* [PATCH v3 1/5] iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats
2026-08-25 20:56 [PATCH v3 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
@ 2026-08-25 20:56 ` Daniel Drake
2026-08-26 18:18 ` Jason Gunthorpe
2026-08-25 20:56 ` [PATCH v3 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU Daniel Drake
` (3 subsequent siblings)
4 siblings, 1 reply; 11+ messages in thread
From: Daniel Drake @ 2026-08-25 20:56 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
test_pgsize_boundary() tests boundary mapping with a hardcoded physical
address that requires 38 bits of physical address space. However, the
upcoming page table format for the Broadcom BCM2712 IOMMU only supports
37 bits of output address space.
This causes a test failure as iommu_map() rejects the large address
with -ERANGE.
Drop the high bits of the address (they are not relevant to the
boundary calculations being tested) so that it fits into 32 bits.
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/generic_pt/kunit_iommu_pt.h | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
diff --git a/drivers/iommu/generic_pt/kunit_iommu_pt.h b/drivers/iommu/generic_pt/kunit_iommu_pt.h
index ece1c9b8c55d..9fc71db74234 100644
--- a/drivers/iommu/generic_pt/kunit_iommu_pt.h
+++ b/drivers/iommu/generic_pt/kunit_iommu_pt.h
@@ -403,7 +403,7 @@ static void test_pgsize_boundary(struct kunit *test)
priv->smallest_pgsz != SZ_4K)
kunit_skip(test, "Format does not have the required range");
- do_map(test, 0xfef80000, 0x208b95d000, 0xfef9ffff - 0xfef80000 + 1);
+ do_map(test, 0xfef80000, 0x8b95d000, 0xfef9ffff - 0xfef80000 + 1);
}
/* See https://lore.kernel.org/r/20250826143816.38686-1-eugkoira@amazon.com */
--
2.55.0
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH v3 1/5] iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats
2026-08-25 20:56 ` [PATCH v3 1/5] iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats Daniel Drake
@ 2026-08-26 18:18 ` Jason Gunthorpe
0 siblings, 0 replies; 11+ messages in thread
From: Jason Gunthorpe @ 2026-08-26 18:18 UTC (permalink / raw)
To: Daniel Drake
Cc: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, iommu, linux-kernel,
devicetree, linux-rpi-kernel, linux-arm-kernel, nick.hollinghurst,
james.quinlan, Jason Gunthorpe
On Tue, 25 Aug 2026 21:56:04 +0100, Daniel Drake <dan@reactivated.net> wrote:
> test_pgsize_boundary() tests boundary mapping with a hardcoded physical
> address that requires 38 bits of physical address space. However, the
> upcoming page table format for the Broadcom BCM2712 IOMMU only supports
> 37 bits of output address space.
>
> This causes a test failure as iommu_map() rejects the large address
> with -ERANGE.
>
> [...]
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
--
Jason
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v3 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU
2026-08-25 20:56 [PATCH v3 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
2026-08-25 20:56 ` [PATCH v3 1/5] iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats Daniel Drake
@ 2026-08-25 20:56 ` Daniel Drake
2026-08-26 20:19 ` Florian Fainelli
2026-08-25 20:56 ` [PATCH v3 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format Daniel Drake
` (2 subsequent siblings)
4 siblings, 1 reply; 11+ messages in thread
From: Daniel Drake @ 2026-08-25 20:56 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
Add bindings for the Broadcom BCM2712 IOMMUs and their shared TLB cache.
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
.../bindings/iommu/brcm,bcm2712-iommu.yaml | 52 ++++++++++++++++++++++
.../bindings/iommu/brcm,bcm2712-iommuc.yaml | 38 ++++++++++++++++
2 files changed, 90 insertions(+)
diff --git a/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml
new file mode 100644
index 000000000000..50274f03e50c
--- /dev/null
+++ b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommu.yaml
@@ -0,0 +1,52 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iommu/brcm,bcm2712-iommu.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Broadcom BCM2712 IOMMU
+
+maintainers:
+ - Daniel Drake <dan@reactivated.net>
+
+description:
+ The BCM2712 SoC features multiple independent IOMMU instances providing
+ address translation for multimedia hardware blocks, such as the VC6 display
+ pipeline, camera receivers, and ISP. Each IOMMU has its own page tables,
+ control registers, and local TLB, and is additionally linked to a centralized
+ L2 TLB (IOMMUC).
+
+properties:
+ compatible:
+ const: brcm,bcm2712-iommu
+
+ reg:
+ maxItems: 1
+
+ '#iommu-cells':
+ const: 0
+
+ brcm,iommu-cache:
+ $ref: /schemas/types.yaml#/definitions/phandle
+ description:
+ Phandle to the shared IOMMU cache (IOMMUC). Each IOMMU instance caches
+ translated descriptors in this centralized L2 TLB cache block and must
+ trigger cache invalidation commands on it when updating or unmapping page
+ table entries.
+
+required:
+ - compatible
+ - reg
+ - '#iommu-cells'
+ - brcm,iommu-cache
+
+additionalProperties: false
+
+examples:
+ - |
+ iommu@5200 {
+ compatible = "brcm,bcm2712-iommu";
+ reg = <0x5200 0x80>;
+ brcm,iommu-cache = <&iommuc>;
+ #iommu-cells = <0>;
+ };
diff --git a/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml
new file mode 100644
index 000000000000..1d892d1dd809
--- /dev/null
+++ b/Documentation/devicetree/bindings/iommu/brcm,bcm2712-iommuc.yaml
@@ -0,0 +1,38 @@
+# SPDX-License-Identifier: (GPL-2.0-only OR BSD-2-Clause)
+%YAML 1.2
+---
+$id: http://devicetree.org/schemas/iommu/brcm,bcm2712-iommuc.yaml#
+$schema: http://devicetree.org/meta-schemas/core.yaml#
+
+title: Broadcom BCM2712 Shared IOMMU Cache (IOMMUC)
+
+maintainers:
+ - Daniel Drake <dan@reactivated.net>
+
+description:
+ The BCM2712 IOMMUC is a centralized Translation Lookaside Buffer (TLB) cache
+ which accelerates address translation across the SoC's IOMMU devices. If an
+ address mapping is not found in the IOMMU's local TLB cache, then this
+ IOMMUC is consulted as a L2 TLB. The SoC includes a single IOMMUC which is
+ shared between all IOMMUs, and it must be explicitly invalidated when
+ modifying or unmapping IOMMU page tables.
+
+properties:
+ compatible:
+ const: brcm,bcm2712-iommuc
+
+ reg:
+ maxItems: 1
+
+required:
+ - compatible
+ - reg
+
+additionalProperties: false
+
+examples:
+ - |
+ iommuc@5b00 {
+ compatible = "brcm,bcm2712-iommuc";
+ reg = <0x5b00 0x80>;
+ };
--
2.55.0
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH v3 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU
2026-08-25 20:56 ` [PATCH v3 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU Daniel Drake
@ 2026-08-26 20:19 ` Florian Fainelli
0 siblings, 0 replies; 11+ messages in thread
From: Florian Fainelli @ 2026-08-26 20:19 UTC (permalink / raw)
To: Daniel Drake, Joerg Roedel (AMD), Will Deacon, Robin Murphy,
Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Broadcom internal kernel review list
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
On 8/25/26 13:56, Daniel Drake wrote:
> Add bindings for the Broadcom BCM2712 IOMMUs and their shared TLB cache.
>
> Signed-off-by: Daniel Drake <dan@reactivated.net>
Only if you need to re-submit, would you mind listing Jim and myself as
bindings maintainer for these two files?
Thanks!
--
Florian
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v3 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format
2026-08-25 20:56 [PATCH v3 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
2026-08-25 20:56 ` [PATCH v3 1/5] iommu_pt: Fix test_pgsize_boundary() failure on narrow-OA formats Daniel Drake
2026-08-25 20:56 ` [PATCH v3 2/5] dt-bindings: iommu: Add Broadcom BCM2712 IOMMU Daniel Drake
@ 2026-08-25 20:56 ` Daniel Drake
2026-08-26 18:18 ` Jason Gunthorpe
2026-08-25 20:56 ` [PATCH v3 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
2026-08-25 20:56 ` [PATCH v3 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes Daniel Drake
4 siblings, 1 reply; 11+ messages in thread
From: Daniel Drake @ 2026-08-25 20:56 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
Implement generic_pt support for the 2-level page table format used by
the BCM2712 IOMMUs.
Adapted from Raspberry Pi's downstream bcm2712-iommu driver (original
author Nick Hollinghurst).
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/generic_pt/.kunitconfig | 1 +
drivers/iommu/generic_pt/Kconfig | 10 +
drivers/iommu/generic_pt/fmt/Makefile | 2 +
drivers/iommu/generic_pt/fmt/bcm2712.h | 288 +++++++++++++++++++++++++++
drivers/iommu/generic_pt/fmt/defs_bcm2712.h | 18 ++
drivers/iommu/generic_pt/fmt/iommu_bcm2712.c | 6 +
include/linux/generic_pt/common.h | 6 +
include/linux/generic_pt/iommu.h | 12 ++
8 files changed, 343 insertions(+)
diff --git a/drivers/iommu/generic_pt/.kunitconfig b/drivers/iommu/generic_pt/.kunitconfig
index 0bb98fe581fe..a3da74328f12 100644
--- a/drivers/iommu/generic_pt/.kunitconfig
+++ b/drivers/iommu/generic_pt/.kunitconfig
@@ -7,6 +7,7 @@ CONFIG_IOMMU_PT_AMDV1=y
CONFIG_IOMMU_PT_VTDSS=y
CONFIG_IOMMU_PT_RISCV64=y
CONFIG_IOMMU_PT_X86_64=y
+CONFIG_IOMMU_PT_BCM2712=y
CONFIG_IOMMU_PT_KUNIT_TEST=y
CONFIG_IOMMUFD=y
diff --git a/drivers/iommu/generic_pt/Kconfig b/drivers/iommu/generic_pt/Kconfig
index f4ed1add58b7..2a81dac960ac 100644
--- a/drivers/iommu/generic_pt/Kconfig
+++ b/drivers/iommu/generic_pt/Kconfig
@@ -72,6 +72,15 @@ config IOMMU_PT_X86_64
Selected automatically by an IOMMU driver that uses this format.
