Go read the Intel application note "TLBs, Paging-Structure Caches, and Their
Invalidation" at http://www.intel.com/design/processor/applnots/317080.pdf
Section 8.1 explains about the PDPTR cache in 32-bit PAE mode, which can
only be refreshed by appropriate tickling of CR0, CR3 or CR4.
It is also important to note that *any* valid page directory entry at *any*
level in the page-table hierarchy can become cached at *any* time. Basically
TLB lookup is performed as a longest-prefix match on the linear address to
skip as many levels in a page-table walk as possible (where a walk is
needed, because there is no full-length match on the linear address). So, if
you modify a directory entry from present to not-present, or change the page
directory that a valid pde points to, you probably need to flush the pde
caching structure. One piece of good news is that all pde caches are flushed
by any arbitrary INVLPG.