Re: [RFC PATCH v2 07/22] coco/tsm: Add tsm and tsm-host modules

[Zhi Wang <zhiw@nvidia.com>]

On Tue, 18 Feb 2025 22:09:54 +1100
Alexey Kardashevskiy <aik@amd.com> wrote:

> The TSM module is a library to create sysfs nodes common for
> hypervisors and VMs. It also provides helpers to parse interface
> reports (required by VMs, visible to HVs). It registers 3 device
> classes:
> - tsm: one per platform,
> - tsm-dev: for physical functions, ("TDEV");
> - tdm-tdi: for PCI functions being assigned to VMs ("TDI").
> 
> The library adds a child device of "tsm-dev" or/and "tsm-tdi" class
> for every capable PCI device. Note that the module is made
> bus-agnostic.
> 
> New device nodes provide sysfs interface for fetching device
> certificates and measurements and TDI interface reports.
> Nodes with the "_user" suffix provide human-readable information,
> without that suffix it is raw binary data to be copied to a guest.
> 
> The TSM-HOST module adds hypervisor-only functionality on top. At the
> moment it is:
> - "connect" to enable/disable IDE (a PCI link encryption);
> - "TDI bind" to manage a PCI function passed through to a secure VM.
> 
> A platform is expected to register itself in TSM-HOST and provide
> necessary callbacks. No platform is added here, AMD SEV is coming in
> the next patches.
> 
> Signed-off-by: Alexey Kardashevskiy <aik@amd.com>
> ---
>  drivers/virt/coco/Makefile        |   2 +
>  drivers/virt/coco/host/Makefile   |   6 +
>  include/linux/tsm.h               | 295 +++++++++
>  drivers/virt/coco/host/tsm-host.c | 552 +++++++++++++++++
>  drivers/virt/coco/tsm.c           | 636 ++++++++++++++++++++
>  Documentation/virt/coco/tsm.rst   |  99 +++
>  drivers/virt/coco/Kconfig         |  14 +
>  drivers/virt/coco/host/Kconfig    |   6 +
>  8 files changed, 1610 insertions(+)
> 
> diff --git a/drivers/virt/coco/Makefile b/drivers/virt/coco/Makefile
> index 885c9ef4e9fc..670f77c564e8 100644
> --- a/drivers/virt/coco/Makefile
> +++ b/drivers/virt/coco/Makefile
> @@ -2,9 +2,11 @@
>  #
>  # Confidential computing related collateral
>  #
> +obj-$(CONFIG_TSM)		+= tsm.o
>  obj-$(CONFIG_EFI_SECRET)	+= efi_secret/
>  obj-$(CONFIG_ARM_PKVM_GUEST)	+= pkvm-guest/
>  obj-$(CONFIG_SEV_GUEST)		+= sev-guest/
>  obj-$(CONFIG_INTEL_TDX_GUEST)	+= tdx-guest/
>  obj-$(CONFIG_ARM_CCA_GUEST)	+= arm-cca-guest/
>  obj-$(CONFIG_TSM_REPORTS)	+= guest/
> +obj-$(CONFIG_TSM_HOST)          += host/
> diff --git a/drivers/virt/coco/host/Makefile
> b/drivers/virt/coco/host/Makefile new file mode 100644
> index 000000000000..c5e216b6cb1c
> --- /dev/null
> +++ b/drivers/virt/coco/host/Makefile
> @@ -0,0 +1,6 @@
> +# SPDX-License-Identifier: GPL-2.0-only
> +#
> +# TSM (TEE Security Manager) Common infrastructure and host drivers
> +
> +obj-$(CONFIG_TSM_HOST) += tsm_host.o
> +tsm_host-y += tsm-host.o
> diff --git a/include/linux/tsm.h b/include/linux/tsm.h
> index 431054810dca..486e386d90fc 100644
> --- a/include/linux/tsm.h
> +++ b/include/linux/tsm.h
> @@ -5,6 +5,11 @@
>  #include <linux/sizes.h>
>  #include <linux/types.h>
>  #include <linux/uuid.h>
> +#include <linux/device.h>
> +#include <linux/slab.h>
> +#include <linux/mutex.h>
> +#include <linux/device.h>
> +#include <linux/bitfield.h>
>  
>  #define TSM_REPORT_INBLOB_MAX 64
>  #define TSM_REPORT_OUTBLOB_MAX SZ_32K
> @@ -109,4 +114,294 @@ struct tsm_report_ops {
>  
>  int tsm_report_register(const struct tsm_report_ops *ops, void
> *priv); int tsm_report_unregister(const struct tsm_report_ops *ops);
> +
> +/* SPDM control structure for DOE */
> +struct tsm_spdm {
> +	unsigned long req_len;
> +	void *req;
> +	unsigned long rsp_len;
> +	void *rsp;
> +};
> +
> +/* Data object for measurements/certificates/attestationreport */
> +struct tsm_blob {
> +	void *data;
> +	size_t len;
> +};
> +
> +struct tsm_blob *tsm_blob_new(void *data, size_t len);
> +static inline void tsm_blob_free(struct tsm_blob *b)
> +{
> +	kfree(b);
> +}
> +
> +/**
> + * struct tdisp_interface_id - TDISP INTERFACE_ID Definition
> + *
> + * @function_id: Identifies the function of the device hosting the
> TDI
> + *   15:0: @rid: Requester ID
> + *   23:16: @rseg: Requester Segment (Reserved if Requester Segment
> Valid is Clear)
> + *   24: @rseg_valid: Requester Segment Valid
> + *   31:25 – Reserved
> + * 8B - Reserved
> + */
> +struct tdisp_interface_id {
> +	u32 function_id; /* TSM_TDISP_IID_xxxx */
> +	u8 reserved[8];
> +} __packed;
> +
> +#define TSM_TDISP_IID_REQUESTER_ID	GENMASK(15, 0)
> +#define TSM_TDISP_IID_RSEG		GENMASK(23, 16)
> +#define TSM_TDISP_IID_RSEG_VALID	BIT(24)
> +

I would suggest that we have separate header files for spec
definitions. E.g. tdisp_defs and spdm_defs.h. from the maintainability
perspective.

