svn commit: r285894 - head/release/doc/en_US.ISO8859-1/relnotes stable/10/release/doc/en_US.ISO8859-1/relnotes

[Glen Barber]

Author: gjb
Date: Sun Jul 26 17:57:35 2015
New Revision: 285894
URL: https://svnweb.freebsd.org/changeset/base/285894

Log:
  Further refine the PAE_TABLES entry, based on feedback from
  alc.
  
  Sponsored by:	The FreeBSD Foundation

Modified:
  head/release/doc/en_US.ISO8859-1/relnotes/article.xml

Changes in other areas also in this revision:
Modified:
  stable/10/release/doc/en_US.ISO8859-1/relnotes/article.xml

Modified: head/release/doc/en_US.ISO8859-1/relnotes/article.xml
==============================================================================
--- head/release/doc/en_US.ISO8859-1/relnotes/article.xml	Sun Jul 26 16:40:51 2015	(r285893)
+++ head/release/doc/en_US.ISO8859-1/relnotes/article.xml	Sun Jul 26 17:57:35 2015	(r285894)
@@ -803,13 +803,16 @@
       <para revision="281495" contrib="sponsor" sponsor="&ff;">The
 	<literal>PAE_TABLES</literal> kernel configuration option has
 	been added for &os;/&arch.i386;, which instructs &man.pmap.9;
-	to use <acronym>PAE</acronym> format for page tables with
-	32-bit physical addresses.  Unlike the <literal>PAE</literal>
-	option, <literal>PAE_TABLES</literal> preserves kernel binary
-	interface (<acronym>KBI</acronym>) compatibility with
-	non-<literal>PAE</literal> kernels, allowing
-	non-<literal>PAE</literal> kernel modules and drivers to work
-	with a <literal>PAE_TABLES</literal>-enabled kernel.
+	to use <acronym>PAE</acronym> format for page tables while
+	maintaining a 32-bit physical address size elsewhere in the
+	kernel.  The use of this option can enhance application-level
+	security by enabling the creation of <quote>no execute</quote>
+	mappings on modern &arch.i386; processors.  Unlike the
+	<literal>PAE</literal> option, <literal>PAE_TABLES</literal>
+	preserves kernel binary interface (<acronym>KBI</acronym>)
+	compatibility with non-<literal>PAE</literal> kernels,
+	allowing non-<literal>PAE</literal> kernel modules and drivers
+	to work with a <literal>PAE_TABLES</literal>-enabled kernel.
 	Additionally, system limits are tuned for 4GB maximum
 	<acronym>RAM</acronym>, avoiding kernel virtual address space
 	(<acronym>KVA</acronym>) exhaustion.</para>