You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
eBPF for Windows requires support for updating the address of helper functions (when the module hosting them is reloaded).
This is currently implemented as a jump table in eBPF-for-Windows, but the performance is sub-part. A better solution would be to modify uBPF to emit rip indirect calling like this, with the jump table being embedded in the emitted machine code.
call QWORD PTR [rip+0x2023] # 0x2029
This might also eliminate the need to perform retpoline based calling.
The text was updated successfully, but these errors were encountered:
eBPF for Windows requires support for updating the address of helper functions (when the module hosting them is reloaded).
This is currently implemented as a jump table in eBPF-for-Windows, but the performance is sub-part. A better solution would be to modify uBPF to emit rip indirect calling like this, with the jump table being embedded in the emitted machine code.
This might also eliminate the need to perform retpoline based calling.
The text was updated successfully, but these errors were encountered: