* [PATCH v11 01/15] target/i386: emulate: include name of unhandled instruction
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 02/15] whpx: i386: x2apic emulation Mohamed Mediouni
` (13 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Instead of just the command number, include the instruction name to make debugging easier.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/emulate/x86_emu.c | 4 ++--
1 file changed, 2 insertions(+), 2 deletions(-)
diff --git a/target/i386/emulate/x86_emu.c b/target/i386/emulate/x86_emu.c
index 55b1a68eb6..c2da1a133f 100644
--- a/target/i386/emulate/x86_emu.c
+++ b/target/i386/emulate/x86_emu.c
@@ -1399,8 +1399,8 @@ static void init_cmd_handler(void)
bool exec_instruction(CPUX86State *env, struct x86_decode *ins)
{
if (!_cmd_handler[ins->cmd].handler) {
- printf("Unimplemented handler (" TARGET_FMT_lx ") for %d (%x %x)\n",
- env->eip,
+ printf("Unimplemented handler (" TARGET_FMT_lx ") for %s - %d (%x %x)\n",
+ env->eip, decode_cmd_to_string(ins->cmd),
ins->cmd, ins->opcode[0],
ins->opcode_len > 1 ? ins->opcode[1] : 0);
env->eip += ins->len;
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 02/15] whpx: i386: x2apic emulation
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 01/15] target/i386: emulate: include name of unhandled instruction Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 03/15] whpx: i386: wire up feature probing Mohamed Mediouni
` (12 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Add x2apic emulation to WHPX for the kernel-irqchip=off case.
Unfortunately, it looks like there isn't a workaround available
for proper behavior of PIC interrupts when kernel-irqchip=on
for Windows 10. The OS is out of support outside of extended
security updates so this will not be addressed.
The performance boost is quite visible for multicore guests.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 134 +++++++++++++++++++++++++++++++++++-
1 file changed, 133 insertions(+), 1 deletion(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index e56ae2b343..4127440c0c 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1082,6 +1082,8 @@ HRESULT whpx_set_exception_exit_bitmap(UINT64 exceptions)
/* Register for MSR and CPUID exits */
memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));
prop.ExtendedVmExits.X64MsrExit = 1;
+ prop.ExtendedVmExits.X64CpuidExit = 1;
+
if (exceptions != 0) {
prop.ExtendedVmExits.ExceptionExit = 1;
}
@@ -1898,6 +1900,18 @@ int whpx_vcpu_run(CPUState *cpu)
WHV_REGISTER_NAME reg_names[3];
UINT32 reg_count;
bool is_known_msr = 0;
+ uint64_t val;
+
+ if (vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
+ val = ((uint32_t)vcpu->exit_ctx.MsrAccess.Rax) |
+ ((uint64_t)(vcpu->exit_ctx.MsrAccess.Rdx) << 32);
+ } else {
+ /*
+ * Workaround for [-Werror=maybe-uninitialized]
+ * with GCC. Not needed with Clang.
+ */
+ val = 0;
+ }
reg_names[0] = WHvX64RegisterRip;
reg_names[1] = WHvX64RegisterRax;
@@ -1911,7 +1925,47 @@ int whpx_vcpu_run(CPUState *cpu)
&& !vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite
&& !whpx_irqchip_in_kernel()) {
is_known_msr = 1;
- reg_values[1].Reg32 = (uint32_t)X86_CPU(cpu)->env.apic_bus_freq;
+ val = X86_CPU(cpu)->env.apic_bus_freq;
+ }
+
+ if (!whpx_irqchip_in_kernel() &&
+ vcpu->exit_ctx.MsrAccess.MsrNumber == MSR_IA32_APICBASE) {
+ is_known_msr = 1;
+ if (!vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
+ /* Read path unreachable on Hyper-V */
+ abort();
+ } else {
+ WHV_REGISTER_VALUE reg = {.Reg64 = val};
+ int msr_ret = cpu_set_apic_base(X86_CPU(cpu)->apic_state, val);
+ if (msr_ret < 0) {
+ x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);
+ }
+ whpx_set_reg(cpu, WHvX64RegisterApicBase, reg);
+ }
+ }
+
+ if (!whpx_irqchip_in_kernel() &&
+ vcpu->exit_ctx.MsrAccess.MsrNumber >= MSR_APIC_START &&
+ vcpu->exit_ctx.MsrAccess.MsrNumber <= MSR_APIC_END) {
+ int index = vcpu->exit_ctx.MsrAccess.MsrNumber - MSR_APIC_START;
+ int msr_ret;
+ is_known_msr = 1;
+ if (!vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
+ bql_lock();
+ msr_ret = apic_msr_read(X86_CPU(cpu)->apic_state, index, &val);
+ bql_unlock();
+ reg_values[1].Reg64 = val;
+ if (msr_ret < 0) {
+ x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);
+ }
+ } else {
+ bql_lock();
+ msr_ret = apic_msr_write(X86_CPU(cpu)->apic_state, index, val);
+ bql_unlock();
+ if (msr_ret < 0) {
+ x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);
+ }
+ }
}
/*
* For all unsupported MSR access we:
@@ -1921,6 +1975,11 @@ int whpx_vcpu_run(CPUState *cpu)
reg_count = vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite ?
1 : 3;
+ if (!vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
+ reg_values[1].Reg32 = (uint32_t)val;
+ reg_values[2].Reg32 = (uint32_t)(val >> 32);
+ }
+
if (!is_known_msr) {
trace_whpx_unsupported_msr_access(vcpu->exit_ctx.MsrAccess.MsrNumber,
vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite);
@@ -1939,6 +1998,47 @@ int whpx_vcpu_run(CPUState *cpu)
ret = 0;
break;
}
+ case WHvRunVpExitReasonX64Cpuid: {
+ WHV_REGISTER_VALUE reg_values[5] = {0};
+ WHV_REGISTER_NAME reg_names[5];
+ UINT32 reg_count = 5;
+ X86CPU *x86_cpu = X86_CPU(cpu);
+ CPUX86State *env = &x86_cpu->env;
+
+ reg_names[0] = WHvX64RegisterRip;
+ reg_names[1] = WHvX64RegisterRax;
+ reg_names[2] = WHvX64RegisterRcx;
+ reg_names[3] = WHvX64RegisterRdx;
+ reg_names[4] = WHvX64RegisterRbx;
+
+ reg_values[0].Reg64 =
+ vcpu->exit_ctx.VpContext.Rip +
+ vcpu->exit_ctx.VpContext.InstructionLength;
+
+ reg_values[1].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRax;
+ reg_values[2].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRcx;
+ reg_values[3].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRdx;
+ reg_values[4].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRbx;
+
+ if (vcpu->exit_ctx.CpuidAccess.Rax == 1) {
+ if (cpu_has_x2apic_feature(env)) {
+ reg_values[2].Reg64 |= CPUID_EXT_X2APIC;
+ }
+ }
+
+ hr = whp_dispatch.WHvSetVirtualProcessorRegisters(
+ whpx->partition,
+ cpu->cpu_index,
+ reg_names, reg_count,
+ reg_values);
+
+ if (FAILED(hr)) {
+ error_report("WHPX: Failed to set CpuidAccess state "
+ " registers, hr=%08lx", hr);
+ }
+ ret = 0;
+ break;
+ }
case WHvRunVpExitReasonException:
whpx_get_registers(cpu, WHPX_LEVEL_FULL_STATE);
@@ -2136,6 +2236,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
WHV_PROCESSOR_FEATURES_BANKS processor_features;
WHV_PROCESSOR_PERFMON_FEATURES perfmon_features;
bool is_legacy_os = false;
+ UINT32 cpuidExitList[] = {1};
whpx = &whpx_global;
@@ -2354,6 +2455,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
/* Register for MSR and CPUID exits */
memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));
prop.ExtendedVmExits.X64MsrExit = 1;
+ prop.ExtendedVmExits.X64CpuidExit = 1;
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
@@ -2366,6 +2468,36 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
goto error;
}
+ memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));
+ prop.X64MsrExitBitmap.UnhandledMsrs = 1;
+ if (!whpx_irqchip_in_kernel()) {
+ prop.X64MsrExitBitmap.ApicBaseMsrWrite = 1;
+ }
+
+ hr = whp_dispatch.WHvSetPartitionProperty(
+ whpx->partition,
+ WHvPartitionPropertyCodeX64MsrExitBitmap,
+ &prop,
+ sizeof(WHV_PARTITION_PROPERTY));
+ if (FAILED(hr)) {
+ error_report("WHPX: Failed to set MSR exit bitmap, hr=%08lx", hr);
+ ret = -EINVAL;
+ goto error;
+ }
+
+ hr = whp_dispatch.WHvSetPartitionProperty(
+ whpx->partition,
+ WHvPartitionPropertyCodeCpuidExitList,
+ cpuidExitList,
+ RTL_NUMBER_OF(cpuidExitList) * sizeof(UINT32));
+
+ if (FAILED(hr)) {
+ error_report("WHPX: Failed to set partition CpuidExitList hr=%08lx",
+ hr);
+ ret = -EINVAL;
+ goto error;
+ }
+
/*
* We do not want to intercept any exceptions from the guest,
* until we actually start debugging with gdb.
