.\" Automatically generated by Pod::Man 4.10 (Pod::Simple 3.35) .\" .\" Standard preamble: .\" ======================================================================== .de Sp \" Vertical space (when we can't use .PP) .if t .sp .5v .if n .sp .. .de Vb \" Begin verbatim text .ft CW .nf .ne \\$1 .. .de Ve \" End verbatim text .ft R .fi .. .\" Set up some character translations and predefined strings. \*(-- will .\" give an unbreakable dash, \*(PI will give pi, \*(L" will give a left .\" double quote, and \*(R" will give a right double quote. \*(C+ will .\" give a nicer C++. Capital omega is used to do unbreakable dashes and .\" therefore won't be available. \*(C` and \*(C' expand to `' in nroff, .\" nothing in troff, for use with C<>. .tr \(*W- .ds C+ C\v'-.1v'\h'-1p'\s-2+\h'-1p'+\s0\v'.1v'\h'-1p' .ie n \{\ . ds -- \(*W- . ds PI pi . if (\n(.H=4u)&(1m=24u) .ds -- \(*W\h'-12u'\(*W\h'-12u'-\" diablo 10 pitch . if (\n(.H=4u)&(1m=20u) .ds -- \(*W\h'-12u'\(*W\h'-8u'-\" diablo 12 pitch . ds L" "" . ds R" "" . ds C` "" . ds C' "" 'br\} .el\{\ . ds -- \|\(em\| . ds PI \(*p . ds L" `` . ds R" '' . ds C` . ds C' 'br\} .\" .\" Escape single quotes in literal strings from groff's Unicode transform. .ie \n(.g .ds Aq \(aq .el .ds Aq ' .\" .\" If the F register is >0, we'll generate index entries on stderr for .\" titles (.TH), headers (.SH), subsections (.SS), items (.Ip), and index .\" entries marked with X<> in POD. Of course, you'll have to process the .\" output yourself in some meaningful fashion. .\" .\" Avoid warning from groff about undefined register 'F'. .de IX .. .nr rF 0 .if \n(.g .if rF .nr rF 1 .if (\n(rF:(\n(.g==0)) \{\ . if \nF \{\ . de IX . tm Index:\\$1\t\\n%\t"\\$2" .. . if !\nF==2 \{\ . nr % 0 . nr F 2 . \} . \} .\} .rr rF .\" ======================================================================== .\" .IX Title "QEMU-CPU-MODELS.7 7" .TH QEMU-CPU-MODELS.7 7 "2020-07-24" " " " " .\" For nroff, turn off justification. Always turn off hyphenation; it makes .\" way too many mistakes in technical documents. .if n .ad l .nh .SH "NAME" qemu\-cpu\-models \- QEMU / KVM CPU model configuration .SH "SYNOPSIS" .IX Header "SYNOPSIS" \&\s-1QEMU / KVM CPU\s0 model configuration .SH "DESCRIPTION" .IX Header "DESCRIPTION" \&\s-1QEMU / KVM\s0 virtualization supports two ways to configure \s-1CPU\s0 models .IP "\fBHost passthrough\fR" 4 .IX Item "Host passthrough" This passes the host \s-1CPU\s0 model features, model, stepping, exactly to the guest. Note that \s-1KVM\s0 may filter out some host \s-1CPU\s0 model features if they cannot be supported with virtualization. Live migration is unsafe when this mode is used as libvirt / \s-1QEMU\s0 cannot guarantee a stable \s-1CPU\s0 is exposed to the guest across hosts. This is the recommended \s-1CPU\s0 to use, provided live migration is not required. .IP "\fBNamed model\fR" 4 .IX Item "Named model" \&\s-1QEMU\s0 comes with a number of predefined named \s-1CPU\s0 models, that typically refer to specific generations of hardware released by Intel and \s-1AMD.