How can kmalloc return a physical address greater

Question

I am allocating a block of memory with kmalloc in a device driver in Linux. The address that I get is 0xffff880000180000. I am using an IvyBridge processor with a 46-bit physical address space. That means that the CPU doesn't have more than 46 addressing pins, so it can't access any address above 0x00003fffffffffff. The address I'm getting is obviously greater than that, as it has bit 47 set.

Assuming that kmalloc returns a physical pointer (that is, a pointer where the virtual, linear and physical addresses are the same), how can I be getting such an address, if it's not accessible by the CPU?

---

This question is related to "Why am I getting a high address when I use kmalloc with GFP_DMA in Linux?". However, it is not identical. This question is about the physical addresses kmalloc returns in general, whereas the linked question is about use of GFP_DMA and its relationship to the returned address.

Answer 1

It's clearly not a physical address but a linear or virtual address, and is in 'canonical form' where the value of bit 47 is 'sign extended' up to bit 63.