[Starlingx-discuss] [stx-tools] New Kernel Version

[Hu, Yong]

On top of these patches, does anyone has concerns to upgrade kernel to the latest 862.6.3??

BTW, from security perspective, CVE-2018-8897 was updated on 862.3.2 and CVE-2018-3665 was on 862.3.3.

======================================================
POP SS (CVE-2018-8897) – Done on May 8 [Software Only Fix]
CentOS6.X: https://lists.centos.org/pipermail/centos-announce/2018-May/022827.html
2.       Speculative Store Bypass Disable (SSBD) (CVE-2018-3639) – Done on May 21 [Software+Microcode Fix]
CentOS6.X: https://lists.centos.org/pipermail/centos-announce/2018-May/022835.html
CentOS7.X: https://lists.centos.org/pipermail/centos-announce/2018-May/022843.html
kernel-3.10.0-862.3.2.el7
3.            Lazy FP State Restore (CVE-2018-3665) – Done on June 13 [Software only Fix] -
CentOS7.X: https://lists.centos.org/pipermail/centos-announce/2018-June/022923.html
kernel-3.10.0-862.3.3.el7
=======================================================



From: "Young, Ken" <Ken.Young at windriver.com>
Date: Friday, 6 July 2018 at 11:58 PM
To: "Hu, Yong" <yong.hu at intel.com>, "Rowsell, Brent" <Brent.Rowsell at windriver.com>, "starlingx-discuss at lists.starlingx.io" <starlingx-discuss at lists.starlingx.io>
Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version

The reviews for the updated kernel are here:
 
https://review.openstack.org/#/c/580688/
https://review.openstack.org/580689
https://review.openstack.org/580690
https://review.openstack.org/580692
 
/KenY
 
From: Ken Young <Ken.Young at windriver.com>
Date: Friday, July 6, 2018 at 9:42 AM
To: YONG HU <yong.hu at intel.com>, "Rowsell, Brent" <Brent.Rowsell at windriver.com>, "starlingx-discuss at lists.starlingx.io" <starlingx-discuss at lists.starlingx.io>
Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version
 
See inline.
 
From: YONG HU <yong.hu at intel.com>
Date: Thursday, July 5, 2018 at 10:18 PM
To: "Rowsell, Brent" <Brent.Rowsell at windriver.com>, Ken Young <Ken.Young at windriver.com>, "starlingx-discuss at lists.starlingx.io" <starlingx-discuss at lists.starlingx.io>
Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version
 
Hi Ken,
>>> we have a kernel update to 862.3.2
>>> We will work to get our updated kernel in ASAP
Did you mean WRS has already been working on upgrade to 862.3.2?
 
Yes.  We had already migrated to this kernel to enable our kubernetes efforts.  The kernel contained capabilities we needed.
 
Could you please post the activities and progress here in this mailing list, so that we all are aware of it?
 
We are planning to put the 862.3.2 into the openstack repos today.
 
Regards,
Yong
 
From: "Hu, Yong" <yong.hu at intel.com>
Date: Friday, 6 July 2018 at 9:14 AM
To: "Rowsell, Brent" <Brent.Rowsell at windriver.com>, "Young, Ken" <Ken.Young at windriver.com>, "starlingx-discuss at lists.starlingx.io" <starlingx-discuss at lists.starlingx.io>
Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version
 
Makes sense!
Do we intend/agree to apply this rule on all new features or big changes (though practically how we gate the granularity of changes?)?
Regards,
Yong
From: "Rowsell, Brent" <Brent.Rowsell at windriver.com>
Date: Friday, 6 July 2018 at 8:58 AM
To: "Hu, Yong" <yong.hu at intel.com>, "Young, Ken" <Ken.Young at windriver.com>, "starlingx-discuss at lists.starlingx.io" <starlingx-discuss at lists.starlingx.io>
Subject: RE: [Starlingx-discuss] [stx-tools] New Kernel Version
 
Going forward, I would recommend pending upgrades be posted to the mailing list before the reviews are actually submitted. 
 
Brent 
 
From: Hu, Yong [mailto:yong.hu at intel.com] 
Sent: Thursday, July 5, 2018 8:56 PM
To: Young, Ken <Ken.Young at windriver.com>; starlingx-discuss at lists.starlingx.io
Subject: Re: [Starlingx-discuss] [stx-tools] New Kernel Version
 
Hi Ken, 
We might need a sync-up on this kernel upgrade topic. 
Actually, moving forward, I would suggest, if there are any big changes to come, we both sides need to inform each other in advance, to avoid duplications or conflicts. 
 
Regards,
Yong
From: "Young, Ken" <mailto:Ken.Young at windriver.com>
Date: Friday, 6 July 2018 at 12:21 AM
To: "mailto:starlingx-discuss at lists.starlingx.io" <mailto:starlingx-discuss at lists.starlingx.io>
Subject: [Starlingx-discuss] [stx-tools] New Kernel Version
 
I discovered 2 new reviews this morning which are security related this morning:
https://review.openstack.org/#/c/580287/
https://review.openstack.org/#/c/580308/
 
These reviews propose to merge the latest CentOS kernel 862.6.3 to address the latest Spectre / Meltdown CVEs.
 
Before this is completed, we have a kernel update to 862.3.2 we would like to merge which includes module updates to enable containers which we would like to get in first.  Otherwise, this will generate a significant amount of rework for these submissions.  The easiest path is to follow the kernels in order.
 
We will work to get our updated kernel in ASAP.
 
Thank you in advance.
 
Regards,
Ken Y