ebpf.yml

# Copyright (c) Microsoft Corporation
# SPDX-License-Identifier: MIT

# This workflow will download the latest ebpf-for-windows MSI installer and run
# the BPF performance tests. The results will be uploaded as an artifact.

name: ebpf-for-windows

on:
  # Permit manual runs of the workflow.
  workflow_dispatch:
    inputs:
      ref:
        description: 'EBPF Branch or Commit'
        required: false
        default: 'main'
        type: string
      profile:
        description: 'Capture CPU profile'
        required: false
        default: false
        type: boolean

  pull_request:
    branches:
    - main
    paths:
    - .github/workflows/ebpf.yml

  repository_dispatch:
    types: [run-ebpf]
      # Args: { guid, sha, ref, pr }

concurrency:
  group: ebpf-${{ github.event.client_payload.pr || github.event.client_payload.sha || inputs.ref || github.event.pull_request.number || 'main' }}
  cancel-in-progress: true

permissions:
  contents: read
  security-events: write # Required by codeql task

jobs:
  # For automated identification of the workflow.
  name:
    name: For ${{ github.event.client_payload.guid }}
    if: ${{ github.event_name == 'repository_dispatch' }}
    needs: []
    runs-on: ubuntu-20.04
    steps:
    - run: |
        echo "guid: ${{ github.event.client_payload.guid }}"
        echo "sha: ${{ github.event.client_payload.sha }}"
        echo "ref: ${{ github.event.client_payload.ref }}"
        echo "pr: ${{ github.event.client_payload.pr }}"

  build:
    name: Build ebpf-for-windows
    uses: microsoft/ebpf-for-windows/.github/workflows/reusable-build.yml@main
    with:
      build_artifact: none
      build_msi: true
      build_nuget: false
      build_options: /t:installer\ebpf-for-windows
      repository: 'microsoft/ebpf-for-windows'
      configurations: '["NativeOnlyRelease"]'
      ref: ${{ github.event.client_payload.sha || github.event.client_payload.ref || inputs.ref || 'main' }}
      perform_skip_check: false

  build_cts_traffic:
    name: Build cts-traffic test tool
    uses: microsoft/ctsTraffic/.github/workflows/reusable-build.yml@master
    with:
      build_artifact: cts-traffic
      repository: 'microsoft/ctsTraffic'
      configurations: '["Release"]'
      ref: 'master'

  test:
    name: Test Windows eBPF Performance
    needs: [build, build_cts_traffic]
    strategy:
      fail-fast: false
      matrix:
        vec: [
          { env: "azure", os: "2022", arch: "x64" },
          { env: "azure", os: "2025", arch: "x64" },
          { env: "lab",   os: "2022", arch: "x64" },
        ]
    runs-on:
    - self-hosted
    - ${{ matrix.vec.env }}
    - os-windows-${{ matrix.vec.os }}
    - ${{ matrix.vec.arch }}

    steps:
    - name: Setup workspace
      run: |
        $process = Start-Process -FilePath "msiexec" -ArgumentList "/x {022C44B5-8969-4B75-8DB0-73F98B1BD7DC} /quiet /qn /norestart /log uninstall.log" -Wait -NoNewWindow
        $process = Start-Process -FilePath "msiexec" -ArgumentList "/x {9363C0E3-4DE9-4067-9F5E-6A1A06034B59} /quiet /qn /norestart /log uninstall.log" -Wait -NoNewWindow
        $url = "https://raw.githubusercontent.com/microsoft/ebpf-for-windows/main/scripts/Cleanup-Installer.ps1"
        iex "& { $(irm $url) }"
        if (Test-Path ${{ github.workspace }}\bpf_performance) { Remove-Item -Recurse -Force ${{ github.workspace }}\bpf_performance }
        if (Test-Path ${{ github.workspace }}\xdp) { Remove-Item -Recurse -Force ${{ github.workspace }}\xdp }
        if (Test-Path ${{ github.workspace }}\cts-traffic) { Remove-Item -Recurse -Force ${{ github.workspace }}\cts-traffic }
        if (Test-Path ${{ github.workspace }}\ETL) { Remove-Item -Recurse -Force ${{ github.workspace }}\ETL }
        New-item -ItemType Directory -Path ${{ github.workspace }}\bpf_performance
        New-item -ItemType Directory -Path ${{ github.workspace }}\xdp
        New-item -ItemType Directory -Path ${{ github.workspace }}\cts-traffic
        New-item -ItemType Directory -Path ${{ github.workspace }}\ETL

