| PacketData (* XDP/TC packet data - use bpf_dynptr_from_xdp/skb *)

| MapValue (* Map lookup result - use bpf_dynptr_from_mem *)

| RingBuffer (* Ring buffer data - use bpf_dynptr_from_ringbuf *)

| LocalStack (* Local stack variables - use regular access *)

region_type: memory_region_type;

bounds_verified: bool;

size_hint: int option;

match ir_val.value_desc with

| IRVariable _ -> LocalStack (* Variables are typically stack-allocated *)

| IRMapRef _ -> RegularMemory (* Map references *)

| IRLiteral _ -> RegularMemory (* Literals *)

| IRTempVariable _ -> RegularMemory (* Temporary variables *)

match ir_val.val_type with

| IRPointer (IRStruct _, _) ->

(* Struct pointers that are variables could be from map lookups *)

(match ir_val.value_desc with

| IRVariable name ->

(* Heuristic: variables with certain names are likely map-derived *)

String.contains name '_' && (String.length name > 3)

| _ -> false)

match memory_info_map with

| Some info_map ->

(* Use provided memory region information *)

(match ir_val.value_desc with

| IRVariable var_name ->

(try

let info = Hashtbl.find info_map var_name in

info.region_type

with

| Not_found -> LocalStack) (* Default for unknown variables *)

| IRMapRef _ -> RegularMemory

| IRLiteral _ -> RegularMemory

| IRTempVariable _ -> RegularMemory

| _ -> RegularMemory)

| None ->

(* Fallback to heuristic detection *)

name: string;

start_val: Ir.ir_value;

end_val: Ir.ir_value;

counter_val: Ir.ir_value;

body_instructions: Ir.ir_instruction list;

(* Generated C code lines *)

mutable output_lines: string list;

(* Current indentation level *)

mutable indent_level: int;

(* Variable counter for generating unique names *)

mutable var_counter: int;

(* Label counter for control flow *)

mutable label_counter: int;

(* Include statements needed *)

mutable includes: string list;

(* Map definitions that need to be emitted *)

mutable map_definitions: ir_map_def list;

(* Next label ID for generating unique callback function names *)

mutable next_label_id: int;

(* Pending callbacks to be emitted *)

mutable pending_callbacks: string list;

(* Pre-collected callback dependencies for ordered emission *)

mutable callback_dependencies: callback_dependency list;

(* Current error variable for try/catch blocks *)

mutable current_error_var: string option;

(* Current catch label for try/catch blocks *)

mutable current_catch_label: string option;

(* Pinned global variables for transparent access *)

mutable pinned_globals: string list;

(* Flag to indicate if we're generating code for a return context *)

mutable in_return_context: bool;

(* Pending string literals to be emitted at scope boundaries *)

mutable pending_string_literals: (string * string * int) list; (* (var_name, content, size) *)

(* Flag to defer string literal emission *)

mutable defer_string_literals: bool;

(* Track which registers have been declared to avoid redeclaration *)

mutable declared_registers: (int, unit) Hashtbl.t;

(* Current function's context type for proper field access generation *)

mutable current_function_context_type: string option;

(* Track dynptr-backed pointers for proper field assignment *)

mutable dynptr_backed_pointers: (string, string) Hashtbl.t; (* pointer_var -> dynptr_var *)

output_lines = [];

indent_level = 0;

var_counter = 0;

label_counter = 0;

includes = [];

map_definitions = [];

next_label_id = 0;

pending_callbacks = [];

callback_dependencies = [];

current_error_var = None;

current_catch_label = None;

pinned_globals = [];

in_return_context = false;

pending_string_literals = [];

defer_string_literals = false;

declared_registers = Hashtbl.create 32;

current_function_context_type = None;

dynptr_backed_pointers = Hashtbl.create 32;

match ctx.current_function_context_type with

| Some "xdp" -> "XDP_PASS"

| Some "tc" -> "TC_ACT_OK"

match ir_type with

(* Basic integer types *)

| IRU8 | IRI8 | IRChar -> 1

| IRU16 | IRI16 -> 2

| IRU32 | IRI32 | IRF32 -> 4

| IRU64 | IRI64 | IRF64 -> 8

| IRBool -> 1

(* String and pointer types (valid in some field contexts) *)

| IRStr _ -> 1 (* Size of individual char *)

| IRPointer (_, _) -> 8 (* Pointer size *)

(* Array elements - recurse to get element size *)

| IRArray (elem_type, _, _) -> calculate_type_size elem_type

(* These types should never appear in field assignments due to type checking *)

| IRVoid ->

failwith "calculate_type_size: IRVoid should not appear in field assignments"

| IRStruct (struct_name, _) ->

failwith ("calculate_type_size: IRStruct should not appear in field assignments, got: " ^ struct_name)

| IREnum (enum_name, _) ->

failwith ("calculate_type_size: IREnum should not appear in field assignments, got: " ^ enum_name)

| IRResult (_, _) ->

failwith "calculate_type_size: IRResult should not appear in field assignments"

(* IRAction removed - xdp_action is now handled as regular enum *)

| IRTypeAlias (alias_name, _) ->

failwith ("calculate_type_size: IRTypeAlias should be resolved by type checker, got: " ^ alias_name)

| IRStructOps (ops_name, _) ->

failwith ("calculate_type_size: IRStructOps should not appear in field assignments, got: " ^ ops_name)

| IRFunctionPointer (_, _) ->

failwith "calculate_type_size: IRFunctionPointer should not appear in field assignments"

| IRRingbuf (_, _) ->

Kernelscript_context.Xdp_codegen.register ();

Kernelscript_context.Tc_codegen.register ();

Kernelscript_context.Kprobe_codegen.register ();

Kernelscript_context.Tracepoint_codegen.register ();

Kernelscript_context.Fprobe_codegen.register ();

List.iter (fun (var_name, content, size) ->

let len = String.length content in

let max_content_len = size in (* Full size available for content *)

let actual_len = min len max_content_len in

let truncated_s = if actual_len < len then String.sub content 0 actual_len else content in

emit_line ctx (sprintf "str_%d_t %s = {" size var_name);

emit_line ctx (sprintf " .data = \"%s\"," (String.escaped truncated_s));

emit_line ctx (sprintf " .len = %d" actual_len);

emit_line ctx "};";

) (List.rev ctx.pending_string_literals);

| Ir.IRU8 -> "__u8" | Ir.IRU16 -> "__u16" | Ir.IRU32 -> "__u32" | Ir.IRU64 -> "__u64"

| Ir.IRI8 -> "__s8" | Ir.IRI16 -> "__s16" | Ir.IRI32 -> "__s32" | Ir.IRI64 -> "__s64"

| Ir.IRBool -> "bool" | Ir.IRChar -> "char" | Ir.IRVoid -> "void"

| Ir.IRPointer (inner_type, _) -> sprintf "%s*" (kfunc_signature_type_to_c inner_type)

| IRHash -> "BPF_MAP_TYPE_HASH"

| IRMapArray -> "BPF_MAP_TYPE_ARRAY"

| IRPercpu_hash -> "BPF_MAP_TYPE_PERCPU_HASH"

| IRPercpu_array -> "BPF_MAP_TYPE_PERCPU_ARRAY"

| IRStr size -> [size]

| IRPointer (inner_type, _) -> collect_string_sizes_from_type inner_type

| IRArray (inner_type, _, _) -> collect_string_sizes_from_type inner_type

| IRResult (ok_type, err_type) ->

(collect_string_sizes_from_type ok_type) @ (collect_string_sizes_from_type err_type)

match ir_expr.expr_desc with

| IRValue ir_val -> collect_string_sizes_from_value ir_val

| IRBinOp (left, _, right) ->

(collect_string_sizes_from_value left) @ (collect_string_sizes_from_value right)

| IRUnOp (_, ir_val) -> collect_string_sizes_from_value ir_val

| IRCast (ir_val, target_type) ->

(collect_string_sizes_from_value ir_val) @ (collect_string_sizes_from_type target_type)

| IRFieldAccess (obj_val, _) -> collect_string_sizes_from_value obj_val

| IRStructLiteral (_, field_assignments) ->

List.fold_left (fun acc (_, field_val) ->

acc @ (collect_string_sizes_from_value field_val)

) [] field_assignments

| IRMatch (matched_val, arms) ->

(* Collect string sizes from matched expression and all arms *)

(collect_string_sizes_from_value matched_val) @

(List.fold_left (fun acc arm ->

acc @ (collect_string_sizes_from_value arm.ir_arm_value)

match ir_instr.instr_desc with

| IRAssign (dest_val, expr) ->

(collect_string_sizes_from_value dest_val) @ (collect_string_sizes_from_expr expr)

| IRConstAssign (dest_val, expr) ->

(collect_string_sizes_from_value dest_val) @ (collect_string_sizes_from_expr expr)

| IRVariableDecl (_dest_val, typ, init_expr_opt) ->

(* New unified variable declaration - collect from both variable type and initializer *)

let var_type_sizes = collect_string_sizes_from_type typ in

let init_sizes = match init_expr_opt with

| Some init_expr -> collect_string_sizes_from_expr init_expr

| None -> []

in

var_type_sizes @ init_sizes

| IRCall (_, args, ret_opt) ->

let args_sizes = concat_map collect_string_sizes_from_value args in

let ret_sizes = match ret_opt with Some ret_val -> collect_string_sizes_from_value ret_val | None -> [] in

args_sizes @ ret_sizes

| IRMapLoad (map_val, key_val, dest_val, _) ->

(collect_string_sizes_from_value map_val) @

(collect_string_sizes_from_value key_val) @

(collect_string_sizes_from_value dest_val)

| IRMapStore (map_val, key_val, value_val, _) ->

(collect_string_sizes_from_value map_val) @

(collect_string_sizes_from_value key_val) @

(collect_string_sizes_from_value value_val)

| IRMapDelete (map_val, key_val) ->

(collect_string_sizes_from_value map_val) @

(collect_string_sizes_from_value key_val)

| IRConfigFieldUpdate (map_val, key_val, _field, value_val) ->

(collect_string_sizes_from_value map_val) @

(collect_string_sizes_from_value key_val) @

(collect_string_sizes_from_value value_val)

| IRStructFieldAssignment (obj_val, _field, value_val) ->

(collect_string_sizes_from_value obj_val) @

(collect_string_sizes_from_value value_val)

| IRConfigAccess (_config_name, _field_name, result_val) ->

collect_string_sizes_from_value result_val

| IRContextAccess (dest_val, _context_type, _field_name) ->

collect_string_sizes_from_value dest_val

| IRBoundsCheck (ir_val, _, _) ->

collect_string_sizes_from_value ir_val

| IRJump _ -> []

| IRCondJump (cond_val, _, _) ->

collect_string_sizes_from_value cond_val

| IRIf (cond_val, then_instrs, else_instrs_opt) ->

let cond_sizes = collect_string_sizes_from_value cond_val in

let then_sizes = concat_map collect_string_sizes_from_instr then_instrs in

let else_sizes = concat_map_opt collect_string_sizes_from_instr else_instrs_opt in

cond_sizes @ then_sizes @ else_sizes

| IRIfElseChain (conditions_and_bodies, final_else) ->

let cond_sizes = concat_map (fun (cond_val, then_instrs) ->

let cond_sz = collect_string_sizes_from_value cond_val in

let then_sz = concat_map collect_string_sizes_from_instr then_instrs in

cond_sz @ then_sz

) conditions_and_bodies in

let else_sizes = match final_else with

| Some else_instrs -> concat_map collect_string_sizes_from_instr else_instrs

| None -> []

in

cond_sizes @ else_sizes

| IRMatchReturn (matched_val, arms) ->

let matched_sizes = collect_string_sizes_from_value matched_val in

let arms_sizes = List.fold_left (fun acc arm ->

let pattern_sizes = match arm.match_pattern with

| IRConstantPattern const_val -> collect_string_sizes_from_value const_val

| IRDefaultPattern -> []

in

let action_sizes = match arm.return_action with

| IRReturnValue ret_val -> collect_string_sizes_from_value ret_val

| IRReturnCall (_, args) -> List.fold_left (fun acc arg ->

acc @ (collect_string_sizes_from_value arg)) [] args

| IRReturnTailCall (_, args, _) -> List.fold_left (fun acc arg ->

acc @ (collect_string_sizes_from_value arg)) [] args

in

acc @ pattern_sizes @ action_sizes

) [] arms in

matched_sizes @ arms_sizes

| IRReturn ret_opt ->

(match ret_opt with

| Some ret_val -> collect_string_sizes_from_value ret_val

| None -> [])

| IRComment _ -> [] (* Comments don't contain values *)

| IRBpfLoop (start_val, end_val, counter_val, ctx_val, body_instructions) ->

(collect_string_sizes_from_value start_val) @

(collect_string_sizes_from_value end_val) @

(collect_string_sizes_from_value counter_val) @

(collect_string_sizes_from_value ctx_val) @

(concat_map collect_string_sizes_from_instr body_instructions)

| IRBreak -> []

| IRContinue -> []

| IRCondReturn (cond_val, ret_if_true, ret_if_false) ->

let cond_sizes = collect_string_sizes_from_value cond_val in

let true_sizes = match ret_if_true with

| Some ret_val -> collect_string_sizes_from_value ret_val

| None -> []

in

let false_sizes = match ret_if_false with

| Some ret_val -> collect_string_sizes_from_value ret_val

| None -> []

in

cond_sizes @ true_sizes @ false_sizes

| IRTry (try_instructions, _catch_clauses) ->

concat_map collect_string_sizes_from_instr try_instructions

| IRThrow _error_code ->

[] (* Throw statements don't contain values to collect *)

| IRDefer defer_instructions ->

concat_map collect_string_sizes_from_instr defer_instructions

| IRTailCall (_, args, _) ->

concat_map collect_string_sizes_from_value args

| IRStructOpsRegister (instance_val, struct_ops_val) ->

(collect_string_sizes_from_value instance_val) @ (collect_string_sizes_from_value struct_ops_val)

| IRObjectNew (dest_val, _) ->

collect_string_sizes_from_value dest_val

| IRObjectNewWithFlag (dest_val, _, flag_val) ->

(collect_string_sizes_from_value dest_val) @ (collect_string_sizes_from_value flag_val)

| IRObjectDelete ptr_val ->

collect_string_sizes_from_value ptr_val

| IRRingbufOp (ringbuf_val, _) ->

let program_sizes = concat_map (fun ir_prog -> collect_string_sizes_from_function ir_prog.entry_function) (Ir.get_programs ir_multi_prog) in

(* Also collect from kernel functions *)

let kernel_func_sizes = concat_map (fun ir_func -> collect_string_sizes_from_function ir_func) (Ir.get_kernel_functions ir_multi_prog) in

(* Also collect from struct field types in source_declarations *)

let struct_field_sizes = concat_map (fun decl ->

match decl.Ir.decl_desc with

| Ir.IRDeclStructDef (_, fields, _) ->

concat_map (fun (_, field_type) -> collect_string_sizes_from_type field_type) fields

| _ -> []

) ir_multi_prog.Ir.source_declarations in

let enum_map = Hashtbl.create 16 in

(* Build a set of kernel-defined enum names from source_declarations *)

let kernel_defined_enums = List.fold_left (fun acc decl ->

match decl.Ir.decl_desc with

| Ir.IRDeclEnumDef (name, _, pos) when is_kernel_defined_type pos ->

StringSet.add name acc

| _ -> acc

) StringSet.empty ir_multi_prog.Ir.source_declarations in

let rec collect_from_type = function

| IREnum (name, values) -> Hashtbl.replace enum_map name values

| IRPointer (inner_type, _) -> collect_from_type inner_type

| IRArray (inner_type, _, _) -> collect_from_type inner_type

| IRResult (ok_type, err_type) ->

collect_from_type ok_type; collect_from_type err_type

| _ -> ()

in

let collect_from_map_def map_def =

collect_from_type map_def.map_key_type;

collect_from_type map_def.map_value_type

in

let collect_from_value ir_val =

collect_from_type ir_val.val_type;

(* Also collect from enum constants *)

(match ir_val.value_desc with

| IREnumConstant (enum_name, constant_name, value) ->

(* Filter out kernel-defined enums using the set built from source_declarations *)

if not (StringSet.mem enum_name kernel_defined_enums) then (

let current_values = try Hashtbl.find enum_map enum_name with Not_found -> [] in

let updated_values = (constant_name, value) :: (List.filter (fun (name, _) -> name <> constant_name) current_values) in

Hashtbl.replace enum_map enum_name updated_values

)

| _ -> ())

in

let collect_from_expr ir_expr =

match ir_expr.expr_desc with

| IRValue ir_val -> collect_from_value ir_val

| IRBinOp (left, _, right) ->

collect_from_value left; collect_from_value right

| IRUnOp (_, ir_val) -> collect_from_value ir_val

| IRCast (ir_val, target_type) ->

collect_from_value ir_val; collect_from_type target_type

| IRFieldAccess (obj_val, _) -> collect_from_value obj_val

| IRStructLiteral (_, field_assignments) ->

List.iter (fun (_, field_val) -> collect_from_value field_val) field_assignments

| IRMatch (matched_val, arms) ->

(* Collect from matched expression and all arms *)

collect_from_value matched_val;

