Hi guys,
This is another try to allow userspace to change ID_AA64PFR1_EL1, and we want to
give userspace the ability to control the visible feature set for a VM, which
could be used by userspace in such a way to transparently migrate VMs.
The patch series have four part:
The first patch disable those fields which KVM doesn't know how to handle, so
KVM will only expose value 0 of those fields to the guest.
The second patch check the FEAT_SSBS in guest IDREG instead of the cpu
capability.
The third patch allow userspace to change ID_AA64PFR1_EL1, it only advertise the
fields known to KVM and leave others unadvertise.
The fourth patch adds the kselftest to test if userspace can change the
ID_AA64PFR1_EL1.
Besides, I also noticed there is another patch [1] which try to make the
ID_AA64PFR1_EL1 writable. This patch [1] is try to enable GCS on baremental, and
add GCS support for the guest. What I understand is if we have GCS support on
baremental, it will be clear to how to handle them in KVM. And same for other
fields like NMI, THE, DF2, MTEX.. At that time, they can be writable.
[1] [PATCH v9 13/39] KVM: arm64: Manage GCS registers for guests
https://lore.kernel.org/all/20240625-arm64-gcs-v9-13-0f634469b8f0@kernel.or…
Changelog:
----------
v4 -> v5:
* Only advertise fields which KVM know how to handle to userspace, leave
others unadvertised.
* Add a new patch to check FEAT_SSBS in IDREG instead of cpu capability.
* Tweak the kselftest writable fields.
* Improve the commit message.
v3 -> v4:
* Add a new patch to disable some feature which KVM doesn't know how to
handle in the register accessor.
* Handle all the fields in the register.
* Fixes a small cnt issue in kselftest.
v2 -> v3:
* Give more description about why only part of the fields can be writable.
* Updated the writable mask by referring the latest ARM spec.
v1 -> v2:
* Tackling the full register instead of single field.
* Changing the patch title and commit message.
RFCv1 -> v1:
* Fix the compilation error.
* Delete the machine specific information and make the description more
generable.
RFCv1: https://lore.kernel.org/all/20240612023553.127813-1-shahuang@redhat.com/
v1: https://lore.kernel.org/all/20240617075131.1006173-1-shahuang@redhat.com/
v2: https://lore.kernel.org/all/20240618063808.1040085-1-shahuang@redhat.com/
v3: https://lore.kernel.org/all/20240628060454.1936886-2-shahuang@redhat.com/
v4: https://lore.kernel.org/all/20240718035017.434996-1-shahuang@redhat.com/
Shaoqin Huang (4):
KVM: arm64: Disable fields that KVM doesn't know how to handle in
ID_AA64PFR1_EL1
KVM: arm64: Use kvm_has_feat() to check if FEAT_SSBS is advertised to
the guest
KVM: arm64: Allow userspace to change ID_AA64PFR1_EL1
KVM: selftests: aarch64: Add writable test for ID_AA64PFR1_EL1
arch/arm64/kvm/hypercalls.c | 12 +++++-----
arch/arm64/kvm/sys_regs.c | 22 ++++++++++++++++++-
.../selftests/kvm/aarch64/set_id_regs.c | 14 +++++++++---
3 files changed, 38 insertions(+), 10 deletions(-)
--
2.40.1
If a BPF selftest program requires (recent) UAPI headers [1], it is
currently needed to duplicate these header files into tools/include/uapi.
That's not a good solution, because it is a duplication that needs to be
kept up-to-date, while the required files are only a few directories
away.
A solution to avoid these duplicated files is to use the KHDR_INCLUDES
from the kselftest infrastructure. That is what is being done in the
first patch.
The second patch removes 'if_xdp.h', which is no longer needed, and was
causing a warning when building the libbpf required by the BPF
selftests. There could be more duplicated UAPI header files that could
be removed, but I didn't spend too much time checking which ones are not
used by anything else from the 'tools' directory.
Hopefully, these modifications should not cause any issues on the
different CIs, because it is using the recommended method for the kernel
selftests. If this causes issues on the CIs side, it should be easy to
fix by overriding the KHDR_INCLUDES variable, and it might be better to
do that, because it likely means the CI is not following the recommended
way to execute the kernel selftests. See patch 1/2 for more details
about that.
Link: https://lore.kernel.org/all/08f925cd-e267-4a6b-84b1-792515c4e199@kernel.org… [1]
Signed-off-by: Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
---
Matthieu Baerts (NGI0) (2):
selftests: bpf: use KHDR_INCLUDES for the UAPI headers
selftests: bpf: remove duplicated UAPI if_xdp headers
tools/include/uapi/linux/if_xdp.h | 173 ---------------------
tools/lib/bpf/Makefile | 3 -
tools/testing/selftests/bpf/Makefile | 2 +-
.../selftests/bpf/prog_tests/assign_reuse.c | 2 +-
tools/testing/selftests/bpf/prog_tests/tc_links.c | 4 +-
tools/testing/selftests/bpf/prog_tests/tc_netkit.c | 2 +-
tools/testing/selftests/bpf/prog_tests/tc_opts.c | 2 +-
.../selftests/bpf/prog_tests/user_ringbuf.c | 2 +-
.../testing/selftests/bpf/prog_tests/xdp_bonding.c | 2 +-
.../selftests/bpf/prog_tests/xdp_cpumap_attach.c | 2 +-
.../selftests/bpf/prog_tests/xdp_devmap_attach.c | 2 +-
.../selftests/bpf/prog_tests/xdp_do_redirect.c | 2 +-
tools/testing/selftests/bpf/prog_tests/xdp_link.c | 2 +-
tools/testing/selftests/bpf/xdp_features.c | 4 +-
14 files changed, 14 insertions(+), 190 deletions(-)
---
base-commit: fdf1c728fac541891ef1aa773bfd42728626769c
change-id: 20240816-ups-bpf-next-selftests-use-khdr-28f935c8848a
Best regards,
--
Matthieu Baerts (NGI0) <matttbe(a)kernel.org>
The relative RPATH ("./") supplied to linker options in CFLAGS is resolved
relative to current working directory and not the executable directory,
which will lead in incorrect resolution when the test executables are run
from elsewhere. Changing it to $ORIGIN makes it resolve relative
to the directory in which the executables reside, which is supposedly
the desired behaviour. This patch also moves these CFLAGS to lib.mk,
so the RPATH is provided for all selftest binaries, which is arguably
a useful default.
Comparison of
find -type f -perm /111 -print0 | sort -z | xargs -0 ldd 2>&1 | sed 's/([^)]*)//'
output before and after the change shows that only the binaries that
previously used RPATH of "," are affected and that the linker now able
to find the used dynamic libraries when the executable invoked outside
directory it resides in:
$ diff -U 0 old_ldd new_ldd
--- old_ldd 2024-08-12 08:00:16.093535910 -0400
+++ new_ldd 2024-08-09 09:58:22.657883491 -0400
@@ -10 +10 @@
- libatest.so => not found
+ libatest.so => /home/build/linux/tools/testing/selftests/./alsa/libatest.so
@@ -17 +17 @@
- libatest.so => not found
+ libatest.so => /home/build/linux/tools/testing/selftests/./alsa/libatest.so
@@ -24 +24 @@
- libatest.so => not found
+ libatest.so => /home/build/linux/tools/testing/selftests/./alsa/libatest.so
@@ -119 +119 @@
- liburandom_read.so => not found
+ liburandom_read.so => /home/build/linux/tools/testing/selftests/./bpf/no_alu32/liburandom_read.so
@@ -445 +445 @@
- liburandom_read.so => not found
+ liburandom_read.so => /home/build/linux/tools/testing/selftests/./bpf/liburandom_read.so
@@ -3321 +3321 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
@@ -3326 +3326 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
@@ -3331 +3331 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
@@ -3340 +3340 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
@@ -3345 +3345 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
@@ -3350 +3350 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
@@ -3355 +3355 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
@@ -3360 +3360 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
@@ -3365 +3365 @@
- librseq.so => not found
+ librseq.so => /home/build/linux/tools/testing/selftests/./rseq/librseq.so
Some minimal testing is done to verify that it does not affect the
tests: alsa, rseq, and sched (which also had the RPATH tag but didn't
actually link against any locally built libraries) selftests are run
successfully before and after the change; for the rest
of the selftests, there was no regression observed as well.
