v3:
-- Use "return failure" instead of "return in failure".
-- Use "Enable BPF JIT by default" for config BPF_JIT_DEFAULT_ON.
v2:
-- Use the full path /proc/sys/net/core/bpf_jit_enable in the help text.
-- Update the commit message to make it clear in patch #2.
Tiezhu Yang (2):
bpf: Add some description about BPF_JIT_ALWAYS_ON in Kconfig
bpf: Make BPF_JIT_DEFAULT_ON selectable in Kconfig
kernel/bpf/Kconfig | 17 +++++++++++++++--
1 file changed, 15 insertions(+), 2 deletions(-)
--
2.1.0
When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
is permanently set to 1 and setting any other value than that will return
failure.
Add the above description in the help text of config BPF_JIT_ALWAYS_ON, and
then we can distinguish between BPF_JIT_ALWAYS_ON and BPF_JIT_DEFAULT_ON.
Signed-off-by: Tiezhu Yang <[email protected]>
Acked-by: Song Liu <[email protected]>
---
kernel/bpf/Kconfig | 4 ++++
1 file changed, 4 insertions(+)
diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig
index d24d518..f3db15a 100644
--- a/kernel/bpf/Kconfig
+++ b/kernel/bpf/Kconfig
@@ -58,6 +58,10 @@ config BPF_JIT_ALWAYS_ON
Enables BPF JIT and removes BPF interpreter to avoid speculative
execution of BPF instructions by the interpreter.
+ When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
+ is permanently set to 1 and setting any other value than that will return
+ failure.
+
config BPF_JIT_DEFAULT_ON
def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
depends on HAVE_EBPF_JIT && BPF_JIT
--
2.1.0
Currently, only x86, arm64 and s390 select ARCH_WANT_DEFAULT_BPF_JIT,
the other archs do not select ARCH_WANT_DEFAULT_BPF_JIT. On the archs
without ARCH_WANT_DEFAULT_BPF_JIT, if we want to set bpf_jit_enable to
1 by default, the only way is to enable CONFIG_BPF_JIT_ALWAYS_ON, then
the users can not change it to 0 or 2, it seems bad for some users. We
can select ARCH_WANT_DEFAULT_BPF_JIT for those archs if it is proper,
but at least for now, make BPF_JIT_DEFAULT_ON selectable can give them
a chance.
Additionally, with this patch, under !BPF_JIT_ALWAYS_ON, we can disable
BPF_JIT_DEFAULT_ON on the archs with ARCH_WANT_DEFAULT_BPF_JIT when make
menuconfig, it seems flexible for some developers.
Signed-off-by: Tiezhu Yang <[email protected]>
---
kernel/bpf/Kconfig | 13 +++++++++++--
1 file changed, 11 insertions(+), 2 deletions(-)
diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig
index f3db15a..8521874 100644
--- a/kernel/bpf/Kconfig
+++ b/kernel/bpf/Kconfig
@@ -54,6 +54,7 @@ config BPF_JIT
config BPF_JIT_ALWAYS_ON
bool "Permanently enable BPF JIT and remove BPF interpreter"
depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
+ select BPF_JIT_DEFAULT_ON
help
Enables BPF JIT and removes BPF interpreter to avoid speculative
execution of BPF instructions by the interpreter.
@@ -63,8 +64,16 @@ config BPF_JIT_ALWAYS_ON
failure.
config BPF_JIT_DEFAULT_ON
- def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
- depends on HAVE_EBPF_JIT && BPF_JIT
+ bool "Enable BPF JIT by default"
+ default y if ARCH_WANT_DEFAULT_BPF_JIT
+ depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
+ help
+ Enables BPF JIT by default to avoid speculative execution of BPF
+ instructions by the interpreter.
+
+ When CONFIG_BPF_JIT_DEFAULT_ON is enabled but CONFIG_BPF_JIT_ALWAYS_ON
+ is disabled, /proc/sys/net/core/bpf_jit_enable is set to 1 by default
+ and can be changed to 0 or 2.
config BPF_UNPRIV_DEFAULT_OFF
bool "Disable unprivileged BPF by default"
--
2.1.0
On Tue, Feb 22, 2022 at 1:57 AM Tiezhu Yang <[email protected]> wrote:
>
> Currently, only x86, arm64 and s390 select ARCH_WANT_DEFAULT_BPF_JIT,
> the other archs do not select ARCH_WANT_DEFAULT_BPF_JIT. On the archs
> without ARCH_WANT_DEFAULT_BPF_JIT, if we want to set bpf_jit_enable to
> 1 by default, the only way is to enable CONFIG_BPF_JIT_ALWAYS_ON, then
> the users can not change it to 0 or 2, it seems bad for some users. We
> can select ARCH_WANT_DEFAULT_BPF_JIT for those archs if it is proper,
> but at least for now, make BPF_JIT_DEFAULT_ON selectable can give them
> a chance.
