[PATCH v4 0/2] iommu/arm-smmu-v3: Make the queue depths tunable, and shrink them in a kdump kernel

[PATCH v4 0/2] iommu/arm-smmu-v3: Make the queue depths tunable, and shrink them in a kdump kernel

[Kiryl Shutsemau (Meta)]

The queues are sized from the IDR1 maxima and allocated at probe, costing
megabytes per queue per SMMU instance. A kdump capture kernel pays that out
of a small crashkernel reservation, for queues it barely uses and two of
which it switches off anyway.

v3 clamped every queue to a page under is_kdump_kernel(). Review wanted a
general mechanism instead, so patch 1 adds a cmdq_entries module parameter
at the max_n_shift initialisation in arm_smmu_device_hw_probe() (Robin),
command queue only (Will), floored at one page (Jason). Patch 2 then has a
kdump kernel default all three depths to one page through the same helper,
with no command line needed (Jason). An explicit cmdq_entries still wins.

The v3 Reviewed-by from Breno, Pranjal, Jason and Nicolin, and Nicolin's
Tested-by, are dropped: this is not the patch they were given to.

Measured per instance under QEMU on -M virt,iommu=smmuv3, through a real
panic and kexec into a capture kernel:

                        4K page          64K page
      cmdq         1 MB -> 4 KB      8 MB -> 64 KB
      evtq         1 MB -> 4 KB     16 MB -> 64 KB

Every clamped queue lands on exactly one page. cmdq_entries moves the
command queue alone and beats the kdump default; the capture kernel
attached four devices with no CMD_SYNC timeout, GERROR or context fault, so
batching survives the floor. QEMU exposes no PRI queue, which takes the
same path. Also build-tested across 4K/16K/64K, TEGRA241_CMDQV=n,
CRASH_DUMP=n and =m, every commit warning-free.

The kdump stream table adoption series drops the event and PRI allocations
outright as of its v10. This sits on the same base, applies on top with no
conflict, and sizes the command queue that series leaves alone.

v3: https://lore.kernel.org/all/20260706084708.8072-1-kas@kernel.org/

Kiryl Shutsemau (Meta) (2):
  iommu/arm-smmu-v3: Add a cmdq_entries module parameter
  iommu/arm-smmu-v3: Default queue depths to one page in a kdump kernel

 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c   | 61 +++++++++++++++++--
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h   |  1 +
 .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c    |  5 +-
 3 files changed, 59 insertions(+), 8 deletions(-)


base-commit: cee9395acd8043be0644b25c34bfa86623f2b935
-- 
2.54.0

[PATCH v4 1/2] iommu/arm-smmu-v3: Add a cmdq_entries module parameter

[Kiryl Shutsemau (Meta)]

The command queue depth comes straight from the maximum the hardware
advertises in IDR1, which reaches megabytes of coherent DMA per queue.
A system with several SMMUv3 instances pays that per instance, and the
Tegra241 CMDQV pays it again for every VCMDQ it preallocates.

Queue depth only bounds how many commands may be in flight before a sync.
A machine driving a handful of devices, or one with a tight memory budget,
has no use for the maximum, and no way to say so.

Add cmdq_entries, an upper bound on the number of command queue entries.
Apply it where the depth is decided, alongside the IDR1 maxima in
arm_smmu_device_hw_probe(), so the queue is allocated at the requested
size rather than allocated large and trimmed afterwards. The Tegra241
CMDQV sizes its VCMDQs from IDR1 itself, so route that through the same
helper.

Round the request down to a power of two and floor it at one page worth of
entries. Coherent DMA is page granular, so a shallower queue occupies the
same memory as one that fills the page, and the retry loop in
arm_smmu_init_one_queue() already stops at a page. On every page size arm64
supports, that floor leaves the queue well above CMDQ_BATCH_ENTRIES, so
command batching keeps working whatever is asked for.

Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Assisted-by: Claude-Code:claude-opus-5
---
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c   | 42 ++++++++++++++++++-
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h   |  1 +
 .../iommu/arm/arm-smmu-v3/tegra241-cmdqv.c    |  5 ++-
 3 files changed, 44 insertions(+), 4 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index 5732f3ba0122..b371e9ddbfcc 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -40,6 +40,11 @@ module_param(disable_msipolling, bool, 0444);
 MODULE_PARM_DESC(disable_msipolling,
 	"Disable MSI-based polling for CMD_SYNC completion.");
 
+static unsigned int cmdq_entries;
+module_param(cmdq_entries, uint, 0444);
+MODULE_PARM_DESC(cmdq_entries,
+	"Upper bound on the number of command queue entries, rounded down to a power of two. Zero means the hardware maximum.");
+
 static const struct iommu_ops arm_smmu_ops;
 static struct iommu_dirty_ops arm_smmu_dirty_ops;
 
@@ -4412,6 +4417,38 @@ static struct iommu_dirty_ops arm_smmu_dirty_ops = {
 };
 
 /* Probing and initialisation functions */
+
+/**
+ * arm_smmu_queue_max_n_shift() - pick the log2 depth of a queue
+ * @hw_shift: log2 depth the hardware allows, capped for natural alignment
+ * @ent_sz_shift: log2 of the queue entry size in bytes
+ * @want: number of entries asked for, or zero to use @hw_shift
+ *
+ * @want is rounded down to a power of two. It never sizes a queue below one
+ * page, because coherent DMA is page granular: a shallower queue occupies the
+ * same memory as one that fills the page, and arm_smmu_init_one_queue() stops
+ * shrinking at a page too.
+ */
+static u32 arm_smmu_queue_max_n_shift(u32 hw_shift, u32 ent_sz_shift, u32 want)
+{
+	u32 page_shift = PAGE_SHIFT - ent_sz_shift;
+
+	if (!want)
+		return hw_shift;
+
+	return min(hw_shift, max(ilog2(want), page_shift));
+}
+
+/*
+ * Command queues are also allocated by the Tegra241 CMDQV for its VCMDQs, which
+ * need the same depth decision.
+ */
+u32 arm_smmu_cmdq_max_n_shift(u32 hw_shift)
+{
+	return arm_smmu_queue_max_n_shift(hw_shift, CMDQ_ENT_SZ_SHIFT,
+					  cmdq_entries);
+}
+
 int arm_smmu_init_one_queue(struct arm_smmu_device *smmu,
 			    struct arm_smmu_queue *q, void __iomem *page,
 			    unsigned long prod_off, unsigned long cons_off,
@@ -5048,6 +5085,7 @@ static void arm_smmu_get_httu(struct arm_smmu_device *smmu, u32 reg)
 
 static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu)
 {
+	u32 hw_shift;
 	u32 reg;
 	bool coherent = smmu->features & ARM_SMMU_FEAT_COHERENCY;
 
@@ -5156,8 +5194,8 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu)
 		smmu->features |= ARM_SMMU_FEAT_ATTR_TYPES_OVR;
 
 	/* Queue sizes, capped to ensure natural alignment */
-	smmu->cmdq.q.llq.max_n_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT,
-					     FIELD_GET(IDR1_CMDQS, reg));
+	hw_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT, FIELD_GET(IDR1_CMDQS, reg));
+	smmu->cmdq.q.llq.max_n_shift = arm_smmu_cmdq_max_n_shift(hw_shift);
 	if (smmu->cmdq.q.llq.max_n_shift <= ilog2(CMDQ_BATCH_ENTRIES)) {
 		/*
 		 * We don't support splitting up batches, so one batch of
diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
index 50f8321e979c..a8cb6a69f03b 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.h
@@ -1165,6 +1165,7 @@ static inline void arm_smmu_domain_inv(struct arm_smmu_domain *smmu_domain)
 
