i386 PROT_EXEC best-effort i386 lacks per-page X bit Only significant relevant hardware feature: code segment limit 3.2/3.3: points below bottom of stack -> no-exec stack Link each shared object to have 1GB gap between code & data Map all text segments low, all data segments 1GB higher Set code segment limit register to point up to highest PROT_EXEC page (floating CS limit) Normally somewhere below 1GB Will be in 3.4: W^X on i386 Changing CS limit is a bit expensive: slight overhead