> +/*
> + * Measurement block as defined in SPDM DSP0274.
> + */
> +struct spdm_measurement_block_header {
> +	u8 index;
> +	u8 spec; /* MeasurementSpecification */
> +	u16 size;
> +} __packed;
> +

....

> +struct tsm_hv_ops {
> +	int (*dev_connect)(struct tsm_dev *tdev, void *private_data);
> +	int (*dev_disconnect)(struct tsm_dev *tdev);
> +	int (*dev_status)(struct tsm_dev *tdev, struct
> tsm_dev_status *s);
> +	int (*dev_measurements)(struct tsm_dev *tdev);
> +	int (*tdi_bind)(struct tsm_tdi *tdi, u32 bdfn, u64 vmid);
> +	int (*tdi_unbind)(struct tsm_tdi *tdi);
> +	int (*guest_request)(struct tsm_tdi *tdi, u8 __user *req,
> size_t reqlen,
> +			     u8 __user *rsp, size_t rsplen, int
> *fw_err);
> +	int (*tdi_status)(struct tsm_tdi *tdi, struct tsm_tdi_status
> *ts); +};
> +

1) Looks we have two more callbacks besides TDI verbs, I think they are
fine to be in TSM driver ops.

For guest_request(), anyway, we need an entry point for QEMU to
reach the TSM services in the kernel. Looks like almost all the platform
(Intel/AMD/ARM) have TVM-HOST paths, which will exit to QEMU from KVM,
and QEMU reaches the TSM services and return to the TVM. I think they
can all leverage the entry point (IOMMUFD) via the guest request ioctl.
And IOMMUFD almost have all the stuff QEMU needs.

Or we would end up with QEMU reaches to different entry points in
per-vendor code path, which was not preferable, backing to the
period when enabling CC in QEMU.

2) Also, it is better that we have separate the tsm_guest and tsm_host
headers since the beginning. 

3) How do you trigger the TDI_BIND from the guest in the late-bind
model? Was looking at tsm_vm_ops, but seems not found yet.

> +struct tsm_subsys {
> +	struct device dev;
> +	struct list_head tdi_head;
> +	struct mutex lock;
> +	const struct attribute_group *tdev_groups[3]; /* Common,
> host/guest, NULL */
> +	const struct attribute_group *tdi_groups[3]; /* Common,
> host/guest, NULL */
> +	int (*update_measurements)(struct tsm_dev *tdev);
> +};
> +
> +struct tsm_subsys *tsm_register(struct device *parent, size_t extra,
> +				const struct attribute_group
> *tdev_ag,
> +				const struct attribute_group *tdi_ag,
> +				int (*update_measurements)(struct
> tsm_dev *tdev)); +void tsm_unregister(struct tsm_subsys *subsys);
> +
> +struct tsm_host_subsys;
> +struct tsm_host_subsys *tsm_host_register(struct device *parent,
> +					  struct tsm_hv_ops *hvops,
> +					  void *private_data);
> +struct tsm_dev *tsm_dev_get(struct device *dev);
> +void tsm_dev_put(struct tsm_dev *tdev);
> +struct tsm_tdi *tsm_tdi_get(struct device *dev);
> +void tsm_tdi_put(struct tsm_tdi *tdi);
> +
> +struct pci_dev;
> +int pci_dev_tdi_validate(struct pci_dev *pdev, bool invalidate);
> +int pci_dev_tdi_mmio_config(struct pci_dev *pdev, u32 range_id, bool
> tee); +
> +int tsm_dev_init(struct tsm_bus_subsys *tsm_bus, struct device
> *parent,
> +		 size_t busdatalen, struct tsm_dev **ptdev);
> +void tsm_dev_free(struct tsm_dev *tdev);
> +int tsm_tdi_init(struct tsm_dev *tdev, struct device *dev);
> +void tsm_tdi_free(struct tsm_tdi *tdi);
> +
> +/* IOMMUFD vIOMMU helpers */
> +int tsm_tdi_bind(struct tsm_tdi *tdi, u32 guest_rid, int kvmfd);
> +void tsm_tdi_unbind(struct tsm_tdi *tdi);
> +int tsm_guest_request(struct tsm_tdi *tdi, u8 __user *req, size_t
> reqlen,
> +		      u8 __user *res, size_t reslen, int *fw_err);
> +
> +/* Debug */
> +ssize_t tsm_report_gen(struct tsm_blob *report, char *b, size_t len);
> +
> +/* IDE */
> +int tsm_create_link(struct tsm_subsys *tsm, struct device *dev,
> const char *name); +void tsm_remove_link(struct tsm_subsys *tsm,
> const char *name); +#define tsm_register_ide_stream(tdev, ide) \
> +	tsm_create_link((tdev)->tsm, &(tdev)->dev, (ide)->name)
> +#define tsm_unregister_ide_stream(tdev, ide) \
> +	tsm_remove_link((tdev)->tsm, (ide)->name)
> +
>  #endif /* __TSM_H */
> diff --git a/drivers/virt/coco/host/tsm-host.c
> b/drivers/virt/coco/host/tsm-host.c new file mode 100644
> index 000000000000..80f3315fb195
> --- /dev/null
> +++ b/drivers/virt/coco/host/tsm-host.c
> @@ -0,0 +1,552 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +
> +#include <linux/module.h>
> +#include <linux/tsm.h>
> +#include <linux/file.h>
> +#include <linux/kvm_host.h>
> +
> +#define DRIVER_VERSION	"0.1"
> +#define DRIVER_AUTHOR	"aik@amd.com"
> +#define DRIVER_DESC	"TSM host library"
> +
> +struct tsm_host_subsys {
> +	struct tsm_subsys base;
> +	struct tsm_hv_ops *ops;
> +	void *private_data;
> +};
> +
> +static int tsm_dev_connect(struct tsm_dev *tdev)
> +{
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	int ret;
> +
> +	if (WARN_ON(!hsubsys->ops->dev_connect))
> +		return -EPERM;
> +
> +	if (WARN_ON(!tdev->tsm_bus))
> +		return -EPERM;
> +
> +	mutex_lock(&tdev->spdm_mutex);
> +	while (1) {
> +		ret = hsubsys->ops->dev_connect(tdev,
> hsubsys->private_data);
> +		if (ret <= 0)
> +			break;
> +
> +		ret = tdev->tsm_bus->ops->spdm_forward(&tdev->spdm,
> ret);
> +		if (ret < 0)
> +			break;
> +	}
> +	mutex_unlock(&tdev->spdm_mutex);
> +
> +	tdev->connected = (ret == 0);
> +
> +	return ret;
> +}
> +
> +static int tsm_dev_reclaim(struct tsm_dev *tdev)
> +{
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	int ret;
> +
> +	if (WARN_ON(!hsubsys->ops->dev_disconnect))
> +		return -EPERM;
> +
> +	/* Do not disconnect with active TDIs */
> +	if (tdev->bound)
> +		return -EBUSY;
> +

