12
Advantages of using XD/NX
Enabling XD/NX provides increased protection against viruses that use buffer overflow attacks. This
increased protection provides the benefit of increased network security as malicious code cannot propa-
gate or spread to infect more computers. Support staff also benefits from much improved containment and
easier eradication of unwanted software.
Disadvantages of using XD/NX
XD/NX compatibility issues can occur for both applications and drivers. Applications that perform
dynamic code generation, such as just-in-time (JIT) code generation, that do not mark the generated code
with Execute permission, will experience compatibility issues.
Drivers can encounter compatibility issues when running on 32-bit systems with PAE mode enabled. There
are several reasons for this:
•
Driver does not load because it cannot perform 64-bit addressing.
•
Driver does not load because it assumes PAE mode requires more than 4-GB of memory.
•
Driver causes problem when it expects a 32-bit PTE, but instead gets a 64-bit PTE.
•
Driver cannot DMA properly with a 64-bit physical addresses.
To a lesser extent, some drivers create code in real time. These drivers encounter the same problem as
applications that create code in real time as mentioned above.
Conclusion and Recommendation
XD/NX is a useful computer architecture innovation that will reduce the number of viruses that exploit
buffer overruns. HP encourages customers who use custom images or third-party software to test software
for XD/NX compatibility. Customers have full control as to whether to use XD/NX, either by enabling or
disabling XD/NX from the BIOS (F10 Setup), or from the operating system (BOOT.INI).
HP is shipping the following for which the noexecute policy level in BOOT.INI will remain at the default
state of OptIn:
•
i915 chipset desktop systems with XD disabled in F10 Setup.
•
i945 desktop systems with XD enabled by default in F10 Setup.
•
Transmeta processor bc1000 computers with NX disabled by default in BIOS.
•
AMD processor-based ATI desktop computers with NX enabled by default in BIOS.
To manually turn off DEP, change the state to
/alwaysoff
in the BOOT.INI.
