On 8/19/2026 1:03 PM, Sohil Mehta wrote: > Thank you for reviewing the patch. > > On 8/18/2026 8:19 PM, Binbin Wu wrote: >> On 8/6/2026 9:15 AM, Sohil Mehta wrote: >>> TSS I/O permission bitmap reads are implicit supervisor accesses which >>> are subject to Linear Address Space Separation (LASS) enforcement. >> >> I am not sure about it. >> >> According to SDM vol 3a (253668-089US), Chapter "LINEAR-ADDRESS >> PRE-PROCESSING", >> section "MODE-BASED ACCESSES AND LINEAR-ADDRESS-SPACE PARTITIONING", it >> defines >> and limits "implicit supervisor-mode accesses" to the following operations: > > The way I understand it, this list isn't exhaustive. The wording in > those sections, "Such accesses include the following.." and "Examples of > such accesses include.." suggests that this is not limiting. > >> - accesses to the global descriptor table (GDT) or local descriptor table >> (LDT) >> to load a segment descriptor >> - accesses to the interrupt descriptor table (IDT) when delivering an >> interrupt >> or exception >> - accesses to the task-state segment (TSS) as part of a task switch or >> change of >> CPL >> - accesses to a user posted-interrupt descriptor (UPID) during user-interrupt >> notification processing >> > > For example, this doesn't list the SENDUIPI instruction's access to the > UITT (IA32_UINTR_TT). That one is an implicit supervisor-mode access to > a kernel address at CPL = 3. > > In section 5.6.1 (Determination of Access Rights), immediately following > the above examples the SDM says: "All these accesses are called > implicit supervisor-mode accesses regardless of CPL." > >> IIUC, the TSS I/O bitmap read during ordinary instruction execution >> (under CPL = 3) rather than during a task switch or CPL transition, I don't >> think they fall under the classification of implicit supervisor-mode >> accesses. >> > AFAIU, the entire TSS struct (including the I/O bitmap portion) is > mapped at struct cpu_entry_area using CPU_ENTRY_AREA_BASE with > PAGE_KERNEL_RO permissions. So bit 63 will always be 1 and U/S = 0. > > Yes, the TSS I/O bitmap access happens at CPL = 3 but it still has to be > an implicit supervisor access. If it weren't, any user instruction > access to the I/O bitmap would always generate a fault (even without > LASS), right? >
You are right. I replied too quickly before fully recalling how these knobs work. > > Sohil > >
