Re: [PATCH v6 3/6] vfio/pci: Add PCIe TPH interface with capability query

[sashiko-bot@kernel.org]

Thank you for your contribution! Sashiko AI review found 1 potential issue(s) to consider:
- [High] The VFIO_DEVICE_PCI_TPH IOCTL reads PCI configuration space without ensuring the device is runtime resumed, potentially reporting bogus capabilities and causing hardware errors.
--

commit c1b7fcc4c0c41ea45b0bcdd16ef1d416fcc244c3
Author: Chengwen Feng <fengchengwen@huawei.com>

vfio/pci: Add PCIe TPH interface with capability query

This commit adds the VFIO_DEVICE_PCI_TPH IOCTL to allow userspace to query
device TPH capabilities. It also introduces a module parameter to restrict
unsafe device-specific TPH mode to trusted userspace.

> diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c
> index 3f8d093aacf8a..d98d04bad4a39 100644
> --- a/drivers/vfio/pci/vfio_pci_core.c
> +++ b/drivers/vfio/pci/vfio_pci_core.c
[ ... ]
> @@ -1461,6 +1463,53 @@ static int vfio_pci_ioctl_ioeventfd(struct vfio_pci_core_device *vdev,
>  				  ioeventfd.fd);
>  }
>  
> +static int vfio_pci_tph_get_cap(struct vfio_pci_core_device *vdev,
> +				struct vfio_device_pci_tph_op *op,
> +				void __user *uarg)
> +{
> +	struct pci_dev *pdev = vdev->pdev;
> +	u8 mode = pcie_tph_get_st_modes(pdev);

Does this ioctl need to ensure the device is runtime resumed before reading
its configuration space?

If the device is in a low-power state (like D3cold), won't the configuration
reads in pcie_tph_get_st_modes() return 0xFFFFFFFF?

This could cause the kernel to falsely report that all TPH modes are
supported and advertise an incorrect ST table size.

Should this handler (or vfio_pci_ioctl_tph) call
pm_runtime_resume_and_get() before invoking hardware-touching operations,
and pm_runtime_put() afterward?

> +	struct vfio_pci_tph_cap cap = {0};
> +
> +	if (op->argsz < offsetof(struct vfio_device_pci_tph_op, cap) +
> +			sizeof(struct vfio_pci_tph_cap))
> +		return -EINVAL;
> +
> +	if (mode == 0 || mode == PCI_TPH_CAP_ST_NS)
> +		return -EOPNOTSUPP;
[ ... ]

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20260506094623.29327-1-fengchengwen@huawei.com?part=3