Hacker News Reader

Comment by phkahler | Hacker News Reader

I don't understand one part. If you read from an arbitrary memory location (during speculative execution, I get all that) how does that read pull data from a different process? Aren't all addresses virtual until they go through the MMU and get translated to a physical address depending on the process?

Or does this work only because the kernel exists in the same virtual address space, hence KPTI as a mitigation?

View on HN

Yes, meltdown only works if the kernel is in the same address space. Also, the kernel maps the whole physical memory as part of its address space somewhere (kernel phyiscal map), so if you can read kernel memory, you can read all phyiscal memory.

And you are right, KPTI is a full fix for Meltdown (but not Spectre).

It is typical for 64 bit machines to have a direct mapping of physical memory at some virtual offset. Ie, virtual 0xfffff...700000 corresponds to 0x0 physical. This simplifies some things since you can allocate and access any physical page without creating new mapping.

32 bit machines do not typically have sufficient kernel address space to do the same.

(Oh, linux still uses direct map on 32 bit machines even today, but only maps some memory? I thought that was abandoned, but wouldn't really know. Anyway, a much better explanation of all things direct map is https://www.sceen.net/mapping-physical-memory-directly/)

>"This simplifies some things since you can allocate and access any physical page without creating new mapping."

I am curious what types of things does this simply for the kernel? When is a physical page allocation ever done that doesn't need to be entered in into a page table entry?

ptrace of another process, for instance.

Can you elaborate? If I strace a process which makes a ptrace system call that is just another userland process and my userland process has a page table entry just like any other userland process.

You call ptrace and ask to read another process's memory. The kernel has to turn the requested VA in that address space into a physical page (walking those page tables, not yours) then copy the memory (from some VA in kernel space). This is quicker if you can turn a PA into a VA by simply adding an offset.

I see. I misinterpreted your previous comment. Cheers.

Reply on news.ycombinator.com