Skip to content

Releases: microsoft/ebpf-for-windows

Release-v1.1.0

25 Mar 00:53

Choose a tag to compare

Release-v1.1.0 Pre-release
Pre-release

Highlights

This is the first stable release of eBPF for Windows following the v1.0.0 release candidates. The important changes include:

  • Custom Maps: eBPF extensions can now register and implement their own custom map types via custom map types via ebpf_base_map_provider_dispatch_table_t, enabling extension-specific map entry handling.
  • Synchronous Ring Buffer and Perf Event Array APIs: Implements libbpf-compatible synchronous APIs for both ring buffer (ring_buffer__poll, ring_buffer__consume) and perf event array (perf_buffer__poll, perf_buffer__consume) maps.
  • Accept and Bind Hook Hard/Soft Permit: Accept and bind hooks now support hard and soft permit verdicts (extending connect hook support from v1.0), giving control over whether subsequent hook programs/filters can override a permit decision.
  • Epoch Memory Improvements: Replaced InterlockedCompareExchange64 with ReadAcquire64 for published epoch reads, eliminating LOCK-prefix cache-line contention (4–43% benchmark improvement). Also fixed a per-CPU epoch skew bug and wrapped remaining async completion code paths in epoch logic.

What's Changed

  • updated list of maintainers. by @shankarseal in #4746
  • update WDK version to 10.0.26100.6584 by @shankarseal in #4752
  • update version to 1.1.0 and other miscellaneous changes. by @shankarseal in #4723
  • wont fix policy. by @shankarseal in #4753
  • fix bpf-conformance version path for onebranch by @mikeagun in #4754
  • Exposing result helpers to be consumable by extensions by @nmlud21 in #4733
  • Optimize nested map operations by @saxena-anurag in #4684
  • Update usersim submodule to latest by @saxena-anurag in #4792
  • Add implementation for RtlUTF8StringToUnicodeString by @saxena-anurag in #4793
  • Fix for #4647 - Bugcheck in eBPFCore by @kumarvin123 in #4790
  • Add metadata file by @saxena-anurag in #4798
  • Update procDump checksum by @LakshK98 in #4836
  • Added KM test to test load/unload of sample drivers by @nmlud21 in #4830
  • Increase test timeout for stress tests. by @saxena-anurag in #4771
  • Re-enable regression tests using v1.0.0-rc1 by @mikeagun in #4838
  • Fix ensure-issue-linked workflow 403 error when commenting on PRs by @Copilot in #4762
  • Fixes: #4702 - The cilium_tests should be changed to work without the… by @kumarvin123 in #4860
  • _ebpf_object_load_native: wait until service is deleted on error by @lmb in #4785
  • Fix path quoting in Install-eBPFComponents and Uninstall-eBPFComponents by @lmb in #4805
  • Updated build platform path by @nmlud21 in #4859
  • Fixed incorrect invocation of netsh during ebpf install by @nmlud21 in #4858
  • Extension Code Deduplication Doc by @LakshK98 in #4806
  • Fix ETL collection for driver tests by @matthewige in #4872
  • Hold program information provider rundown reference while using program information by @Alan-Jowett in #4877
  • Fix VM expiry issue by @matthewige in #4871
  • Fixes #4706: Bring back XDP Mock provider and test XDP programs by @kumarvin123 in #4878
  • Accept hook hard permit support by @mikeagun in #4800
  • Mark load_all_sample_programs as mandatory by @nmlud21 in #4880
  • Let check-pr workflow inherit permissions by @dthaler in #4848
  • bind hook hard/soft permit support by @mikeagun in #4886
  • Add automatic issue creation on netperf workflow failure by @Copilot in #4903
  • Ensure that all comments are complete sentences as per guidelines by @Alan-Jowett in #4760
  • Pickup latest verifier by @Alan-Jowett in #4844
  • Add proposal for bpf_sock_ops_get_flow_id by @Alan-Jowett in #4769
  • Update submodules: pe-parse and kissfft by @Alan-Jowett in #4907
  • Extend api_tests to test all exported eBPF APIs with comprehensive validation by @Copilot in #4606
  • Add ErrorActionPreference to initialize_ebpf_repo.ps1 by @prince-melvin in #4928
  • Fix links to CONTRIBUTING.md in markdown by @mtfriesen in #4918
  • Publish proposal for connect authorization layer by @Alan-Jowett in #4767
  • Fix invalid 'permissions: inherit' syntax with explicit permissions in workflows by @Copilot in #4930
  • Refine issue prioritization criteria in Governance.md by @mingxr in #4667
  • Skip updating lru hotlist for user mode map reads by @mikeagun in #4893
  • Fix UAF in epoch work item: add epoch protection to map delete functions by @Copilot in #4906
  • Fix flaky thread_start_time TCP tests: Handle async worker thread execution by @Copilot in #4942
  • Update external/pe-parse submodule to b0dabd3 by @Alan-Jowett in #4943
  • Fix NuGet package: include spec/ebpf_base.h from ebpf-verifier submodule by @Copilot in #4946
  • Add .github/copilot-instructions.md for Copilot sessions by @Alan-Jowett in #4948
  • Add standalone stress test for eBPF core driver restart with open handles and pinned objects by @Copilot in #4894
  • Implement libbpf synchronous ring buffer API by @mikeagun in #4651
  • epoch: fix per-CPU epoch skew (published global epoch) + add regression tests by @Alan-Jowett in #4924
  • Fix flaky TCP process start key tests - handle async execution context by @Copilot in #4963
  • Fix LRU user mode access test by @mikeagun in #4965
  • Fix fuzzer crash on malformed ELF relocation sections by @Alan-Jowett in #4959
  • Fix kernel dump generation on test timeout using -Scope Global by @Copilot in #4922
  • ci: Set gather_dumps to false for km_ebpfcore_restart_test by @Alan-Jowett in #4968
  • Free outstanding async contexts in ring deletion. by @mikeagun in #4964
  • Extend automatic bug filing to merge-queue CI failures by @Copilot in #4977
  • fix LRU user/kernel behavior tests by @mikeagun in #4981
  • Update API tests to use native helper by @saxena-anurag in #4881
  • Fix setup_build unnecessary rebuilds by @mikeagun in #5004
  • copilot skills for ebpf by @mikeagun in #5005
  • Fix test failures from Catch2 submodule update by @Copilot in #4940
  • Fix BPF program incremental build correctness by @mikeagun in #5002
  • ci: Cache LLVM installer from GitHub releases instead of Chocolatey by @Alan-Jowett in #4980
  • enhance dedup doc by @LakshK98 in #4994
  • Add detailed instrumentation to multi_attach_concurrency_test1 by @Alan-Jowett in #4995
  • Block lookup_and_delete for HASH_OF_MAPS by @saxena-anurag in #5031
  • Fix km_ebpfcore_restart_test to run inside VM by @Alan-Jowett in #5000
  • cache map info for native mode by @saxena-anurag in #5038
  • Custom maps implementation by @saxena-anurag in #4895
  • add stress test duration parameter in api_test. by @shankarseal in https://github.com/micr...
Read more

Release-v1.0.0-rc2

24 Nov 17:52
60aaef5

Choose a tag to compare

Release-v1.0.0-rc2 Pre-release
Pre-release

What's Changed

Full Changelog: Release-v1.0.0-rc1...Release-v1.0.0-rc2

v1.0.0-rc1

23 Oct 15:14
15b87ce

Choose a tag to compare

v1.0.0-rc1 Pre-release
Pre-release

Highlights

This is the release-candidate for v1.0 of eBPF for Windows. The important changes include:

  • Proof of Verification: This feature enforces that only those native eBPF programs are loaded, that are packaged in kernel drivers that are signed by a Microsoft issued certificate with the "eBPF verification" EKU. This certificate proves that the native program was generated from an input BPF program that passed verification and was converted using the bpf2c toolchain.
  • Breaking changes in libbpf implementations: Changes in behavior in various libbpf functions including bpf_prog_attach, ring_buffer__new, perf_buffer__new and lifetime management functions for nested map types, to align closely with the Linux behavior.

What's Changed

Read more

Release-v0.21.1

01 May 19:37
d3bfc88

Choose a tag to compare

Release-v0.21.1 Pre-release
Pre-release

What's Changed

Full Changelog: Release-v0.21.0...Release-v0.21.1

Release-v0.21.0

16 Apr 08:33

Choose a tag to compare

Release-v0.21.0 Pre-release
Pre-release

Highlights

  • This release introduces the following breaking changes:

    • Add support for program loading flags - breaking change version: pull request #3763
    • Make context header support mandatory: pull request #4267
    • Remove obsolete prog-specific helper function: pull request #4287
    • Add versioning to native module NMR interface: pull request #4256
      Any eBPF extension or eBPF programs must be recompiled to work with this version of the eBPF runtime.
  • This release also introduces support for BPF_MAP_TYPE_PERF_EVENT_ARRAY.

What's Changed

Read more

Release-v0.19.2

05 Dec 05:55
e44eed1

Choose a tag to compare

Release-v0.19.2 Pre-release
Pre-release

What's Changed

Full Changelog: Release-v0.18.0...Release-v0.19.2

Release-v0.20.0

05 Dec 06:00
f31c527

Choose a tag to compare

Release-v0.20.0 Pre-release
Pre-release

Highlights

Release includes ARM64 bits.

What's Changed

New Contributors

Read more

v0.18.0

25 Jul 17:40
54632eb

Choose a tag to compare

v0.18.0 Pre-release
Pre-release

What's Changed

Full Changelog: Release-v0.17.0...Release-v0.18.0

Release v0.17.1

26 Jun 00:27
1f01400

Choose a tag to compare

Release v0.17.1 Pre-release
Pre-release

What's Changed

Full Changelog: Release-v0.17.0...Release-v0.17.1

v0.17.0

15 Jun 00:51
197910d

Choose a tag to compare

v0.17.0 Pre-release
Pre-release

What's Changed

New Contributors

Full Changelog: Release-v0.16.0...Release-v0.17.0