aws: disable strict IOMMU TLB invalidation by default

Bug #1902281 reported by Andrea Righi
6
This bug affects 1 person
Affects Status Importance Assigned to Milestone
linux-aws (Ubuntu)
High
Andrea Righi
Bionic
High
Andrea Righi
Focal
High
Andrea Righi
Groovy
High
Andrea Righi

Bug Description

[Impact]

AWS requires to relax the synchronous IOMMU TLB invalidation by default to get a significant performance improvement on certain arm64 instance types (bare metal).

This is not the default behavior in the upstream kernel, that enforces synchronous invalidations to provide a better isolation and potentially prevent side-channel attacks with malicious devices that can be registered in the same IOMMU domain.

This behavior cannot be changed at run-time and it is available only via iommu.strict=0|1 (via kernel boot parameters - GRUB).

[Test Case]

It has been performance-tested by AWS.

[Fix]

Change iommu.strict in the kernel to be off by default. It will be always possible to revert this change and restore the old behavior by setting iommu.strict=1 in the GRUB parameters (and rebooting).

[Regression Potential]

The only concern about this change is that we are relaxing a security constraint. After considerable discussion and evaluation (also with the security team) the conclusion was that this change is not realistically affecting the particular AWS environment in terms of security and it can definitely provide a significant performance boost on certain arm64 instance types.

Andrea Righi (arighi)
Changed in linux-aws (Ubuntu):
importance: Undecided → High
Changed in linux-aws (Ubuntu Bionic):
importance: Undecided → High
Changed in linux-aws (Ubuntu Focal):
importance: Undecided → High
Changed in linux-aws (Ubuntu Groovy):
importance: Undecided → High
Changed in linux-aws (Ubuntu):
assignee: nobody → Andrea Righi (arighi)
Changed in linux-aws (Ubuntu Bionic):
assignee: nobody → Andrea Righi (arighi)
Changed in linux-aws (Ubuntu Focal):
assignee: nobody → Andrea Righi (arighi)
Changed in linux-aws (Ubuntu Groovy):
assignee: nobody → Andrea Righi (arighi)
Ian May (ian-may)
Changed in linux-aws (Ubuntu Groovy):
status: New → Fix Committed
Changed in linux-aws (Ubuntu Focal):
status: New → Fix Committed
Changed in linux-aws (Ubuntu Bionic):
status: New → Fix Committed
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (80.4 KiB)

This bug was fixed in the package linux-aws - 5.4.0-1030.31

---------------
linux-aws (5.4.0-1030.31) focal; urgency=medium

  * focal/linux-aws: 5.4.0-1030.31 -proposed tracker (LP: #1903158)

  * Focal update: v5.4.66 upstream stable release (LP: #1896824)
    - [Config] [aws] updateconfigs for VGACON_SOFT_SCROLLBACK

  * aws: disable strict IOMMU TLB invalidation by default (LP: #1902281)
    - SAUCE: [aws] iommu: set the default iommu-dma mode as non-strict

  * AWS: add the nitro_enclaves driver (LP: #1903087)
    - cpu/hotplug: Add new {add,remove}_cpu() functions
    - [Config][aws] update config for NITRO_ENCLAVES
    - nitro_enclaves: Add ioctl interface definition
    - nitro_enclaves: Define the PCI device interface
    - nitro_enclaves: Define enclave info for internal bookkeeping
    - nitro_enclaves: Init PCI device driver
    - nitro_enclaves: Handle PCI device command requests
    - nitro_enclaves: Handle out-of-band PCI device events
    - nitro_enclaves: Init misc device providing the ioctl interface
    - nitro_enclaves: Add logic for creating an enclave VM
    - nitro_enclaves: Add logic for setting an enclave vCPU
    - nitro_enclaves: Add logic for getting the enclave image load info
    - nitro_enclaves: Add logic for setting an enclave memory region
    - nitro_enclaves: Add logic for starting an enclave
    - nitro_enclaves: Add logic for terminating an enclave
    - nitro_enclaves: Add Kconfig for the Nitro Enclaves driver
    - nitro_enclaves: Add Makefile for the Nitro Enclaves driver
    - nitro_enclaves: Add sample for ioctl interface usage
    - nitro_enclaves: Add overview documentation
    - MAINTAINERS: Add entry for the Nitro Enclaves driver

  [ Ubuntu: 5.4.0-55.61 ]

