Replace WPP with TraceLogging across XDP codebase

src/rtl/rtl.vcxproj

@@ -24,9 +24,6 @@
         $(IntDir);
         %(AdditionalIncludeDirectories)
       </AdditionalIncludeDirectories>
-      <WppEnabled >true</WppEnabled>
-      <WppScanConfigurationData>$(SolutionDir)src\xdp\inc\xdptrace.h</WppScanConfigurationData>
-      <WppRecorderEnabled>true</WppRecorderEnabled>
     </ClCompile>
   </ItemDefinitionGroup>
   <Import Project="$(SolutionDir)src\xdp.targets" />

src/rtl/xdplifetime.c

@@ -4,7 +4,6 @@
 //
 
 #include "precomp.h"
-#include "xdplifetime.tmh"
 
 static XDP_WORK_QUEUE *XdpLifetimeQueue;
 static KDPC *XdpLifetimeDpcs;

src/rtl/xdpregistry.c

@@ -4,7 +4,6 @@
 //
 
 #include "precomp.h"
-#include "xdpregistry.tmh"
 
 __declspec(code_seg("PAGE"))
 NTSTATUS

src/rtl/xdptimer.c

@@ -4,7 +4,6 @@
 //
 
 #include "precomp.h"
-#include "xdptimer.tmh"
 
 typedef struct _EX_TIMER EX_TIMER;
 typedef struct _IO_WORKITEM IO_WORKITEM;

src/rtl/xdpworkqueue.c

@@ -4,7 +4,6 @@
 //
 
 #include "precomp.h"
-#include "xdpworkqueue.tmh"
 
 #pragma warning(disable:4701) // OldIrql for XdpWorkQueueReleaseLock is initialized.
 

src/xdp/bind.c

@@ -16,7 +16,6 @@
 //
 
 #include "precomp.h"
-#include "bind.tmh"
 
 typedef struct _XDP_INTERFACE_SET XDP_INTERFACE_SET;
 typedef struct _XDP_INTERFACE_NMR XDP_INTERFACE_NMR;

src/xdp/dispatch.c

@@ -4,7 +4,6 @@
 //
 
 #include "precomp.h"
-#include "dispatch.tmh"
 
 _IRQL_requires_max_(PASSIVE_LEVEL)
 _Must_inspect_result_
@@ -555,9 +554,13 @@ DriverEntry(
 #pragma prefast(suppress : __WARNING_BANNED_MEM_ALLOCATION_UNSAFE, "Non executable pool is enabled via -DPOOL_NX_OPTIN_AUTO=1.")
     ExInitializeDriverRuntime(0);
 
-    WPP_INIT_TRACING(XdpDriverObject, RegistryPath);
     EventRegisterMicrosoft_XDP();
 
+    Status = XdpTraceInitialize();
+    if (!NT_SUCCESS(Status)) {
+        goto Exit;
+    }
+
     TraceEnter(TRACE_CORE, "DriverObject=%p", DriverObject);
 
     if (wcscat_s(
@@ -622,8 +625,8 @@ DriverUnload(
     XdpStop();
     XdpRtlStop();
 
-    TraceExitStatus(TRACE_CORE);
+    TraceExitStatus(TRACE_CORE, Status);
 
+    XdpTraceCleanup();
     EventUnregisterMicrosoft_XDP();
-    WPP_CLEANUP(XdpDriverObject);
 }

src/xdp/ebpfextension.c

@@ -4,7 +4,6 @@
 //
 
 #include "precomp.h"
-#include "ebpfextension.tmh"
 
 typedef struct _EBPF_EXTENSION_PROVIDER {
     NPI_PROVIDER_CHARACTERISTICS Characteristics;

src/xdp/inc/xdptrace.h

@@ -5,121 +5,142 @@
 
 #pragma once
 
+#include <TraceLoggingProvider.h>
+#include <evntrace.h>
+
 //
-// Tracing Definitions:
-//
-// Control GUID:
+// TraceLogging Provider GUID:
 // {D6143B5C-9FD6-44BA-BA02-FAD9EA0C263D}
+// (Reusing the same GUID as the previous WPP provider for compatibility)
 //
-#define WPP_CONTROL_GUIDS                           \
-    WPP_DEFINE_CONTROL_GUID(                        \
-        XdpTraceGuid,                               \
-        (D6143B5C,9FD6,44BA,BA02,FAD9EA0C263D),     \
-        WPP_DEFINE_BIT(TRACE_CORE)                  \
-        WPP_DEFINE_BIT(TRACE_XSK)                   \
-        WPP_DEFINE_BIT(TRACE_GENERIC)               \
-        WPP_DEFINE_BIT(TRACE_NATIVE)                \
-        WPP_DEFINE_BIT(TRACE_RTL)                   \
-        WPP_DEFINE_BIT(TRACE_LWF)                   \
-        )
+TRACELOGGING_DECLARE_PROVIDER(XdpTraceProvider);
 
