RE: [PATCH v4 25/27] vfio/pci: Provide an opt-out for the CXL Type-2 extensions

[Manish Honap]

> -----Original Message-----
> From: Alex Williamson <alex@xxxxxxxxxxx>
> Sent: Saturday, August 29, 2026 4:27 AM
> To: Manish Honap <mhonap@xxxxxxxxxx>
> Cc: jgg@xxxxxxxx; Ankit Agrawal <ankita@xxxxxxxxxx>; jic23@xxxxxxxxxx;
> dave.jiang@xxxxxxxxx; alejandro.lucero-palau@xxxxxxx; Srirangan Madhavan
> <smadhavan@xxxxxxxxxx>; corbet@xxxxxxx; skhan@xxxxxxxxxxxxxxxxxxx;
> dave@xxxxxxxxxxxx; alison.schofield@xxxxxxxxx; vishal.l.verma@xxxxxxxxx;
> iweiny@xxxxxxxxxx; ming.li@xxxxxxxxxxxx; Yishai Hadas
> <yishaih@xxxxxxxxxx>; Shameer Kolothum Thodi
> <skolothumtho@xxxxxxxxxx>; kevin.tian@xxxxxxxxx; bhelgaas@xxxxxxxxxx;
> dmatlack@xxxxxxxxxx; kees@xxxxxxxxxx; gustavoars@xxxxxxxxxx; Neo Jia
> <cjia@xxxxxxxxxx>; Krishnakant Jaju <kjaju@xxxxxxxxxx>; Vikram Sethi
> <vsethi@xxxxxxxxxx>; Zhi Wang <zhiw@xxxxxxxxxx>; linux-
> doc@xxxxxxxxxxxxxxx; linux-kernel@xxxxxxxxxxxxxxx; kvm@xxxxxxxxxxxxxxx;
> linux-cxl@xxxxxxxxxxxxxxx; linux-pci@xxxxxxxxxxxxxxx; linux-
> kselftest@xxxxxxxxxxxxxxx; linux-hardening@xxxxxxxxxxxxxxx; alex@xxxxxxxxxxx
> Subject: Re: [PATCH v4 25/27] vfio/pci: Provide an opt-out for the CXL Type-2
> extensions
> 
> External email: Use caution opening links or attachments
> 
> 
> On Thu, 13 Aug 2026 15:06:29 +0530
> <mhonap@xxxxxxxxxx> wrote:
> 
> > From: Manish Honap <mhonap@xxxxxxxxxx>
> >
> > Add an opt-out so users can keep vfio-pci's CXL extensions out of the
> > path for individual devices or for an entire vfio-pci instance. The
> > runtime gates are:
> >
> >   - Module parameter vfio_pci.disable_cxl (bool, 0444). Setting
> >     disable_cxl=1 at modprobe time makes vfio_pci_probe() set
> >     vdev->disable_cxl on every device it binds.
> >
> >   - Variant drivers (nvgrace, mlx5, and others) may set vdev->disable_cxl
> >     in their own probe for per-device control without the module
> >     parameter. The bit lives on struct vfio_pci_core_device so it is
> >     reachable from any variant.
> >
> > vfio_pci_core_init_dev() consults vdev->disable_cxl before it probes
> > for a CXL device, so a device that opts out is driven as plain vfio-pci:
> > vfio-cxl is not loaded, init_device() never runs, and the device gets
> > no VFIO_DEVICE_FLAGS_CXL, no HDM or component-register regions, and
> no
> > DVSEC virtualization.
> >
> > The module parameter is built only when CONFIG_VFIO_CXL is enabled;
> > the disable_cxl bit itself is unconditional so a variant driver can
> > set it regardless. This mirrors the long-standing disable_denylist opt-out.
> >
> > Signed-off-by: Manish Honap <mhonap@xxxxxxxxxx>
> > ---
> >  drivers/vfio/pci/vfio_pci.c      | 9 +++++++++
> >  drivers/vfio/pci/vfio_pci_core.c | 8 +++++---
> >  include/linux/vfio_pci_core.h    | 1 +
> >  3 files changed, 15 insertions(+), 3 deletions(-)
> >
> > diff --git a/drivers/vfio/pci/vfio_pci.c b/drivers/vfio/pci/vfio_pci.c
> > index 830369ff878d..0ad041fffe48 100644
> > --- a/drivers/vfio/pci/vfio_pci.c
> > +++ b/drivers/vfio/pci/vfio_pci.c
> > @@ -60,6 +60,12 @@ static bool disable_denylist;
> > module_param(disable_denylist, bool, 0444);
> > MODULE_PARM_DESC(disable_denylist, "Disable use of device denylist.
> > Disabling the denylist allows binding to devices with known errata
> > that may lead to exploitable stability or security issues when
> > accessed by untrusted users.");
> >
> > +#if IS_ENABLED(CONFIG_VFIO_CXL)
> > +static bool disable_cxl;
> > +module_param(disable_cxl, bool, 0444); MODULE_PARM_DESC(disable_cxl,
> > +"Disable CXL Type-2 extensions for all devices bound to vfio-pci. A
> > +variant driver may instead set vdev->disable_cxl in its own .init
> > +callback.");
> 
> The latter sentence isn't module parameter description material, it's aimed at
> users.  Why does this need to be read-only since it's following the latch-at-init
> flow?  Thanks,
> 
> Alex

