net / core / filter.c和linux / bpf / verifier.c

Question

If I understood well initially the cBPF verifier and interpreter were both within net/core/fiter.c for example sk_run_filter here https://elixir.bootlin.com/linux/v3.2/source/net/core/filter.c#L112 just convert the cBPF instructions applying them on the emulated registers and directly on the sk_buff. While sk_chk_filter check if the instructions are all legal.

Currently I've seen that there is still a bpf_check_classic function in filter.c which substitutes the old sk_chk_filter . After the check there is an attempt to JIT the program, if is not possible the next step is to convert the cBPF in eBPF.

QUESTIONS:

1) where is actually the call to run the jitted/converted cbpf filter in the last net/core/filter.c ?

2) Which is the sequence of function calls which bring a cBPF program to be executed as an eBPF program ?

Answer 1

As far as I know, cBPF program are only used for seccomp-bpf and as socket filters.

• For seccomp-bpf, the actual call is in kernel/seccomp.c , after the program has been converted to eBPF.
• For socket filters, the actual call is in net/core/filter.c , as you guessed. sk_filter_trim_cap() then gets called in a number of places in the kernel, for all types of sockets.