
> > @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
> >  	if (!(__supported_pte_mask & _PAGE_NX))
> >  		return new;
> >  
> > +	/* skip verification until kernel text is set to read only */
> > +	if (!kernel_set_to_readonly)
> > +		return new;
> 
> If someone sets up a W+X mapping, such a mapping could persist until
> after boot and this would suppress the warning. Right?
> 
> Sure, you can _get_ checking with debug_checkwx(). But that's a debug
> option and it's kinda weird to shift the burden from an always-on thing
> like verify_rwx() to a literal debug option.
> 
> That said, I think you're completely on target for thinking that it's
> silly for verify_rwx() to even *try* to spew warnings in boot.
> 
> How about we add a kernel_strict_rwx() helper:
> 
> bool strict_kernel_rwx(void)
> {
> 	return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
> }
>
> Have verify_rwx() check *that*.

Checking only that will bring the warning about ITS pages back :)

Both CONFIG_STRICT_KERNEL_RWX and rodata_enabled are set before the
alternatives patching. 

And rodata_enabled is kinda arm64 specific thingy :)

The check for (!kernel_set_to_readonly) has to stay to actually rule
out the silly checks at boot and it covers your strict_kernel_rwx() because
kernel_set_to_readonly is only set when strict_kernel_rwx() will be true.

> Also, make the DEBUG_WX functionality mandatory for STRICT_KERNEL_RWX
> (with appropriate renaming) so that it can be depended upon.  I assume
> all the distros are turning DEBUG_WX on already (Ubuntu seems to).

Just checked my Debian config, it does.
 
> Maybe just do the strict_kernel_rwx() to start and then circle back
> around to muck with making DEBUG_WX mandatory?

I though about making DEBUG_WX mandatory right away, but that's surely not a
oneliner, so I kept it for later. Maybe should have mentioned in the
changelog, though.

-- 
Sincerely yours,
Mike.

Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Dave Hansen]

On 9/9/26 02:40, Mike Rapoport wrote:
> On Tue, Sep 08, 2026 at 05:15:46PM -0700, Dave Hansen wrote:
...
>> How about we add a kernel_strict_rwx() helper:
>>
>> bool strict_kernel_rwx(void)
>> {
>> 	return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
>> }
>>
>> Have verify_rwx() check *that*.
> 
> Checking only that will bring the warning about ITS pages back :)
> 
> Both CONFIG_STRICT_KERNEL_RWX and rodata_enabled are set before the
> alternatives patching. 
> 
> And rodata_enabled is kinda arm64 specific thingy :)

I think I was confusing rodata_enabled and kernel_set_to_readonly as I
read through things.

But either way, I really don't like the idea of checking some random
state bit. It's generally fragile.

> The check for (!kernel_set_to_readonly) has to stay to actually rule
> out the silly checks at boot and it covers your strict_kernel_rwx() because
> kernel_set_to_readonly is only set when strict_kernel_rwx() will be true.

Could we do something slightly more generic?

mark_readonly() is awfully close to setting SYSTEM_RUNNING:

        mark_readonly();
        pti_finalize();
        system_state = SYSTEM_RUNNING;

What if we (eventually) did something like:

/*
 * Get the kernel page tables ready to run userspace.
 * There should be no page table manipulation between this and
 * settings SYSTEM_RUNNING.
 */
void boot_finalize_page_tables(void)
{
	WARN_ON(system_state >= SYSTEM_RUNNING);

	mark_readonly();

	/*
         * Kernel mappings are now finalized - update
	 * the userspace page-able to finalize PTI.
	 */
	pti_finalize();

	/* Ensure the final kernel mappings have no W+X issues: */
	debug_checkwx();
}

and then verify_rwx() can just check system_state?

>> Also, make the DEBUG_WX functionality mandatory for STRICT_KERNEL_RWX
>> (with appropriate renaming) so that it can be depended upon.  I assume
>> all the distros are turning DEBUG_WX on already (Ubuntu seems to).
> 
> Just checked my Debian config, it does.
>  
>> Maybe just do the strict_kernel_rwx() to start and then circle back
>> around to muck with making DEBUG_WX mandatory?
> 
> I though about making DEBUG_WX mandatory right away, but that's surely not a
> oneliner, so I kept it for later. Maybe should have mentioned in the
> changelog, though.

Yes, please. It would be nice to mention that the fix is a bit exposed
without DEBUG_WX. It could honestly even pr_info_once() about it to make
it less likely it somehow gets forgotten.

Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Mike Rapoport]

On Wed, Sep 09, 2026 at 07:22:31AM -0700, Dave Hansen wrote:
> On 9/9/26 02:40, Mike Rapoport wrote:
> > On Tue, Sep 08, 2026 at 05:15:46PM -0700, Dave Hansen wrote:
> ...
> >> How about we add a kernel_strict_rwx() helper:
> >>
> >> bool strict_kernel_rwx(void)
> >> {
> >> 	return IS_ENABLED(CONFIG_STRICT_KERNEL_RWX) && rodata_enabled;
> >> }
> >>
> >> Have verify_rwx() check *that*.
> > 
> > Checking only that will bring the warning about ITS pages back :)
> > 
> > Both CONFIG_STRICT_KERNEL_RWX and rodata_enabled are set before the
> > alternatives patching. 
> > 
> > And rodata_enabled is kinda arm64 specific thingy :)
> 
> I think I was confusing rodata_enabled and kernel_set_to_readonly as I
> read through things.
> 
> But either way, I really don't like the idea of checking some random
> state bit. It's generally fragile.
> 
> > The check for (!kernel_set_to_readonly) has to stay to actually rule
> > out the silly checks at boot and it covers your strict_kernel_rwx() because
> > kernel_set_to_readonly is only set when strict_kernel_rwx() will be true.
> 
> Could we do something slightly more generic?
> 
> mark_readonly() is awfully close to setting SYSTEM_RUNNING:
> 
>         mark_readonly();
>         pti_finalize();
>         system_state = SYSTEM_RUNNING;

We could check SYSTEM_RUNNING, but OTOH using kernel_set_to_readonly is
consistent with the existing checks in protect_rodata() and
protect_kernel_text_ro() in the same file.

I think that it's better to use the consistent kernel_set_to_readonly now
and flipping them all to SYSTEM_RUNNING ...

> What if we (eventually) did something like:

... when something like this materializes. 

> /*
>  * Get the kernel page tables ready to run userspace.
>  * There should be no page table manipulation between this and
>  * settings SYSTEM_RUNNING.
>  */
> void boot_finalize_page_tables(void)
> {
> 	WARN_ON(system_state >= SYSTEM_RUNNING);
> 
> 	mark_readonly();
> 
> 	/*
>          * Kernel mappings are now finalized - update
> 	 * the userspace page-able to finalize PTI.
> 	 */
> 	pti_finalize();
> 
> 	/* Ensure the final kernel mappings have no W+X issues: */
> 	debug_checkwx();
> }
> 
> and then verify_rwx() can just check system_state?

and protect_rodata() and protect_kernel_text_ro() :)
 
> >> Also, make the DEBUG_WX functionality mandatory for STRICT_KERNEL_RWX
> >> (with appropriate renaming) so that it can be depended upon.  I assume
> >> all the distros are turning DEBUG_WX on already (Ubuntu seems to).
> > 
> > Just checked my Debian config, it does.
> >  
> >> Maybe just do the strict_kernel_rwx() to start and then circle back
> >> around to muck with making DEBUG_WX mandatory?
> > 
> > I though about making DEBUG_WX mandatory right away, but that's surely not a
> > oneliner, so I kept it for later. Maybe should have mentioned in the
> > changelog, though.
> 
> Yes, please. It would be nice to mention that the fix is a bit exposed
> without DEBUG_WX. It could honestly even pr_info_once() about it to make
> it less likely it somehow gets forgotten.

I like the pr_info_once() idea, will add it in v2.

-- 
Sincerely yours,
Mike.

Re: [PATCH] x86/mm/pat: skip RWX verification until kernel text is set to read only

[Ihor Solodrai]

