[PATCH] x86/virt/tdx: Skip TDH.SYS.DISABLE if the TDX module is not initialized

[Challvy Tee <challvy.tee@gmail.com>]

Commit XXXXXXXXXXXX ("x86/tdx: Disable the TDX module during kexec and
kdump") made native_machine_crash_shutdown() call tdx_sys_disable(), but
tdx_sys_disable() has no runtime gate: its only guard is compile time
(CONFIG_INTEL_TDX_HOST), which distribution kernels enable.  On a system
where the TDX module was never initialized, kdump now issues a
TDH.SYS.DISABLE SEAMCALL that it did not issue before, and the crashing
CPU stops making forward progress before machine_kexec().  The capture
kernel is never entered, no vmcore is written and nothing reaches the
console, so kdump is completely non-functional.

Having the TDX module uninitialized is an ordinary state rather than an
error.  tdx_enable() returns -ENODEV early when
X86_FEATURE_TDX_HOST_PLATFORM is absent, and it also bails out if
init_tdx_module() fails.  Any guest whose host does not expose TDX is in
this state and logs:

  virt/tdx: TDX not supported by the host platform

The syscore path is implicitly protected: register_syscore() only runs
after init_tdx_module() succeeds, so tdx_shutdown() cannot be reached on
an uninitialized system.  That covers kexec, suspend and resume, which is
why only kdump regressed.

The crash path calls tdx_sys_disable() directly and bypasses that
protection.

Where the CPU has no SEAM support the SEAMCALL raises #UD, which the
exception table entry in tdxcall.S turns into TDX_SEAMCALL_UD, so
tdx_sys_disable() just returns and kdump still works.  On SEAM capable
platforms the observed behaviour is the hang described above.

Reproduced with 'echo c > /proc/sysrq-trigger' in VM guests running on
Intel Sapphire Rapids, Emerald Rapids and Granite Rapids platforms.
Before this change no vmcore is produced; after it, kdump completes
normally.  Guests without SEAM support, and plain kexec everywhere, were
unaffected both before and after, matching the asymmetry above.

Gate the SEAMCALL on tdx_module_state.initialized, the same predicate
tdx_get_sysinfo() already uses in this file.  Putting the check inside
tdx_sys_disable() rather than at the crash.c call site also covers the
syscore caller and any future caller.

Fixes: XXXXXXXXXXXX ("x86/tdx: Disable the TDX module during kexec and kdump")
Cc: stable@vger.kernel.org
Signed-off-by: Challvy Tee <challvy.tee@gmail.com>
---
 arch/x86/virt/vmx/tdx/tdx.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/arch/x86/virt/vmx/tdx/tdx.c b/arch/x86/virt/vmx/tdx/tdx.c
index 96ced0494b68..a7eae7492c1e 100644
--- a/arch/x86/virt/vmx/tdx/tdx.c
+++ b/arch/x86/virt/vmx/tdx/tdx.c
@@ -2321,6 +2321,9 @@ void tdx_sys_disable(void)
 	struct tdx_module_args args = {};
 	u64 ret;
 
+	if (!tdx_module_state.initialized)
+		return;
+
 	/*
 	 * Don't loop forever.
 	 *
-- 
2.52.0