Update verifier submodule, fix breaking changes.#5216
Merged
saxena-anurag merged 13 commits intoMay 13, 2026
Conversation
Contributor
1 similar comment
Contributor
…tps://github.com/microsoft/ebpf-for-windows into user/anusa/user/anusa/update_verifier_submodule2
Contributor
Contributor
Contributor
Contributor
Contributor
Contributor
saxena-anurag
changed the title
saxena-anurag
requested review from
Alan-Jowett,
LakshK98,
dthaler,
matthewige,
mikeagun,
mtfriesen,
poornagmsft and
shankarseal
as code owners
dthaler
reviewed
May 4, 2026
Contributor
2 tasks
mikeagun
previously approved these changes
May 8, 2026
Contributor
Contributor
mikeagun
approved these changes
May 12, 2026
Contributor
There was a problem hiding this comment.
Pull request overview
This PR updates the PREVAIL verifier integration (including the external/ebpf-verifier submodule migration) and refactors the eBPF-for-Windows verifier-facing API surface to match upstream breaking changes (e.g., VerifierOptions, AnalysisContext, and ebpf_ctx_descriptor_t naming).
Changes:
- Updated verifier option plumbing to use
prevail::VerifierOptionsand newer analysis APIs (AnalysisContext, updated printing helpers). - Renamed/adjusted context descriptor usage across the codebase (
ebpf_context_descriptor_t→ebpf_ctx_descriptor_t) and updated serialization/store interactions accordingly. - Tightened Windows verifier platform hooks (helper usability/prototype now takes program type; map descriptor lookup API now takes descriptor list).
Reviewed changes
Copilot reviewed 30 out of 30 changed files in this pull request and generated 3 comments.
Show a summary per file
| File | Description |
|---|---|
| undocked/tests/sample/ext/inc/sample_ext_program_info.h | Rename sample extension context descriptor type to ebpf_ctx_descriptor_t. |
| tests/libfuzzer/netebpfext_fuzzer/libfuzz_harness.cpp | Update fuzzer harness context descriptor pointer type. |
| tests/export_program_info_test/export_program_info_test.cpp | Update exported program-info test context descriptor type. |
| tests/end_to_end/helpers.h | Update end-to-end test context descriptor type. |
| tests/cilium/cilium_tests.cpp | Include/format tweaks and context descriptor type update. |
| scripts/check_binary_dependencies_ebpfsvc_exe_regular_debug.txt | Adjust expected dependency list for ebpfsvc.exe debug build. |
| netebpfext/net_ebpf_ext_program_info.h | Update network extension program context descriptor type. |
| libs/store_helper/ebpf_store_helper.c | Store context descriptor using sizeof(ebpf_ctx_descriptor_t). |
| libs/shared/shared_common.c | Validate/duplicate program descriptors using ebpf_ctx_descriptor_t. |
| libs/shared/ebpf_serialize.c | Serialize/deserialize program type descriptor context using ebpf_ctx_descriptor_t. |
| libs/service/verifier_service.cpp | Switch verifier options to prevail::VerifierOptions. |
| libs/service/api_service.cpp | Pass program type into helper prototype queries during helper-id mapping. |
| libs/runtime/unit/platform_unit_test.cpp | Update serialization unit test to use ebpf_ctx_descriptor_t. |
| libs/execution_context/unit/execution_context_unit_test.cpp | Update unit test declarations/uses for new descriptor type. |
| libs/execution_context/ebpf_program.c | Update context descriptor types used in context header accessors and context-data lookup. |
| libs/api/windows_platform.cpp | Update platform map parsing signature to const VerifierOptions&. |
| libs/api/Verifier.h | Update verifier-related typedefs/APIs to VerifierOptions. |
| libs/api/Verifier.cpp | Update instruction stats/call classification to use call resolver and updated print APIs. |
| libs/api/ebpf_api.cpp | Use VerifierOptions when loading/verifying from ELF. |
| libs/api_common/windows_platform_common.hpp | Update Windows platform helper/map descriptor APIs; add verification program-type setters/getters. |
