]>
Commit | Line | Data |
---|---|---|
2544e9e4 DB |
1 | @c man begin SYNOPSIS |
2 | QEMU / KVM CPU model configuration | |
3 | @c man end | |
4 | ||
5 | @c man begin DESCRIPTION | |
6 | ||
7 | @menu | |
e5a5b1bb SM |
8 | * recommendations_cpu_models_x86:: Recommendations for KVM CPU model configuration on x86 hosts |
9 | * recommendations_cpu_models_MIPS:: Supported CPU model configurations on MIPS hosts | |
10 | * cpu_model_syntax_apps:: Syntax for configuring CPU models | |
2544e9e4 DB |
11 | @end menu |
12 | ||
13 | QEMU / KVM virtualization supports two ways to configure CPU models | |
14 | ||
15 | @table @option | |
16 | ||
17 | @item Host passthrough | |
18 | ||
19 | This passes the host CPU model features, model, stepping, exactly to the | |
20 | guest. Note that KVM may filter out some host CPU model features if they | |
21 | cannot be supported with virtualization. Live migration is unsafe when | |
22 | this mode is used as libvirt / QEMU cannot guarantee a stable CPU is | |
23 | exposed to the guest across hosts. This is the recommended CPU to use, | |
24 | provided live migration is not required. | |
25 | ||
26 | @item Named model | |
27 | ||
28 | QEMU comes with a number of predefined named CPU models, that typically | |
29 | refer to specific generations of hardware released by Intel and AMD. | |
30 | These allow the guest VMs to have a degree of isolation from the host CPU, | |
31 | allowing greater flexibility in live migrating between hosts with differing | |
32 | hardware. | |
33 | @end table | |
34 | ||
35 | In both cases, it is possible to optionally add or remove individual CPU | |
36 | features, to alter what is presented to the guest by default. | |
37 | ||
38 | Libvirt supports a third way to configure CPU models known as "Host model". | |
39 | This uses the QEMU "Named model" feature, automatically picking a CPU model | |
40 | that is similar the host CPU, and then adding extra features to approximate | |
41 | the host model as closely as possible. This does not guarantee the CPU family, | |
42 | stepping, etc will precisely match the host CPU, as they would with "Host | |
43 | passthrough", but gives much of the benefit of passthrough, while making | |
44 | live migration safe. | |
45 | ||
46 | @node recommendations_cpu_models_x86 | |
47 | @subsection Recommendations for KVM CPU model configuration on x86 hosts | |
48 | ||
49 | The information that follows provides recommendations for configuring | |
50 | CPU models on x86 hosts. The goals are to maximise performance, while | |
51 | protecting guest OS against various CPU hardware flaws, and optionally | |
806be373 | 52 | enabling live migration between hosts with heterogeneous CPU models. |
2544e9e4 DB |
53 | |
54 | @menu | |
55 | * preferred_cpu_models_intel_x86:: Preferred CPU models for Intel x86 hosts | |
56 | * important_cpu_features_intel_x86:: Important CPU features for Intel x86 hosts | |
57 | * preferred_cpu_models_amd_x86:: Preferred CPU models for AMD x86 hosts | |
58 | * important_cpu_features_amd_x86:: Important CPU features for AMD x86 hosts | |
59 | * default_cpu_models_x86:: Default x86 CPU models | |
60 | * other_non_recommended_cpu_models_x86:: Other non-recommended x86 CPUs | |
61 | @end menu | |
62 | ||
63 | @node preferred_cpu_models_intel_x86 | |
64 | @subsubsection Preferred CPU models for Intel x86 hosts | |
65 | ||
66 | The following CPU models are preferred for use on Intel hosts. Administrators / | |
67 | applications are recommended to use the CPU model that matches the generation | |
68 | of the host CPUs in use. In a deployment with a mixture of host CPU models | |
