bpf_x86_bpfel.go

// Licensed to Elasticsearch B.V. under one or more contributor
// license agreements. See the NOTICE file distributed with
// this work for additional information regarding copyright
// ownership. Elasticsearch B.V. licenses this file to you under
// the Apache License, Version 2.0 (the "License"); you may
// not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing,
// software distributed under the License is distributed on an
// "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
// KIND, either express or implied.  See the License for the
// specific language governing permissions and limitations
// under the License.

// Code generated by bpf2go; DO NOT EDIT.
//go:build 386 || amd64

package ebpfevents

import (
	"bytes"
	_ "embed"
	"fmt"
	"io"

	"github.com/cilium/ebpf"
)

// loadBpf returns the embedded CollectionSpec for bpf.
func loadBpf() (*ebpf.CollectionSpec, error) {
	reader := bytes.NewReader(_BpfBytes)
	spec, err := ebpf.LoadCollectionSpecFromReader(reader)
	if err != nil {
		return nil, fmt.Errorf("can't load bpf: %w", err)
	}

	return spec, err
}

// loadBpfObjects loads bpf and converts it into a struct.
//
// The following types are suitable as obj argument:
//
//	*bpfObjects
//	*bpfPrograms
//	*bpfMaps
//
// See ebpf.CollectionSpec.LoadAndAssign documentation for details.
func loadBpfObjects(obj interface{}, opts *ebpf.CollectionOptions) error {
	spec, err := loadBpf()
	if err != nil {
		return err
	}

	return spec.LoadAndAssign(obj, opts)
}

// bpfSpecs contains maps and programs before they are loaded into the kernel.
//
// It can be passed ebpf.CollectionSpec.Assign.
type bpfSpecs struct {
	bpfProgramSpecs
	bpfMapSpecs
}