+config IOMMU_PT_BCM2712
+ tristate "IOMMU page table for Broadcom BCM2712"
+ help
+ iommu_domain implementation for the Broadcom BCM2712 IOMMU found on
+ Raspberry Pi 5. It supports 4K page sizes over a 2-level page table
+ format.
+
+ Selected automatically by an IOMMU driver that uses this format.
+
config IOMMU_PT_KUNIT_TEST
tristate "IOMMU Page Table KUnit Test" if !KUNIT_ALL_TESTS
depends on KUNIT
@@ -79,6 +88,7 @@ config IOMMU_PT_KUNIT_TEST
depends on IOMMU_PT_RISCV64 || !IOMMU_PT_RISCV64
depends on IOMMU_PT_X86_64 || !IOMMU_PT_X86_64
depends on IOMMU_PT_VTDSS || !IOMMU_PT_VTDSS
+ depends on IOMMU_PT_BCM2712 || !IOMMU_PT_BCM2712
default KUNIT_ALL_TESTS
help
Enable kunit tests for GENERIC_PT and IOMMU_PT that covers all the
diff --git a/drivers/iommu/generic_pt/fmt/Makefile b/drivers/iommu/generic_pt/fmt/Makefile
index ea024d582594..82ca3c36823d 100644
--- a/drivers/iommu/generic_pt/fmt/Makefile
+++ b/drivers/iommu/generic_pt/fmt/Makefile
@@ -9,6 +9,8 @@ iommu_pt_fmt-$(CONFIG_IOMMU_PT_RISCV64) += riscv64
iommu_pt_fmt-$(CONFIG_IOMMU_PT_X86_64) += x86_64
+iommu_pt_fmt-$(CONFIG_IOMMU_PT_BCM2712) += bcm2712
+
IOMMU_PT_KUNIT_TEST :=
define create_format
obj-$(2) += iommu_$(1).o
diff --git a/drivers/iommu/generic_pt/fmt/bcm2712.h b/drivers/iommu/generic_pt/fmt/bcm2712.h
new file mode 100644
index 000000000000..2c5b034441c1
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/bcm2712.h
@@ -0,0 +1,288 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+/*
+ * Copyright (c) 2026 Daniel Drake
+ *
+ * BCM2712 IOMMU simple two level page table
+ */
+#ifndef __GENERIC_PT_FMT_BCM2712_H
+#define __GENERIC_PT_FMT_BCM2712_H
+
+#include "defs_bcm2712.h"
+#include "../pt_defs.h"
+
+#include <linux/bitfield.h>
+#include <linux/container_of.h>
+#include <linux/log2.h>
+#include <linux/sizes.h>
+
+enum {
+ /* Hardware provides a two-level page table */
+ PT_MAX_TOP_LEVEL = 1,
+
+ /* Hardware page size is strictly 4kb */
+ PT_GRANULE_LG2SZ = ilog2(SZ_4K),
+ PT_TABLEMEM_LG2SZ = PT_GRANULE_LG2SZ,
+
+ /* Table entries and leaf entries are 32 bits */
+ PT_ITEM_WORD_SIZE = sizeof(pt_bcm2712_entry_t),
+
+ /* Leaf entries encode a 25-bit PFN */
+ PT_MAX_OUTPUT_ADDRESS_LG2 = 25 + PT_GRANULE_LG2SZ,
+
+ /*
+ * For simplicity, only manage mappings within an address space of
+ * exactly 4GB. This is because our Level 1 directory page will be 4kb
+ * in the smallest case, permitting 1024 entries pointing at Level 0
+ * pages, each permitting 4mb of mapped memory.
+ */
+ PT_MAX_VA_ADDRESS_LG2 = ilog2(SZ_4G),
+
+ /* Level 1 base address is programmed as a 32-bit PFN */
+ PT_TOP_PHYS_MASK = GENMASK_ULL(31 + PT_GRANULE_LG2SZ, PT_GRANULE_LG2SZ),
+};
+
+/* PTE bits */
+enum {
+ BCM2712PT_VALID = BIT(28),
+ BCM2712PT_WRITE = BIT(29),
+ BCM2712PT_PAGESIZE = GENMASK(31, 30),
+ BCM2712PT_PFN = GENMASK(24, 0),
+};
+
+#define common_to_bcm2712pt(common_ptr) \
+ container_of_const(common_ptr, struct pt_bcm2712, common)
+#define to_bcm2712pt(pts) common_to_bcm2712pt((pts)->range->common)
+
+static inline pt_oaddr_t bcm2712pt_table_pa(const struct pt_state *pts)
+{
+ return oalog2_mul(FIELD_GET(BCM2712PT_PFN, pts->entry),
+ PT_GRANULE_LG2SZ);
+}
+#define pt_table_pa bcm2712pt_table_pa
+#define pt_item_oa bcm2712pt_table_pa
+
+static inline bool bcm2712pt_can_have_leaf(const struct pt_state *pts)
+{
+ return true;
+}
+#define pt_can_have_leaf bcm2712pt_can_have_leaf
+
+/* 4MB pages are installed at level 1, everything else at level 0 */
+static inline unsigned int bcm2712pt_pgsz_lg2_to_level(struct pt_common *common,
+ unsigned int pgsize_lg2)
+{
+ return pgsize_lg2 == ilog2(SZ_4M) ? 1 : 0;
+}
+#define pt_pgsz_lg2_to_level bcm2712pt_pgsz_lg2_to_level
+
+static inline pt_vaddr_t bcm2712pt_possible_sizes(const struct pt_state *pts)
+{
+ struct pt_bcm2712 *table = common_to_bcm2712pt(pts->range->common);
+
+ if (pts->level == 1)
+ return SZ_4M;
+
+ return SZ_4K |
+ (table->bigpage_lg2 ? BIT_ULL(table->bigpage_lg2) : 0) |
+ (table->superpage_lg2 ? BIT_ULL(table->superpage_lg2) : 0);
+}
+#define pt_possible_sizes bcm2712pt_possible_sizes
+
+static inline unsigned int
+bcm2712pt_entry_num_contig_lg2(const struct pt_state *pts)
+{
+ struct pt_bcm2712 *table = common_to_bcm2712pt(pts->range->common);
+ u32 pgsz = FIELD_GET(BCM2712PT_PAGESIZE, pts->entry);
+
+ if (pts->level != 0 || !(pts->entry & BCM2712PT_VALID))
+ return 0;
+
+ /*
+ * Superpage/bigpage contiguous mapping (really just hinting) is handled
+ * via PAGESIZE bits on each leaf entry.
