** Changed in: linux-aws (Ubuntu Groovy)
Status: New => Fix Committed
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux-aws in Ubuntu.
https://bugs.launchpad.net/bugs/1902281
Title:
aws: disable strict IOMMU TLB invalidation by default
Status in linux-aws package in Ubuntu:
New
Status in linux-aws source package in Bionic:
New
Status in linux-aws source package in Focal:
New
Status in linux-aws source package in Groovy:
Fix Committed
Bug description:
[Impact]
AWS requires to relax the synchronous IOMMU TLB invalidation by
default to get a significant performance improvement on certain arm64
instance types (bare metal).
This is not the default behavior in the upstream kernel, that enforces
synchronous invalidations to provide a better isolation and
potentially prevent side-channel attacks with malicious devices that
can be registered in the same IOMMU domain.
This behavior cannot be changed at run-time and it is available only
via iommu.strict=0|1 (via kernel boot parameters - GRUB).
[Test Case]
It has been performance-tested by AWS.
[Fix]
Change iommu.strict in the kernel to be off by default. It will be
always possible to revert this change and restore the old behavior by
setting iommu.strict=1 in the GRUB parameters (and rebooting).
[Regression Potential]
The only concern about this change is that we are relaxing a security
constraint. After considerable discussion and evaluation (also with
the security team) the conclusion was that this change is not
realistically affecting the particular AWS environment in terms of
security and it can definitely provide a significant performance boost
on certain arm64 instance types.
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-aws/+bug/1902281/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : [email protected]
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
