I would like help understanding a particular aspect of meltdown.
My understanding is that the meltdown bug can be used for a userspace linux process to access kernel memory (indirectly, through a timing side channel). Listing 2 in the meltdown paper is:
1 ; rcx = kernel address 2 ; rbx = probe array 3 retry: 4 mov al, byte [rcx] 5 shl rax, 0xc 6 jz retry 7 mov rbx, qword [rbx + rax]
What I am confused about is how a "kernel address" can exist inside a userspace process. Wouldn't a userspace process have its own address space and memory mapping, different to the kernel? My expectation is that in a userspace process the address inside rcx would be translate to something other than what it would be translated to inside the kernel. Probably just an error/segmentation fault.
How is it possible for a userspace process in linux to refer to a kernel address?