+ */
+ if (pgsz == 2 && table->superpage_lg2)
+ return table->superpage_lg2 - PT_GRANULE_LG2SZ;
+ else if (pgsz == 1 && table->bigpage_lg2)
+ return table->bigpage_lg2 - PT_GRANULE_LG2SZ;
+ return 0;
+}
+#define pt_entry_num_contig_lg2 bcm2712pt_entry_num_contig_lg2
+
+static inline unsigned int bcm2712pt_num_items_lg2(const struct pt_state *pts)
+{
+ return PT_TABLEMEM_LG2SZ - ilog2(PT_ITEM_WORD_SIZE);
+}
+#define pt_num_items_lg2 bcm2712pt_num_items_lg2
+
+static inline enum pt_entry_type bcm2712pt_load_entry_raw(struct pt_state *pts)
+{
+ const pt_bcm2712_entry_t *tablep =
+ pt_cur_table(pts, pt_bcm2712_entry_t);
+
+ pts->entry = READ_ONCE(tablep[pts->index]);
+ if (!(pts->entry & BCM2712PT_VALID))
+ return PT_ENTRY_EMPTY;
+
+ if (pts->level == 1) {
+ if (FIELD_GET(BCM2712PT_PAGESIZE, pts->entry) == 3)
+ return PT_ENTRY_OA;
+ return PT_ENTRY_TABLE;
+ }
+
+ return PT_ENTRY_OA;
+}
+#define pt_load_entry_raw bcm2712pt_load_entry_raw
+
+static inline void
+bcm2712pt_install_leaf_entry(struct pt_state *pts, pt_oaddr_t oa,
+ unsigned int oasz_lg2,
+ const struct pt_write_attrs *attrs)
+{
+ pt_bcm2712_entry_t *tablep = pt_cur_table(pts, pt_bcm2712_entry_t);
+ pt_bcm2712_entry_t entry;
+
+ if (!pt_check_install_leaf_args(pts, oa, oasz_lg2))
+ return;
+
+ entry = BCM2712PT_VALID | attrs->descriptor_bits |
+ FIELD_PREP(BCM2712PT_PFN, oalog2_div(oa, PT_GRANULE_LG2SZ));
+
+ if (pts->level == 1) {
+ /* Level 1 hugepage (4MB) */
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 3);
+ WRITE_ONCE(tablep[pts->index], entry);
+ pts->entry = entry;
+ return;
+ }
+
+ if (oasz_lg2 == PT_GRANULE_LG2SZ) {
+ WRITE_ONCE(tablep[pts->index], entry);
+ pts->entry = entry;
+ } else {
+ struct pt_bcm2712 *table =
+ common_to_bcm2712pt(pts->range->common);
+ u32 *end;
+
+ tablep += pts->index;
+ end = tablep + log2_to_int(oasz_lg2 - PT_GRANULE_LG2SZ);
+
+ /*
+ * Leaf entries can contain hints indicating bigpage/superpage
+ * contiguous mappings to permit TLB optimization
+ */
+ if (oasz_lg2 == table->superpage_lg2)
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 2);
+ else if (oasz_lg2 == table->bigpage_lg2)
+ entry |= FIELD_PREP(BCM2712PT_PAGESIZE, 1);
+
+ pts->entry = entry;
+ for (; tablep != end; tablep++, entry++)
+ WRITE_ONCE(*tablep, entry);
+ }
+}
+#define pt_install_leaf_entry bcm2712pt_install_leaf_entry
+
+static inline bool bcm2712pt_install_table(struct pt_state *pts,
+ pt_oaddr_t table_pa,
+ const struct pt_write_attrs *attrs)
+{
+ pt_bcm2712_entry_t entry =
+ BCM2712PT_VALID |
+ FIELD_PREP(BCM2712PT_PFN,
+ oalog2_div(table_pa, PT_GRANULE_LG2SZ));
+
+ return pt_table_install32(pts, entry);
+}
+#define pt_install_table bcm2712pt_install_table
+
+static inline void bcm2712pt_attr_from_entry(const struct pt_state *pts,
+ struct pt_write_attrs *attrs)
+{
+ attrs->descriptor_bits = pts->entry & BCM2712PT_WRITE;
+}
+#define pt_attr_from_entry bcm2712pt_attr_from_entry
+
+static inline unsigned int bcm2712pt_max_sw_bit(struct pt_common *common)
+{
+ return 2;
+}
+#define pt_max_sw_bit bcm2712pt_max_sw_bit
+
+static inline u32 bcm2712pt_sw_bit(unsigned int bitnr)
+{
+ if (__builtin_constant_p(bitnr) && bitnr > 2)
+ BUILD_BUG();
+ if (PT_WARN_ON(bitnr > 2))
+ return 0;
+
+ /* Bits 27, 26 and 25 are believed spare */
+ return BIT(27 - bitnr);
+}
+#define pt_sw_bit bcm2712pt_sw_bit
+
+/* --- iommu */
+#include <linux/generic_pt/iommu.h>
+#include <linux/iommu.h>
+
+#define pt_iommu_table pt_iommu_bcm2712
+
+/* The common struct is in the per-format common struct */
+static inline struct pt_common *common_from_iommu(struct pt_iommu *iommu_table)
+{
+ return &container_of(iommu_table, struct pt_iommu_table, iommu)
+ ->bcm2712pt.common;
+}
+
+static inline struct pt_iommu *iommu_from_common(struct pt_common *common)
+{
+ return &container_of(common, struct pt_iommu_table, bcm2712pt.common)
+ ->iommu;
+}
+
+static inline int bcm2712_pt_iommu_set_prot(struct pt_common *common,
+ struct pt_write_attrs *attrs,
+ unsigned int iommu_prot)
+{
+ attrs->descriptor_bits = 0;
+ if (iommu_prot & IOMMU_WRITE)
+ attrs->descriptor_bits |= BCM2712PT_WRITE;
+ return 0;
+}
+#define pt_iommu_set_prot bcm2712_pt_iommu_set_prot
+
+static inline int bcm2712_pt_fmt_init(struct pt_iommu_table *fmt_table,
+ const struct pt_iommu_bcm2712_cfg *cfg)
+{
+ fmt_table->bcm2712pt.bigpage_lg2 = cfg->bigpage_lg2;
+ fmt_table->bcm2712pt.superpage_lg2 = cfg->superpage_lg2;
+
+ pt_top_set_level(&fmt_table->bcm2712pt.common, PT_MAX_TOP_LEVEL);
+ return 0;
+}
+#define pt_iommu_fmt_init bcm2712_pt_fmt_init
+
+static inline void
+bcm2712pt_iommu_fmt_hw_info(struct pt_iommu_bcm2712 *table,
+ const struct pt_range *top_range,
+ struct pt_iommu_bcm2712_hw_info *info)
+{
+ info->pt_base = virt_to_phys(top_range->top_table);
+ PT_WARN_ON(info->pt_base & ~PT_TOP_PHYS_MASK);
+}
+#define pt_iommu_fmt_hw_info bcm2712pt_iommu_fmt_hw_info
+
+#if defined(GENERIC_PT_KUNIT)
+static const struct pt_iommu_bcm2712_cfg bcm2712_kunit_fmt_cfgs[] = {
+ [0] = {
+ .common.hw_max_vasz_lg2 = 32,
+ .common.hw_max_oasz_lg2 = 37,
+ .bigpage_lg2 = 16,
+ .superpage_lg2 = 20,
+ },
+};
+#define kunit_fmt_cfgs bcm2712_kunit_fmt_cfgs
+enum { KUNIT_FMT_FEATURES = 0 };
+#endif
+
+#endif
diff --git a/drivers/iommu/generic_pt/fmt/defs_bcm2712.h b/drivers/iommu/generic_pt/fmt/defs_bcm2712.h
new file mode 100644
index 000000000000..f1d983be1716
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/defs_bcm2712.h
@@ -0,0 +1,18 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef __GENERIC_PT_FMT_DEFS_BCM2712_H
+#define __GENERIC_PT_FMT_DEFS_BCM2712_H
+
+#include <linux/generic_pt/common.h>
+#include <linux/types.h>
+
+typedef u32 pt_bcm2712_entry_t;
+typedef u64 pt_vaddr_t;
+typedef u64 pt_oaddr_t;
+
+struct bcm2712pt_write_attrs {
+ pt_bcm2712_entry_t descriptor_bits;
+ gfp_t gfp;
+};
+#define pt_write_attrs bcm2712pt_write_attrs
+
+#endif
diff --git a/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c b/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c
new file mode 100644
index 000000000000..43fbc3cf3adc
--- /dev/null
+++ b/drivers/iommu/generic_pt/fmt/iommu_bcm2712.c
@@ -0,0 +1,6 @@
+// SPDX-License-Identifier: GPL-2.0-only
+#define PT_FMT bcm2712
+#define PT_SUPPORTED_FEATURES BIT(PT_FEAT_DMA_INCOHERENT)
+
+#include <linux/generic_pt/iommu.h>
+#include "iommu_template.h"
diff --git a/include/linux/generic_pt/common.h b/include/linux/generic_pt/common.h
index 07ef1c8341a4..1b39b27f0cfa 100644
--- a/include/linux/generic_pt/common.h
+++ b/include/linux/generic_pt/common.h
@@ -213,4 +213,10 @@ enum {
PT_FEAT_X86_64_AMD_ENCRYPT_TABLES = PT_FEAT_FMT_START,
};
+struct pt_bcm2712 {
+ struct pt_common common;
+ u8 bigpage_lg2;
+ u8 superpage_lg2;
+};
+
#endif
diff --git a/include/linux/generic_pt/iommu.h b/include/linux/generic_pt/iommu.h
index dd0edd02a48a..13ebb72a67de 100644
--- a/include/linux/generic_pt/iommu.h
+++ b/include/linux/generic_pt/iommu.h
@@ -346,6 +346,18 @@ struct pt_iommu_x86_64_hw_info {
IOMMU_FORMAT(x86_64, x86_64_pt);
+struct pt_iommu_bcm2712_cfg {
+ struct pt_iommu_cfg common;
+ u8 bigpage_lg2;
+ u8 superpage_lg2;
+};
+
+struct pt_iommu_bcm2712_hw_info {
+ phys_addr_t pt_base;
+};
+
+IOMMU_FORMAT(bcm2712, bcm2712pt);
+
#undef IOMMU_PROTOTYPES
#undef IOMMU_FORMAT
#endif
--
2.55.0
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH v3 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format
2026-08-25 20:56 ` [PATCH v3 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format Daniel Drake
@ 2026-08-26 18:18 ` Jason Gunthorpe
0 siblings, 0 replies; 11+ messages in thread
From: Jason Gunthorpe @ 2026-08-26 18:18 UTC (permalink / raw)
To: Daniel Drake
Cc: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, iommu, linux-kernel,
devicetree, linux-rpi-kernel, linux-arm-kernel, nick.hollinghurst,
james.quinlan, Jason Gunthorpe
On Tue, 25 Aug 2026 21:56:06 +0100, Daniel Drake <dan@reactivated.net> wrote:
> Implement generic_pt support for the 2-level page table format used by
> the BCM2712 IOMMUs.
>
> Adapted from Raspberry Pi's downstream bcm2712-iommu driver (original
> author Nick Hollinghurst).
>
>
> [...]
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
--
Jason
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v3 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-08-25 20:56 [PATCH v3 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
` (2 preceding siblings ...)
2026-08-25 20:56 ` [PATCH v3 3/5] iommu/generic_pt: Add Broadcom BCM2712 page table format Daniel Drake
@ 2026-08-25 20:56 ` Daniel Drake
2026-08-26 18:18 ` Jason Gunthorpe
2026-08-26 18:33 ` Florian Fainelli
2026-08-25 20:56 ` [PATCH v3 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes Daniel Drake
4 siblings, 2 replies; 11+ messages in thread
From: Daniel Drake @ 2026-08-25 20:56 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
This IOMMU translates memory access requests for the VC6 display
pipeline and various multimedia devices in the Broadcom BCM2712 SoC used
on Raspberry Pi 5.
The driver uses the generic_pt framework to manage the 2-level page
tables. It also provides support for the centralized L2 TLB (IOMMUC),
which is shared across the SoC's IOMMU instances and must be flushed
when modifying or unmapping page table entries.
Adapted from Raspberry Pi's downstream bcm2712-iommu driver
(original author Nick Hollinghurst).
