Does BPF_PROG_RUN implements the fallback ebpf interpreter?

Question

https://github.com/torvalds/linux/blob/33920f1ec5bf47c5c0a1d2113989bdd9dfb3fae9/include/linux/filter.h#L556-L571 is this the implementation of the ebpf fallback interpreter?

score 1 · Answer 1 · answered Sep 08 '19 at 19:05

1

No, BPF_PROG_RUN calls either the interpreter or the JITed program depending on what prog->bpf_func points to. It also updates statistics (runtime and number of BPF executions) if the user enabled bpf stats.

answered Sep 08 '19 at 19:05

pchaigno

11,313
2
29
54

score 1 · Accepted Answer · answered Sep 08 '19 at 19:11

To complete pchaigno's answer: The selection for prog->bpf_func is done by bpf_prog_select_runtime() defined in kernel/bpf/core.c, and called in kernel/bpf/syscall.c in bpf_prog_load(), i.e. when the bpf() system call is used with the BPF_PROG_LOAD command.

Selected runtime can be the in-kernel interpreter, a JIT-compiled function if JIT is in use, or a function JIT-compiled by a NIC driver in case of hardware offload.

Does BPF_PROG_RUN implements the fallback ebpf interpreter?

2 Answers2