* [PATCH v4 1/5] iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats
2026-09-02 17:57 [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
@ 2026-09-02 17:57 ` Daniel Drake
2026-09-02 17:57 ` [PATCH v4 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU Daniel Drake
` (4 subsequent siblings)
5 siblings, 0 replies; 10+ messages in thread
From: Daniel Drake @ 2026-09-02 17:57 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
test_pgsize_boundary() tests boundary mapping with a hardcoded physical
address that requires 38 bits of physical address space. However, the
upcoming page table format for the Broadcom BCM2712 IOMMU only supports
37 bits of output address space.
This causes a test failure as iommu_map() rejects the large address
with -ERANGE.
Drop the high bits of the address (they are not relevant to the
boundary calculations being tested) so that it fits into 32 bits.
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/generic_pt/kunit_iommu_pt.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/generic_pt/kunit_iommu_pt.h b/drivers/iommu/generic_pt/kunit_iommu_pt.h
index ece1c9b8c55d..9fc71db74234 100644
--- a/drivers/iommu/generic_pt/kunit_iommu_pt.h
+++ b/drivers/iommu/generic_pt/kunit_iommu_pt.h
@@ -403,7 +403,7 @@ static void test_pgsize_boundary(struct kunit *test)
priv->smallest_pgsz != SZ_4K)
kunit_skip(test, "Format does not have the required range");
- do_map(test, 0xfef80000, 0x208b95d000, 0xfef9ffff - 0xfef80000 + 1);
+ do_map(test, 0xfef80000, 0x8b95d000, 0xfef9ffff - 0xfef80000 + 1);
}
/* See https://lore.kernel.org/r/20250826143816.38686-1-eugkoira@amazon.com */
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH v4 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU
2026-09-02 17:57 [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
2026-09-02 17:57 ` [PATCH v4 1/5] iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats Daniel Drake
@ 2026-09-02 17:57 ` Daniel Drake
2026-09-03 17:36 ` Jim Quinlan
2026-09-02 17:57 ` [PATCH v4 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format Daniel Drake
` (3 subsequent siblings)
5 siblings, 1 reply; 10+ messages in thread
From: Daniel Drake @ 2026-09-02 17:57 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe, Krzysztof Kozlowski
Add bindings for the Broadcom BCM2712 IOMMUs and their shared TLB cache.
Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
.../bindings/iommu/brcm,bcm2712-iommu.yaml | 54 ++++++++++++++++++++++
.../bindings/iommu/brcm,bcm2712-iommuc.yaml | 40 ++++++++++++++++
2 files changed, 94 insertions(+)
diff --git a/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml
new file mode 100644
index 000000000000..5ca8ce469ec3
--- /dev/null
+++ b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml
@@ -0,0 +1,54 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iommu/brcm,bcm2712-iommu.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Broadcom BCM2712 IOMMU
+
+maintainers:
+ - Daniel Drake <dan@reactivated.net>
+ - Florian Fainelli <florian.fainelli@broadcom.com>
+ - Jim Quinlan <james.quinlan@broadcom.com>
+
+description:
+ The BCM2712 SoC features multiple independent IOMMU instances providing
+ address translation for multimedia hardware blocks, such as the VC6 display
+ pipeline, camera receivers, and ISP. Each IOMMU has its own page tables,
+ control registers, and local TLB, and is additionally linked to a centralized
+ L2 TLB (IOMMUC).
+
+properties:
+ compatible:
+ const: brcm,bcm2712-iommu
+
+ reg:
+ maxItems: 1
+
+ '#iommu-cells':
+ const: 0
+
+ brcm,iommu-cache:
+ $ref: /schemas/types.yaml#/definitions/phandle
+ description:
+ Phandle to the shared IOMMU cache (IOMMUC). Each IOMMU instance caches
+ translated descriptors in this centralized L2 TLB cache block and must
+ trigger cache invalidation commands on it when updating or unmapping page
+ table entries.
+
+required:
+ - compatible
+ - reg
+ - '#iommu-cells'
+ - brcm,iommu-cache
+
+additionalProperties: false
+
+examples:
+ - |
+ iommu@5200 {
+ compatible = "brcm,bcm2712-iommu";
+ reg = <0x5200 0x80>;
+ brcm,iommu-cache = <&iommuc>;
+ #iommu-cells = <0>;
+ };
diff --git a/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml
new file mode 100644
index 000000000000..47c584ad667a
--- /dev/null
+++ b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml
@@ -0,0 +1,40 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iommu/brcm,bcm2712-iommuc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Broadcom BCM2712 Shared IOMMU Cache (IOMMUC)
+
+maintainers:
+ - Daniel Drake <dan@reactivated.net>
+ - Florian Fainelli <florian.fainelli@broadcom.com>
+ - Jim Quinlan <james.quinlan@broadcom.com>
+
+description:
+ The BCM2712 IOMMUC is a centralized Translation Lookaside Buffer (TLB) cache
+ which accelerates address translation across the SoC's IOMMU devices. If an
+ address mapping is not found in the IOMMU's local TLB cache, then this
+ IOMMUC is consulted as a L2 TLB. The SoC includes a single IOMMUC which is
+ shared between all IOMMUs, and it must be explicitly invalidated when
+ modifying or unmapping IOMMU page tables.
+
+properties:
+ compatible:
+ const: brcm,bcm2712-iommuc
+
+ reg:
+ maxItems: 1
+
+required:
+ - compatible
+ - reg
+
+additionalProperties: false
+
+examples:
+ - |
+ iommuc@5b00 {
+ compatible = "brcm,bcm2712-iommuc";
+ reg = <0x5b00 0x80>;
+ };
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v4 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU
2026-09-02 17:57 ` [PATCH v4 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU Daniel Drake
@ 2026-09-03 17:36 ` Jim Quinlan
0 siblings, 0 replies; 10+ messages in thread
From: Jim Quinlan @ 2026-09-03 17:36 UTC (permalink / raw)
To: Daniel Drake
Cc: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, iommu, linux-kernel,
devicetree, linux-rpi-kernel, linux-arm-kernel, nick.hollinghurst,
Jason Gunthorpe, Krzysztof Kozlowski
[-- Attachment #1: Type: text/plain, Size: 4567 bytes --]
On Wed, Sep 2, 2026 at 1:58 PM Daniel Drake <dan@reactivated.net> wrote:
>
> Add bindings for the Broadcom BCM2712 IOMMUs and their shared TLB cache.
>
> Reviewed-by: Krzysztof Kozlowski <krzysztof.kozlowski@oss.qualcomm.com>
> Signed-off-by: Daniel Drake <dan@reactivated.net>
> ---
> .../bindings/iommu/brcm,bcm2712-iommu.yaml | 54 ++++++++++++++++++++++
> .../bindings/iommu/brcm,bcm2712-iommuc.yaml | 40 ++++++++++++++++
> 2 files changed, 94 insertions(+)
>
> diff --git a/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml
> new file mode 100644
> index 000000000000..5ca8ce469ec3
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml
> @@ -0,0 +1,54 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/iommu/brcm,bcm2712-iommu.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: Broadcom BCM2712 IOMMU
> +
> +maintainers:
> + - Daniel Drake <dan@reactivated.net>
> + - Florian Fainelli <florian.fainelli@broadcom.com>
> + - Jim Quinlan <james.quinlan@broadcom.com>
> +
> +description:
> + The BCM2712 SoC features multiple independent IOMMU instances providing
> + address translation for multimedia hardware blocks, such as the VC6 display
> + pipeline, camera receivers, and ISP. Each IOMMU has its own page tables,
> + control registers, and local TLB, and is additionally linked to a centralized
> + L2 TLB (IOMMUC).
> +
> +properties:
> + compatible:
> + const: brcm,bcm2712-iommu
> +
> + reg:
> + maxItems: 1
> +
> + '#iommu-cells':
> + const: 0
> +
> + brcm,iommu-cache:
> + $ref: /schemas/types.yaml#/definitions/phandle
> + description:
> + Phandle to the shared IOMMU cache (IOMMUC). Each IOMMU instance caches
> + translated descriptors in this centralized L2 TLB cache block and must
> + trigger cache invalidation commands on it when updating or unmapping page
> + table entries.
> +
> +required:
> + - compatible
> + - reg
> + - '#iommu-cells'
> + - brcm,iommu-cache
Hello Daniel,
What are your thoughts on allowing the iommu work without the cache
property, ie having its presence be optional? I work on the Broadcom
version of the Rpi4/5 SoCs, and (a) on certain workloads the cache
slightly degrades performance or (b) on some chips there is no cache
associated with a specific iommu. This is probably on me to implement
these possibilities, but I just wanted to give you a heads-up.
LGTM
Regards,
Jim Quinlan
Broadcom WCC/CM/STB
> +
> +additionalProperties: false
> +
> +examples:
> + - |
> + iommu@5200 {
> + compatible = "brcm,bcm2712-iommu";
> + reg = <0x5200 0x80>;
> + brcm,iommu-cache = <&iommuc>;
> + #iommu-cells = <0>;
> + };
> diff --git a/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml
> new file mode 100644
> index 000000000000..47c584ad667a
> --- /dev/null
> +++ b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml
> @@ -0,0 +1,40 @@
> +# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
> +%YAML 1.2
> +---
> +$id: http://devicetree.org/schemas/iommu/brcm,bcm2712-iommuc.yaml#
> +$schema: http://devicetree.org/meta-schemas/core.yaml#
> +
> +title: Broadcom BCM2712 Shared IOMMU Cache (IOMMUC)
> +
> +maintainers:
> + - Daniel Drake <dan@reactivated.net>
> + - Florian Fainelli <florian.fainelli@broadcom.com>
> + - Jim Quinlan <james.quinlan@broadcom.com>
> +
> +description:
> + The BCM2712 IOMMUC is a centralized Translation Lookaside Buffer (TLB) cache
> + which accelerates address translation across the SoC's IOMMU devices. If an
> + address mapping is not found in the IOMMU's local TLB cache, then this
> + IOMMUC is consulted as a L2 TLB. The SoC includes a single IOMMUC which is
> + shared between all IOMMUs, and it must be explicitly invalidated when
> + modifying or unmapping IOMMU page tables.
> +
> +properties:
> + compatible:
> + const: brcm,bcm2712-iommuc
> +
> + reg:
> + maxItems: 1
> +
> +required:
> + - compatible
> + - reg
> +
> +additionalProperties: false
> +
> +examples:
> + - |
> + iommuc@5b00 {
> + compatible = "brcm,bcm2712-iommuc";
> + reg = <0x5b00 0x80>;
> + };
>
> --
> 2.55.0
>
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5471 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v4 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format
2026-09-02 17:57 [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
2026-09-02 17:57 ` [PATCH v4 1/5] iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats Daniel Drake
2026-09-02 17:57 ` [PATCH v4 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU Daniel Drake
@ 2026-09-02 17:57 ` Daniel Drake
2026-09-02 17:57 ` [PATCH v4 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
` (2 subsequent siblings)
5 siblings, 0 replies; 10+ messages in thread
From: Daniel Drake @ 2026-09-02 17:57 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
Implement generic_pt support for the 2-level page table format used by
the BCM2712 IOMMUs.
Adapted from Raspberry Pi's downstream bcm2712-iommu driver (original
author Nick Hollinghurst).
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/generic_pt/.kunitconfig | 1 +
drivers/iommu/generic_pt/Kconfig | 10 +
drivers/iommu/generic_pt/fmt/Makefile | 2 +
drivers/iommu/generic_pt/fmt/bcm2712.h | 288 +++++++++++++++++++++++++++
drivers/iommu/generic_pt/fmt/defs_bcm2712.h | 18 ++
drivers/iommu/generic_pt/fmt/iommu_bcm2712.c | 6 +
include/linux/generic_pt/common.h | 6 +
include/linux/generic_pt/iommu.h | 12 ++
8 files changed, 343 insertions(+)
diff --git a/drivers/iommu/generic_pt/.kunitconfig b/drivers/iommu/generic_pt/.kunitconfig
index 0bb98fe581fe..a3da74328f12 100644
--- a/drivers/iommu/generic_pt/.kunitconfig
+++ b/drivers/iommu/generic_pt/.kunitconfig
@@ -7,6 +7,7 @@ CONFIG_IOMMU_PT_AMDV1=y
CONFIG_IOMMU_PT_VTDSS=y
CONFIG_IOMMU_PT_RISCV64=y
CONFIG_IOMMU_PT_X86_64=y
+CONFIG_IOMMU_PT_BCM2712=y
CONFIG_IOMMU_PT_KUNIT_TEST=y
CONFIG_IOMMUFD=y
diff --git a/drivers/iommu/generic_pt/Kconfig b/drivers/iommu/generic_pt/Kconfig
index f4ed1add58b7..2a81dac960ac 100644
--- a/drivers/iommu/generic_pt/Kconfig
+++ b/drivers/iommu/generic_pt/Kconfig
@@ -72,6 +72,15 @@ config IOMMU_PT_X86_64
Selected automatically by an IOMMU driver that uses this format.
+config IOMMU_PT_BCM2712
+ tristate "IOMMU page table for Broadcom BCM2712"
+ help
+ iommu_domain implementation for the Broadcom BCM2712 IOMMU found on
+ Raspberry Pi 5. It supports 4K page sizes over a 2-level page table
+ format.
+
+ Selected automatically by an IOMMU driver that uses this format.
+
config IOMMU_PT_KUNIT_TEST
tristate "IOMMU Page Table KUnit Test" if !KUNIT_ALL_TESTS
depends on KUNIT
@@ -79,6 +88,7 @@ config IOMMU_PT_KUNIT_TEST
depends on IOMMU_PT_RISCV64 || !IOMMU_PT_RISCV64
depends on IOMMU_PT_X86_64 || !IOMMU_PT_X86_64
depends on IOMMU_PT_VTDSS || !IOMMU_PT_VTDSS
+ depends on IOMMU_PT_BCM2712 || !IOMMU_PT_BCM2712
default KUNIT_ALL_TESTS
help
Enable kunit tests for GENERIC_PT and IOMMU_PT that covers all the
diff --git a/drivers/iommu/generic_pt/fmt/Makefile b/drivers/iommu/generic_pt/fmt/Makefile
index ea024d582594..82ca3c36823d 100644
--- a/drivers/iommu/generic_pt/fmt/Makefile
+++ b/drivers/iommu/generic_pt/fmt/Makefile
@@ -9,6 +9,8 @@ iommu_pt_fmt-$(CONFIG_IOMMU_PT_RISCV64) += riscv64
iommu_pt_fmt-$(CONFIG_IOMMU_PT_X86_64) += x86_64
+iommu_pt_fmt-$(CONFIG_IOMMU_PT_BCM2712) += bcm2712
+
IOMMU_PT_KUNIT_TEST :=
define create_format
obj-$(2) += iommu_$(1).o
diff --git a/drivers/iommu/generic_pt/fmt/bcm2712.h b/drivers/iommu/generic_pt/fmt/bcm2712.h
new file mode 100644
index 000000000000..2c5b034441c1
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/bcm2712.h
@@ -0,0 +1,288 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2026 Daniel Drake
+ *
+ * BCM2712 IOMMU simple two level page table
+ */
+#ifndef __GENERIC_PT_FMT_BCM2712_H
+#define __GENERIC_PT_FMT_BCM2712_H
+
+#include "defs_bcm2712.h"
+#include "../pt_defs.h"
+
+#include <linux/bitfield.h>
+#include <linux/container_of.h>
+#include <linux/log2.h>
+#include <linux/sizes.h>
+
+enum {
+ /* Hardware provides a two-level page table */
+ PT_MAX_TOP_LEVEL = 1,
+
+ /* Hardware page size is strictly 4kb */
+ PT_GRANULE_LG2SZ = ilog2(SZ_4K),
+ PT_TABLEMEM_LG2SZ = PT_GRANULE_LG2SZ,
+
+ /* Table entries and leaf entries are 32 bits */
+ PT_ITEM_WORD_SIZE = sizeof(pt_bcm2712_entry_t),
+
+ /* Leaf entries encode a 25-bit PFN */
+ PT_MAX_OUTPUT_ADDRESS_LG2 = 25 + PT_GRANULE_LG2SZ,
+
+ /*
+ * For simplicity, only manage mappings within an address space of
+ * exactly 4GB. This is because our Level 1 directory page will be 4kb
+ * in the smallest case, permitting 1024 entries pointing at Level 0
+ * pages, each permitting 4mb of mapped memory.
+ */
+ PT_MAX_VA_ADDRESS_LG2 = ilog2(SZ_4G),
+
+ /* Level 1 base address is programmed as a 32-bit PFN */
+ PT_TOP_PHYS_MASK = GENMASK_ULL(31 + PT_GRANULE_LG2SZ, PT_GRANULE_LG2SZ),
+};
+
+/* PTE bits */
+enum {
+ BCM2712PT_VALID = BIT(28),
+ BCM2712PT_WRITE = BIT(29),
+ BCM2712PT_PAGESIZE = GENMASK(31, 30),
+ BCM2712PT_PFN = GENMASK(24, 0),
+};
+
+#define common_to_bcm2712pt(common_ptr) \
+ container_of_const(common_ptr, struct pt_bcm2712, common)
+#define to_bcm2712pt(pts) common_to_bcm2712pt((pts)->range->common)
+
+static inline pt_oaddr_t bcm2712pt_table_pa(const struct pt_state *pts)
+{
+ return oalog2_mul(FIELD_GET(BCM2712PT_PFN, pts->entry),
+ PT_GRANULE_LG2SZ);
+}
+#define pt_table_pa bcm2712pt_table_pa
+#define pt_item_oa bcm2712pt_table_pa
+
+static inline bool bcm2712pt_can_have_leaf(const struct pt_state *pts)
+{
+ return true;
+}
+#define pt_can_have_leaf bcm2712pt_can_have_leaf
+
+/* 4MB pages are installed at level 1, everything else at level 0 */
+static inline unsigned int bcm2712pt_pgsz_lg2_to_level(struct pt_common *common,
+ unsigned int pgsize_lg2)
+{
+ return pgsize_lg2 == ilog2(SZ_4M) ? 1 : 0;
+}
+#define pt_pgsz_lg2_to_level bcm2712pt_pgsz_lg2_to_level
+
+static inline pt_vaddr_t bcm2712pt_possible_sizes(const struct pt_state *pts)
+{
+ struct pt_bcm2712 *table = common_to_bcm2712pt(pts->range->common);
+
+ if (pts->level == 1)
+ return SZ_4M;
+
+ return SZ_4K |
+ (table->bigpage_lg2 ? BIT_ULL(table->bigpage_lg2) : 0) |
+ (table->superpage_lg2 ? BIT_ULL(table->superpage_lg2) : 0);
+}
+#define pt_possible_sizes bcm2712pt_possible_sizes
+
+static inline unsigned int
+bcm2712pt_entry_num_contig_lg2(const struct pt_state *pts)
+{
+ struct pt_bcm2712 *table = common_to_bcm2712pt(pts->range->common);
+ u32 pgsz = FIELD_GET(BCM2712PT_PAGESIZE, pts->entry);
+
+ if (pts->level != 0 || !(pts->entry & BCM2712PT_VALID))
+ return 0;
+
+ /*
+ * Superpage/bigpage contiguous mapping (really just hinting) is handled
+ * via PAGESIZE bits on each leaf entry.
