Preserve ebpf_result values up through user mode APIs (#642)

* Rename win32 error code APIs for internal consistency

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Update error mappings

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

* Replace unstable NTSTATUS code with a documented one

STATUS_FILE_NOT_SUPPORTED does not appear in MS-ERREF and support varies
by OS version so cannot be relied on.  Replaced with
STATUS_INVALID_IMAGE_FORMAT.

Signed-off-by: Dave Thaler <dthaler@microsoft.com>

include/ebpf_result.h

@@ -105,6 +105,8 @@ extern "C"
         EBPF_OUT_OF_SPACE,
     } ebpf_result_t;
 
+#define EBPF_RESULT_COUNT (EBPF_OUT_OF_SPACE + 1)
+
 #ifdef __cplusplus
 }
 #endif

libs/api/ebpf_api.cpp

@@ -140,7 +140,7 @@ _create_map(
 
     return_value = invoke_ioctl(request_buffer, reply);
     if (return_value != ERROR_SUCCESS) {
-        result = windows_error_to_ebpf_result(return_value);
+        result = win32_error_code_to_ebpf_result(return_value);
         goto Exit;
     }
     ebpf_assert(reply.header.id == ebpf_operation_id_t::EBPF_OPERATION_CREATE_MAP);
@@ -265,7 +265,7 @@ _map_lookup_element(
         request->handle = handle;
         std::copy(key, key + key_size, request->key);
 
-        result = windows_error_to_ebpf_result(invoke_ioctl(request_buffer, reply_buffer));
+        result = win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer, reply_buffer));
 
         if (reply->header.id != ebpf_operation_id_t::EBPF_OPERATION_MAP_FIND_ELEMENT) {
             result = EBPF_INVALID_ARGUMENT;
@@ -390,7 +390,7 @@ _update_map_element(
         std::copy((uint8_t*)key, (uint8_t*)key + key_size, request->data);
         std::copy((uint8_t*)value, (uint8_t*)value + value_size, request->data + key_size);
 
-        result = windows_error_to_ebpf_result(invoke_ioctl(request_buffer));
+        result = win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer));
     } catch (const std::bad_alloc&) {
         result = EBPF_NO_MEMORY;
         goto Exit;
@@ -422,7 +422,7 @@ _update_map_element_with_handle(
     request->option = static_cast<ebpf_map_option_t>(flags);
     std::copy(key, key + key_size, request->key);
 
-    return windows_error_to_ebpf_result(invoke_ioctl(request_buffer));
+    return win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer));
 }
 
 ebpf_result_t
@@ -514,7 +514,7 @@ ebpf_map_delete_element(fd_t map_fd, _In_ const void* key)
         request->handle = (uint64_t)map_handle;
         std::copy((uint8_t*)key, (uint8_t*)key + key_size, request->key);
 
-        result = windows_error_to_ebpf_result(invoke_ioctl(request_buffer));
+        result = win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer));
         if (result == EBPF_INVALID_OBJECT) {
             result = EBPF_INVALID_FD;
         }
@@ -578,7 +578,7 @@ ebpf_map_get_next_key(fd_t map_fd, _In_opt_ const void* previous_key, _Out_ void
             request->header.length = offsetof(ebpf_operation_map_get_next_key_request_t, previous_key);
         }
 
-        result = windows_error_to_ebpf_result(invoke_ioctl(request_buffer, reply_buffer));
+        result = win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer, reply_buffer));
 
         if (reply->header.id != ebpf_operation_id_t::EBPF_OPERATION_MAP_GET_NEXT_KEY) {
             result = EBPF_INVALID_ARGUMENT;
@@ -639,7 +639,7 @@ _create_program(
     *program_handle = reply.program_handle;
 
 Exit:
-    return windows_error_to_ebpf_result(error);
+    return win32_error_code_to_ebpf_result(error);
 }
 
 ebpf_result_t
@@ -720,7 +720,7 @@ ebpf_object_pin(fd_t fd, _In_z_ const char* path)
     request->header.length = static_cast<uint16_t>(request_buffer.size());
     request->handle = handle;
     std::copy(path, path + path_length, request->path);
-    result = windows_error_to_ebpf_result(invoke_ioctl(request_buffer));
+    result = win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer));
 
     return result;
 }
@@ -739,7 +739,7 @@ ebpf_object_unpin(_In_z_ const char* path)
     request->header.length = static_cast<uint16_t>(request_buffer.size());
     request->handle = UINT64_MAX;
     std::copy(path, path + path_length, request->path);
-    return windows_error_to_ebpf_result(invoke_ioctl(request_buffer));
+    return win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer));
 }
 
 ebpf_result_t
@@ -881,7 +881,7 @@ ebpf_get_next_map(fd_t previous_fd, _Out_ fd_t* next_fd)
             *next_fd = ebpf_fd_invalid;
         }
     }
-    return windows_error_to_ebpf_result(retval);
+    return win32_error_code_to_ebpf_result(retval);
 }
 
 ebpf_result_t
@@ -915,7 +915,7 @@ ebpf_get_next_program(fd_t previous_fd, _Out_ fd_t* next_fd)
             *next_fd = ebpf_fd_invalid;
         }
     }
-    return windows_error_to_ebpf_result(retval);
+    return win32_error_code_to_ebpf_result(retval);
 }
 
 ebpf_result_t
@@ -943,7 +943,7 @@ ebpf_program_query_info(
 
     uint32_t retval = invoke_ioctl(request, reply_buffer);
     if (retval != ERROR_SUCCESS) {
-        result = windows_error_to_ebpf_result(retval);
+        result = win32_error_code_to_ebpf_result(retval);
         __analysis_assume(result != EBPF_SUCCESS);
         return result;
     }
@@ -969,7 +969,7 @@ ebpf_program_query_info(
     *file_name = local_file_name;
     *section_name = local_section_name;
 
-    return windows_error_to_ebpf_result(retval);
+    return win32_error_code_to_ebpf_result(retval);
 }
 
 uint32_t
@@ -1028,7 +1028,7 @@ _link_ebpf_program(
             memcpy_s(request->data, attach_parameter_size, attach_parameter, attach_parameter_size);
         }
 
-        result = windows_error_to_ebpf_result(invoke_ioctl(request_buffer, reply));
+        result = win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer, reply));
         if (result != EBPF_SUCCESS) {
             goto Exit;
         }
@@ -1081,7 +1081,7 @@ _detach_link_by_handle(ebpf_handle_t link_handle)
 {
     ebpf_operation_unlink_program_request_t request = {sizeof(request), EBPF_OPERATION_UNLINK_PROGRAM, link_handle};
 
-    return windows_error_to_ebpf_result(invoke_ioctl(request));
+    return win32_error_code_to_ebpf_result(invoke_ioctl(request));
 }
 
 ebpf_result_t
@@ -1197,7 +1197,7 @@ ebpf_api_close_handle(ebpf_handle_t handle)
 {
     ebpf_operation_close_handle_request_t request = {sizeof(request), EBPF_OPERATION_CLOSE_HANDLE, handle};
 
-    return windows_error_to_ebpf_result(invoke_ioctl(request));
+    return win32_error_code_to_ebpf_result(invoke_ioctl(request));
 }
 
 ebpf_result_t
@@ -1238,7 +1238,7 @@ ebpf_api_get_pinned_map_info(
         }
 
         // Invoke IOCTL.
-        result = windows_error_to_ebpf_result(invoke_ioctl(request, reply_buffer));
+        result = win32_error_code_to_ebpf_result(invoke_ioctl(request, reply_buffer));
 
         if ((result != EBPF_SUCCESS) && (result != EBPF_INSUFFICIENT_BUFFER))
             goto Exit;
@@ -2055,7 +2055,7 @@ _get_fd_by_id(ebpf_operation_id_t operation, ebpf_id_t id, _Out_ int* fd) noexce
     _ebpf_operation_get_handle_by_id_reply reply;
 
     uint32_t error = invoke_ioctl(request, reply);
-    ebpf_result_t result = windows_error_to_ebpf_result(error);
+    ebpf_result_t result = win32_error_code_to_ebpf_result(error);
     if (result != EBPF_SUCCESS) {
         return result;
     }
@@ -2108,7 +2108,7 @@ ebpf_get_next_pinned_program_path(
     memcpy(request->start_path, start_path, start_path_length);
 
