microsoft / microsoft/ebpf-for-windows

Support reloading eBPF core components without invalidating user handles

Open
#2,652 0 comments 0 reactions 0 assignees View on GitHub
enhancement help wanted triaged
Dominant language
C
Stars
3.6k
Forks
311
Avg merge
6d 10h
Merged PRs (30d)
21

Description

### Describe the feature you'd like supported

Permit the core logic of eBPF to be reloaded while persevering eBPF programs, maps, and links.

### Proposed solution

There are several parts required to support this solution.
- [ ] The eBPF code interacting with the Windows IO Manager (eBPF Proxy) should call into the eBPF execution context (eBPF core) via dispatch table.
- [ ] IO Manager handles (FILE_OBJECT) should refer to eBPF execution context objects via object ID and not via pointer.
- [ ] eBPF core should support serializing and deserializing all eBPF objects into a single flat buffer.
- [ ] eBPF Proxy should obtain eBPF core dispatch table via NMR.
- [ ] Split eBPF proxy and eBPF core into two separate drivers.
- [ ] eBPF Proxy should support an interface for eBPF core to store a flat buffer when eBPF core is unloading and reloading.
- [ ] On unload, eBPF core should support serializing all remaining eBPF objects into a flat buffer and storing it with eBPF Proxy.
- [ ] On load, eBPF core should support checking for the presence of a stored buffer and deserializing all eBPF objects stored in the buffer.
- [ ] Serialization format should be forward and backward compatible.

### Additional context

_No response_

Contributor guide

Open the contributing guide

Research direction

Start by mapping the eBPF Proxy, eBPF core, Windows IO Manager, and NMR responsibilities described in the checklist. Review how FILE_OBJECT handles and the current core objects are represented before assessing the serialization boundary. Done means the proxy and core can reload independently while preserving programs, maps, and links with forward- and backward-compatible state.

Written by the indexing model from the issue text.

Assessment

Tech stack
c
Domain
operating-systems
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
20/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.