Re: [PATCH] x86/hvm: Unilaterally inject #UD for unknown VMExits

[Jan Beulich <jbeulich@xxxxxxxx>]

On 28.11.2025 18:47, Andrew Cooper wrote:
> While we do this for unknown user mode exits, crashing for supervisor mode
> exits is unhelpful.  Intel in particular expect the unknown case to be #UD
> because they do introduce new instructions with new VMEXIT_* codes without
> other enablement controls.  e.g. MSRLIST, USER_MSR, MSR_IMM, but AMD have
> RDPRU and SKINIT as examples too.

USER-MSR has MSR_USER_MSR_CTL, so doesn't fully fit here? (It's still not us
to directly control exposure of the insns, but an OS would need to use the
MSR to do so, and hence we need to properly handle writes to that MSR for
the respective exits to become possible.)

MSRLIST has a dedicated exec control, so whether the exits can occur is
under our control.

RDPRU and SKINIT have dedicated intercepts, without use of which the
respective exit can't occur aiui.

IOW it looks to be really only MSR-IMM which is special.

> @@ -3083,8 +3067,13 @@ void asmlinkage svm_vmexit_handler(void)
>          gprintk(XENLOG_ERR, "Unexpected vmexit: reason %#"PRIx64", "
>                  "exitinfo1 %#"PRIx64", exitinfo2 %#"PRIx64"\n",
>                  exit_reason, vmcb->exitinfo1, vmcb->exitinfo2);
> -    crash_or_fault:
> -        svm_crash_or_fault(v);
> +        fallthrough;
> +    case VMEXIT_MONITOR:
> +    case VMEXIT_MWAIT:
> +    case VMEXIT_SKINIT:
> +    case VMEXIT_RDPRU:
> +    inject_ud:
> +        hvm_inject_hw_exception(X86_EXC_UD, X86_EVENT_NO_EC);
>          break;
>      }
>  

Should this be brought more in line with respective VMX code (kept) below,
in never bypassing the gprintk() by any of the case labels? Basically
meaning that the case labels you move could simply be dropped for the time
being (or else, like the INVCPID one visible in context below, would want
re-inserting a few lines earlier).

Jan

> @@ -4902,14 +4903,9 @@ void asmlinkage vmx_vmexit_handler(struct 
> cpu_user_regs *regs)
>      case EXIT_REASON_INVPCID:
>      /* fall through */
>      default:
> -    exit_and_crash:
> +    unexpected_vmexit:
>          gprintk(XENLOG_ERR, "Unexpected vmexit: reason %lu\n", exit_reason);
> -
> -        if ( vmx_get_cpl() )
> -            hvm_inject_hw_exception(X86_EXC_UD,
> -                                    X86_EVENT_NO_EC);
> -        else
> -            domain_crash(v->domain);
> +        hvm_inject_hw_exception(X86_EXC_UD, X86_EVENT_NO_EC);
>          break;
>      }
>  
> 
> base-commit: 117a46287427db2a6f5fe219eb2031d7ca39b603