@samitouri / QOSamiQemu / commits / bb605df21e

whpx: i386: add feature to intercept #GP MSR accesses

It turns out they're not that uncommon, so have a feature around to log those. Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr> Link: https://lore.kernel.org/r/20260422214225.2242-35-mohamed@unpredictable.fr Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Mohamed Mediouni committed Apr 22, 2026 at 23:42 UTC bb605df21e2edb7b40ddff595bb755618c031f7a

3 files changed +166 -19

accel/whpx/whpx-common.c

@@ -555,6 +555,7 @@ static void whpx_accel_instance_init(Object *obj)

555 /* Value determined at whpx_accel_init */

556 whpx->hyperv_enlightenments_enabled = false;

557 whpx->ignore_unknown_msr = true;

558 + whpx->intercept_msr_gp = false;

559 }

560

561 static const TypeInfo whpx_accel_type = {

include/system/whpx-internal.h

@@ -48,6 +48,7 @@ struct whpx_state {

48 bool hyperv_enlightenments_enabled;

50 bool ignore_unknown_msr;

51 + bool intercept_msr_gp;

52 };

54 extern struct whpx_state whpx_global;

target/i386/whpx/whpx-all.c

+164 -19

@@ -1008,6 +1008,27 @@ static int emulate_instruction(CPUState *cpu, const uint8_t *insn_bytes, size_t

1008 return 0;

1009 }

1010

1011 +static int emulate_msr_instruction(CPUState *cpu,

1012 + const uint8_t *insn_bytes, size_t insn_len)

1013 +{

1014 + X86CPU *x86_cpu = X86_CPU(cpu);

1015 + CPUX86State *env = &x86_cpu->env;

1016 + struct x86_decode decode = { 0 };

1017 + x86_insn_stream stream = { .bytes = insn_bytes, .len = insn_len };

1018 +

1019 + whpx_get_registers(cpu, WHPX_LEVEL_FAST_RUNTIME_STATE);

1020 + decode_instruction_stream(env, &decode, &stream);

1021 +

1022 + if (decode.cmd != X86_DECODE_CMD_RDMSR

1023 + && decode.cmd != X86_DECODE_CMD_WRMSR) {

1024 + return 1;

1025 + }

1026 +

1027 + exec_instruction(env, &decode);

1028 + whpx_set_registers(cpu, WHPX_LEVEL_FAST_RUNTIME_STATE);

1029 + return 0;

1030 +}

1031 +

1032 static int whpx_handle_mmio(CPUState *cpu, WHV_RUN_VP_EXIT_CONTEXT *exit_ctx)

1033 {

1034 WHV_MEMORY_ACCESS_CONTEXT *ctx = &exit_ctx->MemoryAccess;

@@ -1022,6 +1043,45 @@ static int whpx_handle_mmio(CPUState *cpu, WHV_RUN_VP_EXIT_CONTEXT *exit_ctx)

1043 return 0;

1044 }

1045

1046 +static int whpx_handle_msr_from_gpf(CPUState *cpu)

1047 +{

1048 + WHV_VP_EXCEPTION_CONTEXT *ctx = &cpu->accel->exit_ctx.VpException;

1049 + int ret;

1050 +

1051 + ret = emulate_msr_instruction(cpu, ctx->InstructionBytes, ctx->InstructionByteCount);

1052 + if (ret == 1) {

1053 + /* Not an MSR instruction */

1054 + return 1;

1055 + }

1056 +

1057 + return 0;

1058 +}

1059 +

1060 +static void whpx_inject_back_gpf(CPUState *cpu)

1061 +{

1062 + WHV_VP_EXCEPTION_CONTEXT *ctx = &cpu->accel->exit_ctx.VpException;

1063 + WHV_REGISTER_VALUE reg = {};

1064 +

1065 + if (ctx->ExceptionInfo.SoftwareException) {

1066 + /* TODO */

1067 + warn_report("Was asked to inject software exception.");

1068 + return;

1069 + }

1070 +

1071 + if (ctx->ExceptionType != EXCP0D_GPF) {

1072 + warn_report("Was asked to inject exception other than GPF.");

1073 + return;

1074 + }

1075 +

1076 + reg.ExceptionEvent.EventPending = 1;

1077 + reg.ExceptionEvent.EventType = WHvX64PendingEventException;

1078 + reg.ExceptionEvent.DeliverErrorCode = ctx->ExceptionInfo.ErrorCodeValid;

1079 + reg.ExceptionEvent.Vector = ctx->ExceptionType;

1080 + reg.ExceptionEvent.ErrorCode = ctx->ErrorCode;

1081 + reg.ExceptionEvent.ExceptionParameter = ctx->ExceptionParameter;

1082 + whpx_set_reg(cpu, WHvRegisterPendingEvent, reg);

1083 +}

1084 +

1085 static void handle_io(CPUState *env, uint16_t port, void *buffer,

1086 int direction, int size, int count)

1087 {

@@ -1210,13 +1270,54 @@ static target_ulong read_cr(CPUState *cpu, int cr)

1270 return val.Reg64;

1271 }

1272

1273 +static bool whpx_simulate_rdmsr(CPUState *cs)

1274 +{

1275 + X86CPU *cpu = X86_CPU(cs);

1276 + CPUX86State *env = &cpu->env;

1277 + uint32_t msr = ECX(env);

1278 + uint64_t val = 0;

1279 +

1280 + switch (msr) {

1281 + default:

1282 + error_report("WHPX: unknown msr 0x%x", msr);

1283 + x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);

1284 + return 1;

1285 + break;

1286 + }

1287 +

1288 + RAX(env) = (uint32_t)val;

1289 + RDX(env) = (uint32_t)(val >> 32);

1290 +

1291 + return 0;

1292 +}

1293 +

1294 +static bool whpx_simulate_wrmsr(CPUState *cs)

1295 +{

1296 + X86CPU *cpu = X86_CPU(cs);

1297 + CPUX86State *env = &cpu->env;

1298 + uint32_t msr = ECX(env);

1299 + uint64_t data = ((uint64_t)EDX(env) << 32) | EAX(env);

1300 +

1301 + switch (msr) {

1302 + default:

1303 + error_report("WHPX: unknown msr 0x%x val %llx", msr, data);

1304 + x86_emul_raise_exception(&X86_CPU(cpu)->env, EXCP0D_GPF, 0);

1305 + return 1;

1306 + break;

1307 + }

1308 +

1309 + return 0;

1310 +}

1311 +

1312 static const struct x86_emul_ops whpx_x86_emul_ops = {

1313 .read_segment_descriptor = read_segment_descriptor,

1314 .handle_io = handle_io,

1315 .is_protected_mode = is_protected_mode,

1316 .is_long_mode = is_long_mode,

1317 .is_user_mode = is_user_mode,

1219 - .read_cr = read_cr

1318 + .read_cr = read_cr,

1319 + .simulate_rdmsr = whpx_simulate_rdmsr,

1320 + .simulate_wrmsr = whpx_simulate_wrmsr

1321 };

1322

1323 static void whpx_init_emu(void)

@@ -1356,6 +1457,18 @@ uint64_t whpx_get_supported_msr_feature(uint32_t index)

1457 return 0;

1458 }

1459

1460 +static UINT64 whpx_get_default_exceptions(void)

1461 +{

1462 + struct whpx_state *whpx = &whpx_global;

1463 + UINT64 intercepts = 0;

1464 +

1465 + if (whpx->intercept_msr_gp) {

1466 + intercepts |= 1UL << WHvX64ExceptionTypeGeneralProtectionFault;

1467 + }

1468 +

1469 + return intercepts;

1470 +}

1471 +

1472 /*

1473 * Controls whether we should intercept various exceptions on the guest,

1474 * namely breakpoint/single-step events.

@@ -1378,7 +1491,7 @@ HRESULT whpx_set_exception_exit_bitmap(UINT64 exceptions)

1491 prop.ExtendedVmExits.X64MsrExit = 1;

1492 prop.ExtendedVmExits.X64CpuidExit = 1;

1493

1381 - if (exceptions != 0) {

1494 + if (exceptions != 0 || whpx_get_default_exceptions() != 0) {

1495 prop.ExtendedVmExits.ExceptionExit = 1;

1496 }

1497

@@ -1393,7 +1506,7 @@ HRESULT whpx_set_exception_exit_bitmap(UINT64 exceptions)

1506 }

1507

1508 memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));

1396 - prop.ExceptionExitBitmap = exceptions;

1509 + prop.ExceptionExitBitmap = exceptions | whpx_get_default_exceptions();

