source/cpu: make cpuid configurable

Add 'cpuid/attributeBlacklist' and 'cpuid/attributeWhitelist' config
options for the cpu feature source. These can be used to filter the set
of cpuid capabilities that get published. The intention is to reduce
clutter in the NFD label space, getting rid of "obvious" or misleading
cpuid labels. Whitelisting has higher priority, i.e.  only whitelist
takes effect if both attributeWhitelist and attributeBlacklist are
specified.

README.md

@@ -215,6 +215,16 @@ such as restricting discovered features with the --label-whitelist option._
 | <br>                    | RDTL2CA            | Intel L2 Cache Allocation Technology
 | <br>                    | RDTMBA             | Intel Memory Bandwidth Allocation (MBA) Technology
 
+The (sub-)set of CPUID attributes to publish is configurable via the
+`attributeBlacklist` and `attributeWhitelist` cpuid options of the cpu source.
+If whitelist is specified, only whitelisted attributes will be published. With
+blacklist, only blacklisted attributes are filtered out. `attributeWhitelist`
+has priority over `attributeBlacklist`.  For examples and more information
+about configurability, see [Configuration Options](#configuration-options).
+By default, the following CPUID flags have been blacklisted:
+BMI1, BMI2, CLMUL, CMOV, CX16, ERMS, F16C, HTT, LZCNT, MMX, MMXEXT, NX, POPCNT,
+RDRAND, RDSEED, RDTSCP, SGX, SSE, SSE2, SSE3, SSE4.1, SSE4.2 and SSSE3.
+
 **NOTE** The cpuid features advertise *supported* CPU capabilities, that is, a
 capability might be supported but not enabled.
 
@@ -227,11 +237,6 @@ capability might be supported but not enabled.
 | AESNI     | Advanced Encryption Standard (AES) New Instructions (AES-NI)
 | AVX       | Advanced Vector Extensions (AVX)
 | AVX2      | Advanced Vector Extensions 2 (AVX2)
-| BMI1      | Bit Manipulation Instruction Set 1 (BMI)
-| BMI2      | Bit Manipulation Instruction Set 2 (BMI2)
-| SSE4.1    | Streaming SIMD Extensions 4.1 (SSE4.1)
-| SSE4.2    | Streaming SIMD Extensions 4.2 (SSE4.2)
-| SGX       | Software Guard Extensions (SGX)
 
 #### Arm64 CPUID Attribute (Partial List)
 
@@ -552,7 +557,8 @@ Configuration options specified from the command line will override those read
 from the config file.
 
 Currently, the only available configuration options are related to the
-[PCI](#pci-features) and [Kernel](#kernel-features) feature sources.
+[CPU](#cpu-features), [PCI](#pci-features) and [Kernel](#kernel-features)
+feature sources.
 
 ## Building from source
 

nfd-worker.conf.example

@@ -1,4 +1,32 @@
 #sources:
+#  cpu:
+#    cpuid:
+##     NOTE: whitelist has priority over blacklist
+#      attributeBlacklist:
+#        - "BMI1"
+#        - "BMI2"
+#        - "CLMUL"
+#        - "CMOV"
+#        - "CX16"
+#        - "ERMS"
+#        - "F16C"
+#        - "HTT"
+#        - "LZCNT"
+#        - "MMX"
+#        - "MMXEXT"
+#        - "NX"
+#        - "POPCNT"
+#        - "RDRAND"
+#        - "RDSEED"
+#        - "RDTSCP"
+#        - "SGX"
+#        - "SSE"
+#        - "SSE2"
+#        - "SSE3"
+#        - "SSE4.1"
+#        - "SSE4.2"
+#        - "SSSE3"
+#      attributeWhitelist:
 #  kernel:
 #    kconfigFile: "/path/to/kconfig"
 #    configOpts:

pkg/nfd-worker/nfd-worker.go

@@ -58,6 +58,7 @@ var (
 // Global config
 type NFDConfig struct {
 	Sources struct {
+		Cpu    *cpu.NFDConfig    `json:"cpu,omitempty"`
 		Kernel *kernel.NFDConfig `json:"kernel,omitempty"`
 		Pci    *pci.NFDConfig    `json:"pci,omitempty"`
 	} `json:"sources,omitempty"`
@@ -197,6 +198,7 @@ func (w *nfdWorker) Run() error {
 
