(Why) does the Linux kernel use an identity mapping for its virtual address space?

Question

I am currently researching the Linux kernels usage of virtual address spaces. I understand the benefits of having those, how page table walks work in x86, and the layout of the virtual address space.

Here is the part I do not understand: During a lecture of mine, it was explained that the linux kernel uses an "identity mapping" in kernel space. Meaning: In kernel space, you can translate any virtual address to its physical address by subtracting a constant number.

This number is often referred to as the PAGE_OFFSET and is different depending on 64bit vs 32bit, 4 Layer vs 5 Layer Address translation and may also be configured. kASLR increases the PAGE_OFFSET by a random amount on every boot as a security measure.

I have seen this explained in many places, but most of them are a bit old: https://stackoverflow.com/a/36640733/15113903
https://stackoverflow.com/questions/24632905/mapping-of-kernel-virtual-address-directly?rq=1
The most recent implicit explanation is that volatility3 seems to rely on this identity mapping when figuring out the kASLR offset of a memory dump.

Now: (Why) is the Kernel virtual address space (still) that way? Are there performance benefits? Is it necessary for some reason? Is it some heritage from earlier days? How likely is it to change in the near future?

Thanks

Answer 1

you can translate any virtual address to its physical address by subtracting a constant number

Not quite; any virtual address in the kernel end of the address space.

The Linux kernel on some architectures (including x86) do still have a linear mapping of the physical address space in the virtual address space. There are a number of advantages:

• reduced TLB pressure (helped with huge page mappings, which the kernel uses for this mapping where possible)
• near-direct access to physical addresses (remember, with an MMU, code running on the CPU can only access virtual addresses)
• access to addresses which aren’t mapped otherwise (because they are used for processes other than the current process, or because they aren’t mapped at all)

None of these are hard requirements, and some people would like to get rid of the linear map at some point, but I don’t know if anyone is actively working on it.