CPU models past gen16a will no longer support the csske feature. In order to secure migration of guests running on machines that still support this feature to machines that do not, let's disable csske in the host-model.

On 11.03.22 10:17, Daniel P. Berrangé wrote: > On Thu, Mar 10, 2022 at 11:17:38PM -0500, Collin Walling wrote: >> CPU models past gen16a will no longer support the csske feature. In >> order to secure migration of guests running on machines that still >> support this feature to machines that do not, let's disable csske >> in the host-model. Sorry to say, removing CPU features is a no-go when wanting to guarantee forward migration without taking care about CPU model details manually and simply using the host model. Self-made HW vendor problem.

> > The problem scenario you describe is the intended semantics of > host-model though. It enables all features available in the host > that you launched on. It lets you live migrate to a target host > with the same, or a greater number of features. If the target has > a greater number of features, it should restrict the VM to the > subset of features that were present on the original source CPU. > If the target has fewer features, then you simply can't live > migrate a VM using host-model. > > To get live migration in both directions across CPUs with differing > featuresets, then the VM needs to be configured with a named CPU > model that is a subset of both, rather than host-model. Right, and cpu-model-baseline does that job for you if you're lazy to lookup the proper model.

On 11.03.22 13:12, Christian Borntraeger wrote: > > > Am 11.03.22 um 10:23 schrieb David Hildenbrand: >> On 11.03.22 10:17, Daniel P. Berrangé wrote: >>> On Thu, Mar 10, 2022 at 11:17:38PM -0500, Collin Walling wrote: >>>> CPU models past gen16a will no longer support the csske feature. In >>>> order to secure migration of guests running on machines that still >>>> support this feature to machines that do not, let's disable csske >>>> in the host-model. >> >> Sorry to say, removing CPU features is a no-go when wanting to guarantee >> forward migration without taking care about CPU model details manually >> and simply using the host model. Self-made HW vendor problem. > > And this simply does not reflect reality. Intel and Power have removed TX > for example. We can now sit back and please ourselves how we live in our > world of dreams. Or we can try to define an interface that deals with > reality and actually solves problems. > Ehm, so, I spell out the obvious and get such a reaction? Okay, thank you.

Am 11.03.22 um 10:23 schrieb David Hildenbrand: > On 11.03.22 10:17, Daniel P. Berrangé wrote: > > On Thu, Mar 10, 2022 at 11:17:38PM -0500, Collin Walling wrote: > > > CPU models past gen16a will no longer support the csske feature. In > > > order to secure migration of guests running on machines that still > > > support this feature to machines that do not, let's disable csske > > > in the host-model. > > Sorry to say, removing CPU features is a no-go when wanting to guarantee > forward migration without taking care about CPU model details manually > and simply using the host model. Self-made HW vendor problem. And this simply does not reflect reality. Intel and Power have removed TX for example. We can now sit back and please ourselves how we live in our world of dreams. Or we can try to define an interface that deals with reality and actually solves problems.

> > The problem scenario you describe is the intended semantics of > > host-model though. It enables all features available in the host > > that you launched on. It lets you live migrate to a target host > > with the same, or a greater number of features. If the target has > > a greater number of features, it should restrict the VM to the > > subset of features that were present on the original source CPU. > > If the target has fewer features, then you simply can't live > > migrate a VM using host-model. > > > > To get live migration in both directions across CPUs with differing > > featuresets, then the VM needs to be configured with a named CPU > > model that is a subset of both, rather than host-model. > > Right, and cpu-model-baseline does that job for you if you're lazy to > lookup the proper model. Yes baseline will work, but this requires tooling like openstack. The normal user will just use the default and this is host-model. Let me explain the usecase for this feature. Migration between different versins baseline: always works host-passthrough: you get what you deserve default model: works We have disabled CSSKE from our default models (-cpu gen15a will not present csske). So that works as well. host-model: Also works for all machines that have csske. Now: Lets say gen17 will no longer support this. That means that we can not migrate host-model from gen16 or gen15 because those will have csske. What options do we have? If we disable csske in the host capabilities that would mean that a host compare against an xml from an older QEMU would fail (even if you move from gen14 to gen14). So this is not a good option. By disabling deprecated features ONLY for the _initial_ expansion of model-model, but keeping it in the host capabilities you can migrate existing guests (with the feature) as we only disable in the expansion, but manually asking for it still works. AND it will allow to move this instantiation of the guest to future machines without the feature. Basically everything works.

