Re: [PATCH v4 2/7] KVM: x86: Use linear_read_system() to read the TSS I/O bitmap

[Sohil Mehta <sohil.mehta@intel.com>]

Thank you for reviewing the patch.

On 8/18/2026 8:19 PM, Binbin Wu wrote:
> On 8/6/2026 9:15 AM, Sohil Mehta wrote:
>> TSS I/O permission bitmap reads are implicit supervisor accesses which
>> are subject to Linear Address Space Separation (LASS) enforcement.
> 
> I am not sure about it.
> 
> According to SDM vol 3a (253668-089US), Chapter "LINEAR-ADDRESS PRE-PROCESSING",
> section "MODE-BASED ACCESSES AND LINEAR-ADDRESS-SPACE PARTITIONING", it defines
> and limits "implicit supervisor-mode accesses" to the following operations:

The way I understand it, this list isn't exhaustive. The wording in
those sections, "Such accesses include the following.." and "Examples of
such accesses include.." suggests that this is not limiting.

> - accesses to the global descriptor table (GDT) or local descriptor table (LDT)
>   to load a segment descriptor
> - accesses to the interrupt descriptor table (IDT) when delivering an interrupt
>   or exception
> - accesses to the task-state segment (TSS) as part of a task switch or change of
>   CPL
> - accesses to a user posted-interrupt descriptor (UPID) during user-interrupt
>   notification processing
> 

For example, this doesn't list the SENDUIPI instruction's access to the
UITT (IA32_UINTR_TT). That one is an implicit supervisor-mode access to
a kernel address at CPL = 3.

In section 5.6.1 (Determination of Access Rights), immediately following
the above examples the SDM says:  "All these accesses are called
implicit supervisor-mode accesses regardless of CPL."

> IIUC, the TSS I/O bitmap read during ordinary instruction execution
> (under CPL = 3) rather than during a task switch or CPL transition, I don't
> think they fall under the classification of implicit supervisor-mode accesses.
> 
AFAIU, the entire TSS struct (including the I/O bitmap portion) is
mapped at struct cpu_entry_area using CPU_ENTRY_AREA_BASE with
PAGE_KERNEL_RO permissions. So bit 63 will always be 1 and U/S = 0.

Yes, the TSS I/O bitmap access happens at CPL = 3 but it still has to be
an implicit supervisor access. If it weren't, any user instruction
access to the I/O bitmap would always generate a fault (even without
LASS), right?


Sohil