Some links on this page are affiliate links: if you buy through them we may earn a commission, at no extra cost to you.
Effective virtual CPU configuration is about choosing the CPU identity and instruction set a virtual machine sees—not just assigning it more vCPUs. For KVM/QEMU on x86-64, Nova’s documented default is host-model. It is a sensible starting point for a broadly homogeneous fleet; use custom when a stable migration baseline matters more, and reserve host-passthrough for tightly controlled hosts where portability is secondary.
The right choice depends on the migration domain: the hosts that must be able to run the same guest, including after maintenance, migration, shutdown, and restart.
What virtual CPU configuration controls
A VM’s CPU configuration has several separate parts:
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →- vCPU count: the number of virtual processors presented to the guest. More vCPUs do not automatically add newer instructions or improve performance; they can also increase scheduling contention.
- Topology: how those processors are arranged as sockets, dies, cores, and threads. This is distinct from CPU identity and can matter to guest operating systems and licensed software.
- CPU model: the processor identity exposed through CPUID, either a named model or one derived from the host.
- Feature flags: capabilities such as AES, AVX2, PCID, RDRAND, VMX, or mitigation-related features. A guest can use only features its virtual CPU exposes and its software supports.
- Scheduling: how the hypervisor schedules guest vCPUs onto physical CPUs. Selecting a CPU model does not pin vCPUs or guarantee a particular amount of host capacity.
Nova describes the guest-visible CPU model as the combined set of features presented to an instance; topology is configured separately. A model that exposes AVX2, for example, does not itself ensure the instance will be scheduled on a host that can provide it unless placement policy and host capabilities also line up.
#1 Best Overall
How the stack fits together
OpenStack Nova policy
→ libvirt driver and domain CPU configuration
→ QEMU virtual machine and CPU model
→ KVM kernel virtualization interface
→ host processor and microcodeKVM supplies hardware-assisted virtualization through the Linux kernel. QEMU creates the VM and implements the virtual CPU it presents. Libvirt provides CPU configuration abstractions and compatibility checks. Nova translates cloud-operator policy into per-instance configuration and coordinates scheduling and migration. The effective result depends on all of these layers, as well as host hardware, microcode, and software versions. The topic is also covered in the historical presentation Effective Virtual CPU Configuration with QEMU and libvirt; for present-day Nova settings, use the current configuration reference.
Choose a CPU mode for the migration domain
Nova documents four libvirt CPU modes: host-model, host-passthrough, custom, and none. The trade-off is between exposing host-specific capabilities and keeping the guest CPU consistent across hosts.
| Mode | What the guest gets | Best fit | Main trade-off |
|---|---|---|---|
host-model |
A named CPU model that closely matches the host, with relevant additional features. | Relatively homogeneous KVM fleets seeking a practical balance. | Migration may not work in both directions; CPU behavior can differ after a later cold restart. |
host-passthrough |
A close representation of the host CPU and its features, with minimal abstraction. | Highly uniform hosts or workloads that need low-level host CPU characteristics. | Strong dependence on source-host details makes migration across differing hosts difficult or unsupported. |
custom |
An operator-selected named model, optionally adjusted with feature flags. | A repeatable CPU contract across a known set of host generations. | A conservative baseline can hide newer features; the model and flags must be validated everywhere. |
none |
No explicit libvirt CPU model; the hypervisor chooses its default. | Non-KVM drivers or deliberate acceptance of the hypervisor default. | Defaults can vary by hypervisor, architecture, machine type, and software version. |
host-model: the balanced starting point
For KVM/QEMU on x86-64, current Nova documentation identifies host-model as the effective default. Libvirt chooses the named CPU model closest to the host and requests additional features to complete the match. This can expose most useful host capabilities while being less host-specific than passthrough.
What’s actually slowing this PC down?
Pick the symptom - the matching free tool is one click away.
It is not a migration guarantee. A guest can migrate while retaining the source CPU definition, yet a later shutdown and restart on the destination may expose a different CPU. Compatibility also depends on the kernel, QEMU, libvirt, microcode, and CPU definitions in use. Review Nova’s CPU model and migration guidance before relying on a behavior for a particular release.
host-passthrough: maximum host fidelity, minimum portability
Passthrough is designed to expose the host CPU more exactly. It may make more host features available, but “more features” is not a guaranteed performance improvement: workload, NUMA placement, vCPU scheduling, and mitigations also matter.
