bump version to 7.4-3
[qemu-server.git] / PVE / QemuServer / CPUConfig.pm
1 package PVE::QemuServer::CPUConfig;
2
3 use strict;
4 use warnings;
5
6 use PVE::JSONSchema;
7 use PVE::Cluster qw(cfs_register_file cfs_read_file);
8 use PVE::QemuServer::Helpers qw(min_version);
9
10 use base qw(PVE::SectionConfig Exporter);
11
12 our @EXPORT_OK = qw(
13 print_cpu_device
14 get_cpu_options
15 );
16
17 # under certain race-conditions, this module might be loaded before pve-cluster
18 # has started completely, so ensure we don't prevent the FUSE mount with our dir
19 if (PVE::Cluster::check_cfs_is_mounted(1)) {
20 mkdir "/etc/pve/virtual-guest";
21 }
22
23 my $default_filename = "virtual-guest/cpu-models.conf";
24 cfs_register_file($default_filename,
25 sub { PVE::QemuServer::CPUConfig->parse_config(@_); },
26 sub { PVE::QemuServer::CPUConfig->write_config(@_); });
27
28 sub load_custom_model_conf {
29 return cfs_read_file($default_filename);
30 }
31
32 my $cpu_vendor_list = {
33 # Intel CPUs
34 486 => 'GenuineIntel',
35 pentium => 'GenuineIntel',
36 pentium2 => 'GenuineIntel',
37 pentium3 => 'GenuineIntel',
38 coreduo => 'GenuineIntel',
39 core2duo => 'GenuineIntel',
40 Conroe => 'GenuineIntel',
41 Penryn => 'GenuineIntel',
42 Nehalem => 'GenuineIntel',
43 'Nehalem-IBRS' => 'GenuineIntel',
44 Westmere => 'GenuineIntel',
45 'Westmere-IBRS' => 'GenuineIntel',
46 SandyBridge => 'GenuineIntel',
47 'SandyBridge-IBRS' => 'GenuineIntel',
48 IvyBridge => 'GenuineIntel',
49 'IvyBridge-IBRS' => 'GenuineIntel',
50 Haswell => 'GenuineIntel',
51 'Haswell-IBRS' => 'GenuineIntel',
52 'Haswell-noTSX' => 'GenuineIntel',
53 'Haswell-noTSX-IBRS' => 'GenuineIntel',
54 Broadwell => 'GenuineIntel',
55 'Broadwell-IBRS' => 'GenuineIntel',
56 'Broadwell-noTSX' => 'GenuineIntel',
57 'Broadwell-noTSX-IBRS' => 'GenuineIntel',
58 'Skylake-Client' => 'GenuineIntel',
59 'Skylake-Client-IBRS' => 'GenuineIntel',
60 'Skylake-Client-noTSX-IBRS' => 'GenuineIntel',
61 'Skylake-Server' => 'GenuineIntel',
62 'Skylake-Server-IBRS' => 'GenuineIntel',
63 'Skylake-Server-noTSX-IBRS' => 'GenuineIntel',
64 'Cascadelake-Server' => 'GenuineIntel',
65 'Cascadelake-Server-noTSX' => 'GenuineIntel',
66 KnightsMill => 'GenuineIntel',
67 'Icelake-Client' => 'GenuineIntel',
68 'Icelake-Client-noTSX' => 'GenuineIntel',
69 'Icelake-Server' => 'GenuineIntel',
70 'Icelake-Server-noTSX' => 'GenuineIntel',
71
72 # AMD CPUs
73 athlon => 'AuthenticAMD',
74 phenom => 'AuthenticAMD',
75 Opteron_G1 => 'AuthenticAMD',
76 Opteron_G2 => 'AuthenticAMD',
77 Opteron_G3 => 'AuthenticAMD',
78 Opteron_G4 => 'AuthenticAMD',
79 Opteron_G5 => 'AuthenticAMD',
80 EPYC => 'AuthenticAMD',
81 'EPYC-IBPB' => 'AuthenticAMD',
82 'EPYC-Rome' => 'AuthenticAMD',
83
84 # generic types, use vendor from host node
85 host => 'default',
86 kvm32 => 'default',
87 kvm64 => 'default',
88 qemu32 => 'default',
89 qemu64 => 'default',
90 max => 'default',
91 };
92
93 my @supported_cpu_flags = (
94 'pcid',
95 'spec-ctrl',
96 'ibpb',
97 'ssbd',
