From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id A37591FF0E4 for ; Tue, 14 Jul 2026 12:42:40 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 653292143D; Tue, 14 Jul 2026 12:42:40 +0200 (CEST) From: Fiona Ebner To: pve-devel@lists.proxmox.com Subject: [PATCH qemu-server v3 3/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS Date: Tue, 14 Jul 2026 12:41:50 +0200 Message-ID: <20260714104201.71308-4-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260714104201.71308-1-f.ebner@proxmox.com> References: <20260714104201.71308-1-f.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1784025708411 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.297 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: K2BB4TN3E33KLCX7F7IBDSCGIGB4LXE4 X-Message-ID-Hash: K2BB4TN3E33KLCX7F7IBDSCGIGB4LXE4 X-MailFrom: f.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: As reported in the community forum [0] and enterprise support, Windows with MBEC and VBS can have issues on certain Intel CPUs, leading to guest freezes and 100% CPU usage. The detection/enabling of APICv support in Windows was determined to be related. With hv_emcs, that feature is not used in Windows anymore. The flag is also recommended in the QEMU documentation [1], so start using it with a bumped 11.0+pve2 machine version. The flag cannot be set on non-Intel hosts, so check the host CPU vendor. For the tests, it is necessary to mock the read_cpuinfo() call. Default to 'GenuineIntel' as the vendor so that the test results do not depend on the actual host CPU. [0]: https://forum.proxmox.com/threads/184178 [1]: https://www.qemu.org/docs/master/system/i386/hyperv.html#recommendations Signed-off-by: Fiona Ebner --- Changes in v3: * Different approach, enable recommended hv-evmcs flag instead of disabling apicv flags. src/PVE/QemuServer/CPUConfig.pm | 8 ++++++ src/PVE/QemuServer/Machine.pm | 3 ++- src/test/cfg2cmd/win11-host-11.0+pve2.conf | 4 +++ .../cfg2cmd/win11-host-11.0+pve2.conf.cmd | 26 +++++++++++++++++++ src/test/run_config2command_tests.pl | 9 +++++++ 5 files changed, 49 insertions(+), 1 deletion(-) create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm index c322cebc..afadaeca 100644 --- a/src/PVE/QemuServer/CPUConfig.pm +++ b/src/PVE/QemuServer/CPUConfig.pm @@ -1127,6 +1127,14 @@ sub get_hyperv_enlightenments( } } + if ( + PVE::ProcFSTools::read_cpuinfo->{vendor} eq 'GenuineIntel' + && $winversion >= 11 + && $version_guard->(11, 0, 2) + ) { + $flagfn->('hv_evmcs', undef, $default_reason . " for Windows 11 on Intel host"); + } + return $flags; } diff --git a/src/PVE/QemuServer/Machine.pm b/src/PVE/QemuServer/Machine.pm index 37b272c6..35161d1f 100644 --- a/src/PVE/QemuServer/Machine.pm +++ b/src/PVE/QemuServer/Machine.pm @@ -44,9 +44,10 @@ our $PVE_MACHINE_VERSION = { }, }, '11.0' => { - highest => 1, + highest => 2, revisions => { '+pve1' => 'Use host_tunnel=off by default for VirtIO NICs.', + '+pve2' => 'Enable hv_emcs for Windows 11/2022/2025 to mitigate issues with VBS.', }, }, }; diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf b/src/test/cfg2cmd/win11-host-11.0+pve2.conf new file mode 100644 index 00000000..f71e37dd --- /dev/null +++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf @@ -0,0 +1,4 @@ +# TEST: Simple test for Windows 11 VM with host CPU and machine version 11.0+pve2 +cpu: host +machine: pc-q35-11.0+pve2 +ostype: win11 diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd new file mode 100644 index 00000000..b1949836 --- /dev/null +++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd @@ -0,0 +1,26 @@ +/usr/bin/kvm \ + -id 8006 \ + -name vm8006 \ + -no-shutdown \ + -chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \ + -mon 'chardev=qmp,mode=control' \ + -chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \ + -mon 'chardev=qmp-event,mode=control' \ + -pidfile /var/run/qemu-server/8006.pid \ + -daemonize \ + -smp '1,sockets=1,cores=1,maxcpus=1' \ + -nodefaults \ + -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \ + -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \ + -global 'kvm-pit.lost_tick_policy=discard' \ + -cpu 'host,-cet-ibt,-cet-ss,hv_evmcs,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt' \ + -m 512 \ + -global 'ICH9-LPC.disable_s3=1' \ + -global 'ICH9-LPC.disable_s4=1' \ + -readconfig /usr/share/qemu-server/pve-q35-4.0.cfg \ + -device 'usb-tablet,id=tablet,bus=ehci.0,port=1' \ + -device 'VGA,id=vga,bus=pcie.0,addr=0x1,edid=off' \ + -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on' \ + -iscsi 'initiator-name=iqn.1993-08.org.debian:01:aabbccddeeff' \ + -rtc 'driftfix=slew,base=localtime' \ + -machine 'hpet=off,type=pc-q35-11.0+pve2' diff --git a/src/test/run_config2command_tests.pl b/src/test/run_config2command_tests.pl index 5c3034ab..a8eebc12 100755 --- a/src/test/run_config2command_tests.pl +++ b/src/test/run_config2command_tests.pl @@ -244,6 +244,15 @@ sub get_test_qemu_version { $current_test->{qemu_version} // $base_env->{real_qemu_version} // '2.12'; } +my $procfs_tools_module = Test::MockModule->new('PVE::ProcFSTools'); +$procfs_tools_module->mock( + read_cpuinfo => sub { + my $res = $procfs_tools_module->original('read_cpuinfo')->(); + $res->{vendor} = 'GenuineIntel'; + return $res; + }, +); + my $qemu_server_module; $qemu_server_module = Test::MockModule->new('PVE::QemuServer'); $qemu_server_module->mock( -- 2.47.3