diff --git a/arch/sandbox/dts/test.dts b/arch/sandbox/dts/test.dts
index e27d106..8cd688e 100644
--- a/arch/sandbox/dts/test.dts
+++ b/arch/sandbox/dts/test.dts
@@ -764,6 +764,11 @@
 		vss-microvolts = <0>;
 	};
 
+	iommu: iommu@0 {
+		compatible = "sandbox,iommu";
+		#iommu-cells = <0>;
+	};
+
 	irq: irq {
 		compatible = "sandbox,irq";
 		interrupt-controller;
@@ -1226,6 +1231,7 @@
 
 	usb_1: usb@1 {
 		compatible = "sandbox,usb";
+		iommus = <&iommu>;
 		hub {
 			compatible = "usb-hub";
 			usb,device-class = <9>;
diff --git a/configs/sandbox64_defconfig b/configs/sandbox64_defconfig
index 838280e..4582889 100644
--- a/configs/sandbox64_defconfig
+++ b/configs/sandbox64_defconfig
@@ -130,6 +130,7 @@
 CONFIG_I2C_ARB_GPIO_CHALLENGE=y
 CONFIG_CROS_EC_KEYB=y
 CONFIG_I8042_KEYB=y
+CONFIG_IOMMU=y
 CONFIG_LED=y
 CONFIG_LED_BLINK=y
 CONFIG_LED_GPIO=y
diff --git a/configs/sandbox_defconfig b/configs/sandbox_defconfig
index d07a7f3..9385857 100644
--- a/configs/sandbox_defconfig
+++ b/configs/sandbox_defconfig
@@ -168,6 +168,7 @@
 CONFIG_I2C_ARB_GPIO_CHALLENGE=y
 CONFIG_CROS_EC_KEYB=y
 CONFIG_I8042_KEYB=y
+CONFIG_IOMMU=y
 CONFIG_LED=y
 CONFIG_LED_BLINK=y
 CONFIG_LED_GPIO=y
diff --git a/configs/sandbox_flattree_defconfig b/configs/sandbox_flattree_defconfig
index 5980c86..edfdac8 100644
--- a/configs/sandbox_flattree_defconfig
+++ b/configs/sandbox_flattree_defconfig
@@ -107,6 +107,7 @@
 CONFIG_I2C_ARB_GPIO_CHALLENGE=y
 CONFIG_CROS_EC_KEYB=y
 CONFIG_I8042_KEYB=y
+CONFIG_IOMMU=y
 CONFIG_LED=y
 CONFIG_LED_BLINK=y
 CONFIG_LED_GPIO=y
diff --git a/configs/sandbox_noinst_defconfig b/configs/sandbox_noinst_defconfig
index 238604f..ab37849 100644
--- a/configs/sandbox_noinst_defconfig
+++ b/configs/sandbox_noinst_defconfig
@@ -128,6 +128,7 @@
 CONFIG_I2C_ARB_GPIO_CHALLENGE=y
 CONFIG_CROS_EC_KEYB=y
 CONFIG_I8042_KEYB=y
+CONFIG_IOMMU=y
 CONFIG_LED=y
 CONFIG_LED_BLINK=y
 CONFIG_LED_GPIO=y
diff --git a/configs/sandbox_spl_defconfig b/configs/sandbox_spl_defconfig
index b9da8dc..9a0a678 100644
--- a/configs/sandbox_spl_defconfig
+++ b/configs/sandbox_spl_defconfig
@@ -130,6 +130,7 @@
 CONFIG_I2C_ARB_GPIO_CHALLENGE=y
 CONFIG_CROS_EC_KEYB=y
 CONFIG_I8042_KEYB=y
+CONFIG_IOMMU=y
 CONFIG_LED=y
 CONFIG_LED_BLINK=y
 CONFIG_LED_GPIO=y
diff --git a/drivers/iommu/Makefile b/drivers/iommu/Makefile
index f1ceb10..af1c6bb 100644
--- a/drivers/iommu/Makefile
+++ b/drivers/iommu/Makefile
@@ -1,3 +1,5 @@
 # SPDX-License-Identifier: GPL-2.0+
 
 obj-$(CONFIG_IOMMU) += iommu-uclass.o
+
+obj-$(CONFIG_SANDBOX) += sandbox_iommu.o
diff --git a/drivers/iommu/sandbox_iommu.c b/drivers/iommu/sandbox_iommu.c
new file mode 100644
index 0000000..c8161a4
--- /dev/null
+++ b/drivers/iommu/sandbox_iommu.c
@@ -0,0 +1,18 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright (C) 2021 Mark Kettenis <kettenis@openbsd.org>
+ */
+
+#include <common.h>
+#include <dm.h>
+
+static const struct udevice_id sandbox_iommu_ids[] = {
+	{ .compatible = "sandbox,iommu" },
+	{ /* sentinel */ }
+};
+
+U_BOOT_DRIVER(sandbox_iommu) = {
+	.name = "sandbox_iommu",
+	.id = UCLASS_IOMMU,
+	.of_match = sandbox_iommu_ids,
+};
diff --git a/test/dm/Makefile b/test/dm/Makefile
index 55162e9..7de013f 100644
--- a/test/dm/Makefile
+++ b/test/dm/Makefile
@@ -48,6 +48,7 @@
 obj-$(CONFIG_SOUND) += i2s.o
 obj-y += irq.o
 obj-$(CONFIG_CLK_K210_SET_RATE) += k210_pll.o
+obj-$(CONFIG_IOMMU) += iommu.o
 obj-$(CONFIG_LED) += led.o
 obj-$(CONFIG_DM_MAILBOX) += mailbox.o
 obj-$(CONFIG_DM_MDIO) += mdio.o
diff --git a/test/dm/iommu.c b/test/dm/iommu.c
new file mode 100644
index 0000000..94174a7
--- /dev/null
+++ b/test/dm/iommu.c
@@ -0,0 +1,28 @@
+// SPDX-License-Identifier: GPL-2.0+
+/*
+ * Copyright (C) 2021 Mark Kettenis <kettenis@openbsd.org>
+ */
+
+#include <common.h>
+#include <dm.h>
+#include <dm/test.h>
+#include <dm/uclass-internal.h>
+#include <iommu.h>
+#include <test/test.h>
+#include <test/ut.h>
+
+static int dm_test_iommu(struct unit_test_state *uts)
+{
+	struct udevice *dev;
+
+	ut_assertok(uclass_find_device(UCLASS_IOMMU, 0, &dev));
+	ut_assert(!(dev_get_flags(dev) & DM_FLAG_ACTIVATED));
+
+	/* Probing USB probes the IOMMU through the "iommus" property */
+	ut_assertok(uclass_probe_all(UCLASS_USB));
+	ut_assert(dev_get_flags(dev) & DM_FLAG_ACTIVATED);
+
+	return 0;
+}
+
+DM_TEST(dm_test_iommu, UT_TESTF_SCAN_FDT);