  * focal/linux: 5.4.0-55.61 -proposed tracker (LP: #1903175)
  * Update kernel packaging to support forward porting kernels (LP: #1902957)
    - [Debian] Update for leader included in BACKPORT_SUFFIX
  * Avoid double newline when running insertchanges (LP: #1903293)
    - [Packaging] insertchanges: avoid double newline
  * EFI: Fails when BootCurrent entry does not exist (LP: #1899993)
    - efivarfs: Replace invalid slashes with exclamation marks in dentries.
  * CVE-2020-14351
    - perf/core: Fix race in the perf_mmap_close() function
  * raid10: Block discard is very slow, causing severe delays for mkfs and
    fstrim operations (LP: #1896578)
    - md: add md_submit_discard_bio() for submitting discard bio
    - md/raid10: extend r10bio devs to raid disks
    - md/raid10: pull codes that wait for blocked dev into one function
    - md/raid10: improve raid10 discard request
    - md/raid10: improve discard request for far layout
    - dm raid: fix discard limits for raid1 and raid10
    - dm raid: remove unnecessary discard limits for raid10
  * Bionic: btrfs: kernel BUG at /build/linux-
    eTBZpZ/linux-4.15.0/fs/btrfs/ctree.c:3233! (LP: #1902254)
    - btrfs: drop unnecessary offset_in_page in extent buffer helpers
    - btrfs: extent_io: do extra check for extent buffer read write functions
    - btrfs: extent-tree: kill BUG_ON() in __btrfs_free_extent()
    - btrfs: extent-tree: kill the BUG_ON() in insert_inline_extent_backref()
   ...

Changed in linux-aws (Ubuntu Focal):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (52.4 KiB)

This bug was fixed in the package linux-aws - 5.8.0-1014.15

---------------
linux-aws (5.8.0-1014.15) groovy; urgency=medium

  * groovy/linux-aws: 5.8.0-1014.15 -proposed tracker (LP: #1903182)

  * Groovy update: v5.8.15 upstream stable release (LP: #1902130)
    - [Packaging] [aws] module ocelot_board rename

  * AWS: add the nitro_enclaves driver (LP: #1903087)
    - [Config][aws] update config for NITRO_ENCLAVES
    - nitro_enclaves: Add ioctl interface definition
    - nitro_enclaves: Define the PCI device interface
    - nitro_enclaves: Define enclave info for internal bookkeeping
    - nitro_enclaves: Init PCI device driver
    - nitro_enclaves: Handle PCI device command requests
    - nitro_enclaves: Handle out-of-band PCI device events
    - nitro_enclaves: Init misc device providing the ioctl interface
    - nitro_enclaves: Add logic for creating an enclave VM
    - nitro_enclaves: Add logic for setting an enclave vCPU
    - nitro_enclaves: Add logic for getting the enclave image load info
    - nitro_enclaves: Add logic for setting an enclave memory region
    - nitro_enclaves: Add logic for starting an enclave
    - nitro_enclaves: Add logic for terminating an enclave
    - nitro_enclaves: Add Kconfig for the Nitro Enclaves driver
    - nitro_enclaves: Add Makefile for the Nitro Enclaves driver
    - nitro_enclaves: Add sample for ioctl interface usage
    - nitro_enclaves: Add overview documentation
    - MAINTAINERS: Add entry for the Nitro Enclaves driver

  * aws: improve hibernation reliability in groovy (LP: #1902926)
    - [Config] [aws] disable CONFIG_INPUT_XEN_KBDDEV_FRONTEND
    - [Config] [aws] disable CONFIG_XEN_BALLOON on amd64
    - [Config] [aws] enforce CONFIG_XEN_NETDEV_FRONTEND
    - [Config] [aws] remove all sound-related modules

  * xen hibernation support for linux-aws (LP: #1732512)
    - [Config] [aws] make sure CONFIG_SUSPEND is disabled
    - [Config] [aws] disable CONFIG_XEN_FBDEV_FRONTEND

  * aws: disable CONFIG_DMA_CMA (LP: #1879711)
    - [Config] [aws] make sure CONFIG_FB_HYPERV is disabled

  * aws: update patch to batch hibernate and resume IO requests (LP: #1902864)
    - Revert "UBUNTU: SAUCE: [aws] PM / hibernate: Speed up hibernation by
      batching requests"
    - PM: hibernate: Batch hibernate and resume IO requests

  * aws: disable strict IOMMU TLB invalidation by default (LP: #1902281)
    - SAUCE: [aws] iommu: set the default iommu-dma mode as non-strict

  [ Ubuntu: 5.8.0-30.32 ]

  * groovy/linux: 5.8.0-30.32 -proposed tracker (LP: #1903194)
  * Update kernel packaging to support forward porting kernels (LP: #1902957)
    - [Debian] Update for leader included in BACKPORT_SUFFIX
  * Avoid double newline when running insertchanges (LP: #1903293)
    - [Packaging] insertchanges: avoid double newline
  * EFI: Fails when BootCurrent entry does not exist (LP: #1899993)
    - efivarfs: Replace invalid slashes with exclamation marks in dentries.
  * raid10: Block discard is very slow, causing severe delays for mkfs and
    fstrim operations (LP: #1896578)
    - md: add md_submit_discard_bio() for submitting discard bio
    - md/raid10: extend r10bio devs to raid disks
    - md/raid10: pull...