// bpfSpecs contains programs before they are loaded into the kernel.
//
// It can be passed ebpf.CollectionSpec.Assign.
type bpfProgramSpecs struct {
	FentryCommitCreds               *ebpf.ProgramSpec `ebpf:"fentry__commit_creds"`
	FentryDoRenameat2               *ebpf.ProgramSpec `ebpf:"fentry__do_renameat2"`
	FentryDoUnlinkat                *ebpf.ProgramSpec `ebpf:"fentry__do_unlinkat"`
	FentryMntWantWrite              *ebpf.ProgramSpec `ebpf:"fentry__mnt_want_write"`
	FentryTaskstatsExit             *ebpf.ProgramSpec `ebpf:"fentry__taskstats_exit"`
	FentryTcpClose                  *ebpf.ProgramSpec `ebpf:"fentry__tcp_close"`
	FentryTtyWrite                  *ebpf.ProgramSpec `ebpf:"fentry__tty_write"`
	FentryVfsRename                 *ebpf.ProgramSpec `ebpf:"fentry__vfs_rename"`
	FentryVfsUnlink                 *ebpf.ProgramSpec `ebpf:"fentry__vfs_unlink"`
	FexitChmodCommon                *ebpf.ProgramSpec `ebpf:"fexit__chmod_common"`
	FexitChownCommon                *ebpf.ProgramSpec `ebpf:"fexit__chown_common"`
	FexitDoFilpOpen                 *ebpf.ProgramSpec `ebpf:"fexit__do_filp_open"`
	FexitDoTruncate                 *ebpf.ProgramSpec `ebpf:"fexit__do_truncate"`
	FexitInetCskAccept              *ebpf.ProgramSpec `ebpf:"fexit__inet_csk_accept"`
	FexitTcpV4Connect               *ebpf.ProgramSpec `ebpf:"fexit__tcp_v4_connect"`
	FexitTcpV6Connect               *ebpf.ProgramSpec `ebpf:"fexit__tcp_v6_connect"`
	FexitVfsRename                  *ebpf.ProgramSpec `ebpf:"fexit__vfs_rename"`
	FexitVfsUnlink                  *ebpf.ProgramSpec `ebpf:"fexit__vfs_unlink"`
	FexitVfsWrite                   *ebpf.ProgramSpec `ebpf:"fexit__vfs_write"`
	FexitVfsWritev                  *ebpf.ProgramSpec `ebpf:"fexit__vfs_writev"`
	KprobeChmodCommon               *ebpf.ProgramSpec `ebpf:"kprobe__chmod_common"`
	KprobeChownCommon               *ebpf.ProgramSpec `ebpf:"kprobe__chown_common"`
	KprobeCommitCreds               *ebpf.ProgramSpec `ebpf:"kprobe__commit_creds"`
	KprobeDoRenameat2               *ebpf.ProgramSpec `ebpf:"kprobe__do_renameat2"`
	KprobeDoTruncate                *ebpf.ProgramSpec `ebpf:"kprobe__do_truncate"`
	KprobeDoUnlinkat                *ebpf.ProgramSpec `ebpf:"kprobe__do_unlinkat"`
	KprobeMntWantWrite              *ebpf.ProgramSpec `ebpf:"kprobe__mnt_want_write"`
	KprobeTaskstatsExit             *ebpf.ProgramSpec `ebpf:"kprobe__taskstats_exit"`
	KprobeTcpClose                  *ebpf.ProgramSpec `ebpf:"kprobe__tcp_close"`
	KprobeTcpV4Connect              *ebpf.ProgramSpec `ebpf:"kprobe__tcp_v4_connect"`
	KprobeTcpV6Connect              *ebpf.ProgramSpec `ebpf:"kprobe__tcp_v6_connect"`
	KprobeTtyWrite                  *ebpf.ProgramSpec `ebpf:"kprobe__tty_write"`
	KprobeVfsRename                 *ebpf.ProgramSpec `ebpf:"kprobe__vfs_rename"`
	KprobeVfsUnlink                 *ebpf.ProgramSpec `ebpf:"kprobe__vfs_unlink"`
	KprobeVfsWrite                  *ebpf.ProgramSpec `ebpf:"kprobe__vfs_write"`
	KprobeVfsWritev                 *ebpf.ProgramSpec `ebpf:"kprobe__vfs_writev"`
	KretprobeChmodCommon            *ebpf.ProgramSpec `ebpf:"kretprobe__chmod_common"`
	KretprobeChownCommon            *ebpf.ProgramSpec `ebpf:"kretprobe__chown_common"`
	KretprobeDoFilpOpen             *ebpf.ProgramSpec `ebpf:"kretprobe__do_filp_open"`
	KretprobeDoTruncate             *ebpf.ProgramSpec `ebpf:"kretprobe__do_truncate"`
	KretprobeInetCskAccept          *ebpf.ProgramSpec `ebpf:"kretprobe__inet_csk_accept"`
	KretprobeTcpV4Connect           *ebpf.ProgramSpec `ebpf:"kretprobe__tcp_v4_connect"`
	KretprobeTcpV6Connect           *ebpf.ProgramSpec `ebpf:"kretprobe__tcp_v6_connect"`
	KretprobeVfsRename              *ebpf.ProgramSpec `ebpf:"kretprobe__vfs_rename"`
	KretprobeVfsUnlink              *ebpf.ProgramSpec `ebpf:"kretprobe__vfs_unlink"`
	KretprobeVfsWrite               *ebpf.ProgramSpec `ebpf:"kretprobe__vfs_write"`
	KretprobeVfsWritev              *ebpf.ProgramSpec `ebpf:"kretprobe__vfs_writev"`
	SchedProcessExec                *ebpf.ProgramSpec `ebpf:"sched_process_exec"`
	SchedProcessFork                *ebpf.ProgramSpec `ebpf:"sched_process_fork"`
	TracepointSyscallsSysExitSetsid *ebpf.ProgramSpec `ebpf:"tracepoint_syscalls_sys_exit_setsid"`
}

// bpfMapSpecs contains maps before they are loaded into the kernel.
//
// It can be passed ebpf.CollectionSpec.Assign.
type bpfMapSpecs struct {
	ElasticEbpfEventsInitBuffer      *ebpf.MapSpec `ebpf:"elastic_ebpf_events_init_buffer"`
	ElasticEbpfEventsScratchSpace    *ebpf.MapSpec `ebpf:"elastic_ebpf_events_scratch_space"`
	ElasticEbpfEventsState           *ebpf.MapSpec `ebpf:"elastic_ebpf_events_state"`
	ElasticEbpfEventsTrustedPids     *ebpf.MapSpec `ebpf:"elastic_ebpf_events_trusted_pids"`
	EventBufferMap                   *ebpf.MapSpec `ebpf:"event_buffer_map"`
	PathResolverDentryScratchMap     *ebpf.MapSpec `ebpf:"path_resolver_dentry_scratch_map"`
	PathResolverKernfsNodeScratchMap *ebpf.MapSpec `ebpf:"path_resolver_kernfs_node_scratch_map"`
	Ringbuf                          *ebpf.MapSpec `ebpf:"ringbuf"`
}

// bpfObjects contains all objects after they have been loaded into the kernel.
//
// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
type bpfObjects struct {
	bpfPrograms
	bpfMaps
}

func (o *bpfObjects) Close() error {
	return _BpfClose(
		&o.bpfPrograms,
		&o.bpfMaps,
	)
}