On Fri, Mar 11, 2022 at 12:37:46PM +0000, Daniel P. Berrangé wrote: > On Fri, Mar 11, 2022 at 01:12:35PM +0100, Christian Borntraeger wrote: >> >> >> Am 11.03.22 um 10:23 schrieb David Hildenbrand: >>> On 11.03.22 10:17, Daniel P. Berrangé wrote: >>>> On Thu, Mar 10, 2022 at 11:17:38PM -0500, Collin Walling wrote: >>>>> CPU models past gen16a will no longer support the csske feature. In >>>>> order to secure migration of guests running on machines that still >>>>> support this feature to machines that do not, let's disable csske >>>>> in the host-model. >>> >>> Sorry to say, removing CPU features is a no-go when wanting to guarantee >>> forward migration without taking care about CPU model details manually >>> and simply using the host model. Self-made HW vendor problem. >> >> And this simply does not reflect reality. Intel and Power have removed TX >> for example. We can now sit back and please ourselves how we live in our >> world of dreams. Or we can try to define an interface that deals with >> reality and actually solves problems. > > This proposal wouldn't have helped in the case of Intel removing > TSX, because it was removed without prior warning in the middle > of the product lifecycle. At that time there were already millions > of VMs in existance using the removed feature. > >>>> The problem scenario you describe is the intended semantics of >>>> host-model though. It enables all features available in the host >>>> that you launched on. It lets you live migrate to a target host >>>> with the same, or a greater number of features. If the target has >>>> a greater number of features, it should restrict the VM to the >>>> subset of features that were present on the original source CPU. >>>> If the target has fewer features, then you simply can't live >>>> migrate a VM using host-model. >>>> >>>> To get live migration in both directions across CPUs with differing >>>> featuresets, then the VM needs to be configured with a named CPU >>>> model that is a subset of both, rather than host-model. >>> >>> Right, and cpu-model-baseline does that job for you if you're lazy to >>> lookup the proper model. >> >> Yes baseline will work, but this requires tooling like openstack. The normal >> user will just use the default and this is host-model. >> >> Let me explain the usecase for this feature. Migration between different versins >> baseline: always works >> host-passthrough: you get what you deserve >> default model: works >> We have disabled CSSKE from our default models (-cpu gen15a will not present csske). >> So that works as well. >> host-model: Also works for all machines that have csske. >> Now: Lets say gen17 will no longer support this. That means that we can not migrate >> host-model from gen16 or gen15 because those will have csske. >> What options do we have? If we disable csske in the host capabilities that would mean >> that a host compare against an xml from an older QEMU would fail (even if you move >> from gen14 to gen14). So this is not a good option. >> >> By disabling deprecated features ONLY for the _initial_ expansion of model-model, but >> keeping it in the host capabilities you can migrate existing guests (with the >> feature) as we only disable in the expansion, but manually asking for it still works. >> AND it will allow to move this instantiation of the guest to future machines without >> the feature. Basically everything works. > > The change you proposal works functionally, but none the less it is > changing the semantics of host-model. It is defined to expose all the > features in the host, and the proposal changes yet. If an app actually > /wants/ to use the deprecated feature and it exists in the host, then > host-model should be allowing that as it does today. > > The problem scenario you describe is ultimately that OpenStack does > not have a future proof default CPU choice. Libvirt and QEMU provide > a mechanism for them to pick other CPU models that would address the > problem, but they're not using that. The challenge is that OpenStack > defaults currently are a zero-interaction thing. > > They could retain their zero-interaction defaults, if at install time > they queried the libvirt capabilities to learn which named CPU models > are available, whereupon they could decide to use gen15a. The main > challenge here is that the list of named CPU models is an unordered > set, so it is hard to programatically figure out which of the available > named CPU models is the newest/best/recommended. > > IOW, what's missing is a way for apps to easily identify that 'gen15a' > is the best CPU to use on the host, without needing human interaction. I think this could be solved with a change to query-cpu-definitions in QEMU, to add an extra 'recommended: bool' attribute to the CpuDefinitionInfo struct. This would be defined to be only set for 1 CPU model in the list, and would reflect the recommended CPU model given the current version of QEMU, kernel and hardware. Or we could allow 'recommended' to be set for more than 1 CPU, provided we define an explicit ordering of returned CPU models.

OpenStack can query this when first launching a guest, and remember it for that guest on future boots. This makes guest robust against QEMU changing its recommendation over time. For example, when it became clear that "TSX" was going to be removed, QEMU could have switched to recommending one of the Intel no-TSX CPU model variants, but existing guests wouldn't be affected.

