UEFI hypervisor - Windows hangs when APs are in VMX WAIT_FOR_SIPI

[blackrose123]

I'm developing a UEFI Type-1 hypervisor (EDK2/GCC) on an Intel i7-10750H (6C/12T) with InsydeH2O firmware. BSP-only VMX works — Windows 11 boots to desktop under the hypervisor.
Problem: When I put APs into VMX with activity_state=WAIT_FOR_SIPI before Windows boots, Windows hangs at the boot logo.
Setup (in ExitBootServices callback):
1. For each AP: INIT-SIPI-SIPI via LAPIC ICR → 16→64 trampoline → VMXON → VMLAUNCH(activity=3)
2. BSP: VMXON → VMLAUNCH (virtualize current context)
3. All 12 logical processors confirmed in VMX
Observations:
- EBS callback completes fully (NVRAM progress marker 203/203)
- No AP timeouts during trampoline
- Disabling AP trampoline (#if 0) → Windows boots fine
- Disabling SIPI handler (eating SIPI, AP stays in WAIT_FOR_SIPI forever) → still hangs
- InsydeH2O MP Services broken (StartupAllAPs hangs), so I use raw LAPIC ICR
VMCS config for APs:
- Guest: CR0=0x30, CR4=0x2000, EFER=0, all segments unusable, activity=WAIT_FOR_SIPI
- Host: same CR3/GDT/IDT as BSP, per-AP VMM stack, shared EPT
- Controls: EPT, VPID, unrestricted guest, HLT/NMI/ExtInt exiting, MSR bitmap
- Entry: LOAD_EFER (no IA32E_MODE_GUEST since guest is in reset state)
VMEXIT handlers: INIT (set WAIT_FOR_SIPI), SIPI (real mode setup), CR0 (PE/PG + IA32E mode transition), EFER, CPUID, MSR, EPT violation
The APs are literally sleeping (WAIT_FOR_SIPI) and not executing any guest code. Yet their presence in VMX prevents Windows from booting. What am I missing?
References I've studied: MiniVisorPkg (tandasat), standa-note.blogspot.com INIT/SIPI posts, Intel SDM Vol 3C Ch 24-26
Hardware: Casper Excalibur G770, i7-10750H, InsydeH2O CP171 BIOS

[Octocontrabass]

I'm developing a UEFI Type-1 hypervisor (EDK2/GCC) on an Intel i7-10750H (6C/12T) with InsydeH2O firmware.

Could you run your hypervisor in a virtual machine? It'd be easier to debug that way.

Setup (in ExitBootServices callback):

How do you ensure that your setup runs only after any callbacks installed by the MP services have completed?

- InsydeH2O MP Services broken (StartupAllAPs hangs)

UEFI MP services are only available before the BSP calls ExitBootServices, and any code running on an AP must return to the caller before the BSP calls ExitBootServices. It's not great that it hangs instead of returning an error, but it isn't supposed to work.