Changed in linux-aws (Ubuntu Groovy):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :
Download full text (33.1 KiB)

This bug was fixed in the package linux-aws - 4.15.0-1088.93

---------------
linux-aws (4.15.0-1088.93) bionic; urgency=medium

  * bionic/linux-aws: 4.15.0-1088.93 -proposed tracker (LP: #1903118)

  * Bionic update: upstream stable patchset 2020-09-30 (LP: #1897977)
    - [Config] aws: updateconfigs for VGACON_SOFT_SCROLLBACK

  * aws: disable strict IOMMU TLB invalidation by default (LP: #1902281)
    - SAUCE: [aws] iommu: set the default iommu-dma mode as non-strict

  [ Ubuntu: 4.15.0-125.128 ]

  * bionic/linux: 4.15.0-125.128 -proposed tracker (LP: #1903137)
  * Update kernel packaging to support forward porting kernels (LP: #1902957)
    - [Debian] Update for leader included in BACKPORT_SUFFIX
  * Avoid double newline when running insertchanges (LP: #1903293)
    - [Packaging] insertchanges: avoid double newline
  * EFI: Fails when BootCurrent entry does not exist (LP: #1899993)
    - efivarfs: Replace invalid slashes with exclamation marks in dentries.
  * CVE-2020-14351
    - perf/core: Fix race in the perf_mmap_close() function
  * raid10: Block discard is very slow, causing severe delays for mkfs and
    fstrim operations (LP: #1896578)
    - md: add md_submit_discard_bio() for submitting discard bio
    - md/raid10: extend r10bio devs to raid disks
    - md/raid10: pull codes that wait for blocked dev into one function
    - md/raid10: improve raid10 discard request
    - md/raid10: improve discard request for far layout
  * Bionic: btrfs: kernel BUG at /build/linux-
    eTBZpZ/linux-4.15.0/fs/btrfs/ctree.c:3233! (LP: #1902254)
    - btrfs: use offset_in_page instead of open-coding it
    - btrfs: use BUG() instead of BUG_ON(1)
    - btrfs: drop unnecessary offset_in_page in extent buffer helpers
    - btrfs: extent_io: do extra check for extent buffer read write functions
    - btrfs: extent-tree: kill BUG_ON() in __btrfs_free_extent()
    - btrfs: extent-tree: kill the BUG_ON() in insert_inline_extent_backref()
    - btrfs: ctree: check key order before merging tree blocks
  * Bionic update: upstream stable patchset 2020-11-04 (LP: #1902943)
    - USB: gadget: f_ncm: Fix NDP16 datagram validation
    - gpio: tc35894: fix up tc35894 interrupt configuration
    - vsock/virtio: use RCU to avoid use-after-free on the_virtio_vsock
    - vsock/virtio: stop workers during the .remove()
    - vsock/virtio: add transport parameter to the
      virtio_transport_reset_no_sock()
    - net: virtio_vsock: Enhance connection semantics
    - Input: i8042 - add nopnp quirk for Acer Aspire 5 A515
    - ftrace: Move RCU is watching check after recursion check
    - drm/amdgpu: restore proper ref count in amdgpu_display_crtc_set_config
    - drivers/net/wan/hdlc_fr: Add needed_headroom for PVC devices
    - drm/sun4i: mixer: Extend regmap max_register
    - net: dec: de2104x: Increase receive ring size for Tulip
    - rndis_host: increase sleep time in the query-response loop
    - nvme-core: get/put ctrl and transport module in nvme_dev_open/release()
    - drivers/net/wan/lapbether: Make skb->protocol consistent with the header
    - drivers/net/wan/hdlc: Set skb->protocol before transmitting
    - mac80211: do not allow bigger VHT MPDUs than t...

Changed in linux-aws (Ubuntu Bionic):
status: Fix Committed → Fix Released
Revision history for this message
Launchpad Janitor (janitor) wrote :

This bug was fixed in the package linux-aws - 5.8.0-1018.20+21.04.1

---------------
linux-aws (5.8.0-1018.20+21.04.1) hirsute; urgency=medium

  * Packaging resync (LP: #1786013)
    - update dkms package versions

  [ Ubuntu: 5.8.0-1018.20 ]

  * debian/scripts/file-downloader does not handle positive failures correctly
    (LP: #1878897)
    - [Packaging] file-downloader not handling positive failures correctly
  * Packaging resync (LP: #1786013)
    - update dkms package versions
  * CVE-2021-1052 // CVE-2021-1053
    - [Packaging] NVIDIA -- Add the NVIDIA 460 driver

 -- Thadeu Lima de Souza Cascardo <email address hidden> Thu, 07 Jan 2021 10:47:22 -0300

Changed in linux-aws (Ubuntu):
status: New → Fix Released
To post a comment you must log in.
This report contains Public information  Edit
Everyone can see this information.

Other bug subscribers