Physical Address Extension (PAE)

This blog post is going to explain the fundamentals and the internals of Physical Address Extension (PAE) on Windows.

Physical Address Extension

PAE Mode enables x86 operating systems to be to address up to 64GB of Physical Memory (x86 processors), and 1,024GB on x64 when the processor is running in Legacy Mode, which is the same as running in x86 Protected Mode. The PDEs and PTEs are extended to 64-bits wide, and a extra layer is added called the Page Directory Pointer Table. The CR3 then points to the address of the this table instead of the Page Directory.

We can check if a system has the PAE bit enabled by checking bit 5 within he CR4 Register. According to my dump file, my system has the PAE bit set. However, due to licensing restrictions set by Microsoft, my operating system will still not address any larger than 4GB of RAM due to compatibility issues with drivers.

Additionally, when PAE has been enabled for x64 processors, then other features are also automatically enabled such as Data Execution Protection (DEP), hot-swappable memory and the support of NUMA (Non Uniform Access Memory). 

Address Windowing Extension

Furthermore, some processes can still support more than the 2GB addressing limit with the AWE (Address Windowing Extension) setting. 

AWE works by allocating the physical memory wished to be used, and then map these views of physical memory into the allocated virtual address space for the process as shown in the above diagram. It's also important to understand, that physical pages and and virtual memory ranges allocated by AWE can not be shared and therefore inherited by other processes. AWE allocated address ranges are always read and write, and so protection bits will not apply to these pages. 

All memory allocated with AWE is non-paged pool. Since, AWE allocated memory must be freed as one unit of memory, then the MEM_RELEASE flag must be specified by using the VirtualFree API function. These pages will then be in the Free page state.

Setting PAE and Checking PAE Support

I've developed a very simple tool using the Win32 API, to check if your processor supports PAE. Please be aware that by default, x64 processors will always return a non-zero (true). The code is available below:

If you have DEP set, then PAE can't be disabled. You must disable DEP but disabling PAE. This can be achieved by editing the Boot Configuration Data through the use of Command Prompt.

 

We can enable PAE with the AlwaysEnable flag instead, or the AlwaysOn flag with DEP.

Additional Reading:



Address Windowing Extensions

BCDEdit /set