Discovered by the check-rpaths script[1][2] that checks for insecure
RPATH/RUNPATH[3], such as relative directories, during an attempt
to package BPF selftests for later use in CI:
ERROR 0004: file '/usr/libexec/kselftests/bpf/urandom_read' contains an insecure runpath '.' in [.]
[1] https://github.com/rpm-software-management/rpm/blob/master/scripts/check-rp…
[2] https://github.com/rpm-software-management/rpm/blob/master/scripts/check-rp…
[3] https://cwe.mitre.org/data/definitions/426.html
Signed-off-by: Eugene Syromiatnikov <esyr(a)redhat.com>
---
v2:
- Consolidated the updated -L/-Wl,-rpath setting into lib.mk
- Described the testing done in the commit message
v1: https://lore.kernel.org/lkml/20240808145639.GA20510@asgard.redhat.com/https://lore.kernel.org/lkml/20240808151335.GA5495@asgard.redhat.com/https://lore.kernel.org/lkml/20240808151621.GA10025@asgard.redhat.com/https://lore.kernel.org/lkml/20240808151621.GA10025@asgard.redhat.com/
---
tools/testing/selftests/alsa/Makefile | 1 -
tools/testing/selftests/bpf/Makefile | 5 ++---
tools/testing/selftests/lib.mk | 3 +++
tools/testing/selftests/rseq/Makefile | 2 +-
tools/testing/selftests/sched/Makefile | 3 +--
5 files changed, 7 insertions(+), 7 deletions(-)
diff --git a/tools/testing/selftests/alsa/Makefile b/tools/testing/selftests/alsa/Makefile
index c1ce39874e2b..68a1651360e5 100644
--- a/tools/testing/selftests/alsa/Makefile
+++ b/tools/testing/selftests/alsa/Makefile
@@ -6,7 +6,6 @@ LDLIBS += $(shell pkg-config --libs alsa)
ifeq ($(LDLIBS),)
LDLIBS += -lasound
endif
-CFLAGS += -L$(OUTPUT) -Wl,-rpath=./
LDLIBS+=-lpthread
diff --git a/tools/testing/selftests/bpf/Makefile b/tools/testing/selftests/bpf/Makefile
index 81d4757ecd4c..a152c12b8a3b 100644
--- a/tools/testing/selftests/bpf/Makefile
+++ b/tools/testing/selftests/bpf/Makefile
@@ -239,9 +239,8 @@ $(OUTPUT)/urandom_read: urandom_read.c urandom_read_aux.c $(OUTPUT)/liburandom_r
$(call msg,BINARY,,$@)
$(Q)$(CLANG) $(CLANG_TARGET_ARCH) \
$(filter-out -static,$(CFLAGS) $(LDFLAGS)) $(filter %.c,$^) \
- -lurandom_read $(filter-out -static,$(LDLIBS)) -L$(OUTPUT) \
- -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 \
- -Wl,-rpath=. -o $@
+ -lurandom_read $(filter-out -static,$(LDLIBS)) \
+ -fuse-ld=$(LLD) -Wl,-znoseparate-code -Wl,--build-id=sha1 -o $@
$(OUTPUT)/sign-file: ../../../../scripts/sign-file.c
$(call msg,SIGN-FILE,,$@)
diff --git a/tools/testing/selftests/lib.mk b/tools/testing/selftests/lib.mk
index d6edcfcb5be8..d75a20bb569c 100644
--- a/tools/testing/selftests/lib.mk
+++ b/tools/testing/selftests/lib.mk
@@ -199,6 +199,9 @@ clean: $(if $(TEST_GEN_MODS_DIR),clean_mods_dir)