98 'virt-ssbd',
99 'amd-ssbd',
100 'amd-no-ssb',
101 'pdpe1gb',
102 'md-clear',
103 'hv-tlbflush',
104 'hv-evmcs',
105 'aes'
106 );
107 my $cpu_flag_supported_re = qr/([+-])(@{[join('|', @supported_cpu_flags)]})/;
108 my $cpu_flag_any_re = qr/([+-])([a-zA-Z0-9\-_\.]+)/;
109
110 our $qemu_cmdline_cpu_re = qr/^((?>[+-]?[\w\-_=]+,?)+)$/;
111
112 my $cpu_fmt = {
113 cputype => {
114 description => "Emulated CPU type. Can be default or custom name (custom model names must be prefixed with 'custom-').",
115 type => 'string',
116 format_description => 'string',
117 default => 'kvm64',
118 default_key => 1,
119 optional => 1,
120 },
121 'reported-model' => {
122 description => "CPU model and vendor to report to the guest. Must be a QEMU/KVM supported model."
123 . " Only valid for custom CPU model definitions, default models will always report themselves to the guest OS.",
124 type => 'string',
125 enum => [ sort { lc("$a") cmp lc("$b") } keys %$cpu_vendor_list ],
126 default => 'kvm64',
127 optional => 1,
128 },
129 hidden => {
130 description => "Do not identify as a KVM virtual machine.",
131 type => 'boolean',
132 optional => 1,
133 default => 0
134 },
135 'hv-vendor-id' => {
136 type => 'string',
137 pattern => qr/[a-zA-Z0-9]{1,12}/,
138 format_description => 'vendor-id',
139 description => 'The Hyper-V vendor ID. Some drivers or programs inside Windows guests need a specific ID.',
140 optional => 1,
141 },
142 flags => {
143 description => "List of additional CPU flags separated by ';'."
144 . " Use '+FLAG' to enable, '-FLAG' to disable a flag."
145 . " Custom CPU models can specify any flag supported by"
146 . " QEMU/KVM, VM-specific flags must be from the following"
147 . " set for security reasons: @{[join(', ', @supported_cpu_flags)]}.",
148 format_description => '+FLAG[;-FLAG...]',
149 type => 'string',
150 pattern => qr/$cpu_flag_any_re(;$cpu_flag_any_re)*/,
151 optional => 1,
152 },
153 'phys-bits' => {
154 type => 'string',
155 format => 'pve-phys-bits',
156 description => "The physical memory address bits that are reported to"
157 . " the guest OS. Should be smaller or equal to the host's."
158 . " Set to 'host' to use value from host CPU, but note that"
159 . " doing so will break live migration to CPUs with other values.",
160 optional => 1,
161 },
162 };
163
164 PVE::JSONSchema::register_format('pve-phys-bits', \&parse_phys_bits);
165 sub parse_phys_bits {
166 my ($str, $noerr) = @_;
167
168 my $err_msg = "value must be an integer between 8 and 64 or 'host'\n";
169
170 if ($str !~ m/^(host|\d{1,2})$/) {
171 die $err_msg if !$noerr;
172 return undef;
173 }
174
175 if ($str =~ m/^\d+$/ && (int($str) < 8 || int($str) > 64)) {
176 die $err_msg if !$noerr;
177 return undef;
178 }
179
180 return $str;
181 }
182
183 # $cpu_fmt describes both the CPU config passed as part of a VM config, as well
184 # as the definition of a custom CPU model. There are some slight differences
185 # though, which we catch in the custom verification function below.
