eBPF

https://pkg.go.dev/github.com/cilium/ebpf
Admin
eBPF is a pure Go library that provides utilities for loading, compiling, and debugging eBPF...
Tokens:86,295
Snippets:1,009
Trust Score:10
Update:3 months ago
Show doc for...
Tokens:
Raw
### Run eBPF examples

Source: https://pkg.go.dev/github.com/cilium/ebpf/examples%40v0.0.0-20220819183058-4420605496c5

Execute the compiled eBPF example binaries with root privileges.

```bash
cd ebpf/examples/
go run -exec sudo [./kprobe, ./uretprobe, ./ringbuffer, ...]
```

--------------------------------

### Recompile eBPF examples

Source: https://pkg.go.dev/github.com/cilium/ebpf/examples%40v0.0.0-20220819183058-4420605496c5

Use the Makefile in the parent directory to recompile the project examples.

```makefile
make -C ..
```

--------------------------------

### BPF perf event output example

Source: https://pkg.go.dev/github.com/cilium/ebpf/perf

Example BPF code demonstrating how to define a perf event array map and output data using perf_event_output.

```c
struct map events __section("maps") = {
  .type = BPF_MAP_TYPE_PERF_EVENT_ARRAY,
};

__section("xdp") int output_single(void *ctx) {
  unsigned char buf[] = {
    1, 2, 3, 4, 5
  };

   return perf_event_output(ctx, &events, BPF_F_CURRENT_CPU, &buf[0], 5);
 }
```

--------------------------------

### Header Start Offset Definitions

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sys

Constants defining the starting offset for packet headers.

```go
type HdrStartOff uint32
```

```go
const (
	BPF_HDR_START_MAC HdrStartOff = 0
	BPF_HDR_START_NET HdrStartOff = 1
)
```

--------------------------------

### Get Program Info

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns metadata about the program. Requires Linux 4.10 or later.

```go
func (p *Program) Info() (*ProgramInfo, error)
```

--------------------------------

### Custom Marshaler Example

Source: https://pkg.go.dev/github.com/cilium/ebpf

Demonstrates how to implement custom encoding logic for map methods.

```go

```

--------------------------------

### Capability Management

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/unix

Functions to get or set process capabilities.

```go
func Capget(hdr *CapUserHeader, data *CapUserData) (err error)
```

```go
func Capset(hdr *CapUserHeader, data *CapUserData) (err error)
```

--------------------------------

### Get BPF-to-BPF function references

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns a set of symbol names that the instructions make calls to.

```go
func (insns Instructions) FunctionReferences() []string
```

--------------------------------

### Get BTF Handle Metadata

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns metadata about the handle.

```go
func (h *Handle) Info() (*HandleInfo, error)
```

--------------------------------

### Get Line Content

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the content of the line.

```go
func (li *Line) Line() string
```

--------------------------------

### Get BTF Handle

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns a reference to the program's type information in the kernel.

```go
func (p *Program) Handle() (*btf.Handle, error)
```

--------------------------------

### Get symbol offsets

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns a map of symbols and their offsets in the instructions.

```go
func (insns Instructions) SymbolOffsets() (map[string]int, error)
```

--------------------------------

### Get Kernel Release String

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/linux

Returns the kernel release string, which typically matches directory names in /lib/modules.

```go
func KernelRelease() (string, error)
```

--------------------------------

### Object retrieval and pinning attributes

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sys

Structures for getting and pinning BPF objects.

```go
type ObjGetAttr struct {
	Pathname  StringPointer
	BpfFd     uint32
	FileFlags uint32
	PathFd    int32
	// contains filtered or unexported fields
}
```

```go
type ObjGetInfoByFdAttr struct {
	BpfFd   uint32
	InfoLen uint32
	Info    Pointer
	// contains filtered or unexported fields
}
```

```go
type ObjPinAttr struct {
	Pathname  StringPointer
	BpfFd     uint32
	FileFlags uint32
	PathFd    int32
	// contains filtered or unexported fields
}
```

--------------------------------

### Get next key as bytes

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the key following an initial key as a byte slice. Passing nil returns the first key.

```go
func (m *Map) NextKeyBytes(key any) ([]byte, error)
```

--------------------------------

### Get reference offsets

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns a map of references and their corresponding offsets within the instructions.

```go
func (insns Instructions) ReferenceOffsets() map[string][]int
```

--------------------------------

### Get instruction size

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns the size in bytes of the instructions in binary form.

```go
func (insns Instructions) Size() uint64
```

--------------------------------

### Create a Version from a code

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal

Creates a Version instance from a LINUX_VERSION_CODE.

```go
func NewVersionFromCode(code uint32) Version
```

--------------------------------

### Run Program

Source: https://pkg.go.dev/github.com/cilium/ebpf

Executes the program in the kernel with the provided options.

```go
func (p *Program) Run(opts *RunOptions) (uint32, error)
```

--------------------------------

### Initialize SafeELFFile

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal

Creates a new SafeELFFile from an io.ReaderAt or a file path. Panics during parsing are converted to errors.

```go
func NewSafeELFFile(r io.ReaderAt) (safe *SafeELFFile, err error)
```

```go
func OpenSafeELFFile(path string) (safe *SafeELFFile, err error)
```

--------------------------------

### Get Typedef Name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the name of the Typedef.

```go
func (td *Typedef) TypeName() string
```

--------------------------------

### Instructions.Iterate

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Allows iterating over a BPF program while tracking offsets.

```APIDOC
## func (Instructions) Iterate

### Description
Iterate allows iterating a BPF program while keeping track of various offsets. Modifying the instruction slice will lead to undefined behaviour.

### Signature
`func (insns Instructions) Iterate() *InstructionIterator`
```

--------------------------------

### Get TypeTag Name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the name of the TypeTag.

```go
func (tt *TypeTag) TypeName() string
```

--------------------------------

### Get Line Number

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the line number.

```go
func (li *Line) LineNumber() uint32
```

