* [PATCH v2 1/5] generic_pt: allow missing sw bit in DMA_INCOHERENT case
2026-07-27 20:43 [PATCH v2 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
@ 2026-07-27 20:43 ` Daniel Drake
2026-07-27 20:43 ` [PATCH v2 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU Daniel Drake
` (4 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Daniel Drake @ 2026-07-27 20:43 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, Jason Gunthorpe
When working with a iommu with PT_FEAT_DMA_INCOHERENT set, generic_pt
will attempt to use a spare "SW" bit in the hardware page tables to
denote when a thread has flushed the CPU cache after modifying an entry.
This means that other threads know that they are not working with
cached/unflushed data, if they come across the same entry.
In the case where no SW bit is implemented, an undefined reference to
__pt_no_sw_bit() is created, causing a linker error in order to prompt
the developer to implement this feature.
For BCM2712 IOMMU, no SW bit is available at the hardware level, so we now
need to permit this case.
Introduce a PT_FEAT_NO_SW_BIT flag to allow for this: this will avoid the
sw_bit codepaths, so no undefined reference is created. __map_range() will
fall back to defensive flushing every time it reads the PT, ensuring
that all data that may have just been manipulated by another thread gets
flushed and made iommu-visible immediately.
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/generic_pt/iommu_pt.h | 13 ++++++++-----
drivers/iommu/generic_pt/pt_fmt_defaults.h | 7 +++++++
include/linux/generic_pt/common.h | 7 +++++++
3 files changed, 22 insertions(+), 5 deletions(-)
diff --git a/drivers/iommu/generic_pt/iommu_pt.h b/drivers/iommu/generic_pt/iommu_pt.h
index c2752151c80a..54f9c311d0ac 100644
--- a/drivers/iommu/generic_pt/iommu_pt.h
+++ b/drivers/iommu/generic_pt/iommu_pt.h
@@ -484,7 +484,8 @@ static inline int pt_iommu_new_table(struct pt_state *pts,
if (pts_feature(pts, PT_FEAT_DMA_INCOHERENT)) {
flush_writes_item(pts);
- pt_set_sw_bit_release(pts, SW_BIT_CACHE_FLUSH_DONE);
+ if (!pts_feature(pts, PT_FEAT_NO_SW_BIT))
+ pt_set_sw_bit_release(pts, SW_BIT_CACHE_FLUSH_DONE);
}
if (IS_ENABLED(CONFIG_DEBUG_GENERIC_PT)) {
@@ -702,10 +703,12 @@ static int __map_range(struct pt_range *range, void *arg, unsigned int level,
* release of the cache flush so that this can acquire
* visibility at the iommu.
*/
- if (pts_feature(&pts, PT_FEAT_DMA_INCOHERENT) &&
- !pt_test_sw_bit_acquire(&pts,
- SW_BIT_CACHE_FLUSH_DONE))
- flush_writes_item(&pts);
+ if (pts_feature(&pts, PT_FEAT_DMA_INCOHERENT)) {
+ if (pts_feature(&pts, PT_FEAT_NO_SW_BIT) ||
+ !pt_test_sw_bit_acquire(&pts,
+ SW_BIT_CACHE_FLUSH_DONE))
+ flush_writes_item(&pts);
+ }
}
/*
diff --git a/drivers/iommu/generic_pt/pt_fmt_defaults.h b/drivers/iommu/generic_pt/pt_fmt_defaults.h
index 69fb7c2314ca..72f341645294 100644
--- a/drivers/iommu/generic_pt/pt_fmt_defaults.h
+++ b/drivers/iommu/generic_pt/pt_fmt_defaults.h
@@ -249,6 +249,13 @@ static inline unsigned int pt_max_sw_bit(struct pt_common *common)
return 0;
}
+/*
+ * In the DMA_INCOHERENT case, if no SW bit has been defined, produce a linker
+ * error (undefined symbol __pt_no_sw_bit) to alert the developer that this
+ * should be implemented. Alternatively, if this is not supported by the
+ * underlying hardware, PT_FEAT_NO_SW_BIT can be set, enabling sw-bit-less
+ * operation with a defensive flushing performance penalty.
+ */
extern void __pt_no_sw_bit(void);
static inline bool pt_test_sw_bit_acquire(struct pt_state *pts,
unsigned int bitnr)
diff --git a/include/linux/generic_pt/common.h b/include/linux/generic_pt/common.h
index 07ef1c8341a4..9e8001f7b069 100644
--- a/include/linux/generic_pt/common.h
+++ b/include/linux/generic_pt/common.h
@@ -139,6 +139,13 @@ enum pt_features {
* sub structure with information about which levels were changed.
*/
PT_FEAT_DETAILED_GATHER,
+ /**
+ * @PT_FEAT_NO_SW_BIT: No software bit is available to denote when a
+ * thread has flushed the CPU cache after modifying an entry. Only
+ * set this if you cannot implement pt_sw_bit() due to hardware
+ * limitations.
+ */
+ PT_FEAT_NO_SW_BIT,
/* private: */
PT_FEAT_FMT_START,
};
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v2 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU
2026-07-27 20:43 [PATCH v2 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
2026-07-27 20:43 ` [PATCH v2 1/5] generic_pt: allow missing sw bit in DMA_INCOHERENT case Daniel Drake
@ 2026-07-27 20:43 ` Daniel Drake
2026-07-27 20:43 ` [PATCH v2 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format Daniel Drake
` (3 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Daniel Drake @ 2026-07-27 20:43 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, Jason Gunthorpe
Add bindings for the Broadcom BCM2712 IOMMUs and their shared TLB cache.
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
.../bindings/iommu/brcm,bcm2712-iommu.yaml | 48 ++++++++++++++++++++++
.../bindings/iommu/brcm,bcm2712-iommuc.yaml | 35 ++++++++++++++++
2 files changed, 83 insertions(+)
diff --git a/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml
new file mode 100644
index 000000000000..af4d8bac10e5
--- /dev/null
+++ b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml
@@ -0,0 +1,48 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iommu/brcm,bcm2712-iommu.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Broadcom BCM2712 IOMMU
+
+maintainers:
+ - Daniel Drake <dan@reactivated.net>
+
+description:
+ The BCM2712 IOMMU provides address translation for various hardware blocks
+ on the BCM2712 SoC, such as the VC6 display pipeline.
+
+properties:
+ compatible:
+ const: brcm,bcm2712-iommu
+
+ reg:
+ maxItems: 1
+
+ '#iommu-cells':
+ const: 0
+
+ brcm,iommu-cache:
+ $ref: /schemas/types.yaml#/definitions/phandle
+ description:
+ Phandle to the shared IOMMU cache. The IOMMUC is a shared hardware block
+ that provides centralized Translation Lookaside Buffer (TLB) caching and
+ invalidation.
+
+required:
+ - compatible
+ - reg
+ - '#iommu-cells'
+ - brcm,iommu-cache
+
+additionalProperties: false
+
+examples:
+ - |
+ iommu@5200 {
+ compatible = "brcm,bcm2712-iommu";
+ reg = <0x5200 0x80>;
+ brcm,iommu-cache = <&iommuc>;
+ #iommu-cells = <0>;
+ };
diff --git a/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml
new file mode 100644
index 000000000000..f22e9be2c473
--- /dev/null
+++ b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml
@@ -0,0 +1,35 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iommu/brcm,bcm2712-iommuc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Broadcom BCM2712 Shared IOMMU Cache (IOMMUC)
+
+maintainers:
+ - Daniel Drake <dan@reactivated.net>
+
+description: |
+ The BCM2712 IOMMU Cache (IOMMUC) provides a shared Translation Lookaside
+ Buffer (TLB) cache used by the primary BCM2712 IOMMUs to speed up address
+ translations.
+
+properties:
+ compatible:
+ const: brcm,bcm2712-iommuc
+
+ reg:
+ maxItems: 1
+
+required:
+ - compatible
+ - reg
+
+additionalProperties: false
+
+examples:
+ - |
+ iommuc: iommu-cache@1001000 {
+ compatible = "brcm,bcm2712-iommuc";
+ reg = <0x1001000 0x100>;
+ };
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v2 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format
2026-07-27 20:43 [PATCH v2 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
2026-07-27 20:43 ` [PATCH v2 1/5] generic_pt: allow missing sw bit in DMA_INCOHERENT case Daniel Drake
2026-07-27 20:43 ` [PATCH v2 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU Daniel Drake
@ 2026-07-27 20:43 ` Daniel Drake
2026-07-27 20:43 ` [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
` (2 subsequent siblings)
5 siblings, 0 replies; 9+ messages in thread
From: Daniel Drake @ 2026-07-27 20:43 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, Jason Gunthorpe
Implement generic_pt support for the 2-level page table format used by
the BCM2712 IOMMUs.
Adapted from Raspberry Pi's downstream bcm2712-iommu driver (original
author Nick Hollinghurst).
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/bcm2712-iommu.h | 22 +++
drivers/iommu/generic_pt/.kunitconfig | 1 +
drivers/iommu/generic_pt/Kconfig | 10 +
drivers/iommu/generic_pt/fmt/Makefile | 2 +
drivers/iommu/generic_pt/fmt/bcm2712.h | 283 +++++++++++++++++++++++++++
drivers/iommu/generic_pt/fmt/defs_bcm2712.h | 18 ++
drivers/iommu/generic_pt/fmt/iommu_bcm2712.c | 8 +
include/linux/generic_pt/common.h | 6 +
include/linux/generic_pt/iommu.h | 12 ++
9 files changed, 362 insertions(+)
diff --git a/drivers/iommu/bcm2712-iommu.h b/drivers/iommu/bcm2712-iommu.h
new file mode 100644
index 000000000000..18969b703e8c
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu.h
@@ -0,0 +1,22 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef _BCM2712_IOMMU_H
+#define _BCM2712_IOMMU_H
+
+#include <linux/sizes.h>
+
+/*
+ * Define an aperture inside which IOMMU mappings are operated.
+ *
+ * This aperture must be placed within a high, unused part of the address space:
+ * the IOMMU hardware caps the maximum reachable address at the top of the
+ * aperture, and we ensure that regular RAM/MMIO is available to non-IOMMU-users
+ * by creating a bypass window for all addresses below the aperture start.
+ *
+ * The aperture is hardcoded to 40GiB here, which is safely above RAM/MMIO
+ * on the BCM2712 SoC.
+ */
+#define BCM2712_APERTURE_BASE (40ULL << 30)
+#define BCM2712_APERTURE_SIZE SZ_4G
+#define BCM2712_APERTURE_END (BCM2712_APERTURE_BASE + BCM2712_APERTURE_SIZE)
+
+#endif
diff --git a/drivers/iommu/generic_pt/.kunitconfig b/drivers/iommu/generic_pt/.kunitconfig
index 0bb98fe581fe..a3da74328f12 100644
--- a/drivers/iommu/generic_pt/.kunitconfig
+++ b/drivers/iommu/generic_pt/.kunitconfig
@@ -7,6 +7,7 @@ CONFIG_IOMMU_PT_AMDV1=y
CONFIG_IOMMU_PT_VTDSS=y
CONFIG_IOMMU_PT_RISCV64=y
CONFIG_IOMMU_PT_X86_64=y
+CONFIG_IOMMU_PT_BCM2712=y
CONFIG_IOMMU_PT_KUNIT_TEST=y
CONFIG_IOMMUFD=y
diff --git a/drivers/iommu/generic_pt/Kconfig b/drivers/iommu/generic_pt/Kconfig
index f4ed1add58b7..2a81dac960ac 100644
--- a/drivers/iommu/generic_pt/Kconfig
+++ b/drivers/iommu/generic_pt/Kconfig
@@ -72,6 +72,15 @@ config IOMMU_PT_X86_64
Selected automatically by an IOMMU driver that uses this format.
+config IOMMU_PT_BCM2712
+ tristate "IOMMU page table for Broadcom BCM2712"
+ help
+ iommu_domain implementation for the Broadcom BCM2712 IOMMU found on
+ Raspberry Pi 5. It supports 4K page sizes over a 2-level page table
+ format.
+
+ Selected automatically by an IOMMU driver that uses this format.
