On Mon, Dec 9, 2019 at 9:07 AM Martin Lau <kafai@xxxxxx> wrote:
>
> On Mon, Dec 09, 2019 at 04:08:03PM +0100, Daniel Borkmann wrote:
> > After Spectre 2 fix via 290af86629b2 ("bpf: introduce BPF_JIT_ALWAYS_ON
> > config") most major distros use BPF_JIT_ALWAYS_ON configuration these days
> > which compiles out the BPF interpreter entirely and always enables the
> > JIT. Also given recent fix in e1608f3fa857 ("bpf: Avoid setting bpf insns
> > pages read-only when prog is jited"), we additionally avoid fragmenting
> > the direct map for the BPF insns pages sitting in the general data heap
> > since they are not used during execution. Latter is only needed when run
> > through the interpreter.
> >
> > Since both x86 and arm64 JITs have seen a lot of exposure over the years,
> > are generally most up to date and maintained, there is more downside in
> > !BPF_JIT_ALWAYS_ON configurations to have the interpreter enabled by default
> > rather than the JIT. Add a ARCH_WANT_DEFAULT_BPF_JIT config which archs can
> > use to set the bpf_jit_{enable,kallsyms} to 1. Back in the days the
> > bpf_jit_kallsyms knob was set to 0 by default since major distros still
> > had /proc/kallsyms addresses exposed to unprivileged user space which is
> > not the case anymore. Hence both knobs are set via BPF_JIT_DEFAULT_ON which
> > is set to 'y' in case of BPF_JIT_ALWAYS_ON or ARCH_WANT_DEFAULT_BPF_JIT.
> Acked-by: Martin KaFai Lau <kafai@xxxxxx>
Applied. Thanks