--------------------------------

### Filesystem Configuration

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/unix

Functions for configuring and mounting filesystems.

```go
func FsconfigCreate(fd int) (err error)
```

```go
func FsconfigSetString(fd int, key string, value string) error
```

```go
func Fsmount(fd int, flags int, mountAttrs int) (fsfd int, err error)
```

```go
func Fsopen(fsname string, flags int) (fd int, err error)
```

```go
func MoveMount(fromDirfd int, fromPathName string, toDirfd int, toPathName string, flags int) (err error)
```

--------------------------------

### Format

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Implements the fmt.Formatter interface for instructions.

```go
func (ins Instruction) Format(f fmt.State, c rune)
```

--------------------------------

### Select Platform Version

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/platform

Extracts the appropriate version string based on the current platform from a provided list.

```go
func SelectVersion(versions []string) (string, error)
```

--------------------------------

### Get Program Type

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the underlying type of the program.

```go
func (p *Program) Type() ProgramType
```

--------------------------------

### Get map type

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the underlying type of the map.

```go
func (m *Map) Type() MapType
```

--------------------------------

### Source

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns BTF source information for the instruction.

```go
func (ins Instruction) Source() fmt.Stringer
```

--------------------------------

### Load Spec from File

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Opens a file and loads the BTF specification.

```go
func LoadSpec(file string) (*Spec, error)
```

--------------------------------

### Get UprobeMultiInfo Offsets

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Returns the offsets attached to the uprobe.

```go
func (umi *UprobeMultiInfo) Offsets() ([]UprobeMultiOffset, bool)
```

--------------------------------

### Get Program Stats

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns runtime statistics. Requires Linux 5.8 or later and enabled statistics collection.

```go
func (p *Program) Stats() (*ProgramStats, error)
```

--------------------------------

### Locate KConfig File

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/linux

Searches for the host kconfig file, checking /boot/config- first, then /proc/config.gz.

```go
func FindKConfig() (*os.File, error)
```

--------------------------------

### Get KprobeMultiInfo addresses

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Returns the addresses hooked by the kprobe.

```go
func (kpm *KprobeMultiInfo) Addresses() ([]KprobeMultiAddress, bool)
```

--------------------------------

### Get Line Column

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the column number of the line.

```go
func (li *Line) LineColumn() uint32
```

--------------------------------

### Format Instructions

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Implements fmt.Formatter for stringifying eBPF programs.

```go
func (insns Instructions) Format(f fmt.State, c rune)
```

--------------------------------

### CPU Affinity

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/unix

Gets or sets the CPU affinity of a process.

```go
func SchedGetaffinity(pid int, set *CPUSet) error
```

```go
func SchedSetaffinity(pid int, set *CPUSet) error
```

--------------------------------

### Test Program

Source: https://pkg.go.dev/github.com/cilium/ebpf

Runs the program in the kernel with input. Requires Linux 4.12 or later.

```go
func (p *Program) Test(in []byte) (uint32, []byte, error)
```

--------------------------------

### Map batch cursor

Source: https://pkg.go.dev/github.com/cilium/ebpf

Represents a starting point for a batch operation.

```go
type MapBatchCursor struct {
	// contains filtered or unexported fields
}
```

--------------------------------

### Define RunOptions for BPF Program Execution

Source: https://pkg.go.dev/github.com/cilium/ebpf

Configuration struct for executing BPF programs, including input data, context, and repetition settings.

```go
type RunOptions struct {
	// Program's data input. Required field.
	//
	// The kernel expects at least 14 bytes input for an ethernet header for
	// XDP and SKB programs.
	Data []byte
	// Program's data after Program has run. Caller must allocate. Optional field.
	DataOut []byte
	// Program's context input. Optional field.
	Context any
	// Program's context after Program has run. Must be a pointer or slice. Optional field.
	ContextOut any
	// Minimum number of times to run Program. Optional field. Defaults to 1.
	//
	// The program may be executed more often than this due to interruptions, e.g.
	// when runtime.AllThreadsSyscall is invoked.
	Repeat uint32
	// Optional flags.
	Flags uint32
	// CPU to run Program on. Optional field.
	// Note not all program types support this field.
	CPU uint32
	// BatchSize (default 64) affects the kernel's packet buffer allocation behaviour when running
	// programs with BPF_F_TEST_XDP_LIVE_FRAMES and a non-zero [RunOptions.Repeat] value.
	// For more details, see the kernel documentation on BPF_PROG_RUN:
	// https://docs.kernel.org/bpf/bpf_prog_run.html#running-xdp-programs-in-live-frame-mode
	BatchSize uint32
	// Called whenever the syscall is interrupted, and should be set to testing.B.ResetTimer
	// or similar. Typically used during benchmarking. Optional field.
	//
	// Deprecated: use [testing.B.ReportMetric] with unit "ns/op" instead.
	Reset func()
}
```

--------------------------------

### Instructions Methods

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Methods for managing collections of BPF instructions.

```APIDOC
## func AppendInstructions(insns Instructions, r io.Reader, bo binary.ByteOrder, platform string) (Instructions, error)

### Description
Decodes instructions from a reader and appends them to an existing slice.

## func (Instructions) AssociateMap(symbol string, m FDer) error

### Description
Updates instructions referencing a specific symbol to point to a provided map.
```

--------------------------------

### Get map flags

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the configuration flags associated with the map.

```go
func (m *Map) Flags() uint32
```

--------------------------------

### Convert version to string

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal

Returns the string representation of the version.

```go
func (v Version) String() string
```

--------------------------------

### Get function name

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns the name of the function the instructions belong to.

```go
func (insns Instructions) Name() string
```

--------------------------------

### Get Instruction Symbol

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Retrieves the symbol name associated with an instruction.

```go
func (ins Instruction) Symbol() string
```

--------------------------------

### Create a Version from a string

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal

Parses a version string in the format Major.Minor.Patch, where Patch is optional.

```go
func NewVersion(ver string) (Version, error)
```

--------------------------------

### Instructions.Size

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns the size in bytes of the instructions in binary form.

```APIDOC
## func (Instructions) Size

### Description
Size returns the amount of bytes insns would occupy in binary form.

### Signature
`func (insns Instructions) Size() uint64`
```

--------------------------------

### Get Var type name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Retrieves the type name of the variable.

```go
func (v *Var) TypeName() string
```

