There's one PTI related layout asymmetry I noticed between 4-level and 5-level kernels:
47-bit: > + | > + | Kernel-space > virtual memory, shared between all processes: > +____________________________________________________________|___________________________________________________________ > + | | | | > + ffff800000000000 | -128 TB | ffff87ffffffffff | 8 TB | ... guard > hole, also reserved for hypervisor > + ffff880000000000 | -120 TB | ffffc7ffffffffff | 64 TB | direct mapping > of all physical memory (page_offset_base) > + ffffc80000000000 | -56 TB | ffffc8ffffffffff | 1 TB | ... unused hole > + ffffc90000000000 | -55 TB | ffffe8ffffffffff | 32 TB | > vmalloc/ioremap space (vmalloc_base) > + ffffe90000000000 | -23 TB | ffffe9ffffffffff | 1 TB | ... unused hole > + ffffea0000000000 | -22 TB | ffffeaffffffffff | 1 TB | virtual memory > map (vmemmap_base) > + ffffeb0000000000 | -21 TB | ffffebffffffffff | 1 TB | ... unused hole > + ffffec0000000000 | -20 TB | fffffbffffffffff | 16 TB | KASAN shadow > memory > + fffffc0000000000 | -4 TB | fffffdffffffffff | 2 TB | ... unused hole > + | | | | vaddr_end for > KASLR > + fffffe0000000000 | -2 TB | fffffe7fffffffff | 0.5 TB | cpu_entry_area > mapping > + fffffe8000000000 | -1.5 TB | fffffeffffffffff | 0.5 TB | LDT remap for > PTI > + ffffff0000000000 | -1 TB | ffffff7fffffffff | 0.5 TB | %esp fixup > stacks > +__________________|____________|__________________|_________|____________________________________________________________ > + | 56-bit: > + | > + | Kernel-space > virtual memory, shared between all processes: > +____________________________________________________________|___________________________________________________________ > + | | | | > + ff00000000000000 | -64 PB | ff0fffffffffffff | 4 PB | ... guard > hole, also reserved for hypervisor > + ff10000000000000 | -60 PB | ff8fffffffffffff | 32 PB | direct mapping > of all physical memory (page_offset_base) > + ff90000000000000 | -28 PB | ff9fffffffffffff | 4 PB | LDT remap for > PTI > + ffa0000000000000 | -24 PB | ffd1ffffffffffff | 12.5 PB | > vmalloc/ioremap space (vmalloc_base) > + ffd2000000000000 | -11.5 PB | ffd3ffffffffffff | 0.5 PB | ... unused hole > + ffd4000000000000 | -11 PB | ffd5ffffffffffff | 0.5 PB | virtual memory > map (vmemmap_base) > + ffd6000000000000 | -10.5 PB | ffdeffffffffffff | 2.25 PB | ... unused hole > + ffdf000000000000 | -8.25 PB | fffffdffffffffff | ~8 PB | KASAN shadow > memory > + fffffc0000000000 | -4 TB | fffffdffffffffff | 2 TB | ... unused hole > + | | | | vaddr_end for > KASLR > + fffffe0000000000 | -2 TB | fffffe7fffffffff | 0.5 TB | cpu_entry_area > mapping > + fffffe8000000000 | -1.5 TB | fffffeffffffffff | 0.5 TB | ... unused hole > + ffffff0000000000 | -1 TB | ffffff7fffffffff | 0.5 TB | %esp fixup > stacks The two layouts are very similar beyond the shift in the offset and the region sizes, except one big asymmetry: is the placement of the LDT remap for PTI. Is there any fundamental reason why the LDT area is mapped into a 4 petabyte (!) area on 56-bit kernels, instead of being at the -1.5 TB offset like on 47-bit kernels? The only reason I can see is that this way is that it's currently coded at the PGD level only: static void map_ldt_struct_to_user(struct mm_struct *mm) { pgd_t *pgd = pgd_offset(mm, LDT_BASE_ADDR); if (static_cpu_has(X86_FEATURE_PTI) && !mm->context.ldt) set_pgd(kernel_to_user_pgdp(pgd), *pgd); } ( BTW., the 4 petabyte size of the area is misleading: a 5-level PGD entry covers 256 TB of virtual memory, i.e 0.25 PB, not 4 PB. So in reality we have a 0.25 PB area there, used up by the LDT mapping in a single PGD entry, plus a 3.75 PB hole after that. ) ... but unless I'm missing something it's not really fundamental for it to be at the PGD level - it could be two levels lower as well, and it could move back to the same place where it's on the 47-bit kernel. The LDT mapping operation is pretty heavy already, and the actual use of the LDT is not impacted by where it's mapped, as the LDT is per mm so no remapping is required on context switch. I.e. could we move the LDT over to the same place? This would make an even larger area of the address space identical between 47-bit and 56-bit kernels: | | Identical layout to the 47-bit one from here on: ____________________________________________________________|____________________________________________________________ | | | | fffffc0000000000 | -4 TB | fffffdffffffffff | 2 TB | ... unused hole | | | | vaddr_end for KASLR fffffe0000000000 | -2 TB | fffffe7fffffffff | 0.5 TB | cpu_entry_area mapping fffffe8000000000 | -1.5 TB | fffffeffffffffff | 0.5 TB | LDT remap for PTI ffffff0000000000 | -1 TB | ffffff7fffffffff | 0.5 TB | %esp fixup stacks ffffff8000000000 | -512 GB | ffffffeeffffffff | 444 GB | ... unused hole ffffffef00000000 | -68 GB | fffffffeffffffff | 64 GB | EFI region mapping space ffffffff00000000 | -4 GB | ffffffff7fffffff | 2 GB | ... unused hole ffffffff80000000 | -2 GB | ffffffff9fffffff | 512 MB | kernel text mapping, mapped to physical address 0 ffffffff80000000 |-2048 MB | | | ffffffffa0000000 |-1536 MB | fffffffffeffffff | 1520 MB | module mapping space ffffffffff000000 | -16 MB | | | FIXADDR_START | ~-11 MB | ffffffffff5fffff | ~0.5 MB | kernel-internal fixmap range, variable size and offset ffffffffff600000 | -10 MB | ffffffffff600fff | 4 kB | legacy vsyscall ABI ffffffffffe00000 | -2 MB | ffffffffffffffff | 2 MB | ... unused hole __________________|____________|__________________|_________|___________________________________________________________ And the rest would basically just be 4 areas: the direct-mapping, vmalloc, vmemmap and KASAN areas - which are scaled according to whether it's a 47-bit or 56-bit kernel. Thoughts? Thanks, Ingo