|
 |
e4cbec |
From ac9aae920fd7705a65f6bf0b236c4baa05e9bf30 Mon Sep 17 00:00:00 2001
|
|
|
e4cbec |
Message-Id: <ac9aae920fd7705a65f6bf0b236c4baa05e9bf30@dist-git>
|
|
|
e4cbec |
From: Pavel Hrdina <phrdina@redhat.com>
|
|
|
e4cbec |
Date: Fri, 15 Mar 2019 09:49:56 +0100
|
|
|
e4cbec |
Subject: [PATCH] domcapabilities: introduce get_cpu_security_features
|
|
|
e4cbec |
|
|
|
e4cbec |
Get all CPU security features that we should enable for guests.
|
|
|
e4cbec |
|
|
|
e4cbec |
In order to do that we need to get CPU definition from domain
|
|
|
e4cbec |
capabilities and modify the XML so it is in required format for
|
|
|
e4cbec |
libvirt CPU baseline APIs. We will prefer the baselineHypervisorCPU
|
|
|
e4cbec |
API because that considers what QEMU actually supports and we will
|
|
|
e4cbec |
fallback to baselineCPU API if the better one is not supported by
|
|
|
e4cbec |
libvirt.
|
|
|
e4cbec |
|
|
|
e4cbec |
This way we can figure out which of the security features are actually
|
|
|
e4cbec |
available on that specific host for that specific QEMU binary.
|
|
|
e4cbec |
|
|
|
e4cbec |
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
|
|
|
e4cbec |
Reviewed-by: Cole Robinson <crobinso@redhat.com>
|
|
|
e4cbec |
(cherry picked from commit 4a8b6363c0891e37d9532213a046c5c57aedfd8b)
|
|
|
e4cbec |
|
|
|
e4cbec |
Resolves: https://bugzilla.redhat.com/show_bug.cgi?id=1582667
|
|
|
e4cbec |
|
|
|
e4cbec |
Conflicts:
|
|
|
e4cbec |
- upstream renamed CPU class to DomainCpu
|
|
|
e4cbec |
- upstream renamed get_xml_config() to get_xml()
|
|
|
e4cbec |
- python 2.7 cannot handle Element.attrib set to None
|
|
|
e4cbec |
|
|
|
e4cbec |
Signed-off-by: Pavel Hrdina <phrdina@redhat.com>
|
|
|
e4cbec |
Reviewed-by: Cole Robinson <crobinso@redhat.com>
|
|
|
e4cbec |
---
|
|
|
e4cbec |
virtinst/domcapabilities.py | 57 +++++++++++++++++++++++++++++++++++++
|
|
|
e4cbec |
1 file changed, 57 insertions(+)
|
|
|
e4cbec |
|
|
|
e4cbec |
diff --git a/virtinst/domcapabilities.py b/virtinst/domcapabilities.py
|
|
|
e4cbec |
index 20b6b38d..12755940 100644
|
|
|
e4cbec |
--- a/virtinst/domcapabilities.py
|
|
|
e4cbec |
+++ b/virtinst/domcapabilities.py
|
|
|
e4cbec |
@@ -20,7 +20,11 @@
|
|
|
e4cbec |
|
|
|
e4cbec |
import logging
|
|
|
e4cbec |
import re
|
|
|
e4cbec |
+import xml.etree.ElementTree as ET
|
|
|
e4cbec |
|
|
|
e4cbec |
+import libvirt
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+from . import CPU
|
|
|
e4cbec |
from .xmlbuilder import XMLBuilder, XMLChildProperty, XMLProperty
|
|
|
e4cbec |
|
|
|
e4cbec |
|
|
|
e4cbec |
@@ -210,6 +214,59 @@ class DomainCapabilities(XMLBuilder):
|
|
|
e4cbec |
return True
|
|
|
e4cbec |
return False
|
|
|
e4cbec |
|
|
|
e4cbec |
+ def _convert_mode_to_cpu(self, xml):
|
|
|
e4cbec |
+ root = ET.fromstring(xml)
|
|
|
e4cbec |
+ root.tag = "cpu"
|
|
|
e4cbec |
+ root.attrib = {}
|
|
|
e4cbec |
+ arch = ET.SubElement(root, "arch")
|
|
|
e4cbec |
+ arch.text = self.arch
|
|
|
e4cbec |
+ return ET.tostring(root, encoding="UTF-8")
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ def _get_expandned_cpu(self, mode):
|
|
|
e4cbec |
+ cpuXML = self._convert_mode_to_cpu(mode.get_xml_config())
|
|
|
e4cbec |
+ logging.debug("CPU XML for security flag baseline: %s", cpuXML)
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ try:
|
|
|
e4cbec |
+ expandedXML = self.conn.baselineHypervisorCPU(
|
|
|
e4cbec |
+ self.path, self.arch, self.machine, self.domain, [cpuXML],
|
|
|
e4cbec |
+ libvirt.VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES)
|
|
|
e4cbec |
+ except libvirt.libvirtError:
|
|
|
e4cbec |
+ expandedXML = self.conn.baselineCPU([cpuXML],
|
|
|
e4cbec |
+ libvirt.VIR_CONNECT_BASELINE_CPU_EXPAND_FEATURES)
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ logging.debug("Expanded CPU XML: %s", expandedXML)
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ return CPU(self.conn, expandedXML)
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ def get_cpu_security_features(self):
|
|
|
e4cbec |
+ sec_features = [
|
|
|
e4cbec |
+ 'pcid',
|
|
|
e4cbec |
+ 'spec-ctrl',
|
|
|
e4cbec |
+ 'ssbd',
|
|
|
e4cbec |
+ 'pdpe1gb',
|
|
|
e4cbec |
+ 'ibpb',
|
|
|
e4cbec |
+ 'virt-ssbd',
|
|
|
e4cbec |
+ 'amd-ssbd',
|
|
|
e4cbec |
+ 'amd-no-ssb']
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ features = []
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ for m in self.cpu.modes:
|
|
|
e4cbec |
+ if m.name != "host-model" or not m.supported:
|
|
|
e4cbec |
+ continue
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ try:
|
|
|
e4cbec |
+ cpu = self._get_expandned_cpu(m)
|
|
|
e4cbec |
+ except libvirt.libvirtError as e:
|
|
|
e4cbec |
+ logging.warning(_("Failed to get expanded CPU XML: %s"), e)
|
|
|
e4cbec |
+ break
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ for feature in cpu.features:
|
|
|
e4cbec |
+ if feature.name in sec_features:
|
|
|
e4cbec |
+ features.append(feature.name)
|
|
|
e4cbec |
+
|
|
|
e4cbec |
+ return features
|
|
|
e4cbec |
+
|
|
|
e4cbec |
|
|
|
e4cbec |
_XML_ROOT_NAME = "domainCapabilities"
|
|
|
e4cbec |
os = XMLChildProperty(_OS, is_single=True)
|
|
|
e4cbec |
--
|
|
|
e4cbec |
2.20.1
|
|
|
e4cbec |
|