158 lines · plain
1.. SPDX-License-Identifier: GPL-2.02 3=================4Memory Management5=================6 7Complete virtual memory map with 4-level page tables8====================================================9 10.. note::11 12 - Negative addresses such as "-23 TB" are absolute addresses in bytes, counted down13 from the top of the 64-bit address space. It's easier to understand the layout14 when seen both in absolute addresses and in distance-from-top notation.15 16 For example 0xffffe90000000000 == -23 TB, it's 23 TB lower than the top of the17 64-bit address space (ffffffffffffffff).18 19 Note that as we get closer to the top of the address space, the notation changes20 from TB to GB and then MB/KB.21 22 - "16M TB" might look weird at first sight, but it's an easier way to visualize size23 notation than "16 EB", which few will recognize at first sight as 16 exabytes.24 It also shows it nicely how incredibly large 64-bit address space is.25 26::27 28 ========================================================================================================================29 Start addr | Offset | End addr | Size | VM area description30 ========================================================================================================================31 | | | |32 0000000000000000 | 0 | 00007fffffffffff | 128 TB | user-space virtual memory, different per mm33 __________________|____________|__________________|_________|___________________________________________________________34 | | | |35 0000800000000000 | +128 TB | ffff7fffffffffff | ~16M TB | ... huge, almost 64 bits wide hole of non-canonical36 | | | | virtual memory addresses up to the -128 TB37 | | | | starting offset of kernel mappings.38 __________________|____________|__________________|_________|___________________________________________________________39 |40 | Kernel-space virtual memory, shared between all processes:41 ____________________________________________________________|___________________________________________________________42 | | | |43 ffff800000000000 | -128 TB | ffff87ffffffffff | 8 TB | ... guard hole, also reserved for hypervisor44 ffff880000000000 | -120 TB | ffff887fffffffff | 0.5 TB | LDT remap for PTI45 ffff888000000000 | -119.5 TB | ffffc87fffffffff | 64 TB | direct mapping of all physical memory (page_offset_base)46 ffffc88000000000 | -55.5 TB | ffffc8ffffffffff | 0.5 TB | ... unused hole47 ffffc90000000000 | -55 TB | ffffe8ffffffffff | 32 TB | vmalloc/ioremap space (vmalloc_base)48 ffffe90000000000 | -23 TB | ffffe9ffffffffff | 1 TB | ... unused hole49 ffffea0000000000 | -22 TB | ffffeaffffffffff | 1 TB | virtual memory map (vmemmap_base)50 ffffeb0000000000 | -21 TB | ffffebffffffffff | 1 TB | ... unused hole51 ffffec0000000000 | -20 TB | fffffbffffffffff | 16 TB | KASAN shadow memory52 __________________|____________|__________________|_________|____________________________________________________________53 |54 | Identical layout to the 56-bit one from here on:55 ____________________________________________________________|____________________________________________________________56 | | | |57 fffffc0000000000 | -4 TB | fffffdffffffffff | 2 TB | ... unused hole58 | | | | vaddr_end for KASLR59 fffffe0000000000 | -2 TB | fffffe7fffffffff | 0.5 TB | cpu_entry_area mapping60 fffffe8000000000 | -1.5 TB | fffffeffffffffff | 0.5 TB | ... unused hole61 ffffff0000000000 | -1 TB | ffffff7fffffffff | 0.5 TB | %esp fixup stacks62 ffffff8000000000 | -512 GB | ffffffeeffffffff | 444 GB | ... unused hole63 ffffffef00000000 | -68 GB | fffffffeffffffff | 64 GB | EFI region mapping space64 ffffffff00000000 | -4 GB | ffffffff7fffffff | 2 GB | ... unused hole65 ffffffff80000000 | -2 GB | ffffffff9fffffff | 512 MB | kernel text mapping, mapped to physical address 066 ffffffff80000000 |-2048 MB | | |67 ffffffffa0000000 |-1536 MB | fffffffffeffffff | 1520 MB | module mapping space68 ffffffffff000000 | -16 MB | | |69 FIXADDR_START | ~-11 MB | ffffffffff5fffff | ~0.5 MB | kernel-internal fixmap range, variable size and offset70 ffffffffff600000 | -10 MB | ffffffffff600fff | 4 kB | legacy vsyscall ABI71 ffffffffffe00000 | -2 MB | ffffffffffffffff | 2 MB | ... unused hole72 __________________|____________|__________________|_________|___________________________________________________________73 74 75Complete virtual memory map with 5-level page tables76====================================================77 78.. note::79 80 - With 56-bit addresses, user-space memory gets expanded by a factor of 512x,81 from 0.125 PB to 64 PB. All kernel mappings shift down to the -64 PB starting82 offset and many of the regions expand to support the much larger physical83 memory