i386 PROT_EXEC real X bit Most x86 cpu use a split-TLB in their MMU already PTE has 3 unused bits: normally used by software Our kernel tracks X bit per-page using PT_AVAIL3 Used to determine where CS limit should be (highest PT_AVAIL3 page is included) If these cpu had a mode (PTX), could do X bit code fetch fault: If PTX && (pte & PT_AVAIL3) == 0 -> fault 150 gates, or approx 4 lines of microcode VIA and AMD are receptive, still trying to build contacts at Intel and Transmeta