[SOLVED] Q. Can I blacklist a specific passthrough block device rather than a driver? A. No

[alafrosty]

I think that the answer is "no" since I can't find a way to accomplish this. AFAIK, the blacklisting is for drivers.
Back story: I have a Proxmox system with an HBA that has some drives used in a ZFS pool in Proxmox and some drives used in a VM's ZFS pool via -virtio passthrough. The pool is exported in Proxmox, but the drives and pool are still visible in Proxmox even when it's in use in the VM. I'd prefer to bar Proxmox from seeing the devices, but I'm not sure how to accomplish that (or if it's even possible).
The HBA controller has two chips on it for controlling the drives, but they're identical, so even if I put all the drives on one, if I try to blacklist the driver, it'd make the rest of the drives unavailable to Proxmox, so that wouldn't work.

 

[leesteken]

In priciple, you do that by early binding the device to vfio-pci by its device ID [xyzw:abcd] (not the PCI ID 0000:xy:ab.f, which depends on the motherboard and other devices) and making sure vfio-pci loads before the device driver. However, if the two device are really identical then they probably have the same device ID. You can check with lspci -nn. I'm not aware of a way to work around this.

 

[alafrosty]

Many of the drives are identical, but none of the drives are listed with lspci. I think that's because they're not PCI devices. Instead, lsblk and lsscsi both list the drives, but lsblk includes numerous virtual drives where lsscsi only includes the physical drives. Note: I edited the post title because I wrote "device" rather than "block device" and that was definitely confusing.

 

[leesteken]

Many of the drives are identical, but none of the drives are listed with lspci. I think that's because they're not PCI devices.

Indeed, you can only do this for PCI(e) devices like NVMe or the controllers themselves (and the drives will follow).

Instead, lsblk and lsscsi both list the drives, but lsblk includes numerous virtual drives where lsscsi only includes the physical drives. Note: I edited the post title because I wrote "device" rather than "block device" and that was definitely confusing.

I did not realize you wanted to hide (some of) the drives from Proxmox but not a whole HBA controller, sorry. I assumed you have two HBA controllers (of the same type) and you wanted to hide one of them. If you are doing passthrough of drives, then you cannot hide them (those drives) from Proxmox. Proxmox needs to know them in order to pass them to a VM.

 

[alafrosty]

I did not realize you wanted to hide (some of) the drives from Proxmox but not a whole HBA controller, sorry.

Thank you for confirming what I suspected.

No apology needed, my initial question was poorly worded at first and the tech is what it is regardless of the torture I want to subject it to. Oddly enough, I do actually have two physical hba controllers in the box (one Sas, one Sata), but the Sas one has two separate controllers on it. Anyway, The proxmox piece works fine; I just thought that it would be safer/more isolated to send all the drives to the VM exclusively. I could futz with the wiring and figure out which drives need to go to the VM and slap them all on one of the Sas controllers, but with it all blacklisted, I'd lose the ability to swap in spares from the other chipset controller. Bla bla bla.

Hopefully this useful answer / info helps someone else avoid asking the same question in the future.