diff options
| author |   Alexandru Avadanii <Alexandru.Avadanii@enea.com> | 2020-01-29 15:40:12 +0100 |
|---|---|---|
| committer | Alexandru Avadanii <Alexandru.Avadanii@enea.com> | 2020-01-29 17:39:52 +0100 |
| commit | d1f1e51f0357266ecddaf63f619c7944c71f5858 (patch) | |
| tree | bae611e50191a9592fd7bd204aef0c6c29687fea /mcp/reclass | |
| parent | 03b837ba6d5ffe38d7641af02518f5b09ce8784f (diff) | |
aarch64: Add kpti=off similar to x86_64 nopti
arm64 kernels use a different kernel option (kpti=off vs nopti) to
disable PTI, so sync the two platform configurations.
Conveniently, this also bypasses kernel 4.15 issues described in [1],
so apply the kernel option customisation via MaaS too, to allow aarch64
deployments to bootstrap using 4.15 kernel (with the downside of these
args being duplicated by Salt later in HA scenarios).
PTI is now disabled for baremetal nodes (via MaaS, no matter the
scenario) and/or for kvm/cmp hosts (in HA scenarios only).
While at it, install missing thin provisioning tools in aarch64
bootstrap image for MaaS deploy stage to succeed.
[1] https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1857074
Change-Id: Ibd1f57f24abc690b0f13b6298f25d7e8a1af1567
Signed-off-by: Alexandru Avadanii <Alexandru.Avadanii@enea.com>
Diffstat (limited to 'mcp/reclass')
6 files changed, 7 insertions, 1 deletions
diff --git a/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2 b/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2 index f98040b93..f3b1f79aa 100644 --- a/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2 +++ b/mcp/reclass/classes/cluster/all-mcp-arch-common/infra/maas.yml.j2 @@ -33,7 +33,7 @@ parameters: aarch64_hugepages_1g: comment: 'Enable 1G pagesizes on aarch64' definition: '//capability[@id="asimd"]|//capability[@id="cp15_barrier"]' - kernel_opts: 'default_hugepagesz=1G hugepagesz=1G' + kernel_opts: 'default_hugepagesz=1G hugepagesz=1G kpti=off' {%- endif %} enable_iframe: False timeout: @@ -111,6 +111,7 @@ parameters: enable_third_party_drivers: true network_discovery: 'enabled' default_min_hwe_kernel: ${_param:hwe_kernel} + kernel_opts: 'spectre_v2=off nopti kpti=off nospec_store_bypass_disable noibrs noibpb' cluster: saltstack_repo_bionic: "deb [arch=amd64] http://repo.saltstack.com/apt/ubuntu/18.04/amd64/2017.7/ bionic main" region: diff --git a/mcp/reclass/classes/cluster/mcp-common-ha/infra/kvm.yml.j2 b/mcp/reclass/classes/cluster/mcp-common-ha/infra/kvm.yml.j2 index fe337fa5b..37bc42225 100644 --- a/mcp/reclass/classes/cluster/mcp-common-ha/infra/kvm.yml.j2 +++ b/mcp/reclass/classes/cluster/mcp-common-ha/infra/kvm.yml.j2 @@ -41,6 +41,7 @@ parameters: boot_options: - spectre_v2=off - nopti + - kpti=off - nospec_store_bypass_disable - noibrs - noibpb diff --git a/mcp/reclass/classes/cluster/mcp-common-ha/openstack_compute.yml b/mcp/reclass/classes/cluster/mcp-common-ha/openstack_compute.yml index 411fcee5a..af87d9c2f 100644 --- a/mcp/reclass/classes/cluster/mcp-common-ha/openstack_compute.yml +++ b/mcp/reclass/classes/cluster/mcp-common-ha/openstack_compute.yml @@ -73,6 +73,7 @@ parameters: boot_options: - spectre_v2=off - nopti + - kpti=off - nospec_store_bypass_disable - noibrs - noibpb diff --git a/mcp/reclass/classes/cluster/mcp-fdio-noha/openstack/compute.yml.j2 b/mcp/reclass/classes/cluster/mcp-fdio-noha/openstack/compute.yml.j2 index cefed963e..14b8a268b 100644 --- a/mcp/reclass/classes/cluster/mcp-fdio-noha/openstack/compute.yml.j2 +++ b/mcp/reclass/classes/cluster/mcp-fdio-noha/openstack/compute.yml.j2 @@ -41,6 +41,7 @@ parameters: boot_options: - spectre_v2=off - nopti + - kpti=off - nospec_store_bypass_disable - noibrs - noibpb diff --git a/mcp/reclass/classes/cluster/mcp-fdio-noha/openstack/gateway.yml b/mcp/reclass/classes/cluster/mcp-fdio-noha/openstack/gateway.yml index 2dfe0370d..c330b677c 100644 --- a/mcp/reclass/classes/cluster/mcp-fdio-noha/openstack/gateway.yml +++ b/mcp/reclass/classes/cluster/mcp-fdio-noha/openstack/gateway.yml @@ -48,6 +48,7 @@ parameters: boot_options: - spectre_v2=off - nopti + - kpti=off - nospec_store_bypass_disable - noibrs - noibpb diff --git a/mcp/reclass/classes/cluster/mcp-iec-noha/infra/kvm.yml.j2 b/mcp/reclass/classes/cluster/mcp-iec-noha/infra/kvm.yml.j2 index 95b39f637..34372c69c 100644 --- a/mcp/reclass/classes/cluster/mcp-iec-noha/infra/kvm.yml.j2 +++ b/mcp/reclass/classes/cluster/mcp-iec-noha/infra/kvm.yml.j2 @@ -62,6 +62,7 @@ parameters: boot_options: - spectre_v2=off - nopti + - kpti=off sysctl: net.ipv4.ip_forward: 0 libvirt: |