Can this replace a lock? refcount is to track the life cycle,
lock is to avoid racing. Think that we just pass here tdev->bound
== 0, take the spdm_mutex and request the TSM to talk to the device
for disconnection, while someone is calling tdi_bind and pass the
tdev->connected check and waiting for the spdm_mutex to do the
tdi_bind. The device might see a TDI_BIND after a DEVICE_DISCONNECT.

Z.
> +	mutex_lock(&tdev->spdm_mutex);
> +	while (1) {
> +		ret = hsubsys->ops->dev_disconnect(tdev);
> +		if (ret <= 0)
> +			break;
> +
> +		ret = tdev->tsm_bus->ops->spdm_forward(&tdev->spdm,
> ret);
> +		if (ret < 0)
> +			break;
> +	}
> +	mutex_unlock(&tdev->spdm_mutex);
> +
> +	if (!ret)
> +		tdev->connected = false;
> +
> +	return ret;
> +}
> +
> +static int tsm_dev_status(struct tsm_dev *tdev, struct
> tsm_dev_status *s) +{
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm; +
> +	if (WARN_ON(!hsubsys->ops->dev_status))
> +		return -EPERM;
> +
> +	return hsubsys->ops->dev_status(tdev, s);
> +}
> +
> +static int tsm_tdi_measurements_locked(struct tsm_dev *tdev)
> +{
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	int ret;
> +
> +	while (1) {
> +		ret = hsubsys->ops->dev_measurements(tdev);
> +		if (ret <= 0)
> +			break;
> +
> +		ret = tdev->tsm_bus->ops->spdm_forward(&tdev->spdm,
> ret);
> +		if (ret < 0)
> +			break;
> +	}
> +
> +	return ret;
> +}
> +
> +static void tsm_tdi_reclaim(struct tsm_tdi *tdi)
> +{
> +	struct tsm_dev *tdev = tdi->tdev;
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	int ret;
> +
> +	if (WARN_ON(!hsubsys->ops->tdi_unbind))
> +		return;
> +
> +	mutex_lock(&tdi->tdev->spdm_mutex);
> +	while (1) {
> +		ret = hsubsys->ops->tdi_unbind(tdi);
> +		if (ret <= 0)
> +			break;
> +
> +		ret =
> tdi->tdev->tsm_bus->ops->spdm_forward(&tdi->tdev->spdm, ret);
> +		if (ret < 0)
> +			break;
> +	}
> +	mutex_unlock(&tdi->tdev->spdm_mutex);
> +}
> +
> +static int tsm_tdi_status(struct tsm_tdi *tdi, void *private_data,
> struct tsm_tdi_status *ts) +{
> +	struct tsm_tdi_status tstmp = { 0 };
> +	struct tsm_dev *tdev = tdi->tdev;
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	int ret;
> +
> +	mutex_lock(&tdi->tdev->spdm_mutex);
> +	while (1) {
> +		ret = hsubsys->ops->tdi_status(tdi, &tstmp);
> +		if (ret <= 0)
> +			break;
> +
> +		ret =
> tdi->tdev->tsm_bus->ops->spdm_forward(&tdi->tdev->spdm, ret);
> +		if (ret < 0)
> +			break;
> +	}
> +	mutex_unlock(&tdi->tdev->spdm_mutex);
> +
> +	if (!ret)
> +		*ts = tstmp;
> +
> +	return ret;
> +}
> +
> +static ssize_t tsm_cert_slot_store(struct device *dev, struct
> device_attribute *attr,
> +				   const char *buf, size_t count)
> +{
> +	struct tsm_dev *tdev = container_of(dev, struct tsm_dev,
> dev);
> +	ssize_t ret = count;
> +	unsigned long val;
> +
> +	if (kstrtoul(buf, 0, &val) < 0)
> +		ret = -EINVAL;
> +	else
> +		tdev->cert_slot = val;
> +
> +	return ret;
> +}
> +
> +static ssize_t tsm_cert_slot_show(struct device *dev, struct
> device_attribute *attr, char *buf) +{
> +	struct tsm_dev *tdev = container_of(dev, struct tsm_dev,
> dev);
> +	ssize_t ret = sysfs_emit(buf, "%u\n", tdev->cert_slot);
> +
> +	return ret;
> +}
> +
> +static DEVICE_ATTR_RW(tsm_cert_slot);
> +
> +static ssize_t tsm_dev_connect_store(struct device *dev, struct
> device_attribute *attr,
> +				     const char *buf, size_t count)
> +{
> +	struct tsm_dev *tdev = container_of(dev, struct tsm_dev,
> dev);
> +	unsigned long val;
> +	ssize_t ret = -EIO;
> +
> +	if (kstrtoul(buf, 0, &val) < 0)
> +		ret = -EINVAL;
> +	else if (val && !tdev->connected)
> +		ret = tsm_dev_connect(tdev);
> +	else if (!val && tdev->connected)
> +		ret = tsm_dev_reclaim(tdev);
> +
> +	if (!ret)
> +		ret = count;
> +
> +	return ret;
> +}
> +
> +static ssize_t tsm_dev_connect_show(struct device *dev, struct
> device_attribute *attr, char *buf) +{
> +	struct tsm_dev *tdev = container_of(dev, struct tsm_dev,
> dev);
> +	ssize_t ret = sysfs_emit(buf, "%u\n", tdev->connected);
> +
> +	return ret;
> +}
> +
> +static DEVICE_ATTR_RW(tsm_dev_connect);
> +
> +static ssize_t tsm_dev_status_show(struct device *dev, struct
> device_attribute *attr, char *buf) +{
> +	struct tsm_dev *tdev = container_of(dev, struct tsm_dev,
> dev);
