* [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0
2026-07-13 12:40 [PATCH-SERIES qemu-server v2 0/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
@ 2026-07-13 12:40 ` Fiona Ebner
2026-07-13 12:46 ` Friedrich Weber
2026-07-13 12:40 ` [PATCH qemu-server v2 2/3] cpu config: use $version_guard rather than passing $machine_version Fiona Ebner
` (2 subsequent siblings)
3 siblings, 1 reply; 7+ messages in thread
From: Fiona Ebner @ 2026-07-13 12:40 UTC (permalink / raw)
To: pve-devel
As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
automatically be enabled if both QEMU (since 11.0) and the kernel
(since 7.0.0-3-pve) support it, but this is incorrect from a machine
version perspective, since the flag was enabled before. While there
were no reports about this causing migration issues in practice, this
cannot be ruled out and it's better to preserve the behavior for
previous machine versions. In particular, existing VMs won't suddenly
be affected by the aforementioned issue after VBS is enabled.
[0]: https://forum.proxmox.com/threads/184178
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
New in v2.
src/PVE/QemuServer/CPUConfig.pm | 12 ++++++++++++
src/test/cfg2cmd/cpu-level.conf.cmd | 2 +-
2 files changed, 13 insertions(+), 1 deletion(-)
diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index df3e2b92..5b243000 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags(
};
}
+ if (
+ $arch eq 'x86_64'
+ && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
+ && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
+ && !min_version($machine_version, 11, 0)
+ ) {
+ $pve_flags->{'vmx-mbec'} = {
+ op => '-',
+ reason => "$pve_msg for backwards compatibility with older kernel and QEMU",
+ };
+ }
+
return $pve_flags;
}
diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd
index d276a6de..5d5f760d 100644
--- a/src/test/cfg2cmd/cpu-level.conf.cmd
+++ b/src/test/cfg2cmd/cpu-level.conf.cmd
@@ -13,7 +13,7 @@
-boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
-vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
-global 'kvm-pit.lost_tick_policy=discard' \
- -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \
+ -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \
-m 768 \
-device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \
-device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* Re: [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0
2026-07-13 12:40 ` [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0 Fiona Ebner
@ 2026-07-13 12:46 ` Friedrich Weber
2026-07-13 12:48 ` Fiona Ebner
0 siblings, 1 reply; 7+ messages in thread
From: Friedrich Weber @ 2026-07-13 12:46 UTC (permalink / raw)
To: Fiona Ebner, pve-devel
Thanks for looking into this!
On 13/07/2026 14:40, Fiona Ebner wrote:
> As reported in the community forum [0] and enterprise support, Windows
> with MBEC and VBS can have issues on certain Intel CPUs, leading to
> guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
> automatically be enabled if both QEMU (since 11.0) and the kernel
> (since 7.0.0-3-pve) support it, but this is incorrect from a machine
> version perspective, since the flag was enabled before. While there
Should this be "since the flag *not* enabled before"?
> were no reports about this causing migration issues in practice, this
> cannot be ruled out and it's better to preserve the behavior for
> previous machine versions. In particular, existing VMs won't suddenly
> be affected by the aforementioned issue after VBS is enabled.
>
> [0]: https://forum.proxmox.com/threads/184178
>
> Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
> ---
>
> New in v2.