# Build with _GNU_SOURCE by default
CFLAGS += -D_GNU_SOURCE=
+# Simplify usage of libraries built alongside the test executables
+CFLAGS += -L$(OUTPUT) -Wl,-rpath=\$$ORIGIN/
+
# Enables to extend CFLAGS and LDFLAGS from command line, e.g.
# make USERCFLAGS=-Werror USERLDFLAGS=-static
CFLAGS += $(USERCFLAGS)
diff --git a/tools/testing/selftests/rseq/Makefile b/tools/testing/selftests/rseq/Makefile
index 5a3432fceb58..887b45d4a675 100644
--- a/tools/testing/selftests/rseq/Makefile
+++ b/tools/testing/selftests/rseq/Makefile
@@ -6,7 +6,7 @@ endif
top_srcdir = ../../../..
-CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) -L$(OUTPUT) -Wl,-rpath=./ \
+CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) \
$(CLANG_FLAGS) -I$(top_srcdir)/tools/include
LDLIBS += -lpthread -ldl
diff --git a/tools/testing/selftests/sched/Makefile b/tools/testing/selftests/sched/Makefile
index 099ee9213557..0e4581ded9d6 100644
--- a/tools/testing/selftests/sched/Makefile
+++ b/tools/testing/selftests/sched/Makefile
@@ -4,8 +4,7 @@ ifneq ($(shell $(CC) --version 2>&1 | head -n 1 | grep clang),)
CLANG_FLAGS += -no-integrated-as
endif
-CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) -Wl,-rpath=./ \
- $(CLANG_FLAGS)
+CFLAGS += -O2 -Wall -g -I./ $(KHDR_INCLUDES) $(CLANG_FLAGS)
LDLIBS += -lpthread
TEST_GEN_FILES := cs_prctl_test
--
2.28.0
Currently while accessing debugfs with Secure Boot enabled on PowerPC,
it is causing the kprobe_opt_types.tc test to fail. Below is the snippet
of the error:
+++ grep kernel_clone /sys/kernel/debug/kprobes/list
grep: /sys/kernel/debug/kprobes/list: Operation not permitted
++ PROBE=
+ '[' 2 -ne 0 ']'
+ kill -s 37 7595
++ SIG_RESULT=1
+ eval_result 1
+ case $1 in
+ prlog ' [\033[31mFAIL\033[0m]'
+ newline='\n'
+ '[' ' [\033[31mFAIL\033[0m]' = -n ']'
+ printf ' [\033[31mFAIL\033[0m]\n'
[FAIL]
This is happening when secure boot is enabled, as it enables lockdown
by default. With lockdown, access to certain debug features and
filesystems like debugfs may be restricted or completely disabled.
To fix this, modify the test to check for Secure Boot status using
lsprop /proc/device-tree/ibm,secure-boot. And, skip execution of the
test on PowerPC if Secure Boot is enabled (00000002).
With this patch, test skips as unsupported:
=== Ftrace unit tests ===
[1] Register/unregister optimized probe [UNSUPPORTED]
Signed-off-by: Akanksha J N <akanksha(a)linux.ibm.com>
---
.../selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc | 5 +++++
1 file changed, 5 insertions(+)
diff --git a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc
index 9f5d99328086..925e74d6acc7 100644
--- a/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc
+++ b/tools/testing/selftests/ftrace/test.d/kprobe/kprobe_opt_types.tc
@@ -10,6 +10,11 @@ x86_64)
arm*)
;;
ppc*)
+ lsprop_output=$(lsprop /proc/device-tree/ibm,secure-boot)
+ if echo "$lsprop_output" | grep -q "00000002"; then
+ echo "Secure Boot is enabled on PowerPC."
+ exit_unsupported
+ fi
;;
*)
echo "Please implement other architecture here"
--
2.45.2
This test validates that the mapping between a mm_cid and a NUMA node id
remains invariant for the process lifetime for a process with a number of
threads >= number of allowed CPUs. In other words, it validates that if
any thread within the process running on behalf of a mm_cid N observes a
NUMA node id M, all threads within this process will always observe the
same NUMA node id value when running on behalf of that same mm_cid.
