How Meltdown Works: Speculative Loads, Cache Side Channels, and Why KPTI Isolates Kernel Page Tables

A process that runs with ordinary user privileges is not supposed to read the kernel's page tables, credential structures, or another process's mapped pages. On affected Intel processors (and a few others) it could. The load that should have faulted still produced a value inside the out-of-order window, and that value left a measurable trace in the cache.

The Contract

The contract between CPU and code is that the CPU will only do what the programmer told it to do. Modern processors break that contract by executing instructions out of order, speculatively, and with an enormous window in which they can do so.

An instruction that is later abandoned and never committed might have still caused side effects: the prefetcher might have brought the target of a load into the cache. Out-of-order execution is invisible to in-order code, so programmers have always been able to assume the contract is upheld. That invisible window is exactly where Meltdown happens.

Three Steps to Meltdown

The Meltdown attack works in three steps:

1. Probe: Try to load kernel data that is normally protected. The load will fault, but not before it has already executed speculatively and left traces in the cache.
2. Trace: The out-of-order load left a measurable trace in the cache by virtue of loading data. Check the cache to see which kernel data was accessed.
3. Repeat: Iterate through all possible kernel addresses to extract kernel memory byte by byte.

Kernel Page Table Isolation (KPTI)

The mitigation for Meltdown is Kernel Page Table Isolation (KPTI). KPTI creates two separate page tables for the kernel: one for kernel mode and one for user mode. When switching from user to kernel mode, the CPU switches to the kernel page table. When switching back, it switches to the user page table, which does not contain kernel addresses.

This prevents the attack because the speculative load of kernel data will fault earlier, before it can leave a trace in the cache.

Performance Cost

KPTI incurs a performance cost due to the overhead of switching page tables on system calls. The cost varies by workload, but typical benchmarks show a 2-10% performance impact on systems with high system call rates.

Common Misconceptions

• Meltdown is only on Intel: While Intel processors are the most affected, some ARM and AMD processors are also vulnerable to similar attacks.
• KPTI is a complete fix: KPTI mitigates Meltdown but does not protect against related attacks like Spectre.
• Disabling SMT fixes the issue: Disabling simultaneous multi-threading does not prevent Meltdown, though it may reduce some side-channel attacks.

Takeaways

• Modern CPUs execute speculatively, creating invisible windows where the contract between CPU and code is broken.
• These invisible effects can leave measurable traces in the cache, allowing privileged information to be extracted.
• KPTI is an effective mitigation that isolates kernel memory from user-mode access.
• Performance monitoring and continued research are necessary to detect and prevent future speculative execution attacks.