On Thu, Mar 13, 2025, Jon Kohler wrote:
> ## Summary
> This series introduces support for Intel Mode-Based Execute Control
> (MBEC) to KVM and nested VMX virtualization, aiming to significantly
> reduce VMexits and improve performance for Windows guests running with
> Hypervisor-Protected Code Integrity (HVCI).
...
> ## Testing
> Initial testing has been on done on 6.12-based code with:
> Guests
> - Windows 11 24H2 26100.2894
> - Windows Server 2025 24H2 26100.2894
> - Windows Server 2022 W1H2 20348.825
> Processors:
> - Intel Skylake 6154
> - Intel Sapphire Rapids 6444Y
This series needs testcases, and lots of 'em. A short list off the top of my head:
- New KVM-Unit-Test (KUT) ept_access_xxx testcases to verify KVM does the right
thing with respect to user and supervisor code fetches when MBEC is:
1. Supported and Enabled
2. Supported but Disabled
3. Unsupported
- KUT testcases to verify VMLAUNCH/VMRESUME consistency checks.
- KUT testcases to verify KVM treats WRITABLE+USER_EXEC as an illegal combination,
i.e. that MBEC doesn't affect the W=1,R=0 behavior.
The access tests in particular absolutely need to be provided along with the next
version. Unless I'm missing something, this RFC implementation is buggy throughout
due to tracking MBEC on a per-vCPU basis, and all of those bugs should be exposed
by even relative basic testcases.
