I am currently researching the Linux kernels usage of virtual address spaces. I understand the benefits of having those, how page table walks work in x86, and the layout of the virtual address space.
Here is the part I do not understand: During a lecture of mine, it was explained that the linux kernel uses an "identity mapping" in kernel space. Meaning: In kernel space, you can translate any virtual address to its physical address by subtracting a constant number.
This number is often referred to as the PAGE_OFFSET and is different depending on 64bit vs 32bit, 4 Layer vs 5 Layer Address translation and may also be configured. kASLR increases the PAGE_OFFSET by a random amount on every boot as a security measure.
I have seen this explained in many places, but most of them are a bit old:
https://stackoverflow.com/a/36640733/15113903
https://stackoverflow.com/questions/24632905/mapping-of-kernel-virtual-address-directly?rq=1
The most recent implicit explanation is that volatility3 seems to rely on this identity mapping when figuring out the kASLR offset of a memory dump.
Now: (Why) is the Kernel virtual address space (still) that way? Are there performance benefits? Is it necessary for some reason? Is it some heritage from earlier days? How likely is it to change in the near future?
Thanks