[PATCH qemu-server v3 3/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS

[Fiona Ebner <f.ebner@proxmox.com>]

As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. The detection/enabling of APICv
support in Windows was determined to be related. With hv_emcs, that
feature is not used in Windows anymore. The flag is also recommended
in the QEMU documentation [1], so start using it with a bumped
11.0+pve2 machine version. The flag cannot be set on non-Intel hosts,
so check the host CPU vendor.

For the tests, it is necessary to mock the read_cpuinfo() call.
Default to 'GenuineIntel' as the vendor so that the test results do
not depend on the actual host CPU.

[0]: https://forum.proxmox.com/threads/184178
[1]: https://www.qemu.org/docs/master/system/i386/hyperv.html#recommendations

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

Changes in v3:
* Different approach, enable recommended hv-evmcs flag instead of
  disabling apicv flags.

 src/PVE/QemuServer/CPUConfig.pm               |  8 ++++++
 src/PVE/QemuServer/Machine.pm                 |  3 ++-
 src/test/cfg2cmd/win11-host-11.0+pve2.conf    |  4 +++
 .../cfg2cmd/win11-host-11.0+pve2.conf.cmd     | 26 +++++++++++++++++++
 src/test/run_config2command_tests.pl          |  9 +++++++
 5 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd

diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index c322cebc..afadaeca 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1127,6 +1127,14 @@ sub get_hyperv_enlightenments(
         }
     }
 
+    if (
+        PVE::ProcFSTools::read_cpuinfo->{vendor} eq 'GenuineIntel'
+        && $winversion >= 11
+        && $version_guard->(11, 0, 2)
+    ) {
+        $flagfn->('hv_evmcs', undef, $default_reason . " for Windows 11 on Intel host");
+    }
+
     return $flags;
 }
 
diff --git a/src/PVE/QemuServer/Machine.pm b/src/PVE/QemuServer/Machine.pm
index 37b272c6..35161d1f 100644
--- a/src/PVE/QemuServer/Machine.pm
+++ b/src/PVE/QemuServer/Machine.pm
@@ -44,9 +44,10 @@ our $PVE_MACHINE_VERSION = {
         },
     },
     '11.0' => {
-        highest => 1,
+        highest => 2,
         revisions => {
             '+pve1' => 'Use host_tunnel=off by default for VirtIO NICs.',
+            '+pve2' => 'Enable hv_emcs for Windows 11/2022/2025 to mitigate issues with VBS.',
         },
     },
 };
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
new file mode 100644
index 00000000..f71e37dd
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
@@ -0,0 +1,4 @@
+# TEST: Simple test for Windows 11 VM with host CPU and machine version 11.0+pve2
+cpu: host
+machine: pc-q35-11.0+pve2
+ostype: win11
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
new file mode 100644
index 00000000..b1949836
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
@@ -0,0 +1,26 @@
+/usr/bin/kvm \
+  -id 8006 \
+  -name vm8006 \
+  -no-shutdown \
+  -chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
+  -mon 'chardev=qmp,mode=control' \
+  -chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
+  -mon 'chardev=qmp-event,mode=control' \
+  -pidfile /var/run/qemu-server/8006.pid \
+  -daemonize \
+  -smp '1,sockets=1,cores=1,maxcpus=1' \
+  -nodefaults \
+  -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
+  -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
+  -global 'kvm-pit.lost_tick_policy=discard' \
+  -cpu 'host,-cet-ibt,-cet-ss,hv_evmcs,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt' \
+  -m 512 \
+  -global 'ICH9-LPC.disable_s3=1' \
+  -global 'ICH9-LPC.disable_s4=1' \
+  -readconfig /usr/share/qemu-server/pve-q35-4.0.cfg \
+  -device 'usb-tablet,id=tablet,bus=ehci.0,port=1' \
+  -device 'VGA,id=vga,bus=pcie.0,addr=0x1,edid=off' \
+  -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on' \
+  -iscsi 'initiator-name=iqn.1993-08.org.debian:01:aabbccddeeff' \
+  -rtc 'driftfix=slew,base=localtime' \
+  -machine 'hpet=off,type=pc-q35-11.0+pve2'
diff --git a/src/test/run_config2command_tests.pl b/src/test/run_config2command_tests.pl
index 5c3034ab..a8eebc12 100755
--- a/src/test/run_config2command_tests.pl
+++ b/src/test/run_config2command_tests.pl
@@ -244,6 +244,15 @@ sub get_test_qemu_version {
     $current_test->{qemu_version} // $base_env->{real_qemu_version} // '2.12';
 }
 
+my $procfs_tools_module = Test::MockModule->new('PVE::ProcFSTools');
+$procfs_tools_module->mock(
+    read_cpuinfo => sub {
+        my $res = $procfs_tools_module->original('read_cpuinfo')->();
+        $res->{vendor} = 'GenuineIntel';
+        return $res;
+    },
+);
+
 my $qemu_server_module;
 $qemu_server_module = Test::MockModule->new('PVE::QemuServer');
 $qemu_server_module->mock(
-- 
2.47.3