How can a userspace linux process refer to a kernel address?

Question

I would like help understanding a particular aspect of meltdown.

My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a timing side channel). Listing 2 in the meltdown paper is:

1 ; rcx = kernel address
2 ; rbx = probe array
3 retry:
4 mov al, byte [rcx]
5 shl rax, 0xc
6 jz retry
7 mov rbx, qword [rbx + rax]

What I am confused about is how a "kernel address" can exist inside a userspace process. Wouldn't a userspace process have its own address space and memory mapping, different to the kernel? My expectation is that in a userspace process the address inside rcx would be translate to something other than what it would be translated to inside the kernel. Probably just an error/segmentation fault.

How is it possible for a userspace process in linux to refer to a kernel address?

Answer 1

As a performance optimization, the kernel memory was mapped within the memory space of the application. The pages are protected, but the page tables were (before KPTI) mapped in so they did not have to load them from memory on each system call. Now each system call incurs additional overhead to load the kernel page tables.