| libs/api_common/windows_platform_common.cpp | Implement program-type info lookup by program type; add TLS program-type tracking. |
| libs/api_common/windows_helpers.cpp | Require program type for helper usability/prototype checks; populate verifier prototype with ctx descriptor. |
| libs/api_common/store_helper_internal.cpp | Update store-loading to allocate/read ebpf_ctx_descriptor_t. |
| libs/api_common/api_common.hpp | Update verifier API signatures to VerifierOptions. |
| libs/api_common/api_common.cpp | Update verification flow to use AnalysisContext + new options fields; set TLS program type for verification. |
| include/ebpf_program_types.h | Update program type descriptor’s context pointer type. |
| docs/PerfEventArray.md | Update docs to reference ebpf_ctx_descriptor_t. |
| docs/eBpfExtensions.md | Update extension documentation and examples for new context descriptor naming. |
| .gitmodules | Move verifier submodule URL to https://github.com/vbpf/prevail.git. |
Comment on lines
183
to
+188
| if (info.type.platform_specific_data == (uintptr_t)&EBPF_PROGRAM_TYPE_UNSPECIFIED) { | ||
| throw std::runtime_error("Unspecified program type."); | ||
| } | ||
| const auto program = prevail::Program::from_sequence(instruction_sequence, info, options); | ||
| auto analysis_result = prevail::analyze(program); | ||
| set_verification_program_type(&info.type); | ||
| auto program = prevail::Program::from_sequence(instruction_sequence, info, options); | ||
| prevail::AnalysisContext context{std::move(program), options}; |
| _In_ const void* program_context, _Out_ const uint8_t** data_start, _Out_ const uint8_t** data_end) | ||
| { | ||
| ebpf_context_descriptor_t* context_descriptor; | ||
| ebpf_ctx_descriptor_t* context_descriptor; |
Comment on lines
132
to
136
| instruction.imm = helper_id_mapping[instruction.imm]; | ||
| } | ||
| for (auto& [old_helper_id, new_helper_id] : helper_id_mapping) { | ||
| if (get_helper_prototype_windows(old_helper_id).return_type != | ||
| if (get_helper_prototype_windows(old_helper_id, program_type).return_type != | ||
| EBPF_RETURN_TYPE_INTEGER_OR_NO_RETURN_IF_SUCCEED) { |
Alan-Jowett
approved these changes
May 13, 2026
saxena-anurag
deleted the
user/anusa/user/anusa/update_verifier_submodule2
branch
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
This PR updates the external verifier submodule that contains one ASAN fix and a couple of other fixes needed for array map optimization, along with code refactoring to integrate with latest verifier options and program context handling changes with eBPF code.
Dependency and Compatibility Updates:
external/ebpf-verifiersubmodule to point to the newprevailrepository, and advanced to a newer commit. This ensures we use the latest upstream verifier codebase. [1] [2]ebpf_context_descriptor_t(nowebpf_ctx_descriptor_t) in the verifier, ensuring existing code continues to work.Verifier Options and API Refactoring:
ebpf_verifier_options_tto the newVerifierOptionsstruct throughout the API, aligning with upstream changes and improving code clarity. [1] [2] [3] [4] [5] [6] [7] [8] [9]runtimeandmust_have_exit, reflecting the latest verifier API.Program and Analysis Context Handling:
AnalysisContextobject, passing it to the analysis routines and invariant printing, which improves modularity and future extensibility.Windows Helper and Map Descriptor Improvements:
context_descriptortoctx_descriptorin several places for consistency with upstream changes, and updated memory management accordingly. [1] [2] [3]Verifier Instruction and Call Resolution:
call_resolverlogic and passProgramInfoas needed, improving accuracy in statistics and reporting. [1] [2] [3]These changes collectively modernize the verifier API, improve compatibility with upstream changes, and enhance the maintainability and correctness of the codebase.
Testing
Existing CICD.
If new tests were added:
Documentation
No
Installation
No