Patch Detail
get:
Show a patch.
patch:
Update a patch.
put:
Update a patch.
GET /api/patches/2224833/?format=api
{ "id": 2224833, "url": "http://patchwork.ozlabs.org/api/patches/2224833/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260418223320.51330-37-mohamed@unpredictable.fr/", "project": { "id": 14, "url": "http://patchwork.ozlabs.org/api/projects/14/?format=api", "name": "QEMU Development", "link_name": "qemu-devel", "list_id": "qemu-devel.nongnu.org", "list_email": "qemu-devel@nongnu.org", "web_url": "", "scm_url": "", "webscm_url": "", "list_archive_url": "", "list_archive_url_format": "", "commit_url_format": "" }, "msgid": "<20260418223320.51330-37-mohamed@unpredictable.fr>", "list_archive_url": null, "date": "2026-04-18T22:33:18", "name": "[36/38] whpx: i386: add feature to intercept #GP MSR accesses", "commit_ref": null, "pull_url": null, "state": "new", "archived": false, "hash": "47b5ce033edc49a58114f26433f8b6cf75cbd7f9", "submitter": { "id": 91318, "url": "http://patchwork.ozlabs.org/api/people/91318/?format=api", "name": "Mohamed Mediouni", "email": "mohamed@unpredictable.fr" }, "delegate": null, "mbox": "http://patchwork.ozlabs.org/project/qemu-devel/patch/20260418223320.51330-37-mohamed@unpredictable.fr/mbox/", "series": [ { "id": 500475, "url": "http://patchwork.ozlabs.org/api/series/500475/?format=api", "web_url": "http://patchwork.ozlabs.org/project/qemu-devel/list/?series=500475", "date": "2026-04-18T22:32:54", "name": "WHPX x86 updates for QEMU 11.1", "version": 1, "mbox": "http://patchwork.ozlabs.org/series/500475/mbox/" } ], "comments": "http://patchwork.ozlabs.org/api/patches/2224833/comments/", "check": "pending", "checks": "http://patchwork.ozlabs.org/api/patches/2224833/checks/", "tags": {}, "related": [], "headers": { "Return-Path": "<qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org>", "X-Original-To": "incoming@patchwork.ozlabs.org", "Delivered-To": "patchwork-incoming@legolas.ozlabs.org", "Authentication-Results": [ "legolas.ozlabs.org;\n\tdkim=pass (2048-bit key;\n unprotected) header.d=unpredictable.fr header.i=@unpredictable.fr\n header.a=rsa-sha256 header.s=sig1 header.b=GjdYZ6LC;\n\tdkim-atps=neutral", "legolas.ozlabs.org;\n spf=pass (sender SPF authorized) smtp.mailfrom=nongnu.org\n (client-ip=209.51.188.17; helo=lists1p.gnu.org;\n envelope-from=qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org;\n receiver=patchwork.ozlabs.org)" ], "Received": [ "from lists1p.gnu.org (lists1p.gnu.org [209.51.188.17])\n\t(using TLSv1.2 with cipher ECDHE-ECDSA-AES256-GCM-SHA384 (256/256 bits))\n\t(No client certificate requested)\n\tby legolas.ozlabs.org (Postfix) with ESMTPS id 4fymnQ5qw1z1yDF\n\tfor <incoming@patchwork.ozlabs.org>; Sun, 19 Apr 2026 08:36:26 +1000 (AEST)", "from localhost ([::1] helo=lists1p.gnu.org)\n\tby lists1p.gnu.org with esmtp (Exim 4.90_1)\n\t(envelope-from <qemu-devel-bounces@nongnu.org>)\n\tid 1wEEFK-0007x3-5l; Sat, 18 Apr 2026 18:34:38 -0400", "from eggs.gnu.org ([2001:470:142:3::10])\n by lists1p.