[RFC PATCH v2 3/8] security/vbs: add platform probe and backend registration

Add a single rootfs_initcall that walks a probe table and registers the
first backend whose detect() succeeds.  The table currently holds only the
KVM software-planes entry; when that backend is not configured a local stub
keeps the probe self-contained and buildable.

Registration only records the backend at this stage.
---
 security/vbs/Makefile   |  4 ++-
 security/vbs/internal.h | 20 ++++++++++++++
 security/vbs/probe.c    | 61 +++++++++++++++++++++++++++++++++++++++++
 3 files changed, 84 insertions(+), 1 deletion(-)
 create mode 100644 security/vbs/internal.h
 create mode 100644 security/vbs/probe.c

diff --git a/security/vbs/Makefile b/security/vbs/Makefile
index 952c2b855465..0fcbb6640ec1 100644
--- a/security/vbs/Makefile
+++ b/security/vbs/Makefile
@@ -1,3 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0-only
 obj-$(CONFIG_VBS) += vbs.o
-vbs-y := core.o
+# probe.o links before core.o so the backend is registered (vbs_probe_init)
+# early in the rootfs_initcall level.
+vbs-y := probe.o core.o
diff --git a/security/vbs/internal.h b/security/vbs/internal.h
new file mode 100644
index 000000000000..2f444781b390
--- /dev/null
+++ b/security/vbs/internal.h
@@ -0,0 +1,20 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * VBS internal header — shared between probe.c and backend implementations.
+ */
+#ifndef _SECURITY_VBS_INTERNAL_H
+#define _SECURITY_VBS_INTERNAL_H
+
+#include <linux/init.h>
+#include <linux/kernel.h>
+#include <linux/printk.h>
+#include <linux/vbs.h>
+
+/* Each backend exports a detect + get_ops pair for the centralized probe. */
+
+#ifdef CONFIG_VBS_KVM_PLANES
+bool __init vbs_kvm_planes_detect(void);
+const struct vbs_ops *vbs_kvm_planes_get_ops(void);
+#endif
+
+#endif /* _SECURITY_VBS_INTERNAL_H */
diff --git a/security/vbs/probe.c b/security/vbs/probe.c
new file mode 100644
index 000000000000..ccaaba93b18b
--- /dev/null
+++ b/security/vbs/probe.c
@@ -0,0 +1,61 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * VBS platform detection and backend selection
+ *
+ * A single boot-time initcall probes the platform and registers the
+ * appropriate VBS backend.  Only one backend can be active; the first
+ * successful probe wins.  VBS is software-only: the only backend today is
+ * KVM software planes; other software backends (e.g. Hyper-V VSM) may be
+ * added later.
+ */
+
+#include "internal.h"
+
+/* Stub for the backend when it is not configured in. */
+#ifndef CONFIG_VBS_KVM_PLANES
+static inline bool vbs_kvm_planes_detect(void) { return false; }
+static inline const struct vbs_ops *vbs_kvm_planes_get_ops(void) { return NULL; }
+#endif
+
+struct vbs_probe_entry {
+	const char *name;
+	bool (*detect)(void);
+	const struct vbs_ops *(*get_ops)(void);
+};
+
+static const struct vbs_probe_entry vbs_probe_table[] __initconst = {
+	{ "KVM planes", vbs_kvm_planes_detect, vbs_kvm_planes_get_ops },
+};
+
+static int __init vbs_probe_init(void)
+{
+	int i, ret;
+
+	for (i = 0; i < ARRAY_SIZE(vbs_probe_table); i++) {
+		const struct vbs_probe_entry *e = &vbs_probe_table[i];
+
+		if (!e->detect())
+			continue;
+
+		pr_info("vbs: detected %s platform\n", e->name);
+
+		ret = vbs_register_backend(e->get_ops());
+		if (ret) {
+			pr_err("vbs: failed to register %s backend (%d)\n",
+			       e->name, ret);
+			return ret;
+		}
+		return 0;
+	}
+
+	pr_debug("vbs: no supported platform detected\n");
+	return 0;
+}
+
+/*
+ * Run at rootfs_initcall level: platform detection is complete and the VM
+ * planes have been set up (init/ links before security/), but subsystems
+ * that consume VBS have not yet started.  Registration only records the
+ * backend; the plane is loaded later, after device drivers initialise.
+ */
+rootfs_initcall(vbs_probe_init);
-- 
2.55.0