Navigate: Advice Beginners BIOS Guide CPUs Links Mainboards Memory Network Storage Video/Sound Cards Contact Forum SiteMap Sponsors WebNews Home	.	.
Prices: Mainboards ABIT ASUS Chaintech Shuttle Soyo Tyan CPU Intel P4 2.4C-800 P4 2.6C-800 P4 2.8C-800 P4 3.0-800 P4 3.2-800 AMD AthlonXP XP 1700+ XP 2000+ XP 2400+ XP 2500+ XP 2700+ XP 3000+ XP 3200+ Athlon64 Athlon64 3200+ Athlon64 FX-51 Opteron Opteron 240 Opteron 242 Opteron 244 Opteron 246 Memory Corsair Crucial Kingston Mushkin OCZ Search Prices:

LOSTCIRCUITS	SHORTCUTS: Names and Confusion Benchmarking Issues Test Configurations Content Creation Office Productivity 3D Rendering Cinebench 2003 FutureMarks Gaming A-D Gaming M-X NX bit Tales More NX bit Tales Surprises and Conclusions Give Us Some Feedback to Help Us Improve our Reviews
AMD Athlon64 4000+
(Review by MS and Jerry Coffin, October 19, 2004)

A word (or several!) about the No-Execution bit

Hacking this protection isn’t necessarily easy, but it’s not necessarily as hard as we’d like (witness the number of times we see critical patches from Bill Gates and company). A commonly used method is a buffer overflow, in which the malicious code writes what looks like some data onto the stack, and then gets some ring 0 routine to start executing it as code instead.

Of course, one way to prevent this would be to use the segment-based memory protection mentioned above. Unfortunately, nearly all of the current OSes diligently ignore the very existence of segments, and grafting segment-based protection onto them at this point would be quite difficult at best.

In this case, it’s easier to fix the problem on the level of hardware by adding or, more precisely, by assigning a protection bit that says a particular page of memory can’t be executed, and then the OS’s paging-based protection can easily prevent executing anything on the stack. In this case, the bit in question is bit 63 in the paging table entry that can be set to either 0 (allow execution) or 1 (no eXecution).

One of the advantages of software is that it can be changed relatively easily compared to hardware. It’s certainly a lot easier and cheaper to install a new copy of Linux (or Windows) than to replace your processor. On the other hand, the last decades have shown that OSes are blessed with substantially higher longevity than any hardware. Likewise, a new CPU is often times less expensive than a new operating system, not to mention the hassles of weeding out the compatibility issues on the hardware AND application level. Therefore, it appears as if rewriting an entire operating system would be very un-economic, not to mention the time to market.

The NX bit is a whole different story: the CPU already has mechanisms to check whether it can access a particular page of memory at any given time anyway. The NX bit only has to activate this mechanism under slightly different circumstances. That means the NX, or, in Intel parlance, DX bit (or maybe XD, depending on who’s talking about it, but either way, standing for some variant of Deny eXecution) is really quite simple to implement. The head designer of one competing CPU says that in their design it required only one extra gate and three lines of VSDL code.

This still means that software support is needed to correctly interpret the NX bit. All AMD 64-bit processors have supported the bit from the beginning, likewise, the correct support was incorporated into the 64-bit version of Windows (in beta for over 2 years and counting…) from the first beta versions on. For 32-bit processors, support was added in Windows XP Service Pack 2.

Currently, all AMD Athlon64 processors support the NX bit. Given the attention this has drawn, it’s a fair bet that it’ll be added to all models over time. Intel also currently supports the DX-bit – on the Itanium only. Other adopters are Transmeta – one advantage of their unique hardware/software approach to executing x86 software is the ability to add such capabilities in the code-morphing software without changing the hardware. Via has promised the feature for an upcoming processor (the C5J, aka the C7) which they plan to deliver somewhere around the beginning of next year

next page: => No eXecute Tales3: The Test =>