3 ms·
It's not built on meltdown. It's not about violating permissions, it's about treating the contents of a page table as valid even if the page is not present or (
by bonzini 8y ago
It's not built on meltdown. It's not about violating permissions, it's about treating the contents of a page table as valid even if the page is not present or (in the case of EPT, which is worse) also treating the physical address on the guest as a physical address on the host.
However, unlike meltdown it cannot access data that is not already in the L1 cache.
- monocasa 8y agoI mean, the V bit, and the other contexts are just PTE permissions. It's literally the same root cause as meltdown, that page table faults occur particularly asynchronously on Intel hardware and speculation occurs past those faults.
- bonzini 8y agoThe root cause is the same but it's a different kind of page fault, and the effect is that you cannot read data that is not already present in the cache. On the other hand, meltdown doesn't break through the guest-host barrier when EPT is active. Yes, deep down they happen for the same reason, but then so does Spectre as well.
- monocasa 8y agoI mean, no, they're way closer than Spectre is. They're both around how page faults are asynchronous at a uArch level on Intel, and not any of the other vendors. This and Meltdown don't apply to AMD or ARM.
- bonzini 8y agoYes, it's true they're close. The lazy FPU state restore bug is similar, too. Though, Meltdown did apply to some ARM 64-bit processors.