I was expecting that pwru is able to track BPF helpers called by XDP progs when running with --filter-trace-xdp --filter-track-bpf-helpers. That turned to be not the case.

The --filter-track-bpf-helpers relies on attaching the kprobe_skb_by_stackid kprobe to the BPF helper functions. The latter is implemented by --filter-track-skb-by-stackid and friends.

In order to track BPF helpers from XDP, we need to extend --filter-track-skb-by-stackid to support XDP. Its kprobe calls kprobe_skb(..) https://github.com/cilium/pwru/blob/v1.0.8/bpf/kprobe_pwru.c#L542 (and later on handle_everything(...)). Both do expect to get an skb addr as param, which is not available for XDP. We should probably refactor the kprobe_skb and handle_everything to make it generic. Afterwards, the tracking should work.