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 03/15] whpx: i386: wire up feature probing
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 01/15] target/i386: emulate: include name of unhandled instruction Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 02/15] whpx: i386: x2apic emulation Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 04/15] whpx: i386: disable TbFlushHypercalls for emulated LAPIC Mohamed Mediouni
` (11 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Windows 10 doesn't have the API for this, so using this
only for Windows 11.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
include/system/whpx-internal.h | 9 ++++
target/i386/cpu.c | 25 ++++++++++++
target/i386/whpx/whpx-all.c | 75 ++++++++++++++++++++++++++++++++--
target/i386/whpx/whpx-i386.h | 4 ++
4 files changed, 109 insertions(+), 4 deletions(-)
create mode 100644 target/i386/whpx/whpx-i386.h
diff --git a/include/system/whpx-internal.h b/include/system/whpx-internal.h
index 8482901f71..5902124b63 100644
--- a/include/system/whpx-internal.h
+++ b/include/system/whpx-internal.h
@@ -73,6 +73,14 @@ void whpx_apic_get(APICCommonState *s);
X(HRESULT, WHvGetVirtualProcessorRegisters, (WHV_PARTITION_HANDLE Partition, UINT32 VpIndex, const WHV_REGISTER_NAME* RegisterNames, UINT32 RegisterCount, WHV_REGISTER_VALUE* RegisterValues)) \
X(HRESULT, WHvSetVirtualProcessorRegisters, (WHV_PARTITION_HANDLE Partition, UINT32 VpIndex, const WHV_REGISTER_NAME* RegisterNames, UINT32 RegisterCount, const WHV_REGISTER_VALUE* RegisterValues)) \
+#ifdef __x86_64__
+#define LIST_WINHVPLATFORM_FUNCTIONS_SUPPLEMENTAL_ARCH(X) \
+ X(HRESULT, WHvGetVirtualProcessorCpuidOutput, \
+ (WHV_PARTITION_HANDLE Partition, UINT32 VpIndex, UINT32 Eax, \
+ UINT32 Ecx, WHV_CPUID_OUTPUT *CpuidOutput))
+#else
+#define LIST_WINHVPLATFORM_FUNCTIONS_SUPPLEMENTAL_ARCH(X)
+#endif
/*
* These are supplemental functions that may not be present
* on all versions and are not critical for basic functionality.
@@ -89,6 +97,7 @@ void whpx_apic_get(APICCommonState *s);
UINT32 StateSize)) \
X(HRESULT, WHvResetPartition, \
(WHV_PARTITION_HANDLE Partition)) \
+ LIST_WINHVPLATFORM_FUNCTIONS_SUPPLEMENTAL_ARCH(X)
#define WHP_DEFINE_TYPE(return_type, function_name, signature) \
typedef return_type (WINAPI *function_name ## _t) signature;
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index c6fd1dc00e..0000093fa3 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -26,6 +26,8 @@
#include "tcg/helper-tcg.h"
#include "exec/translation-block.h"
#include "system/hvf.h"
+#include "system/whpx.h"
+#include "whpx/whpx-i386.h"
#include "hvf/hvf-i386.h"
#include "kvm/kvm_i386.h"
#include "kvm/tdx.h"
@@ -8087,6 +8089,17 @@ uint64_t x86_cpu_get_supported_feature_word(X86CPU *cpu, FeatureWord w)
r = hvf_get_supported_cpuid(wi->cpuid.eax,
wi->cpuid.ecx,
wi->cpuid.reg);
+ } else if (whpx_enabled()) {
+ if (wi->type != CPUID_FEATURE_WORD) {
+ return 0;
+ }
+ if (whpx_is_legacy_os()) {
+ r = wi->tcg_features;
+ } else {
+ r = whpx_get_supported_cpuid(wi->cpuid.eax,
+ wi->cpuid.ecx,
+ wi->cpuid.reg);
+ }
} else if (tcg_enabled() || qtest_enabled()) {
r = wi->tcg_features;
} else {
@@ -8168,6 +8181,18 @@ static void x86_cpu_get_supported_cpuid(uint32_t func, uint32_t index,
*ebx = hvf_get_supported_cpuid(func, index, R_EBX);
*ecx = hvf_get_supported_cpuid(func, index, R_ECX);
*edx = hvf_get_supported_cpuid(func, index, R_EDX);
+ } else if (whpx_enabled()) {
+ if (whpx_is_legacy_os()) {
+ *eax = 0;
+ *ebx = 0;
+ *ecx = 0;
+ *edx = 0;
+ } else {
+ *eax = whpx_get_supported_cpuid(func, index, R_EAX);
+ *ebx = whpx_get_supported_cpuid(func, index, R_EBX);
+ *ecx = whpx_get_supported_cpuid(func, index, R_ECX);
+ *edx = whpx_get_supported_cpuid(func, index, R_EDX);
+ }
} else {
*eax = 0;
*ebx = 0;
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 4127440c0c..2d527b90dd 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -36,6 +36,7 @@
#include "system/whpx-accel-ops.h"
#include "system/whpx-all.h"
#include "system/whpx-common.h"
+#include "whpx-i386.h"
#include "emulate/x86_decode.h"
#include "emulate/x86_emu.h"
@@ -49,6 +50,8 @@
/* for kernel-irqchip=off */
#define HV_X64_MSR_APIC_FREQUENCY 0x40000023
+static bool is_modern_os = true;
+
static const WHV_REGISTER_NAME whpx_register_names[] = {
/* X64 General purpose registers */
@@ -1062,6 +1065,71 @@ static void whpx_init_emu(void)
init_emu(&whpx_x86_emul_ops);
}
+bool whpx_is_legacy_os(void)
+{
+ return !is_modern_os;
+}
+
+uint32_t whpx_get_supported_cpuid(uint32_t func, uint32_t idx, int reg)
+{
+ WHV_CPUID_OUTPUT output;
+ uint32_t eax, ebx, ecx, edx;
+ uint32_t cpu_index = 0;
+ bool temp_cpu = true;
+ HRESULT hr;
+
+ hr = whp_dispatch.WHvCreateVirtualProcessor(
+ whpx_global.partition, cpu_index, 0);
+
+ /* This means that the CPU already exists... */
+ if (FAILED(hr)) {
+ temp_cpu = false;
+ }
+
+ hr = whp_dispatch.WHvGetVirtualProcessorCpuidOutput(whpx_global.partition,
+ cpu_index, func, idx, &output);
+
+ if (FAILED(hr)) {
+ abort();
+ }
+
+ if (temp_cpu) {
+ hr = whp_dispatch.WHvDeleteVirtualProcessor(whpx_global.partition, cpu_index);
+ if (FAILED(hr)) {
+ abort();
+ }
+ }
+
+ eax = output.Eax;
+ ebx = output.Ebx;
+ ecx = output.Ecx;
+ edx = output.Edx;
+
+ /*
+ * We can emulate X2APIC even for the kernel-irqchip=off case.
+ * CPUID_EXT_HYPERVISOR and CPUID_HT should be considered present
+ * always, so report them as unconditionally supported here.
+ */
+ if (func == 1) {
+ ecx |= CPUID_EXT_X2APIC;
+ ecx |= CPUID_EXT_HYPERVISOR;
+ edx |= CPUID_HT;
+ }
+
+ switch (reg) {
+ case R_EAX:
+ return eax;
+ case R_EBX:
+ return ebx;
+ case R_ECX:
+ return ecx;
+ case R_EDX:
+ return edx;
+ default:
+ return 0;
+ }
+}
+
/*
* Controls whether we should intercept various exceptions on the guest,
* namely breakpoint/single-step events.
