4-2 Vol. 3
PAGING
paging modes. Section 4.1.3 discusses how CR0.WP, CR4.PSE, CR4.PGE, and
IA32_EFER.NXE modify the operation of the different paging modes.
4.1.1 Three Paging Modes
If CR0.PG = 0, paging is not used. The logical processor treats all linear addresses as
if they were physical addresses. CR4.PAE and IA32_EFER.LME are ignored by the
processor, as are CR0.WP, CR4.PSE, and CR4.PGE, and IA32_EFER.NXE.
Paging is enabled if CR0.PG = 1. Paging can be enabled only if protection is enabled
(CR0.PE = 1). If paging is enabled, one of three paging modes is used. The values of
CR4.PAE and IA32_EFER.LME determine which paging mode is used:
• If CR0.PG = 1 and CR4.PAE = 0, 32-bit paging is used. 32-bit paging is detailed
in Section 4.3. 32-bit paging uses CR0.WP, CR4.PSE, and CR4.PGE as described
in Section 4.1.3.
• If CR0.PG = 1, CR4.PAE = 1, and IA32_EFER.LME = 0, PAE paging is used. PAE
paging is detailed in Section 4.4. PAE paging uses CR0.WP, CR4.PGE, and
IA32_EFER.NXE as described in Section 4.1.3.
• If CR0.PG = 1, CR4.PAE = 1, and IA32_EFER.LME = 1, IA-32e paging is used.
1
IA-32e paging is detailed in Section 4.5. IA-32e paging uses CR0.WP, CR4.PGE,
and IA32_EFER.NXE as described in Section 4.1.3. IA-32e paging is available
only on processors that support the Intel 64 architecture.
The three paging modes differ with regard to the following details:
• Linear-address width. The size of the linear addresses that can be translated.
• Physical-address width. The size of the physical addresses produced by paging.
• Page size. The granularity at which linear addresses are translated. Linear
addresses on the same page are translated to corresponding physical addresses
on the same page.
• Support for execute-disable access rights. In some paging modes, software can
be prevented from fetching instructions from pages that are otherwise readable.
Table 4-1 illustrates the key differences between the three paging modes.
Because they are used only if IA32_EFER.LME = 0, 32-bit paging and PAE paging is
used only in legacy protected mode. Because legacy protected mode cannot produce
1. The LMA flag in the IA32_EFER MSR (bit 10) is a status bit that indicates whether the logical pro-
cessor is in IA-32e mode (and thus using IA-32e paging). The processor always sets
IA32_EFER.LMA to CR0.PG & IA32_EFER.LME. Software cannot directly modify IA32_EFER.LMA;
an execution of WRMSR to the IA32_EFER MSR ignores bit 10 of its source operand.