This characteristic is important for NUMA locality.
On all architectures except Power, the NUMA topology is never
reconfigured after a CPU has been associated with a NUMA node in the
system lifetime. Even on Power, we can assume that NUMA topology
reconfiguration happens rarely, and therefore we do not expect it to
happen while the NUMA test is running.
As a result the NUMA node id associated with a mm_cid should be
invariant as long as:
- A process has a number of threads >= number of allowed CPUs,
- The allowed CPUs mask is unchanged, and
- The NUMA configuration is unchanged.
This test is skipped on architectures that do not implement
rseq_load_u32_u32.
Signed-off-by: Mathieu Desnoyers <mathieu.desnoyers(a)efficios.com>
Reviewed-by: Shuah Khan <skhan(a)linuxfoundation.org>
Cc: Peter Zijlstra <peterz(a)infradead.org>
Cc: Ingo Molnar <mingo(a)redhat.com>
Cc: Shuah Khan <skhan(a)linuxfoundation.org>
Cc: linux-kselftest(a)vger.kernel.org
---
tools/testing/selftests/rseq/.gitignore | 1 +
tools/testing/selftests/rseq/Makefile | 2 +-
.../testing/selftests/rseq/basic_numa_test.c | 144 ++++++++++++++++++
3 files changed, 146 insertions(+), 1 deletion(-)
create mode 100644 tools/testing/selftests/rseq/basic_numa_test.c
diff --git a/tools/testing/selftests/rseq/.gitignore b/tools/testing/selftests/rseq/.gitignore
index 16496de5f6ce..8a8d163cbb9f 100644
--- a/tools/testing/selftests/rseq/.gitignore
+++ b/tools/testing/selftests/rseq/.gitignore
@@ -1,4 +1,5 @@
# SPDX-License-Identifier: GPL-2.0-only
+basic_numa_test
basic_percpu_ops_test
basic_percpu_ops_mm_cid_test
basic_test
diff --git a/tools/testing/selftests/rseq/Makefile b/tools/testing/selftests/rseq/Makefile
index 5a3432fceb58..9ef1c949114a 100644
--- a/tools/testing/selftests/rseq/Makefile
+++ b/tools/testing/selftests/rseq/Makefile
@@ -14,7 +14,7 @@ LDLIBS += -lpthread -ldl
# still track changes to header files and depend on shared object.
OVERRIDE_TARGETS = 1
-TEST_GEN_PROGS = basic_test basic_percpu_ops_test basic_percpu_ops_mm_cid_test param_test \
+TEST_GEN_PROGS = basic_test basic_numa_test basic_percpu_ops_test basic_percpu_ops_mm_cid_test param_test \
param_test_benchmark param_test_compare_twice param_test_mm_cid \
param_test_mm_cid_benchmark param_test_mm_cid_compare_twice
diff --git a/tools/testing/selftests/rseq/basic_numa_test.c b/tools/testing/selftests/rseq/basic_numa_test.c
new file mode 100644
index 000000000000..8e51c662057d
--- /dev/null
+++ b/tools/testing/selftests/rseq/basic_numa_test.c
@@ -0,0 +1,144 @@
+// SPDX-License-Identifier: LGPL-2.1
+/*
+ * Basic rseq NUMA test. Validate that (mm_cid, numa_node_id) pairs are
+ * invariant when the number of threads >= number of allowed CPUs, as
+ * long as those preconditions are respected:
+ *
+ * - A process has a number of threads >= number of allowed CPUs,
+ * - The allowed CPUs mask is unchanged, and
+ * - The NUMA configuration is unchanged.