--------------------------------

### Define BPF syscall wrapper

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/efw

Initializes the BPF syscall wrapper that maintains ABI compatibility with Linux.

```go
var BPF = newProc("bpf")
```

--------------------------------

### Get Union type name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Retrieves the type name of the union.

```go
func (u *Union) TypeName() string
```

--------------------------------

### Instructions.Marshal

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Encodes a BPF program into the kernel format.

```APIDOC
## func (Instructions) Marshal

### Description
Marshal encodes a BPF program into the kernel format. insns may be modified if there are unresolved jumps or bpf2bpf calls.

### Signature
`func (insns Instructions) Marshal(w io.Writer, bo binary.ByteOrder) error`
```

--------------------------------

### Get Line String Representation

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the string representation of the line.

```go
func (li *Line) String() string
```

--------------------------------

### Get Integer Type Name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the name of the integer type.

```go
func (i *Int) TypeName() string
```

--------------------------------

### Get Function Metadata

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Extracts function metadata from a BPF instruction.

```go
func FuncMetadata(ins *asm.Instruction) *Func
```

--------------------------------

### String representation

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns the string representation of the instructions.

```go
func (insns Instructions) String() string
```

--------------------------------

### Get map value size

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the size of the map value in bytes.

```go
func (m *Map) ValueSize() uint32
```

--------------------------------

### NetkitOptions Structure

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Configuration options for attaching programs to Netkit interfaces.

```go
type NetkitOptions struct {
	// Index of the interface to attach to.
	Interface int
	// Program to attach.
	Program *ebpf.Program
	// One of the AttachNetkit* constants.
	Attach ebpf.AttachType
	// Attach relative to an anchor. Optional.
	Anchor Anchor
	// Only attach if the expected revision matches.
	ExpectedRevision uint64
	// Flags control the attach behaviour. Specify an Anchor instead of
	// F_LINK, F_ID, F_BEFORE, F_AFTER and R_REPLACE. Optional.
	Flags uint32
}
```

--------------------------------

### Define Token creation attributes

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sys

Configuration structure for creating a new BPF token.

```go
type TokenCreateAttr struct {
	Flags   uint32
	BpffsFd uint32
	// contains filtered or unexported fields
}
```

--------------------------------

### TracepointOptions Structure

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Configuration options for loading tracepoints.

```go
type TracepointOptions struct {
	// Arbitrary value that can be fetched from an eBPF program
	// via `bpf_get_attach_cookie()`.
	//
	// Needs kernel 5.15+.
	Cookie uint64
}
```

--------------------------------

### Get Volatile type name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Retrieves the type name of the volatile qualifier.

```go
func (v *Volatile) TypeName() string
```

--------------------------------

### HandleInfo Structure

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Describes a Handle.

```go
type HandleInfo struct {
	// ID of this handle in the kernel. The ID is only valid as long as the
	// associated handle is kept alive.
	ID ID

	// Name is an identifying name for the BTF, currently only used by the
	// kernel.
	Name string

	// IsKernel is true if the BTF originated with the kernel and not
	// userspace.
	IsKernel bool
	// contains filtered or unexported fields
}
```

--------------------------------

### Get Void type name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Retrieves the type name of the void type.

```go
func (v *Void) TypeName() string
```

--------------------------------

### Run function

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/testutils/testmain

Executes the provided testingM with debug aids enabled. This function calls os.Exit and does not return.

```go
func Run(m testingM)
```

--------------------------------

### Get VarLinkage string representation

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Converts the linkage type to its string representation.

```go
func (i VarLinkage) String() string
```

--------------------------------

### System Information

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/unix

Retrieves system information.

```go
func Uname(buf *Utsname) (err error)
```

--------------------------------

### Get Underlying Type

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Skips qualifiers and Typedefs to return the base type.

```go
func UnderlyingType(typ Type) Type
```

--------------------------------

### ProgramOptions

Source: https://pkg.go.dev/github.com/cilium/ebpf

Configuration struct for loading an eBPF program into the kernel.

```APIDOC
## type ProgramOptions

### Description
Controls loading a program into the kernel.

### Fields
- **LogLevel** (LogLevel) - Bitmap controlling the detail emitted by the kernel's eBPF verifier log.
- **LogSizeStart** (uint32) - Starting size of the verifier log buffer.
- **LogDisabled** (bool) - Disables the verifier log completely.
- **KernelTypes** (*btf.Spec) - Type information used for CO-RE relocations.
- **ExtraRelocationTargets** ([]*btf.Spec) - Additional targets to consider for CO-RE relocations.
```

--------------------------------

### Marshal instructions to binary

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Encodes the BPF program into kernel format. May modify instructions to resolve jumps or calls.

```go
func (insns Instructions) Marshal(w io.Writer, bo binary.ByteOrder) error
```

--------------------------------

### Get KernelMarshalOptions

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Generates BTF marshal options suitable for the current kernel.

```go
func KernelMarshalOptions() *MarshalOptions
```

--------------------------------

### Define XDPOptions

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Configuration parameters for attaching an XDP program to a network interface.

```go
type XDPOptions struct {
	// Program must be an XDP BPF program.
	Program *ebpf.Program

	// Interface is the interface index to attach program to.
	Interface int

	// Flags is one of XDPAttachFlags (optional).
	//
	// Only one XDP mode should be set, without flag defaults
	// to driver/generic mode (best effort).
	Flags XDPAttachFlags
}
```

--------------------------------

### Get Line File Name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the file name associated with the line.

```go
func (li *Line) FileName() string
```

--------------------------------

### NewHandle

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Loads the contents of a Builder into the kernel as a BTF handle.

```APIDOC
## func NewHandle

### Description
Loads the contents of a Builder into the kernel. Returns an error wrapping ErrNotSupported if the kernel doesn't support BTF.

### Signature
func NewHandle(b *Builder) (*Handle, error)
```

--------------------------------

### Get BTF Handle File Descriptor

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Returns the file descriptor for the handle.

```go
func (h *Handle) FD() int
```

--------------------------------

### Get Buffer pointer

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sysenc

Returns the memory location for syscall write operations.

```go
func (b Buffer) Pointer() sys.Pointer
```