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
drivers/iommu/Kconfig | 15 +
drivers/iommu/Makefile | 1 +
drivers/iommu/bcm2712-iommu-cache.c | 83 ++++++
drivers/iommu/bcm2712-iommu-cache.h | 9 +
drivers/iommu/bcm2712-iommu.c | 556 ++++++++++++++++++++++++++++++++++++
5 files changed, 664 insertions(+)
diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
index 6e07bd69467a..f2c8788158b0 100644
--- a/drivers/iommu/Kconfig
+++ b/drivers/iommu/Kconfig
@@ -386,6 +386,21 @@ config VSI_IOMMU
Say Y here if you want to use this IOMMU in front of these
hardware blocks.
+config BCM2712_IOMMU
+ bool "BCM2712 IOMMU driver"
+ depends on (ARCH_BCM && ARM64) || COMPILE_TEST
+ select IOMMU_API
+ select GENERIC_PT
+ select IOMMU_PT
+ select IOMMU_PT_BCM2712
+ help
+ Support for IOMMU on BCM2712 SoC. This IOMMU can be used by the
+ display controller and various multimedia devices to perform
+ efficient memory management.
+
+ Say Y here if you want to use this IOMMU in front of these
+ hardware blocks.
+
config IOMMU_DEBUG_PAGEALLOC
bool "Debug IOMMU mappings against page allocations"
depends on DEBUG_PAGEALLOC && IOMMU_API && PAGE_EXTENSION
diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
index 2f05725eaab1..29a26d2a3af1 100644
--- a/drivers/iommu/Makefile
+++ b/drivers/iommu/Makefile
@@ -37,4 +37,5 @@ obj-$(CONFIG_IOMMU_IOPF) += io-pgfault.o
obj-$(CONFIG_SPRD_IOMMU) += sprd-iommu.o
obj-$(CONFIG_APPLE_DART) += apple-dart.o
obj-$(CONFIG_VSI_IOMMU) += vsi-iommu.o
+obj-$(CONFIG_BCM2712_IOMMU) += bcm2712-iommu.o bcm2712-iommu-cache.o
obj-$(CONFIG_IOMMU_DEBUG_PAGEALLOC) += iommu-debug-pagealloc.o
diff --git a/drivers/iommu/bcm2712-iommu-cache.c b/drivers/iommu/bcm2712-iommu-cache.c
new file mode 100644
index 000000000000..040cfc4ccf9f
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu-cache.c
@@ -0,0 +1,83 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * IOMMU driver for BCM2712 TLB cache
+ *
+ * Copyright (c) 2023 Raspberry Pi Ltd.
+ * Copyright (c) 2026 Daniel Drake
+ *
+ * The BCM2712 IOMMUC is a centralized TLB which accelerates address translation
+ * across the SoC's IOMMU devices. If an address mapping is not found in the
+ * IOMMU's local TLB cache, then this IOMMUC is consulted. The IOMMUC must be
+ * explicitly invalidated when modifying or unmapping IOMMU page tables.
+ */
+
+#include <linux/cleanup.h>
+#include <linux/err.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/iopoll.h>
+
+#include "bcm2712-iommu-cache.h"
+
+struct bcm2712_iommu_cache {
+ struct device *dev;
+ spinlock_t hw_lock;
+ void __iomem *reg_base;
+};
+
+#define MMUC_CONTROL_ENABLE 1
+#define MMUC_CONTROL_FLUSH 2
+#define MMUC_CONTROL_FLUSHING 4
+
+void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache)
+{
+ u32 val;
+ int ret;
+
+ scoped_guard(spinlock_irqsave, &cache->hw_lock) {
+ writel(MMUC_CONTROL_ENABLE | MMUC_CONTROL_FLUSH,
+ cache->reg_base);
+
+ ret = readl_poll_timeout_atomic(cache->reg_base, val,
+ !(val & MMUC_CONTROL_FLUSHING),
+ 0, 50);
+ }
+
+ if (ret)
+ dev_err_ratelimited(cache->dev, "cache flush timed out\n");
+}
+
+static int bcm2712_iommu_cache_probe(struct platform_device *pdev)
+{
+ struct bcm2712_iommu_cache *cache;
+
+ cache = devm_kzalloc(&pdev->dev, sizeof(*cache), GFP_KERNEL);
+ if (!cache)
+ return -ENOMEM;
+
+ cache->dev = &pdev->dev;
+ spin_lock_init(&cache->hw_lock);
+
+ cache->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(cache->reg_base))
+ return PTR_ERR(cache->reg_base);
+
+ platform_set_drvdata(pdev, cache);
+ return 0;
+}
+
+static const struct of_device_id bcm2712_iommu_cache_of_match[] = {
+ { .compatible = "brcm,bcm2712-iommuc" },
+ { /* sentinel */ },
+};
+
+static struct platform_driver bcm2712_iommu_cache_driver = {
+ .probe = bcm2712_iommu_cache_probe,
+ .driver = {
+ .name = "bcm2712-iommu-cache",
+ .of_match_table = bcm2712_iommu_cache_of_match,
+ .suppress_bind_attrs = true,
+ },
+};
+builtin_platform_driver(bcm2712_iommu_cache_driver);
diff --git a/drivers/iommu/bcm2712-iommu-cache.h b/drivers/iommu/bcm2712-iommu-cache.h
new file mode 100644
index 000000000000..d2f7851831cc
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu-cache.h
@@ -0,0 +1,9 @@
+/* SPDX-License-Identifier: GPL-2.0-only */
+#ifndef _BCM2712_IOMMU_CACHE_H
+#define _BCM2712_IOMMU_CACHE_H
+
+struct bcm2712_iommu_cache;
+
+void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache);
+
+#endif
diff --git a/drivers/iommu/bcm2712-iommu.c b/drivers/iommu/bcm2712-iommu.c
new file mode 100644
index 000000000000..1bb456a83df5
--- /dev/null
+++ b/drivers/iommu/bcm2712-iommu.c
@@ -0,0 +1,556 @@
+// SPDX-License-Identifier: GPL-2.0-only
+/*
+ * IOMMU driver for Broadcom BCM2712
+ *
+ * Copyright (c) 2023-2025 Raspberry Pi Ltd.
+ * Copyright (c) 2026 Daniel Drake
+ *
+ * Each BCM2712 IOMMU has multiple devices hardwired into it, whose
+ * DMA transactions all route through the IOMMU. There is no stream ID tagging
+ * or any other kind of segmentation to differentiate between requests from
+ * different devices. It is also not possible to toggle a specific device
+ * between iommu-mapped and bypass modes.
+ *
+ * The hardware supports the simultaneous configuration of a bypass window
+ * (where memory accesses operate in identity mode) and a translation aperture
+ * (supporting page mapping). While combining these two would allow for
+ * GART-like operation, this driver's paging domain implementation configures
+ * only the translation aperture (starting at IOVA 0) offering a degree of
+ * memory protection.
+ *
+ * The page table format is a two-level format handled by generic_pt/bcm2712.
+ */
+
+#include <linux/bitfield.h>
+#include <linux/cleanup.h>
+#include <linux/dma-mapping.h>
+#include <linux/err.h>
+#include <linux/iommu.h>
+#include <linux/iopoll.h>
+#include <linux/of_platform.h>
+#include <linux/platform_device.h>
+#include <linux/spinlock.h>
+#include <linux/sizes.h>
+#include <linux/generic_pt/iommu.h>
+
+#include "bcm2712-iommu-cache.h"
+#include "dma-iommu.h"
+#include "iommu-pages.h"
+
+/* BCM2712 IOMMU is organized around 4Kbyte pages */
+#define IOMMU_PAGE_SHIFT 12
+#define IOMMU_PAGE_SIZE (1ul << IOMMU_PAGE_SHIFT)
+/* A PTE is 4 bytes */
+#define PTE_SIZE_SHIFT 2
+/* L1/L2 table sizing (IOMMU hardware pages): 1024 entries per page */
+#define PTES_PER_IOPG_SHIFT (IOMMU_PAGE_SHIFT - PTE_SIZE_SHIFT)
+
+#define MMMU_CTRL_OFFSET 0x00
+#define MMMU_CTRL_CAP_EXCEEDED BIT(27)
+#define MMMU_CTRL_CAP_EXCEEDED_ABORT_EN BIT(26)
+#define MMMU_CTRL_CAP_EXCEEDED_INT_EN BIT(25)
