@samitouri / QOSamiQemu / commits / a26f9b975d

target/i386: SEV: Add support for enabling Secure TSC SEV feature

Add support for enabling Secure TSC VMSA SEV feature in SEV-SNP guests through a new "secure-tsc" boolean property on SEV-SNP guest objects. By default, KVM uses the host TSC frequency for Secure TSC. Sample command-line: -machine q35,confidential-guest-support=sev0 \ -object sev-snp-guest,id=sev0,cbitpos=51,reduced-phys-bits=1,secure-tsc=on Reviewed-by: Tom Lendacky <thomas.lendacky@amd.com> Co-developed-by: Ketan Chaturvedi <Ketan.Chaturvedi@amd.com> Signed-off-by: Ketan Chaturvedi <Ketan.Chaturvedi@amd.com> Co-developed-by: Nikunj A Dadhania <nikunj@amd.com> Signed-off-by: Nikunj A Dadhania <nikunj@amd.com> Signed-off-by: Naveen N Rao (AMD) <naveen@kernel.org> Link: https://lore.kernel.org/r/9f58b92a173f319b3ef725f5ed8a2a173eed55b1.1779281646.git.naveen@kernel.org Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>

Naveen N Rao (AMD) committed May 20, 2026 at 18:58 UTC a26f9b975d5c0690ac5828fadb6242bfee79c008
3 files changed +19 -1
qapi/qom.json
+5 -1
@@ -1113,6 +1113,9 @@
1113 # firmware. Set this to true to disable the use of VCEK.
1114 # (default: false) (since: 9.1)
1115 #
1116 +# @secure-tsc: enable Secure TSC
1117 +# (default: false) (since 11.1)
1118 +#
1119 # Since: 9.1
1120 ##
1121 { 'struct': 'SevSnpGuestProperties',
@@ -1124,7 +1127,8 @@
1127 '*id-auth': 'str',
1128 '*author-key-enabled': 'bool',
1129 '*host-data': 'str',
1127 - '*vcek-disabled': 'bool' } }
1130 + '*vcek-disabled': 'bool',
1131 + '*secure-tsc': 'bool' } }
1132
1133 ##
1134 # @TdxGuestProperties:
target/i386/sev.c
+13
@@ -3212,6 +3212,16 @@ sev_snp_guest_set_host_data(Object *obj, const char *value, Error **errp)
3212 memcpy(finish->host_data, blob, len);
3213 }
3214
3215 +static bool sev_snp_guest_get_secure_tsc(Object *obj, Error **errp)
3216 +{
3217 + return is_sev_feature_set(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC);
3218 +}
3219 +
3220 +static void sev_snp_guest_set_secure_tsc(Object *obj, bool value, Error **errp)
3221 +{
3222 + sev_set_feature(SEV_COMMON(obj), SVM_SEV_FEAT_SECURE_TSC, value);
3223 +}
3224 +
3225 static void
3226 sev_snp_guest_class_init(ObjectClass *oc, const void *data)
3227 {
@@ -3247,6 +3257,9 @@ sev_snp_guest_class_init(ObjectClass *oc, const void *data)
3257 object_class_property_add_str(oc, "host-data",
3258 sev_snp_guest_get_host_data,
3259 sev_snp_guest_set_host_data);
3260 + object_class_property_add_bool(oc, "secure-tsc",
3261 + sev_snp_guest_get_secure_tsc,
3262 + sev_snp_guest_set_secure_tsc);
3263 }
3264
3265 static void
target/i386/sev.h
+1
@@ -48,6 +48,7 @@ bool sev_snp_enabled(void);
48
49 #define SVM_SEV_FEAT_SNP_ACTIVE BIT(0)
50 #define SVM_SEV_FEAT_DEBUG_SWAP BIT(5)
51 +#define SVM_SEV_FEAT_SECURE_TSC BIT(9)
52
53 typedef struct SevKernelLoaderContext {
54 char *setup_data;