5

I'm looking at the Linux IA-32 memory model of a process and I have a simple question to it. What do the grey areas in the picture contain? Are they only included to show the beginning and end of the memory? So, do text start at 0x0 and stack start at 0xFFFFFFFF?

Reopened: Hi, in an OS course I'm attending this question becomes relevant again. Specifically, I need to know what the grey areas contain. Based on the answers so far, I can see it contains kernel code in the top and a null-pointer dereference page in the bottom. But what is the kernel code? I don't assume it is the whole operating system itself, but could it be embedded scheduler, kernel library calls or?

Best regards, Lasse Espeholt

alt text http://img403.imageshack.us/img403/3156/capturecj.png

5 Answers 5

9

I think this is more accurate: alt text

3
  • Ahh seems to make sense ;) But according to that graph processes only have ~1GB ram to work with. (0xC0000000 - 0x80480000) but it may increase to the kernel virtual memory? Jan 12, 2010 at 10:24
  • 1
    It's 0x08048000, not 0x80480000. So it's a bit less than 3 GBs.
    – wj32
    Jan 12, 2010 at 10:31
  • 0x00000000+ is, in general, available to userspace. It's not typically used, because it's generally considered to be a bad idea to have a page mapped at 0x0 though, and recent kernels have a security option to reserve the first few kbs of memory. But it's not a whole 0x08000000 reserved, that's for sure.
    – bdonlan
    Jun 27, 2011 at 23:13
5

I think the grey areas simply represent regions of undefined size. Program text certainly wouldn't start at 0x0, because most OSes use them as invalid pages so null dereferences can be caught easily. Thread stacks also wouldn't go right up to 0xffffffff because usually the top quarter (or half) has kernel memory mapped into it.

0
5

Also note that due to address space layout randomization, the starting addresses of some of the sections are randomly offset from the values in the diagrams.

4
+25

Nobody seems to have mentioned that not all memory in the available space is necessarily mapped (and it almost never is).

2

Note that the zero-page area at the bottom of the address space is not actually forbidden to application use under common linux distributions. The kernel used to do this, then ended up farming that decision out to the LSM module (e.g. SELinux, AppArmor). And they didn't enforce the same rule, so it turned out to be possible for processes to map memory at 0x0. This was part of the vulnerability behind the recent "kernel null pointer dereference" exploits.

2
  • /proc/sys/vm/mmap_min_addr is defaulted to non-zero by the vanilla kernel, so this only matters if you have a distribution that changes it or uses LSM. I don't know how common that is; Debian doesn't, Ubuntu doesn't (unless Wine is installed), Gentoo doesn't, ... and that's all the distributions I use.
    – ephemient
    Jan 12, 2010 at 19:36
  • Fedora and Red Hat ship SELinux enabled by default. Novell/SuSE ships AppArmor, as does Ubuntu in recent versions. LSM is more the rule than the exception in the modern world, and as it happens this resulted in a regression in the null page protection.
    – Andy Ross
    Jan 12, 2010 at 23:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.