50a9ff6df4
The kernel is moved ahead to version 3.10.0-693.21.1.el7 To summarize: CVE-2017-5753 [bounds check bypass] aka 'Spectre Variant 1' This is fixed by load fences and is "baked in" and cannot be turned off. CVE-2017-5715 [branch target injection] aka 'Spectre Variant 2' This is fixed by a combination of retpolines and IBPB, or IBRS+IBPB if on skylake. This requires a microcode change in the processors. This feature, if on, has a significant performance impact. It is assumed on unless turned off via the "nospectre_v2" bootarg. CVE-2017-5754 [rogue data cache load] aka 'Meltdown' aka 'Variant 3' This is fixed by page table isolation using the Kaiser patches. This feature is assumed on unless turned off via the "nopti" bootarg. As of the commit date, we have changed the installer kickstarts to issue both "nopti nospectre_v2" bootargs to minimize realtime impacts by default. The customer will be able to optionally sacrifice performance for extra security at datafill time. Change-Id: Id7c99923f2ee2ee91f77c7bd9940e684eff8b476 Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
40 lines
1.7 KiB
Diff
40 lines
1.7 KiB
Diff
From 02a0f14b1c2d7542fc4919ad5440e354b45e5ab4 Mon Sep 17 00:00:00 2001
|
|
Message-Id: <02a0f14b1c2d7542fc4919ad5440e354b45e5ab4.1524081065.git.Jim.Somerville@windriver.com>
|
|
In-Reply-To: <8d084dcc717666af0283e4ddeefaba7e331d879a.1524081065.git.Jim.Somerville@windriver.com>
|
|
References: <8d084dcc717666af0283e4ddeefaba7e331d879a.1524081065.git.Jim.Somerville@windriver.com>
|
|
From: Alex Kozyrev <alex.kozyrev@windriver.com>
|
|
Date: Fri, 16 Mar 2018 15:58:37 -0400
|
|
Subject: [PATCH 38/39] restrict iSCSI kthreads to CPUs in cpu_kthread_mask
|
|
|
|
Do not allow them to run on other CPUs to prevent interference with VMs.
|
|
|
|
Signed-off-by: Alex Kozyrev <alex.kozyrev@windriver.com>
|
|
Signed-off-by: Jim Somerville <Jim.Somerville@windriver.com>
|
|
---
|
|
SPECS/kernel-rt.spec | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/SPECS/kernel-rt.spec b/SPECS/kernel-rt.spec
|
|
index 5d9b4bc..9dae160 100644
|
|
--- a/SPECS/kernel-rt.spec
|
|
+++ b/SPECS/kernel-rt.spec
|
|
@@ -429,6 +429,7 @@ Patch1031: KVM-x86-Fix-potential-preemption-when-get-the-curren.patch
|
|
Patch1032: mqueue-fix-a-use-after-free-in-sys_mq_notify.patch
|
|
# DRBD was choking on write same
|
|
Patch1033: turn-off-write-same-in-smartqpi-driver.patch
|
|
+Patch1034: restrict-iSCSI-kthreads-to-CPUs-in-cpu_kthread_mask.patch
|
|
|
|
BuildRoot: %{_tmppath}/kernel-%{KVERREL}-root
|
|
|
|
@@ -825,6 +826,7 @@ ApplyPatch dpt_i2o-fix-build-warning.patch
|
|
ApplyPatch KVM-x86-Fix-potential-preemption-when-get-the-curren.patch
|
|
ApplyPatch mqueue-fix-a-use-after-free-in-sys_mq_notify.patch
|
|
ApplyPatch turn-off-write-same-in-smartqpi-driver.patch
|
|
+ApplyPatch restrict-iSCSI-kthreads-to-CPUs-in-cpu_kthread_mask.patch
|
|
|
|
# move off upstream version mechanism
|
|
if [ -e localversion-rt ]; then
|
|
--
|
|
1.8.3.1
|
|
|