From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id 097141FF0E1 for ; Mon, 13 Jul 2026 14:47:27 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 556792143B; Mon, 13 Jul 2026 14:47:26 +0200 (CEST) Message-ID: Date: Mon, 13 Jul 2026 14:46:51 +0200 MIME-Version: 1.0 User-Agent: Mozilla Thunderbird Subject: Re: [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0 To: Fiona Ebner , pve-devel@lists.proxmox.com References: <20260713124025.121154-1-f.ebner@proxmox.com> <20260713124025.121154-2-f.ebner@proxmox.com> Content-Language: en-US From: Friedrich Weber In-Reply-To: <20260713124025.121154-2-f.ebner@proxmox.com> Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 7bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1783946796686 X-SPAM-LEVEL: Spam detection results: 0 DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: L3FCBZH2IAA6VH3EZH5C4JW2SCX5JQXT X-Message-ID-Hash: L3FCBZH2IAA6VH3EZH5C4JW2SCX5JQXT X-MailFrom: f.weber@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Thanks for looking into this! On 13/07/2026 14:40, Fiona Ebner wrote: > As reported in the community forum [0] and enterprise support, Windows > with MBEC and VBS can have issues on certain Intel CPUs, leading to > guest freezes and 100% CPU usage. Note that the vmx-mbec flag will > automatically be enabled if both QEMU (since 11.0) and the kernel > (since 7.0.0-3-pve) support it, but this is incorrect from a machine > version perspective, since the flag was enabled before. While there Should this be "since the flag *not* enabled before"? > were no reports about this causing migration issues in practice, this > cannot be ruled out and it's better to preserve the behavior for > previous machine versions. In particular, existing VMs won't suddenly > be affected by the aforementioned issue after VBS is enabled. > > [0]: https://forum.proxmox.com/threads/184178 > > Signed-off-by: Fiona Ebner > --- > > New in v2. > > src/PVE/QemuServer/CPUConfig.pm | 12 ++++++++++++ > src/test/cfg2cmd/cpu-level.conf.cmd | 2 +- > 2 files changed, 13 insertions(+), 1 deletion(-) > > diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm > index df3e2b92..5b243000 100644 > --- a/src/PVE/QemuServer/CPUConfig.pm > +++ b/src/PVE/QemuServer/CPUConfig.pm > @@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags( > }; > } > > + if ( > + $arch eq 'x86_64' > + && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0. > + && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0. > + && !min_version($machine_version, 11, 0) > + ) { > + $pve_flags->{'vmx-mbec'} = { > + op => '-', > + reason => "$pve_msg for backwards compatibility with older kernel and QEMU", > + }; > + } > + > return $pve_flags; > } > > diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd > index d276a6de..5d5f760d 100644 > --- a/src/test/cfg2cmd/cpu-level.conf.cmd > +++ b/src/test/cfg2cmd/cpu-level.conf.cmd > @@ -13,7 +13,7 @@ > -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \ > -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \ > -global 'kvm-pit.lost_tick_policy=discard' \ > - -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \ > + -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \ > -m 768 \ > -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \ > -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \