RE: [RFC PATCH] vfio/pci: add PCIe TPH to device feature ioctl

[Tian, Kevin]

> From: Jason Gunthorpe <jgg@xxxxxxxx>
> Sent: Tuesday, April 1, 2025 10:12 PM
> 
> On Wed, Mar 12, 2025 at 07:53:17AM +0000, Tian, Kevin wrote:
> 
> > Probably we should not allow device-specific mode unless the user is
> > capable of CAP_SYS_RAWIO? It allows an user to pollute caches on
> > CPUs which its processes are not affined to, hence could easily break
> > SLAs which CSPs try to achieve...
> 
> I'm not sure this is within the threat model for VFIO though..
> 
> qemu or the operator needs to deal with this by not permiting such
> HW to go into a VM.

it could be used by native app e.g. dpdk.

> 
> Really we can't block device specific mode anyhow because we can't
> even discover it on the kernel side..
> 

hmm the TPH capability reports which steering modes (no st,
irq vector, or device specific) are supported by a device. and the
mode must be selected explicitly when sw enables the capability.

so policy-wise vfio could advocate/enforce that only the interrupt
vector mode is supported for non-privileged users.