69 | between machines, if live migration compatibility is required, use the newest | |
70 | CPU model that is compatible across all desired hosts. | |
71 | ||
72 | @table @option | |
73 | @item @code{Skylake-Server} | |
74 | @item @code{Skylake-Server-IBRS} | |
75 | ||
76 | Intel Xeon Processor (Skylake, 2016) | |
77 | ||
78 | ||
79 | @item @code{Skylake-Client} | |
80 | @item @code{Skylake-Client-IBRS} | |
81 | ||
82 | Intel Core Processor (Skylake, 2015) | |
83 | ||
84 | ||
85 | @item @code{Broadwell} | |
86 | @item @code{Broadwell-IBRS} | |
87 | @item @code{Broadwell-noTSX} | |
88 | @item @code{Broadwell-noTSX-IBRS} | |
89 | ||
90 | Intel Core Processor (Broadwell, 2014) | |
91 | ||
92 | ||
93 | @item @code{Haswell} | |
94 | @item @code{Haswell-IBRS} | |
95 | @item @code{Haswell-noTSX} | |
96 | @item @code{Haswell-noTSX-IBRS} | |
97 | ||
98 | Intel Core Processor (Haswell, 2013) | |
99 | ||
100 | ||
101 | @item @code{IvyBridge} | |
102 | @item @code{IvyBridge-IBRS} | |
103 | ||
104 | Intel Xeon E3-12xx v2 (Ivy Bridge, 2012) | |
105 | ||
106 | ||
107 | @item @code{SandyBridge} | |
108 | @item @code{SandyBridge-IBRS} | |
109 | ||
110 | Intel Xeon E312xx (Sandy Bridge, 2011) | |
111 | ||
112 | ||
113 | @item @code{Westmere} | |
114 | @item @code{Westmere-IBRS} | |
115 | ||
116 | Westmere E56xx/L56xx/X56xx (Nehalem-C, 2010) | |
117 | ||
118 | ||
119 | @item @code{Nehalem} | |
120 | @item @code{Nehalem-IBRS} | |
121 | ||
122 | Intel Core i7 9xx (Nehalem Class Core i7, 2008) | |
123 | ||
124 | ||
125 | @item @code{Penryn} | |
126 | ||
127 | Intel Core 2 Duo P9xxx (Penryn Class Core 2, 2007) | |
128 | ||
129 | ||
130 | @item @code{Conroe} | |
131 | ||
132 | Intel Celeron_4x0 (Conroe/Merom Class Core 2, 2006) | |
133 | ||
134 | @end table | |
135 | ||
136 | @node important_cpu_features_intel_x86 | |
137 | @subsubsection Important CPU features for Intel x86 hosts | |
138 | ||
139 | The following are important CPU features that should be used on Intel x86 | |
140 | hosts, when available in the host CPU. Some of them require explicit | |
141 | configuration to enable, as they are not included by default in some, or all, | |
142 | of the named CPU models listed above. In general all of these features are | |
143 | included if using "Host passthrough" or "Host model". | |
144 | ||
145 | ||
146 | @table @option | |
147 | ||
148 | @item @code{pcid} | |
149 | ||
150 | Recommended to mitigate the cost of the Meltdown (CVE-2017-5754) fix | |
151 | ||
152 | Included by default in Haswell, Broadwell & Skylake Intel CPU models. | |
153 | ||
154 | Should be explicitly turned on for Westmere, SandyBridge, and IvyBridge | |
155 | Intel CPU models. Note that some desktop/mobile Westmere CPUs cannot | |
156 | support this feature. | |
157 | ||
158 | ||
159 | @item @code{spec-ctrl} | |
160 | ||
174a78a8 | 161 | Required to enable the Spectre v2 (CVE-2017-5715) fix. |
2544e9e4 DB |
162 | |
163 | Included by default in Intel CPU models with -IBRS suffix. | |
164 | ||
165 | Must be explicitly turned on for Intel CPU models without -IBRS suffix. | |
166 | ||
167 | Requires the host CPU microcode to support this feature before it | |
168 | can be used for guest CPUs. | |
169 | ||
170 | ||
171 | @item @code{ssbd} | |
172 | ||
173 | Required to enable the CVE-2018-3639 fix | |
174 | ||
175 | Not included by default in any Intel CPU model. | |
176 | ||
177 | Must be explicitly turned on for all Intel CPU models. | |
178 | ||
179 | Requires the host CPU microcode to support this feature before it | |
180 | can be used for guest CPUs. | |
181 | ||
