[PATCH pve-qemu v3 0/2] include Hyper-V enlightenments in CPUID flags list

[PATCH pve-qemu v3 0/2] include Hyper-V enlightenments in CPUID flags list

[Arthur Bied-Charreton]

In the context of custom CPU models, the hv-* flags are not part of the
base list at all. This means they don't show up in the selector, not
even as unsupported, making it impossible to set them without manually
editing cpu-models.conf.

Until now, this base list was generated from the '-cpu help' output at
pve-qemu-kvm build time [0].

The first patch refactors the script parsing CPU flags to additionally
include the Hyper-V enlightenments by sourcing the flags from the
qom-list-properties QMP command instead, blacklisting unwanted
properties this new source would add.

The second patch pins the resulting flag list into the repository and
fails the build on any divergence, as already done for CPU models. This
ensures flag additions/removals are surfaced for review on QEMU bumps.


[0] https://git.proxmox.com/?p=pve-qemu.git;a=blob;f=debian/rules;h=c90db29b0f03568224b1c79431bce2b753283a4d;hb=refs/heads/master#l126

Changes since v2 (thanks @Fiona):

* Rename $blacklist to $filtered_props
* Die if QMP greeting does not have the expected format
* Expect the CPU typename as a CLI parameter and use max-x86_64-cpu
  instead of host-x86_64-cpu for portability
* Group blacklist entries by typename
* Fix some style errors and remove dead code


Arthur Bied-Charreton (2):
  build: include Hyper-V enlightenments in CPUID flags list
  build: fail when recognized CPUID flags list changes

 debian/parse-cpu-flags.pl            | 144 ++++++++-
 debian/recognized-CPUID-flags-x86_64 | 429 +++++++++++++++++++++++++++
 debian/rules                         |   6 +-
 3 files changed, 563 insertions(+), 16 deletions(-)
 create mode 100644 debian/recognized-CPUID-flags-x86_64

-- 
2.47.3

[PATCH v3 1/2] build: include Hyper-V enlightenments in CPUID flags list

[Arthur Bied-Charreton]

... by sourcing CPU flags from qom-list-properties.

The recognized-CPUID-flags-x86_64 list was generated from QEMU's '-cpu
help' output, which does not advertise Hyper-V enlightenments. Source
the flags from the qom-list-properties QMP command instead to include
them.

The properties are queried from the max-x86_64-cpu CPU type, which is
also available on aarch64 (as opposed to host-x86_64-cpu). The CPU
typename is passed to the script as a CLI argument to allow easily
extending it to query flags for other architectures.

The following unwanted properties are filtered out:

* Non-boolean properties, since the custom CPU models config only
  supports enable/disable.

* Properties exposed by qom-list-properties that are neither CPUID
  flags nor Hyper-V enlightenments.

* The 'hv-syndbg' Hyper-V enlightenment, which depends on whether KVM
  is available at build time and would therefore lead to inconsistent
  results. [0]

[0] https://lore.proxmox.com/pve-devel/0fbeed5e-3d77-4126-828c-acdb04c109ff@proxmox.com/

Suggested-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 debian/parse-cpu-flags.pl | 144 ++++++++++++++++++++++++++++++++++----
 debian/rules              |   2 +-
 2 files changed, 130 insertions(+), 16 deletions(-)

diff --git a/debian/parse-cpu-flags.pl b/debian/parse-cpu-flags.pl
index 1847b3e..e680f99 100755
--- a/debian/parse-cpu-flags.pl
+++ b/debian/parse-cpu-flags.pl
@@ -1,23 +1,137 @@
 #!/usr/bin/perl
 
-use warnings;
-use strict;
+use v5.36;
 
-my @flags = ();
-my $got_flags_section;
+use IPC::Open2;
+use JSON;
 
