50a9ff6df4
The kernel is moved ahead to version 3.10.0-693.21.1.el7 To summarize: CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' This is fixed by load fences and is "baked in" and cannot be turned off. CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' This is fixed by a combination of retpolines and IBPB, or IBRS+IBPB if on skylake. This requires a microcode change in the processors. This feature, if on, has a significant performance impact. It is assumed on unless turned off via the "nospectre_v2" bootarg. CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' This is fixed by page table isolation using the Kaiser patches. This feature is assumed on unless turned off via the "nopti" bootarg. As of the commit date, we have changed the installer kickstarts to issue both "nopti nospectre_v2" bootargs to minimize realtime impacts by default. The customer will be able to optionally sacrifice performance for extra security at datafill time. Change-Id: Id7c99923f2ee2ee91f77c7bd9940e684eff8b476 Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
53 lines
1.6 KiB
Diff
53 lines
1.6 KiB
Diff
From c8c1453e69025ac3d2afc3064d42b74098bab3aa Mon Sep 17 00:00:00 2001
|
|
Message-Id: <c8c1453e69025ac3d2afc3064d42b74098bab3aa.1522099415.git.Jim.Somerville@windriver.com>
|
|
In-Reply-To: <37dfb62264baec527d56aaf20db887840bec1ea1.1522099415.git.Jim.Somerville@windriver.com>
|
|
References: <37dfb62264baec527d56aaf20db887840bec1ea1.1522099415.git.Jim.Somerville@windriver.com>
|
|
From: Scott Little <scott.little@windriver.com>
|
|
Date: Tue, 9 May 2017 13:10:22 -0400
|
|
Subject: [PATCH 02/32] Tweak install script for patching add patch release
|
|
|
|
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
|
|
---
|
|
SPECS/kernel.spec | 11 +++++++++--
|
|
1 file changed, 9 insertions(+), 2 deletions(-)
|
|
|
|
diff --git a/SPECS/kernel.spec b/SPECS/kernel.spec
|
|
index 55901b6..04b9816 100644
|
|
--- a/SPECS/kernel.spec
|
|
+++ b/SPECS/kernel.spec
|
|
@@ -3,7 +3,9 @@
|
|
|
|
Summary: The Linux kernel
|
|
|
|
-%define buildid .tis
|
|
+# This is the WRS patch release
|
|
+%define patch_rel 2
|
|
+%define buildid .%{patch_rel}.tis
|
|
|
|
# For a kernel released for public testing, released_kernel should be 1.
|
|
# For internal testing builds during development, it should be 0.
|
|
@@ -12,7 +14,8 @@ Summary: The Linux kernel
|
|
%global distro_build 693
|
|
|
|
%define rpmversion 3.10.0
|
|
-%define pkgrelease 693.21.1.el7
|
|
+%define _pkgrelease 693.21.1
|
|
+%define pkgrelease %{_pkgrelease}.el7
|
|
|
|
%define pkg_release %{pkgrelease}%{?buildid}
|
|
|
|
@@ -1425,6 +1428,10 @@ fi}\
|
|
%{expand:\
|
|
%{_sbindir}/new-kernel-pkg --package kernel%{?-v:-%{-v*}} --install %{KVRA}%{?-v:.%{-v*}} || exit $?\
|
|
}\
|
|
+# If this is a pkg upgrade (ie installed as a patch), set the reboot flag\
|
|
+if [ $1 -gt 1 ] ; then\
|
|
+ touch /var/run/node_is_patched_rr\
|
|
+fi\
|
|
%{nil}
|
|
|
|
#
|
|
--
|
|
1.8.3.1
|
|
|