Live migration can require the destination to match the source very closely, potentially including CPU model, microcode, and kernel. Mixed CPU generations can make migration impossible. Choose this mode only when the operational domain is sufficiently controlled and the cost of restricting migration is understood.
custom: an explicit compatibility contract
With a custom model, select a named CPU model supported by the least capable host that must run the VM, then add only necessary, verified features. This trades some newer capabilities for a more predictable guest CPU across the migration domain. It can improve compatibility, but cannot guarantee it without host-level validation and migration testing.
Free tools Windows power users keep installed
One-click scans. No signup required.
Do not choose a model name simply because it appears in a CPU map: a particular host, QEMU build, machine type, or hardware combination may not support it. Check all compute nodes. If the fleet contains both Intel and AMD, treat that as a separate compatibility challenge; do not assume a named model or feature set is interchangeable across vendors.
none: leaving the choice to the hypervisor
With none, libvirt does not specify a CPU model and QEMU chooses its default. That may be acceptable in a controlled test or with another libvirt driver, but it is usually not a clear production policy for a KVM fleet: the effective default can depend on architecture, machine type, and software versions.
Inventory hosts and discover available models
Start by recording each compute host’s CPU vendor, family, model and stepping, microcode, kernel, QEMU, and libvirt versions. Divide hosts into migration domains: groups between which instances are expected to move. Identify whether migration must work in both directions and whether guests must retain the same CPU after a cold restart.
Useful discovery commands include:
# Named CPU models libvirt knows for this architecture
virsh cpu-models x86_64
# Host capabilities and CPU-related definitions
virsh capabilities
# Domain capabilities (availability and arguments vary by libvirt version)
virsh domcapabilities
# CPU models and flags recognized by this QEMU binary
qemu-system-x86_64 -cpu helpThese commands answer different questions. A model listed by libvirt or QEMU is not proof that every host can use it. Verify the actual model and requested flags against each compute node, with the deployed emulator and machine type. For a multi-host baseline, libvirt’s virsh hypervisor-cpu-baseline can derive a CPU definition from host capabilities; its output is environment-specific, not a configuration to copy blindly. See the documented baseline example.
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Clear out junk files and repair common Windows errors3Scan for outdated or missing drivers - takes under a minuteAfter launch, inspect what the guest actually sees, rather than inferring it from host inventory or Nova configuration:
lscpu
grep -m1 '^flags' /proc/cpuinfo
cpuidThe cpuid utility may need to be installed separately. Compare the guest-visible model and flags against the intended policy. The layers to distinguish are: host capability, QEMU capability, libvirt’s selected CPU, Nova’s requested policy, and the guest’s final view.
Build a migration-safe baseline
- Inventory the migration domain. Record vendor, CPU generation, microcode, kernel, QEMU, and libvirt on every host that can receive the workload.
- Separate incompatible groups. Do not assume mixed vendors or widely different generations share a safe baseline.
- Find the common capability set. Consider a baseline generated from host capabilities, then inspect it; do not treat an automated intersection as a complete operational decision.
- Select a named model supported by the oldest suitable host. The newest host is not the compatibility limit.
- Add only required flags. Confirm hardware and hypervisor support on every target and that the guest OS and application can use the feature.
- Apply the policy consistently. A migration domain with inconsistent Nova configuration can yield inconsistent guest CPUs.
- Validate service configuration and launch a test instance. Inspect Nova logs, guest CPU identity, and flags.
- Test live migration in both directions. Where applicable, also shut down and cold-start the VM on the destination, then inspect its CPU again.
- Document and control changes. Re-run compatibility testing when hardware, microcode, kernels, QEMU, libvirt, or the CPU policy changes.
Configure CPU policy in Nova
Nova’s settings are in the [libvirt] group. For the balanced KVM default, the setting can be explicit:
[libvirt]
cpu_mode = host-modelFor a custom baseline, use cpu_models with cpu_mode = custom. For example, using a model and flags shown in Nova’s configuration documentation:
[libvirt]
cpu_mode = custom
cpu_models = Haswell-noTSX-IBRS
cpu_model_extra_flags = -PDPE1GB, +VMX, pcidThis requests that pdpe1gb be disabled and vmx and pcid be enabled. It is an illustration of syntax, not a recommendation that this named model or flags suit every fleet. Nova documents feature names as case-insensitive. See the Nova 2026.1 configuration reference for the applicable release’s options.
