fix: detect Hyper-V enlightenments on guests, not only root partitions#713
Merged
NotRequiem merged 1 commit intoJul 6, 2026
Conversation
da7309f to
b7ada7c
Compare
A QEMU/KVM guest running with Hyper-V enlightenments presents "Microsoft Hv" at CPUID leaf 0x40000000 (so the Windows guest uses the fast Hyper-V ABI) while KVM relocates its "KVMKVMKVM" signature to leaf 0x40000100. The 0x40000100 check that yields HYPERV_ENLIGHTENMENT / QEMU_KVM_HYPERV lived only in the root-partition branch of hyper_x(), which an ordinary guest never takes. Enlightened guests therefore hit the guest branch's eax()==11 && is_hyperv_present() test, were classified HYPERV_REAL_VM, and branded HYPERV; vmid_template() then saw "Microsoft Hv" and (since hyper_x() != HYPERV_HOST) added brand_enum::HYPERV as well, so the final brand became "Microsoft Hyper-V" instead of "QEMU+KVM Hyper-V Enlightenment". - hyper_x(): also check the 0x40000100 KVM signature in the guest branch, before the eax()==11 Hyper-V-guest test. - vmid_template(): when hyper_x() reports HYPERV_ENLIGHTENMENT, still report the VM via the "Microsoft Hv" vendor string but don't add the misleading HYPERV brand (already set to QEMU_KVM_HYPERV by hyper_x()). No behavior change for real Hyper-V guests/hosts, nested Hyper-V, spoofers, or bare metal.
8445a28 to
b8349dc
Compare
Owner
|
Correct It also should be removed from the root partition check entirely |
Owner
|
Thank you |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What does this PR do?
Briefly explain what this PR does:
Fixes misdetection of QEMU/KVM guests running with Hyper-V enlightenments, which were being reported as genuine Microsoft Hyper-V.
Root cause
A QEMU/KVM guest running with Hyper-V enlightenments presents
Microsoft Hvat CPUID leaf0x40000000(so the Windows guest uses the fast Hyper-V ABI), while KVM relocates itsKVMKVMKVMsignature to leaf0x40000100. The0x40000100check that yieldsHYPERV_ENLIGHTENMENT/QEMU_KVM_HYPERVlived only in the root-partition branch ofhyper_x(), which an ordinary guest never reaches.Enlightened guests therefore fell through to the guest branch's
eax() == 11 && is_hyperv_present()test, were classifiedHYPERV_REAL_VMand brandedHYPERV;vmid_template()then sawMicrosoft Hvand (sincehyper_x() != HYPERV_HOST) addedbrand_enum::HYPERVas well. The final brand became "Microsoft Hyper-V" instead of "QEMU+KVM Hyper-V Enlightenment".Changes
hyper_x(): also check the0x40000100KVM signature in the guest branch, before theeax() == 11Hyper-V-guest test.vmid_template(): whenhyper_x()reportsHYPERV_ENLIGHTENMENT, still flag the VM via theMicrosoft Hvvendor string but don't add the misleadingHYPERVbrand (already set toQEMU_KVM_HYPERVbyhyper_x()).No behavior change for real Hyper-V guests/hosts, nested Hyper-V, spoofers, or bare metal.
References