From 7840da00144cabaa7dc911bdaa19621d10dee478 Mon Sep 17 00:00:00 2001
From: David Vallee Delisle <dvd@redhat.com>
Date: Wed, 19 May 2021 21:21:08 -0400
Subject: [PATCH] [train-only] Adding ForceNoTsx flag

Since 050c9aa99fc6a3818ae37fe6382318be9f59706d we need to document the
ForceNoTsx flag.

Depends-On: https://review.opendev.org/c/openstack/python-tripleoclient/+/791089
Related: https://bugzilla.redhat.com/1923165
Change-Id: I2d46b72283cb7f0424d33a1389e4a3bba026db74
---
 .../kernel-boot-params-baremetal-ansible.yaml | 10 ++++++++++
 .../add-forcenotsx-36fc6dce46518f5b.yaml      | 20 +++++++++++++++++++
 2 files changed, 30 insertions(+)
 create mode 100644 releasenotes/notes/add-forcenotsx-36fc6dce46518f5b.yaml

diff --git a/deployment/kernel/kernel-boot-params-baremetal-ansible.yaml b/deployment/kernel/kernel-boot-params-baremetal-ansible.yaml
index a728fbb4ec..340df42f25 100644
--- a/deployment/kernel/kernel-boot-params-baremetal-ansible.yaml
+++ b/deployment/kernel/kernel-boot-params-baremetal-ansible.yaml
@@ -57,6 +57,14 @@ parameters:
     default: 900
     type: number
     description: Timeout in seconds to specify the wait time for ansible node reboot
+  ForceNoTsx:
+    default: false
+    description: >
+      This will disable the TSX flag validation in KernelArgs for this specific role.
+      More information available here: https://access.redhat.com/solutions/6036141
+    type: boolean
+    tags:
+      - role_specific
 
 resources:
   RoleParametersValue:
@@ -69,11 +77,13 @@ resources:
             - tuned_profile: TunedProfileName
               isolated_cores: IsolCpusList
               kernel_args: KernelArgs
+              force_no_tsx: ForceNoTsx
             - values: {get_param: [RoleParameters]}
           - values:
               TunedProfileName: {get_param: TunedProfileName}
               IsolCpusList: {get_param: IsolCpusList}
               KernelArgs: {get_param: KernelArgs}
+              ForceNoTsx: {get_param: ForceNoTsx}
 
 outputs:
   role_data:
diff --git a/releasenotes/notes/add-forcenotsx-36fc6dce46518f5b.yaml b/releasenotes/notes/add-forcenotsx-36fc6dce46518f5b.yaml
new file mode 100644
index 0000000000..8664f463c1
--- /dev/null
+++ b/releasenotes/notes/add-forcenotsx-36fc6dce46518f5b.yaml
@@ -0,0 +1,20 @@
+---
+fixes:
+  - |
+    RHEL-8.3 kernel disabled the Intel TSX (Transactional
+    Synchronization Extensions) feature by default as a preemptive
+    security measure, but it breaks live migration from RHEL-7.9
+    (or even RHEL-8.1 or RHEL-8.2) to RHEL-8.3.
+
+    Operators are expected to explicitly define the TSX flag in
+    their KernelArgs for the compute role to prevent live-migration
+    issues during the upgrade or update process.
+
+    We now introduce this validation in tripleoclient to ensure
+    early failure.
+
+    The `ForceNoTsx` flag will disable this validation on a per-role
+    basis.
+
+    More information here:
+        https://access.redhat.com/solutions/6036141