Re: [PATCH v4 1/7] iommu/arm-smmu-v3: Add release_domain to attach prior to release_dev()

[Jason Gunthorpe <jgg@nvidia.com>]

On Fri, Sep 19, 2025 at 03:47:49PM -0700, Nicolin Chen wrote:
> +/* Same as arm_smmu_blocked_ops but less set_dev_pasid */
> +static const struct iommu_domain_ops arm_smmu_release_ops = {
> +	.attach_dev = arm_smmu_attach_dev_blocked,
> +};

don't worry about set_dev_pasid for the release domain, it is never
called anyhow.

The intention is to just use identity or blocked domains as is.

Jason
> -----------------------------------------------------------------
> From: Jason Gunthorpe <jgg@nvidia.com>
> Date: Fri, 19 Sep 2025 22:26:45 +0000
> Subject: [PATCH] iommu: Use identity_domain as release_domain for
>  require_direct
> 
> If dev->iommu->require_direct is set, the core prevent attaching a BLOCKED
> domains entirely in __iommu_device_set_domain():
> 
> 	if (dev->iommu->require_direct &&
> 	    (new_domain->type == IOMMU_DOMAIN_BLOCKED ||
> 	     new_domain == group->blocking_domain)) {
> 		dev_warn(dev, "....");
> 		return -EINVAL;
> 	}
> 
> Thus, in most sane cases, the above will never convert BLOCKED to IDENTITY
> in order to preserve the RMRs (direct mappings).
> 
> A similar situation would happen to the release_domain: while driver might
> have set it to a BLOCKED domain, replace it with an IDENTITY for RMRs.


How about

[PATCH] iommu: Generic support for RMRs during device release

Generally an IOMMU driver should leave the translation as BLOCKED
until the translation entry is probed onto a struct device. When the
struct device is removed the translation should be put back to
BLOCKED.

Drivers that are able to work like this can set their release_domain
to their blocking domain and the core code handles this work.

The exception is if the device has a IOMMU_RESV_DIRECT region. In this
case the OS should continuously allow translation for the given
range. The core code generally prevents using a BLOCKED domain with
this device.

Continue this logic for the device release and hoist some open coding
from drivers. If the device has dev->iommu->require_direct and the
driver is using a BLOCKED release_domain override this to IDENTITY to
preserve the semantics.

The only remaining required driver code for IOMMU_RESV_DIRECT should
preset an IDENTITY translation during early IOMMU startup for those
devices.

Jason