Re: [PATCH v7 1/9] coco/tsm: Introduce a core device for TEE Security Managers

Carlos López
2025-10-30T09:05:05Z

Hi,

On 10/24/25 4:04 AM, Dan Williams wrote:
> A "TSM" is a platform component that provides an API for securely
> provisioning resources for a confidential guest (TVM) to consume. The
> name originates from the PCI specification for platform agent that
> carries out operations for PCIe TDISP (TEE Device Interface Security
> Protocol).
>
> Instances of this core device are parented by a device representing the
> platform security function like CONFIG_CRYPTO_DEV_CCP or
> CONFIG_INTEL_TDX_HOST.
>
> This device interface is a frontend to the aspects of a TSM and TEE I/O
> that are cross-architecture common. This includes mechanisms like
> enumerating available platform TEE I/O capabilities and provisioning
> connections between the platform TSM and device DSMs (Device Security
> Manager (TDISP)).
>
> For now this is just the scaffolding for registering a TSM device sysfs
> interface.
>
> Cc: Alexey Kardashevskiy <aik@amd.com>
> Cc: Xu Yilun <yilun.xu@linux.intel.com>
> Reviewed-by: Jonathan Cameron <jonathan.cameron@huawei.com>
> Co-developed-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
> Signed-off-by: Aneesh Kumar K.V (Arm) <aneesh.kumar@kernel.org>
> Acked-by: Bjorn Helgaas <bhelgaas@google.com>
> Signed-off-by: Dan Williams <dan.j.williams@intel.com>
> ---
> drivers/virt/coco/Kconfig | 3 +
> drivers/virt/coco/Makefile | 1 +
> Documentation/ABI/testing/sysfs-class-tsm | 9 ++
> include/linux/tsm.h | 4 +
> drivers/virt/coco/tsm-core.c | 109 ++++++++++++++++++++++
> MAINTAINERS | 2 +-
> 6 files changed, 127 insertions(+), 1 deletion(-)
> create mode 100644 Documentation/ABI/testing/sysfs-class-tsm
> create mode 100644 drivers/virt/coco/tsm-core.c
>
> diff --git a/drivers/virt/coco/Kconfig b/drivers/virt/coco/Kconfig
> index 819a97e8ba99..bb0c6d6ddcc8 100644
> --- a/drivers/virt/coco/Kconfig
> +++ b/drivers/virt/coco/Kconfig
> @@ -14,3 +14,6 @@ source "drivers/virt/coco/tdx-guest/Kconfig"
> source "drivers/virt/coco/arm-cca-guest/Kconfig"
>
> source "drivers/virt/coco/guest/Kconfig"
> +
> +config TSM
> + bool
> diff --git a/drivers/virt/coco/Makefile b/drivers/virt/coco/Makefile
> index f918bbb61737..cb52021912b3 100644
> --- a/drivers/virt/coco/Makefile
> +++ b/drivers/virt/coco/Makefile
> @@ -7,4 +7,5 @@ obj-$(CONFIG_ARM_PKVM_GUEST) += pkvm-guest/
> obj-$(CONFIG_SEV_GUEST) += sev-guest/
> obj-$(CONFIG_INTEL_TDX_GUEST) += tdx-guest/
> obj-$(CONFIG_ARM_CCA_GUEST) += arm-cca-guest/
> +obj-$(CONFIG_TSM) += tsm-core.o
> obj-$(CONFIG_TSM_GUEST) += guest/
> diff --git a/Documentation/ABI/testing/sysfs-class-tsm b/Documentation/ABI/testing/sysfs-class-tsm
> new file mode 100644
> index 000000000000..2949468deaf7
> --- /dev/null
> +++ b/Documentation/ABI/testing/sysfs-class-tsm
> @@ -0,0 +1,9 @@
> +What: /sys/class/tsm/tsmN
> +Contact: linux-coco@lists.linux.dev
> +Description:
> + "tsmN" is a device that represents the generic attributes of a
> + platform TEE Security Manager. It is typically a child of a
> + platform enumerated TSM device. /sys/class/tsm/tsmN/uevent
> + signals when the PCI layer is able to support establishment of
> + link encryption and other device-security features coordinated
> + through a platform tsm.
> diff --git a/include/linux/tsm.h b/include/linux/tsm.h
> index 431054810dca..aa906eb67360 100644
> --- a/include/linux/tsm.h
> +++ b/include/linux/tsm.h
> @@ -5,6 +5,7 @@
> #include <linux/sizes.h>
> #include <linux/types.h>
> #include <linux/uuid.h>
> +#include <linux/device.h>
>
> #define TSM_REPORT_INBLOB_MAX 64
> #define TSM_REPORT_OUTBLOB_MAX SZ_32K
> @@ -109,4 +110,7 @@ struct tsm_report_ops {
>
> int tsm_report_register(const struct tsm_report_ops *ops, void *priv);
> int tsm_report_unregister(const struct tsm_report_ops *ops);
> +struct tsm_dev;
> +struct tsm_dev *tsm_register(struct device *parent);
> +void tsm_unregister(struct tsm_dev *tsm_dev);
> #endif /* __TSM_H */
> diff --git a/drivers/virt/coco/tsm-core.c b/drivers/virt/coco/tsm-core.c
> new file mode 100644
> index 000000000000..a64b776642cf
> --- /dev/null
> +++ b/drivers/virt/coco/tsm-core.c
> @@ -0,0 +1,109 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/* Copyright(c) 2024 Intel Corporation. All rights reserved. */
> +
> +#define pr_fmt(fmt) KBUILD_MODNAME ": " fmt
> +
> +#include <linux/tsm.h>
> +#include <linux/idr.h>
> +#include <linux/rwsem.h>
> +#include <linux/device.h>
> +#include <linux/module.h>
> +#include <linux/cleanup.h>
> +
> +static struct class *tsm_class;
> +static DECLARE_RWSEM(tsm_rwsem);
> +static DEFINE_IDR(tsm_idr);

The IDR documentation states it is deprecated and one should use XArray
in its place. Is there any particular reason to use IDR instead in this
patch series?

Best,
Carlos