--------------------------------

### Instructions.FunctionReferences

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns a set of symbol names that the instructions make bpf-to-bpf calls to.

```APIDOC
## func (Instructions) FunctionReferences()

### Description
Returns a set of symbol names these Instructions make bpf-to-bpf calls to.

### Signature
`func (insns Instructions) FunctionReferences() []string`
```

--------------------------------

### Get Next Program ID

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the ID of the next eBPF program in the system.

```go
func ProgramGetNextID(startID ProgramID) (ProgramID, error)
```

--------------------------------

### System Calls

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/unix

Executes a raw system call.

```go
func Syscall(trap, a1, a2, a3 uintptr) (r1, r2 uintptr, err syscall.Errno)
```

--------------------------------

### func (*ProgramInfo) Instructions

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the 'xlated' instruction stream of the program after it has been verified and rewritten by the kernel.

```APIDOC
### func (*ProgramInfo) Instructions()

Returns the 'xlated' instruction stream of the program. Available from 4.13. Requires CAP_BPF or equivalent for plain instructions, and CAP_SYS_ADMIN for instructions with metadata.
```

--------------------------------

### Load a pinned link

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Loads a link from the BPF virtual filesystem. Requires Linux 5.7 or later.

```go
func LoadPinnedLink(fileName string, opts *ebpf.LoadPinOptions) (Link, error)
```

--------------------------------

### Get Program File Descriptor

Source: https://pkg.go.dev/github.com/cilium/ebpf

Retrieves the file descriptor. Invalid to call after Close.

```go
func (p *Program) FD() int
```

--------------------------------

### Get maximum map entries

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the maximum number of elements the map can hold.

```go
func (m *Map) MaxEntries() uint32
```

--------------------------------

### Instruction Methods

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Methods for interacting with individual BPF instructions, including metadata, symbols, and references.

```APIDOC
## func (ins Instruction) Symbol() string

### Description
Returns the symbol name associated with the instruction, or an empty string if none is set.

## func (*Instruction) Unmarshal(r io.Reader, bo binary.ByteOrder, platform string) error

### Description
Decodes a BPF instruction from the provided reader.

## func (*Instruction) Width() RawInstructionOffset

### Description
Returns the number of raw BPF instructions the instruction occupies.

## func (Instruction) WithMetadata(meta Metadata) Instruction

### Description
Sets metadata on the instruction.

## func (Instruction) WithReference(ref string) Instruction

### Description
Links the instruction to another symbol or map by name.

## func (Instruction) WithSource(src fmt.Stringer) Instruction

### Description
Attaches source information to the instruction.

## func (Instruction) WithSymbol(name string) Instruction

### Description
Marks the instruction as a symbol.
```

--------------------------------

### Create temporary BPF filesystem

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/testutils

Creates a temporary directory on a BPF FS that is automatically cleaned up after the test.

```go
func TempBPFFS(tb testing.TB) string
```

--------------------------------

### Check instruction tag

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Verifies if the provided tag matches the kernel tag of the instructions.

```go
func (insns Instructions) HasTag(tag string, bo binary.ByteOrder) (bool, error)
```

--------------------------------

### Get Instruction Width

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns the number of raw BPF instructions occupied by the instruction.

```go
func (ins *Instruction) Width() RawInstructionOffset
```

--------------------------------

### Get Float Type Name

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Retrieves the type name string for a Float type.

```go
func (f *Float) TypeName() string
```

--------------------------------

### Get total buffer size

Source: https://pkg.go.dev/github.com/cilium/ebpf/ringbuf

Returns the total size of the ring buffer in bytes.

```go
func (r *Reader) BufferSize() int
```

--------------------------------

### Run subtest with delegated BPF permissions

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/testutils

Executes a subtest as an unprivileged, user-namespaced subprocess with specific BPF permissions. Requires Linux 6.9 or later.

```go
func RunWithToken(t *testing.T, name string, delegated Delegated, fn func(t *testing.T))
```

```go
testutils.RunWithToken(t, "foo", testutils.Delegated{
	Cmds: []sys.Cmd{sys.BPF_MAP_CREATE},
	Maps: []sys.MapType{sys.BPF_MAP_TYPE_HASH},
}, func(t *testing.T) {
	_, err := newMap(t, hashMapSpec, nil)
	qt.Assert(t, qt.IsNil(err))
})
```

--------------------------------

### Get map metadata

Source: https://pkg.go.dev/github.com/cilium/ebpf

Retrieves metadata about the map. Requires kernel support for BPF_OBJ_GET_INFO_BY_FD or /proc/self/fdinfo.

```go
func (m *Map) Info() (*MapInfo, error)
```

--------------------------------

### Get map file descriptor

Source: https://pkg.go.dev/github.com/cilium/ebpf

Retrieves the file descriptor for the map. Invalid after the map is closed.

```go
func (m *Map) FD() int
```

--------------------------------

### Walk directory for BPF objects

Source: https://pkg.go.dev/github.com/cilium/ebpf/pin

Walks the file tree at the specified root and yields a Pin for each BPF object found. Callers must invoke Pin.Take to retain ownership of the object.

```go
func WalkDir(root string, opts *ebpf.LoadPinOptions) iter.Seq2[*Pin, error]
```

--------------------------------

### Get link by ID

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Retrieves a link associated with a specific ID, returning an error if it does not exist.

```go
func NewFromID(id ID) (Link, error)
```

--------------------------------

### Executable Management

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Structures and methods for interacting with filesystem executables and resolving symbols.

```go
type Executable struct {
	// contains filtered or unexported fields
}
```

```go
func OpenExecutable(path string) (*Executable, error)
```

```go
OpenExecutable("/bin/bash")
```

```go
func (ex *Executable) Symbol(address uint64) (SymbolOffset, error)
```

--------------------------------

### Define Handle and Handle Operations

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Manages references to BTF loaded into the kernel.

```go
type Handle struct {
	// contains filtered or unexported fields
}
```

```go
func FindHandle(predicate func(info *HandleInfo) bool) (*Handle, error)
```

```go
func NewHandle(b *Builder) (*Handle, error)
```

```go
func NewHandleFromID(id ID) (*Handle, error)
```

```go
func NewHandleFromRawBTF(btf []byte) (*Handle, error)
```

--------------------------------

### Get target suffix

Source: https://pkg.go.dev/github.com/cilium/ebpf/cmd/bpf2go/gen

Returns a string suffix used to identify the target in file names.

```go
func (tgt *Target) Suffix() string
```

--------------------------------

### MapOptions structure

Source: https://pkg.go.dev/github.com/cilium/ebpf

Configuration for loading a map into the kernel.

```go
type MapOptions struct {
	// The base path to pin maps in if requested via PinByName.
	// Existing maps will be re-used if they are compatible, otherwise an
	// error is returned.
	PinPath        string
	LoadPinOptions LoadPinOptions
}
```

--------------------------------

### eBPF Type Conversion

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/efw

Utilities for converting between Windows GUIDs and eBPF attach/program type constants.

```go
func EbpfGetBpfAttachType(attachType windows.GUID) (uint32, error)
```

```go
func EbpfGetBpfProgramType(programType windows.GUID) (uint32, error)
```

```go
func EbpfGetEbpfAttachType(attachType uint32) (windows.GUID, error)
```

--------------------------------

### Metadata Management

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Methods for managing metadata associated with instructions.

```go
type Metadata struct {
	// contains filtered or unexported fields
}
```

```go
func (*Metadata) Get(key any) any
```

```go
func (*Metadata) Set(key, value any)
```

--------------------------------

### Prepare Buffer for syscall output

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sysenc

Prepares a buffer for receiving data from a system call.

```go
func SyscallOutput(dst any, size int) Buffer
```

--------------------------------

### Get obsolete target suffix

Source: https://pkg.go.dev/github.com/cilium/ebpf/cmd/bpf2go/gen

Returns an obsolete suffix for specific targets; should not be used in new code.

```go
func (tgt *Target) ObsoleteSuffix() string
```

--------------------------------

### Get GoArches constraint

Source: https://pkg.go.dev/github.com/cilium/ebpf/cmd/bpf2go/gen

Returns a build constraint expression satisfied when the current GOARCH is within the set.

```go
func (arches GoArches) Constraint() constraint.Expr
```

--------------------------------

### NativeFile Function

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/testutils

Substitutes %s in a path with an abbreviation of the host endianness.

```go
func NativeFile(tb testing.TB, path string) string
```

--------------------------------

### Initialize a new BPF ringbuf reader

Source: https://pkg.go.dev/github.com/cilium/ebpf/ringbuf

Creates a reader instance for a specific BPF map.

```go
func NewReader(ringbufMap *ebpf.Map) (*Reader, error)
```

--------------------------------

### Get Platform Syscall Prefix

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/linux

Returns the platform-dependent syscall wrapper prefix used by the Linux kernel.

```go
func PlatformPrefix() string
```

--------------------------------

### String Representation

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns a string representation of the program.

```go
func (p *Program) String() string
```

--------------------------------

### func EnableStats

Source: https://pkg.go.dev/github.com/cilium/ebpf

Starts collecting runtime statistics of eBPF programs. Closing the returned io.Closer stops the collection.

```APIDOC
## func EnableStats(which uint32) (io.Closer, error)

### Description
EnableStats starts collecting runtime statistics of eBPF programs, like the amount of program executions and the cumulative runtime. Specify a BPF_STATS_* constant to select which statistics to collect. Closing the returned io.Closer will stop collecting statistics.

### Parameters
- **which** (uint32) - Required - BPF_STATS_* constant to select statistics type.

### Returns
- **io.Closer** - A closer to stop statistics collection.
- **error** - Returns an error if collection fails or is not supported.
```

--------------------------------

### func (*VariableSpec) Get

Source: https://pkg.go.dev/github.com/cilium/ebpf

Writes the value of the VariableSpec to the provided output using the host's native endianness.

```APIDOC
## func (*VariableSpec) Get(out any) error

### Description
Writes the value of the VariableSpec to the provided output using the host's native endianness. Returns an error if the variable is not initialized or if the unmarshaling fails.

### Parameters
- **out** (any) - Required - A pointer to a value to store the variable data.
```

--------------------------------

### Get platform-specific ProgramType

Source: https://pkg.go.dev/github.com/cilium/ebpf

Retrieves a program type for a specific platform, useful when constants are not yet provided by the library.

```go
func ProgramTypeForPlatform(plat string, value uint32) (ProgramType, error)
```

--------------------------------

### Configure program loading options

Source: https://pkg.go.dev/github.com/cilium/ebpf

Defines options for loading an eBPF program, including verifier log settings and CO-RE relocation targets.

```go
type ProgramOptions struct {
	// Bitmap controlling the detail emitted by the kernel's eBPF verifier log.
	// LogLevel-type values can be ORed together to request specific kinds of
	// verifier output. See the documentation on [ebpf.LogLevel] for details.
	//
	//  opts.LogLevel = (ebpf.LogLevelBranch | ebpf.LogLevelStats)
	//
	// If left to its default value, the program will first be loaded without
	// verifier output enabled. Upon error, the program load will be repeated
	// with LogLevelBranch and the given (or default) LogSize value.
	//
	// Unless LogDisabled is set, setting this to a non-zero value will enable the verifier
	// log, populating the [ebpf.Program.VerifierLog] field on successful loads
	// and including detailed verifier errors if the program is rejected. This
	// will always allocate an output buffer, but will result in only a single
	// attempt at loading the program.
	LogLevel LogLevel

	// Starting size of the verifier log buffer. If the verifier log is larger
	// than this size, the buffer will be grown to fit the entire log. Leave at
	// its default value unless troubleshooting.
	LogSizeStart uint32

	// Disables the verifier log completely, regardless of other options.
	LogDisabled bool

	// Type information used for CO-RE relocations.
	//
	// This is useful in environments where the kernel BTF is not available
	// (containers) or where it is in a non-standard location. Defaults to
	// use the kernel BTF from a well-known location if nil.
	KernelTypes *btf.Spec

	// Additional targets to consider for CO-RE relocations. This can be used to
	// pass BTF information for kernel modules when it's not present on
	// KernelTypes.
	ExtraRelocationTargets []*btf.Spec
}
```

