[PATCH-SERIES qemu-server v3 0/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS

[PATCH-SERIES qemu-server v3 0/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS

[Fiona Ebner]

Changes in v3:
* Improve commit message in patch 1.
* Different approach, enable recommended hv-evmcs flag instead of
  disabling apicv flags.
* Mock host CPU vendor in tests.

Changes in v2:
* Disable MBEC by default for machine versions < 11.0 for backwards
  compat with older kernel and QEMU.

As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. The detection/enabling of APICv
support in Windows was determined to be related. With hv_emcs, that
feature is not used in Windows anymore. The flag is also recommended
in the QEMU documentation [1], so start using it with a bumped
11.0+pve2 machine version.

[0]: https://forum.proxmox.com/threads/184178
[1]: https://www.qemu.org/docs/master/system/i386/hyperv.html#recommendations

qemu-server:

Fiona Ebner (4):
  cpu config: disable vmx-mbec flag for machine versions < 11.0
  cpu config: use $version_guard rather than passing $machine_version
  cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate
    issues with VBS
  test: cfg2cmd: allow setting host CPU vendor for a given test

 src/PVE/QemuServer.pm                         |  2 +-
 src/PVE/QemuServer/CPUConfig.pm               | 40 ++++++++++++++-----
 src/PVE/QemuServer/Machine.pm                 |  3 +-
 src/test/cfg2cmd/cpu-level.conf.cmd           |  2 +-
 .../cfg2cmd/win11-amd-host-11.0+pve2.conf     |  5 +++
 .../cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd | 26 ++++++++++++
 src/test/cfg2cmd/win11-host-11.0+pve2.conf    |  4 ++
 .../cfg2cmd/win11-host-11.0+pve2.conf.cmd     | 26 ++++++++++++
 src/test/run_config2command_tests.pl          | 17 ++++++++
 9 files changed, 112 insertions(+), 13 deletions(-)
 create mode 100644 src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf
 create mode 100644 src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd


Summary over all repositories:
  9 files changed, 112 insertions(+), 13 deletions(-)

-- 
Generated by git-murpp 0.5.0

[PATCH qemu-server v3 1/4] cpu config: disable vmx-mbec flag for machine versions < 11.0

[Fiona Ebner]

As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
automatically be enabled if both QEMU (since 11.0) and the kernel
(since 7.0.0-3-pve) support it, but this is incorrect from a machine
version perspective, since the feature was not available before. While
there were no reports about this causing migration issues in practice,
this cannot be ruled out and it's better to preserve the behavior for
previous machine versions. In particular, existing VMs won't suddenly
be affected by the aforementioned issue after VBS is enabled.

[0]: https://forum.proxmox.com/threads/184178

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

Changes in v3:
* Improve commit message.

 src/PVE/QemuServer/CPUConfig.pm     | 12 ++++++++++++
 src/test/cfg2cmd/cpu-level.conf.cmd |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index df3e2b92..5b243000 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags(
         };
     }
 
+    if (
+        $arch eq 'x86_64'
+        && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
+        && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
+        && !min_version($machine_version, 11, 0)
+    ) {
+        $pve_flags->{'vmx-mbec'} = {
+            op => '-',
+            reason => "$pve_msg for backwards compatibility with older kernel and QEMU",
+        };
+    }
+
     return $pve_flags;
 }
 
diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd
index d276a6de..5d5f760d 100644
--- a/src/test/cfg2cmd/cpu-level.conf.cmd
+++ b/src/test/cfg2cmd/cpu-level.conf.cmd
@@ -13,7 +13,7 @@
   -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
   -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
   -global 'kvm-pit.lost_tick_policy=discard' \
-  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \
+  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \
   -m 768 \
   -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \
   -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \
-- 
2.47.3

[PATCH qemu-server v3 2/4] cpu config: use $version_guard rather than passing $machine_version

[Fiona Ebner]

No functional change intended. This is in preparation for commit "cpu
config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues
with VBS" so that the 11.0+pve2 version is correctly used.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
 src/PVE/QemuServer.pm           |  2 +-
 src/PVE/QemuServer/CPUConfig.pm | 22 +++++++++++-----------
 2 files changed, 12 insertions(+), 12 deletions(-)

diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 59a37098..191ae549 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -3418,7 +3418,7 @@ sub config_to_command {
                 $arch,
                 $kvm,
                 $kvm_off,
-                $machine_version,
+                $version_guard,
                 $winversion,
                 $gpu_passthrough,
                 $kvmver,
diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index 5b243000..c322cebc 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -862,7 +862,7 @@ my sub check_phys_bits_above_40_compat($bios, $cpu_type, $cpu_flags) {
 
 # Calculate QEMU's '-cpu' argument from a given VM configuration
 sub get_cpu_options(
-    $conf, $arch, $kvm, $kvm_off, $machine_version, $winversion, $gpu_passthrough,
+    $conf, $arch, $kvm, $kvm_off, $version_guard, $winversion, $gpu_passthrough,
     $qemu_binary_version,
 ) {
 
@@ -902,14 +902,14 @@ sub get_cpu_options(
         if !defined(get_cpu_models_by_arch($arch)->{$cputype});
 
     my $pve_flags = get_pve_cpu_flags(
-        $conf, $kvm, $cputype, $arch, $machine_version, $winversion, $qemu_binary_version,
+        $conf, $kvm, $cputype, $arch, $version_guard, $winversion, $qemu_binary_version,
     );
 
     my $hv_flags;
     if ($kvm && $arch eq 'x86_64') {
         $hv_flags = get_hyperv_enlightenments(
             $winversion,
-            $machine_version,
+            $version_guard,
             $conf->{bios},
             $gpu_passthrough,
             $hv_vendor_id,
@@ -999,7 +999,7 @@ sub get_cpu_options(
 
 # Some hardcoded flags required by certain configurations
 sub get_pve_cpu_flags(
-    $conf, $kvm, $cputype, $arch, $machine_version, $winversion, $qemu_binary_version,
+    $conf, $kvm, $cputype, $arch, $version_guard, $winversion, $qemu_binary_version,
 ) {
 
     my $pve_flags = {};
@@ -1033,7 +1033,7 @@ sub get_pve_cpu_flags(
         };
     }
 
-    if (min_version($machine_version, 2, 3) && $kvm && $arch eq 'x86_64') {
+    if ($version_guard->(2, 3) && $kvm && $arch eq 'x86_64') {
         $pve_flags->{'kvm_pv_unhalt'} = {
             op => '+',
             reason => "$pve_msg to improve Linux guest spinlock performance",
@@ -1059,7 +1059,7 @@ sub get_pve_cpu_flags(
         $arch eq 'x86_64'
         && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
         && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
-        && !min_version($machine_version, 11, 0)
+        && !$version_guard->(11, 0)
     ) {
         $pve_flags->{'vmx-mbec'} = {
             op => '-',
@@ -1071,7 +1071,7 @@ sub get_pve_cpu_flags(
 }
 
 sub get_hyperv_enlightenments(
-    $winversion, $machine_version, $bios, $gpu_passthrough, $hv_vendor_id = undef,
+    $winversion, $version_guard, $bios, $gpu_passthrough, $hv_vendor_id = undef,
 ) {
 
     return if $winversion < 6;
@@ -1099,7 +1099,7 @@ sub get_hyperv_enlightenments(
         );
     }
 
-    if (min_version($machine_version, 2, 3)) {
+    if ($version_guard->(2, 3)) {
         $flagfn->('hv_spinlocks', '0x1fff');
         $flagfn->('hv_vapic');
         $flagfn->('hv_time');
@@ -1107,7 +1107,7 @@ sub get_hyperv_enlightenments(
         $flagfn->('hv_spinlocks', '0xffff');
     }
 