+ */
+ if (pgsz == 2 && table->superpage_lg2)
+ return table->superpage_lg2 - PT_GRANULE_LG2SZ;
+ else if (pgsz == 1 && table->bigpage_lg2)
+ return table->bigpage_lg2 - PT_GRANULE_LG2SZ;
+ return 0;
+}
+#define pt_entry_num_contig_lg2 bcm2712pt_entry_num_contig_lg2
+
+static inline unsigned int bcm2712pt_num_items_lg2(const struct pt_state *pts)
+{
+ return PT_TABLEMEM_LG2SZ - ilog2(PT_ITEM_WORD_SIZE);
+}
+#define pt_num_items_lg2 bcm2712pt_num_items_lg2
+
+static inline enum pt_entry_type bcm2712pt_load_entry_raw(struct pt_state *pts)
+{
+ const pt_bcm2712_entry_t *tablep =
+ pt_cur_table(pts, pt_bcm2712_entry_t);
+
+ pts->entry = READ_ONCE(tablep[pts->index]);
+ if (!(pts->entry & BCM2712PT_VALID))
+ return PT_ENTRY_EMPTY;
+
+ if (pts->level == 1) {
+ if (FIELD_GET(BCM2712PT_PAGESIZE, pts->entry) == 3)
+ return PT_ENTRY_OA;
+ return PT_ENTRY_TABLE;
+ }
+
+ return PT_ENTRY_OA;
+}
+#define pt_load_entry_raw bcm2712pt_load_entry_raw
+
+static inline void
+bcm2712pt_install_leaf_entry(struct pt_state *pts, pt_oaddr_t oa,
+ unsigned int oasz_lg2,
+ const struct pt_write_attrs *attrs)
+{
+ pt_bcm2712_entry_t *tablep = pt_cur_table(pts, pt_bcm2712_entry_t);
+ pt_bcm2712_entry_t entry;
+
+ if (!pt_check_install_leaf_args(pts, oa, oasz_lg2))
+ return;
+
+ entry = BCM2712PT_VALID | attrs->descriptor_bits |
+ FIELD_PREP(BCM2712PT_PFN, oalog2_div(oa, PT_GRANULE_LG2SZ));
+
+ if (pts->level == 1) {
+ /* Level 1 hugepage (4MB) */
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 3);
+ WRITE_ONCE(tablep[pts->index], entry);
+ pts->entry = entry;
+ return;
+ }
+
+ if (oasz_lg2 == PT_GRANULE_LG2SZ) {
+ WRITE_ONCE(tablep[pts->index], entry);
+ pts->entry = entry;
+ } else {
+ struct pt_bcm2712 *table =
+ common_to_bcm2712pt(pts->range->common);
+ u32 *end;
+
+ tablep += pts->index;
+ end = tablep + log2_to_int(oasz_lg2 - PT_GRANULE_LG2SZ);
+
+ /*
+ * Leaf entries can contain hints indicating bigpage/superpage
+ * contiguous mappings to permit TLB optimization
+ */
+ if (oasz_lg2 == table->superpage_lg2)
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 2);
+ else if (oasz_lg2 == table->bigpage_lg2)
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 1);
+
+ pts->entry = entry;
+ for (; tablep != end; tablep++, entry++)
+ WRITE_ONCE(*tablep, entry);
+ }
+}
+#define pt_install_leaf_entry bcm2712pt_install_leaf_entry
+
+static inline bool bcm2712pt_install_table(struct pt_state *pts,
+ pt_oaddr_t table_pa,
+ const struct pt_write_attrs *attrs)
+{
+ pt_bcm2712_entry_t entry =
+ BCM2712PT_VALID |
+ FIELD_PREP(BCM2712PT_PFN,
+ oalog2_div(table_pa, PT_GRANULE_LG2SZ));
+
+ return pt_table_install32(pts, entry);
+}
+#define pt_install_table bcm2712pt_install_table
+
+static inline void bcm2712pt_attr_from_entry(const struct pt_state *pts,
+ struct pt_write_attrs *attrs)
+{
+ attrs->descriptor_bits = pts->entry & BCM2712PT_WRITE;
+}
+#define pt_attr_from_entry bcm2712pt_attr_from_entry
+
+static inline unsigned int bcm2712pt_max_sw_bit(struct pt_common *common)
+{
+ return 2;
+}
+#define pt_max_sw_bit bcm2712pt_max_sw_bit
+
+static inline u32 bcm2712pt_sw_bit(unsigned int bitnr)
+{
+ if (__builtin_constant_p(bitnr) && bitnr > 2)
+ BUILD_BUG();
+ if (PT_WARN_ON(bitnr > 2))
+ return 0;
+
+ /* Bits 27, 26 and 25 are believed spare */
+ return BIT(27 - bitnr);
+}
+#define pt_sw_bit bcm2712pt_sw_bit
+
+/* --- iommu */
+#include <linux/generic_pt/iommu.h>
+#include <linux/iommu.h>
+
+#define pt_iommu_table pt_iommu_bcm2712
+
+/* The common struct is in the per-format common struct */
+static inline struct pt_common *common_from_iommu(struct pt_iommu *iommu_table)
+{
+ return &container_of(iommu_table, struct pt_iommu_table, iommu)
+ ->bcm2712pt.common;
+}
+
+static inline struct pt_iommu *iommu_from_common(struct pt_common *common)
+{
+ return &container_of(common, struct pt_iommu_table, bcm2712pt.common)
+ ->iommu;
+}
+
+static inline int bcm2712_pt_iommu_set_prot(struct pt_common *common,
+ struct pt_write_attrs *attrs,
+ unsigned int iommu_prot)
+{
+ attrs->descriptor_bits = 0;
+ if (iommu_prot & IOMMU_WRITE)
+ attrs->descriptor_bits |= BCM2712PT_WRITE;
+ return 0;
+}
+#define pt_iommu_set_prot bcm2712_pt_iommu_set_prot
+
+static inline int bcm2712_pt_fmt_init(struct pt_iommu_table *fmt_table,
+ const struct pt_iommu_bcm2712_cfg *cfg)
+{
+ fmt_table->bcm2712pt.bigpage_lg2 = cfg->bigpage_lg2;
+ fmt_table->bcm2712pt.superpage_lg2 = cfg->superpage_lg2;
+
+ pt_top_set_level(&fmt_table->bcm2712pt.common, PT_MAX_TOP_LEVEL);
+ return 0;
+}
+#define pt_iommu_fmt_init bcm2712_pt_fmt_init
+
+static inline void
+bcm2712pt_iommu_fmt_hw_info(struct pt_iommu_bcm2712 *table,
+ const struct pt_range *top_range,
+ struct pt_iommu_bcm2712_hw_info *info)
+{
+ info->pt_base = virt_to_phys(top_range->top_table);
+ PT_WARN_ON(info->pt_base & ~PT_TOP_PHYS_MASK);
+}
+#define pt_iommu_fmt_hw_info bcm2712pt_iommu_fmt_hw_info
+
+#if defined(GENERIC_PT_KUNIT)
+static const struct pt_iommu_bcm2712_cfg bcm2712_kunit_fmt_cfgs[] = {
+ [0] = {
+ .common.hw_max_vasz_lg2 = 32,
+ .common.hw_max_oasz_lg2 = 37,
+ .bigpage_lg2 = 16,
+ .superpage_lg2 = 20,
+ },
+};
+#define kunit_fmt_cfgs bcm2712_kunit_fmt_cfgs
+enum { KUNIT_FMT_FEATURES = 0 };
+#endif
+
+#endif
diff --git a/drivers/iommu/generic_pt/fmt/defs_bcm2712.h b/drivers/iommu/generic_pt/fmt/defs_bcm2712.h
new file mode 100644
index 000000000000..f1d983be1716
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/defs_bcm2712.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef __GENERIC_PT_FMT_DEFS_BCM2712_H
+#define __GENERIC_PT_FMT_DEFS_BCM2712_H
+
+#include <linux/generic_pt/common.h>
+#include <linux/types.h>
+
+typedef u32 pt_bcm2712_entry_t;
+typedef u64 pt_vaddr_t;
+typedef u64 pt_oaddr_t;
+
+struct bcm2712pt_write_attrs {
+ pt_bcm2712_entry_t descriptor_bits;
+ gfp_t gfp;
+};
+#define pt_write_attrs bcm2712pt_write_attrs
+
+#endif
diff --git a/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c b/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c
new file mode 100644
index 000000000000..43fbc3cf3adc
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#define PT_FMT bcm2712
+#define PT_SUPPORTED_FEATURES BIT(PT_FEAT_DMA_INCOHERENT)
+
+#include <linux/generic_pt/iommu.h>
+#include "iommu_template.h"
diff --git a/include/linux/generic_pt/common.h b/include/linux/generic_pt/common.h
index 07ef1c8341a4..1b39b27f0cfa 100644
--- a/include/linux/generic_pt/common.h
+++ b/include/linux/generic_pt/common.h
@@ -213,4 +213,10 @@ enum {
PT_FEAT_X86_64_AMD_ENCRYPT_TABLES = PT_FEAT_FMT_START,
};
+struct pt_bcm2712 {
+ struct pt_common common;
+ u8 bigpage_lg2;
+ u8 superpage_lg2;
+};
+
#endif
diff --git a/include/linux/generic_pt/iommu.h b/include/linux/generic_pt/iommu.h
index dd0edd02a48a..13ebb72a67de 100644
--- a/include/linux/generic_pt/iommu.h
+++ b/include/linux/generic_pt/iommu.h
@@ -346,6 +346,18 @@ struct pt_iommu_x86_64_hw_info {
IOMMU_FORMAT(x86_64, x86_64_pt);
+struct pt_iommu_bcm2712_cfg {
+ struct pt_iommu_cfg common;
+ u8 bigpage_lg2;
+ u8 superpage_lg2;
+};
+
+struct pt_iommu_bcm2712_hw_info {
+ phys_addr_t pt_base;
+};
+
+IOMMU_FORMAT(bcm2712, bcm2712pt);
+
#undef IOMMU_PROTOTYPES
#undef IOMMU_FORMAT
#endif
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* [PATCH v4 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-09-02 17:57 [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
` (2 preceding siblings ...)
