CP-311165 XSI-1958 rely on Linux guest to announce control features (#6864)

We want to rely on a Linux guest kernel to announce supported control
features like suspend. In the unlikely case that a guest Linux kernel
does not support this, provide a flag to re-enable previous behavior:
the toolstack assumes a set of supported features. Linux kernel 3.0 and
above announce features.

The flag is false by default, as such introducing the new behaviour.

This closes a window for a data race that caused XSI-1958: the toolstack
announced control features before the Linux guest kernel was ready and
announced them a moment later. A request coming in before the kernel was
ready caused the request to be missed by the kernel.

Previous behavior and timing is below: observe that dom0 announces the
features before domain 7. Some details are omitted.

2026-01-27T10:22:04 dt034 oxd: DOM0 write /l/d/7/control/feature-suspend
1
2026-01-27T10:22:04 dt034 oxd: DOM0 write
/l/d/7/control/feature-poweroff 1
2026-01-27T10:22:04 dt034 oxd: DOM0 write /l/d/7/control/feature-reboot
1
2026-01-27T10:22:04 dt034 oxd: DOM0 write
/l/d/7/control/feature-vcpu-hotplug 1

2026-01-27T10:22:06 dt034 oxd: DOM7 write control/feature-poweroff 1
2026-01-27T10:22:06 dt034 oxd: DOM7 write control/feature-reboot 1
2026-01-27T10:22:06 dt034 oxd: DOM7 write control/feature-suspend 1
2026-01-27T10:22:10 dt034 oxd: DOM7 write control/feature-balloon 1

Author: lindig

ocaml/xenopsd/lib/xenopsd.ml

@@ -81,6 +81,8 @@ let vm_suspend_timeout = ref 1200.
 
 let vm_suspend_ack_timeout = ref 30.
 
+let linux_assume_ctrl_features = ref false
+
 let oxenstored_conf = ref "/etc/xen/oxenstored.conf"
 
 let for_each_line path f =
@@ -324,6 +326,13 @@ let options =
     , (fun () -> string_of_bool !Xenops_server.xenopsd_vbd_plug_unplug_legacy)
     , "False if we want to split the plug atomic into attach/activate"
     )
+  ; ( "linux-assume-control-features"
+    , Arg.Bool (fun b -> linux_assume_ctrl_features := b)
+    , (fun () -> string_of_bool !linux_assume_ctrl_features)
+    , "To support old Linux guest kernels, assume the kernel supports certain \
+       control features without announcing them. Linux kernels 4.9 and later \
+       announce support in xenstore."
+    )
   ; ( "vm-suspend-timeout"
     , Arg.Set_float vm_suspend_timeout
     , (fun () -> string_of_float !vm_suspend_timeout)

ocaml/xenopsd/xc/device.ml

@@ -2980,6 +2980,16 @@ module Backend = struct
         )
       in
       let xen_platform_pv_driver_info pv_info =
+        (* we would like to keep the assumptions about supported
+           features small and rather have the Linux kernel or a guest agent
+           announce the actually supported featuresi. See commit message *)
+        let features =
+          match !Xenopsd.linux_assume_ctrl_features with
+          | true ->
+              ["suspend"; "poweroff"; "reboot"; "vcpu-hotplug"]
+          | false ->
+              ["vcpu-hotplug"]
+        in
         with_xs (fun xs ->
             let is_hvm_linux {product_num; build_num} =
               let _XEN_IOPORT_LINUX_PRODNUM = 3 in
@@ -2992,9 +3002,7 @@ module Backend = struct
                   (Printf.sprintf "/local/domain/%d/%s%s" domid prefix x)
                   "1"
               in
-              List.iter
-                (write_local_domain "control/feature-")
-                ["suspend"; "poweroff"; "reboot"; "vcpu-hotplug"] ;
+              List.iter (write_local_domain "control/feature-") features ;
               List.iter (write_local_domain "data/") ["updated"]
             )
         )

ocaml/xenopsd/xenopsd.conf

@@ -122,3 +122,11 @@ disable-logging-for=http tracing tracing_export
 
 # Timeout in seconds for a VM to acknowledge a suspend request
 # vm-suspend-ack-timeout=30
+#
+
+# A Linux guest kernel 4.9+ announces the control features it supports in
+# xenstore. If it does not, xenopsd has to assume it supports a range of
+# operations. The default "false" is to rely on guest kernels to announce
+# support. Use "true" to assume support even when unannounced.
+# linux-assume-control-features = false
+