// Test that the version returned by KernelVersion matches expectations.
	major, minor := unix.KernelVersion()
	t.Logf("Kernel version: %d.%d", major, minor)
	if runtime.GOOS == "illumos" {
		if gotSock && gotAccept4 && (major < 5 || (major == 5 && minor < 11)) {
			t.Fatalf("SupportSockNonblockCloexec and SupportAccept4 are true, but kernel version is older than 5.11, SunOS version: %d.%d", major, minor)
		}

  attributes {tf.entry_function = {control_outputs = "", inputs = "", outputs = "dense_2/Add:0"}, tf_saved_model.exported_names = ["serving_default"]} {

	// the same size as what the kernel defines.
	if have, want := unsafe.Sizeof(Siginfo{}), uintptr(SiginfoMaxSize); have != want {
		t.Errorf("Go's siginfo struct is %d bytes long; kernel expects %d", have, want)
	}
	if have, want := unsafe.Sizeof(Sigevent{}), uintptr(SigeventMaxSize); have != want {
		t.Errorf("Go's sigevent struct is %d bytes long; kernel expects %d", have, want)
	}

	sysctls := []v1.Sysctl{
		{
			Name:  "kernel.msgmax",
			Value: "8192",
		},
		{
			Name:  "kernel.shm_rmid_forced",
			Value: "1",
		},
		{
			Name:  "net.ipv4.conf.eno2/100.rp_filter",
			Value: "1",
		},
		{
			Name:  "net/ipv4/ip_local_port_range",
			Value: "1024 65535",
		},
	}
	exceptSysctls := []v1.Sysctl{
		{
			Name:  "kernel.msgmax",
			Value: "8192",
		},
		{

  }
}

LogicalResult DeviceTarget::RegisterKernel(
    llvm::StringRef kernel, const KernelSpecs::Signature& signature,
    const ScaleFn& fn, const ScaleDecomposeFn& dfn) {
  return specs_[kernel].Add(signature, {ScaleConstraintType::CustomScale, fn});
}

namespace ph = std::placeholders;

LogicalResult DeviceTarget::RegisterKernel(
    llvm::StringRef kernel, const KernelSpecs::Signature& signature,

}

// If the kernel is too old to support the getrandom syscall(),
// unix.GetRandom will immediately return ENOSYS and we will then fall back to
// reading from /dev/urandom in rand_unix.go. unix.GetRandom caches the ENOSYS
// result so we only suffer the syscall overhead once in this case.
// If the kernel supports the getrandom() syscall, unix.GetRandom will block

				return nil, errors.New("open /proc/sys/kernel/osrelease: failed to read file")
			},
			err:      errors.New("failed to read os-release file: open /proc/sys/kernel/osrelease: failed to read file"),
			expected: nil,
		},
		{
			name: "version not parsable",
			readFileFunc: func(_ string) ([]byte, error) {
				return []byte("5-15-0"), nil
			},
			err:      errors.New("failed to parse kernel version: illegal version string \"5-15-0\""),

		{
			name: "failed to get kernelVersion, only return safeSysctls with no kernelVersion limit",
			getVersion: func() (*version.Version, error) {
				return nil, fmt.Errorf("fork error")
			},
			want: []string{
				"kernel.shm_rmid_forced",
				"net.ipv4.ip_local_port_range",
				"net.ipv4.tcp_syncookies",
				"net.ipv4.ping_group_range",
				"net.ipv4.ip_unprivileged_port_start",
			},
		},
		{

# NFTables kube-proxy

This is an implementation of service proxying via the nftables API of
the kernel netfilter subsystem.

## General theory of netfilter

Packet flow through netfilter looks something like:

```text
             +================+      +=====================+
             | hostNetwork IP |      | hostNetwork process |
             +================+      +=====================+
                         ^                |

type utsname struct {
	Sysname  [257]byte
	Nodename [257]byte
	Release  [257]byte
	Version  [257]byte
	Machine  [257]byte
}

// KernelVersion returns major and minor kernel version numbers
// parsed from the syscall.Uname's Version field, or (0, 0) if the
// version can't be obtained or parsed.
func KernelVersion() (major int, minor int) {
	var un utsname