From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from DUZPR83CU001.outbound.protection.outlook.com (mail-northeuropeazon11022138.outbound.protection.outlook.com [52.101.66.138]) by lore.virtuozzo.com (Postfix) with ESMTPS id 37CBE80E7E for ; Thu, 29 Oct 2026 13:30:55 +0000 (UTC) ARC-Seal: i=1; a=rsa-sha256; s=arcselector10001; d=microsoft.com; cv=none; b=mV2ohfNXYMWZc2h8nZ28T1LJkbA9raFc+0IlZI1XBvCMHuMpUghUSaem5WNN8zyaFDvSvuLTmiQi8MCnXE0E5DSG9TTdGdFz1X3Mwfy1nRAkSZ4sM5GmiGi7ttx3Vj0ARczlYZrugheOTrnrfmj67EJwpx4uYEdNL+vi0WgoYZ2GYUTWqg270y9SbsQ2OxCDEYzAqfdFDfvIK8eEJTxl0G9qADSNPFW3bwX6DKHRKSSRpE/IAW5JWiHCGk5DcZfblyJmcfLych8JelidYPWAN9vSJFO1hleM2hOhKa1LIe5tNh03gifYSQY+/f0caLcapAiwQiG0k/Xc/YCJqeJQKA== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=microsoft.com; s=arcselector10001; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-AntiSpam-MessageData-ChunkCount:X-MS-Exchange-AntiSpam-MessageData-0:X-MS-Exchange-AntiSpam-MessageData-1; bh=6rJMY95O2u6BpcEB0ieXJRCKEh4pPSjhCpQkQimH53E=; b=HXZ2irawqnLM1jD5+5WsPQtLJ3RciI0fO5emxlrZlJtOPsTyzXy52MqtK+/8keBsCYBqxWj1yN0y335tpdMcFbNzxWJvkAa37ONlxJYijC8/bsJhnWqNAFQMXUbwSqzFavykHmmwIkT5oCBf4rxV4bu8dRysIHQtzZIeO2DpUs89bD0W6vd7Oc3K1zjiycr/9CQGCwtkq6VQZwvy/n/NwoSUcTEDidukANArLgjO8/hUJ9GfEh4Azer7XJKmeX7onOgJNAhyQFz2WOThmcowN3qPxfdu8gmF+jFwfqATv8JbfPHjkjUJdfDCnaGaCUkog3tjuujJKFkOL/cCK2GKxQ== ARC-Authentication-Results: i=1; mx.microsoft.com 1; spf=pass smtp.mailfrom=virtuozzo.com; dmarc=pass action=none header.from=virtuozzo.com; dkim=pass header.d=virtuozzo.com; arc=none DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=virtuozzo.com; s=selector2; h=From:Date:Subject:Message-ID:Content-Type:MIME-Version:X-MS-Exchange-SenderADCheck; bh=6rJMY95O2u6BpcEB0ieXJRCKEh4pPSjhCpQkQimH53E=; b=ko0gzr9YM+1hSLirbwaMOkhqZoVhK3vki83DtHVUJf7JA2uoHM9y9hqchzz/HqIkBzp0JKrtF0SEbMfVExQct289JKsfKaxOK8zXqDK5+yvyJEhOlSQBSmSpQnLwhycZeHQC18jXR5eQos/Mlgd4HTTLQI8K0h01znEBtbS3Xzs8sTs7H8hCWD7kH82k1fIqNonuZw3DhSAQoz2Lke8gccrgFx4Iw4v1njImOoI5KiRDgzjr4Fb6qzQvCgwoIC3cIT+Z9PwDF2zc578UQ7Yr6M2UaEdOT1uB0+F7X/K9jLz4vt/+937DfkgtFz+k/H8BRupYa6942YLBY6VeJpO0qg== Authentication-Results: mx.microsoft.com 1; dkim=none (message not signed) header.d=none;dmarc=none action=none header.from=virtuozzo.com; Received: from DBBPR08MB10650.eurprd08.prod.outlook.com (2603:10a6:10:52d::7) by BR2PR08MB999862.eurprd08.prod.outlook.com (2603:10a6:2c8:9::16) with Microsoft SMTP Server (version=TLS1_2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id 15.21.569.9; Thu, 29 Oct 2026 13:30:52 +0000 Received: from DBBPR08MB10650.eurprd08.prod.outlook.com ([fe80::1b2a:832c:d136:a37c]) by DBBPR08MB10650.eurprd08.prod.outlook.com ([fe80::1b2a:832c:d136:a37c%3]) with mapi id 15.21.0569.007; Thu, 29 Oct 2026 13:30:52 +0000 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 8bit Subject: Re: [PATCH v3 hci-8.0/hci-8.1 0/6] i386: keep CPU features of guests from