@@ -2235,7 +2303,6 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
WHV_CAPABILITY_FEATURES features = {0};
WHV_PROCESSOR_FEATURES_BANKS processor_features;
WHV_PROCESSOR_PERFMON_FEATURES perfmon_features;
- bool is_legacy_os = false;
UINT32 cpuidExitList[] = {1};
whpx = &whpx_global;
@@ -2395,7 +2462,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
if (FAILED(hr)) {
warn_report("WHPX: Failed to get performance "
"monitoring features, hr=%08lx", hr);
- is_legacy_os = true;
+ is_modern_os = false;
} else {
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
@@ -2435,7 +2502,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
synthetic_features.Bank0.DirectSyntheticTimers = 1;
}
- if (!is_legacy_os && whpx->hyperv_enlightenments_allowed) {
+ if (is_modern_os && whpx->hyperv_enlightenments_allowed) {
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
WHvPartitionPropertyCodeSyntheticProcessorFeaturesBanks,
@@ -2446,7 +2513,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
ret = -EINVAL;
goto error;
}
- } else if (is_legacy_os && whpx->hyperv_enlightenments_required) {
+ } else if (!is_modern_os && whpx->hyperv_enlightenments_required) {
error_report("Hyper-V enlightenments not available on legacy Windows");
ret = -EINVAL;
goto error;
diff --git a/target/i386/whpx/whpx-i386.h b/target/i386/whpx/whpx-i386.h
new file mode 100644
index 0000000000..6db9a75d39
--- /dev/null
+++ b/target/i386/whpx/whpx-i386.h
@@ -0,0 +1,4 @@
+/* SPDX-License-Identifier: GPL-2.0-or-later */
+
+uint32_t whpx_get_supported_cpuid(uint32_t func, uint32_t idx, int reg);
+bool whpx_is_legacy_os(void);
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 04/15] whpx: i386: disable TbFlushHypercalls for emulated LAPIC
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (2 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 03/15] whpx: i386: wire up feature probing Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 05/15] whpx: i386: enable x2apic by default for user-mode LAPIC Mohamed Mediouni
` (10 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
AccessHypercallRegs was present twice so clean that up.
Remove TbFlushHypercalls (and its extended Gva range sub-feature)
from the user-mode LAPIC case as it behaves oddly there.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 9 ++++++---
1 file changed, 6 insertions(+), 3 deletions(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 2d527b90dd..0908dfd134 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2489,10 +2489,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
synthetic_features.Bank0.AccessPartitionReferenceTsc = 1;
synthetic_features.Bank0.AccessHypercallRegs = 1;
synthetic_features.Bank0.AccessFrequencyRegs = 1;
- synthetic_features.Bank0.EnableExtendedGvaRangesForFlushVirtualAddressList = 1;
synthetic_features.Bank0.AccessVpIndex = 1;
- synthetic_features.Bank0.AccessHypercallRegs = 1;
- synthetic_features.Bank0.TbFlushHypercalls = 1;
if (whpx_irqchip_in_kernel()) {
synthetic_features.Bank0.AccessSynicRegs = 1;
@@ -2500,6 +2497,12 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
synthetic_features.Bank0.AccessIntrCtrlRegs = 1;
synthetic_features.Bank0.SyntheticClusterIpi = 1;
synthetic_features.Bank0.DirectSyntheticTimers = 1;
+ /*
+ * These technically work without the Hyper-V LAPIC
+ * but behave oddly for multi-core VMs.
+ */
+ synthetic_features.Bank0.TbFlushHypercalls = 1;
+ synthetic_features.Bank0.EnableExtendedGvaRangesForFlushVirtualAddressList = 1;
}
if (is_modern_os && whpx->hyperv_enlightenments_allowed) {
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 05/15] whpx: i386: enable x2apic by default for user-mode LAPIC
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (3 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 04/15] whpx: i386: disable TbFlushHypercalls for emulated LAPIC Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 06/15] whpx: i386: reintroduce enlightenments for Windows 10 Mohamed Mediouni
` (9 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 7 +++++++
1 file changed, 7 insertions(+)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 0908dfd134..66f263558f 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2281,11 +2281,18 @@ error:
return ret;
}
+static PropValue whpx_default_props[] = {
+ { "x2apic", "on" },
+ { NULL, NULL },
+};
+
+
void whpx_cpu_instance_init(CPUState *cs)
{
X86CPU *cpu = X86_CPU(cs);
host_cpu_instance_init(cpu);
+ x86_cpu_apply_props(cpu, whpx_default_props);
}
/*
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 06/15] whpx: i386: reintroduce enlightenments for Windows 10
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (4 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 05/15] whpx: i386: enable x2apic by default for user-mode LAPIC Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 07/15] whpx: i386: introduce proper cpuid support Mohamed Mediouni
` (8 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Was removed in 2c08624 but it's still useful for
Windows 10 so reintroduce it there.
And this time, actually make it work by reporting
the hypervisor bit in CPUID.
Pretend to be vmware to be able to use vmport's functionality.
If the vmware frequency leaf is disabled, pretend to be
KVM, with the only capability reported being X2APIC support.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
accel/whpx/whpx-common.c | 2 ++
include/system/whpx-internal.h | 1 +
target/arm/whpx/whpx-all.c | 1 +
target/i386/whpx/whpx-all.c | 63 +++++++++++++++++++++++++++++-----
4 files changed, 58 insertions(+), 9 deletions(-)
diff --git a/accel/whpx/whpx-common.c b/accel/whpx/whpx-common.c
index b813a5d9d2..59be996aef 100644
--- a/accel/whpx/whpx-common.c
+++ b/accel/whpx/whpx-common.c
@@ -550,6 +550,8 @@ static void whpx_accel_instance_init(Object *obj)
whpx->hyperv_enlightenments_allowed = true;
whpx->hyperv_enlightenments_required = false;
+ /* Value determined at whpx_accel_init */
+ whpx->hyperv_enlightenments_enabled = false;
}
static const TypeInfo whpx_accel_type = {
diff --git a/include/system/whpx-internal.h b/include/system/whpx-internal.h
index 5902124b63..cf782cf5f8 100644
--- a/include/system/whpx-internal.h
+++ b/include/system/whpx-internal.h
@@ -45,6 +45,7 @@ struct whpx_state {
bool hyperv_enlightenments_allowed;
bool hyperv_enlightenments_required;
+ bool hyperv_enlightenments_enabled;
};
diff --git a/target/arm/whpx/whpx-all.c b/target/arm/whpx/whpx-all.c
index bbf0f6be96..4019a513aa 100644
--- a/target/arm/whpx/whpx-all.c
+++ b/target/arm/whpx/whpx-all.c
@@ -968,6 +968,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
* as they're not needed for performance.
*/
if (whpx->hyperv_enlightenments_required) {
+ whpx->hyperv_enlightenments_enabled = true;
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
WHvPartitionPropertyCodeSyntheticProcessorFeaturesBanks,
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 66f263558f..c2a78312f8 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2083,14 +2083,57 @@ int whpx_vcpu_run(CPUState *cpu)
vcpu->exit_ctx.VpContext.Rip +
vcpu->exit_ctx.VpContext.InstructionLength;
- reg_values[1].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRax;
- reg_values[2].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRcx;
- reg_values[3].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRdx;
- reg_values[4].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRbx;
-
- if (vcpu->exit_ctx.CpuidAccess.Rax == 1) {
- if (cpu_has_x2apic_feature(env)) {
- reg_values[2].Reg64 |= CPUID_EXT_X2APIC;
+ if (whpx_is_legacy_os()) {
+ reg_values[1].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRax;
+ reg_values[2].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRcx;
+ reg_values[3].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRdx;
+ reg_values[4].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRbx;
+ } else {
+ cpu_x86_cpuid(env, vcpu->exit_ctx.CpuidAccess.Rax,
+ vcpu->exit_ctx.CpuidAccess.Rcx,
+ (UINT32 *)®_values[1].Reg32,
+ (UINT32 *)®_values[4].Reg32, (UINT32 *)®_values[2].Reg32,
+ (UINT32 *)®_values[3].Reg32);
+ }
+
+ if (!whpx->hyperv_enlightenments_enabled) {
+ switch (vcpu->exit_ctx.CpuidAccess.Rax) {
+ case 1:
+ reg_values[2].Reg64 |= CPUID_EXT_HYPERVISOR;
+ break;
+ case 0x40000000:
+ /*
+ * Use vmware_cpuid_freq as a proxy to report VMware.
+ * This is to get the TSC/APIC frequency query functionality
+ * provided through vmport, as Linux doesn't use leaf
+ * 0x40000010 for getting those frequencies.
