Re: [PATCH] kvm: vmx: Sync all matching EPTPs when injecting nested EPT fault

[Sean Christopherson <seanjc@google.com>]

On Fri, Aug 06, 2021, Junaid Shahid wrote:
> When a nested EPT violation/misconfig is injected into the guest,
> the shadow EPT PTEs associated with that address need to be synced.
> This is done by kvm_inject_emulated_page_fault() before it calls
> nested_ept_inject_page_fault(). However, that will only sync the
> shadow EPT PTE associated with the current L1 EPTP. Since the ASID

For the changelog and the comment, IMO using "vmcs12 EPTP" instead of "L1 EPTP"
would add clarity.  I usually think of "L1 EPTP" as vmcs01->eptp and "L2 EPTP"
as vmcs02->EPTP.  There are enough EPTPs in play with nested that it'd help to
be very explicit.

> is based on EP4TA rather than the full EPTP, so syncing the current
> EPTP is not enough. The SPTEs associated with any other L1 EPTPs
> in the prev_roots cache with the same EP4TA also need to be synced.

No small part of me wonders if we should disallow duplicate vmcs12 EP4TAs in a
single vCPU's root cache, e.g. purge existing roots with the same pgd but
different role.  INVEPT does the right thing, but that seems more coincidental
than intentional.

Practically speaking, this only affects A/D bits.  Wouldn't a VMM need to flush
the EP4TA if it toggled A/D enabling in order to have deterministic behavior?
In other words, is there a real world use case for switching between EPTPs with
same EP4TAs but different properties that would see a performance hit if KVM
purged unusable cached roots with the same EP4TA?