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <mohamed@unpredictable.fr>)\n id 1wEEFG-0007aj-NU\n for qemu-devel@nongnu.org; Sat, 18 Apr 2026 18:34:34 -0400", "from p-east2-cluster1-host9-snip4-8.eps.apple.com ([57.103.76.111]\n helo=outbound.st.icloud.com)\n by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)\n (Exim 4.90_1) (envelope-from <mohamed@unpredictable.fr>)\n id 1wEEFE-0005EP-Gf\n for qemu-devel@nongnu.org; Sat, 18 Apr 2026 18:34:34 -0400", "from outbound.st.icloud.com (unknown [127.0.0.2])\n by p00-icloudmta-asmtp-us-east-1a-100-percent-1 (Postfix) with ESMTPS id\n 0426A1800207; Sat, 18 Apr 2026 22:34:30 +0000 (UTC)", "from localhost.localdomain (unknown [17.42.251.67])\n by p00-icloudmta-asmtp-us-east-1a-100-percent-1 (Postfix) with ESMTPSA id\n 2D3DD18000B4; Sat, 18 Apr 2026 22:34:29 +0000 (UTC)" ], "Dkim-Signature": "v=1; a=rsa-sha256; c=relaxed/relaxed; d=unpredictable.fr;\n s=sig1; t=1776551671; x=1779143671;\n bh=mEtPVQ71C4UScAWJmuCY+zr2oGidklaoc0eP3+xM4is=;\n h=From:To:Subject:Date:Message-ID:MIME-Version:x-icloud-hme;\n b=GjdYZ6LCS54tpAFFzLS92OOIoHFCrys4eipv6hRmn2t7b/DLxvxthKy6BQ6D/HFRAxgs80xY+D33S0jxTGypII4x9Z+26wr2FVBmhm5C9VFIBdVKA9YGewTTdshUQ+XQO0kJyv0Nssn+sX1lROAc8Qm7cFoLslvJS4yLcCI/dTafmmLb6LXzZ2dDd8eD0wOI8bgKu5O93ep6FR9yi/6LvVD11wQ8xK/ZoWjST6P7wy11tZt98i6XLM4KJPgSBtqadK3YiIcdpQ7U7o9HS91+8SMCr4cxnxbzEYraWggz+1xf10VB3YlCZskvNHKEn1wiG0EaWihsM/bFri6j6HLDeA==", "mail-alias-created-date": "1752046281608", "From": "Mohamed Mediouni <mohamed@unpredictable.fr>", "To": "qemu-devel@nongnu.org", "Cc": "Mohamed Mediouni <mohamed@unpredictable.fr>,\n \"Michael S. Tsirkin\" <mst@redhat.com>, Paolo Bonzini <pbonzini@redhat.com>,\n Zhao Liu <zhao1.liu@intel.com>, Pedro Barbuda <pbarbuda@microsoft.com>,\n Roman Bolshakov <rbolshakov@ddn.com>, qemu-arm@nongnu.org,\n Pierrick Bouvier <pierrick.bouvier@linaro.org>,\n Peter Maydell <peter.maydell@linaro.org>, Wei Liu <wei.liu@kernel.org>,\n Phil Dennis-Jordan <phil@philjordan.eu>", "Subject": "[PATCH 36/38] whpx: i386: add feature to intercept #GP MSR accesses", "Date": "Sun, 19 Apr 2026 00:33:18 +0200", "Message-ID": "<20260418223320.51330-37-mohamed@unpredictable.fr>", "X-Mailer": "git-send-email 2.50.1", "In-Reply-To": "<20260418223320.51330-1-mohamed@unpredictable.fr>", "References": "<20260418223320.51330-1-mohamed@unpredictable.fr>", "MIME-Version": "1.0", "Content-Transfer-Encoding": "8bit", "X-Proofpoint-GUID": "Itua0K9TnWYP_PBkNoydkQuFVi1X7BrR", "X-Proofpoint-Spam-Details-Enc": "AW1haW4tMjYwNDE4MDIyOSBTYWx0ZWRfX+lMp3c75ChYq\n flO5SUImcpbz0wsVC2RXHnoc3zzox4QpMHgr2GQa8ojTUgEPYC6CfsRTARWZLQWF+iGjw4R8Zc+\n