I guess this is for user space programming, but I was always taught that nothing "big and/or complicated" should happen in an interrupt. Instead, you should do no more than set a flag and rely on the normal non-interrupt code to check it and call the appropriate big and complicated function.

The usual example was that anything requiringmalloc orfree was too big and complicated. Running an eBPF program certainly seems big and complicated enough. But I guess kernel programmers are made of sterner stuff and they just have to provide for this? I have a feeling that the eBPF hooks for performance events wouldn't be practical if they used the traditional approach.