[PATCH v2 hci-8.0/hci-8.1 2/6] i386: keep hle and rtm on Virtuozzo machine types up to vz9.2.0 #PSBM-149402

["Denis V. Lunev" <den@openvz.org>]

From: Denis V. Lunev <den@openvz.org>

Intel microcode updates for TAA disable TSX, and a host may also boot
with tsx=off. KVM then stops offering hle and rtm, QEMU filters them,
and a guest started with TSX can no longer be migrated, restored or
reverted to a snapshot on that host: libvirt rejects the filtered
features (VSTOR-75689, VSTOR-105458). The guest read its CPUID at
boot, so the bits have to stay until it is restarted.

Add x-tsx-compat: hle and rtm requested by an Intel CPU model or on
the command line are then not filtered, and KVM gets them in the guest
CPUID, ignoring bits it does not support. This also covers Haswell
parts with the TSX erratum, where QEMU drops the bits itself and the
erratum microcode disables TSX. With TSX disabled by microcode XBEGIN
aborts and HLE prefixes are ignored, so a guest that keeps using TSX
falls back to its lock path. Where TSX_CTRL disables TSX instead,
XBEGIN raises #UD, as it does with the libvirt relaxation this
replaces.

As a machine type property it also applies when such a guest is booted
afresh: it gets the CPUID it had on the older node, not a filtered one.
Limiting it to -incoming would make the CPUID depend on how the process
was started, and a cold boot with libvirt check='full' would fail on a
host without TSX. A guest that migrated in already runs with the bits,
so the cold boot adds no new failure mode. The kept bits are not
reported as filtered, so check and enforce stay silent for them.

pc_vz_9_2_compat turns it on for vz9.2.0 and every older vz machine
type. Release 7.x ships up to vz9.1.0, and vz9.2.0 is the last type
based on a RHEL 9 machine type, before the QEMU 10 based vz10.x types.
vz10.x types and -cpu host expansion stay strict.

Signed-off-by: Denis V. Lunev <den@openvz.org>
---
 hw/i386/pc.c         |  5 +++++
 hw/i386/pc_piix.c    |  3 ++-
 hw/i386/pc_q35.c     |  2 +-
 include/hw/i386/pc.h |  3 +++
 target/i386/cpu.c    | 27 ++++++++++++++++++++++++++-
 target/i386/cpu.h    |  7 +++++++
 6 files changed, 44 insertions(+), 3 deletions(-)

diff --git a/hw/i386/pc.c b/hw/i386/pc.c
index 76289b86c28..25b17866103 100644
--- a/hw/i386/pc.c
+++ b/hw/i386/pc.c
@@ -548,6 +548,11 @@ GlobalProperty pc_vz_compat[] = {
 };
 const size_t pc_vz_compat_len = G_N_ELEMENTS(pc_vz_compat);
 
+GlobalProperty pc_vz_9_2_compat[] = {
+    { TYPE_X86_CPU, "x-tsx-compat", "on" },
+};
+const size_t pc_vz_9_2_compat_len = G_N_ELEMENTS(pc_vz_9_2_compat);
+
 GlobalProperty pc_vz_7_16_compat[] = {
     { TYPE_X86_CPU, "kvm-pv-ipi", "off" },
     { TYPE_X86_CPU, "kvm-pv-tlb-flush", "off" },
diff --git a/hw/i386/pc_piix.c b/hw/i386/pc_piix.c
index 1a50c2a645c..5be7c2ab967 100644
--- a/hw/i386/pc_piix.c
+++ b/hw/i386/pc_piix.c
@@ -1060,7 +1060,8 @@ DEFINE_I440FX_RHEL_MACHINE(7, 2, 0);
     X(10, 0, 0, MT_VER_SYM(10, 0, 0), false)                                \
     X(7, 16, 0, MT_VER_SYM(7, 6, 0),  false, hw_compat_vz_9_1,              \
                                              hw_compat_vz_7_16,             \
-                                             pc_vz_7_16_compat)             \
+                                             pc_vz_7_16_compat,             \
+                                             pc_vz_9_2_compat)              \
     X(7, 12, 0, MT_VER_SYM(7, 6, 0),  false, hw_compat_vz_7_12)             \
     X(7, 10, 0, MT_VER_SYM(7, 6, 0),  false, hw_compat_vz_7_10)             \
     X(7, 8,  0, MT_VER_SYM(7, 5, 0),  false)                                \
diff --git a/hw/i386/pc_q35.c b/hw/i386/pc_q35.c
index 2f4a14b4e01..019239bec6a 100644
--- a/hw/i386/pc_q35.c
+++ b/hw/i386/pc_q35.c
@@ -974,7 +974,7 @@ DEFINE_Q35_RHEL_MACHINE(7, 3, 0);
 #define VZ_Q35_MT(X)                                                        \
     X(10, 1, 0, MT_VER_SYM(10, 2, 0), true)                                 \
     X(10, 0, 0, MT_VER_SYM(10, 0, 0), false)                                \
-    X(9, 2,  0, MT_VER_SYM(9, 6, 0),  false)                                \
+    X(9, 2,  0, MT_VER_SYM(9, 6, 0),  false, pc_vz_9_2_compat)              \
     X(9, 1,  0, MT_VER_SYM(9, 4, 0),  false, hw_compat_vz_9_1)              \
     X(9, 0,  0, MT_VER_SYM(9, 2, 0),  false)                                \
     X(7, 16, 0, MT_VER_SYM(7, 6, 0),  false, hw_compat_vz_7_16,             \
diff --git a/include/hw/i386/pc.h b/include/hw/i386/pc.h
index 4d8a01528b8..bd73426644e 100644
--- a/include/hw/i386/pc.h
+++ b/include/hw/i386/pc.h
@@ -364,6 +364,9 @@ extern const size_t pc_rhel_7_2_compat_len;
 extern GlobalProperty pc_vz_compat[];
 extern const size_t pc_vz_compat_len;
 