182 | ||
183 | @item @code{pdpe1gb} | |
184 | ||
185 | Recommended to allow guest OS to use 1GB size pages | |
186 | ||
187 | Not included by default in any Intel CPU model. | |
188 | ||
189 | Should be explicitly turned on for all Intel CPU models. | |
190 | ||
191 | Note that not all CPU hardware will support this feature. | |
192 | @end table | |
193 | ||
194 | ||
195 | @node preferred_cpu_models_amd_x86 | |
196 | @subsubsection Preferred CPU models for AMD x86 hosts | |
197 | ||
198 | The following CPU models are preferred for use on Intel hosts. Administrators / | |
199 | applications are recommended to use the CPU model that matches the generation | |
200 | of the host CPUs in use. In a deployment with a mixture of host CPU models | |
201 | between machines, if live migration compatibility is required, use the newest | |
202 | CPU model that is compatible across all desired hosts. | |
203 | ||
204 | @table @option | |
205 | ||
206 | @item @code{EPYC} | |
207 | @item @code{EPYC-IBPB} | |
208 | ||
209 | AMD EPYC Processor (2017) | |
210 | ||
211 | ||
212 | @item @code{Opteron_G5} | |
213 | ||
214 | AMD Opteron 63xx class CPU (2012) | |
215 | ||
216 | ||
217 | @item @code{Opteron_G4} | |
218 | ||
219 | AMD Opteron 62xx class CPU (2011) | |
220 | ||
221 | ||
222 | @item @code{Opteron_G3} | |
223 | ||
224 | AMD Opteron 23xx (Gen 3 Class Opteron, 2009) | |
225 | ||
226 | ||
227 | @item @code{Opteron_G2} | |
228 | ||
229 | AMD Opteron 22xx (Gen 2 Class Opteron, 2006) | |
230 | ||
231 | ||
232 | @item @code{Opteron_G1} | |
233 | ||
234 | AMD Opteron 240 (Gen 1 Class Opteron, 2004) | |
235 | @end table | |
236 | ||
237 | @node important_cpu_features_amd_x86 | |
238 | @subsubsection Important CPU features for AMD x86 hosts | |
239 | ||
240 | The following are important CPU features that should be used on AMD x86 | |
241 | hosts, when available in the host CPU. Some of them require explicit | |
242 | configuration to enable, as they are not included by default in some, or all, | |
243 | of the named CPU models listed above. In general all of these features are | |
244 | included if using "Host passthrough" or "Host model". | |
245 | ||
246 | ||
247 | @table @option | |
248 | ||
249 | @item @code{ibpb} | |
250 | ||
174a78a8 | 251 | Required to enable the Spectre v2 (CVE-2017-5715) fix. |
2544e9e4 DB |
252 | |
253 | Included by default in AMD CPU models with -IBPB suffix. | |
254 | ||
255 | Must be explicitly turned on for AMD CPU models without -IBPB suffix. | |
256 | ||
257 | Requires the host CPU microcode to support this feature before it | |
258 | can be used for guest CPUs. | |
259 | ||
260 | ||
261 | @item @code{virt-ssbd} | |
262 | ||
263 | Required to enable the CVE-2018-3639 fix | |
264 | ||
265 | Not included by default in any AMD CPU model. | |
266 | ||
267 | Must be explicitly turned on for all AMD CPU models. | |
268 | ||
269 | This should be provided to guests, even if amd-ssbd is also | |
270 | provided, for maximum guest compatibility. | |
271 | ||
272 | Note for some QEMU / libvirt versions, this must be force enabled | |
273 | when when using "Host model", because this is a virtual feature | |
274 | that doesn't exist in the physical host CPUs. | |
275 | ||
276 | ||
277 | @item @code{amd-ssbd} | |
278 | ||
279 | Required to enable the CVE-2018-3639 fix | |
280 | ||
281 | Not included by default in any AMD CPU model. | |
282 | ||
283 | Must be explicitly turned on for all AMD CPU models. | |
284 | ||
285 | This provides higher performance than virt-ssbd so should be | |
286 | exposed to guests whenever available in the host. virt-ssbd | |