186 PVE::JSONSchema::register_format('pve-cpu-conf', \&parse_cpu_conf_basic);
187 sub parse_cpu_conf_basic {
188 my ($cpu_str, $noerr) = @_;
189
190 my $cpu = eval { PVE::JSONSchema::parse_property_string($cpu_fmt, $cpu_str) };
191 if ($@) {
192 die $@ if !$noerr;
193 return undef;
194 }
195
196 # required, but can't be forced in schema since it's encoded in section
197 # header for custom models
198 if (!$cpu->{cputype}) {
199 die "CPU is missing cputype\n" if !$noerr;
200 return undef;
201 }
202
203 return $cpu;
204 }
205
206 PVE::JSONSchema::register_format('pve-vm-cpu-conf', \&parse_vm_cpu_conf);
207 sub parse_vm_cpu_conf {
208 my ($cpu_str, $noerr) = @_;
209
210 my $cpu = parse_cpu_conf_basic($cpu_str, $noerr);
211 return undef if !$cpu;
212
213 my $cputype = $cpu->{cputype};
214
215 # a VM-specific config is only valid if the cputype exists
216 if (is_custom_model($cputype)) {
217 eval { get_custom_model($cputype); };
218 if ($@) {
219 die $@ if !$noerr;
220 return undef;
221 }
222 } else {
223 if (!defined($cpu_vendor_list->{$cputype})) {
224 die "Built-in cputype '$cputype' is not defined (missing 'custom-' prefix?)\n" if !$noerr;
225 return undef;
226 }
227 }
228
229 # in a VM-specific config, certain properties are limited/forbidden
230
231 if ($cpu->{flags} && $cpu->{flags} !~ m/$cpu_flag_supported_re(;$cpu_flag_supported_re)*/) {
232 die "VM-specific CPU flags must be a subset of: @{[join(', ', @supported_cpu_flags)]}\n"
233 if !$noerr;
234 return undef;
235 }
236
237 die "Property 'reported-model' not allowed in VM-specific CPU config.\n"
238 if defined($cpu->{'reported-model'});
239
240 return $cpu;
241 }
242
243 # Section config settings
244 my $defaultData = {
245 # shallow copy, since SectionConfig modifies propertyList internally
246 propertyList => { %$cpu_fmt },
247 };
248
249 sub private {
250 return $defaultData;
251 }
252
253 sub options {
254 return { %$cpu_fmt };
255 }
256
257 sub type {
258 return 'cpu-model';
259 }
260
261 sub parse_section_header {
262 my ($class, $line) = @_;
263
264 my ($type, $sectionId, $errmsg, $config) =
265 $class->SUPER::parse_section_header($line);
266
267 return undef if !$type;
268 return ($type, $sectionId, $errmsg, {
269 # name is given by section header, and we can always prepend 'custom-'
270 # since we're reading the custom CPU file
271 cputype => "custom-$sectionId",
272 });
273 }
274
275 sub write_config {
276 my ($class, $filename, $cfg) = @_;
277
278 mkdir "/etc/pve/virtual-guest";
279
280 for my $model (keys %{$cfg->{ids}}) {
281 my $model_conf = $cfg->{ids}->{$model};
282
283 die "internal error: tried saving built-in CPU model (or missing prefix): $model_conf->{cputype}\n"
284 if !is_custom_model($model_conf->{cputype});
285
286 die "internal error: tried saving custom cpumodel with cputype (ignoring prefix: $model_conf->{cputype}) not equal to \$cfg->ids entry ($model)\n"
287 if "custom-$model" ne $model_conf->{cputype};
288
289 # saved in section header
290 delete $model_conf->{cputype};
291 }
292
293 $class->SUPER::write_config($filename, $cfg);
294 }
295
296 sub get_cpu_models {
297 my ($include_custom) = @_;
298
299 my $models = [];
300
301 for my $default_model (keys %{$cpu_vendor_list}) {
302 push @$models, {
303 name => $default_model,
304 custom => 0,
305 vendor => $cpu_vendor_list->{$default_model},
306 };
307 }
308
309 return $models if !$include_custom;
310
311 my $conf = load_custom_model_conf();
312 for my $custom_model (keys %{$conf->{ids}}) {
313 my $reported_model = $conf->{ids}->{$custom_model}->{'reported-model'};
314 $reported_model //= $cpu_fmt->{'reported-model'}->{default};
315 my $vendor = $cpu_vendor_list->{$reported_model};
316 push @$models, {
317 name => "custom-$custom_model",
318 custom => 1,
319 vendor => $vendor,
320 };
321 }
322
323 return $models;
324 }
325
326 sub is_custom_model {
327 my ($cputype) = @_;
328 return $cputype =~ m/^custom-/;
329 }
330
331 # Use this to get a single model in the format described by $cpu_fmt.