+ */
+ if (x86_cpu->vmware_cpuid_freq) {
+ reg_values[1].Reg64 = 0x40000010;
+ reg_values[4].Reg64 = 0x61774d56;
+ reg_values[2].Reg64 = 0x4d566572;
+ reg_values[3].Reg64 = 0x65726177;
+ } else {
+ /* report KVM otherwise if that's disabled */
+ reg_values[1].Reg64 = 0x40000001;
+ reg_values[4].Reg64 = 0x4b4d564b;
+ reg_values[2].Reg64 = 0x564b4d56;
+ reg_values[3].Reg64 = 0x4d;
+ }
+ break;
+ case 0x40000001:
+ if (!x86_cpu->vmware_cpuid_freq) {
+ /* KVM reporting of X2APIC support */
+ reg_values[1].Reg64 = reg_values[4].Reg64 =
+ reg_values[2].Reg64 = 1 << 15;
+ }
+ break;
+ case 0x40000010:
+ if (x86_cpu->vmware_cpuid_freq) {
+ reg_values[1].Reg64 = env->tsc_khz;
+ reg_values[4].Reg64 = env->apic_bus_freq / 1000; /* Hz to KHz */
+ }
+ break;
}
}
@@ -2311,6 +2354,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
WHV_PROCESSOR_FEATURES_BANKS processor_features;
WHV_PROCESSOR_PERFMON_FEATURES perfmon_features;
UINT32 cpuidExitList[] = {1};
+ UINT32 cpuidExitList_nohyperv[] = {1, 0x40000000, 0x40000001, 0x40000010};
whpx = &whpx_global;
@@ -2513,6 +2557,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
}
if (is_modern_os && whpx->hyperv_enlightenments_allowed) {
+ whpx->hyperv_enlightenments_enabled = true;
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
WHvPartitionPropertyCodeSyntheticProcessorFeaturesBanks,
@@ -2565,7 +2610,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
WHvPartitionPropertyCodeCpuidExitList,
- cpuidExitList,
+ whpx->hyperv_enlightenments_enabled ? cpuidExitList : cpuidExitList_nohyperv,
RTL_NUMBER_OF(cpuidExitList) * sizeof(UINT32));
if (FAILED(hr)) {
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 07/15] whpx: i386: introduce proper cpuid support
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (5 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 06/15] whpx: i386: reintroduce enlightenments for Windows 10 Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 08/15] whpx: i386: kernel-irqchip=off fixes Mohamed Mediouni
` (7 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Unlike the implementation in QEMU 10.2, this one works.
It's not optimal though as it doesn't use the Hyper-V support for this.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 123 ++++++++++++++++++++++++++++++++++--
1 file changed, 119 insertions(+), 4 deletions(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index c2a78312f8..9827c93df1 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2071,6 +2071,7 @@ int whpx_vcpu_run(CPUState *cpu)
WHV_REGISTER_NAME reg_names[5];
UINT32 reg_count = 5;
X86CPU *x86_cpu = X86_CPU(cpu);
+ X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
CPUX86State *env = &x86_cpu->env;
reg_names[0] = WHvX64RegisterRip;
@@ -2083,7 +2084,15 @@ int whpx_vcpu_run(CPUState *cpu)
vcpu->exit_ctx.VpContext.Rip +
vcpu->exit_ctx.VpContext.InstructionLength;
- if (whpx_is_legacy_os()) {
+ /*
+ * On Windows 10 we can't query features from
+ * the Hyper-V interface.
+ *
+ * On Windows 11, if using xcc->max_features
+ * just pass through what the hypervisor
+ * provides without any QEMU filtering.
+ */
+ if (whpx_is_legacy_os() || xcc->max_features) {
reg_values[1].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRax;
reg_values[2].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRcx;
reg_values[3].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRdx;
@@ -2135,6 +2144,60 @@ int whpx_vcpu_run(CPUState *cpu)
}
break;
}
+ } else {
+ switch (vcpu->exit_ctx.CpuidAccess.Rax) {
+ case 0x40000000:
+ case 0x40000001:
+ case 0x40000010:
+ reg_values[1].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRax;
+ reg_values[2].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRcx;
+ reg_values[3].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRdx;
+ reg_values[4].Reg64 = vcpu->exit_ctx.CpuidAccess.DefaultResultRbx;
+ break;
+ }
+ }
+
+ if (vcpu->exit_ctx.CpuidAccess.Rax == 0x1) {
+ if (cpu_has_x2apic_feature(env)) {
+ reg_values[2].Reg64 |= CPUID_EXT_X2APIC;
+ } else {
+ reg_values[2].Reg32 &= CPUID_EXT_X2APIC;
+ }
+ }
+
+ /* Dynamic depending on XCR0 and XSS, so query DefaultResult */
+ if (vcpu->exit_ctx.CpuidAccess.Rax == 0x07
+ && vcpu->exit_ctx.CpuidAccess.Rcx == 0) {
+ if (vcpu->exit_ctx.CpuidAccess.DefaultResultRdx
+ & CPUID_7_0_EDX_CET_IBT) {
+ reg_values[3].Reg32 |= CPUID_7_0_EDX_CET_IBT;
+ } else {
+ reg_values[3].Reg32 &= ~CPUID_7_0_EDX_CET_IBT;
+ }
+
+ if (vcpu->exit_ctx.CpuidAccess.DefaultResultRcx
+ & CPUID_7_0_ECX_CET_SHSTK) {
+ reg_values[2].Reg32 |= CPUID_7_0_ECX_CET_SHSTK;
+ } else {
+ reg_values[2].Reg32 &= ~CPUID_7_0_ECX_CET_SHSTK;
+ }
+
+ if (vcpu->exit_ctx.CpuidAccess.DefaultResultRcx
+ & CPUID_7_0_ECX_OSPKE) {
+ reg_values[2].Reg32 |= CPUID_7_0_ECX_OSPKE;
+ } else {
+ reg_values[2].Reg32 &= ~CPUID_7_0_ECX_OSPKE;
+ }
+ }
+
+ /* OSXSAVE is dynamic. Do this instead of syncing CR4 */
+ if (vcpu->exit_ctx.CpuidAccess.Rax == 1) {
+ if (vcpu->exit_ctx.CpuidAccess.DefaultResultRcx
+ & CPUID_EXT_OSXSAVE) {
+ reg_values[2].Reg32 |= CPUID_EXT_OSXSAVE;
+ } else {
+ reg_values[2].Reg32 &= ~CPUID_EXT_OSXSAVE;
+ }
}
hr = whp_dispatch.WHvSetVirtualProcessorRegisters(
@@ -2324,6 +2387,45 @@ error:
return ret;
}
+static void whpx_cpu_xsave_init(void)
+{
+ static bool first = true;
+ int i;
+
+ if (!first) {
+ return;
+ }
+ first = false;
+
+ /* x87 and SSE states are in the legacy region of the XSAVE area. */
+ x86_ext_save_areas[XSTATE_FP_BIT].offset = 0;
+ x86_ext_save_areas[XSTATE_SSE_BIT].offset = 0;
+
+ for (i = XSTATE_SSE_BIT + 1; i < XSAVE_STATE_AREA_COUNT; i++) {
+ ExtSaveArea *esa = &x86_ext_save_areas[i];
+
+ if (esa->size) {
+ int sz = whpx_get_supported_cpuid(0xd, i, R_EAX);
+ if (sz != 0) {
+ assert(esa->size == sz);
+ esa->offset = whpx_get_supported_cpuid(0xd, i, R_EBX);
+ }
+ }
+ }
+}
+
+static void whpx_cpu_max_instance_init(X86CPU *cpu)
+{
+ CPUX86State *env = &cpu->env;
+
+ env->cpuid_min_level =
+ whpx_get_supported_cpuid(0x0, 0, R_EAX);
+ env->cpuid_min_xlevel =
+ whpx_get_supported_cpuid(0x80000000, 0, R_EAX);
+ env->cpuid_min_xlevel2 =
