Pull-request:Add a kernel command-line option 'config_acs' to directly control all the ACS bits for specific devices

[Brad Figg]

PCIe ACS settings control the level of isolation and the possible P2P paths between devices. With greater isolation the kernel will create smaller iommu_groups and with less isolation there is more HW that can achieve P2P transfers. From a virtualization perspective all devices in the same iommu_group must be assigned to the same VM as they lack security isolation.

There is no way for the kernel to automatically know the correct ACS settings for any given system and workload. Existing command line options (e.g., disable_acs_redir) allow only for large scale change, disabling all isolation, but this is not sufficient for more complex cases.

Add a kernel command-line option 'config_acs' to directly control all the ACS bits for specific devices, which allows the operator to setup the right level of isolation to achieve the desired P2P configuration. The definition is future proof; when new ACS bits are added to the spec the open syntax can be extended.

ACS needs to be setup early in the kernel boot as the ACS settings affect how iommu_groups are formed. iommu_group formation is a one time event during initial device discovery, so changing ACS bits after kernel boot can result in an inaccurate view of the iommu_groups compared to the current isolation configuration.

ACS applies to PCIe Downstream Ports and multi-function devices. The default ACS settings are strict and deny any direct traffic between two functions. This results in the smallest iommu_group the HW can support. Frequently these values result in slow or non-working P2PDMA.

ACS offers a range of security choices controlling how traffic is allowed to go directly between two devices. Some popular choices:

Full prevention

Translated requests can be direct, with various options

Asymmetric direct traffic, A can reach B but not the reverse

All traffic can be direct

Along with some other less common ones for special topologies.

The intention is that this option would be used with expert knowledge of the HW capability and workload to achieve the desired configuration.

[Ubuntu Kernel Bot (ubuntu-kernel-bot)]

This bug is awaiting verification that the linux-nvidia/6.8.0-1013.14 kernel in -proposed solves the problem. Please test the kernel and update this bug with the results. If the problem is solved, change the tag 'verification-needed-noble-linux-nvidia' to 'verification-done-noble-linux-nvidia'. If the problem still exists, change the tag 'verification-needed-noble-linux-nvidia' to 'verification-failed-noble-linux-nvidia'.

If verification is not done by 5 working days from today, this fix will be dropped from the source code, and this bug will be closed.

See https://wiki.ubuntu.com/Testing/EnableProposed for documentation how to enable and use -proposed. Thank you!

[Launchpad Janitor (janitor)]

This bug was fixed in the package linux-nvidia - 6.8.0-1013.14

---------------
linux-nvidia (6.8.0-1013.14) noble; urgency=medium

  * noble/linux-nvidia: 6.8.0-1013.14 -proposed tracker (LP: #2076633)

  * Pull-request to address ARM SMMU issue (LP: #2031320)
    - NVIDIA: SAUCE: iommu/arm-smmu-v3: Allow default substream bypass with a
      pasid support

  * Apply patch to set CONFIG_EFI_CAPSULE_LOADER=y for arm64 (LP: #2067111)
    - NVIDIA: [Config] EFI: set CAPSULE_LOADER=y for arm64

  * Pull request: mm: fix old/young bit handling in the faulting path of
    set_pte_range() (LP: #2075396)
    - mm: fix old/young bit handling in the faulting path

  * Pull-request:Add a kernel command-line option 'config_acs' to directly
    control all the ACS bits for specific devices (LP: #2073811)
    - PCI: Extend ACS configurability

  [ Ubuntu: 6.8.0-44.44 ]

  * noble/linux: 6.8.0-44.44 -proposed tracker (LP: #2076647)
  * Packaging resync (LP: #1786013)
    - [Packaging] debian.master/dkms-versions -- update from kernel-versions
      (main/2024.08.05)
  * Disable PCI_DYNAMIC_OF_NODES in Ubuntu (LP: #2074376)
    - [Config] Disable PCI_DYNAMIC_OF_NODES
  * [SRU] Turbostat support for Arrow Lake H (LP: #2074372)
    - tools/power turbostat: Enhance ARL/LNL support
    - x86/cpu: Add model number for another Intel Arrow Lake mobile processor
    - tools/power turbostat: Add ARL-H support
  * Noble update: upstream stable patchset 2024-07-30 (LP: #2075154)
    - fs/writeback: bail out if there is no more inodes for IO and queued once
    - padata: Disable BH when taking works lock on MT path
    - crypto: hisilicon/sec - Fix memory leak for sec resource release
    - crypto: hisilicon/qm - Add the err memory release process to qm uninit
    - io_uring/sqpoll: work around a potential audit memory leak
    - rcutorture: Fix rcu_torture_one_read() pipe_count overflow comment
    - rcutorture: Make stall-tasks directly exit when rcutorture tests end
    - rcutorture: Fix invalid context warning when enable srcu barrier testing
    - block/ioctl: prefer different overflow check
    - ssb: Fix potential NULL pointer dereference in ssb_device_uevent()
    - selftests/bpf: Prevent client connect before server bind in
      test_tc_tunnel.sh
    - selftests/bpf: Fix flaky test btf_map_in_map/lookup_update
    - batman-adv: bypass empty buckets in batadv_purge_orig_ref()
    - wifi: ath9k: work around memset overflow warning
    - af_packet: avoid a false positive warning in packet_setsockopt()
    - ACPI: x86: Add PNP_UART1_SKIP quirk for Lenovo Blade2 tablets
    - drop_monitor: replace spin_lock by raw_spin_lock
    - scsi: qedi: Fix crash while reading debugfs attribute
    - net: sfp: add quirk for ATS SFP-GE-T 1000Base-TX module
    - net/sched: fix false lockdep warning on qdisc root lock
    - kselftest: arm64: Add a null pointer check
    - net: dsa: realtek: keep default LED state in rtl8366rb
    - netpoll: Fix race condition in netpoll_owner_active
    - wifi: mt76: mt7921s: fix potential hung tasks during chip recovery
    - HID: Add quirk for Logitech Casa touchpad
    - HID: asus: fix more n-key report descriptors if n-key quirked
    - ACP...