[PATCH kernel 0/9] PCI/TSM: coco/sev-guest: Implement SEV-TIO PCIe TDISP (phase2)

Alexey Kardashevskiy
2026-02-25T05:38:46Z

Here are some patches to continue enabling SEV-TIO on AMD.

SEV-TIO allows guests to establish trust in a device that supports TEE
Device Interface Security Protocol (TDISP, defined in PCIe r6.0+) and
then interact with the device via private memory.

In order to streamline upstreaming process, a common TSM infrastructure
is being developed in collaboration with Intel+ARM+RiscV. There is
Documentation/driver-api/pci/tsm.rst with proposed phases:
1. IDE: encrypt PCI, host only
2. TDISP: lock + accept flow, host and guest, interface report
3. Enable secure MMIO + DMA: IOMMUFD, KVM changes
4. Device attestation: certificates, measurements

This is phase2 == basic guest support allowing TDISP CONFIG_LOCKED and RUN states, and unlocking as well.

Acronyms:
TEE - Trusted Execution Environments, a concept of managing trust between the host and devices
TSM - TEE Security Manager (TSM), an entity which ensures security on the host
PSP - AMD platform secure processor (also "ASP", "AMD-SP"), acts as TSM on AMD.
SEV TIO - the TIO protocol implemented by the PSP and used by the host, extension to SEV-SNP
GHCB - guest/host communication block - a protocol for guest-to-host communication via a shared page
TDISP - TEE Device Interface Security Protocol (PCIe).

Flow:
- Boot guest OS, load sev-guest.ko which registers itself as a TSM
- PCI TSM creates sysfs nodes under "tsm" subdirectory in for all
TDISP-capable devices
- lock the device via:
echo tsm0 > "/sys/bus/pci/devices/0000:01:00.0/tsm/lock"
- accept the device via:
echo 1 > "/sys/bus/pci/devices/0000:01:00.0/tsm/accept"
- load the device driver:
- DMA to encrypted memory should work right away
- MMIO regions reported in TDISP interface report will be mapped as encrypted

Since one of my test devices does not use private MMIO for the main function,
there is 9/9 which allows https://github.com/billfarrow/pcimem.git mapping MMIO as private.

The previous conversation is here:
https://lore.kernel.org/r/20250218111017.491719-1-aik@amd.com

This is based on sha1
4fe8662d1a9c Dan Williams PCI/TSM: Documentation: Add Maturity Map
from
https://git.kernel.org/pub/scm/linux/kernel/git/devsec/tsm.git/log/?h=staging
and 3 cherrypicks on top, please find the exact tree at:
https://github.com/AMDESE/linux-kvm/commits/tsm-staging

The host support is pushed here:
https://github.com/AMDESE/linux-kvm/commits/tsm

The SEV TIO spec:
https://www.amd.com/content/dam/amd/en/documents/epyc-technical-docs/specifications/58271.pdf

Individual patches have extra "---" comments (could have been "RFC"?)

Please comment. Thanks.

ps: quite a cc list from get_maintainers.pl.

Alexey Kardashevskiy (9):
pci/tsm: Add TDISP report blob and helpers to parse it
pci/tsm: Add tsm_tdi_status
coco/sev-guest: Allow multiple source files in the driver
dma/swiotlb: Stop forcing SWIOTLB for TDISP devices
x86/mm: Stop forcing decrypted page state for TDISP devices
x86/dma-direct: Stop changing encrypted page state for TDISP devices
coco/sev-guest: Implement the guest support for SEV TIO (phase2)
RFC: PCI: Avoid needless touching of Command register
pci: Allow encrypted MMIO mapping via sysfs

arch/x86/Kconfig | 1 +
drivers/virt/coco/sev-guest/Kconfig | 1 +
drivers/virt/coco/sev-guest/Makefile | 6 +-
arch/x86/include/asm/dma-direct.h | 39 ++
arch/x86/include/asm/sev-common.h | 1 +
arch/x86/include/asm/sev.h | 13 +
arch/x86/include/uapi/asm/svm.h | 13 +
drivers/virt/coco/sev-guest/sev-guest.h | 20 +
include/linux/pci-tsm.h | 110 +++
include/linux/pci.h | 2 +-
include/linux/psp-sev.h | 31 +
include/linux/swiotlb.h | 9 +
include/uapi/linux/sev-guest.h | 43 ++
arch/x86/coco/sev/core.c | 53 ++
arch/x86/mm/mem_encrypt.c | 5 +-
drivers/pci/mmap.c | 11 +-
drivers/pci/pci-sysfs.c | 27 +-
drivers/pci/probe.c | 5 +
drivers/pci/proc.c | 2 +-
drivers/pci/quirks.c | 9 +
drivers/virt/coco/sev-guest/sev-guest.c | 23 +-
drivers/virt/coco/sev-guest/tio.c | 707 ++++++++++++++++++++
drivers/virt/coco/tsm-core.c | 19 +
23 files changed, 1129 insertions(+), 21 deletions(-)
create mode 100644 arch/x86/include/asm/dma-direct.h
create mode 100644 drivers/virt/coco/sev-guest/sev-guest.h
create mode 100644 drivers/virt/coco/sev-guest/tio.c

--
2.52.0