2

When learning Linux Operating Systems, I know the following things:

  1. Real mode will use addresss under 0x10000
  2. Protected mode use 4G for 32bit, and the user space can use 2/3 G
  3. The virtual memory for a program will start from 0x40000 to higher

So, what's under 0x400000, is it reserved?

tyChen
  • 1,404
  • 8
  • 27
  • ...mmmh, perhaps reserved for the kernel? – linuxfan says Reinstate Monica Dec 17 '20 at 16:17
  • Real and Virtual 86 Mode actually uses *offsets* below 10000h (just like 16-bit Protected Mode). Combined with the real address mode segmentation scheme this allows access to the space of the first 10_0000h bytes (1 MiB). Additionally, the carry from high segments allows accessing an additional FFF0h bytes (64 KiB - 16 Byte), which is called the HMA. – ecm Mar 27 '21 at 11:36

2 Answers2

3

As Maxim says, it's simply unmapped. The pages in that region are marked as "not present" in the CPU's page tables, so that accessing them causes a page fault; and the kernel knows they are not backed by any physical memory, file, or swap space, so that such a page fault will be handled by delivering a segmentation fault signal (SIGSEGV) to the process, normally killing it.

It is desirable for at least the lowest page of a program's virtual address space to be unmapped, so that accesses to address 0 (null pointer dereference) will cause a segmentation fault instead of allowing a buggy program to continue running. Leaving a larger region unmapped is also nice so that, for instance, if the program tries to access p[i] where p is a null pointer and i is somewhat greater than 4096, the program will again get a segfault. In 32-bit mode, the value 0x400000 is convenient because this is 4 MB and corresponds to one entry in the page directory. See https://wiki.osdev.org/Paging for an introduction to x86 paging.

Nate Eldredge
  • 48,811
  • 6
  • 54
  • 82
  • Thanks for your reply, and I find something interesting: Windows will use the low address which is unmapped in Linux. – tyChen Dec 18 '20 at 12:59
2

So, what's under 0x400000, is it reserved?

That's virtual address space that doesn't have any physical memory mapped. See page table for more details.

You can view the virtual address space mappings of a process with:

cat /proc/<pid>/maps

Base address of 0x400000 is somewhat arbitrary, and address space randomisation (enabled by default) loads executables at different addresses at each run. You can observe the effect of address space randomisation by running cat /proc/self/maps twice and observing that cat executable is loaded at different virtual address on each run (provided cat is an executable and not a shell built-in).

The minimum virtual address is controlled by vm.mmap_min_addr sysctl variable. On Ubuntu 18.04.5 LTS its default value is 65536 (0x10000 in hex).

Maxim Egorushkin
  • 131,725
  • 17
  • 180
  • 271