* [PATCH 1/4] target/i386: emulate: include name of unhandled instruction
2026-04-02 5:33 [PATCH 0/4] whpx: i386: x2apic emulation for kernel-irqchip=off, feature probing Mohamed Mediouni
@ 2026-04-02 5:33 ` Mohamed Mediouni
2026-04-02 5:33 ` [PATCH 2/4] whpx: i386: x2apic emulation Mohamed Mediouni
` (2 subsequent siblings)
3 siblings, 0 replies; 5+ messages in thread
From: Mohamed Mediouni @ 2026-04-02 5:33 UTC (permalink / raw)
To: qemu-devel
Cc: Wei Liu, Roman Bolshakov, Pedro Barbuda, Zhao Liu, Paolo Bonzini,
Mohamed Mediouni, Phil Dennis-Jordan
Instead of just the command number, include the instruction name to make debugging easier.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/emulate/x86_emu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/target/i386/emulate/x86_emu.c b/target/i386/emulate/x86_emu.c
index 55b1a68eb6..c2da1a133f 100644
--- a/target/i386/emulate/x86_emu.c
+++ b/target/i386/emulate/x86_emu.c
@@ -1399,8 +1399,8 @@ static void init_cmd_handler(void)
bool exec_instruction(CPUX86State *env, struct x86_decode *ins)
{
if (!_cmd_handler[ins->cmd].handler) {
- printf("Unimplemented handler (" TARGET_FMT_lx ") for %d (%x %x)\n",
- env->eip,
+ printf("Unimplemented handler (" TARGET_FMT_lx ") for %s - %d (%x %x)\n",
+ env->eip, decode_cmd_to_string(ins->cmd),
ins->cmd, ins->opcode[0],
ins->opcode_len > 1 ? ins->opcode[1] : 0);
env->eip += ins->len;
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 2/4] whpx: i386: x2apic emulation
2026-04-02 5:33 [PATCH 0/4] whpx: i386: x2apic emulation for kernel-irqchip=off, feature probing Mohamed Mediouni
2026-04-02 5:33 ` [PATCH 1/4] target/i386: emulate: include name of unhandled instruction Mohamed Mediouni
@ 2026-04-02 5:33 ` Mohamed Mediouni
2026-04-02 5:33 ` [PATCH 3/4] whpx: i386: wire up feature probing Mohamed Mediouni
2026-04-02 5:33 ` [PATCH 4/4] whpx: i386: disable TbFlushHypercalls for emulated LAPIC Mohamed Mediouni
3 siblings, 0 replies; 5+ messages in thread
From: Mohamed Mediouni @ 2026-04-02 5:33 UTC (permalink / raw)
To: qemu-devel
Cc: Wei Liu, Roman Bolshakov, Pedro Barbuda, Zhao Liu, Paolo Bonzini,
Mohamed Mediouni, Phil Dennis-Jordan
Add x2apic emulation to WHPX for the kernel-irqchip=off case.
Unfortunately, it looks like there isn't a workaround available
for proper behavior of PIC interrupts when kernel-irqchip=on
for Windows 10. The OS is out of support outside of extended
security updates so this will not be addressed.
On Windows 11, x2apic will be enabled straight away because
Linux enables it even without an IOMMU when using Hyper-V.
