1 # SPDX-License-Identifier: GPL-2.0-only
2 
3 # BPF interpreter that, for example, classic socket filters depend on.
4 config BPF
5 	bool
6 	select CRYPTO_LIB_SHA1
7 
8 # Used by archs to tell that they support BPF JIT compiler plus which
9 # flavour. Only one of the two can be selected for a specific arch since
10 # eBPF JIT supersedes the cBPF JIT.
11 
12 # Classic BPF JIT (cBPF)
13 config HAVE_CBPF_JIT
14 	bool
15 
16 # Extended BPF JIT (eBPF)
17 config HAVE_EBPF_JIT
18 	bool
19 
20 # Used by archs to tell that they want the BPF JIT compiler enabled by
21 # default for kernels that were compiled with BPF JIT support.
22 config ARCH_WANT_DEFAULT_BPF_JIT
23 	bool
24 
25 menu "BPF subsystem"
26 
27 config BPF_SYSCALL
28 	bool "Enable bpf() system call"
29 	select BPF
30 	select IRQ_WORK
31 	select NEED_TASKS_RCU
32 	select TASKS_TRACE_RCU
33 	select BINARY_PRINTF
34 	select NET_SOCK_MSG if NET
35 	select NET_XGRESS if NET
36 	select PAGE_POOL if NET
37 	default n
38 	help
39 	  Enable the bpf() system call that allows to manipulate BPF programs
40 	  and maps via file descriptors.
41 
42 config BPF_JIT
43 	bool "Enable BPF Just In Time compiler"
44 	depends on BPF
45 	depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
46 	select EXECMEM
47 	help
48 	  BPF programs are normally handled by a BPF interpreter. This option
49 	  allows the kernel to generate native code when a program is loaded
50 	  into the kernel. This will significantly speed-up processing of BPF
51 	  programs.
52 
53 	  Note, an admin should enable this feature changing:
54 	  /proc/sys/net/core/bpf_jit_enable
55 	  /proc/sys/net/core/bpf_jit_harden   (optional)
56 	  /proc/sys/net/core/bpf_jit_kallsyms (optional)
57 
58 config BPF_JIT_ALWAYS_ON
59 	bool "Permanently enable BPF JIT and remove BPF interpreter"
60 	depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
61 	help
62 	  Enables BPF JIT and removes BPF interpreter to avoid speculative
63 	  execution of BPF instructions by the interpreter.
64 
65 	  When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
66 	  is permanently set to 1 and setting any other value than that will
67 	  return failure.
68 
69 config BPF_JIT_DEFAULT_ON
70 	def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
71 	depends on HAVE_EBPF_JIT && BPF_JIT
72 
73 config BPF_UNPRIV_DEFAULT_OFF
74 	bool "Disable unprivileged BPF by default"
75 	default y
76 	depends on BPF_SYSCALL
77 	help
78 	  Disables unprivileged BPF by default by setting the corresponding
79 	  /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
80 	  still reenable it by setting it to 0 later on, or permanently
81 	  disable it by setting it to 1 (from which no other transition to
82 	  0 is possible anymore).
83 
84 	  Unprivileged BPF could be used to exploit certain potential
85 	  speculative execution side-channel vulnerabilities on unmitigated
86 	  affected hardware.
87 
88 	  If you are unsure how to answer this question, answer Y.
89 
90 source "kernel/bpf/preload/Kconfig"
91 
92 config BPF_LSM
93 	bool "Enable BPF LSM Instrumentation"
94 	depends on BPF_EVENTS
95 	depends on BPF_SYSCALL
96 	depends on SECURITY
97 	depends on BPF_JIT
98 	help
99 	  Enables instrumentation of the security hooks with BPF programs for
100 	  implementing dynamic MAC and Audit Policies.
101 
102 	  If you are unsure how to answer this question, answer N.
103 
104 endmenu # "BPF subsystem"
105