In some configurations, the top 1G space of each process' memory belongs to the kernel. And in the 1G space, the low 896M part is direct mapped to physical address, called fix-mapping area.
But I'm confused that how it is implemented. Because cpu can only access linear address, which is then interpreted into physical address by MMU. What happens when kernel access that fix-mapping area? Does it skip the MMU?