MOFED modules security and update policy for post-release trees

This document describes the process and criteria for post-release MOFED modules updates. MOFED modules are shipped as DKMS source packages in the archive, one per major upstream version. The described process and criteria are built on the normal StableReleaseUpdates document, and where these documents conflict, this document takes precedence.

Background on MOFED

This outlines details of the project and the current state of their verification to prove that the LTS releases can be considered for an SRU exception.

MOFED consists of kernel modules and userspace packages. The kernel team has an objective of signing the kernel modules so that secure boot can be used on MOFED installations. The userspace packages are currently installed from the upstream installer, as they conflict with the packages in the Ubuntu archive.

Having an exception for MOFED will ensure that users of MOFED receive timely critical updates to this software.

Proposed SRU Approach

SRU updates for MOFED modules in Ubuntu will be aligned to the associated LTS release of MOFED.

Testing and verification

MOFED has very high constraints on the environment (Ubuntu release, kernel version, ...) as well as the hardware (limited to a set of networking cards). Therefore we are performing private tests set outside of autopkgtest that tries to cover the basic use case we know users have in mind (you can use MOFED for way more, but we want and can only test what is in the archive). The tests happen on private cloud machines with the appropriate environment and hardware.

We are also testing using public pycloudlib tests that do the following on an OCI bare metal cluster:

• Functional tests of RDMA ping between nodes
• Performance test of RDMA throughput and latency
• Performance test of ethernet over ConnectX cards via iperf3
• Functional test to ensure mellanox hardware configuration utilities are installed

We test the MOFED releases under Ubuntu LTS, using -proposed. The success of the tests then allows us to release the changes to both the LTS and the interim Ubuntu releases. This is because the hardware is only available on LTS releases.

SRU Template

This bug tracks an update for the mofed-modules-MAJOR package.

This update includes bugfixes only following the SRU policy exception defined at https://wiki.ubuntu.com/KernelTeam/MofedUpdates.

[Impact]

Stable release update so not directly applicable; see the exception policy document.

[Major Changes]

TODO: List the major changes from the upstream changelog

[Test Plan]

See https://wiki.ubuntu.com/KernelTeam/MofedUpdates/#SRU_TestVerify
TODO: verify the update on Ubuntu LTS by running the private test suite.

[Regression Potential]

Upstream performs extensive testing before release, giving us a high degree of confidence in the general case. There problems are most likely to manifest in Ubuntu-specific integrations, such as in relation to the versions of dependencies available and other packaging-specific matters.

TODO: consider any other regression potential specific to the version being updated and list if any or list N/A.