1. Patchew
  2. Libvirt
  3. [RFC PATCH 0/3] qemu: Support vCMDQ
  4. View patch

[RFC PATCH 1/3] qemu: Support NVIDIA Tegra241 CMDQV for SMMUv3

Nathan Chen via Devel posted 3 patches 1 week, 6 days ago
[RFC PATCH 1/3] qemu: Support NVIDIA Tegra241 CMDQV for SMMUv3
Posted by Nathan Chen via Devel 1 week, 6 days ago 
From: Nathan Chen <nathanc@nvidia.com>

Introduce support for a "cmdqv" IOMMU attribute which enables
NVIDIA Tegra241 CMDQV, an extension for ARM SMMUv3. This
supports passthrough of physical SMMU-CMDQ linked command
queue from host space to a VM.

Signed-off-by: Nathan Chen <nathanc@nvidia.com>
---
 docs/formatdomain.rst             |  6 ++++++
 src/conf/domain_conf.c            | 15 +++++++++++++++
 src/conf/domain_conf.h            |  1 +
 src/conf/domain_validate.c        |  5 ++++-
 src/conf/schemas/domaincommon.rng |  5 +++++
 src/qemu/qemu_command.c           |  1 +
 6 files changed, 32 insertions(+), 1 deletion(-)

diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
index 82788c15a2..74431838ff 100644
--- a/docs/formatdomain.rst
+++ b/docs/formatdomain.rst
@@ -9341,6 +9341,12 @@ Examples:
       The ``pciBus`` attribute notes the index of the controller that an
       IOMMU device is attached to. (QEMU/KVM and ``smmuv3`` model only)
 
+   ``cmdqv``
+      The ``cmdqv`` attribute with possible values ``on`` and ``off`` can be used
+      to enable NVIDIA Tegra241 CMDQV, an extension for ARM SMMUv3 that supports
+      passthrough of physical SMMU-CMDQ linked command queue from host space to VM.
+      :since:`Since 12.1.0` (QEMU/KVM and ``smmuv3`` model only)
+
 In case of ``virtio`` IOMMU device, the ``driver`` element can optionally
 contain ``granule`` subelement that allows to choose which granule will be
 used by default. It is useful when running guests with different page size
diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
index 453e301041..6385420c10 100644
--- a/src/conf/domain_conf.c
+++ b/src/conf/domain_conf.c
@@ -14680,6 +14680,10 @@ virDomainIOMMUDefParseXML(virDomainXMLOption *xmlopt,
                           &iommu->pci_bus, -1) < 0)
             return NULL;
 
+        if (virXMLPropTristateSwitch(driver, "cmdqv", VIR_XML_PROP_NONE,
+                                     &iommu->cmdqv) < 0)
+            return NULL;
+
         if ((granule = virXPathNode("./driver/granule", ctxt))) {
             g_autofree char *mode = virXMLPropString(granule, "mode");
             unsigned long long size;
@@ -16781,6 +16785,7 @@ virDomainIOMMUDefEquals(const virDomainIOMMUDef *a,
         a->iotlb != b->iotlb ||
         a->aw_bits != b->aw_bits ||
         a->dma_translation != b->dma_translation ||
+        a->cmdqv != b->cmdqv ||
         a->granule != b->granule)
         return false;
 
@@ -22537,6 +22542,12 @@ virDomainIOMMUDefCheckABIStability(virDomainIOMMUDef *src,
                        dst->pci_bus, src->pci_bus);
         return false;
     }
+    if (src->cmdqv != dst->cmdqv) {
+        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
+                       _("Target domain IOMMU device cmdqv value '%1$d' does not match source '%2$d'"),
+                       dst->cmdqv, src->cmdqv);
+        return false;
+    }
     if (src->dma_translation != dst->dma_translation) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
                        _("Target domain IOMMU device dma translation '%1$s' does not match source '%2$s'"),
@@ -28941,6 +28952,10 @@ virDomainIOMMUDefFormat(virBuffer *buf,
         virBufferAsprintf(&driverAttrBuf, " pciBus='%d'",
                           iommu->pci_bus);
     }
+    if (iommu->cmdqv != VIR_TRISTATE_SWITCH_ABSENT) {
+        virBufferAsprintf(&driverAttrBuf, " cmdqv='%s'",
+                          virTristateSwitchTypeToString(iommu->cmdqv));
+    }
     if (iommu->granule != 0) {
         if (iommu->granule == -1) {
             virBufferAddLit(&driverChildBuf, "<granule mode='host'/>\n");
diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
index a13f6d79e9..41dba29a4f 100644
--- a/src/conf/domain_conf.h
+++ b/src/conf/domain_conf.h
@@ -3075,6 +3075,7 @@ struct _virDomainIOMMUDef {
     virTristateSwitch xtsup;
     virTristateSwitch pt;
     int granule; /* -1 means 'host', 0 unset, page size in KiB otherwise */
+    virTristateSwitch cmdqv;
 };
 
