From nobody Thu May 2 12:57:09 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1569588756; cv=none; d=zoho.com; s=zohoarc; b=V5NlnJxTNxvRWG5AL6TbzmCGVTCXIdZrPthPDtk+G8DT7a/PP7XGQjPlS3CqhT/ul5EcKXBcIYmqU1L1fatRXmZeWk0NJUZf2MP4hEL2fVhwP4ESqcI9xlqPWWtK4C73d6sUKN+ETQG59PgxARuZvSWGqPFWFZK34TFT6RNJPL0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1569588756; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To:ARC-Authentication-Results; bh=OYoL5WS/y6N8/MsGHxp1s2n4V7vCELL+lkBldMNTCow=; b=RSb8rwfX7VHXXGXUhez5V2eQGZhqRe+V/UMMDXISRVZ3rwzWXyGC6JJxDBV28lk3EQB+yf1rfoKiX7vLtMaiabCtNh8l+PTvQEgsU1W1NiMeojYjKku+TWVIorpsGPxK4EHlzjcPcaMBNPgWqMNXPgXrBfr5fYe/ky3db+pvoEE= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1569588756041614.850031514213; Fri, 27 Sep 2019 05:52:36 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 4213F4E926; Fri, 27 Sep 2019 12:52:34 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id E8D06194B6; Fri, 27 Sep 2019 12:52:33 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 6862B4EE68; Fri, 27 Sep 2019 12:52:32 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x8RCqV6L002550 for ; Fri, 27 Sep 2019 08:52:31 -0400 Received: by smtp.corp.redhat.com (Postfix) id DF1221001B08; Fri, 27 Sep 2019 12:52:31 +0000 (UTC) Received: from domokun.gsslab.fab.redhat.com (dhcp-94.gsslab.fab.redhat.com [10.33.9.94]) by smtp.corp.redhat.com (Postfix) with ESMTP id 51CE21001B07; Fri, 27 Sep 2019 12:52:31 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Date: Fri, 27 Sep 2019 13:52:20 +0100 Message-Id: <20190927125225.22432-2-berrange@redhat.com> In-Reply-To: <20190927125225.22432-1-berrange@redhat.com> References: <20190927125225.22432-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v2 1/6] build: introduce logic for using golang in libvirt X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.38]); Fri, 27 Sep 2019 12:52:34 +0000 (UTC) This decides on requiring Golang >=3D 1.11, since that introduces the new standard concept of "Go modules": https://blog.golang.org/using-go-modules Previously such a concept was dealt with by any number of external 3rd party. These didn't seemlessly integrate into the go toolchain in the way modules do. The particularly attractive benefits of Go modules are - You are /not/ forced to use a particular directory hierarchy that matches your package import name. - Independent of any global $GOPATH which may or may not be set in your user sesion. - External dependencies do not need vendoring (copying) into the libvirt source tree. The toolchain downloads (with local caching) as needed, or can be pointed to a local OS distro provided copy Right now Fedora's Go packaging does not support Go modules, and obviously doesn't dynamically download packages during build. Thus in the RPM we need to turn off the normal Go module support and point it at the local copies of deps, provided by RPMs. This is still static linking, but without the deps being bundled in libvirt's src.rpm. Fedora also does not yet have the %gobuildflags macro defined, so in the short term we must define the desired Go build flags to ensure debuginfo RPMs work. Signed-off-by: Daniel P. Berrang=C3=A9 --- configure.ac | 1 + libvirt.spec.in | 19 ++++++++++++++++++- m4/virt-golang.m4 | 46 ++++++++++++++++++++++++++++++++++++++++++++++ 3 files changed, 65 insertions(+), 1 deletion(-) create mode 100644 m4/virt-golang.m4 diff --git a/configure.ac b/configure.ac index af8cbcdfd8..b835a10698 100644 --- a/configure.ac +++ b/configure.ac @@ -511,6 +511,7 @@ LIBVIRT_ARG_TLS_PRIORITY LIBVIRT_ARG_SYSCTL_CONFIG =20 =20 +LIBVIRT_CHECK_GOLANG LIBVIRT_CHECK_DEBUG LIBVIRT_CHECK_DTRACE LIBVIRT_CHECK_NUMAD diff --git a/libvirt.spec.in b/libvirt.spec.in index 7f5183f341..1c74dbb252 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -401,6 +401,8 @@ BuildRequires: libtirpc-devel BuildRequires: firewalld-filesystem %endif =20 +BuildRequires: golang >=3D 1.11 + Provides: bundled(gnulib) =20 %description @@ -1161,6 +1163,21 @@ export SOURCE_DATE_EPOCH=3D$(stat --printf=3D'%Y' %{= _specdir}/%{name}.spec) autoreconf -if %endif =20 +# We're building without go modules enabled, so +# must make a local Go root with the old style +# dir naming scheme/hierarchy +mkdir -p gocode/src/libvirt.org + +export GO111MODULE=3Doff +export GOPATH=3D/usr/share/gocode:`pwd`/gocode + +%if 0%{?fedora} >=3D 32 +GOBUILDFLAGS=3D"%gobuildflags" +%else +GOBUILDFLAGS=3D"-buildmode pie -compiler gc -tags=3D\"rpm_crashtraceback $= {BUILDTAGS:-}\" -ldflags \"${LDFLAGS:-} -B 0x$(head -c20 /dev/urandom|od -A= n -tx1|tr -d ' \n') -extldflags '-Wl,-z,relro -Wl,--as-needed -Wl,-z,now -= specs=3D/usr/lib/rpm/redhat/redhat-hardened-ld '\" -a -v -x" +%endif +export GOBUILDFLAGS + rm -f po/stamp-po %configure --with-runstatedir=3D%{_rundir} \ %{?arg_qemu} \ @@ -1224,7 +1241,7 @@ rm -f po/stamp-po --enable-expensive-tests \ --with-init-script=3Dsystemd \ %{?arg_login_shell} -make %{?_smp_mflags} V=3D1 +make %{?_smp_mflags} V=3D1 GOBUILDFLAGS=3D"$GOBUILDFLAGS" =20 %install rm -fr %{buildroot} diff --git a/m4/virt-golang.m4 b/m4/virt-golang.m4 new file mode 100644 index 0000000000..2e39bdac7d --- /dev/null +++ b/m4/virt-golang.m4 @@ -0,0 +1,46 @@ +dnl Golang checks +dnl +dnl Copyright (C) 2019 Red Hat, Inc. +dnl +dnl This library is free software; you can redistribute it and/or +dnl modify it under the terms of the GNU Lesser General Public +dnl License as published by the Free Software Foundation; either +dnl version 2.1 of the License, or (at your option) any later version. +dnl +dnl This library is distributed in the hope that it will be useful, +dnl but WITHOUT ANY WARRANTY; without even the implied warranty of +dnl MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU +dnl Lesser General Public License for more details. +dnl +dnl You should have received a copy of the GNU Lesser General Public +dnl License along with this library. If not, see +dnl . +dnl + +AC_DEFUN([LIBVIRT_CHECK_GOLANG], [ + AC_PATH_PROGS([GO], [go], [no]) + if test "x$ac_cv_path_GO" !=3D "xno" + then + with_go=3Dyes + else + with_go=3Dno + fi + AM_CONDITIONAL([HAVE_GOLANG], [test "$with_go" !=3D "no"]) + + if test "$with_go" !=3D "no" + then + GOVERSION=3D`$ac_cv_path_GO version | awk '{print \$ 3}' | sed -e 's/g= o//' -e 's/rc.*//'` + GOMAJOR=3D`echo $GOVERSION | awk -F . '{print \$ 1}'` + GOMINOR=3D`echo $GOVERSION | awk -F . '{print \$ 2}'` + + dnl We want to use go modules which first arrived in 1.11 + AC_MSG_CHECKING([for Go version >=3D 1.11]) + if test "$GOMAJOR" !=3D "1" || test "$GOMINOR" -lt "11" + then + with_go=3Dno + AC_MSG_RESULT([no]) + else + AC_MSG_RESULT([yes]) + fi + fi +]) --=20 2.21.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Thu May 2 12:57:09 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1569588770; cv=none; d=zoho.com; s=zohoarc; b=MThaSItGnSUc+SVtj+1hL9s1fMTcZqqM9yHsAJ4flE/R6vlyJZMRygMavr6JUfuhV9Jc+gk9SoT05dFgHQMWIlzzmEkB9b/xmxxPC169K11YHm2nZB2F4ZjKB82x8A9LE1wLYaMWxcOJagvqcsBH+93tUHxGZmupKSeHw86OMi0= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1569588770; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To:ARC-Authentication-Results; bh=iBKi1KA2jLY5o8W1PwshFCZqTm3v2cV8HNjmecCHImc=; b=nF8wUX0E80g+LPrWdkUJdpbNmvSNixEo7smUFgsfwhtpnfLFJpdArrmxNIJ78E7C3vcUtsppb9QbiH/T++XrUZaYF76XLmydRZbBixopu9XmnSnU3h3S6Bg0QB67k06EnW58irubQdgaIeYnfNuxrINszy3bueQEloVzj1HfWmA= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 156958877078776.60599700269358; Fri, 27 Sep 2019 05:52:50 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 932B4A44AF7; Fri, 27 Sep 2019 12:52:48 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 6EC0A5DC1B; Fri, 27 Sep 2019 12:52:48 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 2B6AE4EE69; Fri, 27 Sep 2019 12:52:48 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x8RCqXEP002557 for ; Fri, 27 Sep 2019 08:52:33 -0400 Received: by smtp.corp.redhat.com (Postfix) id 0ECF610001BC; Fri, 27 Sep 2019 12:52:33 +0000 (UTC) Received: from domokun.gsslab.fab.redhat.com (dhcp-94.gsslab.fab.redhat.com [10.33.9.94]) by smtp.corp.redhat.com (Postfix) with ESMTP id 323DF1001B07; Fri, 27 Sep 2019 12:52:32 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Date: Fri, 27 Sep 2019 13:52:21 +0100 Message-Id: <20190927125225.22432-3-berrange@redhat.com> In-Reply-To: <20190927125225.22432-1-berrange@redhat.com> References: <20190927125225.22432-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v2 2/6] tools: introduce a data driven impl of virt-host-validate X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.6.2 (mx1.redhat.com [10.5.110.68]); Fri, 27 Sep 2019 12:52:49 +0000 (UTC) The current virt-host-validate command has a bunch of checks defined in the source code which are thus only extensible by the upstream project, or downstream code modification. The checks are implemented by a fairly simple set of rules, mostly matching the contents of files, or output from commands, against some expected state or regex. This lends itself very well to having the checks defined in data, in the form of rules which can be processed by a generic engine. This patch introduces an implementation of virt-host-validate which does exactly that, using rules defined by a set of YAML files. Parsing XML/JSON/YAML/etc from C is incredibly tedious, which has long discouraged this conversion. The size & fagility of the parsing code in C would be too high to justify the benefits of a rewrite. This new impl is thus written in Go to take advantage of its YAML encoding feature that lets you simply annotate struct fields to define an YAML parser. YAML was chosen instead of XML because the file format is more user readable, than XML, and the Go parsing code is even simpler than with XML. JSON would have been another valid option instead of YAML. JSON is said to be optimized for the simplest machine parsing at the cost of human readability. YAML is said to be optimized for human readability at the cost of more complex parsers. Interestingly YAML is a true superset of JSON so although we used a YAML parser, our code can in fact load JSON files anyway. Comparing the JSON & YAML files for some example rules, the YAML did indeed appear more readable. The new impl also has a few new features in its CLI interface. It is possible display a list of all facts that are set, instead of just the subset which have reports associated with them. For example, by default $ virt-host-validate Checking cgroup memory controller present...PASS Checking cgroup memory controller mounted...PASS Checking cgroup cpu controller present...PASS Checking cgroup cpu controller mounted...PASS Checking cgroup cpuacct controller present...PASS Checking cgroup cpuacct controller mounted...PASS ...snip... But it can be run with $ virt-host-validate -q -f Set fact 'libvirt.driver.qemu' =3D 'true' Set fact 'libvirt.driver.lxc' =3D 'true' Set fact 'libvirt.driver.parallels' =3D 'true' Set fact 'cpu.arch' =3D 'x86_64' Set fact 'os.kernel' =3D 'Linux' Set fact 'os.release' =3D '5.1.16-300.fc30.x86_64' Set fact 'os.version' =3D '#1 SMP Wed Jul 3 15:06:51 UTC 2019' Set fact 'os.cgroup.controller.cpuset' =3D 'true' Set fact 'os.cgroup.controller.cpu' =3D 'true' Set fact 'os.cgroup.controller.cpuacct' =3D 'true' ...snip... This is quite useful for generating reports to include on bug reports / support requests, as it provides much more detailed information than is included in the summary messages. The main thing lost with this new impl is support for translation, which covers two sources: - Reports associated with the facts defined in the YAML. It is unclear how we would best deal with this. Merge translations from the .po file into the .yaml files, and then ensure we pick the appropriate one to display. - Error messages when things go wrong in the code itself. This would need to use some gettext like translation system for golang. I have not investigated the options here yet This impl uses three 3rd party dependancies - github.com/spf13/pflag - replacement command line arg parsing. Go's standard CLI arg parsing uses single dash for long options and does not support short options as a distinct concept. This is a widely used drop-in replacement that does the traditional long/short opt processing. - golang.org/x/sys - this is actually distributed with Golang but is considered an optional part of the runtime, since its APIs are not platform portable. This is needed to check file access permissions and to extract uname data. - github.com/ghodss/yaml - this provides the YAML parsing API. The observant reviewer will notice the facts.go file contains 'json:' attribute annotations. This is because the YAML parser actually leverages the JSON parser internally. Signed-off-by: Daniel P. Berrang=C3=A9 --- tools/host-validate/go.mod | 10 + tools/host-validate/go.sum | 9 + tools/host-validate/main.go | 98 +++++ tools/host-validate/pkg/engine.go | 481 +++++++++++++++++++++ tools/host-validate/pkg/facts.go | 585 ++++++++++++++++++++++++++ tools/host-validate/pkg/facts_test.go | 50 +++ 6 files changed, 1233 insertions(+) create mode 100644 tools/host-validate/go.mod create mode 100644 tools/host-validate/go.sum create mode 100644 tools/host-validate/main.go create mode 100644 tools/host-validate/pkg/engine.go create mode 100644 tools/host-validate/pkg/facts.go create mode 100644 tools/host-validate/pkg/facts_test.go diff --git a/tools/host-validate/go.mod b/tools/host-validate/go.mod new file mode 100644 index 0000000000..fe4d56441d --- /dev/null +++ b/tools/host-validate/go.mod @@ -0,0 +1,10 @@ +module libvirt.org/host-validate + +go 1.11 + +require ( + github.com/ghodss/yaml v1.0.0 + github.com/spf13/pflag v1.0.3 + golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a + gopkg.in/yaml.v2 v2.2.2 // indirect +) diff --git a/tools/host-validate/go.sum b/tools/host-validate/go.sum new file mode 100644 index 0000000000..8f74f6a45f --- /dev/null +++ b/tools/host-validate/go.sum @@ -0,0 +1,9 @@ +github.com/ghodss/yaml v1.0.0 h1:wQHKEahhL6wmXdzwWG11gIVCkOv05bNOh+Rxn0yng= Ak=3D +github.com/ghodss/yaml v1.0.0/go.mod h1:4dBDuWmgqj2HViK6kFavaiC9ZROes6MMH2= rRYeMEF04=3D +github.com/spf13/pflag v1.0.3 h1:zPAT6CGy6wXeQ7NtTnaTerfKOsV6V6F8agHXFiazD= kg=3D +github.com/spf13/pflag v1.0.3/go.mod h1:DYY7MBk1bdzusC3SYhjObp+wFpr4gzcvqq= NjLnInEg4=3D +golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a h1:aYOabOQFp6Vj6W1F80a= ffTUvO9UxmJRx8K0gsfABByQ=3D +golang.org/x/sys v0.0.0-20190813064441-fde4db37ae7a/go.mod h1:h1NjWce9XRLG= QEsW7wpKNCjG9DtNlClVuFLEZdDNbEs=3D +gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznA= aIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=3D +gopkg.in/yaml.v2 v2.2.2 h1:ZCJp+EgiOT7lHqUV2J862kp8Qj64Jo6az82+3Td9dZw=3D +gopkg.in/yaml.v2 v2.2.2/go.mod h1:hI93XBmqTisBFMUTm0b8Fm+jr3Dg1NNxqwp+5A1V= GuI=3D diff --git a/tools/host-validate/main.go b/tools/host-validate/main.go new file mode 100644 index 0000000000..f6dae86558 --- /dev/null +++ b/tools/host-validate/main.go @@ -0,0 +1,98 @@ +/* + * This file is part of the libvirt project + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * . + * + * Copyright (C) 2019 Red Hat, Inc. + * + */ + +package main + +import ( + "flag" + "fmt" + "github.com/spf13/pflag" + "io/ioutil" + vl "libvirt.org/host-validate/pkg" + "os" + "path/filepath" + "strings" +) + +func main() { + var showfacts bool + var quiet bool + var rulesdir string + + pflag.BoolVarP(&showfacts, "show-facts", "f", false, "Show raw fact names= and values") + pflag.BoolVarP(&quiet, "quiet", "q", false, "Don't report on fact checks") + pflag.StringVarP(&rulesdir, "rules-dir", "r", "/usr/share/libvirt/host-va= lidate", "Directory to load validation rules from") + + pflag.CommandLine.AddGoFlagSet(flag.CommandLine) + pflag.Parse() + // Convince glog that we really have parsed CLI + flag.CommandLine.Parse([]string{}) + + if len(pflag.Args()) > 1 { + fmt.Printf("syntax: %s [OPTIONS] [DRIVER]\n", os.Args[0]) + os.Exit(1) + } + + driver :=3D "" + if len(pflag.Args()) =3D=3D 1 { + driver =3D pflag.Args()[0] + } + + files, err :=3D ioutil.ReadDir(rulesdir) + if err !