[PATCH qemu-server v3 1/4] cpu config: disable vmx-mbec flag for machine versions < 11.0

[Fiona Ebner <f.ebner@proxmox.com>]

As reported in the community forum [0] and enterprise support, Windows
with MBEC and VBS can have issues on certain Intel CPUs, leading to
guest freezes and 100% CPU usage. Note that the vmx-mbec flag will
automatically be enabled if both QEMU (since 11.0) and the kernel
(since 7.0.0-3-pve) support it, but this is incorrect from a machine
version perspective, since the feature was not available before. While
there were no reports about this causing migration issues in practice,
this cannot be ruled out and it's better to preserve the behavior for
previous machine versions. In particular, existing VMs won't suddenly
be affected by the aforementioned issue after VBS is enabled.

[0]: https://forum.proxmox.com/threads/184178

Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
---

Changes in v3:
* Improve commit message.

 src/PVE/QemuServer/CPUConfig.pm     | 12 ++++++++++++
 src/test/cfg2cmd/cpu-level.conf.cmd |  2 +-
 2 files changed, 13 insertions(+), 1 deletion(-)

diff --git a/src/PVE/QemuServer/CPUConfig.pm b/src/PVE/QemuServer/CPUConfig.pm
index df3e2b92..5b243000 100644
--- a/src/PVE/QemuServer/CPUConfig.pm
+++ b/src/PVE/QemuServer/CPUConfig.pm
@@ -1055,6 +1055,18 @@ sub get_pve_cpu_flags(
         };
     }
 
+    if (
+        $arch eq 'x86_64'
+        && min_version($qemu_binary_version, 11, 0) # The vmx-mbec flag got introduced in QEMU 11.0.
+        && $cputype eq 'host' # Other QEMU CPU models did not expose the vmx-mbec flag in 11.0.
+        && !min_version($machine_version, 11, 0)
+    ) {
+        $pve_flags->{'vmx-mbec'} = {
+            op => '-',
+            reason => "$pve_msg for backwards compatibility with older kernel and QEMU",
+        };
+    }
+
     return $pve_flags;
 }
 
diff --git a/src/test/cfg2cmd/cpu-level.conf.cmd b/src/test/cfg2cmd/cpu-level.conf.cmd
index d276a6de..5d5f760d 100644
--- a/src/test/cfg2cmd/cpu-level.conf.cmd
+++ b/src/test/cfg2cmd/cpu-level.conf.cmd
@@ -13,7 +13,7 @@
   -boot 'menu=on,strict=on,reboot-timeout=1000,splash=/usr/share/qemu-server/bootsplash.jpg' \
   -vnc 'unix:/var/run/qemu-server/8006.vnc,password=on' \
   -global 'kvm-pit.lost_tick_policy=discard' \
-  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb' \
+  -cpu 'host,level=30,-cet-ibt,-cet-ss,-hv-tlbflush,hv_ipi,hv_relaxed,hv_reset,hv_runtime,hv_spinlocks=0x1fff,hv_stimer,hv_synic,hv_time,hv_vapic,hv_vpindex,+kvm_pv_eoi,+kvm_pv_unhalt,+md-clear,+pdpe1gb,-vmx-mbec' \
   -m 768 \
   -device 'pci-bridge,id=pci.1,chassis_nr=1,bus=pci.0,addr=0x1e' \
   -device 'pci-bridge,id=pci.2,chassis_nr=2,bus=pci.0,addr=0x1f' \
-- 
2.47.3