diff --git a/usr.sbin/bhyve/Makefile b/usr.sbin/bhyve/Makefile
index 65a32d2fb0b9..ae1e82e7b828 100644
--- a/usr.sbin/bhyve/Makefile
+++ b/usr.sbin/bhyve/Makefile
@@ -1,137 +1,138 @@
 #
 # $FreeBSD$
 #
 
 .include <src.opts.mk>
 CFLAGS+=-I${.CURDIR}/../../contrib/lib9p
 CFLAGS+=-I${SRCTOP}/sys
 .PATH:  ${SRCTOP}/sys/libkern ${SRCTOP}/sys/cam/ctl
 
 PROG=	bhyve
 PACKAGE=	bhyve
 
 MAN=	bhyve.8 bhyve_config.5
 
 BHYVE_SYSDIR?=${SRCTOP}
 
 SRCS=	\
 	acpi_device.c		\
 	atkbdc.c		\
 	acpi.c			\
 	audio.c			\
 	basl.c			\
 	bhyvegc.c		\
 	bhyverun.c		\
 	block_if.c		\
 	bootrom.c		\
 	config.c		\
 	console.c		\
 	crc16.c			\
 	ctl_util.c		\
 	ctl_scsi_all.c		\
 	e820.c			\
 	fwctl.c			\
 	gdb.c			\
 	hda_codec.c		\
 	inout.c			\
 	ioapic.c		\
 	kernemu_dev.c		\
 	mem.c			\
 	mevent.c		\
 	mptbl.c			\
 	net_backends.c		\
 	net_utils.c		\
 	pci_ahci.c		\
 	pci_e82545.c		\
 	pci_emul.c		\
 	pci_hda.c		\
 	pci_fbuf.c		\
 	pci_hostbridge.c	\
 	pci_irq.c		\
 	pci_lpc.c		\
 	pci_nvme.c		\
 	pci_passthru.c		\
 	pci_virtio_9p.c		\
 	pci_virtio_block.c	\
 	pci_virtio_console.c	\
 	pci_virtio_input.c	\
 	pci_virtio_net.c	\
 	pci_virtio_rnd.c	\
 	pci_virtio_scsi.c	\
 	pci_uart.c		\
 	pci_xhci.c		\
 	pctestdev.c		\
 	pm.c			\
 	post.c			\
 	ps2kbd.c		\
 	ps2mouse.c		\
 	qemu_fwcfg.c		\
 	qemu_loader.c		\
 	rfb.c			\
 	rtc.c			\
 	smbiostbl.c		\
 	sockstream.c		\
 	task_switch.c		\
+	tpm_device.c		\
 	uart_emul.c		\
 	usb_emul.c		\
 	usb_mouse.c		\
 	virtio.c		\
 	vga.c			\
 	vmgenc.c		\
 	xmsr.c			\
 	spinup_ap.c		\
 	iov.c
 
 .if ${MK_BHYVE_SNAPSHOT} != "no"
 SRCS+=	snapshot.c
 .endif
 
 CFLAGS.kernemu_dev.c+=	-I${SRCTOP}/sys/amd64
 
 .PATH:  ${BHYVE_SYSDIR}/sys/amd64/vmm
 SRCS+=	vmm_instruction_emul.c
 
 LIBADD=	vmmapi md nv pthread z util sbuf cam 9p
 
 .if ${MK_BHYVE_SNAPSHOT} != "no"
 LIBADD+= ucl xo
 .endif
 
 .if ${MK_INET_SUPPORT} != "no"
 CFLAGS+=-DINET
 .endif
 .if ${MK_INET6_SUPPORT} != "no"
 CFLAGS+=-DINET6
 .endif
 .if ${MK_NETGRAPH_SUPPORT} != "no"
 CFLAGS+=-DNETGRAPH
 LIBADD+=    netgraph
 .endif
 .if ${MK_OPENSSL} == "no"
 CFLAGS+=-DNO_OPENSSL
 .else
 LIBADD+=	crypto
 CFLAGS+=-DOPENSSL_API_COMPAT=0x10100000L
 .endif
 
 CFLAGS+= -I${BHYVE_SYSDIR}/sys/dev/e1000
 CFLAGS+= -I${BHYVE_SYSDIR}/sys/dev/mii
 CFLAGS+= -I${BHYVE_SYSDIR}/sys/dev/usb/controller
 .if ${MK_BHYVE_SNAPSHOT} != "no"
 CFLAGS+= -I${SRCTOP}/contrib/libucl/include
 CFLAGS+= -DBHYVE_SNAPSHOT
 .endif
 
 .ifdef GDB_LOG
 CFLAGS+=-DGDB_LOG
 .endif
 
 # Disable thread safety analysis since it only finds very simple bugs and
 # yields many false positives.
 NO_WTHREAD_SAFETY=
 
 NO_WCAST_ALIGN=
 
 SUBDIR=	kbdlayout
 
 .include <bsd.prog.mk>
diff --git a/usr.sbin/bhyve/tpm_device.c b/usr.sbin/bhyve/tpm_device.c
new file mode 100644
index 000000000000..77fd1ccf6a52
--- /dev/null
+++ b/usr.sbin/bhyve/tpm_device.c
@@ -0,0 +1,68 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2023 Beckhoff Automation GmbH & Co. KG
+ * Author: Corvin Köhne <corvink@FreeBSD.org>
+ */
+
+#include <sys/types.h>
+
+#include <err.h>
+#include <errno.h>
+#include <stdlib.h>
+#include <string.h>
+#include <vmmapi.h>
+
+#include "config.h"
+#include "tpm_device.h"
+
+struct tpm_device {
+	struct vmctx *vm_ctx;
+};
+
+void
+tpm_device_destroy(struct tpm_device *const dev)
+{
+	if (dev == NULL)
+		return;
+
+	free(dev);
+}
+
+int
+tpm_device_create(struct tpm_device **const new_dev, struct vmctx *const vm_ctx,
+    nvlist_t *const nvl)
+{
+	struct tpm_device *dev = NULL;
+	const char *value;
+	int error;
+
+	if (new_dev == NULL || vm_ctx == NULL) {
+		error = EINVAL;
+		goto err_out;
+	}
+
+	value = get_config_value_node(nvl, "version");
+	if (value == NULL || strcmp(value, "2.0")) {
+		warnx("%s: unsupported tpm version %s", __func__, value);
+		error = EINVAL;
+		goto err_out;
+	}
+
+	dev = calloc(1, sizeof(*dev));
+	if (dev == NULL) {
+		error = ENOMEM;
+		goto err_out;
+	}
+
+	dev->vm_ctx = vm_ctx;
+
+	*new_dev = dev;
+
+	return (0);
+
+err_out:
+	tpm_device_destroy(dev);
+
+	return (error);
+}
diff --git a/usr.sbin/bhyve/tpm_device.h b/usr.sbin/bhyve/tpm_device.h
new file mode 100644
index 000000000000..a17c85c2ed47
--- /dev/null
+++ b/usr.sbin/bhyve/tpm_device.h
@@ -0,0 +1,18 @@
+/*-
+ * SPDX-License-Identifier: BSD-2-Clause
+ *
+ * Copyright (c) 2023 Beckhoff Automation GmbH & Co. KG
+ * Author: Corvin Köhne <corvink@FreeBSD.org>
+ */
+
+#pragma once
+
+#include <vmmapi.h>
+
+#include "config.h"
+
+struct tpm_device;
+
+int tpm_device_create(struct tpm_device **new_dev, struct vmctx *vm_ctx,
+    nvlist_t *nvl);
+void tpm_device_destroy(struct tpm_device *dev);