memory.rst 7.7 KB

123456789101112131415161718192021222324252627282930313233343536373839404142434445464748495051525354555657585960616263646566676869707172737475767778798081828384858687888990919293949596979899100101102103104105106107108109110111112113114115116117118119120121122123124125126127128129130131132133134135136137138139140141142143144145146147148149150151152153154155156157158159160161162163164165166167168169170171172
  1. ==============================
  2. Memory Layout on AArch64 Linux
  3. ==============================
  4. Author: Catalin Marinas <catalin.marinas@arm.com>
  5. This document describes the virtual memory layout used by the AArch64
  6. Linux kernel. The architecture allows up to 4 levels of translation
  7. tables with a 4KB page size and up to 3 levels with a 64KB page size.
  8. AArch64 Linux uses either 3 levels or 4 levels of translation tables
  9. with the 4KB page configuration, allowing 39-bit (512GB) or 48-bit
  10. (256TB) virtual addresses, respectively, for both user and kernel. With
  11. 64KB pages, only 2 levels of translation tables, allowing 42-bit (4TB)
  12. virtual address, are used but the memory layout is the same.
  13. ARMv8.2 adds optional support for Large Virtual Address space. This is
  14. only available when running with a 64KB page size and expands the
  15. number of descriptors in the first level of translation.
  16. User addresses have bits 63:48 set to 0 while the kernel addresses have
  17. the same bits set to 1. TTBRx selection is given by bit 63 of the
  18. virtual address. The swapper_pg_dir contains only kernel (global)
  19. mappings while the user pgd contains only user (non-global) mappings.
  20. The swapper_pg_dir address is written to TTBR1 and never written to
  21. TTBR0.
  22. AArch64 Linux memory layout with 4KB pages + 4 levels (48-bit)::
  23. Start End Size Use
  24. -----------------------------------------------------------------------
  25. 0000000000000000 0000ffffffffffff 256TB user
  26. ffff000000000000 ffff7fffffffffff 128TB kernel logical memory map
  27. ffff800000000000 ffff9fffffffffff 32TB kasan shadow region
  28. ffffa00000000000 ffffa00007ffffff 128MB bpf jit region
  29. ffffa00008000000 ffffa0000fffffff 128MB modules
  30. ffffa00010000000 fffffdffbffeffff ~93TB vmalloc
  31. fffffdffbfff0000 fffffdfffe5f8fff ~998MB [guard region]
  32. fffffdfffe5f9000 fffffdfffe9fffff 4124KB fixed mappings
  33. fffffdfffea00000 fffffdfffebfffff 2MB [guard region]
  34. fffffdfffec00000 fffffdffffbfffff 16MB PCI I/O space
  35. fffffdffffc00000 fffffdffffdfffff 2MB [guard region]
  36. fffffdffffe00000 ffffffffffdfffff 2TB vmemmap
  37. ffffffffffe00000 ffffffffffffffff 2MB [guard region]
  38. AArch64 Linux memory layout with 64KB pages + 3 levels (52-bit with HW support)::
  39. Start End Size Use
  40. -----------------------------------------------------------------------
  41. 0000000000000000 000fffffffffffff 4PB user
  42. fff0000000000000 fff7ffffffffffff 2PB kernel logical memory map
  43. fff8000000000000 fffd9fffffffffff 1440TB [gap]
  44. fffda00000000000 ffff9fffffffffff 512TB kasan shadow region
  45. ffffa00000000000 ffffa00007ffffff 128MB bpf jit region
  46. ffffa00008000000 ffffa0000fffffff 128MB modules
  47. ffffa00010000000 fffff81ffffeffff ~88TB vmalloc
  48. fffff81fffff0000 fffffc1ffe58ffff ~3TB [guard region]
  49. fffffc1ffe590000 fffffc1ffe9fffff 4544KB fixed mappings
  50. fffffc1ffea00000 fffffc1ffebfffff 2MB [guard region]
  51. fffffc1ffec00000 fffffc1fffbfffff 16MB PCI I/O space
  52. fffffc1fffc00000 fffffc1fffdfffff 2MB [guard region]
  53. fffffc1fffe00000 ffffffffffdfffff 3968GB vmemmap
  54. ffffffffffe00000 ffffffffffffffff 2MB [guard region]
  55. Translation table lookup with 4KB pages::
  56. +--------+--------+--------+--------+--------+--------+--------+--------+
  57. |63 56|55 48|47 40|39 32|31 24|23 16|15 8|7 0|
  58. +--------+--------+--------+--------+--------+--------+--------+--------+
  59. | | | | | |
  60. | | | | | v
  61. | | | | | [11:0] in-page offset
  62. | | | | +-> [20:12] L3 index
  63. | | | +-----------> [29:21] L2 index