 void __arm_smmu_cmdq_skip_err(struct arm_smmu_device *smmu,
 			      struct arm_smmu_cmdq *cmdq);
+u32 arm_smmu_cmdq_max_n_shift(u32 hw_shift);
 int arm_smmu_init_one_queue(struct arm_smmu_device *smmu,
 			    struct arm_smmu_queue *q, void __iomem *page,
 			    unsigned long prod_off, unsigned long cons_off,
diff --git a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
index 6644075c1431..3fe1075a11a1 100644
--- a/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
+++ b/drivers/iommu/arm/arm-smmu-v3/tegra241-cmdqv.c
@@ -655,6 +655,7 @@ static int tegra241_vcmdq_alloc_smmu_cmdq(struct tegra241_vcmdq *vcmdq)
 	struct arm_smmu_cmdq *cmdq = &vcmdq->cmdq;
 	struct arm_smmu_queue *q = &cmdq->q;
 	char name[16];
+	u32 hw_shift;
 	u32 regval;
 	int ret;
 
@@ -662,8 +663,8 @@ static int tegra241_vcmdq_alloc_smmu_cmdq(struct tegra241_vcmdq *vcmdq)
 
 	/* Cap queue size to SMMU's IDR1.CMDQS and ensure natural alignment */
 	regval = readl_relaxed(smmu->base + ARM_SMMU_IDR1);
-	q->llq.max_n_shift =
-		min_t(u32, CMDQ_MAX_SZ_SHIFT, FIELD_GET(IDR1_CMDQS, regval));
+	hw_shift = min_t(u32, CMDQ_MAX_SZ_SHIFT, FIELD_GET(IDR1_CMDQS, regval));
+	q->llq.max_n_shift = arm_smmu_cmdq_max_n_shift(hw_shift);
 
 	/* Use the common helper to init the VCMDQ, and then... */
 	ret = arm_smmu_init_one_queue(smmu, q, vcmdq->page0,
-- 
2.54.0

[PATCH v4 2/2] iommu/arm-smmu-v3: Default queue depths to one page in a kdump kernel

[Kiryl Shutsemau (Meta)]

All three queues are sized from the maxima the hardware advertises in IDR1
and allocated at probe, reaching megabytes of coherent DMA each. The
capture kernel already disables two of them: arm_smmu_device_reset() drops
CR0_EVTQEN and CR0_PRIQEN. It still allocates both at full size.

A kdump capture kernel runs from a small crashkernel reservation, and a
system with several SMMUv3 instances pays the full cost per instance. Tens
of megabytes go to queues that either serve the handful of devices used to
save the dump or are switched off outright, and that is memory the dump
itself needs.

Default all three depths to one page worth of entries when
is_kdump_kernel(). The queues carry commands and fault records rather than
DMA data, so dump throughput is unaffected. A shallower command queue only
bounds how many commands may be in flight before a sync, which does not
matter for the few devices that save the dump.

An explicit cmdq_entries still wins, so a capture kernel that wants a
deeper command queue can ask for one on the command line.

Suggested-by: Kyle McMartin <jkkm@meta.com>
Signed-off-by: Kiryl Shutsemau (Meta) <kas@kernel.org>
Assisted-by: Claude-Code:claude-opus-5
---
 drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c | 25 +++++++++++++++------
 1 file changed, 18 insertions(+), 7 deletions(-)

