1.. SPDX-License-Identifier: GPL-2.0
2
3=================
4Memory Management
5=================
6
7Complete virtual memory map with 4-level page tables
8====================================================
9
10.. note::
11
12 - Negative addresses such as "-23 TB" are absolute addresses in bytes, counted down
13   from the top of the 64-bit address space. It's easier to understand the layout
14   when seen both in absolute addresses and in distance-from-top notation.
15
16   For example 0xffffe90000000000 == -23 TB, it's 23 TB lower than the top of the
17   64-bit address space (ffffffffffffffff).
18
19   Note that as we get closer to the top of the address space, the notation changes
20   from TB to GB and then MB/KB.
21
22 - "16M TB" might look weird at first sight, but it's an easier way to visualize size
23   notation than "16 EB", which few will recognize at first sight as 16 exabytes.
24   It also shows it nicely how incredibly large 64-bit address space is.
25
26::
27
28  ========================================================================================================================
29      Start addr    |   Offset   |     End addr     |  Size   | VM area description
30  ========================================================================================================================
31                    |            |                  |         |
32   0000000000000000 |    0       | 00007fffffffffff |  128 TB | user-space virtual memory, different per mm
33  __________________|____________|__________________|_________|___________________________________________________________
34                    |            |                  |         |
35   0000800000000000 | +128    TB | ffff7fffffffffff | ~16M TB | ... huge, almost 64 bits wide hole of non-canonical
36                    |            |                  |         |     virtual memory addresses up to the -128 TB
37                    |            |                  |         |     starting offset of kernel mappings.
38  __________________|____________|__________________|_________|___________________________________________________________
39                                                              |
40                                                              | Kernel-space virtual memory, shared between all processes:
41  ____________________________________________________________|___________________________________________________________
42                    |            |                  |         |
43   ffff800000000000 | -128    TB | ffff87ffffffffff |    8 TB | ... guard hole, also reserved for hypervisor
44   ffff880000000000 | -120    TB | ffff887fffffffff |  0.5 TB | LDT remap for PTI
45   ffff888000000000 | -119.5  TB | ffffc87fffffffff |   64 TB | direct mapping of all physical memory (page_offset_base)
46   ffffc88000000000 |  -55.5  TB | ffffc8ffffffffff |  0.5 TB | ... unused hole
47   ffffc90000000000 |  -55    TB | ffffe8ffffffffff |   32 TB | vmalloc/ioremap space (vmalloc_base)
48   ffffe90000000000 |  -23    TB | ffffe9ffffffffff |    1 TB | ... unused hole
49   ffffea0000000000 |  -22    TB | ffffeaffffffffff |    1 TB | virtual memory map (vmemmap_base)
50   ffffeb0000000000 |  -21    TB | ffffebffffffffff |    1 TB | ... unused hole
51   ffffec0000000000 |  -20    TB | fffffbffffffffff |   16 TB | KASAN shadow memory
52  __________________|____________|__________________|_________|____________________________________________________________
53                                                              |
54                                                              | Identical layout to the 56-bit one from here on:
55  ____________________________________________________________|____________________________________________________________
56                    |            |                  |         |
57   fffffc0000000000 |   -4    TB | fffffdffffffffff |    2 TB | ... unused hole
58                    |            |                  |         | vaddr_end for KASLR
59   fffffe0000000000 |   -2    TB | fffffe7fffffffff |  0.5 TB | cpu_entry_area mapping
60   fffffe8000000000 |   -1.5  TB | fffffeffffffffff |  0.5 TB | ... unused hole
61   ffffff0000000000 |   -1    TB | ffffff7fffffffff |  0.5 TB | %esp fixup stacks
62   ffffff8000000000 | -512    GB | ffffffeeffffffff |  444 GB | ... unused hole
63   ffffffef00000000 |  -68    GB | fffffffeffffffff |   64 GB | EFI region mapping space
64   ffffffff00000000 |   -4    GB | ffffffff7fffffff |    2 GB | ... unused hole
65   ffffffff80000000 |   -2    GB | ffffffff9fffffff |  512 MB | kernel text mapping, mapped to physical address 0
66   ffffffff80000000 |-2048    MB |                  |         |
67   ffffffffa0000000 |-1536    MB | fffffffffeffffff | 1520 MB | module mapping space
68   ffffffffff000000 |  -16    MB |                  |         |
69      FIXADDR_START | ~-11    MB | ffffffffff5fffff | ~0.5 MB | kernel-internal fixmap range, variable size and offset
70   ffffffffff600000 |  -10    MB | ffffffffff600fff |    4 kB | legacy vsyscall ABI
71   ffffffffffe00000 |   -2    MB | ffffffffffffffff |    2 MB | ... unused hole
72  __________________|____________|__________________|_________|___________________________________________________________
73
74
75Complete virtual memory map with 5-level page tables
76====================================================
77
78.. note::
79
80 - With 56-bit addresses, user-space memory gets expanded by a factor of 512x,
81   from 0.125 PB to 64 PB. All kernel mappings shift down to the -64 PB starting
82   offset and many of the regions expand to support the much larger physical
83   memory supported.
