[PATCH v2 3/6] tools: define YAML rules for virt-host-validate checks

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



This commit defines a set of YAML rules that result in the same set of
logical checks as the existing hardcoded virt-host-validate
implementation does.

Signed-off-by: Daniel P. Berrangé <berrange@xxxxxxxxxx>
---
 tools/host-validate/rules/builtin.yaml        |  20 +
 tools/host-validate/rules/cpu.yaml            |  50 ++
 tools/host-validate/rules/freebsd-kernel.yaml |  77 +++
 tools/host-validate/rules/linux-acpi.yaml     |  39 ++
 tools/host-validate/rules/linux-cgroups.yaml  | 470 ++++++++++++++++++
 tools/host-validate/rules/linux-cpu.yaml      | 134 +++++
 tools/host-validate/rules/linux-devices.yaml  |  71 +++
 tools/host-validate/rules/linux-iommu.yaml    | 113 +++++
 .../host-validate/rules/linux-namespaces.yaml | 119 +++++
 tools/host-validate/rules/linux-pci.yaml      |  10 +
 10 files changed, 1103 insertions(+)
 create mode 100644 tools/host-validate/rules/builtin.yaml
 create mode 100644 tools/host-validate/rules/cpu.yaml
 create mode 100644 tools/host-validate/rules/freebsd-kernel.yaml
 create mode 100644 tools/host-validate/rules/linux-acpi.yaml
 create mode 100644 tools/host-validate/rules/linux-cgroups.yaml
 create mode 100644 tools/host-validate/rules/linux-cpu.yaml
 create mode 100644 tools/host-validate/rules/linux-devices.yaml
 create mode 100644 tools/host-validate/rules/linux-iommu.yaml
 create mode 100644 tools/host-validate/rules/linux-namespaces.yaml
 create mode 100644 tools/host-validate/rules/linux-pci.yaml

diff --git a/tools/host-validate/rules/builtin.yaml b/tools/host-validate/rules/builtin.yaml
new file mode 100644
index 0000000000..f69b069e09
--- /dev/null
+++ b/tools/host-validate/rules/builtin.yaml
@@ -0,0 +1,20 @@
+#
+# Define boilerplate to activate various built-in facts
+#
+
+facts:
+- name: libvirt.driver
+  value:
+    builtin: {}
+- name: cpu.arch
+  value:
+    builtin: {}
+- name: os.kernel
+  value:
+    builtin: {}
+- name: os.release
+  value:
+    builtin: {}
+- name: os.version
+  value:
+    builtin: {}
diff --git a/tools/host-validate/rules/cpu.yaml b/tools/host-validate/rules/cpu.yaml
new file mode 100644
index 0000000000..5af61b1ea1
--- /dev/null
+++ b/tools/host-validate/rules/cpu.yaml
@@ -0,0 +1,50 @@
+#
+# Define facts related to host CPU properties
+#
+
+facts:
+- name: cpu.family.x86
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: cpu.arch
+            value: x86_64
+        - fact:
+            name: cpu.arch
+            value: i386
+        - fact:
+            name: cpu.arch
+            value: i486
+        - fact:
+            name: cpu.arch
+            value: i586
+        - fact:
+            name: cpu.arch
+            value: i686
+- name: cpu.family.arm
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: cpu.arch
+            value: aarch64
+        - fact:
+            name: cpu.arch
+            value: armv6
+        - fact:
+            name: cpu.arch
+            value: armv7
+- name: cpu.family.s390
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: cpu.arch
+            value: s390
+        - fact:
+            name: cpu.arch
+            value: s390x
diff --git a/tools/host-validate/rules/freebsd-kernel.yaml b/tools/host-validate/rules/freebsd-kernel.yaml
new file mode 100644
index 0000000000..345e78dbc2
--- /dev/null
+++ b/tools/host-validate/rules/freebsd-kernel.yaml
@@ -0,0 +1,77 @@
+#
+# Define facts related to BHyve on FreeBSD
+#
+
+facts:
+- name: os.kmod
+  filter:
+    fact:
+      name: os.kernel
+      value: FreeBSD
+  value:
+    command:
+      name: kldstat
+      parse:
+        set:
+          separator: \n
+          skiphead: 1
+          skiptail: 1
+          regex: \s+\d+\s+\d+\s+0x[0-9a-f]+\s+[0-9a-f]+\s+(\w+)
+          match: 1
+- name: kmod.vmm
+  filter:
+    fact:
+      name: libvirt.driver.bhyve
+      value: "true"
+  report:
+    message: BHyve VMs can be run
+  hint:
+    message: load the 'vmm' kernel module
+  value:
+    bool:
+      fact:
+        name: os.kmod.vmm
+        value: "true"
+- name: kmod.if_tap
+  filter:
+    fact:
+      name: libvirt.driver.bhyve
+      value: "true"
+  report:
+    message: BHyve VMs can use networking
+  hint:
+    message: load the 'if_tap' kernel module
