1# SPDX-License-Identifier: GPL-2.0-only 2 3# BPF interpreter that, for example, classic socket filters depend on. 4config BPF 5 bool 6 select CRYPTO_LIB_SHA1 7 8# Used by archs to tell that they support BPF JIT compiler plus which 9# flavour. Only one of the two can be selected for a specific arch since 10# eBPF JIT supersedes the cBPF JIT. 11 12# Classic BPF JIT (cBPF) 13config HAVE_CBPF_JIT 14 bool 15 16# Extended BPF JIT (eBPF) 17config HAVE_EBPF_JIT 18 bool 19 20# Used by archs to tell that they want the BPF JIT compiler enabled by 21# default for kernels that were compiled with BPF JIT support. 22config ARCH_WANT_DEFAULT_BPF_JIT 23 bool 24 25menu "BPF subsystem" 26 27config BPF_SYSCALL 28 bool "Enable bpf() system call" 29 select BPF 30 select IRQ_WORK 31 select TASKS_RCU if PREEMPTION 32 select TASKS_TRACE_RCU 33 select BINARY_PRINTF 34 select NET_SOCK_MSG if NET 35 select NET_XGRESS if NET 36 select PAGE_POOL if NET 37 default n 38 help 39 Enable the bpf() system call that allows to manipulate BPF programs 40 and maps via file descriptors. 41 42config BPF_JIT 43 bool "Enable BPF Just In Time compiler" 44 depends on BPF 45 depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT 46 depends on MODULES 47 help 48 BPF programs are normally handled by a BPF interpreter. This option 49 allows the kernel to generate native code when a program is loaded 50 into the kernel. This will significantly speed-up processing of BPF 51 programs. 52 53 Note, an admin should enable this feature changing: 54 /proc/sys/net/core/bpf_jit_enable 55 /proc/sys/net/core/bpf_jit_harden (optional) 56 /proc/sys/net/core/bpf_jit_kallsyms (optional) 57 58config BPF_JIT_ALWAYS_ON 59 bool "Permanently enable BPF JIT and remove BPF interpreter" 60 depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT 61 help 62 Enables BPF JIT and removes BPF interpreter to avoid speculative 63 execution of BPF instructions by the interpreter. 64 65 When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable 66 is permanently set to 1 and setting any other value than that will 67 return failure. 68 69config BPF_JIT_DEFAULT_ON 70 def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON 71 depends on HAVE_EBPF_JIT && BPF_JIT 72 73config BPF_UNPRIV_DEFAULT_OFF 74 bool "Disable unprivileged BPF by default" 75 default y 76 depends on BPF_SYSCALL 77 help 78 Disables unprivileged BPF by default by setting the corresponding 79 /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can 80 still reenable it by setting it to 0 later on, or permanently 81 disable it by setting it to 1 (from which no other transition to 82 0 is possible anymore). 83 84 Unprivileged BPF could be used to exploit certain potential 85 speculative execution side-channel vulnerabilities on unmitigated 86 affected hardware. 87 88 If you are unsure how to answer this question, answer Y. 89 90source "kernel/bpf/preload/Kconfig" 91 92config BPF_LSM 93 bool "Enable BPF LSM Instrumentation" 94 depends on BPF_EVENTS 95 depends on BPF_SYSCALL 96 depends on SECURITY 97 depends on BPF_JIT 98 help 99 Enables instrumentation of the security hooks with BPF programs for 100 implementing dynamic MAC and Audit Policies. 101 102 If you are unsure how to answer this question, answer N. 103 104endmenu # "BPF subsystem" 105