Vol. 3A 4-13

PAGING

4.4 PAE 

PAGING

A logical processor uses PAE paging if CR0.PG = 1, CR4.PAE = 1, and IA32_EFER.LME = 0. PAE paging translates 
32-bit linear addresses to 52-bit physical addresses.

1

 Although 52 bits corresponds to 4 PBytes, linear addresses 

are limited to 32 bits; at most 4 GBytes of linear-address space may be accessed at any given time.
With PAE paging, a logical processor maintains a set of four (4) PDPTE registers, which are loaded from an address 
in CR3. Linear address are translated using 4 hierarchies of in-memory paging structures, each located using one 
of the PDPTE registers. (This is different from the other paging modes, in which there is one hierarchy referenced 
by CR3.)
Section 4.4.1 discusses the PDPTE registers. Section 4.4.2 describes linear-address translation with PAE paging.

4.4.1 PDPTE 

Registers

When PAE paging is used, CR3 references the base of a 32-Byte page-directory-pointer table. Table 4-7 illus-
trates how CR3 is used with PAE paging.

The page-directory-pointer-table comprises four (4) 64-bit entries called PDPTEs. Each PDPTE controls access to a 
1-GByte region of the linear-address space. Corresponding to the PDPTEs, the logical processor maintains a set of 
four (4) internal, non-architectural PDPTE registers, called PDPTE0, PDPTE1, PDPTE2, and PDPTE3. The logical 
processor loads these registers from the PDPTEs in memory as part of certain operations:

•

If PAE paging would be in use following an execution of MOV to CR0 or MOV to CR4 (see Section 4.1.1) and the 
instruction is modifying any of CR0.CD, CR0.NW, CR0.PG, CR4.PAE, CR4.PGE, CR4.PSE, or CR4.SMEP; then the 
PDPTEs are loaded from the address in CR3.

•

If MOV to CR3 is executed while the logical processor is using PAE paging, the PDPTEs are loaded from the 
address being loaded into CR3.

•

If PAE paging is in use and a task switch changes the value of CR3, the PDPTEs are loaded from the address in 
the new CR3 value.

•

Certain VMX transitions load the PDPTE registers. See Section 4.11.1.

Table 4-8 gives the format of a PDPTE. If any of the PDPTEs sets both the P flag (bit 0) and any reserved bit, the 
MOV to CR instruction causes a general-protection exception (#GP(0)) and the PDPTEs are not loaded.

2

 As shown 

in Table 4-8, bits 2:1, 8:5, and 63:MAXPHYADDR are reserved in the PDPTEs.

1. If MAXPHYADDR < 52, bits in the range 51:MAXPHYADDR will be 0 in any physical address used by PAE paging. (The corresponding 

bits are reserved in the paging-structure entries.) See Section 4.1.4 for how to determine MAXPHYADDR.

Table 4-7.  Use of CR3 with PAE Paging

Bit 

Position(s)

Contents

4:0

Ignored

31:5

Physical address of the 32-Byte aligned page-directory-pointer table used for linear-address translation

63:32

Ignored (these bits exist only on processors supporting the Intel-64 architecture)

2. On some processors, reserved bits are checked even in PDPTEs in which the P flag (bit 0) is 0.