Re: [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0

[Friedrich Weber <f.weber@proxmox.com>]

Thanks for looking into this!

On 13/07/2026 14:40, Fiona Ebner wrote:
> As reported in the community forum [0] and enterprise support, Windows
> with MBEC and VBS can have issues on certain Intel CPUs, leading to
> guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
> automatically be enabled if both QEMU (since 11.0) and the kernel
> (since 7.0.0-3-pve) support it, but this is incorrect from a machine
> version perspective, since the flag was enabled before. While there

Should this be "since the flag *not* enabled before"?

> were no reports about this causing migration issues in practice, this
> cannot be ruled out and it's better to preserve the behavior for
> previous machine versions. In particular, existing VMs won't suddenly
> be affected by the aforementioned issue after VBS is enabled.
> 
> [0]: https://forum.proxmox.com/threads/184178
> 
> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
> ---
> 
> New in v2.
> 
>  src/PVE/QemuServer/CPUConfig.pm     | 12 ++++++++++++
>  src/test/cfg2cmd/cpu-level.conf.cmd |  2 +-
>  2 files changed, 13 insertions(+), 1 deletion(-)
> 
> diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
> index df3e2b92..5b243000 100644
> --- a/src/PVE/QemuServer/CPUConfig.pm
> +++ b/src/PVE/QemuServer/CPUConfig.pm
> @@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags(
>          };
>      }
>  
> +    if (
> +        $arch eq 'x86_64'
> +        && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
> +        && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
> +        && !min_version($machine_version, 11, 0)
> +    ) {
> +        $pve_flags->{'vmx-mbec'} = {
> +            op => '-',
> +            reason => "$pve_msg for backwards compatibility with older kernel and QEMU",
> +        };
> +    }
> +
>      return $pve_flags;
>  }
>  
> diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd
> index d276a6de..5d5f760d 100644
> --- a/src/test/cfg2cmd/cpu-level.conf.cmd
> +++ b/src/test/cfg2cmd/cpu-level.conf.cmd
> @@ -13,7 +13,7 @@
>    -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
>    -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
>    -global 'kvm-pit.lost_tick_policy=discard' \
> -  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \
> +  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \
>    -m 768 \
>    -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \
>    -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \