Vol. 3 4-5
PAGING
• Software can always disable paging by clearing CR0.PG with MOV to CR0.
• Software can make transitions between 32-bit paging and PAE paging by
changing the value of CR4.PAE with MOV to CR4.
• Software cannot make transitions directly between IA-32e paging and either of
the other two paging modes. It must first disable paging (by clearing CR0.PG with
MOV to CR0), then set CR4.PAE and IA32_EFER.LME to the desired values (with
MOV to CR4 and WRMSR), and then re-enable paging (by setting CR0.PG with
MOV to CR0). As noted earlier, an attempt to clear either CR4.PAE or
IA32_EFER.LME cause a general-protection exception (#GP(0)).
• VMX transitions allow transitions between paging modes that are not possible
using MOV to CR or WRMSR. This is because VMX transitions can load CR0, CR4,
and IA32_EFER in one operation. See Section 4.11.1.
4.1.3 Paging-Mode Modifiers
Details of how each paging mode operates are determined by the following control
bits:
• The WP flag in CR0 (bit 16).
• The PSE and PGE flags in CR4 (bit 4 and bit 7, respectively).
• The NXE flag in the IA32_EFER MSR (bit 11).
CR0.WP allows pages to be protected from supervisor-mode writes. If CR0.WP = 0,
software operating with CPL < 3 (supervisor mode) can write to linear addresses with
read-only access rights; if CR0.WP = 1, it cannot. (Software operating with CPL = 3
— user mode — cannot write to linear addresses with read-only access rights,
regardless of the value of CR0.WP.) Section 4.6 explains how access rights are deter-
mined.
CR4.PSE enables 4-MByte pages for 32-bit paging. If CR4.PSE = 0, 32-bit paging can
use only 4-KByte pages; if CR4.PSE = 1, 32-bit paging can use both 4-KByte pages
and 4-MByte pages. See Section 4.3 for more information. (PAE paging and IA-32e
paging can use multiple page sizes regardless of the value of CR4.PSE.)
CR4.PGE enables global pages. If CR4.PGE = 0, no translations are shared across
address spaces; if CR4.PGE = 1, specified translations may be shared across address
spaces. See Section 4.10.1.4 for more information.
IA32_EFER.NXE enables execute-disable access rights for PAE paging and IA-32e
paging. If IA32_EFER.NXE = 0, software may fetch instructions from any linear
address that paging allows the software to read; if IA32_EFER.NXE = 1, instructions
fetches can be prevented from specified linear addresses (even if data reads from the
addresses are allowed). Section 4.6 explains how access rights are determined. (32-
bit paging always allows software to fetch instructions from any linear address that
may be read; IA32_EFER.NXE has no effect with 32-bit paging. Software that wants
to limit instruction fetches from readable pages must use either PAE paging or IA-32e
paging.)