    # Install the latest anti-malware signatures for Windows Defender to prevent false positives.
    # Windows Defender incorrectly flags some of the test binaries as malware.
    - name: Download latest anti-malware signatures for Windows Defender
      run: |
        Update-MpSignature -Verbose
        Start-MpScan -ScanType QuickScan
        Add-MpPreference -ExclusionPath ${{ github.workspace }}

    - name: Download ebpf-for-windows
      uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe
      with:
        name: "ebpf-for-windows - MSI installer (none_NativeOnlyRelease)"
        path: ${{ github.workspace }}\bpf_performance

    - name: Install ebpf-for-windows
      working-directory: ${{ github.workspace }}\bpf_performance
      run: |
        $process = Start-Process -FilePath "msiexec" -ArgumentList "/i ebpf-for-windows.msi /quiet /qn /norestart /log install.log ADDLOCAL=ALL" -Wait -NoNewWindow -PassThru
        if ($process.ExitCode -ne 0) { exit $process.ExitCode }
        echo "C:\Program Files\ebpf-for-windows" | Out-File -FilePath $env:GITHUB_PATH -Encoding utf8 -Append

    - name: Download xdp-for-windows
      working-directory: ${{ github.workspace }}\xdp
      run: |
        $ProgressPreference = 'SilentlyContinue'
        $packageUrl = "https://github.com/microsoft/xdp-for-windows/releases/download/v1.1.0%2B3b7480bf/xdp-for-windows.1.1.0.msi"
        Invoke-WebRequest -Uri $packageUrl -OutFile xdp-for-windows.1.1.0.msi
        dir *.msi
        $packageUrl = "https://github.com/microsoft/xdp-for-windows/releases/download/v1.1.0%2B3b7480bf/xdp-devkit-x64-1.1.0.zip"
        Invoke-WebRequest -Uri $packageUrl -OutFile xdp-devkit-x64-1.1.0.zip
        dir *.zip
        Expand-Archive -Path "xdp-devkit-x64-1.1.0.zip" -DestinationPath .

    - name: Install xdp-for-windows
      working-directory: ${{ github.workspace }}\xdp
      run: |
          $installPath = "${{ github.workspace }}\xdp"
          Write-Output "xdp installPath: $installPath"
          Write-Output "Installing XDP for Windows"
          CertUtil.exe -addstore Root bin\CoreNetSignRoot.cer
          CertUtil.exe -addstore TrustedPublisher bin\CoreNetSignRoot.cer
          $process = Start-Process msiexec.exe -Wait -ArgumentList "/i xdp-for-windows.1.1.0.msi INSTALLFOLDER=$installPath /qn" -PassThru
          if ($process.ExitCode -ne 0) { exit $process.ExitCode }
          Write-Output "XDP for Windows installed"
          sc.exe query xdp
          reg.exe add HKLM\SYSTEM\CurrentControlSet\Services\xdp\Parameters /v XdpEbpfEnabled /d 1 /t REG_DWORD /f
          sc.exe stop xdp
          sc.exe start xdp

    - name: Download bpf_performance repository artifacts
      working-directory: ${{ github.workspace }}\bpf_performance
      run: |
        Invoke-WebRequest https://github.com/microsoft/bpf_performance/releases/download/v0.0.9/build-Release-windows-2022.zip -OutFile bpf_performance.zip

    - name: Unzip bpf_performance repository artifacts
      working-directory: ${{ github.workspace }}\bpf_performance
      run: |
        Expand-Archive -Path bpf_performance.zip -DestinationPath .

