@@ -35,9 +35,34 @@ Table : Subdirectories in /proc/sys/net
3535bpf_jit_enable
3636--------------
3737
38- This enables Berkeley Packet Filter Just in Time compiler.
39- Currently supported on x86_64 architecture, bpf_jit provides a framework
40- to speed packet filtering, the one used by tcpdump/libpcap for example.
38+ This enables the BPF Just in Time (JIT) compiler. BPF is a flexible
39+ and efficient infrastructure allowing to execute bytecode at various
40+ hook points. It is used in a number of Linux kernel subsystems such
41+ as networking (e.g. XDP, tc), tracing (e.g. kprobes, uprobes, tracepoints)
42+ and security (e.g. seccomp). LLVM has a BPF back end that can compile
43+ restricted C into a sequence of BPF instructions. After program load
44+ through bpf(2) and passing a verifier in the kernel, a JIT will then
45+ translate these BPF proglets into native CPU instructions. There are
46+ two flavors of JITs, the newer eBPF JIT currently supported on:
47+ - x86_64
48+ - arm64
49+ - ppc64
50+ - sparc64
51+ - mips64
52+ - s390x
53+
54+ And the older cBPF JIT supported on the following archs:
55+ - arm
56+ - mips
57+ - ppc
58+ - sparc
59+
60+ eBPF JITs are a superset of cBPF JITs, meaning the kernel will
61+ migrate cBPF instructions into eBPF instructions and then JIT
62+ compile them transparently. Older cBPF JITs can only translate
63+ tcpdump filters, seccomp rules, etc, but not mentioned eBPF
64+ programs loaded through bpf(2).
65+
4166Values :
4267 0 - disable the JIT (default value)
4368 1 - enable the JIT
@@ -46,9 +71,9 @@ Values :
4671bpf_jit_harden
4772--------------
4873
49- This enables hardening for the Berkeley Packet Filter Just in Time compiler.
50- Supported are eBPF JIT backends. Enabling hardening trades off performance,
51- but can mitigate JIT spraying.
74+ This enables hardening for the BPF JIT compiler. Supported are eBPF
75+ JIT backends. Enabling hardening trades off performance, but can
76+ mitigate JIT spraying.
5277Values :
5378 0 - disable JIT hardening (default value)
5479 1 - enable JIT hardening for unprivileged users only
@@ -57,11 +82,11 @@ Values :
5782bpf_jit_kallsyms
5883----------------
5984
60- When Berkeley Packet Filter Just in Time compiler is enabled, then compiled
61- images are unknown addresses to the kernel, meaning they neither show up in
62- traces nor in /proc/kallsyms. This enables export of these addresses, which
63- can be used for debugging/tracing. If bpf_jit_harden is enabled, this feature
64- is disabled.
85+ When BPF JIT compiler is enabled, then compiled images are unknown
86+ addresses to the kernel, meaning they neither show up in traces nor
87+ in /proc/kallsyms. This enables export of these addresses, which can
88+ be used for debugging/tracing. If bpf_jit_harden is enabled, this
89+ feature is disabled.
6590Values :
6691 0 - disable JIT kallsyms export (default value)
6792 1 - enable JIT kallsyms export for privileged users only
0 commit comments