> From: Yi Liu > Sent: Thursday, March 16, 2023 8:56 PM > > + > +static int vfio_device_cdev_enable_noiommu(struct vfio_device *device) > +{ > + if (!vfio_device_is_noiommu(device)) > + return -EINVAL; > + > + if (!capable(CAP_SYS_RAWIO)) > + return -EPERM; > + > + return 0; > +} it makes more sense to check CAP first. Reviewed-by: Kevin Tian <kevin.tian@xxxxxxxxx>