1# SPDX-License-Identifier: GPL-2.0-only 2 3# BPF interpreter that, for example, classic socket filters depend on. 4config BPF 5 bool 6 7# Used by archs to tell that they support BPF JIT compiler plus which 8# flavour. Only one of the two can be selected for a specific arch since 9# eBPF JIT supersedes the cBPF JIT. 10 11# Classic BPF JIT (cBPF) 12config HAVE_CBPF_JIT 13 bool 14 15# Extended BPF JIT (eBPF) 16config HAVE_EBPF_JIT 17 bool 18 19# Used by archs to tell that they want the BPF JIT compiler enabled by 20# default for kernels that were compiled with BPF JIT support. 21config ARCH_WANT_DEFAULT_BPF_JIT 22 bool 23 24menu "BPF subsystem" 25 26config BPF_SYSCALL 27 bool "Enable bpf() system call" 28 select BPF 29 select IRQ_WORK 30 select TASKS_TRACE_RCU 31 select BINARY_PRINTF 32 select NET_SOCK_MSG if INET 33 default n 34 help 35 Enable the bpf() system call that allows to manipulate BPF programs 36 and maps via file descriptors. 37 38config BPF_JIT 39 bool "Enable BPF Just In Time compiler" 40 depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT 41 depends on MODULES 42 help 43 BPF programs are normally handled by a BPF interpreter. This option 44 allows the kernel to generate native code when a program is loaded 45 into the kernel. This will significantly speed-up processing of BPF 46 programs. 47 48 Note, an admin should enable this feature changing: 49 /proc/sys/net/core/bpf_jit_enable 50 /proc/sys/net/core/bpf_jit_harden (optional) 51 /proc/sys/net/core/bpf_jit_kallsyms (optional) 52 53config BPF_JIT_ALWAYS_ON 54 bool "Permanently enable BPF JIT and remove BPF interpreter" 55 depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT 56 help 57 Enables BPF JIT and removes BPF interpreter to avoid speculative 58 execution of BPF instructions by the interpreter. 59 60config BPF_JIT_DEFAULT_ON 61 def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON 62 depends on HAVE_EBPF_JIT && BPF_JIT 63 64source "kernel/bpf/preload/Kconfig" 65 66config BPF_LSM 67 bool "Enable BPF LSM Instrumentation" 68 depends on BPF_EVENTS 69 depends on BPF_SYSCALL 70 depends on SECURITY 71 depends on BPF_JIT 72 help 73 Enables instrumentation of the security hooks with BPF programs for 74 implementing dynamic MAC and Audit Policies. 75 76 If you are unsure how to answer this question, answer N. 77 78endmenu # "BPF subsystem" 79