2026-09-02 17:57 ` [PATCH v4 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format Daniel Drake
@ 2026-09-02 17:57 ` Daniel Drake
2026-09-02 22:15 ` Daniel Drake
2026-09-02 17:57 ` [PATCH v4 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes Daniel Drake
2026-09-03 18:14 ` [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Jim Quinlan
5 siblings, 1 reply; 10+ messages in thread
From: Daniel Drake @ 2026-09-02 17:57 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
This IOMMU translates memory access requests for the VC6 display
pipeline and various multimedia devices in the Broadcom BCM2712 SoC used
on Raspberry Pi 5.
The driver uses the generic_pt framework to manage the 2-level page
tables. It also provides support for the centralized L2 TLB (IOMMUC),
which is shared across the SoC's IOMMU instances and must be flushed
when modifying or unmapping page table entries.
Adapted from Raspberry Pi's downstream bcm2712-iommu driver
(original author Nick Hollinghurst).
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/Kconfig | 15 +
drivers/iommu/Makefile | 1 +
drivers/iommu/bcm2712-iommu-cache.c | 84 ++++++
drivers/iommu/bcm2712-iommu-cache.h | 9 +
drivers/iommu/bcm2712-iommu.c | 577 ++++++++++++++++++++++++++++++++++++
5 files changed, 686 insertions(+)
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 6e07bd69467a..f2c8788158b0 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -386,6 +386,21 @@ config VSI_IOMMU
Say Y here if you want to use this IOMMU in front of these
hardware blocks.
+config BCM2712_IOMMU
+ bool "BCM2712 IOMMU driver"
+ depends on (ARCH_BCM && ARM64) || COMPILE_TEST
+ select IOMMU_API
+ select GENERIC_PT
+ select IOMMU_PT
+ select IOMMU_PT_BCM2712
+ help
+ Support for IOMMU on BCM2712 SoC. This IOMMU can be used by the
+ display controller and various multimedia devices to perform
+ efficient memory management.
+
+ Say Y here if you want to use this IOMMU in front of these
+ hardware blocks.
+
config IOMMU_DEBUG_PAGEALLOC
bool "Debug IOMMU mappings against page allocations"
depends on DEBUG_PAGEALLOC && IOMMU_API && PAGE_EXTENSION
diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
index 2f05725eaab1..29a26d2a3af1 100644
--- a/drivers/iommu/Makefile
+++ b/drivers/iommu/Makefile
@@ -37,4 +37,5 @@ obj-$(CONFIG_IOMMU_IOPF) += io-pgfault.o
obj-$(CONFIG_SPRD_IOMMU) += sprd-iommu.o
obj-$(CONFIG_APPLE_DART) += apple-dart.o
obj-$(CONFIG_VSI_IOMMU) += vsi-iommu.o
+obj-$(CONFIG_BCM2712_IOMMU) += bcm2712-iommu.o bcm2712-iommu-cache.o
obj-$(CONFIG_IOMMU_DEBUG_PAGEALLOC) += iommu-debug-pagealloc.o
diff --git a/drivers/iommu/bcm2712-iommu-cache.c b/drivers/iommu/bcm2712-iommu-cache.c
new file mode 100644
index 000000000000..8ed436943b83
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu-cache.c
@@ -0,0 +1,84 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * IOMMU driver for BCM2712 TLB cache
+ *
+ * Copyright (c) 2023 Raspberry Pi Ltd.
+ * Copyright (c) 2026 Daniel Drake
+ *
+ * The BCM2712 IOMMUC is a centralized TLB which accelerates address translation
+ * across the SoC's IOMMU devices. If an address mapping is not found in the
+ * IOMMU's local TLB cache, then this IOMMUC is consulted. The IOMMUC must be
+ * explicitly invalidated when modifying or unmapping IOMMU page tables.
+ */
+
+#include <linux/bits.h>
+#include <linux/cleanup.h>
+#include <linux/err.h>
+#include <linux/iopoll.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+
+#include "bcm2712-iommu-cache.h"
+
+struct bcm2712_iommu_cache {
+ struct device *dev;
+ spinlock_t hw_lock;
+ void __iomem *reg_base;
+};
+
+#define MMUC_CONTROL_ENABLE BIT(0)
+#define MMUC_CONTROL_FLUSH BIT(1)
+#define MMUC_CONTROL_FLUSHING BIT(2)
+
+void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache)
+{
+ u32 val;
+ int ret;
+
+ scoped_guard(spinlock_irqsave, &cache->hw_lock) {
+ writel(MMUC_CONTROL_ENABLE | MMUC_CONTROL_FLUSH,
+ cache->reg_base);
+
+ ret = readl_poll_timeout_atomic(cache->reg_base, val,
+ !(val & MMUC_CONTROL_FLUSHING),
+ 0, 50);
+ }
+
+ if (ret)
+ dev_err_ratelimited(cache->dev, "cache flush timed out\n");
+}
+
+static int bcm2712_iommu_cache_probe(struct platform_device *pdev)
+{
+ struct bcm2712_iommu_cache *cache;
+
+ cache = devm_kzalloc(&pdev->dev, sizeof(*cache), GFP_KERNEL);
+ if (!cache)
+ return -ENOMEM;
+
+ cache->dev = &pdev->dev;
+ spin_lock_init(&cache->hw_lock);
+
+ cache->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(cache->reg_base))
+ return PTR_ERR(cache->reg_base);
+
+ platform_set_drvdata(pdev, cache);
+ return 0;
+}
+
+static const struct of_device_id bcm2712_iommu_cache_of_match[] = {
+ { .compatible = "brcm,bcm2712-iommuc" },
+ { /* sentinel */ },
+};
+
+static struct platform_driver bcm2712_iommu_cache_driver = {
+ .probe = bcm2712_iommu_cache_probe,
+ .driver = {
+ .name = "bcm2712-iommu-cache",
+ .of_match_table = bcm2712_iommu_cache_of_match,
+ .suppress_bind_attrs = true,
+ },
+};
+builtin_platform_driver(bcm2712_iommu_cache_driver);
diff --git a/drivers/iommu/bcm2712-iommu-cache.h b/drivers/iommu/bcm2712-iommu-cache.h
new file mode 100644
index 000000000000..d2f7851831cc
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu-cache.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef _BCM2712_IOMMU_CACHE_H
+#define _BCM2712_IOMMU_CACHE_H
+
+struct bcm2712_iommu_cache;
+
+void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache);
+
+#endif
diff --git a/drivers/iommu/bcm2712-iommu.c b/drivers/iommu/bcm2712-iommu.c
new file mode 100644
index 000000000000..27dad375b7d4
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu.c
@@ -0,0 +1,577 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * IOMMU driver for Broadcom BCM2712
+ *
+ * Copyright (c) 2023-2025 Raspberry Pi Ltd.
+ * Copyright (c) 2026 Daniel Drake
+ *
+ * Each BCM2712 IOMMU has multiple devices hardwired into it, whose
+ * DMA transactions all route through the IOMMU. There is no stream ID tagging
+ * or any other kind of segmentation to differentiate between requests from
+ * different devices. It is also not possible to toggle a specific device
+ * between iommu-mapped and bypass modes.
+ *
+ * The hardware supports the simultaneous configuration of a bypass window
+ * (where memory accesses operate in identity mode) and a translation aperture
+ * (supporting page mapping). While combining these two would allow for
+ * GART-like operation, this driver's paging domain implementation configures
+ * only the translation aperture (starting at IOVA 0) offering a degree of
+ * memory protection.