List.iter (fun arm -> collect_from_value arm.ir_arm_value) arms

in

let rec collect_from_instr ir_instr =

match ir_instr.instr_desc with

| IRAssign (dest_val, expr) ->

collect_from_value dest_val; collect_from_expr expr

| IRVariableDecl (_dest_val, _typ, init_expr_opt) ->

(* New unified variable declaration *)

(match init_expr_opt with

| Some init_expr -> collect_from_expr init_expr

| None -> ())

| IRCall (_, args, ret_opt) ->

List.iter collect_from_value args;

(match ret_opt with Some ret_val -> collect_from_value ret_val | None -> ())

| IRMapLoad (map_val, key_val, dest_val, _) ->

collect_from_value map_val; collect_from_value key_val; collect_from_value dest_val

| IRMapStore (map_val, key_val, value_val, _) ->

collect_from_value map_val; collect_from_value key_val; collect_from_value value_val

| IRMapDelete (map_val, key_val) ->

collect_from_value map_val; collect_from_value key_val

| IRReturn (Some ret_val) -> collect_from_value ret_val

| IRIf (cond_val, then_instrs, else_instrs_opt) ->

collect_from_value cond_val;

List.iter collect_from_instr then_instrs;

(match else_instrs_opt with Some instrs -> List.iter collect_from_instr instrs | None -> ())

| _ -> ()

in

let collect_from_function ir_func =

List.iter (fun block ->

List.iter collect_from_instr block.instructions

) ir_func.basic_blocks

in

(* Collect from global maps *)

List.iter collect_from_map_def (Ir.get_global_maps ir_multi_prog);

(* Collect from all programs *)

List.iter (fun ir_prog ->

collect_from_function ir_prog.entry_function;

) (Ir.get_programs ir_multi_prog);

emit_line ctx (sprintf "enum %s {" enum_name);

increase_indent ctx;

let value_count = List.length enum_values in

List.iteri (fun i (const_name, value) ->

let line = sprintf "%s = %s%s" const_name (Ast.IntegerValue.to_string value) (if i = value_count - 1 then "" else ",") in

emit_line ctx line

) enum_values;

decrease_indent ctx;

emit_line ctx "};";

let enum_map = collect_enum_definitions ir_multi_prog in

if Hashtbl.length enum_map > 0 then (

let all_enums = Hashtbl.fold (fun enum_name enum_values acc ->

(* Only include enums that have values *)

if enum_values <> [] then

(enum_name, enum_values) :: acc

else

acc

) enum_map [] in

if all_enums <> [] then (

emit_line ctx "/* Enum definitions */";

List.iter (fun (enum_name, enum_values) ->

generate_enum_definition ctx enum_name enum_values

) all_enums;

emit_blank_line ctx

)

let all_sizes = collect_string_sizes_from_multi_program ir_multi_prog in

let unique_sizes = List.sort_uniq compare all_sizes in

if unique_sizes <> [] then (

emit_line ctx "/* String type definitions */";

List.iter (fun size ->

emit_line ctx (sprintf "typedef struct { char data[%d]; __u16 len; } str_%d_t;" (size + 1) size)

) unique_sizes;

emit_blank_line ctx

let config_name = config_decl.config_name in

let struct_name = sprintf "%s_config" config_name in

(* Generate C struct for config *)

emit_line ctx (sprintf "struct %s {" struct_name);

increase_indent ctx;

List.iter (fun field ->

let field_declaration = match field.field_type with

| IRU8 -> sprintf "__u8 %s;" field.field_name

| IRU16 -> sprintf "__u16 %s;" field.field_name

| IRU32 -> sprintf "__u32 %s;" field.field_name

| IRU64 -> sprintf "__u64 %s;" field.field_name

| IRI8 -> sprintf "__s8 %s;" field.field_name

| IRBool -> sprintf "__u8 %s;" field.field_name (* bool -> u8 for BPF compatibility *)

| IRChar -> sprintf "char %s;" field.field_name

| IRArray (IRU16, size, _) -> sprintf "__u16 %s[%d];" field.field_name size

| IRArray (IRU32, size, _) -> sprintf "__u32 %s[%d];" field.field_name size

| IRArray (IRU64, size, _) -> sprintf "__u64 %s[%d];" field.field_name size

| _ -> sprintf "__u32 %s;" field.field_name (* fallback *)

in

emit_line ctx field_declaration

) config_decl.config_fields;

decrease_indent ctx;

emit_line ctx "};";

emit_blank_line ctx;