On Fri, Mar 11, 2022 at 03:52:57PM +0100, Christian Borntraeger wrote: > > > Am 11.03.22 um 14:08 schrieb Daniel P. Berrangé: >> On Fri, Mar 11, 2022 at 12:37:46PM +0000, Daniel P. Berrangé wrote: >>> On Fri, Mar 11, 2022 at 01:12:35PM +0100, Christian Borntraeger wrote: >>>> >>>> >>>> Am 11.03.22 um 10:23 schrieb David Hildenbrand: >>>>> On 11.03.22 10:17, Daniel P. Berrangé wrote: >>>>>> On Thu, Mar 10, 2022 at 11:17:38PM -0500, Collin Walling wrote: >>>>>>> CPU models past gen16a will no longer support the csske feature. In >>>>>>> order to secure migration of guests running on machines that still >>>>>>> support this feature to machines that do not, let's disable csske >>>>>>> in the host-model. >>>>> >>>>> Sorry to say, removing CPU features is a no-go when wanting to guarantee >>>>> forward migration without taking care about CPU model details manually >>>>> and simply using the host model. Self-made HW vendor problem. >>>> >>>> And this simply does not reflect reality. Intel and Power have removed TX >>>> for example. We can now sit back and please ourselves how we live in our >>>> world of dreams. Or we can try to define an interface that deals with >>>> reality and actually solves problems. >>> >>> This proposal wouldn't have helped in the case of Intel removing >>> TSX, because it was removed without prior warning in the middle >>> of the product lifecycle. At that time there were already millions >>> of VMs in existance using the removed feature. >>> >>>>>> The problem scenario you describe is the intended semantics of >>>>>> host-model though. It enables all features available in the host >>>>>> that you launched on. It lets you live migrate to a target host >>>>>> with the same, or a greater number of features. If the target has >>>>>> a greater number of features, it should restrict the VM to the >>>>>> subset of features that were present on the original source CPU. >>>>>> If the target has fewer features, then you simply can't live >>>>>> migrate a VM using host-model. >>>>>> >>>>>> To get live migration in both directions across CPUs with differing >>>>>> featuresets, then the VM needs to be configured with a named CPU >>>>>> model that is a subset of both, rather than host-model. >>>>> >>>>> Right, and cpu-model-baseline does that job for you if you're lazy to >>>>> lookup the proper model. >>>> >>>> Yes baseline will work, but this requires tooling like openstack. The normal >>>> user will just use the default and this is host-model. >>>> >>>> Let me explain the usecase for this feature. Migration between different versins >>>> baseline: always works >>>> host-passthrough: you get what you deserve >>>> default model: works >>>> We have disabled CSSKE from our default models (-cpu gen15a will not present csske). >>>> So that works as well. >>>> host-model: Also works for all machines that have csske. >>>> Now: Lets say gen17 will no longer support this. That means that we can not migrate >>>> host-model from gen16 or gen15 because those will have csske. >>>> What options do we have? If we disable csske in the host capabilities that would mean >>>> that a host compare against an xml from an older QEMU would fail (even if you move >>>> from gen14 to gen14). So this is not a good option. >>>> >>>> By disabling deprecated features ONLY for the _initial_ expansion of model-model, but >>>> keeping it in the host capabilities you can migrate existing guests (with the >>>> feature) as we only disable in the expansion, but manually asking for it still works. >>>> AND it will allow to move this instantiation of the guest to future machines without >>>> the feature. Basically everything works. >>> >>> The change you proposal works functionally, but none the less it is >>> changing the semantics of host-model. It is defined to expose all the >>> features in the host, and the proposal changes yet. If an app actually >>> /wants/ to use the deprecated feature and it exists in the host, then >>> host-model should be allowing that as it does today. >>> >>> The problem scenario you describe is ultimately that OpenStack does >>> not have a future proof default CPU choice. Libvirt and QEMU provide >>> a mechanism for them to pick other CPU models that would address the >>> problem, but they're not using that. The challenge is that OpenStack >>> defaults currently are a zero-interaction thing. >>> >>> They could retain their zero-interaction defaults, if at install time >>> they queried the libvirt capabilities to learn which named CPU models >>> are available, whereupon they could decide to use gen15a. The main >>> challenge here is that the list of named CPU models is an unordered >>> set, so it is hard to programatically figure out which of the available >>> named CPU models is the newest/best/recommended. >>> >>> IOW, what's missing is a way for apps to easily identify that 'gen15a' >>> is the best CPU to use on the host, without needing human interaction. >> >> I think this could be solved with a change to query-cpu-definitions >> in QEMU, to add an extra 'recommended: bool' attribute to the >> CpuDefinitionInfo struct. This would be defined to be only set for >> 1 CPU model in the list, and would reflect the recommended CPU model >> given the current version of QEMU, kernel and hardware. Or we could >> allow 'recommended' to be set for more than 1 CPU, provided we define >> an explicit ordering of returned CPU models. > > I like the recommended: bool attribute. It should provide what we need. > > Would you then also suggest to use this for host-model or only for a new > type like "host-recommended" ? Neither of those. Libvirt would simply report this attribute in the information it exposes about CPUs. OpenStack would explicitly extract this and set it in the XML for the guest, so that each guest's view of "recommended" is fixed from the time that guest is first created, rather than potentially changing on each later boots.