=3D nil { + fmt.Printf("Unable to load rules from '%s': %s\n", rulesdir, err) + os.Exit(1) + } + var lists []vl.FactList + for _, file :=3D range files { + path :=3D filepath.Join(rulesdir, file.Name()) + if !strings.HasSuffix(path, ".yaml") { + continue + } + facts, err :=3D vl.NewFactList(path) + if err !=3D nil { + fmt.Printf("Unable to load facts '%s': %s\n", path, err) + os.Exit(1) + } + lists =3D append(lists, *facts) + } + + var output vl.EngineOutput + if !quiet { + output |=3D vl.ENGINE_OUTPUT_REPORTS + } + if showfacts { + output |=3D vl.ENGINE_OUTPUT_FACTS + } + + engine :=3D vl.NewEngine(output, driver) + + failed, err :=3D engine.Validate(vl.MergeFactLists(lists)) + if err !=3D nil { + fmt.Printf("Unable to validate facts: %s\n", err) + os.Exit(1) + } + if failed !=3D 0 { + os.Exit(2) + } + + os.Exit(0) +} diff --git a/tools/host-validate/pkg/engine.go b/tools/host-validate/pkg/en= gine.go new file mode 100644 index 0000000000..61676cdce8 --- /dev/null +++ b/tools/host-validate/pkg/engine.go @@ -0,0 +1,481 @@ +/* + * This file is part of the libvirt project + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * . + * + * Copyright (C) 2019 Red Hat, Inc. + * + */ + +package pkg + +// This defines the logic that executes the checks defined +// for each fact that is loaded. It is responsible for printing +// out messages as the facts are processed too. + +import ( + "fmt" + "golang.org/x/sys/unix" + "io/ioutil" + "os" + "os/exec" + "regexp" + "runtime" + "strings" +) + +type Engine struct { + Facts map[string]string + Errors uint + Output EngineOutput + Driver string +} + +type EngineOutput int + +const ( + // Print the raw key, value pairs for each fact set + ENGINE_OUTPUT_FACTS =3D EngineOutput(1 << 0) + + // Print the human targetted reports for facts set + ENGINE_OUTPUT_REPORTS =3D EngineOutput(1 << 1) +) + +// Create an engine able to process a list of facts +func NewEngine(output EngineOutput, driver string) *Engine { + engine :=3D &Engine{} + + engine.Output =3D output + engine.Facts =3D make(map[string]string) + engine.Driver =3D driver + + return engine +} + +// Set the value associated with a fact +func (engine *Engine) SetFact(name, value string) { + engine.Facts[name] =3D value + if (engine.Output & ENGINE_OUTPUT_FACTS) !=3D 0 { + fmt.Printf("Set fact '%s' =3D '%s'\n", name, value) + } +} + +func (engine *Engine) EvalExpression(expr *Expression) (bool, error) { + if expr.Any !=3D nil { + for _, subexpr :=3D range expr.Any.Expressions { + ok, err :=3D engine.EvalExpression(&subexpr) + if err !=3D nil { + return false, err + } + if ok { + return true, nil + } + } + return false, nil + } else if expr.All !=3D nil { + for _, subexpr :=3D range expr.All.Expressions { + ok, err :=3D engine.EvalExpression(&subexpr) + if err !=3D nil { + return false, err + } + if !ok { + return false, nil + } + } + return true, nil + } else if expr.Fact !=3D nil { + val, ok :=3D engine.Facts[expr.Fact.Name] + if !ok { + return false, nil + } + if expr.Fact.Match =3D=3D "regex" { + match, err :=3D regexp.Match(expr.Fact.Value, []byte(val)) + if err !=3D nil { + return false, err + } + return match, nil + } else if expr.Fact.Match =3D=3D "exists" { + return true, nil + } else { + return val =3D=3D expr.Fact.Value, nil + } + } else { + return false, fmt.Errorf("Expected expression any or all or fact") + } +} + +// Report a fact that failed to have the desired value +func (engine *Engine) Fail(fact *Fact) { + engine.Errors++ + if fact.Report =3D=3D nil { + return + } + if (engine.Output & ENGINE_OUTPUT_REPORTS) !=3D 0 { + hint :=3D "" + if fact.Hint !=3D nil { + hint =3D " (" + fact.Hint.Message + ")" + } + if fact.Report.Level =3D=3D "note" { + fmt.Printf("\033[34mNOTE\033[0m%s\n", hint) + } else if fact.Report.Level =3D=3D "warn" { + fmt.Printf("\033[33mWARN\033[0m%s\n", hint) + } else { + fmt.Printf("\033[31mFAIL\033[0m%s\n", hint) + } + } +} + +// Report a fact that has the desired value +func (engine *Engine) Pass(fact *Fact) { + if fact.Report =3D=3D nil { + return + } + if (engine.Output & ENGINE_OUTPUT_REPORTS) !=3D 0 { + fmt.Printf("\033[32mPASS\033[0m\n") + } +} + +func utsString(v []byte) string { + n :=3D 0 + for i, _ :=3D range v { + if v[i] =3D=3D 0 { + break + } + n++ + } + return string(v[0:n]) +} + +// Populate the engine with values for a built-in fact +func (engine *Engine) SetValueBuiltIn(fact *Fact) error { + var uts unix.Utsname + err :=3D unix.Uname(&uts) + if err !=3D nil { + return err + } + + if fact.Name =3D=3D "os.kernel" { + engine.SetFact(fact.Name, utsString(uts.Sysname[0:])) + } else if fact.Name =3D=3D "os.release" { + engine.SetFact(fact.Name, utsString(uts.Release[0:])) + } else if fact.Name =3D=3D "os.version" { + engine.SetFact(fact.Name, utsString(uts.Version[0:])) + } else if fact.Name =3D=3D "cpu.arch" { + engine.SetFact(fact.Name, utsString(uts.Machine[0:])) + } else if fact.Name =3D=3D "libvirt.driver" { + if engine.Driver !=3D "" { + engine.SetFact(fact.Name+"."+engine.Driver, "true") + } else { + if runtime.GOOS =3D=3D "linux" { + engine.SetFact(fact.Name+".qemu", "true") + engine.SetFact(fact.Name+".lxc", "true") + engine.SetFact(fact.Name+".parallels", "true") + } else if runtime.GOOS =3D=3D "freebsd" { + engine.SetFact(fact.Name+".bhyve", "true") + } + } + } else { + return fmt.Errorf("Unknown built-in fact '%s'", fact.Name) + } + + return nil +} + +func (engine *Engine) SetValueBool(fact *Fact) error { + ok, err :=3D engine.EvalExpression(fact.Value.Bool) + if err !=3D nil { + return err + } + got :=3D "true" + want :=3D "true" + if !ok { + got =3D "false" + } + if fact.Report !=3D nil && fact.Report.Pass !=3D "" { + want =3D fact.Report.Pass + } + engine.SetFact(fact.Name, got) + if got =3D=3D want { + engine.Pass(fact) + } else { + engine.Fail(fact) + } + return nil +} + +func unescape(val string) (string, error) { + escapes :=3D map[rune]string{ + 'a': "\x07", + 'b': "\x08", + 'e': "\x1b", + 'f': "\x0c", + 'n': "\x0a", + 'r': "\x0d", + 't': "\x09", + 'v': "\x0b", + '\\': "\x5c", + '0': "\x00", + } + var ret string + escape :=3D false + for _, c :=3D range val { + if c =3D=3D '\\' { + escape =3D true + } else if escape { + unesc, ok :=3D escapes[c] + if !ok { + return "", fmt.Errorf("Unknown escape '\\%c'", c) + } + ret +=3D string(unesc) + escape =3D false + } else { + ret +=3D string(c) + } + } + return ret, nil +} + +func (engine *Engine) SetValueParse(fact *Fact, parse *Parse, context stri= ng, val string) error { + if parse =3D=3D nil { + engine.SetFact(context, val) + return nil + } + if parse.Whitespace =3D=3D "trim" { + val =3D strings.TrimSpace(val) + } + if parse.Scalar !=3D nil { + if parse.Scalar.Regex !=3D "" { + re, err :=3D regexp.Compile(parse.Scalar.Regex) + if err !=3D nil { + return err + } + matches :=3D re.FindStringSubmatch(val) + if parse.Scalar.Match >=3D uint(len(matches)) { + val =3D "" + } else { + val =3D matches[parse.Scalar.Match] + } + } + engine.SetFact(context, val) + } else if parse.List !=3D nil { + if val =3D=3D "" { + return nil + } + sep, err :=3D unescape(parse.List.Separator) + if err !=3D nil { + return err + } + bits :=3D strings.Split(val, sep) + count :=3D uint(0) + for i, bit :=3D range bits { + if i < int(parse.List.SkipHead) { + continue + } + if i >=3D (len(bits) - int(parse.List.SkipTail)) { + continue + } + subcontext :=3D fmt.Sprintf("%s.%d", context, i) + err :=3D engine.SetValueParse(fact, parse.List.Parse, subcontext, bit) + if err !=3D nil { + return err + } + count++ + if count >=3D parse.List.Limit { + break + } + } + } else if parse.Set !=3D nil { + if val =3D=3D "" { + return nil + } + sep, err :=3D unescape(parse.Set.Separator) + if err !=3D nil { + return err + } + bits :=3D strings.Split(val, sep) + for i, bit :=3D range bits { + if i < int(parse.Set.SkipHead) { + continue + } + if i >=3D (len(bits) - int(parse.Set.SkipTail)) { + continue + } + if parse.Set.Regex !=3D "" { + re, err :=3D regexp.Compile(parse.Set.Regex) + if err !=3D nil { + return err + } + matches :=3D re.FindStringSubmatch(bit) + if parse.Set.Match >=3D uint(len(matches)) { + bit =3D "" + } else { + bit =3D matches[parse.Set.Match] + } + } + subcontext :=3D fmt.Sprintf("%s.%s", context, bit) + engine.SetFact(subcontext, "true") + } + } else if parse.Dict !=3D nil { + sep, err :=3D unescape(parse.Dict.Separator) + if err !=3D nil { + return err + } + dlm, err :=3D unescape(parse.Dict.Delimiter) + if err !=3D nil { + return err + } + bits :=3D strings.Split(val, sep) + for _, bit :=3D range bits { + pair :=3D strings.SplitN(bit, dlm, 2) + if len(pair) !=3D 2 { + //return fmt.Errorf("Cannot split %s value '%s' on '%s'", fact.Name, p= air, parse.Dict.Delimiter) + continue + } + key :=3D strings.TrimSpace(pair[0]) + subcontext :=3D fmt.Sprintf("%s.%s", context, key) + err :=3D engine.SetValueParse(fact, parse.Dict.Parse, subcontext, pair[= 1]) + if err !=3D nil { + return err + } + } + } else { + return fmt.Errorf("Expecting scalar or list or dict to parse") + } + + return nil +} + +func (engine *Engine) SetValueString(fact *Fact) error { + val, ok :=3D engine.Facts[fact.Value.String.Fact] + if !ok { + return fmt.Errorf("Fact %s not present", fact.Value.String.Fact) + } + + return engine.SetValueParse(fact, fact.Value.String.Parse, fact.Name, str= ing(val)) +} + +func (engine *Engine) SetValueFile(fact *Fact) error { + data, err :=3D ioutil.ReadFile(fact.Value.File.Path) + if err !=3D nil { + if os.IsNotExist(err) && fact.Value.File.IgnoreMissing { + return nil + } + return err + } + + return engine.SetValueParse(fact, fact.Value.File.Parse, fact.Name, strin= g(data)) +} + +func (engine *Engine) SetValueDirEnt(fact *Fact) error { + files, err :=3D ioutil.ReadDir(fact.Value.DirEnt.Path) + if err !=3D nil { + if os.IsNotExist(err) && fact.Value.DirEnt.IgnoreMissing { + return nil + } + return err + } + for _, file :=3D range files { + engine.SetFact(fmt.Sprintf("%s.%s", fact.Name, file.Name()), "true") + } + return nil +} + +func (engine *Engine) SetValueCommand(fact *Fact) error { + var args []string + for _, arg :=3D range fact.Value.Command.Args { + args =3D append(args, arg) + } + cmd :=3D exec.Command(fact.Value.Command.Name, args...) + out, err :=3D cmd.Output() + if err !=3D nil { + return err + } + + return engine.SetValueParse(fact, fact.Value.Command.Parse, fact.Name, st= ring(out)) +} + +func (engine *Engine) SetValueAccess(fact *Fact) error { + var flags uint32 + if fact.Value.Access.Check =3D=3D "exists" { + flags =3D 0 + } else if fact.Value.Access.Check =3D=3D "readable" { + flags =3D unix.R_OK + } else if fact.Value.Access.Check =3D=3D "writable" { + flags =3D unix.W_OK + } else if fact.Value.Access.Check =3D=3D "executable" { + flags =3D unix.X_OK + } else { + return fmt.Errorf("No access check type specified for %s", + fact.Value.Access.Path) + } + err :=3D unix.Access(fact.Value.Access.Path, flags) + if err !=3D nil { + engine.SetFact(fact.Name, "false") + engine.Fail(fact) + } else { + engine.SetFact(fact.Name, "true") + engine.Pass(fact) + } + return nil +} + +func (engine *Engine) ValidateFact(fact *Fact) error { + if fact.Filter !=3D nil { + ok, err :=3D engine.EvalExpression(fact.Filter) + if err !=3D nil { + return err + } + if !ok { + return nil + } + } + if fact.Report !=3D nil && (engine.Output&ENGINE_OUTPUT_REPORTS) !=3D 0 { + fmt.Printf("Checking %s...", fact.Report.Message) + } + + if fact.Value.BuiltIn !=3D nil { + return engine.SetValueBuiltIn(fact) + } else if fact.Value.Bool !=3D nil { + return engine.SetValueBool(fact) + } else if fact.Value.String !=3D nil { + return engine.SetValueString(fact) + } else if fact.Value.File !=3D nil { + return engine.SetValueFile(fact) + } else if fact.Value.DirEnt !=3D nil { + return engine.SetValueDirEnt(fact) + } else if fact.Value.Command !=3D nil { + return engine.SetValueCommand(fact) + } else if fact.Value.Access !