MSR intercepts don't trigger the registered handler

[WebDesignbyTM]

Hello! I was playing around with the project using a Windows virtual machine and wanted to see if I could intercept the moment that system calls are made. The main objective was to see if it would be feasible analyze a program's behavior at runtime based on the system calls it invokes within the guest.
In order to do this, I wanted to start the existing MSR intercept in virt_mshv_vtl::UhProtoPartition::build, but the registered handler doesn't seem to fire. I've placed a log inside the HypervisorBackedX86::run_vp function to see when an intercept handler is called, but the only intercept types I've noticed are related to IoPorts, Gpa mappings and unmappings, and Eoi.
The architecture should ne intel x64, am I not looking at the right pieces of code, or am I missing something else?

[smalis-msft]

virt_mshv_vtl is only used when our codebase is built as OpenHCL and is running as a paravisor. From your description it sounds like you're just running plain OpenVMM though, so this codepath wouldn't be active. I recommend reading https://openvmm.dev/guide/ if you're curious about the difference. To see the behavior you want you'll need to find a similar path in whichever virt_ backend you are using (most likely virt_kvm on linux, virt_whp on windows).

Apologies for the delayed response!

[smalis-msft]

Indeed it is, just search for cr_intercept_registration and CrInterceptControl.

[WebDesignbyTM]

Thank you very much! I will look into this and close the discussion as soon as I confirm it works.

[WebDesignbyTM]

Looking through the CVM code, I noticed that within the implementation for UhHypercallHandler::set_vtl1_cr_intercept_control the supported_controls has the bits corresponding to msr_lstar_write and msr_sysenter_eip_write. I assume this code is responsible for intercepting CR changes within the secure kernel that runs at VTL 1. Based on this, I would have two follow-up questions:
Firstly, does the current CVM-adjacent code intercept writes to IA32_LSTAR and IA32_SYSENTER_EIP under the CR logic? Most sources (including the intel software manual) cite these as being a MSRs, and they were the original target of my interception logic.
Secondly, would it be possible to replicate the introduction of such interception logic for non-CVMs at VTL 0? In particular, I am asking if there is any technical gotcha that I should have in mind when writing the associated code owing to the difference in VTL/CVM context between the scopes.
If writes to these 2 are successfully captured, I could essentially discover the entry point into syscall logic, mark the corresponding memory page as non-executable, and capture any attempt to execute a system call through the General Protection exceptions that fire as a result.

[smalis-msft]

My understanding is 1. Yes, if VTL 1 asks for it, and 2. Yes, I think the hypervisor supports this. However I'm not 100% certain.