In this talk, I will show you how to build and deploy ply (a dynamic tracing language for eBPF) to a BeagleBone Black then write ply scripts to attach probes and tracepoints to a running kernel and application on that same target. eBPF has rapidly eclipsed all previous tracers for Linux. While eBPF has taken the cloud native community by storm, the technology has yet to make significant inroads within the embedded Linux ecosystem. I will explain the reasons for this current situation and demonstrate a possible way forward.

The bpftrace dynamic tracing language relies on the LLVM-based BCC toolchain to compile scripts down to eBPF bytecode. Because of its dependency on LLVM, BCC only supports a few 64-bit CPU architectures, severely limiting the use of eBPF in embedded systems. Fortunately, the IO Visor Project offers a lightweight alternative to bpftrace called ply. Like bpftrace, ply’s syntax is inspired by both DTrace and awk. Unlike bpftrace, ply targets embedded CPU architectures like ARM and PowerPC making it possible to deploy eBPF to many more devices. Buildroot includes ply as of its 2021.02 LTS release.