Skip to content

fix: detect Hyper-V enlightenments on guests, not only root partitions#713

Merged
NotRequiem merged 1 commit into
NotRequiem:mainfrom
Manny684:fix/hyperv-enlightenment-guest-misdetection
Jul 6, 2026
Merged

fix: detect Hyper-V enlightenments on guests, not only root partitions#713
NotRequiem merged 1 commit into
NotRequiem:mainfrom
Manny684:fix/hyperv-enlightenment-guest-misdetection

Conversation

@Manny684

@Manny684 Manny684 commented Jul 6, 2026

Copy link
Copy Markdown
Contributor

What does this PR do?

  • Add a new technique
  • Add a new feature
  • Add a new README translation
  • Improve code
  • Fix bugs
  • Refactoring or code organisation
  • Stylistic changes
  • Sync between branches
  • Other

Briefly explain what this PR does:

Fixes misdetection of QEMU/KVM guests running with Hyper-V enlightenments, which were being reported as genuine Microsoft Hyper-V.

Root cause

A QEMU/KVM guest running with Hyper-V enlightenments presents Microsoft Hv at CPUID leaf 0x40000000 (so the Windows guest uses the fast Hyper-V ABI), while KVM relocates its KVMKVMKVM signature to leaf 0x40000100. The 0x40000100 check that yields HYPERV_ENLIGHTENMENT / QEMU_KVM_HYPERV lived only in the root-partition branch of hyper_x(), which an ordinary guest never reaches.

Enlightened guests therefore fell through to the guest branch's eax() == 11 && is_hyperv_present() test, were classified HYPERV_REAL_VM and branded HYPERV; vmid_template() then saw Microsoft Hv and (since hyper_x() != HYPERV_HOST) added brand_enum::HYPERV as well. The final brand became "Microsoft Hyper-V" instead of "QEMU+KVM Hyper-V Enlightenment".
Changes

  • hyper_x(): also check the 0x40000100 KVM signature in the guest branch, before the eax() == 11 Hyper-V-guest test.
  • vmid_template(): when hyper_x() reports HYPERV_ENLIGHTENMENT, still flag the VM via the Microsoft Hv vendor string but don't add the misleading HYPERV brand (already set to QEMU_KVM_HYPERV by hyper_x()).

No behavior change for real Hyper-V guests/hosts, nested Hyper-V, spoofers, or bare metal.

References

@Manny684 Manny684 force-pushed the fix/hyperv-enlightenment-guest-misdetection branch from da7309f to b7ada7c Compare July 6, 2026 08:28
A QEMU/KVM guest running with Hyper-V enlightenments presents "Microsoft Hv" at CPUID leaf 0x40000000 (so the Windows guest uses the fast Hyper-V ABI) while KVM relocates its "KVMKVMKVM" signature to leaf 0x40000100. The 0x40000100 check that yields HYPERV_ENLIGHTENMENT / QEMU_KVM_HYPERV lived only in the root-partition branch of hyper_x(), which an ordinary guest never takes. Enlightened guests therefore hit the guest branch's eax()==11 && is_hyperv_present() test, were classified HYPERV_REAL_VM, and branded HYPERV; vmid_template() then saw "Microsoft Hv" and (since hyper_x() != HYPERV_HOST) added brand_enum::HYPERV as well, so the final brand became "Microsoft Hyper-V" instead of "QEMU+KVM Hyper-V Enlightenment".

- hyper_x(): also check the 0x40000100 KVM signature in the guest branch, before the eax()==11 Hyper-V-guest test.

- vmid_template(): when hyper_x() reports HYPERV_ENLIGHTENMENT, still report the VM via the "Microsoft Hv" vendor string but don't add the misleading HYPERV brand (already set to QEMU_KVM_HYPERV by hyper_x()).

No behavior change for real Hyper-V guests/hosts, nested Hyper-V, spoofers, or bare metal.
@Manny684 Manny684 force-pushed the fix/hyperv-enlightenment-guest-misdetection branch from 8445a28 to b8349dc Compare July 6, 2026 08:33
@Manny684 Manny684 marked this pull request as ready for review July 6, 2026 08:34
@NotRequiem

Copy link
Copy Markdown
Owner

Correct

It also should be removed from the root partition check entirely

@NotRequiem NotRequiem merged commit 759a2d8 into NotRequiem:main Jul 6, 2026
@NotRequiem

Copy link
Copy Markdown
Owner

Thank you

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants