I would like to scan all executable pages in the linux kernel. The most easiest way is to walk through the page table to identify all PTEs(Page Table Entries) which clear the NX bit. However, identifying all PTEs is costly.
I want to know the relationship of the NX bit among the four-level page tables. For example, if the NX bit for a PMD(Page Middle Directory) entry is set, does it mean that all PTEs referred by this PMD entry are non-executable? If so, I can optimize the scan procedure by pruning.
Can someone help me? Great thanks.
