From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [212.224.123.68]) by lore.proxmox.com (Postfix) with ESMTPS id 3D7D41FF138 for ; Mon, 01 Jun 2026 09:16:42 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id 7E23C104E0; Mon, 1 Jun 2026 09:16:37 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH v2 2/2] build: fail when recognized CPUID flags list changes Date: Mon, 1 Jun 2026 09:08:10 +0200 Message-ID: <20260601071633.442590-3-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260601071633.442590-1-a.bied-charreton@proxmox.com> References: <20260601071633.442590-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.265 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SCC_5_SHORT_WORD_LINES 0.25 5 lines with many short words SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record Message-ID-Hash: VYQJATRQAYXUKFTXM3FI6ACT7XCGC5QR X-Message-ID-Hash: VYQJATRQAYXUKFTXM3FI6ACT7XCGC5QR X-MailFrom: abied-charreton@jett.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Check in the current recognized CPUID flags list and fail the build if the list newly generated by parse-cpu-flags.pl differs from it. This forces new or removed flags to be manually reviewed instead of being silently picked up on QEMU bumps and mirrors the existing approach for CPU models. Suggested-by: Fiona Ebner Signed-off-by: Arthur Bied-Charreton --- debian/recognized-CPUID-flags-x86_64 | 430 +++++++++++++++++++++++++++ debian/rules | 4 + 2 files changed, 434 insertions(+) create mode 100644 debian/recognized-CPUID-flags-x86_64 diff --git a/debian/recognized-CPUID-flags-x86_64 b/debian/recognized-CPUID-flags-x86_64 new file mode 100644 index 0000000..0a0119f --- /dev/null +++ b/debian/recognized-CPUID-flags-x86_64 @@ -0,0 +1,430 @@ +3dnow +3dnowext +3dnowprefetch +abm +ace2 +ace2-en +acpi +adx +aes +amd-no-ssb +amd-psfd +amd-ssbd +amd-stibp +amx-avx512 +amx-bf16 +amx-bf16-alias +amx-complex +amx-complex-alias +amx-fp16 +amx-fp16-alias +amx-fp8 +amx-int8 +amx-int8-alias +amx-movrs +amx-tf32 +amx-tile +apic +apx-nci-ndd-nf +apxf +arat +arch-capabilities +arch-lbr +auto-ibrs +avic +avx +avx-ifma +avx-ne-convert +avx-vnni +avx-vnni-int16 +avx-vnni-int8 +avx10 +avx10-128 +avx10-256 +avx10-512 +avx10-vnni-int +avx2 +avx512-4fmaps +avx512-4vnniw +avx512-bf16 +avx512-fp16 +avx512-vp2intersect +avx512-vpopcntdq +avx512bitalg +avx512bw +avx512cd +avx512dq +avx512er +avx512f +avx512ifma +avx512pf +avx512vbmi +avx512vbmi2 +avx512vl +avx512vnni +bhi-ctrl +bhi-no +bmi1 +bmi2 +bus-lock-detect +cet-ibt +cet-ss +cid +cldemote +clflush +clflushopt +clwb +clzero +cmov +cmp-legacy +cmpccxadd +core-capability +cr8legacy +cx16 +cx8 +dca +ddpd-u +de +decodeassists +ds +ds-cpl +dtes64 +eraps +erms +est +extapic +f16c +fb-clear +fbsdp-no +fdp-excptn-only +flush-l1d +flushbyasid +fma +fma4 +fpu +fred +fs-gs-base-ns +fsgsbase +fsrc +fsrm +fsrs +full-width-write +fxsr +fxsr-opt +fzrm +gds-no +gfni +gmet +hle +ht +hv-avic +hv-crash +hv-emsr-bitmap +hv-enforce-cpuid +hv-evmcs +hv-frequencies +hv-ipi +hv-passthrough +hv-reenlightenment +hv-relaxed +hv-reset +hv-runtime +hv-stimer +hv-stimer-direct +hv-syndbg +hv-synic +hv-time +hv-tlbflush +hv-tlbflush-direct +hv-tlbflush-ext +hv-vapic +hv-vpindex +hv-xmm-input +hypervisor +ia64 +ibpb +ibpb-brtype +ibrs +ibrs-all +ibs +intel-psfd +intel-pt +intel-pt-lip +invpcid +invtsc +ipred-ctrl +its-no +kvm-asyncpf +kvm-asyncpf-int +kvm-asyncpf-vmexit +kvm-hint-dedicated +kvm-mmu +kvm-msi-ext-dest-id +kvm-nopiodelay +kvm-poll-control +kvm-pv-eoi +kvm-pv-ipi +kvm-pv-sched-yield +kvm-pv-tlb-flush +kvm-pv-unhalt +kvm-steal-time +kvmclock +kvmclock-stable-bit +la57 +lahf-lm +lam +lbrv +lfence-always-serializing +lkgs +lm +lwp +mca +mcdt-no +mce +md-clear +mds-no +misalignsse +mmx +mmxext +monitor +movbe +movdir64b +movdiri +movrs +mpx +msr +msr-imm +mtrr +no-nested-data-bp +nodeid-msr +npt +nrip-save +null-sel-clr-base +nx +osvw +overflow-recov +pae +pat +pause-filter +pbe +pbrsb-no +pcid +pclmulqdq +pcommit +pdcm +pdpe1gb +perfctr-core +perfctr-nb +perfmon-v2 +pfthreshold +pge +phe +phe-en +pks +pku +pmm +pmm-en +pn +pni +popcnt +prefetchi +prefetchiti +pschange-mc-no +psdp-no +pse +pse36 +rdctl-no +rdpid +rdrand +rdseed +rdtscp +rfds-clear +rfds-no +rrsba-ctrl +rsba +rtm +sbdr-ssdp-no +sbpb +sep +serialize +sgx +sgx-aex-notify +sgx-debug +sgx-edeccssa +sgx-exinfo +sgx-kss +sgx-mode64 +sgx-provisionkey +sgx-tokenkey +sgx1 +sgx2 +sgxlc +sha-ni +sha512 +skinit +skip-l1dfl-vmentry +sm3 +sm4 +smap +smep +smx +spec-ctrl +split-lock-detect +srso-no +srso-user-kernel-no +ss +ssb-no +ssbd +sse +sse2 +sse4.1 +sse4.2 +sse4a +ssse3 +stibp +stibp-always-on +succor +svm +svm-lock +svme-addr-chk +syscall +taa-no +tbm +tce +tm +tm2 +topoext +tsa-l1-no +tsa-sq-no +tsc +tsc-adjust +tsc-deadline +tsc-scale +tsx-ctrl +tsx-ldtrk +umip +v-vmsave-vmload +vaes +verw-clear +vgif +virt-ssbd +vmcb-clean +vme +vmx +vmx-activity-hlt +vmx-activity-shutdown +vmx-activity-wait-sipi +vmx-any-errcode +vmx-apicv-register +vmx-apicv-vid +vmx-apicv-x2apic +vmx-apicv-xapic +vmx-cr3-load-noexit +vmx-cr3-store-noexit +vmx-cr8-load-exit +vmx-cr8-store-exit +vmx-desc-exit +vmx-enable-user-wait-pause +vmx-encls-exit +vmx-entry-ia32e-mode +vmx-entry-load-bndcfgs +vmx-entry-load-cet +vmx-entry-load-efer +vmx-entry-load-fred +vmx-entry-load-pat +vmx-entry-load-perf-global-ctrl +vmx-entry-load-pkrs +vmx-entry-load-rtit-ctl +vmx-entry-noload-debugctl +vmx-ept +vmx-ept-1gb +vmx-ept-2mb +vmx-ept-advanced-exitinfo +vmx-ept-execonly +vmx-eptad +vmx-eptp-switching +vmx-exit-ack-intr +vmx-exit-clear-bndcfgs +vmx-exit-clear-rtit-ctl +vmx-exit-load-efer +vmx-exit-load-pat +vmx-exit-load-perf-global-ctrl +vmx-exit-load-pkrs +vmx-exit-nosave-debugctl +vmx-exit-save-cet +vmx-exit-save-efer +vmx-exit-save-pat +vmx-exit-save-preemption-timer +vmx-exit-secondary-ctls +vmx-flexpriority +vmx-hlt-exit +vmx-ins-outs +vmx-intr-exit +vmx-invept +vmx-invept-all-context +vmx-invept-single-context +vmx-invept-single-context-noglobals +vmx-invlpg-exit +vmx-invpcid-exit +vmx-invvpid +vmx-invvpid-all-context +vmx-invvpid-single-addr +vmx-io-bitmap +vmx-io-exit +vmx-mbec +vmx-monitor-exit +vmx-movdr-exit +vmx-msr-bitmap +vmx-mtf +vmx-mwait-exit +vmx-nested-exception +vmx-nmi-exit +vmx-page-walk-4 +vmx-page-walk-5 +vmx-pause-exit +vmx-ple +vmx-pml +vmx-posted-intr +vmx-preemption-timer +vmx-rdpmc-exit +vmx-rdrand-exit +vmx-rdseed-exit +vmx-rdtsc-exit +vmx-rdtscp-exit +vmx-secondary-ctls +vmx-shadow-vmcs +vmx-store-lma +vmx-true-ctls +vmx-tsc-offset +vmx-tsc-scaling +vmx-unrestricted-guest +vmx-vintr-pending +vmx-vmfunc +vmx-vmwrite-vmexit-fields +vmx-vnmi +vmx-vnmi-pending +vmx-vpid +vmx-wbinvd-exit +vmx-xsaves +vmx-zero-len-inject +vnmi +vpclmulqdq +waitpkg +wbnoinvd +wdt +wrmsrns +x2apic +xcrypt +xcrypt-en +xfd +xgetbv1 +xop +xsave +xsavec +xsaveerptr +xsaveopt +xsaves +xstore +xstore-en +xtpr +zero-fcs-fds diff --git a/debian/rules b/debian/rules index b2eed71..1d57a98 100755 --- a/debian/rules +++ b/debian/rules @@ -124,6 +124,10 @@ install: build # CPU flags are static for QEMU version, allows avoiding more costly checks ./debian/parse-cpu-flags.pl $(destdir)/usr/bin/qemu-system-x86_64 > $(flagfile) + # NOTE: If the diff fails here after upgrading the QEMU submodule, check which new flags + # are to be picked up and which are to be excluded, adapt to other changes and commit the + # new expected file (and parse-cpu-flags.pl script if that changed as well). + diff -u $(flagfile) ./debian/recognized-CPUID-flags-x86_64 # Supported machine versions are static for a given QEMU binary. $(destdir)/usr/bin/qemu-system-x86_64 -machine help | ./debian/parse-machines.pl > $(machine_file_x86_64) -- 2.47.3