> +	struct tsm_dev_status s = { 0 };
> +	int ret = tsm_dev_status(tdev, &s);
> +	ssize_t ret1;
> +
> +	ret1 = sysfs_emit(buf, "ret=%d\n"
> +			  "ctx_state=%x\n"
> +			  "tc_mask=%x\n"
> +			  "certs_slot=%x\n"
> +			  "device_id=%x:%x.%d\n"
> +			  "segment_id=%x\n"
> +			  "no_fw_update=%x\n",
> +			  ret,
> +			  s.ctx_state,
> +			  s.tc_mask,
> +			  s.certs_slot,
> +			  (s.device_id >> 8) & 0xff,
> +			  (s.device_id >> 3) & 0x1f,
> +			  s.device_id & 0x07,
> +			  s.segment_id,
> +			  s.no_fw_update);
> +
> +	tsm_dev_put(tdev);
> +	return ret1;
> +}
> +
> +static DEVICE_ATTR_RO(tsm_dev_status);
> +
> +static struct attribute *host_dev_attrs[] = {
> +	&dev_attr_tsm_cert_slot.attr,
> +	&dev_attr_tsm_dev_connect.attr,
> +	&dev_attr_tsm_dev_status.attr,
> +	NULL,
> +};
> +static const struct attribute_group host_dev_group = {
> +	.attrs = host_dev_attrs,
> +};
> +
> +static ssize_t tsm_tdi_bind_show(struct device *dev, struct
> device_attribute *attr, char *buf) +{
> +	struct tsm_tdi *tdi = container_of(dev, struct tsm_tdi, dev);
> +
> +	if (!tdi->kvm)
> +		return sysfs_emit(buf, "not bound\n");
> +
> +	return sysfs_emit(buf, "VM=%p BDFn=%x:%x.%d\n",
> +			  tdi->kvm,
> +			  (tdi->guest_rid >> 8) & 0xff,
> +			  (tdi->guest_rid >> 3) & 0x1f,
> +			  tdi->guest_rid & 0x07);
> +}
> +
> +static DEVICE_ATTR_RO(tsm_tdi_bind);
> +
> +static char *spdm_algos_to_str(u64 algos, char *buf, size_t len)
> +{
> +	size_t n = 0;
> +
> +	buf[0] = 0;
> +#define __ALGO(x) do {
> 			\
> +		if ((n < len) && (algos & (1ULL <<
> (TSM_TDI_SPDM_ALGOS_##x))))	\
> +			n += snprintf(buf + n, len - n, #x"
> ");			\
> +	} while (0)
> +
> +	__ALGO(DHE_SECP256R1);
> +	__ALGO(DHE_SECP384R1);
> +	__ALGO(AEAD_AES_128_GCM);
> +	__ALGO(AEAD_AES_256_GCM);
> +	__ALGO(ASYM_TPM_ALG_RSASSA_3072);
> +	__ALGO(ASYM_TPM_ALG_ECDSA_ECC_NIST_P256);
> +	__ALGO(ASYM_TPM_ALG_ECDSA_ECC_NIST_P384);
> +	__ALGO(HASH_TPM_ALG_SHA_256);
> +	__ALGO(HASH_TPM_ALG_SHA_384);
> +	__ALGO(KEY_SCHED_SPDM_KEY_SCHEDULE);
> +#undef __ALGO
> +	return buf;
> +}
> +
> +static const char *tdisp_state_to_str(enum tsm_tdisp_state state)
> +{
> +	switch (state) {
> +#define __ST(x) case TDISP_STATE_##x: return #x
> +	case TDISP_STATE_UNAVAIL: return "TDISP state unavailable";
> +	__ST(CONFIG_UNLOCKED);
> +	__ST(CONFIG_LOCKED);
> +	__ST(RUN);
> +	__ST(ERROR);
> +#undef __ST
> +	default: return "unknown";
> +	}
> +}
> +
> +static ssize_t tsm_tdi_status_user_show(struct device *dev,
> +					struct device_attribute
> *attr,
> +					char *buf)
> +{
> +	struct tsm_tdi *tdi = container_of(dev, struct tsm_tdi, dev);
> +	struct tsm_dev *tdev = tdi->tdev;
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	struct tsm_tdi_status ts = { 0 };
> +	char algos[256] = "";
> +	unsigned int n, m;
> +	int ret;
> +
> +	ret = tsm_tdi_status(tdi, hsubsys->private_data, &ts);
> +	if (ret < 0)
> +		return sysfs_emit(buf, "ret=%d\n\n", ret);
> +
> +	if (!ts.valid)
> +		return sysfs_emit(buf, "ret=%d\nstate=%d:%s\n",
> +				  ret, ts.state,
> tdisp_state_to_str(ts.state)); +
> +	n = snprintf(buf, PAGE_SIZE,
> +		     "ret=%d\n"
> +		     "state=%d:%s\n"
> +		     "meas_digest_fresh=%x\n"
> +		     "meas_digest_valid=%x\n"
> +		     "all_request_redirect=%x\n"
> +		     "bind_p2p=%x\n"
> +		     "lock_msix=%x\n"
> +		     "no_fw_update=%x\n"
> +		     "cache_line_size=%d\n"
> +		     "algos=%#llx:%s\n"
> +		     "report_counter=%lld\n"
> +		     ,
> +		     ret,
> +		     ts.state, tdisp_state_to_str(ts.state),
> +		     ts.meas_digest_fresh,
> +		     ts.meas_digest_valid,
> +		     ts.all_request_redirect,
> +		     ts.bind_p2p,
> +		     ts.lock_msix,
> +		     ts.no_fw_update,
> +		     ts.cache_line_size,
> +		     ts.spdm_algos, spdm_algos_to_str(ts.spdm_algos,
> algos, sizeof(algos) - 1),
> +		     ts.intf_report_counter);
> +
> +	n += snprintf(buf + n, PAGE_SIZE - n, "Certs digest: ");
> +	m = hex_dump_to_buffer(ts.certs_digest,
> sizeof(ts.certs_digest), 32, 1,
> +			       buf + n, PAGE_SIZE - n, false);
> +	n += min(PAGE_SIZE - n, m);
> +	n += snprintf(buf + n, PAGE_SIZE - n, "...\nMeasurements
> digest: ");
> +	m = hex_dump_to_buffer(ts.meas_digest,
> sizeof(ts.meas_digest), 32, 1,
> +			       buf + n, PAGE_SIZE - n, false);