     uint32_t error = invoke_ioctl(request_buffer, reply_buffer);
-    ebpf_result_t result = windows_error_to_ebpf_result(error);
+    ebpf_result_t result = win32_error_code_to_ebpf_result(error);
     if (result != EBPF_SUCCESS) {
         return result;
     }
@@ -2129,7 +2129,7 @@ _get_next_id(ebpf_operation_id_t operation, ebpf_id_t start_id, _Out_ ebpf_id_t*
     _ebpf_operation_get_next_id_reply reply;
 
     uint32_t error = invoke_ioctl(request, reply);
-    ebpf_result_t result = windows_error_to_ebpf_result(error);
+    ebpf_result_t result = win32_error_code_to_ebpf_result(error);
     if (result != EBPF_SUCCESS) {
         return result;
     }
@@ -2178,7 +2178,7 @@ ebpf_object_get_info_by_fd(
     request->header.id = ebpf_operation_id_t::EBPF_OPERATION_GET_OBJECT_INFO;
     request->handle = handle;
 
-    ebpf_result_t result = windows_error_to_ebpf_result(invoke_ioctl(request_buffer, reply_buffer));
+    ebpf_result_t result = win32_error_code_to_ebpf_result(invoke_ioctl(request_buffer, reply_buffer));
     if (result == EBPF_SUCCESS) {
         *info_size = reply->header.length - EBPF_OFFSET_OF(ebpf_operation_get_object_info_reply_t, info);
         memcpy(info, reply->info, *info_size);
@@ -2239,7 +2239,7 @@ ebpf_program_bind_map(fd_t program_fd, fd_t map_fd)
     request.program_handle = program_handle;
     request.map_handle = map_handle;
 
-    return windows_error_to_ebpf_result(invoke_ioctl(request));
+    return win32_error_code_to_ebpf_result(invoke_ioctl(request));
 }
 
 ebpf_result_t
@@ -2251,5 +2251,5 @@ ebpf_map_wait_for_update(fd_t map_fd, _Inout_ OVERLAPPED* overlapped)
     }
     ebpf_operation_wait_for_map_change_request_t request{
         sizeof(request), EBPF_OPERATION_WAIT_FOR_MAP_CHANGE, map_handle};
-    return windows_error_to_ebpf_result(invoke_ioctl(request, _empty_reply, overlapped));
+    return win32_error_code_to_ebpf_result(invoke_ioctl(request, _empty_reply, overlapped));
 }

libs/api_common/api_common.cpp

@@ -72,7 +72,7 @@ query_map_definition(
     _ebpf_operation_query_map_definition_reply reply;
 
     uint32_t error = invoke_ioctl(request, reply);
-    ebpf_result_t result = windows_error_to_ebpf_result(error);
+    ebpf_result_t result = win32_error_code_to_ebpf_result(error);
     if (result == EBPF_SUCCESS) {
         *size = reply.map_definition.size;
         *type = reply.map_definition.type;

libs/api_common/api_common.hpp

@@ -81,10 +81,10 @@ get_all_map_handles(void);
 std::vector<map_cache_t>
 get_all_map_descriptors();
 
-// This should be consistent with _ebpf_result_to_ntstatus()
+// This should be consistent with _ebpf_result_mapping[]
 // in ebpf_error.c
 __forceinline ebpf_result_t
-windows_error_to_ebpf_result(uint32_t error)
+win32_error_code_to_ebpf_result(uint32_t error)
 {
     ebpf_result_t result;
 
@@ -99,6 +99,9 @@ windows_error_to_ebpf_result(uint32_t error)
         break;
 
     case ERROR_PATH_NOT_FOUND:
+        result = EBPF_OBJECT_NOT_FOUND;
+        break;
+
     case ERROR_NOT_FOUND:
         result = EBPF_KEY_NOT_FOUND;
         break;
@@ -133,13 +136,80 @@ windows_error_to_ebpf_result(uint32_t error)
         break;
 
     case ERROR_OBJECT_ALREADY_EXISTS:
-    case ERROR_OBJECT_NAME_EXISTS:
         result = EBPF_OBJECT_ALREADY_EXISTS;
         break;
 
