[PATCH pve-qemu 3/3] build: fail when recognized CPU flags list changes

[Arthur Bied-Charreton <a.bied-charreton@proxmox.com>]

Check in the current recognized CPU flags list and fail the build if the
list newly generated by parse-cpu-flags.pl differs from it.

This forces new or removed flags to be manually reviewed instead of
being silently picked up on QEMU bumps.

This mirrors the existing approach for CPU models.

Suggested-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Arthur Bied-Charreton <a.bied-charreton@proxmox.com>
---
 debian/recognized-CPUID-flags-x86_64 | 412 +++++++++++++++++++++++++++
 debian/rules                         |   4 +
 2 files changed, 416 insertions(+)
 create mode 100644 debian/recognized-CPUID-flags-x86_64

diff --git a/debian/recognized-CPUID-flags-x86_64 b/debian/recognized-CPUID-flags-x86_64
new file mode 100644
index 0000000..4458eb2
--- /dev/null
+++ b/debian/recognized-CPUID-flags-x86_64
@@ -0,0 +1,412 @@
+3dnow
+3dnowext
+3dnowprefetch
+abm
+ace2
+ace2-en
+acpi
+adx
+aes
+amd-no-ssb
+amd-psfd
+amd-ssbd
+amd-stibp
+amx-bf16
+amx-complex
+amx-fp16
+amx-int8
+amx-tile
+apic
+arat
+arch-capabilities
+arch-lbr
+auto-ibrs
+avic
+avx
+avx-ifma
+avx-ne-convert
+avx-vnni
+avx-vnni-int16
+avx-vnni-int8
+avx10
+avx10-128
+avx10-256
+avx10-512
+avx2
+avx512-4fmaps
+avx512-4vnniw
+avx512-bf16
+avx512-fp16
+avx512-vp2intersect
+avx512-vpopcntdq
+avx512bitalg
+avx512bw
+avx512cd
+avx512dq
+avx512er
+avx512f
+avx512ifma
+avx512pf
+avx512vbmi
+avx512vbmi2
+avx512vl
+avx512vnni
+bhi-ctrl
+bhi-no
+bmi1
+bmi2
+bus-lock-detect
+cid
+cldemote
+clflush
+clflushopt
+clwb
+clzero
+cmov
+cmp-legacy
+cmpccxadd
+core-capability
+cr8legacy
+cx16
+cx8
+dca
+ddpd-u
+de
+decodeassists
+ds
+ds-cpl
+dtes64
+eraps
+erms
+est
+extapic
+f16c
+fb-clear
+fbsdp-no
+fdp-excptn-only
+flush-l1d
+flushbyasid
+fma
+fma4
+fpu
+fred
+fs-gs-base-ns
+fsgsbase
+fsrc
+fsrm
+fsrs
+full-width-write
+fxsr
+fxsr-opt
+fzrm
+gds-no
+gfni
+hle
+ht
+hv-apicv
+hv-avic
+hv-crash
+hv-emsr-bitmap
+hv-enforce-cpuid
+hv-evmcs
+hv-frequencies
+hv-ipi
+hv-passthrough
+hv-reenlightenment
+hv-relaxed
+hv-reset
+hv-runtime
+hv-stimer
+hv-stimer-direct
+hv-syndbg
+hv-synic
+hv-time
+hv-tlbflush
+hv-tlbflush-direct
+hv-tlbflush-ext
+hv-vapic
+hv-vpindex
+hv-xmm-input
+hypervisor
+ia64
+ibpb
+ibpb-brtype
+ibrs
+ibrs-all
+ibs
+intel-psfd
+intel-pt
+intel-pt-lip
+invpcid
+invtsc
+ipred-ctrl
+its-no
+kvm-asyncpf
+kvm-asyncpf-int
+kvm-asyncpf-vmexit
+kvm-hint-dedicated
+kvm-mmu
+kvm-msi-ext-dest-id
+kvm-nopiodelay
+kvm-poll-control
+kvm-pv-eoi
+kvm-pv-ipi
+kvm-pv-sched-yield
+kvm-pv-tlb-flush
+kvm-pv-unhalt
+kvm-steal-time
+kvmclock
+kvmclock
+kvmclock-stable-bit
+la57
+lahf-lm
+lam
+lbrv
+lfence-always-serializing
+lkgs
+lm
+lwp
+mca
+mcdt-no
+mce
+md-clear
+mds-no
+misalignsse
+mmx
+mmxext
+monitor
+movbe
+movdir64b
+movdiri
+mpx
+msr
+msr-imm
+mtrr
+no-nested-data-bp
+nodeid-msr
+npt
+nrip-save
+null-sel-clr-base
+nx
+osvw
+overflow-recov
+pae
+pat
+pause-filter
+pbe
+pbrsb-no
+pcid
+pclmulqdq
+pcommit
+pdcm
+pdpe1gb
+perfctr-core
+perfctr-nb
+perfmon-v2
+pfthreshold
+pge
+phe
+phe-en
+pks
+pku
+pmm
+pmm-en
+pn
+pni
+popcnt
+prefetchi
+prefetchiti
+pschange-mc-no
+psdp-no
+pse
+pse36
+rdctl-no
+rdpid
+rdrand
+rdseed
+rdtscp
+rfds-clear
+rfds-no
+rrsba-ctrl
+rsba
+rtm
+sbdr-ssdp-no
+sbpb
+sep
+serialize
+sgx
+sgx-aex-notify
+sgx-debug
+sgx-edeccssa
