From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from firstgate.proxmox.com (firstgate.proxmox.com [IPv6:2a01:7e0:0:424::9]) by lore.proxmox.com (Postfix) with ESMTPS id BE1CF1FF13B for ; Wed, 03 Jun 2026 09:09:04 +0200 (CEST) Received: from firstgate.proxmox.com (localhost [127.0.0.1]) by firstgate.proxmox.com (Proxmox) with ESMTP id F40B7373DF; Wed, 3 Jun 2026 09:09:01 +0200 (CEST) From: Arthur Bied-Charreton To: pve-devel@lists.proxmox.com Subject: [PATCH v3 2/2] build: fail when recognized CPUID flags list changes Date: Wed, 3 Jun 2026 09:07:36 +0200 Message-ID: <20260603070857.184709-3-a.bied-charreton@proxmox.com> X-Mailer: git-send-email 2.47.3 In-Reply-To: <20260603070857.184709-1-a.bied-charreton@proxmox.com> References: <20260603070857.184709-1-a.bied-charreton@proxmox.com> MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-SPAM-LEVEL: Spam detection results: 0 AWL -0.256 Adjusted score from AWL reputation of From: address BAYES_00 -1.9 Bayes spam probability is 0 to 1% DMARC_MISSING 0.1 Missing DMARC policy KAM_DMARC_STATUS 0.01 Test Rule for DKIM or SPF Failure with Strict Alignment KAM_LAZY_DOMAIN_SECURITY 1 Sending domain does not have any anti-forgery methods RDNS_NONE 0.793 Delivered to internal network by a host with no rDNS SCC_5_SHORT_WORD_LINES 0.25 5 lines with many short words SPF_HELO_NONE 0.001 SPF: HELO does not publish an SPF Record SPF_NONE 0.001 SPF: sender does not publish an SPF Record URIBL_BLOCKED 0.001 ADMINISTRATOR NOTICE: The query to URIBL was blocked. See http://wiki.apache.org/spamassassin/DnsBlocklists#dnsbl-block for more information. [parse-machines.pl] Message-ID-Hash: QZ33YGQXQSLTC4LD2YIYSNZCZAZNE536 X-Message-ID-Hash: QZ33YGQXQSLTC4LD2YIYSNZCZAZNE536 X-MailFrom: abied-charreton@jett.proxmox.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: Check in the current recognized CPUID flags list and fail the build if the list newly generated by parse-cpu-flags.pl differs from it. This forces new or removed flags to be manually reviewed instead of being silently picked up on QEMU bumps and mirrors the existing approach for CPU models. Suggested-by: Fiona Ebner Signed-off-by: Arthur Bied-Charreton --- debian/recognized-CPUID-flags-x86_64 | 429 +++++++++++++++++++++++++++ debian/rules | 4 + 2 files changed, 433 insertions(+) create mode 100644 debian/recognized-CPUID-flags-x86_64 diff --git a/debian/recognized-CPUID-flags-x86_64 b/debian/recognized-CPUID-flags-x86_64 new file mode 100644 index 0000000..5861e59 --- /dev/null +++ b/debian/recognized-CPUID-flags-x86_64 @@ -0,0 +1,429 @@ +3dnow +3dnowext +3dnowprefetch +abm +ace2 +ace2-en +acpi +adx +aes +amd-no-ssb +amd-psfd +amd-ssbd +amd-stibp +amx-avx512 +amx-bf16 +amx-bf16-alias +amx-complex +amx-complex-alias +amx-fp16 +amx-fp16-alias +amx-fp8 +amx-int8 +amx-int8-alias +amx-movrs +amx-tf32 +amx-tile +apic +apx-nci-ndd-nf +apxf +arat +arch-capabilities +arch-lbr +auto-ibrs +avic +avx +avx-ifma +avx-ne-convert +avx-vnni +avx-vnni-int16 +avx-vnni-int8 +avx10 +avx10-128 +avx10-256 +avx10-512 +avx10-vnni-int +avx2 +avx512-4fmaps +avx512-4vnniw +avx512-bf16 +avx512-fp16 +avx512-vp2intersect +avx512-vpopcntdq +avx512bitalg +avx512bw +avx512cd +avx512dq +avx512er +avx512f +avx512ifma +avx512pf +avx512vbmi +avx512vbmi2 +avx512vl +avx512vnni +bhi-ctrl +bhi-no +bmi1 +bmi2 +bus-lock-detect +cet-ibt +cet-ss +cid +cldemote +clflush +clflushopt +clwb +clzero +cmov +cmp-legacy +cmpccxadd +core-capability +cr8legacy +cx16 +cx8 +dca +ddpd-u +de +decodeassists +ds +ds-cpl +dtes64 +eraps +erms +est +extapic +f16c +fb-clear +fbsdp-no +fdp-excptn-only +flush-l1d +flushbyasid +fma +fma4 +fpu +fred +fs-gs-base-ns +fsgsbase +fsrc +fsrm +fsrs +full-width-write +fxsr +fxsr-opt +fzrm +gds-no +gfni +gmet +hle +ht +hv-avic +hv-crash +hv-emsr-bitmap +hv-enforce-cpuid +hv-evmcs +hv-frequencies +hv-ipi +hv-passthrough +hv-reenlightenment +hv-relaxed +hv-reset +hv-runtime +hv-stimer +hv-stimer-direct +hv-synic +hv-time +hv-tlbflush +hv-tlbflush-direct +hv-tlbflush-ext +hv-vapic +hv-vpindex +hv-xmm-input +hypervisor +ia64 +ibpb +ibpb-brtype +ibrs +ibrs-all +ibs +intel-psfd +intel-pt +intel-pt-lip +invpcid +invtsc +ipred-ctrl +its-no +kvm-asyncpf +kvm-asyncpf-int +kvm-asyncpf-vmexit +kvm-hint-dedicated +kvm-mmu +kvm-msi-ext-dest-id +kvm-nopiodelay +kvm-poll-control +kvm-pv-eoi +kvm-pv-ipi +kvm-pv-sched-yield +kvm-pv-tlb-flush +kvm-pv-unhalt +kvm-steal-time +kvmclock +kvmclock-stable-bit +la57 +lahf-lm +lam +lbrv +lfence-always-serializing +lkgs +lm +lwp +mca +mcdt-no +mce +md-clear +mds-no +misalignsse +mmx +mmxext +monitor +movbe +movdir64b +movdiri +movrs +mpx +msr +msr-imm +mtrr +no-nested-data-bp +nodeid-msr +npt +nrip-save +null-sel-clr-base +nx +osvw +overflow-recov +pae +pat +pause-filter +pbe +pbrsb-no +pcid +pclmulqdq +pcommit +pdcm +pdpe1gb +perfctr-core +perfctr-nb +perfmon-v2 +pfthreshold +pge +phe +phe-en +pks +pku +pmm +pmm-en +pn +pni +popcnt +prefetchi +prefetchiti +pschange-mc-no +psdp-no +pse +pse36 +rdctl-no +rdpid +rdrand +rdseed +rdtscp +rfds-clear +rfds-no +rrsba-ctrl +rsba +rtm +sbdr-ssdp-no +sbpb +sep +serialize +sgx +sgx-aex-notify +sgx-debug +sgx-edeccssa +sgx-exinfo +sgx-kss +sgx-mode64 +sgx-provisionkey +sgx-tokenkey +sgx1 +sgx2 +sgxlc +sha-ni +sha512 +skinit +skip-l1dfl-vmentry +sm3 +sm4 +smap +smep +smx +spec-ctrl +split-lock-detect +srso-no +srso-user-kernel-no +ss +ssb-no +ssbd +sse +sse2 +sse4.1 +sse4.2 +sse4a +ssse3 +stibp +stibp-always-on +succor +svm +svm-lock +svme-addr-chk +syscall +taa-no +tbm +tce +tm +tm2 +topoext +tsa-l1-no +tsa-sq-no +tsc +tsc-adjust +tsc-deadline +tsc-scale +tsx-ctrl +tsx-ldtrk +umip +v-vmsave-vmload +vaes +verw-clear +vgif +virt-ssbd +vmcb-clean +vme +vmx +vmx-activity-hlt +vmx-activity-shutdown +vmx-activity-wait-sipi +vmx-any-errcode +vmx-apicv-register +vmx-apicv-vid +vmx-apicv-x2apic +vmx-apicv-xapic +vmx-cr3-load-noexit +vmx-cr3-store-noexit +vmx-cr8-load-exit +vmx-cr8-store-exit +vmx-desc-exit +vmx-enable-user-wait-pause +vmx-encls-exit +vmx-entry-ia32e-mode +vmx-entry-load-bndcfgs +vmx-entry-load-cet +vmx-entry-load-efer +vmx-entry-load-fred +vmx-entry-load-pat +vmx-entry-load-perf-global-ctrl +vmx-entry-load-pkrs +vmx-entry-load-rtit-ctl +vmx-entry-noload-debugctl +vmx-ept +vmx-ept-1gb +vmx-ept-2mb +vmx-ept-advanced-exitinfo +vmx-ept-execonly +vmx-eptad +vmx-eptp-switching +vmx-exit-ack-intr +vmx-exit-clear-bndcfgs +vmx-exit-clear-rtit-ctl +vmx-exit-load-efer +vmx-exit-load-pat +vmx-exit-load-perf-global-ctrl +vmx-exit-load-pkrs +vmx-exit-nosave-debugctl +vmx-exit-save-cet +vmx-exit-save-efer +vmx-exit-save-pat +vmx-exit-save-preemption-timer +vmx-exit-secondary-ctls +vmx-flexpriority +vmx-hlt-exit +vmx-ins-outs +vmx-intr-exit +vmx-invept +vmx-invept-all-context +vmx-invept-single-context +vmx-invept-single-context-noglobals +vmx-invlpg-exit +vmx-invpcid-exit +vmx-invvpid +vmx-invvpid-all-context +vmx-invvpid-single-addr +vmx-io-bitmap +vmx-io-exit +vmx-mbec +vmx-monitor-exit +vmx-movdr-exit +vmx-msr-bitmap +vmx-mtf +vmx-mwait-exit +vmx-nested-exception +vmx-nmi-exit +vmx-page-walk-4 +vmx-page-walk-5 +vmx-pause-exit +vmx-ple +vmx-pml +vmx-posted-intr +vmx-preemption-timer +vmx-rdpmc-exit +vmx-rdrand-exit +vmx-rdseed-exit +vmx-rdtsc-exit +vmx-rdtscp-exit +vmx-secondary-ctls +vmx-shadow-vmcs +vmx-store-lma +vmx-true-ctls +vmx-tsc-offset +vmx-tsc-scaling +vmx-unrestricted-guest +vmx-vintr-pending +vmx-vmfunc +vmx-vmwrite-vmexit-fields +vmx-vnmi +vmx-vnmi-pending +vmx-vpid +vmx-wbinvd-exit +vmx-xsaves +vmx-zero-len-inject +vnmi +vpclmulqdq +waitpkg +wbnoinvd +wdt +wrmsrns +x2apic +xcrypt +xcrypt-en +xfd +xgetbv1 +xop +xsave +xsavec +xsaveerptr +xsaveopt +xsaves +xstore +xstore-en +xtpr +zero-fcs-fds diff --git a/debian/rules b/debian/rules index 053f2f3..c207527 100755 --- a/debian/rules +++ b/debian/rules @@ -124,6 +124,10 @@ install: build # CPU flags are static for QEMU version, allows avoiding more costly checks ./debian/parse-cpu-flags.pl $(destdir)/usr/bin/qemu-system-x86_64 max-x86_64-cpu > $(flagfile) + # NOTE: If the diff fails here after upgrading the QEMU submodule, check which new flags + # are to be picked up and which are to be excluded, adapt to other changes and commit the + # new expected file (and parse-cpu-flags.pl script if that changed as well). + diff -u $(flagfile) ./debian/recognized-CPUID-flags-x86_64 # Supported machine versions are static for a given QEMU binary. $(destdir)/usr/bin/qemu-system-x86_64 -machine help | ./debian/parse-machines.pl > $(machine_file_x86_64) -- 2.47.3