332 # Allows names with and without custom- prefix.
333 sub get_custom_model {
334 my ($name, $noerr) = @_;
335
336 $name =~ s/^custom-//;
337 my $conf = load_custom_model_conf();
338
339 my $entry = $conf->{ids}->{$name};
340 if (!defined($entry)) {
341 die "Custom cputype '$name' not found\n" if !$noerr;
342 return undef;
343 }
344
345 my $model = {};
346 for my $property (keys %$cpu_fmt) {
347 if (my $value = $entry->{$property}) {
348 $model->{$property} = $value;
349 }
350 }
351
352 return $model;
353 }
354
355 # Print a QEMU device node for a given VM configuration for hotplugging CPUs
356 sub print_cpu_device {
357 my ($conf, $id) = @_;
358
359 my $kvm = $conf->{kvm} // 1;
360 my $cpu = $kvm ? "kvm64" : "qemu64";
361 if (my $cputype = $conf->{cpu}) {
362 my $cpuconf = parse_cpu_conf_basic($cputype)
363 or die "Cannot parse cpu description: $cputype\n";
364 $cpu = $cpuconf->{cputype};
365
366 if (is_custom_model($cpu)) {
367 my $custom_cpu = get_custom_model($cpu);
368
369 $cpu = $custom_cpu->{'reported-model'} //
370 $cpu_fmt->{'reported-model'}->{default};
371 }
372 }
373
374 my $cores = $conf->{cores} || 1;
375
376 my $current_core = ($id - 1) % $cores;
377 my $current_socket = int(($id - 1 - $current_core)/$cores);
378
379 return "$cpu-x86_64-cpu,id=cpu$id,socket-id=$current_socket,core-id=$current_core,thread-id=0";
380 }
381
382 # Resolves multiple arrays of hashes representing CPU flags with metadata to a
383 # single string in QEMU "-cpu" compatible format. Later arrays have higher
384 # priority.
385 #
386 # Hashes take the following format:
387 # {
388 # aes => {
389 # op => "+", # defaults to "" if undefined
390 # reason => "to support AES acceleration", # for override warnings
391 # value => "" # needed for kvm=off (value: off) etc...
392 # },
393 # ...
394 # }
395 sub resolve_cpu_flags {
396 my $flags = {};
397
398 for my $hash (@_) {
399 for my $flag_name (keys %$hash) {
400 my $flag = $hash->{$flag_name};
401 my $old_flag = $flags->{$flag_name};
402
403 $flag->{op} //= "";
404 $flag->{reason} //= "unknown origin";
405
406 if ($old_flag) {
407 my $value_changed = (defined($flag->{value}) != defined($old_flag->{value})) ||
408 (defined($flag->{value}) && $flag->{value} ne $old_flag->{value});
409
410 if ($old_flag->{op} eq $flag->{op} && !$value_changed) {
411 $flags->{$flag_name}->{reason} .= " & $flag->{reason}";
412 next;
413 }
414
415 my $old = print_cpuflag_hash($flag_name, $flags->{$flag_name});
416 my $new = print_cpuflag_hash($flag_name, $flag);
417 warn "warning: CPU flag/setting $new overwrites $old\n";
418 }
419
420 $flags->{$flag_name} = $flag;
421 }
422 }
423
424 my $flag_str = '';
425 # sort for command line stability
426 for my $flag_name (sort keys %$flags) {
427 $flag_str .= ',';
428 $flag_str .= $flags->{$flag_name}->{op};
429 $flag_str .= $flag_name;
430 $flag_str .= "=$flags->{$flag_name}->{value}"
431 if $flags->{$flag_name}->{value};
432 }
433
434 return $flag_str;
435 }
436
437 sub print_cpuflag_hash {
438 my ($flag_name, $flag) = @_;
439 my $formatted = "'$flag->{op}$flag_name";
440 $formatted .= "=$flag->{value}" if defined($flag->{value});
441 $formatted .= "'";