For Windows 10, you need: -device intel-iommu,intremap=on,eim=on
The performance impact is worthwhile for multicore guests.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 128 +++++++++++++++++++++++++++++++++++-
1 file changed, 127 insertions(+), 1 deletion(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index e56ae2b343..f06474c31b 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1082,6 +1082,8 @@ HRESULT whpx_set_exception_exit_bitmap(UINT64 exceptions)
/* Register for MSR and CPUID exits */
memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));
prop.ExtendedVmExits.X64MsrExit = 1;
+ prop.ExtendedVmExits.X64CpuidExit = 1;
+
if (exceptions != 0) {
prop.ExtendedVmExits.ExceptionExit = 1;
}
@@ -1898,6 +1900,12 @@ int whpx_vcpu_run(CPUState *cpu)
WHV_REGISTER_NAME reg_names[3];
UINT32 reg_count;
bool is_known_msr = 0;
+ uint64_t val;
+
+ if (vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
+ val = ((uint32_t)vcpu->exit_ctx.MsrAccess.Rax) |
+ ((uint64_t)(vcpu->exit_ctx.MsrAccess.Rdx) << 32);
+ }
reg_names[0] = WHvX64RegisterRip;
reg_names[1] = WHvX64RegisterRax;
@@ -1911,7 +1919,47 @@ int whpx_vcpu_run(CPUState *cpu)
&& !vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite
&& !whpx_irqchip_in_kernel()) {
is_known_msr = 1;
- reg_values[1].Reg32 = (uint32_t)X86_CPU(cpu)->env.apic_bus_freq;
+ val = X86_CPU(cpu)->env.apic_bus_freq;
+ }
+
+ if (!whpx_irqchip_in_kernel() &&
+ vcpu->exit_ctx.MsrAccess.MsrNumber == MSR_IA32_APICBASE) {
+ is_known_msr = 1;
+ if (!vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
+ /* Read path unreachable on Hyper-V */
+ abort();
+ } else {
+ WHV_REGISTER_VALUE reg = {.Reg64 = val};
+ int ret = cpu_set_apic_base(X86_CPU(cpu)->apic_state, val);
+ if (ret < 0) {
+ x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);
+ }
+ whpx_set_reg(cpu, WHvX64RegisterApicBase, reg);
+ }
+ }
+
+ if (!whpx_irqchip_in_kernel() &&
+ vcpu->exit_ctx.MsrAccess.MsrNumber >= MSR_APIC_START &&
+ vcpu->exit_ctx.MsrAccess.MsrNumber <= MSR_APIC_END) {
+ int index = vcpu->exit_ctx.MsrAccess.MsrNumber - MSR_APIC_START;
+ int ret;
+ is_known_msr = 1;
+ if (!vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
+ bql_lock();
+ ret = apic_msr_read(X86_CPU(cpu)->apic_state, index, &val);
+ bql_unlock();
+ reg_values[1].Reg64 = val;
+ if (ret < 0) {
+ x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);
+ }
+ } else {
+ bql_lock();
+ ret = apic_msr_write(X86_CPU(cpu)->apic_state, index, val);
+ bql_unlock();
+ if (ret < 0) {
+ x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);
+ }
+ }
}
/*
* For all unsupported MSR access we:
@@ -1921,6 +1969,11 @@ int whpx_vcpu_run(CPUState *cpu)
reg_count = vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite ?
1 : 3;
+ if (!vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
+ reg_values[1].Reg32 = (uint32_t)val;
+ reg_values[2].Reg32 = (uint32_t)(val >> 32);
+ }
+
if (!is_known_msr) {
trace_whpx_unsupported_msr_access(vcpu->exit_ctx.MsrAccess.MsrNumber,
vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite);
@@ -1939,6 +1992,47 @@ int whpx_vcpu_run(CPUState *cpu)
ret = 0;
break;
}
+ case WHvRunVpExitReasonX64Cpuid: {
+ WHV_REGISTER_VALUE reg_values[5] = {0};
+ WHV_REGISTER_NAME reg_names[5];
+ UINT32 reg_count = 5;
+ X86CPU *x86_cpu = X86_CPU(cpu);
+ CPUX86State *env = &x86_cpu->env;
+
+ reg_names[0] = WHvX64RegisterRip;
+ reg_names[1] = WHvX64RegisterRax;
+ reg_names[2] = WHvX64RegisterRcx;
+ reg_names[3] = WHvX64RegisterRdx;
+ reg_names[4] = WHvX64RegisterRbx;
+
+ reg_values[0].Reg64 =
+ vcpu->exit_ctx.VpContext.Rip +
+ vcpu->exit_ctx.VpContext.InstructionLength;
+
+ reg_values[1].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRax;
