Re: [RFC PATCH 1/1] vfio/pci: Disable sriov on PF device close

[Jason Gunthorpe]

On Tue, Aug 11, 2026 at 09:52:37AM +0000, Tian, Kevin wrote:

> Before closing the open on reset, does it make sense to first fit it into
> the coming trust infrastructure [1]? e.g. initially set to TRUST_NONE
> for any VF with a PF owned by vfio-pci, preventing any bind to
> in-kernel VF drivers. Then opt-in is allowed to promote the trust of
> such VFs to TRUST_ADVERSARY, allowing driver binding but also put
> it in precaution with IOMMU protection. So a malicious userspace
> PF driver cannot indirectly affect VFs to do dma-based attack.
> 
> somehow VFs in this scenario feel akin to Thunderbolt devices...

That's certainly a novel idea that could make sense for drivers that
support the trust level

Jason