BPF_CORE_READ
name_off = BPF_CORE_READ(t, name_off);
u32 pid = BPF_CORE_READ(p, pid);
u32 pid = BPF_CORE_READ(p, pid);
dev = BPF_CORE_READ(skb, dev);
len = BPF_CORE_READ(skb, len);
type = BPF_CORE_READ(map, map_type);
if (BPF_CORE_READ(link, type) == bpf_core_enum_value(enum bpf_link_type___local,
return BPF_CORE_READ((struct bpf_prog *)ent, aux, id);
return BPF_CORE_READ((struct bpf_map *)ent, id);
return BPF_CORE_READ((struct btf *)ent, id);
return BPF_CORE_READ((struct bpf_link *)ent, id);
event = BPF_CORE_READ(perf_link, perf_file, private_data);
return BPF_CORE_READ(event, bpf_cookie);
BPF_CORE_READ((const struct pt_regs___s390 *)(x), __PT_PARM1_SYSCALL_REG)
BPF_CORE_READ((const struct pt_regs___arm64 *)(x), __PT_PARM1_SYSCALL_REG)
BPF_CORE_READ((const struct pt_regs___riscv *)(x), __PT_PARM1_SYSCALL_REG)
#define PT_REGS_PARM1_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_REG)
#define PT_REGS_PARM2_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_REG)
#define PT_REGS_PARM3_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_REG)
#define PT_REGS_PARM4_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_REG)
#define PT_REGS_PARM5_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_REG)
#define PT_REGS_PARM6_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_REG)
#define PT_REGS_PARM7_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_REG)
#define PT_REGS_PARM8_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM8_REG)
#define PT_REGS_RET_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RET_REG)
#define PT_REGS_FP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_FP_REG)
#define PT_REGS_RC_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_RC_REG)
#define PT_REGS_SP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_SP_REG)
#define PT_REGS_IP_CORE(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_IP_REG)
#define PT_REGS_PARM1_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM1_SYSCALL_REG)
#define PT_REGS_PARM2_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM2_SYSCALL_REG)
#define PT_REGS_PARM3_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM3_SYSCALL_REG)
#define PT_REGS_PARM4_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM4_SYSCALL_REG)
#define PT_REGS_PARM5_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM5_SYSCALL_REG)
#define PT_REGS_PARM6_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM6_SYSCALL_REG)
#define PT_REGS_PARM7_CORE_SYSCALL(x) BPF_CORE_READ(__PT_REGS_CAST(x), __PT_PARM7_SYSCALL_REG)
return BPF_CORE_READ(cgrp_new, ancestors[level], kn, id);
return BPF_CORE_READ(cgrp_old, ancestor_ids[level]);
cgrp = BPF_CORE_READ(p, cgroups, subsys[perf_subsys_id], cgroup);
level = BPF_CORE_READ(cgrp, level);
.pid = BPF_CORE_READ(task, pid),
.pid = BPF_CORE_READ(task, pid),
.pid = BPF_CORE_READ(task, pid),
.pid = BPF_CORE_READ(task, pid),
cgrp = BPF_CORE_READ(task, cgroups, subsys[perf_subsys_id], cgroup);
return BPF_CORE_READ(cgrp, kn, id);
owner = BPF_CORE_READ(mutex, owner.counter);
owner = (unsigned long)BPF_CORE_READ(rwsem, owner);
owner = BPF_CORE_READ(rwsem, owner.counter);
owner = BPF_CORE_READ(rwsem, owner.counter);
owner_pid = BPF_CORE_READ(task, pid);
pelem->flags = BPF_CORE_READ(task, pid);
nr_zones = BPF_CORE_READ(contig_page_data, nr_zones);
nr_zones = BPF_CORE_READ(pgdat, nr_zones);
return BPF_CORE_READ(t_new, __state);
return BPF_CORE_READ(t_old, state);
return BPF_CORE_READ(t, cgroups, dfl_cgrp, kn, id);
cgrp = BPF_CORE_READ(t, cgroups, subsys[perf_subsys_id], cgroup);
return BPF_CORE_READ(cgrp, kn, id);
pid = BPF_CORE_READ(task, tgid);
cgrp = BPF_CORE_READ(task, cgroups, subsys[perf_subsys_id], cgroup);
return BPF_CORE_READ(cgrp, kn, id);
return rq ? BPF_CORE_READ(rq, prev_steal_time_rq) : 0;
return irqt ? BPF_CORE_READ(irqt, total) : 0;
len = BPF_CORE_READ(sgp, length);
len = BPF_CORE_READ(sgp, length);
map_type = BPF_CORE_READ(map, map_type);
parent = BPF_CORE_READ(parent, real_parent);
ppid = BPF_CORE_READ(parent, tgid);
BPF_CORE_READ(parent, self_exec_id);
BPF_CORE_READ(parent, start_time);