Am 11.03.22 um 16:24 schrieb Christian Borntraeger: > > > Am 11.03.22 um 15:56 schrieb Daniel P. Berrangé: > > On Fri, Mar 11, 2022 at 03:52:57PM +0100, Christian Borntraeger wrote: > > > > > > > > > Am 11.03.22 um 14:08 schrieb Daniel P. Berrangé: > > > > On Fri, Mar 11, 2022 at 12:37:46PM +0000, Daniel P. Berrangé wrote: > > > > > On Fri, Mar 11, 2022 at 01:12:35PM +0100, Christian Borntraeger wrote: > > > > > > > > > > > > > > > > > > Am 11.03.22 um 10:23 schrieb David Hildenbrand: > > > > > > > On 11.03.22 10:17, Daniel P. Berrangé wrote: > > > > > > > > On Thu, Mar 10, 2022 at 11:17:38PM -0500, Collin Walling wrote: > > > > > > > > > CPU models past gen16a will no longer support the csske feature. In > > > > > > > > > order to secure migration of guests running on machines that still > > > > > > > > > support this feature to machines that do not, let's disable csske > > > > > > > > > in the host-model. > > > > > > > > > > > > > > Sorry to say, removing CPU features is a no-go when wanting to guarantee > > > > > > > forward migration without taking care about CPU model details manually > > > > > > > and simply using the host model. Self-made HW vendor problem. > > > > > > > > > > > > And this simply does not reflect reality. Intel and Power have removed TX > > > > > > for example. We can now sit back and please ourselves how we live in our > > > > > > world of dreams. Or we can try to define an interface that deals with > > > > > > reality and actually solves problems. > > > > > > > > > > This proposal wouldn't have helped in the case of Intel removing > > > > > TSX, because it was removed without prior warning in the middle > > > > > of the product lifecycle. At that time there were already millions > > > > > of VMs in existance using the removed feature. > > > > > > > > > > > > > The problem scenario you describe is the intended semantics of > > > > > > > > host-model though. It enables all features available in the host > > > > > > > > that you launched on. It lets you live migrate to a target host > > > > > > > > with the same, or a greater number of features. If the target has > > > > > > > > a greater number of features, it should restrict the VM to the > > > > > > > > subset of features that were present on the original source CPU. > > > > > > > > If the target has fewer features, then you simply can't live > > > > > > > > migrate a VM using host-model. > > > > > > > > > > > > > > > > To get live migration in both directions across CPUs with differing > > > > > > > > featuresets, then the VM needs to be configured with a named CPU > > > > > > > > model that is a subset of both, rather than host-model. > > > > > > > > > > > > > > Right, and cpu-model-baseline does that job for you if you're lazy to > > > > > > > lookup the proper model. > > > > > > > > > > > > Yes baseline will work, but this requires tooling like openstack. The normal > > > > > > user will just use the default and this is host-model. > > > > > > > > > > > > Let me explain the usecase for this feature. Migration between different versins > > > > > > baseline: always works > > > > > > host-passthrough: you get what you deserve > > > > > > default model: works > > > > > > We have disabled CSSKE from our default models (-cpu gen15a will not present csske). > > > > > > So that works as well. > > > > > > host-model: Also works for all machines that have csske. > > > > > > Now: Lets say gen17 will no longer support this. That means that we can not migrate > > > > > > host-model from gen16 or gen15 because those will have csske. > > > > > > What options do we have? If we disable csske in the host capabilities that would mean > > > > > > that a host compare against an xml from an older QEMU would fail (even if you move > > > > > > from gen14 to gen14). So this is not a good option. > > > > > > > > > > > > By disabling deprecated features ONLY for the _initial_ expansion of model-model, but > > > > > > keeping it in the host capabilities you can migrate existing guests (with the > > > > > > feature) as we only disable in the expansion, but manually asking for it still works. > > > > > > AND it will allow to move this instantiation of the guest to future machines without > > > > > > the feature. Basically everything works. > > > > > > > > > > The change you proposal works functionally, but none the less it is > > > > > changing the semantics of host-model. It is defined to expose all the > > > > > features in the host, and the proposal changes yet. If an app actually > > > > > /wants/ to use the deprecated feature and it exists in the host, then > > > > > host-model should be allowing that as it does today. > > > > > > > > > > The problem scenario you describe is ultimately that OpenStack does > > > > > not have a future proof default CPU choice. Libvirt and QEMU provide > > > > > a mechanism for them to pick other CPU models that would address the > > > > > problem, but they're not using that. The challenge is that OpenStack > > > > > defaults currently are a zero-interaction thing. > > > > > > > > > > They could retain their zero-interaction defaults, if at install time > > > > > they queried the libvirt capabilities to learn which named CPU models > > > > > are available, whereupon they could decide to use gen15a.  The main > > > > > challenge here is that the list of named CPU models is an unordered > > > > > set, so it is hard to programatically figure out which of the available > > > > > named CPU models is the newest/best/recommended. > > > > > > > > > > IOW, what's missing is a way for apps to easily identify that 'gen15a' > > > > > is the best CPU to use on the host, without needing human interaction. > > > > > > > > I think this could be solved with a change to query-cpu-definitions > > > > in QEMU, to add an extra 'recommended: bool' attribute to the > > > > CpuDefinitionInfo struct.  This would be defined to be only set for > > > > 1 CPU model in the list, and would reflect the recommended CPU model > > > > given the current version of QEMU, kernel and hardware. Or we could > > > > allow 'recommended' to be set for more than 1 CPU, provided we define > > > > an explicit ordering of returned CPU models. > > > > > > I like the recommended: bool attribute. It should provide what we need. > > > > > > Would you then also suggest to use this for host-model or only for a new > > > type like "host-recommended" ? > > > > Neither of those. Libvirt would simply report this attribute in > > the information it exposes about CPUs. > > > > OpenStack would explicitly extract this and set it in the XML > > for the guest, so that each guest's view of "recommended" is > > fixed from the time that guest is first created, rather than > > potentially changing on each later boots. > > Openstack is one thing, but I think this flag would really be useful > for instantiation without open stack. To make things more clear. I would like to have a way where a virsh start of a guest xml without CPU model would work for migration in as many scenarios as possible. And if the default model (today host-model) would ignore features that are not recommended, this would be perfect.

