[RFC PATCH 5/7] target/i386: SEV: Add support for enabling Secure TSC SEV feature

Naveen N Rao (AMD)
2025-09-11T11:57:47Z

Add support for enabling Secure TSC VMSA SEV feature in SEV-SNP guests
through a new "secure-tsc" boolean property on SEV-SNP guest objects.

Sample command-line:
-machine q35,confidential-guest-support=sev0 \
-object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1,secure-tsc=on

Co-developed-by: Ketan Chaturvedi <Ketan.Chaturvedi@amd.com>
Signed-off-by: Ketan Chaturvedi <Ketan.Chaturvedi@amd.com>
Co-developed-by: Nikunj A Dadhania <nikunj@amd.com>
Signed-off-by: Nikunj A Dadhania <nikunj@amd.com>
Signed-off-by: Naveen N Rao (AMD) <naveen@kernel.org>
---
target/i386/sev.h | 1 +
target/i386/sev.c | 13 +++++++++++++
qapi/qom.json | 5 ++++-
3 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/target/i386/sev.h b/target/i386/sev.h
index 8e09b2ce1976..87e73034ad15 100644
--- a/target/i386/sev.h
+++ b/target/i386/sev.h
@@ -46,6 +46,7 @@ bool sev_snp_enabled(void);

#define SVM_SEV_FEAT_SNP_ACTIVE BIT(0)
#define SVM_SEV_FEAT_DEBUG_SWAP BIT(5)
+#define SVM_SEV_FEAT_SECURE_TSC BIT(9)

typedef struct SevKernelLoaderContext {
char *setup_data;
diff --git a/target/i386/sev.c b/target/i386/sev.c
index 3063ad2d077a..8f88df19a408 100644
--- a/target/i386/sev.c
+++ b/target/i386/sev.c
@@ -3117,6 +3117,16 @@ sev_snp_guest_set_host_data(Object *obj, const char *value, Error **errp)
memcpy(finish->host_data, blob, len);
}

+static bool sev_snp_guest_get_secure_tsc(Object *obj, Error **errp)
+{
+ return is_sev_feature_set(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC);
+}
+
+static void sev_snp_guest_set_secure_tsc(Object *obj, bool value, Error **errp)
+{
+ sev_set_feature(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC, value);
+}
+
static void
sev_snp_guest_class_init(ObjectClass *oc, const void *data)
{
@@ -3152,6 +3162,9 @@ sev_snp_guest_class_init(ObjectClass *oc, const void *data)
object_class_property_add_str(oc, "host-data",
sev_snp_guest_get_host_data,
sev_snp_guest_set_host_data);
+ object_class_property_add_bool(oc, "secure-tsc",
+ sev_snp_guest_get_secure_tsc,
+ sev_snp_guest_set_secure_tsc);
}

static void
diff --git a/qapi/qom.json b/qapi/qom.json
index 71cd8ad588b5..b05a475ef499 100644
--- a/qapi/qom.json
+++ b/qapi/qom.json
@@ -1100,6 +1100,8 @@
# firmware. Set this to true to disable the use of VCEK.
# (default: false) (since: 9.1)
#
+# @secure-tsc: enable Secure TSC (default: false) (since 10.2)
+#
# Since: 9.1
##
{ 'struct': 'SevSnpGuestProperties',
@@ -1111,7 +1113,8 @@
'*id-auth': 'str',
'*author-key-enabled': 'bool',
'*host-data': 'str',
- '*vcek-disabled': 'bool' } }
+ '*vcek-disabled': 'bool',
+ '*secure-tsc': 'bool' } }

##
# @TdxGuestProperties:
--
2.50.1