What testing has been done with 862.6.3 ? Brent -----Original Message----- From: Hu, Yong [mailto:yong.hu@intel.com] Sent: Saturday, July 7, 2018 9:17 PM To: Young, Ken <Ken.Young@windriver.com>; Rowsell, Brent <Brent.Rowsell@windriver.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version On top of these patches, does anyone has concerns to upgrade kernel to the latest 862.6.3?? BTW, from security perspective, CVE-2018-8897 was updated on 862.3.2 and CVE-2018-3665 was on 862.3.3. ====================================================== POP SS (CVE-2018-8897) – Done on May 8 [Software Only Fix] CentOS6.X: https://lists.centos.org/pipermail/centos-announce/2018-May/022827.html 2. Speculative Store Bypass Disable (SSBD) (CVE-2018-3639) – Done on May 21 [Software+Microcode Fix] CentOS6.X: https://lists.centos.org/pipermail/centos-announce/2018-May/022835.html CentOS7.X: https://lists.centos.org/pipermail/centos-announce/2018-May/022843.html kernel-3.10.0-862.3.2.el7 3. Lazy FP State Restore (CVE-2018-3665) – Done on June 13 [Software only Fix] - CentOS7.X: https://lists.centos.org/pipermail/centos-announce/2018-June/022923.html kernel-3.10.0-862.3.3.el7 ======================================================= From: "Young, Ken" <Ken.Young@windriver.com> Date: Friday, 6 July 2018 at 11:58 PM To: "Hu, Yong" <yong.hu@intel.com>, "Rowsell, Brent" <Brent.Rowsell@windriver.com>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version The reviews for the updated kernel are here: https://review.openstack.org/#/c/580688/ https://review.openstack.org/580689 https://review.openstack.org/580690 https://review.openstack.org/580692 /KenY From: Ken Young <Ken.Young@windriver.com> Date: Friday, July 6, 2018 at 9:42 AM To: YONG HU <yong.hu@intel.com>, "Rowsell, Brent" <Brent.Rowsell@windriver.com>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version See inline. From: YONG HU <yong.hu@intel.com> Date: Thursday, July 5, 2018 at 10:18 PM To: "Rowsell, Brent" <Brent.Rowsell@windriver.com>, Ken Young <Ken.Young@windriver.com>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version Hi Ken,
we have a kernel update to 862.3.2 We will work to get our updated kernel in ASAP Did you mean WRS has already been working on upgrade to 862.3.2? Yes. We had already migrated to this kernel to enable our kubernetes efforts. The kernel contained capabilities we needed. Could you please post the activities and progress here in this mailing list, so that we all are aware of it? We are planning to put the 862.3.2 into the openstack repos today. Regards, Yong From: "Hu, Yong" <yong.hu@intel.com> Date: Friday, 6 July 2018 at 9:14 AM To: "Rowsell, Brent" <Brent.Rowsell@windriver.com>, "Young, Ken" <Ken.Young@windriver.com>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io> Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version Makes sense! Do we intend/agree to apply this rule on all new features or big changes (though practically how we gate the granularity of changes?)? Regards, Yong From: "Rowsell, Brent" <Brent.Rowsell@windriver.com> Date: Friday, 6 July 2018 at 8:58 AM To: "Hu, Yong" <yong.hu@intel.com>, "Young, Ken" <Ken.Young@windriver.com>, "starlingx-discuss@lists.starlingx.io" <starlingx-discuss@lists.starlingx.io> Subject: RE: [Starlingx-discuss] [stx-tools] New Kernel Version Going forward, I would recommend pending upgrades be posted to the mailing list before the reviews are actually submitted. Brent From: Hu, Yong [mailto:yong.hu@intel.com] Sent: Thursday, July 5, 2018 8:56 PM To: Young, Ken <Ken.Young@windriver.com>; starlingx-discuss@lists.starlingx.io Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version Hi Ken, We might need a sync-up on this kernel upgrade topic. Actually, moving forward, I would suggest, if there are any big changes to come, we both sides need to inform each other in advance, to avoid duplications or conflicts. Regards, Yong From: "Young, Ken" <mailto:Ken.Young@windriver.com> Date: Friday, 6 July 2018 at 12:21 AM To: "mailto:starlingx-discuss@lists.starlingx.io" <mailto:starlingx-discuss@lists.starlingx.io> Subject: [Starlingx-discuss] [stx-tools] New Kernel Version I discovered 2 new reviews this morning which are security related this morning: https://review.openstack.org/#/c/580287/ https://review.openstack.org/#/c/580308/ These reviews propose to merge the latest CentOS kernel 862.6.3 to address the latest Spectre / Meltdown CVEs. Before this is completed, we have a kernel update to 862.3.2 we would like to merge which includes module updates to enable containers which we would like to get in first. Otherwise, this will generate a significant amount of rework for these submissions. The easiest path is to follow the kernels in order. We will work to get our updated kernel in ASAP. Thank you in advance. Regards, Ken Y