+ whpx_get_supported_cpuid(0xC0000000, 0, R_EAX);
+}
+
static PropValue whpx_default_props[] = {
{ "x2apic", "on" },
{ NULL, NULL },
@@ -2333,9 +2435,18 @@ static PropValue whpx_default_props[] = {
void whpx_cpu_instance_init(CPUState *cs)
{
X86CPU *cpu = X86_CPU(cs);
+ X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
host_cpu_instance_init(cpu);
x86_cpu_apply_props(cpu, whpx_default_props);
+
+ if (!whpx_is_legacy_os() && xcc->max_features) {
+ whpx_cpu_max_instance_init(cpu);
+ }
+
+ if (!whpx_is_legacy_os()) {
+ whpx_cpu_xsave_init();
+ }
}
/*
@@ -2353,8 +2464,12 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
WHV_CAPABILITY_FEATURES features = {0};
WHV_PROCESSOR_FEATURES_BANKS processor_features;
WHV_PROCESSOR_PERFMON_FEATURES perfmon_features;
- UINT32 cpuidExitList[] = {1};
- UINT32 cpuidExitList_nohyperv[] = {1, 0x40000000, 0x40000001, 0x40000010};
+
+ UINT32 cpuidExitList[] = {0x0, 0x1, 0x6, 0x7, 0x14, 0x24, 0x29, 0x1E,
+ 0x40000000, 0x40000001, 0x40000010, 0x80000000, 0x80000001,
+ 0x80000002, 0x80000003, 0x80000004, 0x80000007, 0x80000008,
+ 0x8000000A, 0x80000021, 0x80000022, 0xC0000000, 0xC0000001};
+ UINT32 cpuidExitList_legacy_os[] = {1, 0x40000000, 0x40000001, 0x40000010};
whpx = &whpx_global;
@@ -2610,7 +2725,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
WHvPartitionPropertyCodeCpuidExitList,
- whpx->hyperv_enlightenments_enabled ? cpuidExitList : cpuidExitList_nohyperv,
+ !whpx_is_legacy_os() ? cpuidExitList : cpuidExitList_legacy_os,
RTL_NUMBER_OF(cpuidExitList) * sizeof(UINT32));
if (FAILED(hr)) {
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 08/15] whpx: i386: kernel-irqchip=off fixes
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (6 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 07/15] whpx: i386: introduce proper cpuid support Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 09/15] whpx: i386: use WHvX64RegisterCr8 only when kernel-irqchip=off Mohamed Mediouni
` (6 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
This was really... quite broken. After fixing this,
Windows boots with kernel-irqchip=off.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
include/system/whpx-common.h | 1 +
target/i386/whpx/whpx-all.c | 43 +++++-------------------------------
2 files changed, 7 insertions(+), 37 deletions(-)
diff --git a/include/system/whpx-common.h b/include/system/whpx-common.h
index 04289afd97..3406c20fec 100644
--- a/include/system/whpx-common.h
+++ b/include/system/whpx-common.h
@@ -4,6 +4,7 @@
struct AccelCPUState {
bool window_registered;
+ int window_priority;
bool interruptable;
bool ready_for_pic_interrupt;
uint64_t tpr;
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 9827c93df1..62542922a4 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -22,6 +22,8 @@
#include "qemu/main-loop.h"
#include "hw/core/boards.h"
#include "hw/intc/ioapic.h"
+#include "hw/intc/i8259.h"
+#include "hw/i386/x86.h"
#include "hw/i386/apic_internal.h"
#include "qemu/error-report.h"
#include "qapi/error.h"
@@ -371,28 +373,6 @@ static int whpx_set_tsc(CPUState *cpu)
return 0;
}
-/*
- * The CR8 register in the CPU is mapped to the TPR register of the APIC,
- * however, they use a slightly different encoding. Specifically:
- *
- * APIC.TPR[bits 7:4] = CR8[bits 3:0]
- *
- * This mechanism is described in section 10.8.6.1 of Volume 3 of Intel 64
- * and IA-32 Architectures Software Developer's Manual.
- *
- * The functions below translate the value of CR8 to TPR and vice versa.
- */
-
-static uint64_t whpx_apic_tpr_to_cr8(uint64_t tpr)
-{
- return tpr >> 4;
-}
-
-static uint64_t whpx_cr8_to_apic_tpr(uint64_t cr8)
-{
- return cr8 << 4;
-}
-
void whpx_set_registers(CPUState *cpu, WHPXStateLevel level)
{
struct whpx_state *whpx = &whpx_global;
@@ -421,7 +401,7 @@ void whpx_set_registers(CPUState *cpu, WHPXStateLevel level)
v86 = (env->eflags & VM_MASK);
r86 = !(env->cr[0] & CR0_PE_MASK);
- vcpu->tpr = whpx_apic_tpr_to_cr8(cpu_get_apic_tpr(x86_cpu->apic_state));
+ vcpu->tpr = cpu_get_apic_tpr(x86_cpu->apic_state);
vcpu->apic_base = cpu_get_apic_base(x86_cpu->apic_state);
idx = 0;
@@ -692,17 +672,6 @@ void whpx_get_registers(CPUState *cpu, WHPXStateLevel level)
hr);
}
- if (whpx_irqchip_in_kernel()) {
- /*
- * Fetch the TPR value from the emulated APIC. It may get overwritten
- * below with the value from CR8 returned by
- * WHvGetVirtualProcessorRegisters().
- */
- whpx_apic_get(x86_cpu->apic_state);
- vcpu->tpr = whpx_apic_tpr_to_cr8(
- cpu_get_apic_tpr(x86_cpu->apic_state));
- }
-
idx = 0;
/* Indexes for first 16 registers match between HV and QEMU definitions */
@@ -751,7 +720,7 @@ void whpx_get_registers(CPUState *cpu, WHPXStateLevel level)
tpr = vcxt.values[idx++].Reg64;
if (tpr != vcpu->tpr) {
vcpu->tpr = tpr;
- cpu_set_apic_tpr(x86_cpu->apic_state, whpx_cr8_to_apic_tpr(tpr));
+ cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
}
/* 8 Debug Registers - Skipped */
@@ -1690,7 +1659,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
}
/* Sync the TPR to the CR8 if was modified during the intercept */
- tpr = whpx_apic_tpr_to_cr8(cpu_get_apic_tpr(x86_cpu->apic_state));
+ tpr = cpu_get_apic_tpr(x86_cpu->apic_state);
if (tpr != vcpu->tpr) {
vcpu->tpr = tpr;
reg_values[reg_count].Reg64 = tpr;
@@ -1737,7 +1706,7 @@ static void whpx_vcpu_post_run(CPUState *cpu)
if (vcpu->tpr != tpr) {
vcpu->tpr = tpr;
bql_lock();
- cpu_set_apic_tpr(x86_cpu->apic_state, whpx_cr8_to_apic_tpr(vcpu->tpr));
+ cpu_set_apic_tpr(x86_cpu->apic_state, vcpu->tpr);
bql_unlock();
}
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 09/15] whpx: i386: use WHvX64RegisterCr8 only when kernel-irqchip=off
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (7 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 08/15] whpx: i386: kernel-irqchip=off fixes Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 10/15] whpx: i386: disable kernel-irqchip on Windows 10 when PIC enabled Mohamed Mediouni
` (5 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
When kernel-irqchip=on, manage TPR as part of the APIC state instead entirely.
