Somewhat related, if I remember right grsecurity emulated NX bit by abusing the fact that iTLB and dTLB caches are separated. On tlb miss, it hooked code (trap

Somewhat related, if I remember right grsecurity emulated NX bit by abusing the fact that iTLB and dTLB caches are separated. On tlb miss, it hooked code (trap on a page tree walk?) and tried to reverse if it was instruction or data cache miss. If it was instruction, it performed additional check for the "software" NX bit on a page.