On Mon, Nov 30, 2020 at 2:52 PM Andrii Nakryiko
[off-list ref] wrote:

On Sat, Nov 28, 2020 at 5:59 PM Alexei Starovoitov
[off-list ref] wrote:

quoted

On Fri, Nov 20, 2020 at 06:46:14PM -0800, Andrii Nakryiko wrote:

quoted

 SEC("raw_tp/bpf_sidecar_test_read")
-int BPF_PROG(test_core_module,
+int BPF_PROG(test_core_module_probed,
           struct task_struct *task,
           struct bpf_sidecar_test_read_ctx *read_ctx)
 {

@@ -64,3 +64,33 @@ int BPF_PROG(test_core_module,

      return 0;
 }
+
+SEC("tp_btf/bpf_sidecar_test_read")
+int BPF_PROG(test_core_module_direct,
+          struct task_struct *task,
+          struct bpf_sidecar_test_read_ctx *read_ctx)

"sidecar" is such an overused name.

How about "sidekick"? :) Its definition matches quite closely for what
we are doing with it ("person's assistant or close associate,
especially one who has less authority than that person.")?

But if you still hate it, I can call it just "bpf_selftest" or
"bpf_test" or "bpf_testmod", however boring that is... ;)

bpf_testmod sounds the best to me :)