This fixes some failure to set state errors.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 37 ++++++++++++++++++++++---------------
1 file changed, 22 insertions(+), 15 deletions(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 62542922a4..74b94b799e 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -95,7 +95,6 @@ static const WHV_REGISTER_NAME whpx_register_names[] = {
WHvX64RegisterCr2,
WHvX64RegisterCr3,
WHvX64RegisterCr4,
- WHvX64RegisterCr8,
/* X64 Debug Registers */
/*
@@ -459,8 +458,11 @@ void whpx_set_registers(CPUState *cpu, WHPXStateLevel level)
vcxt.values[idx++].Reg64 = env->cr[3];
assert(whpx_register_names[idx] == WHvX64RegisterCr4);
vcxt.values[idx++].Reg64 = env->cr[4];
- assert(whpx_register_names[idx] == WHvX64RegisterCr8);
- vcxt.values[idx++].Reg64 = vcpu->tpr;
+ /* For kernel-irqchip=on, TPR is managed as part of APIC state */
+ if (!whpx_irqchip_in_kernel()) {
+ WHV_REGISTER_VALUE cr8 = {.Reg64 = vcpu->tpr};
+ whpx_set_reg(cpu, WHvX64RegisterCr8, cr8);
+ }
/* 8 Debug Registers - Skipped */
@@ -716,11 +718,14 @@ void whpx_get_registers(CPUState *cpu, WHPXStateLevel level)
env->cr[3] = vcxt.values[idx++].Reg64;
assert(whpx_register_names[idx] == WHvX64RegisterCr4);
env->cr[4] = vcxt.values[idx++].Reg64;
- assert(whpx_register_names[idx] == WHvX64RegisterCr8);
- tpr = vcxt.values[idx++].Reg64;
- if (tpr != vcpu->tpr) {
- vcpu->tpr = tpr;
- cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
+
+ /* For kernel-irqchip=on, TPR is managed as part of APIC state */
+ if (!whpx_irqchip_in_kernel()) {
+ tpr = vcpu->exit_ctx.VpContext.Cr8;
+ if (tpr != vcpu->tpr) {
+ vcpu->tpr = tpr;
+ cpu_set_apic_tpr(x86_cpu->apic_state, tpr);
+ }
}
/* 8 Debug Registers - Skipped */
@@ -1660,7 +1665,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
/* Sync the TPR to the CR8 if was modified during the intercept */
tpr = cpu_get_apic_tpr(x86_cpu->apic_state);
- if (tpr != vcpu->tpr) {
+ if (!whpx_irqchip_in_kernel() && tpr != vcpu->tpr) {
vcpu->tpr = tpr;
reg_values[reg_count].Reg64 = tpr;
qatomic_set(&cpu->exit_request, true);
@@ -1702,12 +1707,14 @@ static void whpx_vcpu_post_run(CPUState *cpu)
env->eflags = vcpu->exit_ctx.VpContext.Rflags;
- uint64_t tpr = vcpu->exit_ctx.VpContext.Cr8;
- if (vcpu->tpr != tpr) {
- vcpu->tpr = tpr;
- bql_lock();
- cpu_set_apic_tpr(x86_cpu->apic_state, vcpu->tpr);
- bql_unlock();
+ if (!whpx_irqchip_in_kernel()) {
+ uint64_t tpr = vcpu->exit_ctx.VpContext.Cr8;
+ if (vcpu->tpr != tpr) {
+ vcpu->tpr = tpr;
+ bql_lock();
+ cpu_set_apic_tpr(x86_cpu->apic_state, vcpu->tpr);
+ bql_unlock();
+ }
}
vcpu->interruption_pending =
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 10/15] whpx: i386: disable kernel-irqchip on Windows 10 when PIC enabled
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (8 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 09/15] whpx: i386: use WHvX64RegisterCr8 only when kernel-irqchip=off Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 11/15] whpx: i386: IO port fast path cleanup Mohamed Mediouni
` (4 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Move WHvCapabilityCodeProcessorPerfmonFeatures queries
as that's how we distinguish if on a legacy OS.
Now that Windows guests are booting, disable kernel-irqchip=on
by default for Windows 10 when the PIC is enabled.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 69 +++++++++++++++++++++----------------
1 file changed, 39 insertions(+), 30 deletions(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 74b94b799e..7c80d653d1 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2447,6 +2447,13 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
0x8000000A, 0x80000021, 0x80000022, 0xC0000000, 0xC0000001};
UINT32 cpuidExitList_legacy_os[] = {1, 0x40000000, 0x40000001, 0x40000010};
+ X86MachineState *x86ms = X86_MACHINE(ms);
+ bool pic_enabled = false;
+
+ if (x86ms->pic == ON_OFF_AUTO_ON || x86ms->pic == ON_OFF_AUTO_AUTO) {
+ pic_enabled = true;
+ }
+
whpx = &whpx_global;
if (!init_whp_dispatch()) {
@@ -2518,6 +2525,35 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
goto error;
}
+ /* Enable supported performance monitoring capabilities */
+ hr = whp_dispatch.WHvGetCapability(
+ WHvCapabilityCodeProcessorPerfmonFeatures, &perfmon_features,
+ sizeof(WHV_PROCESSOR_PERFMON_FEATURES), &whpx_cap_size);
+ /*
+ * Relying on this is a crutch to maintain Windows 10 support.
+ *
+ * WHvCapabilityCodeProcessorPerfmonFeatures and
+ * WHvPartitionPropertyCodeSyntheticProcessorFeaturesBanks
+ * are implemented starting from Windows Server 2022 (build 20348).
+ */
+ if (FAILED(hr)) {
+ warn_report("WHPX: Failed to get performance "
+ "monitoring features, hr=%08lx", hr);
+ is_modern_os = false;
+ } else {
+ hr = whp_dispatch.WHvSetPartitionProperty(
+ whpx->partition,
+ WHvPartitionPropertyCodeProcessorPerfmonFeatures,
+ &perfmon_features,
+ sizeof(WHV_PROCESSOR_PERFMON_FEATURES));
+ if (FAILED(hr)) {
+ error_report("WHPX: Failed to set performance "
+ "monitoring features, hr=%08lx", hr);
+ ret = -EINVAL;
+ goto error;
+ }
+ }
+
/*
* Error out if WHP doesn't support apic emulation and user is requiring
* it.
@@ -2530,8 +2566,9 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
goto error;
}
- if (whpx->kernel_irqchip_allowed && features.LocalApicEmulation &&
- whp_dispatch.WHvSetVirtualProcessorInterruptControllerState2) {
+ if (whpx->kernel_irqchip_allowed && !(whpx_is_legacy_os() && pic_enabled
+ && !whpx->kernel_irqchip_required) && features.LocalApicEmulation
+ && whp_dispatch.WHvSetVirtualProcessorInterruptControllerState2) {
WHV_X64_LOCAL_APIC_EMULATION_MODE mode =
WHvX64LocalApicEmulationModeX2Apic;
hr = whp_dispatch.WHvSetPartitionProperty(
@@ -2590,34 +2627,6 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
goto error;
}
- /* Enable supported performance monitoring capabilities */
- hr = whp_dispatch.WHvGetCapability(
- WHvCapabilityCodeProcessorPerfmonFeatures, &perfmon_features,
- sizeof(WHV_PROCESSOR_PERFMON_FEATURES), &whpx_cap_size);
- /*
- * Relying on this is a crutch to maintain Windows 10 support.
- *
- * WHvCapabilityCodeProcessorPerfmonFeatures and
- * WHvPartitionPropertyCodeSyntheticProcessorFeaturesBanks
- * are implemented starting from Windows Server 2022 (build 20348).
- */
- if (FAILED(hr)) {
- warn_report("WHPX: Failed to get performance "
- "monitoring features, hr=%08lx", hr);
- is_modern_os = false;
- } else {
- hr = whp_dispatch.WHvSetPartitionProperty(
- whpx->partition,
- WHvPartitionPropertyCodeProcessorPerfmonFeatures,
- &perfmon_features,
- sizeof(WHV_PROCESSOR_PERFMON_FEATURES));
- if (FAILED(hr)) {
- error_report("WHPX: Failed to set performance "
- "monitoring features, hr=%08lx", hr);
- ret = -EINVAL;
- goto error;
- }
- }
/* Enable synthetic processor features */
WHV_SYNTHETIC_PROCESSOR_FEATURES_BANKS synthetic_features;
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 11/15] whpx: i386: IO port fast path cleanup
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (9 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 10/15] whpx: i386: disable kernel-irqchip on Windows 10 when PIC enabled Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 12/15] whpx: i386: disable enlightenments and LAPIC for isapc Mohamed Mediouni
` (3 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
vmport calls synchronise_state within an I/O port read.
Support that properly.
What was there before worked because of a side effect of
whpx_get_reg synchronising context if cpu->vcpu_dirty.