287 | should none the less also be exposed for maximum guest | |
806be373 | 288 | compatibility as some kernels only know about virt-ssbd. |
2544e9e4 DB |
289 | |
290 | ||
291 | @item @code{amd-no-ssb} | |
292 | ||
293 | Recommended to indicate the host is not vulnerable CVE-2018-3639 | |
294 | ||
295 | Not included by default in any AMD CPU model. | |
296 | ||
806be373 | 297 | Future hardware generations of CPU will not be vulnerable to |
2544e9e4 DB |
298 | CVE-2018-3639, and thus the guest should be told not to enable |
299 | its mitigations, by exposing amd-no-ssb. This is mutually | |
300 | exclusive with virt-ssbd and amd-ssbd. | |
301 | ||
302 | ||
303 | @item @code{pdpe1gb} | |
304 | ||
305 | Recommended to allow guest OS to use 1GB size pages | |
306 | ||
307 | Not included by default in any AMD CPU model. | |
308 | ||
309 | Should be explicitly turned on for all AMD CPU models. | |
310 | ||
311 | Note that not all CPU hardware will support this feature. | |
312 | @end table | |
313 | ||
314 | ||
315 | @node default_cpu_models_x86 | |
316 | @subsubsection Default x86 CPU models | |
317 | ||
318 | The default QEMU CPU models are designed such that they can run on all hosts. | |
319 | If an application does not wish to do perform any host compatibility checks | |
320 | before launching guests, the default is guaranteed to work. | |
321 | ||
322 | The default CPU models will, however, leave the guest OS vulnerable to various | |
323 | CPU hardware flaws, so their use is strongly discouraged. Applications should | |
324 | follow the earlier guidance to setup a better CPU configuration, with host | |
325 | passthrough recommended if live migration is not needed. | |
326 | ||
327 | @table @option | |
328 | @item @code{qemu32} | |
329 | @item @code{qemu64} | |
330 | ||
331 | QEMU Virtual CPU version 2.5+ (32 & 64 bit variants) | |
332 | ||
333 | qemu64 is used for x86_64 guests and qemu32 is used for i686 guests, when no | |
334 | -cpu argument is given to QEMU, or no <cpu> is provided in libvirt XML. | |
335 | @end table | |
336 | ||
337 | ||
338 | @node other_non_recommended_cpu_models_x86 | |
339 | @subsubsection Other non-recommended x86 CPUs | |
340 | ||
341 | The following CPUs models are compatible with most AMD and Intel x86 hosts, but | |
342 | their usage is discouraged, as they expose a very limited featureset, which | |
343 | prevents guests having optimal performance. | |
344 | ||
345 | @table @option | |
346 | ||
347 | @item @code{kvm32} | |
348 | @item @code{kvm64} | |
349 | ||
350 | Common KVM processor (32 & 64 bit variants) | |
351 | ||
352 | Legacy models just for historical compatibility with ancient QEMU versions. | |
353 | ||
354 | ||
355 | @item @code{486} | |
356 | @item @code{athlon} | |
357 | @item @code{phenom} | |
358 | @item @code{coreduo} | |
359 | @item @code{core2duo} | |
360 | @item @code{n270} | |
361 | @item @code{pentium} | |
362 | @item @code{pentium2} | |
363 | @item @code{pentium3} | |
364 | ||
365 | Various very old x86 CPU models, mostly predating the introduction of | |
366 | hardware assisted virtualization, that should thus not be required for | |
367 | running virtual machines. | |
368 | @end table | |
369 | ||
e5a5b1bb SM |
370 | @node recommendations_cpu_models_MIPS |
371 | @subsection Supported CPU model configurations on MIPS hosts | |
372 | ||
373 | QEMU supports variety of MIPS CPU models: | |
374 | ||
375 | @menu | |
376 | * cpu_models_MIPS32:: Supported CPU models for MIPS32 hosts | |
377 | * cpu_models_MIPS64:: Supported CPU models for MIPS64 hosts | |