--------------------------------

### Load BTF Line Info

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Parses BTF line info in kernel wire format.

```go
func LoadLineInfos(reader io.Reader, bo binary.ByteOrder, recordNum uint32, spec *Spec) (LineOffsets, error)
```

--------------------------------

### Cmd Stringer Method

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sys

Returns the string representation of a BPF command.

```go
func (i Cmd) String() string
```

--------------------------------

### Get map BTF handle

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns a reference to the map's type information. Requires kernel BTF support.

```go
func (m *Map) Handle() (*btf.Handle, error)
```

--------------------------------

### ALUOp Instruction Generation Methods

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Methods for generating BPF instructions from ALU operations.

```go
func (op ALUOp) Imm(dst Register, value int32) Instruction
```

```go
func (op ALUOp) Imm32(dst Register, value int32) Instruction
```

```go
func (op ALUOp) Op(source Source) OpCode
```

```go
func (op ALUOp) Op32(source Source) OpCode
```

```go
func (op ALUOp) Reg(dst, src Register) Instruction
```

```go
func (op ALUOp) Reg32(dst, src Register) Instruction
```

```go
func (i ALUOp) String() string
```

--------------------------------

### RawAttachProgramOptions and RawDetachProgramOptions

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Configuration options for low-level program attachment and detachment.

```go
type RawAttachProgramOptions struct {
	// Target to query. This is usually a file descriptor but may refer to
	// something else based on the attach type.
	Target int
	// Program to attach.
	Program *ebpf.Program
	// Attach must match the attach type of Program.
	Attach ebpf.AttachType
	// Attach relative to an anchor. Optional.
	Anchor Anchor
	// Flags control the attach behaviour. Specify an Anchor instead of
	// F_LINK, F_ID, F_BEFORE, F_AFTER and F_REPLACE. Optional.
	Flags uint32
	// Only attach if the internal revision matches the given value.
	ExpectedRevision uint64
}
```

```go
type RawDetachProgramOptions RawAttachProgramOptions
```

--------------------------------

### Get the kernel version value

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal

Implements the KERNEL_VERSION macro from linux/version.h, returning the version and patch level as a single uint32.

```go
func (v Version) Kernel() uint32
```

--------------------------------

### Pin Program

Source: https://pkg.go.dev/github.com/cilium/ebpf

Persists the program on the BPF virtual file system. Requires bpffs to be mounted.

```go
func (p *Program) Pin(fileName string) error
```

--------------------------------

### Get FeatureMatrix Result

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal

Retrieves the outcome of a feature test. This function is safe for concurrent use and always returns ErrNotSupportedOnOS on Windows.

```go
func (fm FeatureMatrix[K]) Result(key K) error
```

--------------------------------

### Get Go type name

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal

Returns the type name as a string, similar to %T but without the package name. Pointers are automatically peeled off.

```go
func GoTypeName(t any) string
```

--------------------------------

### NewCollectionWithOptions

Source: https://pkg.go.dev/github.com/cilium/ebpf

Creates a Collection from the given spec using options, creating and loading its declared resources into the kernel.

```APIDOC
## func NewCollectionWithOptions(spec *CollectionSpec, opts CollectionOptions) (*Collection, error)

### Description
Creates a Collection from the given spec using options, creating and loading its declared resources into the kernel. Omitting Collection.Close() during application shutdown is an error.

### Parameters
- **spec** (*CollectionSpec) - Required - The specification describing the collection.
- **opts** (CollectionOptions) - Required - Configuration options for loading the collection.
```

--------------------------------

### func (*Variable) Get

Source: https://pkg.go.dev/github.com/cilium/ebpf

Writes the value of the Variable to the provided output. The output must be a pointer to a value whose size matches the Variable.

```APIDOC
## func (*Variable) Get(out any) error

### Description
Writes the value of the Variable to the provided output. The output must be a pointer to a value whose size matches the Variable.

### Parameters
- **out** (any) - Required - A pointer to a value to store the variable data.
```

--------------------------------

### Retrieve program load time

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the time the program was loaded since boot. The boolean indicates if the optional field is available.

```go
func (pi *ProgramInfo) LoadTime() (time.Duration, bool)
```

--------------------------------

### Define StackBuildIdStatus and Constants

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sys

Status of stack build IDs.

```go
type StackBuildIdStatus uint32
```

```go
const (
	BPF_STACK_BUILD_ID_EMPTY StackBuildIdStatus = 0
	BPF_STACK_BUILD_ID_VALID StackBuildIdStatus = 1
	BPF_STACK_BUILD_ID_IP    StackBuildIdStatus = 2
)
```

--------------------------------

### Format Struct Output

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Supports width options for %v to limit member name output. For example, %1v prints only the first member name.

```go
func (s *Struct) Format(fs fmt.State, verb rune)
```

```text
Struct:"struct"[fields=3 fieldNames=[a ...]]
```