diff --git a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
index b371e9ddbfcc..a786219f40ff 100644
--- a/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
+++ b/drivers/iommu/arm/arm-smmu-v3/arm-smmu-v3.c
@@ -4422,7 +4422,10 @@ static struct iommu_dirty_ops arm_smmu_dirty_ops = {
  * arm_smmu_queue_max_n_shift() - pick the log2 depth of a queue
  * @hw_shift: log2 depth the hardware allows, capped for natural alignment
  * @ent_sz_shift: log2 of the queue entry size in bytes
- * @want: number of entries asked for, or zero to use @hw_shift
+ * @want: number of entries asked for, or zero to use the default
+ *
+ * The default is @hw_shift, except in a kdump capture kernel, which defaults
+ * to one page worth of entries.
  *
  * @want is rounded down to a power of two. It never sizes a queue below one
  * page, because coherent DMA is page granular: a shallower queue occupies the
@@ -4432,11 +4435,16 @@ static struct iommu_dirty_ops arm_smmu_dirty_ops = {
 static u32 arm_smmu_queue_max_n_shift(u32 hw_shift, u32 ent_sz_shift, u32 want)
 {
 	u32 page_shift = PAGE_SHIFT - ent_sz_shift;
+	u32 want_shift;
 
-	if (!want)
+	if (want)
+		want_shift = max(ilog2(want), page_shift);
+	else if (is_kdump_kernel())
+		want_shift = page_shift;
+	else
 		return hw_shift;
 
-	return min(hw_shift, max(ilog2(want), page_shift));
+	return min(hw_shift, want_shift);
 }
 
 /*
@@ -5208,10 +5216,13 @@ static int arm_smmu_device_hw_probe(struct arm_smmu_device *smmu)
 		return -ENXIO;
 	}
 
-	smmu->evtq.q.llq.max_n_shift = min_t(u32, EVTQ_MAX_SZ_SHIFT,
-					     FIELD_GET(IDR1_EVTQS, reg));
-	smmu->priq.q.llq.max_n_shift = min_t(u32, PRIQ_MAX_SZ_SHIFT,
-					     FIELD_GET(IDR1_PRIQS, reg));
+	hw_shift = min_t(u32, EVTQ_MAX_SZ_SHIFT, FIELD_GET(IDR1_EVTQS, reg));
+	smmu->evtq.q.llq.max_n_shift =
+		arm_smmu_queue_max_n_shift(hw_shift, EVTQ_ENT_SZ_SHIFT, 0);
+
+	hw_shift = min_t(u32, PRIQ_MAX_SZ_SHIFT, FIELD_GET(IDR1_PRIQS, reg));
+	smmu->priq.q.llq.max_n_shift =
+		arm_smmu_queue_max_n_shift(hw_shift, PRIQ_ENT_SZ_SHIFT, 0);
 
 	/* SID/SSID sizes */
 	smmu->ssid_bits = FIELD_GET(IDR1_SSIDSIZE, reg);
-- 
2.54.0

Re: [PATCH v4 1/2] iommu/arm-smmu-v3: Add a cmdq_entries module parameter

[Nicolin Chen]

On Wed, Sep 02, 2026 at 01:17:23PM +0100, Kiryl Shutsemau (Meta) wrote:
> +/**
> + * arm_smmu_queue_max_n_shift() - pick the log2 depth of a queue
> + * @hw_shift: log2 depth the hardware allows, capped for natural alignment
> + * @ent_sz_shift: log2 of the queue entry size in bytes
> + * @want: number of entries asked for, or zero to use @hw_shift
> + *
> + * @want is rounded down to a power of two. It never sizes a queue below one
> + * page, because coherent DMA is page granular: a shallower queue occupies the
> + * same memory as one that fills the page, and arm_smmu_init_one_queue() stops
> + * shrinking at a page too.

Well, since we want the cmdq depth, why not name the parameter
"max_cmdq_depth"? Then, no rounding and more straightforward.

