Re: [PATCH-SERIES qemu-server 0/2] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS

[Fiona Ebner <f.ebner@proxmox.com>]

Am 09.07.26 um 3:42 PM schrieb Fiona Ebner:
> As reported in the community forum [0] and enterprise support, Windows
> with MBEC and VBS can have issues on certain Intel CPUs, leading to
> guest freezes and 100% CPU usage. The detection/enabling of APICv
> support in Windows was determined to be related. Disabling
> vmx-apicv-vid and/or vmx-apicv-register mitigates the issue. Disable
> both flags starting with a bumped 11.0+pve2 machine version for
> consistency.
> 
> [0]: https://forum.proxmox.com/threads/184178
> 
> 
> What still would be nice to check is if the issue also happens with a
> non-host model with nested-virt/vmx present. Otherwise we might want
> to restrict removing the flags to the host model.

I guess it doesn't really matter. Even if it doesn't trigger for a
specific combination, it might trigger for a different one. Note that
vmx-mbec also needs to be enabled for current virtual models (but QEMU
master has added new versions for many models to enabled it).

What would be nicer is to only remove the flags if vmx-mbec is present.
I looked into creating the dump of CPU model expansion during QEMU build
and shipping it, but the expansion is actually not static for a given
model, because many flags are gated behind other flags, so the expansion
for e.g. Skylake-Server is different than the one for
Skylake-Server,+vmx. Also, the file would be rather large with ~1.65 MiB.

What we could do instead, is have a systemd service for the pve-qemu-kvm
package which starts a dummy VM just for QMP querying. Having the
expansions would also make it possible to be more precise with the
phys-bits check which depends on pdp1gbe and for the custom CPU model
editor to show what the default values for a given model+flags actually are.

Should I look into that or should we disable the apicv flags without
trying to detect mbec?