Proxmox 7.1 cpu type host causing windows 11 to stuck on boot

[talha5389]

I am trying to setup proxmox to run windows vm that need to support nested virtualization and this is my first time using proxmox.

I have ssd with windows 11 pre-installed. I pass through it via proxmox, set cpu type to Host, then started vm. It stuck on boot, causing cpu to reach 100% utilization and then it automatically reset after 1-2 minute. I have verified that I can run it fine with other cpu type like QEMU but I can't use virtualization with those.

I thought that maybe there were some driver issues, so I disabled ssd passthrough and attached a virtual disk directly, installed windows 11. It booted fine but once I enabled hyper v and other virtualization features in windows and restarted, it also got stuck.

I have verified that nested virtualization is supported as below command outputted "1"

cat /sys/module/kvm_amd/parameters/nested

Another thing is that I tried to run pcie ssd passthrough few weeks ago with version 7 of proxmox and I am pretty sure that I got to windows login screen with CPU Type host in it. Although it was having some network issue due to which I didn't manage to login that time. I haven't tried running windows 10 so not sure currently if issue is just with Windows 11 or not

This is my vm config

bios: ovmf
boot: order=ide0
cores: 16
cpu: host
efidisk0: local-lvm:vm-102-disk-0,efitype=4m,pre-enrolled-keys=1,size=4M
ide0: local-lvm:vm-102-disk-3,backup=0,size=32G
ide2: local:iso/Win11_EnglishInternational_x64.iso,media=cdrom,size=5371302K
machine: pc-q35-6.1
memory: 8192
meta: creation-qemu=6.1.0,ctime=1637415648
net0: rtl8139=D2:78:14:86:90:A4,bridge=vmbr0,firewall=1
numa: 0
ostype: win11
scsihw: virtio-scsi-pci
smbios1: uuid=ab9039ca-5997-4ad0-b797-681261ef98eb
sockets: 1
tpmstate0: local-lvm:vm-102-disk-1,size=4M,version=v2.0
vga: vmware
vmgenid: d52b02fa-788a-4ce6-843f-f81c9ae57b34

Host
- Ryzen 5800X
- Asus 550M Plus

 

[gerby]

I'm seeing similar issues with Windows 10 guests; my physical hardware is an EPYC 7351 and guests fail to boot with `host` CPU type as of last week. Setting the CPU type to EPYC does allow them to boot. The guest has been static but I did update all packages last week and after a physical reboot the Win10 instances were no longer able to boot.

I removed all PCIE passthrough devices to no effect before restoring the original configuration and changing the CPU type so there's something that's gone wrong with the "host" type on my deployment. Given the above post I suspect something is up with the flags being passed through from host detection on AMD Zen varieties?

 

[spirit]

do you have tried with "max" cpu.

"host" cpu send a cpu flag to qemu, but sometimes some flags can't be supported by qemu.
"max" cpu is almost the same than host, but only send supported flags to qemu.

 

[gerby]

I haven't tried max but this installation and guest has been running fine on "host" since the box was built in 2018

 

[talha5389]

same behavior with cpu type "max"

 

[gerby]

I'm wondering if this is related to virtualization based security; it's on by default in Win11 and I've got my lab configured to use Credential Guard (a subset) as well.

 

[eminempt]

Any news about that? same problem here.

I have a windows 10 vm that when using KVM64 type CPU, all it's working fine, but when i go to "host" CPU type, it freezes right after logon into windows (my best guess would be some interference w/ Windows and ProxMox)

Whats interesting is that, i think that does not happen w/ a newly generated VM.
This particular VM im using now is booting directly from an SSD (it was my older Windows that was running on this Hardware) so, "Host type CPU" should not be a problem, since it recognizes this hardware (CPU) from before.

whats really odd is that w/ kvm64 it works but with host it doesn't.


My current spec is a Ryzen 5990x 16-core.

 

[gerby]

Do others here have secure boot enabled for your guests? Have you enabled "Core Isolation" or any of the other virtualization based security features in the guest?

 

[eminempt]

Hi @gerby , thanks for getting back.

How should i enable "Core Isolation"? I haven't, as far as i know

 

[joao0]

kernel 5.15 fixed this for me