older nodes on vz machine types #VSTOR-152264 From: Andrey Drobyshev To: "Denis V. Lunev" Cc: andrey.zhadchenko@virtuozzo.com, svt-core@virtuozzo.com In-Reply-To: <20261029122527.365104-1-den@openvz.org> References: <20261029122527.365104-1-den@openvz.org> Date: Thu, 29 Oct 2026 15:30:47 +0200 Message-Id: <179328064793.774312.5097011755521614906.b4-review@b4> X-Mailer: b4 0.16.0 X-ClientProxiedBy: VI1PR06CA0158.eurprd06.prod.outlook.com (2603:10a6:803:c8::15) To DBBPR08MB10650.eurprd08.prod.outlook.com (2603:10a6:10:52d::7) MIME-Version: 1.0 X-MS-PublicTrafficType: Email X-MS-TrafficTypeDiagnostic: DBBPR08MB10650:EE_|BR2PR08MB999862:EE_ X-MS-Office365-Filtering-Correlation-Id: 3910bc37-e88c-4a9c-f8be-08df35c0da7e X-LD-Processed: 0bc7f26d-0264-416e-a6fc-8352af79c58f,ExtAddr List-Id: svt-core@virtuozzo.com X-MS-Exchange-Transport-Rules-Loop: 1 X-MS-Exchange-SenderADCheck: 1 X-MS-Exchange-AntiSpam-Relay: 0 X-Microsoft-Antispam: BCL:0;ARA:13230040|23010399003|376014|52116014|1800799024|366016|38350700014|5023799004|56012099006|261009223027099003|261026140227099003|261026121527099003|261026135527099003|261028144727099003|10067099003|261022105027099003|261021121427099003|261021123027099003|22082099003|18002099003|5113699003|6133799003; X-Microsoft-Antispam-Message-Info: YUpuCXTHOhK8kVQMVQHDSlpHg5OJ2LjD1qgrHn7R5gn9bBNL8tIWsFQHIQulaq/2qQBMsjretm0zbMzvmaCOnLc9w+HFAJmn41BNKgGB18eyKEVL+i4HFEN8xbVyh5DbDRe4FBQM/dmdPigJBaRqrIrIzl7fEbbHL7Em1l8r1hUXSNNBODXOt/vKedY+BXpi5/5t87I2r/RA8/HU3bf2M27FF9o44cXa6UrhIMzjw/ufvW/NZ8nrInVFzWypdVoxvlXukWYheZv97bCiTG2syLH/GwGjsO2Id6a9b+toa3XJYtMeQVgCeH5MNJBQg7BytBVYUbUvcrM42Rg7kLrwgN7KqNi3eQ0d8qMzn8AZ6JK6pvWWX/ek9nu2d9PFEAkDkE+OTMLv6q8HoLMMrdIB5xkF0Ox+Vh/xl6rv60wVGuYlCKmbmMJIUomDD5BmIuM2Q4U9tZtFBH16+U2kzmmiCtn8gxxILvh4tYOqS4sH9vRTepU0dRP6o9sl/3n8UIAKfu9F3frQWH7m9kZnFhuLhqHQy7Pc/gCmoSlIuPdKxaUw+o/ri/FusBKc1HlUtVoZS/uGilhnDKo5ROwCX5yd1nLvSZRzmPYQc4AA89X7w6YeGAh+7BjCTFH23U43yM0LOoDqj5a8ccctpT97tRnQ1XxDRprPcY105eovNDUNPWY= X-Forefront-Antispam-Report: CIP:255.255.255.255;CTRY:;LANG:en;SCL:1;SRV:;IPV:NLI;SFV:NSPM;H:DBBPR08MB10650.eurprd08.prod.outlook.com;PTR:;CAT:NONE;SFS:(13230040)(23010399003)(376014)(52116014)(1800799024)(366016)(38350700014)(5023799004)(56012099006)(261009223027099003)(261026140227099003)(261026121527099003)(261026135527099003)(261028144727099003)(10067099003)(261022105027099003)(261021121427099003)(261021123027099003)(22082099003)(18002099003)(5113699003)(6133799003);DIR:OUT;SFP:1102; X-MS-Exchange-AntiSpam-MessageData-ChunkCount: 1 X-MS-Exchange-AntiSpam-MessageData-0: =?utf-8?B?L3JIY3pQSmxLTkZhS1kreWZSd1J5MkVpM0ZmNEFWWm1xL0t5b2dqOEVqM2t0?= =?utf-8?B?SzgrK2JOU1R1VUE4alZjekd0VEZoZDBwWGhHRklEVytqVzdiMGdGMDNiVWdH?= =?utf-8?B?VFE3MzZDR2sxZjJpem4zazJpNjZ2dmp6NzRIdHdDV2pybVhWQnpNenBMT0ZP?= =?utf-8?B?azNjQWwrNjVNV2N5d3p0cWRJSEgyeklSTGpPcG53emN4NENLTU40UUR6Y3FB?= =?utf-8?B?QjJjVDNmNVhUR3YzeUpOdUtwZUhxRC9CQzVWOEs2TTJNbXo2azV2TG9RR1JV?