+ *
+ * The page table format is a two-level format handled by generic_pt/bcm2712.
+ */
+
+#include <linux/bitfield.h>
+#include <linux/cleanup.h>
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/iommu.h>
+#include <linux/iopoll.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/sizes.h>
+#include <linux/generic_pt/iommu.h>
+
+#include "bcm2712-iommu-cache.h"
+#include "dma-iommu.h"
+#include "iommu-pages.h"
+
+/* BCM2712 IOMMU is organized around 4Kbyte pages */
+#define IOMMU_PAGE_SHIFT 12
+#define IOMMU_PAGE_SIZE (1ul << IOMMU_PAGE_SHIFT)
+/* A PTE is 4 bytes */
+#define PTE_SIZE_SHIFT 2
+/* L1/L2 table sizing (IOMMU hardware pages): 1024 entries per page */
+#define PTES_PER_IOPG_SHIFT (IOMMU_PAGE_SHIFT - PTE_SIZE_SHIFT)
+
+#define MMMU_CTRL_OFFSET 0x00
+#define MMMU_CTRL_CAP_EXCEEDED BIT(27)
+#define MMMU_CTRL_CAP_EXCEEDED_ABORT_EN BIT(26)
+#define MMMU_CTRL_CAP_EXCEEDED_INT_EN BIT(25)
+#define MMMU_CTRL_CAP_EXCEEDED_EXCEPTION_EN BIT(24)
+#define MMMU_CTRL_PT_INVALID BIT(20)
+#define MMMU_CTRL_PT_INVALID_ABORT_EN BIT(19)
+#define MMMU_CTRL_PT_INVALID_INT_EN BIT(18)
+#define MMMU_CTRL_PT_INVALID_EXCEPTION_EN BIT(17)
+#define MMMU_CTRL_PT_INVALID_EN BIT(16)
+#define MMMU_CTRL_WRITE_VIOLATION BIT(12)
+#define MMMU_CTRL_WRITE_VIOLATION_ABORT_EN BIT(11)
+#define MMMU_CTRL_WRITE_VIOLATION_INT_EN BIT(10)
+#define MMMU_CTRL_WRITE_VIOLATION_EXCEPTION_EN BIT(9)
+#define MMMU_CTRL_BYPASS BIT(8)
+#define MMMU_CTRL_TLB_CLEARING BIT(7)
+#define MMMU_CTRL_STATS_CLEAR BIT(3)
+#define MMMU_CTRL_TLB_CLEAR BIT(2)
+#define MMMU_CTRL_STATS_ENABLE BIT(1)
+#define MMMU_CTRL_ENABLE BIT(0)
+
+#define MMMU_CTRL_OPERATING_FLAGS (\
+ MMMU_CTRL_CAP_EXCEEDED_ABORT_EN | \
+ MMMU_CTRL_PT_INVALID_ABORT_EN | \
+ MMMU_CTRL_PT_INVALID_EN | \
+ MMMU_CTRL_WRITE_VIOLATION_ABORT_EN | \
+ MMMU_CTRL_STATS_ENABLE | \
+ MMMU_CTRL_ENABLE)
+
+#define MMMU_PT_PA_BASE_OFFSET 0x04
+
+#define MMMU_ADDR_CAP_OFFSET 0x14
+#define MMMU_ADDR_CAP_ENABLE BIT(31)
+#define ADDR_CAP_SHIFT ilog2(SZ_256M)
+
+#define MMMU_SHOOT_DOWN_OFFSET 0x18
+#define MMMU_SHOOT_DOWN_SHOOTING BIT(31)
+#define MMMU_SHOOT_DOWN_SHOOT BIT(30)
+
+#define MMMU_BYPASS_START_OFFSET 0x1c
+#define MMMU_BYPASS_START_ENABLE BIT(31)
+
+#define MMMU_BYPASS_END_OFFSET 0x20
+#define MMMU_BYPASS_END_ENABLE BIT(31)
+
+#define MMMU_MISC_OFFSET 0x24
+#define MMMU_MISC_SINGLE_TABLE BIT(31)
+
+#define MMMU_ILLEGAL_ADR_OFFSET 0x30
+#define MMMU_ILLEGAL_ADR_ENABLE BIT(31)
+
+#define MMMU_DEBUG_INFO_OFFSET 0x38
+#define MMMU_DEBUG_INFO_VERSION_MASK 0x0000000Fu
+#define MMMU_DEBUG_INFO_VA_WIDTH_MASK 0x000000F0u
+#define MMMU_DEBUG_INFO_PA_WIDTH_MASK 0x00000F00u
+#define MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK 0x000FF000u
+#define MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK 0x0FF00000u
+#define MMMU_DEBUG_INFO_BYPASS_4M BIT(28)
+#define MMMU_DEBUG_INFO_BYPASS BIT(29)
+
+struct bcm2712_iommu {
+ struct device *dev;
+ struct iommu_device iommu;
+ struct bcm2712_iommu_domain *domain;
+ struct bcm2712_iommu_cache *cache;
+ void __iomem *reg_base;
+ spinlock_t hw_lock;
+ size_t bigpage_size;
+ size_t superpage_size;
+};
+
+struct bcm2712_iommu_domain {
+ union {
+ struct iommu_domain base;
+ struct pt_iommu_bcm2712 pt;
+ };
+ struct bcm2712_iommu *mmu;
+ void *default_page;
+};
+
+static inline void bcm2712_iommu_writel(struct bcm2712_iommu *mmu,
+ unsigned int offset, u32 val)
+{
+ writel(val, mmu->reg_base + offset);
+}
+
+static inline u32 bcm2712_iommu_readl(struct bcm2712_iommu *mmu,
+ unsigned int offset)
+{
+ return readl(mmu->reg_base + offset);
+}
+
+static struct bcm2712_iommu_domain *
+to_bcm2712_domain(struct iommu_domain *domain)
+{
+ return container_of(domain, struct bcm2712_iommu_domain, base);
+}
+
+static void bcm2712_iommu_init(struct bcm2712_iommu *mmu)
+{
+ unsigned int bigpage_width, superpage_width;
+ u32 u = bcm2712_iommu_readl(mmu, MMMU_DEBUG_INFO_OFFSET);
+ u32 pa_width = FIELD_GET(MMMU_DEBUG_INFO_PA_WIDTH_MASK, u);
+
+ dev_dbg(mmu->dev, "DEBUG_INFO = 0x%08x\n", u);
+ WARN_ON(FIELD_GET(MMMU_DEBUG_INFO_VERSION_MASK, u) < 4 ||
+ FIELD_GET(MMMU_DEBUG_INFO_VA_WIDTH_MASK, u) < 6 ||
+ pa_width < 6 || !(u & MMMU_DEBUG_INFO_BYPASS));
+
+ dma_set_mask_and_coherent(mmu->dev, DMA_BIT_MASK(pa_width + 30u));
+
+ bigpage_width = FIELD_GET(MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK, u);
+ if (bigpage_width)
+ mmu->bigpage_size = IOMMU_PAGE_SIZE << bigpage_width;
+
+ superpage_width = FIELD_GET(MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK, u);
+ if (superpage_width)
+ mmu->superpage_size = IOMMU_PAGE_SIZE << superpage_width;
+
+ /* Disable MMU and clear sticky flags */
+ bcm2712_iommu_writel(mmu, MMMU_CTRL_OFFSET,
+ MMMU_CTRL_CAP_EXCEEDED | MMMU_CTRL_PT_INVALID |
+ MMMU_CTRL_WRITE_VIOLATION |
+ MMMU_CTRL_STATS_CLEAR);
+
+ /* Put MMU into 2-level mode */
+ bcm2712_iommu_writel(mmu, MMMU_MISC_OFFSET,
+ bcm2712_iommu_readl(mmu, MMMU_MISC_OFFSET) &
+ ~MMMU_MISC_SINGLE_TABLE);
+}
+
+static int bcm2712_iommu_identity_attach(struct iommu_domain *identity_domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+
+ guard(spinlock_irqsave)(&mmu->hw_lock);
+ bcm2712_iommu_writel(mmu, MMMU_CTRL_OFFSET, 0);
+ mmu->domain = NULL;
+
+ return 0;
+}
+
+static struct iommu_domain bcm2712_identity_domain = {
+ .type = IOMMU_DOMAIN_IDENTITY,
+ .ops = &(const struct iommu_domain_ops) {
+ .attach_dev = bcm2712_iommu_identity_attach,
+ },
+};
+
+static int bcm2712_iommu_clear_and_enable(struct bcm2712_iommu *mmu)
+ __must_hold(&mmu->hw_lock)
+{
+ u32 val;
+
+ bcm2712_iommu_cache_flush(mmu->cache);
+ bcm2712_iommu_writel(mmu, MMMU_CTRL_OFFSET,
+ MMMU_CTRL_OPERATING_FLAGS | MMMU_CTRL_TLB_CLEAR);
+ return readl_poll_timeout_atomic(mmu->reg_base + MMMU_CTRL_OFFSET, val,
+ !(val & MMMU_CTRL_TLB_CLEARING), 0,
+ 50);
+}
+
+static int bcm2712_iommu_blocking_attach(struct iommu_domain *blocking_domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ int ret = 0;
+
+ scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
+ /*
+ * Completely block DMA by disabling both the bypass window
+ * and the translation aperture.
