You can probably replace some of those use cases by mapping the same physical page in two places with different permissions (W^X is per-address, not per physical page).