On August 18, 2026 10:03:03 PM PDT, Sohil Mehta <[email protected]> wrote: >Thank you for reviewing the patch. > >On 8/18/2026 8:19 PM, Binbin Wu wrote: >> On 8/6/2026 9:15 AM, Sohil Mehta wrote: >>> TSS I/O permission bitmap reads are implicit supervisor accesses which >>> are subject to Linear Address Space Separation (LASS) enforcement. >> >> I am not sure about it. >> >> According to SDM vol 3a (253668-089US), Chapter "LINEAR-ADDRESS >> PRE-PROCESSING", >> section "MODE-BASED ACCESSES AND LINEAR-ADDRESS-SPACE PARTITIONING", it >> defines >> and limits "implicit supervisor-mode accesses" to the following operations: > >The way I understand it, this list isn't exhaustive. The wording in >those sections, "Such accesses include the following.." and "Examples of >such accesses include.." suggests that this is not limiting. > >> - accesses to the global descriptor table (GDT) or local descriptor table >> (LDT) >> to load a segment descriptor >> - accesses to the interrupt descriptor table (IDT) when delivering an >> interrupt >> or exception >> - accesses to the task-state segment (TSS) as part of a task switch or >> change of >> CPL >> - accesses to a user posted-interrupt descriptor (UPID) during user-interrupt >> notification processing >> > >For example, this doesn't list the SENDUIPI instruction's access to the >UITT (IA32_UINTR_TT). That one is an implicit supervisor-mode access to >a kernel address at CPL = 3. > >In section 5.6.1 (Determination of Access Rights), immediately following >the above examples the SDM says: "All these accesses are called >implicit supervisor-mode accesses regardless of CPL." > >> IIUC, the TSS I/O bitmap read during ordinary instruction execution >> (under CPL = 3) rather than during a task switch or CPL transition, I don't >> think they fall under the classification of implicit supervisor-mode >> accesses. >> >AFAIU, the entire TSS struct (including the I/O bitmap portion) is >mapped at struct cpu_entry_area using CPU_ENTRY_AREA_BASE with >PAGE_KERNEL_RO permissions. So bit 63 will always be 1 and U/S = 0. > >Yes, the TSS I/O bitmap access happens at CPL = 3 but it still has to be >an implicit supervisor access. If it weren't, any user instruction >access to the I/O bitmap would always generate a fault (even without >LASS), right? > > >Sohil >
The I/O bitmap is most definitely an implicit supervisor access.
