Re: [PATCH v4 4/5] iommu: Add Broadcom BCM2712 IOMMU driver

[Daniel Drake <dan@reactivated.net>]

On 02/09/2026 18:57, Daniel Drake wrote:
> +static int bcm2712_iommu_blocking_attach(struct iommu_domain *blocking_domain,
> +					 struct device *dev,
> +					 struct iommu_domain *old)
> +{
> +	struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> +	int ret = 0;
> +
> +	scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
> +		/*
> +		 * Completely block DMA by disabling both the bypass window
> +		 * and the translation aperture.
> +		 */
> +		bcm2712_iommu_writel(mmu, MMMU_BYPASS_START_OFFSET, 0);
> +		bcm2712_iommu_writel(mmu, MMMU_BYPASS_END_OFFSET, 0);
> +		bcm2712_iommu_writel(mmu, MMMU_ADDR_CAP_OFFSET,
> +				     MMMU_ADDR_CAP_ENABLE);
> +		bcm2712_iommu_writel(mmu, MMMU_ILLEGAL_ADR_OFFSET, 0);
> +		ret = bcm2712_iommu_clear_and_enable(mmu);
> +		mmu->domain = NULL;
> +	}

My understanding is that when the IOMMU is enabled, the address cap 
represents the highest permittable memory address; requests for anything 
higher would abort. So I had hoped to achieve blocking mode by setting 
ENABLE | 0 in ADDR_CAP, thinking that would set a cap of 0, and hence 
memory accesses would fail.

But a Sashiko review pointed out that actually this value would produce 
a translation aperture of 256MB, because of the way the register works. 
And I confirmed this experimentally, Sashiko is right.

I also confirmed experimentally that setting value 0 to ADDR_CAP (i.e. 
dropping the enable bit too), with the IOMMU enabled, results in a full 
unrestricted bypass/identity mode.

So unless someone from RPi/Broadcom can inform otherwise, I'm going to 
conclude that the hardware doesn't support blocking mode and remove the 
blocking domain implementation.

This will cause the iommu layer to fall back to creating an empty paging 
domain when blocking mode is requested, which seems appropriate if the 
hardware doesn't offer a more direct way of blocking all memory access.

Daniel