eBPF for Windows
ebpf_utilities.h
Go to the documentation of this file.
1 // Copyright (c) Microsoft Corporation
2 // SPDX-License-Identifier: MIT
3 
4 #pragma once
5 
6 #include <stdint.h>
7 #define WIN32_LEAN_AND_MEAN // Exclude rarely-used stuff from Windows headers
8 // Windows Header Files
9 #include <windows.h>
10 
11 #include "ebpf_result.h"
12 
13 // This should be consistent with _ebpf_result_mapping[]
14 // in ebpf_error.c
15 __forceinline ebpf_result_t
17 {
18  ebpf_result_t result;
19 
20  switch (error) {
21  case ERROR_SUCCESS:
22  result = EBPF_SUCCESS;
23  break;
24 
25  case ERROR_OUTOFMEMORY:
26  case ERROR_NOT_ENOUGH_MEMORY:
27  result = EBPF_NO_MEMORY;
28  break;
29 
30  case ERROR_PATH_NOT_FOUND:
31  result = EBPF_OBJECT_NOT_FOUND;
32  break;
33 
34  case ERROR_NOT_FOUND:
35  result = EBPF_KEY_NOT_FOUND;
36  break;
37 
38  case ERROR_INVALID_PARAMETER:
39  result = EBPF_INVALID_ARGUMENT;
40  break;
41 
42  case ERROR_NO_MORE_ITEMS:
43  case ERROR_NO_MORE_MATCHES:
44  result = EBPF_NO_MORE_KEYS;
45  break;
46 
47  case ERROR_INVALID_HANDLE:
48  result = EBPF_INVALID_FD;
49  break;
50 
51  case ERROR_NOT_SUPPORTED:
53  break;
54 
55  case ERROR_MORE_DATA:
56  result = EBPF_INSUFFICIENT_BUFFER;
57  break;
58 
59  case ERROR_FILE_NOT_FOUND:
60  result = EBPF_FILE_NOT_FOUND;
61  break;
62 
63  case ERROR_ALREADY_INITIALIZED:
64  result = EBPF_ALREADY_INITIALIZED;
65  break;
66 
67  case ERROR_OBJECT_ALREADY_EXISTS:
69  break;
70 
71  case ERROR_IO_PENDING:
72  result = EBPF_PENDING;
73  break;
74 
75  case ERROR_VERIFIER_STOP:
76  result = EBPF_VERIFICATION_FAILED;
77  break;
78 
79  case ERROR_NONE_MAPPED:
81  break;
82 
83  case ERROR_BAD_DRIVER:
85  break;
86 
87  case ERROR_INVALID_FUNCTION:
88  result = EBPF_INVALID_OBJECT;
89  break;
90 
91  case ERROR_OBJECT_NAME_EXISTS:
92  result = EBPF_ALREADY_PINNED;
93  break;
94 
95  case ERROR_TOO_MANY_CMDS:
96  result = EBPF_PROGRAM_TOO_LARGE;
97  break;
98 
99  case RPC_S_CALL_FAILED:
100  result = EBPF_RPC_EXCEPTION;
101  break;
102 
103  case ERROR_BAD_EXE_FORMAT:
104  result = EBPF_ELF_PARSING_FAILED;
105  break;
106 
107  case ERROR_ACCESS_DENIED:
108  result = EBPF_ACCESS_DENIED;
109  break;
110 
111  case ERROR_NOT_OWNER:
112  result = EBPF_NOT_PINNED;
113  break;
114 
115  case ERROR_CONTENT_BLOCKED:
116  result = EBPF_BLOCKED_BY_POLICY;
117  break;
118 
119  case ERROR_ARITHMETIC_OVERFLOW:
120  result = EBPF_ARITHMETIC_OVERFLOW;
121  break;
122 
123  case ERROR_GENERIC_COMMAND_FAILED:
124  result = EBPF_PROGRAM_LOAD_FAILED;
125  break;
126 
127  case ERROR_ALREADY_REGISTERED:
128  // Currently STATUS_ALREADY_REGISTERED is mapped to
129  // ERROR_INTERNAL_ERROR instead of ERROR_ALREADY_REGISTERED.
130  case ERROR_INTERNAL_ERROR:
131  result = EBPF_KEY_ALREADY_EXISTS;
132  break;
133 
134  case ERROR_TOO_MANY_NAMES:
135  result = EBPF_NO_MORE_TAIL_CALLS;
136  break;
137 
138  case ERROR_NO_SYSTEM_RESOURCES:
139  result = EBPF_OUT_OF_SPACE;
140  break;
141 
142  case ERROR_OPERATION_ABORTED:
143  result = EBPF_CANCELED;
144  break;
145 
146  case ERROR_NOACCESS:
147  result = EBPF_INVALID_POINTER;
148  break;
149 
150  default:
151  result = EBPF_FAILED;
152  break;
153  }
154 
155  return result;
156 }
EBPF_JIT_COMPILATION_FAILED
@ EBPF_JIT_COMPILATION_FAILED
JIT compilation failed.
Definition: ebpf_result.h:24
EBPF_NO_MORE_TAIL_CALLS
@ EBPF_NO_MORE_TAIL_CALLS
Caller has reached tail call limit.
Definition: ebpf_result.h:99
EBPF_BLOCKED_BY_POLICY
@ EBPF_BLOCKED_BY_POLICY
The operation was blocked for all requesters by policy.
Definition: ebpf_result.h:81
EBPF_INVALID_ARGUMENT
@ EBPF_INVALID_ARGUMENT
An invalid argument was supplied.
Definition: ebpf_result.h:36
EBPF_INVALID_FD
@ EBPF_INVALID_FD
Invalid FD provided.
Definition: ebpf_result.h:30
EBPF_SUCCESS
@ EBPF_SUCCESS
The operation was successful.
Definition: ebpf_result.h:18
EBPF_ACCESS_DENIED
@ EBPF_ACCESS_DENIED
Access was denied for the requested operation.
Definition: ebpf_result.h:78
win32_error_code_to_ebpf_result
__forceinline ebpf_result_t win32_error_code_to_ebpf_result(uint32_t error)
Definition: ebpf_utilities.h:16
EBPF_PROGRAM_TOO_LARGE
@ EBPF_PROGRAM_TOO_LARGE
The program is too large.
Definition: ebpf_result.h:57
EBPF_OBJECT_NOT_FOUND
@ EBPF_OBJECT_NOT_FOUND
No pinned map or program exists for the path provided.
Definition: ebpf_result.h:39
EBPF_INVALID_POINTER
@ EBPF_INVALID_POINTER
Invalid pointer.
Definition: ebpf_result.h:111
EBPF_ARITHMETIC_OVERFLOW
@ EBPF_ARITHMETIC_OVERFLOW
Arithmetic overflow occurred.
Definition: ebpf_result.h:84
EBPF_INSUFFICIENT_BUFFER
@ EBPF_INSUFFICIENT_BUFFER
A buffer of insufficient size was supplied.
Definition: ebpf_result.h:90
EBPF_OPERATION_NOT_SUPPORTED
@ EBPF_OPERATION_NOT_SUPPORTED
Operation is not supported.
Definition: ebpf_result.h:72
EBPF_OUT_OF_SPACE
@ EBPF_OUT_OF_SPACE
The container can not hold additional elements.
Definition: ebpf_result.h:105
EBPF_ALREADY_INITIALIZED
@ EBPF_ALREADY_INITIALIZED
The handle was already initialized.
Definition: ebpf_result.h:63
EBPF_NOT_PINNED
@ EBPF_NOT_PINNED
The program or map is not pinned.
Definition: ebpf_result.h:51
EBPF_NO_MEMORY
@ EBPF_NO_MEMORY
Low memory.
Definition: ebpf_result.h:54
EBPF_PENDING
@ EBPF_PENDING
Requested action is still pending.
Definition: ebpf_result.h:102
EBPF_CANCELED
@ EBPF_CANCELED
Operation was canceled.
Definition: ebpf_result.h:108
EBPF_ELF_PARSING_FAILED
@ EBPF_ELF_PARSING_FAILED
A failure occurred in parsing the ELF file.
Definition: ebpf_result.h:66
EBPF_VERIFICATION_FAILED
@ EBPF_VERIFICATION_FAILED
Program verification failed.
Definition: ebpf_result.h:21
EBPF_NO_MORE_KEYS
@ EBPF_NO_MORE_KEYS
The enumeration found no more keys.
Definition: ebpf_result.h:93
EBPF_PROGRAM_LOAD_FAILED
@ EBPF_PROGRAM_LOAD_FAILED
Program load failed.
Definition: ebpf_result.h:27
EBPF_EXTENSION_FAILED_TO_LOAD
@ EBPF_EXTENSION_FAILED_TO_LOAD
The eBPF extension failed to load.
Definition: ebpf_result.h:87
EBPF_RPC_EXCEPTION
@ EBPF_RPC_EXCEPTION
An RPC exception occurred.
Definition: ebpf_result.h:60
EBPF_OBJECT_ALREADY_EXISTS
@ EBPF_OBJECT_ALREADY_EXISTS
A program or map is already pinned with the same path.
Definition: ebpf_result.h:42
EBPF_KEY_ALREADY_EXISTS
@ EBPF_KEY_ALREADY_EXISTS
The requested key is already present.
Definition: ebpf_result.h:96
ebpf_result_t
enum ebpf_result ebpf_result_t
EBPF_ALREADY_PINNED
@ EBPF_ALREADY_PINNED
The program or map already pinned to a different path.
Definition: ebpf_result.h:48
EBPF_FAILED
@ EBPF_FAILED
Generic failure code for all other errors.
Definition: ebpf_result.h:69
EBPF_KEY_NOT_FOUND
@ EBPF_KEY_NOT_FOUND
The requested key was not found.
Definition: ebpf_result.h:75
EBPF_FILE_NOT_FOUND
@ EBPF_FILE_NOT_FOUND
Invalid ELF file path.
Definition: ebpf_result.h:45
EBPF_INVALID_OBJECT
@ EBPF_INVALID_OBJECT
Invalid object provided (ebpf_object, ebpf_map, ebpf_program).
Definition: ebpf_result.h:33
ebpf_result.h