+ */
+ bcm2712_iommu_writel(mmu, MMMU_BYPASS_START_OFFSET, 0);
+ bcm2712_iommu_writel(mmu, MMMU_BYPASS_END_OFFSET, 0);
+ bcm2712_iommu_writel(mmu, MMMU_ADDR_CAP_OFFSET,
+ MMMU_ADDR_CAP_ENABLE);
+ bcm2712_iommu_writel(mmu, MMMU_ILLEGAL_ADR_OFFSET, 0);
+ ret = bcm2712_iommu_clear_and_enable(mmu);
+ mmu->domain = NULL;
+ }
+
+ if (ret)
+ dev_err_ratelimited(mmu->dev,
+ "TLB clear timed out during blocking attach\n");
+
+ return ret;
+}
+
+static struct iommu_domain bcm2712_blocking_domain = {
+ .type = IOMMU_DOMAIN_BLOCKED,
+ .ops = &(const struct iommu_domain_ops) {
+ .attach_dev = bcm2712_iommu_blocking_attach,
+ },
+};
+
+static int bcm2712_iommu_attach_dev(struct iommu_domain *domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
+ struct pt_iommu_bcm2712_hw_info info;
+ u32 default_page_pfn;
+ int ret = 0;
+
+ /* all attached devices must belong to the same IOMMU instance */
+ if (mydomain->mmu != mmu)
+ return -EINVAL;
+
+ scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
+ if (mmu->domain == mydomain)
+ break;
+
+ mmu->domain = mydomain;
+
+ /* Configure translation aperture */
+ bcm2712_iommu_writel(mmu, MMMU_ADDR_CAP_OFFSET,
+ MMMU_ADDR_CAP_ENABLE +
+ (domain->geometry.aperture_end >>
+ ADDR_CAP_SHIFT));
+
+ /*
+ * When the IOMMU handles a request, it adds the
+ * PT_PA_BASE_OFFSET to (IOVA>>32) to calculate the PFN of the
+ * corresponding L1 directory page.
+ * IOVA bits [31:22] are then used to fetch the L1 descriptor
+ * within (which in turn points to the L2 table).
+ * This clever logic would allow for a L1 table larger than 4kb
+ * (and hence a larger aperture).
+ */
+ pt_iommu_bcm2712_hw_info(&mydomain->pt, &info);
+ bcm2712_iommu_writel(mmu, MMMU_PT_PA_BASE_OFFSET,
+ info.pt_base >> IOMMU_PAGE_SHIFT);
+
+ /* Disable bypass window */
+ bcm2712_iommu_writel(mmu, MMMU_BYPASS_START_OFFSET, 0);
+ bcm2712_iommu_writel(mmu, MMMU_BYPASS_END_OFFSET, 0);
+
+ /*
+ * A default (error) page is used to catch illegal reads/writes.
+ */
+ default_page_pfn = virt_to_phys(mydomain->default_page) >>
+ IOMMU_PAGE_SHIFT;
+ bcm2712_iommu_writel(mmu, MMMU_ILLEGAL_ADR_OFFSET,
+ MMMU_ILLEGAL_ADR_ENABLE +
+ default_page_pfn);
+
+ ret = bcm2712_iommu_clear_and_enable(mmu);
+ }
+
+ if (ret)
+ dev_err_ratelimited(mmu->dev,
+ "TLB clear timed out during attach\n");
+
+ return ret;
+}
+
+static int bcm2712_iommu_shootdown_range(struct bcm2712_iommu *mmu,
+ unsigned long iova, size_t size)
+ __must_hold(&mmu->hw_lock)
+{
+ unsigned long iova_end = iova + size - 1;
+ unsigned int page_group;
+ u32 val;
+ int ret;
+
+ /* Shootdown register deals with 4 pages at a time */
+ for (page_group = iova >> (IOMMU_PAGE_SHIFT + 2);
+ page_group <= iova_end >> (IOMMU_PAGE_SHIFT + 2); page_group++) {
+ bcm2712_iommu_writel(mmu, MMMU_SHOOT_DOWN_OFFSET,
+ MMMU_SHOOT_DOWN_SHOOT + (page_group << 2));
+ ret = readl_poll_timeout_atomic(
+ mmu->reg_base + MMMU_SHOOT_DOWN_OFFSET, val,
+ !(val & MMMU_SHOOT_DOWN_SHOOTING), 0, 50);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
+static int bcm2712_iommu_sync_range(struct iommu_domain *domain,
+ unsigned long iova, size_t size)
+{
+ struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
+ struct bcm2712_iommu *mmu = mydomain->mmu;
+ int ret = 0;
+
+ scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
+ if (mmu->domain != mydomain)
+ return 0;
+
+ /* If invalidating more than 1MB, just do a full TLB clear */
+ if (size >= SZ_1M) {
+ ret = bcm2712_iommu_clear_and_enable(mmu);
+ } else {
+ bcm2712_iommu_cache_flush(mmu->cache);
+ ret = bcm2712_iommu_shootdown_range(mmu, iova, size);
+ }
+ }
+
+ if (ret)
+ dev_err_ratelimited(mmu->dev,
+ "TLB sync timed out (size=%#zx)\n", size);
+
+ return ret;
+}
+
+static void bcm2712_iommu_sync(struct iommu_domain *domain,
+ struct iommu_iotlb_gather *gather)
+{
+ bcm2712_iommu_sync_range(domain, gather->start,
+ gather->end - gather->start + 1);
+}
+
+static int bcm2712_iommu_sync_map(struct iommu_domain *domain,
+ unsigned long iova, size_t size)
+{
+ return bcm2712_iommu_sync_range(domain, iova, size);
+}
+
+static void bcm2712_iommu_sync_all(struct iommu_domain *domain)
+{
+ size_t aperture_size = domain->geometry.aperture_end -
+ domain->geometry.aperture_start + 1;
+
+ bcm2712_iommu_sync_range(domain, domain->geometry.aperture_start,
+ aperture_size);
+}
+
+static void bcm2712_iommu_domain_free(struct iommu_domain *domain)
+{
+ struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
+ struct bcm2712_iommu *mmu = mydomain->mmu;
+
+ scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
+ if (mmu->domain == mydomain) {
+ bcm2712_iommu_writel(mmu, MMMU_CTRL_OFFSET, 0);
+ mmu->domain = NULL;
+ }
+ }
+
+ pt_iommu_deinit(&mydomain->pt.iommu);
+ if (mydomain->default_page)
+ iommu_free_pages(mydomain->default_page);
+ kfree(mydomain);
+}
+
+static const struct iommu_domain_ops bcm2712_paging_domain_ops = {
+ IOMMU_PT_DOMAIN_OPS(bcm2712),
+ .attach_dev = bcm2712_iommu_attach_dev,
+ .iotlb_sync = bcm2712_iommu_sync,
+ .iotlb_sync_map = bcm2712_iommu_sync_map,
+ .flush_iotlb_all = bcm2712_iommu_sync_all,
+ .free = bcm2712_iommu_domain_free,
+};
+
+static struct iommu_domain *bcm2712_iommu_domain_alloc(struct device *dev)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ struct bcm2712_iommu_domain *domain;
+ struct pt_iommu_bcm2712_cfg cfg;
+ int ret;
+
+ domain = kzalloc_obj(*domain);
+ if (!domain)
+ return NULL;
+
+ domain->mmu = mmu;
+ domain->pt.iommu.iommu_device = mmu->dev;
+ memset(&cfg, 0, sizeof(cfg));
+ cfg.common.features = BIT(PT_FEAT_DMA_INCOHERENT);
+
+ /* Bigpage and superpage sizes are typically 64K and 1M, but may vary */
+ if (mmu->bigpage_size)
+ cfg.bigpage_lg2 = ilog2(mmu->bigpage_size);
+ if (mmu->superpage_size)
+ cfg.superpage_lg2 = ilog2(mmu->superpage_size);
+
+ /* 2-level format: 10-bit L1 + 10-bit L2 + 12-bit page offset */
+ cfg.common.hw_max_vasz_lg2 =
+ (2 * PTES_PER_IOPG_SHIFT) + IOMMU_PAGE_SHIFT;
+
+ /* PTEs encode a 25-bit output address PFN */
+ cfg.common.hw_max_oasz_lg2 = 25 + IOMMU_PAGE_SHIFT;
+
+ ret = pt_iommu_bcm2712_init(&domain->pt, &cfg, GFP_KERNEL);
+ if (ret)
+ goto err;
+
+ /* Set up a default (error) page used to catch illegal reads/writes */
+ domain->default_page = iommu_alloc_pages_sz(GFP_KERNEL, PAGE_SIZE);
+ if (!domain->default_page)
+ goto err;
+
+ domain->base.ops = &bcm2712_paging_domain_ops;
+ return &domain->base;
+
+err:
+ bcm2712_iommu_domain_free(&domain->base);
+ return NULL;
+}
+
+static struct bcm2712_iommu *
+bcm2712_iommu_get_by_fwnode(struct fwnode_handle *fwnode)
+{
+ struct device *dev __free(put_device) =
+ bus_find_device_by_fwnode(&platform_bus_type, fwnode);
+
+ return dev ? dev_get_drvdata(dev) : NULL;
+}
+
+static struct iommu_device *bcm2712_iommu_probe_device(struct device *dev)
+{
+ struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+ struct bcm2712_iommu *mmu;
+
+ if (!fwspec || !fwspec->iommu_fwnode)
+ return ERR_PTR(-ENODEV);
+
+ mmu = bcm2712_iommu_get_by_fwnode(fwspec->iommu_fwnode);
+ if (!mmu)
+ return ERR_PTR(-ENODEV);
+
+ dev_iommu_priv_set(dev, mmu);
+
+ return &mmu->iommu;
+}
+
+static int bcm2712_iommu_of_xlate(struct device *dev,
+ const struct of_phandle_args *args)
+{
+ return iommu_fwspec_add_ids(dev, args->args, 0);
+}
+
+static const struct iommu_ops bcm2712_iommu_ops = {
+ .identity_domain = &bcm2712_identity_domain,
