virtio-pmem: device reports start=0/size=0 without negotiating VIRTIO_PMEM_F_SHMEM_REGION

Summary

The virtio-pmem device maps a nonzero persistent-memory region but never offers VIRTIO_PMEM_F_SHMEM_REGION (device feature bit 0), and its device-config registers always read 0. Per the spec, when that feature is not negotiated the device must report the region via the start/size config fields; returning 0/0 leaves a driver unable to discover the region.

Root cause

• The device offers only ring_event_idx, ring_indirect_desc, ring_packed — not F_SHMEM_REGION — vm/devices/virtio/virtio_pmem/src/lib.rs:70-75.
• It exposes the region only through the shared-memory capability (shared_memory { id: 0, size: … }) — vm/devices/virtio/virtio_pmem/src/lib.rs:76-81.
• read_registers_u32 is hard-coded to return 0, so the PmemConfig { start, size } fields read 0/0 — vm/devices/virtio/virtio_pmem/src/lib.rs:85-89.

Because the feature is never offered it can never be negotiated, so the device is always in the "feature not negotiated" branch, where §5.19.5 requires start/size to be set to the region's absolute address and size.

Reproduction

Found by virtio-villain. E0032 reads start/size and E0028 reads size; both observe 0.

Impact

Spec conformance (virtio §5.19.5); a spec-compliant driver that doesn't implement the shared-memory-capability path cannot locate the pmem region.

Suggested fix

Either offer VIRTIO_PMEM_F_SHMEM_REGION (and keep advertising the region via the shared-memory capability), or populate the start/size device-config fields with the region's guest-physical address and size. Decide which discovery mechanism virtio-pmem intends to support and make it internally consistent.

Start in vm/devices/virtio/virtio_pmem/src/lib.rs, reading the feature advertisement, shared-memory capability, and read_registers_u32 implementation around lines 70-89. Check the virtio §5.19.5 requirements and the E0032/E0028 reproduction. Done means the selected discovery mechanism is consistently advertised or populated and a compliant driver no longer observes start/size as 0/0.