50a9ff6df4
The kernel is moved ahead to version 3.10.0-693.21.1.el7 To summarize: CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' This is fixed by load fences and is "baked in" and cannot be turned off. CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' This is fixed by a combination of retpolines and IBPB, or IBRS+IBPB if on skylake. This requires a microcode change in the processors. This feature, if on, has a significant performance impact. It is assumed on unless turned off via the "nospectre_v2" bootarg. CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' This is fixed by page table isolation using the Kaiser patches. This feature is assumed on unless turned off via the "nopti" bootarg. As of the commit date, we have changed the installer kickstarts to issue both "nopti nospectre_v2" bootargs to minimize realtime impacts by default. The customer will be able to optionally sacrifice performance for extra security at datafill time. Change-Id: Id7c99923f2ee2ee91f77c7bd9940e684eff8b476 Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
37 lines
1.4 KiB
Diff
37 lines
1.4 KiB
Diff
From a16074d0ff38ea44fb03f8d118ad058f5a062471 Mon Sep 17 00:00:00 2001
|
|
Message-Id: <a16074d0ff38ea44fb03f8d118ad058f5a062471.1522097754.git.Jim.Somerville@windriver.com>
|
|
In-Reply-To: <f4706beaf86081b0890ea616082913f8f51823ff.1522097754.git.Jim.Somerville@windriver.com>
|
|
References: <f4706beaf86081b0890ea616082913f8f51823ff.1522097754.git.Jim.Somerville@windriver.com>
|
|
From: Chris Friesen <chris.friesen@windriver.com>
|
|
Date: Wed, 11 Jan 2017 13:38:37 -0500
|
|
Subject: [PATCH 13/27] Enable building kernel with CONFIG_BLK_DEV_NBD
|
|
|
|
By default, the CentOS 7.3 kernel will fail to build if
|
|
CONFIG_BLK_DEV_NBD is enabled, either as module or builtin.
|
|
|
|
The issue seems to be due to the use of REQ_TYPE_SPECIAL in the
|
|
NBD code. Switching it to use REQ_TYPE_DRV_PRIV instead makes the
|
|
problem go away.
|
|
|
|
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
|
|
---
|
|
drivers/block/nbd.c | 2 +-
|
|
1 file changed, 1 insertion(+), 1 deletion(-)
|
|
|
|
diff --git a/drivers/block/nbd.c b/drivers/block/nbd.c
|
|
index a40a4f0..e0c6b62 100644
|
|
--- a/drivers/block/nbd.c
|
|
+++ b/drivers/block/nbd.c
|
|
@@ -616,7 +616,7 @@ static int __nbd_ioctl(struct block_device *bdev, struct nbd_device *nbd,
|
|
fsync_bdev(bdev);
|
|
mutex_lock(&nbd->tx_lock);
|
|
blk_rq_init(NULL, &sreq);
|
|
- sreq.cmd_type = REQ_TYPE_SPECIAL;
|
|
+ sreq.cmd_type = REQ_TYPE_DRV_PRIV;
|
|
nbd_cmd(&sreq) = NBD_CMD_DISC;
|
|
|
|
/* Check again after getting mutex back. */
|
|
--
|
|
1.8.3.1
|
|
|