= =?utf-8?B?bWdpR0lRL1d4YXZiQUFYMXdtV2pGbDZFbHhTWjYxdE81VkpMbGJ1aVN2WjJN?= =?utf-8?B?dDJWOFhvUG1kTXlGOUFMeUFTcm5aMCsvcER5SGR3S2FpVEw4TDZuaUlydGdF?= =?utf-8?B?dG9ucThVc2hLNFJTUXdwL0V5cVFjVCtTOWFLNFlvMmFYYlVVcXpXUmxkUG52?= =?utf-8?B?K29RdW1nRVU5bTBOaENwUGdBb2RKdEVUQVdITlprN2lobTg4UEgrUXFnRUUz?= =?utf-8?B?cXNYRnkwUWo4UG83L1Q3d3I5QVNCM2FUbXRXWU4wUDNmNUxaMDdqWURsYW5j?= =?utf-8?B?VnRZOUIxbW95aFpFRU94bXVjbjIrK21xYUxhaXV2K1ZhS0l0SGdFOGYwNTBK?= =?utf-8?B?b0JkUmxzZmFsVXFiQ3BVS2lYRVhpNVozRVJTYW85d01LS0xlR2JjTndpeGZB?= =?utf-8?B?eml0Q3RsbzY3a0xFd3B0d3dySXJRM0cwVW5oUENna1gxK2tLMjNqaDcwVndx?= =?utf-8?B?K244S29ZcmlLc01xcmY0M0gyS1dqa05JcDZ5eUZ0TUZIRGNucWFhei9vN2xu?= =?utf-8?B?cG4rVkFsTy9DNFZYenA3SEMwMGU2Q2ZUcnp1U2tvelVNTm9zRm9rNTVYZmZ4?= =?utf-8?B?RW9LWEc5MHo1YUt2bE5NYnMxMjFTd1FlOXNTYVptL3FKeU9VaERpNVEzMm5V?= =?utf-8?B?TmZxNjdSZ3VxWnd1WnJrOWNPUHdkY3JiOE1GOEwzUyswLzVtbDRJcFFtM0Y1?= =?utf-8?B?ZVdLVGVPR212TlR6Ym5YcGtSbzkwMVJDeHdhYkpNR0VDZ1lkSkxGV1hjOWJO?= =?utf-8?B?RWdIYTQzOU80aVVTdUZ6WnJyNUovbTFHRVlmWGN3bVFwWGVMRGlKQTRjbVNX?= =?utf-8?B?L1VQanE2dVI2RjVNREdlbnJSUHgvWVl4ekVpR01zblVMR3dJVDMxYUJBQjZM?= =?utf-8?B?L1VzNnYwYXZYRldGTnlseVBaN0tjSDdBSjRBWWlwU1NTQ3FDRnAwT3JGTFhF?= =?utf-8?B?dGJ4RWptVUJXTnBOUHV1YmNOQTRYRHQvOEhPMCtiM0VHWWtyVHF5K0RQOTZm?= =?utf-8?B?Uk9zZFNjbDJOcm45UzBUTjNzVzZUR2l5MERXeWEraWxDY3R5cXNNUVhoZCtj?= =?utf-8?B?WHk2bW9uN0M4MU9CN0dYdE9zWXpXTUNsL1RybUxzRWpFcXArdzA5N2xkSEYw?= =?utf-8?B?TkZvK2cwUlU1eWlNK0lVMmUwdEtPWC9ia2Z0eUJyWnBYd1lMNEExZDBiSFlz?= =?utf-8?B?R0ExQ1N6K1orak1kdGNzRjJQdzlaUDByWVB2WDNLZ1RRMUdOMHFQU3ZDZ28v?= =?utf-8?B?bFBCVnR6VlNRNzhCOEYrcGgvQ1RXV1BKOFBnMUJjR2h6R3NObldmSjA4bkVE?= =?utf-8?B?MTdka05CRXJIS2NCQ05SZDI4WU9mTWU5QTViY2x3R2tQU1hpRE9aTEhlRE1V?= =?utf-8?B?RkkxV3BUUXVnSTFLT1JraUxwRDRycDJmdFVwa2Q3R2N3MnplSmFpNGJoemNY?= =?utf-8?B?amRRUVNCWHgzaXF4Z0ZFYWZxM1BOZHlRdGo3TjRCaStZbU4yaTRGSGpsZjJP?= =?utf-8?B?L0prZENnYjh6NExpbEt6R2hrSko0THpSR25RVmVGMEFwK3FJZTBSUWNMYS9v?= =?utf-8?B?MmdIOUVUUFErNjYvZ0NOamtuY1FDaDk3YXhhRGNrcnJwMGRCTFVSRTRIRzY5?= =?utf-8?B?amMrMC9EamVHY0Z2cnVIOVlzSkduUlFsdERuZDkzUlI1TGJKUjBHWXZKMXZj?= =?utf-8?B?TWprUERXYzlVZStaRVczdnBNR0tKK1lNemZ0Rkx2WVl5dTBscFhPM09JNzVr?= =?utf-8?B?blpKZm9UZjhHQzRjeUJnNTd2RWE0Z24wbkx2c3JmeW1XV0lUODkwUTAyRklt?= =?utf-8?B?OXhlM1RFbGVtWmNnTHM0dUpjRWVPTnRQSzBlZjd1SElNbkNIQUFFcjBDaGNW?= =?utf-8?B?VytmYXhsekpkdFIzMGJaeUI2bUoxQXY0dkRsQ01kRjZseTdKSGNhU0RhR2F0?= =?utf-8?B?dmRxSS93a3ltYWEyLzVUY2VJUXRLZjEzVmZybHQ2cG05RFV4UEZLVzhoVncy?= =?utf-8?B?Y1IyUDBVdjRnOWpUcS90ZERnakhZUndqcUdZcUJDUmEwTkZRbUhuK2VJUTha?= =?utf-8?Q?r0SKjG6DZDVQfO4I=3D?= X-OriginatorOrg: virtuozzo.com X-MS-Exchange-CrossTenant-Network-Message-Id: 3910bc37-e88c-4a9c-f8be-08df35c0da7e X-MS-Exchange-CrossTenant-AuthSource: DBBPR08MB10650.eurprd08.prod.outlook.com X-MS-Exchange-CrossTenant-AuthAs: Internal X-MS-Exchange-CrossTenant-OriginalArrivalTime: 29 Oct 2026 13:30:52.7190 (UTC) X-MS-Exchange-CrossTenant-FromEntityHeader: Hosted X-MS-Exchange-CrossTenant-Id: 0bc7f26d-0264-416e-a6fc-8352af79c58f X-MS-Exchange-CrossTenant-MailboxType: HOSTED X-MS-Exchange-CrossTenant-UserPrincipalName: H47BDewvAABi/+l3MNfrVOoQdkDIoohFbHS9xOE8At3s1uOejdE6ik/leyhnnmY67sYFjMVczk9LoZf5kJGsH2z+kxycdtqpfZVp9tGvAGQ= X-MS-Exchange-Transport-CrossTenantHeadersStamped: BR2PR08MB999862 > A guest started on an older node can have a CPU feature that the > destination host no longer offers: TSX disabled by microcode, a newer > kernel that stops offering spec-ctrl or bus-lock-detect on AMD, or SVM > leaf features that QEMU 2.12 on Vz7 kept with svm off. QEMU filters the > feature on the destination, and libvirt refuses the live migration, > restore or snapshot revert: > > guest CPU doesn't match specification: missing features: hle,rtm > > The guest read its CPUID at boot, so the bit has to stay until the guest > restarts. > > Until now libvirt relaxed the check, in three places that behave > differently. One of them crashes libvirtd on the destination of any > migration of a host-passthrough VM with a vz7 machine type > (VSTOR-152247). This series keeps the bits in QEMU instead: one > x-...-compat X86CPU property per feature, all turned on by a new > pc_vz_9_2_compat on vz9.2.0 and every older vz machine type. Release > 7.x ships up to vz9.1.0, and vz9.2.0 is the last type based on a RHEL 9 > machine type. vz10.x types and -cpu host expansion stay strict. A > property keeps a bit only when the CPU model or the command line asks > for it and the condition in the commit message holds; KVM ignores > CPUID bits it does not support. > > Patch 1 lets a row of the vz machine type tables name a fourth compat > array, which the i440fx vz7.16.0 row needs. Patches 2 to 6 add one > property each: > > 2 hle, rtm PSBM-149402 (field: VSTOR-75689, > VSTOR-105458) > 3 spec-ctrl, AMD VSTOR-151770 > 4 bus-lock-detect, AMD VSTOR-152291 > 5 v-vmsave-vmload, AMD code review, nested guests on Zen 4 > client parts, no field report > 6 SVM leaf features, svm off PSBM-144630 > > The same patches apply to hci-8.0 and hci-8.1 without changes; the > base given below is hci-dev. On 8.0 they also fix the migration on > their own: hci-8.0 libvirt keeps its relaxations, and they no longer > see a filtered bit. That covers bus-lock-detect (VSTOR-152291), which > hci-8.0 libvirt does not relax. The vz7 CPU fixup there still runs on > migration (with the NULL check from VSTOR-152247) and forces npt and > nrip-save off, which the guest does not see, because leaf 0x8000000a > is hidden without svm. Only the destination needs the new qemu-kvm: > the compat acts when the incoming QEMU process starts. > > On hci-dev the libvirt side drops its relaxations and the qemu.d hooks > in libvirt.ovz pr/den-VSTOR-152247-drop-vz-cpu-relaxations. It needs > this series in qemu-kvm first. > > Testing: > - dev-cl04, EPYC 7443P: a saved guest whose migration cookie CPU was > rewritten to the shape of a Vz7 host-model guest > (svm=off,npt=on,nrip-save=on, plus spec-ctrl) fails to restore > without the series with "missing features: npt,nrip-save" and > "missing features: spec-ctrl". With it the guest restores, the > features stay on and filtered-features is empty. Stock 8.1 libvirt, > which carries the same relaxations as hci-8.0, restores it with no > warning as well. > - sqvm2-1015, Broadwell without TSX: the VSTOR-75689 guest CPU fails > with "missing features: hle,rtm" without the series and keeps hle > and rtm with it. > - sqvm2-1013 <-> sqvm2-1015, with the libvirt PR: live migration in > both directions of a pc-i440fx-vz7.12.0 host-passthrough guest and > of the VSTOR-75689 Broadwell-IBRS guest. No crash, no warning, > hle/rtm kept, the CPU stays match='exact'. Stock libvirt crashes on > the first of them. > - hci-8.0 and hci-8.1 builds: -cpu EPYC-Milan,svm=off,npt=on, > nrip-save=on,enforce and -cpu EPYC-Milan,spec-ctrl=on,enforce start > on vz7.12.0, vz9.0.0 and vz9.2.0 and are refused on vz10.x. A fresh > Broadwell-IBRS start with check='full' is refused on vz10.1.0. > - both builds, TCG: -cpu EPYC-Milan,svm=off warns about the same > features on vz9.2.0 as on vz10.0.0, none from leaf 0x8000000a. > - both builds, qtest-x86_64: ivshmem-test, test-hmp and qom-test fail > as on the base (qemu_ram_free assertion, isapc aborting at start). > - both builds, spec-ctrl on vz9.2.0 and vz7.16.0: EPYC-Milan with > spec-ctrl=on,enforce starts, also with only one of ibrs, amd-stibp > and amd-ssbd left; EPYC-IBPB, or EPYC-Milan without ibpb or without > all three, is refused. Everything is refused on vz10.1.0. > - bus-lock-detect and v-vmsave-vmload are build-tested only: no Zen 5 > or Zen 4 client host was available. > > Changes v2 -> v3: > - 3/6: keep spec-ctrl only when the guest also has the amd-* bits that > give it the MSRs, not only the host (Andrey) > - 2/6: pc_vz_9_2_compat first in the vz7.16.0 row (Andrey); TSX_CTRL > makes XBEGIN abort, not #UD, and libvirt check='partial' still > refuses a fresh start > - 5/6, 6/6: commit messages clarified > - R-b on 1/6, A-b on 2/6, 4/6, 5/6 and 6/6 > > Changes v1 -> v2: > - 6/6: keep SVM leaf features past the svm dependency under KVM only, > TCG warned about them > - 2/6, 6/6, cover: commit messages clarified after the Sashiko review > > v2: http://lore.virtuozzo.com/qemu/20261029113436.93521-1-den@openvz.org/ > v1: http://lore.virtuozzo.com/kernel/20261029095645.4173762-1-den@openvz.org/ > > Signed-off-by: Denis V. Lunev > > Denis V. Lunev (6): > i386/pc: raise the limit of compat arrays per Virtuozzo machine type > to four #VSTOR-152264 > i386: keep hle and rtm on Virtuozzo machine types up to vz9.2.0 > #PSBM-149402 > i386: keep spec-ctrl for AMD guests on vz machine types up to vz9.2.0 > #VSTOR-151770 > i386: keep bus-lock-detect for AMD guests