Re: [kvm-unit-tests PATCH 00/39] x86/access: nVMX: Big overhaul

[Sean Christopherson <seanjc@google.com>]

On Fri, Nov 26, 2021, Paolo Bonzini wrote:
> On 11/25/21 02:28, Sean Christopherson wrote:
> > This started out as a very simple test (patch 39/39) to expose a KVM bug
> > where KVM doesn't sync a shadow MMU on a vmcs12->vpid change.  Except the
> > test didn't fail.  And it turns out, completely removing INVLPG from the
> > base access test doesn't fail when using shadow paging either.
> > 
> > The underlying problem in both cases is that the access test is flat out
> > stupid when it comes to handling page tables.  Instead of allocating page
> > tables once and manipulating them on each iteration, it "allocates" a new
> > paging structure when necessary on every. single. iteration.  In addition
> > to being incredibly inefficient (allocation also zeros the entire 4kb page,
> > so the test zeros absurd amounts of memory), writing upper level PTEs on
> > every iteration triggers write-protection mechanisms in KVM.  In effect,
> > KVM ends up synchronizing the relevant SPTEs on every iteration, which
> > again is ridiculously slow and makes it all but impossible to actually
> > test that KVM handles other TLB invalidation scenarios.
> > 
> > Trying to solve that mess by pre-allocating the page tables exposed a
> > whole pile of 5-level paging issues.  I'd say the test's 5-level support
> > is held together by duct tape, but I've fixed many things with duct tape
> > that are far less fragile.
> > 
> > The second half of this series is cleanups in the nVMX code to prepare
> > for adding the (INV)VPID variants.  Not directly related to the access
> > tests, but it annoyed me to no end that simply checking if INVVPID is
> > supported was non-trivial.
> 
> Queued, thanks.  The new tests are pretty slow on debug kernels (about 3
> minutes each).  I'll check next week if there's any low hanging fruit---or
> anything broken.

Hrm, by "debug kernels", do you mean with KASAN, UBSAN, etc...?  I don't think I
tested those.  And with or without EPT enabled?

The tests are definitely much slower than the base access test and its nVMX variant
as they trigger exits on every INVLPG, but three minutes is a bit extreme.