### Run Windows VM Setup Script

Source: https://github.com/cilium/ebpf/blob/main/scripts/windows/README.md

Execute the setup script with the path to your Windows ISO image to automate the installation of a Windows VM and its dependencies.

```shell
./setup.sh path-to-windows.iso

```

--------------------------------

### Install eBPF for Windows Runtime

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Install the eBPF for Windows runtime by executing the setup script after compilation. The script can also be used for uninstallation.

```powershell
.\x64\Debug\setup-ebpf.ps1
```

--------------------------------

### Preview Documentation

Source: https://github.com/cilium/ebpf/blob/main/docs/README.md

Starts a live preview server for the documentation. Access it at http://127.0.0.1:8000.

```bash
make preview
```

--------------------------------

### Install QEMU and binfmt-support

Source: https://github.com/cilium/ebpf/blob/main/testdata/docker/README.md

On Debian-based systems, install qemu-user-static and binfmt-support to enable cross-platform builds with Docker buildx.

```bash
apt install qemu-user-static binfmt-support
```

--------------------------------

### Run eBPF Examples

Source: https://github.com/cilium/ebpf/blob/main/examples/README.md

Command to run eBPF examples. Requires root privileges for execution.

```bash
cd ebpf/examples/
go run -exec sudo [./kprobe, ./uretprobe, ./ringbuffer, ...]
```

--------------------------------

### Install and Register ntosebpfext Extension

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Install the ntosebpfext Windows kernel service and register its program types in the eBPF Store. This involves running a setup script and an export utility.

```powershell
PS C:\Users\lorenz\ntosebpfext> .\tests\process_monitor.Tests\Setup-ProcessMonitorTests.ps1 -ArtifactsRoot .\x64\Debug\
Creating and starting the ntosebpfext service from C:\Users\lorenz\ntosebpfext\x64\Debug\\ntosebpfext.sys.
PS C:\Users\lorenz\ntosebpfext> .\x64\Debug\ntos_ebpf_ext_export_program_info.exe
Exporting program information.
Exporting section information.
```

--------------------------------

### Enter Virtual Environment

Source: https://github.com/cilium/ebpf/blob/main/docs/README.md

Enters the Python virtual environment with all documentation dependencies installed.

```bash
make shell
```

--------------------------------

### Recompile eBPF Examples

Source: https://github.com/cilium/ebpf/blob/main/examples/README.md

Command to recompile eBPF examples using the project's Makefile. This ensures examples are up-to-date with the latest code.

```bash
make -C ../
```

--------------------------------

### Install eBPF Go Library

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/index.md

Add the cilium/ebpf library as a dependency to your Go module.

```bash
go get github.com/cilium/ebpf
```

--------------------------------

### Add bpf2go as a tool dependency

Source: https://github.com/cilium/ebpf/blob/main/cmd/bpf2go/README.md

Add bpf2go as a tool dependency to your project's Go module using 'go get'.

```go
go get -tool github.com/cilium/ebpf/cmd/bpf2go
```

--------------------------------

### Compile eBPF for Windows Installer

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Compile the installer for the eBPF for Windows runtime using MSBuild. Ensure the correct solution file and target are specified.

```powershell
msbuild /m /p:Configuration=Debug /p:Platform=x64 ebpf-for-windows.sln -t:"installer\ebpf-for-windows"
```

--------------------------------

### Run Go Unit Tests for eBPF Library

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Execute the Go unit tests for the eBPF library after the Windows runtime has been installed.

```go
go test ./internal/sys
```

--------------------------------

### Detect kernel support for XDP programs

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/features.md

This Go example demonstrates how to use the features package to detect if the kernel supports XDP programs. It utilizes the HaveProgramType function and checks for specific error types to determine support.

```go
package main

import (
	"fmt"

	"github.com/cilium/ebpf/features"
)

func main() {
	// Check if the kernel supports XDP programs.
	if err := features.HaveProgramType(0); err != nil {
		fmt.Printf("XDP program type not supported: %v\n", err)
		return
	}

	fmt.Println("XDP program type is supported.")
}

```

--------------------------------

### Compile and Run Go eBPF Application

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/getting-started.md

Compile the Go application and run it with root privileges to start counting incoming packets.

```shell
% go build && sudo ./ebpf-test
2023/09/20 17:18:43 Counting incoming packets on eth0..
2023/09/20 17:18:47 Received 0 packets
2023/09/20 17:18:48 Received 4 packets
2023/09/20 17:18:49 Received 11 packets
2023/09/20 17:18:50 Received 15 packets
```

