4 ms·
Correct me if I'm wrong, but isn't amd64 kernels always going to have this implemented in hardware? I mean, W^X is a replication of the NX bit, which is (as fa
by hlieberman 12y ago
Correct me if I'm wrong, but isn't amd64 kernels always going to have this implemented in hardware? I mean, W^X is a replication of the NX bit, which is (as far as I know) mandatory for the x86 instruction set.
- achernya 12y agoYou're correct, the protection is implemented in hardware, but the pages have to be marked appropriately. This message describes a patchset that correctly marks the kernel pages as writable xor executable.
- k__ 12y agoSo they can but don't have to be marked?
- taejo 12y agoYes. Many programs rely on W&X (I believe the JVM is a prominent example)
- masklinn 12y agoAny JIT-based system requires executable writable memory. This includes the JVM, LuaJIT, Pypy, HHVM and all modern browsers.
- m_eiman 12y agoIt'd be quite possible for a JIT to have the memory first writable but not executable when creating the code, then the other way around when running it. No need to be both at the same time.
- mrweasel 12y agoI don't think the first versions of Intels AMD64 chips had the NX bit, but those chips are so old at this point it might be unimportant.
- geofft 12y agoAs I understand it, the NX bit is just a new permission bit to say "Don't execute this page". The i386 architecture only had read and write bits, and assumed that read also meant execute. W^X is a policy that a kernel can choose to implement, that if the W bit is set on a page table entry, so is the NX bit. You need the NX bit to be available in hardware for this to be useful, but hardware support for NX doesn't mean that you have to use it, let alone implement W^X. This means that amd64 processors are backwards-compatible with kernel and userspace designs that require W|X, even in long (64-bit) mode.