Hi David,

On 16/07/2026 22:23, David Matlack wrote:

On 2026-07-16 03:51 PM, Matt Evans wrote:

...

Hi David,

On 15/07/2026 19:12, David Matlack wrote:

...

On Wed, Jul 15, 2026 at 10:47 AM Matt Evans matt@ozlabs.org wrote:

...

This is based on v7.2-rc3.

These commits are on GitHub for easier browsing, along with "[RFC ONLY] selftests: vfio: Add standalone vfio_dmabuf_mmap_test":

https://github.com/metamev/linux/compare/v7.2-rc3...dev/mev/vfio-dmabuf-mmap...

It'd be great to have this test upstream. I'm happy to review it when you're ready. Looks like it just needs to be redone to use the VFIO selftests library and kselftests harness. AI could probably do the conversion pretty quick :)

For sure, I'd intended to catch up with you on best approach here. :)

Aside from the organic structure of the test (the open-coded VFIO device/group setup/init needs to go), the main issue is that it relies on a hacked/out of tree QEMU "EDU++" device with a second larger BAR (containing freely read-writable memory). A subset of tests run with the in-tree EDU device, but coverage is too low.

The desirable properties are:

• Having a BAR that is pure memory (all locations present, writable

without disruptive side-effects) so that mapping aliases can be constructed and detected. This is good to test things like non-zero vm_pgoffs and VA space presentation of physically-discontiguous DMABUFs.

• BAR >> hugepage size so we can eyeball huge mappings work (or better,

mechanically test for them). At least 32MB would tick this box for 4K, 16K page systems.

• Something QEMU supports*, so one can run the test in a VM/TCG system.

There were some real device models in QEMU that could be used this way, but needed a fair bit of setup; I didn't want to rathole vfio_dmabuf_mmap_test on including a ton of device-specific code for some video card or similar.

I'll dig more for a simple target that provides these properties -- obviously it would be better to point this test at an off-the-shelf device (including silicon!). And, proposing EDU extensions to the QEMU folks may be useful (there're uses for a better EDU in other contexts too).

Since this test uses MMIO for a specific [class of] function, my first thought is it should be another VFIO driver-type test sibling of vfio_pci_driver_test. For example, we could extend the driver-type tests' backend struct vfio_pci_driver_ops for functions capable of providing a Big Memory BAR, like QEMU EDU++. EDU can also memcpy, so could also support vfio_pci_driver_test.

The spirit of the device backends hiding setup of a complex device is handy, and it's plausible that several backends could provide this "big memory BAR" service. What do you think, any concerns with extending vfio_pci_driver_ops like that?

I wouldn't recommend leveraging the driver framework unless absolutely necessary. It makes the test harder to run.

The biggest issue I see with the proposed properties is being able to treat the BAR as memory. That obviously will depend on the device and may require device-specific setup. If we decide that treating the BAR as memory is truly required then using the driver framework is the way to go. But I'm hoping we can avoid that requirement.

Instead, I think you can get pretty far by inspecting /proc/pid/pagemap to determine if the mmap() set things up correctly, without actually accessing the BAR. You can use /proc/pid/pagemap to look up the PFN and PAGEMAP_SCAN to detect huge pages.

Hmm, possible, although that's quite a different test at that point. I agree never touching the device has advantages, but it's harder to test certain things if we _never_ do MMIO. The mitigation effort to get coverage may not be the right tradeoff vs easier running. I can think of some "easy" VFIO bugs that would be challenging to properly verify in userspace (e.g. PFNs all having some undesired offset). The current test method is harder to fool per unit effort in writing it.

Though, I will have a think about this no-touch flavour of test.

What were you picturing regarding populating the VMA PTEs in order to inspect the result via /proc/pid/pagemap, whilst still upholding the principle of not touching the device? For example, madvise(MADV_POPULATE_WRITE) won't work on the VFIO BAR regions because they're VM_PFNMAP/VM_IO.

With that requirement gone, then all you really need is a device with a large enough BAR. And even that it not a hard requirement. I'm sure there are plenty of test cases that could work with smaller BARs. The few tests that want to exercise huge mappings can inspect the device BAR sizes first, and if they're all too small, SKIP() the test.

If you structure the test this way, then it's easy for the test to be used. It can be run against any device for the basic functional coverage, and can be run against a device with a larger BAR for full coverage of huge mappings.

Does QEMU emulate any devices that have 32MB or larger BARs?

Yep, looks like `-device pci-testdev,membar=64M,membar-backed=on` or even `-device bochs-display,vgamem=64M` would be suitable.

So I'll also try moving the existing test over to one of these to at least remove the EDU++ device dependency. (bochs-display has >1 BAR, and some MMIO regs which are nice for a quick kick-the-tyres access test.)

Cheers,

Matt