[PATCH-SERIES qemu-server v2 0/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS

[PATCH-SERIES qemu-server v2 0/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS

[Fiona Ebner]

Changes in v2:
* Disable MBEC by default for machine versions < 11.0 for backwards
  compat with older kernel and QEMU.

As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. The detection/enabling of APICv
support in Windows was determined to be related. Disabling
vmx-apicv-vid and/or vmx-apicv-register mitigates the issue. Disable
both flags starting with a bumped 11.0+pve2 machine version for
consistency.

[0]: https://forum.proxmox.com/threads/184178

qemu-server:

Fiona Ebner (3):
  cpu config: disable vmx-mbec flag for machine versions < 11.0
  cpu config: use $version_guard rather than passing $machine_version
  cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues
    with VBS

 src/PVE/QemuServer.pm                         |  2 +-
 src/PVE/QemuServer/CPUConfig.pm               | 46 +++++++++++++++----
 src/PVE/QemuServer/Machine.pm                 |  3 +-
 src/test/cfg2cmd/cpu-level.conf.cmd           |  2 +-
 src/test/cfg2cmd/win11-host-11.0+pve2.conf    |  4 ++
 .../cfg2cmd/win11-host-11.0+pve2.conf.cmd     | 26 +++++++++++
 6 files changed, 70 insertions(+), 13 deletions(-)
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd


Summary over all repositories:
  6 files changed, 70 insertions(+), 13 deletions(-)

-- 
Generated by git-murpp 0.5.0

[PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0

[Fiona Ebner]

As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
automatically be enabled if both QEMU (since 11.0) and the kernel
(since 7.0.0-3-pve) support it, but this is incorrect from a machine
version perspective, since the flag was enabled before. While there
were no reports about this causing migration issues in practice, this
cannot be ruled out and it's better to preserve the behavior for
previous machine versions. In particular, existing VMs won't suddenly
be affected by the aforementioned issue after VBS is enabled.

[0]: https://forum.proxmox.com/threads/184178

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

New in v2.

 src/PVE/QemuServer/CPUConfig.pm     | 12 ++++++++++++
 src/test/cfg2cmd/cpu-level.conf.cmd |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index df3e2b92..5b243000 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags(
         };
     }
 
+    if (
+        $arch eq 'x86_64'
+        && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
+        && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
+        && !min_version($machine_version, 11, 0)
+    ) {
+        $pve_flags->{'vmx-mbec'} = {
+            op => '-',
+            reason => "$pve_msg for backwards compatibility with older kernel and QEMU",
+        };
+    }
+
     return $pve_flags;
 }
 
diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd
index d276a6de..5d5f760d 100644
--- a/src/test/cfg2cmd/cpu-level.conf.cmd
+++ b/src/test/cfg2cmd/cpu-level.conf.cmd
@@ -13,7 +13,7 @@
   -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
   -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
   -global 'kvm-pit.lost_tick_policy=discard' \
-  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \
+  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \
   -m 768 \
   -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \
   -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \
-- 
2.47.3

[PATCH qemu-server v2 2/3] cpu config: use $version_guard rather than passing $machine_version

[Fiona Ebner]

No functional change intended. This is in preparation for commit "cpu
config: disable APICv for Windows 11/2022/2025 to mitigate issues with
VBS" so that the 11.0+pve2 version is correctly used.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

Changes in v2:
* Adapt new hunk from previous patch.

 src/PVE/QemuServer.pm           |  2 +-
 src/PVE/QemuServer/CPUConfig.pm | 22 +++++++++++-----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 59a37098..191ae549 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -3418,7 +3418,7 @@ sub config_to_command {
                 $arch,
                 $kvm,
                 $kvm_off,
-                $machine_version,
+                $version_guard,
                 $winversion,
                 $gpu_passthrough,
                 $kvmver,
diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index 5b243000..c322cebc 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -862,7 +862,7 @@ my sub check_phys_bits_above_40_compat($bios, $cpu_type, $cpu_flags) {
 
 # Calculate QEMU's '-cpu' argument from a given VM configuration
 sub get_cpu_options(
-    $conf, $arch, $kvm, $kvm_off, $machine_version, $winversion, $gpu_passthrough,
+    $conf, $arch, $kvm, $kvm_off, $version_guard, $winversion, $gpu_passthrough,
     $qemu_binary_version,
 ) {
 
@@ -902,14 +902,14 @@ sub get_cpu_options(
         if !defined(get_cpu_models_by_arch($arch)->{$cputype});
 
     my $pve_flags = get_pve_cpu_flags(
-        $conf, $kvm, $cputype, $arch, $machine_version, $winversion, $qemu_binary_version,
+        $conf, $kvm, $cputype, $arch, $version_guard, $winversion, $qemu_binary_version,
     );
 
     my $hv_flags;
     if ($kvm && $arch eq 'x86_64') {
         $hv_flags = get_hyperv_enlightenments(
             $winversion,
-            $machine_version,
+            $version_guard,
             $conf->{bios},
             $gpu_passthrough,
             $hv_vendor_id,
@@ -999,7 +999,7 @@ sub get_cpu_options(
 
