microsoft / microsoft/ebpf-for-windows
Support reloading eBPF core components without invalidating user handles
- Dominant language
- C
- Stars
- 3.6k
- Forks
- 311
- Avg merge
- 6d 10h
- Merged PRs (30d)
- 21
Description
### Describe the feature you'd like supported
Permit the core logic of eBPF to be reloaded while persevering eBPF programs, maps, and links.
### Proposed solution
There are several parts required to support this solution.
- [ ] The eBPF code interacting with the Windows IO Manager (eBPF Proxy) should call into the eBPF execution context (eBPF core) via dispatch table.
- [ ] IO Manager handles (FILE_OBJECT) should refer to eBPF execution context objects via object ID and not via pointer.
- [ ] eBPF core should support serializing and deserializing all eBPF objects into a single flat buffer.
- [ ] eBPF Proxy should obtain eBPF core dispatch table via NMR.
- [ ] Split eBPF proxy and eBPF core into two separate drivers.
- [ ] eBPF Proxy should support an interface for eBPF core to store a flat buffer when eBPF core is unloading and reloading.
- [ ] On unload, eBPF core should support serializing all remaining eBPF objects into a flat buffer and storing it with eBPF Proxy.
- [ ] On load, eBPF core should support checking for the presence of a stored buffer and deserializing all eBPF objects stored in the buffer.
- [ ] Serialization format should be forward and backward compatible.
### Additional context
_No response_
Contributor guide
Research direction
Start by mapping the eBPF Proxy, eBPF core, Windows IO Manager, and NMR responsibilities described in the checklist. Review how FILE_OBJECT handles and the current core objects are represented before assessing the serialization boundary. Done means the proxy and core can reload independently while preserving programs, maps, and links with forward- and backward-compatible state.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- c
- Domain
- operating-systems
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 20/100