{"id":89094,"date":"2021-11-29T09:00:32","date_gmt":"2021-11-29T17:00:32","guid":{"rendered":""},"modified":"2025-05-29T14:41:46","modified_gmt":"2025-05-29T21:41:46","slug":"progress-on-making-ebpf-work-on-windows","status":"publish","type":"post","link":"https:\/\/opensource.microsoft.com\/blog\/2021\/11\/29\/progress-on-making-ebpf-work-on-windows\/","title":{"rendered":"Progress on making eBPF work on Windows"},"content":{"rendered":"\n

eBPF<\/a> is a well-known, but revolutionary, technology for providing programmability, extensibility, and agility. eBPF has been applied to use cases such as denial-of-service protection and observability. In May 2021, we announced the effort to make eBPF work on Windows<\/a>, and were encouraged by the huge amount of interest. Six months have passed since then, and we have achieved some significant milestones worthy of mention.<\/p>\n\n\n\n

Announcements and talks<\/h2>\n\n\n\n

In June, we did an eCHO live stream episode on eBPF for Windows<\/a>. Less than two months later, we were part of another huge announcement for the whole eBPF ecosystem<\/a>: the creation of the eBPF Foundation<\/a> with Microsoft as one of the founding members!   We expect this foundation will encourage collaboration across the industry and help many projects, including eBPF for Windows.<\/p>\n\n\n\n

A week later, we gave a keynote talk on eBPF for Windows<\/a> at the eBPF Summit, and then an invited talk on the cross-platform future of eBPF<\/a> at Cloud Native eBPF Day, co-located with KubeCon. We\u2019ve been excited by the energy we\u2019ve seen from others around these discussions and look forward to continued collaboration as we continue the journey on eBPF for Windows.<\/p>\n\n\n\n

eBPF for Windows<\/h2>\n\n\n\n

Let\u2019s talk about the great progress we\u2019ve made over the past six months on the eBPF for Windows project<\/a>. When we first announced the project, there were relatively few APIs available to eBPF programs, and no support yet for the de facto standard libbpf APIs<\/a>. The table below shows the progress on several dimensions:<\/p>\n\n\n\n

Dimension<\/strong><\/td>May <\/strong>2021<\/strong><\/td>November 2021<\/strong><\/td><\/tr>
Standard libbpf APIs<\/em><\/td>0<\/td>68<\/td><\/tr>
Standard helper functions for eBPF programs<\/em><\/td>3<\/td>11<\/td><\/tr>
Standard map types<\/em><\/td>2<\/td>12<\/td><\/tr>
XDP hook actions<\/em><\/td>2<\/td>3<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

 <\/p>\n\n\n\n

In particular, we have tried to focus on some of the most used APIs and map types, to unblock key application scenarios. For example, eBPF for Windows now includes the following eBPF features, among others:<\/p>\n\n\n\n