From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [IPv6:2a0f:8001:1:32::40]) by lore.proxmox.com (Postfix) with ESMTPS id ACC0F1FF0E1 for ; Mon, 13 Jul 2026 14:40:39 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id AAD11213E7; Mon, 13 Jul 2026 14:40:32 +0200 (CEST) From: Fiona Ebner To: pve-devel@lists.proxmox.com Subject: [PATCH qemu-server v2 1/3] cpu config: disable vmx-mbec flag for machine versions < 11.0 Date: Mon, 13 Jul 2026 14:40:15 +0200 Message-ID: <20260713124025.121154-2-f.ebner@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260713124025.121154-1-f.ebner@proxmox.com> References: <20260713124025.121154-1-f.ebner@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Bm-Milter-Handled: 55990f41-d878-4baa-be0a-ee34c49e34d2 X-Bm-Transport-Timestamp: 1783946413370 X-SPAM-LEVEL: Spam detection results: 0 AWL 0.359 Adjusted score from AWL reputation of From: address DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment (newer systems) RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: JYV3XYGTPPAY4IOOOFNYKDFQKPU7EYPP X-Message-ID-Hash: JYV3XYGTPPAY4IOOOFNYKDFQKPU7EYPP X-MailFrom: f.ebner@proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: As reported in the community forum [0] and enterprise support, Windows with MBEC and VBS can have issues on certain Intel CPUs, leading to guest freezes and 100% CPU usage. Note that the vmx-mbec flag will automatically be enabled if both QEMU (since 11.0) and the kernel (since 7.0.0-3-pve) support it, but this is incorrect from a machine version perspective, since the flag was enabled before. While there were no reports about this causing migration issues in practice, this cannot be ruled out and it's better to preserve the behavior for previous machine versions. In particular, existing VMs won't suddenly be affected by the aforementioned issue after VBS is enabled. [0]: https://forum.proxmox.com/threads/184178 Signed-off-by: Fiona Ebner --- New in v2. src/PVE/QemuServer/CPUConfig.pm | 12 ++++++++++++ src/test/cfg2cmd/cpu-level.conf.cmd | 2 +- 2 files changed, 13 insertions(+), 1 deletion(-) diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm index df3e2b92..5b243000 100644 --- a/src/PVE/QemuServer/CPUConfig.pm +++ b/src/PVE/QemuServer/CPUConfig.pm @@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags( }; } + if ( + $arch eq 'x86_64' + && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0. + && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0. + && !min_version($machine_version, 11, 0) + ) { + $pve_flags->{'vmx-mbec'} = { + op => '-', + reason => "$pve_msg for backwards compatibility with older kernel and QEMU", + }; + } + return $pve_flags; } diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd index d276a6de..5d5f760d 100644 --- a/src/test/cfg2cmd/cpu-level.conf.cmd +++ b/src/test/cfg2cmd/cpu-level.conf.cmd @@ -13,7 +13,7 @@ -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \ -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \ -global 'kvm-pit.lost_tick_policy=discard' \ - -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \ + -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \ -m 768 \ -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \ -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \ -- 2.47.3