Intel® Architecture Instruction Set Extensions Programming Reference

ADDITIONAL NEW INSTRUCTIONS
• If CPL = 3 (an implicit supervisor access) or EFLAGS.AC = 0, data may be written to any linear address
with a valid translation for which the U/S flag (bit 2) is 0 in at least one of the paging-structure entries
controlling the translation.
— If CR0.WP = 1 and CR4.SMAP = 0, data may be written to any linear address with a valid translation for
which the R/W flag (bit 1) is 1 in every paging-structure entry controlling the translation.
— If CR0.WP = 1 and CR4.SMAP = 1, access rights depend on CPL and EFLAGS.AC.
• If CPL < 3 and EFLAGS.AC = 1, data may be written to any linear address with a valid translation for
which the R/W flag (bit 1) is 1 in every paging-structure entry controlling the translation.
• If CPL = 3 (an implicit supervisor access) or EFLAGS.AC = 0, data may be written to any linear address
with a valid translation for which the U/S flag (bit 2) is 0 in at least one of the paging-structure entries
controlling the translation and for which the R/W flag (bit 1) is 1 in every paging-structure entry
controlling the translation.
Supervisor-mode data accesses that are not allowed by SMAP cause page-fault exceptions (see Section 4). SMAP
has no effect on instruction fetches, user-mode data accesses, or supervisor-mode data accesses to supervisoronly
pages.
9.3.3 SMAP and Page-Fault Exceptions
If SMAP prevents a supervisor-mode access to a linear address, a page-fault exception (#PF) occurs.
SMAP does not define any new bits in the error code delivered by page-fault exceptions. Page-fault exceptions
induced by SMAP set the existing bits in the error code as follows:
• P flag (bit 0).
SMAP causes a page-fault exception only if there is a valid translation for the linear address. Bit 0 of the
error code is 1 if there is a valid translation. Thus, page-fault exceptions caused by SMAP always set bit 0 of
the error code.
• W/R (bit 1).
If the access causing the page-fault exception was a write, this flag is 1; otherwise, it is 0.
• U/S (bit 2).
SMAP causes page-fault exceptions only for supervisor-mode accesses. Bit 2 of the error code is 0 for
supervisor-mode accesses. Thus, page-fault exceptions caused by SMAP always clear bit 2 of the error code.
• RSVD flag (bit 3).
SMAP causes a page-fault exception only if there is a valid translation for the linear address. Bit 3 of the
error code is 0 if there is a valid translation. Thus, page-fault exceptions caused by SMAP always clear bit 3
of the error code.
• I/D flag (bit 4).
SMAP causes page-fault exceptions only for data accesses. Bit 4 of the error code is 0 for data accesses.
Thus, page-fault exceptions caused by SMAP always clear bit 4 of the error code.
The above items imply that the error code delivered by a page-fault exception due to SMAP is either 1 (for reads)
or 3 (for writes). Note that the only page-fault exceptions that deliver an error code of 1 are those induced by
SMAP. (If CR0.WP = 1, some page-fault exceptions may deliver an error code of 3 even if CR4.SMAP = 0.)
9.3.4 CR4.SMAP and Cached Translation Information
The MOV to CR4 instruction is not required to invalidate the TLBs or paging-structure caches because of changes
being made to CR4.SMAP. If PAE paging is in use, the MOV to CR4 instruction does not cause the PDPTE registers
to be reloaded because of changes being made to CR4.SMAP.
9-4 Ref. # 319433-014