lookupKernelField finds the C-side field name for a Go field on a kernel struct. Reads the `bpf:"..."` struct tag if present; falls back to a snake-ca

mapLookupCall returns (mapName, valType, true) if call is `<mapVar>.Lookup(...)` where mapVar is a package-level bpf.ArrayMap or bpf.HashMap.

mapTypes resolves each parameter's C type to a Go type and computes the Go return type. Returns a skip reason if any parameter or the return type can'

parseParams splits a comma-separated C parameter list. Returns ok=false (with a reason) for variadic or otherwise unsupported shapes.

perfEventArrayMethodCall recognises (*bpf.PerfEventArray[T]).Output(ctx, val).

posFor builds a token.Position from raw fields. Used by tests; kept here so it can also support a future "load sourcemap from disk" path.

progArrayMethodCall recognises (*bpf.ProgArray).TailCall(ctx, key).

queueLikeMethodCall recognises Push/Pop/Peek on a *bpf.Queue[T] or *bpf.Stack[T] and returns the matching libbpf helper call.

redirectMapCall handles Redirect(ctx, key, flags) on a DevMap, CpuMap, or XskMap. All three route to the single bpf_redirect_map helper; the userspace

requiresVmlinuxParam reports whether a function parameter's type points to a bpf-package struct that needs vmlinux.h to compile.

ringbufMethodCall recognizes `<rb>.{Submit,Discard,Output}(event)` on a `*bpf.RingBuf[T]`. Returns the C call string for the supported methods.

ringbufReserveCall returns (mapName, valType, true) if call is `<rb>.Reserve()` on a `*bpf.RingBuf[T]`.

sanitizePackageName turns an arbitrary directory name into a valid Go package identifier: lowercase alphanumerics, underscores collapse non-id runes,

storageGetCall recognizes `<storage>.Get(obj)` for the comma-ok path (`v, ok := taskCtx.Get(task)`). Returns (mapName, valType, helperName) so the cal

storageMethodCall handles TaskStorage / SkStorage / InodeStorage calls that aren't comma-ok Get (those are handled in writeAssignStmt). Covers GetOrCr

tryBuildMapDecl examines a single var name from a ValueSpec. If the var's type is a known bpf-package map (ArrayMap, HashMap, RingBuf, …), it returns

uname returns the kernel-side arch name used in /usr/include paths. runtime.GOARCH gives Go's name (amd64, arm64); the multiarch include dirs use Linu

usedPreludeHelpers returns the names of bpf-package sugar functions (in deterministic order) used anywhere in the program that require a static C help

usesEndianHelpers reports whether any program or user-defined helper calls one of bpf.Ntohl / Htonl / Ntohs / Htons. When true, the emitter adds `#inc

usesKernelFieldAccess reports whether the emitted C needs the CO-RE header set (vmlinux.h + bpf_core_read.h). True when: - any //bpf:section function

writeHelper emits a user-defined Go helper as a C function with `static __always_inline` linkage so the BPF verifier inlines it into every caller (BPF

writeRaw emits s verbatim, tracking newlines for the sourcemap. Used for static helper bodies pulled from the prelude.

writeStorageGet emits the typed-pointer + ok-alias pair for a comma-ok storage Get, mirroring writeMapLookup. The kernel helper returns NULL when no e

bpf:license GPL bpf:section lsm/file_open

bpf:section xdp

keep the import even when no helper needs it Bind wraps the BPF helper `bpf_bind`. Bind the socket associated to *ctx* to the address pointed by *a

BprmOptsSet wraps the BPF helper `bpf_bprm_opts_set`. Set or clear certain options on *bprm*: **BPF_F_BPRM_SECUREEXEC** Set the secureexec bit wh

BtfFindByNameKind wraps the BPF helper `bpf_btf_find_by_name_kind`. Find BTF type with given name and kind in vmlinux BTF or in module's BTFs. Ret

CgrpStorageGet wraps the BPF helper `bpf_cgrp_storage_get`. Get a bpf_local_storage from the *cgroup*. Logically, it could be thought of as gettin

CheckMtu wraps the BPF helper `bpf_check_mtu`. Check packet size against exceeding MTU of net device (based on *ifindex*). This helper will likely

CloneRedirect wraps the BPF helper `bpf_clone_redirect`. Clone and redirect the packet associated to *skb* to another net device of index *ifindex*

CopyFromUser wraps the BPF helper `bpf_copy_from_user`. Read *size* bytes from user space address *user_ptr* and store the data in *dst*. This is a

CopyFromUserTask wraps the BPF helper `bpf_copy_from_user_task`. Read *size* bytes from user space address *user_ptr* in *tsk*'s address space, and

bpf:section xdp

bpf:section xdp

bpf:section tracepoint/syscalls/sys_enter_openat

bpf:section cgroup_skb/egress

bpf:section sockops

bpf:section kprobe/__x64_sys_openat

bpf:section xdp

bpf:section xdp

bpf:section xdp

bpf:section xdp

bpf:section xdp

CsumDiff wraps the BPF helper `bpf_csum_diff`. Compute a checksum difference, from the raw buffer pointed by *from*, of length *from_size* (that mu

CsumLevel wraps the BPF helper `bpf_csum_level`. Change the skbs checksum level by one layer up or down, or reset it entirely to none in order to h

CsumUpdate wraps the BPF helper `bpf_csum_update`. Add the checksum *csum* into *skb*\ **->csum** in case the driver has supplied a checksum for th

CurrentTaskUnderCgroup wraps the BPF helper `bpf_current_task_under_cgroup`. Check whether the probe is being run is the context of a given subset

Delete removes the entry for task.

Discard drops a previously reserved event without publishing it. Use this on the error path to avoid leaking ring budget.

bpf:section xdp

bpf:section xdp

DPath wraps the BPF helper `bpf_d_path`. Return full path for given **struct path** object, which needs to be the kernel BTF *path* object. The pa

DynptrFromMem wraps the BPF helper `bpf_dynptr_from_mem`. Get a dynptr to local memory *data*. *data* must be a ptr to a map value. The maximum *

DynptrRead wraps the BPF helper `bpf_dynptr_read`. Read *len* bytes from *src* into *dst*, starting from *offset* into *src*. *flags* is currently

DynptrWrite wraps the BPF helper `bpf_dynptr_write`. Write *len* bytes from *src* into *dst*, starting from *offset* into *dst*. *flags* must be

FibLookup wraps the BPF helper `bpf_fib_lookup`. Do FIB lookup in kernel tables using parameters in *params*. If lookup is successful and result sh

bpf:section xdp

FindVma wraps the BPF helper `bpf_find_vma`. Find vma of *task* that contains *addr*, call *callback_fn* function with *task*, *vma*, and *callback

ForEachMapElem wraps the BPF helper `bpf_for_each_map_elem`. For each element in **map**, call **callback_fn** function with **map**, **callback_ct

bpf:section xdp

Get returns the entry for task or nil if no entry exists.

GetAttachCookie wraps the BPF helper `bpf_get_attach_cookie`. Get bpf_cookie value provided (optionally) during the program attachment. It might be

GetBranchSnapshot wraps the BPF helper `bpf_get_branch_snapshot`. Get branch trace from hardware engines like Intel LBR. The hardware engine is sto

GetCgroupClassid wraps the BPF helper `bpf_get_cgroup_classid`. Retrieve the classid for the current task, i.e. for the net_cls cgroup to which *sk

GetCurrentAncestorCgroupId wraps the BPF helper `bpf_get_current_ancestor_cgroup_id`. Return id of cgroup v2 that is ancestor of the cgroup associat

GetCurrentCgroupId wraps the BPF helper `bpf_get_current_cgroup_id`. Get the current cgroup id based on the cgroup within which the current task is

GetCurrentComm wraps the BPF helper `bpf_get_current_comm`. Copy the **comm** attribute of the current task into *buf* of *size_of_buf*. The **comm

GetCurrentGid returns the calling task's effective GID (the upper 32 bits of bpf_get_current_uid_gid).

GetCurrentTask wraps the BPF helper `bpf_get_current_task`. Get the current task. Returns A pointer to the current task struct.

GetCurrentTid returns the calling thread's ID (the lower 32 bits of bpf_get_current_pid_tgid). Equivalent to gettid(2).

GetCurrentUidGid wraps the BPF helper `bpf_get_current_uid_gid`. Get the current uid and gid. Returns A 64-bit integer containing the current GID

GetFuncArg wraps the BPF helper `bpf_get_func_arg`. Get **n**-th argument register (zero based) of the traced function (for tracing programs) retur