Search code examples
cinterpreterbpfebpf

Does BPF_PROG_RUN implements the fallback ebpf interpreter?

https://github.com/torvalds/linux/blob/33920f1ec5bf47c5c0a1d2113989bdd9dfb3fae9/include/linux/filter.h#L556-L571 is this the implementation of the ebpf fallback interpreter?

Solution

  • To complete pchaigno's answer: The selection for prog->bpf_func is done by bpf_prog_select_runtime() defined in kernel/bpf/core.c, and called in kernel/bpf/syscall.c in bpf_prog_load(), i.e. when the bpf() system call is used with the BPF_PROG_LOAD command.

    Selected runtime can be the in-kernel interpreter, a JIT-compiled function if JIT is in use, or a function JIT-compiled by a NIC driver in case of hardware offload.