+ reg_values[2].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRcx;
+ reg_values[3].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRdx;
+ reg_values[4].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRbx;
+
+ if (vcpu->exit_ctx.CpuidAccess.Rax == 1) {
+ if (cpu_has_x2apic_feature(env)) {
+ reg_values[2].Reg64 |= CPUID_EXT_X2APIC;
+ }
+ }
+
+ hr = whp_dispatch.WHvSetVirtualProcessorRegisters(
+ whpx->partition,
+ cpu->cpu_index,
+ reg_names, reg_count,
+ reg_values);
+
+ if (FAILED(hr)) {
+ error_report("WHPX: Failed to set CpuidAccess state "
+ " registers, hr=%08lx", hr);
+ }
+ ret = 0;
+ break;
+ }
case WHvRunVpExitReasonException:
whpx_get_registers(cpu, WHPX_LEVEL_FULL_STATE);
@@ -2136,6 +2230,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
WHV_PROCESSOR_FEATURES_BANKS processor_features;
WHV_PROCESSOR_PERFMON_FEATURES perfmon_features;
bool is_legacy_os = false;
+ UINT32 cpuidExitList[] = {1};
whpx = &whpx_global;
@@ -2354,6 +2449,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
/* Register for MSR and CPUID exits */
memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));
prop.ExtendedVmExits.X64MsrExit = 1;
+ prop.ExtendedVmExits.X64CpuidExit = 1;
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
@@ -2366,6 +2462,36 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
goto error;
}
+ memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));
+ prop.X64MsrExitBitmap.UnhandledMsrs = 1;
+ if (!whpx_irqchip_in_kernel()) {
+ prop.X64MsrExitBitmap.ApicBaseMsrWrite = 1;
+ }
+
+ hr = whp_dispatch.WHvSetPartitionProperty(
+ whpx->partition,
+ WHvPartitionPropertyCodeX64MsrExitBitmap,
+ &prop,
+ sizeof(WHV_PARTITION_PROPERTY));
+ if (FAILED(hr)) {
+ error_report("WHPX: Failed to set MSR exit bitmap, hr=%08lx", hr);
+ ret = -EINVAL;
+ goto error;
+ }
+
+ hr = whp_dispatch.WHvSetPartitionProperty(
+ whpx->partition,
+ WHvPartitionPropertyCodeCpuidExitList,
+ cpuidExitList,
+ RTL_NUMBER_OF(cpuidExitList) * sizeof(UINT32));
+
+ if (FAILED(hr)) {
+ error_report("WHPX: Failed to set partition CpuidExitList hr=%08lx",
+ hr);
+ ret = -EINVAL;
+ goto error;
+ }
+
/*
* We do not want to intercept any exceptions from the guest,
* until we actually start debugging with gdb.
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 3/4] whpx: i386: wire up feature probing
2026-04-02 5:33 [PATCH 0/4] whpx: i386: x2apic emulation for kernel-irqchip=off, feature probing Mohamed Mediouni
2026-04-02 5:33 ` [PATCH 1/4] target/i386: emulate: include name of unhandled instruction Mohamed Mediouni
2026-04-02 5:33 ` [PATCH 2/4] whpx: i386: x2apic emulation Mohamed Mediouni
@ 2026-04-02 5:33 ` Mohamed Mediouni
2026-04-02 5:33 ` [PATCH 4/4] whpx: i386: disable TbFlushHypercalls for emulated LAPIC Mohamed Mediouni
3 siblings, 0 replies; 5+ messages in thread
From: Mohamed Mediouni @ 2026-04-02 5:33 UTC (permalink / raw)
To: qemu-devel
Cc: Wei Liu, Roman Bolshakov, Pedro Barbuda, Zhao Liu, Paolo Bonzini,
Mohamed Mediouni, Phil Dennis-Jordan
Windows 10 doesn't have the API for this, so using this
only for Windows 11.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
include/system/whpx-internal.h | 3 ++
target/i386/cpu.c | 25 ++++++++++++++
target/i386/whpx/whpx-all.c | 63 +++++++++++++++++++++++++++++++++-
target/i386/whpx/whpx-i386.h | 4 +++
4 files changed, 94 insertions(+), 1 deletion(-)
create mode 100644 target/i386/whpx/whpx-i386.h
diff --git a/include/system/whpx-internal.h b/include/system/whpx-internal.h
index 8482901f71..480d05fdca 100644
--- a/include/system/whpx-internal.h
+++ b/include/system/whpx-internal.h
@@ -89,6 +89,9 @@ void whpx_apic_get(APICCommonState *s);
