1 # SPDX-License-Identifier: GPL-2.0-only
2
3 # BPF interpreter that, for example, classic s
4 config BPF
5 bool
6 select CRYPTO_LIB_SHA1
7
8 # Used by archs to tell that they support BPF
9 # flavour. Only one of the two can be selected
10 # eBPF JIT supersedes the cBPF JIT.
11
12 # Classic BPF JIT (cBPF)
13 config HAVE_CBPF_JIT
14 bool
15
16 # Extended BPF JIT (eBPF)
17 config HAVE_EBPF_JIT
18 bool
19
20 # Used by archs to tell that they want the BPF
21 # default for kernels that were compiled with
22 config ARCH_WANT_DEFAULT_BPF_JIT
23 bool
24
25 menu "BPF subsystem"
26
27 config BPF_SYSCALL
28 bool "Enable bpf() system call"
29 select BPF
30 select IRQ_WORK
31 select NEED_TASKS_RCU
32 select TASKS_TRACE_RCU
33 select BINARY_PRINTF
34 select NET_SOCK_MSG if NET
35 select NET_XGRESS if NET
36 select PAGE_POOL if NET
37 default n
38 help
39 Enable the bpf() system call that al
40 and maps via file descriptors.
41
42 config BPF_JIT
43 bool "Enable BPF Just In Time compiler
44 depends on BPF
45 depends on HAVE_CBPF_JIT || HAVE_EBPF_
46 select EXECMEM
47 help
48 BPF programs are normally handled by
49 allows the kernel to generate native
50 into the kernel. This will significa
51 programs.
52
53 Note, an admin should enable this fe
54 /proc/sys/net/core/bpf_jit_enable
55 /proc/sys/net/core/bpf_jit_harden
56 /proc/sys/net/core/bpf_jit_kallsyms
57
58 config BPF_JIT_ALWAYS_ON
59 bool "Permanently enable BPF JIT and r
60 depends on BPF_SYSCALL && HAVE_EBPF_JI
61 help
62 Enables BPF JIT and removes BPF inte
63 execution of BPF instructions by the
64
65 When CONFIG_BPF_JIT_ALWAYS_ON is ena
66 is permanently set to 1 and setting
67 return failure.
68
69 config BPF_JIT_DEFAULT_ON
70 def_bool ARCH_WANT_DEFAULT_BPF_JIT ||
71 depends on HAVE_EBPF_JIT && BPF_JIT
72
73 config BPF_UNPRIV_DEFAULT_OFF
74 bool "Disable unprivileged BPF by defa
75 default y
76 depends on BPF_SYSCALL
77 help
78 Disables unprivileged BPF by default
79 /proc/sys/kernel/unprivileged_bpf_di
80 still reenable it by setting it to 0
81 disable it by setting it to 1 (from
82 0 is possible anymore).
83
84 Unprivileged BPF could be used to ex
85 speculative execution side-channel v
86 affected hardware.
87
88 If you are unsure how to answer this
89
90 source "kernel/bpf/preload/Kconfig"
91
92 config BPF_LSM
93 bool "Enable BPF LSM Instrumentation"
94 depends on BPF_EVENTS
95 depends on BPF_SYSCALL
96 depends on SECURITY
97 depends on BPF_JIT
98 help
99 Enables instrumentation of the secur
100 implementing dynamic MAC and Audit P
101
102 If you are unsure how to answer this
103
104 endmenu # "BPF subsystem"
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.