 typedef enum {
diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
index 1ad614935f..cac5dabf06 100644
--- a/src/conf/domain_validate.c
+++ b/src/conf/domain_validate.c
@@ -3208,7 +3208,8 @@ virDomainIOMMUDefValidate(const virDomainIOMMUDef *iommu)
             iommu->eim != VIR_TRISTATE_SWITCH_ABSENT ||
             iommu->iotlb != VIR_TRISTATE_SWITCH_ABSENT ||
             iommu->dma_translation != VIR_TRISTATE_SWITCH_ABSENT ||
-            iommu->pci_bus >= 0) {
+            iommu->pci_bus >= 0 ||
+            iommu->cmdqv != VIR_TRISTATE_SWITCH_ABSENT) {
             virReportError(VIR_ERR_XML_ERROR,
                            _("iommu model '%1$s' doesn't support some additional attributes"),
                            virDomainIOMMUModelTypeToString(iommu->model));
@@ -3231,6 +3232,7 @@ virDomainIOMMUDefValidate(const virDomainIOMMUDef *iommu)
             iommu->aw_bits != 0 ||
             iommu->dma_translation != VIR_TRISTATE_SWITCH_ABSENT ||
             iommu->pci_bus >= 0 ||
+            iommu->cmdqv != VIR_TRISTATE_SWITCH_ABSENT ||
             iommu->granule != 0) {
             virReportError(VIR_ERR_XML_ERROR,
                            _("iommu model '%1$s' doesn't support some additional attributes"),
@@ -3243,6 +3245,7 @@ virDomainIOMMUDefValidate(const virDomainIOMMUDef *iommu)
         if (iommu->pt != VIR_TRISTATE_SWITCH_ABSENT ||
             iommu->xtsup != VIR_TRISTATE_SWITCH_ABSENT ||
             iommu->pci_bus >= 0 ||
+            iommu->cmdqv != VIR_TRISTATE_SWITCH_ABSENT ||
             iommu->granule != 0) {
             virReportError(VIR_ERR_XML_ERROR,
                            _("iommu model '%1$s' doesn't support some additional attributes"),
diff --git a/src/conf/schemas/domaincommon.rng b/src/conf/schemas/domaincommon.rng
index dafbdc63e7..2677207ae4 100644
--- a/src/conf/schemas/domaincommon.rng
+++ b/src/conf/schemas/domaincommon.rng
@@ -6352,6 +6352,11 @@
                 <data type="unsignedInt"/>
               </attribute>
             </optional>
+            <optional>
+              <attribute name="cmdqv">
+                <ref name="virOnOff"/>
+              </attribute>
+            </optional>
             <optional>
               <element name="granule">
                 <choice>
diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index a742998e4c..3735387ebd 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -6330,6 +6330,7 @@ qemuBuildPCINestedSmmuv3DevProps(const virDomainDef *def,
                               "s:driver", "arm-smmuv3",
                               "s:primary-bus", bus,
                               "s:id", iommu->info.alias,
+                              "B:tegra241-cmdqv", (iommu->cmdqv == VIR_TRISTATE_SWITCH_ON),
                               NULL) < 0)
         return NULL;
 
-- 
2.43.0
RE: [RFC PATCH 1/3] qemu: Support NVIDIA Tegra241 CMDQV for SMMUv3
Posted by Shameer Kolothum Thodi via Devel 1 week, 5 days ago 

> -----Original Message-----
> From: Nathan Chen <nathanc@nvidia.com>
> Sent: 17 February 2026 23:20
> To: devel@lists.libvirt.org
> Cc: Shameer Kolothum Thodi <skolothumtho@nvidia.com>; Nicolin Chen
> <nicolinc@nvidia.com>; Nathan Chen <nathanc@nvidia.com>; Matt Ochs
> <mochs@nvidia.com>
> Subject: [RFC PATCH 1/3] qemu: Support NVIDIA Tegra241 CMDQV for
> SMMUv3
> 
> From: Nathan Chen <nathanc@nvidia.com>
> 
> Introduce support for a "cmdqv" IOMMU attribute which enables
> NVIDIA Tegra241 CMDQV, an extension for ARM SMMUv3. This
> supports passthrough of physical SMMU-CMDQ linked command
> queue from host space to a VM.

Currently the v2 QEMU vCMDQ series uses the "tegra241-cmdqv" property
to enable NVIDIA Tegra241 CMDQV. There is a suggestion to change this to a
generic "cmdqv" property and probe the host CMDQV extension type from
the kernel. Also, plan is to change it to ON_OFF_AUTO format like the
suggestion for other properties like ril and ats etc

I am currently looking into that. From a libvirt point of view, not sure
this will have much impact, but just a heads up.