> +	n += min(PAGE_SIZE - n, m);
> +	n += snprintf(buf + n, PAGE_SIZE - n, "...\nInterface report
> digest: ");
> +	m = hex_dump_to_buffer(ts.interface_report_digest,
> sizeof(ts.interface_report_digest),
> +			       32, 1, buf + n, PAGE_SIZE - n, false);
> +	n += min(PAGE_SIZE - n, m);
> +	n += snprintf(buf + n, PAGE_SIZE - n, "...\n");
> +
> +	return n;
> +}
> +
> +static DEVICE_ATTR_RO(tsm_tdi_status_user);
> +
> +static ssize_t tsm_tdi_status_show(struct device *dev, struct
> device_attribute *attr, char *buf) +{
> +	struct tsm_tdi *tdi = container_of(dev, struct tsm_tdi, dev);
> +	struct tsm_dev *tdev = tdi->tdev;
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	struct tsm_tdi_status ts = { 0 };
> +	u8 state;
> +	int ret;
> +
> +	ret = tsm_tdi_status(tdi, hsubsys->private_data, &ts);
> +	if (ret)
> +		return ret;
> +
> +	state = ts.state;
> +	memcpy(buf, &state, sizeof(state));
> +
> +	return sizeof(state);
> +}
> +
> +static DEVICE_ATTR_RO(tsm_tdi_status);
> +
> +static struct attribute *host_tdi_attrs[] = {
> +	&dev_attr_tsm_tdi_bind.attr,
> +	&dev_attr_tsm_tdi_status_user.attr,
> +	&dev_attr_tsm_tdi_status.attr,
> +	NULL,
> +};
> +
> +static const struct attribute_group host_tdi_group = {
> +	.attrs = host_tdi_attrs,
> +};
> +
> +int tsm_tdi_bind(struct tsm_tdi *tdi, u32 guest_rid, int kvmfd)
> +{
> +	struct tsm_dev *tdev = tdi->tdev;
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	struct fd f = fdget(kvmfd);
> +	struct kvm *kvm;
> +	u64 vmid;
> +	int ret;
> +
> +	if (!fd_file(f))
> +		return -EBADF;
> +
> +	if (!file_is_kvm(fd_file(f))) {
> +		ret = -EBADF;
> +		goto out_fput;
> +	}
> +
> +	kvm = fd_file(f)->private_data;
> +	if (!kvm || !kvm_get_kvm_safe(kvm)) {
> +		ret = -EFAULT;
> +		goto out_fput;
> +	}
> +
> +	vmid = kvm_arch_tsm_get_vmid(kvm);
> +	if (!vmid) {
> +		ret = -EFAULT;
> +		goto out_kvm_put;
> +	}
> +
> +	if (WARN_ON(!hsubsys->ops->tdi_bind)) {
> +		ret = -EPERM;
> +		goto out_kvm_put;
> +	}
> +
> +	if (!tdev->connected) {
> +		ret = -EIO;
> +		goto out_kvm_put;
> +	}
> +
> +	mutex_lock(&tdi->tdev->spdm_mutex);
> +	while (1) {
> +		ret = hsubsys->ops->tdi_bind(tdi, guest_rid, vmid);
> +		if (ret < 0)
> +			break;
> +
> +		if (!ret)
> +			break;
> +
> +		ret =
> tdi->tdev->tsm_bus->ops->spdm_forward(&tdi->tdev->spdm, ret);
> +		if (ret < 0)
> +			break;
> +	}
> +	mutex_unlock(&tdi->tdev->spdm_mutex);
> +
> +	if (ret) {
> +		tsm_tdi_unbind(tdi);
> +		goto out_kvm_put;
> +	}
> +
> +	tdi->guest_rid = guest_rid;
> +	tdi->kvm = kvm;
> +	++tdi->tdev->bound;
> +	goto out_fput;
> +
> +out_kvm_put:
> +	kvm_put_kvm(kvm);
> +out_fput:
> +	fdput(f);
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(tsm_tdi_bind);
> +
> +void tsm_tdi_unbind(struct tsm_tdi *tdi)
> +{
> +	if (tdi->kvm) {
> +		tsm_tdi_reclaim(tdi);
> +		--tdi->tdev->bound;
> +		kvm_put_kvm(tdi->kvm);
> +		tdi->kvm = NULL;
> +	}
> +
> +	tdi->guest_rid = 0;
> +	tdi->dev.parent->tdi_enabled = false;
> +}
> +EXPORT_SYMBOL_GPL(tsm_tdi_unbind);
> +
> +int tsm_guest_request(struct tsm_tdi *tdi, u8 __user *req, size_t
> reqlen,
> +		      u8 __user *res, size_t reslen, int *fw_err)
> +{
> +	struct tsm_dev *tdev = tdi->tdev;
> +	struct tsm_host_subsys *hsubsys = (struct tsm_host_subsys *)
> tdev->tsm;
> +	int ret;
> +
> +	if (!hsubsys->ops->guest_request)
> +		return -EPERM;
> +
> +	mutex_lock(&tdi->tdev->spdm_mutex);
> +	while (1) {
> +		ret = hsubsys->ops->guest_request(tdi, req, reqlen,
> +						  res, reslen,
> fw_err);
> +		if (ret <= 0)
> +			break;
> +
> +		ret =
> tdi->tdev->tsm_bus->ops->spdm_forward(&tdi->tdev->spdm,
> +							    ret);
> +		if (ret < 0)
> +			break;
> +	}
> +
> +	mutex_unlock(&tdi->tdev->spdm_mutex);
> +
> +	return ret;
> +}
> +EXPORT_SYMBOL_GPL(tsm_guest_request);
> +
> +struct tsm_host_subsys *tsm_host_register(struct device *parent,
> +					  struct tsm_hv_ops *hvops,
> +					  void *private_data)
> +{
> +	struct tsm_subsys *subsys = tsm_register(parent,
> sizeof(struct tsm_host_subsys),
> +						 &host_dev_group,
> &host_tdi_group,
> +
> tsm_tdi_measurements_locked);
> +	struct tsm_host_subsys *hsubsys;
> +
> +	hsubsys = (struct tsm_host_subsys *) subsys;
> +
> +	if (IS_ERR(hsubsys))
> +		return hsubsys;