// bpfMaps contains all maps after they have been loaded into the kernel.
//
// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
type bpfMaps struct {
	ElasticEbpfEventsInitBuffer      *ebpf.Map `ebpf:"elastic_ebpf_events_init_buffer"`
	ElasticEbpfEventsScratchSpace    *ebpf.Map `ebpf:"elastic_ebpf_events_scratch_space"`
	ElasticEbpfEventsState           *ebpf.Map `ebpf:"elastic_ebpf_events_state"`
	ElasticEbpfEventsTrustedPids     *ebpf.Map `ebpf:"elastic_ebpf_events_trusted_pids"`
	EventBufferMap                   *ebpf.Map `ebpf:"event_buffer_map"`
	PathResolverDentryScratchMap     *ebpf.Map `ebpf:"path_resolver_dentry_scratch_map"`
	PathResolverKernfsNodeScratchMap *ebpf.Map `ebpf:"path_resolver_kernfs_node_scratch_map"`
	Ringbuf                          *ebpf.Map `ebpf:"ringbuf"`
}

func (m *bpfMaps) Close() error {
	return _BpfClose(
		m.ElasticEbpfEventsInitBuffer,
		m.ElasticEbpfEventsScratchSpace,
		m.ElasticEbpfEventsState,
		m.ElasticEbpfEventsTrustedPids,
		m.EventBufferMap,
		m.PathResolverDentryScratchMap,
		m.PathResolverKernfsNodeScratchMap,
		m.Ringbuf,
	)
}

// bpfPrograms contains all programs after they have been loaded into the kernel.
//
// It can be passed to loadBpfObjects or ebpf.CollectionSpec.LoadAndAssign.
type bpfPrograms struct {
	FentryCommitCreds               *ebpf.Program `ebpf:"fentry__commit_creds"`
	FentryDoRenameat2               *ebpf.Program `ebpf:"fentry__do_renameat2"`
	FentryDoUnlinkat                *ebpf.Program `ebpf:"fentry__do_unlinkat"`
	FentryMntWantWrite              *ebpf.Program `ebpf:"fentry__mnt_want_write"`
	FentryTaskstatsExit             *ebpf.Program `ebpf:"fentry__taskstats_exit"`
	FentryTcpClose                  *ebpf.Program `ebpf:"fentry__tcp_close"`
	FentryTtyWrite                  *ebpf.Program `ebpf:"fentry__tty_write"`
	FentryVfsRename                 *ebpf.Program `ebpf:"fentry__vfs_rename"`
	FentryVfsUnlink                 *ebpf.Program `ebpf:"fentry__vfs_unlink"`
	FexitChmodCommon                *ebpf.Program `ebpf:"fexit__chmod_common"`
	FexitChownCommon                *ebpf.Program `ebpf:"fexit__chown_common"`
	FexitDoFilpOpen                 *ebpf.Program `ebpf:"fexit__do_filp_open"`
	FexitDoTruncate                 *ebpf.Program `ebpf:"fexit__do_truncate"`
	FexitInetCskAccept              *ebpf.Program `ebpf:"fexit__inet_csk_accept"`
	FexitTcpV4Connect               *ebpf.Program `ebpf:"fexit__tcp_v4_connect"`
	FexitTcpV6Connect               *ebpf.Program `ebpf:"fexit__tcp_v6_connect"`
	FexitVfsRename                  *ebpf.Program `ebpf:"fexit__vfs_rename"`
	FexitVfsUnlink                  *ebpf.Program `ebpf:"fexit__vfs_unlink"`
	FexitVfsWrite                   *ebpf.Program `ebpf:"fexit__vfs_write"`
	FexitVfsWritev                  *ebpf.Program `ebpf:"fexit__vfs_writev"`
	KprobeChmodCommon               *ebpf.Program `ebpf:"kprobe__chmod_common"`
	KprobeChownCommon               *ebpf.Program `ebpf:"kprobe__chown_common"`
	KprobeCommitCreds               *ebpf.Program `ebpf:"kprobe__commit_creds"`
	KprobeDoRenameat2               *ebpf.Program `ebpf:"kprobe__do_renameat2"`
	KprobeDoTruncate                *ebpf.Program `ebpf:"kprobe__do_truncate"`
	KprobeDoUnlinkat                *ebpf.Program `ebpf:"kprobe__do_unlinkat"`
	KprobeMntWantWrite              *ebpf.Program `ebpf:"kprobe__mnt_want_write"`
	KprobeTaskstatsExit             *ebpf.Program `ebpf:"kprobe__taskstats_exit"`
	KprobeTcpClose                  *ebpf.Program `ebpf:"kprobe__tcp_close"`
	KprobeTcpV4Connect              *ebpf.Program `ebpf:"kprobe__tcp_v4_connect"`
	KprobeTcpV6Connect              *ebpf.Program `ebpf:"kprobe__tcp_v6_connect"`
	KprobeTtyWrite                  *ebpf.Program `ebpf:"kprobe__tty_write"`
	KprobeVfsRename                 *ebpf.Program `ebpf:"kprobe__vfs_rename"`
	KprobeVfsUnlink                 *ebpf.Program `ebpf:"kprobe__vfs_unlink"`
	KprobeVfsWrite                  *ebpf.Program `ebpf:"kprobe__vfs_write"`
	KprobeVfsWritev                 *ebpf.Program `ebpf:"kprobe__vfs_writev"`
	KretprobeChmodCommon            *ebpf.Program `ebpf:"kretprobe__chmod_common"`
	KretprobeChownCommon            *ebpf.Program `ebpf:"kretprobe__chown_common"`
	KretprobeDoFilpOpen             *ebpf.Program `ebpf:"kretprobe__do_filp_open"`
	KretprobeDoTruncate             *ebpf.Program `ebpf:"kretprobe__do_truncate"`
	KretprobeInetCskAccept          *ebpf.Program `ebpf:"kretprobe__inet_csk_accept"`
	KretprobeTcpV4Connect           *ebpf.Program `ebpf:"kretprobe__tcp_v4_connect"`
	KretprobeTcpV6Connect           *ebpf.Program `ebpf:"kretprobe__tcp_v6_connect"`
	KretprobeVfsRename              *ebpf.Program `ebpf:"kretprobe__vfs_rename"`
	KretprobeVfsUnlink              *ebpf.Program `ebpf:"kretprobe__vfs_unlink"`
	KretprobeVfsWrite               *ebpf.Program `ebpf:"kretprobe__vfs_write"`
	KretprobeVfsWritev              *ebpf.Program `ebpf:"kretprobe__vfs_writev"`
	SchedProcessExec                *ebpf.Program `ebpf:"sched_process_exec"`
	SchedProcessFork                *ebpf.Program `ebpf:"sched_process_fork"`
	TracepointSyscallsSysExitSetsid *ebpf.Program `ebpf:"tracepoint_syscalls_sys_exit_setsid"`
}

