mirror of
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git
synced 2026-10-26 10:57:38 +08:00
Eric Biggers
d5c101840a
BPF crypto was implemented using the lskcipher API, which doesn't seem to be going anywhere. lskcipher supports only ARC4 and block ciphers in CBC and ECB mode, and only with unoptimized implementations. Library APIs also have been found to be a much better approach, for a variety of reasons, including reduced overhead, greater flexibility, and having to be explicit about the crypto algorithms that are supported. We can safely ignore the theoretical ARC4 and non-AES block cipher support in BPF crypto as unused, which leaves AES-CBC and AES-ECB. AES-CBC was stated to be needed for decrypting packets using a homebrew UDP-based protocol (https://lore.kernel.org/r/d1cdfc23-b336-49a9-8833-29f05b5b9fec@linux.dev/). AES-ECB is used by the BPF self-tests, and it was stated to maybe be used in the future for QUIC-LB (https://lore.kernel.org/r/5f9c3aab-5339-463c-a86d-edac297e1e95@linux.dev/). Those reasons don't make much sense either, especially AES-ECB which isn't appropriate in new systems and should be dropped. Regardless, let's assume that both AES-CBC and AES-ECB need to be kept for now. There are library APIs for both of these now, which are much easier to use and more efficient. Reimplement BPF crypto on top of them, greatly simplifying the code. As part of this, the bpf_crypto_type abstraction layer is removed, as it's not useful. This removes the only user of the lskcipher API, so follow-up patches will be able to remove that code as well. Signed-off-by: Eric Biggers <ebiggers@kernel.org> Signed-off-by: Alexei Starovoitov <ast@kernel.org> Link: https://patch.msgid.link/20260924184254.142720-1-ebiggers@kernel.org
131 lines
3.7 KiB
Plaintext
131 lines
3.7 KiB
Plaintext
# SPDX-License-Identifier: GPL-2.0-only
|
|
|
|
# BPF interpreter that, for example, classic socket filters depend on.
|
|
config BPF
|
|
bool
|
|
select CRYPTO_LIB_SHA256
|
|
|
|
# Used by archs to tell that they support BPF JIT compiler plus which
|
|
# flavour. Only one of the two can be selected for a specific arch since
|
|
# eBPF JIT supersedes the cBPF JIT.
|
|
|
|
# Classic BPF JIT (cBPF)
|
|
config HAVE_CBPF_JIT
|
|
bool
|
|
|
|
# Extended BPF JIT (eBPF)
|
|
config HAVE_EBPF_JIT
|
|
bool
|
|
|
|
# KASAN support for JIT compiler
|
|
config HAVE_EBPF_JIT_KASAN
|
|
bool
|
|
|
|
# Used by archs to tell that they want the BPF JIT compiler enabled by
|
|
# default for kernels that were compiled with BPF JIT support.
|
|
config ARCH_WANT_DEFAULT_BPF_JIT
|
|
bool
|
|
|
|
menu "BPF subsystem"
|
|
|
|
config BPF_SYSCALL
|
|
bool "Enable bpf() system call"
|
|
select BPF
|
|
select IRQ_WORK
|
|
select NEED_TASKS_RCU
|
|
select TASKS_TRACE_RCU
|
|
select BINARY_PRINTF
|
|
select NET_SOCK_MSG if NET
|
|
select NET_XGRESS if NET
|
|
select PAGE_POOL if NET
|
|
default n
|
|
help
|
|
Enable the bpf() system call that allows to manipulate BPF programs
|
|
and maps via file descriptors.
|
|
|
|
config BPF_JIT
|
|
bool "Enable BPF Just In Time compiler"
|
|
depends on BPF
|
|
depends on HAVE_CBPF_JIT || HAVE_EBPF_JIT
|
|
select EXECMEM
|
|
help
|
|
BPF programs are normally handled by a BPF interpreter. This option
|
|
allows the kernel to generate native code when a program is loaded
|
|
into the kernel. This will significantly speed-up processing of BPF
|
|
programs.
|
|
|
|
Note, an admin should enable this feature changing:
|
|
/proc/sys/net/core/bpf_jit_enable
|
|
/proc/sys/net/core/bpf_jit_harden (optional)
|
|
/proc/sys/net/core/bpf_jit_kallsyms (optional)
|
|
|
|
config BPF_JIT_ALWAYS_ON
|
|
bool "Permanently enable BPF JIT and remove BPF interpreter"
|
|
depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
|
|
help
|
|
Enables BPF JIT and removes BPF interpreter to avoid speculative
|
|
execution of BPF instructions by the interpreter.
|
|
|
|
When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
|
|
is permanently set to 1 and setting any other value than that will
|
|
return failure.
|
|
|
|
config BPF_JIT_DEFAULT_ON
|
|
def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
|
|
depends on HAVE_EBPF_JIT && BPF_JIT
|
|
|
|
config BPF_UNPRIV_DEFAULT_OFF
|
|
bool "Disable unprivileged BPF by default"
|
|
default y
|
|
depends on BPF_SYSCALL
|
|
help
|
|
Disables unprivileged BPF by default by setting the corresponding
|
|
/proc/sys/kernel/unprivileged_bpf_disabled knob to 2. An admin can
|
|
still reenable it by setting it to 0 later on, or permanently
|
|
disable it by setting it to 1 (from which no other transition to
|
|
0 is possible anymore).
|
|
|
|
Unprivileged BPF could be used to exploit certain potential
|
|
speculative execution side-channel vulnerabilities on unmitigated
|
|
affected hardware.
|
|
|
|
If you are unsure how to answer this question, answer Y.
|
|
|
|
config BPF_CRYPTO
|
|
def_bool y
|
|
depends on BPF_SYSCALL
|
|
select CRYPTO_LIB_AES_CBC
|
|
select CRYPTO_LIB_AES_ECB
|
|
help
|
|
Provide the kfuncs needed for BPF programs to encrypt and decrypt
|
|
data. The supported algorithms are AES-CBC and AES-ECB.
|
|
|
|
source "kernel/bpf/preload/Kconfig"
|
|
|
|
config BPF_LSM
|
|
bool "Enable BPF LSM Instrumentation"
|
|
depends on BPF_EVENTS
|
|
depends on BPF_SYSCALL
|
|
depends on SECURITY
|
|
depends on BPF_JIT
|
|
help
|
|
Enables instrumentation of the security hooks with BPF programs for
|
|
implementing dynamic MAC and Audit Policies.
|
|
|
|
If you are unsure how to answer this question, answer N.
|
|
|
|
config BPF_JIT_KASAN
|
|
bool
|
|
depends on HAVE_EBPF_JIT_KASAN
|
|
depends on KASAN_GENERIC
|
|
depends on KASAN_VMALLOC
|
|
depends on BPF_JIT
|
|
default y
|
|
help
|
|
Makes JIT compiler insert generic outline KASAN checks in BPF
|
|
programs when they are inserted in the kernel. This feature is
|
|
automatically enabled if the needed set of KASAN and BPF
|
|
configuration options is enabled.
|
|
|
|
endmenu # "BPF subsystem"
|