Secure Launch won't initiate DRTM on S3 resume (the code for starting
DRTM is not part of Xen), so abort a request to perform S3 suspend to
not lose the state of DRTM PCRs.

Signed-off-by: Sergii Dmytruk <sergii.dmytruk@3mdeb.com>
---
 xen/arch/x86/acpi/power.c | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/xen/arch/x86/acpi/power.c b/xen/arch/x86/acpi/power.c
index 448aa9f3a7..6a53c6718c 100644
--- a/xen/arch/x86/acpi/power.c
+++ b/xen/arch/x86/acpi/power.c
@@ -28,6 +28,7 @@
 #include <asm/irq.h>
 #include <asm/microcode.h>
 #include <asm/prot-key.h>
+#include <asm/slaunch.h>
 #include <asm/spec_ctrl.h>
 #include <asm/tboot.h>
 #include <asm/trampoline.h>
@@ -356,6 +357,13 @@ int acpi_enter_sleep(const struct xenpf_enter_acpi_sleep *sleep)
            PAGE_SIZE - acpi_sinfo.vector_width / 8)) )
         return -EOPNOTSUPP;
 
+    /* Secure Launch won't initiate DRTM on S3 resume, so abort S3 suspend. */
+    if ( sleep->sleep_state == ACPI_STATE_S3 && slaunch_active )
+    {
+        printk(XENLOG_INFO "SLAUNCH: refusing switching into ACPI S3 state.\n");
+        return -EPERM;
+    }
+
     if ( sleep->flags & XENPF_ACPI_SLEEP_EXTENDED )
     {
         if ( !acpi_sinfo.sleep_control.address ||
-- 
2.49.0

On 30.05.2025 15:17, Sergii Dmytruk wrote:
> @@ -356,6 +357,13 @@ int acpi_enter_sleep(const struct xenpf_enter_acpi_sleep *sleep)
>             PAGE_SIZE - acpi_sinfo.vector_width / 8)) )
>          return -EOPNOTSUPP;
>  
> +    /* Secure Launch won't initiate DRTM on S3 resume, so abort S3 suspend. */
> +    if ( sleep->sleep_state == ACPI_STATE_S3 && slaunch_active )
> +    {
> +        printk(XENLOG_INFO "SLAUNCH: refusing switching into ACPI S3 state.\n");
> +        return -EPERM;

Not sure about the error code here: Generally we prefer to limit EPERM to
what XSM has to say. Could I talk you into using e.g. EACCES instead?

Jan

On Wed, Jul 02, 2025 at 04:48:38PM +0200, Jan Beulich wrote:
> On 30.05.2025 15:17, Sergii Dmytruk wrote:
> > @@ -356,6 +357,13 @@ int acpi_enter_sleep(const struct xenpf_enter_acpi_sleep *sleep)
> >             PAGE_SIZE - acpi_sinfo.vector_width / 8)) )
> >          return -EOPNOTSUPP;
> >
> > +    /* Secure Launch won't initiate DRTM on S3 resume, so abort S3 suspend. */
> > +    if ( sleep->sleep_state == ACPI_STATE_S3 && slaunch_active )
> > +    {
> > +        printk(XENLOG_INFO "SLAUNCH: refusing switching into ACPI S3 state.\n");
> > +        return -EPERM;
>
> Not sure about the error code here: Generally we prefer to limit EPERM to
> what XSM has to say. Could I talk you into using e.g. EACCES instead?
>
> Jan

I have nothing against EACCES.  I went with EPERM because I saw it
being used twice in this function.

Regards