* [PATCH qemu-server 1/2] cpu config: use $version_guard rather than passing $machine_version
2026-07-09 13:41 [PATCH-SERIES qemu-server 0/2] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
@ 2026-07-09 13:42 ` Fiona Ebner
2026-07-09 13:42 ` [PATCH qemu-server 2/2] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
1 sibling, 0 replies; 3+ messages in thread
From: Fiona Ebner @ 2026-07-09 13:42 UTC (permalink / raw)
To: pve-devel
No functional change intended. This is in preparation for commit "cpu
config: disable APICv for Windows 11/2022/2025 to mitigate issues with
VBS" so that the 11.0+pve2 version is correctly used.
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/QemuServer.pm | 2 +-
src/PVE/QemuServer/CPUConfig.pm | 20 ++++++++++----------
2 files changed, 11 insertions(+), 11 deletions(-)
diff --git a/src/PVE/QemuServer.pm b/src/PVE/QemuServer.pm
index 59a37098..191ae549 100644
--- a/src/PVE/QemuServer.pm
+++ b/src/PVE/QemuServer.pm
@@ -3418,7 +3418,7 @@ sub config_to_command {
$arch,
$kvm,
$kvm_off,
- $machine_version,
+ $version_guard,
$winversion,
$gpu_passthrough,
$kvmver,
diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index df3e2b92..4f409528 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -862,7 +862,7 @@ my sub check_phys_bits_above_40_compat($bios, $cpu_type, $cpu_flags) {
# Calculate QEMU's '-cpu' argument from a given VM configuration
sub get_cpu_options(
- $conf, $arch, $kvm, $kvm_off, $machine_version, $winversion, $gpu_passthrough,
+ $conf, $arch, $kvm, $kvm_off, $version_guard, $winversion, $gpu_passthrough,
$qemu_binary_version,
) {
@@ -902,14 +902,14 @@ sub get_cpu_options(
if !defined(get_cpu_models_by_arch($arch)->{$cputype});
my $pve_flags = get_pve_cpu_flags(
- $conf, $kvm, $cputype, $arch, $machine_version, $winversion, $qemu_binary_version,
+ $conf, $kvm, $cputype, $arch, $version_guard, $winversion, $qemu_binary_version,
);
my $hv_flags;
if ($kvm && $arch eq 'x86_64') {
$hv_flags = get_hyperv_enlightenments(
$winversion,
- $machine_version,
+ $version_guard,
$conf->{bios},
$gpu_passthrough,
$hv_vendor_id,
@@ -999,7 +999,7 @@ sub get_cpu_options(
# Some hardcoded flags required by certain configurations
sub get_pve_cpu_flags(
- $conf, $kvm, $cputype, $arch, $machine_version, $winversion, $qemu_binary_version,
+ $conf, $kvm, $cputype, $arch, $version_guard, $winversion, $qemu_binary_version,
) {
my $pve_flags = {};
@@ -1033,7 +1033,7 @@ sub get_pve_cpu_flags(
};
}
- if (min_version($machine_version, 2, 3) && $kvm && $arch eq 'x86_64') {
+ if ($version_guard->(2, 3) && $kvm && $arch eq 'x86_64') {
$pve_flags->{'kvm_pv_unhalt'} = {
op => '+',
reason => "$pve_msg to improve Linux guest spinlock performance",
@@ -1059,7 +1059,7 @@ sub get_pve_cpu_flags(
}
sub get_hyperv_enlightenments(
- $winversion, $machine_version, $bios, $gpu_passthrough, $hv_vendor_id = undef,
+ $winversion, $version_guard, $bios, $gpu_passthrough, $hv_vendor_id = undef,
) {
return if $winversion < 6;
@@ -1087,7 +1087,7 @@ sub get_hyperv_enlightenments(
);
}
- if (min_version($machine_version, 2, 3)) {
+ if ($version_guard->(2, 3)) {
$flagfn->('hv_spinlocks', '0x1fff');
$flagfn->('hv_vapic');
$flagfn->('hv_time');
@@ -1095,7 +1095,7 @@ sub get_hyperv_enlightenments(
$flagfn->('hv_spinlocks', '0xffff');
}
- if (min_version($machine_version, 2, 6)) {
+ if ($version_guard->(2, 6)) {
$flagfn->('hv_reset');
$flagfn->('hv_vpindex');
$flagfn->('hv_runtime');
@@ -1105,12 +1105,12 @@ sub get_hyperv_enlightenments(
my $win7_reason = $default_reason . " 7 and higher";
$flagfn->('hv_relaxed', undef, $win7_reason);
- if (min_version($machine_version, 2, 12)) {
+ if ($version_guard->(2, 12)) {
$flagfn->('hv_synic', undef, $win7_reason);
$flagfn->('hv_stimer', undef, $win7_reason);
}
- if (min_version($machine_version, 3, 1)) {
+ if ($version_guard->(3, 1)) {
$flagfn->('hv_ipi', undef, $win7_reason);
}
}
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread* [PATCH qemu-server 2/2] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS
2026-07-09 13:41 [PATCH-SERIES qemu-server 0/2] cpu config: disable APICv for Windows 11/2022/2025 to mitigate issues with VBS Fiona Ebner
2026-07-09 13:42 ` [PATCH qemu-server 1/2] cpu config: use $version_guard rather than passing $machine_version Fiona Ebner
@ 2026-07-09 13:42 ` Fiona Ebner
1 sibling, 0 replies; 3+ messages in thread
From: Fiona Ebner @ 2026-07-09 13:42 UTC (permalink / raw)
To: pve-devel
As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. The detection/enabling of APICv
support in Windows was determined to be related. Disabling
vmx-apicv-vid and/or vmx-apicv-register mitigates the issue. Disable
both flags starting with a bumped 11.0+pve2 machine version for
consistency.
