On Wed, 2023-07-12 at 18:53 +0200, Peter Zijlstra wrote: > On Wed, Jul 12, 2023 at 08:55:21PM +1200, Kai Huang wrote: > > > > @@ -72,7 +142,46 @@ > > movq %r9, TDX_MODULE_r9(%rsi) > > movq %r10, TDX_MODULE_r10(%rsi) > > movq %r11, TDX_MODULE_r11(%rsi) > > - .endif > > + .endif /* \ret */ > > + > > + .if \saved > > + .if \ret && \host > > + /* > > + * Clear registers shared by guest for VP.ENTER to prevent > > + * speculative use of guest's values, including those are > > + * restored from the stack. > > + * > > + * See arch/x86/kvm/vmx/vmenter.S: > > + * > > + * In theory, a L1 cache miss when restoring register from stack > > + * could lead to speculative execution with guest's values. > > + * > > + * Note: RBP/RSP are not used as shared register. RSI has been > > + * restored already. > > + * > > + * XOR is cheap, thus unconditionally do for all leafs. > > + */ > > + xorq %rcx, %rcx > > + xorq %rdx, %rdx > > + xorq %r8, %r8 > > + xorq %r9, %r9 > > + xorq %r10, %r10 > > + xorq %r11, %r11 > > > + xorq %r12, %r12 > > + xorq %r13, %r13 > > + xorq %r14, %r14 > > + xorq %r15, %r15 > > + xorq %rbx, %rbx > > ^ those are an instant pop below, seems daft to clear them. > > I found below comment in KVM code: > + * See arch/x86/kvm/vmx/vmenter.S: > + * > + * In theory, a L1 cache miss when restoring register from stack > + * could lead to speculative execution with guest's values. And KVM explicitly does XOR for the registers that gets "pop"ed almost instantly, so I followed. But to be honest I don't quite understand this. :-)
