From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 87CC91FF0E7 for ; Fri, 10 Jul 2026 10:09:29 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 046E1214E3; Fri, 10 Jul 2026 10:09:29 +0200 (CEST) Message-ID: <16c8d95b-50a4-43a5-b101-1b0381a61868@proxmox.com> Date: Fri, 10 Jul 2026 10:08:42 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH-SERIES qemu-server 0/2] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS From: Fiona Ebner To: pve-devel@lists.proxmox.com References: <20260709134211.199744-1-f.ebner@proxmox.com> Content-Language: en-US In-Reply-To: <20260709134211.199744-1-f.ebner@proxmox.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1783670922955 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.027 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: YKSTWUH6D5B4N7DAB774YGIYLOIV57NX X-Message-ID-Hash: YKSTWUH6D5B4N7DAB774YGIYLOIV57NX X-MailFrom: f.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Am 09.07.26 um 3:42 PM schrieb Fiona Ebner: > As reported in the community forum [0] and enterprise support, Windows > with MBEC and VBS can have issues on certain Intel CPUs, leading to > guest freezes and 100% CPU usage. The detection/enabling of APICv > support in Windows was determined to be related. Disabling > vmx-apicv-vid and/or vmx-apicv-register mitigates the issue. Disable > both flags starting with a bumped 11.0+pve2 machine version for > consistency. > > [0]: https://forum.proxmox.com/threads/184178 > > > What still would be nice to check is if the issue also happens with a > non-host model with nested-virt/vmx present. Otherwise we might want > to restrict removing the flags to the host model. I guess it doesn't really matter. Even if it doesn't trigger for a specific combination, it might trigger for a different one. Note that vmx-mbec also needs to be enabled for current virtual models (but QEMU master has added new versions for many models to enabled it). What would be nicer is to only remove the flags if vmx-mbec is present. I looked into creating the dump of CPU model expansion during QEMU build and shipping it, but the expansion is actually not static for a given model, because many flags are gated behind other flags, so the expansion for e.g. Skylake-Server is different than the one for Skylake-Server,+vmx. Also, the file would be rather large with ~1.65 MiB. What we could do instead, is have a systemd service for the pve-qemu-kvm package which starts a dummy VM just for QMP querying. Having the expansions would also make it possible to be more precise with the phys-bits check which depends on pdp1gbe and for the custom CPU model editor to show what the default values for a given model+flags actually are. Should I look into that or should we disable the apicv flags without trying to detect mbec?