From: Mohamed Mediouni <mohamed@unpredictable.fr>
To: qemu-devel@nongnu.org
Cc: Pedro Barbuda <pbarbuda@microsoft.com>,
Pierrick Bouvier <pierrick.bouvier@oss.qualcomm.com>,
Peter Maydell <peter.maydell@linaro.org>,
Mohamed Mediouni <mohamed@unpredictable.fr>,
qemu-arm@nongnu.org,
Akshey Taneja <aksheynew.tanejanew@gmail.com>
Subject: [PULL 12/13] whpx: i386: fall back to xAPIC when the MSR exit bitmap is unavailable
Date: Sun, 8 Nov 2026 17:41:07 -0700 [thread overview]
Message-ID: <20261109004108.85808-13-mohamed@unpredictable.fr> (raw)
In-Reply-To: <20261109004108.85808-1-mohamed@unpredictable.fr>
From: Akshey Taneja <aksheynew.tanejanew@gmail.com>
WHvPartitionPropertyCodeX64MsrExitBitmap is not implemented on Windows
10 version 1809 and earlier, where WHvSetPartitionProperty() returns
WHV_E_UNKNOWN_PROPERTY (0x80370302) and whpx_accel_init() aborts with
-EINVAL. QEMU started requesting it in ba1bda25b7 ("whpx: i386: x2apic emulation").
Treating the failure as non-fatal is not sufficient on its own:
whpx_default_props unconditionally enables x2apic, and x2APIC is reached
through MSRs, so without MSR exits the userspace LAPIC never observes
the guest's APIC accesses and the guest hangs immediately after the
firmware hands over. Observed as a black screen with an Ubuntu 24.04
guest that otherwise boots in about 40 seconds.
Record whether the MSR exit bitmap was accepted and, when it was not,
apply x2apic=off so the guest uses the MMIO based xAPIC, which is still
intercepted normally.
Reported on Windows 10 Enterprise LTSC version 1809 (build 17763)
Signed-off-by: Akshey Taneja <aksheynew.tanejanew@gmail.com>
[Patch edited, version 1903 is the first release of Windows 10 with this API]
Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
target/i386/whpx/whpx-all.c | 30 ++++++++++++++++++++++++++----
1 file changed, 26 insertions(+), 4 deletions(-)
diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 7c2172a7ed..19a552c456 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -57,6 +57,7 @@
#define HV_X64_MSR_GUEST_IDLE 0x400000f0
static bool is_modern_os = true;
+static bool whpx_msr_exits_available = true;
static const WHV_REGISTER_NAME whpx_register_names[] = {
@@ -3009,6 +3010,16 @@ static PropValue whpx_default_props[] = {
{ NULL, NULL },
};
+/*
+ * x2APIC is reached through MSRs, so emulating it in userspace requires the
+ * MSR exit bitmap. Hosts without that property must fall back to xAPIC,
+ * which is MMIO based and therefore still intercepted.
+ */
+static PropValue whpx_no_msr_exit_props[] = {
+ { "x2apic", "off" },
+ { NULL, NULL },
+};
+
void whpx_cpu_instance_init(CPUState *cs)
{
@@ -3016,7 +3027,8 @@ void whpx_cpu_instance_init(CPUState *cs)
X86CPUClass *xcc = X86_CPU_GET_CLASS(cpu);
host_cpu_instance_init(cpu);
- x86_cpu_apply_props(cpu, whpx_default_props);
+ x86_cpu_apply_props(cpu, whpx_msr_exits_available ? whpx_default_props
+ : whpx_no_msr_exit_props);
if (xcc->max_features) {
whpx_cpu_max_instance_init(cpu);
@@ -3420,10 +3432,20 @@ int whpx_accel_init(AccelState *as, MachineState *ms)
WHvPartitionPropertyCodeX64MsrExitBitmap,
&prop,
sizeof(WHV_PARTITION_PROPERTY));
+ /*
+ * Earlier Windows 10 releases not implement this property.
+ * It is implemented starting from Windows 10 version 1903 (18362).
+ */
if (FAILED(hr)) {
- error_report("WHPX: Failed to set MSR exit bitmap, hr=%08lx", hr);
- ret = -EINVAL;
- goto error;
+ if (hr == WHV_E_UNKNOWN_PROPERTY) {
+ whpx_msr_exits_available = false;
+ warn_report("WHPX: MSR exit bitmap unsupported on this Windows "
+ "version, falling back to xAPIC");
+ } else {
+ error_report("WHPX: Failed to set MSR exit bitmap, hr=%08lx", hr);
+ ret = -EINVAL;
+ goto error;
+ }
}
hr = whp_dispatch.WHvSetPartitionProperty(
--
2.54.0 (Apple Git-157)
next prev parent reply other threads:[~2026-11-09 0:42 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-09 0:40 [PULL 00/13] whpx: QEMU 11.2 pull request Mohamed Mediouni
2026-11-09 0:40 ` [PULL 01/13] target/i386/whpx: fix VMX capability MSR values Mohamed Mediouni
2026-11-09 0:40 ` [PULL 02/13] target/i386/whpx: whpx_get_xsave_state error handling Mohamed Mediouni
2026-11-09 0:40 ` [PULL 03/13] whpx: i386: get APIC state before VM save Mohamed Mediouni
2026-11-09 11:11 ` Philippe Mathieu-Daudé
2026-11-09 0:40 ` [PULL 04/13] whpx: i386: fix TPR encodings for local APIC Mohamed Mediouni
2026-11-09 0:41 ` [PULL 05/13] whpx: i386: save/restore xss Mohamed Mediouni
2026-11-09 0:41 ` [PULL 06/13] whpx: i386: make nested virtualisation init failure non-fatal Mohamed Mediouni
2026-11-09 0:41 ` [PULL 07/13] whpx: i386: avoid updating hflags for vmexits Mohamed Mediouni
2026-11-09 0:41 ` [PULL 08/13] target/i386/whpx: handle processor reset Mohamed Mediouni
2026-11-09 0:41 ` [PULL 09/13] target/arm/whpx: " Mohamed Mediouni
2026-11-09 0:41 ` [PULL 10/13] whpx: i386: forward the dynamic EBX of CPUID[0xD] sub-leaves 0 and 1, not 1 and 2 Mohamed Mediouni
2026-11-09 0:41 ` [PULL 11/13] whpx: i386: do not require ProcessorFeaturesBanks on legacy Windows Mohamed Mediouni
2026-11-09 0:41 ` Mohamed Mediouni [this message]
2026-11-09 0:41 ` [PULL 13/13] whpx: i386: also save debug registers Mohamed Mediouni
2026-11-09 11:10 ` [PULL 00/13] whpx: QEMU 11.2 pull request Philippe Mathieu-Daudé
2026-11-09 11:18 ` Philippe Mathieu-Daudé
-- strict thread matches above, loose matches on Subject: below --
2026-11-08 9:53 [PULL 00/13] Whpx fix 0 patches Mohamed Mediouni
2026-11-08 9:54 ` [PULL 12/13] whpx: i386: fall back to xAPIC when the MSR exit bitmap is unavailable Mohamed Mediouni
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20261109004108.85808-13-mohamed@unpredictable.fr \
--to=mohamed@unpredictable.fr \
--cc=aksheynew.tanejanew@gmail.com \
--cc=pbarbuda@microsoft.com \
--cc=peter.maydell@linaro.org \
--cc=pierrick.bouvier@oss.qualcomm.com \
--cc=qemu-arm@nongnu.org \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.