Re: [PATCH v4 2/7] KVM: x86: Use linear_read_system() to read the TSS I/O bitmap

[H. Peter Anvin]

On August 18, 2026 10:03:03 PM PDT, Sohil Mehta <sohil.mehta@xxxxxxxxx> wrote:
>Thank you for reviewing the patch.
>
>On 8/18/2026 8:19 PM, Binbin Wu wrote:
>> On 8/6/2026 9:15 AM, Sohil Mehta wrote:
>>> TSS I/O permission bitmap reads are implicit supervisor accesses which
>>> are subject to Linear Address Space Separation (LASS) enforcement.
>> 
>> I am not sure about it.
>> 
>> According to SDM vol 3a (253668-089US), Chapter "LINEAR-ADDRESS PRE-PROCESSING",
>> section "MODE-BASED ACCESSES AND LINEAR-ADDRESS-SPACE PARTITIONING", it defines
>> and limits "implicit supervisor-mode accesses" to the following operations:
>
>The way I understand it, this list isn't exhaustive. The wording in
>those sections, "Such accesses include the following.." and "Examples of
>such accesses include.." suggests that this is not limiting.
>
>> - accesses to the global descriptor table (GDT) or local descriptor table (LDT)
>>   to load a segment descriptor
>> - accesses to the interrupt descriptor table (IDT) when delivering an interrupt
>>   or exception
>> - accesses to the task-state segment (TSS) as part of a task switch or change of
>>   CPL
>> - accesses to a user posted-interrupt descriptor (UPID) during user-interrupt
>>   notification processing
>> 
>
>For example, this doesn't list the SENDUIPI instruction's access to the
>UITT (IA32_UINTR_TT). That one is an implicit supervisor-mode access to
>a kernel address at CPL = 3.
>
>In section 5.6.1 (Determination of Access Rights), immediately following
>the above examples the SDM says:  "All these accesses are called
>implicit supervisor-mode accesses regardless of CPL."
>
>> IIUC, the TSS I/O bitmap read during ordinary instruction execution
>> (under CPL = 3) rather than during a task switch or CPL transition, I don't
>> think they fall under the classification of implicit supervisor-mode accesses.
>> 
>AFAIU, the entire TSS struct (including the I/O bitmap portion) is
>mapped at struct cpu_entry_area using CPU_ENTRY_AREA_BASE with
>PAGE_KERNEL_RO permissions. So bit 63 will always be 1 and U/S = 0.
>
>Yes, the TSS I/O bitmap access happens at CPL = 3 but it still has to be
>an implicit supervisor access. If it weren't, any user instruction
>access to the I/O bitmap would always generate a fault (even without
>LASS), right?
>
>
>Sohil
>

The I/O bitmap is most definitely an implicit supervisor access.