+  value:
+    bool:
+      fact:
+        name: os.kmod.if_tap
+        value: "true"
+- name: kmod.if_bridge
+  filter:
+    fact:
+      name: libvirt.driver.bhyve
+      value: "true"
+  report:
+    message: BHyve VMs can use bridged network
+  hint:
+    message: load the 'if_bridge' kernel module
+  value:
+    bool:
+      fact:
+        name: os.kmod.if_bridge
+        value: "true"
+- name: kmod.nmdm
+  filter:
+    fact:
+      name: libvirt.driver.bhyve
+      value: "true"
+  report:
+    message: BHyve VMs can use nmdm console
+    level: warn
+  hint:
+    message: load the 'nmdm' kernel module
+  value:
+    bool:
+      fact:
+        name: os.kmod.nmdm
+        value: "true"
diff --git a/tools/host-validate/rules/linux-acpi.yaml b/tools/host-validate/rules/linux-acpi.yaml
new file mode 100644
index 0000000000..cad324dd96
--- /dev/null
+++ b/tools/host-validate/rules/linux-acpi.yaml
@@ -0,0 +1,39 @@
+#
+# Define facts for interesting ACPI tables on the host
+#
+
+facts:
+- name: cpu.acpi.dmar
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: cpu.family.x86
+          value: "true"
+      - fact:
+          name: cpu.vendor.intel
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/firmware/acpi/tables/DMAR
+- name: cpu.acpi.ivrs
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: cpu.family.x86
+          value: "true"
+      - fact:
+          name: cpu.vendor.amd
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/firmware/acpi/tables/IVRS
diff --git a/tools/host-validate/rules/linux-cgroups.yaml b/tools/host-validate/rules/linux-cgroups.yaml
new file mode 100644
index 0000000000..e886bccd17
--- /dev/null
+++ b/tools/host-validate/rules/linux-cgroups.yaml
@@ -0,0 +1,470 @@
+#
+# Define facts for Linux control cgroups v1/v2
+#
+
+facts:
+- name: os.cgroup.controller
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    file:
+      path: /proc/cgroups
+      parse:
+        set:
+          separator: \n
+          skiphead: 1
+          skiptail: 1
+          regex: ^(\w+)
+          match: 1
+- name: os.cgroup.v2only
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/cgroup.subtree_control
+- name: os.cgroup.v2hybrid
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    file:
+      path: /sys/fs/cgroup/unified/cgroup.controllers
+      ignoreMissing: true
+      parse:
+        whitespace: trim
+        set:
+          skiphead: 0
+          skiptail: 0
+          separator: ' '
+- name: os.cgroup.mount.v2
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    file:
+      path: /sys/fs/cgroup/cgroup.controllers
+      ignoreMissing: true
+      parse:
+        whitespace: trim
+        set:
+          skiphead: 0
+          skiptail: 0
+          separator: ' '
+- name: os.cgroup.mount.v1.blkio
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/blkio/cgroup.procs
+- name: os.cgroup.mount.v1.cpu
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/cpu/cgroup.procs
+- name: os.cgroup.mount.v1.cpuacct
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/cpuacct/cgroup.procs
+- name: os.cgroup.mount.v1.cpuset
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/cpuset/cgroup.procs
+- name: os.cgroup.mount.v1.devices
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/devices/cgroup.procs
+- name: os.cgroup.mount.v1.freezer
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/freezer/cgroup.procs
+- name: os.cgroup.mount.v1.hugetlb
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/hugetlb/cgroup.procs
+- name: os.cgroup.mount.v1.memory
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/memory/cgroup.procs
+- name: os.cgroup.mount.v1.net_cls
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/net_cls/cgroup.procs
+- name: os.cgroup.mount.v1.net_prio
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/net_prio/cgroup.procs
+- name: os.cgroup.mount.v1.perf_event
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/perf_event/cgroup.procs
+- name: os.cgroup.mount.v1.pids
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/pids/cgroup.procs
+- name: os.cgroup.mount.unified
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    access:
+      check: exists
+      path: /sys/fs/cgroup/unified/cgroup.procs
+- name: os.cgroup.memory.present
+  filter:
+    all:
+      expressions:
+      - any:
+          expressions:
+          - fact:
+              name: libvirt.driver.lxc
+              value: "true"
+          - fact:
+              name: libvirt.driver.qemu
+              value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: cgroup memory controller present
+  hint:
+    message: enable memory cgroup controller in Kconfig
+  value:
+    bool:
+      fact:
+        name: os.cgroup.controller.memory
+        value: "true"
+- name: os.cgroup.memory.mounted
+  filter:
+    fact:
+      name: os.cgroup.memory.present
+      value: "true"
+  report:
+    message: cgroup memory controller mounted
+  hint:
+    message: mount the memory cgroup controller under /sys/fs/cgroup
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: os.cgroup.mount.v1.memory
+            value: "true"
+        - fact:
+            name: os.cgroup.mount.v2.memory
+            value: "true"
+- name: os.cgroup.cpu.present
+  filter:
+    all:
+      expressions:
+      - any:
+          expressions:
+          - fact:
+              name: libvirt.driver.lxc
+              value: "true"
+          - fact:
+              name: libvirt.driver.qemu
+              value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: cgroup cpu controller present
+  hint:
+    message: enable cpu cgroup controller in Kconfig
+  value:
+    bool:
+      fact:
+        name: os.cgroup.controller.cpu
+        value: "true"
+- name: os.cgroup.cpu.mounted
+  filter:
+    fact:
+      name: os.cgroup.cpu.present
+      value: "true"
+  report:
+    message: cgroup cpu controller mounted
+  hint:
+    message: mount the cpu cgroup controller under /sys/fs/cgroup
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: os.cgroup.mount.v1.cpu
+            value: "true"
+        - fact:
+            name: os.cgroup.mount.v2.cpu
+            value: "true"
+- name: os.cgroup.cpuacct.present
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.lxc
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: cgroup cpuacct controller present
+  hint:
+    message: enable cpuacct cgroup controller in Kconfig
+  value:
+    bool:
+      fact:
+        name: os.cgroup.controller.cpuacct
+        value: "true"
+- name: os.cgroup.cpuacct.mounted
+  filter:
+    fact:
+      name: os.cgroup.cpuacct.present
+      value: "true"
+  report:
+    message: cgroup cpuacct controller mounted
+  hint:
+    message: mount the cpuacct cgroup controller under /sys/fs/cgroup
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: os.cgroup.mount.v1.cpuacct
+            value: "true"
+        - fact:
+            name: os.cgroup.mount.v2.cpuacct
+            value: "true"
+- name: os.cgroup.cpuset.present
+  filter:
+    all:
+      expressions:
+      - any:
+          expressions:
+          - fact:
+              name: libvirt.driver.lxc
+              value: "true"
+          - fact:
+              name: libvirt.driver.qemu
+              value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: cgroup cpuset controller present
+  hint:
+    message: enable cpuset cgroup controller in Kconfig
+  value:
+    bool:
+      fact:
+        name: os.cgroup.controller.cpuset
+        value: "true"
+- name: os.cgroup.cpuset.mounted
+  filter:
+    fact:
+      name: os.cgroup.cpuset.present
+      value: "true"
+  report:
+    message: cgroup cpuset controller mounted
+  hint:
+    message: mount the cpuset cgroup controller under /sys/fs/cgroup
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: os.cgroup.mount.v1.cpuset
+            value: "true"
+        - fact:
+            name: os.cgroup.mount.v2.cpuset
+            value: "true"
+- name: os.cgroup.devices.present
+  filter:
+    all:
+      expressions:
+      - any:
+          expressions:
+          - fact:
+              name: libvirt.driver.lxc
+              value: "true"
+          - fact:
+              name: libvirt.driver.qemu
+              value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: cgroup devices controller present
+  hint:
+    message: enable devices cgroup controller in Kconfig
+  value:
+    bool:
+      fact:
+        name: os.cgroup.controller.devices
+        value: "true"
+- name: os.cgroup.devices.mounted
+  filter:
+    fact:
+      name: os.cgroup.devices.present
+      value: "true"
+  report:
+    message: cgroup devices controller mounted
+  hint:
+    message: mount the devices cgroup controller under /sys/fs/cgroup
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: os.cgroup.mount.v1.devices
+            value: "true"
+        - fact:
+            name: os.cgroup.v2hybrid
+            value: "true"
+        - fact:
+            name: os.cgroup.v2only
+            value: "true"
+- name: os.cgroup.blkio.present
+  filter:
+    all:
+      expressions:
+      - any:
+          expressions:
+          - fact:
+              name: libvirt.driver.lxc
+              value: "true"
+          - fact:
+              name: libvirt.driver.qemu
+              value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: cgroup blkio controller present
+  hint:
+    message: enable blkio cgroup controller in Kconfig
+  value:
+    bool:
+      fact:
+        name: os.cgroup.controller.blkio
+        value: "true"
+- name: os.cgroup.blkio.mounted
+  filter:
+    fact:
+      name: os.cgroup.blkio.present
+      value: "true"
+  report:
+    message: cgroup blkio controller mounted
+  hint:
+    message: mount the blkio cgroup controller under /sys/fs/cgroup
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: os.cgroup.mount.v1.blkio
+            value: "true"
+        - fact:
+            name: os.cgroup.mount.v2.io
+            value: "true"
+- name: os.cgroup.freezer.present
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.lxc
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: cgroup freezer controller present
+  hint:
+    message: enable freezer cgroup controller in Kconfig
+  value:
+    bool:
+      fact:
+        name: os.cgroup.controller.freezer
+        value: "true"
+- name: os.cgroup.freezer.mounted
+  filter:
+    fact:
+      name: os.cgroup.freezer.present
+      value: "true"
+  report:
+    message: cgroup freezer controller mounted
+  hint:
+    message: mount the freezer cgroup controller under /sys/fs/cgroup
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: os.cgroup.mount.v1.freezer
+            value: "true"
+        - fact:
+            name: os.cgroup.mount.v2.freezer
+            value: "true"
diff --git a/tools/host-validate/rules/linux-cpu.yaml b/tools/host-validate/rules/linux-cpu.yaml
new file mode 100644
index 0000000000..81aee516bf
--- /dev/null
+++ b/tools/host-validate/rules/linux-cpu.yaml
@@ -0,0 +1,134 @@
+#
+# Define facts related to host CPU properties
+#
+
+facts:
+- name: cpu.info
+  filter:
+    fact:
+      name: os.kernel
+      value: Linux
+  value:
+    file:
+      path: /proc/cpuinfo
+      parse:
+        list:
+          limit: 1
+          separator: \n\n
+          parse:
+            whitespace: trim
+            dict:
+              separator: \n
+              delimiter: ':'
+              parse:
+                whitespace: trim
+                scalar: {}
+- name: cpu.vendor.intel
+  filter:
+    fact:
+      name: cpu.family.x86
+      value: "true"
+  value:
+    bool:
+      fact:
+        name: cpu.info.0.vendor_id
+        value: GenuineIntel
+- name: cpu.vendor.amd
+  filter:
+    fact:
+      name: cpu.family.x86
+      value: "true"
+  value:
+    bool:
+      fact:
+        name: cpu.info.0.vendor_id
+        value: AuthenticAMD
+- name: cpu.features.x86
+  filter:
+    fact:
+      name: cpu.family.x86
+      value: "true"
+  value:
+    string:
+      fact: cpu.info.0.flags
+      parse:
+        whitespace: trim
+        set:
+          skiphead: 0
+          skiptail: 0
+          separator: ' '
+- name: cpu.features.arm
+  filter:
+    fact:
+      name: cpu.family.arm
+      value: "true"
+  value:
+    string:
+      fact: cpu.info.0.Features
+      parse:
+        whitespace: trim
+        set:
+          skiphead: 0
+          skiptail: 0
+          separator: ' '
+- name: cpu.features.s390
+  filter:
+    fact:
+      name: cpu.family.s390
+      value: "true"
+  value:
+    string:
+      fact: cpu.info.0.features
+      parse:
+        whitespace: trim
+        set:
+          skiphead: 0
+          skiptail: 0
+          separator: ' '
+- name: cpu.virt.possible
+  filter:
+    fact:
+      name: libvirt.driver.qemu
+      value: "true"
+  report:
+    message: hardware virt possible
+  value:
+    bool:
+      any:
+        expressions:
+        - fact:
+            name: cpu.family.x86
+            value: "true"
+- name: cpu.virt.present
+  filter:
+    fact:
+      name: cpu.virt.possible
+      value: "true"
+  report:
+    message: hardware virt present
+    level: warn
+  hint:
+    message: only emulated CPUs are available, performance will be significantly limited
+  value:
+    bool:
+      any:
+        expressions:
+        - all:
+            expressions:
+            - fact:
+                name: cpu.vendor.amd
+                value: "true"
+            - fact:
+                name: cpu.features.x86.svm
+                value: "true"
+        - all:
+            expressions:
+            - fact:
+                name: cpu.vendor.intel
+                value: "true"
+            - fact:
+                name: cpu.features.x86.vmx
+                value: "true"
+        - fact:
+            name: cpu.features.s390.sie
+            value: "true"
diff --git a/tools/host-validate/rules/linux-devices.yaml b/tools/host-validate/rules/linux-devices.yaml
new file mode 100644
index 0000000000..791f35a0b6
--- /dev/null
+++ b/tools/host-validate/rules/linux-devices.yaml
@@ -0,0 +1,71 @@
+#
+# Define facts related to device nodes on the host
+#
+
+facts:
+- name: os.kvm.loaded
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.qemu
+          value: "true"
+      - fact:
+          name: cpu.virt.present
+          value: "true"
+  report:
+    message: /dev/kvm loaded
+  value:
+    access:
+      check: exists
+      path: /dev/kvm
+- name: os.kvm.accessible
+  filter:
+    fact:
+      name: os.kvm.loaded
+      value: "true"
+  report:
+    message: /dev/kvm accessible
+  hint:
+    message: Check /dev/kvm is world writable or you are in a group that is allowed
+      to access it
+  value:
+    access:
+      check: writable
+      path: /dev/kvm
+- name: os.vhostnet.present
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.qemu
+          value: "true"
+      - fact:
+          name: os.kvm.loaded
+          value: "true"
+  report:
+    message: /dev/vhost-net present
+  hint:
+    message: Load the 'vhost_net' module to improve performance of virtio networking
+  value:
+    access:
+      check: exists
+      path: /dev/vhost-net
+- name: os.tun.present
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.qemu
+          value: "true"
+      - fact:
+          name: os.kvm.loaded
+          value: "true"
+  report:
+    message: /dev/net/tun present
+  hint:
+    message: Load the 'tun' module to enable networking for QEMU guests
+  value:
+    access:
+      check: exists
+      path: /dev/net/tun
diff --git a/tools/host-validate/rules/linux-iommu.yaml b/tools/host-validate/rules/linux-iommu.yaml
new file mode 100644
index 0000000000..4f056e92ba
--- /dev/null
+++ b/tools/host-validate/rules/linux-iommu.yaml
@@ -0,0 +1,113 @@
+#
+# Define facts related to IOMMU availability
+#
+
+facts:
+- name: cpu.iommu.x86.intel.present
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.qemu
+          value: "true"
+      - fact:
+          name: cpu.family.x86
+          value: "true"
+      - fact:
+          name: cpu.vendor.intel
+          value: "true"
+  report:
+    message: Intel device assignment IOMMU present
+    level: note
+  hint:
+    message: IOMMU either disabled in BIOS or not supported by this hardware
+  value:
+    bool:
+      fact:
+        name: cpu.acpi.dmar
+        value: "true"
+- name: cpu.iommu.x86.amd.present
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: cpu.family.x86
+          value: "true"
+      - fact:
+          name: cpu.vendor.amd
+          value: "true"
+  report:
+    message: AMD device assignment IOMMU present
+    level: note
+  hint:
+    message: IOMMU either disabled in BIOS or not supported by this hardware
+  value:
+    bool:
+      fact:
+        name: cpu.acpi.ivrs
+        value: "true"
+- name: cpu.iommu.s390x.present
+  filter:
+    fact:
+      name: cpu.family.s390
+      value: "true"
+  report:
+    message: s390x device assignment IOMMU present
+    level: note
+  hint:
+    message: IOMMU either disabled in BIOS or not supported by this hardware
+  value:
+    bool:
+      fact:
+        match: exists
+        name: os.pci.devices.0
+- name: os.iommu.groups
+  value:
+    dirent:
+      ignoreMissing: true
+      path: /sys/kernel/iommu_groups
+- name: os.iommu.x86.intel.enabled
+  filter:
+    fact:
+      name: cpu.iommu.x86.intel.present
+      value: "true"
+  report:
+    message: Intel device assignment IOMMU enabled
+    level: warn
+  hint:
+    message: IOMMU disabled by the kernel. Pass 'intel_iommu=on' on the kernel command line
+  value:
+    bool:
+      fact:
+        name: os.iommu.groups.0
+        match: exists
+- name: os.iommu.x86.amd.enabled
+  filter:
+    fact:
+      name: cpu.iommu.x86.amd.present
+      value: "true"
+  report:
+    message: AMD device assignment IOMMU enabled
+    level: warn
+  hint:
+    message: IOMMU disabled by the kernel. Pass 'iommu=pt iommu=1' on the kernel command line
+  value:
+    bool:
+      fact:
+        name: os.iommu.groups.0
+        match: exists
+- name: os.iommu.s390x.enabled
+  filter:
+    fact:
+      name: cpu.iommu.s390x.present
+      value: "true"
+  report:
+    message: s390x device assignment IOMMU enabled
+    level: warn
+  hint:
+    message: IOMMU disabled by the kernel
+  value:
+    bool:
+      fact:
+        name: os.iommu.groups.0
+        match: exists
diff --git a/tools/host-validate/rules/linux-namespaces.yaml b/tools/host-validate/rules/linux-namespaces.yaml
new file mode 100644
index 0000000000..239d0c58e4
--- /dev/null
+++ b/tools/host-validate/rules/linux-namespaces.yaml
@@ -0,0 +1,119 @@
+#
+# Define facts related to Linux kernel namespaces
+#
+
+facts:
+- name: os.namespace.ipc
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.lxc
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: ipc process namespace
+  hint:
+    message: Enable ipc namespace in Kconfig
+  value:
+    access:
+      path: /proc/self/ns/ipc
+      check: exists
+- name: os.namespace.mnt
+  filter:
+    all:
+      expressions:
+      - any:
+          expressions:
+          - fact:
+              name: libvirt.driver.lxc
+              value: "true"
+          - fact:
+              name: libvirt.driver.qemu
+              value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: mnt process namespace
+  hint:
+    message: Enable mnt namespace in Kconfig
+  value:
+    access:
+      path: /proc/self/ns/mnt
+      check: exists
+- name: os.namespace.pid
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.lxc
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: pid process namespace
+  hint:
+    message: Enable pid namespace in Kconfig
+  value:
+    access:
+      path: /proc/self/ns/pid
+      check: exists
+- name: os.namespace.uts
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.lxc
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: uts process namespace
+  hint:
+    message: Enable uts namespace in Kconfig
+  value:
+    access:
+      path: /proc/self/ns/uts
+      check: exists
+- name: os.namespace.net
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.lxc
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    message: net process namespace
+  hint:
+    message: Enable net namespace in Kconfig
+  value:
+    access:
+      path: /proc/self/ns/net
+      check: exists
+- name: os.namespace.user
+  filter:
+    all:
+      expressions:
+      - fact:
+          name: libvirt.driver.lxc
+          value: "true"
+      - fact:
+          name: os.kernel
+          value: Linux
+  report:
+    level: warn
+    message: user process namespace
+  hint:
+    message: Enable user namespace in Kconfig
+  value:
+    access:
+      path: /proc/self/ns/user
+      check: exists
diff --git a/tools/host-validate/rules/linux-pci.yaml b/tools/host-validate/rules/linux-pci.yaml
new file mode 100644
index 0000000000..facb67f4e9
--- /dev/null
+++ b/tools/host-validate/rules/linux-pci.yaml
@@ -0,0 +1,10 @@
+#
+# Define facts related to physical PCI devices on the host system
+#
+
+facts:
+- name: os.pci.devices
+  value:
+    dirent:
+      path: /sys/bus/pci/devices
+      ignoreMissing: true
-- 
2.21.0

--
libvir-list mailing list
libvir-list@xxxxxxxxxx
https://www.redhat.com/mailman/listinfo/libvir-list




[Index of Archives]     [Virt Tools]     [Libvirt Users]     [Lib OS Info]     [Fedora Users]     [Fedora Desktop]     [Fedora SELinux]     [Big List of Linux Books]     [Yosemite News]     [KDE Users]     [Fedora Tools]

  Powered by Linux