=3D nil { + return engine.SetValueAccess(fact) + } else { + return fmt.Errorf("No information provided for value in fact %s", fact.N= ame) + } +} + +// Validate all facts in the list, returning a count of +// any non-fatal errors encountered. +func (engine *Engine) Validate(facts FactList) (uint, error) { + err :=3D facts.Sort() + if err !=3D nil { + return 0, err + } + for _, fact :=3D range facts.Facts { + err =3D engine.ValidateFact(fact) + if err !=3D nil { + return 0, err + } + } + return engine.Errors, nil +} diff --git a/tools/host-validate/pkg/facts.go b/tools/host-validate/pkg/fac= ts.go new file mode 100644 index 0000000000..4bb935cc50 --- /dev/null +++ b/tools/host-validate/pkg/facts.go @@ -0,0 +1,585 @@ +/* + * This file is part of the libvirt project + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * . + * + * Copyright (C) 2019 Red Hat, Inc. + * + */ + +package pkg + +// This file defines the data structures that are being +// parsed from the YAML files. Note that the YAML parser +// internally uses the Golang JSON parser, hence the 'json:' +// comments against struct fields. + +import ( + "fmt" + "github.com/ghodss/yaml" + "io/ioutil" + "strings" +) + +// A list of all the facts we are going to validate +type FactList struct { + Facts []*Fact `json:"facts"` +} + +// A fact is a description of a single piece of information +// we wish to check. Conceptually a fact is simply a plain +// key, value pair where both parts are strings. +// +// Every fact has a name which is a dot separated list of +// strings, eg 'cpu.family.arm'. By convention the dots +// are forming an explicit hierarchy, so a common prefix +// on names is used to group related facts. +// +// Optionally a report can be associated with a fact +// This is a freeform string intended to be read by +// humans, eg 'hardware virt possible' +// +// If a report is given, there can also be an optional +// hint given, which is used when a fact fails to match +// some desired condition. This is another freeform string +// intended to be read by humans, eg +// 'enable cpuset cgroup controller in Kconfig' +// +// The optional filter is an expression that can be used +// to skip the processing of this fact when certain +// conditions are not met. eg, a filter might skip +// the checking of cgroups when the os kernel is not "linux" +// +// Finally there is a mandatory value. This defines how +// to extract the value for setting the fact. +// +// +// +type Fact struct { + Name string `json:"name"` + Report *Report `json:"report,omitempty"` + Hint *Report `json:"hint,omitempty"` + Filter *Expression `json:"filter,omitempty"` + Value Value `json:"value"` +} + +// A report is a message intended to be targetted at humans +// +// The message can be an arbitrary string, informing them +// of some relevant information +// +// The level is one of 'warn' or 'note' or 'error', with +// 'error' being assumed if no value is given +type Report struct { + Message string `json:"message"` + Level string `json:"level,omitempty"` + Pass string `json:"pass,omitempty"` +} + +// An expression is used to evaluate some complex conditions +// +// Expressions can be simple, comparing a single fact to +// some desired match. +// +// Expressions can be compound, requiring any or all of a +// list of sub-expressions to evaluate to true. +type Expression struct { + Any *ExpressionCompound `json:"any,omitempty"` + All *ExpressionCompound `json:"all,omitempty"` + Fact *ExpressionFact `json:"fact,omitempty"` +} + +// A compound expression is simply a list of expressions +// to be evaluated +type ExpressionCompound struct { + Expressions []Expression `json:"expressions,omitempty"` +} + +// A fact expression defines a rule that compares the +// value associated with the fact, to some desired +// match. +// +// The name gives the name of the fact to check +// +// The semantics of value vary according to the match +// type +// +// If the match type is 'regex', then the value must +// match against the declared regular expression. +// +// If the match type is 'exists', the value is ignored +// and the fact must simply exist. +// +// If the match type is not set, then a plain string +// equality comparison is done +type ExpressionFact struct { + Name string `json:"name"` + Value string `json:"value,omitempty"` + Match string `json:"match,omitempty"` +} + +// A value defines the various data sources for +// setting a fact's value. Only one of the data +// sources is permitted to be non-nil for each +// fact +// +// A builtin value is one of the standard facts +// defined in code. +// +// A bool value is one set to 'true' or 'false' +// depending on the results of evaluating an +// expression. It is user error to construct +// an expression which is self-referential +// +// A string value is one set by parsing the +// the value of another fact. A typical use +// case would be to split a string based on +// a whitespace separator +// +// A file value is one set by parsing the +// contents of a file on disk +// +// A dirent value results in creation of +// many facts, one for each directory entry +// seen +// +// An access value is one that sets a value +// to 'true' or 'false' depending on the +// permissions of a file +// +// A command value is one set by parsing +// the output of a command's stdout +type Value struct { + BuiltIn *ValueBuiltIn `json:"builtin,omitempty"` + Bool *Expression `json:"bool,omitempty"` + String *ValueString `json:"string,omitempty"` + File *ValueFile `json:"file,omitempty"` + DirEnt *ValueDirEnt `json:"dirent,omitempty"` + Access *ValueAccess `json:"access,omitempty"` + Command *ValueCommand `json:"command,omitempty"` +} + +// Valid built-in fact names are +// - os.{kernel,release,version} and cpu.arch, +// set from uname() syscall results +// - libvirt.driver set from a command line arg +type ValueBuiltIn struct { +} + +// Sets a value from a command. +// +// The name is the binary command name, either +// unqualified and resolved against $PATH, or +// or fully qualified +// +// A command can be given an arbitray set of +// arguments when run +// +// By default the entire contents of stdout +// will be set as the fact value. +// +// It is possible to instead parse the stdout +// data to extract interesting pieces of information +// from it +type ValueCommand struct { + Name string `json:"name"` + Args []string `json:"args,omitempty"` + Parse *Parse `json:"parse,omitempty"` +} + +// Sets a value from a file contents +// +// The path is the fully qualified filename path +// +// By default the entire contents of the file +// will be set as the fact value. +// +// It is possible to instead parse the file +// data to extract interesting pieces of information +// from it +type ValueFile struct { + Path string `json:"path"` + Parse *Parse `json:"parse,omitempty"` + IgnoreMissing bool `json:"ignoreMissing,omitempty"` +} + +// Sets a value from another fact +// +// The fact is the name of the other fact +// +// By default the entire contents of the other fact +// will be set as the fact value. +// +// More usually though the other fact value will be +// parsed to extract interesting pieces of information +// from it +type ValueString struct { + Fact string `json:"fact"` + Parse *Parse `json:"parse,omitempty"` +} + +// Sets a value from a list of directory entries +// +// The path is the fully qualified path of the directory +// +// By default an error will be raised if the directory +// does not exist. Typically a filter rule would be +// desired to skip processing of the fact in cases +// where it is known the directory may not exist. +// +// If filters are not practical though, missing directory +// can be made non-fatal +type ValueDirEnt struct { + Path string `json:"path"` + IgnoreMissing bool `json:"ignoreMissing,omitempty"` +} + +// Sets a value from the access permissions of a file +// +// The path is the fully qualified path of the file +// +// The check can be one of the strings 'readable', +// 'writable' or 'executable'. +type ValueAccess struct { + Path string `json:"path"` + Check string `json:"check"` +} + +// The parse object defines a set of rules for +// parsing strings to extract interesting +// pieces of data +// +// The optional whitespace attribute can be set to +// 'trim' to cause leading & trailing whitespace to +// be removed before further processing +// +// To extract a single data item from the string, +// the scalar parsing rule can be used +// +// To extract an ordered list of data items from +// the string, the list parsing rule can be used +// +// To extract an unordered list of data items, +// with duplicates excluded, the set parsing rule +// can be used +// +// To extract a list of key, value pairs from the +// string, the dict parsing rule can be used +type Parse struct { + Whitespace string `json:"whitespace,omitempty"` + Scalar *ParseScalar `json:"scalar,omitempty"` + List *ParseList `json:"list,omitempty"` + Set *ParseSet `json:"set,omitempty"` + Dict *ParseDict `json:"dict,omitempty"` +} + +// Parsing a string to extract a single data item +// using a regular expression. +// +// The regular expression should contain at least +// one capturing group. The match attribute indicates +// which capturing group will be used to set the +// fact value. +type ParseScalar struct { + Regex string `json:"regex,omitempty"` + Match uint `json:"match,omitempty"` +} + +// Parsing a string to extract an ordered list of +// data items +// +// The separator declares the boundary on which +// the string will be split +// +// The skip head attribute should be non-zero if +// any leading elements in the list are to be +// discarded. This is typically useful if the +// list contains a header/label as the first +// entry +// +// The skip tail attribute should be non-zero if +// any trailing elements in the list are to be +// discarded +// +// The limit attribute sets an upper bound on +// the number of elements that will be kept in +// the list. It is applied after discarding any +// leading or trailing elements. +// +// Each element in the list is then itself parsed +type ParseList struct { + Separator string `json:"separator,omitempty"` + SkipHead uint `json:"skiphead,omitempty"` + SkipTail uint `json:"skiptail,omitempty"` + Limit uint `json:"limit,omitempty"` + Parse *Parse `json:"parse,omitempty"` +} + +// Parsing a string to extract an unordered list of +// data items with duplicates removed +// +// The separator declares the boundary on which +// the string will be split +// +// The skip head attribute should be non-zero if +// any leading elements in the list are to be +// discarded. This is typically useful if the +// list contains a header/label as the first +// entry +// +// The skip tail attribute should be non-zero if +// any trailing elements in the list are to be +// discarded +// +// Each element is then parsed using a regular +// expression +// +// The regular expression should contain at least +// one capturing group. The match attribute indicates +// which capturing group will be used to set the +// fact value. +type ParseSet struct { + Separator string `json:"separator,omitempty"` + SkipHead uint `json:"skiphead,omitempty"` + SkipTail uint `json:"skiptail,omitempty"` + Regex string `json:"regex,omitempty"` + Match uint `json:"match,omitempty"` +} + +// Parsing a string to extract an unordered list of +// data items with duplicates removed +// +// The separator declares the boundary on which +// the string will be split to acquire the list +// of pairs +// +// The delimiter declares the boundary to separate +// the key from the value +// +// The value is then further parsed with the declared +// rules +type ParseDict struct { + Separator string `json:"separator,omitempty"` + Delimiter string `json:"delimiter,omitempty"` + Parse *Parse `json:"parse,omitempty"` +} + +// Helper for parsing a string containing an YAML +// doc defining a list of facts +func (f *FactList) Unmarshal(doc string) error { + return yaml.Unmarshal([]byte(doc), f) +} + +// Create a new fact list, loading from the +// specified plain file +func NewFactList(filename string) (*FactList, error) { + yamlstr, err :=3D ioutil.ReadFile(filename) + if err !=3D nil { + return nil, err + } + + facts :=3D &FactList{} + err =3D facts.Unmarshal(string(yamlstr)) + if err !=3D nil { + return nil, err + } + + return facts, nil +} + +// Used to ensure that no fact has a name which is a sub-string of +// another fact. +func validateNames(names map[string]*Fact) error { + for name, _ :=3D range names { + bits :=3D strings.Split(name, ".") + subname :=3D "" + for _, bit :=3D range bits[0 : len(bits)-1] { + if subname =3D=3D "" { + subname =3D bit + } else { + subname =3D subname + "." + bit + } + _, ok :=3D names[subname] + + if ok { + return fmt.Errorf("Fact name '%s' has fact '%s' as a substring", + name, subname) + } + } + } + + return nil +} + +// Identify the name of the corresponding fact that +// is referenced, by chopping off suffixes until a +// match is found +func findFactReference(names map[string]*Fact, name string) (string, error= ) { + bits :=3D strings.Split(name, ".") + subname :=3D "" + for _, bit :=3D range bits { + if subname =3D=3D "" { + subname =3D bit + } else { + subname =3D subname + "." + bit + } + _, ok :=3D names[subname] + if ok { + return subname, nil + } + } + + return "", fmt.Errorf("Cannot find fact providing %s", name) +} + +// Build up a list of dependant facts referenced by an expression +func addDepsExpr(deps *map[string][]string, names map[string]*Fact, fact *= Fact, expr *Expression) error { + if expr.Any !=3D nil { + for _, sub :=3D range expr.Any.Expressions { + err :=3D addDepsExpr(deps, names, fact, &sub) + if err !=3D nil { + return err + } + } + } else if expr.All !=3D nil { + for _, sub :=3D range expr.All.Expressions { + err :=3D addDepsExpr(deps, names, fact, &sub) + if err !=3D nil { + return err + } + } + } else if expr.Fact !=3D nil { + ref, err :=3D findFactReference(names, expr.Fact.Name) + if err !=3D nil { + return err + } + entries, _ :=3D (*deps)[fact.Name] + entries =3D append(entries, ref) + (*deps)[fact.Name] =3D entries + } + return nil +} + +// Build up a list of dependancies between facts +func addDeps(deps *map[string][]string, names map[string]*Fact, fact *Fact= ) error { + if fact.Filter !=3D nil { + err :=3D addDepsExpr(deps, names, fact, fact.Filter) + if err !=3D nil { + return err + } + } + if fact.Value.Bool !=3D nil { + err :=3D addDepsExpr(deps, names, fact, fact.Value.Bool) + if err !=3D nil { + return err + } + } + if fact.Value.String !=3D nil { + ref, err :=3D findFactReference(names, fact.Value.String.Fact) + if err !=3D nil { + return err + } + entries, _ :=3D (*deps)[fact.Name] + entries =3D append(entries, ref) + (*deps)[fact.Name] =3D entries + } + return nil +} + +// Perform a topological sort on facts so that they can be +// processed in the order required to satisfy dependancies +// between facts +func (facts *FactList) Sort() error { + deps :=3D make(map[string][]string) + names :=3D make(map[string]*Fact) + + var remaining []string + for _, fact :=3D range facts.Facts { + deps[fact.Name] =3D []string{} + names[fact.Name] =3D fact + remaining =3D append(remaining, fact.Name) + } + + err :=3D validateNames(names) + if err !=3D nil { + return err + } + + for _, fact :=3D range facts.Facts { + err =3D addDeps(&deps, names, fact) + if err !=3D nil { + return err + } + } + + var sorted []string + done :=3D make(map[string]bool) + for len(remaining) > 0 { + prev_done :=3D len(done) + var skipped []string + for _, fact :=3D range remaining { + using, ok :=3D deps[fact] + if !ok { + done[fact] =3D true + sorted =3D append(sorted, fact) + } else { + unsolved :=3D false + for _, entry :=3D range using { + _, ok :=3D done[entry] + if !ok { + unsolved =3D true + break + } + } + if !unsolved { + sorted =3D append(sorted, fact) + done[fact] =3D true + } else { + skipped =3D append(skipped, fact) + } + } + } + + if len(done) =3D=3D prev_done { + return fmt.Errorf("Cycle detected in facts") + } + + remaining =3D skipped + } + + var newfacts []*Fact + for _, name :=3D range sorted { + newfacts =3D append(newfacts, names[name]) + } + + facts.Facts =3D newfacts + + return nil +} + +// Create a new fact list that contains all the facts +// from the passed in list of fact lists +func MergeFactLists(lists []FactList) FactList { + var allfacts []*Fact + for _, list :=3D range lists { + for _, fact :=3D range list.Facts { + allfacts =3D append(allfacts, fact) + } + } + + facts :=3D FactList{} + facts.Facts =3D allfacts + return facts +} diff --git a/tools/host-validate/pkg/facts_test.go b/tools/host-validate/pk= g/facts_test.go new file mode 100644 index 0000000000..850ba50bfb --- /dev/null +++ b/tools/host-validate/pkg/facts_test.go @@ -0,0 +1,50 @@ +/* + * This file is part of the libvirt project + * + * This library is free software; you can redistribute it and/or + * modify it under the terms of the GNU Lesser General Public + * License as published by the Free Software Foundation; either + * version 2.1 of the License, or (at your option) any later version. + * + * This library is distributed in the hope that it will be useful, + * but WITHOUT ANY WARRANTY; without even the implied warranty of + * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU + * Lesser General Public License for more details. + * + * You should have received a copy of the GNU Lesser General Public + * License along with this library. If not, see + * . + * + * Copyright (C) 2019 Red Hat, Inc. + * + */ + +package pkg + +import ( + "fmt" + "io/ioutil" + "path" + "strings" + "testing" +) + +func testYAMLFile(t *testing.T, filename string) { + _, err :=3D NewFactList(filename) + if err !=3D nil { + t.Fatal(fmt.Errorf("Cannot parse %s: %s", filename, err)) + } +} + +func TestParse(t *testing.T) { + dir :=3D path.Join("..", "rules") + files, err :=3D ioutil.ReadDir(dir) + if err !=3D nil { + t.Fatal(fmt.Errorf("Cannot read %s: %s", dir, err)) + } + for _, file :=3D range files { + if strings.HasSuffix(file.Name(), ".yaml") { + testYAMLFile(t, path.Join(dir, file.Name())) + } + } +} --=20 2.21.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Thu May 2 12:57:09 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1569588774; cv=none; d=zoho.com; s=zohoarc; b=gpE9j5DkMOM76Uo1Z1d8BnhACtEcP3OiSXnI49tTBY67FqyrV8cPVRESvpZRM5CDj2Twr8R4yiqxfqzZpSgVco2VkT08T5PzEetOk1ouCaDE2BXnrfQdoYF+8Goj94+qj0gE37WK7UzoEhKNarfxzPeHFfWhMFQ35+UfK5noE3M= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1569588774; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To:ARC-Authentication-Results; bh=9g4zTPU7X4JubL498s61ipchpA68d/nlqbJjsRTk2Qg=; b=WuIN/T9rnOP40Z8B/XKSnjeYTso1b+kzhlnDtKF+QwZ6PZd9wY3RCXxPtnSLwjuM3k1hxxwh6kmUw0NErbVQqfgtBt7QD9Sdu5iXSLdKMJKOPfzlz6GG1dNT5bL4nGarQAipdWpo60OPWPCdbk7KXsI9Acs6qq6ixmUkI1qk7Ac= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1569588774551262.62226044362353; Fri, 27 Sep 2019 05:52:54 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 1E61E307D92E; Fri, 27 Sep 2019 12:52:52 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.21]) by smtp.corp.redhat.com (Postfix) with ESMTPS id EA8FC1C92B; Fri, 27 Sep 2019 12:52:51 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id B08774EE6E; Fri, 27 Sep 2019 12:52:51 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x8RCqXkV002565 for ; Fri, 27 Sep 2019 08:52:33 -0400 Received: by smtp.corp.redhat.com (Postfix) id E05DE1001B13; Fri, 27 Sep 2019 12:52:33 +0000 (UTC) Received: from domokun.gsslab.fab.redhat.com (dhcp-94.gsslab.fab.redhat.com [10.33.9.94]) by smtp.corp.redhat.com (Postfix) with ESMTP id 53EE81000232; Fri, 27 Sep 2019 12:52:33 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Date: Fri, 27 Sep 2019 13:52:22 +0100 Message-Id: <20190927125225.22432-4-berrange@redhat.com> In-Reply-To: <20190927125225.22432-1-berrange@redhat.com> References: <20190927125225.22432-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v2 3/6] tools: define YAML rules for virt-host-validate checks X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.48]); Fri, 27 Sep 2019 12:52:52 +0000 (UTC) This commit defines a set of YAML rules that result in the same set of logical checks as the existing hardcoded virt-host-validate implementation does. Signed-off-by: Daniel P. Berrang=C3=A9 --- tools/host-validate/rules/builtin.yaml | 20 + tools/host-validate/rules/cpu.yaml | 50 ++ tools/host-validate/rules/freebsd-kernel.yaml | 77 +++ tools/host-validate/rules/linux-acpi.yaml | 39 ++ tools/host-validate/rules/linux-cgroups.yaml | 470 ++++++++++++++++++ tools/host-validate/rules/linux-cpu.yaml | 134 +++++ tools/host-validate/rules/linux-devices.yaml | 71 +++ tools/host-validate/rules/linux-iommu.yaml | 113 +++++ .../host-validate/rules/linux-namespaces.yaml | 119 +++++ tools/host-validate/rules/linux-pci.yaml | 10 + 10 files changed, 1103 insertions(+) create mode 100644 tools/host-validate/rules/builtin.yaml create mode 100644 tools/host-validate/rules/cpu.yaml create mode 100644 tools/host-validate/rules/freebsd-kernel.yaml create mode 100644 tools/host-validate/rules/linux-acpi.yaml create mode 100644 tools/host-validate/rules/linux-cgroups.yaml create mode 100644 tools/host-validate/rules/linux-cpu.yaml create mode 100644 tools/host-validate/rules/linux-devices.yaml create mode 100644 tools/host-validate/rules/linux-iommu.yaml create mode 100644 tools/host-validate/rules/linux-namespaces.yaml create mode 100644 tools/host-validate/rules/linux-pci.yaml diff --git a/tools/host-validate/rules/builtin.yaml b/tools/host-validate/r= ules/builtin.yaml new file mode 100644 index 0000000000..f69b069e09 --- /dev/null +++ b/tools/host-validate/rules/builtin.yaml @@ -0,0 +1,20 @@ +# +# Define boilerplate to activate various built-in facts +# + +facts: +- name: libvirt.driver + value: + builtin: {} +- name: cpu.arch + value: + builtin: {} +- name: os.kernel + value: + builtin: {} +- name: os.release + value: + builtin: {} +- name: os.version + value: + builtin: {} diff --git a/tools/host-validate/rules/cpu.yaml b/tools/host-validate/rules= /cpu.yaml new file mode 100644 index 0000000000..5af61b1ea1 --- /dev/null +++ b/tools/host-validate/rules/cpu.yaml @@ -0,0 +1,50 @@ +# +# Define facts related to host CPU properties +# + +facts: +- name: cpu.family.x86 + value: + bool: + any: + expressions: + - fact: + name: cpu.arch + value: x86_64 + - fact: + name: cpu.arch + value: i386 + - fact: + name: cpu.arch + value: i486 + - fact: + name: cpu.arch + value: i586 + - fact: + name: cpu.arch + value: i686 +- name: cpu.family.arm + value: + bool: + any: + expressions: + - fact: + name: cpu.arch + value: aarch64 + - fact: + name: cpu.arch + value: armv6 + - fact: + name: cpu.arch + value: armv7 +- name: cpu.family.s390 + value: + bool: + any: + expressions: + - fact: + name: cpu.arch + value: s390 + - fact: + name: cpu.arch + value: s390x diff --git a/tools/host-validate/rules/freebsd-kernel.yaml b/tools/host-val= idate/rules/freebsd-kernel.yaml new file mode 100644 index 0000000000..345e78dbc2 --- /dev/null +++ b/tools/host-validate/rules/freebsd-kernel.yaml @@ -0,0 +1,77 @@ +# +# Define facts related to BHyve on FreeBSD +# + +facts: +- name: os.kmod + filter: + fact: + name: os.kernel + value: FreeBSD + value: + command: + name: kldstat + parse: + set: + separator: \n + skiphead: 1 + skiptail: 1 + regex: \s+\d+\s+\d+\s+0x[0-9a-f]+\s+[0-9a-f]+\s+(\w+) + match: 1 +- name: kmod.vmm + filter: + fact: + name: libvirt.driver.bhyve + value: "true" + report: + message: BHyve VMs can be run + hint: + message: load the 'vmm' kernel module + value: + bool: + fact: + name: os.kmod.vmm + value: "true" +- name: kmod.if_tap + filter: + fact: + name: libvirt.driver.bhyve + value: "true" + report: + message: BHyve VMs can use networking + hint: + message: load the 'if_tap' kernel module + value: + bool: + fact: + name: os.kmod.if_tap + value: "true" +- name: kmod.if_bridge + filter: + fact: + name: libvirt.driver.bhyve + value: "true" + report: + message: BHyve VMs can use bridged network + hint: + message: load the 'if_bridge' kernel module + value: + bool: + fact: + name: os.kmod.if_bridge + value: "true" +- name: kmod.nmdm + filter: + fact: + name: libvirt.driver.bhyve + value: "true" + report: + message: BHyve VMs can use nmdm console + level: warn + hint: + message: load the 'nmdm' kernel module + value: + bool: + fact: + name: os.kmod.nmdm + value: "true" diff --git a/tools/host-validate/rules/linux-acpi.yaml b/tools/host-validat= e/rules/linux-acpi.yaml new file mode 100644 index 0000000000..cad324dd96 --- /dev/null +++ b/tools/host-validate/rules/linux-acpi.yaml @@ -0,0 +1,39 @@ +# +# Define facts for interesting ACPI tables on the host +# + +facts: +- name: cpu.acpi.dmar + filter: + all: + expressions: + - fact: + name: cpu.family.x86 + value: "true" + - fact: + name: cpu.vendor.intel + value: "true" + - fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/firmware/acpi/tables/DMAR +- name: cpu.acpi.ivrs + filter: + all: + expressions: + - fact: + name: cpu.family.x86 + value: "true" + - fact: + name: cpu.vendor.amd + value: "true" + - fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/firmware/acpi/tables/IVRS diff --git a/tools/host-validate/rules/linux-cgroups.yaml b/tools/host-vali= date/rules/linux-cgroups.yaml new file mode 100644 index 0000000000..e886bccd17 --- /dev/null +++ b/tools/host-validate/rules/linux-cgroups.yaml @@ -0,0 +1,470 @@ +# +# Define facts for Linux control cgroups v1/v2 +# + +facts: +- name: os.cgroup.controller + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /proc/cgroups + parse: + set: + separator: \n + skiphead: 1 + skiptail: 1 + regex: ^(\w+) + match: 1 +- name: os.cgroup.v2only + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/cgroup.subtree_control +- name: os.cgroup.v2hybrid + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/fs/cgroup/unified/cgroup.controllers + ignoreMissing: true + parse: + whitespace: trim + set: + skiphead: 0 + skiptail: 0 + separator: ' ' +- name: os.cgroup.mount.v2 + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/fs/cgroup/cgroup.controllers + ignoreMissing: true + parse: + whitespace: trim + set: + skiphead: 0 + skiptail: 0 + separator: ' ' +- name: os.cgroup.mount.v1.blkio + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/blkio/cgroup.procs +- name: os.cgroup.mount.v1.cpu + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/cpu/cgroup.procs +- name: os.cgroup.mount.v1.cpuacct + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/cpuacct/cgroup.procs +- name: os.cgroup.mount.v1.cpuset + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/cpuset/cgroup.procs +- name: os.cgroup.mount.v1.devices + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/devices/cgroup.procs +- name: os.cgroup.mount.v1.freezer + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/freezer/cgroup.procs +- name: os.cgroup.mount.v1.hugetlb + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/hugetlb/cgroup.procs +- name: os.cgroup.mount.v1.memory + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/memory/cgroup.procs +- name: os.cgroup.mount.v1.net_cls + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/net_cls/cgroup.procs +- name: os.cgroup.mount.v1.net_prio + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/net_prio/cgroup.procs +- name: os.cgroup.mount.v1.perf_event + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/perf_event/cgroup.procs +- name: os.cgroup.mount.v1.pids + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/pids/cgroup.procs +- name: os.cgroup.mount.unified + filter: + fact: + name: os.kernel + value: Linux + value: + access: + check: exists + path: /sys/fs/cgroup/unified/cgroup.procs +- name: os.cgroup.memory.present + filter: + all: + expressions: + - any: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: cgroup memory controller present + hint: + message: enable memory cgroup controller in Kconfig + value: + bool: + fact: + name: os.cgroup.controller.memory + value: "true" +- name: os.cgroup.memory.mounted + filter: + fact: + name: os.cgroup.memory.present + value: "true" + report: + message: cgroup memory controller mounted + hint: + message: mount the memory cgroup controller under /sys/fs/cgroup + value: + bool: + any: + expressions: + - fact: + name: os.cgroup.mount.v1.memory + value: "true" + - fact: + name: os.cgroup.mount.v2.memory + value: "true" +- name: os.cgroup.cpu.present + filter: + all: + expressions: + - any: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: cgroup cpu controller present + hint: + message: enable cpu cgroup controller in Kconfig + value: + bool: + fact: + name: os.cgroup.controller.cpu + value: "true" +- name: os.cgroup.cpu.mounted + filter: + fact: + name: os.cgroup.cpu.present + value: "true" + report: + message: cgroup cpu controller mounted + hint: + message: mount the cpu cgroup controller under /sys/fs/cgroup + value: + bool: + any: + expressions: + - fact: + name: os.cgroup.mount.v1.cpu + value: "true" + - fact: + name: os.cgroup.mount.v2.cpu + value: "true" +- name: os.cgroup.cpuacct.present + filter: + all: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: cgroup cpuacct controller present + hint: + message: enable cpuacct cgroup controller in Kconfig + value: + bool: + fact: + name: os.cgroup.controller.cpuacct + value: "true" +- name: os.cgroup.cpuacct.mounted + filter: + fact: + name: os.cgroup.cpuacct.present + value: "true" + report: + message: cgroup cpuacct controller mounted + hint: + message: mount the cpuacct cgroup controller under /sys/fs/cgroup + value: + bool: + any: + expressions: + - fact: + name: os.cgroup.mount.v1.cpuacct + value: "true" + - fact: + name: os.cgroup.mount.v2.cpuacct + value: "true" +- name: os.cgroup.cpuset.present + filter: + all: + expressions: + - any: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: cgroup cpuset controller present + hint: + message: enable cpuset cgroup controller in Kconfig + value: + bool: + fact: + name: os.cgroup.controller.cpuset + value: "true" +- name: os.cgroup.cpuset.mounted + filter: + fact: + name: os.cgroup.cpuset.present + value: "true" + report: + message: cgroup cpuset controller mounted + hint: + message: mount the cpuset cgroup controller under /sys/fs/cgroup + value: + bool: + any: + expressions: + - fact: + name: os.cgroup.mount.v1.cpuset + value: "true" + - fact: + name: os.cgroup.mount.v2.cpuset + value: "true" +- name: os.cgroup.devices.present + filter: + all: + expressions: + - any: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: cgroup devices controller present + hint: + message: enable devices cgroup controller in Kconfig + value: + bool: + fact: + name: os.cgroup.controller.devices + value: "true" +- name: os.cgroup.devices.mounted + filter: + fact: + name: os.cgroup.devices.present + value: "true" + report: + message: cgroup devices controller mounted + hint: + message: mount the devices cgroup controller under /sys/fs/cgroup + value: + bool: + any: + expressions: + - fact: + name: os.cgroup.mount.v1.devices + value: "true" + - fact: + name: os.cgroup.v2hybrid + value: "true" + - fact: + name: os.cgroup.v2only + value: "true" +- name: os.cgroup.blkio.present + filter: + all: + expressions: + - any: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: cgroup blkio controller present + hint: + message: enable blkio cgroup controller in Kconfig + value: + bool: + fact: + name: os.cgroup.controller.blkio + value: "true" +- name: os.cgroup.blkio.mounted + filter: + fact: + name: os.cgroup.blkio.present + value: "true" + report: + message: cgroup blkio controller mounted + hint: + message: mount the blkio cgroup controller under /sys/fs/cgroup + value: + bool: + any: + expressions: + - fact: + name: os.cgroup.mount.v1.blkio + value: "true" + - fact: + name: os.cgroup.mount.v2.io + value: "true" +- name: os.cgroup.freezer.present + filter: + all: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: cgroup freezer controller present + hint: + message: enable freezer cgroup controller in Kconfig + value: + bool: + fact: + name: os.cgroup.controller.freezer + value: "true" +- name: os.cgroup.freezer.mounted + filter: + fact: + name: os.cgroup.freezer.present + value: "true" + report: + message: cgroup freezer controller mounted + hint: + message: mount the freezer cgroup controller under /sys/fs/cgroup + value: + bool: + any: + expressions: + - fact: + name: os.cgroup.mount.v1.freezer + value: "true" + - fact: + name: os.cgroup.mount.v2.freezer + value: "true" diff --git a/tools/host-validate/rules/linux-cpu.yaml b/tools/host-validate= /rules/linux-cpu.yaml new file mode 100644 index 0000000000..81aee516bf --- /dev/null +++ b/tools/host-validate/rules/linux-cpu.yaml @@ -0,0 +1,134 @@ +# +# Define facts related to host CPU properties +# + +facts: +- name: cpu.info + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /proc/cpuinfo + parse: + list: + limit: 1 + separator: \n\n + parse: + whitespace: trim + dict: + separator: \n + delimiter: ':' + parse: + whitespace: trim + scalar: {} +- name: cpu.vendor.intel + filter: + fact: + name: cpu.family.x86 + value: "true" + value: + bool: + fact: + name: cpu.info.0.vendor_id + value: GenuineIntel +- name: cpu.vendor.amd + filter: + fact: + name: cpu.family.x86 + value: "true" + value: + bool: + fact: + name: cpu.info.0.vendor_id + value: AuthenticAMD +- name: cpu.features.x86 + filter: + fact: + name: cpu.family.x86 + value: "true" + value: + string: + fact: cpu.info.0.flags + parse: + whitespace: trim + set: + skiphead: 0 + skiptail: 0 + separator: ' ' +- name: cpu.features.arm + filter: + fact: + name: cpu.family.arm + value: "true" + value: + string: + fact: cpu.info.0.Features + parse: + whitespace: trim + set: + skiphead: 0 + skiptail: 0 + separator: ' ' +- name: cpu.features.s390 + filter: + fact: + name: cpu.family.s390 + value: "true" + value: + string: + fact: cpu.info.0.features + parse: + whitespace: trim + set: + skiphead: 0 + skiptail: 0 + separator: ' ' +- name: cpu.virt.possible + filter: + fact: + name: libvirt.driver.qemu + value: "true" + report: + message: hardware virt possible + value: + bool: + any: + expressions: + - fact: + name: cpu.family.x86 + value: "true" +- name: cpu.virt.present + filter: + fact: + name: cpu.virt.possible + value: "true" + report: + message: hardware virt present + level: warn + hint: + message: only emulated CPUs are available, performance will be signifi= cantly limited + value: + bool: + any: + expressions: + - all: + expressions: + - fact: + name: cpu.vendor.amd + value: "true" + - fact: + name: cpu.features.x86.svm + value: "true" + - all: + expressions: + - fact: + name: cpu.vendor.intel + value: "true" + - fact: + name: cpu.features.x86.vmx + value: "true" + - fact: + name: cpu.features.s390.sie + value: "true" diff --git a/tools/host-validate/rules/linux-devices.yaml b/tools/host-vali= date/rules/linux-devices.yaml new file mode 100644 index 0000000000..791f35a0b6 --- /dev/null +++ b/tools/host-validate/rules/linux-devices.yaml @@ -0,0 +1,71 @@ +# +# Define facts related to device nodes on the host +# + +facts: +- name: os.kvm.loaded + filter: + all: + expressions: + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: cpu.virt.present + value: "true" + report: + message: /dev/kvm loaded + value: + access: + check: exists + path: /dev/kvm +- name: os.kvm.accessible + filter: + fact: + name: os.kvm.loaded + value: "true" + report: + message: /dev/kvm accessible + hint: + message: Check /dev/kvm is world writable or you are in a group that i= s allowed + to access it + value: + access: + check: writable + path: /dev/kvm +- name: os.vhostnet.present + filter: + all: + expressions: + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: os.kvm.loaded + value: "true" + report: + message: /dev/vhost-net present + hint: + message: Load the 'vhost_net' module to improve performance of virtio = networking + value: + access: + check: exists + path: /dev/vhost-net +- name: os.tun.present + filter: + all: + expressions: + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: os.kvm.loaded + value: "true" + report: + message: /dev/net/tun present + hint: + message: Load the 'tun' module to enable networking for QEMU guests + value: + access: + check: exists + path: /dev/net/tun diff --git a/tools/host-validate/rules/linux-iommu.yaml b/tools/host-valida= te/rules/linux-iommu.yaml new file mode 100644 index 0000000000..4f056e92ba --- /dev/null +++ b/tools/host-validate/rules/linux-iommu.yaml @@ -0,0 +1,113 @@ +# +# Define facts related to IOMMU availability +# + +facts: +- name: cpu.iommu.x86.intel.present + filter: + all: + expressions: + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: cpu.family.x86 + value: "true" + - fact: + name: cpu.vendor.intel + value: "true" + report: + message: Intel device assignment IOMMU present + level: note + hint: + message: IOMMU either disabled in BIOS or not supported by this hardwa= re + value: + bool: + fact: + name: cpu.acpi.dmar + value: "true" +- name: cpu.iommu.x86.amd.present + filter: + all: + expressions: + - fact: + name: cpu.family.x86 + value: "true" + - fact: + name: cpu.vendor.amd + value: "true" + report: + message: AMD device assignment IOMMU present + level: note + hint: + message: IOMMU either disabled in BIOS or not supported by this hardwa= re + value: + bool: + fact: + name: cpu.acpi.ivrs + value: "true" +- name: cpu.iommu.s390x.present + filter: + fact: + name: cpu.family.s390 + value: "true" + report: + message: s390x device assignment IOMMU present + level: note + hint: + message: IOMMU either disabled in BIOS or not supported by this hardwa= re + value: + bool: + fact: + match: exists + name: os.pci.devices.0 +- name: os.iommu.groups + value: + dirent: + ignoreMissing: true + path: /sys/kernel/iommu_groups +- name: os.iommu.x86.intel.enabled + filter: + fact: + name: cpu.iommu.x86.intel.present + value: "true" + report: + message: Intel device assignment IOMMU enabled + level: warn + hint: + message: IOMMU disabled by the kernel. Pass 'intel_iommu=3Don' on the = kernel command line + value: + bool: + fact: + name: os.iommu.groups.0 + match: exists +- name: os.iommu.x86.amd.enabled + filter: + fact: + name: cpu.iommu.x86.amd.present + value: "true" + report: + message: AMD device assignment IOMMU enabled + level: warn + hint: + message: IOMMU disabled by the kernel. Pass 'iommu=3Dpt iommu=3D1' on = the kernel command line + value: + bool: + fact: + name: os.iommu.groups.0 + match: exists +- name: os.iommu.s390x.enabled + filter: + fact: + name: cpu.iommu.s390x.present + value: "true" + report: + message: s390x device assignment IOMMU enabled + level: warn + hint: + message: IOMMU disabled by the kernel + value: + bool: + fact: + name: os.iommu.groups.0 + match: exists diff --git a/tools/host-validate/rules/linux-namespaces.yaml b/tools/host-v= alidate/rules/linux-namespaces.yaml new file mode 100644 index 0000000000..239d0c58e4 --- /dev/null +++ b/tools/host-validate/rules/linux-namespaces.yaml @@ -0,0 +1,119 @@ +# +# Define facts related to Linux kernel namespaces +# + +facts: +- name: os.namespace.ipc + filter: + all: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: ipc process namespace + hint: + message: Enable ipc namespace in Kconfig + value: + access: + path: /proc/self/ns/ipc + check: exists +- name: os.namespace.mnt + filter: + all: + expressions: + - any: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: libvirt.driver.qemu + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: mnt process namespace + hint: + message: Enable mnt namespace in Kconfig + value: + access: + path: /proc/self/ns/mnt + check: exists +- name: os.namespace.pid + filter: + all: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: pid process namespace + hint: + message: Enable pid namespace in Kconfig + value: + access: + path: /proc/self/ns/pid + check: exists +- name: os.namespace.uts + filter: + all: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: uts process namespace + hint: + message: Enable uts namespace in Kconfig + value: + access: + path: /proc/self/ns/uts + check: exists +- name: os.namespace.net + filter: + all: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: os.kernel + value: Linux + report: + message: net process namespace + hint: + message: Enable net namespace in Kconfig + value: + access: + path: /proc/self/ns/net + check: exists +- name: os.namespace.user + filter: + all: + expressions: + - fact: + name: libvirt.driver.lxc + value: "true" + - fact: + name: os.kernel + value: Linux + report: + level: warn + message: user process namespace + hint: + message: Enable user namespace in Kconfig + value: + access: + path: /proc/self/ns/user + check: exists diff --git a/tools/host-validate/rules/linux-pci.yaml b/tools/host-validate= /rules/linux-pci.yaml new file mode 100644 index 0000000000..facb67f4e9 --- /dev/null +++ b/tools/host-validate/rules/linux-pci.yaml @@ -0,0 +1,10 @@ +# +# Define facts related to physical PCI devices on the host system +# + +facts: +- name: os.pci.devices + value: + dirent: + path: /sys/bus/pci/devices + ignoreMissing: true --=20 2.21.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Thu May 2 12:57:09 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1569588828; cv=none; d=zoho.com; s=zohoarc; b=hYGOt2JB9VyX5grG/Xb+GPC49OlX6a6We6Fty2eUqiuhpp2H4rxDG1FQe1vD+tU0GyDMLzw3cLoMSBySZsMeef3e2sxPzS0xlCNIcznglKlGAC3kFQXduymok7KnM+726x76qipc8nL89yzB8lmSsABV3qVDIliDt9eTUoNgiqI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1569588828; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To:ARC-Authentication-Results; bh=mdV1RoXaGZeEIaJZt4jtge/lpIA5KvL3ZF5pEVIqSx4=; b=XYX/MkOPO/ws/gXTaW0LENhV7maXgaXN8r6LXmcTLNga497RqEoBQ8gWaR4pfJ6kRDCIrjl31EbbEMfxkFLo0y8o70PcukGLxbByYFDs5szRd7Bd9voQdecNgXNxaI2k+1odE6/U9fFd3ee6iSzbyBsICDeQiMbSWEtlY8iYxsA= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1569588828809283.07882336988575; Fri, 27 Sep 2019 05:53:48 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 2A1D5300D219; Fri, 27 Sep 2019 12:53:47 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 00E4060BF3; Fri, 27 Sep 2019 12:53:46 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id BC761180B536; Fri, 27 Sep 2019 12:53:46 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x8RCqYT1002572 for ; Fri, 27 Sep 2019 08:52:34 -0400 Received: by smtp.corp.redhat.com (Postfix) id BD1AC1001B13; Fri, 27 Sep 2019 12:52:34 +0000 (UTC) Received: from domokun.gsslab.fab.redhat.com (dhcp-94.gsslab.fab.redhat.com [10.33.9.94]) by smtp.corp.redhat.com (Postfix) with ESMTP id 313181001938; Fri, 27 Sep 2019 12:52:34 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Date: Fri, 27 Sep 2019 13:52:23 +0100 Message-Id: <20190927125225.22432-5-berrange@redhat.com> In-Reply-To: <20190927125225.22432-1-berrange@redhat.com> References: <20190927125225.22432-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v2 4/6] tools: switch to build the new virt-host-validate impl X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.40]); Fri, 27 Sep 2019 12:53:47 +0000 (UTC) This stop building the existing C based virt-host-validate implementation and instead builds the Go implementation. For the RPM spec this is written to rely on pre-packaged RPMs for the 3rd party Go dependencies. These are all already present in supported Fedora releases. Signed-off-by: Daniel P. Berrang=C3=A9 --- libvirt.spec.in | 15 ++++++++ m4/virt-host-validate.m4 | 8 ++-- tools/Makefile.am | 75 ++++++++++++++++-------------------- tools/virt-host-validate.pod | 12 ++++-- 4 files changed, 60 insertions(+), 50 deletions(-) diff --git a/libvirt.spec.in b/libvirt.spec.in index 1c74dbb252..f336296a08 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -402,6 +402,9 @@ BuildRequires: firewalld-filesystem %endif =20 BuildRequires: golang >=3D 1.11 +BuildRequires: golang-ipath(github.com/spf13/pflag) +BuildRequires: golang-ipath(golang.org/x/sys) +BuildRequires: golang-ipath(github.com/ghodss/yaml) =20 Provides: bundled(gnulib) =20 @@ -1167,6 +1170,7 @@ export SOURCE_DATE_EPOCH=3D$(stat --printf=3D'%Y' %{_= specdir}/%{name}.spec) # must make a local Go root with the old style # dir naming scheme/hierarchy mkdir -p gocode/src/libvirt.org +ln -s `pwd`/tools/host-validate `pwd`/gocode/src/libvirt.org/host-validate =20 export GO111MODULE=3Doff export GOPATH=3D/usr/share/gocode:`pwd`/gocode @@ -1890,6 +1894,17 @@ exit 0 %if %{with_qemu} %{_datadir}/systemtap/tapset/libvirt_qemu_probes*.stp %endif +%dir %{_datadir}/libvirt/host-validate +%{_datadir}/libvirt/host-validate/builtin.yaml +%{_datadir}/libvirt/host-validate/cpu.yaml +%{_datadir}/libvirt/host-validate/freebsd-kernel.yaml +%{_datadir}/libvirt/host-validate/linux-acpi.yaml +%{_datadir}/libvirt/host-validate/linux-cgroups.yaml +%{_datadir}/libvirt/host-validate/linux-cpu.yaml +%{_datadir}/libvirt/host-validate/linux-devices.yaml +%{_datadir}/libvirt/host-validate/linux-iommu.yaml +%{_datadir}/libvirt/host-validate/linux-namespaces.yaml +%{_datadir}/libvirt/host-validate/linux-pci.yaml =20 %if %{with_bash_completion} %{_datadir}/bash-completion/completions/virsh diff --git a/m4/virt-host-validate.m4 b/m4/virt-host-validate.m4 index e43cec5366..16f2d36acd 100644 --- a/m4/virt-host-validate.m4 +++ b/m4/virt-host-validate.m4 @@ -21,14 +21,14 @@ AC_DEFUN([LIBVIRT_ARG_HOST_VALIDATE], [ =20 AC_DEFUN([LIBVIRT_CHECK_HOST_VALIDATE], [ if test "x$with_host_validate" !=3D "xno"; then - if test "x$with_win" =3D "xyes"; then + if test "$with_go" =3D "no"; then if test "x$with_host_validate" =3D "xyes"; then - AC_MSG_ERROR([virt-host-validate is not supported on Windows]) + AC_MSG_ERROR([Cannot build virt-host-validate without Go toolchain= ]) else - with_host_validate=3Dno; + with_host_validate=3Dno fi else - with_host_validate=3Dyes; + with_host_validate=3Dyes fi fi =20 diff --git a/tools/Makefile.am b/tools/Makefile.am index 29fdbfe846..728de475a2 100644 --- a/tools/Makefile.am +++ b/tools/Makefile.am @@ -157,50 +157,41 @@ libvirt_shell_la_SOURCES =3D \ vsh-table.c vsh-table.h =20 virt_host_validate_SOURCES =3D \ - virt-host-validate.c \ - virt-host-validate-common.c virt-host-validate-common.h - -VIRT_HOST_VALIDATE_QEMU =3D \ - virt-host-validate-qemu.c \ - virt-host-validate-qemu.h -VIRT_HOST_VALIDATE_LXC =3D \ - virt-host-validate-lxc.c \ - virt-host-validate-lxc.h -VIRT_HOST_VALIDATE_BHYVE =3D \ - virt-host-validate-bhyve.c \ - virt-host-validate-bhyve.h -if WITH_QEMU -virt_host_validate_SOURCES +=3D $(VIRT_HOST_VALIDATE_QEMU) -else ! WITH_QEMU -EXTRA_DIST +=3D $(VIRT_HOST_VALIDATE_QEMU) -endif ! WITH_QEMU - -if WITH_LXC -virt_host_validate_SOURCES +=3D $(VIRT_HOST_VALIDATE_LXC) -else ! WITH_LXC -EXTRA_DIST +=3D $(VIRT_HOST_VALIDATE_LXC) -endif ! WITH_LXC - -if WITH_BHYVE -virt_host_validate_SOURCES +=3D $(VIRT_HOST_VALIDATE_BHYVE) -else ! WITH_BHYVE -EXTRA_DIST +=3D $(VIRT_HOST_VALIDATE_BHYVE) -endif ! WITH_BHYVE - -virt_host_validate_LDFLAGS =3D \ - $(AM_LDFLAGS) \ - $(PIE_LDFLAGS) \ - $(COVERAGE_LDFLAGS) \ - $(NULL) + $(srcdir)/host-validate/go.mod \ + $(srcdir)/host-validate/go.sum \ + $(srcdir)/host-validate/main.go \ + $(srcdir)/host-validate/pkg/facts.go \ + $(srcdir)/host-validate/pkg/facts_test.go \ + $(srcdir)/host-validate/pkg/engine.go \ + $(NULL) =20 -virt_host_validate_LDADD =3D \ - ../src/libvirt.la \ - ../gnulib/lib/libgnu.la \ - $(NULL) +virt_host_validate_rulesdir =3D $(pkgdatadir)/host-validate +virt_host_validate_rules_DATA =3D \ + $(srcdir)/host-validate/rules/builtin.yaml \ + $(srcdir)/host-validate/rules/cpu.yaml \ + $(srcdir)/host-validate/rules/freebsd-kernel.yaml \ + $(srcdir)/host-validate/rules/linux-acpi.yaml \ + $(srcdir)/host-validate/rules/linux-cgroups.yaml \ + $(srcdir)/host-validate/rules/linux-cpu.yaml \ + $(srcdir)/host-validate/rules/linux-devices.yaml \ + $(srcdir)/host-validate/rules/linux-iommu.yaml \ + $(srcdir)/host-validate/rules/linux-namespaces.yaml \ + $(srcdir)/host-validate/rules/linux-pci.yaml \ + $(NULL) =20 -virt_host_validate_CFLAGS =3D \ - $(AM_CFLAGS) \ - $(NULL) +EXTRA_DIST +=3D $(virt_host_validate_rules_DATA) $(virt_host_validate_SOUR= CES) + +virt-host-validate$(EXEEXT): $(virt_host_validate_SOURCES) + $(AM_V_CC) cd $(srcdir)/host-validate && \ + $(GO) build $(GOBUILDFLAGS) -o $(abs_builddir)/$@ main.go +if WITH_HOST_VALIDATE +check-host-validate: + cd $(srcdir)/host-validate && $(GO) test $(GOTESTFLAGS) ./... +else ! WITH_HOST_VALIDATE +check-host-validate: +endif ! WITH_HOST_VALIDATE + +check-local: check-host-validate =20 # virt-login-shell will be setuid, and must not link to anything # except glibc. It wil scrub the environment and then invoke the diff --git a/tools/virt-host-validate.pod b/tools/virt-host-validate.pod index 121bb7ed7a..df10530916 100644 --- a/tools/virt-host-validate.pod +++ b/tools/virt-host-validate.pod @@ -19,9 +19,13 @@ to those relevant for that virtualization technology =20 =3Dover 4 =20 -=3Ditem C<-v>, C<--version> +=3Ditem C<-f>, C<--facts> =20 -Display the command version +Display all the key, value pairs set for facts + +=3Ditem C<-r>, C<--rules-dir> + +Override the default location of the XML rule files =20 =3Ditem C<-h>, C<--help> =20 @@ -52,11 +56,11 @@ Alternatively report bugs to your software distributor = / vendor. =20 =3Dhead1 COPYRIGHT =20 -Copyright (C) 2012 by Red Hat, Inc. +Copyright (C) 2019 by Red Hat, Inc. =20 =3Dhead1 LICENSE =20 -virt-host-validate is distributed under the terms of the GNU GPL v2+. +virt-host-validate is distributed under the terms of the GNU LGPL v2.1+. This is free software; see the source for copying conditions. There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE --=20 2.21.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Thu May 2 12:57:09 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1569588765; cv=none; d=zoho.com; s=zohoarc; b=NL3+zRSG8u2aCCn7Qtupaco+GqBbw0PfdbXYDkuiCCaBzKAfaA+i9CWdCGSqrOgpvT6LtzMdmVWrSeiI5HnbOYfdOi3izeNxL6fkzdLx33TAMr5vDjSavdv5XwN7yi43IhsbKupZJODL1387dua49txajfEhmbjCCRFC7C2Cerc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1569588765; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To:ARC-Authentication-Results; bh=NHx4d2sjW87jx/HtGFrX/lzG0XD0I7jdIm4zN886N8U=; b=cFv7V76Y3h96ZlD9wCaOaIw6ky1TyZ5M9kiOVUo3mi3MD8aZU9SfmFI49/XFDkIJyXj5XQfmUpOoBPIe7WZtnbIH0h8RCwW1VxxrsQZBWgkgYsXwkPSNuIdGOnM1OK2C8fLdt3b8KiWqXos9IPAnA3y1n6T7YzNnuEMvcM3K6Y0= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1569588765860897.0607515322874; Fri, 27 Sep 2019 05:52:45 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id CD5B5641C9; Fri, 27 Sep 2019 12:52:43 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id A861D5D9C9; Fri, 27 Sep 2019 12:52:43 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 6A9F818037C9; Fri, 27 Sep 2019 12:52:43 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x8RCqZqj002577 for ; Fri, 27 Sep 2019 08:52:35 -0400 Received: by smtp.corp.redhat.com (Postfix) id BE0341017E3B; Fri, 27 Sep 2019 12:52:35 +0000 (UTC) Received: from domokun.gsslab.fab.redhat.com (dhcp-94.gsslab.fab.redhat.com [10.33.9.94]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0F9B41001938; Fri, 27 Sep 2019 12:52:34 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Date: Fri, 27 Sep 2019 13:52:24 +0100 Message-Id: <20190927125225.22432-6-berrange@redhat.com> In-Reply-To: <20190927125225.22432-1-berrange@redhat.com> References: <20190927125225.22432-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v2 5/6] tools: delete the old virt-host-validate impl X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.39]); Fri, 27 Sep 2019 12:52:44 +0000 (UTC) The C based virt-host-validate implementation is no longer required so can be deleted entirely. Signed-off-by: Daniel P. Berrang=C3=A9 --- po/POTFILES | 5 - tools/virt-host-validate-bhyve.c | 77 ------ tools/virt-host-validate-bhyve.h | 24 -- tools/virt-host-validate-common.c | 419 ------------------------------ tools/virt-host-validate-common.h | 85 ------ tools/virt-host-validate-lxc.c | 87 ------- tools/virt-host-validate-lxc.h | 24 -- tools/virt-host-validate-qemu.c | 116 --------- tools/virt-host-validate-qemu.h | 24 -- tools/virt-host-validate.c | 152 ----------- 10 files changed, 1013 deletions(-) delete mode 100644 tools/virt-host-validate-bhyve.c delete mode 100644 tools/virt-host-validate-bhyve.h delete mode 100644 tools/virt-host-validate-common.c delete mode 100644 tools/virt-host-validate-common.h delete mode 100644 tools/virt-host-validate-lxc.c delete mode 100644 tools/virt-host-validate-lxc.h delete mode 100644 tools/virt-host-validate-qemu.c delete mode 100644 tools/virt-host-validate-qemu.h delete mode 100644 tools/virt-host-validate.c diff --git a/po/POTFILES b/po/POTFILES index 35fc26c4b9..9939114bec 100644 --- a/po/POTFILES +++ b/po/POTFILES @@ -311,11 +311,6 @@ tools/virsh-util.c tools/virsh-volume.c tools/virsh.c tools/virt-admin.c -tools/virt-host-validate-bhyve.c -tools/virt-host-validate-common.c -tools/virt-host-validate-lxc.c -tools/virt-host-validate-qemu.c -tools/virt-host-validate.c tools/virt-login-shell.c tools/vsh.c tools/vsh.h diff --git a/tools/virt-host-validate-bhyve.c b/tools/virt-host-validate-bh= yve.c deleted file mode 100644 index 2f0ec1e36c..0000000000 --- a/tools/virt-host-validate-bhyve.c +++ /dev/null @@ -1,77 +0,0 @@ -/* - * virt-host-validate-bhyve.c: Sanity check a bhyve hypervisor host - * - * Copyright (C) 2017 Roman Bogorodskiy - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#include - -#include -#include - -#include "virt-host-validate-bhyve.h" -#include "virt-host-validate-common.h" - -#define MODULE_STATUS(mod, err_msg, err_code) \ - virHostMsgCheck("BHYVE", _("for %s module"), #mod); \ - if (mod ## _loaded) { \ - virHostMsgPass(); \ - } else { \ - virHostMsgFail(err_code, \ - _("%s module is not loaded, " err_msg), \ - #mod); \ - ret =3D -1; \ - } - -#define MODULE_STATUS_FAIL(mod, err_msg) \ - MODULE_STATUS(mod, err_msg, VIR_HOST_VALIDATE_FAIL) - -#define MODULE_STATUS_WARN(mod, err_msg) \ - MODULE_STATUS(mod, err_msg, VIR_HOST_VALIDATE_WARN) - - -int virHostValidateBhyve(void) -{ - int ret =3D 0; - int fileid =3D 0; - struct kld_file_stat stat; - bool vmm_loaded =3D false, if_tap_loaded =3D false; - bool if_bridge_loaded =3D false, nmdm_loaded =3D false; - - for (fileid =3D kldnext(0); fileid > 0; fileid =3D kldnext(fileid)) { - stat.version =3D sizeof(struct kld_file_stat); - if (kldstat(fileid, &stat) < 0) - continue; - - if (STREQ(stat.name, "vmm.ko")) - vmm_loaded =3D true; - else if (STREQ(stat.name, "if_tap.ko")) - if_tap_loaded =3D true; - else if (STREQ(stat.name, "if_bridge.ko")) - if_bridge_loaded =3D true; - else if (STREQ(stat.name, "nmdm.ko")) - nmdm_loaded =3D true; - } - - MODULE_STATUS_FAIL(vmm, "will not be able to start VMs"); - MODULE_STATUS_WARN(if_tap, "networking will not work"); - MODULE_STATUS_WARN(if_bridge, "bridged networking will not work"); - MODULE_STATUS_WARN(nmdm, "nmdm console will not work"); - - return ret; -} diff --git a/tools/virt-host-validate-bhyve.h b/tools/virt-host-validate-bh= yve.h deleted file mode 100644 index a5fd22c871..0000000000 --- a/tools/virt-host-validate-bhyve.h +++ /dev/null @@ -1,24 +0,0 @@ -/* - * virt-host-validate-bhyve.h: Sanity check a bhyve hypervisor host - * - * Copyright (C) 2017 Roman Bogorodskiy - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#pragma once - -int virHostValidateBhyve(void); diff --git a/tools/virt-host-validate-common.c b/tools/virt-host-validate-c= ommon.c deleted file mode 100644 index 804c0adc2d..0000000000 --- a/tools/virt-host-validate-common.c +++ /dev/null @@ -1,419 +0,0 @@ -/* - * virt-host-validate-common.c: Sanity check helper APIs - * - * Copyright (C) 2012, 2014 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#include - -#include -#include -#include -#include - -#include "viralloc.h" -#include "vircgroup.h" -#include "virfile.h" -#include "virt-host-validate-common.h" -#include "virstring.h" -#include "virarch.h" - -#define VIR_FROM_THIS VIR_FROM_NONE - -VIR_ENUM_IMPL(virHostValidateCPUFlag, - VIR_HOST_VALIDATE_CPU_FLAG_LAST, - "vmx", - "svm", - "sie"); - -static bool quiet; - -void virHostMsgSetQuiet(bool quietFlag) -{ - quiet =3D quietFlag; -} - -void virHostMsgCheck(const char *prefix, - const char *format, - ...) -{ - va_list args; - char *msg; - - if (quiet) - return; - - va_start(args, format); - if (virVasprintf(&msg, format, args) < 0) { - perror("malloc"); - abort(); - } - va_end(args); - - fprintf(stdout, _("%6s: Checking %-60s: "), prefix, msg); - VIR_FREE(msg); -} - -static bool virHostMsgWantEscape(void) -{ - static bool detectTty =3D true; - static bool wantEscape; - if (detectTty) { - if (isatty(STDOUT_FILENO)) - wantEscape =3D true; - detectTty =3D false; - } - return wantEscape; -} - -void virHostMsgPass(void) -{ - if (quiet) - return; - - if (virHostMsgWantEscape()) - fprintf(stdout, "\033[32m%s\033[0m\n", _("PASS")); - else - fprintf(stdout, "%s\n", _("PASS")); -} - - -static const char * failMessages[] =3D { - N_("FAIL"), - N_("WARN"), - N_("NOTE"), -}; - -verify(ARRAY_CARDINALITY(failMessages) =3D=3D VIR_HOST_VALIDATE_LAST); - -static const char *failEscapeCodes[] =3D { - "\033[31m", - "\033[33m", - "\033[34m", -}; - -verify(ARRAY_CARDINALITY(failEscapeCodes) =3D=3D VIR_HOST_VALIDATE_LAST); - -void virHostMsgFail(virHostValidateLevel level, - const char *format, - ...) -{ - va_list args; - char *msg; - - if (quiet) - return; - - va_start(args, format); - if (virVasprintf(&msg, format, args) < 0) { - perror("malloc"); - abort(); - } - va_end(args); - - if (virHostMsgWantEscape()) - fprintf(stdout, "%s%s\033[0m (%s)\n", - failEscapeCodes[level], _(failMessages[level]), msg); - else - fprintf(stdout, "%s (%s)\n", - _(failMessages[level]), msg); - VIR_FREE(msg); -} - - -int virHostValidateDeviceExists(const char *hvname, - const char *dev_name, - virHostValidateLevel level, - const char *hint) -{ - virHostMsgCheck(hvname, "if device %s exists", dev_name); - - if (access(dev_name, F_OK) < 0) { - virHostMsgFail(level, "%s", hint); - return -1; - } - - virHostMsgPass(); - return 0; -} - - -int virHostValidateDeviceAccessible(const char *hvname, - const char *dev_name, - virHostValidateLevel level, - const char *hint) -{ - virHostMsgCheck(hvname, "if device %s is accessible", dev_name); - - if (access(dev_name, R_OK|W_OK) < 0) { - virHostMsgFail(level, "%s", hint); - return -1; - } - - virHostMsgPass(); - return 0; -} - - -int virHostValidateNamespace(const char *hvname, - const char *ns_name, - virHostValidateLevel level, - const char *hint) -{ - virHostMsgCheck(hvname, "for namespace %s", ns_name); - char nspath[100]; - - snprintf(nspath, sizeof(nspath), "/proc/self/ns/%s", ns_name); - - if (access(nspath, F_OK) < 0) { - virHostMsgFail(level, "%s", hint); - return -1; - } - - virHostMsgPass(); - return 0; -} - - -virBitmapPtr virHostValidateGetCPUFlags(void) -{ - FILE *fp; - virBitmapPtr flags =3D NULL; - - if (!(fp =3D fopen("/proc/cpuinfo", "r"))) - return NULL; - - if (!(flags =3D virBitmapNewQuiet(VIR_HOST_VALIDATE_CPU_FLAG_LAST))) - goto cleanup; - - do { - char line[1024]; - char *start; - char **tokens; - size_t ntokens; - size_t i; - - if (!fgets(line, sizeof(line), fp)) - break; - - /* The line we're interested in is marked differently depending - * on the architecture, so check possible prefixes */ - if (!STRPREFIX(line, "flags") && - !STRPREFIX(line, "Features") && - !STRPREFIX(line, "features")) - continue; - - /* fgets() includes the trailing newline in the output buffer, - * so we need to clean that up ourselves. We can safely access - * line[strlen(line) - 1] because the checks above would cause - * us to skip empty strings */ - line[strlen(line) - 1] =3D '\0'; - - /* Skip to the separator */ - if (!(start =3D strchr(line, ':'))) - continue; - - /* Split the line using " " as a delimiter. The first token - * will always be ":", but that's okay */ - if (!(tokens =3D virStringSplitCount(start, " ", 0, &ntokens))) - continue; - - /* Go through all flags and check whether one of those we - * might want to check for later on is present; if that's - * the case, set the relevant bit in the bitmap */ - for (i =3D 0; i < ntokens; i++) { - int value; - - if ((value =3D virHostValidateCPUFlagTypeFromString(tokens[i])= ) >=3D 0) - ignore_value(virBitmapSetBit(flags, value)); - } - - virStringListFreeCount(tokens, ntokens); - } while (1); - - cleanup: - VIR_FORCE_FCLOSE(fp); - - return flags; -} - - -int virHostValidateLinuxKernel(const char *hvname, - int version, - virHostValidateLevel level, - const char *hint) -{ - struct utsname uts; - unsigned long thisversion; - - uname(&uts); - - virHostMsgCheck(hvname, _("for Linux >=3D %d.%d.%d"), - ((version >> 16) & 0xff), - ((version >> 8) & 0xff), - (version & 0xff)); - - if (STRNEQ(uts.sysname, "Linux")) { - virHostMsgFail(level, "%s", hint); - return -1; - } - - if (virParseVersionString(uts.release, &thisversion, true) < 0) { - virHostMsgFail(level, "%s", hint); - return -1; - } - - if (thisversion < version) { - virHostMsgFail(level, "%s", hint); - return -1; - } else { - virHostMsgPass(); - return 0; - } -} - -#ifdef __linux__ -int virHostValidateCGroupControllers(const char *hvname, - int controllers, - virHostValidateLevel level) -{ - virCgroupPtr group =3D NULL; - int ret =3D 0; - size_t i; - - if (virCgroupNewSelf(&group) < 0) - return -1; - - for (i =3D 0; i < VIR_CGROUP_CONTROLLER_LAST; i++) { - int flag =3D 1 << i; - const char *cg_name =3D virCgroupControllerTypeToString(i); - - if (!(controllers & flag)) - continue; - - virHostMsgCheck(hvname, "for cgroup '%s' controller support", cg_n= ame); - - if (!virCgroupHasController(group, i)) { - ret =3D -1; - virHostMsgFail(level, "Enable '%s' in kernel Kconfig file or " - "mount/enable cgroup controller in your system", - cg_name); - } else { - virHostMsgPass(); - } - } - - virCgroupFree(&group); - - return ret; -} -#else /* !__linux__ */ -int virHostValidateCGroupControllers(const char *hvname ATTRIBUTE_UNUSED, - int controllers ATTRIBUTE_UNUSED, - virHostValidateLevel level) -{ - virHostMsgFail(level, "%s", "This platform does not support cgroups"); - return -1; -} -#endif /* !__linux__ */ - -int virHostValidateIOMMU(const char *hvname, - virHostValidateLevel level) -{ - virBitmapPtr flags; - struct stat sb; - const char *bootarg =3D NULL; - bool isAMD =3D false, isIntel =3D false; - virArch arch =3D virArchFromHost(); - struct dirent *dent; - DIR *dir; - int rc; - - flags =3D virHostValidateGetCPUFlags(); - - if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_VMX)) - isIntel =3D true; - else if (flags && virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_= SVM)) - isAMD =3D true; - - virBitmapFree(flags); - - if (isIntel) { - virHostMsgCheck(hvname, "%s", _("for device assignment IOMMU suppo= rt")); - if (access("/sys/firmware/acpi/tables/DMAR", F_OK) =3D=3D 0) { - virHostMsgPass(); - bootarg =3D "intel_iommu=3Don"; - } else { - virHostMsgFail(level, - "No ACPI DMAR table found, IOMMU either " - "disabled in BIOS or not supported by this " - "hardware platform"); - return -1; - } - } else if (isAMD) { - virHostMsgCheck(hvname, "%s", _("for device assignment IOMMU suppo= rt")); - if (access("/sys/firmware/acpi/tables/IVRS", F_OK) =3D=3D 0) { - virHostMsgPass(); - bootarg =3D "iommu=3Dpt iommu=3D1"; - } else { - virHostMsgFail(level, - "No ACPI IVRS table found, IOMMU either " - "disabled in BIOS or not supported by this " - "hardware platform"); - return -1; - } - } else if (ARCH_IS_PPC64(arch)) { - /* Empty Block */ - } else if (ARCH_IS_S390(arch)) { - /* On s390x, we skip the IOMMU check if there are no PCI - * devices (which is quite usual on s390x). If there are - * no PCI devices the directory is still there but is - * empty. */ - if (!virDirOpen(&dir, "/sys/bus/pci/devices")) - return 0; - rc =3D virDirRead(dir, &dent, NULL); - VIR_DIR_CLOSE(dir); - if (rc <=3D 0) - return 0; - } else { - virHostMsgFail(level, - "Unknown if this platform has IOMMU support"); - return -1; - } - - - /* We can only check on newer kernels with iommu groups & vfio */ - if (stat("/sys/kernel/iommu_groups", &sb) < 0) - return 0; - - if (!S_ISDIR(sb.st_mode)) - return 0; - - virHostMsgCheck(hvname, "%s", _("if IOMMU is enabled by kernel")); - if (sb.st_nlink <=3D 2) { - if (bootarg) - virHostMsgFail(level, - "IOMMU appears to be disabled in kernel. " - "Add %s to kernel cmdline arguments", bootarg); - else - virHostMsgFail(level, "IOMMU capability not compiled into kern= el."); - return -1; - } - virHostMsgPass(); - return 0; -} diff --git a/tools/virt-host-validate-common.h b/tools/virt-host-validate-c= ommon.h deleted file mode 100644 index c4e4fa2175..0000000000 --- a/tools/virt-host-validate-common.h +++ /dev/null @@ -1,85 +0,0 @@ -/* - * virt-host-validate-common.h: Sanity check helper APIs - * - * Copyright (C) 2012 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#pragma once - -#include "internal.h" -#include "virutil.h" -#include "virbitmap.h" -#include "virenum.h" - -typedef enum { - VIR_HOST_VALIDATE_FAIL, - VIR_HOST_VALIDATE_WARN, - VIR_HOST_VALIDATE_NOTE, - - VIR_HOST_VALIDATE_LAST, -} virHostValidateLevel; - -typedef enum { - VIR_HOST_VALIDATE_CPU_FLAG_VMX =3D 0, - VIR_HOST_VALIDATE_CPU_FLAG_SVM, - VIR_HOST_VALIDATE_CPU_FLAG_SIE, - - VIR_HOST_VALIDATE_CPU_FLAG_LAST, -} virHostValidateCPUFlag; - -VIR_ENUM_DECL(virHostValidateCPUFlag); - -void virHostMsgSetQuiet(bool quietFlag); - -void virHostMsgCheck(const char *prefix, - const char *format, - ...) ATTRIBUTE_FMT_PRINTF(2, 3); - -void virHostMsgPass(void); -void virHostMsgFail(virHostValidateLevel level, - const char *format, - ...) ATTRIBUTE_FMT_PRINTF(2, 3); - -int virHostValidateDeviceExists(const char *hvname, - const char *dev_name, - virHostValidateLevel level, - const char *hint); - -int virHostValidateDeviceAccessible(const char *hvname, - const char *dev_name, - virHostValidateLevel level, - const char *hint); - -virBitmapPtr virHostValidateGetCPUFlags(void); - -int virHostValidateLinuxKernel(const char *hvname, - int version, - virHostValidateLevel level, - const char *hint); - -int virHostValidateNamespace(const char *hvname, - const char *ns_name, - virHostValidateLevel level, - const char *hint); - -int virHostValidateCGroupControllers(const char *hvname, - int controllers, - virHostValidateLevel level); - -int virHostValidateIOMMU(const char *hvname, - virHostValidateLevel level); diff --git a/tools/virt-host-validate-lxc.c b/tools/virt-host-validate-lxc.c deleted file mode 100644 index 8613f37cc7..0000000000 --- a/tools/virt-host-validate-lxc.c +++ /dev/null @@ -1,87 +0,0 @@ -/* - * virt-host-validate-lxc.c: Sanity check a LXC hypervisor host - * - * Copyright (C) 2012 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#include - -#include "virt-host-validate-lxc.h" -#include "virt-host-validate-common.h" -#include "vircgroup.h" - -int virHostValidateLXC(void) -{ - int ret =3D 0; - - if (virHostValidateLinuxKernel("LXC", (2 << 16) | (6 << 8) | 26, - VIR_HOST_VALIDATE_FAIL, - _("Upgrade to a kernel supporting names= paces")) < 0) - ret =3D -1; - - if (virHostValidateNamespace("LXC", "ipc", - VIR_HOST_VALIDATE_FAIL, - _("IPC namespace support is required")) <= 0) - ret =3D -1; - - if (virHostValidateNamespace("LXC", "mnt", - VIR_HOST_VALIDATE_FAIL, - _("Mount namespace support is required"))= < 0) - ret =3D -1; - - if (virHostValidateNamespace("LXC", "pid", - VIR_HOST_VALIDATE_FAIL, - _("PID namespace support is required")) <= 0) - ret =3D -1; - - if (virHostValidateNamespace("LXC", "uts", - VIR_HOST_VALIDATE_FAIL, - _("UTS namespace support is required")) <= 0) - ret =3D -1; - - if (virHostValidateNamespace("LXC", "net", - VIR_HOST_VALIDATE_WARN, - _("Network namespace support is recommend= ed")) < 0) - ret =3D -1; - - if (virHostValidateNamespace("LXC", "user", - VIR_HOST_VALIDATE_WARN, - _("User namespace support is recommended"= )) < 0) - ret =3D -1; - - if (virHostValidateCGroupControllers("LXC", - (1 << VIR_CGROUP_CONTROLLER_MEMOR= Y) | - (1 << VIR_CGROUP_CONTROLLER_CPU) | - (1 << VIR_CGROUP_CONTROLLER_CPUAC= CT) | - (1 << VIR_CGROUP_CONTROLLER_CPUSE= T) | - (1 << VIR_CGROUP_CONTROLLER_DEVIC= ES) | - (1 << VIR_CGROUP_CONTROLLER_FREEZ= ER) | - (1 << VIR_CGROUP_CONTROLLER_BLKIO= ), - VIR_HOST_VALIDATE_FAIL) < 0) { - ret =3D -1; - } - -#if WITH_FUSE - if (virHostValidateDeviceExists("LXC", "/sys/fs/fuse/connections", - VIR_HOST_VALIDATE_FAIL, - _("Load the 'fuse' module to enable /p= roc/ overrides")) < 0) - ret =3D -1; -#endif - - return ret; -} diff --git a/tools/virt-host-validate-lxc.h b/tools/virt-host-validate-lxc.h deleted file mode 100644 index fefab17552..0000000000 --- a/tools/virt-host-validate-lxc.h +++ /dev/null @@ -1,24 +0,0 @@ -/* - * virt-host-validate-lxc.h: Sanity check a LXC hypervisor host - * - * Copyright (C) 2012 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#pragma once - -int virHostValidateLXC(void); diff --git a/tools/virt-host-validate-qemu.c b/tools/virt-host-validate-qem= u.c deleted file mode 100644 index ff3c1f0231..0000000000 --- a/tools/virt-host-validate-qemu.c +++ /dev/null @@ -1,116 +0,0 @@ -/* - * virt-host-validate-qemu.c: Sanity check a QEMU hypervisor host - * - * Copyright (C) 2012 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#include -#include - -#include "virt-host-validate-qemu.h" -#include "virt-host-validate-common.h" -#include "virarch.h" -#include "virbitmap.h" -#include "vircgroup.h" - -int virHostValidateQEMU(void) -{ - virBitmapPtr flags; - int ret =3D 0; - bool hasHwVirt =3D false; - bool hasVirtFlag =3D false; - virArch arch =3D virArchFromHost(); - const char *kvmhint =3D _("Check that CPU and firmware supports virtua= lization " - "and kvm module is loaded"); - - if (!