Update: iommu.strict=1 avoids it too, so the bug is in the lazy (flush
queue) IOTLB invalidation path.
Same host as before (6.8.0-138, drive firmware GPK6, IOMMU translated):
- nvme.sgl_threshold=0 at runtime (PRP only, no SGLs): still failing,
IO_PAGE_FAULT + checksum failure 9 minutes later.
- reboot with iommu.strict=1 ("DMA domain TLB invalidation policy: strict
mode", default domain still Translated):
0 IO_PAGE_FAULTs and 0 checksum failures in 12 hours at normal load (~4,000
reads/s). In lazy mode the same
host had ~2.5 faults per hour, so ~25-30 were expected.
Not the difference between the failing drive and drives that run clean on the
same platform (same EPYC 9334,
same 6.8.0-138, same lazy mode): no ATS/PRI/PASID capability on any of them;
SGL support differs (KIOXIA CM6
sgls 0x70001, Samsung PM9A3 0, another vendor 0x2 which also uses SGLs and is
clean), but forcing PRP does not
help; max I/O size is 128 KiB on all.
Cost of strict on that host: NVMe read latency +~35 us (+15%), write
latency and CPU unchanged.
Summary so far:
- 6.8.0-65 .. 6.8.0-124: good
- 6.8.0-138 and 6.8.0-147 (proposed), lazy IOTLB flush: bad
- 6.8.0-138 + iommu=pt: good
- 6.8.0-138 + iommu.strict=1: good
- drive firmware GPK4 or GPK6, cold power cycle, nvme.sgl_threshold=0: no
difference
Possible candidate in the range: "iommu/amd: move wait_on_sem() out of
spinlock" (6.8.0-130), with follow-ups
"iommu/amd: serialize sequence allocation under concurrent TLB invalidations"
(-136) and the CVE-2026-68329 fix
"iommu/amd: Wait for completion instead of returning early in
iommu_completion_wait()" (-147), which do not fix it.
We can test intermediate kernels (-130, -131, -134, -136) or test builds
if that helps.
** CVE added: https://cve.org/CVERecord?id=CVE-2026-68329
--
You received this bug notification because you are a member of Ubuntu
Bugs, which is subscribed to Ubuntu.
https://bugs.launchpad.net/bugs/2172387
Title:
Regression in 6.8.0-138: AMD-Vi IO_PAGE_FAULT on NVMe read DMA returns
wrong data (still in -147, iommu=pt avoids it)
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu/+source/linux-hwe-6.8/+bug/2172387/+subscriptions
--
ubuntu-bugs mailing list
[email protected]
https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs
