microsoft / microsoft/ebpf-for-windows

Document how to detect and workaround verifier failure on correlated branches

Open
#3,193 0 comments 0 reactions 0 assignees View on GitHub
documentation P3 triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

This sample demonstrates a case of correlated branches, which the Prevail verifier is unable to verify:
https://github.com/vbpf/ebpf-samples/blob/9057f7de29fb9bd8eaf6144f7bbf0b2d6e545e0e/src/dependent_read.c

Outside of hard-coded assembly sequences this occurs when the LLVM compiler merges multiple branches (as an example checks for packet size) into a single instruction sequence and stores the result in another register.

One work around is to make the context pointer volatile, which prevents the LLVM compiler from eliding reads from the context data structure which can help prevent the generation of correlated branches.

Contributor guide

Open the contributing guide

Research direction

Start with the linked src/dependent_read.c sample and trace how it demonstrates correlated branches that the Prevail verifier cannot verify. Document the failure scenario and the context-pointer volatile workaround, including the LLVM branch-merging behavior described in the issue; done means the explanation is available in the appropriate project documentation.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
compilers, documentation
Issue type
Documentation
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.