Linux Kernel Memory Layout

The Linux kernel manages the system's memory resources, providing a virtualized environment to processes. Understanding the memory layout is crucial for systems programmers, driver developers, and those involved in performance tuning or security analysis. The layout describes how both physical RAM and virtual address spaces are organized. While specific implementations vary between CPU architectures (such as x86_64, ARM64, and x86), the fundamental concepts remain consistent across modern Linux systems.

Virtual vs. Physical Addressing

Modern operating systems utilize virtual memory. This means that a process does not directly access physical RAM addresses. Instead, it operates within a virtual address space. The CPU's Memory Management Unit (MMU) translates these virtual addresses to physical addresses in real-time using page tables.

The Linux kernel splits the virtual address space into two distinct parts:

• User Space (Low Memory): Used by applications. Each process has its own private user space.
• Kernel Space (High Memory): Used by the operating system. This space is shared among all processes but is only accessible when the process is in "kernel mode" (via a system call or interrupt).

The Address Space (x86_64 Example)

In the 64-bit x86 architecture (x86_64), the potential address space is enormous (2^64 bytes). However, current implementations do not use the full 64 bits for addressing; typically, only 48 bits are used for canonical addressing. This results in 256TB of usable virtual address space. Linux generally splits this 256TB evenly between kernel and user space.

Kernel Space Components

The high-memory region (kernel space) contains specific memory areas reserved for core system functions. The exact addresses depend on the kernel configuration and architecture, but the logical divisions are standardized.

The Direct Physical Map

Also known as the linear mapping, this region maps a contiguous range of virtual addresses directly to physical addresses. Usually, the formula is virtual_address = PAGE_OFFSET + physical_address. This allows the kernel to access any physical RAM page by simply adding an offset. It simplifies memory management because the kernel does not need to set up complex page tables to access arbitrary physical memory; it just calculates the address.

vmalloc Space

The vmalloc (virtual malloc) space is used when the kernel needs virtually contiguous memory that is not necessarily physically contiguous. The direct mapping requires physical contiguity, which can be hard to find as memory becomes fragmented. vmalloc creates a new virtual mapping area in the page tables, pointing to potentially scattered physical pages. This is often used for loading kernel modules.

Kernel Text and Static Data

This region contains the actual executable code of the Linux kernel (the text segment) and static global variables (data and BSS segments). This area is typically mapped as read-only and executable. It is placed at a fixed virtual address determined at compile time.

Kernel Modules

Loadable Kernel Modules (LKMs) are drivers or filesystem extensions loaded into the running kernel. They are allocated memory dynamically, usually from the vmalloc space or a dedicated module region. This allows them to call kernel functions and access kernel symbols.

Fixmap Area

The fixmap region is a compile-time fixed virtual address mapping. The kernel uses this for mapping physical pages temporarily. For example, during the early boot process, before the full page table hierarchy is set up, or for mapping the first few pages of memory to manage the page tables themselves.

User Space Memory Layout

While the kernel defines the boundaries, the internal layout of user space is largely managed by the C library and the kernel's ELF loader. Every process views its memory as a private contiguous block.

• Text Segment: Contains the compiled program code. Usually read-only to prevent self-modification.
• Data Segment: Contains initialized global and static variables.
• BSS Segment: Contains uninitialized global and static variables. The kernel zeros this memory at process start.
• Heap: Dynamic memory allocated at runtime (e.g., using malloc). It grows upwards toward higher addresses.
• Stack: Stores local variables and function call history. It grows downward toward lower addresses.
• Memory Mapping Segment: Used for memory mapping files and loading shared libraries (libc.so, etc.).

Physical Memory Zones

Besides virtual layout, the kernel organizes physical RAM into "zones" to solve hardware constraints. Not all physical memory is equal due to limitations in older hardware or specific device requirements.

Common zones include:

• DMA Zone: Historically used for devices that can only access the first 16MB of RAM (due to 24-bit address buses). On modern systems, this zone is often small or non-existent DMA32, which covers the first 4GB.
• Normal Zone (or DMA32 on x86): Contains pages that can be used for normal kernel allocations. This fits the first 4GB of memory on 32-bit systems or generally accessible memory on 64-bit systems.
• HighMem Zone: Relevant primarily for 32-bit architectures. Since the kernel virtual space is limited (1GB or 2GB), it cannot permanently map all physical RAM. "High Memory" refers to physical RAM that is not permanently mapped into the kernel's address space and requires temporary mapping to access. On 64-bit systems, the kernel space is vast enough to map all physical RAM directly, so the HighMem concept is obsolete.
• Movable Zone: Used to group physical memory pages that can be easily migrated (moved). This is essential for memory hot-plugging (adding/removing RAM) and anti-fragmentation algorithms.

Page Tables and Structural Organization

The translation of virtual to physical addresses is hierarchical. x86_64 uses 4-level paging:

1. PGD (Page Global Directory)
2. PUD (Page Upper Directory)
3. PMD (Page Middle Directory)
4. PTE (Page Table Entry)

The kernel stores the physical address of the PGD in a special register (CR3). Each entry in these tables points to the next level, ultimately pointing to a physical page frame. The layout of the virtual address determines the indices used to traverse these tables. The high bits of the virtual address select the PGD entry, the next bits select the PUD, and so on. This tree structure allows sparse address spaces; memory is only consumed when regions are actually mapped.

Security and Memory Layout

Modern kernels implement several features to protect the memory layout from exploitation:

KASLR (Kernel Address Space Layout Randomization): Similar to ASLR for user applications, KASLR randomizes the base address of the kernel code and data regions at boot time. This prevents attackers from reliably jumping to known kernel function addresses.

Kernel Page Table Isolation (KPTI) / KAISER: Mitigates the Meltdown vulnerability. Before KPTI, the kernel page tables mapped the entire user space (though with user privileges) even when running in kernel mode, to speed up context switches. KPTI separates these completely; when entering kernel space, the kernel switches to a full set of page tables. When returning to user space, it switches back to a minimal set that only contains the user mappings, removing the kernel mappings from user visibility entirely.

Conclusion

The Linux Kernel Memory Layout is a complex, structured arrangement designed to maximize hardware utilization while maintaining security and stability. It balances the need for efficient direct access to physical hardware (via the direct map) with the flexibility of virtual memory (via vmalloc). By separating user and kernel spaces, and by managing physical zones effectively, Linux provides a robust environment for applications and the kernel itself to coexist without interfering with one another's memory.