microsoft / microsoft/ebpf-for-windows
Document how to detect and workaround verifier failure on correlated branches
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
This sample demonstrates a case of correlated branches, which the Prevail verifier is unable to verify:
https://github.com/vbpf/ebpf-samples/blob/9057f7de29fb9bd8eaf6144f7bbf0b2d6e545e0e/src/dependent_read.c
Outside of hard-coded assembly sequences this occurs when the LLVM compiler merges multiple branches (as an example checks for packet size) into a single instruction sequence and stores the result in another register.
One work around is to make the context pointer volatile, which prevents the LLVM compiler from eliding reads from the context data structure which can help prevent the generation of correlated branches.
Contributor guide
Research direction
Start with the linked src/dependent_read.c sample and trace how it demonstrates correlated branches that the Prevail verifier cannot verify. Document the failure scenario and the context-pointer volatile workaround, including the LLVM branch-merging behavior described in the issue; done means the explanation is available in the appropriate project documentation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- compilers, documentation
- Issue type
- Documentation
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 45/100