edb
edb copied to clipboard
Add map "live" mode
This issue proposes that we add the ability to use actual eBPF maps instead of the emulated maps. So after loading maps from an ELF file you would be able to map live pin {path to pinned map}
or map live new
to use an existing pinned map or create a new map in the kernel. After this, all reads/writes/deletes will use this actual map via the syscalls.
This would allow us to to a few things, for example in a use-case where a user has multiple eBPF programs coordinating via maps, this would allow you to replace one program with EDB while debugging it.
This also allows a user to very easily switch between running a program live and debugging it with little setup, to persist map state over multiple EDB sessions and it is a pre-cursor to run programs in "live" mode.