378 | * cpu_models_nanoMIPS:: Supported CPU models for nanoMIPS hosts | |
379 | * preferred_cpu_models_MIPS:: Preferred CPU models for MIPS hosts | |
380 | @end menu | |
381 | ||
382 | @node cpu_models_MIPS32 | |
383 | @subsubsection Supported CPU models for MIPS32 hosts | |
384 | ||
385 | The following CPU models are supported for use on MIPS32 hosts. Administrators / | |
386 | applications are recommended to use the CPU model that matches the generation | |
387 | of the host CPUs in use. In a deployment with a mixture of host CPU models | |
388 | between machines, if live migration compatibility is required, use the newest | |
389 | CPU model that is compatible across all desired hosts. | |
390 | ||
391 | @table @option | |
392 | @item @code{mips32r6-generic} | |
393 | ||
394 | MIPS32 Processor (Release 6, 2015) | |
395 | ||
396 | ||
397 | @item @code{P5600} | |
398 | ||
399 | MIPS32 Processor (P5600, 2014) | |
400 | ||
401 | ||
402 | @item @code{M14K} | |
403 | @item @code{M14Kc} | |
404 | ||
405 | MIPS32 Processor (M14K, 2009) | |
406 | ||
407 | ||
408 | @item @code{74Kf} | |
409 | ||
410 | MIPS32 Processor (74K, 2007) | |
411 | ||
412 | ||
413 | @item @code{34Kf} | |
414 | ||
415 | MIPS32 Processor (34K, 2006) | |
416 | ||
417 | ||
418 | @item @code{24Kc} | |
419 | @item @code{24KEc} | |
420 | @item @code{24Kf} | |
421 | ||
422 | MIPS32 Processor (24K, 2003) | |
423 | ||
424 | ||
425 | @item @code{4Kc} | |
426 | @item @code{4Km} | |
427 | @item @code{4KEcR1} | |
428 | @item @code{4KEmR1} | |
429 | @item @code{4KEc} | |
430 | @item @code{4KEm} | |
431 | ||
432 | MIPS32 Processor (4K, 1999) | |
433 | @end table | |
434 | ||
435 | @node cpu_models_MIPS64 | |
436 | @subsubsection Supported CPU models for MIPS64 hosts | |
437 | ||
438 | The following CPU models are supported for use on MIPS64 hosts. Administrators / | |
439 | applications are recommended to use the CPU model that matches the generation | |
440 | of the host CPUs in use. In a deployment with a mixture of host CPU models | |
441 | between machines, if live migration compatibility is required, use the newest | |
442 | CPU model that is compatible across all desired hosts. | |
443 | ||
444 | @table @option | |
445 | @item @code{I6400} | |
446 | ||
447 | MIPS64 Processor (Release 6, 2014) | |
448 | ||
449 | ||
450 | @item @code{Loongson-2F} | |
451 | ||
806be373 | 452 | MIPS64 Processor (Loongson 2, 2008) |
e5a5b1bb SM |
453 | |
454 | ||
455 | @item @code{Loongson-2E} | |
456 | ||
457 | MIPS64 Processor (Loongson 2, 2006) | |
458 | ||
459 | ||
460 | @item @code{mips64dspr2} | |
461 | ||
462 | MIPS64 Processor (Release 2, 2006) | |
463 | ||
464 | ||
465 | @item @code{MIPS64R2-generic} | |
466 | @item @code{5KEc} | |
467 | @item @code{5KEf} | |
468 | ||
469 | MIPS64 Processor (Release 2, 2002) | |
470 | ||
471 | ||
472 | @item @code{20Kc} | |
473 | ||
474 | MIPS64 Processor (20K, 2000) | |
475 | ||
476 | ||
477 | @item @code{5Kc} | |
478 | @item @code{5Kf} | |
479 | ||
480 | MIPS64 Processor (5K, 1999) | |
481 | ||
482 | ||
483 | @item @code{VR5432} | |
484 | ||
485 | MIPS64 Processor (VR, 1998) | |
486 | ||
487 | ||
488 | @item @code{R4000} | |
489 | ||
490 | MIPS64 Processor (MIPS III, 1991) | |
491 | @end table | |
492 | ||
493 | @node cpu_models_nanoMIPS | |
494 | @subsubsection Supported CPU models for nanoMIPS hosts | |
495 | ||
496 | The following CPU models are supported for use on nanoMIPS hosts. Administrators / | |
497 | applications are recommended to use the CPU model that matches the generation | |
498 | of the host CPUs in use. In a deployment with a mixture of host CPU models | |