(flags =3D virHostValidateGetCPUFlags())) - return -1; - - switch ((int)arch) { - case VIR_ARCH_I686: - case VIR_ARCH_X86_64: - hasVirtFlag =3D true; - kvmhint =3D _("Check that the 'kvm-intel' or 'kvm-amd' modules are= " - "loaded & the BIOS has enabled virtualization"); - if (virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_SVM) || - virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_VMX)) - hasHwVirt =3D true; - break; - case VIR_ARCH_S390: - case VIR_ARCH_S390X: - hasVirtFlag =3D true; - if (virBitmapIsBitSet(flags, VIR_HOST_VALIDATE_CPU_FLAG_SIE)) - hasHwVirt =3D true; - break; - default: - hasHwVirt =3D false; - } - - if (hasVirtFlag) { - virHostMsgCheck("QEMU", "%s", _("for hardware virtualization")); - if (hasHwVirt) { - virHostMsgPass(); - } else { - virHostMsgFail(VIR_HOST_VALIDATE_FAIL, - _("Only emulated CPUs are available, performanc= e will be significantly limited")); - ret =3D -1; - } - } - - if (hasHwVirt || !hasVirtFlag) { - if (virHostValidateDeviceExists("QEMU", "/dev/kvm", - VIR_HOST_VALIDATE_FAIL, - kvmhint) <0) - ret =3D -1; - else if (virHostValidateDeviceAccessible("QEMU", "/dev/kvm", - VIR_HOST_VALIDATE_FAIL, - _("Check /dev/kvm is worl= d writable or you are in " - "a group that is allowe= d to access it")) < 0) - ret =3D -1; - } - - virBitmapFree(flags); - - if (virHostValidateDeviceExists("QEMU", "/dev/vhost-net", - VIR_HOST_VALIDATE_WARN, - _("Load the 'vhost_net' module to impr= ove performance " - "of virtio networking")) < 0) - ret =3D -1; - - if (virHostValidateDeviceExists("QEMU", "/dev/net/tun", - VIR_HOST_VALIDATE_FAIL, - _("Load the 'tun' module to enable net= working for QEMU guests")) < 0) - ret =3D -1; - - if (virHostValidateCGroupControllers("QEMU", - (1 << VIR_CGROUP_CONTROLLER_MEMOR= Y) | - (1 << VIR_CGROUP_CONTROLLER_CPU) | - (1 << VIR_CGROUP_CONTROLLER_CPUAC= CT) | - (1 << VIR_CGROUP_CONTROLLER_CPUSE= T) | - (1 << VIR_CGROUP_CONTROLLER_DEVIC= ES) | - (1 << VIR_CGROUP_CONTROLLER_BLKIO= ), - VIR_HOST_VALIDATE_WARN) < 0) { - ret =3D -1; - } - - if (virHostValidateIOMMU("QEMU", - VIR_HOST_VALIDATE_WARN) < 0) - ret =3D -1; - - return ret; -} diff --git a/tools/virt-host-validate-qemu.h b/tools/virt-host-validate-qem= u.h deleted file mode 100644 index ddb86aa52c..0000000000 --- a/tools/virt-host-validate-qemu.h +++ /dev/null @@ -1,24 +0,0 @@ -/* - * virt-host-validate-qemu.h: Sanity check a QEMU hypervisor host - * - * Copyright (C) 2012 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#pragma once - -int virHostValidateQEMU(void); diff --git a/tools/virt-host-validate.c b/tools/virt-host-validate.c deleted file mode 100644 index e797e63475..0000000000 --- a/tools/virt-host-validate.c +++ /dev/null @@ -1,152 +0,0 @@ -/* - * virt-host-validate.c: Sanity check a hypervisor host - * - * Copyright (C) 2012 Red Hat, Inc. - * - * This library is free software; you can redistribute it and/or - * modify it under the terms of the GNU Lesser General Public - * License as published by the Free Software Foundation; either - * version 2.1 of the License, or (at your option) any later version. - * - * This library is distributed in the hope that it will be useful, - * but WITHOUT ANY WARRANTY; without even the implied warranty of - * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU - * Lesser General Public License for more details. - * - * You should have received a copy of the GNU Lesser General Public - * License along with this library. If not, see - * . - * - */ - -#include - -#ifdef HAVE_LIBINTL_H -# include -#endif /* HAVE_LIBINTL_H */ -#include - -#include "internal.h" -#include "virgettext.h" - -#include "virt-host-validate-common.h" -#if WITH_QEMU -# include "virt-host-validate-qemu.h" -#endif -#if WITH_LXC -# include "virt-host-validate-lxc.h" -#endif -#if WITH_BHYVE -# include "virt-host-validate-bhyve.h" -#endif - -static void -show_help(FILE *out, const char *argv0) -{ - fprintf(out, - _("\n" - "syntax: %s [OPTIONS] [HVTYPE]\n" - "\n" - " Hypervisor types:\n" - "\n" - " - qemu\n" - " - lxc\n" - " - bhyve\n" - "\n" - " Options:\n" - " -h, --help Display command line help\n" - " -v, --version Display command version\n" - " -q, --quiet Don't display progress information\n" - "\n"), - argv0); -} - -static void -show_version(FILE *out, const char *argv0) -{ - fprintf(out, "version: %s %s\n", argv0, VERSION); -} - -static const struct option argOptions[] =3D { - { "help", 0, NULL, 'h', }, - { "version", 0, NULL, 'v', }, - { "quiet", 0, NULL, 'q', }, - { NULL, 0, NULL, '\0', } -}; - -int -main(int argc, char **argv) -{ - const char *hvname =3D NULL; - int c; - int ret =3D EXIT_SUCCESS; - bool quiet =3D false; - bool usedHvname =3D false; - - if (virGettextInitialize() < 0) - return EXIT_FAILURE; - - while ((c =3D getopt_long(argc, argv, "hvq", argOptions, NULL)) !=3D -= 1) { - switch (c) { - case 'v': - show_version(stdout, argv[0]); - return EXIT_SUCCESS; - - case 'h': - show_help(stdout, argv[0]); - return EXIT_SUCCESS; - - case 'q': - quiet =3D true; - break; - - case '?': - default: - show_help(stderr, argv[0]); - return EXIT_FAILURE; - } - } - - if ((argc-optind) > 2) { - fprintf(stderr, _("%s: too many command line arguments\n"), argv[0= ]); - show_help(stderr, argv[0]); - return EXIT_FAILURE; - } - - if (argc > 1) - hvname =3D argv[optind]; - - virHostMsgSetQuiet(quiet); - -#if WITH_QEMU - if (!hvname || STREQ(hvname, "qemu")) { - usedHvname =3D true; - if (virHostValidateQEMU() < 0) - ret =3D EXIT_FAILURE; - } -#endif - -#if WITH_LXC - if (!hvname || STREQ(hvname, "lxc")) { - usedHvname =3D true; - if (virHostValidateLXC() < 0) - ret =3D EXIT_FAILURE; - } -#endif - -#if WITH_BHYVE - if (!hvname || STREQ(hvname, "bhyve")) { - usedHvname =3D true; - if (virHostValidateBhyve() < 0) - ret =3D EXIT_FAILURE; - } -#endif - - if (hvname && !usedHvname) { - fprintf(stderr, _("%s: unsupported hypervisor name %s\n"), - argv[0], hvname); - return EXIT_FAILURE; - } - - return ret; -} --=20 2.21.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list From nobody Thu May 2 12:57:09 2024 Delivered-To: importer@patchew.org Received-SPF: pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) client-ip=209.132.183.28; envelope-from=libvir-list-bounces@redhat.com; helo=mx1.redhat.com; Authentication-Results: mx.zohomail.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1569588771; cv=none; d=zoho.com; s=zohoarc; b=BbpFhN9O/ZehNJBp/2CU6Td0m2qFxLD+qYkjLVGZhspR4Zu9EJhflDt1uboTHbWFp1L7zLfafYlg/zxXsREUq8RQIxjp4R2/pPCqHY7w4eveDGqh2Ot2I8xIlC+nYMN8LeyTwZ84OrVV23B3Bz7PxxxjdO8cD/IO0Cf2CPUtvtQ= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zoho.com; s=zohoarc; t=1569588771; h=Content-Type:Content-Transfer-Encoding:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To:ARC-Authentication-Results; bh=pc/QKUPJTfSUzsHnl3RAAN5Bm/KlteKaXS2C/y+j8hw=; b=gYZVYYJgomH9hfucOQPhiDD+FMEqHRohnP3mgS7+Hcd7zv6q4DbsRvhsZxW0CnHJwaxT3BypVzDxuam0h8UfgYi3iy3tsVC69xTPBbNzvbqNwHJ2SzMjeEb7LfYot1OeNybNgqtKJ3u0LyRDCX+/vyUjwHi5e1CzNJZLIrdx5Cg= ARC-Authentication-Results: i=1; mx.zoho.com; spf=pass (zoho.com: domain of redhat.com designates 209.132.183.28 as permitted sender) smtp.mailfrom=libvir-list-bounces@redhat.com; dmarc=pass header.from= (p=none dis=none) header.from= Return-Path: Received: from mx1.redhat.com (mx1.redhat.com [209.132.183.28]) by mx.zohomail.com with SMTPS id 1569588771535131.69437717458527; Fri, 27 Sep 2019 05:52:51 -0700 (PDT) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 7EA2A796EB; Fri, 27 Sep 2019 12:52:49 +0000 (UTC) Received: from colo-mx.corp.redhat.com (colo-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.20]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 589EC100EBDA; Fri, 27 Sep 2019 12:52:49 +0000 (UTC) Received: from lists01.pubmisc.prod.ext.phx2.redhat.com (lists01.pubmisc.prod.ext.phx2.redhat.com [10.5.19.33]) by colo-mx.corp.redhat.com (Postfix) with ESMTP id 13074180BA9A; Fri, 27 Sep 2019 12:52:49 +0000 (UTC) Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) by lists01.pubmisc.prod.ext.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id x8RCqa80002585 for ; Fri, 27 Sep 2019 08:52:36 -0400 Received: by smtp.corp.redhat.com (Postfix) id 9AF231001B07; Fri, 27 Sep 2019 12:52:36 +0000 (UTC) Received: from domokun.gsslab.fab.redhat.com (dhcp-94.gsslab.fab.redhat.com [10.33.9.94]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0F14F1001B08; Fri, 27 Sep 2019 12:52:35 +0000 (UTC) From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= To: libvir-list@redhat.com Date: Fri, 27 Sep 2019 13:52:25 +0100 Message-Id: <20190927125225.22432-7-berrange@redhat.com> In-Reply-To: <20190927125225.22432-1-berrange@redhat.com> References: <20190927125225.22432-1-berrange@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-loop: libvir-list@redhat.com Subject: [libvirt] [PATCH v2 6/6] tools: make virt-host-validate check CPU vulnerabilities X-BeenThere: libvir-list@redhat.com X-Mailman-Version: 2.1.12 Precedence: junk List-Id: Development discussions about the libvirt library & tools List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: quoted-printable Sender: libvir-list-bounces@redhat.com Errors-To: libvir-list-bounces@redhat.com X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Greylist: Sender IP whitelisted, not delayed by milter-greylist-4.5.16 (mx1.redhat.com [10.5.110.25]); Fri, 27 Sep 2019 12:52:50 +0000 (UTC) Add a check reporting if any CPU vulnerabilities have not been mitigated by the kernel. It further reports whether it is safe to use Intel SMT for KVM guests or not, as several of the vulnerabilities are dangerous when combined with SMT and KVM, even if mitigations are in effect. eg on a host with mitigations, but unsafe SMT still enabled: Checking CPU hardware vulnerability mitigation...PASS Checking CPU hardware vulnerability SMT safety...FAIL Signed-off-by: Daniel P. Berrang=C3=A9 --- libvirt.spec.in | 1 + tools/Makefile.am | 1 + .../rules/linux-cpu-hardware-flaws.yaml | 165 ++++++++++++++++++ 3 files changed, 167 insertions(+) create mode 100644 tools/host-validate/rules/linux-cpu-hardware-flaws.yaml diff --git a/libvirt.spec.in b/libvirt.spec.in index f336296a08..8aa226798a 100644 --- a/libvirt.spec.in +++ b/libvirt.spec.in @@ -1901,6 +1901,7 @@ exit 0 %{_datadir}/libvirt/host-validate/linux-acpi.yaml %{_datadir}/libvirt/host-validate/linux-cgroups.yaml %{_datadir}/libvirt/host-validate/linux-cpu.yaml +%{_datadir}/libvirt/host-validate/linux-cpu-hardware-flaws.yaml %{_datadir}/libvirt/host-validate/linux-devices.yaml %{_datadir}/libvirt/host-validate/linux-iommu.yaml %{_datadir}/libvirt/host-validate/linux-namespaces.yaml diff --git a/tools/Makefile.am b/tools/Makefile.am index 728de475a2..907b0195c2 100644 --- a/tools/Makefile.am +++ b/tools/Makefile.am @@ -173,6 +173,7 @@ virt_host_validate_rules_DATA =3D \ $(srcdir)/host-validate/rules/linux-acpi.yaml \ $(srcdir)/host-validate/rules/linux-cgroups.yaml \ $(srcdir)/host-validate/rules/linux-cpu.yaml \ + $(srcdir)/host-validate/rules/linux-cpu-hardware-flaws.yaml \ $(srcdir)/host-validate/rules/linux-devices.yaml \ $(srcdir)/host-validate/rules/linux-iommu.yaml \ $(srcdir)/host-validate/rules/linux-namespaces.yaml \ diff --git a/tools/host-validate/rules/linux-cpu-hardware-flaws.yaml b/tool= s/host-validate/rules/linux-cpu-hardware-flaws.yaml new file mode 100644 index 0000000000..6a243df96d --- /dev/null +++ b/tools/host-validate/rules/linux-cpu-hardware-flaws.yaml @@ -0,0 +1,165 @@ +# +# Define facts related to CPU hardware vulnerabilities +# + +facts: +- name: cpu.vulnerability.meltdown + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/devices/system/cpu/vulnerabilities/meltdown + ignoreMissing: true + parse: + scalar: + regex: (\w+) + match: 1 +- name: cpu.vulnerability.spectre_v1 + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/devices/system/cpu/vulnerabilities/spectre_v1 + ignoreMissing: true + parse: + scalar: + regex: (\w+) + match: 1 +- name: cpu.vulnerability.spectre_v2 + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/devices/system/cpu/vulnerabilities/spectre_v2 + ignoreMissing: true + parse: + scalar: + regex: (\w+) + match: 1 +- name: cpu.vulnerability.spec_store_bypass + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/devices/system/cpu/vulnerabilities/spec_store_bypass + ignoreMissing: true + parse: + scalar: + regex: (\w+) + match: 1 +- name: cpu.vulnerability.mds + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/devices/system/cpu/vulnerabilities/mds + ignoreMissing: true + parse: + scalar: + regex: (\w+) + match: 1 +- name: cpu.vulnerability.mds_smt + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/devices/system/cpu/vulnerabilities/mds + ignoreMissing: true + parse: + scalar: + regex: SMT (\w+) + match: 1 +- name: cpu.vulnerability.l1tf + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/devices/system/cpu/vulnerabilities/l1tf + ignoreMissing: true + parse: + scalar: + regex: (\w+) + match: 1 +- name: cpu.vulnerability.l1tf_smt + filter: + fact: + name: os.kernel + value: Linux + value: + file: + path: /sys/devices/system/cpu/vulnerabilities/l1tf + ignoreMissing: true + parse: + scalar: + regex: SMT (\w+) + match: 1 +- name: cpu.vulnerability.unsafe + filter: + fact: + name: os.kernel + value: Linux + report: + message: CPU hardware vulnerability mitigation + pass: false + value: + bool: + any: + expressions: + - fact: + name: cpu.vulnerability.meltdown + value: Vulnerable + - fact: + name: cpu.vulnerability.spectre_v1 + value: Vulnerable + - fact: + name: cpu.vulnerability.spectre_v2 + value: Vulnerable + - fact: + name: cpu.vulnerability.spec_store_bypass + value: Vulnerable + - fact: + name: cpu.vulnerability.mds + value: Vulnerable + - fact: + name: cpu.vulnerability.l1tf + value: Vulnerable +- name: cpu.vulnerability.unsafe_smt + filter: + all: + expressions: + - fact: + name: os.kernel + value: Linux + - fact: + name: cpu.vendor.intel + value: "true" + - fact: + name: cpu.virt.present + value: "true" + report: + message: CPU hardware vulnerability SMT safety + pass: false + value: + bool: + any: + expressions: + - fact: + name: cpu.vulnerability.mds_smt + value: vulnerable + - fact: + name: cpu.vulnerability.l1tf_smt + value: vulnerable --=20 2.21.0 -- libvir-list mailing list libvir-list@redhat.com https://www.redhat.com/mailman/listinfo/libvir-list