Re: [PATCH 7/8] target/i386: SEV: Add support for enabling Secure TSC SEV feature

[Tom Lendacky <thomas.lendacky@amd.com>]

On 9/18/25 05:27, Naveen N Rao (AMD) wrote:
> Add support for enabling Secure TSC VMSA SEV feature in SEV-SNP guests
> through a new "secure-tsc" boolean property on SEV-SNP guest objects. By
> default, KVM uses the host TSC frequency for Secure TSC.
> 
> Sample command-line:
>   -machine q35,confidential-guest-support=sev0 \
>   -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1,secure-tsc=on
> 
> Co-developed-by: Ketan Chaturvedi <Ketan.Chaturvedi@amd.com>
> Signed-off-by: Ketan Chaturvedi <Ketan.Chaturvedi@amd.com>
> Co-developed-by: Nikunj A Dadhania <nikunj@amd.com>
> Signed-off-by: Nikunj A Dadhania <nikunj@amd.com>
> Signed-off-by: Naveen N Rao (AMD) <naveen@kernel.org>

Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com>

> ---
>  target/i386/sev.h |  1 +
>  target/i386/sev.c | 13 +++++++++++++
>  qapi/qom.json     |  6 +++++-
>  3 files changed, 19 insertions(+), 1 deletion(-)
> 
> diff --git a/target/i386/sev.h b/target/i386/sev.h
> index 8e09b2ce1976..87e73034ad15 100644
> --- a/target/i386/sev.h
> +++ b/target/i386/sev.h
> @@ -46,6 +46,7 @@ bool sev_snp_enabled(void);
>  
>  #define SVM_SEV_FEAT_SNP_ACTIVE     BIT(0)
>  #define SVM_SEV_FEAT_DEBUG_SWAP     BIT(5)
> +#define SVM_SEV_FEAT_SECURE_TSC     BIT(9)
>  
>  typedef struct SevKernelLoaderContext {
>      char *setup_data;
> diff --git a/target/i386/sev.c b/target/i386/sev.c
> index 6b11359f06dd..679bedb63c3a 100644
> --- a/target/i386/sev.c
> +++ b/target/i386/sev.c
> @@ -3117,6 +3117,16 @@ sev_snp_guest_set_host_data(Object *obj, const char *value, Error **errp)
>      memcpy(finish->host_data, blob, len);
>  }
>  
> +static bool sev_snp_guest_get_secure_tsc(Object *obj, Error **errp)
> +{
> +    return is_sev_feature_set(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC);
> +}
> +
> +static void sev_snp_guest_set_secure_tsc(Object *obj, bool value, Error **errp)
> +{
> +    sev_set_feature(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC, value);
> +}
> +
>  static void
>  sev_snp_guest_class_init(ObjectClass *oc, const void *data)
>  {
> @@ -3152,6 +3162,9 @@ sev_snp_guest_class_init(ObjectClass *oc, const void *data)
>      object_class_property_add_str(oc, "host-data",
>                                    sev_snp_guest_get_host_data,
>                                    sev_snp_guest_set_host_data);
> +    object_class_property_add_bool(oc, "secure-tsc",
> +                                  sev_snp_guest_get_secure_tsc,
> +                                  sev_snp_guest_set_secure_tsc);
>  }
>  
>  static void
> diff --git a/qapi/qom.json b/qapi/qom.json
> index df962d4a5215..52c23e85e349 100644
> --- a/qapi/qom.json
> +++ b/qapi/qom.json
> @@ -1100,6 +1100,9 @@
>  #     firmware.  Set this to true to disable the use of VCEK.
>  #     (default: false) (since: 9.1)
>  #
> +# @secure-tsc: enable Secure TSC
> +#     (default: false) (since 10.2)
> +#
>  # Since: 9.1
>  ##
>  { 'struct': 'SevSnpGuestProperties',
> @@ -1111,7 +1114,8 @@
>              '*id-auth': 'str',
>              '*author-key-enabled': 'bool',
>              '*host-data': 'str',
> -            '*vcek-disabled': 'bool' } }
> +            '*vcek-disabled': 'bool',
> +            '*secure-tsc': 'bool' } }
>  
>  ##
>  # @TdxGuestProperties: