iommu/amd: Add ops->release_domain

In release path, remove device from existing domain and attach it to
blocked domain. So that all DMAs from device is blocked.

Note that soon blocked_domain will support other ops like
set_dev_pasid() but release_domain supports only attach_dev ops.
Hence added separate 'release_domain' variable.

Signed-off-by: Vasant Hegde <vasant.hegde@amd.com>
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Link: https://lore.kernel.org/r/20241030063556.6104-12-vasant.hegde@amd.com
Signed-off-by: Joerg Roedel <jroedel@suse.de>

diff --git a/drivers/iommu/amd/iommu.c b/drivers/iommu/amd/iommu.c
index a481c45..fd39b54 100644 (file)
--- a/drivers/iommu/amd/iommu.c
+++ b/drivers/iommu/amd/iommu.c
@@ -2515,6 +2515,14 @@ void amd_iommu_init_identity_domain(void)
        protection_domain_init(&identity_domain, NUMA_NO_NODE);
 }
 
+/* Same as blocked domain except it supports only ops->attach_dev() */
+static struct iommu_domain release_domain = {
+       .type = IOMMU_DOMAIN_BLOCKED,
+       .ops = &(const struct iommu_domain_ops) {
+               .attach_dev     = blocked_domain_attach_device,
+       }
+};
+
 static int amd_iommu_attach_device(struct iommu_domain *dom,
                                   struct device *dev)
 {
@@ -2894,6 +2902,7 @@ static int amd_iommu_dev_disable_feature(struct device *dev,
 const struct iommu_ops amd_iommu_ops = {
        .capable = amd_iommu_capable,
        .blocked_domain = &blocked_domain,
+       .release_domain = &release_domain,
        .identity_domain = &identity_domain.domain,
        .domain_alloc = amd_iommu_domain_alloc,
        .domain_alloc_user = amd_iommu_domain_alloc_user,