Re: [PATCH v4 4/5] iommu: Add Broadcom BCM2712 IOMMU driver

[Jim Quinlan]

On Wed, Sep 2, 2026 at 6:15 PM Daniel Drake <dan@xxxxxxxxxxxxxxx> wrote:
>
> On 02/09/2026 18:57, Daniel Drake wrote:
> > +static int bcm2712_iommu_blocking_attach(struct iommu_domain *blocking_domain,
> > +                                      struct device *dev,
> > +                                      struct iommu_domain *old)
> > +{
> > +     struct bcm2712_iommu *mmu = dev_iommu_priv_get(dev);
> > +     int ret = 0;
> > +
> > +     scoped_guard(spinlock_irqsave, &mmu->hw_lock) {
> > +             /*
> > +              * Completely block DMA by disabling both the bypass window
> > +              * and the translation aperture.
> > +              */
> > +             bcm2712_iommu_writel(mmu, MMMU_BYPASS_START_OFFSET, 0);
> > +             bcm2712_iommu_writel(mmu, MMMU_BYPASS_END_OFFSET, 0);
> > +             bcm2712_iommu_writel(mmu, MMMU_ADDR_CAP_OFFSET,
> > +                                  MMMU_ADDR_CAP_ENABLE);
> > +             bcm2712_iommu_writel(mmu, MMMU_ILLEGAL_ADR_OFFSET, 0);
> > +             ret = bcm2712_iommu_clear_and_enable(mmu);
> > +             mmu->domain = NULL;
> > +     }
>
> My understanding is that when the IOMMU is enabled, the address cap
> represents the highest permittable memory address; requests for anything
> higher would abort. So I had hoped to achieve blocking mode by setting
> ENABLE | 0 in ADDR_CAP, thinking that would set a cap of 0, and hence
> memory accesses would fail.
>
> But a Sashiko review pointed out that actually this value would produce
> a translation aperture of 256MB, because of the way the register works.
> And I confirmed this experimentally, Sashiko is right.
>
> I also confirmed experimentally that setting value 0 to ADDR_CAP (i.e.
> dropping the enable bit too), with the IOMMU enabled, results in a full
> unrestricted bypass/identity mode.
>
> So unless someone from RPi/Broadcom can inform otherwise, I'm going to
> conclude that the hardware doesn't support blocking mode and remove the
> blocking domain implementation.

Hi Daniel,
IIRC, the value in this register field -- let's call it X -- is in
256M-sized pages.  An access is blocked/capped if  iova[39:28] > X.
So it still passes some accesses even if X==0.
Regards,

Jim Quinlan
Broadcom
>
> This will cause the iommu layer to fall back to creating an empty paging
> domain when blocking mode is requested, which seems appropriate if the
> hardware doesn't offer a more direct way of blocking all memory access.
>
> Daniel
>

Attachment: smime.p7s
Description: S/MIME Cryptographic Signature