+extern GlobalProperty pc_vz_9_2_compat[];
+extern const size_t pc_vz_9_2_compat_len;
+
 extern GlobalProperty pc_vz_7_16_compat[];
 extern const size_t pc_vz_7_16_compat_len;
 
diff --git a/target/i386/cpu.c b/target/i386/cpu.c
index 5310d68443b..5ff5644dee9 100644
--- a/target/i386/cpu.c
+++ b/target/i386/cpu.c
@@ -9100,6 +9100,29 @@ void x86_cpu_expand_features(X86CPU *cpu, Error **errp)
     }
 }
 
+/* Requested features that a vz compat property keeps despite the host */
+static uint64_t x86_cpu_compat_kept_features(X86CPU *cpu, FeatureWord w)
+{
+    CPUX86State *env = &cpu->env;
+    uint64_t kept = 0;
+
+    if (!kvm_enabled()) {
+        return 0;
+    }
+
+    switch (w) {
+    case FEAT_7_0_EBX:
+        if (cpu->tsx_compat && IS_INTEL_CPU(env)) {
+            kept = CPUID_7_0_EBX_HLE | CPUID_7_0_EBX_RTM;
+        }
+        break;
+    default:
+        break;
+    }
+
+    return kept & env->features[w];
+}
+
 /*
  * Finishes initialization of CPUID data, filters CPU feature
  * words based on host availability of each feature.
@@ -9126,7 +9149,8 @@ static bool x86_cpu_filter_features(X86CPU *cpu, bool verbose)
         uint64_t host_feat =
             x86_cpu_get_supported_feature_word(NULL, w);
         uint64_t requested_features = env->features[w];
-        uint64_t unavailable_features = requested_features & ~host_feat;
+        uint64_t unavailable_features = requested_features & ~host_feat &
+            ~x86_cpu_compat_kept_features(cpu, w);
         mark_unavailable_features(cpu, w, unavailable_features, prefix);
     }
 
@@ -10056,6 +10080,7 @@ static const Property x86_cpu_properties[] = {
                      arch_cap_always_on, false),
     DEFINE_PROP_BOOL("x-pdcm-on-even-without-pmu", X86CPU,
                      pdcm_on_even_without_pmu, false),
+    DEFINE_PROP_BOOL("x-tsx-compat", X86CPU, tsx_compat, false),
 };
 
 #ifndef CONFIG_USER_ONLY
diff --git a/target/i386/cpu.h b/target/i386/cpu.h
index 07b7a9417b1..85efd0b9fbe 100644
--- a/target/i386/cpu.h
+++ b/target/i386/cpu.h
@@ -2331,6 +2331,13 @@ struct ArchCPU {
      */
     bool pdcm_on_even_without_pmu;
 
+    /*
+     * Virtuozzo machine types up to vz9.2.0: do not filter requested
+     * features the host no longer provides, so that a guest started on an
+     * older node keeps its CPUID.
+     */
+    bool tsx_compat;
+
     /* Number of physical address bits supported */
     uint32_t phys_bits;
 
-- 
2.53.0