The s390x architecture has a growing list of features that will no longer be supported on future hardware releases. This introduces an issue with migration such that guests, running on models with these features enabled, will be rejected outright by machines that do not support these features. A current example is the CSSKE feature that has been deprecated for some time. It has been publicly announced that gen15 will be the last release to support this feature, however we have postponed this to gen16a. A possible solution to remedy this would be to create a new QEMU QMP Response that allows users to query for deprecated/unsupported features. This presents two parts of the puzzle: how to report deprecated features to a user (libvirt) and how should libvirt handle this information. First, let's discuss the latter. The patch presented alongside this cover letter attempts to solve the migration issue by hard-coding the CSSKE feature to be disabled for all s390x CPU models. This is done by simply appending the CSSKE feature with the disabled policy to the host-model. libvirt pseudo: if arch is s390x set CSSKE to disabled for host-model

Am 11.03.22 um 10:30 schrieb David Hildenbrand: > On 11.03.22 05:17, Collin Walling wrote: >> The s390x architecture has a growing list of features that will no longer >> be supported on future hardware releases. This introduces an issue with >> migration such that guests, running on models with these features enabled, >> will be rejected outright by machines that do not support these features. >> >> A current example is the CSSKE feature that has been deprecated for some time. >> It has been publicly announced that gen15 will be the last release to >> support this feature, however we have postponed this to gen16a. A possible >> solution to remedy this would be to create a new QEMU QMP Response that allows >> users to query for deprecated/unsupported features. >> >> This presents two parts of the puzzle: how to report deprecated features to >> a user (libvirt) and how should libvirt handle this information. >> >> First, let's discuss the latter. The patch presented alongside this cover letter >> attempts to solve the migration issue by hard-coding the CSSKE feature to be >> disabled for all s390x CPU models. This is done by simply appending the CSSKE >> feature with the disabled policy to the host-model. >> >> libvirt pseudo: >> >> if arch is s390x >> set CSSKE to disabled for host-model > > That violates host-model semantics and possibly the user intend. There > would have to be some toggle to manually specify this, for example, a > new model type or a some magical flag. What we actually want to do is to disable csske completely from QEMU and thus from the host-model. Then it would not violate the spec. But this has all kind of issues (you cannot migrate from older versions of software and machines) although the hardware still can provide the feature. The hardware guys promised me to deprecate things two generations earlier and we usually deprecate things that are not used or where software has a runtime switch. From what I hear from you is that you do not want to modify the host-model semantics to something more useful but rather define a new thing (e.g. "host-sane") ?

On 11.03.22 13:44, Christian Borntraeger wrote: > > > Am 11.03.22 um 10:30 schrieb David Hildenbrand: >> On 11.03.22 05:17, Collin Walling wrote: >>> The s390x architecture has a growing list of features that will no longer >>> be supported on future hardware releases. This introduces an issue with >>> migration such that guests, running on models with these features enabled, >>> will be rejected outright by machines that do not support these features. >>> >>> A current example is the CSSKE feature that has been deprecated for some time. >>> It has been publicly announced that gen15 will be the last release to >>> support this feature, however we have postponed this to gen16a. A possible >>> solution to remedy this would be to create a new QEMU QMP Response that allows >>> users to query for deprecated/unsupported features. >>> >>> This presents two parts of the puzzle: how to report deprecated features to >>> a user (libvirt) and how should libvirt handle this information. >>> >>> First, let's discuss the latter. The patch presented alongside this cover letter >>> attempts to solve the migration issue by hard-coding the CSSKE feature to be >>> disabled for all s390x CPU models. This is done by simply appending the CSSKE >>> feature with the disabled policy to the host-model. >>> >>> libvirt pseudo: >>> >>> if arch is s390x >>> set CSSKE to disabled for host-model >> >> That violates host-model semantics and possibly the user intend. There >> would have to be some toggle to manually specify this, for example, a >> new model type or a some magical flag. > > What we actually want to do is to disable csske completely from QEMU and > thus from the host-model. Then it would not violate the spec. > But this has all kind of issues (you cannot migrate from older versions > of software and machines) although the hardware still can provide the feature. > > The hardware guys promised me to deprecate things two generations earlier > and we usually deprecate things that are not used or where software has a > runtime switch. > > From what I hear from you is that you do not want to modify the host-model > semantics to something more useful but rather define a new thing (e.g. "host-sane") ? My take would be, to keep the host model consistent, meaning, the semantics in QEMU exactly match the semantics in Libvirt. It defines the maximum CPU model that's runnable under KVM. If a feature is not included (e.g., csske) that feature cannot be enabled in any way. The "host model" has the semantics of resembling the actual host CPU. This is only partially true, because we support some features the host might not support (e.g., zPCI IIRC) and obviously don't support all host features in QEMU. So instead of playing games on the libvirt side with the host model, I see the following alternatives: 1. Remove the problematic features from the host model in QEMU, like "we just don't support this feature". Consequently, any migration of a VM with csske=on to a new QEMU version will fail, similar to having an older QEMU version without support for a certain feature. "host-passthrough" would change between QEMU versions ... which I see as problematic. 2. Introduce a new CPU model that has these new semantics: "host model" - deprecated features. Migration of older VMs with csske=on to a new QEMU version will work. Make libvirt use/expand that new CPU model It doesn't necessarily have to be an actual new cpu model. We can use a feature group, like "-cpu host,deprectated-features=false". What's inside "deprecated-features" will actually change between QEMU versions, but we don't really care, as the expanded CPU model won't change. "host-passthrough" won't change between QEMU versions ... 3. As Daniel suggested, don't use the host model, but a CPU model indicated as "suggested". The real issue is that in reality, we don't simply always use a model like "gen15a", but usually want optional features, if they are around. Prime examples are "sie" and friends. I tend to prefer 2. With 3. I see issues with optional features like "sie" and friends. Often, you really want "give me all you got, but disable deprecated features that might cause problems in the future".