> +
> +	hsubsys->ops = hvops;
> +	hsubsys->private_data = private_data;
> +
> +	return hsubsys;
> +}
> +EXPORT_SYMBOL_GPL(tsm_host_register);
> +
> +static int __init tsm_init(void)
> +{
> +	int ret = 0;
> +
> +	pr_info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
> +
> +	return ret;
> +}
> +
> +static void __exit tsm_exit(void)
> +{
> +	pr_info(DRIVER_DESC " version: " DRIVER_VERSION "
> shutdown\n"); +}
> +
> +module_init(tsm_init);
> +module_exit(tsm_exit);
> +
> +MODULE_VERSION(DRIVER_VERSION);
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR(DRIVER_AUTHOR);
> +MODULE_DESCRIPTION(DRIVER_DESC);
> diff --git a/drivers/virt/coco/tsm.c b/drivers/virt/coco/tsm.c
> new file mode 100644
> index 000000000000..b6235d1210ca
> --- /dev/null
> +++ b/drivers/virt/coco/tsm.c
> @@ -0,0 +1,636 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +
> +#include <linux/module.h>
> +#include <linux/tsm.h>
> +
> +#define DRIVER_VERSION	"0.1"
> +#define DRIVER_AUTHOR	"aik@amd.com"
> +#define DRIVER_DESC	"TSM library"
> +
> +static struct class *tsm_class, *tdev_class, *tdi_class;
> +
> +/* snprintf does not check for the size, hence this wrapper */
> +static int tsmprint(char *buf, size_t size, const char *fmt, ...)
> +{
> +	va_list args;
> +	size_t i;
> +
> +	if (!size)
> +		return 0;
> +
> +	va_start(args, fmt);
> +	i = vsnprintf(buf, size, fmt, args);
> +	va_end(args);
> +
> +	return min(i, size);
> +}
> +
> +struct tsm_blob *tsm_blob_new(void *data, size_t len)
> +{
> +	struct tsm_blob *b;
> +
> +	if (!len || !data)
> +		return NULL;
> +
> +	b = kzalloc(sizeof(*b) + len, GFP_KERNEL);
> +	if (!b)
> +		return NULL;
> +
> +	b->data = (void *)b + sizeof(*b);
> +	b->len = len;
> +	memcpy(b->data, data, len);
> +
> +	return b;
> +}
> +EXPORT_SYMBOL_GPL(tsm_blob_new);
> +
> +static int match_class(struct device *dev, const void *data)
> +{
> +	return dev->class == data;
> +}
> +
> +struct tsm_dev *tsm_dev_get(struct device *parent)
> +{
> +	struct device *dev = device_find_child(parent, tdev_class,
> match_class); +
> +	if (!dev) {
> +		dev = device_find_child(parent, tdi_class,
> match_class);
> +		if (dev) {
> +			struct tsm_tdi *tdi = container_of(dev,
> struct tsm_tdi, dev); +
> +			dev = &tdi->tdev->dev;
> +		}
> +	}
> +
> +	if (!dev)
> +		return NULL;
> +
> +	/* device_find_child() does get_device() */
> +	return container_of(dev, struct tsm_dev, dev);
> +}
> +EXPORT_SYMBOL_GPL(tsm_dev_get);
> +
> +void tsm_dev_put(struct tsm_dev *tdev)
> +{
> +	put_device(&tdev->dev);
> +}
> +EXPORT_SYMBOL_GPL(tsm_dev_put);
> +
> +struct tsm_tdi *tsm_tdi_get(struct device *parent)
> +{
> +	struct device *dev = device_find_child(parent, tdi_class,
> match_class); +
> +	if (!dev)
> +		return NULL;
> +
> +	/* device_find_child() does get_device() */
> +	return container_of(dev, struct tsm_tdi, dev);
> +}
> +EXPORT_SYMBOL_GPL(tsm_tdi_get);
> +
> +void tsm_tdi_put(struct tsm_tdi *tdi)
> +{
> +	put_device(&tdi->dev);
> +}
> +EXPORT_SYMBOL_GPL(tsm_tdi_put);
> +
> +static ssize_t blob_show(struct tsm_blob *blob, char *buf)
> +{
> +	unsigned int n, m;
> +	size_t sz = PAGE_SIZE - 1;
> +
> +	if (!blob)
> +		return sysfs_emit(buf, "none\n");
> +
> +	n = tsmprint(buf, sz, "%lu %u\n", blob->len);
> +	m = hex_dump_to_buffer(blob->data, blob->len, 32, 1,
> +			       buf + n, sz - n, false);
> +	n += min(sz - n, m);
> +	n += tsmprint(buf + n, sz - n, "...\n");
> +	return n;
> +}
> +
> +static ssize_t tsm_certs_gen(struct tsm_blob *certs, char *buf,
> size_t len) +{
> +	struct spdm_certchain_block_header *h;
> +	unsigned int n = 0, m, i, off, o2;
> +	u8 *p;
> +
> +	for (i = 0, off = 0; off < certs->len; ++i) {
> +		h = (struct spdm_certchain_block_header *) ((u8
> *)certs->data + off);
> +		if (WARN_ON_ONCE(h->length > certs->len - off))
> +			return 0;
> +
> +		n += tsmprint(buf + n, len - n, "[%d] len=%d:\n", i,
> h->length); +
> +		for (o2 = 0, p = (u8 *)&h[1]; o2 < h->length; o2 +=
> 32) {
> +			m = hex_dump_to_buffer(p + o2, h->length -
> o2, 32, 1,
> +					       buf + n, len - n,
> true);
> +			n += min(len - n, m);
> +			n += tsmprint(buf + n, len - n, "\n");
> +		}
> +
> +		off += h->length; /* Includes the header */
> +	}
> +
> +	return n;
> +}
> +

