Leon Hwang

It's interesting to compile libpcap-like expression to JIT'ed eBPF insns, and make them work with `pwru` existing eBPF insns. How about `bpf_tail_call()`? Get the `skb` first, then `bpf_tail_call()` the JIT'ed...

> Could you attach the object file pwru/kprobepwru_bpfel.o How to attach it?

Oh, sorry, I misunderstand the 'attach'. Attach the kprobes in object file to kernel. Here it is. [kprobepwru_bpfel.o.txt](https://github.com/cilium/pwru/files/7619666/kprobepwru_bpfel.o.txt) (Can't upload the .o file, plz remove the suffix .txt to get...

How about supporting tc-bpf together?

> Do you mean tracing each individual BPF program? Yes. Recently, I discussed with @jschwinger233 that `pwru` traces XDP and tc-bpf. I was writing some code at that time. But,...

Yeah, small world 😀 I'm afraid I can not help this issue for some time. I'm planning to do tailcalls tracing things after fixing the kernel-bpf bug.

Hi @brb , I'm glad to tell you that I just finished the POC of tracing TC bpf programs. But, it's based on PR #266 and the latest go-ebpf library....

> is it the same as Gray's one No. I trace TC bpf programs by listing then filtering all bpf progs. Would you like to upgrade go-ebpf to latest version?

Hi, @brb, I will work on it when my PRs get merged. It'll be nice to work on it without other on-going PRs.

> bpf prog tag is not unique Yes, the tag is not unique. [bpf_prog_calc_tag](https://github.com/torvalds/linux/blob/v6.6/kernel/bpf/core.c#L280) How about name -> addr instead of tag -> addr? I think, it's to map addr...