On 15.03.22 18:40, Boris Fiuczynski wrote: > On 3/15/22 4:58 PM, David Hildenbrand wrote: >> On 11.03.22 13:44, Christian Borntraeger wrote: >>> >>> >>> Am 11.03.22 um 10:30 schrieb David Hildenbrand: >>>> On 11.03.22 05:17, Collin Walling wrote: >>>>> The s390x architecture has a growing list of features that will no longer >>>>> be supported on future hardware releases. This introduces an issue with >>>>> migration such that guests, running on models with these features enabled, >>>>> will be rejected outright by machines that do not support these features. >>>>> >>>>> A current example is the CSSKE feature that has been deprecated for some time. >>>>> It has been publicly announced that gen15 will be the last release to >>>>> support this feature, however we have postponed this to gen16a. A possible >>>>> solution to remedy this would be to create a new QEMU QMP Response that allows >>>>> users to query for deprecated/unsupported features. >>>>> >>>>> This presents two parts of the puzzle: how to report deprecated features to >>>>> a user (libvirt) and how should libvirt handle this information. >>>>> >>>>> First, let's discuss the latter. The patch presented alongside this cover letter >>>>> attempts to solve the migration issue by hard-coding the CSSKE feature to be >>>>> disabled for all s390x CPU models. This is done by simply appending the CSSKE >>>>> feature with the disabled policy to the host-model. >>>>> >>>>> libvirt pseudo: >>>>> >>>>> if arch is s390x >>>>> set CSSKE to disabled for host-model >>>> >>>> That violates host-model semantics and possibly the user intend. There >>>> would have to be some toggle to manually specify this, for example, a >>>> new model type or a some magical flag. >>> >>> What we actually want to do is to disable csske completely from QEMU and >>> thus from the host-model. Then it would not violate the spec. >>> But this has all kind of issues (you cannot migrate from older versions >>> of software and machines) although the hardware still can provide the feature. >>> >>> The hardware guys promised me to deprecate things two generations earlier >>> and we usually deprecate things that are not used or where software has a >>> runtime switch. >>> >>> From what I hear from you is that you do not want to modify the host-model >>> semantics to something more useful but rather define a new thing (e.g. "host-sane") ? >> >> My take would be, to keep the host model consistent, meaning, the >> semantics in QEMU exactly match the semantics in Libvirt. It defines the >> maximum CPU model that's runnable under KVM. If a feature is not >> included (e.g., csske) that feature cannot be enabled in any way. >> >> The "host model" has the semantics of resembling the actual host CPU. >> This is only partially true, because we support some features the host >> might not support (e.g., zPCI IIRC) and obviously don't support all host >> features in QEMU. >> >> So instead of playing games on the libvirt side with the host model, I >> see the following alternatives: >> >> 1. Remove the problematic features from the host model in QEMU, like "we >> just don't support this feature". Consequently, any migration of a VM >> with csske=on to a new QEMU version will fail, similar to having an >> older QEMU version without support for a certain feature. >> >> "host-passthrough" would change between QEMU versions ... which I see as >> problematic. >> >> 2. Introduce a new CPU model that has these new semantics: "host model" >> - deprecated features. Migration of older VMs with csske=on to a new >> QEMU version will work. Make libvirt use/expand that new CPU model >> >> It doesn't necessarily have to be an actual new cpu model. We can use a >> feature group, like "-cpu host,deprectated-features=false". What's >> inside "deprecated-features" will actually change between QEMU versions, >> but we don't really care, as the expanded CPU model won't change. >> >> "host-passthrough" won't change between QEMU versions ... >> >> 3. As Daniel suggested, don't use the host model, but a CPU model >> indicated as "suggested". >> >> The real issue is that in reality, we don't simply always use a model >> like "gen15a", but usually want optional features, if they are around. >> Prime examples are "sie" and friends. >> >> >> >> I tend to prefer 2. With 3. I see issues with optional features like >> "sie" and friends. Often, you really want "give me all you got, but >> disable deprecated features that might cause problems in the future". >> > > David, > if I understand you proposal 2 correctly it sounds a lot like Christians > idea of leaving the CPU mode "host-model" as is and introduce a new CPU > mode "host-recommended" for the new semantics in which > query-cpu-model-expansion would be called with the additional > "deprectated-features" property. > That way libvirt would not have to fiddle around with the deprecation > itself and users would have the option which semantic they want to use. > Is that correct? Yes, exactly.

From what I understand:

