Page-Table Entry Structure
What a PTE contains
Each page-table entry (PTE) maps one virtual page to either a physical frame or a “not present” marker. In 64-bit x86, a PTE is 8 bytes (64 bits). The fields:
| Bits | Name | Description |
|---|---|---|
| 0 | P (Present) | Page is in RAM. If 0, the rest of the PTE can be used by the OS for swap-metadata (e.g., disk location of the page). |
| 1 | R/W | Read/Write. 0 = read-only. Writes cause a page fault. |
| 2 | U/S | User/Supervisor. 0 = kernel-only page. User-mode accesses cause a page fault. |
| 3 | PWT | Page-Level Write-Through (caching mode). |
| 4 | PCD | Page-Level Cache Disable. |
| 5 | A (Accessed) | Set by hardware on any read or write to the page. The OS clears it periodically to detect which pages have been used (for page replacement). |
| 6 | D (Dirty) | Set by hardware on a write to the page. If a dirty page is evicted, its contents must be written to disk. Clean pages can be discarded (they match the disk copy). |
| 7 | PAT | Page Attribute Table — extends caching control. |
| 8 | G (Global) | If set, the TLB entry for this page is not flushed on a CR3 reload (used for kernel pages shared across all processes). |
| 9–11 | Ignored/Avail | Available for OS use (Linux stores swap metadata in non-present PTEs). |
| 12–51 | Physical Frame Address | The top 40 bits of the physical frame number. Since frames are 4 KB-aligned, the bottom 12 bits of the physical address are always zero and not stored. |
| 52–62 | Available/Reserved | OS or hardware-reserved. |
| 63 | NX (No-Execute) | If set, instruction fetches from this page cause a page fault. Prevents executing code injected into data/heap/stack regions (DEP/W^X). |
Present vs Not Present
When P = 0, the PTE is not present. The remaining 63 bits are available for OS use. Linux stores the swap-device and offset in these bits, so the page-fault handler knows exactly where on disk to find the page.
The MMU ignores non-present entries during normal execution but will fault on any access, invoking the kernel’s page-fault handler.
Accessed and Dirty bits in page replacement
The A and D bits are the hardware’s contribution to page-replacement algorithms:
- A = 0: the page has not been accessed since the OS last cleared the bit. It is a candidate for eviction.
- A = 1, D = 0: the page was read but not written. It matches its backing-store copy, so eviction does not require a disk write.
- A = 1, D = 1: the page was written. Eviction requires writing the page back to disk (or swap).
The CLOCK (second-chance) algorithm uses the A bit exclusively; the enhanced CLOCK algorithm uses both A and D to prioritise eviction candidates (clean idle pages first, dirty idle second, etc.).
NX bit and security
The NX (No-Execute) bit, also called XD (Execute Disable) by Intel, allows the MMU to enforce a non-executable stack and heap. Without NX, any writable page could also be executable — a prerequisite for classic buffer-overflow attacks where shellcode is injected onto the stack. NX + ASLR (Address Space Layout Randomisation) are the foundation of modern exploit mitigation.
Summary
- The PTE contains the frame number, permission bits, and flags for page replacement (A, D).
- When P = 0, the OS repurposes the PTE for swap metadata.
- The NX bit prevents execution from data pages, blocking whole classes of exploits.
- A and D bits are the minimal hardware support needed for reasonable page-replacement policies.