 // Parse configuration options
 func configParse(filepath string, overrides string) error {
+	config.Sources.Cpu = &cpu.Config
 	config.Sources.Kernel = &kernel.Config
 	config.Sources.Pci = &pci.Config
 

source/cpu/cpu.go

@@ -28,6 +28,57 @@ const (
 	cpuDevicesBaseDir = "/sys/bus/cpu/devices"
 )
 
+// Configuration file options
+type cpuidConfig struct {
+	AttributeBlacklist []string `json:"attributeBlacklist,omitempty"`
+	AttributeWhitelist []string `json:"attributeWhitelist,omitempty"`
+}
+
+// NFDConfig is the type holding configuration of the cpuid feature source
+type NFDConfig struct {
+	Cpuid cpuidConfig `json:"cpuid,omitempty"`
+}
+
+// Config contains the configuration of the cpuid source
+var Config = NFDConfig{
+	cpuidConfig{
+		AttributeBlacklist: []string{
+			"BMI1",
+			"BMI2",
+			"CLMUL",
+			"CMOV",
+			"CX16",
+			"ERMS",
+			"F16C",
+			"HTT",
+			"LZCNT",
+			"MMX",
+			"MMXEXT",
+			"NX",
+			"POPCNT",
+			"RDRAND",
+			"RDSEED",
+			"RDTSCP",
+			"SGX",
+			"SSE",
+			"SSE2",
+			"SSE3",
+			"SSE4.1",
+			"SSE4.2",
+			"SSSE3",
+		},
+		AttributeWhitelist: []string{},
+	},
+}
+
+// Filter for cpuid labels
+type keyFilter struct {
+	keys      map[string]struct{}
+	whitelist bool
+}
+
+var cpuidFilter *keyFilter
+
 // Implement FeatureSource interface
 type Source struct{}
 
@@ -36,6 +87,11 @@ func (s Source) Name() string { return "cpu" }
 func (s Source) Discover() (source.Features, error) {
 	features := source.Features{}
 
+	if cpuidFilter == nil {
+		initCpuidFilter()
+	}
+	log.Printf("CONF: %s", Config)
+
 	// Check if hyper-threading seems to be enabled
 	found, err := haveThreadSiblings()
 	if err != nil {
@@ -55,7 +111,9 @@ func (s Source) Discover() (source.Features, error) {
 	// Detect CPUID
 	cpuidFlags := getCpuidFlags()
 	for _, f := range cpuidFlags {
-		features["cpuid."+f] = true
+		if cpuidFilter.unmask(f) {
+			features["cpuid."+f] = true
+		}
 	}
 
 	// Detect turbo boost
@@ -98,3 +156,32 @@ func haveThreadSiblings() (bool, error) {
 	// No siblings were found
 	return false, nil
 }
+
+func initCpuidFilter() {
+	newFilter := keyFilter{keys: map[string]struct{}{}}
+	if len(Config.Cpuid.AttributeWhitelist) > 0 {
+		for _, k := range Config.Cpuid.AttributeWhitelist {
+			newFilter.keys[k] = struct{}{}
+		}
+		newFilter.whitelist = true
+	} else {
+		for _, k := range Config.Cpuid.AttributeBlacklist {
+			newFilter.keys[k] = struct{}{}
+		}
+		newFilter.whitelist = false
+	}
+	cpuidFilter = &newFilter
+}
+
+func (f keyFilter) unmask(k string) bool {
+	if f.whitelist {
+		if _, ok := f.keys[k]; ok {
+			return true
+		}
+	} else {
+		if _, ok := f.keys[k]; !ok {
+			return true
+		}
+	}
+	return false
+}