From: Manish Honap <[email protected]> Let an admin or a variant driver keep the CXL Type-2 extensions out of the path and bind the device without them.
Add a vfio_pci.disable_cxl module parameter, and let a variant driver set vdev->disable_cxl in its own init callback for per-device control. The parameter is built only when the CXL provider is configured. Assisted-by: LLM Signed-off-by: Manish Honap <[email protected]> --- drivers/vfio/pci/vfio_pci.c | 13 +++++++++++++ drivers/vfio/pci/vfio_pci_core.c | 2 +- include/linux/vfio_pci_core.h | 1 + 3 files changed, 15 insertions(+), 1 deletion(-) diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c index 286244059569..0ea349fb8d4a 100644 --- a/drivers/vfio/pci/vfio_pci.c +++ b/drivers/vfio/pci/vfio_pci.c @@ -60,6 +60,16 @@ static bool disable_denylist; module_param(disable_denylist, bool, 0444); MODULE_PARM_DESC(disable_denylist, "Disable use of device denylist. Disabling the denylist allows binding to devices with known errata that may lead to exploitable stability or security issues when accessed by untrusted users."); +#if IS_ENABLED(CONFIG_VFIO_CXL) +/* + * A variant driver may instead set vdev->disable_cxl in its own init callback + * for per-device control without this module-wide parameter. + */ +static bool disable_cxl; +module_param(disable_cxl, bool, 0644); +MODULE_PARM_DESC(disable_cxl, "Disable CXL Type-2 extensions for all devices bound to vfio-pci."); +#endif + static bool vfio_pci_dev_in_denylist(struct pci_dev *pdev) { switch (pdev->vendor) { @@ -142,6 +152,9 @@ static int vfio_pci_init_dev(struct vfio_device *core_vdev) #ifdef CONFIG_VFIO_PCI_VGA vdev->disable_vga = disable_vga; #endif +#if IS_ENABLED(CONFIG_VFIO_CXL) + vdev->disable_cxl = disable_cxl; +#endif return vfio_pci_core_init_dev(core_vdev); } diff --git a/drivers/vfio/pci/vfio_pci_core.c b/drivers/vfio/pci/vfio_pci_core.c index f1e1ec36eec7..1e0ac28b7564 100644 --- a/drivers/vfio/pci/vfio_pci_core.c +++ b/drivers/vfio/pci/vfio_pci_core.c @@ -2466,7 +2466,7 @@ static int vfio_pci_core_cxl_init(struct vfio_pci_core_device *vdev) const struct vfio_cxl_ops *ops; int ret; - if (!vfio_pci_is_cxl_type2(vdev->pdev)) + if (vdev->disable_cxl || !vfio_pci_is_cxl_type2(vdev->pdev)) return 0; request_module("vfio-cxl"); diff --git a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index 881e51c42414..991a3fcd84eb 100644 --- a/include/linux/vfio_pci_core.h +++ b/include/linux/vfio_pci_core.h @@ -162,6 +162,7 @@ struct vfio_pci_core_device { bool disable_idle_d3:1; bool nointxmask:1; bool disable_vga:1; + bool disable_cxl:1; /* Flags modified at runtime - dedicated storage unit */ bool needs_reset; bool pm_intx_masked; -- 2.53.0