>
> src/PVE/QemuServer/CPUConfig.pm | 12 ++++++++++++
> src/test/cfg2cmd/cpu-level.conf.cmd | 2 +-
> 2 files changed, 13 insertions(+), 1 deletion(-)
>
> diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
> index df3e2b92..5b243000 100644
> --- a/src/PVE/QemuServer/CPUConfig.pm
> +++ b/src/PVE/QemuServer/CPUConfig.pm
> @@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags(
> };
> }
>
> + if (
> + $arch eq 'x86_64'
> + && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
> + && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
> + && !min_version($machine_version, 11, 0)
> + ) {
> + $pve_flags->{'vmx-mbec'} = {
> + op => '-',
> + reason => "$pve_msg for backwards compatibility with older kernel and QEMU",
> + };
> + }
> +
> return $pve_flags;
> }
>
> diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd
> index d276a6de..5d5f760d 100644
> --- a/src/test/cfg2cmd/cpu-level.conf.cmd
> +++ b/src/test/cfg2cmd/cpu-level.conf.cmd
> @@ -13,7 +13,7 @@
> -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
> -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
> -global 'kvm-pit.lost_tick_policy=discard' \
> - -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \
> + -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \
> -m 768 \
> -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \
> -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \
^ permalink raw reply [flat|nested] 7+ messages in thread* Re: [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0
2026-07-13 12:46 ` Friedrich Weber
@ 2026-07-13 12:48 ` Fiona Ebner
0 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2026-07-13 12:48 UTC (permalink / raw)
To: Friedrich Weber, pve-devel
Am 13.07.26 um 2:46 PM schrieb Friedrich Weber:
> On 13/07/2026 14:40, Fiona Ebner wrote:
>> As reported in the community forum [0] and enterprise support, Windows
>> with MBEC and VBS can have issues on certain Intel CPUs, leading to
>> guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
>> automatically be enabled if both QEMU (since 11.0) and the kernel
>> (since 7.0.0-3-pve) support it, but this is incorrect from a machine
>> version perspective, since the flag was enabled before. While there
>
> Should this be "since the flag *not* enabled before"?
Yes, good catch! Maybe even "the feature was not available before",
since the flag did not even exist yet.
^ permalink raw reply [flat|nested] 7+ messages in thread
* [PATCH qemu-server v2 2/3] cpu config: use $version_guard rather than passing $machine_version
2026-07-13 12:40 [PATCH-SERIES qemu-server v2 0/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
2026-07-13 12:40 ` [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0 Fiona Ebner
@ 2026-07-13 12:40 ` Fiona Ebner
2026-07-13 12:40 ` [PATCH qemu-server v2 3/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
2026-07-15 8:21 ` superseded: [PATCH-SERIES qemu-server v2 0/3] " Fiona Ebner
3 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2026-07-13 12:40 UTC (permalink / raw)
To: pve-devel
No functional change intended. This is in preparation for commit "cpu
config: disable APICv for Windows 11/2022/2025 to mitigate issues with
VBS" so that the 11.0+pve2 version is correctly used.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
Changes in v2:
* Adapt new hunk from previous patch.
src/PVE/QemuServer.pm | 2 +-
src/PVE/QemuServer/CPUConfig.pm | 22 +++++++++++-----------
2 files changed, 12 insertions(+), 12 deletions(-)
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 59a37098..191ae549 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -3418,7 +3418,7 @@ sub config_to_command {
$arch,
$kvm,
$kvm_off,
- $machine_version,
+ $version_guard,
$winversion,
$gpu_passthrough,
$kvmver,
diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index 5b243000..c322cebc 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -862,7 +862,7 @@ my sub check_phys_bits_above_40_compat($bios, $cpu_type, $cpu_flags) {
# Calculate QEMU's '-cpu' argument from a given VM configuration
sub get_cpu_options(
- $conf, $arch, $kvm, $kvm_off, $machine_version, $winversion, $gpu_passthrough,
+ $conf, $arch, $kvm, $kvm_off, $version_guard, $winversion, $gpu_passthrough,
$qemu_binary_version,
) {
@@ -902,14 +902,14 @@ sub get_cpu_options(
if !defined(get_cpu_models_by_arch($arch)->{$cputype});
my $pve_flags = get_pve_cpu_flags(