cQ3oIyCzLLEYUwj3W3wjFDUHFjCopbviVKTjvQZNXt1H9IEbMPgglRfQ3RSFW5TFgFIhjzd/Vg1\n z4mQJkF1uD5fgoz9Ll8LKgzT8yJZ7uROyBA/yGG8YPHjBRPo2kl/s3T5G3DFDII9zwsSAhICHfl\n nktgL5vB9rGUBOhzznz7JXldKiII1z0iqmzKr8mRwwzwMY9iU16Shrf9ia2y1Lm9TuS8rD+WMio\n xZ4dqZkDqxjWYjsriRET5MOwJK1vpDxNd4mX988QeQD42cj01G1capeVXumd2c=", "X-Authority-Info-Out": "v=2.4 cv=KLxXzVFo c=1 sm=1 tr=0 ts=69e406f7\n cx=c_apl:c_pps:t_out a=YrL12D//S6tul8v/L+6tKg==:117\n a=YrL12D//S6tul8v/L+6tKg==:17 a=A5OVakUREuEA:10 a=VkNPw1HP01LnGYTKEx00:22\n a=CoAbg4nstuYx8jGKVk0A:9", "X-Proofpoint-ORIG-GUID": "Itua0K9TnWYP_PBkNoydkQuFVi1X7BrR", "X-Proofpoint-Virus-Version": "vendor=baseguard\n engine=ICAP:2.0.293,Aquarius:18.0.1143,Hydra:6.1.51,FMLib:17.12.100.49\n definitions=2026-04-18_06,2026-04-17_04,2025-10-01_01", "X-Proofpoint-Spam-Details": "rule=notspam policy=default score=0 spamscore=0\n malwarescore=0 lowpriorityscore=0 mlxscore=0 suspectscore=0 bulkscore=0\n adultscore=0 clxscore=1030 mlxlogscore=999 phishscore=0 classifier=spam\n authscore=0 adjust=0 reason=mlx scancount=1 engine=8.22.0-2601150000\n definitions=main-2604180229", "Received-SPF": "pass client-ip=57.103.76.111;\n envelope-from=mohamed@unpredictable.fr; helo=outbound.st.icloud.com", "X-Spam_score_int": "-20", "X-Spam_score": "-2.1", "X-Spam_bar": "--", "X-Spam_report": "(-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1,\n DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1,\n RCVD_IN_VALIDITY_RPBL_BLOCKED=0.001, RCVD_IN_VALIDITY_SAFE_BLOCKED=0.001,\n SPF_HELO_PASS=-0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no", "X-Spam_action": "no action", "X-BeenThere": "qemu-devel@nongnu.org", "X-Mailman-Version": "2.1.29", "Precedence": "list", "List-Id": "qemu development <qemu-devel.nongnu.org>", "List-Unsubscribe": "<https://lists.nongnu.org/mailman/options/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>", "List-Archive": "<https://lists.nongnu.org/archive/html/qemu-devel>", "List-Post": "<mailto:qemu-devel@nongnu.org>", "List-Help": "<mailto:qemu-devel-request@nongnu.org?subject=help>", "List-Subscribe": "<https://lists.nongnu.org/mailman/listinfo/qemu-devel>,\n <mailto:qemu-devel-request@nongnu.org?subject=subscribe>", "Errors-To": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org", "Sender": "qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org" }, "content": "It turns out they're not that uncommon, so have\na feature around to log those.