>
> Additionally, with this patch, under !BPF_JIT_ALWAYS_ON, we can disable
> BPF_JIT_DEFAULT_ON on the archs with ARCH_WANT_DEFAULT_BPF_JIT when make
> menuconfig, it seems flexible for some developers.
>
> Signed-off-by: Tiezhu Yang <[email protected]>
Acked-by: Song Liu <[email protected]>
Hi Tiezhu,
(patch 1/2 applied so far, thanks!)
On 2/22/22 10:57 AM, Tiezhu Yang wrote:
> Currently, only x86, arm64 and s390 select ARCH_WANT_DEFAULT_BPF_JIT,
> the other archs do not select ARCH_WANT_DEFAULT_BPF_JIT. On the archs
> without ARCH_WANT_DEFAULT_BPF_JIT, if we want to set bpf_jit_enable to
> 1 by default, the only way is to enable CONFIG_BPF_JIT_ALWAYS_ON, then
> the users can not change it to 0 or 2, it seems bad for some users. We
Can you elaborate on the "it seems bad for some users" part? What's the concrete
use case? Also, why not add (e.g. mips) JIT to ARCH_WANT_DEFAULT_BPF_JIT if the
CI suite passes with high degree/confidence?
> can select ARCH_WANT_DEFAULT_BPF_JIT for those archs if it is proper,
> but at least for now, make BPF_JIT_DEFAULT_ON selectable can give them
> a chance.
>
> Additionally, with this patch, under !BPF_JIT_ALWAYS_ON, we can disable
> BPF_JIT_DEFAULT_ON on the archs with ARCH_WANT_DEFAULT_BPF_JIT when make
> menuconfig, it seems flexible for some developers.
>
> Signed-off-by: Tiezhu Yang <[email protected]>
> ---
> kernel/bpf/Kconfig | 13 +++++++++++--
> 1 file changed, 11 insertions(+), 2 deletions(-)
>
> diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig
> index f3db15a..8521874 100644
> --- a/kernel/bpf/Kconfig
> +++ b/kernel/bpf/Kconfig
> @@ -54,6 +54,7 @@ config BPF_JIT
> config BPF_JIT_ALWAYS_ON
> bool "Permanently enable BPF JIT and remove BPF interpreter"
> depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
> + select BPF_JIT_DEFAULT_ON
Is the above needed if ...
> help
> Enables BPF JIT and removes BPF interpreter to avoid speculative
> execution of BPF instructions by the interpreter.
> @@ -63,8 +64,16 @@ config BPF_JIT_ALWAYS_ON
> failure.
>
> config BPF_JIT_DEFAULT_ON
> - def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
> - depends on HAVE_EBPF_JIT && BPF_JIT
> + bool "Enable BPF JIT by default"
> + default y if ARCH_WANT_DEFAULT_BPF_JIT
... we retain the prior `default y if ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON` ?
> + depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
Why is the extra BPF_SYSCALL dependency needed? You could still have this for cBPF->eBPF
translations when BPF syscall is compiled out (e.g. seccomp, sock/packet filters, etc).
> + help
> + Enables BPF JIT by default to avoid speculative execution of BPF
> + instructions by the interpreter.
> +
> + When CONFIG_BPF_JIT_DEFAULT_ON is enabled but CONFIG_BPF_JIT_ALWAYS_ON
> + is disabled, /proc/sys/net/core/bpf_jit_enable is set to 1 by default
> + and can be changed to 0 or 2.
>
> config BPF_UNPRIV_DEFAULT_OFF
> bool "Disable unprivileged BPF by default"
>
Hello:
This series was applied to bpf/bpf-next.git (master)
by Daniel Borkmann <[email protected]>:
On Tue, 22 Feb 2022 17:57:04 +0800 you wrote:
> v3:
> -- Use "return failure" instead of "return in failure".
> -- Use "Enable BPF JIT by default" for config BPF_JIT_DEFAULT_ON.
>
> v2:
> -- Use the full path /proc/sys/net/core/bpf_jit_enable in the help text.
> -- Update the commit message to make it clear in patch #2.
>
> [...]
Here is the summary with links:
- [bpf-next,v3,1/2] bpf: Add some description about BPF_JIT_ALWAYS_ON in Kconfig
https://git.kernel.org/bpf/bpf-next/c/b664e255ba3c
- [bpf-next,v3,2/2] bpf: Make BPF_JIT_DEFAULT_ON selectable in Kconfig
(no matching commit)
You are awesome, thank you!
--
Deet-doot-dot, I am a bot.
https://korg.docs.kernel.org/patchwork/pwbot.html