From: Sean Christopherson <seanjc@google.com>
To: Josh Hilke <jrhilke@google.com>
Cc: Alex Williamson <alex@shazbot.org>,
David Matlack <dmatlack@google.com>,
kvm@vger.kernel.org, linux-kernel@vger.kernel.org,
Vipin Sharma <vipinsh@google.com>
Subject: Re: [PATCH v7] vfio: selftests: Find devices that have VFIO selftest drivers
Date: Wed, 11 Nov 2026 08:51:07 -0800 [thread overview]
Message-ID: <avSc-7J5JpEamGGl@seanjc-mac.roam.internal> (raw)
In-Reply-To: <20261106051726.3964374-1-jrhilke@google.com>
On Fri, Nov 06, 2026, Josh Hilke wrote:
> Add a new script, list_supported_devices.sh, which prints out the
> segment:bus:device.function (SBDF) numbers and names of devices on a
> machine that have a VFIO selftest driver. This makes it easier to
> determine if the system is capable of running VFIO selftests.
>
> Some of these devices are on the vfio-pci denylist, so vfio-pci refuses
> to bind them unless vfio_pci.disable_denylist=Y. The script marks such
> devices as DENYLISTED and prints how to enable them, so the user is not
> left wondering why the selftests cannot use a "supported" device.
>
> Includes a -q (quiet) argument which prints just the SBDFs of devices
> that vfio-pci can bind, so that the output can be passed directly to
> tools/testing/selftests/vfio/scripts/setup.sh. Does not print the SBDF
> of a device on the denylist.
>
> Examples on a host with eight Intel DSA devices:
>
> $ cat /sys/module/vfio_pci/parameters/disable_denylist
> N
>
> $ ./list_supported_devices.sh
> 0000:6a:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
> 0000:6f:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
> ...
> vfio-pci does not bind DENYLISTED devices while
> vfio_pci.disable_denylist=N. To use them, reload vfio-pci:
> modprobe -r vfio-pci
> modprobe vfio-pci disable_denylist=1
> If vfio-pci is built into the kernel, boot with
> vfio_pci.disable_denylist=1 instead.
>
> With vfio_pci.disable_denylist=Y, the script lists the same devices with
> "(DENYLISTED, but vfio_pci.disable_denylist=Y)", prints no hint, and
> includes them in the -q output:
Sorry for dragging this on, but I still find the output painful to read.
To me, this does not make it obvious that the devices are usable/available:
# ./list_supported_devices.sh
0000:6a:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED, but vfio_pci.disable_denylist=Y)
0000:6f:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED, but vfio_pci.disable_denylist=Y)
0000:74:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED, but vfio_pci.disable_denylist=Y)
0000:79:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED, but vfio_pci.disable_denylist=Y)
0000:e7:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED, but vfio_pci.disable_denylist=Y)
0000:ec:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED, but vfio_pci.disable_denylist=Y)
0000:f1:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED, but vfio_pci.disable_denylist=Y)
0000:f6:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED, but vfio_pci.disable_denylist=Y)
Especially if I glance at the output of the "bad" state:
# ./list_supported_devices.sh
0000:6a:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
0000:6f:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
0000:74:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
0000:79:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
0000:e7:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
0000:ec:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
0000:f1:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
0000:f6:01.0 - Intel DSA SPR [8086:0b25] (DENYLISTED)
vfio-pci does not bind DENYLISTED devices while
vfio_pci.disable_denylist=N. To use them, reload vfio-pci:
modprobe -r vfio-pci
modprobe vfio-pci disable_denylist=1
If vfio-pci is built into the kernel, boot with
vfio_pci.disable_denylist=1 instead.
IMO, the blurb at the end is also unnecessarily noisy. I don't think we need to
tell the user how to manage kernel modules. I realize I'm setting a double
standard with respect to assumed knowledge, but IMO knowing how to load kernel
modules is table stakes for anyone running this script.
The blurb (and strictly speaking, the scirpt as a whole) is also somewhat
misleading because it doesn't actually verify that vfio-pci is loaded.
Rather than squish everything into a the per-device output, what if we organize
the devices so that it's more obvious what is what, and so that the output isn't
as noisy/redundant. E.g. something like the below. And for the -q output, it
probably makes sense to also provide a flag to show/hide unusable devices. Probably
to show? i.e. have -q output show only fully supported devices by default? And
maybe fail -q outright if vfio-pci isn't loaded? Dunno about that last one, not
sure what would be the least confusing.