Remove that whpx_get_reg call in whpx_bump_rip too as it's no longer
needed now.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 17 +++++++++++++----
1 file changed, 13 insertions(+), 4 deletions(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 7c80d653d1..61aec98e66 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -862,7 +862,6 @@ static void handle_io(CPUState *env, uint16_t port, void *buffer,
static void whpx_bump_rip(CPUState *cpu, WHV_RUN_VP_EXIT_CONTEXT *exit_ctx)
{
WHV_REGISTER_VALUE reg;
- whpx_get_reg(cpu, WHvX64RegisterRip, ®);
reg.Reg64 = exit_ctx->VpContext.Rip + exit_ctx->VpContext.InstructionLength;
whpx_set_reg(cpu, WHvX64RegisterRip, reg);
}
@@ -890,13 +889,23 @@ static int whpx_handle_portio(CPUState *cpu,
} else {
reg.Reg64 = (uint64_t)val;
}
- whpx_bump_rip(cpu, exit_ctx);
- whpx_set_reg(cpu, WHvX64RegisterRax, reg);
+ /* vmport calls cpu_synchronize_state on an I/O port read */
+ if (!cpu->vcpu_dirty) {
+ whpx_bump_rip(cpu, exit_ctx);
+ whpx_set_reg(cpu, WHvX64RegisterRax, reg);
+ } else {
+ env->eip = exit_ctx->VpContext.Rip + exit_ctx->VpContext.InstructionLength;
+ env->regs[R_EAX] = reg.Reg64;
+ }
return 0;
} else if (!ctx->AccessInfo.StringOp && ctx->AccessInfo.IsWrite) {
RAX(env) = ctx->Rax;
handle_io(cpu, ctx->PortNumber, &RAX(env), 1, ctx->AccessInfo.AccessSize, 1);
- whpx_bump_rip(cpu, exit_ctx);
+ if (!cpu->vcpu_dirty) {
+ whpx_bump_rip(cpu, exit_ctx);
+ } else {
+ env->eip = exit_ctx->VpContext.Rip + exit_ctx->VpContext.InstructionLength;
+ }
return 0;
}
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 12/15] whpx: i386: disable enlightenments and LAPIC for isapc
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (10 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 11/15] whpx: i386: IO port fast path cleanup Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 13/15] whpx: i386: interrupt priority support Mohamed Mediouni
` (2 subsequent siblings)
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
The isapc machine doesn't have an APIC. And Hyper-V enlightenments
don't sound too useful to have there so disable those.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 8 ++++++++
1 file changed, 8 insertions(+)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 61aec98e66..7a31dc6427 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -2470,6 +2470,14 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
goto error;
}
+ /* for isapc, disable Hyper-V enlightenments and LAPIC */
+ if (!strcmp(MACHINE_GET_CLASS(ms)->name, "isapc")) {
+ whpx->kernel_irqchip_allowed = false;
+ whpx->kernel_irqchip_required = false;
+ whpx->hyperv_enlightenments_allowed = false;
+ whpx->hyperv_enlightenments_required = false;
+ }
+
whpx->mem_quota = ms->ram_size;
hr = whp_dispatch.WHvGetCapability(
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 13/15] whpx: i386: interrupt priority support
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (11 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 12/15] whpx: i386: disable enlightenments and LAPIC for isapc Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 14/15] hw/intc: apic: disallow APIC reads when disabled Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 15/15] whpx: i386: fix CPUID[1:EDX].APIC reporting Mohamed Mediouni
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Implement APIC IRR interrupt priorities.
Even with kernel-irqchip=off, Hyper-V is aware of interrupt priorities
and implements CR8/TPR, with the InterruptPriority field being followed.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 24 ++++++++++++++++++++----
1 file changed, 20 insertions(+), 4 deletions(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 7a31dc6427..8cd81fffee 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1588,6 +1588,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
UINT32 reg_count = 0;
WHV_REGISTER_VALUE reg_values[3];
WHV_REGISTER_NAME reg_names[3];
+ int irr = apic_get_highest_priority_irr(x86_cpu->apic_state);
memset(&new_int, 0, sizeof(new_int));
memset(reg_values, 0, sizeof(reg_values));
@@ -1623,10 +1624,20 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
}
}
+ if (irr == -1) {
+ if (pic_get_output(isa_pic)) {
+ /* In case it's a PIC interrupt */
+ irr = 0;
+ } else if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
+ abort();
+ }
+ }
+
/* Get pending hard interruption or replay one that was overwritten */
if (!whpx_irqchip_in_kernel()) {
if (!vcpu->interruption_pending &&
- vcpu->interruptable && (env->eflags & IF_MASK)) {
+ vcpu->interruptable && (env->eflags & IF_MASK)
+ && (vcpu->tpr < irr || irr == 0)) {
assert(!new_int.InterruptionPending);
if (cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
cpu_reset_interrupt(cpu, CPU_INTERRUPT_HARD);
@@ -1683,13 +1694,17 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
}
/* Update the state of the interrupt delivery notification */
- if (!vcpu->window_registered &&
+ if ((!vcpu->window_registered ||
+ (vcpu->window_priority < irr && vcpu->window_priority != 0) ||
+ (irr == 0 && vcpu->window_priority != 0)) &&
cpu_test_interrupt(cpu, CPU_INTERRUPT_HARD)) {
reg_values[reg_count].DeliverabilityNotifications =
(WHV_X64_DELIVERABILITY_NOTIFICATIONS_REGISTER) {
- .InterruptNotification = 1
+ .InterruptNotification = 1,
+ .InterruptPriority = irr >> 4
};
vcpu->window_registered = 1;
+ vcpu->window_priority = irr;
reg_names[reg_count] = WHvX64RegisterDeliverabilityNotifications;
reg_count += 1;
}
@@ -1703,7 +1718,7 @@ static void whpx_vcpu_pre_run(CPUState *cpu)
reg_names, reg_count, reg_values);
if (FAILED(hr)) {
error_report("WHPX: Failed to set interrupt state registers,"
- " hr=%08lx", hr);
+ " hr=%08lx, InterruptPriority=%i", hr, irr >> 4);
}
}
}
@@ -1919,6 +1934,7 @@ int whpx_vcpu_run(CPUState *cpu)
case WHvRunVpExitReasonX64InterruptWindow:
vcpu->ready_for_pic_interrupt = 1;
vcpu->window_registered = 0;
+ vcpu->window_priority = 0;
ret = 0;
break;
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 14/15] hw/intc: apic: disallow APIC reads when disabled
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (12 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 13/15] whpx: i386: interrupt priority support Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
2026-04-13 16:52 ` [PATCH v11 15/15] whpx: i386: fix CPUID[1:EDX].APIC reporting Mohamed Mediouni
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
!APICBASE_ENABLE + attempting to read xAPIC registers is not an allowed combination.
And neither is x2APIC enabled + attempting to read xAPIC registers
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
hw/intc/apic.c | 9 +++++++++
1 file changed, 9 insertions(+)
diff --git a/hw/intc/apic.c b/hw/intc/apic.c
index 8766ed00b9..c09dddef39 100644
--- a/hw/intc/apic.c
+++ b/hw/intc/apic.c
@@ -875,6 +875,15 @@ static uint64_t apic_mem_read(void *opaque, hwaddr addr, unsigned size)
return -1;
}
+ /* if the xAPIC is disabled, return early. */
+ if (!(s->apicbase & MSR_IA32_APICBASE_ENABLE)) {
+ return 0xffffffff;
+ }
+
+ if (s->apicbase & MSR_IA32_APICBASE_EXTD) {
+ return 0xffffffff;
+ }
+
index = (addr >> 4) & 0xff;
apic_register_read(s, index, &val);
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread* [PATCH v11 15/15] whpx: i386: fix CPUID[1:EDX].APIC reporting
2026-04-13 16:52 [PATCH v11 00/15] whpx: i386: bug fixes, feature probing and CPUID Mohamed Mediouni
` (13 preceding siblings ...)
2026-04-13 16:52 ` [PATCH v11 14/15] hw/intc: apic: disallow APIC reads when disabled Mohamed Mediouni
@ 2026-04-13 16:52 ` Mohamed Mediouni
14 siblings, 0 replies; 16+ messages in thread
From: Mohamed Mediouni @ 2026-04-13 16:52 UTC (permalink / raw)
To: qemu-devel
Cc: Michael S. Tsirkin, Pedro Barbuda, Mohamed Mediouni,
Paolo Bonzini, Zhao Liu, Roman Bolshakov, Wei Liu,
Phil Dennis-Jordan
Hyper-V always has CPUID[1:EDX].APIC set, even when the APIC isn't enabled yet.
Work around this by also using the APICBASE trap for kernel-irqchip=on.