+
config IOMMU_PT_KUNIT_TEST
tristate "IOMMU Page Table KUnit Test" if !KUNIT_ALL_TESTS
depends on KUNIT
@@ -79,6 +88,7 @@ config IOMMU_PT_KUNIT_TEST
depends on IOMMU_PT_RISCV64 || !IOMMU_PT_RISCV64
depends on IOMMU_PT_X86_64 || !IOMMU_PT_X86_64
depends on IOMMU_PT_VTDSS || !IOMMU_PT_VTDSS
+ depends on IOMMU_PT_BCM2712 || !IOMMU_PT_BCM2712
default KUNIT_ALL_TESTS
help
Enable kunit tests for GENERIC_PT and IOMMU_PT that covers all the
diff --git a/drivers/iommu/generic_pt/fmt/Makefile b/drivers/iommu/generic_pt/fmt/Makefile
index ea024d582594..82ca3c36823d 100644
--- a/drivers/iommu/generic_pt/fmt/Makefile
+++ b/drivers/iommu/generic_pt/fmt/Makefile
@@ -9,6 +9,8 @@ iommu_pt_fmt-$(CONFIG_IOMMU_PT_RISCV64) += riscv64
iommu_pt_fmt-$(CONFIG_IOMMU_PT_X86_64) += x86_64
+iommu_pt_fmt-$(CONFIG_IOMMU_PT_BCM2712) += bcm2712
+
IOMMU_PT_KUNIT_TEST :=
define create_format
obj-$(2) += iommu_$(1).o
diff --git a/drivers/iommu/generic_pt/fmt/bcm2712.h b/drivers/iommu/generic_pt/fmt/bcm2712.h
new file mode 100644
index 000000000000..83af4e5fa53b
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/bcm2712.h
@@ -0,0 +1,283 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2026 Daniel Drake
+ *
+ * BCM2712 IOMMU simple two level page table
+ */
+#ifndef __GENERIC_PT_FMT_BCM2712_H
+#define __GENERIC_PT_FMT_BCM2712_H
+
+#include "defs_bcm2712.h"
+#include "../pt_defs.h"
+
+#include <linux/bitfield.h>
+#include <linux/container_of.h>
+#include <linux/log2.h>
+#include <linux/sizes.h>
+
+#include "../../bcm2712-iommu.h"
+
+enum {
+ /* Hardware provides a two-level page table */
+ PT_MAX_TOP_LEVEL = 1,
+
+ /* Hardware page size is strictly 4kb */
+ PT_GRANULE_LG2SZ = ilog2(SZ_4K),
+ PT_TABLEMEM_LG2SZ = PT_GRANULE_LG2SZ,
+
+ /* Table entries and leaf entries are 32 bits */
+ PT_ITEM_WORD_SIZE = sizeof(pt_bcm2712_entry_t),
+
+ /* Leaf entries encode a 28-bit PFN */
+ PT_MAX_OUTPUT_ADDRESS_LG2 = 28 + PT_GRANULE_LG2SZ,
+
+ /*
+ * For simplicity, only manage mappings within an address space of
+ * exactly 4GB. This is because our Level 1 directory page will be 4kb
+ * in the smallest case, permitting 1024 entries pointing at Level 0
+ * pages, each permitting 4mb of mapped memory.
+ */
+ PT_MAX_VA_ADDRESS_LG2 = ilog2(SZ_4G),
+
+ /* Level 1 base address is programmed as a 32-bit PFN */
+ PT_TOP_PHYS_MASK = GENMASK_ULL(31 + PT_GRANULE_LG2SZ, PT_GRANULE_LG2SZ),
+};
+
+/* PTE bits */
+enum {
+ BCM2712PT_VALID = BIT(28),
+ BCM2712PT_WRITE = BIT(29),
+ BCM2712PT_PAGESIZE = GENMASK(31, 30),
+ BCM2712PT_PFN = GENMASK(27, 0),
+};
+
+#define common_to_bcm2712pt(common_ptr) \
+ container_of_const(common_ptr, struct pt_bcm2712, common)
+#define to_bcm2712pt(pts) common_to_bcm2712pt((pts)->range->common)
+
+static inline pt_oaddr_t bcm2712pt_table_pa(const struct pt_state *pts)
+{
+ return oalog2_mul(FIELD_GET(BCM2712PT_PFN, pts->entry),
+ PT_GRANULE_LG2SZ);
+}
+#define pt_table_pa bcm2712pt_table_pa
+#define pt_item_oa bcm2712pt_table_pa
+
+/*
+ * IOPTEs placed within the page table correspond to addresses within the
+ * preconfigured aperture.
+ */
+static inline pt_vaddr_t
+bcm2712pt_full_va_prefix(const struct pt_common *common)
+{
+ return BCM2712_APERTURE_BASE;
+}
+#define pt_full_va_prefix bcm2712pt_full_va_prefix
+
+static inline bool bcm2712pt_can_have_leaf(const struct pt_state *pts)
+{
+ return true;
+}
+#define pt_can_have_leaf bcm2712pt_can_have_leaf
+
+/* 4MB pages are installed at level 1, everything else at level 0 */
+static inline unsigned int bcm2712pt_pgsz_lg2_to_level(struct pt_common *common,
+ unsigned int pgsize_lg2)
+{
+ return pgsize_lg2 == ilog2(SZ_4M) ? 1 : 0;
+}
+#define pt_pgsz_lg2_to_level bcm2712pt_pgsz_lg2_to_level
+
+static inline pt_vaddr_t bcm2712pt_possible_sizes(const struct pt_state *pts)
+{
+ struct pt_bcm2712 *table = common_to_bcm2712pt(pts->range->common);
+
+ if (pts->level == 1)
+ return SZ_4M;
+
+ return SZ_4K |
+ (table->bigpage_lg2 ? BIT_ULL(table->bigpage_lg2) : 0) |
+ (table->superpage_lg2 ? BIT_ULL(table->superpage_lg2) : 0);
+}
+#define pt_possible_sizes bcm2712pt_possible_sizes
+
+static inline unsigned int
+bcm2712pt_entry_num_contig_lg2(const struct pt_state *pts)
+{
+ struct pt_bcm2712 *table = common_to_bcm2712pt(pts->range->common);
+ u32 pgsz = FIELD_GET(BCM2712PT_PAGESIZE, pts->entry);
+
+ if (pts->level != 0 || !(pts->entry & BCM2712PT_VALID))
+ return 0;
+
+ /*
+ * Superpage/bigpage contiguous mapping (really just hinting) is handled
+ * via PAGESIZE bits on each leaf entry.
+ */
+ if (pgsz == 2 && table->superpage_lg2)
+ return table->superpage_lg2 - PT_GRANULE_LG2SZ;
+ else if (pgsz == 1 && table->bigpage_lg2)
+ return table->bigpage_lg2 - PT_GRANULE_LG2SZ;
+ return 0;
+}
+#define pt_entry_num_contig_lg2 bcm2712pt_entry_num_contig_lg2
+
+static inline unsigned int bcm2712pt_num_items_lg2(const struct pt_state *pts)
+{
+ return PT_TABLEMEM_LG2SZ - ilog2(PT_ITEM_WORD_SIZE);
+}
+#define pt_num_items_lg2 bcm2712pt_num_items_lg2
+
+static inline enum pt_entry_type bcm2712pt_load_entry_raw(struct pt_state *pts)
+{
+ const pt_bcm2712_entry_t *tablep =
+ pt_cur_table(pts, pt_bcm2712_entry_t);
+
+ pts->entry = READ_ONCE(tablep[pts->index]);
+ if (!(pts->entry & BCM2712PT_VALID))
+ return PT_ENTRY_EMPTY;
+
+ if (pts->level == 1) {
+ if (FIELD_GET(BCM2712PT_PAGESIZE, pts->entry) == 3)
+ return PT_ENTRY_OA;
+ return PT_ENTRY_TABLE;
+ }
+
+ return PT_ENTRY_OA;
+}
+#define pt_load_entry_raw bcm2712pt_load_entry_raw
+
+static inline void
+bcm2712pt_install_leaf_entry(struct pt_state *pts, pt_oaddr_t oa,
+ unsigned int oasz_lg2,
+ const struct pt_write_attrs *attrs)
+{
+ pt_bcm2712_entry_t *tablep = pt_cur_table(pts, pt_bcm2712_entry_t);
+ pt_bcm2712_entry_t entry;
+
+ if (!pt_check_install_leaf_args(pts, oa, oasz_lg2))
+ return;
+
+ entry = BCM2712PT_VALID | attrs->descriptor_bits |
+ FIELD_PREP(BCM2712PT_PFN, oalog2_div(oa, PT_GRANULE_LG2SZ));
+
+ if (pts->level == 1) {
+ /* Level 1 hugepage (4MB) */
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 3);
+ WRITE_ONCE(tablep[pts->index], entry);
+ pts->entry = entry;
+ return;
+ }
+
+ if (oasz_lg2 == PT_GRANULE_LG2SZ) {
+ WRITE_ONCE(tablep[pts->index], entry);
+ pts->entry = entry;
+ } else {
+ struct pt_bcm2712 *table =
+ common_to_bcm2712pt(pts->range->common);
+ u32 *end;
+
+ tablep += pts->index;
+ end = tablep + log2_to_int(oasz_lg2 - PT_GRANULE_LG2SZ);
+
+ /*
+ * Leaf entries can contain hints indicating bigpage/superpage
+ * contiguous mappings to permit TLB optimization
+ */
+ if (oasz_lg2 == table->superpage_lg2)
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 2);
+ else if (oasz_lg2 == table->bigpage_lg2)
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 1);
+
+ pts->entry = entry;
+ for (; tablep != end; tablep++, entry++)
+ WRITE_ONCE(*tablep, entry);
+ }
+}
+#define pt_install_leaf_entry bcm2712pt_install_leaf_entry
+
+static inline bool bcm2712pt_install_table(struct pt_state *pts,
+ pt_oaddr_t table_pa,
+ const struct pt_write_attrs *attrs)
+{
+ pt_bcm2712_entry_t entry =
+ BCM2712PT_VALID |
+ FIELD_PREP(BCM2712PT_PFN,
+ oalog2_div(table_pa, PT_GRANULE_LG2SZ));
+
+ return pt_table_install32(pts, entry);
+}
+#define pt_install_table bcm2712pt_install_table
+
+static inline void bcm2712pt_attr_from_entry(const struct pt_state *pts,
+ struct pt_write_attrs *attrs)
+{
+ attrs->descriptor_bits = pts->entry & BCM2712PT_WRITE;
+}
+#define pt_attr_from_entry bcm2712pt_attr_from_entry
+
+/* --- iommu */
+#include <linux/generic_pt/iommu.h>
+#include <linux/iommu.h>
+
+#define pt_iommu_table pt_iommu_bcm2712
+
+/* The common struct is in the per-format common struct */
+static inline struct pt_common *common_from_iommu(struct pt_iommu *iommu_table)
+{
+ return &container_of(iommu_table, struct pt_iommu_table, iommu)
+ ->bcm2712pt.common;
+}
+
+static inline struct pt_iommu *iommu_from_common(struct pt_common *common)
+{
+ return &container_of(common, struct pt_iommu_table, bcm2712pt.common)
+ ->iommu;
+}
+
+static inline int bcm2712_pt_iommu_set_prot(struct pt_common *common,
+ struct pt_write_attrs *attrs,
+ unsigned int iommu_prot)
+{
+ attrs->descriptor_bits = 0;
+ if (iommu_prot & IOMMU_WRITE)
+ attrs->descriptor_bits |= BCM2712PT_WRITE;
+ return 0;
+}
+#define pt_iommu_set_prot bcm2712_pt_iommu_set_prot
+
+static inline int bcm2712_pt_fmt_init(struct pt_iommu_table *fmt_table,
+ const struct pt_iommu_bcm2712_cfg *cfg)
+{
+ fmt_table->bcm2712pt.bigpage_lg2 = cfg->bigpage_lg2;
+ fmt_table->bcm2712pt.superpage_lg2 = cfg->superpage_lg2;
+
+ pt_top_set_level(&fmt_table->bcm2712pt.common, PT_MAX_TOP_LEVEL);
+ return 0;
+}
+#define pt_iommu_fmt_init bcm2712_pt_fmt_init
+
+static inline void
+bcm2712pt_iommu_fmt_hw_info(struct pt_iommu_bcm2712 *table,
+ const struct pt_range *top_range,
+ struct pt_iommu_bcm2712_hw_info *info)
+{
+ info->pt_base = virt_to_phys(top_range->top_table);
+ PT_WARN_ON(info->pt_base & ~PT_TOP_PHYS_MASK);
+}
+#define pt_iommu_fmt_hw_info bcm2712pt_iommu_fmt_hw_info
+
+#if defined(GENERIC_PT_KUNIT)
+static const struct pt_iommu_bcm2712_cfg bcm2712_kunit_fmt_cfgs[] = {
+ [0] = {
+ .common.hw_max_vasz_lg2 = 32,
+ .common.hw_max_oasz_lg2 = 40,
+ .bigpage_lg2 = 16,
+ .superpage_lg2 = 20,
+ },
+};
+#define kunit_fmt_cfgs bcm2712_kunit_fmt_cfgs
+enum { KUNIT_FMT_FEATURES = 0 };
+#endif
+
+#endif
diff --git a/drivers/iommu/generic_pt/fmt/defs_bcm2712.h b/drivers/iommu/generic_pt/fmt/defs_bcm2712.h
new file mode 100644
index 000000000000..f1d983be1716
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/defs_bcm2712.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef __GENERIC_PT_FMT_DEFS_BCM2712_H
+#define __GENERIC_PT_FMT_DEFS_BCM2712_H
+
+#include <linux/generic_pt/common.h>
+#include <linux/types.h>
+
+typedef u32 pt_bcm2712_entry_t;
+typedef u64 pt_vaddr_t;
+typedef u64 pt_oaddr_t;
+
+struct bcm2712pt_write_attrs {
+ pt_bcm2712_entry_t descriptor_bits;
+ gfp_t gfp;
+};
+#define pt_write_attrs bcm2712pt_write_attrs
+
+#endif
diff --git a/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c b/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c
new file mode 100644
index 000000000000..855a3a07fb63
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c
@@ -0,0 +1,8 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#define PT_FMT bcm2712
+#define PT_SUPPORTED_FEATURES (BIT(PT_FEAT_DMA_INCOHERENT) | BIT(PT_FEAT_NO_SW_BIT))
+/* BCM2712 has no spare software bits for tracking cache flushes */
+#define PT_FORCE_ENABLED_FEATURES BIT(PT_FEAT_NO_SW_BIT)
+
+#include <linux/generic_pt/iommu.h>
+#include "iommu_template.h"
diff --git a/include/linux/generic_pt/common.h b/include/linux/generic_pt/common.h
index 9e8001f7b069..073332de7400 100644
--- a/include/linux/generic_pt/common.h
+++ b/include/linux/generic_pt/common.h
@@ -220,4 +220,10 @@ enum {
PT_FEAT_X86_64_AMD_ENCRYPT_TABLES = PT_FEAT_FMT_START,
};
+struct pt_bcm2712 {
+ struct pt_common common;
+ u8 bigpage_lg2;
+ u8 superpage_lg2;
+};
+
#endif
diff --git a/include/linux/generic_pt/iommu.h b/include/linux/generic_pt/iommu.h
index dd0edd02a48a..13ebb72a67de 100644
--- a/include/linux/generic_pt/iommu.h
+++ b/include/linux/generic_pt/iommu.h
@@ -346,6 +346,18 @@ struct pt_iommu_x86_64_hw_info {
IOMMU_FORMAT(x86_64, x86_64_pt);
+struct pt_iommu_bcm2712_cfg {
+ struct pt_iommu_cfg common;
+ u8 bigpage_lg2;
+ u8 superpage_lg2;
+};
+
+struct pt_iommu_bcm2712_hw_info {
+ phys_addr_t pt_base;
+};
+
+IOMMU_FORMAT(bcm2712, bcm2712pt);
+
#undef IOMMU_PROTOTYPES
#undef IOMMU_FORMAT
#endif
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-07-27 20:43 [PATCH v2 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
` (2 preceding siblings ...)