func (p *bpfPrograms) Close() error {
	return _BpfClose(
		p.FentryCommitCreds,
		p.FentryDoRenameat2,
		p.FentryDoUnlinkat,
		p.FentryMntWantWrite,
		p.FentryTaskstatsExit,
		p.FentryTcpClose,
		p.FentryTtyWrite,
		p.FentryVfsRename,
		p.FentryVfsUnlink,
		p.FexitChmodCommon,
		p.FexitChownCommon,
		p.FexitDoFilpOpen,
		p.FexitDoTruncate,
		p.FexitInetCskAccept,
		p.FexitTcpV4Connect,
		p.FexitTcpV6Connect,
		p.FexitVfsRename,
		p.FexitVfsUnlink,
		p.FexitVfsWrite,
		p.FexitVfsWritev,
		p.KprobeChmodCommon,
		p.KprobeChownCommon,
		p.KprobeCommitCreds,
		p.KprobeDoRenameat2,
		p.KprobeDoTruncate,
		p.KprobeDoUnlinkat,
		p.KprobeMntWantWrite,
		p.KprobeTaskstatsExit,
		p.KprobeTcpClose,
		p.KprobeTcpV4Connect,
		p.KprobeTcpV6Connect,
		p.KprobeTtyWrite,
		p.KprobeVfsRename,
		p.KprobeVfsUnlink,
		p.KprobeVfsWrite,
		p.KprobeVfsWritev,
		p.KretprobeChmodCommon,
		p.KretprobeChownCommon,
		p.KretprobeDoFilpOpen,
		p.KretprobeDoTruncate,
		p.KretprobeInetCskAccept,
		p.KretprobeTcpV4Connect,
		p.KretprobeTcpV6Connect,
		p.KretprobeVfsRename,
		p.KretprobeVfsUnlink,
		p.KretprobeVfsWrite,
		p.KretprobeVfsWritev,
		p.SchedProcessExec,
		p.SchedProcessFork,
		p.TracepointSyscallsSysExitSetsid,
	)
}

func _BpfClose(closers ...io.Closer) error {
	for _, closer := range closers {
		if err := closer.Close(); err != nil {
			return err
		}
	}
	return nil
}

// Do not access this directly.
//
//go:embed bpf_x86_bpfel.o
var _BpfBytes []byte