[kvm-unit-tests PATCH] x86: Disable PKU in vCPU model for vmx_pf_{vpid/no_vpid/invvpid}_test

[kvm-unit-tests PATCH] x86: Disable PKU in vCPU model for vmx_pf_{vpid/no_vpid/invvpid}_test

[Sean Christopherson]

Run the vmx_pf_{vpid/no_vpid/invvpid}_test VMX tests with -pku, i.e. with
Protection Keys disabled in the (v)CPU model, to reduce the number of
testcases by an order of magnitude, which in turn reduces the runtime by
roughly the same factor.  As is, even the 240 seconds timeout is
insufficient, e.g. each test can take upwards of 300 seconds when run on
Skylake-era hardware with a debug kernel.

Simply disable PKU in the config as the purpose of the VMX #PF tests is
primarily to validate #PF routing (to L1 vs. L0), and secondarily to
validate alternative TLB flushing mechanisms, e.g. INVVPID.  The only
novelty provided by PKU with respect to those goals is an additional
flag in the #PF error code, and the odds of KVM botching _only the PKU
flag when routing #PFs is very low.

Disable PKU in the config, e.g. instead of passing a param from the test,
so that the test can be run with PKU enabled simply by tweaking the QEMU
command line, e.g. without recompiling.

Reported-by: Yosry Ahmed <yosry.ahmed@linux.dev>
Signed-off-by: Sean Christopherson <seanjc@google.com>
---
 x86/unittests.cfg | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/x86/unittests.cfg b/x86/unittests.cfg
index 48835eba..f1ae3caa 100644
--- a/x86/unittests.cfg
+++ b/x86/unittests.cfg
@@ -426,7 +426,11 @@ groups = vmx nested_exception
 [vmx_pf_exception_test_fep]
 file = vmx.flat
 test_args = "vmx_pf_exception_forced_emulation_test"
-qemu_params = -cpu max,+vmx
+# Disable Protection Keys for the VMX #PF tests that require KVM to emulate one
+# or more instructions per testcase, as PKU increases the number of testcases
+# by an order of magnitude, and testing PKU for these specific tests isn't all
+# that interesting.
+qemu_params = -cpu max,+vmx,-pku
 arch = x86_64
 groups = vmx nested_exception nodefault
 timeout = 240
@@ -434,7 +438,7 @@ timeout = 240
 [vmx_pf_vpid_test]
 file = vmx.flat
 test_args = "vmx_pf_vpid_test"
-qemu_params = -cpu max,+vmx
+qemu_params = -cpu max,+vmx,-pku
 arch = x86_64
 groups = vmx nested_exception nodefault
 timeout = 240
@@ -442,7 +446,7 @@ timeout = 240
 [vmx_pf_invvpid_test]
 file = vmx.flat
 test_args = "vmx_pf_invvpid_test"
-qemu_params = -cpu max,+vmx
+qemu_params = -cpu max,+vmx,-pku
 arch = x86_64
 groups = vmx nested_exception nodefault
 timeout = 240
@@ -450,7 +454,7 @@ timeout = 240
 [vmx_pf_no_vpid_test]
 file = vmx.flat
 test_args = "vmx_pf_no_vpid_test"
-qemu_params = -cpu max,+vmx
+qemu_params = -cpu max,+vmx,-pku
 arch = x86_64
 groups = vmx nested_exception nodefault
 timeout = 240

base-commit: 4d60e2429d63dc0c24990114a8afc89e86c187cc
-- 
2.54.0.563.g4f69b47b94-goog

Re: [kvm-unit-tests PATCH] x86: Disable PKU in vCPU model for vmx_pf_{vpid/no_vpid/invvpid}_test

[Yosry Ahmed]

On Thu, May 14, 2026 at 1:05 PM Sean Christopherson <seanjc@google.com> wrote:
>
> Run the vmx_pf_{vpid/no_vpid/invvpid}_test VMX tests with -pku, i.e. with
> Protection Keys disabled in the (v)CPU model, to reduce the number of
> testcases by an order of magnitude, which in turn reduces the runtime by
> roughly the same factor.  As is, even the 240 seconds timeout is
> insufficient, e.g. each test can take upwards of 300 seconds when run on
> Skylake-era hardware with a debug kernel.
>
> Simply disable PKU in the config as the purpose of the VMX #PF tests is
> primarily to validate #PF routing (to L1 vs. L0), and secondarily to
> validate alternative TLB flushing mechanisms, e.g. INVVPID.  The only
> novelty provided by PKU with respect to those goals is an additional
> flag in the #PF error code, and the odds of KVM botching _only the PKU
> flag when routing #PFs is very low.
>
> Disable PKU in the config, e.g. instead of passing a param from the test,
> so that the test can be run with PKU enabled simply by tweaking the QEMU
> command line, e.g. without recompiling.
>
> Reported-by: Yosry Ahmed <yosry.ahmed@linux.dev>
> Signed-off-by: Sean Christopherson <seanjc@google.com>

Reviewed-by: Yosry Ahmed <yosry@kernel.org>

Feel free to update the Reported-by email if you want it to match Reviewed-by.