84
85::
86
87  ========================================================================================================================
88      Start addr    |   Offset   |     End addr     |  Size   | VM area description
89  ========================================================================================================================
90                    |            |                  |         |
91   0000000000000000 |    0       | 00ffffffffffffff |   64 PB | user-space virtual memory, different per mm
92  __________________|____________|__________________|_________|___________________________________________________________
93                    |            |                  |         |
94   0100000000000000 |  +64    PB | feffffffffffffff | ~16K PB | ... huge, still almost 64 bits wide hole of non-canonical
95                    |            |                  |         |     virtual memory addresses up to the -64 PB
96                    |            |                  |         |     starting offset of kernel mappings.
97  __________________|____________|__________________|_________|___________________________________________________________
98                                                              |
99                                                              | Kernel-space virtual memory, shared between all processes:
100  ____________________________________________________________|___________________________________________________________
101                    |            |                  |         |
102   ff00000000000000 |  -64    PB | ff0fffffffffffff |    4 PB | ... guard hole, also reserved for hypervisor
103   ff10000000000000 |  -60    PB | ff10ffffffffffff | 0.25 PB | LDT remap for PTI
104   ff11000000000000 |  -59.75 PB | ff90ffffffffffff |   32 PB | direct mapping of all physical memory (page_offset_base)
105   ff91000000000000 |  -27.75 PB | ff9fffffffffffff | 3.75 PB | ... unused hole
106   ffa0000000000000 |  -24    PB | ffd1ffffffffffff | 12.5 PB | vmalloc/ioremap space (vmalloc_base)
107   ffd2000000000000 |  -11.5  PB | ffd3ffffffffffff |  0.5 PB | ... unused hole
108   ffd4000000000000 |  -11    PB | ffd5ffffffffffff |  0.5 PB | virtual memory map (vmemmap_base)
109   ffd6000000000000 |  -10.5  PB | ffdeffffffffffff | 2.25 PB | ... unused hole
110   ffdf000000000000 |   -8.25 PB | fffffbffffffffff |   ~8 PB | KASAN shadow memory
111  __________________|____________|__________________|_________|____________________________________________________________
112                                                              |
113                                                              | Identical layout to the 47-bit one from here on:
114  ____________________________________________________________|____________________________________________________________
115                    |            |                  |         |
116   fffffc0000000000 |   -4    TB | fffffdffffffffff |    2 TB | ... unused hole
117                    |            |                  |         | vaddr_end for KASLR
118   fffffe0000000000 |   -2    TB | fffffe7fffffffff |  0.5 TB | cpu_entry_area mapping
119   fffffe8000000000 |   -1.5  TB | fffffeffffffffff |  0.5 TB | ... unused hole
120   ffffff0000000000 |   -1    TB | ffffff7fffffffff |  0.5 TB | %esp fixup stacks
121   ffffff8000000000 | -512    GB | ffffffeeffffffff |  444 GB | ... unused hole
122   ffffffef00000000 |  -68    GB | fffffffeffffffff |   64 GB | EFI region mapping space
123   ffffffff00000000 |   -4    GB | ffffffff7fffffff |    2 GB | ... unused hole
124   ffffffff80000000 |   -2    GB | ffffffff9fffffff |  512 MB | kernel text mapping, mapped to physical address 0
125   ffffffff80000000 |-2048    MB |                  |         |
126   ffffffffa0000000 |-1536    MB | fffffffffeffffff | 1520 MB | module mapping space
127   ffffffffff000000 |  -16    MB |                  |         |
128      FIXADDR_START | ~-11    MB | ffffffffff5fffff | ~0.5 MB | kernel-internal fixmap range, variable size and offset
129   ffffffffff600000 |  -10    MB | ffffffffff600fff |    4 kB | legacy vsyscall ABI
130   ffffffffffe00000 |   -2    MB | ffffffffffffffff |    2 MB | ... unused hole
131  __________________|____________|__________________|_________|___________________________________________________________
132
133Architecture defines a 64-bit virtual address. Implementations can support
134less. Currently supported are 48- and 57-bit virtual addresses. Bits 63
135through to the most-significant implemented bit are sign extended.
136This causes hole between user space and kernel addresses if you interpret them
137as unsigned.
138
139The direct mapping covers all memory in the system up to the highest
140memory address (this means in some cases it can also include PCI memory
141holes).
142
143We map EFI runtime services in the 'efi_pgd' PGD in a 64GB large virtual
144memory window (this size is arbitrary, it can be raised later if needed).
145The mappings are not part of any other kernel PGD and are only available
146during EFI runtime calls.
147
148Note that if CONFIG_RANDOMIZE_MEMORY is enabled, the direct mapping of all
149physical memory, vmalloc/ioremap space and virtual memory map are randomized.
150Their order is preserved but their base will be offset early at boot time.
151
152Be very careful vs. KASLR when changing anything here. The KASLR address
153range must not overlap with anything except the KASAN shadow area, which is
154correct as KASAN disables KASLR.
155
156For both 4- and 5-level layouts, the STACKLEAK_POISON value in the last 2MB
157hole: ffffffffffff4111
158