Thanks,
Shameer

> Signed-off-by: Nathan Chen <nathanc@nvidia.com>
> ---
>  docs/formatdomain.rst             |  6 ++++++
>  src/conf/domain_conf.c            | 15 +++++++++++++++
>  src/conf/domain_conf.h            |  1 +
>  src/conf/domain_validate.c        |  5 ++++-
>  src/conf/schemas/domaincommon.rng |  5 +++++
>  src/qemu/qemu_command.c           |  1 +
>  6 files changed, 32 insertions(+), 1 deletion(-)
> 
> diff --git a/docs/formatdomain.rst b/docs/formatdomain.rst
> index 82788c15a2..74431838ff 100644
> --- a/docs/formatdomain.rst
> +++ b/docs/formatdomain.rst
> @@ -9341,6 +9341,12 @@ Examples:
>        The ``pciBus`` attribute notes the index of the controller that an
>        IOMMU device is attached to. (QEMU/KVM and ``smmuv3`` model only)
> 
> +   ``cmdqv``
> +      The ``cmdqv`` attribute with possible values ``on`` and ``off`` can be used
> +      to enable NVIDIA Tegra241 CMDQV, an extension for ARM SMMUv3 that
> supports
> +      passthrough of physical SMMU-CMDQ linked command queue from host
> space to VM.
> +      :since:`Since 12.1.0` (QEMU/KVM and ``smmuv3`` model only)
> +
>  In case of ``virtio`` IOMMU device, the ``driver`` element can optionally
>  contain ``granule`` subelement that allows to choose which granule will be
>  used by default. It is useful when running guests with different page size
> diff --git a/src/conf/domain_conf.c b/src/conf/domain_conf.c
> index 453e301041..6385420c10 100644
> --- a/src/conf/domain_conf.c
> +++ b/src/conf/domain_conf.c
> @@ -14680,6 +14680,10 @@
> virDomainIOMMUDefParseXML(virDomainXMLOption *xmlopt,
>                            &iommu->pci_bus, -1) < 0)
>              return NULL;
> 
> +        if (virXMLPropTristateSwitch(driver, "cmdqv", VIR_XML_PROP_NONE,
> +                                     &iommu->cmdqv) < 0)
> +            return NULL;
> +
>          if ((granule = virXPathNode("./driver/granule", ctxt))) {
>              g_autofree char *mode = virXMLPropString(granule, "mode");
>              unsigned long long size;
> @@ -16781,6 +16785,7 @@ virDomainIOMMUDefEquals(const
> virDomainIOMMUDef *a,
>          a->iotlb != b->iotlb ||
>          a->aw_bits != b->aw_bits ||
>          a->dma_translation != b->dma_translation ||
> +        a->cmdqv != b->cmdqv ||
>          a->granule != b->granule)
>          return false;
> 
> @@ -22537,6 +22542,12 @@
> virDomainIOMMUDefCheckABIStability(virDomainIOMMUDef *src,
>                         dst->pci_bus, src->pci_bus);
>          return false;
>      }
> +    if (src->cmdqv != dst->cmdqv) {
> +        virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
> +                       _("Target domain IOMMU device cmdqv value '%1$d' does not
> match source '%2$d'"),
> +                       dst->cmdqv, src->cmdqv);
> +        return false;
> +    }
>      if (src->dma_translation != dst->dma_translation) {
>          virReportError(VIR_ERR_CONFIG_UNSUPPORTED,
>                         _("Target domain IOMMU device dma translation '%1$s' does not
> match source '%2$s'"),
> @@ -28941,6 +28952,10 @@ virDomainIOMMUDefFormat(virBuffer *buf,
>          virBufferAsprintf(&driverAttrBuf, " pciBus='%d'",
>                            iommu->pci_bus);
>      }
> +    if (iommu->cmdqv != VIR_TRISTATE_SWITCH_ABSENT) {
> +        virBufferAsprintf(&driverAttrBuf, " cmdqv='%s'",
> +                          virTristateSwitchTypeToString(iommu->cmdqv));
> +    }
>      if (iommu->granule != 0) {
>          if (iommu->granule == -1) {
>              virBufferAddLit(&driverChildBuf, "<granule mode='host'/>\n");
> diff --git a/src/conf/domain_conf.h b/src/conf/domain_conf.h
> index a13f6d79e9..41dba29a4f 100644
> --- a/src/conf/domain_conf.h
> +++ b/src/conf/domain_conf.h
> @@ -3075,6 +3075,7 @@ struct _virDomainIOMMUDef {
>      virTristateSwitch xtsup;
>      virTristateSwitch pt;
>      int granule; /* -1 means 'host', 0 unset, page size in KiB otherwise */
> +    virTristateSwitch cmdqv;
>  };
> 
>  typedef enum {
> diff --git a/src/conf/domain_validate.c b/src/conf/domain_validate.c