+#define MMMU_CTRL_CAP_EXCEEDED_EXCEPTION_EN BIT(24)
+#define MMMU_CTRL_PT_INVALID BIT(20)
+#define MMMU_CTRL_PT_INVALID_ABORT_EN BIT(19)
+#define MMMU_CTRL_PT_INVALID_INT_EN BIT(18)
+#define MMMU_CTRL_PT_INVALID_EXCEPTION_EN BIT(17)
+#define MMMU_CTRL_PT_INVALID_EN BIT(16)
+#define MMMU_CTRL_WRITE_VIOLATION BIT(12)
+#define MMMU_CTRL_WRITE_VIOLATION_ABORT_EN BIT(11)
+#define MMMU_CTRL_WRITE_VIOLATION_INT_EN BIT(10)
+#define MMMU_CTRL_WRITE_VIOLATION_EXCEPTION_EN BIT(9)
+#define MMMU_CTRL_BYPASS BIT(8)
+#define MMMU_CTRL_TLB_CLEARING BIT(7)
+#define MMMU_CTRL_STATS_CLEAR BIT(3)
+#define MMMU_CTRL_TLB_CLEAR BIT(2)
+#define MMMU_CTRL_STATS_ENABLE BIT(1)
+#define MMMU_CTRL_ENABLE BIT(0)
+
+#define MMMU_CTRL_OPERATING_FLAGS (\
+ MMMU_CTRL_CAP_EXCEEDED_ABORT_EN | \
+ MMMU_CTRL_PT_INVALID_ABORT_EN | \
+ MMMU_CTRL_PT_INVALID_EN | \
+ MMMU_CTRL_WRITE_VIOLATION_ABORT_EN | \
+ MMMU_CTRL_STATS_ENABLE | \
+ MMMU_CTRL_ENABLE)
+
+#define MMMU_PT_PA_BASE_OFFSET 0x04
+
+#define MMMU_ADDR_CAP_OFFSET 0x14
+#define MMMU_ADDR_CAP_ENABLE BIT(31)
+#define ADDR_CAP_SHIFT ilog2(SZ_256M)
+
+#define MMMU_SHOOT_DOWN_OFFSET 0x18
+#define MMMU_SHOOT_DOWN_SHOOTING BIT(31)
+#define MMMU_SHOOT_DOWN_SHOOT BIT(30)
+
+#define MMMU_BYPASS_START_OFFSET 0x1c
+#define MMMU_BYPASS_START_ENABLE BIT(31)
+
+#define MMMU_BYPASS_END_OFFSET 0x20
+#define MMMU_BYPASS_END_ENABLE BIT(31)
+
+#define MMMU_MISC_OFFSET 0x24
+#define MMMU_MISC_SINGLE_TABLE BIT(31)
+
+#define MMMU_ILLEGAL_ADR_OFFSET 0x30
+#define MMMU_ILLEGAL_ADR_ENABLE BIT(31)
+
+#define MMMU_DEBUG_INFO_OFFSET 0x38
+#define MMMU_DEBUG_INFO_VERSION_MASK 0x0000000Fu
+#define MMMU_DEBUG_INFO_VA_WIDTH_MASK 0x000000F0u
+#define MMMU_DEBUG_INFO_PA_WIDTH_MASK 0x00000F00u
+#define MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK 0x000FF000u
+#define MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK 0x0FF00000u
+#define MMMU_DEBUG_INFO_BYPASS_4M BIT(28)
+#define MMMU_DEBUG_INFO_BYPASS BIT(29)
+
+struct bcm2712_iommu {
+ struct device *dev;
+ struct iommu_device iommu;
+ struct bcm2712_iommu_domain *domain;
+ struct bcm2712_iommu_cache *cache;
+ void __iomem *reg_base;
+ spinlock_t hw_lock;
+ size_t bigpage_size;
+ size_t superpage_size;
+};
+
+struct bcm2712_iommu_domain {
+ union {
+ struct iommu_domain base;
+ struct pt_iommu_bcm2712 pt;
+ };
+ struct bcm2712_iommu *mmu;
+ void *default_page;
+};
+
+#define MMU_WR(off, val) writel(val, mmu->reg_base + (off))
+#define MMU_RD(off) readl(mmu->reg_base + (off))
+
+static struct bcm2712_iommu_domain *
+to_bcm2712_domain(struct iommu_domain *domain)
+{
+ return container_of(domain, struct bcm2712_iommu_domain, base);
+}
+
+static void bcm2712_iommu_init(struct bcm2712_iommu *mmu)
+{
+ unsigned int bigpage_width, superpage_width;
+ u32 u = MMU_RD(MMMU_DEBUG_INFO_OFFSET);
+ u32 pa_width = FIELD_GET(MMMU_DEBUG_INFO_PA_WIDTH_MASK, u);
+
+ dev_dbg(mmu->dev, "DEBUG_INFO = 0x%08x\n", u);
+ WARN_ON(FIELD_GET(MMMU_DEBUG_INFO_VERSION_MASK, u) < 4 ||
+ FIELD_GET(MMMU_DEBUG_INFO_VA_WIDTH_MASK, u) < 6 ||
+ pa_width < 6 || !(u & MMMU_DEBUG_INFO_BYPASS));
+
+ dma_set_mask_and_coherent(mmu->dev, DMA_BIT_MASK(pa_width + 30u));
+
+ bigpage_width = FIELD_GET(MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK, u);
+ if (bigpage_width)
+ mmu->bigpage_size = IOMMU_PAGE_SIZE << bigpage_width;
+
+ superpage_width = FIELD_GET(MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK, u);
+ if (superpage_width)
+ mmu->superpage_size = IOMMU_PAGE_SIZE << superpage_width;
+
+ /* Disable MMU and clear sticky flags */
+ MMU_WR(MMMU_CTRL_OFFSET, MMMU_CTRL_CAP_EXCEEDED | MMMU_CTRL_PT_INVALID |
+ MMMU_CTRL_WRITE_VIOLATION |
+ MMMU_CTRL_STATS_CLEAR);
+
+ /* Put MMU into 2-level mode */
+ MMU_WR(MMMU_MISC_OFFSET,
+ MMU_RD(MMMU_MISC_OFFSET) & ~MMMU_MISC_SINGLE_TABLE);
+}
+
+static int bcm2712_iommu_identity_attach(struct iommu_domain *identity_domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+
+ guard(spinlock_irqsave)(&mmu->hw_lock);
+ MMU_WR(MMMU_CTRL_OFFSET, 0);
+ mmu->domain = NULL;
+
+ return 0;
+}
+
+static struct iommu_domain bcm2712_identity_domain = {
+ .type = IOMMU_DOMAIN_IDENTITY,
+ .ops = &(const struct iommu_domain_ops) {
+ .attach_dev = bcm2712_iommu_identity_attach,
+ },
+};
+
+static int bcm2712_iommu_blocking_attach(struct iommu_domain *blocking_domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+
+ guard(spinlock_irqsave)(&mmu->hw_lock);
+
+ /*
+ * Completely block DMA by disabling both the bypass window and the
+ * translation aperture.
+ */
+ MMU_WR(MMMU_BYPASS_START_OFFSET, 0);
+ MMU_WR(MMMU_BYPASS_END_OFFSET, 0);
+ MMU_WR(MMMU_ADDR_CAP_OFFSET, MMMU_ADDR_CAP_ENABLE);
+ MMU_WR(MMMU_CTRL_OFFSET, MMMU_CTRL_OPERATING_FLAGS);
+
+ mmu->domain = NULL;
+
+ return 0;
+}
+
+static struct iommu_domain bcm2712_blocking_domain = {
+ .type = IOMMU_DOMAIN_BLOCKED,
+ .ops = &(const struct iommu_domain_ops) {
+ .attach_dev = bcm2712_iommu_blocking_attach,
+ },
+};
+
+static int bcm2712_iommu_enable_and_clear_tlb(struct bcm2712_iommu *mmu)
+{
+ u32 val;
+
+ MMU_WR(MMMU_CTRL_OFFSET,
+ MMMU_CTRL_OPERATING_FLAGS | MMMU_CTRL_TLB_CLEAR);
+ return readl_poll_timeout_atomic(mmu->reg_base + MMMU_CTRL_OFFSET, val,
+ !(val & MMMU_CTRL_TLB_CLEARING), 0,
+ 50);
+}
+
+static int bcm2712_iommu_attach_dev(struct iommu_domain *domain,
+ struct device *dev,
+ struct iommu_domain *old)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
+ struct pt_iommu_bcm2712_hw_info info;
+ u32 default_page_pfn;
+ int ret = 0;
+
+ /* all attached devices must belong to the same IOMMU instance */
+ if (mydomain->mmu != mmu)
+ return -EINVAL;
+
+ scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
+ if (mmu->domain == mydomain)
+ break;
+
+ mmu->domain = mydomain;
+
+ /* Configure translation aperture */
+ MMU_WR(MMMU_ADDR_CAP_OFFSET,
+ MMMU_ADDR_CAP_ENABLE +
+ (domain->geometry.aperture_end >> ADDR_CAP_SHIFT));
+
+ /*
+ * When the IOMMU handles a request, it adds the
+ * PT_PA_BASE_OFFSET to (IOVA>>32) to calculate the PFN of the
+ * corresponding L1 directory page.
+ * IOVA bits [31:22] are then used to fetch the L1 descriptor
+ * within (which in turn points to the L2 table).
+ * This clever logic would allow for a L1 table larger than 4kb
+ * (and hence a larger aperture).
+ */
+ pt_iommu_bcm2712_hw_info(&mydomain->pt, &info);
+ MMU_WR(MMMU_PT_PA_BASE_OFFSET,
+ info.pt_base >> IOMMU_PAGE_SHIFT);
+
+ /* Disable bypass window */
+ MMU_WR(MMMU_BYPASS_START_OFFSET, 0);
+ MMU_WR(MMMU_BYPASS_END_OFFSET, 0);
+
+ /*
+ * A default (error) page is used to catch illegal reads/writes.
