The linear address space of a process is divided into two parts(Figure7.13):
· Linear addresses from 0x00000000 to 0xbfffffff can be addressed when the process runs in either User or Kernel Mode.
· Linear addresses from 0xc0000000 to 0xffffffff can be addressed only when the process runs in Kernel Mode.
Figure 8-7 shows how the fourth gigabyte linear addresses（starting from PAGE_OFFSET ，usually 0xc0000000） are used:
· The initial part of the fourth gigabyte of kernel linear addresses maps the physical memory of the system. The beginning of the area includes the linear addresses that map the first 896 MB of RAM; the linear address that corresponds to the end of the directly mapped physical memory is stored in the high_memory variable.
· The end of the area contains the fix-mapped linear addresses. Basically, a fix-mapped linear address is a constant linear address like 0xffffc000 whose corresponding physical address does not have to be the linear address minus 0xc000000, but rather a physical address set in an arbitrary way. Thus, each fix-mapped linear address maps one page frame of the physical memory. As we'll see in later chapters, the kernel uses fix-mapped linear addresses instead of pointer variables that never change their value.
就是说内核是常驻内存的，内核的每一页物理地址都被固定的映射为线性地址中的一页，不会像用户程序一样被页管理机制换入换出，内核不会再被重定位，开发内核的人员自己知道内核运行时的线性地址，所以可以直接使用线性地址而无需使用变量。而开发用户程序的人员站在用户层的角度，不知道自己程序即将分配的线性地址，所以使用变量，由链接器为其分配运行时线性地址，并由加载器loader载入内存。
· Starting from PKMAP_BASE we find the linear addresses used for the persistent kernel mapping of high-memory page frames.Permanent kernel mappings allow the kernel to establish long-lasting mappings of high-memory page frames into the kernel address space. They use a dedicated Page Table in the master kernel page tables . The pkmap_page_table variable stores the address of this Page Table, while the LAST_PKMAP macro yields the number of entries. As usual, the Page Table includes either 512 or 1,024 entries, according to whether PAE is enabled or disabled (see the section "The Physical Address Extension (PAE) Paging Mechanism" in Chapter 2); thus, the kernel can access at most 2 or 4 MB of high memory at once.The Page Table maps the linear addresses starting from PKMAP_BASE.
· The remaining linear addresses can be used for noncontiguous memory areas. A safety interval of size 8 MB (macro VMALLOC_OFFSET) is inserted between the end of the physical memory mapping and the first memory area; its purpose is to "capture" out-of-bounds memory accesses. For the same reason, additional safety intervals of size 4 KB are inserted to separate noncontiguous memory areas.
The VMALLOC_START macro defines the starting address of the linear space reserved for noncontiguous memory areas, while VMALLOC_END defines its ending address.
References:
《understanding computer system》
《understanding linux kernel》