499 | between machines, if live migration compatibility is required, use the newest | |
500 | CPU model that is compatible across all desired hosts. | |
501 | ||
502 | @table @option | |
503 | @item @code{I7200} | |
504 | ||
505 | MIPS I7200 (nanoMIPS, 2018) | |
506 | ||
507 | @end table | |
508 | ||
509 | @node preferred_cpu_models_MIPS | |
510 | @subsubsection Preferred CPU models for MIPS hosts | |
511 | ||
512 | The following CPU models are preferred for use on different MIPS hosts: | |
513 | ||
514 | @table @option | |
515 | @item @code{MIPS III} | |
516 | R4000 | |
517 | ||
518 | @item @code{MIPS32R2} | |
519 | 34Kf | |
520 | ||
521 | @item @code{MIPS64R6} | |
522 | I6400 | |
523 | ||
524 | @item @code{nanoMIPS} | |
525 | I7200 | |
526 | @end table | |
527 | ||
2544e9e4 DB |
528 | @node cpu_model_syntax_apps |
529 | @subsection Syntax for configuring CPU models | |
530 | ||
531 | The example below illustrate the approach to configuring the various | |
532 | CPU models / features in QEMU and libvirt | |
533 | ||
534 | @menu | |
535 | * cpu_model_syntax_qemu:: QEMU command line | |
536 | * cpu_model_syntax_libvirt:: Libvirt guest XML | |
537 | @end menu | |
538 | ||
539 | @node cpu_model_syntax_qemu | |
540 | @subsubsection QEMU command line | |
541 | ||
542 | @table @option | |
543 | ||
544 | @item Host passthrough | |
545 | ||
546 | @example | |
547 | $ qemu-system-x86_64 -cpu host | |
548 | @end example | |
549 | ||
550 | With feature customization: | |
551 | ||
552 | @example | |
553 | $ qemu-system-x86_64 -cpu host,-vmx,... | |
554 | @end example | |
555 | ||
556 | @item Named CPU models | |
557 | ||
558 | @example | |
559 | $ qemu-system-x86_64 -cpu Westmere | |
560 | @end example | |
561 | ||
562 | With feature customization: | |
563 | ||
564 | @example | |
565 | $ qemu-system-x86_64 -cpu Westmere,+pcid,... | |
566 | @end example | |
567 | ||
568 | @end table | |
569 | ||
570 | @node cpu_model_syntax_libvirt | |
571 | @subsubsection Libvirt guest XML | |
572 | ||
573 | @table @option | |
574 | ||
575 | @item Host passthrough | |
576 | ||
577 | @example | |
578 | <cpu mode='host-passthrough'/> | |
579 | @end example | |
580 | ||
581 | With feature customization: | |
582 | ||
583 | @example | |
584 | <cpu mode='host-passthrough'> | |
585 | <feature name="vmx" policy="disable"/> | |
586 | ... | |
587 | </cpu> | |
588 | @end example | |
589 | ||
590 | @item Host model | |
591 | ||
592 | @example | |
593 | <cpu mode='host-model'/> | |
594 | @end example | |
595 | ||
596 | With feature customization: | |
597 | ||
598 | @example | |
599 | <cpu mode='host-model'> | |
600 | <feature name="vmx" policy="disable"/> | |
601 | ... | |
602 | </cpu> | |
603 | @end example | |
604 | ||
605 | @item Named model | |
606 | ||
607 | @example | |
608 | <cpu mode='custom'> | |
609 | <model name="Westmere"/> | |
610 | </cpu> | |
611 | @end example | |
612 | ||
613 | With feature customization: | |
614 | ||
615 | @example | |
616 | <cpu mode='custom'> | |
617 | <model name="Westmere"/> | |
618 | <feature name="pcid" policy="require"/> | |
619 | ... | |
620 | </cpu> | |
621 | @end example | |
622 | ||
623 | @end table | |
624 | ||
625 | @c man end | |
626 | ||
627 | @ignore | |
628 | ||
629 | @setfilename qemu-cpu-models | |
630 | @settitle QEMU / KVM CPU model configuration | |
631 | ||
632 | @c man begin SEEALSO | |
633 | The HTML documentation of QEMU for more precise information and Linux | |
634 | user mode emulator invocation. | |
635 | @c man end | |
636 | ||
637 | @c man begin AUTHOR | |
638 | Daniel P. Berrange | |
639 | @c man end | |
640 | ||
641 | @end ignore |