From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: <010701a18774cc0a-036cec86-68a7-4b14-a829-b85dc4185f17-000000@eu-central-1.amazonses.com> Received: from AS8PR04CU009.outbound.protection.outlook.com (mail-westeuropeazon11021102.outbound.protection.outlook.com [52.101.70.102]) by lore.virtuozzo.com (Postfix) with ESMTPS id 20DCF80E7E for ; Thu, 29 Oct 2026 11:39:06 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=QJP6XfYcPSKXzIVCj0t2jl8nSP/cJk8VGpr6YzWA/zA+F7xaHKAYC+4a16PeFjpyq1gH9vV7bMx6aBeiJR/rbTcg/mW38n3fCOlAJtVXSwgsWPtwNmecADQcsvulpNbplvxf9PoQ47cQJaDmrZ+sDVGNkhsoZEEQNA60YV/1M0edS4W5/6d8pf7HeVKpSbxQ6i9A7EN4i5vp2Zy46LWOaIgSNRjRWWK2d2iNloR9iATVTozSE1O7r3i02/cZVD+70iHu3wt1+EKEl+XKfHLlHUVI+VIVyVDBKVIZCmSVOBvqPrC+M4Q35UnNHcGkDLcOF0TUnKtceVfCEEddQE5aIg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=OFQLLV3Z5w/L1LCX7iOuOrS5MvEpm+cDZw3IC+3uNRU=; b=VlqZP78wUYrB+9+q/eTaMz4Uzl4FSiuhcYNplbJSxz+vvkA2GYIlL8/yBDuRQXg4+AcejxymxW5Bhs7XQgUlHoTHZJLvXqPphvKQdz3LXlfzUZcqQMMxQL09prkotigUMXshDNgzfsTC8yo51o/r56PerTfyejM0SIeEo79vMwK0lAZzR5REEY835NsBmScdZVb2TbEAJLG3HcVC8TiEFj7MZqn7mfq2YEc6+1Vy+1kBue0w8hASzXCgWeydF0WHUxJUAZnYLXkjucf1buili+74inz3Wn+H9UboasLK63YX3IpLqqLQBNM3W53iyrLYscMc30+fO7NWCduwxEi5OA== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass (sender ip is 69.169.224.5) smtp.rcpttodomain=virtuozzo.com smtp.mailfrom=eu-central-1.amazonses.com; dmarc=pass (p=quarantine sp=quarantine pct=100) action=none header.from=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com; dkim=pass (signature was verified) header.d=amazonses.com; arc=none (0) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.onmicrosoft.com; s=selector2-virtuozzo-onmicrosoft-com; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=OFQLLV3Z5w/L1LCX7iOuOrS5MvEpm+cDZw3IC+3uNRU=; b=ovi0XQ3BBPvyOGQbR5j9UnAx33OxtRw8HEY0cife3+3mA0Xlj/ZmQsbGmwf5KkcKclaGc/TzLQ8j9Wu0l+OQevT/f/hLwngkwdr/rjQx36n6Vb1qoHOw96zaMHXZlEOqlQwaeN84UbZp/Eqs/8B+Ad5xBTb0fpgG9pXqazys5D8= Received: from DU6P191CA0001.EURP191.PROD.OUTLOOK.COM (2603:10a6:10:540::11) by MA9PR08MB532528.eurprd08.prod.outlook.com (2603:10a6:250:105::5) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Thu, 29 Oct 2026 11:39:02 +0000 Received: from DU2PEPF00028CFE.eurprd03.prod.outlook.com (2603:10a6:10:540:cafe::1f) by DU6P191CA0001.outlook.office365.com (2603:10a6:10:540::11) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.546.25 via Frontend Transport; Thu, 29 Oct 2026 11:39:01 +0000 Authentication-Results: mx.microsoft.com 1; spf=pass (sender IP is 69.169.224.5) smtp.mailfrom=eu-central-1.amazonses.com; dkim=pass (signature was verified) header.d=sashiko.virtuozzo.com;dkim=pass (signature was verified) header.d=amazonses.com;dmarc=pass action=none header.from=sashiko.virtuozzo.com; Received-SPF: Pass (protection.outlook.com: domain of eu-central-1.amazonses.com designates 69.169.224.5 as permitted sender) receiver=protection.outlook.com; client-ip=69.169.224.5; helo=b224-5.smtp-out.eu-central-1.amazonses.com; pr=C Received: from b224-5.smtp-out.eu-central-1.amazonses.com (69.169.224.5) by DU2PEPF00028CFE.mail.protection.outlook.com (10.167.242.182) with Microsoft SMTP Server (version=TLS1_3, cipher=TLS_AES_256_GCM_SHA384) id 15.21.569.4 via Frontend Transport; Thu, 29 Oct 2026 11:39:01 +0000 DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=23yjbh4k34hwzfubhuiim7m4inbd3ick; d=sashiko.virtuozzo.com; t=1793273941; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date; bh=nbCCAbFnL0cYT4X0Lmz3FwSgl9cQeFR5Aou8D2FDi1s=; b=fi89LE2k3VWl3dqBIlIWcOKcl0E1YJNmO8Idn4d0jUcYka863rV1kncO+y19e+ZC I9JduSIOF6K2wzNV9n1ZFZ921CgWZk0cg9L87CmWdJBv4iWx4NqPWSFcjHfU/5mO99a nVKSLlS2eOiH8CXX1mfKXZpO6v4xVa4MGjkckLkBz88rmVyhyvkYYS/OgDSNbcVCw+Z xLl0MSP4tsTuC7mGGp/t7J7gAPo8v8eopmft7YR6fbckfZJcfxBeGWlWj+Ln6INqpVF tXq+SRbW3EtqB511gMZFZJfZGhITe3oQPAzhE1U2GS92PRjzy6DbF04MPmg07z28nXQ RohxT6I4YA== DKIM-Signature: v=1; a=rsa-sha256; q=dns/txt; c=relaxed/simple; s=qftdzk2dqsatjnlrq4r5brjbihpfcrsh; d=amazonses.com; t=1793273941; h=Message-ID:From:Subject:To:Cc:In-Reply-To:References:Content-Type:Content-Transfer-Encoding:Date:Feedback-ID; bh=nbCCAbFnL0cYT4X0Lmz3FwSgl9cQeFR5Aou8D2FDi1s=; b=kp4hj83SIDLPGB8f/Alv6/uZ9oQoaDauocOayEoLRrB3LeUWpfNITmxqUo6rCJcM iz91OgYdWCUPnvLcR91/bqXdKhDIubTJ+nvv6UjmLwpeN82qYvJ00OYmDmPD9FDrxMJ LC0IIVekrtfSpWZ90Pv81r8+BRV0lOAgZrHPn1Bs= Message-ID: <010701a18774cc0a-036cec86-68a7-4b14-a829-b85dc4185f17-000000@eu-central-1.amazonses.com> From: no-reply@sashiko.virtuozzo.com Subject: Re: [PATCH v2 hci-8.0/hci-8.1 3/6] i386: keep spec-ctrl for AMD guests on vz machine types up to vz9.2.0 #VSTOR-151770 To: "Denis V. Lunev" , andrey.zhadchenko@virtuozzo.com Cc: den@openvz.org, khorenko@virtuozzo.com, svt-core@virtuozzo.com In-Reply-To: <20261029113436.93521-4-den@openvz.org> References: <20261029113436.93521-1-den@openvz.org> <20261029113436.93521-4-den@openvz.org> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: quoted-printable Date: Thu, 29 Oct 2026 11:39:01 +0000 Feedback-ID: ::1.eu-central-1.2wRQJBpg9g1fGRYexx3dUuYGS25Bux+2TEOx72/m6U4=:AmazonSES X-SES-Outgoing: 2026.10.29-69.169.224.5 X-EOPAttributedMessage: 0 X-EOPTenantAttributedMessage: 0bc7f26d-0264-416e-a6fc-8352af79c58f:0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DU2PEPF00028CFE:EE_|MA9PR08MB532528:EE_ MIME-Version: 1.0 X-MS-Office365-Filtering-Correlation-Id: 1cee40d4-24ad-41cc-4e95-08df35b13a7a X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr X-MS-Exchange-AtpMessageProperties: SA List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|704161411799003|376014|48200799018|61400799027|9140799003|32142699015|5023799004|4143699003|56012099006|5063699009|261009223027099003|261026135527099003|261026121527099003|261026140227099003|261028144727099003|261022105027099003|261021121427099003|261021123027099003|10067099003|55112099003|16102099003|22082099003|18002099003|5113699003|4113699003|13003099007; X-Microsoft-Antispam-Message-Info: j2oL0LUH6xGoRogS/UAmpceeH6a5Bzu16K8v2+JU4wJfsQzUxv23R6viEGiwqp2Z04nv2/7V4uPpKRetYl1y1oqzZFcNH0ZnXpF7GQrFttFYgeuS1lVJsYl04i28Jhq2C6ap+gyZlD/5RlljbqUNhZ+LSQ+i6JGoEGeyw8fGeWmhWCO4G9kKhtC+4+FgTEAsuwEH+bk7NkaNkXDS1k2xfNc+hZJmMMWWn8awuya9ofmHFELFYldIPrcrT8S9k5+KUaNPHQ1v4TtiV7xv/UR1M4SAf6CO8dg34zNqVFaGbty2DcWVcWE+7jOYBiwB8q7t+3OMa58FBhlsGtmAyoDg6IwuFYKE4tLCqfh6YZB/HVcWB8tizgXAioeXnPkri7pcPrTFp62MYmQZ7+jpJp5McrSnn8Pq/9ldWAEVgZmIOCHxXByWTk9peKVamSrnf88xENs9BkUF6L6Jaq32XSQCLW9DFLk6nQxmh7p2m38JK8f/GKpcEn1TveN+zx4BtX/uMZpieuneMwc7f6xUWYdSG8V1uH8ufXCzVSbPEpCcHVvb5vnR2r8J037/tikclRFETv0kkj5ROsd/BueDXWrl+QxwzBBiLhdgaNQzhEayM553qNRRW3Z5Jxb4pqW24PBFzD6d97+x3hPeKgGiigHVOsn3+7Xgw2ao/GTEkEkZcfagElD76Nz7WfSKi8D4r8iHyK+W+Qcz2mYb2lZ8gyZ/kyAhZXDSsD83OnXfN3Btvwcm2rIWroqpYDKFIXa8W+q47JDQ4Ch+/cyZWRxsqYxa0XyFMWjTzSn7rRLH5T+E90zMpnfHQzciIz37Ub2w38h44x8UpBJb+jLf8p+cV1BFbQ9CUf1mPJ6j9LKXTq+8LZ4C8s/AqRS47eGyWEBdGVbw7JsdMlZh5m5azJAN4JFAfQ== X-Forefront-Antispam-Report: CIP:69.169.224.5;CTRY:US;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:b224-5.smtp-out.eu-central-1.amazonses.com;PTR:b224-5.smtp-out.eu-central-1.amazonses.com;CAT:NONE;SFS:(13230040)(704161411799003)(376014)(48200799018)(61400799027)(9140799003)(32142699015)(5023799004)(4143699003)(56012099006)(5063699009)(261009223027099003)(261026135527099003)(261026121527099003)(261026140227099003)(261028144727099003)(261022105027099003)(261021121427099003)(261021123027099003)(10067099003)(55112099003)(16102099003)(22082099003)(18002099003)(5113699003)(4113699003)(13003099007);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: ug+KY+w8OHdpfeK0gOSLs8G4DXBwNVWisseM4ovkoQXwObXEEMXMkyry1xJCsoUGUVBba0OKhzx6mCDMaq+ZctOSlhHF+8vHJSOoZcjkhAh7mVZF/nxmUFabRG9zvsTkobC6/vEvD9ZFehZLTmFq8CD9AtxYZRbO/EwsmqRH/8/xquWaakaTDHzUcOV8+IJfq/GEK1RYwuyL1SVFRBTblqmiFtHKBG9PZo983/Zbcx8Q3U2SzlxtLLNgcM3VcE7yQj0KSgrdLXDEPV+fSdzEkVuGxiSEXDUFDG9bVNzfTgQCWFNQQhw/IXnV8fUUYqkDYIOG6YUE9oSKjg5+2QL3110JT5f+mZeZtTcfQ6bUeAx+l5JaNL8fPuq5XV7j52wIqd69esYVlwmtR6H/40JaiMafP9ln6GBnMfJQrX9HfzxF6g36HyP73ViFl9f/fBmE X-ExternalRecipientOutboundConnectors: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Oct 2026 11:39:01.5615 (UTC) X-MS-Exchange-CrossTenant-Network-Message-Id: 1cee40d4-24ad-41cc-4e95-08df35b13a7a X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-AuthSource: DU2PEPF00028CFE.eurprd03.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Anonymous X-MS-Exchange-CrossTenant-FromEntityHeader: Internet X-MS-Exchange-Transport-CrossTenantHeadersStamped: MA9PR08MB532528 Thank you for your contribution! Sashiko AI review found 3 potential issue(= s) to consider: - [Medium] i386: spec-ctrl compat checks host AMD bits, not the guest's own= AMD bits - [Low] i386: spec_ctrl_compat field sits under the TSX-only comment with n= o doc - [Low] i386: spec-ctrl compat keyed on guest vendor, not covering Intel mo= dels on AMD hosts -- commit 345ccab3ac1f9c86d5966e00d0e21318a3f7dff4 Author: Denis V. Lunev i386: keep spec-ctrl for AMD guests on vz machine types up to vz9.2.0 This patch adds the x-spec-ctrl-compat CPU property and enables it in pc_vz_9_2_compat. When it is set, an AMD guest keeps a requested spec-ctrl if the host reports amd-ibpb and one of amd-ibrs, amd-stibp or amd-ssbd. This avoids spec-ctrl being filtered on hosts where KVM no longer offers it without IBPB_RET. > diff --git a/target/i386/cpu.c b/target/i386/cpu.c > --- a/target/i386/cpu.c > +++ b/target/i386/cpu.c [ ... ] > @@ -9116,6 +9116,19 @@ static uint64_t x86_cpu_compat_kept_features(X86CP= U *cpu, FeatureWord w) > kept =3D CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_RTM; > } > break; > + case FEAT_7_0_EDX: > + if (cpu->spec_ctrl_compat && IS_AMD_CPU(env)) { > + uint32_t ebx =3D kvm_arch_get_supported_cpuid(kvm_state, 0x8= 0000008, > + 0, R_EBX); > + > + if ((ebx & CPUID_8000_0008_EBX_IBPB) && > + (ebx & (CPUID_8000_0008_EBX_IBRS | > + CPUID_8000_0008_EBX_STIBP | > + CPUID_8000_0008_EBX_AMD_SSBD))) { > + kept =3D CPUID_7_0_EDX_SPEC_CTRL; [Severity: Medium] Can spec-ctrl be kept for a guest that does not itself carry the AMD bits? The condition in x86_cpu_compat_kept_features() reads only the host-supported bits from kvm_arch_get_supported_cpuid() for 0x80000008 EBX. It never looks at env->features[FEAT_8000_0008_EBX]. In x86_cpu_filter_features() the guest's FEAT_8000_0008_EBX is filtered independently, and the kept bit bypasses the host-support filter: uint64_t unavailable_features =3D requested_features & ~host_feat & ~x86_cpu_compat_kept_features(cpu, w); A guest with x-spec-ctrl-compat=3Don and spec-ctrl requested, but lacking amd-ibpb or all of amd-ibrs, amd-stibp and amd-ssbd, could keep spec-ctrl in CPUID. KVM might then leave MSR_IA32_SPEC_CTRL or MSR_IA32_PRED_CMD unavailable to that guest, so a guest wrmsr would take #GP. This relies on the KVM behaviour described in the cited kernel commits, which I could not verify in this tree. Should the check also test the guest's own FEAT_8000_0008_EBX bits? The later patches in the series do not change this case. > + } > + } > + break; [Severity: Low] Is the IS_AMD_CPU(env) gate too narrow? It tests the guest CPUID vendor, not the host vendor. For an Intel-vendor guest model on an AMD host, kept stays 0 in x86_cpu_compat_kept_features(), so x86_cpu_filter_features() still marks spec-ctrl unavailable: uint64_t unavailable_features =3D requested_features & ~host_feat & ~x86_cpu_compat_kept_features(cpu, w); The existing Intel models set CPUID_7_0_EDX_SPEC_CTRL, and nothing in this tree forces the guest vendor to match the host vendor. Such a guest would hit the same migration, restore and snapshot revert failure described in the commit message. Is it intended that Hygon guests and Intel-vendor models on AMD hosts are left out? The series-final state keeps the same IS_AMD_CPU(env) gate. [ ... ] > diff --git a/target/i386/cpu.h b/target/i386/cpu.h > --- a/target/i386/cpu.h > +++ b/target/i386/cpu.h > @@ -2337,6 +2337,7 @@ struct ArchCPU { > * older node keeps its CPUID. > */ > bool tsx_compat; > + bool spec_ctrl_compat; [Severity: Low] This isn't a bug, but the new spec_ctrl_compat field is placed directly under the comment that describes tsx_compat, so that comment appears to cover it as well. Could it get its own comment describing the AMD spec-ctrl behaviour? > =20 > /* Number of physical address bits supported */ > uint32_t phys_bits; --=20 Sashiko AI review =C2=B7 https://sashiko.vzint.dev/#/patchset/2026102911343= 6.93521-1-den@openvz.org?part=3D3