-while (<STDIN>) {
-    if (/^\s*Recognized CPUID flags:/) {
-	$got_flags_section = 1;
-	next;
-    }
-    next if !$got_flags_section;
+# qemu/target/i386/cpu.c, x86_cpu_initfn()
+my $qemu_cpu_flag_alias_map = {
+    cmp_legacy => 'cmp-legacy',
+    ds_cpl => 'ds-cpl',
+    ffxsr => 'fxsr-opt',
+    fxsr_opt => 'fxsr-opt',
+    'hv-apicv' => 'hv-avic',
+    i64 => 'lm',
+    kvm_nopiodelay => 'kvm-nopiodelay',
+    kvm_mmu => 'kvm-mmu',
+    kvm_asyncpf => 'kvm-asyncpf',
+    kvm_asyncpf_int => 'kvm-asyncpf-int',
+    kvm_steal_time => 'kvm-steal-time',
+    kvm_pv_eoi => 'kvm-pv-eoi',
+    kvm_pv_unhalt => 'kvm-pv-unhalt',
+    kvm_poll_control => 'kvm-poll-control',
+    lahf_lm => 'lahf-lm',
+    lbr_fmt => 'lbr-fmt',
+    nodeid_msr => 'nodeid-msr',
+    nrip_save => 'nrip-save',
+    pause_filter => 'pause-filter',
+    pclmuldq => 'pclmulqdq',
+    perfctr_core => 'perfctr-core',
+    perfctr_nb => 'perfctr-nb',
+    sse3 => 'pni',
+    sse4_1 => 'sse4.1',
+    sse4_2 => 'sse4.2',
+    'sse4-1' => 'sse4.1',
+    'sse4-2' => 'sse4.2',
+    svm_lock => 'svm-lock',
+    tsc_adjust => 'tsc-adjust',
+    tsc_scale => 'tsc-scale',
+    vmcb_clean => 'vmcb-clean',
+    xd => 'nx',
+};
 
-    s/^\s+//;
+# Static blacklist to be reviewed on QEMU bumps.
+#
+# Currently includes boolean properties from qom-list-properties that are neither CPUID
+# flags ('-cpu help') nor Hyper-V enlightenments ('hv-*'). Entries excluded for other
+# reasons are annotated inline.
+my $filtered_props = {
+    'max-x86_64-cpu' => {
+        check => 1,
+        'cpuid-0xb' => 1,
+        enforce => 1,
+        'fill-mtrr-mask' => 1,
+        'host-cache-info' => 1,
+        'host-phys-bits' => 1,
+        hotpluggable => 1,
+        hotplugged => 1,
+        # Presence varies at built-time based on whether KVM is present (CONFIG_SYNDBG)
+        # https://lore.proxmox.com/pve-devel/0fbeed5e-3d77-4126-828c-acdb04c109ff@proxmox.com/
+        'hv-syndbg' => 1,
+        kvm => 1,
+        'kvm-pv-enforce-cpuid' => 1,
+        'l3-cache' => 1,
+        'legacy-cache' => 1,
+        'legacy-multi-node' => 1,
+        lmce => 1,
+        migratable => 1,
+        pmu => 1,
+        realized => 1,
+        'start-powered-off' => 1,
+        'tcg-cpuid' => 1,
+        'vmware-cpuid-freq' => 1,
+        'x-amd-topoext-features-only' => 1,
+        'x-arch-cap-always-on' => 1,
+        'x-consistent-cache' => 1,
+        'x-force-cpuid-0x1f' => 1,
+        'x-force-features' => 1,
+        'x-l1-cache-per-thread' => 1,
+        'x-migrate-error-code' => 1,
+        'x-migrate-smi-count' => 1,
+        'x-pdcm-on-even-without-pmu' => 1,
+        'x-vendor-cpuid-only' => 1,
+        'x-vendor-cpuid-only-v2' => 1,
+        'xen-vapic' => 1,
+    },
+};
 
-    push @flags, split(/\s+/);
-}
+sub print_flags($qemu_bin, $typename) {
+    die "Unknown typename, must be one of '" . join("', '", keys $filtered_props->%*) . "'\n"
+        if !defined($filtered_props->{$typename});
+
+    my $pid = open2(
+        my $out,
+        my $in,
+        $qemu_bin,
+        '-machine',
+        'none',
+        '-display',
+        'none',
+        '-S',
+        '-qmp',
+        'stdio',
+        '-nodefaults',
+    );
+
+    my $qmp = sub ($cmd, %args) {
+        print $in encode_json({ execute => $cmd, %args ? (arguments => \%args) : () }), "\n";
+        while (my $line = <$out>) {
+            my $msg = decode_json($line);
+            next if $msg->{event};
+            return $msg->{return} if exists($msg->{return});
+            die "QMP error: " . encode_json($msg->{error}) if $msg->{error};
+        }
+    };
 
-die "no QEMU/KVM CPU flags detected from STDIN input" if scalar (@flags) <= 0;
+    my $flags = {};
+    my $greeting = <$out>;
+    my $decoded_greeting = decode_json($greeting);
+    die "Unexpected QMP greeting: $greeting\n" if !exists($decoded_greeting->{QMP});
+
+    $qmp->('qmp_capabilities');
+    my $props = $qmp->('qom-list-properties', typename => $typename);
+    for my $qo ($props->@*) {
+        next if $qo->{type} ne 'bool' || defined($filtered_props->{$typename}->{$qo->{name}});
+        my $resolved_name = $qemu_cpu_flag_alias_map->{$qo->{name}} // $qo->{name};
+        $flags->{$resolved_name} = 1;
+    }
+    $qmp->('quit');
+    waitpid($pid, 0);
+
+    my @flags = sort keys $flags->%*;
+    print join("\n", @flags) . "\n";
+}
 
