[qemu-x86 package document] SLES 15 QEMU/KVM RELATED SUPPORT STATEMENTS Overview -------- The QEMU based packages included with SLES 15 provide a large variety of features, from the very latest customer requests to features of questionable quality or value. The linux kernel includes components which contribute KVM virtualization features as well. This document was created to assist the user in deciding which features can be relied upon to build enterprise class virtualization solutions. KVM based virtualization for x86 (Intel 64/AMD64), for IBM System z (s390x), for Power8 Systems (ppc64le) and for the ARM64 architecture (AArch64) are offered at the L3 (full support) level. The bulk of this document deals with L3 supported features and is primarily x86 centric. This document should be considered a companion to the standard virtualization documentation delivered with the product. KVM is implemented in linux kernel modules which enable the linux kernel to function as an integral part of the KVM hypervisor. The hypervisor-guest interaction is managed by QEMU through the /dev/kvm ioctl interface. The linux host assists in the virtualization of storage, networking and display resources as well as allowing direct hardware passthrough of PCI and USB devices. Linux memory and cpu management features are used by QEMU/KVM to enable guests to share those host resources as efficiently as possible. QEMU is a primary component of KVM based virtualization. The legacy qemu-kvm program is available for continuity with pre SLES 12 usage, including in libvirt domain xml references. The QEMU emulator binaries qemu-system-x86_64 and qemu-system-i386 (x86 host) are now the primary programs to use to access KVM virtualization. When using these programs, the -machine option accel=kvm (or its alias -enable-kvm) must be specified for KVM acceleration to be used by the guest. Although Xen uses QEMU for virtualization as well, this document does not identify Xen supported features. Libvirt is the preferred means of accessing QEMU/KVM functionality and is documented elsewhere. This document focuses on the features and direct usage of QEMU/KVM as provided by the QEMU based packages. Major QEMU/KVM Supported Features --------------------------------- - KVM virtualization is accomplished by using the QEMU program in KVM acceleration mode. KVM acceleration requires that both guest and host have the same fundamental architecture. - Guest images created under previous QEMU versions are supported by machine version compatibilities built into more recent QEMU versions. - For ease of use, the QEMU program has defaults which represent traditional usage patterns. - Guest virtual machine characteristics are specified by a combination of internal defaults, options provided on the QEMU program command-line, runtime configurations set via the monitor interfaces and optional config files. The runtime control of a VM is effected either through the Human Monitor "Protocol" (HMP), or the JSON based programmatical QEMU Monitor Protocol (QMP) interface. For QMP details, see qemu-qmp-ref man page. Since a KVM guest runs in the context of a normal linux process, some types of execution controls are managed with linux tools. - Various standard vCPU types are available, along with the ability to specify individual CPU features visible to the guest. - QEMU incorporates a SEABIOS based system BIOS and iPXE based PXE ROMs, which allow boot options common to physical systems, along with other features tailored to virtualization. Various VGABIOS ROMs, also from the SEABIOS project, are also included. A UEFI based guest boot environment is also now possible by using the firmware provided by the qemu-ovmf-x86_64 package. - Some QEMU messages have been localized to various languages. This is provided by the optional qemu-lang package. Keyboard mappings for various nationalities is also provided. - Virtual machine lifecycle controls include startup through the system BIOS or kernel boot, ACPI or legacy based shutdown, execution pausing, the saving and restoring of machine state or disk state, VM migration to another host, and