On 9/8/26 2:27 AM, Mike Rapoport wrote:
> From: "Mike Rapoport (Microsoft)" <rppt@kernel.org>
> 
> Nathan Chancellor reports the following warning:
> 
>   CPA detected W^X violation: 8000000000000123 -> 0000000000000123 range: 0xffffffffc0400000 - 0xffffffffc0400fff PFN 100e00
>   WARNING: arch/x86/mm/pat/set_memory.c:722 at __change_page_attr_set_clr+0xde7/0x1290, CPU#0: swapper/0/0
>   Modules linked in:
>   CPU: 0 UID: 0 PID: 0 Comm: swapper/0 Not tainted 7.3.0-rc1-debug-00006-g453e78594434 #1 PREEMPT(full)  2950d432dd3910251071a66f3134fe0875432786
>   Hardware name: ASUS System Product Name/PRIME Z590M-PLUS, BIOS 1801 12/26/2022
>   RIP: 0010:__change_page_attr_set_clr+0xdff/0x1290
>   Code: 80 7c 24 42 00 0f 85 3a 04 00 00 48 8d 3d 19 8d 79 02 49 89 d9 4c 89 e1 4c 89 d2 4c 89 f6 4d 8d 84 24 ff 0f 00 00 4c 89 14 24 <67> 48 0f b9 3a 4c 8b 14 24 48 8b 0d 81 44 bf 01 41 f6 c2 01
>   RSP: 0000:ffffffff87003c60 EFLAGS: 00010246
>   RAX: 0000000000000002 RBX: 0000000000100e00 RCX: ffffffffc0400000
>   RDX: 0000000000000123 RSI: 8000000000000123 RDI: ffffffff872e50c0
>   RBP: 8000000100e00123 R08: ffffffffc0400fff R09: 0000000000100e00
>   R10: 0000000000000123 R11: 0000000000000001 R12: ffffffffc0400000
>   R13: 0000000100e00123 R14: 8000000000000123 R15: ffffffff87003d58
>   FS:  0000000000000000(0000) GS:ffff8ad1777a7000(0000) knlGS:0000000000000000
>   CS:  0010 DS: 0000 ES: 0000 CR0: 0000000080050033
>   CR2: ffff8ad0a4201000 CR3: 00000007e3022001 CR4: 0000000000770ef0
>   PKRU: 55555554
>   Call Trace:
>    <TASK>
>    ? _vm_unmap_aliases+0x219/0x280
>    change_page_attr_set_clr+0x161/0x250
>    ? events_sysfs_show+0x5d/0x80
>    set_memory_x+0x39/0x50
>    apply_retpolines+0x656/0x6d0
>    ? events_sysfs_show+0x5d/0x80
>    ? events_sysfs_show+0x6c/0x80
>    ? events_sysfs_show+0x62/0x80
>    alternative_instructions+0x3c/0xd0
>    arch_cpu_finalize_init+0x130/0x190
>    start_kernel+0x97d/0xa10
>    x86_64_start_reservations+0x24/0x30
>    x86_64_start_kernel+0xda/0xe0
>    common_startup_64+0x13e/0x151
>    </TASK>
>   ---[ end trace 0000000000000000 ]---

BPF CI has caught similar splats on linux-next [1].
The patch fixes it [2][3].

Tested-by: Ihor Solodrai <ihor.solodrai@linux.dev>

Thanks!

[1] https://github.com/kernel-patches/bpf/actions/runs/33918575854/job/101174705812
[2] https://github.com/kernel-patches/vmtest/pull/523
[3] https://github.com/kernel-patches/bpf/actions/runs/34279792157

> 
> The warning appears because commit 038176c21617f ("x86/mm/pat: fix
> effective RW computation in lookup_address_in_pgd_attr()") fixed the
> effective RW checked by verify_rwx() and it exposed that pages used
> for ITS trampolines temporarily have RWX permissions.
> 
> The permissions are updated in its_fini_core() after all the ITS
> trampolines are generated, but since verify_rwx() detects invalid
> transitions, it warns when its_alloc() makes RW memory executable.
> 
> At the time of alternatives patching the entire kernel text is mapped
> RWX, so the warning is bogus anyway.
> 
> Skip verification of W^X violations in verify_rwx() when they are
> triggered by transitions happening before the kernel text is remapped as
> read-only.
> 
> Reported-by: Nathan Chancellor <nathan@kernel.org>
> Closes: https://lore.kernel.org/all/20260905044253.GA3816371@ax162
> Signed-off-by: Mike Rapoport (Microsoft) <rppt@kernel.org>
> ---
>  arch/x86/mm/pat/set_memory.c | 4 ++++
>  1 file changed, 4 insertions(+)
> 
> diff --git a/arch/x86/mm/pat/set_memory.c b/arch/x86/mm/pat/set_memory.c
> index 226660973d515..2eecb76703bb4 100644
> --- a/arch/x86/mm/pat/set_memory.c
> +++ b/arch/x86/mm/pat/set_memory.c
> @@ -708,6 +708,10 @@ static inline pgprot_t verify_rwx(pgprot_t old, pgprot_t new, unsigned long star
>  	if (!(__supported_pte_mask & _PAGE_NX))
>  		return new;
>  
> +	/* skip verification until kernel text is set to read only */
> +	if (!kernel_set_to_readonly)
> +		return new;
> +
>  	if (!((pgprot_val(old) ^ pgprot_val(new)) & (_PAGE_RW | _PAGE_NX)))
>  		return new;
>  
> 
> base-commit: 038176c21617fcc03ccc1ca43230ffedb712c047