On 18.03.22 18:23, Collin Walling wrote: > On 3/15/22 15:08, David Hildenbrand wrote: >> On 15.03.22 18:40, Boris Fiuczynski wrote: >>> On 3/15/22 4:58 PM, David Hildenbrand wrote: >>>> On 11.03.22 13:44, Christian Borntraeger wrote: >>>>> >>>>> >>>>> Am 11.03.22 um 10:30 schrieb David Hildenbrand: >>>>>> On 11.03.22 05:17, Collin Walling wrote: >>>>>>> The s390x architecture has a growing list of features that will no longer >>>>>>> be supported on future hardware releases. This introduces an issue with >>>>>>> migration such that guests, running on models with these features enabled, >>>>>>> will be rejected outright by machines that do not support these features. >>>>>>> >>>>>>> A current example is the CSSKE feature that has been deprecated for some time. >>>>>>> It has been publicly announced that gen15 will be the last release to >>>>>>> support this feature, however we have postponed this to gen16a. A possible >>>>>>> solution to remedy this would be to create a new QEMU QMP Response that allows >>>>>>> users to query for deprecated/unsupported features. >>>>>>> >>>>>>> This presents two parts of the puzzle: how to report deprecated features to >>>>>>> a user (libvirt) and how should libvirt handle this information. >>>>>>> >>>>>>> First, let's discuss the latter. The patch presented alongside this cover letter >>>>>>> attempts to solve the migration issue by hard-coding the CSSKE feature to be >>>>>>> disabled for all s390x CPU models. This is done by simply appending the CSSKE >>>>>>> feature with the disabled policy to the host-model. >>>>>>> >>>>>>> libvirt pseudo: >>>>>>> >>>>>>> if arch is s390x >>>>>>> set CSSKE to disabled for host-model >>>>>> >>>>>> That violates host-model semantics and possibly the user intend. There >>>>>> would have to be some toggle to manually specify this, for example, a >>>>>> new model type or a some magical flag. >>>>> >>>>> What we actually want to do is to disable csske completely from QEMU and >>>>> thus from the host-model. Then it would not violate the spec. >>>>> But this has all kind of issues (you cannot migrate from older versions >>>>> of software and machines) although the hardware still can provide the feature. >>>>> >>>>> The hardware guys promised me to deprecate things two generations earlier >>>>> and we usually deprecate things that are not used or where software has a >>>>> runtime switch. >>>>> >>>>> From what I hear from you is that you do not want to modify the host-model >>>>> semantics to something more useful but rather define a new thing (e.g. "host-sane") ? >>>> >>>> My take would be, to keep the host model consistent, meaning, the >>>> semantics in QEMU exactly match the semantics in Libvirt. It defines the >>>> maximum CPU model that's runnable under KVM. If a feature is not >>>> included (e.g., csske) that feature cannot be enabled in any way. >>>> >>>> The "host model" has the semantics of resembling the actual host CPU. >>>> This is only partially true, because we support some features the host >>>> might not support (e.g., zPCI IIRC) and obviously don't support all host >>>> features in QEMU. >>>> >>>> So instead of playing games on the libvirt side with the host model, I >>>> see the following alternatives: >>>> >>>> 1. Remove the problematic features from the host model in QEMU, like "we >>>> just don't support this feature". Consequently, any migration of a VM >>>> with csske=on to a new QEMU version will fail, similar to having an >>>> older QEMU version without support for a certain feature. >>>> >>>> "host-passthrough" would change between QEMU versions ... which I see as >>>> problematic. >>>> >>>> 2. Introduce a new CPU model that has these new semantics: "host model" >>>> - deprecated features. Migration of older VMs with csske=on to a new >>>> QEMU version will work. Make libvirt use/expand that new CPU model >>>> >>>> It doesn't necessarily have to be an actual new cpu model. We can use a >>>> feature group, like "-cpu host,deprectated-features=false". What's >>>> inside "deprecated-features" will actually change between QEMU versions, >>>> but we don't really care, as the expanded CPU model won't change. >>>> >>>> "host-passthrough" won't change between QEMU versions ... >>>> >>>> 3. As Daniel suggested, don't use the host model, but a CPU model >>>> indicated as "suggested". >>>> >>>> The real issue is that in reality, we don't simply always use a model >>>> like "gen15a", but usually want optional features, if they are around. >>>> Prime examples are "sie" and friends. >>>> >>>> >>>> >>>> I tend to prefer 2. With 3. I see issues with optional features like >>>> "sie" and friends. Often, you really want "give me all you got, but >>>> disable deprecated features that might cause problems in the future". >>>> >>> >>> David, >>> if I understand you proposal 2 correctly it sounds a lot like Christians >>> idea of leaving the CPU mode "host-model" as is and introduce a new CPU >>> mode "host-recommended" for the new semantics in which >>> query-cpu-model-expansion would be called with the additional >>> "deprectated-features" property. >>> That way libvirt would not have to fiddle around with the deprecation >>> itself and users would have the option which semantic they want to use. >>> Is that correct? >> >> Yes, exactly. >> >> > > From what I understand: > > QEMU > - add a "deprecated-features" feature group (more-or-less David's code) > > libvirt > - recognize a new model name "host-recommended" > - query QEMU for host-model + deprecated-features and cache it in caps > file (something like <hostRecCpu>) > - when guest is defined with "host-recommended", pull <hostRecCPU> from > caps when guest is started (similar to how host-model works today) > > If this is sufficient, then I can then get to work on this. > > My question is what would be the best way to include the deprecated > features when calculating a baseline or comparison. Both work with the > host-model and may no longer present an accurate result. Say, for > example, we baseline a z15 with a gen17 (which will outright not support > CSSKE). With today's implementation, this might result in a ridiculously > old CPU model which also does not support CSSKE. The ideal response > would be a z15 - deprecated features (i.e. host-recommended on a z15), > but we'd need a way to flag to QEMU that we want to exclude the > deprecated features. Or am I totally wrong about this? For baselining, it would be reasonable to always disable deprecated features, and to ignore them during the model selection. Should be fairly easy to implement, let me know if you need any pointers.

I *assume* that for comparison there is nothing to do.