-    if (min_version($machine_version, 2, 6)) {
+    if ($version_guard->(2, 6)) {
         $flagfn->('hv_reset');
         $flagfn->('hv_vpindex');
         $flagfn->('hv_runtime');
@@ -1117,12 +1117,12 @@ sub get_hyperv_enlightenments(
         my $win7_reason = $default_reason . " 7 and higher";
         $flagfn->('hv_relaxed', undef, $win7_reason);
 
-        if (min_version($machine_version, 2, 12)) {
+        if ($version_guard->(2, 12)) {
             $flagfn->('hv_synic', undef, $win7_reason);
             $flagfn->('hv_stimer', undef, $win7_reason);
         }
 
-        if (min_version($machine_version, 3, 1)) {
+        if ($version_guard->(3, 1)) {
             $flagfn->('hv_ipi', undef, $win7_reason);
         }
     }
-- 
2.47.3

[PATCH qemu-server v3 3/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS

[Fiona Ebner]

As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. The detection/enabling of APICv
support in Windows was determined to be related. With hv_emcs, that
feature is not used in Windows anymore. The flag is also recommended
in the QEMU documentation [1], so start using it with a bumped
11.0+pve2 machine version. The flag cannot be set on non-Intel hosts,
so check the host CPU vendor.

For the tests, it is necessary to mock the read_cpuinfo() call.
Default to 'GenuineIntel' as the vendor so that the test results do
not depend on the actual host CPU.

[0]: https://forum.proxmox.com/threads/184178
[1]: https://www.qemu.org/docs/master/system/i386/hyperv.html#recommendations

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

Changes in v3:
* Different approach, enable recommended hv-evmcs flag instead of
  disabling apicv flags.

 src/PVE/QemuServer/CPUConfig.pm               |  8 ++++++
 src/PVE/QemuServer/Machine.pm                 |  3 ++-
 src/test/cfg2cmd/win11-host-11.0+pve2.conf    |  4 +++
 .../cfg2cmd/win11-host-11.0+pve2.conf.cmd     | 26 +++++++++++++++++++
 src/test/run_config2command_tests.pl          |  9 +++++++
 5 files changed, 49 insertions(+), 1 deletion(-)
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf
 create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd

diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index c322cebc..afadaeca 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1127,6 +1127,14 @@ sub get_hyperv_enlightenments(
         }
     }
 
+    if (
+        PVE::ProcFSTools::read_cpuinfo->{vendor} eq 'GenuineIntel'
+        && $winversion >= 11
+        && $version_guard->(11, 0, 2)
+    ) {
+        $flagfn->('hv_evmcs', undef, $default_reason . " for Windows 11 on Intel host");
+    }
+
     return $flags;
 }
 