+ */
+#define _GNU_SOURCE
+#include <assert.h>
+#include <sched.h>
+#include <signal.h>
+#include <stdio.h>
+#include <string.h>
+#include <poll.h>
+#include <sys/time.h>
+
+#include "rseq.h"
+
+#define NR_LOOPS 100
+
+static int nr_threads, nr_active_threads, test_go, test_stop;
+
+#ifdef RSEQ_ARCH_HAS_LOAD_U32_U32
+
+static int cpu_numa_id[CPU_SETSIZE];
+
+static int get_affinity_weight(void)
+{
+ cpu_set_t allowed_cpus;
+
+ if (sched_getaffinity(0, sizeof(allowed_cpus), &allowed_cpus)) {
+ perror("sched_getaffinity");
+ abort();
+ }
+ return CPU_COUNT(&allowed_cpus);
+}
+
+static void numa_id_init(void)
+{
+ int i;
+
+ for (i = 0; i < CPU_SETSIZE; i++)
+ cpu_numa_id[i] = -1;
+}
+
+static void *test_thread(void *arg)
+{
+ int i;
+
+ if (rseq_register_current_thread()) {
+ fprintf(stderr, "Error: rseq_register_current_thread(...) failed(%d): %s\n",
+ errno, strerror(errno));
+ abort();
+ }
+ /*
+ * Rendez-vous across all threads to make sure the number of
+ * threads >= number of possible CPUs for the entire test duration.
+ */
+ if (__atomic_add_fetch(&nr_active_threads, 1, __ATOMIC_RELAXED) == nr_threads)
+ __atomic_store_n(&test_go, 1, __ATOMIC_RELAXED);
+ while (!__atomic_load_n(&test_go, __ATOMIC_RELAXED))
+ rseq_barrier();
+
+ for (i = 0; i < NR_LOOPS; i++) {
+ uint32_t mm_cid, node;
+ int cached_node_id;
+
+ while (rseq_load_u32_u32(RSEQ_MO_RELAXED, &mm_cid,
+ &rseq_get_abi()->mm_cid,
+ &node, &rseq_get_abi()->node_id) != 0) {
+ /* Retry. */
+ }
+ cached_node_id = RSEQ_READ_ONCE(cpu_numa_id[mm_cid]);
+ if (cached_node_id == -1) {
+ RSEQ_WRITE_ONCE(cpu_numa_id[mm_cid], node);
+ } else {
+ if (node != cached_node_id) {
+ fprintf(stderr, "Error: NUMA node id discrepancy: mm_cid %u cached node id %d node id %u.\n",
+ mm_cid, cached_node_id, node);
+ fprintf(stderr, "This is likely a kernel bug, or caused by a concurrent NUMA topology reconfiguration.\n");
+ abort();
+ }
+ }
+ (void) poll(NULL, 0, 10); /* wait 10ms */
+ }
+ /*
+ * Rendez-vous before exiting all threads to make sure the
+ * number of threads >= number of possible CPUs for the entire
+ * test duration.
+ */
+ if (__atomic_sub_fetch(&nr_active_threads, 1, __ATOMIC_RELAXED) == 0)
+ __atomic_store_n(&test_stop, 1, __ATOMIC_RELAXED);
+ while (!__atomic_load_n(&test_stop, __ATOMIC_RELAXED))
+ rseq_barrier();
+
+ if (rseq_unregister_current_thread()) {
+ fprintf(stderr, "Error: rseq_unregister_current_thread(...) failed(%d): %s\n",
+ errno, strerror(errno));
+ abort();
+ }
+ return NULL;
+}
+
+static int test_numa(void)
+{
+ pthread_t tid[nr_threads];
+ int err, i;
+ void *tret;
+
+ numa_id_init();
+
+ printf("testing rseq (mm_cid, numa_node_id) invariant, multi-threaded (%d threads)\n",
+ nr_threads);
+
+ for (i = 0; i < nr_threads; i++) {
+ err = pthread_create(&tid[i], NULL, test_thread, NULL);
+ if (err != 0)
+ abort();
+ }
+
+ for (i = 0; i < nr_threads; i++) {
+ err = pthread_join(tid[i], &tret);
+ if (err != 0)
+ abort();
+ }
+
+ return 0;
+}
+#else
+static int test_numa(void)
+{
+ fprintf(stderr, "rseq_load_u32_u32 is not implemented on this architecture. Skipping numa test.\n");
+ return 0;
+}
+#endif
+
+int main(int argc, char **argv)
+{
+ nr_threads = get_affinity_weight();
+ return test_numa();
+}
--
2.39.2
This option makes IP6_NF_IPTABLES_LEGACY user selectable, giving
users the option to configure iptables without enabling any other
config.