1510

1511 hr = whp_dispatch.WHvSetPartitionProperty(

1512 whpx->partition,

@@ -1403,6 +1516,8 @@ HRESULT whpx_set_exception_exit_bitmap(UINT64 exceptions)

1516

1517 if (SUCCEEDED(hr)) {

1518 whpx->exception_exit_bitmap = exceptions;

1519 + } else {

1520 + error_report("WHPX: Failed to set exception exit bitmap, hr=%08lx", hr);

1521 }

1522

1523 return hr;

@@ -2518,6 +2633,15 @@ int whpx_vcpu_run(CPUState *cpu)

2633 break;

2634 }

2635 case WHvRunVpExitReasonException:

2636 + if (vcpu->exit_ctx.VpException.ExceptionType ==

2637 + WHvX64ExceptionTypeGeneralProtectionFault) {

2638 + if (whpx_handle_msr_from_gpf(cpu)) {

2639 + whpx_inject_back_gpf(cpu);

2640 + }

2641 + ret = 0;

2642 + break;

2643 + }

2644 +

2645 whpx_get_registers(cpu, WHPX_LEVEL_FULL_STATE);

2646

2647 if ((vcpu->exit_ctx.VpException.ExceptionType ==

@@ -2806,6 +2930,38 @@ static void whpx_set_unknown_msr(Object *obj, Visitor *v,

2930 }

2931 }

2932

2933 +static void whpx_set_intercept_msr_gp(Object *obj, Visitor *v,

2934 + const char *name, void *opaque,

2935 + Error **errp)

2936 +{

2937 + struct whpx_state *whpx = &whpx_global;

2938 + OnOffAuto mode;

2939 +

2940 + if (!visit_type_OnOffAuto(v, name, &mode, errp)) {

2941 + return;

2942 + }

2943 +

2944 + switch (mode) {

2945 + case ON_OFF_AUTO_ON:

2946 + whpx->intercept_msr_gp = true;

2947 + break;

2948 +

2949 + case ON_OFF_AUTO_OFF:

2950 + whpx->intercept_msr_gp = false;

2951 + break;

2952 +

2953 + case ON_OFF_AUTO_AUTO:

2954 + whpx->intercept_msr_gp = false;

2955 + break;

2956 + default:

2957 + /*

2958 + * The value was checked in visit_type_OnOffAuto() above. If

2959 + * we get here, then something is wrong in QEMU.

2960 + */

2961 + abort();

2962 + }

2963 +}

2964 +

2965 void whpx_arch_accel_class_init(ObjectClass *oc)

2966 {

2967 object_class_property_add(oc, "ignore-unknown-msr", "OnOffAuto",

@@ -2813,6 +2969,11 @@ void whpx_arch_accel_class_init(ObjectClass *oc)

2969 NULL, NULL);

2970 object_class_property_set_description(oc, "ignore-unknown-msr",

2971 "Configure unknown MSR behavior");

2972 + object_class_property_add(oc, "intercept-msr-gp", "OnOffAuto",

2973 + NULL, whpx_set_intercept_msr_gp,

2974 + NULL, NULL);

2975 + object_class_property_set_description(oc, "intercept-msr-gp",

2976 + "Intercept #GP to log erroring MSR accesses.");

2977 }

2978

2979 int whpx_accel_init(AccelState *as, MachineState *ms)

@@ -3067,22 +3228,6 @@ int whpx_accel_init(AccelState *as, MachineState *ms)

3228 goto error;

3229 }

3230

3070 - /* Register for MSR and CPUID exits */

3071 - memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));

3072 - prop.ExtendedVmExits.X64MsrExit = 1;

3073 - prop.ExtendedVmExits.X64CpuidExit = 1;

3074 -

3075 - hr = whp_dispatch.WHvSetPartitionProperty(

3076 - whpx->partition,

3077 - WHvPartitionPropertyCodeExtendedVmExits,

3078 - &prop,

3079 - sizeof(WHV_PARTITION_PROPERTY));

3080 - if (FAILED(hr)) {

3081 - error_report("WHPX: Failed to enable extended VM exits, hr=%08lx", hr);

3082 - ret = -EINVAL;

3083 - goto error;

3084 - }

3085 -

3231 memset(&prop, 0, sizeof(WHV_PARTITION_PROPERTY));

3232 prop.X64MsrExitBitmap.UnhandledMsrs = 1;

3233 prop.X64MsrExitBitmap.ApicBaseMsrWrite = 1;