Is there any interpreter stage for eBPF programs?

Question

I'm new to eBPF, as the tutorial suggests, eBPF is a runtime with a jit compiler. As far as I am concerned, the bytecode is just translated into native code in eBPF, so I wonder if there is any interpretation stage like JVM in eBPF?

Answer 1

If you disable the JIT compiler, then yes, it will be interpreted.

You can disable the JIT compiler with:

echo 0 > /proc/sys/net/core/bpf_jit_enable

or in the kernel config. with:

CONFIG_BPF_JIT=n

Answer 2

In the Linux kernel, eBPF comes both with an interpreter and (for all wide-spread architectures) a JIT-compiler.

You can use either the interpreter or the JIT-compiler for your programs. This is controlled through the bpf_jit_enable knob for sysctl. They are not different stages of the execution process: When you use the interpreter, the kernel interprets your program and emulates registers; whereas with the JIT-compiler enabled, you get your instructions compiled into native code.

This being said, the interpreter is not always available. For security reasons (related to Spectre), some distributions will leave it out when compiling the kernel, by setting the kernel config option CONFIG_BPF_JIT_ALWAYS_ON=y. In that case, the interpreter cannot be used.