  64. | | +---------------------> [38:30] L1 index
  65. | +-------------------------------> [47:39] L0 index
  66. +-------------------------------------------------> [63] TTBR0/1
  67. Translation table lookup with 64KB pages::
  68. +--------+--------+--------+--------+--------+--------+--------+--------+
  69. |63 56|55 48|47 40|39 32|31 24|23 16|15 8|7 0|
  70. +--------+--------+--------+--------+--------+--------+--------+--------+
  71. | | | | |
  72. | | | | v
  73. | | | | [15:0] in-page offset
  74. | | | +----------> [28:16] L3 index
  75. | | +--------------------------> [41:29] L2 index
  76. | +-------------------------------> [47:42] L1 index (48-bit)
  77. | [51:42] L1 index (52-bit)
  78. +-------------------------------------------------> [63] TTBR0/1
  79. When using KVM without the Virtualization Host Extensions, the
  80. hypervisor maps kernel pages in EL2 at a fixed (and potentially
  81. random) offset from the linear mapping. See the kern_hyp_va macro and
  82. kvm_update_va_mask function for more details. MMIO devices such as
  83. GICv2 gets mapped next to the HYP idmap page, as do vectors when
  84. ARM64_SPECTRE_V3A is enabled for particular CPUs.
  85. When using KVM with the Virtualization Host Extensions, no additional
  86. mappings are created, since the host kernel runs directly in EL2.
  87. 52-bit VA support in the kernel
  88. -------------------------------
  89. If the ARMv8.2-LVA optional feature is present, and we are running
  90. with a 64KB page size; then it is possible to use 52-bits of address
  91. space for both userspace and kernel addresses. However, any kernel
  92. binary that supports 52-bit must also be able to fall back to 48-bit
  93. at early boot time if the hardware feature is not present.
  94. This fallback mechanism necessitates the kernel .text to be in the
  95. higher addresses such that they are invariant to 48/52-bit VAs. Due
  96. to the kasan shadow being a fraction of the entire kernel VA space,
  97. the end of the kasan shadow must also be in the higher half of the
  98. kernel VA space for both 48/52-bit. (Switching from 48-bit to 52-bit,
  99. the end of the kasan shadow is invariant and dependent on ~0UL,
  100. whilst the start address will "grow" towards the lower addresses).
  101. In order to optimise phys_to_virt and virt_to_phys, the PAGE_OFFSET
  102. is kept constant at 0xFFF0000000000000 (corresponding to 52-bit),
  103. this obviates the need for an extra variable read. The physvirt
  104. offset and vmemmap offsets are computed at early boot to enable
  105. this logic.
  106. As a single binary will need to support both 48-bit and 52-bit VA
  107. spaces, the VMEMMAP must be sized large enough for 52-bit VAs and
  108. also must be sized large enough to accommodate a fixed PAGE_OFFSET.
  109. Most code in the kernel should not need to consider the VA_BITS, for
  110. code that does need to know the VA size the variables are
  111. defined as follows:
  112. VA_BITS constant the *maximum* VA space size
  113. VA_BITS_MIN constant the *minimum* VA space size
  114. vabits_actual variable the *actual* VA space size
  115. Maximum and minimum sizes can be useful to ensure that buffers are
  116. sized large enough or that addresses are positioned close enough for
  117. the "worst" case.
  118. 52-bit userspace VAs
  119. --------------------
  120. To maintain compatibility with software that relies on the ARMv8.0
  121. VA space maximum size of 48-bits, the kernel will, by default,
  122. return virtual addresses to userspace from a 48-bit range.
  123. Software can "opt-in" to receiving VAs from a 52-bit space by
  124. specifying an mmap hint parameter that is larger than 48-bit.
  125. For example:
  126. .. code-block:: c
  127. maybe_high_address = mmap(~0UL, size, prot, flags,...);
  128. It is also possible to build a debug kernel that returns addresses
  129. from a 52-bit space by enabling the following kernel config options:
  130. .. code-block:: sh
  131. CONFIG_EXPERT=y && CONFIG_ARM64_FORCE_52BIT=y
  132. Note that this option is only intended for debugging applications
  133. and should not be used in production.