HARDWARE_PTE

The HARDWARE_PTE structure, including its early variants HARDWARE_PTE_X86 and HARDWARE_PTE_X86PAE, is Microsoft’s representation of a Page Table Entry (PTE) as described in Intel’s manuals. In Intel’s terminology, this structure applies only when the PTE has a set P bit (masked by 0x01) to denote that the corresponding page of linear address space has physical memory.

Introduction for Windows 2000 of separate kernels that do and don’t use Physical Page Extension (PAE) brought separate definitions for the HARDWARE_PTE. These were at first given separate names, HARDWARE_PTE_X86 for the four-byte PTE when not using PAE and HARDWARE_PTE_X86PAE for the eight-byte PTE when using PAE. This separation of names was discontinued by the version 5.1 from Windows XP SP1.

Names and types in the following tables are from public symbol files for the kernel, starting with Windows 2000 SP3. That these names were in use for at least one earlier version is confirmed from the output of the !dso command as implemented by the USEREXTS debugger extension from the Device Driver Kit (DDK) for Windows NT 4.0.

32-Bit PTE

For the x86 builds that do not use Physical Address Extension, page table entries are four bytes. The whole HARDWARE_PTE is a structure of ULONG bit fields:

ULONG Valid : 1;

ULONG Write : 1;

ULONG Owner : 1;

ULONG WriteThrough : 1;

ULONG CacheDisable : 1;

ULONG Accessed : 1;

ULONG Dirty : 1;

ULONG LargePage : 1;

ULONG Global : 1;

ULONG CopyOnWrite : 1;

ULONG Prototype : 1;

ULONG reserved : 1;

ULONG PageFrameNumber : 20;

The CopyOnWrite and Prototype bits are how Windows uses two of the three that Intel leaves as available. Note that Prototype is preserved in the various PTE interpretations that Microsoft applies when physical memory is not present.

64-Bit PTE

For 64-bit Windows but also for the x86 builds that use PAE, page table entries are eight bytes. The HARDWARE_PTE is a structure of ULONGLONG bit fields in 64-bit Windows. To the 32-bit PAE kernel, however, the HARDWARE_PTE is a union of two structures, one to define the bit fields, the other to provide for accessing bits together in 32-bit parts.

typedef union _HARDWARE_PTE {
    struct {
        /*  bit fields, see below  */
    };
    struct {
        ULONG LowPart;
        ULONG HighPart;
    };
} HARDWARE_PTE;

Bit Fields

The low 12 bits of the 64-bit PTE, whether for PAE and x64, match closely those of the 32-bit PTE:

ULONGLONG Valid : 1;

ULONGLONG Write : 1;

ULONGLONG Owner : 1;

ULONGLONG WriteThrough : 1;

ULONGLONG CacheDisable : 1;

ULONGLONG Accessed : 1;

ULONGLONG Dirty : 1;

ULONGLONG LargePage : 1;

ULONGLONG Global : 1;

ULONGLONG CopyOnWrite : 1;

ULONGLONG Prototype : 1;

ULONGLONG reserved0 : 1;

The remaining bits differ significantly, not just from the 32-bit PTE but between the PAE and x64 implementations:

ULONGLONG PageFrameNumber  : 24;

ULONGLONG PageFrameNumber : 26;

ULONGLONG reserved1 : 28;

ULONGLONG reserved1 : 26;

ULONGLONG reserved1 : 25;

ULONGLONG NoExecute : 1;

In the first PAE kernels, the PageFrameNumber can describe 16M pages, as if for 36 address lines and 64GB of physical memory. Version 5.1 raises this to 64M pages, as if for 38 address lines. This would allow 256GB of physical memory, even though 32-bit Windows cannot possibly support so much. (It has a long-standing architectural limit of 128GB caused by needing kernel-mode address space for an array of MMPFN structures, one per page of physical memory. At 0x1C bytes per MMPFN, even 128GB of physical memory requires 896MB for the MMPFN array when at most 1GB can be available.)

ULONGLONG PageFrameNumber : 28;

ULONGLONG PageFrameNumber : 36;

ULONGLONG reserved1 : 12;

ULONGLONG reserved1 : 4;

ULONGLONG SoftwareWsIndex : 11;

ULONGLONG NoExecute : 1;

The first 64-bit kernels provide for 256M pages, as if for 40 address lines and 1TB of physical memory. Raising this waited for the version 6.1 from Windows 7 SP1, whose widened PageFrameNumber allows 48 address lines and thus 256TB of physical memory. Note that the PageFrameNumber in the otherwise very close MMPTE_HARDWARE got this same widening in the version 6.0 from Windows Vista SP1. It is not known whether the lag in updating the HARDWARE_PTE had real-world consequence.

In the high dword, 64-bit Windows defines SoftwareWsIndex as using all 11 bits that Intel leaves as available if the processor is not using protection keys.

Note that for both the PAE and x64 kernels, the HARDWARE_PTE leaves unspecified that not all the bits of the PageFrameNumber are meaningful in a PTE for a large page. In a PTE for a 2MB page—or, if you prefer, a PDE for which LargePage is set—the lowest bit of the PageFrameNumber is Intel’s PAT and the next eight are reserved, i.e., must be zero. This applies also in 64-bit Windows to a PTE for a 1GB page, i.e., a PDPTE for which LargePage is set, except that nine more bits are reserved.