2026-07-27 20:43 ` [PATCH v2 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format Daniel Drake
@ 2026-07-27 20:43 ` Daniel Drake
2026-07-28 10:51 ` Robin Murphy
2026-07-27 20:44 ` [PATCH v2 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes Daniel Drake
2026-07-28 22:57 ` [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Jim Quinlan
5 siblings, 1 reply; 9+ messages in thread
From: Daniel Drake @ 2026-07-27 20:43 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, Jason Gunthorpe
This IOMMU translates memory access requests for the VC6 display
pipeline and various multimedia devices in the Broadcom BCM2712 SoC used
on Raspberry Pi 5.
This driver places a 4GB aperture at a high memory address in which the
IOMMU mappings are operated. All addresses outside this window bypass the
translation logic and give direct access to physical memory.
Also includes support for the IOMMU cache, which is shared between
all the IOMMU devices found on the SoC.
Adapted from Raspberry Pi's downstream bcm2712-iommu driver
(original author Nick Hollinghurst).
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/Kconfig | 15 +
drivers/iommu/Makefile | 1 +
drivers/iommu/bcm2712-iommu-cache.c | 73 +++++
drivers/iommu/bcm2712-iommu.c | 582 ++++++++++++++++++++++++++++++++++++
drivers/iommu/bcm2712-iommu.h | 4 +
5 files changed, 675 insertions(+)
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 6e07bd69467a..f2c8788158b0 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -386,6 +386,21 @@ config VSI_IOMMU
Say Y here if you want to use this IOMMU in front of these
hardware blocks.
+config BCM2712_IOMMU
+ bool "BCM2712 IOMMU driver"
+ depends on (ARCH_BCM && ARM64) || COMPILE_TEST
+ select IOMMU_API
+ select GENERIC_PT
+ select IOMMU_PT
+ select IOMMU_PT_BCM2712
+ help
+ Support for IOMMU on BCM2712 SoC. This IOMMU can be used by the
+ display controller and various multimedia devices to perform
+ efficient memory management.
+
+ Say Y here if you want to use this IOMMU in front of these
+ hardware blocks.
+
config IOMMU_DEBUG_PAGEALLOC
bool "Debug IOMMU mappings against page allocations"
depends on DEBUG_PAGEALLOC && IOMMU_API && PAGE_EXTENSION
diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
index 2f05725eaab1..29a26d2a3af1 100644
--- a/drivers/iommu/Makefile
+++ b/drivers/iommu/Makefile
@@ -37,4 +37,5 @@ obj-$(CONFIG_IOMMU_IOPF) += io-pgfault.o
obj-$(CONFIG_SPRD_IOMMU) += sprd-iommu.o
obj-$(CONFIG_APPLE_DART) += apple-dart.o
obj-$(CONFIG_VSI_IOMMU) += vsi-iommu.o
+obj-$(CONFIG_BCM2712_IOMMU) += bcm2712-iommu.o bcm2712-iommu-cache.o
obj-$(CONFIG_IOMMU_DEBUG_PAGEALLOC) += iommu-debug-pagealloc.o
diff --git a/drivers/iommu/bcm2712-iommu-cache.c b/drivers/iommu/bcm2712-iommu-cache.c
new file mode 100644
index 000000000000..d97a8cda448e
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu-cache.c
@@ -0,0 +1,73 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * IOMMU driver for BCM2712 TLB cache
+ *
+ * Copyright (c) 2023 Raspberry Pi Ltd.
+ */
+
+#include <linux/err.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/iopoll.h>
+
+#include "bcm2712-iommu.h"
+
+struct bcm2712_iommu_cache {
+ spinlock_t hw_lock;
+ void __iomem *reg_base;
+};
+
+#define MMUC_CONTROL_ENABLE 1
+#define MMUC_CONTROL_FLUSH 2
+#define MMUC_CONTROL_FLUSHING 4
+
+void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache)
+{
+ unsigned long flags;
+ u32 val;
+
+ spin_lock_irqsave(&cache->hw_lock, flags);
+
+ /* Enable and flush the TLB cache */
+ writel(MMUC_CONTROL_ENABLE | MMUC_CONTROL_FLUSH, cache->reg_base);
+
+ /* Wait for flush to complete: it should be very quick */
+ readl_poll_timeout_atomic(cache->reg_base, val,
+ !(val & MMUC_CONTROL_FLUSHING), 0, 1000);
+
+ spin_unlock_irqrestore(&cache->hw_lock, flags);
+}
+
+static int bcm2712_iommu_cache_probe(struct platform_device *pdev)
+{
+ struct bcm2712_iommu_cache *cache;
+
+ cache = devm_kzalloc(&pdev->dev, sizeof(*cache), GFP_KERNEL);
+ if (!cache)
+ return -ENOMEM;
+
+ platform_set_drvdata(pdev, cache);
+ spin_lock_init(&cache->hw_lock);
+
+ cache->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(cache->reg_base))
+ return PTR_ERR(cache->reg_base);
+
+ return 0;
+}
+
+static const struct of_device_id bcm2712_iommu_cache_of_match[] = {
+ { .compatible = "brcm,bcm2712-iommuc" },
+ { /* sentinel */ },
+};
+
+static struct platform_driver bcm2712_iommu_cache_driver = {
+ .probe = bcm2712_iommu_cache_probe,
+ .driver = {
+ .name = "bcm2712-iommu-cache",
+ .of_match_table = bcm2712_iommu_cache_of_match,
+ .suppress_bind_attrs = true,
+ },
+};
+builtin_platform_driver(bcm2712_iommu_cache_driver);
diff --git a/drivers/iommu/bcm2712-iommu.c b/drivers/iommu/bcm2712-iommu.c
new file mode 100644
index 000000000000..55678009f9c4
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu.c
@@ -0,0 +1,582 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * IOMMU driver for Broadcom BCM2712
+ *
+ * Copyright (c) 2023-2025 Raspberry Pi Ltd.
+ * Copyright (c) 2026 Daniel Drake
+ *
+ * Each BCM2712 IOMMU has multiple devices hardwired into it, whose
+ * DMA transactions all route through the IOMMU. There is no stream ID tagging
+ * or any other kind of segmentation to differentiate between requests from
+ * different devices. It is also not possible to toggle a specific device
+ * between iommu-mapped and bypass modes.
+ *
+ * With these limitations in mind, we configure the hardware to operate over two
+ * windows:
+ * 1. The lower part of the address space operates in identity/bypass mode.
+ * This enables non-IOMMU-consumer devices to work as normal (including
+ * devices set up by the firmware, devices that don't require large DMA
+ * allocations, devices that handle scatter-gather natively, etc.)
+ * 2. A 4GB translation aperture is defined at a fixed, high address, beyond
+ * regular RAM and MMIO space. Mappings are operated in this aperture for
+ * devices that wish to take advantage of the IOMMU.
+ *
+ * The BCM2712 SoC contains multiple independent IOMMU hardware instances.
+ * The same aperture address is used across all of them; they do not conflict
+ * because these IOVA spaces are strictly localized to each IOMMU instance.
+ *
+ * The page table format is a two-level format handled by generic_pt/bcm2712.