Signed-off-by: Breno Leitao <leitao(a)debian.org>
---
net/ipv6/netfilter/Kconfig | 22 ++++++++++++----------
tools/testing/selftests/net/config | 1 +
2 files changed, 13 insertions(+), 10 deletions(-)
diff --git a/net/ipv6/netfilter/Kconfig b/net/ipv6/netfilter/Kconfig
index f3c8e2d918e1..dad0a50d3ef4 100644
--- a/net/ipv6/netfilter/Kconfig
+++ b/net/ipv6/netfilter/Kconfig
@@ -8,7 +8,13 @@ menu "IPv6: Netfilter Configuration"
# old sockopt interface and eval loop
config IP6_NF_IPTABLES_LEGACY
- tristate
+ tristate "Legacy IP6 tables support"
+ depends on INET && IPV6
+ select NETFILTER_XTABLES
+ default n
+ help
+ ip6tables is a general, extensible packet identification legacy framework.
+ This is not needed if you are using iptables over nftables (iptables-nft).
config NF_SOCKET_IPV6
tristate "IPv6 socket lookup support"
@@ -190,7 +196,7 @@ config IP6_NF_TARGET_HL
config IP6_NF_FILTER
tristate "Packet filtering"
default m if NETFILTER_ADVANCED=n
- select IP6_NF_IPTABLES_LEGACY
+ depends on IP6_NF_IPTABLES_LEGACY
tristate
help
Packet filtering defines a table `filter', which has a series of
@@ -227,7 +233,7 @@ config IP6_NF_TARGET_SYNPROXY
config IP6_NF_MANGLE
tristate "Packet mangling"
default m if NETFILTER_ADVANCED=n
- select IP6_NF_IPTABLES_LEGACY
+ depends on IP6_NF_IPTABLES_LEGACY
help
This option adds a `mangle' table to iptables: see the man page for
iptables(8). This table is used for various packet alterations
@@ -237,7 +243,7 @@ config IP6_NF_MANGLE
config IP6_NF_RAW
tristate 'raw table support (required for TRACE)'
- select IP6_NF_IPTABLES_LEGACY
+ depends on IP6_NF_IPTABLES_LEGACY
help
This option adds a `raw' table to ip6tables. This table is the very
first in the netfilter framework and hooks in at the PREROUTING
@@ -249,9 +255,7 @@ config IP6_NF_RAW
# security table for MAC policy
config IP6_NF_SECURITY
tristate "Security table"
- depends on SECURITY
- depends on NETFILTER_ADVANCED
- select IP6_NF_IPTABLES_LEGACY
+ depends on SECURITY && NETFILTER_ADVANCED && IP6_NF_IPTABLES_LEGACY
help
This option adds a `security' table to iptables, for use
with Mandatory Access Control (MAC) policy.
@@ -260,10 +264,8 @@ config IP6_NF_SECURITY
config IP6_NF_NAT
tristate "ip6tables NAT support"
- depends on NF_CONNTRACK
- depends on NETFILTER_ADVANCED
+ depends on NF_CONNTRACK && NETFILTER_ADVANCED && IP6_NF_IPTABLES_LEGACY
select NF_NAT
- select IP6_NF_IPTABLES_LEGACY
select NETFILTER_XT_NAT
help
This enables the `nat' table in ip6tables. This allows masquerading,
diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
index 784e2965896a..32e04837084e 100644
--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@ -34,6 +34,7 @@ CONFIG_IPV6_SIT=y
CONFIG_IP_DCCP=m
CONFIG_NF_NAT=m
CONFIG_IP6_NF_IPTABLES=m
+CONFIG_IP6_NF_IPTABLES_LEGACY=m
CONFIG_IP_NF_IPTABLES=m
CONFIG_IP_NF_IPTABLES_LEGACY=m
CONFIG_IP6_NF_NAT=m
--
2.43.5
This option makes IP_NF_IPTABLES_LEGACY user selectable, giving
users the option to configure iptables without enabling any other
config.
