Re: [PATCH 07/10] x86/tdx: Extend TDX_MODULE_CALL to support more TDCALL/SEAMCALL leafs

From: Huang, Kai
Date: Thu Jul 13 2023 - 03:48:58 EST


On Wed, 2023-07-12 at 18:53 +0200, Peter Zijlstra wrote:
> On Wed, Jul 12, 2023 at 08:55:21PM +1200, Kai Huang wrote:
>
>
> > @@ -72,7 +142,46 @@
> > movq %r9, TDX_MODULE_r9(%rsi)
> > movq %r10, TDX_MODULE_r10(%rsi)
> > movq %r11, TDX_MODULE_r11(%rsi)
> > - .endif
> > + .endif /* \ret */
> > +
> > + .if \saved
> > + .if \ret && \host
> > + /*
> > + * Clear registers shared by guest for VP.ENTER to prevent
> > + * speculative use of guest's values, including those are
> > + * restored from the stack.
> > + *
> > + * See arch/x86/kvm/vmx/vmenter.S:
> > + *
> > + * In theory, a L1 cache miss when restoring register from stack
> > + * could lead to speculative execution with guest's values.
> > + *
> > + * Note: RBP/RSP are not used as shared register. RSI has been
> > + * restored already.
> > + *
> > + * XOR is cheap, thus unconditionally do for all leafs.
> > + */
> > + xorq %rcx, %rcx
> > + xorq %rdx, %rdx
> > + xorq %r8, %r8
> > + xorq %r9, %r9
> > + xorq %r10, %r10
> > + xorq %r11, %r11
>
> > + xorq %r12, %r12
> > + xorq %r13, %r13
> > + xorq %r14, %r14
> > + xorq %r15, %r15
> > + xorq %rbx, %rbx
>
> ^ those are an instant pop below, seems daft to clear them.
> >

I found below comment in KVM code:

> + * See arch/x86/kvm/vmx/vmenter.S:
> + *
> + * In theory, a L1 cache miss when restoring register from stack
> + * could lead to speculative execution with guest's values.

And KVM explicitly does XOR for the registers that gets "pop"ed almost
instantly, so I followed.

But to be honest I don't quite understand this. :-)