\s0 These allow the guest VMs to have a degree of isolation from the host \s-1CPU,\s0 allowing greater flexibility in live migrating between hosts with differing hardware. .PP In both cases, it is possible to optionally add or remove individual \s-1CPU\s0 features, to alter what is presented to the guest by default. .PP Libvirt supports a third way to configure \s-1CPU\s0 models known as \*(L"Host model\*(R". This uses the \s-1QEMU\s0 \*(L"Named model\*(R" feature, automatically picking a \s-1CPU\s0 model that is similar the host \s-1CPU,\s0 and then adding extra features to approximate the host model as closely as possible. This does not guarantee the \s-1CPU\s0 family, stepping, etc will precisely match the host \s-1CPU,\s0 as they would with \*(L"Host passthrough\*(R", but gives much of the benefit of passthrough, while making live migration safe. .PP \fIRecommendations for \s-1KVM CPU\s0 model configuration on x86 hosts\fR .IX Subsection "Recommendations for KVM CPU model configuration on x86 hosts" .PP The information that follows provides recommendations for configuring \&\s-1CPU\s0 models on x86 hosts. The goals are to maximise performance, while protecting guest \s-1OS\s0 against various \s-1CPU\s0 hardware flaws, and optionally enabling live migration between hosts with hetergeneous \s-1CPU\s0 models. .PP Preferred \s-1CPU\s0 models for Intel x86 hosts .IX Subsection "Preferred CPU models for Intel x86 hosts" .PP The following \s-1CPU\s0 models are preferred for use on Intel hosts. Administrators / applications are recommended to use the \s-1CPU\s0 model that matches the generation of the host CPUs in use. In a deployment with a mixture of host \s-1CPU\s0 models between machines, if live migration compatibility is required, use the newest \&\s-1CPU\s0 model that is compatible across all desired hosts. .ie n .IP "\fB\f(CB""Skylake\-Server""\fB\fR" 4 .el .IP "\fB\f(CBSkylake\-Server\fB\fR" 4 .IX Item "Skylake-Server" .PD 0 .ie n .IP "\fB\f(CB""Skylake\-Server\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBSkylake\-Server\-IBRS\fB\fR" 4 .IX Item "Skylake-Server-IBRS" .PD Intel Xeon Processor (Skylake, 2016) .ie n .IP "\fB\f(CB""Skylake\-Client""\fB\fR" 4 .el .IP "\fB\f(CBSkylake\-Client\fB\fR" 4 .IX Item "Skylake-Client" .PD 0 .ie n .IP "\fB\f(CB""Skylake\-Client\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBSkylake\-Client\-IBRS\fB\fR" 4 .IX Item "Skylake-Client-IBRS" .PD Intel Core Processor (Skylake, 2015) .ie n .IP "\fB\f(CB""Broadwell""\fB\fR" 4 .el .IP "\fB\f(CBBroadwell\fB\fR" 4 .IX Item "Broadwell" .PD 0 .ie n .IP "\fB\f(CB""Broadwell\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBBroadwell\-IBRS\fB\fR" 4 .IX Item "Broadwell-IBRS" .ie n .IP "\fB\f(CB""Broadwell\-noTSX""\fB\fR" 4 .el .IP "\fB\f(CBBroadwell\-noTSX\fB\fR" 4 .IX Item "Broadwell-noTSX" .ie n .IP "\fB\f(CB""Broadwell\-noTSX\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBBroadwell\-noTSX\-IBRS\fB\fR" 4 .IX Item "Broadwell-noTSX-IBRS" .PD Intel Core Processor (Broadwell, 2014) .ie n .IP "\fB\f(CB""Haswell""\fB\fR" 4 .el .IP "\fB\f(CBHaswell\fB\fR" 4 .IX Item "Haswell" .PD 0 .ie n .IP "\fB\f(CB""Haswell\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBHaswell\-IBRS\fB\fR" 4 .IX Item "Haswell-IBRS" .ie n .IP "\fB\f(CB""Haswell\-noTSX""\fB\fR" 4 .el .IP "\fB\f(CBHaswell\-noTSX\fB\fR" 4 .IX Item "Haswell-noTSX" .ie n .IP "\fB\f(CB""Haswell\-noTSX\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBHaswell\-noTSX\-IBRS\fB\fR" 4 .IX Item "Haswell-noTSX-IBRS" .PD Intel Core Processor (Haswell, 2013) .ie n .IP "\fB\f(CB""IvyBridge""\fB\fR" 4 .el .IP "\fB\f(CBIvyBridge\fB\fR" 4 .IX Item "IvyBridge" .PD 0 .ie n .IP "\fB\f(CB""IvyBridge\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBIvyBridge\-IBRS\fB\fR" 4 .IX Item "IvyBridge-IBRS" .PD Intel Xeon E3\-12xx v2 (Ivy Bridge, 2012) .ie n .IP "\fB\f(CB""SandyBridge""\fB\fR" 4 .el .IP "\fB\f(CBSandyBridge\fB\fR" 4 .IX Item "SandyBridge" .PD 0 .ie n .IP "\fB\f(CB""SandyBridge\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBSandyBridge\-IBRS\fB\fR" 4 .IX Item "SandyBridge-IBRS" .PD Intel Xeon E312xx (Sandy Bridge, 2011) .ie n .IP "\fB\f(CB""Westmere""\fB\fR" 4 .el .IP "\fB\f(CBWestmere\fB\fR" 4 .IX Item "Westmere" .PD 0 .ie n .IP "\fB\f(CB""Westmere\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBWestmere\-IBRS\fB\fR" 4 .IX Item "Westmere-IBRS" .PD Westmere E56xx/L56xx/X56xx (Nehalem-C, 2010) .ie n .IP "\fB\f(CB""Nehalem""\fB\fR" 4 .el .IP "\fB\f(CBNehalem\fB\fR" 4 .IX Item "Nehalem" .PD 0 .ie n .IP "\fB\f(CB""Nehalem\-IBRS""\fB\fR" 4 .el .IP "\fB\f(CBNehalem\-IBRS\fB\fR" 4 .IX Item "Nehalem-IBRS" .PD Intel Core i7 9xx (Nehalem Class Core i7, 2008) .ie n .IP "\fB\f(CB""Penryn""\fB\fR" 4 .el .IP "\fB\f(CBPenryn\fB\fR" 4 .IX Item "Penryn" Intel Core 2 Duo P9xxx (Penryn Class Core 2, 2007) .ie n .IP "\fB\f(CB""Conroe""\fB\fR" 4 .el .IP "\fB\f(CBConroe\fB\fR" 4 .IX Item "Conroe" Intel Celeron_4x0 (Conroe/Merom Class Core 2, 2006) .PP Important \s-1CPU\s0 features for Intel x86 hosts .IX Subsection "Important CPU features for Intel x86 hosts" .PP The following are important \s-1CPU\s0 features that should be used on Intel x86 hosts, when available in the host \s-1CPU.\s0 Some of them require explicit configuration to enable, as they are not included by default in some, or all, of the named \s-1CPU\s0 models listed above. In general all of these features are included if using \*(L"Host passthrough\*(R" or \*(L"Host model\*(R". .ie n .IP "\fB\f(CB""pcid""\fB\fR" 4 .el .IP "\fB\f(CBpcid\fB\fR" 4 .IX Item "pcid" Recommended to mitigate the cost of the Meltdown (\s-1CVE\-2017\-5754\s0) fix .Sp Included by default in Haswell, Broadwell & Skylake Intel \s-1CPU\s0 models. .Sp Should be explicitly turned on for Westmere, SandyBridge, and IvyBridge Intel \s-1CPU\s0 models. Note that some desktop/mobile Westmere CPUs cannot support this feature. .ie n .IP "\fB\f(CB""spec\-ctrl""\fB\fR" 4 .el .IP "\fB\f(CBspec\-ctrl\fB\fR" 4 .IX Item "spec-ctrl" Required to enable the Spectre (\s-1CVE\-2017\-5753\s0 and \s-1CVE\-2017\-5715\s0) fix, in cases where retpolines are not sufficient. .Sp Included by default in Intel \s-1CPU\s0 models with \-IBRS suffix. .Sp Must be explicitly