UINT32 StateSize)) \
X(HRESULT, WHvResetPartition, \
(WHV_PARTITION_HANDLE Partition)) \
+ X(HRESULT, WHvGetVirtualProcessorCpuidOutput, \
+ (WHV_PARTITION_HANDLE Partition, UINT32 VpIndex, UINT32 Eax, \
+ UINT32 Ecx, WHV_CPUID_OUTPUT* CpuidOutput))
#define WHP_DEFINE_TYPE(return_type, function_name, signature) \
typedef return_type (WINAPI *function_name ## _t) signature;
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index c6fd1dc00e..0000093fa3 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -26,6 +26,8 @@
#include "tcg/helper-tcg.h"
#include "exec/translation-block.h"
#include "system/hvf.h"
+#include "system/whpx.h"
+#include "whpx/whpx-i386.h"
#include "hvf/hvf-i386.h"
#include "kvm/kvm_i386.h"
#include "kvm/tdx.h"
@@ -8087,6 +8089,17 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w)
r = hvf_get_supported_cpuid(wi->cpuid.eax,
wi->cpuid.ecx,
wi->cpuid.reg);
+ } else if (whpx_enabled()) {
+ if (wi->type != CPUID_FEATURE_WORD) {
+ return 0;
+ }
+ if (whpx_is_legacy_os()) {
+ r = wi->tcg_features;
+ } else {
+ r = whpx_get_supported_cpuid(wi->cpuid.eax,
+ wi->cpuid.ecx,
+ wi->cpuid.reg);
+ }
} else if (tcg_enabled() || qtest_enabled()) {
r = wi->tcg_features;
} else {
@@ -8168,6 +8181,18 @@ static void x86_cpu_get_supported_cpuid(uint32_t func, uint32_t index,
*ebx = hvf_get_supported_cpuid(func, index, R_EBX);
*ecx = hvf_get_supported_cpuid(func, index, R_ECX);
*edx = hvf_get_supported_cpuid(func, index, R_EDX);
+ } else if (whpx_enabled()) {
+ if (whpx_is_legacy_os()) {
+ *eax = 0;
+ *ebx = 0;
+ *ecx = 0;
+ *edx = 0;
+ } else {
+ *eax = whpx_get_supported_cpuid(func, index, R_EAX);
+ *ebx = whpx_get_supported_cpuid(func, index, R_EBX);
+ *ecx = whpx_get_supported_cpuid(func, index, R_ECX);
+ *edx = whpx_get_supported_cpuid(func, index, R_EDX);
+ }
} else {
*eax = 0;
*ebx = 0;
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index f06474c31b..ad5ec3e700 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -36,6 +36,7 @@
#include "system/whpx-accel-ops.h"
#include "system/whpx-all.h"
#include "system/whpx-common.h"
+#include "whpx-i386.h"
#include "emulate/x86_decode.h"
#include "emulate/x86_emu.h"
@@ -49,6 +50,8 @@
/* for kernel-irqchip=off */
#define HV_X64_MSR_APIC_FREQUENCY 0x40000023
+bool is_legacy_os = false;
+
static const WHV_REGISTER_NAME whpx_register_names[] = {
/* X64 General purpose registers */
@@ -1062,6 +1065,65 @@ static void whpx_init_emu(void)
init_emu(&whpx_x86_emul_ops);
}
+bool whpx_is_legacy_os(void)
+{
+ return is_legacy_os;
+}
+
+uint32_t whpx_get_supported_cpuid(uint32_t func, uint32_t idx, int reg)
+{
+ WHV_CPUID_OUTPUT output;
+ uint32_t eax, ebx, ecx, edx;
+ uint32_t cpu_index = 0;
+ bool temp_cpu = true;
+ HRESULT hr;
+
+ hr = whp_dispatch.WHvCreateVirtualProcessor(
+ whpx_global.partition, cpu_index, 0);
+
+ /* This means that the CPU already exists... */
+ if (FAILED(hr)) {
+ temp_cpu = false;
+ }
+
+ hr = whp_dispatch.WHvGetVirtualProcessorCpuidOutput(whpx_global.partition,
+ cpu_index, func, idx, &output);
+
+ if (FAILED(hr)) {
+ abort();
+ }
+
+ if (temp_cpu) {
+ hr = whp_dispatch.WHvDeleteVirtualProcessor(whpx_global.partition, cpu_index);
+ if (FAILED(hr)) {
+ abort();
+ }
+ }
+
+ eax = output.Eax;
+ ebx = output.Ebx;
+ ecx = output.Ecx;
+ edx = output.Edx;
+
+ /* We can emulate X2APIC even for the kernel-irqchip=off case */
+ if (func == 1) {
+ ecx |= CPUID_EXT_X2APIC;
+ }
+
+ switch (reg) {
+ case R_EAX:
+ return eax;
+ case R_EBX:
+ return ebx;
+ case R_ECX:
+ return ecx;
+ case R_EDX:
+ return edx;
+ default:
+ return 0;
+ }
+}
+
/*
* Controls whether we should intercept various exceptions on the guest,
* namely breakpoint/single-step events.