> +
> +void tsm_dev_free(struct tsm_dev *tdev)
> +{
> +	dev_notice(&tdev->dev, "Freeing tdevice\n");
> +	device_unregister(&tdev->dev);
> +}
> +EXPORT_SYMBOL_GPL(tsm_dev_free);
> +
> +int tsm_create_link(struct tsm_subsys *tsm, struct device *dev,
> const char *name) +{
> +	return sysfs_create_link(&tsm->dev.kobj, &dev->kobj, name);
> +}
> +EXPORT_SYMBOL_GPL(tsm_create_link);
> +
> +void tsm_remove_link(struct tsm_subsys *tsm, const char *name)
> +{
> +	sysfs_remove_link(&tsm->dev.kobj, name);
> +}
> +EXPORT_SYMBOL_GPL(tsm_remove_link);
> +
> +static struct tsm_subsys *alloc_tsm_subsys(struct device *parent,
> size_t size) +{
> +	struct tsm_subsys *subsys;
> +	struct device *dev;
> +
> +	if (WARN_ON_ONCE(size < sizeof(*subsys)))
> +		return ERR_PTR(-EINVAL);
> +
> +	subsys = kzalloc(size, GFP_KERNEL);
> +	if (!subsys)
> +		return ERR_PTR(-ENOMEM);
> +
> +	dev = &subsys->dev;
> +	dev->parent = parent;
> +	dev->class = tsm_class;
> +	device_initialize(dev);
> +	return subsys;
> +}
> +
> +struct tsm_subsys *tsm_register(struct device *parent, size_t size,
> +				const struct attribute_group
> *tdev_ag,
> +				const struct attribute_group *tdi_ag,
> +				int (*update_measurements)(struct
> tsm_dev *tdev)) +{
> +	struct tsm_subsys *subsys = alloc_tsm_subsys(parent, size);
> +	struct device *dev;
> +	int rc;
> +
> +	if (IS_ERR(subsys))
> +		return subsys;
> +
> +	dev = &subsys->dev;
> +	rc = dev_set_name(dev, "tsm0");
> +	if (rc)
> +		return ERR_PTR(rc);
> +
> +	rc = device_add(dev);
> +	if (rc)
> +		return ERR_PTR(rc);
> +
> +	subsys->tdev_groups[0] = &dev_group;
> +	subsys->tdev_groups[1] = tdev_ag;
> +	subsys->tdi_groups[0] = &tdi_group;
> +	subsys->tdi_groups[1] = tdi_ag;
> +	subsys->update_measurements = update_measurements;
> +
> +	return subsys;
> +}
> +EXPORT_SYMBOL_GPL(tsm_register);
> +
> +void tsm_unregister(struct tsm_subsys *subsys)
> +{
> +	device_unregister(&subsys->dev);
> +}
> +EXPORT_SYMBOL_GPL(tsm_unregister);
> +
> +static void tsm_release(struct device *dev)
> +{
> +	struct tsm_subsys *tsm = container_of(dev, typeof(*tsm),
> dev); +
> +	dev_info(&tsm->dev, "Releasing TSM\n");
> +	kfree(tsm);
> +}
> +
> +static void tdev_release(struct device *dev)
> +{
> +	struct tsm_dev *tdev = container_of(dev, typeof(*tdev), dev);
> +
> +	dev_info(&tdev->dev, "Releasing %s TDEV\n",
> +		 tdev->connected ? "connected":"disconnected");
> +	kfree(tdev);
> +}
> +
> +static void tdi_release(struct device *dev)
> +{
> +	struct tsm_tdi *tdi = container_of(dev, typeof(*tdi), dev);
> +
> +	dev_info(&tdi->dev, "Releasing %s TDI\n", tdi->kvm ? "bound"
> : "unbound");
> +	sysfs_remove_link(&tdi->dev.parent->kobj, "tsm_dev");
> +	kfree(tdi);
> +}
> +
> +static int __init tsm_init(void)
> +{
> +	int ret = 0;
> +
> +	pr_info(DRIVER_DESC " version: " DRIVER_VERSION "\n");
> +
> +	tsm_class = class_create("tsm");
> +	if (IS_ERR(tsm_class))
> +		return PTR_ERR(tsm_class);
> +	tsm_class->dev_release = tsm_release;
> +
> +	tdev_class = class_create("tsm-dev");
> +	if (IS_ERR(tdev_class))
> +		return PTR_ERR(tdev_class);
> +	tdev_class->dev_release = tdev_release;
> +
> +	tdi_class = class_create("tsm-tdi");
> +	if (IS_ERR(tdi_class))
> +		return PTR_ERR(tdi_class);
> +	tdi_class->dev_release = tdi_release;
> +
> +	return ret;
> +}
> +
> +static void __exit tsm_exit(void)
> +{
> +	pr_info(DRIVER_DESC " version: " DRIVER_VERSION "
> shutdown\n");
> +	class_destroy(tdi_class);
> +	class_destroy(tdev_class);
> +	class_destroy(tsm_class);
> +}
> +
> +module_init(tsm_init);
> +module_exit(tsm_exit);
> +
> +MODULE_VERSION(DRIVER_VERSION);
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR(DRIVER_AUTHOR);
> +MODULE_DESCRIPTION(DRIVER_DESC);
> diff --git a/Documentation/virt/coco/tsm.rst
> b/Documentation/virt/coco/tsm.rst new file mode 100644
> index 000000000000..7cb5f1862492
> --- /dev/null
> +++ b/Documentation/virt/coco/tsm.rst
> @@ -0,0 +1,99 @@
> +.. SPDX-License-Identifier: GPL-2.0
> +
> +What it is
> +==========
> +
> +This is for PCI passthrough in confidential computing (CoCo:
> SEV-SNP, TDX, CoVE). +Currently passing through PCI devices to a CoCo
> VM uses SWIOTLB to pre-shared +memory buffers.
> +
> +PCIe IDE (Integrity and Data Encryption) and TDISP (TEE Device
> Interface Security +Protocol) are protocols to enable encryption over
> PCIe link and DMA to encrypted +memory. This doc is focused to DMAing
> to encrypted VM, the encrypted host memory is +out of scope.
> +
> +
> +Protocols
> +=========
> +
> +PCIe r6 DOE is a mailbox protocol to read/write object from/to
> device. +Objects are of plain SPDM or secure SPDM type. SPDM is
> responsible for authenticating +devices, creating a secure link
> between a device and TSM. +IDE_KM manages PCIe link encryption keys,
> it works on top of secure SPDM. +TDISP manages a passed through PCI
> function state, also works on top on secure SPDM. +Additionally, PCIe
> defines IDE capability which provides the host OS a way +to enable
> streams on the PCIe link. +
> +
> +TSM modules
> +===========
