From 1ccda1533d6b7880495d194f41112a9eb1c8ad42 Mon Sep 17 00:00:00 2001 From: Paul Meyer Date: Tue, 19 May 2026 13:56:46 +0200 Subject: [PATCH] vmspawn: use EPYC-v4 cpu for SNP SNP requires a named, stable CPU model so the launch measurement is reproducible across hosts. EPYC-v4 is the baseline that covers all SNP-capable processors (Milan and later). Signed-off-by: Paul Meyer --- src/vmspawn/vmspawn.c | 13 ++++++++----- 1 file changed, 8 insertions(+), 5 deletions(-) diff --git a/src/vmspawn/vmspawn.c b/src/vmspawn/vmspawn.c index e52e9d9852..73f2a19eef 100644 --- a/src/vmspawn/vmspawn.c +++ b/src/vmspawn/vmspawn.c @@ -2944,14 +2944,17 @@ static int run_virtual_machine(int kvm_device_fd, int vhost_device_fd) { config.vsock.cid = child_cid; } - /* -cpu stays on cmdline since not all flags are supported in config */ - r = strv_extend_many(&cmdline, "-cpu", + /* -cpu stays on cmdline since not all flags are supported in config. SNP needs a stable, + * named CPU model so the launch measurement is reproducible across hosts; EPYC-v4 is the + * baseline that covers all SNP-capable processors (Milan and later). */ + const char *cpu_model = #ifdef __x86_64__ - "max,hv_relaxed,hv-vapic,hv-time" + arg_confidential_computing == COCO_AMD_SEV_SNP ? "EPYC-v4" + : "max,hv_relaxed,hv-vapic,hv-time"; #else - "max" + "max"; #endif - ); + r = strv_extend_many(&cmdline, "-cpu", cpu_model); if (r < 0) return log_oom();