Geoff Chappell - Software Analyst
The pae option specifies whether to use the Physical Address Extension feature.
To have the BCDEDIT tool set the pae option for the currently running operating system, run the command
bcdedit /set pae value
where value is either a decimal number from the first column of the following table or a string from the second:
| 0 | Default | |
| 1 | ForceEnable | /PAE |
| 2 | ForceDisable | /NOPAE |
The third column shows the command-line switch that is shown for this option at the Edit Boot Options Menu. This is also the syntax for the option as a BOOT.INI switch in earlier Windows versions. See the details below for constraints on changing the option at the menu.
PAE, meaning Physical Address Extension, is a processor feature that enables use of 64-bit page table entries for physical addresses that are wider than 32 bits. Support for PAE is established by executing the CPUID instruction with 1 in EAX and testing for the PAE bit (0x40) in the feature flags that are returned in EDX.
Support for PAE is a prerequisite for another CPU feature which Intel names Execute Disable and Microsoft calls Data Execution Prevention (DEP). Support for DEP is established by executing the CPUID instruction with 0x80000001 in EAX and testing for the Execute Disable bit (0x00100000) in the feature flags that are returned in EDX.
Windows enables PAE unless all the following are true:
Of particular interest is the meaning of each pae value for modern machines that support both features:
| Default or ForceEnable | enable PAE |
| ForceDisable | disable PAE if nx is
AlwaysOff; else enable PAE |
| absent | disable PAE if nx is
AlwaysOff and PAE is not needed for hot-add memory above 4GB; else enable PAE |
Note that ForceDisable does not necessarily disable PAE and that setting pae to Default is not the same as leaving pae to be defaulted.
The question of whether to enable PAE is decided very early by the loader in order to configure its own memory management. Although the ForceEnable and ForceDisable values of the pae option are reported in the Edit Boot Options Menu, as /PAE and /NOPAE respectively, and can be edited or added, changes made at this menu are too late to be acted on and are not respected.
The loader expects different kernels for when PAE is and isn’t enabled. The default name for the kernel is NTKRNLPA.EXE when PAE is enabled, else NTOSKRNL.EXE, but note that the default can (usually) be overridden by the kernel option. Whatever the name, the loader insists that the PAE kernel has the IMAGE_FILE_LARGE_ADDRESS_AWARE (0x0020) bit set in the Characteristics field of its IMAGE_FILE_HEADER, and that the ordinary kernel has this same bit cleared. A mismatch is fatal to starting Windows.