 # Some hardcoded flags required by certain configurations
 sub get_pve_cpu_flags(
-    $conf, $kvm, $cputype, $arch, $machine_version, $winversion, $qemu_binary_version,
+    $conf, $kvm, $cputype, $arch, $version_guard, $winversion, $qemu_binary_version,
 ) {
 
     my $pve_flags = {};
@@ -1033,7 +1033,7 @@ sub get_pve_cpu_flags(
         };
     }
 
-    if (min_version($machine_version, 2, 3) && $kvm && $arch eq 'x86_64') {
+    if ($version_guard->(2, 3) && $kvm && $arch eq 'x86_64') {
         $pve_flags->{'kvm_pv_unhalt'} = {
             op => '+',
             reason => "$pve_msg to improve Linux guest spinlock performance",
@@ -1059,7 +1059,7 @@ sub get_pve_cpu_flags(
         $arch eq 'x86_64'
         && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
         && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
-        && !min_version($machine_version, 11, 0)
+        && !$version_guard->(11, 0)
     ) {
         $pve_flags->{'vmx-mbec'} = {
             op => '-',
@@ -1071,7 +1071,7 @@ sub get_pve_cpu_flags(
 }
 
 sub get_hyperv_enlightenments(
-    $winversion, $machine_version, $bios, $gpu_passthrough, $hv_vendor_id = undef,
+    $winversion, $version_guard, $bios, $gpu_passthrough, $hv_vendor_id = undef,
 ) {
 
     return if $winversion < 6;
@@ -1099,7 +1099,7 @@ sub get_hyperv_enlightenments(
         );
     }
 
-    if (min_version($machine_version, 2, 3)) {
+    if ($version_guard->(2, 3)) {
         $flagfn->('hv_spinlocks', '0x1fff');
         $flagfn->('hv_vapic');
         $flagfn->('hv_time');
@@ -1107,7 +1107,7 @@ sub get_hyperv_enlightenments(
         $flagfn->('hv_spinlocks', '0xffff');
     }
 
-    if (min_version($machine_version, 2, 6)) {
+    if ($version_guard->(2, 6)) {
         $flagfn->('hv_reset');
         $flagfn->('hv_vpindex');
         $flagfn->('hv_runtime');
@@ -1117,12 +1117,12 @@ sub get_hyperv_enlightenments(
         my $win7_reason = $default_reason . " 7 and higher";
         $flagfn->('hv_relaxed', undef, $win7_reason);
 
-        if (min_version($machine_version, 2, 12)) {
+        if ($version_guard->(2, 12)) {
             $flagfn->('hv_synic', undef, $win7_reason);
             $flagfn->('hv_stimer', undef, $win7_reason);
         }
 
-        if (min_version($machine_version, 3, 1)) {
+        if ($version_guard->(3, 1)) {
             $flagfn->('hv_ipi', undef, $win7_reason);
         }
     }
-- 
2.47.3

[PATCH qemu-server v2 3/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS

[Fiona Ebner]

As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. The detection/enabling of APICv
support in Windows was determined to be related. Disabling
vmx-apicv-vid and/or vmx-apicv-register mitigates the issue. Disable
both flags starting with a bumped 11.0+pve2 machine version for
consistency.

[0]: https://forum.proxmox.com/threads/184178

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

Changes in v2:
* Extend comment to mention why the check is not restricted to the
  'host' model.

 src/PVE/QemuServer/CPUConfig.pm               | 14 ++++++++++
 src/PVE/QemuServer/Machine.pm                 |  3 ++-
 src/test/cfg2cmd/win11-host-11.0+pve2.conf    |  4 +++
 .../cfg2cmd/win11-host-11.0+pve2.conf.cmd     | 26 +++++++++++++++++++
 4 files changed, 46 insertions(+), 1 deletion(-)
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd

diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index c322cebc..30d477f7 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1067,6 +1067,20 @@ sub get_pve_cpu_flags(
         };
     }
 
+    # Note that this is only relevant for Intel CPUs if nested-virt/vmx is enabled. Otherwise, the
+    # flags are already disabled. Note that newer QEMU CPU models do come with MBEC enabled, so the
+    # model is not restricted to 'host' here.
+    if ($arch eq 'x86_64' && $winversion >= 11 && $version_guard->(11, 0, 2)) {
+        $pve_flags->{'vmx-apicv-register'} = {
+            op => '-',
+            reason => "$pve_msg to avoid issues with certain Windows configurations like VBS",
+        };
+        $pve_flags->{'vmx-apicv-vid'} = {
+            op => '-',
+            reason => "$pve_msg to avoid issues with certain Windows configurations like VBS",
+        };
+    }
+
     return $pve_flags;
 }
 
