Alexis Lothoré – Bootlin

A safety net for eBPF: adding KASAN support to JITed programs

The eBPF technology implemented in the Linux kernel keeps on gaining traction in various areas: infrastructure, observability, security, debugging, and many more. Its wider adoption reinforces one core concept that drives its development: it must be safe for the kernel to load an eBPF program, and so a program that cannot be proven to be safe must be rejected. This fundamental concept led to the development of some complex mechanisms such as the BPF verifier; but this guarantee is not foolproof: the verifier is written in C and can have the same kinds of bugs as the rest of the kernel. Addressing this kind of risk is a key strategy for Alpha-Omega, which is funding initiatives to improve the security and safety of widely used software projects and technologies. Alpha-Omega allocated a grant to the eBPF Foundation, which teamed up with Bootlin, to improve the security and safety of the eBPF technology by implementing KASAN support in eBPF programs, with the goal of enabling better detection of memory-safety issues for eBPF subsystem developers.

Continue reading “A safety net for eBPF: adding KASAN support to JITed programs”

Linux 7.3 released, Bootlin contributions inside

Tux Linus Torvalds has released the 7.3 kernel last Sunday afternoon. LWN once again covered extensively the content of this new version through two merge window posts (see part 1 and part 2). This release continues the record-breaking spree started a few releases ago, with 18,765 non-merge commits from 3,021 developers, with plenty of first-time kernel contributors. You can find more details and facts about this release in the 7.3 coverage from LWN.

Continue reading “Linux 7.3 released, Bootlin contributions inside”

Linux 7.2 released, Bootlin contributions inside

Tux Linux 7.2 has been released last Sunday afternoon. You can take a look at the whole content of this new version thanks to LWN merge window posts (see part 1 and part 2). As stated by Linus Torvalds himself, the final week of this release has not been a peaceful endeavour (with some late reverts being needed), but this phenomenon seems to be slowly becoming “the new normal thing”. You can find more details and facts about this release in the 7.2 coverage from LWN.

Continue reading “Linux 7.2 released, Bootlin contributions inside”

Poison, redzones and shadows: inside KASAN

Even if the presence of Rust is slowly increasing in the Linux kernel code base, the project largely remains written in C, and while this is the de facto language to write low level code, it unfortunately also comes with a significant ability of making mistakes, with the corresponding failures then coming in a wide variety of shapes: undefined behaviors, buffer overflows, segmentation faults… The kernel is not immune to such issues, and so kernel developers need some dedicated tooling to catch those issues early. As many problems have their roots in memory management, one tool that can legitimately sit in any kernel hacker toolbox is the Kernel Address Sanitizer, or KASAN for short. This blog does not aim to teach readers how to use KASAN: the kernel documentation is pretty explicit on this matter. We are rather going to explore KASAN internals, mostly to understand its impact (both at build time and at runtime), but up to some extent, to appreciate the elegant engineering involved in its implementation!

Continue reading “Poison, redzones and shadows: inside KASAN”

eBPF at LSFMMBPF 2026

As part of a project I am currently working on at Bootlin, I had the opportunity to attend the Linux Storage, Filesystem, Memory Management and BPF conference (enough of a mouthful to shorten to LSFMMBPF !) earlier in May. The conference took place this year in Zagreb from May 4th to May 6th, and was a fantastic opportunity to meet people working in deep technical topics in the Linux kernel.

Continue reading “eBPF at LSFMMBPF 2026”

Linux 7.1 released, Bootlin contributions inside

Linux 7.1 was released Tux earlier this week. As usual, the best source of information about the content of this new version will be LWN, see merge windows posts, part 1 and part 2 . This release is a bit outstanding, as it is one of the largest in kernel history, considering commits count. It also highlights a trend that has been visible since 7.0: the number of first-time contributors is increasing a lot. You can find some comments about this tendency in the 7.1 coverage from LWN.

This time again, Bootlin has been very active, as no less than 116 commits were contributed by Bootlin engineers, making the company rank at 21th according to the Linux Kernel Patch Statistics.

Continue reading “Linux 7.1 released, Bootlin contributions inside”

Bootlin at Capitole du Libre 2025

The 2025 edition of Capitole du Libre took place in Toulouse, France on November, 15th and 16th this year, and as in previous years, Bootlin was actively involved through a variety of contributions.

The Capitole du Libre is a major conference about Free Software in the south of France, even attracting people from other countries. This is an important opportunity for local actors to meet and share their interests and contributions to Open Source Software.

Continue reading “Bootlin at Capitole du Libre 2025”

The Dwarves Beneath the Kernel: Forging BTF for eBPF

This blog post is the third installment in our eBPF blog post series, following our posts about eBPF selftests and eBPF trampolines.

In the previous blog post, we discussed how eBPF trampolines are dynamically generated to allow hooking tracing programs to functions’ entry and/or exit. Each trampoline is tailored specifically for the target function on which we want to hook programs: it is then able to read the function context (e.g. function arguments and return value) and to pass those to the hooked programs. However there is one detail that we did not address: how does the trampoline generator know exactly about the function layout? To be able to generate trampolines that can read and store the function arguments, the trampoline generator needs many details about each argument: the location (a register? If so, which one? Or maybe it is on the stack? And if so, at which offset?) and its size. Parsing the function machine code is not enough to learn about those, and even if it was, compiler optimizations would obfuscate this kind of info even more. What if besides the actual executable code, the kernel image could be bearing some data about its internal functions? In this post, we will dive into the DWARF debug information format, and the BPF Type Format (BTF) derived from it to support such a purpose.

Continue reading “The Dwarves Beneath the Kernel: Forging BTF for eBPF”

Bouncing on trampolines to run eBPF programs

This blog post is the second installment in our eBPF blog post series, following our blog post about eBPF selftests.

As eBPF is more and more used in the industry, eBPF kernel developers give considerable attention to eBPF performance: some standard use cases like system monitoring involve hundreds of eBPF programs attached to events triggered at high frequencies. It is then paramount to keep eBPF programs execution overhead as low as possible. This blog post aims to shed some light on an internal eBPF mechanism perfectly showcasing those efforts: the eBPF trampoline.

Continue reading “Bouncing on trampolines to run eBPF programs”

Improving the eBPF tests in the kernel

As part of a partnership with the eBPF Foundation, Bootlin engineers Bastien Curutchet and Alexis Lothoré are working with the kernel community in order to improve eBPF support in the kernel on different aspects. This post is the first one of a series highlighting this effort. For those who need to catch up with the eBPF technology, you can take a look at our “Linux Debugging, tracing and profiling” training course which has been recently updated with eBPF basics !

Continue reading “Improving the eBPF tests in the kernel”