title: How exactly do kernel virtual addresses get translated to physical RAM?
body: <p>On the surface, this appears to be a silly question. Some patience please.. :-)
  Am structuring this qs into 2 parts:</p>
  
  <p><strong>Part 1:</strong>
  I fully understand that platform RAM is mapped into the kernel segment; esp on 64-bit systems this will work well. So each kernel virtual address is indeed just an offset from physical memory (DRAM).</p>
  
  <p>Also, it's my understanding that as Linux is a modern virtual memory OS, (pretty much) <em>all</em> addresses are treated as virtual addresses and must "go" via hardware - the TLB/MMU - at runtime and then get  translated by the TLB/MMU via kernel paging tables. Again, easy to understand for user-mode processes.</p>
  
  <p>HOWEVER, what about kernel virtual addresses? For efficiency, would it not be simpler to direct-map these (and an identity mapping is indeed setup from PAGE_OFFSET onwards). But still, at runtime, the kernel virtual address <strong><em>must</em></strong> go via the TLB/MMU and get translated right??? Is this actually the case? Or is kernel virtual addr translation just an offset calculation?? (But how can that be, as we <em>must</em> go via hardware TLB/MMU?). As a simple example, lets consider:</p>
  
  <pre><code>char *kptr = kmalloc(1024, GFP_KERNEL);
  </code></pre>
  
  <p>Now kptr is a kernel virtual address. 
  I understand that virt_to_phys() can perform the offset calculation and return the physical DRAM address. 
  But, <em>here's the Actual Question</em>: it can't be done in this manner via software - that would be pathetically slow! So, back to my earlier point: it would have to be translated via hardware (TLB/MMU). 
  <em>Is this actually the case??</em></p>
  
  <p><strong>Part 2:</strong>
  Okay, lets say this is the case, and we do use paging in the kernel to do this, we must of course setup kernel paging tables; I understand it's rooted at swapper_pg_dir.</p>
  
  <p>(I also understand that vmalloc() unlike kmalloc() is a special case- it's  a pure virtual region that gets backed by physical frames only on page fault).</p>
  
  <p>If (in Part 1) we do conclude that kernel virtual address translation is done via kernel paging tables, then how exactly does the kernel paging table (swapper_pg_dir) get "attached" or "mapped" to a user-mode process?? This should happen in the context-switch code? How? Where?</p>
  
  <p>Eg.
  On an x86_64, 2 processes A and B are alive, 1 cpu.
  A is running, so it's higher-canonical addr
  <code>0xFFFF8000 00000000 through 0xFFFFFFFF FFFFFFFF</code>  "map" to the kernel segment, and it's lower-canonical addr
  <code>0x0 through 0x00007FFF FFFFFFFF</code>   map to it's private userspace.</p>
  
  <p>Now, if we context-switch A->B, process B's lower-canonical region is unique But
  it must "map" to the same kernel of course!
  How exactly does this happen? How do we "auto" refer to the kernel paging table when
  in kernel mode? Or is that a wrong statement?</p>
  
  <p>Thanks for your patience, would really appreciate a well thought out answer!</p>