+sgx-exinfo
+sgx-kss
+sgx-mode64
+sgx-provisionkey
+sgx-tokenkey
+sgx1
+sgx2
+sgxlc
+sha-ni
+sha512
+skinit
+skip-l1dfl-vmentry
+sm3
+sm4
+smap
+smep
+smx
+spec-ctrl
+split-lock-detect
+srso-no
+srso-user-kernel-no
+ss
+ssb-no
+ssbd
+sse
+sse2
+sse4.1
+sse4.2
+sse4a
+ssse3
+stibp
+stibp-always-on
+succor
+svm
+svm-lock
+svme-addr-chk
+syscall
+taa-no
+tbm
+tce
+tm
+tm2
+topoext
+tsc
+tsc-adjust
+tsc-deadline
+tsc-scale
+tsx-ctrl
+tsx-ldtrk
+umip
+v-vmsave-vmload
+vaes
+vgif
+virt-ssbd
+vmcb-clean
+vme
+vmx
+vmx-activity-hlt
+vmx-activity-shutdown
+vmx-activity-wait-sipi
+vmx-any-errcode
+vmx-apicv-register
+vmx-apicv-vid
+vmx-apicv-x2apic
+vmx-apicv-xapic
+vmx-cr3-load-noexit
+vmx-cr3-store-noexit
+vmx-cr8-load-exit
+vmx-cr8-store-exit
+vmx-desc-exit
+vmx-enable-user-wait-pause
+vmx-encls-exit
+vmx-entry-ia32e-mode
+vmx-entry-load-bndcfgs
+vmx-entry-load-efer
+vmx-entry-load-fred
+vmx-entry-load-pat
+vmx-entry-load-perf-global-ctrl
+vmx-entry-load-pkrs
+vmx-entry-load-rtit-ctl
+vmx-entry-noload-debugctl
+vmx-ept
+vmx-ept-1gb
+vmx-ept-2mb
+vmx-ept-advanced-exitinfo
+vmx-ept-execonly
+vmx-eptad
+vmx-eptp-switching
+vmx-exit-ack-intr
+vmx-exit-clear-bndcfgs
+vmx-exit-clear-rtit-ctl
+vmx-exit-load-efer
+vmx-exit-load-pat
+vmx-exit-load-perf-global-ctrl
+vmx-exit-load-pkrs
+vmx-exit-nosave-debugctl
+vmx-exit-save-efer
+vmx-exit-save-pat
+vmx-exit-save-preemption-timer
+vmx-exit-secondary-ctls
+vmx-flexpriority
+vmx-hlt-exit
+vmx-ins-outs
+vmx-intr-exit
+vmx-invept
+vmx-invept-all-context
+vmx-invept-single-context
+vmx-invept-single-context
+vmx-invept-single-context-noglobals
+vmx-invlpg-exit
+vmx-invpcid-exit
+vmx-invvpid
+vmx-invvpid-all-context
+vmx-invvpid-single-addr
+vmx-io-bitmap
+vmx-io-exit
+vmx-monitor-exit
+vmx-movdr-exit
+vmx-msr-bitmap
+vmx-mtf
+vmx-mwait-exit
+vmx-nested-exception
+vmx-nmi-exit
+vmx-page-walk-4
+vmx-page-walk-5
+vmx-pause-exit
+vmx-ple
+vmx-pml
+vmx-posted-intr
+vmx-preemption-timer
+vmx-rdpmc-exit
+vmx-rdrand-exit
+vmx-rdseed-exit
+vmx-rdtsc-exit
+vmx-rdtscp-exit
+vmx-secondary-ctls
+vmx-shadow-vmcs
+vmx-store-lma
+vmx-true-ctls
+vmx-tsc-offset
+vmx-tsc-scaling
+vmx-unrestricted-guest
+vmx-vintr-pending
+vmx-vmfunc
+vmx-vmwrite-vmexit-fields
+vmx-vnmi
+vmx-vnmi-pending
+vmx-vpid
+vmx-wbinvd-exit
+vmx-xsaves
+vmx-zero-len-inject
+vnmi
+vpclmulqdq
+waitpkg
+wbnoinvd
+wdt
+wrmsrns
+x2apic
+xcrypt
+xcrypt-en
+xfd
+xgetbv1
+xop
+xsave
+xsavec
+xsaveerptr
+xsaveopt
+xsaves
+xstore
+xstore-en
+xtpr
+zero-fcs-fds
\ No newline at end of file
diff --git a/debian/rules b/debian/rules
index e3eebe8..d2bb593 100755
--- a/debian/rules
+++ b/debian/rules
@@ -124,6 +124,10 @@ install: build
 
 	# CPU flags are static for QEMU version, allows avoiding more costly checks
 	$(destdir)/usr/bin/qemu-system-x86_64 -cpu help | ./debian/parse-cpu-flags.pl $(destdir)/usr/bin/qemu-system-x86_64 > $(flagfile)
+	# NOTE: If the diff fails here after upgrading the QEMU submodule, check which new flags
+	# are to be picked up and which are to be excluded, adapt to other changes and commit the
+	# new expected file (and parse-cpu-flags.pl script if that changed as well).
+	diff -u $(flagfile) ./debian/recognized-CPUID-flags-x86_64
 
 	# Supported machine versions are static for a given QEMU binary.
 	$(destdir)/usr/bin/qemu-system-x86_64 -machine help | ./debian/parse-machines.pl > $(machine_file_x86_64)
-- 
2.47.3