package efw
import "github.com/cilium/ebpf/internal/efw"
Package efw contains support code for eBPF for Windows.
Index ¶
- Variables
- func EbpfCloseFd(fd int) error
- func EbpfDuplicateFd(fd int) (int, error)
- func EbpfGetBpfAttachType(attachType windows.GUID) (uint32, error)
- func EbpfGetBpfProgramType(programType windows.GUID) (uint32, error)
- func EbpfGetEbpfAttachType(attachType uint32) (windows.GUID, error)
- func EbpfObjectLoadNativeFds(fileName string, mapFds []FD, programFds []FD) (int, int, error)
- func EbpfObjectUnpin(path string) error
- func EbpfProgramAttachFds(fd int, attachType windows.GUID, params unsafe.Pointer, params_size uintptr) (int, error)
- type BpfMapInfo
- type BpfProgInfo
- type FD
- type Int
- type ObjectType
- func EbpfGetNextPinnedObjectPath(startPath string, objectType ObjectType) (string, ObjectType, error)
- func EbpfObjectGetInfoByFd(fd int, info unsafe.Pointer, info_size *uint32) (ObjectType, error)
- type Result
- type Size
Variables ¶
var BPF = newProc("bpf")
The BPF syscall wrapper which is ABI compatible with Linux.
int bpf(int cmd, union bpf_attr* attr, unsigned int size)
Functions ¶
func EbpfCloseFd ¶
func EbpfDuplicateFd ¶
func EbpfGetBpfAttachType ¶
func EbpfGetBpfProgramType ¶
func EbpfGetEbpfAttachType ¶
func EbpfObjectLoadNativeFds ¶
func EbpfObjectUnpin ¶
func EbpfProgramAttachFds ¶
func EbpfProgramAttachFds(fd int, attachType windows.GUID, params unsafe.Pointer, params_size uintptr) (int, error)
Types ¶
type BpfMapInfo ¶
type BpfMapInfo struct {
Name [_BPF_OBJ_NAME_LEN]byte ///< Null-terminated map name.
// contains filtered or unexported fields
}
type BpfProgInfo ¶
type BpfProgInfo struct {
Name [_BPF_OBJ_NAME_LEN]byte ///< Null-terminated map name.
// contains filtered or unexported fields
}
type FD ¶
type FD int32
FD is the equivalent of fd_t.
type Int ¶
type Int int32
Int is the equivalent of int on MSVC (am64, arm64) and MinGW (gcc, clang).
type ObjectType ¶
type ObjectType uint32
ObjectType is the equivalent of ebpf_object_type_t.
const ( EBPF_OBJECT_UNKNOWN ObjectType = iota EBPF_OBJECT_MAP EBPF_OBJECT_LINK EBPF_OBJECT_PROGRAM )
func EbpfGetNextPinnedObjectPath ¶
func EbpfGetNextPinnedObjectPath(startPath string, objectType ObjectType) (string, ObjectType, error)
func EbpfObjectGetInfoByFd ¶
type Result ¶
type Result int32
See https://github.com/microsoft/ebpf-for-windows/blob/main/include/ebpf_result.h
const ( EBPF_SUCCESS Result = iota EBPF_VERIFICATION_FAILED EBPF_JIT_COMPILATION_FAILED EBPF_PROGRAM_LOAD_FAILED EBPF_INVALID_FD EBPF_INVALID_OBJECT EBPF_INVALID_ARGUMENT EBPF_OBJECT_NOT_FOUND EBPF_OBJECT_ALREADY_EXISTS EBPF_FILE_NOT_FOUND EBPF_ALREADY_PINNED EBPF_NOT_PINNED EBPF_NO_MEMORY EBPF_PROGRAM_TOO_LARGE EBPF_RPC_EXCEPTION EBPF_ALREADY_INITIALIZED EBPF_ELF_PARSING_FAILED EBPF_FAILED EBPF_OPERATION_NOT_SUPPORTED EBPF_KEY_NOT_FOUND EBPF_ACCESS_DENIED EBPF_BLOCKED_BY_POLICY EBPF_ARITHMETIC_OVERFLOW EBPF_EXTENSION_FAILED_TO_LOAD EBPF_INSUFFICIENT_BUFFER EBPF_NO_MORE_KEYS EBPF_KEY_ALREADY_EXISTS EBPF_NO_MORE_TAIL_CALLS EBPF_PENDING EBPF_OUT_OF_SPACE EBPF_CANCELED EBPF_INVALID_POINTER EBPF_TIMEOUT EBPF_STALE_ID EBPF_INVALID_STATE )
func (Result) Error ¶
func (Result) String ¶
type Size ¶
type Size uint64
Size is the equivalent of size_t.
This is correct on amd64 and arm64 according to tests on godbolt.org.
Source Files ¶
enums.go error_reporting.go fd.go module.go native.go object.go proc.go program.go result.go result_string_windows.go structs.go
- Version
- v0.18.0 (latest)
- Published
- Apr 2, 2025
- Platform
- windows/amd64
- Imports
- 8 packages
- Last checked
- 2 hours ago –
Tools for package owners.