442 $formatted .= " ($flag->{reason})" if defined($flag->{reason});
443 return $formatted;
444 }
445
446 sub parse_cpuflag_list {
447 my ($re, $reason, $flaglist) = @_;
448
449 my $res = {};
450 return $res if !$flaglist;
451
452 foreach my $flag (split(";", $flaglist)) {
453 if ($flag =~ $re) {
454 $res->{$2} = { op => $1, reason => $reason };
455 }
456 }
457
458 return $res;
459 }
460
461 # Calculate QEMU's '-cpu' argument from a given VM configuration
462 sub get_cpu_options {
463 my ($conf, $arch, $kvm, $kvm_off, $machine_version, $winversion, $gpu_passthrough) = @_;
464
465 my $cputype = $kvm ? "kvm64" : "qemu64";
466 if ($arch eq 'aarch64') {
467 $cputype = 'cortex-a57';
468 }
469
470 my $cpu = {};
471 my $custom_cpu;
472 my $hv_vendor_id;
473 if (my $cpu_prop_str = $conf->{cpu}) {
474 $cpu = parse_vm_cpu_conf($cpu_prop_str)
475 or die "Cannot parse cpu description: $cpu_prop_str\n";
476
477 $cputype = $cpu->{cputype};
478
479 if (is_custom_model($cputype)) {
480 $custom_cpu = get_custom_model($cputype);
481
482 $cputype = $custom_cpu->{'reported-model'} //
483 $cpu_fmt->{'reported-model'}->{default};
484 $kvm_off = $custom_cpu->{hidden}
485 if defined($custom_cpu->{hidden});
486 $hv_vendor_id = $custom_cpu->{'hv-vendor-id'};
487 }
488
489 # VM-specific settings override custom CPU config
490 $kvm_off = $cpu->{hidden}
491 if defined($cpu->{hidden});
492 $hv_vendor_id = $cpu->{'hv-vendor-id'}
493 if defined($cpu->{'hv-vendor-id'});
494 }
495
496 my $pve_flags = get_pve_cpu_flags($conf, $kvm, $cputype, $arch,
497 $machine_version);
498
499 my $hv_flags = get_hyperv_enlightenments($winversion, $machine_version,
500 $conf->{bios}, $gpu_passthrough, $hv_vendor_id) if $kvm;
501
502 my $custom_cputype_flags = parse_cpuflag_list($cpu_flag_any_re,
503 "set by custom CPU model", $custom_cpu->{flags});
504
505 my $vm_flags = parse_cpuflag_list($cpu_flag_supported_re,
506 "manually set for VM", $cpu->{flags});
507
508 my $pve_forced_flags = {};
509 $pve_forced_flags->{'enforce'} = {
510 reason => "error if requested CPU settings not available",
511 } if $cputype ne 'host' && $kvm && $arch eq 'x86_64';
512 $pve_forced_flags->{'kvm'} = {
513 value => "off",
514 reason => "hide KVM virtualization from guest",
515 } if $kvm_off;
516
517 # $cputype is the "reported-model" for custom types, so we can just look up
518 # the vendor in the default list
519 my $cpu_vendor = $cpu_vendor_list->{$cputype};
520 if ($cpu_vendor) {
521 $pve_forced_flags->{'vendor'} = {
522 value => $cpu_vendor,
523 } if $cpu_vendor ne 'default';
524 } elsif ($arch ne 'aarch64') {
525 die "internal error"; # should not happen
526 }
527
528 my $cpu_str = $cputype;
529
530 # will be resolved in parameter order
531 $cpu_str .= resolve_cpu_flags($pve_flags, $hv_flags, $custom_cputype_flags,
532 $vm_flags, $pve_forced_flags);
533
534 my $phys_bits = '';
535 foreach my $conf ($custom_cpu, $cpu) {
536 next if !defined($conf);
537 my $conf_val = $conf->{'phys-bits'};
538 next if !$conf_val;
539 if ($conf_val eq 'host') {
540 $phys_bits = ",host-phys-bits=true";
541 } else {
542 $phys_bits = ",phys-bits=$conf_val";
543 }
544 }
545 $cpu_str .= $phys_bits;
546
