hardware: Add validation for 'cpu_realtime_mask'

It's possible to specify some strange values for the cpu realtime mask
and the code won't currently complain, so let's make it a bit more
strict.

Change-Id: I0ba06529affe5b48af5ac37bc24242dffdac77d3
Closes-Bug: #1884231

nova/tests/unit/virt/test_hardware.py

@@ -3658,7 +3658,8 @@ class CPURealtimeTestCase(test.NoDBTestCase):
             exception.RealtimeMaskNotFoundOrInvalid,
             hw.vcpus_realtime_topology, flavor, image)
 
-    def test_mask_badly_configured(self):
+    def test_invalid_mask_no_rt_cpus(self):
+        # The mask excludes all vCPUs from being RT
         flavor = objects.Flavor(vcpus=3, memory_mb=2048,
                                 extra_specs={"hw:cpu_realtime_mask": "^0-2"})
         image = objects.ImageMeta.from_dict({"properties": {}})
@@ -3666,6 +3667,44 @@ class CPURealtimeTestCase(test.NoDBTestCase):
             exception.RealtimeMaskNotFoundOrInvalid,
             hw.vcpus_realtime_topology, flavor, image)
 
+    def test_invalid_mask_exclude_out_of_range(self):
+        # The mask excludes an invalidly high vCPU number.
+        flavor = objects.Flavor(vcpus=3, memory_mb=2048,
+                                extra_specs={"hw:cpu_realtime_mask": "^3"})
+        image = objects.ImageMeta.from_dict({"properties": {}})
+        self.assertRaises(
+            exception.RealtimeMaskNotFoundOrInvalid,
+            hw.vcpus_realtime_topology, flavor, image)
+
+    def test_explicit_range(self):
+        # The mask is not just an exclusion mask.  This is unexpected but
+        # the code doesn't prevent it.
+        flavor = objects.Flavor(vcpus=3, memory_mb=2048,
+                                extra_specs={"hw:cpu_realtime_mask": "0-2,^0"})
+        image = objects.ImageMeta.from_dict({"properties": {}})
+        rt = hw.vcpus_realtime_topology(flavor, image)
+        self.assertEqual({1, 2}, rt)
+
+    def test_invalid_mask_no_exclusion_wo_emulator_policy(self):
+        # The mask has no exclusion and there's no emulator thread policy
+        # configured
+        flavor = objects.Flavor(vcpus=3, memory_mb=2048,
+                                extra_specs={"hw:cpu_realtime_mask": "0-2"})
+        image = objects.ImageMeta.from_dict({"properties": {}})
+        self.assertRaises(
+            exception.RealtimeMaskNotFoundOrInvalid,
+            hw.vcpus_realtime_topology, flavor, image)
+
+    def test_invalid_mask_rt_cpus_out_of_range(self):
+        # The mask is not just an exclusion mask, and the RT range specifies
+        # an invalid vCPU number.
+        flavor = objects.Flavor(vcpus=3, memory_mb=2048,
+                                extra_specs={"hw:cpu_realtime_mask": "0-3,^0"})
+        image = objects.ImageMeta.from_dict({"properties": {}})
+        self.assertRaises(
+            exception.RealtimeMaskNotFoundOrInvalid,
+            hw.vcpus_realtime_topology, flavor, image)
+
 
 class EmulatorThreadsTestCase(test.NoDBTestCase):
 

nova/virt/hardware.py

@@ -1720,10 +1720,21 @@ def vcpus_realtime_topology(
     if not mask:
         raise exception.RealtimeMaskNotFoundOrInvalid()
 
+    vcpus_set = set(range(flavor.vcpus))
     vcpus_rt = parse_cpu_spec("0-%d,%s" % (flavor.vcpus - 1, mask))
-    if len(vcpus_rt) < 1:
+
+    if not vcpus_rt:
         raise exception.RealtimeMaskNotFoundOrInvalid()
 
+    if vcpus_set == vcpus_rt:
+        raise exception.RealtimeMaskNotFoundOrInvalid()
+
+    if not vcpus_rt.issubset(vcpus_set):
+        msg = _("Realtime policy vCPU(s) mask is configured with RT vCPUs "
+                "that are not a subset of the vCPUs in the flavor. See "
+                "hw:cpu_realtime_mask or hw_cpu_realtime_mask")
+        raise exception.RealtimeMaskNotFoundOrInvalid(msg)
+
     return vcpus_rt
 
 

releasenotes/notes/bug-1884231-16acf297d88b122e.yaml

@@ -0,0 +1,6 @@
+---
+fixes:
+  - |
+    Previously, it was possible to specify values for the
+    ``hw:cpu_realtime_mask`` extra spec that were not within the range of valid
+    instances cores. This value is now correctly validated.