On 3/15/22 15:08, David Hildenbrand wrote: > On 15.03.22 18:40, Boris Fiuczynski wrote: >> On 3/15/22 4:58 PM, David Hildenbrand wrote: >>> On 11.03.22 13:44, Christian Borntraeger wrote: >>>> >>>> >>>> Am 11.03.22 um 10:30 schrieb David Hildenbrand: >>>>> On 11.03.22 05:17, Collin Walling wrote: >>>>>> The s390x architecture has a growing list of features that will no longer >>>>>> be supported on future hardware releases. This introduces an issue with >>>>>> migration such that guests, running on models with these features enabled, >>>>>> will be rejected outright by machines that do not support these features. >>>>>> >>>>>> A current example is the CSSKE feature that has been deprecated for some time. >>>>>> It has been publicly announced that gen15 will be the last release to >>>>>> support this feature, however we have postponed this to gen16a. A possible >>>>>> solution to remedy this would be to create a new QEMU QMP Response that allows >>>>>> users to query for deprecated/unsupported features. >>>>>> >>>>>> This presents two parts of the puzzle: how to report deprecated features to >>>>>> a user (libvirt) and how should libvirt handle this information. >>>>>> >>>>>> First, let's discuss the latter. The patch presented alongside this cover letter >>>>>> attempts to solve the migration issue by hard-coding the CSSKE feature to be >>>>>> disabled for all s390x CPU models. This is done by simply appending the CSSKE >>>>>> feature with the disabled policy to the host-model. >>>>>> >>>>>> libvirt pseudo: >>>>>> >>>>>> if arch is s390x >>>>>> set CSSKE to disabled for host-model >>>>> >>>>> That violates host-model semantics and possibly the user intend. There >>>>> would have to be some toggle to manually specify this, for example, a >>>>> new model type or a some magical flag. >>>> >>>> What we actually want to do is to disable csske completely from QEMU and >>>> thus from the host-model. Then it would not violate the spec. >>>> But this has all kind of issues (you cannot migrate from older versions >>>> of software and machines) although the hardware still can provide the feature. >>>> >>>> The hardware guys promised me to deprecate things two generations earlier >>>> and we usually deprecate things that are not used or where software has a >>>> runtime switch. >>>> >>>> From what I hear from you is that you do not want to modify the host-model >>>> semantics to something more useful but rather define a new thing (e.g. "host-sane") ? >>> >>> My take would be, to keep the host model consistent, meaning, the >>> semantics in QEMU exactly match the semantics in Libvirt. It defines the >>> maximum CPU model that's runnable under KVM. If a feature is not >>> included (e.g., csske) that feature cannot be enabled in any way. >>> >>> The "host model" has the semantics of resembling the actual host CPU. >>> This is only partially true, because we support some features the host >>> might not support (e.g., zPCI IIRC) and obviously don't support all host >>> features in QEMU. >>> >>> So instead of playing games on the libvirt side with the host model, I >>> see the following alternatives: >>> >>> 1. Remove the problematic features from the host model in QEMU, like "we >>> just don't support this feature". Consequently, any migration of a VM >>> with csske=on to a new QEMU version will fail, similar to having an >>> older QEMU version without support for a certain feature. >>> >>> "host-passthrough" would change between QEMU versions ... which I see as >>> problematic. >>> >>> 2. Introduce a new CPU model that has these new semantics: "host model" >>> - deprecated features. Migration of older VMs with csske=on to a new >>> QEMU version will work. Make libvirt use/expand that new CPU model >>> >>> It doesn't necessarily have to be an actual new cpu model. We can use a >>> feature group, like "-cpu host,deprectated-features=false". What's >>> inside "deprecated-features" will actually change between QEMU versions, >>> but we don't really care, as the expanded CPU model won't change. >>> >>> "host-passthrough" won't change between QEMU versions ... >>> >>> 3. As Daniel suggested, don't use the host model, but a CPU model >>> indicated as "suggested". >>> >>> The real issue is that in reality, we don't simply always use a model >>> like "gen15a", but usually want optional features, if they are around. >>> Prime examples are "sie" and friends. >>> >>> >>> >>> I tend to prefer 2. With 3. I see issues with optional features like >>> "sie" and friends. Often, you really want "give me all you got, but >>> disable deprecated features that might cause problems in the future". >>> >> >> David, >> if I understand you proposal 2 correctly it sounds a lot like Christians >> idea of leaving the CPU mode "host-model" as is and introduce a new CPU >> mode "host-recommended" for the new semantics in which >> query-cpu-model-expansion would be called with the additional >> "deprectated-features" property. >> That way libvirt would not have to fiddle around with the deprecation >> itself and users would have the option which semantic they want to use. >> Is that correct? > > Yes, exactly. > > From what I understand: QEMU - add a "deprecated-features" feature group (more-or-less David's code) libvirt - recognize a new model name "host-recommended" - query QEMU for host-model + deprecated-features and cache it in caps file (something like <hostRecCpu>) - when guest is defined with "host-recommended", pull <hostRecCPU> from caps when guest is started (similar to how host-model works today) If this is sufficient, then I can then get to work on this. My question is what would be the best way to include the deprecated features when calculating a baseline or comparison. Both work with the host-model and may no longer present an accurate result. Say, for example, we baseline a z15 with a gen17 (which will outright not support CSSKE). With today's implementation, this might result in a ridiculously old CPU model which also does not support CSSKE. The ideal response would be a z15 - deprecated features (i.e. host-recommended on a z15), but we'd need a way to flag to QEMU that we want to exclude the deprecated features. Or am I totally wrong about this?