     case ERROR_IO_PENDING:
         result = EBPF_PENDING;
         break;
+
+    case ERROR_VERIFIER_STOP:
+        result = EBPF_VERIFICATION_FAILED;
+        break;
+
+    case ERROR_NONE_MAPPED:
+        result = EBPF_JIT_COMPILATION_FAILED;
+        break;
+
+    case ERROR_BAD_DRIVER:
+        result = EBPF_EXTENSION_FAILED_TO_LOAD;
+        break;
+
+    case ERROR_INVALID_FUNCTION:
+        result = EBPF_INVALID_OBJECT;
+        break;
+
+    case ERROR_OBJECT_NAME_EXISTS:
+        result = EBPF_ALREADY_PINNED;
+        break;
+
+    case ERROR_TOO_MANY_CMDS:
+        result = EBPF_PROGRAM_TOO_LARGE;
+        break;
+
+    case RPC_S_CALL_FAILED:
+        result = EBPF_RPC_EXCEPTION;
+        break;
+
+    case ERROR_BAD_EXE_FORMAT:
+        result = EBPF_ELF_PARSING_FAILED;
+        break;
+
+    case ERROR_ACCESS_DENIED:
+        result = EBPF_ACCESS_DENIED;
+        break;
+
+    case ERROR_NOT_OWNER:
+        result = EBPF_NOT_PINNED;
+        break;
+
+    case ERROR_CONTENT_BLOCKED:
+        result = EBPF_BLOCKED_BY_POLICY;
+        break;
+
+    case ERROR_ARITHMETIC_OVERFLOW:
+        result = EBPF_ARITHMETIC_OVERFLOW;
+        break;
+
+    case ERROR_GENERIC_COMMAND_FAILED:
+        result = EBPF_PROGRAM_LOAD_FAILED;
+        break;
+
+    case ERROR_ALREADY_REGISTERED:
+        // Currently STATUS_ALREADY_REGISTERED is mapped to
+        // ERROR_INTERNAL_ERROR instead of ERROR_ALREADY_REGISTERED.
+    case ERROR_INTERNAL_ERROR:
+        result = EBPF_KEY_ALREADY_EXISTS;
+        break;
+
+    case ERROR_TOO_MANY_NAMES:
+        result = EBPF_NO_MORE_TAIL_CALLS;
+        break;
+
+    case ERROR_NO_SYSTEM_RESOURCES:
+        result = EBPF_OUT_OF_SPACE;
+        break;
+
     default:
         result = EBPF_FAILED;
         break;
@@ -164,11 +234,11 @@ ebpf_result_to_errno(ebpf_result_t result)
 
     case EBPF_ALREADY_INITIALIZED:
     case EBPF_INVALID_ARGUMENT:
+    case EBPF_INVALID_OBJECT:
         error = EINVAL;
         break;
 
     case EBPF_INVALID_FD:
-    case EBPF_INVALID_OBJECT:
         error = EBADF;
         break;
 

libs/api_common/device_helper.cpp

@@ -33,7 +33,7 @@ initialize_device_handle()
         EBPF_DEVICE_WIN32_NAME, GENERIC_READ | GENERIC_WRITE, 0, nullptr, CREATE_ALWAYS, FILE_ATTRIBUTE_NORMAL, 0);
 
     if (_device_handle == ebpf_handle_invalid) {
-        return windows_error_to_ebpf_result(GetLastError());
+        return win32_error_code_to_ebpf_result(GetLastError());
     }
 
     return EBPF_SUCCESS;

libs/api_common/windows_helpers.cpp

@@ -70,7 +70,7 @@ get_program_info_data(ebpf_program_type_t program_type, _Outptr_ ebpf_program_in
     *program_info = nullptr;
 
     auto reply = reinterpret_cast<ebpf_operation_get_program_info_reply_t*>(reply_buffer.data());
-    ebpf_result_t result = windows_error_to_ebpf_result(invoke_ioctl(request, reply_buffer));
+    ebpf_result_t result = win32_error_code_to_ebpf_result(invoke_ioctl(request, reply_buffer));
     if ((result != EBPF_SUCCESS) && (result != EBPF_INSUFFICIENT_BUFFER))
         goto Exit;
 