> index 1ad614935f..cac5dabf06 100644
> --- a/src/conf/domain_validate.c
> +++ b/src/conf/domain_validate.c
> @@ -3208,7 +3208,8 @@ virDomainIOMMUDefValidate(const
> virDomainIOMMUDef *iommu)
>              iommu->eim != VIR_TRISTATE_SWITCH_ABSENT ||
>              iommu->iotlb != VIR_TRISTATE_SWITCH_ABSENT ||
>              iommu->dma_translation != VIR_TRISTATE_SWITCH_ABSENT ||
> -            iommu->pci_bus >= 0) {
> +            iommu->pci_bus >= 0 ||
> +            iommu->cmdqv != VIR_TRISTATE_SWITCH_ABSENT) {
>              virReportError(VIR_ERR_XML_ERROR,
>                             _("iommu model '%1$s' doesn't support some additional
> attributes"),
>                             virDomainIOMMUModelTypeToString(iommu->model));
> @@ -3231,6 +3232,7 @@ virDomainIOMMUDefValidate(const
> virDomainIOMMUDef *iommu)
>              iommu->aw_bits != 0 ||
>              iommu->dma_translation != VIR_TRISTATE_SWITCH_ABSENT ||
>              iommu->pci_bus >= 0 ||
> +            iommu->cmdqv != VIR_TRISTATE_SWITCH_ABSENT ||
>              iommu->granule != 0) {
>              virReportError(VIR_ERR_XML_ERROR,
>                             _("iommu model '%1$s' doesn't support some additional
> attributes"),
> @@ -3243,6 +3245,7 @@ virDomainIOMMUDefValidate(const
> virDomainIOMMUDef *iommu)
>          if (iommu->pt != VIR_TRISTATE_SWITCH_ABSENT ||
>              iommu->xtsup != VIR_TRISTATE_SWITCH_ABSENT ||
>              iommu->pci_bus >= 0 ||
> +            iommu->cmdqv != VIR_TRISTATE_SWITCH_ABSENT ||
>              iommu->granule != 0) {
>              virReportError(VIR_ERR_XML_ERROR,
>                             _("iommu model '%1$s' doesn't support some additional
> attributes"),
> diff --git a/src/conf/schemas/domaincommon.rng
> b/src/conf/schemas/domaincommon.rng
> index dafbdc63e7..2677207ae4 100644
> --- a/src/conf/schemas/domaincommon.rng
> +++ b/src/conf/schemas/domaincommon.rng
> @@ -6352,6 +6352,11 @@
>                  <data type="unsignedInt"/>
>                </attribute>
>              </optional>
> +            <optional>
> +              <attribute name="cmdqv">
> +                <ref name="virOnOff"/>
> +              </attribute>
> +            </optional>
>              <optional>
>                <element name="granule">
>                  <choice>
> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
> index a742998e4c..3735387ebd 100644
> --- a/src/qemu/qemu_command.c
> +++ b/src/qemu/qemu_command.c
> @@ -6330,6 +6330,7 @@ qemuBuildPCINestedSmmuv3DevProps(const
> virDomainDef *def,
>                                "s:driver", "arm-smmuv3",
>                                "s:primary-bus", bus,
>                                "s:id", iommu->info.alias,
> +                              "B:tegra241-cmdqv", (iommu->cmdqv ==
> VIR_TRISTATE_SWITCH_ON),
>                                NULL) < 0)
>          return NULL;
> 
> --
> 2.43.0
Re: [RFC PATCH 1/3] qemu: Support NVIDIA Tegra241 CMDQV for SMMUv3
Posted by Nathan Chen via Devel 1 week, 5 days ago 

On 2/18/2026 12:05 AM, Shameer Kolothum Thodi wrote:
>> Introduce support for a "cmdqv" IOMMU attribute which enables
>> NVIDIA Tegra241 CMDQV, an extension for ARM SMMUv3. This
>> supports passthrough of physical SMMU-CMDQ linked command
>> queue from host space to a VM.
> Currently the v2 QEMU vCMDQ series uses the "tegra241-cmdqv" property
> to enable NVIDIA Tegra241 CMDQV. There is a suggestion to change this to a
> generic "cmdqv" property and probe the host CMDQV extension type from
> the kernel. Also, plan is to change it to ON_OFF_AUTO format like the
> suggestion for other properties like ril and ats etc
> 
> I am currently looking into that. From a libvirt point of view, not sure
> this will have much impact, but just a heads up.

Ok, I will keep track of the QEMU series refreshes and support the 
generic "cmdqv" property with ON_OFF_AUTO format when sent to the 
mailing list.

Thanks,
Nathan

Patchew 2.1-devel-ea86937

© 2016 - 2026 Red Hat, Inc.