Okay, I will move the user-facing sentence out of the module-parameter description
and use the normal parameter mode rather than read-only.

Thanks,
Manish

> 
> > +#endif
> > +
> >  static bool vfio_pci_dev_in_denylist(struct pci_dev *pdev)  {
> >       switch (pdev->vendor) {
> > @@ -142,6 +148,9 @@ static int vfio_pci_init_dev(struct vfio_device
> > *core_vdev)  #ifdef CONFIG_VFIO_PCI_VGA
> >       vdev->disable_vga = disable_vga;  #endif
> > +#if IS_ENABLED(CONFIG_VFIO_CXL)
> > +     vdev->disable_cxl = disable_cxl; #endif
> >
> >       return vfio_pci_core_init_dev(core_vdev);
> >  }
> > diff --git a/drivers/vfio/pci/vfio_pci_core.c
> > b/drivers/vfio/pci/vfio_pci_core.c
> > index 0fed8e00bc1d..4b51a0f1e847 100644
> > --- a/drivers/vfio/pci/vfio_pci_core.c
> > +++ b/drivers/vfio/pci/vfio_pci_core.c
> > @@ -2423,10 +2423,12 @@ int vfio_pci_core_init_dev(struct vfio_device
> *core_vdev)
> >       xa_init(&vdev->ctx);
> >
> >       /*
> > -      * Load vfio-cxl on demand for a CXL device. If it is absent, drive the
> > -      * device as plain vfio-pci rather than failing the bind.
> > +      * Load vfio-cxl on demand for a CXL device unless the user opted out.
> > +      * If it is opted out or absent, drive the device as plain vfio-pci
> > +      * rather than failing the bind.
> >        */
> > -     if (pcie_is_cxl(vdev->pdev) && vfio_pci_is_cxl_type2(vdev->pdev)) {
> > +     if (!vdev->disable_cxl && pcie_is_cxl(vdev->pdev) &&
> > +         vfio_pci_is_cxl_type2(vdev->pdev)) {
> >               const struct vfio_cxl_ops *ops;
> >
> >               request_module("vfio-cxl"); diff --git
> > a/include/linux/vfio_pci_core.h b/include/linux/vfio_pci_core.h index
> > 18e206a35d8c..8e3723a55c17 100644
> > --- a/include/linux/vfio_pci_core.h
> > +++ b/include/linux/vfio_pci_core.h
> > @@ -158,6 +158,7 @@ struct vfio_pci_core_device {
> >       bool                    disable_idle_d3:1;
> >       bool                    nointxmask:1;
> >       bool                    disable_vga:1;
> > +     bool                    disable_cxl:1;
> >       /* Flags modified at runtime - dedicated storage unit */
> >       bool                    needs_reset;
> >       bool                    pm_intx_masked;