-print join("\n", @flags) or die "$!\n";
+my ($qemu_bin, $typename) = @ARGV;
+print_flags($qemu_bin, $typename);
diff --git a/debian/rules b/debian/rules
index c90db29..053f2f3 100755
--- a/debian/rules
+++ b/debian/rules
@@ -123,7 +123,7 @@ install: build
 	rm -f $(destdir)/usr/lib/kvm/virtfs-proxy-helper
 
 	# CPU flags are static for QEMU version, allows avoiding more costly checks
-	$(destdir)/usr/bin/qemu-system-x86_64 -cpu help | ./debian/parse-cpu-flags.pl > $(flagfile)
+	./debian/parse-cpu-flags.pl $(destdir)/usr/bin/qemu-system-x86_64 max-x86_64-cpu > $(flagfile)
 
 	# Supported machine versions are static for a given QEMU binary.
 	$(destdir)/usr/bin/qemu-system-x86_64 -machine help | ./debian/parse-machines.pl > $(machine_file_x86_64)
-- 
2.47.3

[PATCH v3 2/2] build: fail when recognized CPUID flags list changes

[Arthur Bied-Charreton]

Check in the current recognized CPUID flags list and fail the build if
the list newly generated by parse-cpu-flags.pl differs from it.

This forces new or removed flags to be manually reviewed instead of
being silently picked up on QEMU bumps and mirrors the existing
approach for CPU models.

Suggested-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 debian/recognized-CPUID-flags-x86_64 | 429 +++++++++++++++++++++++++++
 debian/rules                         |   4 +
 2 files changed, 433 insertions(+)
 create mode 100644 debian/recognized-CPUID-flags-x86_64