(* Generate array map for config (single entry at index 0) *)

let map_name = sprintf "%s_config_map" config_name in

emit_line ctx "struct {";

increase_indent ctx;

emit_line ctx "__uint(type, BPF_MAP_TYPE_ARRAY);";

emit_line ctx "__uint(max_entries, 1);";

emit_line ctx "__uint(key_size, sizeof(__u32));";

emit_line ctx (sprintf "__uint(value_size, sizeof(struct %s));" struct_name);

decrease_indent ctx;

emit_line ctx (sprintf "} %s SEC(\".maps\");" map_name);

emit_blank_line ctx;

(* Generate helper function to access config *)

emit_line ctx (sprintf "static inline struct %s* get_%s_config(void) {" struct_name config_name);

increase_indent ctx;

emit_line ctx "__u32 key = 0;";

emit_line ctx (sprintf "struct %s *config = bpf_map_lookup_elem(&%s, &key);" struct_name map_name);

emit_line ctx "if (!config) {";

increase_indent ctx;

emit_line ctx "/* Config not initialized - this should not happen in normal operation */";

emit_line ctx "return NULL;";

decrease_indent ctx;

emit_line ctx "}";

emit_line ctx "return config;";

decrease_indent ctx;

emit_line ctx "}";

List.exists (fun instr ->

match instr.instr_desc with

| IRObjectNew (_, _) | IRObjectDelete _ -> true

| IRIf (_, then_body, else_body) ->

(check_object_allocation_usage_in_instrs then_body) ||

(match else_body with

| Some else_instrs -> check_object_allocation_usage_in_instrs else_instrs

| None -> false)

| IRIfElseChain (conditions_and_bodies, final_else) ->

(List.exists (fun (_, then_body) ->

check_object_allocation_usage_in_instrs then_body

) conditions_and_bodies) ||

(match final_else with

| Some else_instrs -> check_object_allocation_usage_in_instrs else_instrs

| None -> false)

| IRBpfLoop (_, _, _, _, body_instrs) ->

check_object_allocation_usage_in_instrs body_instrs

| IRTry (try_instrs, catch_clauses) ->

(check_object_allocation_usage_in_instrs try_instrs) ||

(List.exists (fun clause ->

check_object_allocation_usage_in_instrs clause.catch_body

) catch_clauses)

| IRDefer defer_instrs ->

check_object_allocation_usage_in_instrs defer_instrs

| _ -> false

(* Check all programs *)

(List.exists (fun ir_prog ->

check_object_allocation_usage_in_function ir_prog.entry_function

) (Ir.get_programs ir_multi_prog)) ||

(* Check kernel functions *)

List.exists (fun instr ->

match instr.instr_desc with

| IRRingbufOp (_, _) -> true (* Ring buffer operations always use dynptr *)

| IRStructFieldAssignment (obj_val, _, _) ->

(* Struct field assignments on packet data or map values use dynptr *)

(match detect_memory_region_enhanced obj_val with

| PacketData | MapValue -> true

| _ -> false)

| IRAssign (_, expr) ->

(* Check if assignment expressions use enhanced memory access patterns *)

check_dynptr_usage_in_expr expr

| IRCall (_, args, _) ->

(* Check function call arguments for enhanced memory patterns *)

List.exists check_dynptr_usage_in_value args

| IRIf (condition, then_body, else_body) ->

(check_dynptr_usage_in_value condition) ||

(check_dynptr_usage_in_instrs then_body) ||

(match else_body with

| Some else_instrs -> check_dynptr_usage_in_instrs else_instrs

| None -> false)

| IRIfElseChain (conditions_and_bodies, final_else) ->

(List.exists (fun (condition, then_body) ->

(check_dynptr_usage_in_value condition) ||

(check_dynptr_usage_in_instrs then_body)

) conditions_and_bodies) ||

(match final_else with

| Some else_instrs -> check_dynptr_usage_in_instrs else_instrs

| None -> false)

| IRBpfLoop (_, _, _, _, body_instrs) ->

check_dynptr_usage_in_instrs body_instrs

| _ -> false

match expr.expr_desc with

| IRValue value -> check_dynptr_usage_in_value value

| IRBinOp (left, _, right) ->

(check_dynptr_usage_in_value left) || (check_dynptr_usage_in_value right)

| IRUnOp (IRDeref, value) ->

(* Dereference operations on packet data or map values use dynptr *)