- $conf, $kvm, $cputype, $arch, $machine_version, $winversion, $qemu_binary_version,
+ $conf, $kvm, $cputype, $arch, $version_guard, $winversion, $qemu_binary_version,
);
my $hv_flags;
if ($kvm && $arch eq 'x86_64') {
$hv_flags = get_hyperv_enlightenments(
$winversion,
- $machine_version,
+ $version_guard,
$conf->{bios},
$gpu_passthrough,
$hv_vendor_id,
@@ -999,7 +999,7 @@ sub get_cpu_options(
# Some hardcoded flags required by certain configurations
sub get_pve_cpu_flags(
- $conf, $kvm, $cputype, $arch, $machine_version, $winversion, $qemu_binary_version,
+ $conf, $kvm, $cputype, $arch, $version_guard, $winversion, $qemu_binary_version,
) {
my $pve_flags = {};
@@ -1033,7 +1033,7 @@ sub get_pve_cpu_flags(
};
}
- if (min_version($machine_version, 2, 3) && $kvm && $arch eq 'x86_64') {
+ if ($version_guard->(2, 3) && $kvm && $arch eq 'x86_64') {
$pve_flags->{'kvm_pv_unhalt'} = {
op => '+',
reason => "$pve_msg to improve Linux guest spinlock performance",
@@ -1059,7 +1059,7 @@ sub get_pve_cpu_flags(
$arch eq 'x86_64'
&& min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
&& $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
- && !min_version($machine_version, 11, 0)
+ && !$version_guard->(11, 0)
) {
$pve_flags->{'vmx-mbec'} = {
op => '-',
@@ -1071,7 +1071,7 @@ sub get_pve_cpu_flags(
}
sub get_hyperv_enlightenments(
- $winversion, $machine_version, $bios, $gpu_passthrough, $hv_vendor_id = undef,
+ $winversion, $version_guard, $bios, $gpu_passthrough, $hv_vendor_id = undef,
) {
return if $winversion < 6;
@@ -1099,7 +1099,7 @@ sub get_hyperv_enlightenments(
);
}
- if (min_version($machine_version, 2, 3)) {
+ if ($version_guard->(2, 3)) {
$flagfn->('hv_spinlocks', '0x1fff');
$flagfn->('hv_vapic');
$flagfn->('hv_time');
@@ -1107,7 +1107,7 @@ sub get_hyperv_enlightenments(
$flagfn->('hv_spinlocks', '0xffff');
}
- if (min_version($machine_version, 2, 6)) {
+ if ($version_guard->(2, 6)) {
$flagfn->('hv_reset');
$flagfn->('hv_vpindex');
$flagfn->('hv_runtime');
@@ -1117,12 +1117,12 @@ sub get_hyperv_enlightenments(
my $win7_reason = $default_reason . " 7 and higher";
$flagfn->('hv_relaxed', undef, $win7_reason);
- if (min_version($machine_version, 2, 12)) {
+ if ($version_guard->(2, 12)) {
$flagfn->('hv_synic', undef, $win7_reason);
$flagfn->('hv_stimer', undef, $win7_reason);
}
- if (min_version($machine_version, 3, 1)) {
+ if ($version_guard->(3, 1)) {
$flagfn->('hv_ipi', undef, $win7_reason);
}
}
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* [PATCH qemu-server v2 3/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS
2026-07-13 12:40 [PATCH-SERIES qemu-server v2 0/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
2026-07-13 12:40 ` [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0 Fiona Ebner
2026-07-13 12:40 ` [PATCH qemu-server v2 2/3] cpu config: use $version_guard rather than passing $machine_version Fiona Ebner
@ 2026-07-13 12:40 ` Fiona Ebner
2026-07-15 8:21 ` superseded: [PATCH-SERIES qemu-server v2 0/3] " Fiona Ebner
3 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2026-07-13 12:40 UTC (permalink / raw)
To: pve-devel
As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. The detection/enabling of APICv
support in Windows was determined to be related. Disabling
vmx-apicv-vid and/or vmx-apicv-register mitigates the issue. Disable
both flags starting with a bumped 11.0+pve2 machine version for
consistency.
[0]: https://forum.proxmox.com/threads/184178
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
Changes in v2:
* Extend comment to mention why the check is not restricted to the
'host' model.
src/PVE/QemuServer/CPUConfig.pm | 14 ++++++++++
src/PVE/QemuServer/Machine.pm | 3 ++-
src/test/cfg2cmd/win11-host-11.0+pve2.conf | 4 +++
.../cfg2cmd/win11-host-11.0+pve2.conf.cmd | 26 +++++++++++++++++++
4 files changed, 46 insertions(+), 1 deletion(-)
create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf
create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index c322cebc..30d477f7 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1067,6 +1067,20 @@ sub get_pve_cpu_flags(
};
}
+ # Note that this is only relevant for Intel CPUs if nested-virt/vmx is enabled. Otherwise, the
+ # flags are already disabled. Note that newer QEMU CPU models do come with MBEC enabled, so the
+ # model is not restricted to 'host' here.
