• Daniel Borkmann's avatar
    bpf, x86, arm64: Enable jit by default when not built as always-on · 81c22041
    Daniel Borkmann authored
    After Spectre 2 fix via 290af866 ("bpf: introduce BPF_JIT_ALWAYS_ON
    config") most major distros use BPF_JIT_ALWAYS_ON configuration these days
    which compiles out the BPF interpreter entirely and always enables the
    JIT. Also given recent fix in e1608f3f ("bpf: Avoid setting bpf insns
    pages read-only when prog is jited"), we additionally avoid fragmenting
    the direct map for the BPF insns pages sitting in the general data heap
    since they are not used during execution. Latter is only needed when run
    through the interpreter.
    
    Since both x86 and arm64 JITs have seen a lot of exposure over the years,
    are generally most up to date and maintained, there is more downside in
    !BPF_JIT_ALWAYS_ON configurations to have the interpreter enabled by default
    rather than the JIT. Add a ARCH_WANT_DEFAULT_BPF_JIT config which archs can
    use to set the bpf_jit_{enable,kallsyms} to 1. Back in the days the
    bpf_jit_kallsyms knob was set to 0 by default since major distros still
    had /proc/kallsyms addresses exposed to unprivileged user space which is
    not the case anymore. Hence both knobs are set via BPF_JIT_DEFAULT_ON which
    is set to 'y' in case of BPF_JIT_ALWAYS_ON or ARCH_WANT_DEFAULT_BPF_JIT.
    Signed-off-by: default avatarDaniel Borkmann <daniel@iogearbox.net>
    Signed-off-by: default avatarAlexei Starovoitov <ast@kernel.org>
    Acked-by: default avatarWill Deacon <will@kernel.org>
    Acked-by: default avatarMartin KaFai Lau <kafai@fb.com>
    Link: https://lore.kernel.org/bpf/f78ad24795c2966efcc2ee19025fa3459f622185.1575903816.git.daniel@iogearbox.net
    81c22041
Kconfig 71.7 KB