Navigate: Advice Beginners BIOS Guide CPUs Links Mainboards Memory Network Storage Video/Sound Cards Contact Forum SiteMap Sponsors WebNews Home	.	.
Prices: Mainboards ABIT ASUS Chaintech Shuttle Soyo Tyan CPU Intel P4 2.4C-800 P4 2.6C-800 P4 2.8C-800 P4 3.0-800 P4 3.2-800 AMD AthlonXP XP 1700+ XP 2000+ XP 2400+ XP 2500+ XP 2700+ XP 3000+ XP 3200+ Athlon64 Athlon64 3200+ Athlon64 FX-51 Opteron Opteron 240 Opteron 242 Opteron 244 Opteron 246 Memory Corsair Crucial Kingston Mushkin OCZ Search Prices:

LOSTCIRCUITS	SHORTCUTS: Names and Confusion Benchmarking Issues Test Configurations Content Creation Office Productivity 3D Rendering Cinebench 2003 FutureMarks Gaming A-D Gaming M-X NX bit Tales More NX bit Tales Surprises and Conclusions Give Us Some Feedback to Help Us Improve our Reviews
AMD Athlon64 4000+
(Review by MS and Jerry Coffin, October 19, 2004)

A word (or several!) about the No-Execution bit

In theory, the No Execution (NX) bit should never have been necessary. Starting with the 80286, Intel (and later AMD) provided memory protection in the form of segments. A segment can be marked for any combination of reading, writing or execution.

For better or worse, segmentation-based memory protection never achieved a high level of popularity – nearly the only OS that ever used it to a significant degree was OS/2 1.x. Starting with the 80386, Intel provided a paging-based virtual memory system, with its own form of memory protection on a per-page (rather than per-segment) basis. In an apparent attempt at simplifying programming, paging-based memory protection reduces the three bits for read/write/execute to a single bit that governs ONLY whether a particular page of memory can be written or not, meaning that any page that can be accessed at all can be read or executed.

It should be noted that when executing in protected mode (as all reasonably recent OSes for x86 CPUs do) that paging is optional, but segmentation is NOT. That is to say that the OS has to set up a segment descriptor (with the previously mentioned read, write and execute permission bits) to be able to access memory at all.

Why then, is the new No-eXecute bit even necessary? The answer is rather simple: The segments ALLOW protection on a per segment basis, however, the OS normally sets the code segment to cover the ENTIRE 4 Gigabyte address space, with permission to execute. In other words, the OS is explicitly giving permission for anything to be executed anywhere and, therefore any protection via segmentation is negated.

It is somewhat symptomatic for current computer technology (including software) that there is a mechanism that is then negated only to be re-enacted in a different form. Along these lines, a.k.a, why do it simple if we can make it complicated, the OS still does (or attempt to) impose some protection: the x86 architecture provides four levels of protection, numbered 0 through 3, with 0 being the most privileged (ring 0 code can do anything) and 3 the least privileged. Normally, ring 0 code is restricted to the core of the OS, along with device drivers that need direct access to the hardware to do their jobs. All applications normally run at ring 3, so at least in theory, they can only do what the OS says they can.

next page: => No eXecute Tales2 =>