    - name: Download cts-traffic
      uses: actions/download-artifact@eaceaf801fd36c7dee90939fad912460b18a1ffe
      with:
        name: "cts-traffic Release"
        path: ${{ github.workspace }}\cts-traffic

    # Run CTS traffic without XDP installed to establish a baseline.
    - name: Run CTS cts-traffic baseline
      working-directory: ${{ github.workspace }}\cts-traffic
      # Note: The script is not in the repository, but is downloaded from the web.
      run: |
        dir .
        $profile = 0
        if ("${{inputs.profile}}" -eq "true") { $profile = 1 }
        $url = "https://raw.githubusercontent.com/microsoft/bpf_performance/main/scripts/two-machine-perf.ps1"
        iex "& { $(irm $url) } -CpuProfile $profile"
        if ($Profile) {  Rename-Item -Path ${{ github.workspace }}\etl\cts_traffic_send.etl -NewName "cts_traffic_send_baseline.etl"}
        if ($Profile) { Rename-Item -Path ${{ github.workspace }}\etl\cts_traffic_recv.etl -NewName "cts_traffic_recv_baseline.etl" }

    # The resulting CSV file's header is updated to match the format produced by the BPF performance tests.
    # The "Average Duration (ns)" column is the metric of interest.
    - name: Fixup cts traffic results baseline
      working-directory: ${{ github.workspace }}\cts-traffic
      run: |
        $content = Get-Content ctsTrafficResults.csv
        $content[0] = "Timestamp,Test,Average Duration (ns)"
        $content | Set-Content ctsTrafficResults.csv
        Copy-Item ctsTrafficResults.csv ctsTrafficResults_baseline.csv

    - name: Upload CTS cts-traffic results baseline
      if: always()
      uses: actions/upload-artifact@v2
      with:
        name: cts_traffic_baseline_${{ matrix.vec.env }}_${{ matrix.vec.os }}_${{ matrix.vec.arch }}
        path: ${{ github.workspace }}\cts-traffic\ctsTrafficResults.csv 

    - name: Attach xdp baseline program to interface (first program in xdp.sys)
      working-directory: ${{ github.workspace }}\bpf_performance
      run: |
        Test-Connection -ComputerName netperf-peer -Count 1 -Ping
        $remote_address = [System.Net.Dns]::GetHostAddresses("netperf-peer")[0]
        Write-Output "Remote address: $remote_address"
        $route = Find-NetRoute -RemoteIPAddress $remote_address
        Write-Output "Route: $route"
        $if_index = $route[0].InterfaceIndex
        Write-Output "Interface index: $if_index"
        Get-NetAdapter -ifIndex $if_index
        netsh ebpf add prog filenam=xdp.sys interface=$if_index
        bpftool prog show
        Test-Connection -ComputerName netperf-peer -Count 1 -Ping

    # Run CTS traffic with XDP installed to measure the impact of XDP on performance.
    - name: Run CTS cts-traffic xdp
      working-directory: ${{ github.workspace }}\cts-traffic
      # Note: The script is not in the repository, but is downloaded from the web.
      run: |
        dir .
        $profile = 0
        if ("${{inputs.profile}}" -eq "true") { $profile = 1 }
        $url = "https://raw.githubusercontent.com/microsoft/bpf_performance/main/scripts/two-machine-perf.ps1"
        iex "& { $(irm $url) } -CpuProfile $profile"
        if ($Profile) {  Rename-Item -Path ${{ github.workspace }}\etl\cts_traffic_send.etl -NewName "cts_traffic_send_xdp.etl"}
        if ($Profile) { Rename-Item -Path ${{ github.workspace }}\etl\cts_traffic_recv.etl -NewName "cts_traffic_recv_xdp.etl" }

    - name: Detach xdp baseline program from interface
      run: |
        $programs = (bpftool prog show)
        Write-Output "Programs: $programs"
        if ($programs.length -gt 0) { netsh ebpf del prog ($programs.split(':')[0]) }

      # The resulting CSV file's header is updated to match the format produced by the BPF performance tests.
      # The "Average Duration (ns)" column is the metric of interest.
    - name: Fixup cts traffic results xdp
      working-directory: ${{ github.workspace }}\cts-traffic
      run: |
        $content = Get-Content ctsTrafficResults.csv
        $content[0] = "Timestamp,Test,Average Duration (ns)"
        $content | Set-Content ctsTrafficResults.csv
        Copy-Item ctsTrafficResults.csv ctsTrafficResults_xdp.csv

    - name: Upload CTS cts-traffic results xdp
      if: always()
      uses: actions/upload-artifact@v2
      with:
        name: cts_traffic_xdp_${{ matrix.vec.env }}_${{ matrix.vec.os }}_${{ matrix.vec.arch }}
        path: ${{ github.workspace }}\cts-traffic\ctsTrafficResults.csv 

