Enable this configuration to bypass such error reports:

    WARNING: drivers/powercap/intel_rapl_common.o(.text+0x10fb): Section mismatch in reference from the function rapl_add_package() to the variable .init.rodata:rapl_ids
    The function rapl_add_package() references
    the variable __initconst rapl_ids.
    This is often because rapl_add_package lacks a __initconst
    annotation or the annotation of rapl_ids is wrong.

    FATAL: modpost: Section mismatches detected.
    Set CONFIG_SECTION_MISMATCH_WARN_ONLY=y to allow them.
    make[1]: *** [__modpost] Error 1
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

Turn on several configs to support icelake.
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: NXunlei Pang <xlpang@linux.alibaba.com>

Add CONFIG_DEV_DAX_KMEM and make some related configs as Y.
Signed-off-by: NYang Shi <yang.shi@linux.alibaba.com>
Reviewed-by: NGavin Shan <shan.gavin@linux.alibaba.com>

Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

When in a KVM image, the user wants to use vHost_vSocks
the resource is already taken by virito_vSockets, so
set them as m to enable this use case.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

1. cubic makes redis performance doubled than bbr in some case.
2. keep same default setting with RHEL8.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

With the VLAN filtering feature, the Linux bridge acts more like a
real switch. Administrators can control all VLANs with only one
bridge, making it more easy and efficient to set up distinct subnets
on virtualization servers.

Kubernetes cni (container network interface) takes advantages of this
feature to configure pod network.

There will be error prompt like below if BRIDGE_VLAN_FILTERING is not
set.
NetworkPlugin cni failed to set up pod "<pod-name>" network: failed to
create bridge "cni0": could not add "cni0": operation not supported.

Therefore, enable BRIDGE_VLAN_FILTERING in this commit.
Signed-off-by: NXu Yu <xuyu@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Dpdk needs NOIOMMU mode for virtualization in Aliyun. It depends
on vfio in Alinux2.
With VFIO_NOIOMMU configured, NOIOMMU mode can be enabled by:
/sys/module/vfio/parameters/enable_unsafe_noiommu_mode. The default
is IOMMU mode.
Signed-off-by: NShile Zhang <shile.zhang@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

CONFIG_BFQ_GROUP_IOSCHED is required when we need BFQ support in
cgroup-v1 and cgroup-v2.
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

Enable function profiling feature of ftrace.
Signed-off-by: NJeffle Xu <jefflexu@linux.alibaba.com>
Acked-by: NCaspar Zhang <caspar@linux.alibaba.com>

Support IMA as an integrity service provider.
Signed-off-by: Nluanshi <zhangliguang@linux.alibaba.com>
Reviewed-by: Jia Zhang <zhang.jia@linux.alibaba.com>
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>

Support TPM Interface Specification 1.2 Interface / TPM 2.0 FIFO
Interface.
Signed-off-by: Nzou cao <zoucao@linux.alibaba.com>
Reviewed-by: Jia Zhang <zhang.jia@linux.alibaba.com>
Acked-by: NCaspar Zhang <caspar@linux.alibaba.com>

Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Now we have psi tracking support in kernel code, let's make it support
in kconfig.
As of now, we require a boot parameter to enable psi tracking for
performance impact concern. That means we disable it by default, and
user can pass a boot parameter "psi=1" to enable it if they want this
feature.
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

iproute2 suite, including ss, depends on INET_DIAG.

This patch enables CONFIG_INET_DIAG and a set of
protocol specific configs depend on CONFIG_INET_DIAG,
such as CONFIG_INET_TCP_DIAG, CONFIG_INET_UDP_DIAG,
CONFIG_INET_RAW_DIAG and CONFIG_INET_SCTP_DIAG.

These configs are all set as module.
Signed-off-by: NJeffle Xu <jefflexu@linux.alibaba.com>
Acked-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Firecracker micro-vm fails to boot. It turns out that the following
configs must be enabled and set to built-in:

- CONFIG_VIRTIO_MMIO
- CONFIG_VIRTIO_MMIO_CMDLINE_DEVICES
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>
Tested-by: NEryu Guan <eguan@linux.alibaba.com>

Applications related to the security mostly need SELinux function which
may increase the overhead of performance howerver. So many tests have
been done on the whole system. The result says it actually doesn't have
impact only when disabling the service in the user-space. However, if
someone still tries to enable the feature, something like the balance of
the performance and the security must be taken into consideration.
Signed-off-by: NJason Xing <kerneljasonxing@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Applications related to the security mostly need audit function which
may increase the overhead of performance howerver. So many tests have
been done on the whole system. The result says it actually doesn't have
impact only when disabling the service in the user-space. However, if
someone still tries to enable the feature, something like the balance of
the performance and the security must be taken into consideration.
Signed-off-by: NJason Xing <kerneljasonxing@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

IP policy routing depends on IP_MULTIPLE_TABLES, enable it by default
for IPv4 and IPv6.

Enable CONFIG_IPV6_SUBTREES at the same time, which enables IPv6 routing
by source address or prefix.
Signed-off-by: NXu Yu <xuyu@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

Set system time from RTC on startup and resume.
Signed-off-by: NJoseph Qi <joseph.qi@linux.alibaba.com>
Reviewed-by: NCaspar Zhang <caspar@linux.alibaba.com>
Reviewed-by: NJiufei Xue <jiufei.xue@linux.alibaba.com>

CONFIG_DEVMEM is recently added in newer kernels, many applications
depend on this option, enable it by default.
Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>
Reviewed-by: NJoseph Qi <joseph.qi@linux.alibaba.com>

IFB driver is needed to do ingress traffic control.
Signed-off-by: NDust Li <dust.li@linux.alibaba-inc.com>

Signed-off-by: NGeorge Zhang <georgezhang@linux.alibaba.com>
Reviewed-by: NCaspar Zhang <caspar@linux.alibaba.com>

Signed-off-by: NCaspar Zhang <caspar@linux.alibaba.com>