supported.84 85::86 87 ========================================================================================================================88 Start addr | Offset | End addr | Size | VM area description89 ========================================================================================================================90 | | | |91 0000000000000000 | 0 | 00ffffffffffffff | 64 PB | user-space virtual memory, different per mm92 __________________|____________|__________________|_________|___________________________________________________________93 | | | |94 0100000000000000 | +64 PB | feffffffffffffff | ~16K PB | ... huge, still almost 64 bits wide hole of non-canonical95 | | | | virtual memory addresses up to the -64 PB96 | | | | starting offset of kernel mappings.97 __________________|____________|__________________|_________|___________________________________________________________98 |99 | Kernel-space virtual memory, shared between all processes:100 ____________________________________________________________|___________________________________________________________101 | | | |102 ff00000000000000 | -64 PB | ff0fffffffffffff | 4 PB | ... guard hole, also reserved for hypervisor103 ff10000000000000 | -60 PB | ff10ffffffffffff | 0.25 PB | LDT remap for PTI104 ff11000000000000 | -59.75 PB | ff90ffffffffffff | 32 PB | direct mapping of all physical memory (page_offset_base)105 ff91000000000000 | -27.75 PB | ff9fffffffffffff | 3.75 PB | ... unused hole106 ffa0000000000000 | -24 PB | ffd1ffffffffffff | 12.5 PB | vmalloc/ioremap space (vmalloc_base)107 ffd2000000000000 | -11.5 PB | ffd3ffffffffffff | 0.5 PB | ... unused hole108 ffd4000000000000 | -11 PB | ffd5ffffffffffff | 0.5 PB | virtual memory map (vmemmap_base)109 ffd6000000000000 | -10.5 PB | ffdeffffffffffff | 2.25 PB | ... unused hole110 ffdf000000000000 | -8.25 PB | fffffbffffffffff | ~8 PB | KASAN shadow memory111 __________________|____________|__________________|_________|____________________________________________________________112 |113 | Identical layout to the 47-bit one from here on:114 ____________________________________________________________|____________________________________________________________115 | | | |116 fffffc0000000000 | -4 TB | fffffdffffffffff | 2 TB | ... unused hole117 | | | | vaddr_end for KASLR118 fffffe0000000000 | -2 TB | fffffe7fffffffff | 0.5 TB | cpu_entry_area mapping119 fffffe8000000000 | -1.5 TB | fffffeffffffffff | 0.5 TB | ... unused hole120 ffffff0000000000 | -1 TB | ffffff7fffffffff | 0.5 TB | %esp fixup stacks121 ffffff8000000000 | -512 GB | ffffffeeffffffff | 444 GB | ... unused hole122 ffffffef00000000 | -68 GB | fffffffeffffffff | 64 GB | EFI region mapping space123 ffffffff00000000 | -4 GB | ffffffff7fffffff | 2 GB | ... unused hole124 ffffffff80000000 | -2 GB | ffffffff9fffffff | 512 MB | kernel text mapping, mapped to physical address 0125 ffffffff80000000 |-2048 MB | | |126 ffffffffa0000000 |-1536 MB | fffffffffeffffff | 1520 MB | module mapping space127 ffffffffff000000 | -16 MB | | |128 FIXADDR_START | ~-11 MB | ffffffffff5fffff | ~0.5 MB | kernel-internal fixmap range, variable size and offset129 ffffffffff600000 | -10 MB | ffffffffff600fff | 4 kB | legacy vsyscall ABI130 ffffffffffe00000 | -2 MB | ffffffffffffffff | 2 MB | ... unused hole131 __________________|____________|__________________|_________|___________________________________________________________132 133Architecture defines a 64-bit virtual address. Implementations can support134less. Currently supported are 48- and 57-bit virtual addresses. Bits 63135through to the most-significant implemented bit are sign extended.136This causes hole between user space and kernel addresses if you interpret them137as unsigned.138 139The direct mapping covers all memory in the system up to the highest140memory address (this means in some cases it can also include PCI memory141holes).142 143We map EFI runtime services in the 'efi_pgd' PGD in a 64GB large virtual144memory window (this size is arbitrary, it can be raised later if needed).145The mappings are not part of any other kernel PGD and are only available146during EFI runtime calls.147 148Note that if CONFIG_RANDOMIZE_MEMORY is enabled, the direct mapping of all149physical memory, vmalloc/ioremap space and virtual memory map are randomized.150Their order is preserved but their base will be offset early at boot time.151 152Be very careful vs. KASLR when changing anything here. The KASLR address153range must not overlap with anything except the KASAN shadow area, which is154correct as KASAN disables KASLR.155 156For both 4- and 5-level layouts, the STACKLEAK_POISON value in the last 2MB157hole: ffffffffffff4111158