[Part2,V1,06/14] iommu/vt-d: fix incorrect iommu_count for si_domain

diff --git a/drivers/iommu/intel-iommu.c b/drivers/iommu/intel-iommu.c
index d5ad21d..7038b38 100644
--- a/drivers/iommu/intel-iommu.c
+++ b/drivers/iommu/intel-iommu.c
@@ -425,7 +425,8 @@  static LIST_HEAD(unmaps_to_do);
 static int timer_on;
 static long list_size;
 
-static void domain_remove_dev_info(struct dmar_domain *domain);
+static void domain_remove_dev_info(struct dmar_domain *domain,
+				   struct intel_iommu *match);
 static void domain_remove_one_dev_info(struct dmar_domain *domain,
 				       struct pci_dev *pdev);
 
@@ -1300,15 +1301,22 @@  static void free_dmar_iommu(struct intel_iommu *iommu)
 		for_each_set_bit(i, iommu->domain_ids, cap_ndoms(iommu->cap)) {
 			domain = iommu->domains[i];
 			clear_bit(i, iommu->domain_ids);
+			domain_remove_dev_info(domain, iommu);
 
 			spin_lock_irqsave(&domain->iommu_lock, flags);
-			count = --domain->iommu_count;
+			if (test_and_clear_bit(iommu->seq_id,
+					       domain->iommu_bmp))
+				count = --domain->iommu_count;
+			else
+				count = 1;
 			spin_unlock_irqrestore(&domain->iommu_lock, flags);
-			if (count == 0) {
-				if (domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE)
-					vm_domain_exit(domain);
-				else
-					domain_exit(domain);
+
+			/* Keep VM domains, user still has reference to them */
+			if (count == 0 &&
+			    !(domain->flags & DOMAIN_FLAG_VIRTUAL_MACHINE)) {
+				domain_exit(domain);
+				if (domain == si_domain)
+					si_domain = NULL;
 			}
 		}
 	}
@@ -1336,8 +1344,11 @@  static struct dmar_domain *alloc_domain(void)
 		return NULL;
 
 	domain->nid = -1;
+	domain->iommu_count = 0;
 	memset(domain->iommu_bmp, 0, sizeof(domain->iommu_bmp));
 	domain->flags = 0;
+	spin_lock_init(&domain->iommu_lock);
+	INIT_LIST_HEAD(&domain->devices);
 
 	return domain;
 }
@@ -1361,6 +1372,7 @@  static int iommu_attach_domain(struct dmar_domain *domain,
 	}
 
 	domain->id = num;
+	domain->iommu_count++;
 	set_bit(num, iommu->domain_ids);
 	set_bit(iommu->seq_id, domain->iommu_bmp);
 	iommu->domains[num] = domain;
@@ -1461,8 +1473,6 @@  static int domain_init(struct dmar_domain *domain, int guest_width)
 	unsigned long sagaw;
 
 	init_iova_domain(&domain->iovad, DMA_32BIT_PFN);
-	spin_lock_init(&domain->iommu_lock);
-
 	domain_reserve_special_ranges(domain);
 
 	/* calculate AGAW */
@@ -1481,7 +1491,6 @@  static int domain_init(struct dmar_domain *domain, int guest_width)
 			return -ENODEV;
 	}
 	domain->agaw = agaw;
-	INIT_LIST_HEAD(&domain->devices);
 
 	if (ecap_coherent(iommu->ecap))
 		domain->iommu_coherency = 1;
@@ -1494,7 +1503,6 @@  static int domain_init(struct dmar_domain *domain, int guest_width)
 		domain->iommu_snooping = 0;
 
 	domain->iommu_superpage = fls(cap_super_page_val(iommu->cap));
-	domain->iommu_count = 1;
 	domain->nid = iommu->node;
 
 	/* always allocate the top pgd */
@@ -1518,7 +1526,7 @@  static void domain_exit(struct dmar_domain *domain)
 	if (!intel_iommu_strict)
 		flush_unmaps_timeout(0);
 
-	domain_remove_dev_info(domain);
+	domain_remove_dev_info(domain, NULL);
 	/* destroy iovas */
 	put_iova_domain(&domain->iovad);
 
@@ -1918,27 +1926,29 @@  static inline void unlink_domain_info(struct device_domain_info *info)
 		info->dev->dev.archdata.iommu = NULL;
 }
 
-static void domain_remove_dev_info(struct dmar_domain *domain)
+static void domain_remove_dev_info(struct dmar_domain *domain,
+				   struct intel_iommu *match)
 {
-	struct device_domain_info *info;
+	struct device_domain_info *info, *tmp;
 	unsigned long flags;
 	struct intel_iommu *iommu;
+	LIST_HEAD(list);
 
 	spin_lock_irqsave(&device_domain_lock, flags);
-	while (!list_empty(&domain->devices)) {
-		info = list_entry(domain->devices.next,
-			struct device_domain_info, link);
-		unlink_domain_info(info);
-		spin_unlock_irqrestore(&device_domain_lock, flags);
+	list_for_each_entry_safe(info, tmp, &domain->devices, link)
+		if (!match || match == device_to_iommu(info->segment,
+					info->bus, info->devfn)) {
+			unlink_domain_info(info);
+			list_add(&info->link, &list);
+		}
+	spin_unlock_irqrestore(&device_domain_lock, flags);
 
+	list_for_each_entry_safe(info, tmp, &list, link) {
 		iommu_disable_dev_iotlb(info);
 		iommu = device_to_iommu(info->segment, info->bus, info->devfn);
 		iommu_detach_dev(iommu, info->bus, info->devfn);
 		free_devinfo_mem(info);
-
-		spin_lock_irqsave(&device_domain_lock, flags);
 	}
-	spin_unlock_irqrestore(&device_domain_lock, flags);
 }
 
 /*
@@ -3862,8 +3872,11 @@  static struct dmar_domain *iommu_alloc_vm_domain(void)
 
 	domain->id = atomic_inc_return(&vm_domid);
 	domain->nid = -1;
+	domain->iommu_count = 0;
 	memset(domain->iommu_bmp, 0, sizeof(domain->iommu_bmp));
 	domain->flags = DOMAIN_FLAG_VIRTUAL_MACHINE;
+	spin_lock_init(&domain->iommu_lock);
+	INIT_LIST_HEAD(&domain->devices);
 
 	return domain;
 }
@@ -3873,8 +3886,6 @@  static int md_domain_init(struct dmar_domain *domain, int guest_width)
 	int adjust_width;
 
 	init_iova_domain(&domain->iovad, DMA_32BIT_PFN);
-	spin_lock_init(&domain->iommu_lock);
-
 	domain_reserve_special_ranges(domain);
 
 	/* calculate AGAW */
@@ -3882,9 +3893,6 @@  static int md_domain_init(struct dmar_domain *domain, int guest_width)
 	adjust_width = guestwidth_to_adjustwidth(guest_width);
 	domain->agaw = width_to_agaw(adjust_width);
 
-	INIT_LIST_HEAD(&domain->devices);
-
-	domain->iommu_count = 0;
 	domain->iommu_coherency = 0;
 	domain->iommu_snooping = 0;
 	domain->iommu_superpage = 0;
@@ -3993,7 +4001,7 @@  static int intel_iommu_attach_device(struct iommu_domain *domain,
 			    dmar_domain->flags & DOMAIN_FLAG_STATIC_IDENTITY)
 				domain_remove_one_dev_info(old_domain, pdev);
 			else
-				domain_remove_dev_info(old_domain);
+				domain_remove_dev_info(old_domain, NULL);
 		}
 	}