Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
---
 target/i386/whpx/whpx-all.c | 22 ++++++++++++++++++++++
 1 file changed, 22 insertions(+)

diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
index 561a48206c..0259782a82 100644
--- a/target/i386/whpx/whpx-all.c
+++ b/target/i386/whpx/whpx-all.c
@@ -1506,6 +1506,26 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
     }
 }
 
+static void whpx_inject_exceptions(CPUState* cpu)
+{
+    X86CPU *x86_cpu = X86_CPU(cpu);
+    CPUX86State *env = &x86_cpu->env;
+
+    if (env->exception_injected) {
+        env->exception_injected = 0;
+        WHV_REGISTER_VALUE reg = {};
+        reg.ExceptionEvent.EventPending = 1;
+        reg.ExceptionEvent.EventType = WHvX64PendingEventException;
+        reg.ExceptionEvent.DeliverErrorCode = 1;
+        reg.ExceptionEvent.Vector = env->exception_nr;
+        reg.ExceptionEvent.ErrorCode = env->error_code;
+        if (env->exception_nr == EXCP0E_PAGE) {
+            reg.ExceptionEvent.ExceptionParameter = env->cr[2];
+        }
+        whpx_set_reg(cpu, WHvRegisterPendingEvent, reg);
+    }
+}
+
 int whpx_vcpu_run(CPUState *cpu)
 {
     HRESULT hr;
@@ -1600,6 +1620,8 @@ int whpx_vcpu_run(CPUState *cpu)
             whpx_vcpu_configure_single_stepping(cpu, true, NULL);
         }
 
+        whpx_inject_exceptions(cpu);
+
         hr = whp_dispatch.WHvRunVirtualProcessor(
             whpx->partition, cpu->cpu_index,
             &vcpu->exit_ctx, sizeof(vcpu->exit_ctx));
-- 
2.50.1 (Apple Git-155)

On 2/24/26 00:39, Mohamed Mediouni wrote:
> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
> ---
>   target/i386/whpx/whpx-all.c | 22 ++++++++++++++++++++++
>   1 file changed, 22 insertions(+)
> 
> diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
> index 561a48206c..0259782a82 100644
> --- a/target/i386/whpx/whpx-all.c
> +++ b/target/i386/whpx/whpx-all.c
> @@ -1506,6 +1506,26 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
>       }
>   }
>   
> +static void whpx_inject_exceptions(CPUState* cpu)
> +{
> +    X86CPU *x86_cpu = X86_CPU(cpu);
> +    CPUX86State *env = &x86_cpu->env;
> +
> +    if (env->exception_injected) {
> +        env->exception_injected = 0;
> +        WHV_REGISTER_VALUE reg = {};
> +        reg.ExceptionEvent.EventPending = 1;
> +        reg.ExceptionEvent.EventType = WHvX64PendingEventException;
> +        reg.ExceptionEvent.DeliverErrorCode = 1;

I can't find very good documentation of the WHPX API, but does this need 
to be limited to: 1) #DF/#TS/#NP/#SS/#GP/#PF/#AC vectors; 2) CR0.PE=1?

Thanks,

Paolo

> On 24. Feb 2026, at 10:49, Paolo Bonzini <pbonzini@redhat.com> wrote:
> 
> On 2/24/26 00:39, Mohamed Mediouni wrote:
>> Signed-off-by: Mohamed Mediouni <mohamed@unpredictable.fr>
>> ---
>>  target/i386/whpx/whpx-all.c | 22 ++++++++++++++++++++++
>>  1 file changed, 22 insertions(+)
>> diff --git a/target/i386/whpx/whpx-all.c b/target/i386/whpx/whpx-all.c
>> index 561a48206c..0259782a82 100644
>> --- a/target/i386/whpx/whpx-all.c
>> +++ b/target/i386/whpx/whpx-all.c
>> @@ -1506,6 +1506,26 @@ static void whpx_vcpu_process_async_events(CPUState *cpu)
>>      }
>>  }
>>  +static void whpx_inject_exceptions(CPUState* cpu)
>> +{
>> +    X86CPU *x86_cpu = X86_CPU(cpu);
>> +    CPUX86State *env = &x86_cpu->env;
>> +
>> +    if (env->exception_injected) {
>> +        env->exception_injected = 0;
>> +        WHV_REGISTER_VALUE reg = {};
>> +        reg.ExceptionEvent.EventPending = 1;
>> +        reg.ExceptionEvent.EventType = WHvX64PendingEventException;
>> +        reg.ExceptionEvent.DeliverErrorCode = 1;
> 
> I can't find very good documentation of the WHPX API, but does this need to be limited to: 1) #DF/#TS/#NP/#SS/#GP/#PF/#AC vectors; 2) CR0.PE=1?
> 
> Thanks,
> 
> Paolo

Hello,

There’s no (maintained) documentation other than the headers for WHP unfortunately, but there shouldn't be limitations in particular on the injectable exception types.

The headers have a comment that say that the event type has to be WHvX64PendingEventException but not much else: https://github.com/MicrosoftDocs/Virtualization-Documentation/blob/main/virtualization/api/hypervisor-platform/headers/WinHvPlatformDefs.h#L1012

From a cursory test, #DB and #UD don’t look to be blocked by WHP.

And as of CR0.PE=1, that’s handled earlier on before the creation of the exception
instead of injection time, as part of the walker helpers at target/i386/emulate/x86_mmu.c.

Thanks,
-Mohamed