--------------------------------

### Generated counter_bpfel.go

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/getting-started.md

An example of the Go scaffolding code generated by bpf2go. It provides Go types and functions to interact with the compiled eBPF program.

```go
package main

import (
	"bytes"
	"encoding/binary"
	"fmt"
	
```

--------------------------------

### Declare a minimal map and a program

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/loader.md

Defines a simple eBPF map and a program in C. This serves as a basic example for eBPF object compilation.

```c
#include "vmlinux.h"

struct {
	unsigned int type;
	char name[16];
	__u32 key_size;
	__u32 value_size;
	__u32 max_entries;
} my_map SEC("maps") = {
	.type = BPF_MAP_TYPE_HASH,
	.name = "my_map",
	.key_size = sizeof(int),
	.value_size = sizeof(int),
	.max_entries = 100,
};

SEC("program")
int hello(struct pt_regs *ctx) {
	return 0;
}
```

--------------------------------

### Build Documentation

Source: https://github.com/cilium/ebpf/blob/main/docs/README.md

Builds the documentation into a self-contained production copy in the site/ directory.

```bash
make build
```

--------------------------------

### Initialize Go Module and Tidy

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/getting-started.md

Initializes a new Go module for the project and tidies up dependencies. This is a prerequisite for managing tool dependencies.

```shell
go mod init ebpf-test
go mod tidy
```

--------------------------------

### Regenerate Testdata and Source Code with Make

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/index.md

Run the 'make' command in the repository root to regenerate binary artifacts and source code. This process requires Docker.

```shell
make
```

--------------------------------

### Cross-compiling Go Application for Raspberry Pi

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/portable-ebpf.md

Build a standalone Go application for a 64-bit Raspberry Pi, disabling CGO for reduced dependencies.

```shell
CGO_ENABLED=0 GOARCH=arm64 go build
```

--------------------------------

### Enable Windows Trace Log

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Run Go tests with the `-trace-log` flag to enable detailed tracing of the efW subsystem. This log provides entry-exit information for eBPF map operations and initialization.

```go
PS C:\Users\lorenz\ebpf> go test -run '^TestMap$' -v -trace-log
```

--------------------------------

### Run eBPF Program with Global Variable

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/global-variables.md

Dry-run the eBPF program 'global_example()' multiple times to observe the incrementing value of the 'global_u16' variable.

```go
package main

import (
	"fmt"

	"github.com/cilium/ebpf/examples/bpf"
)

func main() {
	// DocVariablesSetGlobalRun

	vars, err := bpf.Collection("variables.o")
	if err != nil {
		panic(err)
	}

	globalU16 := var "global_u16"

	// Initialize global_u16 to 9000.
	if err := globalU16.Set(9000); err != nil {
		panic(err)
	}

	// Dry-run global_example() a few times.
	for i := 0; i < 3; i++ {
		_, _, err := var "global_example".Run(nil)
		if err != nil {
			panic(err)
		}

		val, err := globalU16.Get() // Read the incremented variable.
		if err != nil {
			panic(err)
		}
		fmt.Printf("global_u16 = %d\n", val)
	}
}

```

--------------------------------

### Push the Docker Image

Source: https://github.com/cilium/ebpf/blob/main/testdata/docker/README.md

Push the built Docker image to the registry specified in the IMAGE variable using the Makefile.

```bash
make push
```

--------------------------------

### Run All Tests with sudo

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/index.md

Execute all project tests using sudo privileges, which are often required for eBPF operations.

```shell
go test -exec sudo ./...
```

--------------------------------

### Run Go Generate

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/getting-started.md

Executes the go generate command, which triggers bpf2go to compile the eBPF C code and generate Go object files and Go source files.

```shell
go generate
```

--------------------------------

### Disassembling eBPF Section with Source Code

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/section-naming.md

Use 'llvm-objdump' to display disassembled instructions and corresponding source code for a specific eBPF section.

```bash
llvm-objdump -SD my_ebpf.o -j xdp
```

--------------------------------

### Invoke bpf2go using go generate

Source: https://github.com/cilium/ebpf/blob/main/cmd/bpf2go/README.md

Invoke the bpf2go tool using 'go generate' to compile C source files into eBPF bytecode and generate Go files. The generated files will be named with a stem (e.g., 'foo_bpfel.go' and 'foo_bpfeb.go') for little and big-endian systems respectively.

```go
//go:generate go tool bpf2go foo path/to/src.c -- -I/path/to/include
```

