Physical Address Extension

PAE was first implemented in the Intel Pentium Pro in 1995,[3] although the accompanying chipsets usually lacked support for the required extra address bits.[4]

PAE is supported by the Pentium Pro, Pentium II, Pentium III, and Pentium 4 processors. The first Pentium M family processors ("Banias") introduced in 2003 also support PAE; however, they do not show the PAE support flag in their CPUID information.[5] This was remedied in a later revision of the "Dothan" core in 2005. It was also available on AMD processors including the AMD Athlon[6][7] (although the chipsets are limited to 32-bit addressing[8]) and later AMD processor models.

When AMD defined their 64-bit extension of the industry standard x86 architecture, AMD64 or x86-64, they also enhanced the paging system in "long mode" based on PAE.[9] It supports 64-bit virtual addresses[10]^: 24 (as of July 2023, 48 bits are implemented on some processors and 57 bits are implemented on others[10]^{: 139, 141–143}[11]), 52-bit physical addresses,[10]^: 24 and includes NX bit functionality. When the x86-64 processor is initialized, the PAE feature is required to be enabled before the processor is switched from Legacy Mode to Long Mode.[9]

With PAE, the page table entry of the x86 architecture is enlarged from 32 to 64 bits. This allows more room for the physical page address, or "page frame number" field, in the page table entry. In the initial implementations of PAE the page frame number field was expanded from 20 to 24 bits. The size of the "byte offset" from the address being translated is still 12 bits, so total physical address size increases from 32 bits to 36 bits (i.e. from 20+12 to 24+12). This increased the physical memory that is theoretically addressable by the CPU from 4 GB to 64 GB.

In the first processors that supported PAE, support for larger physical addresses is evident in their package pinout, with address pin designations going up to A35 instead of stopping at A31.[12] Later processor families use interconnects such as Hypertransport or QuickPath Interconnect, which lack dedicated memory address signals, so this relationship is less apparent.

The 32-bit size of the virtual address is not changed, so regular application software continues to use instructions with 32-bit addresses and (in a flat memory model) is limited to 4 gigabytes of virtual address space. Operating systems supporting this mode use page tables to map the regular 4 GB virtual address space into the physical memory, which, depending on the operating system and the rest of the hardware platform, may be as big as 64 GB. The mapping is typically applied separately for each process, so that the additional RAM is useful even though no single process can access it all simultaneously.

Later work associated with AMD's development of x86-64 architecture expanded the theoretical possible size of physical addresses to 52 bits.[10]^: 24

In protected mode with paging enabled (bit 31, PG, of control register CR0 is set), but without PAE, x86 processors use a two-level page translation scheme. Control register CR3 holds the page-aligned physical address of a single 4 KB long page directory. This is divided into 1024 four-byte page directory entries that in turn, if valid, hold the page-aligned physical addresses of page tables, each 4 KB in size. These similarly consist of 1024 four-byte page table entries which, if valid, hold the page-aligned physical addresses of 4 KB long pages of physical memory (RAM).

Enabling PAE (by setting bit 5, PAE, of the system register CR4) causes major changes to this scheme. By default, the size of each page remains as 4 KB. Each entry in the page table and page directory becomes 64 bits long (8 bytes), instead of 32 bits, to allow for additional address bits. However, the size of each table does not change, so both table and directory now have only 512 entries. Because this allows only one half of the entries of the original scheme, an extra level of hierarchy has been added, so CR3 now points physically to a Page Directory Pointer Table, a short table containing four pointers to page directories.

Supporting 64 bit addresses in the page-table is a significant change as this enables two changes to the processor addressing. Firstly, the page table walker, which uses physical addresses to access the page table and directory, can now access physical addresses greater than the 32-bit physical addresses (no PAE system). From the CR3, the page table walker can access page directories and tables that are beyond the 32-bit range. Secondly, the physical address for the data that is being accessed (stored in the page table) can be represented as a physical address that is greater than the 32-bit address (no PAE system). Again, this allows data accesses to access physical memory regions beyond the 32-bit range.

The entries in the page directory have an additional flag in bit 7, named PS (for page size). If the system has set this bit to 1, the page directory entry does not point to a page table but to a single, large 2 MB page (Page Size Extension).

In all page table formats supported by x86 and x86-64, the 12 least significant bits of the page table entry are either interpreted by the memory management unit or are reserved for operating system use. In processors that implement the "no-execute" or "execution disable" feature, the most significant bit (bit 63) is the NX bit. The next eleven most significant bits (bits 52 through 62) are reserved for operating system use by both Intel and AMD's architecture specifications. Thus, from 64 bits in the page table entry, 12 low-order and 12 high-order bits have other uses, leaving 40 bits (bits 12 though 51) for the physical page number. Combined with 12 bits of "offset within page" from the linear address, a maximum of 52 bits are available to address physical memory. This allows a maximum RAM configuration of 2⁵² bytes, or 4 petabytes (about 4.5×10¹⁵ bytes).

On x86-64 processors in native long mode, the address translation scheme uses PAE but adds a fourth table, the 512-entry page-map level 4 table, and extends the page directory pointer table to 512 entries instead of the original 4 entries it has in protected mode. This means that 48 bits of virtual page number are translated, giving a virtual address space of up to 256 TB. For some processors, a mode can be enabled with a fifth table, the 512-entry page-map level 5 table; this means that 57 bits of virtual page number are translated, giving a virtual address space of up to 128 PB.[10]^{: 141–153} In the page table entries, in the original specification, 40 bits of physical page number are implemented.

• Page table structures
• 
  No PAE, 4 KB pages
• 
  No PAE, 4 MB pages
• 
  With PAE; 4 KB pages
• 
  With PAE; 2 MB pages

Software can identify via the CPUID flag PAE whether a CPU supports PAE mode or not. A free-of-charge program for Microsoft Windows is available which will list many processor capabilities, including PAE support.[13] In Linux, commands such as cat /proc/cpuinfo can list the pae flag when present,[14] as well as other tools such as the SYSLINUX Hardware Detection Tool.

To run the processor in PAE mode, operating system support is required. To use PAE to access more than 4 GB of RAM, further support is required in the operating system, in the chipset, and on the motherboard. Some chipsets do not support physical memory addresses above 4 GB (FFFFFFFF in hexadecimal), and some motherboards simply do not have enough RAM sockets to allow the installation of more than 4 GB of RAM. Nevertheless, even if no more than 4 GB of RAM is available and accessible, a PAE-capable CPU may be run in PAE mode, for example to allow use of the No execute feature.

• Page Size Extension
• PCI hole
• PSE-36
• Architecture of Windows NT
• 3 GB barrier
• Large Physical Address Extension (LPAE) – in the ARM architecture
• Intel 5-level paging

• "Intel 64 and IA-32 Architectures Software Developer's Manual, Volume 3A: System Programming Guide, Part 1". Intel. 11 February 2014.
• "Physical Address Extension". Microsoft Docs. 7 January 2021. Retrieved 2023-07-11.