1 # SPDX-License-Identifier: GPL-2.0-only 1 # SPDX-License-Identifier: GPL-2.0-only
2 2
3 # BPF interpreter that, for example, classic s 3 # BPF interpreter that, for example, classic socket filters depend on.
4 config BPF 4 config BPF
5 bool 5 bool
6 select CRYPTO_LIB_SHA1 6 select CRYPTO_LIB_SHA1
7 7
8 # Used by archs to tell that they support BPF 8 # Used by archs to tell that they support BPF JIT compiler plus which
9 # flavour. Only one of the two can be selected 9 # flavour. Only one of the two can be selected for a specific arch since
10 # eBPF JIT supersedes the cBPF JIT. 10 # eBPF JIT supersedes the cBPF JIT.
11 11
12 # Classic BPF JIT (cBPF) 12 # Classic BPF JIT (cBPF)
13 config HAVE_CBPF_JIT 13 config HAVE_CBPF_JIT
14 bool 14 bool
15 15
16 # Extended BPF JIT (eBPF) 16 # Extended BPF JIT (eBPF)
17 config HAVE_EBPF_JIT 17 config HAVE_EBPF_JIT
18 bool 18 bool
19 19
20 # Used by archs to tell that they want the BPF 20 # Used by archs to tell that they want the BPF JIT compiler enabled by
21 # default for kernels that were compiled with 21 # default for kernels that were compiled with BPF JIT support.
22 config ARCH_WANT_DEFAULT_BPF_JIT 22 config ARCH_WANT_DEFAULT_BPF_JIT
23 bool 23 bool
24 24
25 menu "BPF subsystem" 25 menu "BPF subsystem"
26 26
27 config BPF_SYSCALL 27 config BPF_SYSCALL
28 bool "Enable bpf() system call" 28 bool "Enable bpf() system call"
29 select BPF 29 select BPF
30 select IRQ_WORK 30 select IRQ_WORK
31 select NEED_TASKS_RCU 31 select NEED_TASKS_RCU
32 select TASKS_TRACE_RCU 32 select TASKS_TRACE_RCU
33 select BINARY_PRINTF 33 select BINARY_PRINTF
34 select NET_SOCK_MSG if NET 34 select NET_SOCK_MSG if NET
35 select NET_XGRESS if NET 35 select NET_XGRESS if NET
36 select PAGE_POOL if NET 36 select PAGE_POOL if NET
37 default n 37 default n
38 help 38 help
39 Enable the bpf() system call that al 39 Enable the bpf() system call that allows to manipulate BPF programs
40 and maps via file descriptors. 40 and maps via file descriptors.
41 41
42 config BPF_JIT 42 config BPF_JIT
43 bool "Enable BPF Just In Time compiler 43 bool "Enable BPF Just In Time compiler"
44 depends on BPF 44 depends on BPF
45 depends on HAVE_CBPF_JIT || HAVE_EBPF_ 45 depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
46 select EXECMEM 46 select EXECMEM
47 help 47 help
48 BPF programs are normally handled by 48 BPF programs are normally handled by a BPF interpreter. This option
49 allows the kernel to generate native 49 allows the kernel to generate native code when a program is loaded
50 into the kernel. This will significa 50 into the kernel. This will significantly speed-up processing of BPF
51 programs. 51 programs.
52 52
53 Note, an admin should enable this fe 53 Note, an admin should enable this feature changing:
54 /proc/sys/net/core/bpf_jit_enable 54 /proc/sys/net/core/bpf_jit_enable
55 /proc/sys/net/core/bpf_jit_harden 55 /proc/sys/net/core/bpf_jit_harden (optional)
56 /proc/sys/net/core/bpf_jit_kallsyms 56 /proc/sys/net/core/bpf_jit_kallsyms (optional)
57 57
58 config BPF_JIT_ALWAYS_ON 58 config BPF_JIT_ALWAYS_ON
59 bool "Permanently enable BPF JIT and r 59 bool "Permanently enable BPF JIT and remove BPF interpreter"
60 depends on BPF_SYSCALL && HAVE_EBPF_JI 60 depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
61 help 61 help
62 Enables BPF JIT and removes BPF inte 62 Enables BPF JIT and removes BPF interpreter to avoid speculative
63 execution of BPF instructions by the 63 execution of BPF instructions by the interpreter.
64 64
65 When CONFIG_BPF_JIT_ALWAYS_ON is ena 65 When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
66 is permanently set to 1 and setting 66 is permanently set to 1 and setting any other value than that will
67 return failure. 67 return failure.
68 68
69 config BPF_JIT_DEFAULT_ON 69 config BPF_JIT_DEFAULT_ON
70 def_bool ARCH_WANT_DEFAULT_BPF_JIT || 70 def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
71 depends on HAVE_EBPF_JIT && BPF_JIT 71 depends on HAVE_EBPF_JIT && BPF_JIT
72 72
73 config BPF_UNPRIV_DEFAULT_OFF 73 config BPF_UNPRIV_DEFAULT_OFF
74 bool "Disable unprivileged BPF by defa 74 bool "Disable unprivileged BPF by default"
75 default y 75 default y
76 depends on BPF_SYSCALL 76 depends on BPF_SYSCALL
77 help 77 help
78 Disables unprivileged BPF by default 78 Disables unprivileged BPF by default by setting the corresponding
79 /proc/sys/kernel/unprivileged_bpf_di 79 /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
80 still reenable it by setting it to 0 80 still reenable it by setting it to 0 later on, or permanently
81 disable it by setting it to 1 (from 81 disable it by setting it to 1 (from which no other transition to
82 0 is possible anymore). 82 0 is possible anymore).
83 83
84 Unprivileged BPF could be used to ex 84 Unprivileged BPF could be used to exploit certain potential
85 speculative execution side-channel v 85 speculative execution side-channel vulnerabilities on unmitigated
86 affected hardware. 86 affected hardware.
87 87
88 If you are unsure how to answer this 88 If you are unsure how to answer this question, answer Y.
89 89
90 source "kernel/bpf/preload/Kconfig" 90 source "kernel/bpf/preload/Kconfig"
91 91
92 config BPF_LSM 92 config BPF_LSM
93 bool "Enable BPF LSM Instrumentation" 93 bool "Enable BPF LSM Instrumentation"
94 depends on BPF_EVENTS 94 depends on BPF_EVENTS
95 depends on BPF_SYSCALL 95 depends on BPF_SYSCALL
96 depends on SECURITY 96 depends on SECURITY
97 depends on BPF_JIT 97 depends on BPF_JIT
98 help 98 help
99 Enables instrumentation of the secur 99 Enables instrumentation of the security hooks with BPF programs for
100 implementing dynamic MAC and Audit P 100 implementing dynamic MAC and Audit Policies.
101 101
102 If you are unsure how to answer this 102 If you are unsure how to answer this question, answer N.
103 103
104 endmenu # "BPF subsystem" 104 endmenu # "BPF subsystem"
Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.