BPF_CORE_READ(cgroup_node, name));
cgroup_node = BPF_CORE_READ(cgroup_node, __parent);
return BPF_CORE_READ(node52, id.ino);
return (u64)BPF_CORE_READ(node, id);
BPF_CORE_READ(task, nsproxy, cgroup_ns, root_cset, dfl_cgrp, kn);
struct kernfs_node* proc_kernfs = BPF_CORE_READ(task, cgroups, dfl_cgrp, kn);
BPF_CORE_READ(task, cgroups, subsys[i]);
int subsys_id = BPF_CORE_READ(subsys, ss, id);
proc_kernfs = BPF_CORE_READ(subsys, cgroup, kn);
root_kernfs = BPF_CORE_READ(subsys, ss, root, kf_root, kn);
BPF_CORE_READ(root_kernfs, iattr, ia_mtime.tv_nsec);
BPF_CORE_READ(proc_kernfs, iattr, ia_mtime.tv_nsec);
(struct kernfs_iattrs___52*)BPF_CORE_READ(root_kernfs, iattr);
BPF_CORE_READ(root_iattr, ia_iattr.ia_mtime.tv_nsec);
(struct kernfs_iattrs___52*)BPF_CORE_READ(proc_kernfs, iattr);
BPF_CORE_READ(proc_iattr, ia_iattr.ia_mtime.tv_nsec);
BPF_CORE_READ(root_kernfs, name));
BPF_CORE_READ(proc_kernfs, name));
metadata->exec_id = BPF_CORE_READ(task, self_exec_id);
metadata->start_time = BPF_CORE_READ(task, start_time);
BPF_CORE_READ(filp_dentry, d_name.name));
parent_dentry = BPF_CORE_READ(filp_dentry, d_parent);
u64 dir_ino = BPF_CORE_READ(filp_dentry, d_inode, i_ino);
parent_dentry = BPF_CORE_READ(filp_dentry, d_parent);
u32 dev_id = BPF_CORE_READ(file_dentry, d_sb, s_dev);
u64 ino = BPF_CORE_READ(file_dentry, d_inode, i_ino);
if (!is_ancestor_in_allowed_inodes(BPF_CORE_READ(file_dentry, d_parent)))
BPF_CORE_READ(filp, f_path.dentry,
struct kernfs_node* proc_kernfs = BPF_CORE_READ(task, cgroups, dfl_cgrp, kn);
BPF_CORE_READ(proc_kernfs, name));
u64 inode = BPF_CORE_READ(bprm, file, f_inode, i_ino);
struct task_struct* parent_task = BPF_CORE_READ(task, real_parent);
proc_exec_data->parent_pid = BPF_CORE_READ(parent_task, tgid);
proc_exec_data->parent_uid = BPF_CORE_READ(parent_task, real_cred, uid.val);
proc_exec_data->parent_exec_id = BPF_CORE_READ(parent_task, self_exec_id);
proc_exec_data->parent_start_time = BPF_CORE_READ(parent_task, start_time);
const char* filename = BPF_CORE_READ(bprm, filename);
void* arg_start = (void*)BPF_CORE_READ(task, mm, arg_start);
void* arg_end = (void*)BPF_CORE_READ(task, mm, arg_end);
void* env_start = (void*)BPF_CORE_READ(task, mm, env_start);
void* env_end = (void*)BPF_CORE_READ(task, mm, env_end);
unsigned int flags = BPF_CORE_READ(filp, f_flags);
struct inode* file_inode = BPF_CORE_READ(filp, f_inode);
umode_t mode = BPF_CORE_READ(file_inode, i_mode);
struct dentry* filp_dentry = BPF_CORE_READ(filp, f_path.dentry);
BPF_CORE_READ(child, pid), fork_data->payload);
fork_data->parent_pid = BPF_CORE_READ(parent, pid);
fork_data->parent_exec_id = BPF_CORE_READ(parent, self_exec_id);
fork_data->parent_start_time = BPF_CORE_READ(parent, start_time);
k_core_out = (long)BPF_CORE_READ(&k_core_in, next, next, func);
out->a_value = BPF_CORE_READ(in, a);
out->b_value = BPF_CORE_READ(in, b);
out->c_value = BPF_CORE_READ(in, c);
out->arr_value = BPF_CORE_READ(in, arr[0]);
out->s_value = BPF_CORE_READ(in, s.x);
out->valid[1] = BPF_CORE_READ(task,
out->valid[2] = BPF_CORE_READ(task,
out->valid[3] = BPF_CORE_READ(task,
out->valid[4] = BPF_CORE_READ(task,
out->valid[5] = BPF_CORE_READ(task,
out->valid[6] = BPF_CORE_READ(task,
out->valid[7] = BPF_CORE_READ(task,
out->valid[8] = BPF_CORE_READ(task,
out->valid[9] = BPF_CORE_READ(task,
if (BPF_CORE_READ(task, pid) != real_pid || BPF_CORE_READ(task, tgid) != real_tgid)
out->len = BPF_CORE_READ(read_ctx, len);
out->off = BPF_CORE_READ(read_ctx, off);
int tgid = BPF_CORE_READ(task, tgid);
sz = BPF_CORE_READ(read_ctx, len);
sz = BPF_CORE_READ(write_ctx, len);
if (!BPF_CORE_READ(t, pid) || !get_task_tgid((uintptr_t)t))
if (!BPF_CORE_READ(t, pid) || !get_task_tgid((uintptr_t)t))
return BPF_CORE_READ((struct task_struct *)(void *)t, tgid);
if (!BPF_CORE_READ(t, pid) || !get_task_tgid((uintptr_t)t))
if (!BPF_CORE_READ(t, pid) || !get_task_tgid((uintptr_t)t))
struct net_device *dev = BPF_CORE_READ((struct sk_buff *)skb, dev);
headroom = BPF_CORE_READ(dev, needed_headroom);
tailroom = BPF_CORE_READ(dev, needed_tailroom);