@@ -2229,7 +2291,6 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
WHV_CAPABILITY_FEATURES features = {0};
WHV_PROCESSOR_FEATURES_BANKS processor_features;
WHV_PROCESSOR_PERFMON_FEATURES perfmon_features;
- bool is_legacy_os = false;
UINT32 cpuidExitList[] = {1};
whpx = &whpx_global;
diff --git a/target/i386/whpx/whpx-i386.h b/target/i386/whpx/whpx-i386.h
new file mode 100644
index 0000000000..6db9a75d39
--- /dev/null
+++ b/target/i386/whpx/whpx-i386.h
@@ -0,0 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+uint32_t whpx_get_supported_cpuid(uint32_t func, uint32_t idx, int reg);
+bool whpx_is_legacy_os(void);
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 5+ messages in thread* [PATCH 4/4] whpx: i386: disable TbFlushHypercalls for emulated LAPIC
2026-04-02 5:33 [PATCH 0/4] whpx: i386: x2apic emulation for kernel-irqchip=off, feature probing Mohamed Mediouni
` (2 preceding siblings ...)
2026-04-02 5:33 ` [PATCH 3/4] whpx: i386: wire up feature probing Mohamed Mediouni
@ 2026-04-02 5:33 ` Mohamed Mediouni
3 siblings, 0 replies; 5+ messages in thread
From: Mohamed Mediouni @ 2026-04-02 5:33 UTC (permalink / raw)
To: qemu-devel
Cc: Wei Liu, Roman Bolshakov, Pedro Barbuda, Zhao Liu, Paolo Bonzini,
Mohamed Mediouni, Phil Dennis-Jordan
AccessHypercallRegs was present twice so clean that up.
Remove TbFlushHypercalls (and its extended Gva range sub-feature)
from the user-mode LAPIC case as it behaves oddly there.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index ad5ec3e700..b29f8d43c9 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2477,10 +2477,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
synthetic_features.Bank0.AccessPartitionReferenceTsc = 1;
synthetic_features.Bank0.AccessHypercallRegs = 1;
synthetic_features.Bank0.AccessFrequencyRegs = 1;
- synthetic_features.Bank0.EnableExtendedGvaRangesForFlushVirtualAddressList = 1;
synthetic_features.Bank0.AccessVpIndex = 1;
- synthetic_features.Bank0.AccessHypercallRegs = 1;
- synthetic_features.Bank0.TbFlushHypercalls = 1;
if (whpx_irqchip_in_kernel()) {
synthetic_features.Bank0.AccessSynicRegs = 1;
@@ -2488,6 +2485,12 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
synthetic_features.Bank0.AccessIntrCtrlRegs = 1;
synthetic_features.Bank0.SyntheticClusterIpi = 1;
synthetic_features.Bank0.DirectSyntheticTimers = 1;
+ /*
+ * These technically work without the Hyper-V LAPIC
+ * but behave oddly for multi-core VMs.
+ */
+ synthetic_features.Bank0.TbFlushHypercalls = 1;
+ synthetic_features.Bank0.EnableExtendedGvaRangesForFlushVirtualAddressList = 1;
}
if (!is_legacy_os && whpx->hyperv_enlightenments_allowed) {
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 5+ messages in thread