diff --git a/src/PVE/QemuServer/Machine.pm b/src/PVE/QemuServer/Machine.pm
index 37b272c6..35161d1f 100644
--- a/src/PVE/QemuServer/Machine.pm
+++ b/src/PVE/QemuServer/Machine.pm
@@ -44,9 +44,10 @@ our $PVE_MACHINE_VERSION = {
         },
     },
     '11.0' => {
-        highest => 1,
+        highest => 2,
         revisions => {
             '+pve1' => 'Use host_tunnel=off by default for VirtIO NICs.',
+            '+pve2' => 'Enable hv_emcs for Windows 11/2022/2025 to mitigate issues with VBS.',
         },
     },
 };
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
new file mode 100644
index 00000000..f71e37dd
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
@@ -0,0 +1,4 @@
+# TEST: Simple test for Windows 11 VM with host CPU and machine version 11.0+pve2
+cpu: host
+machine: pc-q35-11.0+pve2
+ostype: win11
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
new file mode 100644
index 00000000..b1949836
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
@@ -0,0 +1,26 @@
+/usr/bin/kvm \
+  -id 8006 \
+  -name vm8006 \
+  -no-shutdown \
+  -chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
+  -mon 'chardev=qmp,mode=control' \
+  -chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
+  -mon 'chardev=qmp-event,mode=control' \
+  -pidfile /var/run/qemu-server/8006.pid \
+  -daemonize \
+  -smp '1,sockets=1,cores=1,maxcpus=1' \
+  -nodefaults \
+  -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
+  -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
+  -global 'kvm-pit.lost_tick_policy=discard' \
+  -cpu 'host,-cet-ibt,-cet-ss,hv_evmcs,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt' \
+  -m 512 \
+  -global 'ICH9-LPC.disable_s3=1' \
+  -global 'ICH9-LPC.disable_s4=1' \
+  -readconfig /usr/share/qemu-server/pve-q35-4.0.cfg \
+  -device 'usb-tablet,id=tablet,bus=ehci.0,port=1' \
+  -device 'VGA,id=vga,bus=pcie.0,addr=0x1,edid=off' \
+  -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on' \
+  -iscsi 'initiator-name=iqn.1993-08.org.debian:01:aabbccddeeff' \
+  -rtc 'driftfix=slew,base=localtime' \
+  -machine 'hpet=off,type=pc-q35-11.0+pve2'
diff --git a/src/test/run_config2command_tests.pl b/src/test/run_config2command_tests.pl
index 5c3034ab..a8eebc12 100755
--- a/src/test/run_config2command_tests.pl
+++ b/src/test/run_config2command_tests.pl
@@ -244,6 +244,15 @@ sub get_test_qemu_version {
     $current_test->{qemu_version} // $base_env->{real_qemu_version} // '2.12';
 }
 
+my $procfs_tools_module = Test::MockModule->new('PVE::ProcFSTools');
+$procfs_tools_module->mock(
+    read_cpuinfo => sub {
+        my $res = $procfs_tools_module->original('read_cpuinfo')->();
+        $res->{vendor} = 'GenuineIntel';
+        return $res;
+    },
+);
+
 my $qemu_server_module;
 $qemu_server_module = Test::MockModule->new('PVE::QemuServer');
 $qemu_server_module->mock(
-- 
2.47.3

[PATCH qemu-server v3 4/4] test: cfg2cmd: allow setting host CPU vendor for a given test

[Fiona Ebner]

The host CPU vendor defaults to GenuineIntel for test stability, but
it can be useful to also test for other vendors. Allow overriding the
vendor in a test using a new HOST_CPU_VENDOR property.

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

New in v3.

 .../cfg2cmd/win11-amd-host-11.0+pve2.conf     |  5 ++++
 .../cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd | 26 +++++++++++++++++++
 src/test/run_config2command_tests.pl          | 10 ++++++-
 3 files changed, 40 insertions(+), 1 deletion(-)
 create mode 100644 src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf
 create mode 100644 src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd

