TdR> By the way, I am pleased to say that my research has shown that the
TdR> AMD PAE NX bit will work in 32 bit mode. We are trying to make
TdR> modifications that will permit OpenBSD to use it.

you are pleased? your research ?!

you should be aware of fact that feature implemented by Microsoft for
XP which is in beta yet but announced for several months already.

"The 32-bit version of Windows currently leverages the NX processor
feature, as defined by the AMD64 Architecture Programmer's Manual.
This processor feature requires the processor run in Physical Address Extension (PAE) mode."

http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnwxp/h
tml/securityinxpsp2.asp

Best regards,
Andrey

TdR> Whoa, hold on. What these vendors are doing to their cpus is not on
TdR> the same scale as what you are suggesting.

TdR> In this regard, all AMD has added (to the amd64) is a per-page
TdR> non-executable bit. In PAE mode, bit 63 of the PTE becomes a NX bit.

TdR> This is not really all that new. sparc v8, sparc v9, alpha, and hppa
TdR> have had this for a very long time. The motorola 88k is also capable
TdR> of this, due to the split mmu handling. In general cpus like mips,
TdR> vax, m68k, and powerpc cpus are not capable of it. Some cpus with
TdR> split code & data tlb's are -- if they have software tlb load
TdR> mechanisms -- and some arm cpus fall into this catagory. But
TdR> performance can suffer significantly if the mechanims are poorly
TdR> designed.

TdR> Some operating systems make use of this. Such as OpenBSD, for ..
TdR> what.. 2 years now..

TdR> Now why is this not the same as yours? Even though we have an entire
TdR> operating system modified to operate with as many non-executable page
TdR> as possible, we still consider this a weaker protection mechanism than
TdR> gcc propolice. However these two very cheap mechanisms can work
TdR> together to improve resistance; fewer bugs can be exploited to control
TdR> flow.

[ reply ]