--------------------------------

### Exploring ELF Section Table

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/section-naming.md

Use 'readelf -S' to display the section table of an ELF binary.

```bash
readelf -S <binary>
```

--------------------------------

### gen.go for bpf2go

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/getting-started.md

This Go file contains the //go:generate statement to invoke bpf2go, which compiles the eBPF C program and generates necessary Go scaffolding code.

```go
//go:generate bpf2go counter.c --cc clang

```

--------------------------------

### Iterate on eBPF C Code

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/getting-started.md

Update generated Go files, recompile the eBPF C code, and rebuild the Go application for development iterations.

```shell
% go generate && go build && sudo ./ebpf-test
```

--------------------------------

### Go program modifying a const, loading and running the BPF program

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/global-variables.md

Loads a BPF object, retrieves a global constant variable, sets its value, and executes the BPF program. This demonstrates the user-space interaction with eBPF global variables.

```go
package main

import (
	"bytes"
	"encoding/binary"
	"log"

	"github.com/cilium/ebpf"
)

//go:generate go run github.com/cilium/ebpf/cmd/bpf2go ./bpf -cc clang -cflags "-O2 -g" variables.c -- -I/usr/include

func main() {
	var bpf variables
	// Load the BPF program
	if err := bpf.Load(); err != nil {
		log.Fatalf("loading BPF program: %s", err)
	}

	// Retrieve the global variable spec
	varSpec, ok := bpf.CollectionSpec().Variables["const_u32"]
	if !ok {
		log.Fatalf("variable const_u32 not found")
	}

	// Set the value of the global variable
	value := uint32(42)
	var buf bytes.Buffer
	if err := binary.Write(&buf, binary.LittleEndian, value);
		err != nil {
		log.Fatalf("writing value to buffer: %s", err)
	}

	if err := varSpec.Set(buf.Bytes()); err != nil {
		log.Fatalf("setting variable value: %s", err)
	}

	// Run the BPF program
	ctx := make([]byte, 15)
	_, _, err := bpf.Program("const_example").Tracepoint(ctx)
	if err != nil {
		log.Fatalf("running BPF program: %s", err)
	}

	log.Println("BPF program executed successfully.")
}
```

--------------------------------

### main.go for eBPF Application

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/getting-started.md

The main Go application code responsible for loading and attaching the eBPF program to a kernel hook. It demonstrates setting resource limits, loading eBPF objects, attaching the program to an interface, and reading map values.

```go
package main

import (
	
```

--------------------------------

### Initialize Global Variable in Go

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/global-variables.md

Initialize a global unsigned 16-bit integer variable named 'global_u16' to 9000 in user space before loading the eBPF program.

```go
package main

import (
	"fmt"

	"github.com/cilium/ebpf/examples/bpf"
)

func main() {
	// DocVariablesSetGlobalU16

	vars, err := bpf.Collection("variables.o")
	if err != nil {
		panic(err)
	}

	globalU16 := var "global_u16"

	// Initialize global_u16 to 9000.
	if err := globalU16.Set(9000); err != nil {
		panic(err)
	}

	fmt.Printf("global_u16 set to %d\n", globalU16)
}

```

--------------------------------

### Import Visual Studio Environment

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Use Import-VsEnv to add MSBuild to the PATH for Visual Studio 2022 Developer PowerShell.

```powershell
PS C:\Users\lmbauer> Import-VsEnv
**********************************************************************
** Visual Studio 2022 Developer PowerShell v17.10.4
** Copyright (c) 2022 Microsoft Corporation
**********************************************************************
PS C:\Users\lmbauer> msbuild
MSBuild version 17.10.4+10fbfbf2e for .NET Framework
MSBUILD : error MSB1003: Specify a project or solution file. The current working directory does not contain a project or solution file.
```

--------------------------------

### Regenerate Data with Podman

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/index.md

Override Docker-related environment variables to use Podman for regenerating test data and source code.

```shell
make CONTAINER_ENGINE=podman CONTAINER_RUN_ARGS=
```

--------------------------------

### eBPF Counter Program (counter.c)

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/getting-started.md

A basic eBPF C program that counts packets. It demonstrates map declaration, accessing map elements, and using BPF helpers like bpf_map_lookup_elem and bpf_atomic_add. This program is intended for XDP hooks.

```c
#include <linux/bpf.h>
#include <bpf/bpf_helpers.h>

// Define the BPF map for packet counting
struct {
	__uint(type, BPF_MAP_TYPE_ARRAY);
	__uint(max_entries, 1);
	__type(key, __u32);
	__type(value, __u64);
} pkt_count SEC(".maps");

// eBPF program for XDP
SEC("xdp")
int getting_started_counter(struct xdp_md *ctx) {
	__u64 *count;

	// Get a pointer to the map element (key 0)
	count = bpf_map_lookup_elem(&pkt_count, &0);

	// If the map element exists, increment its value atomically
	if (count) {
		bpf_atomic_add(count, 1);
	}

	// Pass the packet to the next handler
	return XDP_PASS;
}

// License declaration for the eBPF program
char _license[] SEC("license") = "Dual MIT/GPL";

```

--------------------------------

### Compile eBPF for Windows Unit Tests

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Compile the unit tests for the eBPF for Windows runtime using MSBuild. Ensure the correct solution file and target are specified.

```powershell
msbuild /m /p:Configuration=Debug /p:Platform=x64 ebpf-for-windows.sln -t:"tests\unit_tests"
```

--------------------------------

### Run Tests with vimto and a Specific Kernel

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/index.md

Use vimto to run tests against a specific kernel version, such as the mainline kernel.

```shell
vimto -- go test ./...
```

```shell
vimto -kernel :mainline -- go test ./...
```

--------------------------------

### Sign Commits with Developer Certificate of Origin

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/index.md

Append this line to your commits to certify that you have read and understood the DCO.

```text
Signed-off-by: Your Name <name@example.org>
```

--------------------------------

### Dumping eBPF Object BTF Type Information

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/section-naming.md

Use 'bpftool' to display BTF type information from an eBPF object file.

```bash
bpftool btf dump file my_object.o
```

--------------------------------

### Load Signed eBPF Driver on Windows

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/windows-support.md

Load a pre-signed eBPF driver file on Windows using the LoadCollection function. This method is used when eBPF programs are packaged as drivers and cannot be modified via CollectionSpec.

```go
coll, err := LoadCollection("path\\to\\driver.sys")
```

--------------------------------

### Load eBPF objects into the kernel

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/loader.md

Loads an eBPF ELF into the kernel, creating the defined maps and programs. This is the primary method for bringing eBPF logic into the running kernel.

```go
import (
	"fmt"

	"github.com/cilium/ebpf"
)

func DocNewCollection() error {
	// Load the ELF object from disk.
	collectionSpec, err := ebpf.LoadCollectionSpec("program.elf")
	if err != nil {
		return fmt.Errorf("failed to load collection spec: %w", err)
	}

	// Load the eBPF Collection into the kernel.
	collection, err := ebpf.NewCollection(collectionSpec)
	if err != nil {
		return fmt.Errorf("failed to create collection: %w", err)
	}
	defer collection.Close() // Ensure resources are freed.

	// Interact with the loaded maps and programs via the collection.
	// For example, get a map:
	// myMap := collection.Maps["my_map"]

	return nil
}
```

--------------------------------

### eBPF Library Architecture Diagram

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/architecture.md

A Mermaid diagram illustrating the dependency relationships between key types in the eBPF library, such as Program, Map, ELF, and their specifications.

```mermaid
graph RL
    Program --> ProgramSpec --> ELF
    btf.Spec --> ELF
    Map --> MapSpec --> ELF
    Links --> Map & Program
    ProgramSpec -.-> btf.Spec
    MapSpec -.-> btf.Spec
    subgraph Collection
        Program & Map
    end
    subgraph CollectionSpec
        ProgramSpec & MapSpec & btf.Spec
    end
```

--------------------------------

### Set C flags with BPF2GO_CFLAGS environment variable

Source: https://github.com/cilium/ebpf/blob/main/cmd/bpf2go/README.md

Use the BPF2GO_CFLAGS environment variable to set C flags for all bpf2go invocations across a project. This allows for consistent compilation settings.

```bash
BPF2GO_CFLAGS="-O2 -g -Wall -Werror $(CFLAGS)" go generate ./...
```

--------------------------------

### Clean eBPF for Windows Build Artifacts

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Clean the build artifacts for eBPF for Windows using MSBuild. Ensure the correct solution file and target are specified.

```powershell
msbuild /m /p:Configuration=Debug /p:Platform=x64 ebpf-for-windows.sln -t:"Clean"
```

--------------------------------

### Pass a custom struct to LoadAndAssign

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/loader.md

Uses LoadAndAssign to load eBPF objects directly into a custom struct, automating map/program extraction and enabling selective loading. This simplifies resource management.

```go
import (
	"fmt"

	"github.com/cilium/ebpf"
)

func DocLoadAndAssign() error {
	// Load the ELF object from disk.
	collectionSpec, err := ebpf.LoadCollectionSpec("program.elf")
	if err != nil {
		return fmt.Errorf("failed to load collection spec: %w", err)
	}

	// Instantiate the struct that will hold our eBPF objects.
	var objs myObjs

	// Load and assign eBPF objects into the struct.
	// Only "my_map" and "hello" (and their dependencies) will be loaded.
	if err := collectionSpec.LoadAndAssign(&objs, nil);
		err != nil {
		return fmt.Errorf("failed to load and assign: %w", err)
	}
	defer objs.Close() // Ensure resources are freed.

	// Now objs.MyMap and objs.Hello can be used.

	return nil
}
```

--------------------------------

### Parse ELF and inspect its CollectionSpec

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/loader.md

Loads an eBPF ELF into a CollectionSpec, allowing inspection and modification of eBPF objects before kernel loading. Use this to understand the structure of an eBPF object.

```go
import (
	"fmt"

	"github.com/cilium/ebpf"
)

func DocLoadCollectionSpec() error {
	// Load the ELF object from disk.
	collectionSpec, err := ebpf.LoadCollectionSpec("program.elf")
	if err != nil {
		return fmt.Errorf("failed to load collection spec: %w", err)
	}

	// Inspect the loaded spec.
	fmt.Printf("Loaded %d maps and %d programs.\n", len(collectionSpec.Maps), len(collectionSpec.Programs))

	// You can now modify collectionSpec.Maps and collectionSpec.Programs before loading.

	return nil
}
```

--------------------------------

### Declare a custom struct myObjs

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/loader.md

Defines a Go struct to hold references to eBPF maps and programs, intended for use with LoadAndAssign. Includes a Close method for resource management.

```go
import (
	"github.com/cilium/ebpf"
)

// myObjs holds loaded eBPF objects.
type myObjs struct {
	MyMap *ebpf.Map
	Hello *ebpf.Program
}

// Close cleans up the loaded eBPF objects.
func (objs *myObjs) Close() error {
	if err := objs.Hello.Close(); err != nil {
		return err
	}
	if err := objs.MyMap.Close(); err != nil {
		return err
	}
	return nil
}
```

--------------------------------

### eBPF Program License Declaration

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/section-naming.md

Declare the license for your eBPF program. This is required for using certain BPF helpers and must be GPL-compatible.

```c
#!c char __license[] SEC("license") = "Dual MIT/GPL";
```

--------------------------------

### Access BTF Type Information by Name

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/loader.md

Retrieves BTF (BPF Type Format) type information from an eBPF ELF object by its name. Requires the ELF to be compiled with debug information (e.g., `clang -g`).

```go
import (
	"fmt"

	"github.com/cilium/ebpf"
)

func DocBTFTypeByName() error {
	// Load the ELF object from disk.
	collectionSpec, err := ebpf.LoadCollectionSpec("program.elf")
	if err != nil {
		return fmt.Errorf("failed to load collection spec: %w", err)
	}

	// Check if BTF information is available.
	if collectionSpec.Types == nil {
		fmt.Println("No BTF type information found in the ELF.")
		return nil
	}

	// Retrieve a specific type by name.
	btfType, ok := collectionSpec.Types["my_map"]
	if !ok {
		return fmt.Errorf("type 'my_map' not found")
	}

	fmt.Printf("Found type '%s' with ID %d\n", btfType.Name, btfType.ID)

	return nil
}
```