diff --git a/src/PVE/QemuServer/Machine.pm b/src/PVE/QemuServer/Machine.pm
index 37b272c6..04e63f56 100644
--- a/src/PVE/QemuServer/Machine.pm
+++ b/src/PVE/QemuServer/Machine.pm
@@ -44,9 +44,10 @@ our $PVE_MACHINE_VERSION = {
         },
     },
     '11.0' => {
-        highest => 1,
+        highest => 2,
         revisions => {
             '+pve1' => 'Use host_tunnel=off by default for VirtIO NICs.',
+            '+pve2' => 'Disable APICv for Windows 11/2022/2025 to mitigate issues with VBS.',
         },
     },
 };
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
new file mode 100644
index 00000000..f71e37dd
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
@@ -0,0 +1,4 @@
+# TEST: Simple test for Windows 11 VM with host CPU and machine version 11.0+pve2
+cpu: host
+machine: pc-q35-11.0+pve2
+ostype: win11
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
new file mode 100644
index 00000000..a17d6ffd
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
@@ -0,0 +1,26 @@
+/usr/bin/kvm \
+  -id 8006 \
+  -name vm8006 \
+  -no-shutdown \
+  -chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
+  -mon 'chardev=qmp,mode=control' \
+  -chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
+  -mon 'chardev=qmp-event,mode=control' \
+  -pidfile /var/run/qemu-server/8006.pid \
+  -daemonize \
+  -smp '1,sockets=1,cores=1,maxcpus=1' \
+  -nodefaults \
+  -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
+  -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
+  -global 'kvm-pit.lost_tick_policy=discard' \
+  -cpu 'host,-cet-ibt,-cet-ss,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,-vmx-apicv-register,-vmx-apicv-vid' \
+  -m 512 \
+  -global 'ICH9-LPC.disable_s3=1' \
+  -global 'ICH9-LPC.disable_s4=1' \
+  -readconfig /usr/share/qemu-server/pve-q35-4.0.cfg \
+  -device 'usb-tablet,id=tablet,bus=ehci.0,port=1' \
+  -device 'VGA,id=vga,bus=pcie.0,addr=0x1,edid=off' \
+  -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on' \
+  -iscsi 'initiator-name=iqn.1993-08.org.debian:01:aabbccddeeff' \
+  -rtc 'driftfix=slew,base=localtime' \
+  -machine 'hpet=off,type=pc-q35-11.0+pve2'
-- 
2.47.3

Re: [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0

[Friedrich Weber]

Thanks for looking into this!

On 13/07/2026 14:40, Fiona Ebner wrote:
> As reported in the community forum [0] and enterprise support, Windows
> with MBEC and VBS can have issues on certain Intel CPUs, leading to
> guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
> automatically be enabled if both QEMU (since 11.0) and the kernel
> (since 7.0.0-3-pve) support it, but this is incorrect from a machine
> version perspective, since the flag was enabled before. While there

Should this be "since the flag *not* enabled before"?

> were no reports about this causing migration issues in practice, this
> cannot be ruled out and it's better to preserve the behavior for
> previous machine versions. In particular, existing VMs won't suddenly
> be affected by the aforementioned issue after VBS is enabled.
> 
> [0]: https://forum.proxmox.com/threads/184178
> 
> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
> ---
> 
> New in v2.
> 
>  src/PVE/QemuServer/CPUConfig.pm     | 12 ++++++++++++
>  src/test/cfg2cmd/cpu-level.conf.cmd |  2 +-
>  2 files changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
> index df3e2b92..5b243000 100644
> --- a/src/PVE/QemuServer/CPUConfig.pm
> +++ b/src/PVE/QemuServer/CPUConfig.pm
> @@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags(
>          };
>      }
>  
> +    if (
> +        $arch eq 'x86_64'
> +        && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
> +        && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
> +        && !min_version($machine_version, 11, 0)
> +    ) {
> +        $pve_flags->{'vmx-mbec'} = {
> +            op => '-',
> +            reason => "$pve_msg for backwards compatibility with older kernel and QEMU",
> +        };
> +    }
> +
>      return $pve_flags;
>  }
>  
> diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd
> index d276a6de..5d5f760d 100644
> --- a/src/test/cfg2cmd/cpu-level.conf.cmd
> +++ b/src/test/cfg2cmd/cpu-level.conf.cmd
> @@ -13,7 +13,7 @@
>    -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
>    -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
>    -global 'kvm-pit.lost_tick_policy=discard' \
> -  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \
> +  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \
>    -m 768 \
>    -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \
>    -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \

Re: [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0

[Fiona Ebner]

Am 13.07.26 um 2:46 PM schrieb Friedrich Weber:
> On 13/07/2026 14:40, Fiona Ebner wrote:
>> As reported in the community forum [0] and enterprise support, Windows
>> with MBEC and VBS can have issues on certain Intel CPUs, leading to
>> guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
>> automatically be enabled if both QEMU (since 11.0) and the kernel
>> (since 7.0.0-3-pve) support it, but this is incorrect from a machine
>> version perspective, since the flag was enabled before. While there
> 
> Should this be "since the flag *not* enabled before"?

Yes, good catch! Maybe even "the feature was not available before",
since the flag did not even exist yet.

superseded: [PATCH-SERIES qemu-server v2 0/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS

[Fiona Ebner]

superseded-by:
https://lore.proxmox.com/pve-devel/20260714104201.71308-1-f.ebner@proxmox.com/T/