turned on for Intel \s-1CPU\s0 models without \-IBRS suffix. .Sp Requires the host \s-1CPU\s0 microcode to support this feature before it can be used for guest CPUs. .ie n .IP "\fB\f(CB""ssbd""\fB\fR" 4 .el .IP "\fB\f(CBssbd\fB\fR" 4 .IX Item "ssbd" Required to enable the \s-1CVE\-2018\-3639\s0 fix .Sp Not included by default in any Intel \s-1CPU\s0 model. .Sp Must be explicitly turned on for all Intel \s-1CPU\s0 models. .Sp Requires the host \s-1CPU\s0 microcode to support this feature before it can be used for guest CPUs. .ie n .IP "\fB\f(CB""pdpe1gb""\fB\fR" 4 .el .IP "\fB\f(CBpdpe1gb\fB\fR" 4 .IX Item "pdpe1gb" Recommended to allow guest \s-1OS\s0 to use 1GB size pages .Sp Not included by default in any Intel \s-1CPU\s0 model. .Sp Should be explicitly turned on for all Intel \s-1CPU\s0 models. .Sp Note that not all \s-1CPU\s0 hardware will support this feature. .PP Preferred \s-1CPU\s0 models for \s-1AMD\s0 x86 hosts .IX Subsection "Preferred CPU models for AMD x86 hosts" .PP The following \s-1CPU\s0 models are preferred for use on Intel hosts. Administrators / applications are recommended to use the \s-1CPU\s0 model that matches the generation of the host CPUs in use. In a deployment with a mixture of host \s-1CPU\s0 models between machines, if live migration compatibility is required, use the newest \&\s-1CPU\s0 model that is compatible across all desired hosts. .ie n .IP "\fB\f(CB""EPYC""\fB\fR" 4 .el .IP "\fB\f(CBEPYC\fB\fR" 4 .IX Item "EPYC" .PD 0 .ie n .IP "\fB\f(CB""EPYC\-IBPB""\fB\fR" 4 .el .IP "\fB\f(CBEPYC\-IBPB\fB\fR" 4 .IX Item "EPYC-IBPB" .PD \&\s-1AMD EPYC\s0 Processor (2017) .ie n .IP "\fB\f(CB""Opteron_G5""\fB\fR" 4 .el .IP "\fB\f(CBOpteron_G5\fB\fR" 4 .IX Item "Opteron_G5" \&\s-1AMD\s0 Opteron 63xx class \s-1CPU\s0 (2012) .ie n .IP "\fB\f(CB""Opteron_G4""\fB\fR" 4 .el .IP "\fB\f(CBOpteron_G4\fB\fR" 4 .IX Item "Opteron_G4" \&\s-1AMD\s0 Opteron 62xx class \s-1CPU\s0 (2011) .ie n .IP "\fB\f(CB""Opteron_G3""\fB\fR" 4 .el .IP "\fB\f(CBOpteron_G3\fB\fR" 4 .IX Item "Opteron_G3" \&\s-1AMD\s0 Opteron 23xx (Gen 3 Class Opteron, 2009) .ie n .IP "\fB\f(CB""Opteron_G2""\fB\fR" 4 .el .IP "\fB\f(CBOpteron_G2\fB\fR" 4 .IX Item "Opteron_G2" \&\s-1AMD\s0 Opteron 22xx (Gen 2 Class Opteron, 2006) .ie n .IP "\fB\f(CB""Opteron_G1""\fB\fR" 4 .el .IP "\fB\f(CBOpteron_G1\fB\fR" 4 .IX Item "Opteron_G1" \&\s-1AMD\s0 Opteron 240 (Gen 1 Class Opteron, 2004) .PP Important \s-1CPU\s0 features for \s-1AMD\s0 x86 hosts .IX Subsection "Important CPU features for AMD x86 hosts" .PP The following are important \s-1CPU\s0 features that should be used on \s-1AMD\s0 x86 hosts, when available in the host \s-1CPU.