data

const (
	NONE_T DecodeAs = iota // Default value - the argument does not originate from a decodable buffer.
	INT_T
	UINT_T
	LONG_T
	ULONG_T
	U16_T
	U8_T
	INT_ARR_2_T
	UINT64_ARR_T
	POINTER_T
	BYTES_T
	STR_T
	STR_ARR_T
	SOCK_ADDR_T
	CRED_T
	TIMESPEC_T
)

The types of this section in particular are those possibly submitted in syscall events. Therefore, these should match to the type enum and table in: pkg/ebpf/c/types.h and buffer.h respectively.

const (
	ARGS_ARR_T DecodeAs = iota + 64
	BOOL_T
	FLOAT_T
	FLOAT64_T
	MAX_TRACEE_DECODES
)

These types are in a separate section since they are not defined as enums in the ebpf code. That is because they are unused by syscalls. Instead, they designate a functional submission strategy. (ie. ARGS_ARR_T is submitted by the strategy defined in buffer.h:save_args_str_arr_to_buf).

const (
	USER_DEFINED_DECODE_BEGIN DecodeAs = 128
	USER_DEFINED_DECODE_END   DecodeAs = 255
)

The maximum value for decode types is 0xFF. The values from 0x80 to 0xFF are reserved for user defined decode types. This is to allow users to define their own decode types in their own ebpf programs. The values from 0x00 to 0x7F are reserved for tracee.