Nicolin

Re: [PATCH v4 1/2] iommu/arm-smmu-v3: Add a cmdq_entries module parameter

[Kiryl Shutsemau]

On Wed, Sep 02, 2026 at 10:22:31AM -0700, Nicolin Chen wrote:
> On Wed, Sep 02, 2026 at 01:17:23PM +0100, Kiryl Shutsemau (Meta) wrote:
> > +/**
> > + * arm_smmu_queue_max_n_shift() - pick the log2 depth of a queue
> > + * @hw_shift: log2 depth the hardware allows, capped for natural alignment
> > + * @ent_sz_shift: log2 of the queue entry size in bytes
> > + * @want: number of entries asked for, or zero to use @hw_shift
> > + *
> > + * @want is rounded down to a power of two. It never sizes a queue below one
> > + * page, because coherent DMA is page granular: a shallower queue occupies the
> > + * same memory as one that fills the page, and arm_smmu_init_one_queue() stops
> > + * shrinking at a page too.
> 
> Well, since we want the cmdq depth, why not name the parameter
> "max_cmdq_depth"? Then, no rounding and more straightforward.

The max_ prefix is better, thanks. cmdq_entries does not say it is a
ceiling.

On the units, the page floor has to stay whatever we call the parameter.

Ask for 8 entries and max_n_shift comes out as 3, which the
CMDQ_BATCH_ENTRIES check in arm_smmu_device_hw_probe() rejects with
-ENXIO. The floor gives you 256 entries on a 4K kernel instead of a failed
probe.

So log2 removes the rounding but not the flooring, and the number asked for
still is not always the number you get. I would rather keep entries than
make people convert.

The rounding is not silent, either: arm_smmu_init_one_queue() already
prints "allocated %u entries for cmdq", so the effective depth lands in
dmesg whichever unit the parameter takes.

On the name itself, "depth" reads to me as a number of entries rather than
its log2, so max_cmdq_depth=8 meaning 256 seems more surprising than the
rounding it replaces.

-- 
  Kiryl Shutsemau / Kirill A. Shutemov

Re: [PATCH v4 1/2] iommu/arm-smmu-v3: Add a cmdq_entries module parameter

[Nicolin Chen]

On Thu, Sep 03, 2026 at 03:15:27PM +0100, Kiryl Shutsemau wrote:
> On Wed, Sep 02, 2026 at 10:22:31AM -0700, Nicolin Chen wrote:
> > On Wed, Sep 02, 2026 at 01:17:23PM +0100, Kiryl Shutsemau (Meta) wrote:
> > > +/**
> > > + * arm_smmu_queue_max_n_shift() - pick the log2 depth of a queue
> > > + * @hw_shift: log2 depth the hardware allows, capped for natural alignment
> > > + * @ent_sz_shift: log2 of the queue entry size in bytes
> > > + * @want: number of entries asked for, or zero to use @hw_shift
> > > + *
> > > + * @want is rounded down to a power of two. It never sizes a queue below one
> > > + * page, because coherent DMA is page granular: a shallower queue occupies the
> > > + * same memory as one that fills the page, and arm_smmu_init_one_queue() stops
> > > + * shrinking at a page too.
> > 
> > Well, since we want the cmdq depth, why not name the parameter
> > "max_cmdq_depth"? Then, no rounding and more straightforward.
> 
> The max_ prefix is better, thanks. cmdq_entries does not say it is a
> ceiling.
> 
> On the units, the page floor has to stay whatever we call the parameter.
> 
> Ask for 8 entries and max_n_shift comes out as 3, which the
> CMDQ_BATCH_ENTRIES check in arm_smmu_device_hw_probe() rejects with
> -ENXIO. The floor gives you 256 entries on a 4K kernel instead of a failed
> probe.
> 
> So log2 removes the rounding but not the flooring, and the number asked for
> still is not always the number you get. I would rather keep entries than
> make people convert.
> 
> The rounding is not silent, either: arm_smmu_init_one_queue() already
> prints "allocated %u entries for cmdq", so the effective depth lands in
> dmesg whichever unit the parameter takes.
> 
> On the name itself, "depth" reads to me as a number of entries rather than
> its log2, so max_cmdq_depth=8 meaning 256 seems more surprising than the
> rounding it replaces.

Well, maybe "cmdq_max_n_shift" is a better one over "depth".

Given CMDQ_BATCH_ENTRIES is used, I think cmdq_max_entries works.

Nicolin