Loading...
1# SPDX-License-Identifier: GPL-2.0-only
2
3# BPF interpreter that, for example, classic socket filters depend on.
4config BPF
5 bool
6 select CRYPTO_LIB_SHA1
7
8# Used by archs to tell that they support BPF JIT compiler plus which
9# flavour. Only one of the two can be selected for a specific arch since
10# eBPF JIT supersedes the cBPF JIT.
11
12# Classic BPF JIT (cBPF)
13config HAVE_CBPF_JIT
14 bool
15
16# Extended BPF JIT (eBPF)
17config HAVE_EBPF_JIT
18 bool
19
20# Used by archs to tell that they want the BPF JIT compiler enabled by
21# default for kernels that were compiled with BPF JIT support.
22config ARCH_WANT_DEFAULT_BPF_JIT
23 bool
24
25menu "BPF subsystem"
26
27config BPF_SYSCALL
28 bool "Enable bpf() system call"
29 select BPF
30 select IRQ_WORK
31 select NEED_TASKS_RCU
32 select TASKS_TRACE_RCU
33 select BINARY_PRINTF
34 select NET_SOCK_MSG if NET
35 select NET_XGRESS if NET
36 select PAGE_POOL if NET
37 default n
38 help
39 Enable the bpf() system call that allows to manipulate BPF programs
40 and maps via file descriptors.
41
42config BPF_JIT
43 bool "Enable BPF Just In Time compiler"
44 depends on BPF
45 depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
46 select EXECMEM
47 help
48 BPF programs are normally handled by a BPF interpreter. This option
49 allows the kernel to generate native code when a program is loaded
50 into the kernel. This will significantly speed-up processing of BPF
51 programs.
52
53 Note, an admin should enable this feature changing:
54 /proc/sys/net/core/bpf_jit_enable
55 /proc/sys/net/core/bpf_jit_harden (optional)
56 /proc/sys/net/core/bpf_jit_kallsyms (optional)
57
58config BPF_JIT_ALWAYS_ON
59 bool "Permanently enable BPF JIT and remove BPF interpreter"
60 depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
61 help
62 Enables BPF JIT and removes BPF interpreter to avoid speculative
63 execution of BPF instructions by the interpreter.
64
65 When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
66 is permanently set to 1 and setting any other value than that will
67 return failure.
68
69config BPF_JIT_DEFAULT_ON
70 def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
71 depends on HAVE_EBPF_JIT && BPF_JIT
72
73config BPF_UNPRIV_DEFAULT_OFF
74 bool "Disable unprivileged BPF by default"
75 default y
76 depends on BPF_SYSCALL
77 help
78 Disables unprivileged BPF by default by setting the corresponding
79 /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
80 still reenable it by setting it to 0 later on, or permanently
81 disable it by setting it to 1 (from which no other transition to
82 0 is possible anymore).
83
84 Unprivileged BPF could be used to exploit certain potential
85 speculative execution side-channel vulnerabilities on unmitigated
86 affected hardware.
87
88 If you are unsure how to answer this question, answer Y.
89
90source "kernel/bpf/preload/Kconfig"
91
92config BPF_LSM
93 bool "Enable BPF LSM Instrumentation"
94 depends on BPF_EVENTS
95 depends on BPF_SYSCALL
96 depends on SECURITY
97 depends on BPF_JIT
98 help
99 Enables instrumentation of the security hooks with BPF programs for
100 implementing dynamic MAC and Audit Policies.
101
102 If you are unsure how to answer this question, answer N.
103
104endmenu # "BPF subsystem"
1# SPDX-License-Identifier: GPL-2.0-only
2
3# BPF interpreter that, for example, classic socket filters depend on.
4config BPF
5 bool
6
7# Used by archs to tell that they support BPF JIT compiler plus which
8# flavour. Only one of the two can be selected for a specific arch since
9# eBPF JIT supersedes the cBPF JIT.
10
11# Classic BPF JIT (cBPF)
12config HAVE_CBPF_JIT
13 bool
14
15# Extended BPF JIT (eBPF)
16config HAVE_EBPF_JIT
17 bool
18
19# Used by archs to tell that they want the BPF JIT compiler enabled by
20# default for kernels that were compiled with BPF JIT support.
21config ARCH_WANT_DEFAULT_BPF_JIT
22 bool
23
24menu "BPF subsystem"
25
26config BPF_SYSCALL
27 bool "Enable bpf() system call"
28 select BPF
29 select IRQ_WORK
30 select TASKS_TRACE_RCU
31 select BINARY_PRINTF
32 select NET_SOCK_MSG if INET
33 default n
34 help
35 Enable the bpf() system call that allows to manipulate BPF programs
36 and maps via file descriptors.
37
38config BPF_JIT
39 bool "Enable BPF Just In Time compiler"
40 depends on BPF
41 depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
42 depends on MODULES
43 help
44 BPF programs are normally handled by a BPF interpreter. This option
45 allows the kernel to generate native code when a program is loaded
46 into the kernel. This will significantly speed-up processing of BPF
47 programs.
48
49 Note, an admin should enable this feature changing:
50 /proc/sys/net/core/bpf_jit_enable
51 /proc/sys/net/core/bpf_jit_harden (optional)
52 /proc/sys/net/core/bpf_jit_kallsyms (optional)
53
54config BPF_JIT_ALWAYS_ON
55 bool "Permanently enable BPF JIT and remove BPF interpreter"
56 depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
57 help
58 Enables BPF JIT and removes BPF interpreter to avoid speculative
59 execution of BPF instructions by the interpreter.
60
61config BPF_JIT_DEFAULT_ON
62 def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
63 depends on HAVE_EBPF_JIT && BPF_JIT
64
65config BPF_UNPRIV_DEFAULT_OFF
66 bool "Disable unprivileged BPF by default"
67 depends on BPF_SYSCALL
68 help
69 Disables unprivileged BPF by default by setting the corresponding
70 /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
71 still reenable it by setting it to 0 later on, or permanently
72 disable it by setting it to 1 (from which no other transition to
73 0 is possible anymore).
74
75source "kernel/bpf/preload/Kconfig"
76
77config BPF_LSM
78 bool "Enable BPF LSM Instrumentation"
79 depends on BPF_EVENTS
80 depends on BPF_SYSCALL
81 depends on SECURITY
82 depends on BPF_JIT
83 help
84 Enables instrumentation of the security hooks with BPF programs for
85 implementing dynamic MAC and Audit Policies.
86
87 If you are unsure how to answer this question, answer N.
88
89endmenu # "BPF subsystem"