Ply: Lightweight BPF Tracing
summary
Ply provides a small C-based front end for eBPF that targets targets 32-bit ARM and PowerPC, avoids the no LLVM/BCC dependency and ships in Buildroot so you can produce a BeagleBone Black image that boots and runs examples. It attaches to kernel entry/exit probes and static tracepoints (not userspace), needs kernel ≳4.9 with ftrace/kprobe options enabled, and runs scripts like open snoop, exec snoop and a brk heap allocation quantize that shows most allocations in the 4–8KB bucket.
AI-written summary · about
chapters (20)
- 0:00Start
- 0:51Agenda
- 1:40What Is Ebpf
- 2:10Ebpf
- 3:12How Does Ebpf Work
- 5:33Microsoft Is Porting Ebpf to Windows
- 10:16Dynamic Instrumentation
- 12:48Instrument the Entry into Kernel Functions
- 13:20Static Trace Points
- 15:39Enabling Ebpf in this Kernel
- 18:11Adding Ply to the Build Root Image
- 18:56What Does Ply Need To Build and Run
- 19:37What Features We Need Enabled in the in the Kernel To Use Ebpf
- 20:30Command Line Options
- 23:07Output
- 24:18Ply Syntax
- 26:50Global Variables
- 31:38Aggregations
- 34:24Open Snoop
- 41:53Heap Allocation
related talks
47mDive into BPF performance tools using python
27mBeyond printf & tcpdump: Debugging Kubernetes Networking with eBPF
25mPowering Observability with Simple, Sharable, EBPF Programs
38mMy First Monitoring with eBPF
11mFetchBPF: Customizable Prefetching Policies in Linux with eBPF
08mLightning Talk: BTFGen: one Step Closer to Truly Portable eBPF Programs
37mKernel and userspace tracing with LTTng and friends
23mSecuring Your Software Delivery Chain with Process Auditing