0001 # SPDX-License-Identifier: GPL-2.0-only
0002
0003 # BPF interpreter that, for example, classic socket filters depend on.
0004 config BPF
0005 bool
0006
0007 # Used by archs to tell that they support BPF JIT compiler plus which
0008 # flavour. Only one of the two can be selected for a specific arch since
0009 # eBPF JIT supersedes the cBPF JIT.
0010
0011 # Classic BPF JIT (cBPF)
0012 config HAVE_CBPF_JIT
0013 bool
0014
0015 # Extended BPF JIT (eBPF)
0016 config HAVE_EBPF_JIT
0017 bool
0018
0019 # Used by archs to tell that they want the BPF JIT compiler enabled by
0020 # default for kernels that were compiled with BPF JIT support.
0021 config ARCH_WANT_DEFAULT_BPF_JIT
0022 bool
0023
0024 menu "BPF subsystem"
0025
0026 config BPF_SYSCALL
0027 bool "Enable bpf() system call"
0028 select BPF
0029 select IRQ_WORK
0030 select TASKS_RCU if PREEMPTION
0031 select TASKS_TRACE_RCU
0032 select BINARY_PRINTF
0033 select NET_SOCK_MSG if NET
0034 select PAGE_POOL if NET
0035 default n
0036 help
0037 Enable the bpf() system call that allows to manipulate BPF programs
0038 and maps via file descriptors.
0039
0040 config BPF_JIT
0041 bool "Enable BPF Just In Time compiler"
0042 depends on BPF
0043 depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
0044 depends on MODULES
0045 help
0046 BPF programs are normally handled by a BPF interpreter. This option
0047 allows the kernel to generate native code when a program is loaded
0048 into the kernel. This will significantly speed-up processing of BPF
0049 programs.
0050
0051 Note, an admin should enable this feature changing:
0052 /proc/sys/net/core/bpf_jit_enable
0053 /proc/sys/net/core/bpf_jit_harden (optional)
0054 /proc/sys/net/core/bpf_jit_kallsyms (optional)
0055
0056 config BPF_JIT_ALWAYS_ON
0057 bool "Permanently enable BPF JIT and remove BPF interpreter"
0058 depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
0059 help
0060 Enables BPF JIT and removes BPF interpreter to avoid speculative
0061 execution of BPF instructions by the interpreter.
0062
0063 When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
0064 is permanently set to 1 and setting any other value than that will
0065 return failure.
0066
0067 config BPF_JIT_DEFAULT_ON
0068 def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
0069 depends on HAVE_EBPF_JIT && BPF_JIT
0070
0071 config BPF_UNPRIV_DEFAULT_OFF
0072 bool "Disable unprivileged BPF by default"
0073 default y
0074 depends on BPF_SYSCALL
0075 help
0076 Disables unprivileged BPF by default by setting the corresponding
0077 /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
0078 still reenable it by setting it to 0 later on, or permanently
0079 disable it by setting it to 1 (from which no other transition to
0080 0 is possible anymore).
0081
0082 Unprivileged BPF could be used to exploit certain potential
0083 speculative execution side-channel vulnerabilities on unmitigated
0084 affected hardware.
0085
0086 If you are unsure how to answer this question, answer Y.
0087
0088 source "kernel/bpf/preload/Kconfig"
0089
0090 config BPF_LSM
0091 bool "Enable BPF LSM Instrumentation"
0092 depends on BPF_EVENTS
0093 depends on BPF_SYSCALL
0094 depends on SECURITY
0095 depends on BPF_JIT
0096 help
0097 Enables instrumentation of the security hooks with BPF programs for
0098 implementing dynamic MAC and Audit Policies.
0099
0100 If you are unsure how to answer this question, answer N.
0101
0102 endmenu # "BPF subsystem"