[0]: https://forum.proxmox.com/threads/184178
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---
src/PVE/QemuServer/CPUConfig.pm | 13 ++++++++++
src/PVE/QemuServer/Machine.pm | 3 ++-
src/test/cfg2cmd/win11-host-11.0+pve2.conf | 4 +++
.../cfg2cmd/win11-host-11.0+pve2.conf.cmd | 26 +++++++++++++++++++
4 files changed, 45 insertions(+), 1 deletion(-)
create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf
create mode 100644 src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index 4f409528..65234489 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1055,6 +1055,19 @@ sub get_pve_cpu_flags(
};
}
+ # Note that this is only relevant for Intel CPUs if nested-virt/vmx is enabled. Otherwise, the
+ # flags are already disabled.
+ if ($arch eq 'x86_64' && $winversion >= 11 && $version_guard->(11, 0, 2)) {
+ $pve_flags->{'vmx-apicv-register'} = {
+ op => '-',
+ reason => "$pve_msg to avoid issues with certain Windows configurations like VBS",
+ };
+ $pve_flags->{'vmx-apicv-vid'} = {
+ op => '-',
+ reason => "$pve_msg to avoid issues with certain Windows configurations like VBS",
+ };
+ }
+
return $pve_flags;
}
diff --git a/src/PVE/QemuServer/Machine.pm b/src/PVE/QemuServer/Machine.pm
index 37b272c6..04e63f56 100644
--- a/src/PVE/QemuServer/Machine.pm
+++ b/src/PVE/QemuServer/Machine.pm
@@ -44,9 +44,10 @@ our $PVE_MACHINE_VERSION = {
},
},
'11.0' => {
- highest => 1,
+ highest => 2,
revisions => {
'+pve1' => 'Use host_tunnel=off by default for VirtIO NICs.',
+ '+pve2' => 'Disable APICv for Windows 11/2022/2025 to mitigate issues with VBS.',
},
},
};
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
new file mode 100644
index 00000000..f71e37dd
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf
@@ -0,0 +1,4 @@
+# TEST: Simple test for Windows 11 VM with host CPU and machine version 11.0+pve2
+cpu: host
+machine: pc-q35-11.0+pve2
+ostype: win11
diff --git a/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
new file mode 100644
index 00000000..a17d6ffd
--- /dev/null
+++ b/src/test/cfg2cmd/win11-host-11.0+pve2.conf.cmd
@@ -0,0 +1,26 @@
+/usr/bin/kvm \
+ -id 8006 \
+ -name vm8006 \
+ -no-shutdown \
+ -chardev 'socket,id=qmp,path=/var/run/qemu-server/8006.qmp,server=on,wait=off' \
+ -mon 'chardev=qmp,mode=control' \
+ -chardev 'socket,id=qmp-event,path=/var/run/qmeventd.sock,reconnect-ms=5000' \
+ -mon 'chardev=qmp-event,mode=control' \
+ -pidfile /var/run/qemu-server/8006.pid \
+ -daemonize \
+ -smp '1,sockets=1,cores=1,maxcpus=1' \
+ -nodefaults \
+ -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
+ -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
+ -global 'kvm-pit.lost_tick_policy=discard' \
+ -cpu 'host,-cet-ibt,-cet-ss,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,-vmx-apicv-register,-vmx-apicv-vid' \
+ -m 512 \
+ -global 'ICH9-LPC.disable_s3=1' \
+ -global 'ICH9-LPC.disable_s4=1' \
+ -readconfig /usr/share/qemu-server/pve-q35-4.0.cfg \
+ -device 'usb-tablet,id=tablet,bus=ehci.0,port=1' \
+ -device 'VGA,id=vga,bus=pcie.0,addr=0x1,edid=off' \
+ -device 'virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3,free-page-reporting=on' \
+ -iscsi 'initiator-name=iqn.1993-08.org.debian:01:aabbccddeeff' \
+ -rtc 'driftfix=slew,base=localtime' \
+ -machine 'hpet=off,type=pc-q35-11.0+pve2'
--
2.47.3
^ permalink raw reply related [flat|nested] 3+ messages in thread