diff --git a/debian/recognized-CPUID-flags-x86_64 b/debian/recognized-CPUID-flags-x86_64
new file mode 100644
index 0000000..5861e59
--- /dev/null
+++ b/debian/recognized-CPUID-flags-x86_64
@@ -0,0 +1,429 @@
+3dnow
+3dnowext
+3dnowprefetch
+abm
+ace2
+ace2-en
+acpi
+adx
+aes
+amd-no-ssb
+amd-psfd
+amd-ssbd
+amd-stibp
+amx-avx512
+amx-bf16
+amx-bf16-alias
+amx-complex
+amx-complex-alias
+amx-fp16
+amx-fp16-alias
+amx-fp8
+amx-int8
+amx-int8-alias
+amx-movrs
+amx-tf32
+amx-tile
+apic
+apx-nci-ndd-nf
+apxf
+arat
+arch-capabilities
+arch-lbr
+auto-ibrs
+avic
+avx
+avx-ifma
+avx-ne-convert
+avx-vnni
+avx-vnni-int16
+avx-vnni-int8
+avx10
+avx10-128
+avx10-256
+avx10-512
+avx10-vnni-int
+avx2
+avx512-4fmaps
+avx512-4vnniw
+avx512-bf16
+avx512-fp16
+avx512-vp2intersect
+avx512-vpopcntdq
+avx512bitalg
+avx512bw
+avx512cd
+avx512dq
+avx512er
+avx512f
+avx512ifma
+avx512pf
+avx512vbmi
+avx512vbmi2
+avx512vl
+avx512vnni
+bhi-ctrl
+bhi-no
+bmi1
+bmi2
+bus-lock-detect
+cet-ibt
+cet-ss
+cid
+cldemote
+clflush
+clflushopt
+clwb
+clzero
+cmov
+cmp-legacy
+cmpccxadd
+core-capability
+cr8legacy
+cx16
+cx8
+dca
+ddpd-u
+de
+decodeassists
+ds
+ds-cpl
+dtes64
+eraps
+erms
+est
+extapic
+f16c
+fb-clear
+fbsdp-no
+fdp-excptn-only
+flush-l1d
+flushbyasid
+fma
+fma4
+fpu
+fred
+fs-gs-base-ns
+fsgsbase
+fsrc
+fsrm
+fsrs
+full-width-write
+fxsr
+fxsr-opt
+fzrm
+gds-no
+gfni
+gmet
+hle
+ht
+hv-avic
+hv-crash
+hv-emsr-bitmap
+hv-enforce-cpuid
+hv-evmcs
+hv-frequencies
+hv-ipi
+hv-passthrough
+hv-reenlightenment
+hv-relaxed
+hv-reset
+hv-runtime
+hv-stimer
+hv-stimer-direct
+hv-synic
+hv-time
+hv-tlbflush
+hv-tlbflush-direct
+hv-tlbflush-ext
+hv-vapic
+hv-vpindex
+hv-xmm-input
+hypervisor
+ia64
+ibpb
+ibpb-brtype
+ibrs
+ibrs-all
+ibs
+intel-psfd
+intel-pt
+intel-pt-lip
+invpcid
+invtsc
+ipred-ctrl
+its-no
+kvm-asyncpf
+kvm-asyncpf-int
+kvm-asyncpf-vmexit
+kvm-hint-dedicated
+kvm-mmu
+kvm-msi-ext-dest-id
+kvm-nopiodelay
+kvm-poll-control
+kvm-pv-eoi
+kvm-pv-ipi
+kvm-pv-sched-yield
+kvm-pv-tlb-flush
+kvm-pv-unhalt
+kvm-steal-time
+kvmclock
+kvmclock-stable-bit
+la57
+lahf-lm
+lam
+lbrv
+lfence-always-serializing
+lkgs
+lm
+lwp
+mca
+mcdt-no
+mce
+md-clear
+mds-no
+misalignsse
+mmx
+mmxext
+monitor
+movbe
+movdir64b
+movdiri
+movrs
+mpx
+msr
+msr-imm
+mtrr
+no-nested-data-bp
+nodeid-msr
+npt
+nrip-save
+null-sel-clr-base
+nx
+osvw
+overflow-recov
+pae
+pat
+pause-filter
+pbe
+pbrsb-no
+pcid
+pclmulqdq
+pcommit
+pdcm
+pdpe1gb
+perfctr-core
+perfctr-nb
+perfmon-v2
+pfthreshold
+pge
+phe
+phe-en
+pks
+pku
+pmm
+pmm-en
+pn
+pni
+popcnt
+prefetchi
+prefetchiti
+pschange-mc-no
+psdp-no
+pse
+pse36
+rdctl-no
+rdpid
+rdrand
+rdseed
+rdtscp
+rfds-clear
+rfds-no
+rrsba-ctrl
+rsba
+rtm
+sbdr-ssdp-no
+sbpb
+sep
+serialize
+sgx
+sgx-aex-notify
+sgx-debug
+sgx-edeccssa
+sgx-exinfo
+sgx-kss
+sgx-mode64
+sgx-provisionkey
+sgx-tokenkey
+sgx1
+sgx2
+sgxlc
+sha-ni
+sha512
+skinit
+skip-l1dfl-vmentry
+sm3
+sm4
+smap
+smep
+smx
+spec-ctrl
+split-lock-detect
+srso-no
+srso-user-kernel-no
+ss
+ssb-no
+ssbd
+sse
+sse2
+sse4.1
+sse4.2
+sse4a
+ssse3
+stibp
+stibp-always-on
+succor
+svm
+svm-lock
+svme-addr-chk
+syscall
+taa-no
+tbm
+tce
+tm
+tm2
+topoext
+tsa-l1-no
+tsa-sq-no
+tsc
+tsc-adjust
+tsc-deadline
+tsc-scale
+tsx-ctrl
+tsx-ldtrk
+umip
+v-vmsave-vmload
+vaes
+verw-clear
+vgif
+virt-ssbd
+vmcb-clean
+vme
+vmx
+vmx-activity-hlt
+vmx-activity-shutdown
+vmx-activity-wait-sipi
+vmx-any-errcode
+vmx-apicv-register
+vmx-apicv-vid
+vmx-apicv-x2apic
+vmx-apicv-xapic
+vmx-cr3-load-noexit
+vmx-cr3-store-noexit
+vmx-cr8-load-exit
+vmx-cr8-store-exit
+vmx-desc-exit
+vmx-enable-user-wait-pause
+vmx-encls-exit
+vmx-entry-ia32e-mode
+vmx-entry-load-bndcfgs
+vmx-entry-load-cet
+vmx-entry-load-efer
+vmx-entry-load-fred
+vmx-entry-load-pat
+vmx-entry-load-perf-global-ctrl
+vmx-entry-load-pkrs
+vmx-entry-load-rtit-ctl
+vmx-entry-noload-debugctl
+vmx-ept
+vmx-ept-1gb
+vmx-ept-2mb
+vmx-ept-advanced-exitinfo
+vmx-ept-execonly
+vmx-eptad
+vmx-eptp-switching
+vmx-exit-ack-intr
+vmx-exit-clear-bndcfgs
+vmx-exit-clear-rtit-ctl
+vmx-exit-load-efer
+vmx-exit-load-pat
+vmx-exit-load-perf-global-ctrl
+vmx-exit-load-pkrs
+vmx-exit-nosave-debugctl
+vmx-exit-save-cet
+vmx-exit-save-efer
+vmx-exit-save-pat
+vmx-exit-save-preemption-timer
+vmx-exit-secondary-ctls
+vmx-flexpriority
+vmx-hlt-exit
+vmx-ins-outs
+vmx-intr-exit
+vmx-invept
+vmx-invept-all-context
+vmx-invept-single-context
+vmx-invept-single-context-noglobals
+vmx-invlpg-exit
+vmx-invpcid-exit
+vmx-invvpid
+vmx-invvpid-all-context
+vmx-invvpid-single-addr
+vmx-io-bitmap
+vmx-io-exit
+vmx-mbec
+vmx-monitor-exit
+vmx-movdr-exit
+vmx-msr-bitmap
+vmx-mtf
+vmx-mwait-exit
+vmx-nested-exception
+vmx-nmi-exit
+vmx-page-walk-4
+vmx-page-walk-5
+vmx-pause-exit
+vmx-ple
+vmx-pml
+vmx-posted-intr
+vmx-preemption-timer
+vmx-rdpmc-exit
+vmx-rdrand-exit
+vmx-rdseed-exit
+vmx-rdtsc-exit
+vmx-rdtscp-exit
+vmx-secondary-ctls
+vmx-shadow-vmcs
+vmx-store-lma
+vmx-true-ctls
+vmx-tsc-offset
+vmx-tsc-scaling
+vmx-unrestricted-guest
+vmx-vintr-pending
+vmx-vmfunc
+vmx-vmwrite-vmexit-fields
+vmx-vnmi
+vmx-vnmi-pending
+vmx-vpid
+vmx-wbinvd-exit
+vmx-xsaves
+vmx-zero-len-inject
+vnmi
+vpclmulqdq
+waitpkg
+wbnoinvd
+wdt
+wrmsrns
+x2apic
+xcrypt
+xcrypt-en
+xfd
+xgetbv1
+xop
+xsave
+xsavec
+xsaveerptr
+xsaveopt
+xsaves
+xstore
+xstore-en
+xtpr
+zero-fcs-fds
diff --git a/debian/rules b/debian/rules
index 053f2f3..c207527 100755
--- a/debian/rules
+++ b/debian/rules
@@ -124,6 +124,10 @@ install: build
 