--------------------------------

### System and BPF Constants

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/unix

Various system-level and BPF-specific constants used for configuration and interaction with the Linux kernel.

```go
const (
	BPF_F_NO_PREALLOC          = linux.BPF_F_NO_PREALLOC
	BPF_F_NUMA_NODE            = linux.BPF_F_NUMA_NODE
	BPF_F_RDONLY               = linux.BPF_F_RDONLY
	BPF_F_WRONLY               = linux.BPF_F_WRONLY
	BPF_F_RDONLY_PROG          = linux.BPF_F_RDONLY_PROG
	BPF_F_WRONLY_PROG          = linux.BPF_F_WRONLY_PROG
	BPF_F_SLEEPABLE            = linux.BPF_F_SLEEPABLE
	BPF_F_XDP_HAS_FRAGS        = linux.BPF_F_XDP_HAS_FRAGS
	BPF_F_MMAPABLE             = linux.BPF_F_MMAPABLE
	BPF_F_INNER_MAP            = linux.BPF_F_INNER_MAP
	BPF_F_KPROBE_MULTI_RETURN  = linux.BPF_F_KPROBE_MULTI_RETURN
	BPF_F_UPROBE_MULTI_RETURN  = linux.BPF_F_UPROBE_MULTI_RETURN
	BPF_F_LOCK                 = linux.BPF_F_LOCK
	BPF_OBJ_NAME_LEN           = linux.BPF_OBJ_NAME_LEN
	BPF_TAG_SIZE               = linux.BPF_TAG_SIZE
	BPF_RINGBUF_BUSY_BIT       = linux.BPF_RINGBUF_BUSY_BIT
	BPF_RINGBUF_DISCARD_BIT    = linux.BPF_RINGBUF_DISCARD_BIT
	BPF_RINGBUF_HDR_SZ         = linux.BPF_RINGBUF_HDR_SZ
	SYS_BPF                    = linux.SYS_BPF
	F_DUPFD_CLOEXEC            = linux.F_DUPFD_CLOEXEC
	EPOLL_CTL_ADD              = linux.EPOLL_CTL_ADD
	EPOLL_CLOEXEC              = linux.EPOLL_CLOEXEC
	O_RDONLY                   = linux.O_RDONLY
	O_DIRECTORY                = linux.O_DIRECTORY
	O_CLOEXEC                  = linux.O_CLOEXEC
	O_NONBLOCK                 = linux.O_NONBLOCK
	PROT_NONE                  = linux.PROT_NONE
	PROT_READ                  = linux.PROT_READ
	PROT_WRITE                 = linux.PROT_WRITE
	MAP_ANON                   = linux.MAP_ANON
	MAP_SHARED                 = linux.MAP_SHARED
	MAP_FIXED                  = linux.MAP_FIXED
	MAP_PRIVATE                = linux.MAP_PRIVATE
	PERF_ATTR_SIZE_VER1        = linux.PERF_ATTR_SIZE_VER1
	PERF_TYPE_SOFTWARE         = linux.PERF_TYPE_SOFTWARE
	PERF_TYPE_TRACEPOINT       = linux.PERF_TYPE_TRACEPOINT
	PERF_COUNT_SW_BPF_OUTPUT   = linux.PERF_COUNT_SW_BPF_OUTPUT
	PERF_EVENT_IOC_DISABLE     = linux.PERF_EVENT_IOC_DISABLE
	PERF_EVENT_IOC_ENABLE      = linux.PERF_EVENT_IOC_ENABLE
	PERF_EVENT_IOC_SET_BPF     = linux.PERF_EVENT_IOC_SET_BPF
	PerfBitWatermark           = linux.PerfBitWatermark
	PerfBitWriteBackward       = linux.PerfBitWriteBackward
	PERF_SAMPLE_RAW            = linux.PERF_SAMPLE_RAW
	PERF_FLAG_FD_CLOEXEC       = linux.PERF_FLAG_FD_CLOEXEC
	RLIM_INFINITY              = linux.RLIM_INFINITY
	RLIMIT_MEMLOCK             = linux.RLIMIT_MEMLOCK
	BPF_STATS_RUN_TIME         = linux.BPF_STATS_RUN_TIME
	PERF_RECORD_LOST           = linux.PERF_RECORD_LOST
	PERF_RECORD_SAMPLE         = linux.PERF_RECORD_SAMPLE
	AT_FDCWD                   = linux.AT_FDCWD
	RENAME_NOREPLACE           = linux.RENAME_NOREPLACE
	SO_ATTACH_BPF              = linux.SO_ATTACH_BPF
	SO_DETACH_BPF              = linux.SO_DETACH_BPF
	SOL_SOCKET                 = linux.SOL_SOCKET
	SIGPROF                    = linux.SIGPROF
	SIGUSR1                    = linux.SIGUSR1
	SIG_BLOCK                  = linux.SIG_BLOCK
	SIG_UNBLOCK                = linux.SIG_UNBLOCK
	BPF_FS_MAGIC               = linux.BPF_FS_MAGIC
	TRACEFS_MAGIC              = linux.TRACEFS_MAGIC
	DEBUGFS_MAGIC              = linux.DEBUGFS_MAGIC
	BPF_RB_NO_WAKEUP           = linux.BPF_RB_NO_WAKEUP
	BPF_RB_FORCE_WAKEUP        = linux.BPF_RB_FORCE_WAKEUP
	AF_UNSPEC                  = linux.AF_UNSPEC
	IFF_UP                     = linux.IFF_UP
	LINUX_CAPABILITY_VERSION_3 = linux.LINUX_CAPABILITY_VERSION_3
	CLONE_NEWNET               = linux.CLONE_NEWNET
	CLONE_NEWUSER              = linux.CLONE_NEWUSER
	CLONE_NEWNS                = linux.CLONE_NEWNS
	MOVE_MOUNT_F_EMPTY_PATH    = linux.MOVE_MOUNT_F_EMPTY_PATH
	AF_UNIX                    = linux.AF_UNIX
	SOCK_STREAM                = linux.SOCK_STREAM
	SOCK_CLOEXEC               = linux.SOCK_CLOEXEC
	FSOPEN_CLOEXEC             = linux.FSOPEN_CLOEXEC
	FSMOUNT_CLOEXEC            = linux.FSMOUNT_CLOEXEC
	MSG_CMSG_CLOEXEC           = linux.MSG_CMSG_CLOEXEC
	SizeofInt                  = linux.SizeofInt
)
```

--------------------------------

### Clone Program

Source: https://pkg.go.dev/github.com/cilium/ebpf

Creates a duplicate of the program. Closing the clone does not affect the original.

```go
func (p *Program) Clone() (*Program, error)
```

--------------------------------

### Pointer management

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sys

Helper type and functions for handling 64-bit pointers.

```go
type Pointer struct {
	structs.HostLayout
	// contains filtered or unexported fields
}
```

```go
func UnsafePointer(ptr unsafe.Pointer) Pointer
```

```go
func UnsafeSlicePointer[T comparable](buf []T) Pointer
```

--------------------------------

### Probe for ISA Support

Source: https://pkg.go.dev/github.com/cilium/ebpf/features

Functions to verify if the kernel supports specific BPF ISA versions.

```go
func HaveV2ISA() error
```

```go
func HaveV3ISA() error
```

```go
func HaveV4ISA() error
```