miscellaneous controls available through the "monitors" mentioned above. - Guest execution state may be "moved" in both time (save/restore) and space (static and live migration). These migrations or save/restore operations can take place either from certain prior SLES versioned hosts to a SLES 15 host or between hosts of the same version. Certain other restrictions also apply. - Security considerations include seccomp2 based sandboxing, vTPM, privileged helpers and a security model which allows running guests as a non-root user. - QEMU/KVM supports a wide range of operating systems within the VMs. See the online SUSE documentation for supported OS's. Windows guests can optionally be accelerated with QEMU/KVM provided Hyper-V hypercalls, or with paravirtual drivers from the SUSE Virtual Machine Driver Pack. Linux includes a number of paravirtual drivers as well. - QEMU provides best effort reuse of existing disk images, including those with systems installed, through geometry probing. Also disk images produced by other popular virtualization technologies may be imported into QEMU supported storage formats. These QEMU formats include features which exploit the benefits of virtualization. - Memory, cpu and disk space overcommit are possible and can be beneficial when done responsibly. Additional management of these resources comes in the form of memory ballooning or hotplug, host KSM, vcpu hot-add, online disk resizing, trim, discard and hole punching. - Guest performance is enhanced through the use of virtio devices, various disk caching modes, network acceleration via the vhost-net kernel module, multi- queue network transmit capabilities, host transparent huge pages (THP) and direct hugetlb usage. Physical PCI and USB devices may also be passed through to the guest, including SR-IOV VF's. - The guest UI is accessable via GTK, VNC, Spice, and serial (including curses TUI) interfaces. - Guest timekeeping is supported in a variety of ways, including a paravirtual clocksource, and options for the various guest clocks for how to handle the timeslicing of the guest's execution on the host. - Guest OS's interact with virtualized hardware including a choice of either older or more recent x86 system chipsets, system devices and buses, and a variety of common storage and networking emulated devices. SMBIOS and ACPI table details can be customized. - In addition to the para-virtualized devices already mentioned, other devices and infrastructure designed to avoid virtualization "problem areas" are available such as SPICE graphics, vmmouse emulation, tablet style pointer interfaces and virtio based UI interfaces. - A built-in user-mode network (SLIRP) stack is available. - Portions of the host file system may be shared with a guest by using virtFS. - A guest "agent" is available for SLES 15 KVM guests via the qemu-guest-agent package. This allows some introspection and control of the guest OS environment from the host. QEMU/KVM Technology Previews ---------------------------- - Specifying and placing PCI devices on a PCI bridge allows for a greater number of devices. - Nested VMX and SVM virtualization is possible. - All features indicated as not being supported in this document fall under the Technology Preview definition contained in the main product's release notes. Noteworthy QEMU/KVM Unsupported Features ---------------------------------------- - Note that some features are unsupported simply due to lack of validation. If an existing feature is desired, but not marked supported, let SUSE know about your requirements. - The TCG "acceleration" mode may be helpful for problem isolation, but otherwise presents insufficient benefit and stability. - Use of -cpu host is not supported in all host/guest configurations. - GlusterFS integration is not enabled. Deprecated, Superseded, Modified and Dropped Features ----------------------------------------------------- - http://wiki.qemu-project.org/Features/LegacyRemoval This website tracks feature deprecation and removal at the upstream development level. Our qemu package inherits this community direction, but be aware that we can and will