ioctl: allow common operations without allocations

[lmb]

Describe the feature you'd like supported

Operations like looking up a map value via EBPF_OPERATION_MAP_FIND_ELEMENT are currently forced to allocate a buffer because of the way that the request structure is defined:

ebpf-for-windows/libs/execution_context/ebpf_protocol.h

Lines 145 to 151 in 2448139

	typedef struct _ebpf_operation_map_find_element_request
	{
	struct _ebpf_operation_header header;
	ebpf_handle_t handle;
	bool find_and_delete;
	uint8_t key[1];
	} ebpf_operation_map_find_element_request_t;

The key is appended to the request buffer. This means that the caller has to allocate memory and perform copying. This is especially bad for batch operations where the amount if memory to be allocated and copied is larger:

ebpf-for-windows/libs/execution_context/ebpf_protocol.h

Lines 481 to 489 in 2448139

	typedef struct _ebpf_operation_map_update_element_batch_request
	{
	struct _ebpf_operation_header header;
	ebpf_handle_t handle;
	ebpf_map_option_t option;
	// Count of elements is derived from the length of the request.
	// Data is a concatenation of key+value.
	uint8_t data[1];
	} ebpf_operation_map_update_element_batch_request_t;

It would be nice if common performance critical map operations could be implemented without allocations.

Proposed solution

This could be achieved by making map keys and values pointers, like it is done for struct bpf_prog_info:

ebpf-for-windows/include/ebpf_structs.h

Line 397 in 2448139

uintptr_t map_ids; ///< Pointer to caller-allocated array to fill map IDs into.

Additional context

No response

[jrfastab]

I'll take a look at performance here once we get Tetragon up and running so we cant est.