Thank you for reviewing the patch. On 8/18/2026 8:19 PM, Binbin Wu wrote: > On 8/6/2026 9:15 AM, Sohil Mehta wrote: >> TSS I/O permission bitmap reads are implicit supervisor accesses which >> are subject to Linear Address Space Separation (LASS) enforcement. > > I am not sure about it. > > According to SDM vol 3a (253668-089US), Chapter "LINEAR-ADDRESS > PRE-PROCESSING", > section "MODE-BASED ACCESSES AND LINEAR-ADDRESS-SPACE PARTITIONING", it > defines > and limits "implicit supervisor-mode accesses" to the following operations:
The way I understand it, this list isn't exhaustive. The wording in those sections, "Such accesses include the following.." and "Examples of such accesses include.." suggests that this is not limiting. > - accesses to the global descriptor table (GDT) or local descriptor table > (LDT) > to load a segment descriptor > - accesses to the interrupt descriptor table (IDT) when delivering an > interrupt > or exception > - accesses to the task-state segment (TSS) as part of a task switch or change > of > CPL > - accesses to a user posted-interrupt descriptor (UPID) during user-interrupt > notification processing > For example, this doesn't list the SENDUIPI instruction's access to the UITT (IA32_UINTR_TT). That one is an implicit supervisor-mode access to a kernel address at CPL = 3. In section 5.6.1 (Determination of Access Rights), immediately following the above examples the SDM says: "All these accesses are called implicit supervisor-mode accesses regardless of CPL." > IIUC, the TSS I/O bitmap read during ordinary instruction execution > (under CPL = 3) rather than during a task switch or CPL transition, I don't > think they fall under the classification of implicit supervisor-mode accesses. > AFAIU, the entire TSS struct (including the I/O bitmap portion) is mapped at struct cpu_entry_area using CPU_ENTRY_AREA_BASE with PAGE_KERNEL_RO permissions. So bit 63 will always be 1 and U/S = 0. Yes, the TSS I/O bitmap access happens at CPL = 3 but it still has to be an implicit supervisor access. If it weren't, any user instruction access to the I/O bitmap would always generate a fault (even without LASS), right? Sohil
