[PATCH 1/2] iommu: Add iommu_is_available() API

["Mario Limonciello (AMD)" <superm1@kernel.org>]

Add a generic API to query whether IOMMU subsystem is available on the
platform. This returns true if at least one IOMMU driver has been
registered and successfully probed, meaning hardware IOMMU support is
available on the platform.

The iommu_set_available() function is called from iommu_device_register()
when an IOMMU driver successfully registers, marking IOMMU as available.

This will be used by security subsystems (e.g. lockdown) that require
IOMMU isolation to provide meaningful security guarantees. Without IOMMU,
PCI/PCIe devices can perform DMA to arbitrary physical memory, bypassing
all software-level security protections.

Signed-off-by: Mario Limonciello (AMD) <superm1@kernel.org>
---
 drivers/iommu/iommu.c | 48 ++++++++++++++++++++++++++++++++++++++++++++++++
 include/linux/iommu.h | 14 ++++++++++++++
 2 files changed, 62 insertions(+)

diff --git a/drivers/iommu/iommu.c b/drivers/iommu/iommu.c
index b486b8bbd1fcd..d042944713ab4 100644
--- a/drivers/iommu/iommu.c
+++ b/drivers/iommu/iommu.c
@@ -309,6 +309,13 @@ int iommu_device_register(struct iommu_device *iommu,
 		iommu_device_unregister(iommu);
 	else
 		WRITE_ONCE(iommu->ready, true);
+	/*
+	 * Mark IOMMU as available if registration succeeded and bus probing
+	 * succeeded. This enables security checks (e.g. lockdown IOMMU check)
+	 * that depend on knowing whether hardware IOMMU isolation is present.
+	 */
+	if (!err)
+		iommu_set_available();
 	return err;
 }
 EXPORT_SYMBOL_GPL(iommu_device_register);
@@ -2961,6 +2968,47 @@ static int __init iommu_init(void)
 }
 core_initcall(iommu_init);
 
+static bool iommu_available __read_mostly;
+
+/**
+ * iommu_is_available() - Check if IOMMU subsystem is available
+ *
+ * Returns true if at least one IOMMU driver has been registered and
+ * successfully probed, meaning hardware IOMMU support is available on
+ * the platform. Returns false if no IOMMU driver is available.
+ *
+ * This function is intended for use by security subsystems that require
+ * IOMMU isolation to provide meaningful security guarantees (e.g. lockdown).
+ *
+ * Note: This function only reports on whether IOMMU drivers are present,
+ * not whether specific devices are covered. Use device_iommu_capable() or
+ * iommu_group_get() to check per-device IOMMU coverage.
+ *
+ * Context: Can be called at any time after module initialization has begun.
+ * Returns a snapshot of the IOMMU availability state.
+ *
+ * Return: True if IOMMU is available, false otherwise.
+ */
+bool iommu_is_available(void)
+{
+	return iommu_available;
+}
+EXPORT_SYMBOL_GPL(iommu_is_available);
+
+/**
+ * iommu_set_available() - Mark IOMMU as available
+ *
+ * Called by IOMMU drivers during probe to indicate that hardware IOMMU
+ * support is functional on this platform.
+ *
+ * Context: Called from driver probe paths.
+ */
+void iommu_set_available(void)
+{
+	iommu_available = true;
+}
+EXPORT_SYMBOL_GPL(iommu_set_available);
+
 int iommu_set_pgtable_quirks(struct iommu_domain *domain,
 		unsigned long quirk)
 {
diff --git a/include/linux/iommu.h b/include/linux/iommu.h
index ef5043752a365..d77237fc880ae 100644
--- a/include/linux/iommu.h
+++ b/include/linux/iommu.h
@@ -1222,6 +1222,13 @@ void iommu_detach_device_pasid(struct iommu_domain *domain,
 ioasid_t iommu_alloc_global_pasid(struct device *dev);
 void iommu_free_global_pasid(ioasid_t pasid);
 
+/*
+ * IOMMU availability API - for use by subsystems that require IOMMU
+ * isolation to provide security guarantees.
+ */
+bool iommu_is_available(void);
+void iommu_set_available(void);
+
 /* PCI device reset functions */
 int pci_dev_reset_iommu_prepare(struct pci_dev *pdev);
 void pci_dev_reset_iommu_done(struct pci_dev *pdev);
@@ -1557,6 +1564,13 @@ static inline int pci_dev_reset_iommu_prepare(struct pci_dev *pdev)
 static inline void pci_dev_reset_iommu_done(struct pci_dev *pdev)
 {
 }
+
+static inline bool iommu_is_available(void)
+{
+	return false;
+}
+static inline void iommu_set_available(void) {}
+
 #endif /* CONFIG_IOMMU_API */
 
 #ifdef CONFIG_IRQ_MSI_IOMMU

-- 
2.53.0