@@ -78,7 +78,7 @@ get_program_info_data(ebpf_program_type_t program_type, _Outptr_ ebpf_program_in
         required_buffer_length = reply->header.length;
         reply_buffer.resize(required_buffer_length);
         reply = reinterpret_cast<ebpf_operation_get_program_info_reply_t*>(reply_buffer.data());
-        result = windows_error_to_ebpf_result(invoke_ioctl(request, reply_buffer));
+        result = win32_error_code_to_ebpf_result(invoke_ioctl(request, reply_buffer));
         if (result != EBPF_SUCCESS)
             goto Exit;
     }

libs/platform/ebpf_error.c

@@ -8,71 +8,46 @@
 #include <ntstatus.h>
 #include <ebpf_result.h>
 
-// This may need to be updated as part of issue:
-// https://github.com/microsoft/ebpf-for-windows/issues/595
+// Mapping from each eBPF result to NTSTATUS
+// (and also show the Win32 error code that the NTSTATUS maps to).
 // This should be consistent with windows_error_to_ebpf_result()
 // in api_common.hpp
+static const NTSTATUS _ebpf_result_mapping[] = {
+    /* EBPF_SUCCESS */ STATUS_SUCCESS /* ERROR_SUCCESS */,
+    /* EBPF_VERIFICATION_FAILED */ STATUS_VERIFIER_STOP /* ERROR_VERIFIER_STOP */,
+    /* EBPF_JIT_COMPILATION_FAILED */ STATUS_NONE_MAPPED /* ERROR_NONE_MAPPED */,
+    /* EBPF_PROGRAM_LOAD_FAILED */ STATUS_GENERIC_COMMAND_FAILED /* ERROR_GENERIC_COMMAND_FAILED */,
+    /* EBPF_INVALID_FD */ STATUS_INVALID_HANDLE /* ERROR_INVALID_HANDLE */,
+    /* EBPF_INVALID_OBJECT */ STATUS_INVALID_DEVICE_REQUEST /* ERROR_INVALID_FUNCTION */,
+    /* EBPF_INVALID_ARGUMENT */ STATUS_INVALID_PARAMETER /* ERROR_INVALID_PARAMETER */,
+    /* EBPF_OBJECT_NOT_FOUND */ STATUS_OBJECT_PATH_NOT_FOUND /* ERROR_PATH_NOT_FOUND */,
+    /* EBPF_OBJECT_ALREADY_EXISTS */ STATUS_OBJECTID_EXISTS /* ERROR_OBJECT_ALREADY_EXISTS */,
+    /* EBPF_FILE_NOT_FOUND */ STATUS_NO_SUCH_FILE /* ERROR_FILE_NOT_FOUND */,
+    /* EBPF_ALREADY_PINNED */ STATUS_OBJECT_NAME_EXISTS /* ERROR_OBJECT_NAME_EXISTS */,
+    /* EBPF_NOT_PINNED */ STATUS_RESOURCE_NOT_OWNED /* ERROR_NOT_OWNER */,
+    /* EBPF_NO_MEMORY */ STATUS_NO_MEMORY /* ERROR_NOT_ENOUGH_MEMORY */,
+    /* EBPF_PROGRAM_TOO_LARGE */ STATUS_TOO_MANY_COMMANDS /* ERROR_TOO_MANY_CMDS */,
+    /* EBPF_RPC_EXCEPTION */ RPC_NT_CALL_FAILED /* RPC_S_CALL_FAILED */,
+    /* EBPF_ALREADY_INITIALIZED */ STATUS_ALREADY_INITIALIZED /* ERROR_ALREADY_INITIALIZED */,
+    /* EBPF_ELF_PARSING_FAILED */ STATUS_INVALID_IMAGE_FORMAT /* ERROR_BAD_EXE_FORMAT */,
+    /* EBPF_FAILED */ STATUS_UNSUCCESSFUL /* ERROR_GEN_FAILURE */,
+    /* EBPF_OPERATION_NOT_SUPPORTED */ STATUS_NOT_SUPPORTED /* ERROR_NOT_SUPPORTED */,
+    /* EBPF_KEY_NOT_FOUND */ STATUS_NOT_FOUND /* ERROR_NOT_FOUND */,
+    /* EBPF_ACCESS_DENIED */ STATUS_ACCESS_DENIED /* ERROR_ACCESS_DENIED */,
+    /* EBPF_BLOCKED_BY_POLICY */ STATUS_CONTENT_BLOCKED /* ERROR_CONTENT_BLOCKED */,
+    /* EBPF_ARITHMETIC_OVERFLOW */ STATUS_INTEGER_OVERFLOW /* ERROR_ARITHMETIC_OVERFLOW */,
+    /* EBPF_EXTENSION_FAILED_TO_LOAD */ STATUS_DRIVER_UNABLE_TO_LOAD /* ERROR_BAD_DRIVER */,
+    /* EBPF_INSUFFICIENT_BUFFER */ STATUS_BUFFER_OVERFLOW /* ERROR_MORE_DATA */,
+    /* EBPF_NO_MORE_KEYS */ STATUS_NO_MORE_MATCHES /* ERROR_NO_MORE_MATCHES */,
+    /* EBPF_KEY_ALREADY_EXISTS */
+    STATUS_ALREADY_REGISTERED /* ERROR_INTERNAL_ERROR, but ought to be ERROR_ALREADY_REGISTERED */,
+    /* EBPF_NO_MORE_TAIL_CALLS */ STATUS_TOO_MANY_NODES /* ERROR_TOO_MANY_NAMES */,
+    /* EBPF_PENDING */ STATUS_PENDING /* ERROR_IO_PENDING */,
+    /* EBPF_OUT_OF_SPACE */ STATUS_INSUFFICIENT_RESOURCES /* ERROR_NO_SYSTEM_RESOURCES */,
+};
+
 NTSTATUS
 ebpf_result_to_ntstatus(ebpf_result_t result)
 {
-    NTSTATUS status;
-    switch (result) {
-    case EBPF_SUCCESS: {
-        status = STATUS_SUCCESS;
-        break;
-    }
-    case EBPF_NO_MEMORY: {
-        status = STATUS_INSUFFICIENT_RESOURCES;
-        break;
-    }
-    case EBPF_KEY_NOT_FOUND: {
-        status = STATUS_NOT_FOUND;
-        break;
-    }
-    case EBPF_INVALID_ARGUMENT:
-    case EBPF_INVALID_OBJECT: {
-        status = STATUS_INVALID_PARAMETER;
-        break;
-    }
-    case EBPF_BLOCKED_BY_POLICY: {
-        status = STATUS_CONTENT_BLOCKED;
-        break;
-    }
-    case EBPF_NO_MORE_KEYS: {
-        status = STATUS_NO_MORE_MATCHES;
-        break;
-    }
-    case EBPF_INVALID_FD: {
-        status = STATUS_INVALID_HANDLE;
-        break;
-    }
-    case EBPF_OPERATION_NOT_SUPPORTED: {
-        status = STATUS_NOT_SUPPORTED;
-        break;
-    }
-    case EBPF_INSUFFICIENT_BUFFER: {
-        status = STATUS_BUFFER_OVERFLOW;
-        break;
-    }
-    case EBPF_OBJECT_ALREADY_EXISTS: {
-        status = STATUS_OBJECT_NAME_EXISTS;
-        break;
-    }
-    case EBPF_OBJECT_NOT_FOUND: {
-        status = STATUS_OBJECT_PATH_NOT_FOUND;
-        break;
-    }
-    case EBPF_EXTENSION_FAILED_TO_LOAD: {
-        status = STATUS_UNSUCCESSFUL;
-        break;
-    }
-    case EBPF_PENDING: {
-        status = STATUS_PENDING;
-        break;
-    }
-    default:
-        status = STATUS_UNSUCCESSFUL;
-    }
-
-    return status;
+    return (result < EBPF_RESULT_COUNT) ? _ebpf_result_mapping[result] : STATUS_UNSUCCESSFUL;
 }

libs/platform/ebpf_platform.h

@@ -949,10 +949,10 @@ extern "C"
      * @brief Map an ebpf_result_t to a generic Win32 error code.
      *
      * @param[in] result ebpf_result_t to map.
-     * @return The generic Win32 code.
+     * @return The generic Win32 error code.
      */
-    unsigned long
-    ebpf_result_to_win32(ebpf_result_t result);
+    uint32_t
+    ebpf_result_to_win32_error_code(ebpf_result_t result);
 