on vz machine types up to > vz9.2.0 #VSTOR-152291 > i386: keep v-vmsave-vmload for nested AMD guests on vz types up to > vz9.2.0 #VSTOR-152264 > i386: keep SVM leaf features without svm on vz types up to vz9.2.0 > #PSBM-144630 > > hw/i386/pc.c | 9 ++++++ > hw/i386/pc_piix.c | 5 ++-- > hw/i386/pc_q35.c | 4 +-- > include/hw/i386/pc.h | 10 +++++-- > target/i386/cpu.c | 68 +++++++++++++++++++++++++++++++++++++++++++- > target/i386/cpu.h | 11 +++++++ > 6 files changed, 100 insertions(+), 7 deletions(-) Major: vz10.x AMD guests from 55.x-kernel nodes are left out (patch 3 / cover letter) - The SPEC_CTRL gate change (AMD_IBPB_RET required) entered vzkernel with the RHEL 10.1 import, commit 9f055df113432, first tag rh10-6.12.0-211.16.1..vz10. All earlier vz10 kernels (rh10-6.12.0-55..vz10) still advertise spec-ctrl on every AMD host with IBPB+IBRS, i.e. on Zen 1-3. - Release-kernel tags rk-6.12.0-55.52.1.5.28.vz10-v10.2 and rk-6.12.0-55.52.1.5.22.vz10-v10.3 show shipped 8.0 nodes ran 55.x. Host-model guests started there carry vz10.0.0/vz10.1.0 and spec-ctrl as require. - After such a node moves to a 211.x kernel those guests fail migration, restore and revert exactly as in VSTOR-151770, but pc_vz_9_2_compat does not apply to vz10.x. The libvirt kludge being reverted in PR 392 (d7e2f96f877f) covered every machine type, so the pair of series regresses this population relative to the kludge. - Fix: enable x-spec-ctrl-compat for vz10.0.0 and vz10.1.0 as well, with only the next new type strict, or keep the libvirt spec-ctrl kludge until then. The other four properties are fine at vz9.2.0: BLD and VMSAVE/VMLOAD changes are in every vz10 kernel, TSX is host-config, not kernel-version. Medium: tsx_compat has no host guard (patch 2) - kept = HLE|RTM whenever the vendor is Intel. The message says it "also covers Haswell parts with the TSX erratum" and that XBEGIN aborts. On HSW136-microcode parts and on silicon without TSX, XBEGIN raises #UD, so a guest that selected RTM paths at startup gets SIGILL. - Not a regression against the libvirt skip, which had the same hole, but the message overclaims. Guard suggestion: keep only when the host still has TSX silicon, i.e. ARCH_CAPABILITIES.TSX_CTRL, CPUID.7.EDX rtm-always-abort or tsx-force-abort, and never when host_tsx_broken(). Low: Hygon hosts excluded (patches 3, 4) - IS_AMD_CPU matches AuthenticAMD only. Dhyana (Zen 1) hosts lose spec-ctrl on 211.x the same way and get nothing from the series. Add the HygonGenuine vendor check if Hygon is in the fleet. Low: bus-lock-detect kept bit on 211.x (patch 4) - svm_set_msr rejects any DEBUGCTL bit but LBR (DEBUGCTL_RESERVED_BITS = ~DEBUGCTLMSR_LBR), so a rebooted guest enabling BLD gets #GP and one "unchecked MSR access error" splat. A migrated guest loses BLD silently since QEMU does not migrate DEBUGCTL. Cosmetic, worth a sentence in the message. -- Andrey Drobyshev