I would like help understanding a particular aspect of meltdown.

My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a timing side channel). Listing 2 in the meltdown paper is:

1 ; rcx = kernel address
2 ; rbx = probe array
3 retry:
4 mov al, byte [rcx]
5 shl rax, 0xc
6 jz retry
7 mov rbx, qword [rbx + rax]

What I am confused about is how a "kernel address" can exist inside a userspace process. Wouldn't a userspace process have its own address space and memory mapping, different to the kernel? My expectation is that in a userspace process the address inside rcx would be translate to something other than what it would be translated to inside the kernel. Probably just an error/segmentation fault.

How is it possible for a userspace process in linux to refer to a kernel address?

1 Answer 1


As a performance optimization, the kernel memory was mapped within the memory space of the application. The pages are protected, but the page tables were (before KPTI) mapped in so they did not have to load them from memory on each system call. Now each system call incurs additional overhead to load the kernel page tables.

  • Thank you very much for the answer. If I can just ask if I understand this right, the kernel memory is mapped inside all user space applications but it has "read and write and execute" permission all turned off?
    – river
    Commented Jan 8, 2018 at 17:08
  • Those pages have 'supervisor' flag set, which makes them accessible only from kernel mode: wiki.osdev.org/Paging#Handling
    – domen
    Commented Mar 7, 2018 at 10:27

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .