formatExpr returns the C representation of a Go expression as a string.

Contains reports whether `value` may be in the filter. False positives are possible (rate decided by MaxEntries and the kernel's hash count); false ne

AtomicAdd64 atomically adds delta to *addr. Transpiles to __sync_fetch_and_add(addr, delta) in BPF C.

goTypeToC maps a resolved Go type to its emitted C representation. Pointer types render as `<C base type> *`; named bpf-package types map to their ker

ParseFile loads a single Go file, type-checks it, and returns the gobee IR. Diagnostics from the Go front-end are returned as errors with file:line:co

declString joins a C type and a variable name with libbpf-style spacing: pointer types attach the `*` to the variable (`struct xdp_md *ctx`).

Reserve allocates space for one event in the ring. Returns (event, true) on success or (nil, false) if the ring is full. The bool is the recognized co

Submit publishes a previously reserved event so the userspace reader can see it.

Validate checks that every //bpf:section function in the program uses only the supported Go subset. Returns all findings sorted by source position.

Emit produces the BPF C source for a parsed program along with a sourcemap that lets `gobee diagnose` map verifier errors back to the originating Go s

KtimeGetNs wraps the BPF helper `bpf_ktime_get_ns`. Return the time elapsed since system boot, in nanoseconds. Does not include time the system was

fillHeader sets every field of e that's the same for every kind of event: timestamp, pid, uid, comm, kind. Inlined into each section program by the BP

recordPos pairs the current C line with a Go source position. Called at the top of each emit step (statement, map decl, program header, license) so th

This file holds typed convenience wrappers over the auto-generated libbpf helpers. They exist purely so kernel-side Go code reads naturally; the gobee

ParseSourceMap reads a sourcemap as written by transpile.FormatSourceMap. Comment lines (`#...`) and blank lines are skipped.

parseDirective returns the parsed directive if the comment text starts with "//bpf:". Returns (nil, nil) for unrelated comments. Whitespace around fie

pascalCase upper-cases the first rune. Internal-only helper for translating ELF symbol names like `events` or `OnExec` into Go field names like `Event

FormatSourceMap renders mappings as a tab-separated text file: <c-line>\t<go-file>:<go-line>:<go-col> Lines are sorted by C line number. The format

GetCurrentPidTgid wraps the BPF helper `bpf_get_current_pid_tgid`. Get the current pid and tgid. Returns A 64-bit integer containing the current

Redirect hands the current packet to the interface stored at key. The return value is the XdpAction the BPF program should return (typically XDP_REDIR

Rewrite reads verifier output from r line by line and writes an annotated copy to w. Each line that contains a `<file>.bpf.c:<N>` reference is extende

Run translates every kernel-side .go file in opts.InputDir into a sibling .bpf.c file. gobee stops here — the user owns clang invocation, .o embedding

bpfPackageTypeInfo returns the bpfTypeInfo for a Named type if it's declared in the gobee bpf package; ok=false otherwise.

resolveLHSName returns ident.Name unless it's the Go blank identifier, in which case it mints a unique synthetic C identifier. Two `_, ok := Map.Looku

AnnotateLines walks each input line, extends any line that mentions a `<stem>.bpf.c:<N>` reference with the matching Go position from sm, and returns

GetCurrentUid returns the calling task's effective UID (the lower 32 bits of bpf_get_current_uid_gid).

GetUserString copies a NUL-terminated string from the userspace pointer addr into buf, up to its length. Returns the number of bytes copied including

ParseSourceMapBytes is the byte-slice convenience wrapper for callers that already have the sourcemap in memory (e.g. generated bindings that embed it

annotateLine returns line with one trailing `(→ go-file:line:col)` per distinct C-line ref it contains. Unknown refs are left alone (no false rewrites

cTypeToGo maps a single C type to its Go counterpart. - integer types map directly - char* / const char* are rejected (strings are not BPF-safe) - st

goNameToBpfHelper converts a `bpf` package Go function name back to its libbpf C helper name. Inverse of tools/genhelpers's goNameFor. MapLookupElem

isKernelContextStruct reports whether the named type is one of the bpf-package kernel-context structs whose field reads should go through BPF_CORE_REA

mapMethodCall recognizes any `<mapVar>.<Method>(...)` call where mapVar is a gobee map type (ArrayMap or HashMap). Returns the map identifier name, it

storageMapInfo extracts (mapName, valType, scopeKey) for a TaskStorage / SkStorage / InodeStorage method call. scopeKey is the storage Go type name ("

Add inserts an element. Always succeeds (a bloom filter never rejects).

Execute runs the root command. Returns any error encountered so main.go can decide on the exit code.

GetCurrentTaskBtf wraps the BPF helper `bpf_get_current_task_btf`. Return a BTF pointer to the "current" task. This pointer can also be used in hel

GetPrandomU32 wraps the BPF helper `bpf_get_prandom_u32`. Get a pseudo-random number. From a security point of view, this helper uses its own pse

GetSmpProcessorId wraps the BPF helper `bpf_get_smp_processor_id`. Get the SMP (symmetric multiprocessing) processor id. Note that all programs run

GetTaskComm fills buf with the calling task's command name (the kernel's TASK_COMM_LEN is 16, NUL-padded). Returns 0 on success, a negative errno on f

GetUserArgv reads up to 8 entries of the userspace argv array (a `char *const *`) into buf as 32-byte slots. Returns the number of bytes written.

Byte-order helpers for reading network-endian fields like `bpf_sock_ops::remote_port` (a __be32 ABI). These are clang macros from <bpf/bpf_endian.h>,

Output is the one-shot variant of Reserve+Submit: it allocates, copies the value, and submits in a single call. Returns 0 on success or a negative err

PrintSummary writes a one-line-per-artifact summary to w.

SockOpsCbFlagsSet wraps the BPF helper `bpf_sock_ops_cb_flags_set`. Attempt to set the value of the **bpf_sock_ops_cb_flags** field for the full TC

TailCall jumps into the program registered at key. On success this never returns; on failure (key out of range, no program registered, or tail-call li

WriteBindings emits a Go file with typed accessors for the program's BPF programs and maps. Consumers use cilium/ebpf's LoadAndAssign machinery via th

attachFor maps a //bpf:section value to an attach-helper template, or returns nil if gobee doesn't yet know how to attach this program kind from the b

bpfFieldNameTag returns the value of the `bpf:"…"` struct tag on goName-named field of named, or "" if no such tag exists.

checkBodyTypes flags forbidden basic types (string) reachable inside the function body. This catches `var s string`, `s := "hi"`, etc., which a pure-A

coreReadChain detects field access on a `*bpf.<KernelStruct>` value and returns the equivalent BPF_CORE_READ(...) expression. Returns ok=false if the

decodeArgs joins the 8 fixed-size 32-byte slots produced by the kernel's gobee_read_user_argv helper into a single space-separated string. Empty slots

docDirective scans a doc comment group for the named directive and returns the first match, or nil if absent. Errors during parsing are ignored here;

findArchObjects returns every .bpf.o under example/*/bpf/bin/<arch>/. arch is mapped from runtime.GOARCH because the Makefile uses libbpf- style names

findInputs returns .go files in dir whose contents reference //bpf:license. Cheap text scan — avoids paying go/types cost on unrelated files.

goNameFor turns a C helper name into its exported Go counterpart. The leading `bpf_` is dropped; remaining snake_case becomes PascalCase. bpf_map_lo

kernelStructType returns the underlying *types.Named for `*bpf.<Type>` expressions where <Type> is one of the kernel-context structs we model. Returns