\n\nSigned-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>\n---\n accel/whpx/whpx-common.c | 38 +++++++++\n include/system/whpx-internal.h | 1 +\n target/i386/whpx/whpx-all.c | 144 ++++++++++++++++++++++++++++-----\n 3 files changed, 164 insertions(+), 19 deletions(-)", "diff": "diff --git a/accel/whpx/whpx-common.c b/accel/whpx/whpx-common.c\nindex 706871f138..8f28b1d617 100644\n--- a/accel/whpx/whpx-common.c\n+++ b/accel/whpx/whpx-common.c\n@@ -537,6 +537,38 @@ static void whpx_set_unknown_msr(Object *obj, Visitor *v,\n }\n }\n \n+static void whpx_set_intercept_msr_gp(Object *obj, Visitor *v,\n+ const char *name, void *opaque,\n+ Error **errp)\n+{\n+ struct whpx_state *whpx = &whpx_global;\n+ OnOffAuto mode;\n+\n+ if (!visit_type_OnOffAuto(v, name, &mode, errp)) {\n+ return;\n+ }\n+\n+ switch (mode) {\n+ case ON_OFF_AUTO_ON:\n+ whpx->intercept_msr_gp = true;\n+ break;\n+\n+ case ON_OFF_AUTO_OFF:\n+ whpx->intercept_msr_gp = false;\n+ break;\n+\n+ case ON_OFF_AUTO_AUTO:\n+ whpx->intercept_msr_gp = false;\n+ break;\n+ default:\n+ /*\n+ * The value was checked in visit_type_OnOffAuto() above. If\n+ * we get here, then something is wrong in QEMU.\n+ */\n+ abort();\n+ }\n+}\n+\n static void whpx_cpu_accel_class_init(ObjectClass *oc, const void *data)\n {\n AccelCPUClass *acc = ACCEL_CPU_CLASS(oc);\n@@ -575,6 +607,11 @@ static void whpx_accel_class_init(ObjectClass *oc, const void *data)\n NULL, NULL);\n object_class_property_set_description(oc, \"ignore-unknown-msr\",\n \"Configure unknown MSR behavior\");\n+ object_class_property_add(oc, \"intercept-msr-gp\", \"OnOffAuto\",\n+ NULL, whpx_set_intercept_msr_gp,\n+ NULL, NULL);\n+ object_class_property_set_description(oc, \"intercept-msr-gp\",\n+ \"Intercept #GP to log erroring MSR accesses.\");\n }\n \n static void whpx_accel_instance_init(Object *obj)\n@@ -590,6 +627,7 @@ static void whpx_accel_instance_init(Object *obj)\n /* Value determined at whpx_accel_init */\n whpx->hyperv_enlightenments_enabled = false;\n whpx->ignore_unknown_msr = true;\n+ whpx->intercept_msr_gp = false;\n }\n \n static const TypeInfo whpx_accel_type = {\ndiff --git a/include/system/whpx-internal.h b/include/system/whpx-internal.h\nindex 0aae83bd7c..15027a7d52 100644\n--- a/include/system/whpx-internal.h\n+++ b/include/system/whpx-internal.h\n@@ -48,6 +48,7 @@ struct whpx_state {\n bool hyperv_enlightenments_enabled;\n \n bool ignore_unknown_msr;\n+ bool intercept_msr_gp;\n };\n \n extern struct whpx_state whpx_global;\ndiff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c\nindex de254e236b..e79d085da8 100644\n--- a/target/i386/whpx/whpx-all.c\n+++ b/target/i386/whpx/whpx-all.c\n@@ -1007,6 +1007,25 @@ static int emulate_instruction(CPUState *cpu, const uint8_t *insn_bytes, size_t\n return 0;\n }\n \n+static int emulate_msr_instruction(CPUState *cpu, const uint8_t *insn_bytes, size_t insn_len) {\n+ X86CPU *x86_cpu = X86_CPU(cpu);\n+ CPUX86State *env = &x86_cpu->env;\n+ struct x86_decode decode = { 0 };\n+ x86_insn_stream stream = { .bytes = insn_bytes, .len = insn_len };\n+\n+ whpx_get_registers(cpu, WHPX_LEVEL_FAST_RUNTIME_STATE);\n+ decode_instruction_stream(env, &decode, &stream);\n+\n+ if (decode.cmd != X86_DECODE_CMD_RDMSR \n+ && decode.cmd != X86_DECODE_CMD_WRMSR) {\n+ return 1;\n+ }\n+\n+ exec_instruction(env, &decode);\n+ whpx_set_registers(cpu, WHPX_LEVEL_FAST_RUNTIME_STATE);\n+ return 0;\n+}\n+\n static int whpx_handle_mmio(CPUState *cpu, WHV_RUN_VP_EXIT_CONTEXT *exit_ctx)\n {\n WHV_MEMORY_ACCESS_CONTEXT *ctx = &exit_ctx->MemoryAccess;\n@@ -1021,6 +1040,45 @@ static int whpx_handle_mmio(CPUState *cpu, WHV_RUN_VP_EXIT_CONTEXT *exit_ctx)\n return 0;\n }\n \n+static int whpx_handle_msr_from_gpf(CPUState *cpu)\n+{\n+ WHV_VP_EXCEPTION_CONTEXT *ctx = &cpu->accel->exit_ctx.VpException;\n+ int ret;\n+\n+ ret = emulate_msr_instruction(cpu, ctx->InstructionBytes, ctx->InstructionByteCount);\n+ if (ret == 1) {\n+ /* Not an MSR instruction */\n+ return 1;\n+ }\n+\n+ return 0;\n+}\n+\n+static void whpx_inject_back_gpf(CPUState* cpu)\n+{\n+ WHV_VP_EXCEPTION_CONTEXT* ctx = &cpu->accel->exit_ctx.VpException;\n+ WHV_REGISTER_VALUE reg = {};\n+\n+ if (ctx->ExceptionInfo.SoftwareException) {\n+ /* TODO */\n+ warn_report(\"Was asked to inject software exception.\");\n+ return;\n+ }\n+\n+ if (ctx->ExceptionType != EXCP0D_GPF) {\n+ warn_report(\"Was asked to inject exception other than GPF.\");\n+ return;\n+ }\n+\n+ reg.ExceptionEvent.EventPending = 1;\n+ reg.ExceptionEvent.EventType = WHvX64PendingEventException;\n+ reg.ExceptionEvent.DeliverErrorCode = ctx->ExceptionInfo.ErrorCodeValid;\n+ reg.ExceptionEvent.Vector = ctx->ExceptionType;\n+ reg.ExceptionEvent.ErrorCode = ctx->ErrorCode;\n+ reg.ExceptionEvent.ExceptionParameter = ctx->ExceptionParameter;\n+ whpx_set_reg(cpu, WHvRegisterPendingEvent, reg);\n+}\n+\n static void handle_io(CPUState *env, uint16_t port, void *buffer,\n int direction, int size, int count)\n {\n@@ -1209,13 +1267,54 @@ static target_ulong read_cr(CPUState *cpu, int cr)\n return val.Reg64;\n }\n \n+static bool whpx_simulate_rdmsr(CPUState *cs)\n+{\n+ X86CPU *cpu = X86_CPU(cs);\n+ CPUX86State *env = &cpu->env;\n+ uint32_t msr = ECX(env);\n+ uint64_t val = 0;\n+\n+ switch (msr) {\n+ default:\n+ error_report(\"WHPX: unknown msr 0x%x\\n\", msr);\n+ x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);\n+ return 1;\n+ break;\n+ }\n+\n+ RAX(env) = (uint32_t)val;\n+ RDX(env) = (uint32_t)(val >> 32);\n+\n+ return 0;\n+}\n+\n+static bool whpx_simulate_wrmsr(CPUState *cs)\n+{\n+ X86CPU *cpu = X86_CPU(cs);\n+ CPUX86State *env = &cpu->env;\n+ uint32_t msr = ECX(env);\n+ uint64_t data = ((uint64_t)EDX(env) << 32) | EAX(env);\n+\n+ switch (msr) {\n+ default:\n+ error_report(\"WHPX: unknown msr 0x%x val %llx\\n\", msr, data);\n+ x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);\n+ return 1;\n+ break;\n+ }\n+\n+ return 0;\n+}\n+\n static const struct x86_emul_ops whpx_x86_emul_ops = {\n .read_segment_descriptor = read_segment_descriptor,\n .handle_io = handle_io,\n .is_protected_mode = is_protected_mode,\n .is_long_mode = is_long_mode,\n .is_user_mode = is_user_mode,\n- .read_cr = read_cr\n+ .read_cr = read_cr,\n+ .simulate_rdmsr = whpx_simulate_rdmsr,\n+ .simulate_wrmsr = whpx_simulate_wrmsr\n };\n \n static void whpx_init_emu(void)\n@@ -1294,6 +1393,18 @@ uint32_t whpx_get_supported_cpuid(uint32_t func, uint32_t idx, int reg)\n }\n }\n \n+static UINT64 whpx_get_default_exceptions(void)\n+{\n+ struct whpx_state *whpx = &whpx_global;\n+ UINT64 intercepts = 0;\n+\n+ if (whpx->intercept_msr_gp) {\n+ intercepts |= 1UL << WHvX64ExceptionTypeGeneralProtectionFault;\n+ }\n+\n+ return intercepts;\n+}\n+\n /*\n * Controls whether we should intercept various exceptions on the guest,\n * namely breakpoint/single-step events.\n@@ -1316,7 +1427,7 @@ HRESULT whpx_set_exception_exit_bitmap(UINT64 exceptions)\n prop.ExtendedVmExits.X64MsrExit = 1;\n prop.ExtendedVmExits.X64CpuidExit = 1;\n \n- if (exceptions != 0) {\n+ if (exceptions != 0 || whpx_get_default_exceptions() != 0) {\n prop.ExtendedVmExits.ExceptionExit = 1;\n }\n \n@@ -1331,7 +1442,7 @@ HRESULT whpx_set_exception_exit_bitmap(UINT64 exceptions)\n }\n \n memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));\n- prop.ExceptionExitBitmap = exceptions;\n+ prop.ExceptionExitBitmap = exceptions | whpx_get_default_exceptions();\n \n hr = whp_dispatch.WHvSetPartitionProperty(\n whpx->partition,\n@@ -1341,6 +1452,8 @@ HRESULT whpx_set_exception_exit_bitmap(UINT64 exceptions)\n \n if (SUCCEEDED(hr)) {\n whpx->exception_exit_bitmap = exceptions;\n+ } else {\n+ error_report(\"WHPX: Failed to set exception exit bitmap, hr=%08lx\", hr);\n }\n \n return hr;\n@@ -2476,6 +2589,15 @@ int whpx_vcpu_run(CPUState *cpu)\n break;\n }\n case WHvRunVpExitReasonException:\n+ if (vcpu->exit_ctx.VpException.ExceptionType ==\n+ WHvX64ExceptionTypeGeneralProtectionFault) {\n+ if (whpx_handle_msr_from_gpf(cpu)) {\n+ whpx_inject_back_gpf(cpu);\n+ }\n+ ret = 0;\n+ break;\n+ }\n+\n whpx_get_registers(cpu, WHPX_LEVEL_FULL_STATE);\n \n if ((vcpu->exit_ctx.VpException.ExceptionType ==\n@@ -2984,22 +3106,6 @@ int whpx_accel_init(AccelState *as, MachineState *ms)\n goto error;\n }\n \n- /* Register for MSR and CPUID exits */\n- memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));\n- prop.ExtendedVmExits.X64MsrExit = 1;\n- prop.ExtendedVmExits.X64CpuidExit = 1;\n-\n- hr = whp_dispatch.WHvSetPartitionProperty(\n- whpx->partition,\n- WHvPartitionPropertyCodeExtendedVmExits,\n- &prop,\n- sizeof(WHV_PARTITION_PROPERTY));\n- if (FAILED(hr)) {\n- error_report(\"WHPX: Failed to enable extended VM exits, hr=%08lx\", hr);\n- ret = -EINVAL;\n- goto error;\n- }\n-\n memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));\n prop.X64MsrExitBitmap.UnhandledMsrs = 1;\n prop.X64MsrExitBitmap.ApicBaseMsrWrite = 1;\n", "prefixes": [ "36/38" ] }