--------------------------------

### RawLinkOptions Structure

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Configuration options for creating a raw link.

```go
type RawLinkOptions struct {
	// File descriptor to attach to. This differs for each attach type.
	Target int
	// Program to attach.
	Program *ebpf.Program
	// Attach must match the attach type of Program.
	Attach ebpf.AttachType
	// BTF is the BTF of the attachment target.
	BTF btf.TypeID
	// Flags control the attach behaviour.
	Flags uint32
}
```

--------------------------------

### Set BTF Handle

Source: https://pkg.go.dev/github.com/cilium/ebpf

Caches program type information. Requires CAP_SYS_ADMIN.

```go
func (p *Program) SetHandle(h *btf.Handle) error
```

--------------------------------

### Define MarshalOptions

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Configuration options for marshaling BTF data, including compatibility settings for older kernels.

```go
type MarshalOptions struct {
	// Target byte order. Defaults to the system's native endianness.
	Order binary.ByteOrder
	// Remove function linkage information for compatibility with <5.6 kernels.
	StripFuncLinkage bool
	// Replace decl tags with a placeholder for compatibility with <5.16 kernels.
	ReplaceDeclTags bool
	// Replace TypeTags with a placeholder for compatibility with <5.17 kernels.
	ReplaceTypeTags bool
	// Replace Enum64 with a placeholder for compatibility with <6.0 kernels.
	ReplaceEnum64 bool
	// Prevent the "No type found" error when loading BTF without any types.
	PreventNoTypeFound bool
}
```

--------------------------------

### Instructions.ReferenceOffsets

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Returns the set of references and their offsets in the instructions.

```APIDOC
## func (Instructions) ReferenceOffsets

### Description
ReferenceOffsets returns the set of references and their offset in the instructions.

### Signature
`func (insns Instructions) ReferenceOffsets() map[string][]int`
```

--------------------------------

### Program attachment and binding attributes

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/sys

Structures for attaching programs and binding maps.

```go
type ProgAttachAttr struct {
	TargetFdOrIfindex uint32
	AttachBpfFd       uint32
	AttachType        uint32
	AttachFlags       uint32
	ReplaceBpfFd      uint32
	RelativeFdOrId    uint32
	ExpectedRevision  uint64
	// contains filtered or unexported fields
}
```

```go
type ProgBindMapAttr struct {
	ProgFd uint32
	MapFd  uint32
	Flags  uint32
	// contains filtered or unexported fields
}
```

--------------------------------

### Raw Program Attachment Functions

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Low-level wrappers for BPF_PROG_ATTACH and BPF_PROG_DETACH operations.

```go
func RawAttachProgram(opts RawAttachProgramOptions) error
```

```go
func RawDetachProgram(opts RawDetachProgramOptions) error
```

--------------------------------

### Associate Map with Instructions

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Updates references to point to a specific map.

```go
func (insns Instructions) AssociateMap(symbol string, m FDer) error
```

--------------------------------

### Append Instructions

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Decodes and appends instructions from a reader.

```go
func AppendInstructions(insns Instructions, r io.Reader, bo binary.ByteOrder, platform string) (Instructions, error)
```

--------------------------------

### Instructions.HasTag

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Checks if the given tag matches the kernel tag of the instructions.

```APIDOC
## func (Instructions) HasTag

### Description
HasTag returns true if the given tag matches the kernel tag of insns.

### Signature
`func (insns Instructions) HasTag(tag string, bo binary.ByteOrder) (bool, error)`
```

--------------------------------

### Benchmark eBPF Program

Source: https://pkg.go.dev/github.com/cilium/ebpf

Runs the program multiple times to measure performance. Requires Linux 4.12 or later.

```go
func (p *Program) Benchmark(in []byte, repeat int, reset func()) (uint32, time.Duration, error)
```

--------------------------------

### Cgroup and Event Configuration

Source: https://pkg.go.dev/github.com/cilium/ebpf/link

Structures for defining cgroup attachment options and event information.

```go
type CgroupInfo struct {
	CgroupId   uint64
	AttachType sys.AttachType
	// contains filtered or unexported fields
}
```

```go
type CgroupOptions struct {
	// Path to a cgroupv2 folder.
	Path string
	// One of the AttachCgroup* constants
	Attach ebpf.AttachType
	// Program must be of type CGroup*, and the attach type must match Attach.
	Program *ebpf.Program
}
```

```go
type EventInfo struct {
	Config uint64
	Type   uint32
	Cookie uint64
}
```

--------------------------------

### Retrieve JITed Instructions

Source: https://pkg.go.dev/github.com/cilium/ebpf

Returns the machine native instructions of the JITed program.

```go
func (pi *ProgramInfo) JitedInsns() ([]byte, bool)
```

--------------------------------

### Retrieve Filesystem Type

Source: https://pkg.go.dev/github.com/cilium/ebpf/internal/linux

Returns the filesystem type for a given path.

```go
func FSType(path string) (int64, error)
```

--------------------------------

### Add bpf2go as a tool dependency

Source: https://pkg.go.dev/github.com/cilium/ebpf/cmd/bpf2go

Use this command to add bpf2go to your project's Go module dependencies.

```bash
go get -tool github.com/cilium/ebpf/cmd/bpf2go
```

--------------------------------

### Format Typedef

Source: https://pkg.go.dev/github.com/cilium/ebpf/btf

Formatting implementation for Typedef.

```go
func (td *Typedef) Format(fs fmt.State, verb rune)
```

--------------------------------

### Set Instruction Metadata

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Attaches metadata to an instruction.

```go
func (ins Instruction) WithMetadata(meta Metadata) Instruction
```

--------------------------------

### StoreImm

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Emits an instruction to store an immediate value to memory.

```go
func StoreImm(dst Register, offset int16, value int64, size Size) Instruction
```

--------------------------------

### Set Instruction Source

Source: https://pkg.go.dev/github.com/cilium/ebpf/asm

Adds source information to an instruction.

```go
func (ins Instruction) WithSource(src fmt.Stringer) Instruction
```
Tokens:
Raw