+ */
+
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/iommu.h>
+#include <linux/iopoll.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/sizes.h>
+#include <linux/generic_pt/iommu.h>
+
+#include "iommu-pages.h"
+#include "bcm2712-iommu.h"
+
+/* BCM2712 IOMMU is organized around 4Kbyte pages */
+#define IOMMU_PAGE_SHIFT 12
+#define IOMMU_PAGE_SIZE (1ul << IOMMU_PAGE_SHIFT)
+/* A PTE is 4 bytes */
+#define PTE_SIZE_SHIFT 2
+/* L1/L2 table sizing (IOMMU hardware pages): 1024 entries per page */
+#define PTES_PER_IOPG_SHIFT (IOMMU_PAGE_SHIFT - PTE_SIZE_SHIFT)
+/* An iommu hugepage covers 4MB */
+#define IOMMU_HUGEPAGE_SHIFT (IOMMU_PAGE_SHIFT + PTES_PER_IOPG_SHIFT)
+
+
+#define MMMU_CTRL_OFFSET 0x00
+#define MMMU_CTRL_CAP_EXCEEDED BIT(27)
+#define MMMU_CTRL_CAP_EXCEEDED_ABORT_EN BIT(26)
+#define MMMU_CTRL_CAP_EXCEEDED_INT_EN BIT(25)
+#define MMMU_CTRL_CAP_EXCEEDED_EXCEPTION_EN BIT(24)
+#define MMMU_CTRL_PT_INVALID BIT(20)
+#define MMMU_CTRL_PT_INVALID_ABORT_EN BIT(19)
+#define MMMU_CTRL_PT_INVALID_INT_EN BIT(18)
+#define MMMU_CTRL_PT_INVALID_EXCEPTION_EN BIT(17)
+#define MMMU_CTRL_PT_INVALID_EN BIT(16)
+#define MMMU_CTRL_WRITE_VIOLATION BIT(12)
+#define MMMU_CTRL_WRITE_VIOLATION_ABORT_EN BIT(11)
+#define MMMU_CTRL_WRITE_VIOLATION_INT_EN BIT(10)
+#define MMMU_CTRL_WRITE_VIOLATION_EXCEPTION_EN BIT(9)
+#define MMMU_CTRL_BYPASS BIT(8)
+#define MMMU_CTRL_TLB_CLEARING BIT(7)
+#define MMMU_CTRL_STATS_CLEAR BIT(3)
+#define MMMU_CTRL_TLB_CLEAR BIT(2)
+#define MMMU_CTRL_STATS_ENABLE BIT(1)
+#define MMMU_CTRL_ENABLE BIT(0)
+
+#define MMMU_CTRL_OPERATING_FLAGS (\
+ MMMU_CTRL_CAP_EXCEEDED_ABORT_EN | \
+ MMMU_CTRL_PT_INVALID_ABORT_EN | \
+ MMMU_CTRL_PT_INVALID_EN | \
+ MMMU_CTRL_WRITE_VIOLATION_ABORT_EN | \
+ MMMU_CTRL_STATS_ENABLE | \
+ MMMU_CTRL_ENABLE)
+
+#define MMMU_PT_PA_BASE_OFFSET 0x04
+
+#define MMMU_ADDR_CAP_OFFSET 0x14
+#define MMMU_ADDR_CAP_ENABLE BIT(31)
+#define ADDR_CAP_SHIFT ilog2(SZ_256M)
+
+#define MMMU_SHOOT_DOWN_OFFSET 0x18
+#define MMMU_SHOOT_DOWN_SHOOTING BIT(31)
+#define MMMU_SHOOT_DOWN_SHOOT BIT(30)
+
+#define MMMU_BYPASS_START_OFFSET 0x1c
+#define MMMU_BYPASS_START_ENABLE BIT(31)
+
+#define MMMU_BYPASS_END_OFFSET 0x20
+#define MMMU_BYPASS_END_ENABLE BIT(31)
+
+#define MMMU_MISC_OFFSET 0x24
+#define MMMU_MISC_SINGLE_TABLE BIT(31)
+
+#define MMMU_ILLEGAL_ADR_OFFSET 0x30
+#define MMMU_ILLEGAL_ADR_ENABLE BIT(31)
+
+#define MMMU_DEBUG_INFO_OFFSET 0x38
+#define MMMU_DEBUG_INFO_VERSION_MASK 0x0000000Fu
+#define MMMU_DEBUG_INFO_VA_WIDTH_MASK 0x000000F0u
+#define MMMU_DEBUG_INFO_PA_WIDTH_MASK 0x00000F00u
+#define MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK 0x000FF000u
+#define MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK 0x0FF00000u
+#define MMMU_DEBUG_INFO_BYPASS_4M BIT(28)
+#define MMMU_DEBUG_INFO_BYPASS BIT(29)
+
+struct bcm2712_iommu {
+ struct device *dev;
+ struct iommu_device iommu;
+ struct bcm2712_iommu_domain *domain;
+ struct bcm2712_iommu_cache *cache;
+ void __iomem *reg_base;
+ spinlock_t hw_lock;
+ size_t bigpage_size;
+ size_t superpage_size;
+};
+
+struct bcm2712_iommu_domain {
+ union {
+ struct iommu_domain base;
+ struct pt_iommu_bcm2712 pt;
+ };
+ struct bcm2712_iommu *mmu;
+ void *default_page;
+};
+
+#define MMU_WR(off, val) writel(val, mmu->reg_base + (off))
+#define MMU_RD(off) readl(mmu->reg_base + (off))
+
+#define domain_to_mmu(d) \
+ (container_of(d, struct bcm2712_iommu_domain, base)->mmu)
+
+static struct bcm2712_iommu_domain *
+to_bcm2712_domain(struct iommu_domain *domain)
+{
+ return container_of(domain, struct bcm2712_iommu_domain, base);
+}
+
+static void bcm2712_iommu_init(struct bcm2712_iommu *mmu)
+{
+ unsigned int bigpage_width, superpage_width;
+ u32 u = MMU_RD(MMMU_DEBUG_INFO_OFFSET);
+ u32 pa_width = FIELD_GET(MMMU_DEBUG_INFO_PA_WIDTH_MASK, u);
+
+ dev_dbg(mmu->dev, "DEBUG_INFO = 0x%08x\n", u);
+ WARN_ON(FIELD_GET(MMMU_DEBUG_INFO_VERSION_MASK, u) < 4 ||
+ FIELD_GET(MMMU_DEBUG_INFO_VA_WIDTH_MASK, u) < 6 ||
+ pa_width < 6 || !(u & MMMU_DEBUG_INFO_BYPASS));
+
+ dma_set_mask_and_coherent(mmu->dev, DMA_BIT_MASK(pa_width + 30u));
+
+ bigpage_width = FIELD_GET(MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK, u);
+ if (bigpage_width)
+ mmu->bigpage_size = IOMMU_PAGE_SIZE << bigpage_width;
+
+ superpage_width = FIELD_GET(MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK, u);
+ if (superpage_width)
+ mmu->superpage_size = IOMMU_PAGE_SIZE << superpage_width;
+
+ /* Disable MMU and clear sticky flags; meanwhile flush the TLB */
+ MMU_WR(MMMU_CTRL_OFFSET, MMMU_CTRL_CAP_EXCEEDED | MMMU_CTRL_PT_INVALID |
+ MMMU_CTRL_WRITE_VIOLATION |
+ MMMU_CTRL_STATS_CLEAR |
+ MMMU_CTRL_TLB_CLEAR);
+
+ /* Put MMU into 2-level mode */
+ MMU_WR(MMMU_MISC_OFFSET,
+ MMU_RD(MMMU_MISC_OFFSET) & ~MMMU_MISC_SINGLE_TABLE);
+}
+
+/*
+ * Since the BCM2712 IOMMU is address-based (not device based), we don't
+ * need to change any hardware state to support identity mapping.
+ * The IOMMU is natively bypassed for addresses outside the aperture.
+ */
+static int bcm2712_iommu_identity_attach(struct iommu_domain *identity_domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ unsigned long flags;
+
+ spin_lock_irqsave(&mmu->hw_lock, flags);
+ MMU_WR(MMMU_CTRL_OFFSET, 0);
+ mmu->domain = NULL;
+ spin_unlock_irqrestore(&mmu->hw_lock, flags);
+
+ return 0;
+}
+
+static struct iommu_domain bcm2712_identity_domain = {
+ .type = IOMMU_DOMAIN_IDENTITY,
+ .ops = &(const struct iommu_domain_ops) {
+ .attach_dev = bcm2712_iommu_identity_attach,
+ },
+};
+
+static int bcm2712_iommu_blocking_attach(struct iommu_domain *blocking_domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ unsigned long flags;
+
+ spin_lock_irqsave(&mmu->hw_lock, flags);
+
+ /*
+ * To completely block DMA:
+ * 1. Disable the bypass window (requests outside aperture will abort).
+ * 2. Set the address cap to 0 (requests inside aperture will abort).
+ */
+ MMU_WR(MMMU_BYPASS_START_OFFSET, 0);
+ MMU_WR(MMMU_BYPASS_END_OFFSET, 0);
+ MMU_WR(MMMU_ADDR_CAP_OFFSET, MMMU_ADDR_CAP_ENABLE);
+
+ MMU_WR(MMMU_CTRL_OFFSET, MMMU_CTRL_OPERATING_FLAGS);
+
+ mmu->domain = NULL;
+ spin_unlock_irqrestore(&mmu->hw_lock, flags);
+
+ return 0;
+}
+
+static struct iommu_domain bcm2712_blocking_domain = {
+ .type = IOMMU_DOMAIN_BLOCKED,
+ .ops = &(const struct iommu_domain_ops) {
+ .attach_dev = bcm2712_iommu_blocking_attach,
+ },
+};
+
+static int bcm2712_iommu_attach_dev(struct iommu_domain *domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
+ struct pt_iommu_bcm2712_hw_info info;
+ u32 default_page_pfn, u;
+ unsigned int byp_shift;
+ unsigned long flags;
+
+ spin_lock_irqsave(&mmu->hw_lock, flags);
+
+ if (mmu->domain == mydomain)
+ goto unlock;
+
+ mmu->domain = mydomain;
+
+ /*
+ * This driver is for VC IOMMU version >= 4 and assumes at least 36
+ * bits of virtual and physical address space.
+ */
+ u = MMU_RD(MMMU_DEBUG_INFO_OFFSET);
+ byp_shift = (u & MMMU_DEBUG_INFO_BYPASS_4M) ? IOMMU_HUGEPAGE_SHIFT :
+ ADDR_CAP_SHIFT;
+
+ /*
+ * Set address cap and bypass range (note unintuitive off-by-ones).
+ * Requests to the bypass window pass straight through unchanged: this
+ * is useful for blocks which share an IOMMU with other blocks whose
+ * drivers are not IOMMU-aware.
+ */
+ MMU_WR(MMMU_ADDR_CAP_OFFSET,
+ MMMU_ADDR_CAP_ENABLE +
+ (BCM2712_APERTURE_END >> ADDR_CAP_SHIFT) - 1);
+ MMU_WR(MMMU_BYPASS_START_OFFSET, 0);
+ MMU_WR(MMMU_BYPASS_END_OFFSET,
+ MMMU_BYPASS_END_ENABLE + (BCM2712_APERTURE_BASE >> byp_shift));
+
+ /*
+ * When the IOMMU handles a request, it adds the PT_PA_BASE_OFFSET to
+ * (IOVA>>32) to calculate the PFN of the corresponding L1 directory page.
+ * IOVA bits [31:22] are then used to fetch the L1 descriptor within
+ * (which in turn points to the L2 table).
+ * This clever logic would allow for a L1 table larger than 4kb (and hence
+ * a larger aperture.
