Ubuntu Wiki

Firmware Test Suite - nx test

Most modern CPUs protect against executing non-executable memory regions (heap, stack, etc). This is known either as Non-eXecute (NX) or eXecute-Disable (XD). This protection reduces the areas an attacker can use to perform arbitrary code execution. See https://wiki.ubuntu.com/Security/Features for more details.

Some BIOS manufacturers needlessly disable it by default. The nx test checks to see if the CPU is NX capable and if it has been disabled in the BIOS.

Typical output from this test is as follows:

Test if CPU NX is disabled by the BIOS.
--------------------------------------------------------------------------------
Test 1 of 3: Check CPU NX capability.
PASSED: Test 1, CPU has NX flags, BIOS is not disabling it.

Test 2 of 3: Check all CPUs have same BIOS set NX flag.
This test verifies that all CPUs have the same NX flag setting. Although rare,
BIOS may set the NX flag differently per CPU. 
PASSED: Test 2, All 4 CPUs have the same NX flag set.

Test 3 of 3: Check all CPUs have same msr setting in MSR 0x1a0.
This test verifies that all CPUs have the same NX flag setting by examining the
per CPU MSR register 0x1a0.
PASSED: Test 3, All 4 CPUs have the NX flag in MSR 0x1a0 set.

================================================================================
3 passed, 0 failed, 0 warnings, 0 aborted, 0 skipped, 0 info only.
================================================================================

Examples:

sudo fwts nx - 

..runs the nx test on your machine and dumps the output to stdout.

sudo fwts nx

..runs the nx test on your machine and appends the output to the default logfile results.log

Explanation of test results

Certain test results may require a little more explanation. This section will try and give some context to specific test failures.