[PATCH bpf-next v2 0/2] Modify BPF_JIT_ALWAYS_ON and BPF_JIT_DEFAULT_ON

v2:
  -- Use the full path /proc/sys/net/core/bpf_jit_enable in the help text.
  -- Update the commit message to make it clear in patch #2.

Tiezhu Yang (2):
  bpf: Add some description about BPF_JIT_ALWAYS_ON in Kconfig
  bpf: Make BPF_JIT_DEFAULT_ON selectable in Kconfig

 kernel/bpf/Kconfig | 17 +++++++++++++++--
 1 file changed, 15 insertions(+), 2 deletions(-)

-- 
2.1.0

When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
is permanently set to 1 and setting any other value than that will return
in failure.

Add the above description in the help text of config BPF_JIT_ALWAYS_ON, and
then we can distinguish between BPF_JIT_ALWAYS_ON and BPF_JIT_DEFAULT_ON.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
 kernel/bpf/Kconfig | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig
index d24d518..cbf3f65 100644
--- a/kernel/bpf/Kconfig
+++ b/kernel/bpf/Kconfig

@@ -58,6 +58,10 @@ config BPF_JIT_ALWAYS_ON
 	  Enables BPF JIT and removes BPF interpreter to avoid speculative
 	  execution of BPF instructions by the interpreter.
 
+	  When CONFIG_BPF_JIT_ALWAYS_ON is enabled, /proc/sys/net/core/bpf_jit_enable
+	  is permanently set to 1 and setting any other value than that will return
+	  in failure.
+
 config BPF_JIT_DEFAULT_ON
 	def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
 	depends on HAVE_EBPF_JIT && BPF_JIT

-- 
2.1.0

Currently, only x86, arm64 and s390 select ARCH_WANT_DEFAULT_BPF_JIT,
the other archs do not select ARCH_WANT_DEFAULT_BPF_JIT. On the archs
without ARCH_WANT_DEFAULT_BPF_JIT, if we want to set bpf_jit_enable to
1 by default, the only way is to enable CONFIG_BPF_JIT_ALWAYS_ON, then
the users can not change it to 0 or 2, it seems bad for some users. We
can select ARCH_WANT_DEFAULT_BPF_JIT for those archs if it is proper,
but at least for now, make BPF_JIT_DEFAULT_ON selectable can give them
a chance.

Additionally, with this patch, under !BPF_JIT_ALWAYS_ON, we can disable
BPF_JIT_DEFAULT_ON on the archs with ARCH_WANT_DEFAULT_BPF_JIT when make
menuconfig, it seems flexible for some developers.

Signed-off-by: Tiezhu Yang <yangtiezhu@loongson.cn>
---
 kernel/bpf/Kconfig | 13 +++++++++++--
 1 file changed, 11 insertions(+), 2 deletions(-)

diff --git a/kernel/bpf/Kconfig b/kernel/bpf/Kconfig
index cbf3f65..461ac60 100644
--- a/kernel/bpf/Kconfig
+++ b/kernel/bpf/Kconfig

@@ -54,6 +54,7 @@ config BPF_JIT
 config BPF_JIT_ALWAYS_ON
 	bool "Permanently enable BPF JIT and remove BPF interpreter"
 	depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
+	select BPF_JIT_DEFAULT_ON
 	help
 	  Enables BPF JIT and removes BPF interpreter to avoid speculative
 	  execution of BPF instructions by the interpreter.

@@ -63,8 +64,16 @@ config BPF_JIT_ALWAYS_ON
 	  in failure.
 
 config BPF_JIT_DEFAULT_ON
-	def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
-	depends on HAVE_EBPF_JIT && BPF_JIT
+	bool "Defaultly enable BPF JIT and remove BPF interpreter"
+	default y if ARCH_WANT_DEFAULT_BPF_JIT
+	depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
+	help
+	  Enables BPF JIT and removes BPF interpreter to avoid speculative
+	  execution of BPF instructions by the interpreter.
+
+	  When CONFIG_BPF_JIT_DEFAULT_ON is enabled but CONFIG_BPF_JIT_ALWAYS_ON
+	  is disabled, /proc/sys/net/core/bpf_jit_enable is set to 1 by default
+	  and can be changed to 0 or 2.
 
 config BPF_UNPRIV_DEFAULT_OFF
 	bool "Disable unprivileged BPF by default"

-- 
2.1.0

On Fri, Feb 18, 2022 at 7:15 PM Tiezhu Yang [off-list ref] wrote:

nit: "return failure" (no "in").

Other than this,

Acked-by: Song Liu <redacted>

+
 config BPF_JIT_DEFAULT_ON
        def_bool ARCH_WANT_DEFAULT_BPF_JIT || BPF_JIT_ALWAYS_ON
        depends on HAVE_EBPF_JIT && BPF_JIT
--
2.1.0

On Fri, Feb 18, 2022 at 7:15 PM Tiezhu Yang [off-list ref] wrote:

I think "remove BPF interpreter" is not accurate. I guess we can just say
"Enable BPF JIT by default". (also "defaultly" sounds weird to me).

+       default y if ARCH_WANT_DEFAULT_BPF_JIT
+       depends on BPF_SYSCALL && HAVE_EBPF_JIT && BPF_JIT
+       help
+         Enables BPF JIT and removes BPF interpreter to avoid speculative
+         execution of BPF instructions by the interpreter.
+
+         When CONFIG_BPF_JIT_DEFAULT_ON is enabled but CONFIG_BPF_JIT_ALWAYS_ON
+         is disabled, /proc/sys/net/core/bpf_jit_enable is set to 1 by default
+         and can be changed to 0 or 2.

 config BPF_UNPRIV_DEFAULT_OFF
        bool "Disable unprivileged BPF by default"
--
2.1.0