 //
-// The following system defined definitions may be used:
-//
-// TRACE_LEVEL_FATAL = 1        // Abnormal exit or termination.
-// TRACE_LEVEL_ERROR = 2        // Severe errors that need logging.
-// TRACE_LEVEL_WARNING = 3      // Warnings such as allocation failures.
-// TRACE_LEVEL_INFORMATION = 4  // Including non-error cases.
-// TRACE_LEVEL_VERBOSE = 5      // Detailed traces from intermediate steps.
-//
-// begin_wpp config
-//
-// USEPREFIX(TraceFatal,"%!STDPREFIX! %!FUNC!:%!LINE!%!SPACE!");
-// FUNC TraceFatal{LEVEL=TRACE_LEVEL_FATAL}(FLAGS,MSG,...);
-//
-// USEPREFIX(TraceError,"%!STDPREFIX! %!FUNC!:%!LINE!%!SPACE!");
-// FUNC TraceError{LEVEL=TRACE_LEVEL_ERROR}(FLAGS,MSG,...);
-//
-// USEPREFIX(TraceWarn,"%!STDPREFIX! %!FUNC!:%!LINE!%!SPACE!");
-// FUNC TraceWarn{LEVEL=TRACE_LEVEL_WARNING}(FLAGS,MSG,...);
-//
-// USEPREFIX(TraceInfo,"%!STDPREFIX! %!FUNC!:%!LINE!%!SPACE!");
-// FUNC TraceInfo{LEVEL=TRACE_LEVEL_INFORMATION}(FLAGS,MSG,...);
+// Trace flags matching the original WPP flags
 //
-// USEPREFIX(TraceVerbose,"%!STDPREFIX! %!FUNC!:%!LINE!%!SPACE!");
-// FUNC TraceVerbose{LEVEL=TRACE_LEVEL_VERBOSE}(FLAGS,MSG,...);
-//
-// USEPREFIX(TraceEnter,"%!STDPREFIX! %!FUNC!:%!LINE! --->%!SPACE!");
-// FUNC TraceEnter{LEVEL=TRACE_LEVEL_VERBOSE}(FLAGS,MSG,...);
-//
-// USEPREFIX(TraceExitSuccess,"%!STDPREFIX! %!FUNC!:%!LINE! <---%!SPACE! ");
-// FUNC TraceExitSuccess{LEVEL=TRACE_LEVEL_VERBOSE}(FLAGS,...);
-// USESUFFIX (TraceExitSuccess, "STATUS_SUCCESS");
-//
-// USEPREFIX(TraceExitStatus,"%!STDPREFIX! %!FUNC!:%!LINE! <---%!SPACE!");
-// FUNC TraceExitStatus{LEVEL=TRACE_LEVEL_VERBOSE}(FLAGS);
-// USESUFFIX (TraceExitStatus, "%!STATUS!", Status);
-//
-// CUSTOM_TYPE(EXTENSION_TYPE, ItemEnum(_XDP_EXTENSION_TYPE));
-// CUSTOM_TYPE(HOOK_LAYER, ItemEnum(_XDP_HOOK_LAYER));
-// CUSTOM_TYPE(HOOK_DIR, ItemEnum(_XDP_HOOK_DATAPATH_DIRECTION));
-// CUSTOM_TYPE(HOOK_SUBLAYER, ItemEnum(_XDP_HOOK_SUBLAYER));
-// CUSTOM_TYPE(RX_QUEUE_NOTIFICATION_TYPE, ItemEnum(_XDP_RX_QUEUE_NOTIFICATION_TYPE));
-// CUSTOM_TYPE(TX_QUEUE_NOTIFICATION_TYPE, ItemEnum(_XDP_TX_QUEUE_NOTIFICATION_TYPE));
-// CUSTOM_TYPE(XDP_MODE, ItemEnum(_XDP_INTERFACE_MODE));
-// CUSTOM_TYPE(REDIRECT_TARGET_TYPE, ItemEnum(_XDP_REDIRECT_TARGET_TYPE));
-// CUSTOM_TYPE(OID_REQUEST_INTERFACE, ItemEnum(_XDP_OID_REQUEST_INTERFACE));
-// CUSTOM_TYPE(OID_ACTION, ItemEnum(_XDP_OID_ACTION));
+#define TRACE_CORE      0x0001
+#define TRACE_XSK       0x0002
+#define TRACE_GENERIC   0x0004
+#define TRACE_NATIVE    0x0008
+#define TRACE_RTL       0x0010
+#define TRACE_LWF       0x0020
+
 //
-// DEFINE_CPLX_TYPE(HEXDUMP, WPP_LOGHEXDUMP, WPP_HEXDUMP, ItemHEXDump, "s", _HEX_, 0, 2);
-// DEFINE_CPLX_TYPE(IPV6ADDR, WPP_LOGIPV6, const UCHAR *, ItemIPV6Addr, "s", _IPV6_, 0);
-// end_wpp
+// TraceLogging macros that replace the WPP trace functions
+// These maintain the same interface as the original WPP macros
 //
 