+ */
+ default_page_pfn = virt_to_phys(mydomain->default_page) >>
+ IOMMU_PAGE_SHIFT;
+ MMU_WR(MMMU_ILLEGAL_ADR_OFFSET,
+ MMMU_ILLEGAL_ADR_ENABLE + default_page_pfn);
+
+ bcm2712_iommu_cache_flush(mmu->cache);
+ ret = bcm2712_iommu_enable_and_clear_tlb(mmu);
+ }
+
+ if (ret)
+ dev_err_ratelimited(mmu->dev,
+ "TLB clear timed out during attach\n");
+
+ return ret;
+}
+
+static int bcm2712_iommu_shootdown_range(struct bcm2712_iommu *mmu,
+ unsigned long iova, size_t size)
+{
+ unsigned long iova_end = iova + size - 1;
+ unsigned int page_group;
+ u32 val;
+ int ret;
+
+ /* Shootdown register deals with 4 pages at a time */
+ for (page_group = iova >> (IOMMU_PAGE_SHIFT + 2);
+ page_group <= iova_end >> (IOMMU_PAGE_SHIFT + 2); page_group++) {
+ MMU_WR(MMMU_SHOOT_DOWN_OFFSET,
+ MMMU_SHOOT_DOWN_SHOOT + (page_group << 2));
+ ret = readl_poll_timeout_atomic(
+ mmu->reg_base + MMMU_SHOOT_DOWN_OFFSET, val,
+ !(val & MMMU_SHOOT_DOWN_SHOOTING), 0, 50);
+ if (ret)
+ return ret;
+ }
+
+ return 0;
+}
+
+static int bcm2712_iommu_sync_range(struct iommu_domain *domain,
+ unsigned long iova, size_t size)
+{
+ struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
+ struct bcm2712_iommu *mmu = mydomain->mmu;
+ int ret = 0;
+
+ scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
+ if (mmu->domain != mydomain)
+ return 0;
+
+ bcm2712_iommu_cache_flush(mmu->cache);
+
+ /* If invalidating more than 1MB, just do a full TLB clear */
+ if (size >= SZ_1M)
+ ret = bcm2712_iommu_enable_and_clear_tlb(mmu);
+ else
+ ret = bcm2712_iommu_shootdown_range(mmu, iova, size);
+ }
+
+ if (ret)
+ dev_err_ratelimited(mmu->dev,
+ "TLB sync timed out (size=%#zx)\n", size);
+
+ return ret;
+}
+
+static void bcm2712_iommu_sync(struct iommu_domain *domain,
+ struct iommu_iotlb_gather *gather)
+{
+ bcm2712_iommu_sync_range(domain, gather->start,
+ gather->end - gather->start + 1);
+}
+
+static int bcm2712_iommu_sync_map(struct iommu_domain *domain,
+ unsigned long iova, size_t size)
+{
+ return bcm2712_iommu_sync_range(domain, iova, size);
+}
+
+static void bcm2712_iommu_sync_all(struct iommu_domain *domain)
+{
+ size_t aperture_size = domain->geometry.aperture_end -
+ domain->geometry.aperture_start + 1;
+
+ bcm2712_iommu_sync_range(domain, domain->geometry.aperture_start,
+ aperture_size);
+}
+
+static void bcm2712_iommu_domain_free(struct iommu_domain *domain)
+{
+ struct bcm2712_iommu_domain *mydomain = to_bcm2712_domain(domain);
+ struct bcm2712_iommu *mmu = mydomain->mmu;
+
+ scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
+ if (mmu->domain == mydomain) {
+ MMU_WR(MMMU_CTRL_OFFSET, 0);
+ mmu->domain = NULL;
+ }
+ }
+
+ pt_iommu_deinit(&mydomain->pt.iommu);
+ if (mydomain->default_page)
+ iommu_free_pages(mydomain->default_page);
+ kfree(mydomain);
+}
+
+static const struct iommu_domain_ops bcm2712_paging_domain_ops = {
+ IOMMU_PT_DOMAIN_OPS(bcm2712),
+ .attach_dev = bcm2712_iommu_attach_dev,
+ .iotlb_sync = bcm2712_iommu_sync,
+ .iotlb_sync_map = bcm2712_iommu_sync_map,
+ .flush_iotlb_all = bcm2712_iommu_sync_all,
+ .free = bcm2712_iommu_domain_free,
+};
+
+static struct iommu_domain *bcm2712_iommu_domain_alloc(struct device *dev)
+{
+ struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
+ struct bcm2712_iommu_domain *domain;
+ struct pt_iommu_bcm2712_cfg cfg;
+ int ret;
+
+ domain = kzalloc_obj(*domain);
+ if (!domain)
+ return NULL;
+
+ domain->mmu = mmu;
+ domain->pt.iommu.iommu_device = mmu->dev;
+ memset(&cfg, 0, sizeof(cfg));
+ cfg.common.features = BIT(PT_FEAT_DMA_INCOHERENT);
+
+ /* Bigpage and superpage sizes are typically 64K and 1M, but may vary */
+ if (mmu->bigpage_size)
+ cfg.bigpage_lg2 = ilog2(mmu->bigpage_size);
+ if (mmu->superpage_size)
+ cfg.superpage_lg2 = ilog2(mmu->superpage_size);
+
+ /* 2-level format: 10-bit L1 + 10-bit L2 + 12-bit page offset */
+ cfg.common.hw_max_vasz_lg2 =
+ (2 * PTES_PER_IOPG_SHIFT) + IOMMU_PAGE_SHIFT;
+
+ /* PTEs encode a 25-bit output address PFN */
+ cfg.common.hw_max_oasz_lg2 = 25 + IOMMU_PAGE_SHIFT;
+
+ ret = pt_iommu_bcm2712_init(&domain->pt, &cfg, GFP_KERNEL);
+ if (ret)
+ goto err;
+
+ /* Set up a default (error) page used to catch illegal reads/writes */
+ domain->default_page = iommu_alloc_pages_sz(GFP_KERNEL, PAGE_SIZE);
+ if (!domain->default_page)
+ goto err;
+
+ domain->base.ops = &bcm2712_paging_domain_ops;
+ return &domain->base;
+
+err:
+ bcm2712_iommu_domain_free(&domain->base);
+ return NULL;
+}
+
+static struct bcm2712_iommu *
+bcm2712_iommu_get_by_fwnode(struct fwnode_handle *fwnode)
+{
+ struct device *dev __free(put_device) =
+ bus_find_device_by_fwnode(&platform_bus_type, fwnode);
+
+ return dev ? dev_get_drvdata(dev) : NULL;
+}
+
+static struct iommu_device *bcm2712_iommu_probe_device(struct device *dev)
+{
+ struct iommu_fwspec *fwspec = dev_iommu_fwspec_get(dev);
+ struct bcm2712_iommu *mmu;
+
+ if (!fwspec || !fwspec->iommu_fwnode)
+ return ERR_PTR(-ENODEV);
+
+ mmu = bcm2712_iommu_get_by_fwnode(fwspec->iommu_fwnode);
+ if (!mmu)
+ return ERR_PTR(-ENODEV);
+
+ dev_iommu_priv_set(dev, mmu);
+
+ return &mmu->iommu;
+}
+
+static int bcm2712_iommu_of_xlate(struct device *dev,
+ const struct of_phandle_args *args)
+{
+ return iommu_fwspec_add_ids(dev, args->args, 0);
+}
+
+static const struct iommu_ops bcm2712_iommu_ops = {
+ .identity_domain = &bcm2712_identity_domain,
+ .blocked_domain = &bcm2712_blocking_domain,
+ .domain_alloc_paging = bcm2712_iommu_domain_alloc,
+ .probe_device = bcm2712_iommu_probe_device,
+ .device_group = generic_single_device_group,
+ .get_resv_regions = iommu_dma_get_resv_regions,
+ .of_xlate = bcm2712_iommu_of_xlate,
+};
+
+static const struct of_device_id bcm2712_iommu_of_match[] = {
+ { .compatible = "brcm,bcm2712-iommu" },
+ { /* sentinel */ }
+};
+
+static int bcm2712_iommu_init_cache(struct bcm2712_iommu *mmu,
+ struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+
+ struct device_node *cache_np __free(device_node) =
+ of_parse_phandle(dev->of_node, "brcm,iommu-cache", 0);
+ if (!cache_np)
+ return dev_err_probe(dev, -ENOENT,
+ "missing brcm,iommu-cache property\n");
+
+ struct platform_device *cache_pdev __free(platform_device_put) =
+ of_find_device_by_node(cache_np);
+ if (!cache_pdev)
+ return dev_err_probe(dev, -EPROBE_DEFER,
+ "waiting for cache device\n");
+
+ mmu->cache = platform_get_drvdata(cache_pdev);
+ if (!mmu->cache)
+ return dev_err_probe(dev, -EPROBE_DEFER,
+ "waiting for cache driver probe\n");
+
+ return 0;
+}
+
+static int bcm2712_iommu_probe(struct platform_device *pdev)
+{
+ struct device *dev = &pdev->dev;
+ struct bcm2712_iommu *mmu;
+ int ret;
+
+ mmu = devm_kzalloc(dev, sizeof(*mmu), GFP_KERNEL);
+ if (!mmu)
+ return -ENOMEM;
+
+ mmu->dev = dev;
+ spin_lock_init(&mmu->hw_lock);
+
+ mmu->reg_base = devm_platform_ioremap_resource(pdev, 0);
+ if (IS_ERR(mmu->reg_base))
+ return PTR_ERR(mmu->reg_base);
+
+ ret = bcm2712_iommu_init_cache(mmu, pdev);
+ if (ret)
+ return ret;
+
+ platform_set_drvdata(pdev, mmu);
+ bcm2712_iommu_init(mmu);
+
+ ret = iommu_device_sysfs_add(&mmu->iommu, dev, NULL, "%s",
+ dev_name(dev));
+ if (ret)
+ return ret;
+
+ ret = iommu_device_register(&mmu->iommu, &bcm2712_iommu_ops, dev);
+ if (ret) {
+ iommu_device_sysfs_remove(&mmu->iommu);
+ return ret;
+ }
+
+ return 0;
+}
+
+static struct platform_driver bcm2712_iommu_driver = {
+ .driver = {
+ .name = "bcm2712-iommu",
+ .of_match_table = bcm2712_iommu_of_match,
+ .suppress_bind_attrs = true,
+ },
+ .probe = bcm2712_iommu_probe,
+};
+builtin_platform_driver(bcm2712_iommu_driver);
+
+MODULE_LICENSE("GPL");
+MODULE_AUTHOR("Daniel Drake <dan@reactivated.net>");
+MODULE_DESCRIPTION("Broadcom BCM2712 IOMMU driver");
--
2.55.0
^ permalink raw reply related [flat|nested] 11+ messages in thread* Re: [PATCH v3 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-08-25 20:56 ` [PATCH v3 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
@ 2026-08-26 18:18 ` Jason Gunthorpe
2026-08-26 18:33 ` Florian Fainelli
1 sibling, 0 replies; 11+ messages in thread
From: Jason Gunthorpe @ 2026-08-26 18:18 UTC (permalink / raw)
To: Daniel Drake
Cc: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, iommu, linux-kernel,
devicetree, linux-rpi-kernel, linux-arm-kernel, nick.hollinghurst,
james.quinlan, Jason Gunthorpe
> This IOMMU translates memory access requests for the VC6 display
> pipeline and various multimedia devices in the Broadcom BCM2712 SoC used
> on Raspberry Pi 5.
>
> The driver uses the generic_pt framework to manage the 2-level page
> tables. It also provides support for the centralized L2 TLB (IOMMUC),
> which is shared across the SoC's IOMMU instances and must be flushed
> when modifying or unmapping page table entries.
>
> Adapted from Raspberry Pi's downstream bcm2712-iommu driver
> (original author Nick Hollinghurst).
>
> Signed-off-by: Daniel Drake <dan@reactivated.net>
This seems OK to me.
The sashiko remarks all look wrong except maybe the bit about leaving
stale entries in the IOTLB and leaving the ILEGAL_ADR_OFFSET programed
Reviewed-by: Jason Gunthorpe <jgg@nvidia.com>
--
Jason
^ permalink raw reply [flat|nested] 11+ messages in thread
* Re: [PATCH v3 4/5] iommu: Add Broadcom BCM2712 IOMMU driver
2026-08-25 20:56 ` [PATCH v3 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
2026-08-26 18:18 ` Jason Gunthorpe
@ 2026-08-26 18:33 ` Florian Fainelli
1 sibling, 0 replies; 11+ messages in thread
From: Florian Fainelli @ 2026-08-26 18:33 UTC (permalink / raw)
To: Daniel Drake, Joerg Roedel (AMD), Will Deacon, Robin Murphy,
Rob Herring, Krzysztof Kozlowski, Conor Dooley,
Broadcom internal kernel review list
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
On 8/25/26 13:56, Daniel Drake wrote:
> This IOMMU translates memory access requests for the VC6 display
> pipeline and various multimedia devices in the Broadcom BCM2712 SoC used
> on Raspberry Pi 5.
>
> The driver uses the generic_pt framework to manage the 2-level page
> tables. It also provides support for the centralized L2 TLB (IOMMUC),
> which is shared across the SoC's IOMMU instances and must be flushed
> when modifying or unmapping page table entries.
>
> Adapted from Raspberry Pi's downstream bcm2712-iommu driver
> (original author Nick Hollinghurst).
>
> Signed-off-by: Daniel Drake <dan@reactivated.net>
> ---
> drivers/iommu/Kconfig | 15 +
> drivers/iommu/Makefile | 1 +
> drivers/iommu/bcm2712-iommu-cache.c | 83 ++++++
> drivers/iommu/bcm2712-iommu-cache.h | 9 +
> drivers/iommu/bcm2712-iommu.c | 556 ++++++++++++++++++++++++++++++++++++
> 5 files changed, 664 insertions(+)
>
> diff --git a/drivers/iommu/Kconfig b/drivers/iommu/Kconfig
> index 6e07bd69467a..f2c8788158b0 100644
> --- a/drivers/iommu/Kconfig
> +++ b/drivers/iommu/Kconfig
> @@ -386,6 +386,21 @@ config VSI_IOMMU
> Say Y here if you want to use this IOMMU in front of these
> hardware blocks.
>
> +config BCM2712_IOMMU
> + bool "BCM2712 IOMMU driver"
> + depends on (ARCH_BCM && ARM64) || COMPILE_TEST
> + select IOMMU_API
> + select GENERIC_PT
> + select IOMMU_PT
> + select IOMMU_PT_BCM2712
> + help
> + Support for IOMMU on BCM2712 SoC. This IOMMU can be used by the
> + display controller and various multimedia devices to perform
> + efficient memory management.
> +
> + Say Y here if you want to use this IOMMU in front of these
> + hardware blocks.
> +
> config IOMMU_DEBUG_PAGEALLOC
> bool "Debug IOMMU mappings against page allocations"
> depends on DEBUG_PAGEALLOC && IOMMU_API && PAGE_EXTENSION
> diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
> index 2f05725eaab1..29a26d2a3af1 100644
> --- a/drivers/iommu/Makefile
> +++ b/drivers/iommu/Makefile
> @@ -37,4 +37,5 @@ obj-$(CONFIG_IOMMU_IOPF) += io-pgfault.o
> obj-$(CONFIG_SPRD_IOMMU) += sprd-iommu.o
> obj-$(CONFIG_APPLE_DART) += apple-dart.o
> obj-$(CONFIG_VSI_IOMMU) += vsi-iommu.o
> +obj-$(CONFIG_BCM2712_IOMMU) += bcm2712-iommu.o bcm2712-iommu-cache.o
> obj-$(CONFIG_IOMMU_DEBUG_PAGEALLOC) += iommu-debug-pagealloc.o
> diff --git a/drivers/iommu/bcm2712-iommu-cache.c b/drivers/iommu/bcm2712-iommu-cache.c
> new file mode 100644
> index 000000000000..040cfc4ccf9f
> --- /dev/null
> +++ b/drivers/iommu/bcm2712-iommu-cache.c
> @@ -0,0 +1,83 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * IOMMU driver for BCM2712 TLB cache
> + *
> + * Copyright (c) 2023 Raspberry Pi Ltd.
> + * Copyright (c) 2026 Daniel Drake
> + *
> + * The BCM2712 IOMMUC is a centralized TLB which accelerates address translation
> + * across the SoC's IOMMU devices. If an address mapping is not found in the
> + * IOMMU's local TLB cache, then this IOMMUC is consulted. The IOMMUC must be
> + * explicitly invalidated when modifying or unmapping IOMMU page tables.
> + */
> +
> +#include <linux/cleanup.h>
> +#include <linux/err.h>
> +#include <linux/of_platform.h>
> +#include <linux/platform_device.h>
> +#include <linux/spinlock.h>
> +#include <linux/iopoll.h>
> +
> +#include "bcm2712-iommu-cache.h"
> +
> +struct bcm2712_iommu_cache {
> + struct device *dev;
> + spinlock_t hw_lock;
> + void __iomem *reg_base;
> +};
> +
> +#define MMUC_CONTROL_ENABLE 1
> +#define MMUC_CONTROL_FLUSH 2
> +#define MMUC_CONTROL_FLUSHING 4
Those should be BIT(0), BIT(1) and BIT(2) respectively.
> +
> +void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache)
> +{
> + u32 val;
> + int ret;
> +
> + scoped_guard(spinlock_irqsave, &cache->hw_lock) {
> + writel(MMUC_CONTROL_ENABLE | MMUC_CONTROL_FLUSH,
> + cache->reg_base);
> +
> + ret = readl_poll_timeout_atomic(cache->reg_base, val,
> + !(val & MMUC_CONTROL_FLUSHING),
> + 0, 50);
> + }
> +
> + if (ret)
> + dev_err_ratelimited(cache->dev, "cache flush timed out\n");
> +}
> +
> +static int bcm2712_iommu_cache_probe(struct platform_device *pdev)
> +{
> + struct bcm2712_iommu_cache *cache;
> +
> + cache = devm_kzalloc(&pdev->dev, sizeof(*cache), GFP_KERNEL);
> + if (!cache)
> + return -ENOMEM;
> +
> + cache->dev = &pdev->dev;
> + spin_lock_init(&cache->hw_lock);
> +
> + cache->reg_base = devm_platform_ioremap_resource(pdev, 0);
> + if (IS_ERR(cache->reg_base))
> + return PTR_ERR(cache->reg_base);
> +
> + platform_set_drvdata(pdev, cache);
> + return 0;
> +}
> +
> +static const struct of_device_id bcm2712_iommu_cache_of_match[] = {
> + { .compatible = "brcm,bcm2712-iommuc" },
> + { /* sentinel */ },
> +};
> +
> +static struct platform_driver bcm2712_iommu_cache_driver = {
> + .probe = bcm2712_iommu_cache_probe,
> + .driver = {
> + .name = "bcm2712-iommu-cache",
> + .of_match_table = bcm2712_iommu_cache_of_match,
> + .suppress_bind_attrs = true,
> + },
> +};
> +builtin_platform_driver(bcm2712_iommu_cache_driver);
> diff --git a/drivers/iommu/bcm2712-iommu-cache.h b/drivers/iommu/bcm2712-iommu-cache.h
> new file mode 100644
> index 000000000000..d2f7851831cc
> --- /dev/null
> +++ b/drivers/iommu/bcm2712-iommu-cache.h
> @@ -0,0 +1,9 @@
> +/* SPDX-License-Identifier: GPL-2.0-only */
> +#ifndef _BCM2712_IOMMU_CACHE_H
> +#define _BCM2712_IOMMU_CACHE_H
> +
> +struct bcm2712_iommu_cache;
> +
> +void bcm2712_iommu_cache_flush(struct bcm2712_iommu_cache *cache);
> +
> +#endif
> diff --git a/drivers/iommu/bcm2712-iommu.c b/drivers/iommu/bcm2712-iommu.c
> new file mode 100644
> index 000000000000..1bb456a83df5
> --- /dev/null
> +++ b/drivers/iommu/bcm2712-iommu.c
> @@ -0,0 +1,556 @@
> +// SPDX-License-Identifier: GPL-2.0-only
> +/*
> + * IOMMU driver for Broadcom BCM2712
> + *
> + * Copyright (c) 2023-2025 Raspberry Pi Ltd.
> + * Copyright (c) 2026 Daniel Drake
> + *
> + * Each BCM2712 IOMMU has multiple devices hardwired into it, whose
> + * DMA transactions all route through the IOMMU. There is no stream ID tagging
> + * or any other kind of segmentation to differentiate between requests from
> + * different devices. It is also not possible to toggle a specific device
> + * between iommu-mapped and bypass modes.
> + *
> + * The hardware supports the simultaneous configuration of a bypass window
> + * (where memory accesses operate in identity mode) and a translation aperture
> + * (supporting page mapping). While combining these two would allow for
> + * GART-like operation, this driver's paging domain implementation configures
> + * only the translation aperture (starting at IOVA 0) offering a degree of
> + * memory protection.