\s0 Some of them require explicit configuration to enable, as they are not included by default in some, or all, of the named \s-1CPU\s0 models listed above. In general all of these features are included if using \*(L"Host passthrough\*(R" or \*(L"Host model\*(R". .ie n .IP "\fB\f(CB""ibpb""\fB\fR" 4 .el .IP "\fB\f(CBibpb\fB\fR" 4 .IX Item "ibpb" Required to enable the Spectre (\s-1CVE\-2017\-5753\s0 and \s-1CVE\-2017\-5715\s0) fix, in cases where retpolines are not sufficient. .Sp Included by default in \s-1AMD CPU\s0 models with \-IBPB suffix. .Sp Must be explicitly turned on for \s-1AMD CPU\s0 models without \-IBPB suffix. .Sp Requires the host \s-1CPU\s0 microcode to support this feature before it can be used for guest CPUs. .ie n .IP "\fB\f(CB""virt\-ssbd""\fB\fR" 4 .el .IP "\fB\f(CBvirt\-ssbd\fB\fR" 4 .IX Item "virt-ssbd" Required to enable the \s-1CVE\-2018\-3639\s0 fix .Sp Not included by default in any \s-1AMD CPU\s0 model. .Sp Must be explicitly turned on for all \s-1AMD CPU\s0 models. .Sp This should be provided to guests, even if amd-ssbd is also provided, for maximum guest compatibility. .Sp Note for some \s-1QEMU /\s0 libvirt versions, this must be force enabled when when using \*(L"Host model\*(R", because this is a virtual feature that doesn't exist in the physical host CPUs. .ie n .IP "\fB\f(CB""amd\-ssbd""\fB\fR" 4 .el .IP "\fB\f(CBamd\-ssbd\fB\fR" 4 .IX Item "amd-ssbd" Required to enable the \s-1CVE\-2018\-3639\s0 fix .Sp Not included by default in any \s-1AMD CPU\s0 model. .Sp Must be explicitly turned on for all \s-1AMD CPU\s0 models. .Sp This provides higher performance than virt-ssbd so should be exposed to guests whenever available in the host. virt-ssbd should none the less also be exposed for maximum guest compatability as some kernels only know about virt-ssbd. .ie n .IP "\fB\f(CB""amd\-no\-ssb""\fB\fR" 4 .el .IP "\fB\f(CBamd\-no\-ssb\fB\fR" 4 .IX Item "amd-no-ssb" Recommended to indicate the host is not vulnerable \s-1CVE\-2018\-3639\s0 .Sp Not included by default in any \s-1AMD CPU\s0 model. .Sp Future hardware genarations of \s-1CPU\s0 will not be vulnerable to \&\s-1CVE\-2018\-3639,\s0 and thus the guest should be told not to enable its mitigations, by exposing amd-no-ssb. This is mutually exclusive with virt-ssbd and amd-ssbd. .ie n .IP "\fB\f(CB""pdpe1gb""\fB\fR" 4 .el .IP "\fB\f(CBpdpe1gb\fB\fR" 4 .IX Item "pdpe1gb" Recommended to allow guest \s-1OS\s0 to use 1GB size pages .Sp Not included by default in any \s-1AMD CPU\s0 model. .Sp Should be explicitly turned on for all \s-1AMD CPU\s0 models. .Sp Note that not all \s-1CPU\s0 hardware will support this feature. .PP Default x86 \s-1CPU\s0 models .IX Subsection "Default x86 CPU models" .PP The default \s-1QEMU CPU\s0 models are designed such that they can run on all hosts. If an application does not wish to do perform any host compatibility checks before launching guests, the default is guaranteed to work. .PP The default \s-1CPU\s0 models will, however, leave the guest \s-1OS\s0 vulnerable to various \&\s-1CPU\s0 hardware flaws, so their use is strongly discouraged. Applications should follow the earlier guidance to setup a better \s-1CPU\s0 configuration, with host passthrough recommended if live migration is not needed. .ie n .IP "\fB\f(CB""qemu32""\fB\fR" 4 .el .IP "\fB\f(CBqemu32\fB\fR" 4 .IX Item "qemu32" .PD 0 .ie n .IP "\fB\f(CB""qemu64""\fB\fR" 4 .el .IP "\fB\f(CBqemu64\fB\fR" 4 .IX Item "qemu64" .PD \&\s-1QEMU\s0 Virtual \s-1CPU\s0 version 2.5+ (32 & 64 bit variants) .Sp qemu64 is used for x86_64 guests and qemu32 is used for i686 guests, when no \&\-cpu argument is given to \s-1QEMU,\s0 or no is provided in libvirt \s-1XML.