+ .blocked_domain = &bcm2712_blocking_domain,
+ .domain_alloc_paging = bcm2712_iommu_domain_alloc,
+ .probe_device = bcm2712_iommu_probe_device,
+ .device_group = generic_single_device_group,
+ .get_resv_regions = iommu_dma_get_resv_regions,
+ .of_xlate = bcm2712_iommu_of_xlate,
+};
+
+static const struct of_device_id bcm2712_iommu_of_match[] = {
+ { .compatible = "brcm,bcm2712-iommu" },
+ { /* sentinel */ }
+};
+
+static int bcm2712_iommu_init_cache(struct bcm2712_iommu *mmu,
+ struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+
+ struct device_node *cache_np __free(device_node) =
+ of_parse_phandle(dev->of_node, "brcm,iommu-cache", 0);
+ if (!cache_np)
+ return dev_err_probe(dev, -ENOENT,
+ "missing brcm,iommu-cache property\n");
+
+ struct platform_device *cache_pdev __free(platform_device_put) =
+ of_find_device_by_node(cache_np);
+ if (!cache_pdev)
+ return dev_err_probe(dev, -EPROBE_DEFER,
+ "waiting for cache device\n");
+
+ mmu->cache = platform_get_drvdata(cache_pdev);
+ if (!mmu->cache)
+ return dev_err_probe(dev, -EPROBE_DEFER,
+ "waiting for cache driver probe\n");
+
+ return 0;
+}
+
+static int bcm2712_iommu_probe(struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+ struct bcm2712_iommu *mmu;
+ int ret;
+
+ mmu = devm_kzalloc(dev, sizeof(*mmu), GFP_KERNEL);
+ if (!mmu)
+ return -ENOMEM;
+
+ mmu->dev = dev;
+ spin_lock_init(&mmu->hw_lock);
+
+ mmu->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(mmu->reg_base))
+ return PTR_ERR(mmu->reg_base);
+
+ ret = bcm2712_iommu_init_cache(mmu, pdev);
+ if (ret)
+ return ret;
+
+ platform_set_drvdata(pdev, mmu);
+ bcm2712_iommu_init(mmu);
+
+ ret = iommu_device_sysfs_add(&mmu->iommu, dev, NULL, "%s",
+ dev_name(dev));
+ if (ret)
+ return ret;
+
+ ret = iommu_device_register(&mmu->iommu, &bcm2712_iommu_ops, dev);
+ if (ret) {
+ iommu_device_sysfs_remove(&mmu->iommu);
+ return ret;
+ }
+
+ return 0;
+}
+
+static struct platform_driver bcm2712_iommu_driver = {
+ .driver = {
+ .name = "bcm2712-iommu",
+ .of_match_table = bcm2712_iommu_of_match,
+ .suppress_bind_attrs = true,
+ },
+ .probe = bcm2712_iommu_probe,
+};
+builtin_platform_driver(bcm2712_iommu_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Daniel Drake <dan@reactivated.net>");
+MODULE_DESCRIPTION("Broadcom BCM2712 IOMMU driver");
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v4 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-09-02 17:57 ` [PATCH v4 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
@ 2026-09-02 22:15 ` Daniel Drake
2026-09-03 18:00 ` Jim Quinlan
0 siblings, 1 reply; 10+ messages in thread
From: Daniel Drake @ 2026-09-02 22:15 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
On 02/09/2026 18:57, Daniel Drake wrote:
> +static int bcm2712_iommu_blocking_attach(struct iommu_domain *blocking_domain,
> + struct device *dev,
> + struct iommu_domain *old)
> +{
> + struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> + int ret = 0;
> +
> + scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
> + /*
> + * Completely block DMA by disabling both the bypass window
> + * and the translation aperture.
> + */
> + bcm2712_iommu_writel(mmu, MMMU_BYPASS_START_OFFSET, 0);
> + bcm2712_iommu_writel(mmu, MMMU_BYPASS_END_OFFSET, 0);
> + bcm2712_iommu_writel(mmu, MMMU_ADDR_CAP_OFFSET,
> + MMMU_ADDR_CAP_ENABLE);
> + bcm2712_iommu_writel(mmu, MMMU_ILLEGAL_ADR_OFFSET, 0);
> + ret = bcm2712_iommu_clear_and_enable(mmu);
> + mmu->domain = NULL;
> + }
My understanding is that when the IOMMU is enabled, the address cap
represents the highest permittable memory address; requests for anything
higher would abort. So I had hoped to achieve blocking mode by setting
ENABLE | 0 in ADDR_CAP, thinking that would set a cap of 0, and hence
memory accesses would fail.
But a Sashiko review pointed out that actually this value would produce
a translation aperture of 256MB, because of the way the register works.
And I confirmed this experimentally, Sashiko is right.
I also confirmed experimentally that setting value 0 to ADDR_CAP (i.e.
dropping the enable bit too), with the IOMMU enabled, results in a full
unrestricted bypass/identity mode.
So unless someone from RPi/Broadcom can inform otherwise, I'm going to
conclude that the hardware doesn't support blocking mode and remove the
blocking domain implementation.
This will cause the iommu layer to fall back to creating an empty paging
domain when blocking mode is requested, which seems appropriate if the
hardware doesn't offer a more direct way of blocking all memory access.
Daniel
^ permalink raw reply [flat|nested] 10+ messages in thread* Re: [PATCH v4 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-09-02 22:15 ` Daniel Drake
@ 2026-09-03 18:00 ` Jim Quinlan
0 siblings, 0 replies; 10+ messages in thread
From: Jim Quinlan @ 2026-09-03 18:00 UTC (permalink / raw)
To: Daniel Drake
Cc: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, iommu, linux-kernel,
devicetree, linux-rpi-kernel, linux-arm-kernel, nick.hollinghurst,
Jason Gunthorpe
[-- Attachment #1: Type: text/plain, Size: 2540 bytes --]
On Wed, Sep 2, 2026 at 6:15 PM Daniel Drake <dan@reactivated.net> wrote:
>
> On 02/09/2026 18:57, Daniel Drake wrote:
> > +static int bcm2712_iommu_blocking_attach(struct iommu_domain *blocking_domain,
> > + struct device *dev,
> > + struct iommu_domain *old)
> > +{
> > + struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> > + int ret = 0;
> > +
> > + scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
> > + /*
> > + * Completely block DMA by disabling both the bypass window
> > + * and the translation aperture.
> > + */
> > + bcm2712_iommu_writel(mmu, MMMU_BYPASS_START_OFFSET, 0);
> > + bcm2712_iommu_writel(mmu, MMMU_BYPASS_END_OFFSET, 0);
> > + bcm2712_iommu_writel(mmu, MMMU_ADDR_CAP_OFFSET,
> > + MMMU_ADDR_CAP_ENABLE);
> > + bcm2712_iommu_writel(mmu, MMMU_ILLEGAL_ADR_OFFSET, 0);
> > + ret = bcm2712_iommu_clear_and_enable(mmu);
> > + mmu->domain = NULL;
> > + }
>
> My understanding is that when the IOMMU is enabled, the address cap
> represents the highest permittable memory address; requests for anything
> higher would abort. So I had hoped to achieve blocking mode by setting
> ENABLE | 0 in ADDR_CAP, thinking that would set a cap of 0, and hence
> memory accesses would fail.
>
> But a Sashiko review pointed out that actually this value would produce
> a translation aperture of 256MB, because of the way the register works.
> And I confirmed this experimentally, Sashiko is right.
>
> I also confirmed experimentally that setting value 0 to ADDR_CAP (i.e.
> dropping the enable bit too), with the IOMMU enabled, results in a full
> unrestricted bypass/identity mode.
>
> So unless someone from RPi/Broadcom can inform otherwise, I'm going to
> conclude that the hardware doesn't support blocking mode and remove the
> blocking domain implementation.
Hi Daniel,
IIRC, the value in this register field -- let's call it X -- is in
256M-sized pages. An access is blocked/capped if iova[39:28] > X.
So it still passes some accesses even if X==0.
Regards,
Jim Quinlan
Broadcom
>
> This will cause the iommu layer to fall back to creating an empty paging
> domain when blocking mode is requested, which seems appropriate if the
> hardware doesn't offer a more direct way of blocking all memory access.
