On Fri, Nov 20, 2020 at 06:46:14PM -0800, Andrii Nakryiko wrote: > > SEC("raw_tp/bpf_sidecar_test_read") > -int BPF_PROG(test_core_module, > +int BPF_PROG(test_core_module_probed, > struct task_struct *task, > struct bpf_sidecar_test_read_ctx *read_ctx) > { > @@ -64,3 +64,33 @@ int BPF_PROG(test_core_module, > > return 0; > } > + > +SEC("tp_btf/bpf_sidecar_test_read") > +int BPF_PROG(test_core_module_direct, > + struct task_struct *task, > + struct bpf_sidecar_test_read_ctx *read_ctx) "sidecar" is such an overused name. I didn't like it earlier, but seeing that it here again and again I couldn't help it. Could you please pick a different name for kernel module? It's just a kernel module for testing. Just call it so. No need for fancy name.