[Devel] [PATCH hci-8.1 0/2] mempolicy: prohibit mbind and set_mempolicy_home_node in VE

[Konstantin Khorenko]

A CT is meant to see a kernel without NUMA, so the NUMA API syscalls
return -ENOSYS in a non-super VE.

mbind(2) was blocked in vz7, but the vz8 port put its check into the
compat entry point only, and the compat entry points were dropped on
the rebase to RHEL9. Since then a CT task can bind its pages to nodes
and migrate them with mbind(2), while get_mempolicy(2) tells it there
is no NUMA.

set_mempolicy_home_node(2) appeared after vz7 and was never blocked. It
only sets the home node of a policy installed by mbind(2), so it goes
with it.

- Patch 1 returns -ENOSYS from both in a non-super VE.
- Patch 2 adds a ve selftest: all six NUMA API syscalls, with arguments
  that succeed on the host, must return -ENOSYS in a VE.

The unmerged selftests series for VSTOR-137234 carries an older
ve_numa_syscalls_prohibited_test that covers four of the syscalls with
arguments that fail on the host anyway; this version replaces it.

Tested on a 4-node host, ve_numa_syscalls_prohibited_test:

+----------------------------+--------------+--------------------------+
| kernel                     | host calls   | calls in a VE            |
+----------------------------+--------------+--------------------------+
| vz10 without patch 1       | PASS         | FAIL: mbind and          |
|                            |              | set_mempolicy_home_node  |
|                            |              | return 0                 |
+----------------------------+--------------+--------------------------+
| vz10 with the series       | PASS         | PASS                     |
+----------------------------+--------------+--------------------------+

ve_numa_migrate_test still passes with the series.

Assisted-by: LLM
Signed-off-by: Konstantin Khorenko <khorenko at virtuozzo.com>
---
Konstantin Khorenko (2):
      mempolicy: prohibit mbind and set_mempolicy_home_node in VE
      selftests/ve: check that the NUMA API syscalls return ENOSYS in a VE

 mm/mempolicy.c                                     |   6 +
 tools/testing/selftests/ve/.gitignore              |   1 +
 tools/testing/selftests/ve/Makefile                |   1 +
 .../ve/ve_numa_syscalls_prohibited_test.c          | 192 +++++++++++++++++++++
 4 files changed, 200 insertions(+)
---
base-commit: 1f21db982845109040d1feb279e9ee34f8e6f065
change-id: 20261105-b4-prep-khorenko-vstor-153679-mbind-ve-bd811ea9be42

Best regards,
--  
Konstantin Khorenko,
Virtuozzo Linux Kernel Team