To support intel icelake, now enable RAS features, dax pmem and icelake
related configs.
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NJiufei Xue <jiufei.xue@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Deferred struct_page init can same more boot time, especially for large
memory instance. In my local test with 2C312GB VM, it decreases from
2.389s to 0.138s.
Please note that this has a potential performance impact on processes
running early in the lifetime of the system until these kthreads finish
the initialisation.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

To compile as modules can make the driver init parallel with systemd
startup, which can save about 40ms startup time.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

PS/2 mouse device probing costs more than 600ms after mouse driver
was initialized.
To compile it as modules can make the probing parallel with
init(systemd) startup, which can save about 600ms startup time.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

Turn on several configs to support icelake.
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: NXunlei Pang <xlpang@linux.alibaba.com>

Add CONFIG_DEV_DAX_KMEM and make some related configs as Y.
Signed-off-by: NYang Shi <yang.shi@linux.alibaba.com>
Reviewed-by: NGavin Shan <shan.gavin@linux.alibaba.com>

Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

When in a KVM image, the user wants to use vHost_vSocks
the resource is already taken by virito_vSockets, so
set them as m to enable this use case.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

1. cubic makes redis performance doubled than bbr in some case.
2. keep same default setting with RHEL8.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

With the VLAN filtering feature, the Linux bridge acts more like a
real switch. Administrators can control all VLANs with only one
bridge, making it more easy and efficient to set up distinct subnets
on virtualization servers.

Kubernetes cni (container network interface) takes advantages of this
feature to configure pod network.

There will be error prompt like below if BRIDGE_VLAN_FILTERING is not
set.
NetworkPlugin cni failed to set up pod "<pod-name>" network: failed to
create bridge "cni0": could not add "cni0": operation not supported.

Therefore, enable BRIDGE_VLAN_FILTERING in this commit.
Signed-off-by: NXu Yu <xuyu@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Dpdk needs NOIOMMU mode for virtualization in Aliyun. It depends
on vfio in Alinux2.
With VFIO_NOIOMMU configured, NOIOMMU mode can be enabled by:
/sys/module/vfio/parameters/enable_unsafe_noiommu_mode. The default
is IOMMU mode.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

CONFIG_BFQ_GROUP_IOSCHED is required when we need BFQ support in
cgroup-v1 and cgroup-v2.
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

Enable function profiling feature of ftrace.
Signed-off-by: NJeffle Xu <jefflexu@linux.alibaba.com>
Acked-by: NCaspar Zhang <caspar@linux.alibaba.com>

Support IMA as an integrity service provider.
Signed-off-by: Nluanshi <zhangliguang@linux.alibaba.com>
Reviewed-by: Jia Zhang <zhang.jia@linux.alibaba.com>
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

Support TPM Interface Specification 1.2 Interface / TPM 2.0 FIFO
Interface.
Signed-off-by: Nzou cao <zoucao@linux.alibaba.com>
Reviewed-by: Jia Zhang <zhang.jia@linux.alibaba.com>
Acked-by: NCaspar Zhang <caspar@linux.alibaba.com>

Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Now we have psi tracking support in kernel code, let's make it support
in kconfig.
As of now, we require a boot parameter to enable psi tracking for
performance impact concern. That means we disable it by default, and
user can pass a boot parameter "psi=1" to enable it if they want this
feature.
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

iproute2 suite, including ss, depends on INET_DIAG.

This patch enables CONFIG_INET_DIAG and a set of
protocol specific configs depend on CONFIG_INET_DIAG,
such as CONFIG_INET_TCP_DIAG, CONFIG_INET_UDP_DIAG,
CONFIG_INET_RAW_DIAG and CONFIG_INET_SCTP_DIAG.

These configs are all set as module.
Signed-off-by: NJeffle Xu <jefflexu@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Firecracker micro-vm fails to boot. It turns out that the following
configs must be enabled and set to built-in:

- CONFIG_VIRTIO_MMIO
- CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>
Tested-by: NEryu Guan <eguan@linux.alibaba.com>

Applications related to the security mostly need SELinux function which
may increase the overhead of performance howerver. So many tests have
been done on the whole system. The result says it actually doesn't have
impact only when disabling the service in the user-space. However, if
someone still tries to enable the feature, something like the balance of
the performance and the security must be taken into consideration.
Signed-off-by: NJason Xing <kerneljasonxing@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Applications related to the security mostly need audit function which
may increase the overhead of performance howerver. So many tests have
been done on the whole system. The result says it actually doesn't have
impact only when disabling the service in the user-space. However, if
someone still tries to enable the feature, something like the balance of
the performance and the security must be taken into consideration.
Signed-off-by: NJason Xing <kerneljasonxing@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

IP policy routing depends on IP_MULTIPLE_TABLES, enable it by default
for IPv4 and IPv6.

Enable CONFIG_IPV6_SUBTREES at the same time, which enables IPv6 routing
by source address or prefix.
Signed-off-by: NXu Yu <xuyu@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Set system time from RTC on startup and resume.
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: NCaspar Zhang <caspar@linux.alibaba.com>
Reviewed-by: NJiufei Xue <jiufei.xue@linux.alibaba.com>

CONFIG_DEVMEM is recently added in newer kernels, many applications
depend on this option, enable it by default.
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

IFB driver is needed to do ingress traffic control.
Signed-off-by: NDust Li <dust.li@linux.alibaba-inc.com>

Signed-off-by: NGeorge Zhang <georgezhang@linux.alibaba.com>
Reviewed-by: NCaspar Zhang <caspar@linux.alibaba.com>

Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>