(match detect_memory_region_enhanced value with

| PacketData | MapValue -> true

| _ -> false)

| IRUnOp (_, value) -> check_dynptr_usage_in_value value

| IRFieldAccess (obj_value, _) ->

(* Field access on packet data or map values uses dynptr *)

(match detect_memory_region_enhanced obj_value with

| PacketData | MapValue -> true

| _ -> false)

| IRCast (value, _) -> check_dynptr_usage_in_value value

match value.value_desc with

| IRMapAccess (_, _, _) -> true (* Map access may use enhanced patterns *)

(* Conservative approach: include dynptr for XDP/TC programs or any enhanced memory access *)

(List.exists (fun ir_prog ->

match ir_prog.program_type with

| Xdp | Tc -> true (* XDP/TC commonly use packet data access *)

| _ -> check_dynptr_usage_in_function ir_prog.entry_function

) (Ir.get_programs ir_multi_prog)) ||

(* Check kernel functions *)

emit_line ctx "/* eBPF Dynptr API integration for enhanced pointer safety */";

emit_line ctx "/* Using system-provided bpf_dynptr_* helper functions from bpf_helpers.h */";

emit_blank_line ctx;

(* Generate enhanced dynptr safety macros *)

emit_line ctx "/* Enhanced dynptr safety macros */";

emit_line ctx "#define DYNPTR_SAFE_ACCESS(dynptr, offset, size, type) \\";

emit_line ctx " ({ \\";

emit_line ctx " type *__ptr = (type*)bpf_dynptr_data(dynptr, offset, sizeof(type)); \\";

emit_line ctx " __ptr ? *__ptr : (type){0}; \\";

emit_line ctx " })";

emit_blank_line ctx;

emit_line ctx "#define DYNPTR_SAFE_WRITE(dynptr, offset, value, type) \\";

emit_line ctx " ({ \\";

emit_line ctx " type __tmp = (value); \\";

emit_line ctx " bpf_dynptr_write(dynptr, offset, &__tmp, sizeof(type), 0); \\";

emit_line ctx " })";

emit_blank_line ctx;

emit_line ctx "#define DYNPTR_SAFE_READ(dst, dynptr, offset, type) \\";

emit_line ctx " bpf_dynptr_read(dst, sizeof(type), dynptr, offset, 0)";

emit_blank_line ctx;

(* Fallback macros for regular pointers *)

emit_line ctx "/* Fallback macros for regular pointer operations */";

emit_line ctx "#define SAFE_DEREF(ptr) \\";

emit_line ctx " ({ \\";

emit_line ctx " typeof(*ptr) __val = {0}; \\";

emit_line ctx " if (ptr) { \\";

emit_line ctx " __builtin_memcpy(&__val, ptr, sizeof(__val)); \\";

emit_line ctx " } \\";

emit_line ctx " __val; \\";

emit_line ctx " })";

emit_blank_line ctx;

emit_line ctx "#define SAFE_PTR_ACCESS(ptr, field) \\";

emit_line ctx " ({ \\";

emit_line ctx " typeof((ptr)->field) __val = {0}; \\";

emit_line ctx " if (ptr) { \\";

emit_line ctx " __val = (ptr)->field; \\";

emit_line ctx " } \\";

emit_line ctx " __val; \\";

emit_line ctx " })";

(* Use vmlinux.h which contains all kernel types from BTF *)

let vmlinux_includes = [

"#include \"vmlinux.h\"";

] in

(* Only include essential eBPF helpers, vmlinux.h provides all kernel types *)

let standard_includes = [

"#include <bpf/bpf_helpers.h>";

] in

(* Get context-specific includes for macros not in vmlinux.h *)

let context_includes = List.fold_left (fun acc prog_type ->

let context_type = match prog_type with

| Ast.Tc -> Some "tc"

| Ast.Probe probe_type ->

(match probe_type with

| Ast.Kprobe -> Some "kprobe" (* Only kprobe needs pt_regs includes *)

| Ast.Fprobe -> Some "fprobe") (* Fprobe needs BPF tracing includes *)

| _ -> None

in

match context_type with

| Some ctx_type ->

let includes = Kernelscript_context.Context_codegen.get_context_includes ctx_type in

acc @ includes

| None -> acc

) [] program_types in

(* Remove duplicates between all include sets *)

let all_base_includes = vmlinux_includes @ standard_includes in

let unique_context_includes = List.filter (fun inc ->

not (List.mem inc all_base_includes)) context_includes in

(* For kprobe programs, still use vmlinux.h but include context-specific macro headers *)

let has_kprobe = List.exists (function Ast.Probe Ast.Kprobe -> true | _ -> false) program_types in

if has_kprobe then (

(* Use vmlinux.h and context-specific headers for macros *)

let vmlinux_and_helpers = [

"#include \"vmlinux.h\"";

"#include <bpf/bpf_helpers.h>";

] in

List.iter (emit_line ctx) vmlinux_and_helpers;

List.iter (emit_line ctx) unique_context_includes;

emit_blank_line ctx

) else (

(* For non-kprobe programs, use vmlinux.h and standard processing *)

let all_includes = vmlinux_includes @ standard_includes @ unique_context_includes in

List.iter (emit_line ctx) all_includes;

emit_blank_line ctx;

(* Only include object allocation code if the program actually uses new() or delete() *)

let uses_object_allocation = match ir_multi_prog, ir_program with

| Some multi_prog, _ -> check_object_allocation_usage multi_prog

| None, Some single_prog -> check_object_allocation_usage_in_program single_prog

| None, None -> false (* Conservative: don't include if we can't analyze *)

in

if uses_object_allocation then (

(* Use proper kernel implementation: extern declarations and macros *)

emit_line ctx "extern void *bpf_obj_new_impl(__u64 local_type_id__k, void *meta__ign) __ksym;";

emit_line ctx "extern void bpf_obj_drop_impl(void *p__alloc, void *meta__ign) __ksym;";

emit_blank_line ctx;

(* Use exact kernel implementation for proper typeof handling *)

emit_line ctx "#define ___concat(a, b) a ## b";

emit_line ctx "#ifdef __clang__";

emit_line ctx "#define ___bpf_typeof(type) ((typeof(type) *) 0)";

emit_line ctx "#else";

emit_line ctx "#define ___bpf_typeof1(type, NR) ({ \\";

emit_line ctx " extern typeof(type) *___concat(bpf_type_tmp_, NR); \\";

emit_line ctx " ___concat(bpf_type_tmp_, NR); \\";

emit_line ctx "})";

emit_line ctx "#define ___bpf_typeof(type) ___bpf_typeof1(type, __COUNTER__)";

emit_line ctx "#endif";

emit_blank_line ctx;

(* Add BPF_TYPE_ID_LOCAL constant *)

emit_line ctx "#ifndef BPF_TYPE_ID_LOCAL";

emit_line ctx "#define BPF_TYPE_ID_LOCAL 1";

emit_line ctx "#endif";

emit_blank_line ctx;

emit_line ctx "#define bpf_core_type_id_kernel(type) __builtin_btf_type_id(*(type*)0, 0)";

emit_line ctx "#define bpf_obj_new(type) ((type *)bpf_obj_new_impl(bpf_core_type_id_kernel(type), NULL))";

emit_line ctx "#define bpf_obj_drop(ptr) bpf_obj_drop_impl(ptr, NULL)";

emit_blank_line ctx

)

let map_type_str = ir_map_type_to_c_type map_def.map_type in

let key_type_str = ebpf_type_from_ir_type map_def.map_key_type in

let value_type_str = ebpf_type_from_ir_type map_def.map_value_type in

emit_line ctx "struct {";

increase_indent ctx;

emit_line ctx (sprintf "__uint(type, %s);" map_type_str);

emit_line ctx (sprintf "__uint(max_entries, %d);" map_def.max_entries);

emit_line ctx (sprintf "__type(key, %s);" key_type_str);

emit_line ctx (sprintf "__type(value, %s);" value_type_str);

(* Add map flags if specified *)

if map_def.flags <> 0 then

emit_line ctx (sprintf "__uint(map_flags, 0x%x);" map_def.flags);

(* Note: We do NOT emit __uint(pinning, LIBBPF_PIN_BY_NAME) here when pin_path is specified.

decrease_indent ctx;

emit_line ctx (sprintf "} %s SEC(\".maps\");" map_def.map_name);

let c_type = ebpf_type_from_ir_type global_var.global_var_type in

let var_name = global_var.global_var_name in