 	# CPU flags are static for QEMU version, allows avoiding more costly checks
 	./debian/parse-cpu-flags.pl $(destdir)/usr/bin/qemu-system-x86_64 max-x86_64-cpu > $(flagfile)
+	# NOTE: If the diff fails here after upgrading the QEMU submodule, check which new flags
+	# are to be picked up and which are to be excluded, adapt to other changes and commit the
+	# new expected file (and parse-cpu-flags.pl script if that changed as well).
+	diff -u $(flagfile) ./debian/recognized-CPUID-flags-x86_64
 
 	# Supported machine versions are static for a given QEMU binary.
 	$(destdir)/usr/bin/qemu-system-x86_64 -machine help | ./debian/parse-machines.pl > $(machine_file_x86_64)
-- 
2.47.3

Re: [PATCH v3 1/2] build: include Hyper-V enlightenments in CPUID flags list

[Arthur Bied-Charreton]

argh just realized my git config for pve-qemu was still missing a
subjectprefix entry, sorry about the missing repo in the subject

applied: [PATCH pve-qemu v3 0/2] include Hyper-V enlightenments in CPUID flags list

[Fiona Ebner]

On Wed, 03 Jun 2026 09:07:34 +0200, Arthur Bied-Charreton wrote:
> In the context of custom CPU models, the hv-* flags are not part of the
> base list at all. This means they don't show up in the selector, not
> even as unsupported, making it impossible to set them without manually
> editing cpu-models.conf.
> 
> Until now, this base list was generated from the '-cpu help' output at
> pve-qemu-kvm build time [0].

Applied, thanks!

[1/2] build: include Hyper-V enlightenments in CPUID flags list
      commit: 31ab984fb20a518532929685b31bfcf879761c96
[2/2] build: fail when recognized CPUID flags list changes
      commit: 817dab1cdae098114aa95c4ba48a6d038a904647