1# SPDX-License-Identifier: GPL-2.0-only
  2
  3# BPF interpreter that, for example, classic socket filters depend on.
  4config BPF
  5	bool
  6
  7# Used by archs to tell that they support BPF JIT compiler plus which
  8# flavour. Only one of the two can be selected for a specific arch since
  9# eBPF JIT supersedes the cBPF JIT.
 10
 11# Classic BPF JIT (cBPF)
 12config HAVE_CBPF_JIT
 13	bool
 14
 15# Extended BPF JIT (eBPF)
 16config HAVE_EBPF_JIT
 17	bool
 18
 19# Used by archs to tell that they want the BPF JIT compiler enabled by
 20# default for kernels that were compiled with BPF JIT support.
 21config ARCH_WANT_DEFAULT_BPF_JIT
 22	bool
 23
 24menu "BPF subsystem"
 25
 26config BPF_SYSCALL
 27	bool "Enable bpf() system call"
 28	select BPF
 29	select IRQ_WORK
 30	select TASKS_RCU if PREEMPTION
 31	select TASKS_TRACE_RCU
 32	select BINARY_PRINTF
 33	select NET_SOCK_MSG if NET
 34	select NET_XGRESS if NET
 35	select PAGE_POOL if NET
 36	default n
 37	help
 38	  Enable the bpf() system call that allows to manipulate BPF programs
 39	  and maps via file descriptors.
 40
 41config BPF_JIT
 42	bool "Enable BPF Just In Time compiler"
 43	depends on BPF
 44	depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
 45	depends on MODULES
 46	help
 47	  BPF programs are normally handled by a BPF interpreter. This option
 48	  allows the kernel to generate native code when a program is loaded
 49	  into the kernel. This will significantly speed-up processing of BPF
 50	  programs.
 51
 52	  Note, an admin should enable this feature changing:
 53	  /proc/sys/net/core/bpf_jit_enable
 54	  /proc/sys/net/core/bpf_jit_harden   (optional)
 55	  /proc/sys/net/core/bpf_jit_kallsyms (optional)
 56
 57config BPF_JIT_ALWAYS_ON
 58	bool "Permanently enable BPF JIT and remove BPF interpreter"
 59	depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
 60	help
 61	  Enables BPF JIT and removes BPF interpreter to avoid speculative
 62	  execution of BPF instructions by the interpreter.
 63
 64	  When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
 65	  is permanently set to 1 and setting any other value than that will
 66	  return failure.
 67
 68config BPF_JIT_DEFAULT_ON
 69	def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
 70	depends on HAVE_EBPF_JIT && BPF_JIT
 71
 72config BPF_UNPRIV_DEFAULT_OFF
 73	bool "Disable unprivileged BPF by default"
 74	default y
 75	depends on BPF_SYSCALL
 76	help
 77	  Disables unprivileged BPF by default by setting the corresponding
 78	  /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
 79	  still reenable it by setting it to 0 later on, or permanently
 80	  disable it by setting it to 1 (from which no other transition to
 81	  0 is possible anymore).
 82
 83	  Unprivileged BPF could be used to exploit certain potential
 84	  speculative execution side-channel vulnerabilities on unmitigated
 85	  affected hardware.
 86
 87	  If you are unsure how to answer this question, answer Y.
 88
 89source "kernel/bpf/preload/Kconfig"
 90
 91config BPF_LSM
 92	bool "Enable BPF LSM Instrumentation"
 93	depends on BPF_EVENTS
 94	depends on BPF_SYSCALL
 95	depends on SECURITY
 96	depends on BPF_JIT
 97	help
 98	  Enables instrumentation of the security hooks with BPF programs for
 99	  implementing dynamic MAC and Audit Policies.
100
101	  If you are unsure how to answer this question, answer N.
102
103endmenu # "BPF subsystem"

  1# SPDX-License-Identifier: GPL-2.0-only
  2
  3# BPF interpreter that, for example, classic socket filters depend on.
  4config BPF
  5	bool
  6
  7# Used by archs to tell that they support BPF JIT compiler plus which
  8# flavour. Only one of the two can be selected for a specific arch since
  9# eBPF JIT supersedes the cBPF JIT.
 10
 11# Classic BPF JIT (cBPF)
 12config HAVE_CBPF_JIT
 13	bool
 14
 15# Extended BPF JIT (eBPF)
 16config HAVE_EBPF_JIT
 17	bool
 18
 19# Used by archs to tell that they want the BPF JIT compiler enabled by
 20# default for kernels that were compiled with BPF JIT support.
 21config ARCH_WANT_DEFAULT_BPF_JIT
 22	bool
 23
 24menu "BPF subsystem"
 25
 26config BPF_SYSCALL
 27	bool "Enable bpf() system call"
 28	select BPF
 29	select IRQ_WORK
 30	select TASKS_RCU if PREEMPTION
 31	select TASKS_TRACE_RCU
 32	select BINARY_PRINTF
 33	select NET_SOCK_MSG if NET
 
 34	select PAGE_POOL if NET
 35	default n
 36	help
 37	  Enable the bpf() system call that allows to manipulate BPF programs
 38	  and maps via file descriptors.
 39
 40config BPF_JIT
 41	bool "Enable BPF Just In Time compiler"
 42	depends on BPF
 43	depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
 44	depends on MODULES
 45	help
 46	  BPF programs are normally handled by a BPF interpreter. This option
 47	  allows the kernel to generate native code when a program is loaded
 48	  into the kernel. This will significantly speed-up processing of BPF
 49	  programs.
 50
 51	  Note, an admin should enable this feature changing:
 52	  /proc/sys/net/core/bpf_jit_enable
 53	  /proc/sys/net/core/bpf_jit_harden   (optional)
 54	  /proc/sys/net/core/bpf_jit_kallsyms (optional)
 55
 56config BPF_JIT_ALWAYS_ON
 57	bool "Permanently enable BPF JIT and remove BPF interpreter"
 58	depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
 59	help
 60	  Enables BPF JIT and removes BPF interpreter to avoid speculative
 61	  execution of BPF instructions by the interpreter.
 62
 63	  When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
 64	  is permanently set to 1 and setting any other value than that will
 65	  return failure.
 66
 67config BPF_JIT_DEFAULT_ON
 68	def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
 69	depends on HAVE_EBPF_JIT && BPF_JIT
 70
 71config BPF_UNPRIV_DEFAULT_OFF
 72	bool "Disable unprivileged BPF by default"
 73	default y
 74	depends on BPF_SYSCALL
 75	help
 76	  Disables unprivileged BPF by default by setting the corresponding
 77	  /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
 78	  still reenable it by setting it to 0 later on, or permanently
 79	  disable it by setting it to 1 (from which no other transition to
 80	  0 is possible anymore).
 81
 82	  Unprivileged BPF could be used to exploit certain potential
 83	  speculative execution side-channel vulnerabilities on unmitigated
 84	  affected hardware.
 85
 86	  If you are unsure how to answer this question, answer Y.
 87
 88source "kernel/bpf/preload/Kconfig"
 89
 90config BPF_LSM
 91	bool "Enable BPF LSM Instrumentation"
 92	depends on BPF_EVENTS
 93	depends on BPF_SYSCALL
 94	depends on SECURITY
 95	depends on BPF_JIT
 96	help
 97	  Enables instrumentation of the security hooks with BPF programs for
 98	  implementing dynamic MAC and Audit Policies.
 99
100	  If you are unsure how to answer this question, answer N.
101
102endmenu # "BPF subsystem"