+ */
+ pt_iommu_bcm2712_hw_info(&mydomain->pt, &info);
+ MMU_WR(MMMU_PT_PA_BASE_OFFSET, (info.pt_base >> IOMMU_PAGE_SHIFT) -
+ (BCM2712_APERTURE_BASE >> 32));
+
+ /* Set up a default (error) page used to catch illegal reads/writes */
+ default_page_pfn = virt_to_phys(mydomain->default_page) >>
+ IOMMU_PAGE_SHIFT;
+ MMU_WR(MMMU_ILLEGAL_ADR_OFFSET,
+ MMMU_ILLEGAL_ADR_ENABLE + default_page_pfn);
+
+ /* Flush (and enable) the shared TLB cache; enable this MMU. */
+ bcm2712_iommu_cache_flush(mmu->cache);
+ MMU_WR(MMMU_CTRL_OFFSET, MMMU_CTRL_OPERATING_FLAGS);
+
+unlock:
+ spin_unlock_irqrestore(&mmu->hw_lock, flags);
+ return 0;
+}
+
+static void bcm2712_iommu_shootdown_range(struct bcm2712_iommu *mmu,
+ unsigned long iova, size_t size)
+{
+ unsigned long iova_end = iova + size - 1;
+ unsigned int page_group;
+ u32 val;
+
+ /* Shootdown register deals with 4 pages at a time */
+ for (page_group = iova >> (IOMMU_PAGE_SHIFT + 2);
+ page_group <= iova_end >> (IOMMU_PAGE_SHIFT + 2); page_group++) {
+ MMU_WR(MMMU_SHOOT_DOWN_OFFSET,
+ MMMU_SHOOT_DOWN_SHOOT + (page_group << 2));
+ readl_poll_timeout_atomic(
+ mmu->reg_base + MMMU_SHOOT_DOWN_OFFSET, val,
+ !(val & MMMU_SHOOT_DOWN_SHOOTING), 0, 1000);
+ }
+}
+
+static int bcm2712_iommu_sync_range(struct iommu_domain *domain,
+ unsigned long iova, size_t size)
+{
+ struct bcm2712_iommu *mmu = domain_to_mmu(domain);
+ unsigned long flags;
+ u32 val;
+
+ spin_lock_irqsave(&mmu->hw_lock, flags);
+ bcm2712_iommu_cache_flush(mmu->cache);
+
+ /* If invalidating more than 16MB, just do a full TLB clear */
+ if (size >= SZ_16M) {
+ MMU_WR(MMMU_CTRL_OFFSET,
+ MMMU_CTRL_OPERATING_FLAGS | MMMU_CTRL_TLB_CLEAR);
+ readl_poll_timeout_atomic(mmu->reg_base + MMMU_CTRL_OFFSET, val,
+ !(val & MMMU_CTRL_TLB_CLEARING), 0,
+ 1000);
+ } else {
+ bcm2712_iommu_shootdown_range(mmu, iova, size);
+ }
+
+ spin_unlock_irqrestore(&mmu->hw_lock, flags);
+ return 0;
+}
+
+static void bcm2712_iommu_sync(struct iommu_domain *domain,
+ struct iommu_iotlb_gather *gather)
+{
+ bcm2712_iommu_sync_range(domain, gather->start,
+ gather->end - gather->start + 1);
+}
+
+static int bcm2712_iommu_sync_map(struct iommu_domain *domain,
+ unsigned long iova, size_t size)
+{
+ return bcm2712_iommu_sync_range(domain, iova, size);
+}
+
+static void bcm2712_iommu_sync_all(struct iommu_domain *domain)
+{
+ size_t aperture_size = domain->geometry.aperture_end -
+ domain->geometry.aperture_start + 1;
+
+ bcm2712_iommu_sync_range(domain, domain->geometry.aperture_start,
+ aperture_size);
+}
+
+static void bcm2712_iommu_domain_free(struct iommu_domain *domain)
+{
+ struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
+ struct bcm2712_iommu *mmu = mydomain->mmu;
+
+ if (mmu && mmu->domain == mydomain) {
+ unsigned long flags;
+
+ spin_lock_irqsave(&mmu->hw_lock, flags);
+ MMU_WR(MMMU_CTRL_OFFSET, 0);
+ mmu->domain = NULL;
+ spin_unlock_irqrestore(&mmu->hw_lock, flags);
+ }
+
+ pt_iommu_deinit(&mydomain->pt.iommu);
+ if (mydomain->default_page)
+ iommu_free_pages(mydomain->default_page);
+ kfree(mydomain);
+}
+
+static const struct iommu_domain_ops bcm2712_paging_domain_ops = {
+ IOMMU_PT_DOMAIN_OPS(bcm2712),
+ .attach_dev = bcm2712_iommu_attach_dev,
+ .iotlb_sync = bcm2712_iommu_sync,
+ .iotlb_sync_map = bcm2712_iommu_sync_map,
+ .flush_iotlb_all = bcm2712_iommu_sync_all,
+ .free = bcm2712_iommu_domain_free,
+};
+
+static struct iommu_domain *bcm2712_iommu_domain_alloc(struct device *dev)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ struct bcm2712_iommu_domain *domain;
+ struct pt_iommu_bcm2712_cfg cfg;
+ int ret;
+
+ domain = kzalloc_obj(*domain);
+ if (!domain)
+ return NULL;
+
+ domain->mmu = mmu;
+ domain->pt.iommu.iommu_device = mmu->dev;
+ memset(&cfg, 0, sizeof(cfg));
+ cfg.common.features = BIT(PT_FEAT_DMA_INCOHERENT);
+
+ /* Bigpage and superpage sizes are typically 64K and 1M, but may vary */
+ if (mmu->bigpage_size)
+ cfg.bigpage_lg2 = ilog2(mmu->bigpage_size);
+ if (mmu->superpage_size)
+ cfg.superpage_lg2 = ilog2(mmu->superpage_size);
+
+ /* 2-level format: 10-bit L1 + 10-bit L2 + 12-bit page offset */
+ cfg.common.hw_max_vasz_lg2 =
+ (2 * PTES_PER_IOPG_SHIFT) + IOMMU_PAGE_SHIFT;
+
+ /* PTEs encode a 28-bit output address PFN */
+ cfg.common.hw_max_oasz_lg2 = 28 + IOMMU_PAGE_SHIFT;
+
+ ret = pt_iommu_bcm2712_init(&domain->pt, &cfg, GFP_KERNEL);
+ if (ret)
+ goto err;
+
+ /* Set up a default (error) page used to catch illegal reads/writes */
+ domain->default_page = iommu_alloc_pages_sz(GFP_KERNEL, PAGE_SIZE);
+ if (!domain->default_page)
+ goto err;
+
+ domain->base.geometry.aperture_start = BCM2712_APERTURE_BASE;
+ domain->base.geometry.aperture_end = BCM2712_APERTURE_END - 1;
+ domain->base.geometry.force_aperture = true;
+ domain->base.ops = &bcm2712_paging_domain_ops;
+ return &domain->base;
+
+err:
+ bcm2712_iommu_domain_free(&domain->base);
+ return NULL;
+}
+
+static struct bcm2712_iommu *
+bcm2712_iommu_get_by_fwnode(struct fwnode_handle *fwnode)
+{
+ struct device *dev =
+ bus_find_device_by_fwnode(&platform_bus_type, fwnode);
+ struct bcm2712_iommu *mmu;
+
+ if (!dev)
+ return NULL;
+
+ mmu = dev_get_drvdata(dev);
+ put_device(dev);
+ return mmu;
+}
+
+static struct iommu_device *bcm2712_iommu_probe_device(struct device *dev)
+{
+ struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+ struct bcm2712_iommu *mmu;
+
+ if (!fwspec || !fwspec->iommu_fwnode)
+ return ERR_PTR(-ENODEV);
+
+ mmu = bcm2712_iommu_get_by_fwnode(fwspec->iommu_fwnode);
+ if (!mmu)
+ return ERR_PTR(-ENODEV);
+
+ dev_iommu_priv_set(dev, mmu);
+
+ return &mmu->iommu;
+}
+
+static int bcm2712_iommu_of_xlate(struct device *dev,
+ const struct of_phandle_args *args)
+{
+ return iommu_fwspec_add_ids(dev, args->args, 0);
+}
+
+static const struct iommu_ops bcm2712_iommu_ops = {
+ .identity_domain = &bcm2712_identity_domain,
+ .blocked_domain = &bcm2712_blocking_domain,
+ .domain_alloc_paging = bcm2712_iommu_domain_alloc,
+ .probe_device = bcm2712_iommu_probe_device,
+ .device_group = generic_single_device_group,
+ .of_xlate = bcm2712_iommu_of_xlate,
+};
+
+static const struct of_device_id bcm2712_iommu_of_match[] = {
+ { .compatible = "brcm,bcm2712-iommu" },
+ { /* sentinel */ }
+};
+
+static int bcm2712_iommu_init_cache(struct bcm2712_iommu *mmu,
+ struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+ struct platform_device *cache_pdev;
+ struct device_node *cache_np;
+
+ cache_np = of_parse_phandle(dev->of_node, "brcm,iommu-cache", 0);
+
+ /* Fall back on 'cache' property used in old/downstream firmware */
+ if (!cache_np)
+ cache_np = of_parse_phandle(dev->of_node, "cache", 0);
+
+ if (!cache_np)
+ return dev_err_probe(dev, -ENOENT,
+ "missing brcm,iommu-cache property\n");
+
+ cache_pdev = of_find_device_by_node(cache_np);
+ of_node_put(cache_np);
+ if (!cache_pdev)
+ return -EPROBE_DEFER;
+
+ mmu->cache = platform_get_drvdata(cache_pdev);
+ if (!mmu->cache) {
+ put_device(&cache_pdev->dev);
+ return -EPROBE_DEFER;
+ }
+
+ put_device(&cache_pdev->dev);
+ return 0;
+}
+
+static int bcm2712_iommu_probe(struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+
+ struct bcm2712_iommu *mmu;
+ int ret;
+
+ mmu = devm_kzalloc(dev, sizeof(*mmu), GFP_KERNEL);
+ if (!mmu)
+ return -ENOMEM;
+
+ mmu->dev = dev;
+ spin_lock_init(&mmu->hw_lock);
+
+ mmu->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(mmu->reg_base))
+ return PTR_ERR(mmu->reg_base);
+
+ ret = bcm2712_iommu_init_cache(mmu, pdev);
+ if (ret)
+ return ret;
+
+ platform_set_drvdata(pdev, mmu);
+ bcm2712_iommu_init(mmu);
+
+ ret = iommu_device_sysfs_add(&mmu->iommu, dev, NULL, dev_name(dev));
+ if (ret)
+ return ret;
+
+ ret = iommu_device_register(&mmu->iommu, &bcm2712_iommu_ops, dev);
+ if (ret) {
+ iommu_device_sysfs_remove(&mmu->iommu);
+ return ret;
+ }
+
+ return 0;
+}
+
+static struct platform_driver bcm2712_iommu_driver = {
+ .driver = {
+ .name = "bcm2712-iommu",
+ .of_match_table = bcm2712_iommu_of_match,
+ .suppress_bind_attrs = true,
+ },
+ .probe = bcm2712_iommu_probe,
+};
+builtin_platform_driver(bcm2712_iommu_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Daniel Drake <dan@reactivated.net>");
+MODULE_DESCRIPTION("Broadcom BCM2712 IOMMU driver");
diff --git a/drivers/iommu/bcm2712-iommu.h b/drivers/iommu/bcm2712-iommu.h
index 18969b703e8c..30e08b3729d9 100644
--- a/drivers/iommu/bcm2712-iommu.h
+++ b/drivers/iommu/bcm2712-iommu.h
@@ -19,4 +19,8 @@
#define BCM2712_APERTURE_SIZE SZ_4G
#define BCM2712_APERTURE_END (BCM2712_APERTURE_BASE + BCM2712_APERTURE_SIZE)
+struct bcm2712_iommu_cache;
+
+void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache);
+
#endif
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-07-27 20:43 ` [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
@ 2026-07-28 10:51 ` Robin Murphy
2026-07-29 0:10 ` Jason Gunthorpe
0 siblings, 1 reply; 9+ messages in thread
From: Robin Murphy @ 2026-07-28 10:51 UTC (permalink / raw)
To: Daniel Drake, Joerg Roedel (AMD), Will Deacon, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, Jason Gunthorpe
On 27/07/2026 9:43 pm, Daniel Drake wrote:
[...]
> + * Each BCM2712 IOMMU has multiple devices hardwired into it, whose
> + * DMA transactions all route through the IOMMU. There is no stream ID tagging
> + * or any other kind of segmentation to differentiate between requests from
> + * different devices. It is also not possible to toggle a specific device
> + * between iommu-mapped and bypass modes.
Hmm, so it's kind of like an IOMMU and a GART had a baby?
> + * With these limitations in mind, we configure the hardware to operate over two
> + * windows:
> + * 1. The lower part of the address space operates in identity/bypass mode.
> + * This enables non-IOMMU-consumer devices to work as normal (including
> + * devices set up by the firmware, devices that don't require large DMA
> + * allocations, devices that handle scatter-gather natively, etc.)
> + * 2. A 4GB translation aperture is defined at a fixed, high address, beyond
> + * regular RAM and MMIO space. Mappings are operated in this aperture for
> + * devices that wish to take advantage of the IOMMU.
[...]
> +static struct iommu_domain *bcm2712_iommu_domain_alloc(struct device *dev)
> +{
> + struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> + struct bcm2712_iommu_domain *domain;
> + struct pt_iommu_bcm2712_cfg cfg;
> + int ret;
> +
> + domain = kzalloc_obj(*domain);
> + if (!domain)
> + return NULL;
> +
> + domain->mmu = mmu;
> + domain->pt.iommu.iommu_device = mmu->dev;
> + memset(&cfg, 0, sizeof(cfg));
> + cfg.common.features = BIT(PT_FEAT_DMA_INCOHERENT);
> +
> + /* Bigpage and superpage sizes are typically 64K and 1M, but may vary */
> + if (mmu->bigpage_size)
> + cfg.bigpage_lg2 = ilog2(mmu->bigpage_size);
> + if (mmu->superpage_size)
> + cfg.superpage_lg2 = ilog2(mmu->superpage_size);
> +
> + /* 2-level format: 10-bit L1 + 10-bit L2 + 12-bit page offset */
> + cfg.common.hw_max_vasz_lg2 =
> + (2 * PTES_PER_IOPG_SHIFT) + IOMMU_PAGE_SHIFT;
> +
> + /* PTEs encode a 28-bit output address PFN */
> + cfg.common.hw_max_oasz_lg2 = 28 + IOMMU_PAGE_SHIFT;
> +
> + ret = pt_iommu_bcm2712_init(&domain->pt, &cfg, GFP_KERNEL);
> + if (ret)
> + goto err;
> +
> + /* Set up a default (error) page used to catch illegal reads/writes */
> + domain->default_page = iommu_alloc_pages_sz(GFP_KERNEL, PAGE_SIZE);
> + if (!domain->default_page)
> + goto err;
> +
> + domain->base.geometry.aperture_start = BCM2712_APERTURE_BASE;
> + domain->base.geometry.aperture_end = BCM2712_APERTURE_END - 1;
> + domain->base.geometry.force_aperture = true;
...and thus (as things stand) this is a lie :(
If you want to operate like an IOMMU, then the translation aperture and
the bypass window should really be mutually-exclusive; conversely if you
want to operate like a GART then you can't really pretend to support
blocking domains which will also disrupt devices outside the IOMMU
group. Trying to compromise leaves you with rather a
worst-of-both-worlds setup as-is...
Thanks,
Robin.