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
include/system/whpx-common.h | 1 -
target/i386/whpx/whpx-all.c | 34 ++++++++---------
target/i386/whpx/whpx-apic.c | 71 ++++++++++++++++++++++++++++++++++--
3 files changed, 84 insertions(+), 22 deletions(-)
diff --git a/include/system/whpx-common.h b/include/system/whpx-common.h
index 3406c20fec..79710e2fb3 100644
--- a/include/system/whpx-common.h
+++ b/include/system/whpx-common.h
@@ -8,7 +8,6 @@ struct AccelCPUState {
bool interruptable;
bool ready_for_pic_interrupt;
uint64_t tpr;
- uint64_t apic_base;
bool interruption_pending;
/* Must be the last field as it may have a tail */
WHV_RUN_VP_EXIT_CONTEXT exit_ctx;
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 8cd81fffee..9ce73261c2 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -139,7 +139,6 @@ static const WHV_REGISTER_NAME whpx_register_names[] = {
#ifdef TARGET_X86_64
WHvX64RegisterKernelGsBase,
#endif
- WHvX64RegisterApicBase,
/* WHvX64RegisterPat, */
WHvX64RegisterSysenterCs,
WHvX64RegisterSysenterEip,
@@ -401,7 +400,6 @@ void whpx_set_registers(CPUState *cpu, WHPXStateLevel level)
r86 = !(env->cr[0] & CR0_PE_MASK);
vcpu->tpr = cpu_get_apic_tpr(x86_cpu->apic_state);
- vcpu->apic_base = cpu_get_apic_base(x86_cpu->apic_state);
idx = 0;
@@ -519,9 +517,6 @@ void whpx_set_registers(CPUState *cpu, WHPXStateLevel level)
vcxt.values[idx++].Reg64 = env->kernelgsbase;
#endif
- assert(whpx_register_names[idx] == WHvX64RegisterApicBase);
- vcxt.values[idx++].Reg64 = vcpu->apic_base;
-
/* WHvX64RegisterPat - Skipped */
assert(whpx_register_names[idx] == WHvX64RegisterSysenterCs);
@@ -556,6 +551,12 @@ void whpx_set_registers(CPUState *cpu, WHPXStateLevel level)
error_report("WHPX: Failed to set virtual processor context, hr=%08lx",
hr);
}
+
+ if (level >= WHPX_LEVEL_FULL_STATE) {
+ WHV_REGISTER_VALUE apic_base = {};
+ apic_base.Reg64 = cpu_get_apic_base(X86_CPU(cpu)->apic_state);
+ whpx_set_reg(cpu, WHvX64RegisterApicBase, apic_base);
+ }
}
static int whpx_get_tsc(CPUState *cpu)
@@ -647,7 +648,7 @@ void whpx_get_registers(CPUState *cpu, WHPXStateLevel level)
X86CPU *x86_cpu = X86_CPU(cpu);
CPUX86State *env = &x86_cpu->env;
struct whpx_register_set vcxt;
- uint64_t tpr, apic_base;
+ uint64_t tpr;
HRESULT hr;
int idx;
int idx_next;
@@ -779,13 +780,6 @@ void whpx_get_registers(CPUState *cpu, WHPXStateLevel level)
env->kernelgsbase = vcxt.values[idx++].Reg64;
#endif
- assert(whpx_register_names[idx] == WHvX64RegisterApicBase);
- apic_base = vcxt.values[idx++].Reg64;
- if (apic_base != vcpu->apic_base) {
- vcpu->apic_base = apic_base;
- cpu_set_apic_base(x86_cpu->apic_state, vcpu->apic_base);
- }
-
/* WHvX64RegisterPat - Skipped */
assert(whpx_register_names[idx] == WHvX64RegisterSysenterCs);
@@ -1997,8 +1991,7 @@ int whpx_vcpu_run(CPUState *cpu)
val = X86_CPU(cpu)->env.apic_bus_freq;
}
- if (!whpx_irqchip_in_kernel() &&
- vcpu->exit_ctx.MsrAccess.MsrNumber == MSR_IA32_APICBASE) {
+ if (vcpu->exit_ctx.MsrAccess.MsrNumber == MSR_IA32_APICBASE) {
is_known_msr = 1;
if (!vcpu->exit_ctx.MsrAccess.AccessInfo.IsWrite) {
/* Read path unreachable on Hyper-V */
@@ -2164,6 +2157,13 @@ int whpx_vcpu_run(CPUState *cpu)
} else {
reg_values[2].Reg32 &= CPUID_EXT_X2APIC;
}
+
+ /* CPUID[1:EDX].APIC is dynamic */
+ if (env->features[FEAT_1_EDX] & CPUID_APIC) {
+ reg_values[3].Reg32 |= CPUID_APIC;
+ } else {
+ reg_values[3].Reg32 &= ~CPUID_APIC;
+ }
}
/* Dynamic depending on XCR0 and XSS, so query DefaultResult */
@@ -2725,9 +2725,7 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));
prop.X64MsrExitBitmap.UnhandledMsrs = 1;
- if (!whpx_irqchip_in_kernel()) {
- prop.X64MsrExitBitmap.ApicBaseMsrWrite = 1;
- }
+ prop.X64MsrExitBitmap.ApicBaseMsrWrite = 1;
hr = whp_dispatch.WHvSetPartitionProperty(
whpx->partition,
diff --git a/target/i386/whpx/whpx-apic.c b/target/i386/whpx/whpx-apic.c
index f26ecaf6e8..65629ca45f 100644
--- a/target/i386/whpx/whpx-apic.c
+++ b/target/i386/whpx/whpx-apic.c
@@ -90,9 +90,70 @@ static void whpx_get_apic_state(APICCommonState *s,
apic_next_timer(s, s->initial_count_load_time);
}
-static int whpx_apic_set_base(APICCommonState *s, uint64_t val)
+static int apic_set_base_check(APICCommonState *s, uint64_t val)
{
- s->apicbase = val;
+ /* Enable x2apic when x2apic is not supported by CPU */
+ if (!cpu_has_x2apic_feature(&s->cpu->env) &&
+ val & MSR_IA32_APICBASE_EXTD) {
+ return -1;
+ }
+
+ /*
+ * Transition into invalid state
+ * (s->apicbase & MSR_IA32_APICBASE_ENABLE == 0) &&
+ * (s->apicbase & MSR_IA32_APICBASE_EXTD) == 1
+ */
+ if (!(val & MSR_IA32_APICBASE_ENABLE) &&
+ (val & MSR_IA32_APICBASE_EXTD)) {
+ return -1;
+ }
+
+ /* Invalid transition from disabled mode to x2APIC */
+ if (!(s->apicbase & MSR_IA32_APICBASE_ENABLE) &&
+ !(s->apicbase & MSR_IA32_APICBASE_EXTD) &&
+ (val & MSR_IA32_APICBASE_ENABLE) &&
+ (val & MSR_IA32_APICBASE_EXTD)) {
+ return -1;
+ }
+
+ /* Invalid transition from x2APIC to xAPIC */
+ if ((s->apicbase & MSR_IA32_APICBASE_ENABLE) &&
+ (s->apicbase & MSR_IA32_APICBASE_EXTD) &&
+ (val & MSR_IA32_APICBASE_ENABLE) &&
+ !(val & MSR_IA32_APICBASE_EXTD)) {
+ return -1;
+ }
+
+ return 0;
+}
+
+static int apic_set_base(APICCommonState *s, uint64_t val)
+{
+ if (apic_set_base_check(s, val) < 0) {
+ return -1;
+ }
+
+ s->apicbase = (val & MSR_IA32_APICBASE_BASE) |
+ (s->apicbase & (MSR_IA32_APICBASE_BSP | MSR_IA32_APICBASE_ENABLE));
+ if (!(val & MSR_IA32_APICBASE_ENABLE)) {
+ s->apicbase &= ~MSR_IA32_APICBASE_ENABLE;
+ cpu_clear_apic_feature(&s->cpu->env);
+ }
+
+ /* Transition from disabled mode to xAPIC */
+ if (!(s->apicbase & MSR_IA32_APICBASE_ENABLE) &&
+ (val & MSR_IA32_APICBASE_ENABLE)) {
+ s->apicbase |= MSR_IA32_APICBASE_ENABLE;
+ cpu_set_apic_feature(&s->cpu->env);
+ }
+
+ /* Transition from xAPIC to x2APIC */
+ if (cpu_has_x2apic_feature(&s->cpu->env) &&
+ !(s->apicbase & MSR_IA32_APICBASE_EXTD) &&
+ (val & MSR_IA32_APICBASE_EXTD)) {
+ s->apicbase |= MSR_IA32_APICBASE_EXTD;
+ }
+
return 0;
}
@@ -235,6 +296,10 @@ static void whpx_apic_mem_write(void *opaque, hwaddr addr,
static const MemoryRegionOps whpx_apic_io_ops = {
.read = whpx_apic_mem_read,
.write = whpx_apic_mem_write,
+ .impl.min_access_size = 1,
+ .impl.max_access_size = 4,
+ .valid.min_access_size = 1,
+ .valid.max_access_size = 4,
.endianness = DEVICE_LITTLE_ENDIAN,
};
@@ -262,7 +327,7 @@ static void whpx_apic_class_init(ObjectClass *klass, const void *data)
k->realize = whpx_apic_realize;
k->reset = whpx_apic_reset;
- k->set_base = whpx_apic_set_base;
+ k->set_base = apic_set_base;
k->set_tpr = whpx_apic_set_tpr;
k->get_tpr = whpx_apic_get_tpr;
k->post_load = whpx_apic_post_load;
--
2.50.1 (Apple Git-155)
^ permalink raw reply related [flat|nested] 16+ messages in thread