diff --git a/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf b/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf
new file mode 100644
index 00000000..5624d2de
--- /dev/null
+++ b/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf
@@ -0,0 +1,5 @@
+# TEST: Simple test for Windows 11 VM with AMD host CPU and machine version 11.0+pve2
+# HOST_CPU_VENDOR: AuthenticAMD
+cpu: host
+machine: pc-q35-11.0+pve2
+ostype: win11
diff --git a/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd
new file mode 100644
index 00000000..c2b6657f
--- /dev/null
+++ b/src/test/cfg2cmd/win11-amd-host-11.0+pve2.conf.cmd
@@ -0,0 +1,26 @@
+/usr/bin/kvm \
+  -id 8006 \
+  -name vm8006 \
+  -no-shutdown \
+  -chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
+  -mon 'chardev=qmp,mode=control' \
+  -chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
+  -mon 'chardev=qmp-event,mode=control' \
+  -pidfile /var/run/qemu-server/8006.pid \
+  -daemonize \
+  -smp '1,sockets=1,cores=1,maxcpus=1' \
+  -nodefaults \
+  -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
+  -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
+  -global 'kvm-pit.lost_tick_policy=discard' \
+  -cpu 'host,-cet-ibt,-cet-ss,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt' \
+  -m 512 \
+  -global 'ICH9-LPC.disable_s3=1' \
+  -global 'ICH9-LPC.disable_s4=1' \
+  -readconfig /usr/share/qemu-server/pve-q35-4.0.cfg \
+  -device 'usb-tablet,id=tablet,bus=ehci.0,port=1' \
+  -device 'VGA,id=vga,bus=pcie.0,addr=0x1,edid=off' \
+  -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on' \
+  -iscsi 'initiator-name=iqn.1993-08.org.debian:01:aabbccddeeff' \
+  -rtc 'driftfix=slew,base=localtime' \
+  -machine 'hpet=off,type=pc-q35-11.0+pve0'
diff --git a/src/test/run_config2command_tests.pl b/src/test/run_config2command_tests.pl
index a8eebc12..47250c67 100755
--- a/src/test/run_config2command_tests.pl
+++ b/src/test/run_config2command_tests.pl
@@ -184,6 +184,7 @@ my $current_test; # = {
 #   description => 'Test description', # if available
 #   qemu_version => '2.12',
 #   host_arch => 'HOST_ARCH',
+#   'host-cpu-vendor' => 'HOST_CPU_VENDOR',
 #   expected_error => 'error message',
 #   expected_warning => 'warning message',
 #   config => { config hash },
@@ -194,6 +195,7 @@ my $current_test; # = {
 #   TEST: A single line describing the test, gets outputted
 #   QEMU_VERSION: \d+\.\d+(\.\d+)? (defaults to current version)
 #   HOST_ARCH: x86_64 | aarch64 (default to x86_64, to make tests stable)
+#   HOST_CPU_VENDOR: AuthenticAMD | GenuineIntel | etc. (defaults to GenuineIntel)
 #   EXPECT_ERROR: <error message> For negative tests
 #   EXPECT_WARN(ING): <warning message> that is expected
 #   HW_CAPABILITIES: <cpu-type-or-json-string> to defined the HW caps the test should expose
@@ -209,6 +211,8 @@ sub parse_test($config_fn) {
 
     my $description = $config->{description} // '';
 
+    $current_test->{'host-cpu-vendor'} = 'GenuineIntel';
+
     while ($description =~ /^\h*(.*?)\h*$/gm) {
         my $line = $1;
         next if !$line || $line =~ /^#/;
@@ -221,6 +225,8 @@ sub parse_test($config_fn) {
             $current_test->{qemu_version} = "$1";
         } elsif ($line =~ /^HOST_ARCH:\s*(.*)\s*$/) {
             $current_test->{host_arch} = "$1";
+        } elsif ($line =~ /^HOST_CPU_VENDOR:\s*(.*)\s*$/) {
+            $current_test->{'host-cpu-vendor'} = "$1";
         } elsif ($line =~ /^EXPECT_ERROR:\s*(.*)\s*$/) {
             $current_test->{expect_error} = "$1";
         } elsif ($line =~ /^EXPECT_WARN(?:ING)?:\s*(.*)\s*$/) {
@@ -248,7 +254,9 @@ my $procfs_tools_module = Test::MockModule->new('PVE::ProcFSTools');
 $procfs_tools_module->mock(
     read_cpuinfo => sub {
         my $res = $procfs_tools_module->original('read_cpuinfo')->();
-        $res->{vendor} = 'GenuineIntel';
+        my $vendor = $current_test->{'host-cpu-vendor'}
+            or die "internal error - host cpu vendor not set";
+        $res->{vendor} = $vendor;
         return $res;
     },
 );
-- 
2.47.3

Re: [PATCH-SERIES qemu-server v3 0/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS

[Maximiliano Sandoval]

Fiona Ebner <f.ebner@proxmox.com> writes:

> Changes in v3:
> * Improve commit message in patch 1.
> * Different approach, enable recommended hv-evmcs flag instead of
>   disabling apicv flags.
> * Mock host CPU vendor in tests.
>
> Changes in v2:
> * Disable MBEC by default for machine versions < 11.0 for backwards
>   compat with older kernel and QEMU.
>
> As reported in the community forum [0] and enterprise support, Windows
> with MBEC and VBS can have issues on certain Intel CPUs, leading to
> guest freezes and 100% CPU usage. The detection/enabling of APICv
> support in Windows was determined to be related. With hv_emcs, that
> feature is not used in Windows anymore. The flag is also recommended
> in the QEMU documentation [1], so start using it with a bumped
> 11.0+pve2 machine version.
>
> [0]: https://forum.proxmox.com/threads/184178
> [1]: https://www.qemu.org/docs/master/system/i386/hyperv.html#recommendations
>
> [..]

