Debugging with eBPF on Arm Platforms
summary
eBPF on Arm is practical for low‑overhead kernel debugging using kprobes and tracepoints to attach tiny programs and export state via maps, demonstrated by a working memory‑leak detector that correlates alloc/free sites and reports live allocations. Tooling uses BCC and bpftrace or raw LLVM/Clang cross‑compile plus libbpf, requires matching kernel headers and significant build disk and RAM, and generally reduces trace volume by doing aggregation in‑kernel rather than streaming raw traces.
AI-written summary · about
chapters (8)
- 0:00eBPF and Arm platforms intro
- 2:13What is eBPF and evolution
- 8:10eBPF debugging differences
- 13:15Writing eBPF with BCC
- 21:16eBPF compilation challenges
- 25:20eBPF kernel tracing & memory
- 30:07Advanced eBPF tracing
- 35:45Conclusion & Q&A
related talks
36mDebugging with eBPF on Arm Platforms
42mKernel Analysis Using eBPF
25mKernel tracing with BPF
38mLinux Kernel Tracing Using eBPF
27mLow-Overhead Tracing Using eBPF for Observability into Kubernetes Apps and Services
38mThe Next Linux Superpower: eBPF Primer
36mObservability and performance analysis with BPF
51meBPF Warfare - Detecting Kernel & eBPF Rootkits with Tracee