547 return ('-cpu', $cpu_str);
548 }
549
550 # Some hardcoded flags required by certain configurations
551 sub get_pve_cpu_flags {
552 my ($conf, $kvm, $cputype, $arch, $machine_version) = @_;
553
554 my $pve_flags = {};
555 my $pve_msg = "set by PVE;";
556
557 $pve_flags->{'lahf_lm'} = {
558 op => '+',
559 reason => "$pve_msg to support Windows 8.1+",
560 } if $cputype eq 'kvm64' && $arch eq 'x86_64';
561
562 $pve_flags->{'x2apic'} = {
563 op => '-',
564 reason => "$pve_msg incompatible with Solaris",
565 } if $conf->{ostype} && $conf->{ostype} eq 'solaris';
566
567 $pve_flags->{'sep'} = {
568 op => '+',
569 reason => "$pve_msg to support Windows 8+ and improve Windows XP+",
570 } if $cputype eq 'kvm64' || $cputype eq 'kvm32';
571
572 $pve_flags->{'rdtscp'} = {
573 op => '-',
574 reason => "$pve_msg broken on AMD Opteron",
575 } if $cputype =~ m/^Opteron/;
576
577 if (min_version($machine_version, 2, 3) && $kvm && $arch eq 'x86_64') {
578 $pve_flags->{'kvm_pv_unhalt'} = {
579 op => '+',
580 reason => "$pve_msg to improve Linux guest spinlock performance",
581 };
582 $pve_flags->{'kvm_pv_eoi'} = {
583 op => '+',
584 reason => "$pve_msg to improve Linux guest interrupt performance",
585 };
586 }
587
588 return $pve_flags;
589 }
590
591 sub get_hyperv_enlightenments {
592 my ($winversion, $machine_version, $bios, $gpu_passthrough, $hv_vendor_id) = @_;
593
594 return if $winversion < 6;
595 return if $bios && $bios eq 'ovmf' && $winversion < 8;
596
597 my $flags = {};
598 my $default_reason = "automatic Hyper-V enlightenment for Windows";
599 my $flagfn = sub {
600 my ($flag, $value, $reason) = @_;
601 $flags->{$flag} = {
602 reason => $reason // $default_reason,
603 value => $value,
604 }
605 };
606
607 my $hv_vendor_set = defined($hv_vendor_id);
608 if ($gpu_passthrough || $hv_vendor_set) {
609 $hv_vendor_id //= 'proxmox';
610 $flagfn->('hv_vendor_id', $hv_vendor_id, $hv_vendor_set ?
611 "custom hv_vendor_id set" : "NVIDIA workaround for GPU passthrough");
612 }
613
614 if (min_version($machine_version, 2, 3)) {
615 $flagfn->('hv_spinlocks', '0x1fff');
616 $flagfn->('hv_vapic');
617 $flagfn->('hv_time');
618 } else {
619 $flagfn->('hv_spinlocks', '0xffff');
620 }
621
622 if (min_version($machine_version, 2, 6)) {
623 $flagfn->('hv_reset');
624 $flagfn->('hv_vpindex');
625 $flagfn->('hv_runtime');
626 }
627
628 if ($winversion >= 7) {
629 my $win7_reason = $default_reason . " 7 and higher";
630 $flagfn->('hv_relaxed', undef, $win7_reason);
631
632 if (min_version($machine_version, 2, 12)) {
633 $flagfn->('hv_synic', undef, $win7_reason);
634 $flagfn->('hv_stimer', undef, $win7_reason);
635 }
636
637 if (min_version($machine_version, 3, 1)) {
638 $flagfn->('hv_ipi', undef, $win7_reason);
639 }
640 }
641
642 return $flags;
643 }
644
645 sub get_cpu_from_running_vm {
646 my ($pid) = @_;
647
648 my $cmdline = PVE::QemuServer::Helpers::parse_cmdline($pid);
649 die "could not read commandline of running machine\n"
650 if !$cmdline->{cpu}->{value};
651
652 # sanitize and untaint value
653 $cmdline->{cpu}->{value} =~ $qemu_cmdline_cpu_re;
654 return $1;
655 }
656
657 __PACKAGE__->register();
658 __PACKAGE__->init();
659
660 1;