I tested this direction on my host with a AMD CPU as a smoke test and
updated the machine version from three Windows VMs from 10.1 to
11.0+pve2 (two were using i440fx and the third q35) from the web UI and
the VMs boot as expected. The windows versions were 2019, 2016, and
2022. I also tried with a Linux VM.

The code looks OK to me.

Tested-by: Maximiliano Sandoval <m.sandoval@proxmox.com>
Reviewed-by: Maximiliano Sandoval <m.sandoval@proxmox.com>

-- 
Maximiliano

Re: [PATCH-SERIES qemu-server v3 0/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS

[Jonas Theisen]

On 7/14/26 12:41, Fiona Ebner wrote:
> Changes in v3:
> * Improve commit message in patch 1.
> * Different approach, enable recommended hv-evmcs flag instead of
>    disabling apicv flags.
> * Mock host CPU vendor in tests.
>
> Changes in v2:
> * Disable MBEC by default for machine versions < 11.0 for backwards
>    compat with older kernel and QEMU.
>
> As reported in the community forum [0] and enterprise support, Windows
> with MBEC and VBS can have issues on certain Intel CPUs, leading to
> guest freezes and 100% CPU usage. The detection/enabling of APICv
> support in Windows was determined to be related. With hv_emcs, that
> feature is not used in Windows anymore. The flag is also recommended
> in the QEMU documentation [1], so start using it with a bumped
> 11.0+pve2 machine version.
>
> [0]: https://forum.proxmox.com/threads/184178
> [1]: https://www.qemu.org/docs/master/system/i386/hyperv.html#recommendations
>
> [...]

Tested the patch on an affected Intel machine with q35 Windows Server 
2025 VMs.

Bumping the machine version to 11.0-pve2 fixes the issue while the 
previously available 11.0-pve1 stays unchanged.

Tested-by: Jonas Theisen <j.theisen@proxmox.com>

applied: [PATCH-SERIES qemu-server v3 0/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS

[Thomas Lamprecht]

On Tue, 14 Jul 2026 12:41:47 +0200, Fiona Ebner wrote:
> Changes in v3:
> * Improve commit message in patch 1.
> * Different approach, enable recommended hv-evmcs flag instead of
>   disabling apicv flags.
> * Mock host CPU vendor in tests.
> 
> Changes in v2:
> * Disable MBEC by default for machine versions < 11.0 for backwards
>   compat with older kernel and QEMU.
> 
> [...]

Applied, thanks!

[1/4] cpu config: disable vmx-mbec flag for machine versions < 11.0
      https://git.proxmox.com/?p=qemu-server.git;a=commitdiff;h=20f60d315f25204302b682d6cc6c4b14768cd1da
[2/4] cpu config: use $version_guard rather than passing $machine_version
      https://git.proxmox.com/?p=qemu-server.git;a=commitdiff;h=55f766ee198dff07cdbcf4b922e1971c60712015
[3/4] cpu config: enable hv-evmcs for Windows 11/2022/2025 to mitigate issues with VBS
      https://git.proxmox.com/?p=qemu-server.git;a=commitdiff;h=30531026d3ccce7f531b19f0cb0ff2c762976bb5
[4/4] test: cfg2cmd: allow setting host CPU vendor for a given test
      https://git.proxmox.com/?p=qemu-server.git;a=commitdiff;h=17a256e53d713e9b21be2cc371bb3d751c36ed1e