If vfio-pci is loaded with disable_denylist=1 and there are both allowed and
denied-by-default devices (ignore that they're all the same device):
# ./list_supported_devices.sh
Supported
0000:6a:01.0 - Intel DSA SPR [8086:0b25]
0000:6f:01.0 - Intel DSA SPR [8086:0b25]
0000:74:01.0 - Intel DSA SPR [8086:0b25]
0000:79:01.0 - Intel DSA SPR [8086:0b25]
0000:e7:01.0 - Intel DSA SPR [8086:0b25]
0000:ec:01.0 - Intel DSA SPR [8086:0b25]
0000:f1:01.0 - Intel DSA SPR [8086:0b25]
0000:f6:01.0 - Intel DSA SPR [8086:0b25]
Supported (on denylist, but denylist disabled)
0000:6a:01.0 - Intel DSA SPR [8086:0b25]
0000:6f:01.0 - Intel DSA SPR [8086:0b25]
0000:74:01.0 - Intel DSA SPR [8086:0b25]
0000:79:01.0 - Intel DSA SPR [8086:0b25]
0000:e7:01.0 - Intel DSA SPR [8086:0b25]
0000:ec:01.0 - Intel DSA SPR [8086:0b25]
0000:f1:01.0 - Intel DSA SPR [8086:0b25]
0000:f6:01.0 - Intel DSA SPR [8086:0b25]
Versus if vfio-pci is loaded with disable_denylist=0:
# ./list_supported_devices.sh
Supported
0000:6a:01.0 - Intel DSA SPR [8086:0b25]
0000:6f:01.0 - Intel DSA SPR [8086:0b25]
0000:74:01.0 - Intel DSA SPR [8086:0b25]
0000:79:01.0 - Intel DSA SPR [8086:0b25]
0000:e7:01.0 - Intel DSA SPR [8086:0b25]
0000:ec:01.0 - Intel DSA SPR [8086:0b25]
0000:f1:01.0 - Intel DSA SPR [8086:0b25]
0000:f6:01.0 - Intel DSA SPR [8086:0b25]
Unusable (available, but denylisted by the kernel):
0000:6a:01.0 - Intel DSA SPR [8086:0b25]
0000:6f:01.0 - Intel DSA SPR [8086:0b25]
0000:74:01.0 - Intel DSA SPR [8086:0b25]
0000:79:01.0 - Intel DSA SPR [8086:0b25]
0000:e7:01.0 - Intel DSA SPR [8086:0b25]
0000:ec:01.0 - Intel DSA SPR [8086:0b25]
0000:f1:01.0 - Intel DSA SPR [8086:0b25]
0000:f6:01.0 - Intel DSA SPR [8086:0b25]
To use denylisted devices, load vfio-pci with disable_denylist=1
(or boot the kernel with vfio_pci.disable_denylist=1).
Versus if vfio-pci isn't loaded at all:
# ./list_supported_devices.sh
Unusable (available, but vfio-pci not loaded)
0000:6a:01.0 - Intel DSA SPR [8086:0b25]
0000:6f:01.0 - Intel DSA SPR [8086:0b25]
0000:74:01.0 - Intel DSA SPR [8086:0b25]
0000:79:01.0 - Intel DSA SPR [8086:0b25]
0000:e7:01.0 - Intel DSA SPR [8086:0b25]
0000:ec:01.0 - Intel DSA SPR [8086:0b25]
0000:f1:01.0 - Intel DSA SPR [8086:0b25]
0000:f6:01.0 - Intel DSA SPR [8086:0b25]
Unusable (available, but vfio-pci not loaded, and denylisted by the kernel):
0000:6a:01.0 - Intel DSA SPR [8086:0b25]
0000:6f:01.0 - Intel DSA SPR [8086:0b25]
0000:74:01.0 - Intel DSA SPR [8086:0b25]
0000:79:01.0 - Intel DSA SPR [8086:0b25]
0000:e7:01.0 - Intel DSA SPR [8086:0b25]
0000:ec:01.0 - Intel DSA SPR [8086:0b25]
0000:f1:01.0 - Intel DSA SPR [8086:0b25]
0000:f6:01.0 - Intel DSA SPR [8086:0b25]
To use denylisted devices, load vfio-pci with disable_denylist=1
(or boot the kernel with vfio_pci.disable_denylist=1).
prev parent reply other threads:[~2026-11-11 16:51 UTC|newest]
Thread overview: 2+ messages / expand[flat|nested] mbox.gz Atom feed top
2026-11-06 5:17 Josh Hilke
2026-11-11 16:51 ` Sean Christopherson [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=avSc-7J5JpEamGGl@seanjc-mac.roam.internal \
--to=seanjc@google.com \
--cc=alex@shazbot.org \
--cc=dmatlack@google.com \
--cc=jrhilke@google.com \
--cc=kvm@vger.kernel.org \
--cc=linux-kernel@vger.kernel.org \
--cc=vipinsh@google.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®