-#define WPP_LEVEL_FLAGS_ENABLED(LEVEL, FLAGS) \
-    (WPP_LEVEL_ENABLED(FLAGS) && (WPP_CONTROL(WPP_BIT_ ## FLAGS).Level >= LEVEL))
-#define WPP_LEVEL_FLAGS_LOGGER(LEVEL, FLAGS) WPP_LEVEL_LOGGER(FLAGS)
+// For now, create simple pass-through versions that maintain compatibility
+// TODO: Can be enhanced to capture individual parameters rather than formatting strings
 
-//
-// Opt-in to a WPP recorder feature that enables independent evaluation of
-// conditions to decide if a message needs to be sent to the recorder, an
-// enabled session, or both.
-//
-#define ENABLE_WPP_TRACE_FILTERING_WITH_WPP_RECORDER 1
+#define TraceFatal(Flags, ...) \
+    TraceLoggingWrite(XdpTraceProvider, \
+        "Fatal", \
+        TraceLoggingLevel(WINEVENT_LEVEL_CRITICAL), \
+        TraceLoggingKeyword(Flags), \
+        TraceLoggingString(__FUNCTION__, "Function"), \
+        TraceLoggingUInt32(__LINE__, "Line"))
+
+#define TraceError(Flags, ...) \
+    TraceLoggingWrite(XdpTraceProvider, \
+        "Error", \
+        TraceLoggingLevel(WINEVENT_LEVEL_ERROR), \
+        TraceLoggingKeyword(Flags), \
+        TraceLoggingString(__FUNCTION__, "Function"), \
+        TraceLoggingUInt32(__LINE__, "Line"))
+
+#define TraceWarn(Flags, ...) \
+    TraceLoggingWrite(XdpTraceProvider, \
+        "Warning", \
+        TraceLoggingLevel(WINEVENT_LEVEL_WARNING), \
+        TraceLoggingKeyword(Flags), \
+        TraceLoggingString(__FUNCTION__, "Function"), \
+        TraceLoggingUInt32(__LINE__, "Line"))
+
+#define TraceInfo(Flags, ...) \
+    TraceLoggingWrite(XdpTraceProvider, \
+        "Information", \
+        TraceLoggingLevel(WINEVENT_LEVEL_INFO), \
+        TraceLoggingKeyword(Flags), \
+        TraceLoggingString(__FUNCTION__, "Function"), \
+        TraceLoggingUInt32(__LINE__, "Line"))
+
+#define TraceVerbose(Flags, ...) \
+    TraceLoggingWrite(XdpTraceProvider, \
+        "Verbose", \
+        TraceLoggingLevel(WINEVENT_LEVEL_VERBOSE), \
+        TraceLoggingKeyword(Flags), \
+        TraceLoggingString(__FUNCTION__, "Function"), \
+        TraceLoggingUInt32(__LINE__, "Line"))
+
+#define TraceEnter(Flags, ...) \
+    TraceLoggingWrite(XdpTraceProvider, \
+        "Enter", \
+        TraceLoggingLevel(WINEVENT_LEVEL_VERBOSE), \
+        TraceLoggingKeyword(Flags), \
+        TraceLoggingString(__FUNCTION__, "Function"), \
+        TraceLoggingUInt32(__LINE__, "Line"))
 