> + *
> + * The page table format is a two-level format handled by generic_pt/bcm2712.
> + */
> +
> +#include <linux/bitfield.h>
> +#include <linux/cleanup.h>
> +#include <linux/dma-mapping.h>
> +#include <linux/err.h>
> +#include <linux/iommu.h>
> +#include <linux/iopoll.h>
> +#include <linux/of_platform.h>
> +#include <linux/platform_device.h>
> +#include <linux/spinlock.h>
> +#include <linux/sizes.h>
> +#include <linux/generic_pt/iommu.h>
> +
> +#include "bcm2712-iommu-cache.h"
> +#include "dma-iommu.h"
> +#include "iommu-pages.h"
> +
> +/* BCM2712 IOMMU is organized around 4Kbyte pages */
> +#define IOMMU_PAGE_SHIFT 12
> +#define IOMMU_PAGE_SIZE (1ul << IOMMU_PAGE_SHIFT)
> +/* A PTE is 4 bytes */
> +#define PTE_SIZE_SHIFT 2
> +/* L1/L2 table sizing (IOMMU hardware pages): 1024 entries per page */
> +#define PTES_PER_IOPG_SHIFT (IOMMU_PAGE_SHIFT - PTE_SIZE_SHIFT)
> +
> +#define MMMU_CTRL_OFFSET 0x00
> +#define MMMU_CTRL_CAP_EXCEEDED BIT(27)
> +#define MMMU_CTRL_CAP_EXCEEDED_ABORT_EN BIT(26)
> +#define MMMU_CTRL_CAP_EXCEEDED_INT_EN BIT(25)
> +#define MMMU_CTRL_CAP_EXCEEDED_EXCEPTION_EN BIT(24)
> +#define MMMU_CTRL_PT_INVALID BIT(20)
> +#define MMMU_CTRL_PT_INVALID_ABORT_EN BIT(19)
> +#define MMMU_CTRL_PT_INVALID_INT_EN BIT(18)
> +#define MMMU_CTRL_PT_INVALID_EXCEPTION_EN BIT(17)
> +#define MMMU_CTRL_PT_INVALID_EN BIT(16)
> +#define MMMU_CTRL_WRITE_VIOLATION BIT(12)
> +#define MMMU_CTRL_WRITE_VIOLATION_ABORT_EN BIT(11)
> +#define MMMU_CTRL_WRITE_VIOLATION_INT_EN BIT(10)
> +#define MMMU_CTRL_WRITE_VIOLATION_EXCEPTION_EN BIT(9)
> +#define MMMU_CTRL_BYPASS BIT(8)
> +#define MMMU_CTRL_TLB_CLEARING BIT(7)
> +#define MMMU_CTRL_STATS_CLEAR BIT(3)
> +#define MMMU_CTRL_TLB_CLEAR BIT(2)
> +#define MMMU_CTRL_STATS_ENABLE BIT(1)
> +#define MMMU_CTRL_ENABLE BIT(0)
> +
> +#define MMMU_CTRL_OPERATING_FLAGS (\
> + MMMU_CTRL_CAP_EXCEEDED_ABORT_EN | \
> + MMMU_CTRL_PT_INVALID_ABORT_EN | \
> + MMMU_CTRL_PT_INVALID_EN | \
> + MMMU_CTRL_WRITE_VIOLATION_ABORT_EN | \
> + MMMU_CTRL_STATS_ENABLE | \
> + MMMU_CTRL_ENABLE)
> +
> +#define MMMU_PT_PA_BASE_OFFSET 0x04
> +
> +#define MMMU_ADDR_CAP_OFFSET 0x14
> +#define MMMU_ADDR_CAP_ENABLE BIT(31)
> +#define ADDR_CAP_SHIFT ilog2(SZ_256M)
> +
> +#define MMMU_SHOOT_DOWN_OFFSET 0x18
> +#define MMMU_SHOOT_DOWN_SHOOTING BIT(31)
> +#define MMMU_SHOOT_DOWN_SHOOT BIT(30)
> +
> +#define MMMU_BYPASS_START_OFFSET 0x1c
> +#define MMMU_BYPASS_START_ENABLE BIT(31)
> +
> +#define MMMU_BYPASS_END_OFFSET 0x20
> +#define MMMU_BYPASS_END_ENABLE BIT(31)
> +
> +#define MMMU_MISC_OFFSET 0x24
> +#define MMMU_MISC_SINGLE_TABLE BIT(31)
> +
> +#define MMMU_ILLEGAL_ADR_OFFSET 0x30
> +#define MMMU_ILLEGAL_ADR_ENABLE BIT(31)
> +
> +#define MMMU_DEBUG_INFO_OFFSET 0x38
> +#define MMMU_DEBUG_INFO_VERSION_MASK 0x0000000Fu
> +#define MMMU_DEBUG_INFO_VA_WIDTH_MASK 0x000000F0u
> +#define MMMU_DEBUG_INFO_PA_WIDTH_MASK 0x00000F00u
> +#define MMMU_DEBUG_INFO_BIGPAGE_WIDTH_MASK 0x000FF000u
> +#define MMMU_DEBUG_INFO_SUPERPAGE_WIDTH_MASK 0x0FF00000u
> +#define MMMU_DEBUG_INFO_BYPASS_4M BIT(28)
> +#define MMMU_DEBUG_INFO_BYPASS BIT(29)
> +
> +struct bcm2712_iommu {
> + struct device *dev;
> + struct iommu_device iommu;
> + struct bcm2712_iommu_domain *domain;
> + struct bcm2712_iommu_cache *cache;
> + void __iomem *reg_base;
> + spinlock_t hw_lock;
> + size_t bigpage_size;
> + size_t superpage_size;
> +};
> +
> +struct bcm2712_iommu_domain {
> + union {
> + struct iommu_domain base;
> + struct pt_iommu_bcm2712 pt;
> + };
> + struct bcm2712_iommu *mmu;
> + void *default_page;
> +};
> +
> +#define MMU_WR(off, val) writel(val, mmu->reg_base + (off))
> +#define MMU_RD(off) readl(mmu->reg_base + (off))
I would prefer using static inline wrappers here because it gets super
easy to just instrument those with debug prints by adding a couple of
lines, it also gives you type validation at the same time.
[snip]
> +static struct iommu_domain bcm2712_blocking_domain = {
> + .type = IOMMU_DOMAIN_BLOCKED,
> + .ops = &(const struct iommu_domain_ops) {
> + .attach_dev = bcm2712_iommu_blocking_attach,
> + },
> +};
> +
> +static int bcm2712_iommu_enable_and_clear_tlb(struct bcm2712_iommu *mmu)
Maybe add __must_hold() here to indicate when this is called?
The rest looks good to me, but I defer to Jim for the functional review.
--
Florian
^ permalink raw reply [flat|nested] 11+ messages in thread
* [PATCH v3 5/5] arm64: dts: broadcom: bcm2712: Add GPU IOMMU and IOMMU cache nodes
2026-08-25 20:56 [PATCH v3 0/5] Add support for Broadcom BCM2712 IOMMU driver (Raspberry Pi 5) Daniel Drake
` (3 preceding siblings ...)
2026-08-25 20:56 ` [PATCH v3 4/5] iommu: Add Broadcom BCM2712 IOMMU driver Daniel Drake
@ 2026-08-25 20:56 ` Daniel Drake
4 siblings, 0 replies; 11+ messages in thread
From: Daniel Drake @ 2026-08-25 20:56 UTC (permalink / raw)
To: Joerg Roedel (AMD), Will Deacon, Robin Murphy, Rob Herring,
Krzysztof Kozlowski, Conor Dooley, Florian Fainelli,
Broadcom internal kernel review list, Daniel Drake
Cc: iommu, linux-kernel, devicetree, linux-rpi-kernel,
linux-arm-kernel, nick.hollinghurst, james.quinlan,
Jason Gunthorpe
Define the IOMMU and IOMMUC nodes for the Broadcom BCM2712 SoC found in
the Raspberry Pi 5. Enable use of the IOMMU for the graphics/display
block.
Signed-off-by: Daniel Drake <dan@reactivated.net>
---
arch/arm64/boot/dts/broadcom/bcm2712.dtsi | 15 +++++++++++++++
1 file changed, 15 insertions(+)
diff --git a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
index 45aa8ec5e2b1..f40651ea29bb 100644
--- a/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
+++ b/arch/arm64/boot/dts/broadcom/bcm2712.dtsi
@@ -626,6 +626,19 @@ pcie2: pcie@1000120000 {
status = "disabled";
};
+ iommu4: iommu@1000005200 {
+ /* IOMMU for VC4 (HVS & MPL/TXP), Unicam, PISP-FE, MiniBVN */
+ compatible = "brcm,bcm2712-iommu";
+ reg = <0x10 0x5200 0x0 0x80>;
+ #iommu-cells = <0>;
+ brcm,iommu-cache = <&iommuc>;
+ };
+
+ iommuc: iommuc@1000005b00 {
+ compatible = "brcm,bcm2712-iommuc";
+ reg = <0x10 0x5b00 0x0 0x80>;
+ };
+
mip0: msi-controller@1000130000 {
compatible = "brcm,bcm2712-mip";
reg = <0x10 0x00130000 0x00 0xc0>,
@@ -667,6 +680,7 @@ v3d: gpu@1002000000 {
vc4: gpu {
compatible = "brcm,bcm2712-vc6";
+ iommus = <&iommu4>;
};
timer {
@@ -701,5 +715,6 @@ hvs: hvs@107c580000 {
interrupt-parent = <&disp_intr>;
interrupts = <2>, <9>, <16>;
interrupt-names = "ch0-eof", "ch1-eof", "ch2-eof";
+ iommus = <&iommu4>;
};
};
--
2.55.0
^ permalink raw reply related [flat|nested] 11+ messages in thread