ebpf – Bootlin

Bootlin at Capitole du Libre in Toulouse, Nov 15-16

Capitole du Libre is the leading annual open-source and free software conference in Toulouse, France, and has been a key event in the community for over a decade. With offices based in Toulouse, Bootlin has been a long-time participant and active contributor to this event, and 2025 will be no exception.

Bootlin is part of the 4 Platine sponsors of the event, the highest sponsorship level
Bootlin will have a booth in the main hall of the conference, which will allow visitors to meet the Bootlin team, discuss Bootlin activities, career and internship opportunities, and more
Bootlin engineers will be giving a number of talks, related to Embedded Linux or not:
- Thomas Petazzoni will be giving a talk titled What’s new in the Linux kernel: a year of changes in review
- Alexis Lothoré and Maxime Chevallier will be delivering a hands-on workshop on Mastering eBPF and XDP: creating a high-performance ad blocker
- The same Alexis Lothoré will be talking about a more personal project: An Open-Source Blind Test from Start to Finish: When Free Software Makes Our Parties Buzz

Looking forward to meet you at Capitole du Libre in November!

The Dwarves Beneath the Kernel: Forging BTF for eBPF

This blog post is the third installment in our eBPF blog post series, following our posts about eBPF selftests and eBPF trampolines.

In the previous blog post, we discussed how eBPF trampolines are dynamically generated to allow hooking tracing programs to functions’ entry and/or exit. Each trampoline is tailored specifically for the target function on which we want to hook programs: it is then able to read the function context (e.g. function arguments and return value) and to pass those to the hooked programs. However there is one detail that we did not address: how does the trampoline generator know exactly about the function layout ? To be able to generate trampolines that can read and store the function arguments, the trampoline generator needs many details about each argument: the location (a register ? If so, which one ? Or maybe it is on the stack ? And if so, at which offset ?) and its size. Parsing the function machine code is not enough to learn about those, and even if it was, compiler optimizations would obfuscate this kind of info even more. What if besides the actual executable code, the kernel image could be bearing some data about its internal functions ? In this post, we will dive into the DWARF debug information format, and the BPF Type Format (BTF) derived from it to support such a purpose.

Continue reading “The Dwarves Beneath the Kernel: Forging BTF for eBPF”

Bouncing on trampolines to run eBPF programs

This blog post is the second installment in our eBPF blog post series, following our blog post about eBPF selftests.

As eBPF is more and more used in the industry, eBPF kernel developers give considerable attention to eBPF performance: some standard use cases like system monitoring involve hundreds of eBPF programs attached to events triggered at high frequencies. It is then paramount to keep eBPF programs execution overhead as low as possible. This blog post aims to shed some light on an internal eBPF mechanism perfectly showcasing those efforts: the eBPF trampoline.

Continue reading “Bouncing on trampolines to run eBPF programs”

Improving the eBPF tests in the kernel

As part of a partnership with the eBPF Foundation, Bootlin engineers Bastien Curutchet and Alexis Lothoré are working with the kernel community in order to improve eBPF support in the kernel on different aspects. This post is the first one of a series highlighting this effort. For those who need to catch up with the eBPF technology, you can take a look at our “Linux Debugging, tracing and profiling” training course which has been recently updated with eBPF basics !

Continue reading “Improving the eBPF tests in the kernel”

Linux 6.12 released, Bootlin contributions inside

Linux 6.12 has been released during the past week-end, pretty much as expected after 7 release candidates. As usual, we recommend our readers to go through the amazing LWN.net articles covering the 6.12 merge window (part 1, part 2) to get a high-level overview of the major new features and improvements in this 6.12 release. One of the prominent improvement in this release, as far as the embeded industry is concerned, is obviously the merge of the final bits enabling PREEMPT_RT… which already caused our Real-Time Linux with PREEMPT_RT training course to be updated.

As usual, Bootlin again contributed to this release: with 118 commits merged, we are again in the top 20 contributing companies! Also, in addition to contributing our own code, several of our engineers are also maintainers, and as part of this work those engineers review and merge patches from other contributors. As part of this effort, for this 6.12 release:

Alexandre Belloni, as the RTC and I3C subsystems maintainer, merged 29 patches from other contributors
Miquèl Raynal, as the MTD subsystem co-maintainer, merged 24 patches from other contributors
Grégory Clement, as the Marvell platform maintainer, merged 4 patches from other contributors

Overall, 13 active Bootlin engineers made contributions to this release, which on a total staff of 24 people, means that more than half of our team has contributed to the Linux kernel for 6.12, a good indication of our strong focus on Linux kernel development and upstreaming!

Continue reading “Linux 6.12 released, Bootlin contributions inside”

Debugging, tracing and profiling training updated with new eBPF content

Back in January 2023, we announced the availability of a new Bootlin training course “Linux debugging, profiling, tracing and performance analysis”, initially developed and taught by former Bootlin engineer Clement Léger. A year and a half later, the training course, now taught by Bootlin engineers Luca Ceresoli and Alexis Lothoré, is one of the most requested amongst Bootlin training courses.

Following the feedback received from many people who attended the course, we are happy to announce that a new version of the training is available and now includes a whole new part about eBPF technology !

Continue reading “Debugging, tracing and profiling training updated with new eBPF content”