3 ms·
L1 cache is shared between threads on the same core so, with SMT, you can attack the code that runs on the sibling thread too. However, that is more for Spectr
by bonzini 8y ago
L1 cache is shared between threads on the same core so, with SMT, you can attack the code that runs on the sibling thread too.
However, that is more for Spectre, which abuses the reads done from foreign code to observe the effect they have on the cache. That foreign code can be the kernel, another process, the hypervisor, etc. running on the same core. Meltdown can read the entire comments of memory without needing foreign code and therefore SMT doesn't matter for it.
- dnautics 8y agoMaybe my understanding is wrong but with smt though the kernel.is not informed of which virtual CPU is in residence at any given time. IIRC, With smp only, the kernel is responsible for scheduling onto the processor so it can invalidate the cache exactly when it needs to.
- bonzini 8y agoThe threads look exactly like real processors to the kernel. The only difference as far as the kernel is concerned is that they share the L1 cache.
- dnautics 8y agoExactly. So you can have insecure boundary between threads because they share L1 cache. Is my understanding of how meltdown works incorrect?
- bonzini 8y agoYou're thinking of Spectre. Meltdown doesn't need to share cache, a thread can just read kernel mappings into its own L1. Kernel mappings typically include the whole physical memory (on 64-bit machines where virtual address space is huge).