>
> Daniel
>
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5471 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread
* [PATCH v4 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes
2026-09-02 17:57 [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
` (3 preceding siblings ...)
2026-09-02 17:57 ` [PATCH v4 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
@ 2026-09-02 17:57 ` Daniel Drake
2026-09-03 18:14 ` [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Jim Quinlan
5 siblings, 0 replies; 10+ messages in thread
From: Daniel Drake @ 2026-09-02 17:57 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
Define the IOMMU and IOMMUC nodes for the Broadcom BCM2712 SoC found in
the Raspberry Pi 5. Enable use of the IOMMU for the graphics/display
block.
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
index 45aa8ec5e2b1..f40651ea29bb 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
@@ -626,6 +626,19 @@ pcie2: pcie@1000120000 {
status = "disabled";
};
+ iommu4: iommu@1000005200 {
+ /* IOMMU for VC4 (HVS & MPL/TXP), Unicam, PISP-FE, MiniBVN */
+ compatible = "brcm,bcm2712-iommu";
+ reg = <0x10 0x5200 0x0 0x80>;
+ #iommu-cells = <0>;
+ brcm,iommu-cache = <&iommuc>;
+ };
+
+ iommuc: iommuc@1000005b00 {
+ compatible = "brcm,bcm2712-iommuc";
+ reg = <0x10 0x5b00 0x0 0x80>;
+ };
+
mip0: msi-controller@1000130000 {
compatible = "brcm,bcm2712-mip";
reg = <0x10 0x00130000 0x00 0xc0>,
@@ -667,6 +680,7 @@ v3d: gpu@1002000000 {
vc4: gpu {
compatible = "brcm,bcm2712-vc6";
+ iommus = <&iommu4>;
};
timer {
@@ -701,5 +715,6 @@ hvs: hvs@107c580000 {
interrupt-parent = <&disp_intr>;
interrupts = <2>, <9>, <16>;
interrupt-names = "ch0-eof", "ch1-eof", "ch2-eof";
+ iommus = <&iommu4>;
};
};
--
2.55.0
^ permalink raw reply related [flat|nested] 10+ messages in thread* Re: [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5)
2026-09-02 17:57 [PATCH v4 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
` (4 preceding siblings ...)
2026-09-02 17:57 ` [PATCH v4 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes Daniel Drake
@ 2026-09-03 18:14 ` Jim Quinlan
5 siblings, 0 replies; 10+ messages in thread
From: Jim Quinlan @ 2026-09-03 18:14 UTC (permalink / raw)
To: Daniel Drake
Cc: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, iommu, linux-kernel,
devicetree, linux-rpi-kernel, linux-arm-kernel, nick.hollinghurst,
Jason Gunthorpe, Krzysztof Kozlowski
[-- Attachment #1: Type: text/plain, Size: 6579 bytes --]
s
On Wed, Sep 2, 2026 at 1:58 PM Daniel Drake <dan@reactivated.net> wrote:
>
> Hi,
>
> This series adds a driver for the Broadcom BCM2712 IOMMU found on
> Raspberry Pi 5, and hooks up the display controller IOMMU for efficient
> management of graphics memory. This is adapted from the downstream driver
> from Raspberry Pi (original author Nick Hollinghurst), with main changes:
> - In page mapping mode, operate the translation aperture from address 0,
> with no bypass window. More like a IOMMU and less like a GART.
> - Implement the page table management using generic_pt
> - Support 4MB hugepage mapping in top level page table
> - Implement brcm,iommu-cache as standards-compliant DT property
> - Drop the dma-iova-offset hack, used to work around some issue seen with
> dma-ranges. This will need to be investigated separately and solved
> properly. (It's not needed for display controller iommu support included
> here.)
Hi Daniel,
I wish you had kept the dma-iova offset hack but I understand why you
did not. I've built and successfully tested your driver on the
Broadcom sister chip of the RpI 5. I am mostly interested in the
iommu attached to the PCIe controller. I tested this by running
multiple tests where 10MiB is sent by a Wifi chip. Data integrity was
validated of course.
I did not use the driver code as is. I tried merely decrementing the
MMMU_PT_PA_BASE value for the 4GB iova-offset required for our
configuration, but that did not work for some reason. So I just
hacked in some iova conversions and got it working.
At any rate, LGTM and thanks for submitting this.
Regards,
Jim Quinlan
Broadcom
> - Misc simplifications/standardisations/cleanups
>
> The IOMMU works strictly with 4KB pages. This means that unfortunately
> when the kernel is compiled with PAGE_SIZE=16KB (the Raspberry Pi 5
> kernel default), 12KB is wasted in each page that is allocated for page
> tables. I plan to address this in followup work.
>
> It has been tested on Raspberry Pi 5 using a 3D-accelerated graphical
> environment which causes plenty of IOMMU maps & unmaps.
>
> Thanks for the review comments and discussion. Further feedback and
> testing welcome!
>
> Changes in v4:
> - Add Jim Quinlan and Florian Fainelli as bindings maintainers
> - Replace MMU register access macros with static inline functions
> - Clear illegal address register and flush caches on blocking domain attach
> - Add __must_hold annotations in TLB helpers
> - Use BIT() macro for MMUC_CONTROL definitions
> - Link to v3: https://lore.kernel.org/r/20260825-bcm2712-iommu-submit-v3-0-7f143e7289b6@reactivated.net
>
> Changes in v3:
> - Switch from a aperture and bypass window GART-like approach
> to IOMMU-like 0-based translation
> - Add 3 SW bits which seem unused (per the chipset docs); drop patch
> for NO_SW_BIT handling. This reduces the claimed address space, so I had
> to tweak a iommu_pt test accordingly.
> - Disallow domain sharing across multiple hardware IOMMU instances
> - Clear and flush local MMU TLB during domain attach
> - Handle unattached domains safely during TLB sync
> - Set cache platform driver data late during probe to prevent race condition
> - Improved handling of cache flush timeouts
> - Use format string for device name in iommu_device_sysfs_add()
> - Use cleanup.h helpers for scope management
> - Expand DT binding descriptions for IOMMU and IOMMUC
> - Add iommus property to HVS display node in DT
> - Drop iommuc back-compat with current RPi DT
> - Link to v2: https://lore.kernel.org/r/20260727-bcm2712-iommu-submit-v2-0-0247b5c03de8@reactivated.net
>
> Changes in v2:
> - Use iommu_fwspec in xlate & probe_device
> - Add blocked_domain support
> - Simplify page size configuration between iommu driver and format
> - Introduce PT_FEAT_NO_SW_BIT flag to allow formats to explicitly opt-in to
> a defensive flushing algorithm when no sw bit is available
> - Implement 4MB pages at Level 1; this is more efficient and means the
> "allow full-table contiguous leaves in unit tests" commit has been
> dropped because it is no longer needed.
> - Hardcode the aperture in an unused part of the address space, removing
> it from DT (it's a software-specific decision, not an attribute of the
> hardware), adding more explanatory comments
> - Use pt_full_va_prefix to have the PT format operate within the aperture
> space, enabling use of IOMMU_PT_DOMAIN_OPS
> - Add more dt-bindings explanation to brcm,iommu-cache and drop docs
> around the cache property used in RPi firmware (the driver still supports
> this however, for fw compat reasons)
> - Correct iommu device address in bcm2712.dtsi
> - Link to v1: https://lore.kernel.org/r/20260712-bcm2712-iommu-submit-v1-0-80e10cdde2ea@reactivated.net
>
> ---
> Daniel Drake (5):
> iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats
> dt-bindings: iommu: Add Broadcom BCM2712 IOMMU
> iommu/generic_pt: Add Broadcom BCM2712 page table format
> iommu: Add Broadcom BCM2712 IOMMU driver
> arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes
>
> .../bindings/iommu/brcm,bcm2712-iommu.yaml | 54 ++
> .../bindings/iommu/brcm,bcm2712-iommuc.yaml | 40 ++
> arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 15 +
> drivers/iommu/Kconfig | 15 +
> drivers/iommu/Makefile | 1 +
> drivers/iommu/bcm2712-iommu-cache.c | 84 +++
> drivers/iommu/bcm2712-iommu-cache.h | 9 +
> drivers/iommu/bcm2712-iommu.c | 577 +++++++++++++++++++++
> drivers/iommu/generic_pt/.kunitconfig | 1 +
> drivers/iommu/generic_pt/Kconfig | 10 +
> drivers/iommu/generic_pt/fmt/Makefile | 2 +
> drivers/iommu/generic_pt/fmt/bcm2712.h | 288 ++++++++++
> drivers/iommu/generic_pt/fmt/defs_bcm2712.h | 18 +
> drivers/iommu/generic_pt/fmt/iommu_bcm2712.c | 6 +
> drivers/iommu/generic_pt/kunit_iommu_pt.h | 2 +-
> include/linux/generic_pt/common.h | 6 +
> include/linux/generic_pt/iommu.h | 12 +
> 17 files changed, 1139 insertions(+), 1 deletion(-)
> ---
> base-commit: 786262be6048deab760f68c8acc2c85607165894
> change-id: 20260712-bcm2712-iommu-submit-2e09899e65c4
>
> Best regards,
> --
> Daniel Drake <dan@reactivated.net>
>
[-- Attachment #2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 5471 bytes --]
^ permalink raw reply [flat|nested] 10+ messages in thread