\s0 .PP Other non-recommended x86 CPUs .IX Subsection "Other non-recommended x86 CPUs" .PP The following CPUs models are compatible with most \s-1AMD\s0 and Intel x86 hosts, but their usage is discouraged, as they expose a very limited featureset, which prevents guests having optimal performance. .ie n .IP "\fB\f(CB""kvm32""\fB\fR" 4 .el .IP "\fB\f(CBkvm32\fB\fR" 4 .IX Item "kvm32" .PD 0 .ie n .IP "\fB\f(CB""kvm64""\fB\fR" 4 .el .IP "\fB\f(CBkvm64\fB\fR" 4 .IX Item "kvm64" .PD Common \s-1KVM\s0 processor (32 & 64 bit variants) .Sp Legacy models just for historical compatibility with ancient \s-1QEMU\s0 versions. .IP "\fB\f(CB486\fB\fR" 4 .IX Item "486" .PD 0 .ie n .IP "\fB\f(CB""athlon""\fB\fR" 4 .el .IP "\fB\f(CBathlon\fB\fR" 4 .IX Item "athlon" .ie n .IP "\fB\f(CB""phenom""\fB\fR" 4 .el .IP "\fB\f(CBphenom\fB\fR" 4 .IX Item "phenom" .ie n .IP "\fB\f(CB""coreduo""\fB\fR" 4 .el .IP "\fB\f(CBcoreduo\fB\fR" 4 .IX Item "coreduo" .ie n .IP "\fB\f(CB""core2duo""\fB\fR" 4 .el .IP "\fB\f(CBcore2duo\fB\fR" 4 .IX Item "core2duo" .ie n .IP "\fB\f(CB""n270""\fB\fR" 4 .el .IP "\fB\f(CBn270\fB\fR" 4 .IX Item "n270" .ie n .IP "\fB\f(CB""pentium""\fB\fR" 4 .el .IP "\fB\f(CBpentium\fB\fR" 4 .IX Item "pentium" .ie n .IP "\fB\f(CB""pentium2""\fB\fR" 4 .el .IP "\fB\f(CBpentium2\fB\fR" 4 .IX Item "pentium2" .ie n .IP "\fB\f(CB""pentium3""\fB\fR" 4 .el .IP "\fB\f(CBpentium3\fB\fR" 4 .IX Item "pentium3" .PD Various very old x86 \s-1CPU\s0 models, mostly predating the introduction of hardware assisted virtualization, that should thus not be required for running virtual machines. .PP \fISyntax for configuring \s-1CPU\s0 models\fR .IX Subsection "Syntax for configuring CPU models" .PP The example below illustrate the approach to configuring the various \&\s-1CPU\s0 models / features in \s-1QEMU\s0 and libvirt .PP \s-1QEMU\s0 command line .IX Subsection "QEMU command line" .IP "\fBHost passthrough\fR" 4 .IX Item "Host passthrough" .Vb 1 \& $ qemu\-system\-x86_64 \-cpu host .Ve .Sp With feature customization: .Sp .Vb 1 \& $ qemu\-system\-x86_64 \-cpu host,\-vmx,... .Ve .IP "\fBNamed \s-1CPU\s0 models\fR" 4 .IX Item "Named CPU models" .Vb 1 \& $ qemu\-system\-x86_64 \-cpu Westmere .Ve .Sp With feature customization: .Sp .Vb 1 \& $ qemu\-system\-x86_64 \-cpu Westmere,+pcid,... .Ve .PP Libvirt guest \s-1XML\s0 .IX Subsection "Libvirt guest XML" .IP "\fBHost passthrough\fR" 4 .IX Item "Host passthrough" .Vb 1 \& .Ve .Sp With feature customization: .Sp .Vb 4 \& \& \& ... \& .Ve .IP "\fBHost model\fR" 4 .IX Item "Host model" .Vb 1 \& .Ve .Sp With feature customization: .Sp .Vb 4 \& \& \& ... \& .Ve .IP "\fBNamed model\fR" 4 .IX Item "Named model" .Vb 3 \& \& \& .Ve .Sp With feature customization: .Sp .Vb 5 \& \& \& \& ... \& .Ve .SH "SEE ALSO" .IX Header "SEE ALSO" The \s-1HTML\s0 documentation of \s-1QEMU\s0 for more precise information and Linux user mode emulator invocation. .SH "AUTHOR" .IX Header "AUTHOR" Daniel P. Berrange