Why can ZONE_NORMAL only go up to 896MiB on 32-bit x86 processors?

According to Linux Kernel Development by Robert Love, p. 233: > Because of hardware limitations, the kernel cannot treat all pages as identical. Some pages, because of their physical address in memory, cannot be used for certain tasks. Because of this limitation, the kernel divides pages into different *zones*. The kernel uses the zones to group pages of similar properties. In particular, Linux has to deal with two shortcomings of hardware with respect to memory addressing: > * Some hardware devices can perform DMA (direct memory access) to only certain memory addresses. > * **Some architectures can physically addressing [sic] larger amounts of memory than they can virtually address.** Consequently, some memory is not permanently mapped into the kernel address space. The bold face is added by me. What does this statement mean? Love goes on to say: > What an architecture can and cannot directly map varies. On 32-bit x86 systems, ZONE_HIGHMEM is all memory above the physical 896MB mark. On other architectures, ZONE_HIGHMEM is empty because all memory is directly mapped. Could this mean that the MMU on 32-bit x86 can't map more than 896MiB or so of physical addresses at one time? In other words, the MMU can handle a page table with up to 896MiB/4KiB = 229,376 entries? [This answer](https://unix.stackexchange.com/a/98229/703626) says that Love is talking about Physical Address Extension (PAE). If my mental model of the whole situation is correct, it is saying that if the kernel were to ever need to take up more than 4GiB of physical memory on a system with PAE, then it would not be able to fit enough entries in the page table at once (because there's not enough virtual address space to address it at once), so it would need to bring pages in and out (hence "Dynamically mapped pages" in Love's table on p. 234). But then why is the mark so low at 896MiB? Why can't it be somewhere higher, like 4096-128MiB? Then, on any system where the physical address space *does* fit within the virtual address space (<4GiB), almost all of the memory would be ZONE_NORMAL, and could be mapped in the kernel's virtual address space without needing to dynamically map and unmap memory. This is the current situation on x86_64.