--------------------------------

### Remove RLIMIT_MEMLOCK if kernel lacks memcg accounting

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/rlimit.md

This Go code snippet demonstrates how to conditionally remove the RLIMIT_MEMLOCK restriction if the kernel does not support memory cgroup accounting for eBPF. It's designed to be included in an application to ensure compatibility across different kernel versions.

```go
package main

import (
	"fmt"
	"log"

	"github.com/cilium/ebpf/rlimit"
)

func main() {
	// Remove RLIMIT_MEMLOCK if kernel lacks memcg accounting.
	// This is a no-op on kernels >= 5.11.
	if err := rlimit.RemoveMemlock(); err != nil {
		log.Fatalf("Failed to remove memlock rlimit: %v", err)
	}

	fmt.Println("Successfully removed memlock rlimit if necessary.")

	// Proceed with eBPF map/program loading...
}

```

--------------------------------

### Defining eBPF Map in .maps Section

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/section-naming.md

Define eBPF maps using BTF-style definitions within the '.maps' ELF section.

```c
struct {
    __uint(type, BPF_MAP_TYPE_ARRAY);
    __uint(max_entries, 10);
    __type(key, __u32);
    __type(value, __u64);
} my_map SEC(".maps");
```

--------------------------------

### Read Global Variable After Loading in Go

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/global-variables.md

Read the incremented value of the 'global_u16' global variable from user space after the eBPF program has been loaded into the kernel.

```go
package main

import (
	"fmt"

	"github.com/cilium/ebpf/examples/bpf"
)

func main() {
	// DocVariablesGetGlobalU16

	vars, err := bpf.Collection("variables.o")
	if err != nil {
		panic(err)
	}

	globalU16 := var "global_u16"

	// Initialize global_u16 to 9000.
	if err := globalU16.Set(9000); err != nil {
		panic(err)
	}

	// Dry-run global_example() a few times.
	for i := 0; i < 3; i++ {
		_, _, err := var "global_example".Run(nil)
		if err != nil {
			panic(err)
		}

		// Read the incremented variable.
		val, err := globalU16.Get()
		if err != nil {
			panic(err)
		}
		fmt.Printf("global_u16 = %d\n", val)
	}
}

```

--------------------------------

### Declare eBPF for Windows Platform Tag

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/guides/windows-support.md

Add this C constant to ELFs targeting Windows until an official platform declaration method is available. This is required for compatibility with the eBPF for Windows runtime.

```c
const bool __ebpf_for_windows_tag __attribute__((section (".ebpf_for_windows"))) = true;
```

--------------------------------

### Declare Global Variable in .data Section

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/section-naming.md

Declare a mutable global variable in a custom section prefixed with .data*. This is useful for Go code generation or custom variable rewriting.

```c
#!c SEC(".data.foo")
my_var = 123;
```

--------------------------------

### Set Breakpoint in WinDbg

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/contributing/windows.md

Use WinDbg to set a breakpoint on the `bpf()` function within `ebpfapi.dll` to halt execution when the library is called. This is useful for stepping through C++ code during debugging.

```debugger
bu ebpfapi!bpf
g
```

--------------------------------

### BPF C program declaring global constant const_u32

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/global-variables.md

Declares a global constant variable 'const_u32' in BPF C. The 'volatile' qualifier is crucial to ensure the variable is not optimized away by the compiler and is available for modification from user space.

```c
#include "vmlinux.h"

// Global constant variable. Volatile is required to ensure it is not optimized away.
volatile const unsigned int const_u32 = 42;

SEC("xdp")
int const_example(struct xdp_md *ctx)
{
	return const_u32;
}
```

--------------------------------

### BPF C program declaring global variable global_u16

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/global-variables.md

Declares a mutable global variable 'global_u16' in BPF C. The 'volatile' qualifier is used to ensure the variable is not optimized away and remains accessible for modification from user space.

```c
#include "vmlinux.h"

// Global variable. Volatile is required to ensure it is not optimized away.
volatile unsigned short global_u16 = 10;

SEC("xdp")
int global_example(struct xdp_md *ctx)
{
	return global_u16;
}
```

--------------------------------

### Declare Internal Global Variable in BPF C

Source: https://github.com/cilium/ebpf/blob/main/docs/ebpf/concepts/global-variables.md

Declare an internal global variable 'internal_var' in a BPF C program using the '__hidden' macro to prevent user space access.

```c
/* BPF C program declaring internal global variable internal_var */

#include "bpf/bpf_helpers.h"

struct {
	unsigned int type;
} __attribute__((section("maps/internal_var")));

__hidden int internal_var;

SEC("xdp")
int xdp_pass() {
	internal_var++;
	return 0;
}

```

=== COMPLETE CONTENT === This response contains all available snippets from this library. No additional content exists. Do not make further requests.