> +
> +TSM is a library, shared among hosts and guests.
> +
> +TSM-HOST contains host-specific bits, controls IDE and TDISP
> bindings. +
> +TSM-GUEST contains guest-specific bits, controls enablement of
> encrypted DMA and +MMIO.
> +
> +TSM-PCI is PCI binding for TSM, calls the above libraries for
> setting up +sysfs nodes and corresponding data structures.
> +
> +
> +Flow
> +====
> +
> +At the boot time the tsm.ko scans the PCI bus to find and setup
> TDISP-cabable +devices; it also listens to hotplug events. If setup
> was successful, tsm-prefixed +nodes will appear in sysfs.
> +
> +Then, the user enables IDE by writing to
> /sys/bus/pci/devices/0000:e1:00.0/tsm_dev_connect +and this is how
> PCIe encryption is enabled. +
> +To pass the device through, a modifined VMM is required.
> +
> +In the VM, the same tsm.ko loads. In addition to the host's setup,
> the VM wants +to receive the report and enable secure DMA or/and
> secure MMIO, via some VM<->HV +protocol (such as AMD GHCB). Once this
> is done, a VM can access validated MMIO +with the Cbit set and the
> device can DMA to encrypted memory. +
> +The sysfs example from a host with a TDISP capable device:
> +
> +~> find /sys -iname "*tsm*"  
> +/sys/class/tsm-tdi
> +/sys/class/tsm
> +/sys/class/tsm/tsm0
> +/sys/class/tsm-dev
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.1/tsm_dev
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.1/tsm-tdi
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.1/tsm-tdi/tdi:0000:e1:00.1/tsm_tdi_bind
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.1/tsm-tdi/tdi:0000:e1:00.1/tsm_tdi_status
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.1/tsm-tdi/tdi:0000:e1:00.1/tsm_tdi_status_user
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.1/tsm-tdi/tdi:0000:e1:00.1/tsm_report_user
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.1/tsm-tdi/tdi:0000:e1:00.1/tsm_report
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm_dev
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-tdi
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-tdi/tdi:0000:e1:00.0/tsm_tdi_bind
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-tdi/tdi:0000:e1:00.0/tsm_tdi_status
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-tdi/tdi:0000:e1:00.0/tsm_tdi_status_user
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-tdi/tdi:0000:e1:00.0/tsm_report_user
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-tdi/tdi:0000:e1:00.0/tsm_report
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev/tdev:0000:e1:00.0/tsm_certs
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev/tdev:0000:e1:00.0/tsm_nonce
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev/tdev:0000:e1:00.0/tsm_meas_user
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev/tdev:0000:e1:00.0/tsm_certs_user
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev/tdev:0000:e1:00.0/tsm_dev_status
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev/tdev:0000:e1:00.0/tsm_cert_slot
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev/tdev:0000:e1:00.0/tsm_dev_connect
> +/sys/devices/pci0000:e0/0000:e0:01.1/0000:e1:00.0/tsm-dev/tdev:0000:e1:00.0/tsm_meas
> +/sys/devices/pci0000:a0/0000:a0:07.1/0000:a9:00.5/tsm
> +/sys/devices/pci0000:a0/0000:a0:07.1/0000:a9:00.5/tsm/tsm0
> +
> +
> +References
> +==========
> +
> +[1] TEE Device Interface Security Protocol - TDISP - v2022-07-27
> +https://members.pcisig.com/wg/PCI-SIG/document/18268?downloadRevision=21500
> +[2] Security Protocol and Data Model (SPDM)
> +https://www.dmtf.org/sites/default/files/standards/documents/DSP0274_1.2.1.pdf
> diff --git a/drivers/virt/coco/Kconfig b/drivers/virt/coco/Kconfig
> index 819a97e8ba99..e4385247440b 100644
> --- a/drivers/virt/coco/Kconfig
> +++ b/drivers/virt/coco/Kconfig
> @@ -3,6 +3,18 @@
>  # Confidential computing related collateral
>  #
>  
> +config TSM
> +	tristate "Platform support for TEE Device Interface Security
> Protocol (TDISP)"
> +	default m
> +	depends on AMD_MEM_ENCRYPT
> +	select PCI_DOE
> +	select PCI_IDE
> +	help
> +	  Add a common place for user visible platform support for
> PCIe TDISP.
> +	  TEE Device Interface Security Protocol (TDISP) from
> PCI-SIG,
> +
> https://pcisig.com/tee-device-interface-security-protocol-tdisp
> +	  This is prerequisite for host and guest support.
> +
>  source "drivers/virt/coco/efi_secret/Kconfig"
>  
>  source "drivers/virt/coco/pkvm-guest/Kconfig"
> @@ -14,3 +26,5 @@ source "drivers/virt/coco/tdx-guest/Kconfig"
>  source "drivers/virt/coco/arm-cca-guest/Kconfig"
>  
>  source "drivers/virt/coco/guest/Kconfig"
> +
> +source "drivers/virt/coco/host/Kconfig"
> diff --git a/drivers/virt/coco/host/Kconfig
> b/drivers/virt/coco/host/Kconfig new file mode 100644
> index 000000000000..3bde38b91fd4
> --- /dev/null
> +++ b/drivers/virt/coco/host/Kconfig
> @@ -0,0 +1,6 @@
> +# SPDX-License-Identifier: GPL-2.0-only
> +#
> +# TSM (TEE Security Manager) Common infrastructure and host drivers
> +#
> +config TSM_HOST
> +	tristate