Move NT process-telemetry declarations into a public header - #316
Merged
Conversation
PROCESS_TELEMETRY_ID_INFORMATION and the NtQueryInformationProcess prototype were declared privately in src/ps.cpp and independently duplicated in the eBPF for Windows api_test. Move them into a new leaf header, inc/usersim/nt_process_info.h, so usersim and its consumers share one definition instead of maintaining divergent copies. The header declares only native NT types (no usersim platform dependencies) so consumers can include it without pulling in usersim's internal headers. ps.cpp now includes it and drops its local PROCESS_TELEMETRY_ID_INFORMATION, PROCESSINFOCLASS, and NtQueryInformationProcess_t declarations; the query logic is unchanged.
mikeagun
marked this pull request as ready for review
July 28, 2026 18:27
mikeagun
pushed a commit
to mikeagun/ebpf-for-windows
that referenced
this pull request
Jul 28, 2026
Bump the external/usersim submodule to mikeagun/usersim@43e2294 (share-nt-process-info) and repoint its .gitmodules URL at the fork so CI can build against usersim/nt_process_info.h before microsoft/usersim#316 merges. Revert once microsoft#316 merges: restore the URL to microsoft/usersim and bump the submodule to the merged commit on usersim main. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4
3 tasks
Alan-Jowett
approved these changes
Jul 28, 2026
mikeagun
pushed a commit
to mikeagun/ebpf-for-windows
that referenced
this pull request
Jul 28, 2026
Point the external/usersim submodule at usersim main (fc3c2a2), which now includes usersim/nt_process_info.h from microsoft/usersim#316. This replaces the temporary fork/branch pin used while that PR was in review; the submodule URL is back to microsoft/usersim. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4
Alan-Jowett
added a commit
to Alan-Jowett/ebpf-for-windows
that referenced
this pull request
Aug 3, 2026
* Fix flaky UDP thread/process affinity test assertions The bpf_get_thread_start_time and bpf_get_process_start_key tests incorrectly assumed that WFP ALE_AUTH_CONNECT hooks run on the caller's thread for UDP connections. This assumption was falsified on ARM64 NativeOnlyDebug where the classify ran on a worker thread. Remove the protocol-conditional branches in run_thread_start_time_test and run_process_start_key_test, replacing strict identity assertions (exact TID/PID match) with validity checks (non-zero) for both TCP and UDP. The WFP ALE_AUTH_CONNECT callout does not guarantee caller-thread affinity for either protocol. The bpf_get_current_pid_tgid test (BPF_PROG_TYPE_BIND on FWPS_LAYER_ALE_RESOURCE_ASSIGNMENT_V4) is unchanged because that layer does fire inline on the caller thread. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * tests/api_test: validate process start key and thread create time pairs The bpf_get_process_start_key and bpf_get_thread_start_time tests captured their values from a sock_addr program keyed on array index 0. Because sock_addr programs run for every connection on the system, an unrelated connection could overwrite the captured value before the test read it, making the pid/tid assertions unreliable (the source of the flakiness). Filter the sample programs to the test's own traffic (user_port == SOCKET_TEST_PORT) so the captured record belongs to the connection under test, then validate each helper's output for self-consistency rather than asserting caller-thread affinity (which the WFP ALE_AUTH_CONNECT callout does not guarantee): - process_start_key: open the captured PID and compare its ProcessStartKey (via NtQueryInformationProcess/ProcessTelemetryIdInformation) to the helper-reported start_key. - thread_start_time: open the captured TID and compare GetThreadTimes() creation time to the helper-reported start_time. If the captured process/thread can no longer be opened, print a warning and skip the strict comparison rather than failing the test. Regenerate the bpf2c expected files for the two modified sample programs. Addresses review feedback on microsoft#5383 and issue microsoft#5403. * tests/api_test: use NTSTATUS and require success in process start-key lookup Address review feedback on the NtQueryInformationProcess helper: use the NTSTATUS return type, require STATUS_SUCCESS instead of status >= 0, fail when the export is unavailable, and link the API docs. * tests: share SOCKET_TEST_PORT and start-key/create-time value structs Move SOCKET_TEST_PORT and the process-start-key / thread-create-time map value structs into tests/sample/sample_test_common.h so the sample BPF programs (process_start_key.c, thread_start_time.c) and api_test.cpp share one definition instead of hand-syncing duplicated copies. Add tests/sample to api_test's include path so it can consume the shared header. Addresses review feedback on microsoft#5383. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4 * tests/api_test: use shared usersim NT process-telemetry declarations Replace api_test's private PROCESS_TELEMETRY_ID_INFORMATION struct and NtQueryInformationProcess prototype with the shared declarations from usersim/nt_process_info.h, so the two no longer maintain divergent copies of the same native NT definitions. Behavior is unchanged. Addresses review feedback on microsoft#5383. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4 * Bump external/usersim to pick up shared NT process-telemetry header Point the external/usersim submodule at usersim main (fc3c2a2), which now includes usersim/nt_process_info.h from microsoft/usersim#316. This replaces the temporary fork/branch pin used while that PR was in review; the submodule URL is back to microsoft/usersim. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4 --------- Co-authored-by: Michael Agun <danielagun@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Alan Jowett <alanjo@microsoft.com> Copilot-Session: 364142a9-32ad-4087-9b61-87f1bb8370a4
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
PsGetProcessStartKeyis implemented on top of the native NTPROCESS_TELEMETRY_ID_INFORMATIONstructure and theNtQueryInformationProcessAPI. Per Microsoft's documentation these have no public SDK header and must be
declared by hand, and today usersim declares them privately inside
src/ps.cpp.Because the declarations live in a
.cpp, anything else that needs the samenative definitions cannot reuse them and has to maintain a separate,
drift-prone copy.
Promote those declarations to a public leaf header,
inc/usersim/nt_process_info.h, so they are defined once and can be reused byusersim consumers.
Changes
inc/usersim/nt_process_info.hdeclaringPROCESS_TELEMETRY_ID_INFORMATION,the
ProcessTelemetryIdInformationinformation-class value, and theNtQueryInformationProcess_tfunction-pointer typedef.src/ps.cppincludes the new header and drops its local declarations; thePsGetProcessStartKeylogic is unchanged.src/usersim.vcxproj.Design notes
The header is intentionally a leaf: it declares only native NT types and depends
solely on basic Windows types (
ULONG/HANDLE/NTSTATUS/NTAPI/...), with nousersim platform dependencies, so it can be included on its own without pulling
in usersim's internal headers.
NtQueryInformationProcess_tusesULONGfor theinformation-class parameter so the header does not also need to carry a
PROCESSINFOCLASSenum.Testing
Context
Prompted by review of the corresponding eBPF for Windows change
(microsoft/ebpf-for-windows#5383).