 #ifdef __cplusplus
 }

libs/platform/unit/platform_unit_test.cpp

@@ -10,6 +10,7 @@
 #include <thread>
 #include <sddl.h>
 
+#include "api_common.hpp"
 #include "catch_wrapper.hpp"
 #include "ebpf_async.h"
 #include "ebpf_bind_program_data.h"
@@ -813,3 +814,12 @@ TEST_CASE("ring_buffer", "[platform]")
     ebpf_ring_buffer_destroy(ring_buffer);
     ring_buffer = nullptr;
 }
+
+TEST_CASE("error codes", "[platform]")
+{
+    for (ebpf_result_t result = EBPF_SUCCESS; result < EBPF_RESULT_COUNT; result = (ebpf_result_t)(result + 1)) {
+        uint32_t error = ebpf_result_to_win32_error_code(result);
+        ebpf_result_t result2 = win32_error_code_to_ebpf_result(error);
+        REQUIRE(result2 == result);
+    }
+}

libs/platform/user/ebpf_platform_user.cpp

@@ -669,10 +669,10 @@ Done:
     return result;
 }
 
-unsigned long
-ebpf_result_to_win32(ebpf_result_t result)
+uint32_t
+ebpf_result_to_win32_error_code(ebpf_result_t result)
 {
-    static ULONG (*RtlNtStatusToDosError)(NTSTATUS Status) = NULL;
+    static uint32_t (*RtlNtStatusToDosError)(NTSTATUS Status) = NULL;
     if (!RtlNtStatusToDosError) {
         HMODULE ntdll = LoadLibrary(L"ntdll.dll");
         if (!ntdll) {
@@ -682,4 +682,4 @@ ebpf_result_to_win32(ebpf_result_t result)
             reinterpret_cast<decltype(RtlNtStatusToDosError)>(GetProcAddress(ntdll, "RtlNtStatusToDosError"));
     }
     return RtlNtStatusToDosError(ebpf_result_to_ntstatus(result));
-}
+}

libs/service/api_service.cpp

@@ -73,7 +73,7 @@ _build_helper_id_to_address_map(
 
     uint32_t result = invoke_ioctl(request_buffer, reply_buffer);
     if (result != ERROR_SUCCESS) {
-        return windows_error_to_ebpf_result(result);
+        return win32_error_code_to_ebpf_result(result);
     }
 
     helper_addresses.resize(helper_id_mapping.size());
@@ -109,7 +109,7 @@ _resolve_ec_function(ebpf_ec_function_t function, uint64_t* address)
 
     uint32_t result = invoke_ioctl(request, reply);
     if (result != ERROR_SUCCESS) {
-        return windows_error_to_ebpf_result(result);
+        return win32_error_code_to_ebpf_result(result);
     }
 
     if (reply.header.id != ebpf_operation_id_t::EBPF_OPERATION_GET_EC_FUNCTION) {
@@ -176,7 +176,7 @@ _resolve_maps_in_byte_code(ebpf_handle_t program_handle, ebpf_code_buffer_t& byt
 
     uint32_t result = invoke_ioctl(request_buffer, reply_buffer);
     if (result != ERROR_SUCCESS) {
-        return windows_error_to_ebpf_result(result);
+        return win32_error_code_to_ebpf_result(result);
     }
 
     for (size_t index = 0; index < map_handles.size(); index++) {

tests/end_to_end/end_to_end.cpp

@@ -1089,7 +1089,7 @@ TEST_CASE("link_tests", "[end_to_end]")
     REQUIRE(program != nullptr);
 
     // Test the case where the provider only permits a single program to be attached.
-    REQUIRE(hook.attach(program) == EBPF_FAILED);
+    REQUIRE(hook.attach(program) == EBPF_EXTENSION_FAILED_TO_LOAD);
 
     hook.detach();
 }

tests/end_to_end/test_helper.cpp

@@ -114,7 +114,7 @@ GlueDeviceIoControl(
 
 Fail:
     if (result != EBPF_SUCCESS) {
-        SetLastError(ebpf_result_to_win32(result));
+        SetLastError(ebpf_result_to_win32_error_code(result));
     }
 
     return FALSE;