Re: [PATCH v4 2/7] KVM: x86: Use linear_read_system() to read the TSS I/O bitmap

[Binbin Wu]

On 8/19/2026 1:03 PM, Sohil Mehta wrote:
> Thank you for reviewing the patch.
> 
> On 8/18/2026 8:19 PM, Binbin Wu wrote:
>> On 8/6/2026 9:15 AM, Sohil Mehta wrote:
>>> TSS I/O permission bitmap reads are implicit supervisor accesses which
>>> are subject to Linear Address Space Separation (LASS) enforcement.
>>
>> I am not sure about it.
>>
>> According to SDM vol 3a (253668-089US), Chapter "LINEAR-ADDRESS PRE-PROCESSING",
>> section "MODE-BASED ACCESSES AND LINEAR-ADDRESS-SPACE PARTITIONING", it defines
>> and limits "implicit supervisor-mode accesses" to the following operations:
> 
> The way I understand it, this list isn't exhaustive. The wording in
> those sections, "Such accesses include the following.." and "Examples of
> such accesses include.." suggests that this is not limiting.
> 
>> - accesses to the global descriptor table (GDT) or local descriptor table (LDT)
>>   to load a segment descriptor
>> - accesses to the interrupt descriptor table (IDT) when delivering an interrupt
>>   or exception
>> - accesses to the task-state segment (TSS) as part of a task switch or change of
>>   CPL
>> - accesses to a user posted-interrupt descriptor (UPID) during user-interrupt
>>   notification processing
>>
> 
> For example, this doesn't list the SENDUIPI instruction's access to the
> UITT (IA32_UINTR_TT). That one is an implicit supervisor-mode access to
> a kernel address at CPL = 3.
> 
> In section 5.6.1 (Determination of Access Rights), immediately following
> the above examples the SDM says:  "All these accesses are called
> implicit supervisor-mode accesses regardless of CPL."
> 
>> IIUC, the TSS I/O bitmap read during ordinary instruction execution
>> (under CPL = 3) rather than during a task switch or CPL transition, I don't
>> think they fall under the classification of implicit supervisor-mode accesses.
>>
> AFAIU, the entire TSS struct (including the I/O bitmap portion) is
> mapped at struct cpu_entry_area using CPU_ENTRY_AREA_BASE with
> PAGE_KERNEL_RO permissions. So bit 63 will always be 1 and U/S = 0.
> 
> Yes, the TSS I/O bitmap access happens at CPL = 3 but it still has to be
> an implicit supervisor access. If it weren't, any user instruction
> access to the I/O bitmap would always generate a fault (even without
> LASS), right?
> 

You are right.
I replied too quickly before fully recalling how these knobs work.

> 
> Sohil
> 
>