Re: [PATCH v3 3/3] vfio: selftests: Test BAR write faults after clear_refs

[Alex Williamson <alex@shazbot.org>]

On Mon,  2 Nov 2026 23:04:45 +0000
Mina Almasry <almasrymina@google.com> wrote:

> Add a regression test in vfio_pci_device_test to verify that huge_fault
> on writable MAP_SHARED VFIO PCI BAR mappings handles write faults after
> soft-dirty tracking clears VM_SOFTDIRTY and downgrades vma->vm_page_prot
> to read-only via /proc/self/clear_refs ("4").
> 
> Use vfio_pci_find_mem_bar() to locate a memory-backed BAR of at least
> 2 MiB that is safe to read and write, and zap existing BAR mappings via
> PCI_COMMAND_MEMORY before each sub-test to verify both:
> 
> 1. Read-then-write fault sequence after clear_refs, exercising in-place
>    huge PMD/PUD write-protection upgrade via wp_huge_pmd()/wp_huge_pud().
> 2. Direct initial write fault on an unpopulated BAR VMA after clear_refs,
>    exercising vmf_insert_pfn_pmd()/vmf_insert_pfn_pud() with
>    FAULT_FLAG_WRITE set.
> 
> Skip gracefully when the device has no known memory-backed BAR >= 2 MiB
> or when /proc/self/clear_refs soft-dirty tracking (CONFIG_MEM_SOFT_DIRTY)
> is unavailable.
> 
> Suggested-by: Alex Williamson <alex@shazbot.org>
> Cc: David Matlack <dmatlack@google.com>
> Cc: Matt Evans <matt@ozlabs.org>
> Signed-off-by: Mina Almasry <almasrymina@google.com>
> ---
>  .../selftests/vfio/vfio_pci_device_test.c     | 65 +++++++++++++++++++
>  1 file changed, 65 insertions(+)
> 
> diff --git a/tools/testing/selftests/vfio/vfio_pci_device_test.c b/tools/testing/selftests/vfio/vfio_pci_device_test.c
> index 93c11fd5e081..323a316f59e7 100644
> --- a/tools/testing/selftests/vfio/vfio_pci_device_test.c
> +++ b/tools/testing/selftests/vfio/vfio_pci_device_test.c
> @@ -1,10 +1,13 @@
>  // SPDX-License-Identifier: GPL-2.0-only
> +#include <errno.h>
>  #include <fcntl.h>
>  #include <stdlib.h>
> +#include <unistd.h>
>  
>  #include <sys/ioctl.h>
>  #include <sys/mman.h>
>  
> +#include <linux/compiler.h>
>  #include <linux/limits.h>
>  #include <linux/pci_regs.h>
>  #include <linux/sizes.h>
> @@ -102,6 +105,68 @@ TEST_F(vfio_pci_device_test, validate_bars)
>  	}
>  }
>  
> +static void zap_bar_mappings(struct vfio_pci_device *device)
> +{
> +	vfio_pci_cmd_clear(device, PCI_COMMAND_MEMORY);
> +	vfio_pci_cmd_set(device, PCI_COMMAND_MEMORY);
> +}
> +
> +static int clear_soft_dirty_refs(void)
> +{
> +	ssize_t ret;
> +	int fd;
> +
> +	fd = open("/proc/self/clear_refs", O_WRONLY);
> +	if (fd < 0)
> +		return -errno;
> +
> +	ret = write(fd, "4\n", 2);
> +	if (ret < 0)
> +		ret = -errno;
> +	else
> +		VFIO_ASSERT_EQ(ret, 2);
> +
> +	VFIO_ASSERT_EQ(close(fd), 0);
> +	return ret < 0 ? ret : 0;
> +}
> +
> +TEST_F(vfio_pci_device_test, bar_write_fault_after_clear_refs)
> +{
> +	struct vfio_pci_mem_bar mem_bar;
> +	int ret;
> +	u32 val;
> +
> +	if (!vfio_pci_find_mem_bar(self->device, SZ_2M, &mem_bar))
> +		SKIP(return, "No memory-backed BAR >= 2M on %s\n", device_bdf);
> +
> +	zap_bar_mappings(self->device);
> +
> +	ret = clear_soft_dirty_refs();
> +	if (ret == -ENOENT || ret == -EINVAL)
> +		SKIP(return, "soft-dirty clear_refs unsupported (%d)\n", ret);

My comment on v2 that this doesn't accurately test whether soft-dirty
is supported, potentially leading to a false pass still stands.

Please also have the courtesy to give reasonable time for review before
a respin.  Personally I would expect self review and testing to take
longer than the 80 minutes between David's feedback and v3.  Thanks,

Alex

> +	ASSERT_EQ(0, ret);
> +
> +	/*
> +	 * clear_soft_dirty_refs() stripped write permissions from
> +	 * vma->vm_page_prot on the unpopulated BAR mapping. Fault it read-only
> +	 * first, then write to exercise in-place write-upgrade
> +	 * (wp_huge_pmd/wp_huge_pud).
> +	 */
> +	val = READ_ONCE(*(u32 *)mem_bar.vaddr);
> +	WRITE_ONCE(*(u32 *)mem_bar.vaddr, val);
> +
> +	/*
> +	 * Zap the BAR PTEs/PMDs, clear soft-dirty again, and fault with an
> +	 * immediate store to exercise initial write insertion
> +	 * (vmf_insert_pfn_pmd/pud with write=true).
> +	 */
> +	zap_bar_mappings(self->device);
> +	ASSERT_EQ(0, clear_soft_dirty_refs());
> +
> +	WRITE_ONCE(*(u32 *)mem_bar.vaddr, val);
> +	(void)READ_ONCE(*(u32 *)mem_bar.vaddr);
> +}
> +
>  FIXTURE(vfio_pci_irq_test) {
>  	struct iommu *iommu;
>  	struct vfio_pci_device *device;