[PATCH v3 6/9] iommu/vt-d: Refuse system suspend while acquired by the TDX module

[Lu Baolu <baolu.lu@linux.intel.com>]

While tdx-host has acquired an IOMMU, the VT-d driver blocks its GCMD
writes. TDX disables S3 by clearing acpi_suspend_lowlevel, but that is
only checked after the syscore suspend callbacks have run, so an S3
request, e.g. "echo mem > /sys/power/state", still runs iommu_suspend()
and then iommu_resume():

  suspend_enter()
    syscore_suspend()
      iommu_suspend()                  <- runs on the acquired IOMMU
    suspend_ops->enter() = acpi_suspend_enter()
      if (!acpi_suspend_lowlevel)      <- TDX's "S3 disabled" check
          return -ENOSYS
    syscore_resume()
      iommu_resume()                   <- runs on the acquired IOMMU

Register a PM notifier for each DMAR unit that supports trusted DMA and
refuse PM_SUSPEND_PREPARE with -EBUSY while the unit is acquired. The
suspend then fails before tasks are frozen and before syscore callbacks
run.

A check at PM_SUSPEND_PREPARE alone leaves a window: user space is only
frozen after the notifiers run, so a device connect may still acquire
the unit in between. Close it with a per-unit tdxc_suspending flag, set
when the notifier lets the suspend proceed and cleared at
PM_POST_SUSPEND. dmar_tdxc_acquire() fails with -EBUSY while it is set.
Both the notifier and dmar_tdxc_acquire() hold the unit's tdxc_lock, so
the check and the acquisition can't interleave.

The notifiers are registered at init only for units advertising
ECAP.TDXCS. Such units are never hot-added or hot-removed, so the set
doesn't change afterwards and the notifiers are never unregistered.

Signed-off-by: Lu Baolu <baolu.lu@linux.intel.com>
---
 drivers/iommu/intel/iommu.h |  1 +
 include/linux/dmar.h        |  4 ++-
 drivers/iommu/intel/dmar.c  | 53 +++++++++++++++++++++++++++++++++++++
 drivers/iommu/intel/iommu.c |  1 +
 4 files changed, 58 insertions(+), 1 deletion(-)

diff --git a/drivers/iommu/intel/iommu.h b/drivers/iommu/intel/iommu.h
index 26135248675d..f7554df8cd2d 100644
--- a/drivers/iommu/intel/iommu.h
+++ b/drivers/iommu/intel/iommu.h
@@ -1363,6 +1363,7 @@ extern int rwbf_quirk;
 int iommu_calculate_agaw(struct intel_iommu *iommu);
 int iommu_calculate_max_sagaw(struct intel_iommu *iommu);
 int ecmd_submit_sync(struct intel_iommu *iommu, u8 ecmd, u64 oa, u64 ob);
+void dmar_tdxc_pm_init(void);
 
 static inline bool ecmd_has_pmu_essential(struct intel_iommu *iommu)
 {
diff --git a/include/linux/dmar.h b/include/linux/dmar.h
index a39ca13f13dc..8b407bc6d179 100644
--- a/include/linux/dmar.h
+++ b/include/linux/dmar.h
@@ -47,7 +47,9 @@ struct dmar_drhd_unit {
 	u8	ignored:1; 		/* ignore drhd		*/
 	u8	include_all:1;
 	u8	gfx_dedicated:1;	/* graphic dedicated	*/
-	struct mutex tdxc_lock;		/* serializes acquire/release */
+	struct mutex tdxc_lock;		/* serializes acquire/release/suspend */
+	struct notifier_block tdxc_pm_nb;
+	bool	tdxc_suspending;	/* protected by tdxc_lock */
 	struct intel_iommu *iommu;
 };
 
diff --git a/drivers/iommu/intel/dmar.c b/drivers/iommu/intel/dmar.c
index 91826705a06b..ad6b22601446 100644
--- a/drivers/iommu/intel/dmar.c
+++ b/drivers/iommu/intel/dmar.c
@@ -28,6 +28,7 @@
 #include <linux/iommu.h>
 #include <linux/numa.h>
 #include <linux/limits.h>
+#include <linux/suspend.h>
 #include <asm/irq_remapping.h>
 
 #include "iommu.h"
@@ -2683,6 +2684,9 @@ int dmar_tdxc_acquire(struct pci_dev *pdev,
 		return -EINVAL;
 
 	guard(mutex)(&drhd->tdxc_lock);
+	if (drhd->tdxc_suspending)
+		return -EBUSY;
+
 	/* Still set if TDH.IOMMU.CLEAR failed and tdx-host was reloaded. */
 	if (iommu->tdxc_acquired)
 		return -EBUSY;
@@ -2737,3 +2741,52 @@ void dmar_tdxc_release(struct pci_dev *pdev,
 	dmar_tdxc_unreserve_did(drhd->iommu);
 }
 EXPORT_SYMBOL_FOR_MODULES(dmar_tdxc_release, "tdx-host");
+
+/*
+ * TDX only fails S3 after syscore suspend/resume have run, and those
+ * would hit the blocked GCMD paths. Refuse the suspend up front instead.
+ */
+static int dmar_tdxc_pm_notify(struct notifier_block *nb,
+			       unsigned long action, void *data)
+{
+	struct dmar_drhd_unit *drhd =
+		container_of(nb, struct dmar_drhd_unit, tdxc_pm_nb);
+
+	guard(mutex)(&drhd->tdxc_lock);
+
+	switch (action) {
+	case PM_SUSPEND_PREPARE:
+		if (drhd->iommu->tdxc_acquired)
+			return notifier_from_errno(-EBUSY);
+		drhd->tdxc_suspending = true;
+		break;
+	case PM_POST_SUSPEND:
+		drhd->tdxc_suspending = false;
+		break;
+	}
+
+	return NOTIFY_DONE;
+}
+
+void __init dmar_tdxc_pm_init(void)
+{
+	struct dmar_drhd_unit *drhd;
+	struct intel_iommu *iommu;
+
+	down_read(&dmar_global_lock);
+	for_each_active_iommu(iommu, drhd) {
+		if (!ecap_tdxcs(iommu->ecap))
+			continue;
+
+		drhd->tdxc_pm_nb.notifier_call = dmar_tdxc_pm_notify;
+		/*
+		 * CPU hotplug takes dmar_global_lock under the PM notifier chain
+		 * lock. Drop it to avoid a lock order splat; TDXCS units are never
+		 * hot-removed, so @drhd stays valid.
+		 */
+		up_read(&dmar_global_lock);
+		register_pm_notifier(&drhd->tdxc_pm_nb);
+		down_read(&dmar_global_lock);
+	}
+	up_read(&dmar_global_lock);
+}
diff --git a/drivers/iommu/intel/iommu.c b/drivers/iommu/intel/iommu.c
index 69e8c2c8680a..d8b9610ae791 100644
--- a/drivers/iommu/intel/iommu.c
+++ b/drivers/iommu/intel/iommu.c
@@ -2041,6 +2041,7 @@ static struct syscore iommu_syscore = {
 static void __init init_iommu_pm_ops(void)
 {
 	register_syscore(&iommu_syscore);
+	dmar_tdxc_pm_init();
 }
 
 #else
-- 
2.43.0