CentOS - Nov 2017 - How to blacklist a device driver (sysemd)

Hi,

how can a specific device driver in CentOS 7 be blacklisted, so that it 
doesn't load at boot time?  We have Infiniband adapters which are not 
completely supported by CentOS and we want to silence the error messages 
for the time being.

I tried with the files

   /etc/modprobe.d/blacklist
   /etc/modprobe.d/blacklist.conf

and with entries

   mlx5_core
   mlx5_ib

   blacklist mlx5_core
   blacklist mlx5_ib

   install mlx5_core /dev/null
   install mlx5_ib /dev/null

all found on different websites.

None of these entries helps.  mlx5_core and mlx5_ib are still loaded and 
the system is flooded with error messages.

Cheers
frank

On 11/15/2017 10:35 AM, Frank Thommen wrote:
>
> I tried with the files
> ? /etc/modprobe.d/blacklist
> ? /etc/modprobe.d/blacklist.conf
> and with entries
> ? blacklist mlx5_core
> ? blacklist mlx5_ib 
The "blacklist" entries prevent a module being loaded by its alias 
(typically a PCI ID), but not from being loaded if something explicitly 
loads it by module name.? Most likely, those modules are included in 
your initrd.

I'd suggest using the entries described above, and editing grub.conf to 
add arguments to the kernel command line:
 ??? rd.driver.blacklist=mlx5_core rd.driver.blacklist=mlx5_ib
... then rebuilding your initrd using "dracut --force"

On 11/15/2017 07:50 PM, Gordon Messmer wrote:
> On 11/15/2017 10:35 AM, Frank Thommen wrote:
>>
>> I tried with the files
>>   /etc/modprobe.d/blacklist
>>   /etc/modprobe.d/blacklist.conf
>> and with entries
>>   blacklist mlx5_core
>>   blacklist mlx5_ib
>
> The "blacklist" entries prevent a module being loaded by its
alias
> (typically a PCI ID), but not from being loaded if something explicitly
> loads it by module name.  Most likely, those modules are included in
> your initrd.
>
> I'd suggest using the entries described above, and editing grub.conf to
> add arguments to the kernel command line:
>     rd.driver.blacklist=mlx5_core rd.driver.blacklist=mlx5_ib
> ... then rebuilding your initrd using "dracut --force"
Thanks for the hint.  However as this should only be a temporary measure 
and needs to be done on ca. 100 hosts I'm not sure if we want to go 
through the hassles.  Deploying a textfile is no problem, but creating 
new initrds for differing hardware....

frank

Frank Thommen wrote:
> ** WARNING: This mail is from an external source **
> 
> 
> Hi,
> 
> how can a specific device driver in CentOS 7 be blacklisted, so that it
> doesn't load at boot time?? We have Infiniband adapters which are not
> completely supported by CentOS and we want to silence the error messages
> for the time being.
> 
> I tried with the files
> 
>  ? /etc/modprobe.d/blacklist
>  ? /etc/modprobe.d/blacklist.conf
> 
> and with entries
> 
>  ? mlx5_core
>  ? mlx5_ib
> 
>  ? blacklist mlx5_core
>  ? blacklist mlx5_ib
> 
>  ? install mlx5_core /dev/null
>  ? install mlx5_ib /dev/null
> 
> all found on different websites.
> 
> None of these entries helps.? mlx5_core and mlx5_ib are still loaded and
> the system is flooded with error messages.
They are probably being loaded via the initramfs at boot time - i.e. 
before the real root is mounted (where the blacklist entries exist)

I believe you can either add 'rd.driver.blacklist=<driver_name>'
to the
grub2 boot cmdline - or generate a new initramfs (using 'dracut -f -v' -
make a copy of your current initramfs first) - as this should pull in 
entries in /etc/modprobe.d/

James Pearson

> -----Original Message-----
> From: James Pearson [mailto:james-p at moving-picture.com]
> Sent: Friday, November 17, 2017 5:21 AM
> To: CentOS mailing list; Frank Thommen
> Subject: Re: [CentOS] How to blacklist a device driver (sysemd)
> 
> Frank Thommen wrote:
> > Hi,
> >
> > how can a specific device driver in CentOS 7 be blacklisted, so that
it
> > doesn't load at boot time?? We have Infiniband adapters which are
not
> > completely supported by CentOS and we want to silence the error
messages
> > for the time being.
> >
> > I tried with the files
> >
> >  ? /etc/modprobe.d/blacklist
> >  ? /etc/modprobe.d/blacklist.conf
<SNIP reasonable blacklist changes>
> >
> > None of these entries helps.? mlx5_core and mlx5_ib are still loaded
and
> > the system is flooded with error messages.
> 
> They are probably being loaded via the initramfs at boot time - i.e.
> before the real root is mounted (where the blacklist entries exist)
> 
<SNIP>
Having had to blacklist things like this in the past, it has been my experience
that James is correct.
If the driver is available in the existing initrd (created before the updates to
the blacklists), then the driver WILL be loaded prior to the blacklists being
read.
For me I found two solutions that worked:
1) (re)install a new kernel after blacklist creation (which causes an dracut run
with all the correct parameters)
2) create the blacklists, then workout the correct dracut parameters and run it.

obviously from the point of avoiding research time, doing a boot into an _older_
kernel,
'yum remove kernel-currentversion; yum update kernel' is easier, but
once you figure out how to tell Dracut to use it's usual parameters for each
machine you can avoid the time of doing the extra reboot on a bunch of machines.
It has been ~4 years since I looked at this so I don't remember how to
automate using the right options per machine.
Or you could wait for the next CentOS 7 kernel update...Unfortunately the
CVE's for the 6 kernel that just came out were all fixed in the 7 kernel
back in October, so I have no expectation of a new 7 kernel anytime soon.

--
Even when this disclaimer is not here:
I am not a contracting officer. I do not have authority to make or modify the
terms of any contract.