deviate as needed. Those deviations and additional information can be found in this section. - When no video adapter is specified, the default used is stdvga. This differs from the default of prior releases which was cirrus. The cirrus adapter was considered too outdated to continue to use as the default. - The deprecated windows drivers (win-virtio-drivers.iso) are no longer provided. The Virtual Machine Driver Pack is the supported way to get virtio drivers for Windows guests. - The use of ",boot=on" for virtio disks is no longer needed since the bios used supports the virtio block interface directly. In fact, its usage may cause problems, and is now considered deprecated. - The use of "?" as a parameter to "-cpu", "-soundhw", "-device", "-M", "-machine", "-d", and "-clock" is now considered deprecated. Use "help" instead. - The use of "if=scsi" as a parameter to "-drive" does not work anymore with PC machine types, as it created an obsolete SCSI controller model. - Passthrough of a host floppy device is now considered deprecated. - Use of aio=native without direct cache mode also being specified (cache=none, cache=directsync, or cache.direct=on) is no longer allowed. - The use of image encryption in qcow and qcow2 formats is now considered deprecated. Analysis has shown it to be weak encryption, in addition to suffering from poor design. Images can easily be converted to a non-encrypted format. - Use of acpi, boot-opts, and smp-opts in a -readconfig config file are now considered deprecated. In the future those names will be standardized to acpitable, boot, and smp respectively. - When only a partial SMP topology is provided (ie only some of sockets, cores, threads) the derived guest ABI is not guaranteed to be equivalent in future versions. - These previously supported command line options are now considered deprecated: -balloon (use -device virtio-balloon instead) -clock -device ivshmem (use ivshmem-doorbell or ivshmem-plain instead) -nodefconfig (use -no-user-config instead) -no-frame -virtioconsole (use -device virtconsole instead) - These previously supported command line options are no longer supported: - These previously supported command line options are no longer recognized: -device pc-sysfw (no longer needed) -device pci-assign, -device kvm-pci-assign (use -device vfio-pci instead) -display sdl -sdl - Specifying a cpu feature with both "+feature/-feature" and "feature=on/off" will now cause a warning. The current behavior for this combination where "+feature/-feature" wins over "feature=on/off", will be changed going forward so that "+feature" and "-feature" will be synonyms for "feature=on" and "feature=off" respectively. - The previously supported blkdev-add QMP command has been flagged as lacking and could possibly change syntax in the future. - These previously unsupported command line options are now deprecated: -no-kvm-irqchip (use -machine kernel_irqchip=off instead) -no-kvm-pit -no-kvm-pit-reinjection -tdf - The case of specified sockets, cores, and threads not matching the vcpu count is no longer silently ignored. QEMU now requires that the topology match the vcpu count. - These previously unsupported command line options are no longer recognized: -device ccid-card-passthru -device cfi.pflash01 -device esp -device exynos4210-ehci-usb -device fusbh200-ehci-usb -device icc-bridge -device q35-pcihost -device mch -device smbus-eeprom -device SUNW,fdtwo -device sysbus-ahci -device sysbus-fdc -device sysbus-ohci -device tegra2-ehci-usb -device testdev (use -device pc-testdev instead) -device virtio-mmio -device xln,ps7-usb -enable-nesting -kvm-shadow-memory (use -machine kvm_shadow_mem= instead) -M mac -nvram -old-param -osk -pcidevice (use -device vfio-pci instead) -qtest -semihosting - This previously supported QMP command is now deprecated: query-cpus - These previously supported monitor commands are now deprecated: usb_add (use device_add instead) usb_del (use device_del instead) - These previously supported monitor commands are no longer recognized: cpu_set pci_add (use device_add instead) pci_del (use device_del instead) - This previously unsupported