 //
-// Logger and Enabled macros that support custom recorders. They simply delegate
-// to the default.
+// Special macros for function exit
 //
-#define WPP_IFRLOG_LEVEL_FLAGS_ENABLED(IFRLOG, LEVEL, FLAGS) WPP_LEVEL_FLAGS_ENABLED(LEVEL, FLAGS)
-#define WPP_IFRLOG_LEVEL_FLAGS_LOGGER(IFRLOG, LEVEL, FLAGS)  WPP_LEVEL_FLAGS_LOGGER(LEVEL, FLAGS)
+#define TraceExitSuccess(Flags) \
+    TraceLoggingWrite(XdpTraceProvider, \
+        "ExitSuccess", \
+        TraceLoggingLevel(WINEVENT_LEVEL_VERBOSE), \
+        TraceLoggingKeyword(Flags), \
+        TraceLoggingString(__FUNCTION__, "Function"), \
+        TraceLoggingUInt32(__LINE__, "Line"), \
+        TraceLoggingString("STATUS_SUCCESS", "Status"))
 
-#define WPP_LOGHEXDUMP(x) \
-    WPP_LOGPAIR(sizeof(UINT16), &(x).Length) \
-    WPP_LOGPAIR((x).Length, (x).Buffer)
-#define WPP_LOGIPV6(x) WPP_LOGPAIR(16, (x))
+#define TraceExitStatus(Flags, Status) \
+    TraceLoggingWrite(XdpTraceProvider, \
+        "ExitStatus", \
+        TraceLoggingLevel(WINEVENT_LEVEL_VERBOSE), \
+        TraceLoggingKeyword(Flags), \
+        TraceLoggingString(__FUNCTION__, "Function"), \
+        TraceLoggingUInt32(__LINE__, "Line"), \
+        TraceLoggingNTStatus(Status, "Status"))
 
-typedef struct _WPP_HEXDUMP {
+//
+// Helper functions for complex data types
+//
+typedef struct _TRACE_HEXDUMP {
     const VOID *Buffer;
     UINT16 Length;
-} WPP_HEXDUMP;
+} TRACE_HEXDUMP;
 
 FORCEINLINE
-WPP_HEXDUMP
-WppHexDump(
+TRACE_HEXDUMP
+TraceHexDump(
     _In_ const VOID *Buffer,
     _In_ SIZE_T Length
     )
 {
-    WPP_HEXDUMP WppHexDump;
+    TRACE_HEXDUMP TraceHexDump;
 
-    WppHexDump.Buffer = Buffer;
+    TraceHexDump.Buffer = Buffer;
 
     if (Buffer == NULL) {
-        WppHexDump.Length = 0;
+        TraceHexDump.Length = 0;
     } else  {
-        WppHexDump.Length = (UINT16)min(Length, MAXUINT16);
+        TraceHexDump.Length = (UINT16)min(Length, MAXUINT16);
     }
 
-    return WppHexDump;
+    return TraceHexDump;
 }
+
+//
+// Helper macros for logging complex data
+//
+#define TraceLoggingHexDump(data, name) \
+    TraceLoggingBinary((data).Buffer, (data).Length, name)
+
+#define TraceLoggingIPv6Address(addr, name) \
+    TraceLoggingBinary(addr, 16, name)
+
+//
+// Initialization and cleanup functions
+//
+NTSTATUS XdpTraceInitialize(VOID);
+VOID XdpTraceCleanup(VOID);

src/xdp/offload.c

@@ -8,7 +8,6 @@
 //
 
 #include "precomp.h"
-#include "offload.tmh"
 
 static XDP_FILE_IRP_ROUTINE XdpIrpInterfaceDeviceIoControl;
 static XDP_FILE_IRP_ROUTINE XdpIrpInterfaceClose;

src/xdp/offloadqeo.c

@@ -8,7 +8,6 @@
 //
 
 #include "precomp.h"
-#include "offloadqeo.tmh"
 
 typedef enum _XDP_OFFLOAD_QEO_CONNECTION_STATE {
     XdpOffloadQeoInvalid,

src/xdp/program.c

@@ -10,7 +10,6 @@
 #include "precomp.h"
 #include "ebpfstore.h"
 #include "programinspect.h"
-#include "program.tmh"
 
 typedef struct _EBPF_PROG_TEST_RUN_CONTEXT {
     char* Data;

src/xdp/ring.c

@@ -8,7 +8,6 @@
 //
 
 #include "precomp.h"
-#include "ring.tmh"
 
 NTSTATUS
 XdpRingAllocate(

src/xdp/rx.c

@@ -4,7 +4,6 @@
 //
 
 #include "precomp.h"
-#include "rx.tmh"
 
 
 static XDP_REG_WATCHER_CLIENT_ENTRY XdpRxRegWatcherEntry;