Kernel memory is never writable and executable, and a boot audit holds it

issues/an-ap-loads-the-idt-before-its-control-registers.md

@@ -16,7 +16,7 @@ ordering is stated at the site.
 trampoline's long-mode half sets `CR4.PAE` and nothing else, then sets the GS
 base, then `lidt`s the kernel's table — and `CR4.OSFXSR` is not set until
 `percpu::init_ap` reaches `control_regs::init`, several Rust statements later.
-Between them an AP runs `control_regs::init_cr0`, `pat::init` (MSR writes and a
+Between them an AP runs `control_regs::init_paging`, `pat::init` (MSR writes and a
 CR0 round trip) and `mm::paging::load_kernel_flush` (a CR3 reload) with a table
 loaded whose every stub is `#UD` on entry. Any exception in that window is a
 triple fault with nothing on any channel.

issues/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md

@@ -37,7 +37,8 @@ work needs.
 - `issues/every-syscall-runs-at-one-kernel-stack-offset.md`
 - `issues/kernel-functions-return-with-their-used-registers-intact.md`
 - `issues/a-threads-kernel-stack-has-no-guard-page.md`
-- `issues/kernel-text-is-writable-and-every-kernel-page-executable.md`
+- `issues/the-kernels-relro-stays-writable.md`
+- `issues/x86-64s-boot-map-is-writable-and-executable.md`
 - `issues/the-kernel-heap-has-none-of-slubs-hardening.md`
 - `issues/a-device-without-a-domain-of-its-own-reaches-all-memory.md`
 - `issues/user-programs-run-without-a-shadow-stack.md`

issues/the-kernels-relro-stays-writable.md

@@ -0,0 +1,20 @@
+---
+status: open
+kind: defect
+opened: 2026-10-21
+---
+
+# The kernel's RELRO stays writable
+
+The kernel maps its own image page by page from its `PT_LOAD` flags
+(`kernel/src/mm/image.rs`), so its `PT_GNU_RELRO` — `.data.rel.ro`, `.got` and
+`.dynamic`, about 70 KiB on x86-64 — is read-write and execute-never for the
+machine's life. The loader applies the image's relocations before the kernel
+runs, so nothing needs to write it afterwards, and a stray kernel write can
+rewrite a vtable or a function pointer there. Linux at the parity tag of
+`issues/the-kernel-is-at-least-as-secure-as-linux-on-every-machine-toyos-supports.md`
+maps the same data read-only. `toyos-elf` parses no `PT_GNU_RELRO`, which
+`issues/an-executables-relro-stays-writable.md` needs too.
+
+Exit: the kernel's `PT_GNU_RELRO` pages are read-only in its tables from
+`mm::init` on, and a boot check or test write shows it.

issues/x86-64s-boot-map-is-writable-and-executable.md

@@ -0,0 +1,23 @@
+---
+status: open
+kind: defect
+opened: 2026-10-21
+---
+
+# x86-64's boot map is writable and executable
+
+The loader's x86-64 boot map (`lib/bootmap/src/x86_64.rs`) maps the kernel's
+text read-only and every other page writable, and every page executable: bit 63
+is execute-disable only under `IA32_EFER.NXE`, and the loader switches to the
+map from firmware's state, before the kernel declares `NXE`. The boot CPU runs
+the kernel on it until `mm::init`, and each AP from its trampoline, whose page
+at 0x8000 the map holds writable, until `smp::ap_entry` loads the kernel's
+tables. The boot's audit (`mm::audit_wx`) walks the kernel's tables, not this
+map. AArch64's boot map is not writable and executable anywhere: the kernel's
+entry declares `SCTLR_EL1.WXN` before it turns translation on under it, and the
+loader maps everything but the text execute-never.
+
+Exit: as on AArch64, the kernel's entry applies its declared `EFER` before it
+switches to the boot map; every leaf there but the text's and the trampoline
+page's is execute-disable, and those two are read-only; and the plan's host
+tests show it.

kernel/pure/lib.rs

@@ -23,4 +23,5 @@ pub mod pipe;
 pub mod pointers;
 pub mod proclife;
 pub mod sched;
+pub mod wx;
 pub mod xsave;