nVMX: Windows 11 with nested Hyper-V fails to boot when MBEC is exposed to L1 (7.2)

[Panayotis Katsaloulis <panayotis@panayotis.com>]

Hi,

After updating the host from 7.1.13 to 7.2.9, a Windows 11 guest that
runs its own hypervisor (VBS / Hyper-V, hypervisorlaunchtype Auto) no
longer boots. It fails very early (no bugcheck, no minidump, bootstat
not updated) and ends in Automatic Repair ("Your device ran into a
problem and couldn't be repaired"). Startup Repair reports no root
cause.

Hiding MBEC from the guest is enough to make it boot again:

   -cpu host,migratable=on,vmx=on,vmx-mbec=off,hv-...

Host:
   CPU:      Intel Core i9-13900 (Raptor Lake)
   Kernel:   7.2.9 (distro kernel, Manjaro), kvm_intel nested=Y, mbec=Y
   QEMU:     11.1.2 (also reproduced with 11.1.1)
   libvirt:  12.8.0
   OVMF:     edk2 202608, Secure Boot, swtpm 0.10.2 (TPM 2.0, CRB)
   Machine:  pc-q35-9.2

Guest:
   Windows 11 24H2 (build 26100), UEFI + Secure Boot, VBS enabled,
   hypervisorlaunchtype Auto, 8 GiB, host-passthrough CPU.
   Hyper-V enlightenments: relaxed, vapic, spinlocks, vpindex, runtime,
   synic, stimer, frequencies, tlbflush, ipi, evmcs, avic, hypervclock.

Results (host kernel 7.2.9 in all cases):

   vmx  vmx-mbec  hv-evmcs  QEMU    result
   on   default   on        11.1.2  fails (Automatic Repair)
   off  n/a       on        11.1.2  boots
   on   default   on        11.1.1  fails
   on   off       on        11.1.1  boots
   on   default   off       11.1.1  fails

The same guest, with an identical QEMU command line (compared from the
libvirt log; only fds/ids differ), last booted fine on 2026-10-23 on
7.1.13 with QEMU 11.1.1. So disabling eVMCS does not help, and QEMU
and libvirt do not seem to be involved; the only difference that
matters is whether MBEC is offered to L1.

What I could not test:
   - 7.1.x with the exact same setup again (no longer installable here)
   - latest 7.2.y / 7.3.y
   - kvm_intel.mbec=0 (I expect it to behave like vmx-mbec=off)

Someone else reports the same symptom (7.1.8 works, 7.2.x fails,
Windows 11 26100 with nested Hyper-V), without a root cause:
https://discuss.cachyos.org/t/windows-11-kvm-guest-with-nested-hyper-v-boot-loops-on-linux-cachyos-7-2-x-works-on-7-1-8/36134

I can test patches or collect traces if that helps.

Thanks,
Panayotis