Debugging with eBPF on Arm Platforms
summary
Shows eBPF deployed on Arm to do live kernel debugging and lightweight profiling, with concrete builds: a memory‑leak detector that tracks malloc/free via maps of pointer → stack and a scheduler profiler correlating modules by tracing calls. Uses kprobe/tracepoint attach and user tools (BCC, tracepoint.py, perf) with clang/LLVM compilation to emit eBPF bytecode; notes verifier limits, cross‑compile pain, and that 1 GB images are too small on embedded boards. The examples run and expose actionable leak and latency data.
AI-written summary · about
chapters (27)
- 0:00Introduction
- 2:22Extending the Berkeley Packet Filter
- 6:17Using eBPF for debugging - cont.
- 8:30Debugging with eBPF versus tracing
- 9:40libbpf: helper functions for eBPF
- 10:36Coding for eBPF in assembler
- 13:14Kernel samples
- 14:28Sample code: trace kmem_cache alloc_node
- 16:11Ply: light dynamic tracer for eBPF
- 17:36System call (sys_exit) failure statistics in ply
- 17:57Build ply
- 18:25BPF Compiler Collection (BCC)
- 20:19BCC example code
- 21:23BCC and embedded systems
- 23:06System Tap - eBPF backend
- 24:07System Tap - Revenge of the verifier
- 25:35BPFtrace - high level tracing language for eBPF
- 26:38BPFtrace with data structure support
- 27:28Build BPFtrace
- 28:02perftrace with eBPF event
- 29:09perf with eBPF program profiling
- 30:28Build perf
- 31:06The story - Hunting leaks
- 32:24The story - Debug kernel functions at the runtime
- 34:10Debug kernel functions - cont.
- 34:41Statistics based on function arguments
- 35:39Summary (and thank you)
related talks
36mDebugging with eBPF on Arm Platforms
42mKernel Analysis Using eBPF
38mLinux Kernel Tracing Using eBPF
38mThe Next Linux Superpower: eBPF Primer
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
25mKernel tracing with BPF
32mDeveloping eBPF profiler for polyglot cloud-native appli...
46mReal World Debugging with eBPF