search

microsoft / ebpf-for-windows

eBPF implementation that runs on top of Windows
MIT License
2.94k stars 237 forks source link

Check for clang version in bpf2c / ebpfapi.dll #3369

Open saxena-anurag opened 8 months ago

saxena-anurag commented 8 months ago

ebpf-for-windows currently only supports clang v11.0.1. If someone is using a newer clang version to compile their eBPF program, the program may fail the verification and it is not easy to figure out that the issue is with the clang version used.

It looks like clang embeds the version in the ELF file in .debug_str section like below:

```Contents of section .debug_str:
0000 636c616e 67207665 7273696f 6e203131  clang version 11
0010 2e302e31 00756e64 6f636b65 645c7465  .0.1.undocked\te
0020 73745f73 616d706c 655f6562 70662e63  st_sample_ebpf.c
0030 00453a5c 6769745c 67697468 7562325c  .E:\git\github2\
0040 65627066 2d666f72 2d77696e 646f7773  ebpf-for-windows
0050 2d315c74 65737473 5c73616d 706c6500  -1\tests\sample.
0060 74657374 5f6d6170 00747970 6500696e  test_map.type.in
0070 74005f5f 41525241 595f5349 5a455f54  t.__ARRAY_SIZE_T
0080 5950455f 5f006b65 7900756e 7369676e  YPE__.key.unsign
0090 65642069 6e740075 696e7433 325f7400  ed int.uint32_t.

We can probably update ebpfapi and bpf2c to check the clang version before invoking the verifier, and fail verification with clear error message stating that wrong version of clang was used.

Alan-Jowett commented 3 weeks ago

Bpf2c should reject if this is not the MSVC version of Clang/LLVM.

dthaler commented 3 weeks ago

I disagree. I would say to just warn (not reject). If a newer clang passes verification it can be significantly more performant which might be important for some customers. If there's a technical reason to reject more performant code, please state it.