QMP command is now supported under a new name: x-input-send-event (use input-send-event instead) - Due to the lack of migration support (mainly due to ahci interface issues) and other unstable interface issues, earlier versions of the q35 machine type are not supported in this release. The current q35 machine type is however now fully supported. - Due to upstream's decision to no longer fully support the qed storage format going forward (since it really provides no benefit over qcow2 and is now no longer actively maintained upstream), creating qed storage images is no longer supported and it is highly discouraged to continue using existing qed images. They should instead be converted to another supported format. QEMU Command-Line and Monitor Syntax and Support ------------------------------------------------ - The QEMU program command-line syntax is as follows: qemu-system-i386 [options] [disk_image] qemu-system-x86_64 [options] [disk_image] Where 'options' are taken from the options listed below, and 'disk_image' is the file system reference to the x86 guest's primary IDE based hard disk image. This image as well as those used with -drive or -cdrom, may be in the raw (no format) or qcow2 storage formats, and may be located in files within the host filesystem, logical volumes, host physical disks, or network based storage. Read only media may also be accessed via URL style protocol specifiers. Note that as a general rule, as new command line options are added which serve to replace an older option or interface, you are strongly encouraged to adapt your usage to the new option. The new option is being introduced to provide better functionality and usability going forward. In some cases existing problems or even bugs in older interfaces cannot be fixed due to functional expectations, but are resolved in the newer interface or option. This advice includes moving to the most recent machine type (eg pc-i440fx-2.11 instead of pc-i440fx-2.9) if possible. - The following command line options are supported: -accel ... -add-fd ... -alt-grab -append ... -audio-help -balloon ... -bios ... -blockdev ... -boot ... -cdrom ... -chardev .. -clock ... -cpu ... (all except host) -ctrl-grab -d ... -daemonize -debugcon ... -device [isa-serial|isa-parallel|isa-fdc|ide-drive|ide-hd|ide-cd| VGA|cirrus-vga|rtl8139|virtio-net-pci|virtio-blk-pci| virtio-balloon-pci|virtio-9p-pci|usb-hub|usb-ehci|usb-tablet| usb-storage|usb-mouse|usb-kbd|virtserialport|virtconsole| virtio-serial-pci|sga|i82559er|virtio-scsi-pci|scsi-cd|scsi-hd| scsi-generic|scsi-disk|scsi-block|pci-serial|pci-serial-2x| pci-serial-4x|ich9-ahci|piix-usb-uhci|usb-host|usb-serial| usb-wacom-tablet|usb-braille|usb-net|pci-ohci|piix4-usb-uhci| virtio-rng-pci|i6300esb|ib700|qxl|qxl-vga|pvpanic|vfio-pci|ivshmem| ivshmem-doorbell|ivshmem-plain|pci-bridge|megasas-gen2|pc-dimm| floppy|e1000e|ccid-card-emulated|ccid-card-passthrough|xen-backend| loader|e1000|vmgenid|vmcoreinfo|pcie-pci-bridge] (the following are aliases of these supported devices: ahci| virtio-blk|virtio-net|virtio-serial|virtio-balloon| virtio-9p| virtio-scsi|virtio-rng|e1000-82540em) -dfilter range, ... -display ... -drive ... (if specified if=[floppy|ide|virtio] and format=[qcow2|raw] and snapshot=off only) -echr ... -enable-fips -enable-kvm -fda/-fdb ... -fsdev ... -full-screen -fw_cfg ... -gdb ... -global ... -h -hda/-hdb/-hdc/-hdd ... -help -incoming ... -initrd ... -iscsi ... -k ... -kernel ... -loadvm ... -m ... -M [help|?|none|pc|pc-0.12|pc-0.14|pc-0.15|pc-i440fx-1.4|pc-i440fx-1.7| pc-i440fx-2.0|pc-i440fx-2.3|pc-i440fx-2.6|pc-i440fx-2.9|pc-i440fx-2.11|q35| pc-q35-2.6|pc-q35-2.9|pc-q35-2.11|xenfv|xenpv] -machine [help|?