Public bug reported:
Kernel config 4.15.0-13-generic #14 (and same for 4.15.0-15-generic) is
not OK, because both security mechanisms nobp AND expoline are enabled:
CONFIG_KERNEL_NOBP=y
CONFIG_EXPOLINE=y
# CONFIG_EXPOLINE_OFF is not set
# CONFIG_EXPOLINE_MEDIUM is not set
CONFIG_EXPOLINE_FULL=y
If the kernel is compiled with a gcc that can generate expoline thunks
the correct config is as follows:
# CONFIG_KERNEL_NOBP is not set
CONFIG_EXPOLINE=y
# CONFIG_EXPOLINE_OFF is not set
# CONFIG_EXPOLINE_MEDIUM is not set
CONFIG_EXPOLINE_FULL=y
Alternatively the auto-detection patch can be used which is upstream as
of today:
commit 6e179d64126b909f0b288fa63cdbf07c531e9b1d
s390: add automatic detection of the spectre defense
Automatically decide between nobp vs. expolines if the spectre_v2=auto
kernel parameter is specified or CONFIG_EXPOLINE_AUTO=y is set.
The decision made at boot time due to CONFIG_EXPOLINE_AUTO=y being set
can be overruled with the nobp, nospec and spectre_v2 kernel parameters.
If this patch is used, then the correct config is
# CONFIG_KERNEL_NOBP is not set
CONFIG_EXPOLINE=y
# CONFIG_EXPOLINE_OFF is not set
CONFIG_EXPOLINE_AUTO=y
# CONFIG_EXPOLINE_FULL is not set
This patch goes together with three others, so a total of four patches
would be needed for the latest-and-greated solution:
b2e2f43a01bace1a25bdbae04c9f9846882b727a
6e179d64126b909f0b288fa63cdbf07c531e9b1d
bc035599718412cfba9249aa713f90ef13f13ee9
d424986f1d6b16079b3231db0314923f4f8deed1
** Affects: ubuntu-z-systems
Importance: Critical
Assignee: Canonical Kernel Team (canonical-kernel-team)
Status: Triaged
** Affects: linux (Ubuntu)
Importance: Undecided
Assignee: Skipper Bug Screeners (skipper-screen-team)
Status: New
** Tags: architecture-s39064 bugnameltc-166584 severity-critical
targetmilestone-inin1804
** Tags added: architecture-s39064 bugnameltc-166584 severity-critical
targetmilestone-inin---
** Changed in: ubuntu
Assignee: (unassigned) => Skipper Bug Screeners (skipper-screen-team)
** Package changed: ubuntu => linux (Ubuntu)
--
You received this bug notification because you are a member of Kernel
Packages, which is subscribed to linux in Ubuntu.
https://bugs.launchpad.net/bugs/1762719
Title:
System Z {kernel} UBUNTU18.04 wrong kernel config
Status in Ubuntu on IBM z Systems:
Triaged
Status in linux package in Ubuntu:
New
Bug description:
Kernel config 4.15.0-13-generic #14 (and same for 4.15.0-15-generic)
is not OK, because both security mechanisms nobp AND expoline are
enabled:
CONFIG_KERNEL_NOBP=y
CONFIG_EXPOLINE=y
# CONFIG_EXPOLINE_OFF is not set
# CONFIG_EXPOLINE_MEDIUM is not set
CONFIG_EXPOLINE_FULL=y
If the kernel is compiled with a gcc that can generate expoline thunks
the correct config is as follows:
# CONFIG_KERNEL_NOBP is not set
CONFIG_EXPOLINE=y
# CONFIG_EXPOLINE_OFF is not set
# CONFIG_EXPOLINE_MEDIUM is not set
CONFIG_EXPOLINE_FULL=y
Alternatively the auto-detection patch can be used which is upstream
as of today:
commit 6e179d64126b909f0b288fa63cdbf07c531e9b1d
s390: add automatic detection of the spectre defense
Automatically decide between nobp vs. expolines if the spectre_v2=auto
kernel parameter is specified or CONFIG_EXPOLINE_AUTO=y is set.
The decision made at boot time due to CONFIG_EXPOLINE_AUTO=y being set
can be overruled with the nobp, nospec and spectre_v2 kernel parameters.
If this patch is used, then the correct config is
# CONFIG_KERNEL_NOBP is not set
CONFIG_EXPOLINE=y
# CONFIG_EXPOLINE_OFF is not set
CONFIG_EXPOLINE_AUTO=y
# CONFIG_EXPOLINE_FULL is not set
This patch goes together with three others, so a total of four patches
would be needed for the latest-and-greated solution:
b2e2f43a01bace1a25bdbae04c9f9846882b727a
6e179d64126b909f0b288fa63cdbf07c531e9b1d
bc035599718412cfba9249aa713f90ef13f13ee9
d424986f1d6b16079b3231db0314923f4f8deed1
To manage notifications about this bug go to:
https://bugs.launchpad.net/ubuntu-z-systems/+bug/1762719/+subscriptions
--
Mailing list: https://launchpad.net/~kernel-packages
Post to : kernel-packages@lists.launchpad.net
Unsubscribe : https://launchpad.net/~kernel-packages
More help : https://help.launchpad.net/ListHelp
