1# SPDX-License-Identifier: GPL-2.0-only
  2
  3# BPF interpreter that, for example, classic socket filters depend on.
  4config BPF
  5	bool
  6	select CRYPTO_LIB_SHA1
  7
  8# Used by archs to tell that they support BPF JIT compiler plus which
  9# flavour. Only one of the two can be selected for a specific arch since
 10# eBPF JIT supersedes the cBPF JIT.
 11
 12# Classic BPF JIT (cBPF)
 13config HAVE_CBPF_JIT
 14	bool
 15
 16# Extended BPF JIT (eBPF)
 17config HAVE_EBPF_JIT
 18	bool
 19
 20# Used by archs to tell that they want the BPF JIT compiler enabled by
 21# default for kernels that were compiled with BPF JIT support.
 22config ARCH_WANT_DEFAULT_BPF_JIT
 23	bool
 24
 25menu "BPF subsystem"
 26
 27config BPF_SYSCALL
 28	bool "Enable bpf() system call"
 29	select BPF
 30	select IRQ_WORK
 31	select NEED_TASKS_RCU
 32	select TASKS_TRACE_RCU
 33	select BINARY_PRINTF
 34	select NET_SOCK_MSG if NET
 35	select NET_XGRESS if NET
 36	select PAGE_POOL if NET
 37	default n
 38	help
 39	  Enable the bpf() system call that allows to manipulate BPF programs
 40	  and maps via file descriptors.
 41
 42config BPF_JIT
 43	bool "Enable BPF Just In Time compiler"
 44	depends on BPF
 45	depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
 46	select EXECMEM
 47	help
 48	  BPF programs are normally handled by a BPF interpreter. This option
 49	  allows the kernel to generate native code when a program is loaded
 50	  into the kernel. This will significantly speed-up processing of BPF
 51	  programs.
 52
 53	  Note, an admin should enable this feature changing:
 54	  /proc/sys/net/core/bpf_jit_enable
 55	  /proc/sys/net/core/bpf_jit_harden   (optional)
 56	  /proc/sys/net/core/bpf_jit_kallsyms (optional)
 57
 58config BPF_JIT_ALWAYS_ON
 59	bool "Permanently enable BPF JIT and remove BPF interpreter"
 60	depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
 61	help
 62	  Enables BPF JIT and removes BPF interpreter to avoid speculative
 63	  execution of BPF instructions by the interpreter.
 64
 65	  When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
 66	  is permanently set to 1 and setting any other value than that will
 67	  return failure.
 68
 69config BPF_JIT_DEFAULT_ON
 70	def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
 71	depends on HAVE_EBPF_JIT && BPF_JIT
 72
 73config BPF_UNPRIV_DEFAULT_OFF
 74	bool "Disable unprivileged BPF by default"
 75	default y
 76	depends on BPF_SYSCALL
 77	help
 78	  Disables unprivileged BPF by default by setting the corresponding
 79	  /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
 80	  still reenable it by setting it to 0 later on, or permanently
 81	  disable it by setting it to 1 (from which no other transition to
 82	  0 is possible anymore).
 83
 84	  Unprivileged BPF could be used to exploit certain potential
 85	  speculative execution side-channel vulnerabilities on unmitigated
 86	  affected hardware.
 87
 88	  If you are unsure how to answer this question, answer Y.
 89
 90source "kernel/bpf/preload/Kconfig"
 91
 92config BPF_LSM
 93	bool "Enable BPF LSM Instrumentation"
 94	depends on BPF_EVENTS
 95	depends on BPF_SYSCALL
 96	depends on SECURITY
 97	depends on BPF_JIT
 98	help
 99	  Enables instrumentation of the security hooks with BPF programs for
100	  implementing dynamic MAC and Audit Policies.
101
102	  If you are unsure how to answer this question, answer N.
103
104endmenu # "BPF subsystem"