Debuggers and eBPF - Bringing Debugging to Production

This talk explains how eBPF can complement source-level debuggers with low-overhead tracing in production environments. It covers implementation details, performance tradeoffs, and practical constraints such as the eBPF verifier.

Syllabus

Introduction
Overview
Derek Parker
Why
PTrace
Testing
Why is ptrace so slow
Solution eBPF
Benchmarks
Why is eBPF so fast
eBPF requirements
Embedded eBPF
Lowlevel implementation details
Ring buffers and maps
eBPF information
eBPF probes
Updating eBPF map
Getting data back from eBPF
Upsides and downsides
eBPF programs
Fighting the verifier
Small stack requirements
Limited control flow
Rep probes