> + domain->base.ops = &bcm2712_paging_domain_ops;
> + return &domain->base;
> +
> +err:
> + bcm2712_iommu_domain_free(&domain->base);
> + return NULL;
> +}
^ permalink raw reply [flat|nested] 9+ messages in thread* Re: [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-07-28 10:51 ` Robin Murphy
@ 2026-07-29 0:10 ` Jason Gunthorpe
0 siblings, 0 replies; 9+ messages in thread
From: Jason Gunthorpe @ 2026-07-29 0:10 UTC (permalink / raw)
To: Robin Murphy
Cc: Daniel Drake, Joerg Roedel (AMD), Will Deacon, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, iommu, linux-kernel,
devicetree, linux-rpi-kernel, linux-arm-kernel, nick.hollinghurst
On Tue, Jul 28, 2026 at 11:51:04AM +0100, Robin Murphy wrote:
> > + ret = pt_iommu_bcm2712_init(&domain->pt, &cfg, GFP_KERNEL);
> > + if (ret)
> > + goto err;
> > +
> > + /* Set up a default (error) page used to catch illegal reads/writes */
> > + domain->default_page = iommu_alloc_pages_sz(GFP_KERNEL, PAGE_SIZE);
> > + if (!domain->default_page)
> > + goto err;
> > +
> > + domain->base.geometry.aperture_start = BCM2712_APERTURE_BASE;
> > + domain->base.geometry.aperture_end = BCM2712_APERTURE_END - 1;
> > + domain->base.geometry.force_aperture = true;
>
> ...and thus (as things stand) this is a lie :(
Well, it shouldn't be here, the iommupt core code should be setting
this from its own internal information. If there is something missing
to add in the full_va_prefix we should fix it.
But, AFAIK this is the correct way to declare a page table that has a
range of IOVA - which I think is what this is doing..
> If you want to operate like an IOMMU, then the translation aperture and the
> bypass window should really be mutually-exclusive;
I think it is operating like an iommu..
It uses generic_single_device_group() so there is only ever one
translation.
If identity is attached then it clears MMMU_CTRL_OPERATING_FLAGS which
I guess fully disables the IOVA aperture
If paging is attached then it sets MMMU_CTRL_OPERATING_FLAGS and
places the aperture at 40G. Based on the comments about blocking I
wonder if the "bypass" even works when paging is on?
If blocking is attached then it sets MMMU_CTRL_OPERATING_FLAGS with
some 0 address cap which aborts everything?
It looks to me like some of those comments and choices don't reflect
what the driver actually does. Since there is only ever one
translation we never need to be worried about where the aperture is,
it could be anything so long as the HW gives it priority to bypass.
Could the aperture be placed at 0 with the bypass fully disabled? Then
it would basically be a normal iommu.
Jason
^ permalink raw reply [flat|nested] 9+ messages in thread
* [PATCH v2 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes
2026-07-27 20:43 [PATCH v2 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
` (3 preceding siblings ...)
2026-07-27 20:43 ` [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
@ 2026-07-27 20:44 ` Daniel Drake
2026-07-28 22:57 ` [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Jim Quinlan
5 siblings, 0 replies; 9+ messages in thread
From: Daniel Drake @ 2026-07-27 20:44 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, Jason Gunthorpe
Define the IOMMU and IOMMUC nodes for the Broadcom BCM2712 SoC found in
the Raspberry Pi 5. Enable use of the IOMMU for the graphics/display
block.
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 14 ++++++++++++++
1 file changed, 14 insertions(+)
diff --git a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
index 761c59d90ffc..2e0dcf8ccd4c 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
@@ -626,6 +626,19 @@ pcie2: pcie@1000120000 {
status = "disabled";
};
+ iommu4: iommu@1000005200 {
+ /* IOMMU for VC4 (HVS & MPL/TXP), Unicam, PISP-FE, MiniBVN */
+ compatible = "brcm,bcm2712-iommu";
+ reg = <0x10 0x5200 0x0 0x80>;
+ #iommu-cells = <0>;
+ brcm,iommu-cache = <&iommuc>;
+ };
+
+ iommuc: iommuc@1000005b00 {
+ compatible = "brcm,bcm2712-iommuc";
+ reg = <0x10 0x5b00 0x0 0x80>;
+ };
+
mip0: msi-controller@1000130000 {
compatible = "brcm,bcm2712-mip";
reg = <0x10 0x00130000 0x00 0xc0>,
@@ -667,6 +680,7 @@ v3d: gpu@1002000000 {
vc4: gpu {
compatible = "brcm,bcm2712-vc6";
+ iommus = <&iommu4>;
};
timer {
--
2.55.0
^ permalink raw reply related [flat|nested] 9+ messages in thread* Re: [PATCH v2 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-07-27 20:43 [PATCH v2 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
` (4 preceding siblings ...)
2026-07-27 20:44 ` [PATCH v2 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes Daniel Drake
@ 2026-07-28 22:57 ` Jim Quinlan
5 siblings, 0 replies; 9+ messages in thread
From: Jim Quinlan @ 2026-07-28 22:57 UTC (permalink / raw)
To: dan
Cc: bcm-kernel-feedback-list, conor+dt, devicetree, florian.fainelli,
iommu, jgg, joro, krzk+dt, linux-arm-kernel, linux-kernel,
linux-rpi-kernel, nick.hollinghurst, robh, robin.murphy, will
> This IOMMU translates memory access requests for the VC6 display
> pipeline and various multimedia devices in the Broadcom BCM2712 SoC used
> on Raspberry Pi 5.
>
> This driver places a 4GB aperture at a high memory address in which the
> IOMMU mappings are operated. All addresses outside this window bypass the
> translation logic and give direct access to physical memory.
>
> Also includes support for the IOMMU cache, which is shared between
> all the IOMMU devices found on the SoC.
>
> Adapted from Raspberry Pi's downstream bcm2712-iommu driver
> (original author Nick Hollinghurst).
>
> Signed-off-by: Daniel Drake <dan@reactivated.net>
>
> diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
> index 6e07bd69467a..f2c8788158b0 100644
> --- a/drivers/iommu/Kconfig
> +++ b/drivers/iommu/Kconfig
> @@ -386,6 +386,21 @@ config VSI_IOMMU
> Say Y here if you want to use this IOMMU in front of these
> hardware blocks.
>
> +config BCM2712_IOMMU
> + bool "BCM2712 IOMMU driver"
> + depends on (ARCH_BCM && ARM64) || COMPILE_TEST
> + select IOMMU_API
> + select GENERIC_PT
> + select IOMMU_PT
> + select IOMMU_PT_BCM2712
> + help
> + Support for IOMMU on BCM2712 SoC. This IOMMU can be used by the
> + display controller and various multimedia devices to perform
> + efficient memory management.
> +
> + Say Y here if you want to use this IOMMU in front of these
> + hardware blocks.
> +
> config IOMMU_DEBUG_PAGEALLOC
> bool "Debug IOMMU mappings against page allocations"
> depends on DEBUG_PAGEALLOC && IOMMU_API && PAGE_EXTENSION
> diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
> index 2f05725eaab1..29a26d2a3af1 100644
> --- a/drivers/iommu/Makefile
> +++ b/drivers/iommu/Makefile
> @@ -37,4 +37,5 @@ obj-$(CONFIG_IOMMU_IOPF) += io-pgfault.o
> obj-$(CONFIG_SPRD_IOMMU) += sprd-iommu.o
> obj-$(CONFIG_APPLE_DART) += apple-dart.o
> obj-$(CONFIG_VSI_IOMMU) += vsi-iommu.o
> +obj-$(CONFIG_BCM2712_IOMMU) += bcm2712-iommu.o bcm2712-iommu-cache.o
> obj-$(CONFIG_IOMMU_DEBUG_PAGEALLOC) += iommu-debug-pagealloc.o
> diff --git a/drivers/iommu/bcm2712-iommu-cache.c b/drivers/iommu/bcm2712-iommu-cache.c
> new file mode 100644
> index 000000000000..d97a8cda448e
> --- /dev/null
> +++ b/drivers/iommu/bcm2712-iommu-cache.c
> @@ -0,0 +1,73 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * IOMMU driver for BCM2712 TLB cache
> + *
> + * Copyright (c) 2023 Raspberry Pi Ltd.
> + */
> +
> +#include <linux/err.h>
> +#include <linux/of_platform.h>
> +#include <linux/platform_device.h>
> +#include <linux/spinlock.h>
> +#include <linux/iopoll.h>
> +
> +#include "bcm2712-iommu.h"
> +
> +struct bcm2712_iommu_cache {
> + spinlock_t hw_lock;
> + void __iomem *reg_base;
> +};
> +
> +#define MMUC_CONTROL_ENABLE 1
> +#define MMUC_CONTROL_FLUSH 2
> +#define MMUC_CONTROL_FLUSHING 4
> +
> +void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache)
> +{
> + unsigned long flags;
> + u32 val;
> +
> + spin_lock_irqsave(&cache->hw_lock, flags);
> +
> + /* Enable and flush the TLB cache */
> + writel(MMUC_CONTROL_ENABLE | MMUC_CONTROL_FLUSH, cache->reg_base);
> +
> + /* Wait for flush to complete: it should be very quick */
> + readl_poll_timeout_atomic(cache->reg_base, val,
> + !(val & MMUC_CONTROL_FLUSHING), 0, 1000);
> +
> + spin_unlock_irqrestore(&cache->hw_lock, flags);
> +}
> +
> +static int bcm2712_iommu_cache_probe(struct platform_device *pdev)
> +{
> + struct bcm2712_iommu_cache *cache;
> +
> + cache = devm_kzalloc(&pdev->dev, sizeof(*cache), GFP_KERNEL);
> + if (!cache)
> + return -ENOMEM;
> +
> + platform_set_drvdata(pdev, cache);
> + spin_lock_init(&cache->hw_lock);
> +
> + cache->reg_base = devm_platform_ioremap_resource(pdev, 0);
> + if (IS_ERR(cache->reg_base))
> + return PTR_ERR(cache->reg_base);
> +
> + return 0;
> +}
> +
> +static const struct of_device_id bcm2712_iommu_cache_of_match[] = {
> + { .compatible = "brcm,bcm2712-iommuc" },
> + { /* sentinel */ },
> +};
> +
> +static struct platform_driver bcm2712_iommu_cache_driver = {
> + .probe = bcm2712_iommu_cache_probe,
> + .driver = {
> + .name = "bcm2712-iommu-cache",
> + .of_match_table = bcm2712_iommu_cache_of_match,
> + .suppress_bind_attrs = true,
> + },
> +};
> +builtin_platform_driver(bcm2712_iommu_cache_driver);
> diff --git a/drivers/iommu/bcm2712-iommu.c b/drivers/iommu/bcm2712-iommu.c
> new file mode 100644
> index 000000000000..55678009f9c4
> --- /dev/null
> +++ b/drivers/iommu/bcm2712-iommu.c
> @@ -0,0 +1,582 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * IOMMU driver for Broadcom BCM2712
> + *
> + * Copyright (c) 2023-2025 Raspberry Pi Ltd.
> + * Copyright (c) 2026 Daniel Drake
> + *
> + * Each BCM2712 IOMMU has multiple devices hardwired into it, whose
> + * DMA transactions all route through the IOMMU. There is no stream ID tagging
> + * or any other kind of segmentation to differentiate between requests from
> + * different devices. It is also not possible to toggle a specific device
> + * between iommu-mapped and bypass modes.
> + *
> + * With these limitations in mind, we configure the hardware to operate over two
> + * windows:
> + * 1. The lower part of the address space operates in identity/bypass mode.
> + * This enables non-IOMMU-consumer devices to work as normal (including
> + * devices set up by the firmware, devices that don't require large DMA
> + * allocations, devices that handle scatter-gather natively, etc.)
> + * 2. A 4GB translation aperture is defined at a fixed, high address, beyond
> + * regular RAM and MMIO space. Mappings are operated in this aperture for
> + * devices that wish to take advantage of the IOMMU.
> + *
> + * The BCM2712 SoC contains multiple independent IOMMU hardware instances.
> + * The same aperture address is used across all of them; they do not conflict
> + * because these IOVA spaces are strictly localized to each IOMMU instance.
> + *
> + * The page table format is a two-level format handled by generic_pt/bcm2712.
> + */
> +
> +#include <linux/dma-mapping.h>
> +#include <linux/err.h>
> +#include <linux/iommu.h>
> +#include <linux/iopoll.h>
> +#include <linux/of_platform.h>
> +#include <linux/platform_device.h>
> +#include <linux/spinlock.h>
> +#include <linux/sizes.h>
> +#include <linux/generic_pt/iommu.h>
> +
> +#include "iommu-pages.h"
> +#include "bcm2712-iommu.h"
> +
> +/* BCM2712 IOMMU is organized around 4Kbyte pages */
> +#define IOMMU_PAGE_SHIFT 12
> +#define IOMMU_PAGE_SIZE (1ul << IOMMU_PAGE_SHIFT)
> +/* A PTE is 4 bytes */
> +#define PTE_SIZE_SHIFT 2
> +/* L1/L2 table sizing (IOMMU hardware pages): 1024 entries per page */
> +#define PTES_PER_IOPG_SHIFT (IOMMU_PAGE_SHIFT - PTE_SIZE_SHIFT)
> +/* An iommu hugepage covers 4MB */
> +#define IOMMU_HUGEPAGE_SHIFT (IOMMU_PAGE_SHIFT + PTES_PER_IOPG_SHIFT)
> +
> +
> +#define MMMU_CTRL_OFFSET 0x00
> +#define MMMU_CTRL_CAP_EXCEEDED BIT(27)
> +#define MMMU_CTRL_CAP_EXCEEDED_ABORT_EN BIT(26)
> +#define MMMU_CTRL_CAP_EXCEEDED_INT_EN BIT(25)
> +#define MMMU_CTRL_CAP_EXCEEDED_EXCEPTION_EN BIT(24)
> +#define MMMU_CTRL_PT_INVALID BIT(20)
> +#define MMMU_CTRL_PT_INVALID_ABORT_EN BIT(19)
> +#define MMMU_CTRL_PT_INVALID_INT_EN BIT(18)
> +#define MMMU_CTRL_PT_INVALID_EXCEPTION_EN BIT(17)
> +#define MMMU_CTRL_PT_INVALID_EN BIT(16)
> +#define MMMU_CTRL_WRITE_VIOLATION BIT(12)
> +#define MMMU_CTRL_WRITE_VIOLATION_ABORT_EN BIT(11)
> +#define MMMU_CTRL_WRITE_VIOLATION_INT_EN BIT(10)
> +#define MMMU_CTRL_WRITE_VIOLATION_EXCEPTION_EN BIT(9)
> +#define MMMU_CTRL_BYPASS BIT(8)
> +#define MMMU_CTRL_TLB_CLEARING BIT(7)
> +#define MMMU_CTRL_STATS_CLEAR BIT(3)
> +#define MMMU_CTRL_TLB_CLEAR BIT(2)
> +#define MMMU_CTRL_STATS_ENABLE BIT(1)
> +#define MMMU_CTRL_ENABLE BIT(0)
> +
> +#define MMMU_CTRL_OPERATING_FLAGS (\
> + MMMU_CTRL_CAP_EXCEEDED_ABORT_EN | \
> + MMMU_CTRL_PT_INVALID_ABORT_EN | \
> + MMMU_CTRL_PT_INVALID_EN | \
> + MMMU_CTRL_WRITE_VIOLATION_ABORT_EN | \
> + MMMU_CTRL_STATS_ENABLE | \
> + MMMU_CTRL_ENABLE)
Hello,
Why not request the MMU interrupt and use the "INT_EN" version, e.g.
MMMU_CTRL_PT_INVALID_INT_EN? It seems better than "ABORT", as with an
interrupt you have a fighting chance of the handler printing out something
helpful and shutting down gracefully.
> +
> +#define MMMU_PT_PA_BASE_OFFSET 0x04
> +
> +#define MMMU_ADDR_CAP_OFFSET 0x14
> +#define MMMU_ADDR_CAP_ENABLE BIT(31)
> +#define ADDR_CAP_SHIFT ilog2(SZ_256M)
> +
> +#define MMMU_SHOOT_DOWN_OFFSET 0x18
> +#define MMMU_SHOOT_DOWN_SHOOTING BIT(31)
> +#define MMMU_SHOOT_DOWN_SHOOT BIT(30)
> +
> +#define MMMU_BYPASS_START_OFFSET 0x1c
> +#define MMMU_BYPASS_START_ENABLE BIT(31)
> +
> +#define MMMU_BYPASS_END_OFFSET 0x20
> +#define MMMU_BYPASS_END_ENABLE BIT(31)
> +
> +#define MMMU_MISC_OFFSET 0x24
> +#define MMMU_MISC_SINGLE_TABLE BIT(31)
> +
> +#define MMMU_ILLEGAL_ADR_OFFSET 0x30
> +#define MMMU_ILLEGAL_ADR_ENABLE BIT(31)
> +
> +#define MMMU_DEBUG_INFO_OFFSET 0x38
> +#define MMMU_DEBUG_INFO_VERSION_MASK 0x0000000Fu
> +#define MMMU_DEBUG_INFO_VA_WIDTH_MASK 0x000000F0u
> +#define MMMU_DEBUG_INFO_PA_WIDTH_MASK 0x00000F00u
> +#define MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK 0x000FF000u
> +#define MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK 0x0FF00000u
> +#define MMMU_DEBUG_INFO_BYPASS_4M BIT(28)
> +#define MMMU_DEBUG_INFO_BYPASS BIT(29)
> +
> +struct bcm2712_iommu {
> + struct device *dev;
> + struct iommu_device iommu;
> + struct bcm2712_iommu_domain *domain;
> + struct bcm2712_iommu_cache *cache;
> + void __iomem *reg_base;
> + spinlock_t hw_lock;
> + size_t bigpage_size;
> + size_t superpage_size;
> +};
> +
> +struct bcm2712_iommu_domain {
> + union {
> + struct iommu_domain base;
> + struct pt_iommu_bcm2712 pt;
> + };
> + struct bcm2712_iommu *mmu;
> + void *default_page;
> +};
> +
> +#define MMU_WR(off, val) writel(val, mmu->reg_base + (off))
> +#define MMU_RD(off) readl(mmu->reg_base + (off))
> +
> +#define domain_to_mmu(d) \
> + (container_of(d, struct bcm2712_iommu_domain, base)->mmu)
> +
> +static struct bcm2712_iommu_domain *
> +to_bcm2712_domain(struct iommu_domain *domain)
> +{
> + return container_of(domain, struct bcm2712_iommu_domain, base);
> +}
> +
> +static void bcm2712_iommu_init(struct bcm2712_iommu *mmu)
> +{
> + unsigned int bigpage_width, superpage_width;
> + u32 u = MMU_RD(MMMU_DEBUG_INFO_OFFSET);
> + u32 pa_width = FIELD_GET(MMMU_DEBUG_INFO_PA_WIDTH_MASK, u);
> +
> + dev_dbg(mmu->dev, "DEBUG_INFO = 0x%08x\n", u);
> + WARN_ON(FIELD_GET(MMMU_DEBUG_INFO_VERSION_MASK, u) < 4 ||
> + FIELD_GET(MMMU_DEBUG_INFO_VA_WIDTH_MASK, u) < 6 ||
> + pa_width < 6 || !(u & MMMU_DEBUG_INFO_BYPASS));
> +
> + dma_set_mask_and_coherent(mmu->dev, DMA_BIT_MASK(pa_width + 30u));
> +
> + bigpage_width = FIELD_GET(MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK, u);
> + if (bigpage_width)
> + mmu->bigpage_size = IOMMU_PAGE_SIZE << bigpage_width;
> +
> + superpage_width = FIELD_GET(MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK, u);
> + if (superpage_width)
> + mmu->superpage_size = IOMMU_PAGE_SIZE << superpage_width;
> +
> + /* Disable MMU and clear sticky flags; meanwhile flush the TLB */
> + MMU_WR(MMMU_CTRL_OFFSET, MMMU_CTRL_CAP_EXCEEDED | MMMU_CTRL_PT_INVALID |
> + MMMU_CTRL_WRITE_VIOLATION |
> + MMMU_CTRL_STATS_CLEAR |
> + MMMU_CTRL_TLB_CLEAR);
> +
> + /* Put MMU into 2-level mode */
> + MMU_WR(MMMU_MISC_OFFSET,
> + MMU_RD(MMMU_MISC_OFFSET) & ~MMMU_MISC_SINGLE_TABLE);
> +}
> +
> +/*
> + * Since the BCM2712 IOMMU is address-based (not device based), we don't
> + * need to change any hardware state to support identity mapping.
> + * The IOMMU is natively bypassed for addresses outside the aperture.
> + */
> +static int bcm2712_iommu_identity_attach(struct iommu_domain *identity_domain,
> + struct device *dev,
> + struct iommu_domain *old)
> +{
> + struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> + unsigned long flags;
> +
> + spin_lock_irqsave(&mmu->hw_lock, flags);
> + MMU_WR(MMMU_CTRL_OFFSET, 0);
> + mmu->domain = NULL;
> + spin_unlock_irqrestore(&mmu->hw_lock, flags);
> +
> + return 0;
> +}
> +
> +static struct iommu_domain bcm2712_identity_domain = {
> + .type = IOMMU_DOMAIN_IDENTITY,
> + .ops = &(const struct iommu_domain_ops) {
> + .attach_dev = bcm2712_iommu_identity_attach,
> + },
> +};
> +
> +static int bcm2712_iommu_blocking_attach(struct iommu_domain *blocking_domain,
> + struct device *dev,
> + struct iommu_domain *old)
> +{
> + struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> + unsigned long flags;
> +
> + spin_lock_irqsave(&mmu->hw_lock, flags);
> +
> + /*
> + * To completely block DMA:
> + * 1. Disable the bypass window (requests outside aperture will abort).
> + * 2. Set the address cap to 0 (requests inside aperture will abort).
> + */
> + MMU_WR(MMMU_BYPASS_START_OFFSET, 0);
> + MMU_WR(MMMU_BYPASS_END_OFFSET, 0);
> + MMU_WR(MMMU_ADDR_CAP_OFFSET, MMMU_ADDR_CAP_ENABLE);
> +
> + MMU_WR(MMMU_CTRL_OFFSET, MMMU_CTRL_OPERATING_FLAGS);
> +
> + mmu->domain = NULL;
> + spin_unlock_irqrestore(&mmu->hw_lock, flags);
> +
> + return 0;
> +}
> +
> +static struct iommu_domain bcm2712_blocking_domain = {
> + .type = IOMMU_DOMAIN_BLOCKED,
> + .ops = &(const struct iommu_domain_ops) {
> + .attach_dev = bcm2712_iommu_blocking_attach,
> + },
> +};
> +
> +static int bcm2712_iommu_attach_dev(struct iommu_domain *domain,
> + struct device *dev,
> + struct iommu_domain *old)
> +{
> + struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> + struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
> + struct pt_iommu_bcm2712_hw_info info;
> + u32 default_page_pfn, u;
> + unsigned int byp_shift;
> + unsigned long flags;
> +
> + spin_lock_irqsave(&mmu->hw_lock, flags);
> +
> + if (mmu->domain == mydomain)
> + goto unlock;
> +
> + mmu->domain = mydomain;
> +
> + /*
> + * This driver is for VC IOMMU version >= 4 and assumes at least 36
> + * bits of virtual and physical address space.
> + */
> + u = MMU_RD(MMMU_DEBUG_INFO_OFFSET);
> + byp_shift = (u & MMMU_DEBUG_INFO_BYPASS_4M) ? IOMMU_HUGEPAGE_SHIFT :
> + ADDR_CAP_SHIFT;
> +
> + /*
> + * Set address cap and bypass range (note unintuitive off-by-ones).
> + * Requests to the bypass window pass straight through unchanged: this
> + * is useful for blocks which share an IOMMU with other blocks whose
> + * drivers are not IOMMU-aware.
> + */
> + MMU_WR(MMMU_ADDR_CAP_OFFSET,
> + MMMU_ADDR_CAP_ENABLE +
> + (BCM2712_APERTURE_END >> ADDR_CAP_SHIFT) - 1);
> + MMU_WR(MMMU_BYPASS_START_OFFSET, 0);
> + MMU_WR(MMMU_BYPASS_END_OFFSET,
> + MMMU_BYPASS_END_ENABLE + (BCM2712_APERTURE_BASE >> byp_shift));
> +
> + /*
> + * When the IOMMU handles a request, it adds the PT_PA_BASE_OFFSET to
> + * (IOVA>>32) to calculate the PFN of the corresponding L1 directory page.
> + * IOVA bits [31:22] are then used to fetch the L1 descriptor within
> + * (which in turn points to the L2 table).
> + * This clever logic would allow for a L1 table larger than 4kb (and hence
> + * a larger aperture.
