microsoft / microsoft/ebpf-for-windows

Support for providing max IRQL level for each program type and global helper functions.

Open
#1,900 1 comment 0 reactions 0 assignees View on GitHub
help wanted triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

This discussion came up as part of PR comment:
https://github.com/microsoft/ebpf-for-windows/pull/1847#discussion_r1068602104

Some eBPF program types are always invoked at PASSIVE level (e.g., `bind`) and some programs are always invoked at DISPATCH level (e.g., `xdp`).

This may cause some problems for different program types calling global helper functions, if the helper function can, say, only be called at passive level. This issue is more relevant now that we have support for overriding global helper functions, hence there can be multiple implementations.

**Proposal**:
1. Include the IRQL info in the program info and the helper prototypes passed to the verifier.
2. Add support in verifier to check the IRQL info to ensure a program running at DISPATCH does not invoke a helper function which can only be invoked at PASSIVE.

Contributor guide

Open the contributing guide

Research direction

Start with the discussion in PR 1847 and trace how program info and helper prototypes are passed to the verifier. Define how each program type and helper implementation reports its IRQL constraints, then verify that DISPATCH-level programs cannot invoke passive-only helpers. Done means the verifier enforces these compatibility checks, including overridden global helpers.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.