|none|pc|pc-0.12|pc-0.14|pc-0.15|pc-i440fx-1.4|pc-i440fx-1.7| pc-i440fx-2.0|pc-i440fx-2.3|pc-440fx-2.6|pc-i440fx-2.9| pc-i440fx-2.11|q35|pc-q35-2.6|pc-q35-2.9|pc-q35-2.11|xenfv|xenpv] -mem-path ... -mem-prealloc -mon ... -monitor ... -msg ... -name ... -net [bridge|l2tpv3|nic|none|tap|user] ... (for model= only e1000, rtl8139, and virtio are supported) -netdev [bridge|tap|user] ... -no-acpi -nodefaults -nodefconfig -no-fd-bootchk -no-frame -nographic -no-hpet -no-quit -no-reboot -no-shutdown -no-user-config -numa cpu ... -numa dist ... -object ... -only-migratable -parallel ... -pidfile ... -qmp ... -qmp-pretty ... -readconfig ... -realtime ... -rtc ... -runas ... -s -S -sandbox ... -serial ... -show-cursor -smbios ... -smp ... -spice -tdf -tpmdev passthrough ... -trace ... -usb -usbdevice [braile|disk|host|mouse|net|serial|tablet] -uuid .. -version -vga [cirrus|none|qxl|std|xenfb] -virtfs ... -virtioconsole ... -vnc ... -watchdog ... -watchdog-action ... -writeconfig ... -xen-attach ... -xen-domid ... -xen-domid-restrict ... - The following monitor commands are supported: ? balloon ... block_resize ... boot_set ... c change ... chardev-add ... chardev-change ... chardev-remove ... chardev-send-break ... client_migrate_info ... closefd ... cont cpu ... cpu-add ... delvm ... device_add ... device_del ... drive_add ... drive_backup ... drive_del ... dump_guest_memory ... eject ... gdbserver ... gpa2hpa ... gpa2hva ... help i ... info ... loadvm ... logfile ... logitem ... mce ... memsave ... migrate ... migrate_cancel migrate_continue ... migrate_incoming migrate_set_cache_size ... migrate_set_capability ... migrate_set_downtime ... migrate_set_parameter ... migrate_set_speed ... migrate_start_post_copy mouse_button ... mouse_move ... mouse_set ... nmi ... o ... object_add ... object_del ... p ... pmemsave ... print ... q qemu-io ... qom-list qom-set ringbuf_read ... ringbuf_write ... savevm ... screendump ... sendkey ... snapshot_blkdev_internal ... snapshot_delete_blkdev_internal ... stop sum ... system_powerdown system_reset system_wakeup trace-event ... usb_add ... usb_del ... watchdog_action ... x ... xp ... - The following QMP commands are supported: add_client add-fd balloon blockdev-add blockdev-backup blockdev-change-medium blockdev-close-tray blockdev-del blockdev-mirror blockdev-open-tray blockdev-snapshot blockdev-snapshot-delete-internal-sync blockdev-snapshot-internal-sync blockdev-snapshot-sync block-commit block-dirty-bitmap-add block-dirty-bitmap-clear block-dirty-bitmap-remove block_passwd block_resize block_set_io_throttle block-set-write-threshold block_stream change change-vnc-password chardev-add chardev-change chardev-remove chardev-send-break client_migrate_info closefd cont cpu cpu-add device_add device_del device-list-properties dump-guest-memory eject expire_password getfd human-monitor-command inject-nmi input-send-event memsave migrate migrate_cancel migrate-continue migrate-incoming migrate-set-cache-size migrate-set-capabilities migrate_set_downtime migrate_set_speed migrate-set-parameters migrate-start-postcopy object-add object-del pmemsave qmp_capabilities qom-get qom-list qom-list-types qom-set query-acpi-ospm-status query-balloon query-block query-block-jobs query-blockstats query-chardev query-chardev-backends query-command-line-options query-commands query-cpu-definitions query-cpu-model-baseline query-cpu-model-comparison query-cpu-model-expansion query-cpus query-dump query-dump-guest-memory-capability query-events query-fdsets query-gic-capabilities query-hotpluggable-cpus query-iothreads query-kvm query-machines query-memdev query-memory-devices query-memory-size-summary query-mice query-migrate query-migrate-cache-size query-migrate-capabilities query-migrate-parameters query-name query-named-block-nodes query-pci query-qmp-schema query-rocker query-rocker-of-dpa-flows query-rocker-of-dpa-groups query-rocker-ports query-rx-filter query-spice query-status query-target query-tpm query-tpm-models query-tpm-types query-uuid query-version query-vnc query-vnc-servers query-xen-replication-status quit remove-fd ringbuf-read ringbuf-write rtc-reset-reinjection screendump send-key set_link set_password stop system_powerdown system_reset system_wakeup trace-event-get-state trace-event-set-state transaction watchdog-set-action xen-load-devices-state xen-save-devices-state xen-set-global-dirty-log - The following command line options are unsupported: -acpitable ... -bt ... -chroot ... -cpu host -curses -device [ipoctal232|i82562|nec-usb-xhci|hda-duplex|hda-output|usb-bot| lsi53c810a|ich9-usb-uhci2|ich9-usb-uhci6|ich9-usb-uhci5| ich9-usb-uhci3|isa-debug-exit|ne2k_pci|usb-uas|ich9-usb-uhci4|ioh3420| isa-ide|usb-ccid|ich9-usb-ehci2|pcnet|ich9-intel-hda|dc390| ich9-usb-ehci1|hda-micro|x3130-upstream|isa-cirrus-vga|ich9-usb-uhci1| pc-testdev|ne2k_isa|isa-vga|cs4231a|gus|vmware-svga|i82801b11-bridge| i82557a|i82557c|i82557b|i82801|AC97|am53c974|intel-hda|i82558a| i82558b|usb-audio|i82550|isa-debugcon|sb16|megasas|i82551| xio3130-downstream|vt82c686b-usb-uhci|tpci200|i82559a|i82559b|i82559c| isa-applesmc|usb-bt-dongle|adlib|ES1370|lsi53c810|nvme|pci-testdev| pvscsi|vhost-scsi|vhost-scsi-pci|virtio-9p-device| virtio-balloon-device|virtio-blk-device|virtio-net-device| virtio-rng-device|virtio-scsi-device|virtio-serial-device|vmxnet3| xen-pci-passthrough|xen-platform|xen-pvdevice|piix3-ide|piix3-ide-xen| piix3-ide|i8042|sdhci-pci|secondary-vga|edu|intel_iommu|usb-mtp| e1000-82544gc|e1000-82545em|virtio-input-host-pci|virtio-keyboard-pci| virtio-mouse-pci|virtio-tablet-pci|virtio-gpu-pci|pci-bridge-seat|pxb| pxb-pcie|rocker|virtio-input-host-device|virtio-keyboard-device| virtio-mouse-device|virtio-tablet-device|virtio-vga|hyperv-testdev| generic-sdhci|igd-passthrough-isa-bridge|ipmi-bmc-extern|ipmi-bmc-sim| isa-ipmi-bt|isa-ipmi-kcs|mptsas1068|nvdimm|pxb-host|sd-card| virtio-gpu-device|amd-iommu|AMDVI-PCI|vhost-vsock-device| vhost-vsock-pci|virtio-crypto-device|virtio-crypto-pci| vfio-pci-igd-lpc-bridge|pcie-root-port|qemu-xhci|*-i386-cpu| *-x86_64-cpu|vhost-user-scsi|vhost-user-scsi-pci|mmio_interface] (the following are aliases of these unsupported devices: lsi| virtio-input-host|virtio-keyboard|virtio-mouse|virtio-tablet| virtio-gpu) (note that some of these device names represent supported devices and are used internally, but are not specifyable via -device even though they appear in the list of devices) -drive ,if=[scsi|mtd|pflash], snapshot=on, format=[anything besides qcow2 or raw] -dtb file -enable-hax -g ... -icount ... -L ... -M [isapc|pc-0.10|pc-0.11|pc-0.13|pc-1.0|pc-1.1|pc-1.2|pc-1.3|pc-i440fx-1.5| pc-i440fx-1.6|pc-i440fx-2.1|pc-i440fx-2.2|pc-i440fx-2.4|pc-i440fx-2.5| pc-i440fx-2.7|pc-i440fx-2.8|pc-i440fx-2.10|pc-q35-1.4|pc-q35-1.5| pc-q35-1.6|pc-q35-1.7|pc-q35-2.0|pc-q35-2.1|pc-q35-2.2|pc-q35-2.3| pc-q35-2.4|pc-q35-2.5|pc-q35-2.7|pc-q35-2.8|pc-q35-2.10] -machine [isapc|pc-0.10|pc-0.11|pc-0.13|pc-1.0|pc-1.1|pc-1.2|pc-1.3| pc-i440fx-1.5|pc-i440fx-1.6|pc-i440fx-2.1|pc-i440fx-2.2| pc-i440fx-2.4|pc-i440fx-2.5|pc-i440fx-2.7|pc-i440fx-2.8| pc-i440fx-2.10|pc-q35-1.4|pc-q35-1.5|pc-q35-1.6|pc-q35-1.7| pc-q35-2.0|pc-q35-2.1|pc-q35-2.2|pc-q35-2.3|pc-q35-2.4|pc-q35-2.5| pc-q35-2.7|pc-q35-2.8|pc-q35-2.10] -mtdblock file -net [dump|socket|vde] ... -netdev [dump|hubport|l2tpv3|socket|vde] ... -no-kvm -no-kvm-irqchip -no-kvm-pit -no-kvm-pit-reinjection -numa node ... -option-rom ... -pflash file -portrait -prom-env ... -qtest ... -qtest-log ... -rotate -sd file -sdl -set ... -singlestep -snapshot -soundhw ... -tb-size ... -tpmdev emulator ... -vga [cg3|tcx|virtio|vmware] -win2k-hack -xen-create - The following monitor commands are unsupported: acl_add ... acl_policy ... acl_remove ... acl_reset ... acl_show ... block_job_cancel ... block_job_complete ... block_job_pause ... block_job_resume ... block_job_set_speed ... block_passwd ... commit ... drive_mirror ... expire_password ... hostfwd_add ... hostfwd_remove ... host_net_add ... host_net_remove ... nbd_server_add ... nbd server_start ... nbd_server_stop ... netdev_add netdev_del ... pcie_aer_inject_error ... set_link ... set_password ... singlestep ... snapshot_blkdev ... stopcapture ... wavcapture ... x_colo_lost_heartbeat - The following QMP commands are unsupported: block-job-cancel block-job-complete block-job-pause block-job-resume block-job-set-speed change-backing-file drive-backup drive-mirror dump-skeys netdev_add netdev_del nbd-server-add nbd-server-start nbd-server-stop query-sev query-sev-launch-measure query-sev-capabilities x-blockdev-change x-blockdev-insert-medium x-blockdev-remove-medium x-colo-lost-heartbeat x-debug-block-dirty-bitmap-sha256 xen-colo-do-checkpoint xen-set-replication