> + */
> + pt_iommu_bcm2712_hw_info(&mydomain->pt, &info);
> + MMU_WR(MMMU_PT_PA_BASE_OFFSET, (info.pt_base >> IOMMU_PAGE_SHIFT) -
> + (BCM2712_APERTURE_BASE >> 32));
> +
> + /* Set up a default (error) page used to catch illegal reads/writes */
> + default_page_pfn = virt_to_phys(mydomain->default_page) >>
> + IOMMU_PAGE_SHIFT;
> + MMU_WR(MMMU_ILLEGAL_ADR_OFFSET,
> + MMMU_ILLEGAL_ADR_ENABLE + default_page_pfn);
> +
> + /* Flush (and enable) the shared TLB cache; enable this MMU. */
> + bcm2712_iommu_cache_flush(mmu->cache);
> + MMU_WR(MMMU_CTRL_OFFSET, MMMU_CTRL_OPERATING_FLAGS);
> +
> +unlock:
> + spin_unlock_irqrestore(&mmu->hw_lock, flags);
> + return 0;
> +}
> +
> +static void bcm2712_iommu_shootdown_range(struct bcm2712_iommu *mmu,
> + unsigned long iova, size_t size)
> +{
> + unsigned long iova_end = iova + size - 1;
> + unsigned int page_group;
> + u32 val;
> +
> + /* Shootdown register deals with 4 pages at a time */
> + for (page_group = iova >> (IOMMU_PAGE_SHIFT + 2);
> + page_group <= iova_end >> (IOMMU_PAGE_SHIFT + 2); page_group++) {
> + MMU_WR(MMMU_SHOOT_DOWN_OFFSET,
> + MMMU_SHOOT_DOWN_SHOOT + (page_group << 2));
> + readl_poll_timeout_atomic(
> + mmu->reg_base + MMMU_SHOOT_DOWN_OFFSET, val,
> + !(val & MMMU_SHOOT_DOWN_SHOOTING), 0, 1000);
I think it would be prudent to have this function return the
readl_poll_timeout_atomic() result and then do a dev_{warn,err}() call once
you are out of the containing spinlock. Also, why 1ms -- seems a long
time to have a spinlock.
> + }
> +}
> +
> +static int bcm2712_iommu_sync_range(struct iommu_domain *domain,
> + unsigned long iova, size_t size)
> +{
> + struct bcm2712_iommu *mmu = domain_to_mmu(domain);
> + unsigned long flags;
> + u32 val;
> +
> + spin_lock_irqsave(&mmu->hw_lock, flags);
> + bcm2712_iommu_cache_flush(mmu->cache);
> +
> + /* If invalidating more than 16MB, just do a full TLB clear */
> + if (size >= SZ_16M) {
> + MMU_WR(MMMU_CTRL_OFFSET,
> + MMMU_CTRL_OPERATING_FLAGS | MMMU_CTRL_TLB_CLEAR);
> + readl_poll_timeout_atomic(mmu->reg_base + MMMU_CTRL_OFFSET, val,
> + !(val & MMMU_CTRL_TLB_CLEARING), 0,
> + 1000);
Same comment as above.
Regards,
Jim Quinlan
Broadcom STB/CM
> + } else {
> + bcm2712_iommu_shootdown_range(mmu, iova, size);
> + }
> +
> + spin_unlock_irqrestore(&mmu->hw_lock, flags);
> + return 0;
> +}
> +
> +static void bcm2712_iommu_sync(struct iommu_domain *domain,
> + struct iommu_iotlb_gather *gather)
> +{
> + bcm2712_iommu_sync_range(domain, gather->start,
> + gather->end - gather->start + 1);
> +}
> +
> +static int bcm2712_iommu_sync_map(struct iommu_domain *domain,
> + unsigned long iova, size_t size)
> +{
> + return bcm2712_iommu_sync_range(domain, iova, size);
> +}
> +
> +static void bcm2712_iommu_sync_all(struct iommu_domain *domain)
> +{
> + size_t aperture_size = domain->geometry.aperture_end -
> + domain->geometry.aperture_start + 1;
> +
> + bcm2712_iommu_sync_range(domain, domain->geometry.aperture_start,
> + aperture_size);
> +}
> +
> +static void bcm2712_iommu_domain_free(struct iommu_domain *domain)
> +{
> + struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
> + struct bcm2712_iommu *mmu = mydomain->mmu;
> +
> + if (mmu && mmu->domain == mydomain) {
> + unsigned long flags;
> +
> + spin_lock_irqsave(&mmu->hw_lock, flags);
> + MMU_WR(MMMU_CTRL_OFFSET, 0);
> + mmu->domain = NULL;
> + spin_unlock_irqrestore(&mmu->hw_lock, flags);
> + }
> +
> + pt_iommu_deinit(&mydomain->pt.iommu);
> + if (mydomain->default_page)
> + iommu_free_pages(mydomain->default_page);
> + kfree(mydomain);
> +}
> +
> +static const struct iommu_domain_ops bcm2712_paging_domain_ops = {
> + IOMMU_PT_DOMAIN_OPS(bcm2712),
> + .attach_dev = bcm2712_iommu_attach_dev,
> + .iotlb_sync = bcm2712_iommu_sync,
> + .iotlb_sync_map = bcm2712_iommu_sync_map,
> + .flush_iotlb_all = bcm2712_iommu_sync_all,
> + .free = bcm2712_iommu_domain_free,
> +};
> +
> +static struct iommu_domain *bcm2712_iommu_domain_alloc(struct device *dev)
> +{
> + struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> + struct bcm2712_iommu_domain *domain;
> + struct pt_iommu_bcm2712_cfg cfg;
> + int ret;
> +
> + domain = kzalloc_obj(*domain);
> + if (!domain)
> + return NULL;
> +
> + domain->mmu = mmu;
> + domain->pt.iommu.iommu_device = mmu->dev;
> + memset(&cfg, 0, sizeof(cfg));
> + cfg.common.features = BIT(PT_FEAT_DMA_INCOHERENT);
> +
> + /* Bigpage and superpage sizes are typically 64K and 1M, but may vary */
> + if (mmu->bigpage_size)
> + cfg.bigpage_lg2 = ilog2(mmu->bigpage_size);
> + if (mmu->superpage_size)
> + cfg.superpage_lg2 = ilog2(mmu->superpage_size);
> +
> + /* 2-level format: 10-bit L1 + 10-bit L2 + 12-bit page offset */
> + cfg.common.hw_max_vasz_lg2 =
> + (2 * PTES_PER_IOPG_SHIFT) + IOMMU_PAGE_SHIFT;
> +
> + /* PTEs encode a 28-bit output address PFN */
> + cfg.common.hw_max_oasz_lg2 = 28 + IOMMU_PAGE_SHIFT;
> +
> + ret = pt_iommu_bcm2712_init(&domain->pt, &cfg, GFP_KERNEL);
> + if (ret)
> + goto err;
> +
> + /* Set up a default (error) page used to catch illegal reads/writes */
> + domain->default_page = iommu_alloc_pages_sz(GFP_KERNEL, PAGE_SIZE);
> + if (!domain->default_page)
> + goto err;
> +
> + domain->base.geometry.aperture_start = BCM2712_APERTURE_BASE;
> + domain->base.geometry.aperture_end = BCM2712_APERTURE_END - 1;
> + domain->base.geometry.force_aperture = true;
> + domain->base.ops = &bcm2712_paging_domain_ops;
> + return &domain->base;
> +
> +err:
> + bcm2712_iommu_domain_free(&domain->base);
> + return NULL;
> +}
> +
> +static struct bcm2712_iommu *
> +bcm2712_iommu_get_by_fwnode(struct fwnode_handle *fwnode)
> +{
> + struct device *dev =
> + bus_find_device_by_fwnode(&platform_bus_type, fwnode);
> + struct bcm2712_iommu *mmu;
> +
> + if (!dev)
> + return NULL;
> +
> + mmu = dev_get_drvdata(dev);
> + put_device(dev);
> + return mmu;
> +}
> +
> +static struct iommu_device *bcm2712_iommu_probe_device(struct device *dev)
> +{
> + struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
> + struct bcm2712_iommu *mmu;
> +
> + if (!fwspec || !fwspec->iommu_fwnode)
> + return ERR_PTR(-ENODEV);
> +
> + mmu = bcm2712_iommu_get_by_fwnode(fwspec->iommu_fwnode);
> + if (!mmu)
> + return ERR_PTR(-ENODEV);
> +
> + dev_iommu_priv_set(dev, mmu);
> +
> + return &mmu->iommu;
> +}
> +
> +static int bcm2712_iommu_of_xlate(struct device *dev,
> + const struct of_phandle_args *args)
> +{
> + return iommu_fwspec_add_ids(dev, args->args, 0);
> +}
> +
> +static const struct iommu_ops bcm2712_iommu_ops = {
> + .identity_domain = &bcm2712_identity_domain,
> + .blocked_domain = &bcm2712_blocking_domain,
> + .domain_alloc_paging = bcm2712_iommu_domain_alloc,
> + .probe_device = bcm2712_iommu_probe_device,
> + .device_group = generic_single_device_group,
> + .of_xlate = bcm2712_iommu_of_xlate,
> +};
> +
> +static const struct of_device_id bcm2712_iommu_of_match[] = {
> + { .compatible = "brcm,bcm2712-iommu" },
> + { /* sentinel */ }
> +};
> +
> +static int bcm2712_iommu_init_cache(struct bcm2712_iommu *mmu,
> + struct platform_device *pdev)
> +{
> + struct device *dev = &pdev->dev;
> + struct platform_device *cache_pdev;
> + struct device_node *cache_np;
> +
> + cache_np = of_parse_phandle(dev->of_node, "brcm,iommu-cache", 0);
> +
> + /* Fall back on 'cache' property used in old/downstream firmware */
> + if (!cache_np)
> + cache_np = of_parse_phandle(dev->of_node, "cache", 0);
> +
> + if (!cache_np)
> + return dev_err_probe(dev, -ENOENT,
> + "missing brcm,iommu-cache property\n");
> +
> + cache_pdev = of_find_device_by_node(cache_np);
> + of_node_put(cache_np);
> + if (!cache_pdev)
> + return -EPROBE_DEFER;
> +
> + mmu->cache = platform_get_drvdata(cache_pdev);
> + if (!mmu->cache) {
> + put_device(&cache_pdev->dev);
> + return -EPROBE_DEFER;
> + }
> +
> + put_device(&cache_pdev->dev);
> + return 0;
> +}
> +
> +static int bcm2712_iommu_probe(struct platform_device *pdev)
> +{
> + struct device *dev = &pdev->dev;
> +
> + struct bcm2712_iommu *mmu;
> + int ret;
> +
> + mmu = devm_kzalloc(dev, sizeof(*mmu), GFP_KERNEL);
> + if (!mmu)
> + return -ENOMEM;
> +
> + mmu->dev = dev;
> + spin_lock_init(&mmu->hw_lock);
> +
> + mmu->reg_base = devm_platform_ioremap_resource(pdev, 0);
> + if (IS_ERR(mmu->reg_base))
> + return PTR_ERR(mmu->reg_base);
> +
> + ret = bcm2712_iommu_init_cache(mmu, pdev);
> + if (ret)
> + return ret;
> +
> + platform_set_drvdata(pdev, mmu);
> + bcm2712_iommu_init(mmu);
> +
> + ret = iommu_device_sysfs_add(&mmu->iommu, dev, NULL, dev_name(dev));
> + if (ret)
> + return ret;
> +
> + ret = iommu_device_register(&mmu->iommu, &bcm2712_iommu_ops, dev);
> + if (ret) {
> + iommu_device_sysfs_remove(&mmu->iommu);
> + return ret;
> + }
> +
> + return 0;
> +}
> +
> +static struct platform_driver bcm2712_iommu_driver = {
> + .driver = {
> + .name = "bcm2712-iommu",
> + .of_match_table = bcm2712_iommu_of_match,
> + .suppress_bind_attrs = true,
> + },
> + .probe = bcm2712_iommu_probe,
> +};
> +builtin_platform_driver(bcm2712_iommu_driver);
> +
> +MODULE_LICENSE("GPL");
> +MODULE_AUTHOR("Daniel Drake <dan@reactivated.net>");
> +MODULE_DESCRIPTION("Broadcom BCM2712 IOMMU driver");
> diff --git a/drivers/iommu/bcm2712-iommu.h b/drivers/iommu/bcm2712-iommu.h
> index 18969b703e8c..30e08b3729d9 100644
> --- a/drivers/iommu/bcm2712-iommu.h
> +++ b/drivers/iommu/bcm2712-iommu.h
> @@ -19,4 +19,8 @@
> #define BCM2712_APERTURE_SIZE SZ_4G
> #define BCM2712_APERTURE_END (BCM2712_APERTURE_BASE + BCM2712_APERTURE_SIZE)
>
> +struct bcm2712_iommu_cache;
> +
> +void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache);
> +
> #endif
^ permalink raw reply [flat|nested] 9+ messages in thread