Suggested-by: Florian Westphal <fw(a)strlen.de>
Signed-off-by: Breno Leitao <leitao(a)debian.org>
---
net/ipv4/netfilter/Kconfig | 19 +++++++++++--------
tools/testing/selftests/net/config | 1 +
2 files changed, 12 insertions(+), 8 deletions(-)
diff --git a/net/ipv4/netfilter/Kconfig b/net/ipv4/netfilter/Kconfig
index 1b991b889506..a06c1903183f 100644
--- a/net/ipv4/netfilter/Kconfig
+++ b/net/ipv4/netfilter/Kconfig
@@ -12,7 +12,12 @@ config NF_DEFRAG_IPV4
# old sockopt interface and eval loop
config IP_NF_IPTABLES_LEGACY
- tristate
+ tristate "Legacy IP tables support"
+ default n
+ select NETFILTER_XTABLES
+ help
+ iptables is a general, extensible packet identification legacy framework.
+ This is not needed if you are using iptables over nftables (iptables-nft).
config NF_SOCKET_IPV4
tristate "IPv4 socket lookup support"
@@ -177,7 +182,7 @@ config IP_NF_MATCH_TTL
config IP_NF_FILTER
tristate "Packet filtering"
default m if NETFILTER_ADVANCED=n
- select IP_NF_IPTABLES_LEGACY
+ depends on IP_NF_IPTABLES_LEGACY
help
Packet filtering defines a table `filter', which has a series of
rules for simple packet filtering at local input, forwarding and
@@ -217,7 +222,7 @@ config IP_NF_NAT
default m if NETFILTER_ADVANCED=n
select NF_NAT
select NETFILTER_XT_NAT
- select IP_NF_IPTABLES_LEGACY
+ depends on IP_NF_IPTABLES_LEGACY
help
This enables the `nat' table in iptables. This allows masquerading,
port forwarding and other forms of full Network Address Port
@@ -258,7 +263,7 @@ endif # IP_NF_NAT
config IP_NF_MANGLE
tristate "Packet mangling"
default m if NETFILTER_ADVANCED=n
- select IP_NF_IPTABLES_LEGACY
+ depends on IP_NF_IPTABLES_LEGACY
help
This option adds a `mangle' table to iptables: see the man page for
iptables(8). This table is used for various packet alterations
@@ -293,7 +298,7 @@ config IP_NF_TARGET_TTL
# raw + specific targets
config IP_NF_RAW
tristate 'raw table support (required for NOTRACK/TRACE)'
- select IP_NF_IPTABLES_LEGACY
+ depends on IP_NF_IPTABLES_LEGACY
help
This option adds a `raw' table to iptables. This table is the very
first in the netfilter framework and hooks in at the PREROUTING
@@ -305,9 +310,7 @@ config IP_NF_RAW
# security table for MAC policy
config IP_NF_SECURITY
tristate "Security table"
- depends on SECURITY
- depends on NETFILTER_ADVANCED
- select IP_NF_IPTABLES_LEGACY
+ depends on SECURITY && NETFILTER_ADVANCED && IP_NF_IPTABLES_LEGACY
help
This option adds a `security' table to iptables, for use
with Mandatory Access Control (MAC) policy.
diff --git a/tools/testing/selftests/net/config b/tools/testing/selftests/net/config
index 5b9baf708950..784e2965896a 100644
--- a/tools/testing/selftests/net/config
+++ b/tools/testing/selftests/net/config
@@ -35,6 +35,7 @@ CONFIG_IP_DCCP=m
CONFIG_NF_NAT=m
CONFIG_IP6_NF_IPTABLES=m
CONFIG_IP_NF_IPTABLES=m
+CONFIG_IP_NF_IPTABLES_LEGACY=m
CONFIG_IP6_NF_NAT=m
CONFIG_IP6_NF_RAW=m
CONFIG_IP_NF_NAT=m
--
2.43.5