    - name: Run BPF performance tests
      working-directory: ${{ github.workspace }}\bpf_performance
      run: |
        if ("${{inputs.profile}}" -eq "true") {
          $pre_command = 'wpr.exe -start CPU'
          $post_command = 'wpr.exe -stop ""${{ github.workspace }}\ETL\%NAME%.etl""'
          Release\bpf_performance_runner.exe -i tests.yml -e .sys -r -p 4 --pre "$pre_command" --post "$post_command" | Tee-Object -FilePath result.csv
        }
        else {
          Release\bpf_performance_runner.exe -i tests.yml -e .sys -r  -p 4 | Tee-Object -FilePath result.csv
        }
        Get-Content result.csv | Where-Object { $_ -notmatch "^Program returned non-zero" } | Set-Content bpf_performance_native.csv

    - name: Upload BPF performance test results
      if: always()
      uses: actions/upload-artifact@v2
      with:
        name: bpf_performance_native_${{ matrix.vec.env }}_${{ matrix.vec.os }}_${{ matrix.vec.arch }}
        path: ${{ github.workspace }}\bpf_performance\bpf_performance_native.csv

    - name: Merge results
      working-directory: ${{ github.workspace }}\bpf_performance
      run: |
        $baseline = Get-Content -Path ${{ github.workspace }}\cts-traffic\ctsTrafficResults_baseline.csv | ConvertFrom-Csv
        $baseline | foreach-object { $_.Test += " Baseline"}
        $xdp = Get-Content -Path ${{ github.workspace }}\cts-traffic\ctsTrafficResults_xdp.csv | ConvertFrom-Csv
        $xdp | foreach-object { $_.Test += " XDP"}
        $native = Get-Content -Path ${{ github.workspace }}\bpf_performance\bpf_performance_native.csv | ConvertFrom-Csv
        $result = $native + $baseline + $xdp
        $result | Where-Object -Property "Test" -ne "" | ConvertTo-Csv -NoTypeInformation | % { $_ -replace '"', '' } | Out-File -FilePath "ebpf.csv" -Encoding utf8

    - name: Upload merged results
      if: always()
      uses: actions/upload-artifact@v2
      with:
        name: ebpf_${{ matrix.vec.env }}_${{ matrix.vec.os }}_${{ matrix.vec.arch }}
        path: ${{ github.workspace }}\bpf_performance\ebpf.csv

    - name: Upload CPU profile
      if: ${{ inputs.profile == true }}
      uses: actions/upload-artifact@v2
      with:
        name: CPU_Profile_${{ matrix.vec.env }}_${{ matrix.vec.os }}_${{ matrix.vec.arch }}
        path: ETL

    - name: Cleanup workspace
      if: always()
      run: |
        $process = Start-Process -FilePath "msiexec" -ArgumentList "/x {022C44B5-8969-4B75-8DB0-73F98B1BD7DC} /quiet /qn /norestart /log uninstall.log" -Wait -NoNewWindow
        $process = Start-Process -FilePath "msiexec" -ArgumentList "/x {9363C0E3-4DE9-4067-9F5E-6A1A06034B59} /quiet /qn /norestart /log uninstall.log" -Wait -NoNewWindow
        $url = "https://raw.githubusercontent.com/microsoft/ebpf-for-windows/main/scripts/Cleanup-Installer.ps1"
        iex "& { $(irm $url) }"
        if (Test-Path ${{ github.workspace }}\bpf_performance) { Remove-Item -Recurse -Force ${{ github.workspace }}\bpf_performance }
        if (Test-Path ${{ github.workspace }}\xdp) { Remove-Item -Recurse -Force ${{ github.workspace }}\xdp }
        if (Test-Path ${{ github.workspace }}\cts-traffic) { Remove-Item -Recurse -Force ${{ github.workspace }}\cts-traffic }
        if (Test-Path ${{ github.workspace }}\ETL) { Remove-Item -Recurse -Force ${{ github.workspace }}\ETL }
        
    - name: Restore Windows Defender exclusions
      run: |
        Remove-MpPreference -ExclusionPath ${{ github.workspace }}
        Update-MpSignature -Verbose
        Start-MpScan -ScanType QuickScan