1 # SPDX-License-Identifier: GPL-2.0-only
3 # BPF interpreter that, for example, classic socket filters depend on.
7 # Used by archs to tell that they support BPF JIT compiler plus which
8 # flavour. Only one of the two can be selected for a specific arch since
9 # eBPF JIT supersedes the cBPF JIT.
11 # Classic BPF JIT (cBPF)
15 # Extended BPF JIT (eBPF)
19 # Used by archs to tell that they want the BPF JIT compiler enabled by
20 # default for kernels that were compiled with BPF JIT support.
21 config ARCH_WANT_DEFAULT_BPF_JIT
27 bool "Enable bpf() system call"
30 select TASKS_TRACE_RCU
32 select NET_SOCK_MSG if NET
35 Enable the bpf() system call that allows to manipulate BPF programs
36 and maps via file descriptors.
39 bool "Enable BPF Just In Time compiler"
41 depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
44 BPF programs are normally handled by a BPF interpreter. This option
45 allows the kernel to generate native code when a program is loaded
46 into the kernel. This will significantly speed-up processing of BPF
49 Note, an admin should enable this feature changing:
50 /proc/sys/net/core/bpf_jit_enable
51 /proc/sys/net/core/bpf_jit_harden (optional)
52 /proc/sys/net/core/bpf_jit_kallsyms (optional)
54 config BPF_JIT_ALWAYS_ON
55 bool "Permanently enable BPF JIT and remove BPF interpreter"
56 depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
58 Enables BPF JIT and removes BPF interpreter to avoid speculative
59 execution of BPF instructions by the interpreter.
61 config BPF_JIT_DEFAULT_ON
62 def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
63 depends on HAVE_EBPF_JIT && BPF_JIT
65 config BPF_UNPRIV_DEFAULT_OFF
66 bool "Disable unprivileged BPF by default"
67 depends on BPF_SYSCALL
69 Disables unprivileged BPF by default by setting the corresponding
70 /proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
71 still reenable it by setting it to 0 later on, or permanently
72 disable it by setting it to 1 (from which no other transition to
73 0 is possible anymore).
75 source "kernel/bpf/preload/Kconfig"
78 bool "Enable BPF LSM Instrumentation"
80 depends on BPF_SYSCALL
84 Enables instrumentation of the security hooks with BPF programs for
85 implementing dynamic MAC and Audit Policies.
87 If you are unsure how to answer this question, answer N.
89 endmenu # "BPF subsystem"