+ if ($arch eq 'x86_64' && $winversion >= 11 && $version_guard->(11, 0, 2)) {
+ $pve_flags->{'vmx-apicv-register'} = {
+ op => '-',
+ reason => "$pve_msg to avoid issues with certain Windows configurations like VBS",
+ };
+ $pve_flags->{'vmx-apicv-vid'} = {
+ op => '-',
+ reason => "$pve_msg to avoid issues with certain Windows configurations like VBS",
+ };
+ }
+
return $pve_flags;
}
diff --git a/src/PVE/QemuServer/Machine.pm b/src/PVE/QemuServer/Machine.pm
index 37b272c6..04e63f56 100644
--- a/src/PVE/QemuServer/Machine.pm
+++ b/src/PVE/QemuServer/Machine.pm
@@ -44,9 +44,10 @@ our $PVE_MACHINE_VERSION = {
},
},
'11.0' => {
- highest => 1,
+ highest => 2,
revisions => {
'+pve1' => 'Use host_tunnel=off by default for VirtIO NICs.',
+ '+pve2' => 'Disable APICv for Windows 11/2022/2025 to mitigate issues with VBS.',
},
},
};
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
new file mode 100644
index 00000000..f71e37dd
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
@@ -0,0 +1,4 @@
+# TEST: Simple test for Windows 11 VM with host CPU and machine version 11.0+pve2
+cpu: host
+machine: pc-q35-11.0+pve2
+ostype: win11
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
new file mode 100644
index 00000000..a17d6ffd
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
@@ -0,0 +1,26 @@
+/usr/bin/kvm \
+ -id 8006 \
+ -name vm8006 \
+ -no-shutdown \
+ -chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
+ -mon 'chardev=qmp,mode=control' \
+ -chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
+ -mon 'chardev=qmp-event,mode=control' \
+ -pidfile /var/run/qemu-server/8006.pid \
+ -daemonize \
+ -smp '1,sockets=1,cores=1,maxcpus=1' \
+ -nodefaults \
+ -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
+ -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
+ -global 'kvm-pit.lost_tick_policy=discard' \
+ -cpu 'host,-cet-ibt,-cet-ss,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,-vmx-apicv-register,-vmx-apicv-vid' \
+ -m 512 \
+ -global 'ICH9-LPC.disable_s3=1' \
+ -global 'ICH9-LPC.disable_s4=1' \
+ -readconfig /usr/share/qemu-server/pve-q35-4.0.cfg \
+ -device 'usb-tablet,id=tablet,bus=ehci.0,port=1' \
+ -device 'VGA,id=vga,bus=pcie.0,addr=0x1,edid=off' \
+ -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on' \
+ -iscsi 'initiator-name=iqn.1993-08.org.debian:01:aabbccddeeff' \
+ -rtc 'driftfix=slew,base=localtime' \
+ -machine 'hpet=off,type=pc-q35-11.0+pve2'
--
2.47.3
^ permalink raw reply related [flat|nested] 7+ messages in thread* superseded: [PATCH-SERIES qemu-server v2 0/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS
2026-07-13 12:40 [PATCH-SERIES qemu-server v2 0/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
` (2 preceding siblings ...)
2026-07-13 12:40 ` [PATCH qemu-server v2 3/3] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
@ 2026-07-15 8:21 ` Fiona Ebner
3 siblings, 0 replies; 7+ messages in thread
From: Fiona Ebner @ 2026-07-15 8:21 UTC (permalink / raw)
To: pve-devel
superseded-by:
https://lore.proxmox.com/pve-devel/20260714104201.71308-1-f.ebner@proxmox.com/T/
^ permalink raw reply [flat|nested] 7+ messages in thread