The older singular cpu_model option is deprecated in current configuration documentation in favor of cpu_models. Use cpu_models with cpu_mode = custom; do not assume settings from an older release apply unchanged. An invalid model or unsupported feature can prevent the Nova service from starting, so validate configuration against every compute host before rolling it out.
Feature flags, workload requirements, and security
A feature can generally be required or enabled with an unprefixed name or +feature, and disabled with -feature. For example, a workload may need AES for cryptographic acceleration, AVX or AVX2 for a vectorized application, or VMX for nested virtualization on Intel hardware. These are not interchangeable: confirm that the host supports the feature, QEMU and libvirt can expose it, the guest OS supports it, and the application benefits from it.
CPU scheduling is a separate requirement. A guest configured to see a feature still needs to land on a host that can execute it. Nova flavor-level CPU traits and other placement policy can constrain scheduling; they complement the libvirt CPU model rather than replacing it. For feature-sensitive workloads, verify both the exposed guest CPU and the host selection policy.
Mitigation-related features such as spec-ctrl, ssbd, and md-clear may be relevant to a security policy. A documented example is:
[libvirt]
cpu_mode = custom
cpu_models = IvyBridge
cpu_model_extra_flags = spec-ctrl,ssbd,md-clearDo not copy this as a universal security configuration. Required mitigations depend on the vulnerability, processor, microcode, host and guest kernels, QEMU, libvirt, and guest operating system. Exposing a flag alone is not a complete mitigation. Nova’s CPU model guidance also notes that running guests may need a full power-off and cold boot before a changed CPU model takes effect.
Timekeeping features such as invtsc need particular care because they may affect migration behavior. Any feature that changes guest-visible CPU behavior should be evaluated against the full lifecycle—launch, migration, stop, and restart—not just a successful initial boot.
Why generic models may be too conservative
Generic models such as qemu32 and qemu64 have historically favored compatibility and can omit useful capabilities such as AES, RDRAND, or PCID. That does not make them universally wrong, and the old names should not be mistaken for the current default in every QEMU deployment. Defaults and available models depend on architecture, machine type, and installed QEMU version. Inspect the actual host rather than applying a model recommendation from an older presentation or article.
The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Test migration and troubleshoot failures
A successful boot on one host is not proof of a valid fleet-wide CPU policy. Test migration in both directions where required; then test a cold shutdown and restart on the destination. A guest can migrate while retaining its source CPU definition yet present a different CPU after it is later restarted there.
Nova fails to start after a CPU change
- Check Nova logs for an invalid model or unsupported flag.
- Confirm
cpu_mode = customis set when usingcpu_models. - Verify the model and flags with the installed libvirt and QEMU tools, and validate them on every compute host.
- Remove the newest model or flag, restore the last known-good configuration, and reintroduce changes one at a time.
- Check that the configuration syntax matches the deployed Nova release rather than an older option name.
Live migration is rejected
Compare source and destination CPU models and required or disabled flags. Check vendor, CPU generation, microcode, kernel, QEMU, libvirt, and machine type; confirm whether the guest was started with passthrough; and check whether the failed direction is the reverse of a previously successful migration. A failure may be a genuine incompatibility, not a transient problem.
The guest does not see an expected feature
Compare Nova policy, libvirt/QEMU capabilities on that host, and guest output from lscpu or /proc/cpuinfo. Then verify that placement selected an appropriate host. If the feature was added after the instance was created, a full power-off and cold boot may be necessary before it appears.
Quick Recap
Practical decision guide
- Hosts are broadly alike and balanced behavior is the goal: start with
host-model, then test migration and restart behavior across the actual fleet. - Hosts span known CPU generations and predictable migration is the priority: use
customwith a validated baseline supported by the oldest target host. - Hosts are exceptionally uniform and host fidelity outweighs portability: consider
host-passthrough, after confirming its operational migration limits. - A workload requires a specific instruction set: validate the flag on every eligible host, expose it deliberately, and use Nova placement policy to keep the guest on a capable host.
- You are considering
none: make sure accepting QEMU’s version- and machine-dependent default is an intentional policy, not an accidental omission.
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
