Background In a BPF program, we use a BPF_MAP_TYPE_PERF_EVENT_ARRAY map to communicate with userspace. Initially, for our BPF program, we set the locked memory limit to be infinity: struct rlimit ...

Introduction bpftrace is a high-level tracing language for Linux enhanced Berkeley Packet Filter (eBPF). I found it very useful for debugging issues as well as understanding kernel code. In this po...

I got an interesting issue while debugging a BPF program. The BPF program couldn’t be loaded because of an “invalid memory access” error. Though the access was completely within the valid memory bo...

Summary Recently, I submitted my first kernel patch. I will note down the basic workflow of submitting code to kernel in this post. This folder contains more detailed instructions on how to become ...

Summary Recently, I submitted my first kernel patch. One of the lessons I learned is that kernel mail server doesn’t accept HTML content in emails. To make sure my email contains absolutely no HTML...

Introduction Among all BPF map types, two special ones, BPF_MAP_TYPE_ARRAY_OF_MAPS and BPF_MAP_TYPE_HASH_OF_MAPS, are more complex than others. As the names imply, they are “map-in-map”, meaning th...

TL;DR Recently, I solved a tricky bug in a BPF program. Because inline instead of always_inline was used to declare a function, when the function body grew big, the compiler decided to not inline i...

Preface A few days back, one of my friends asked an interesting question - How is ping deduplexed by Linux kernel network stack? In other words, when a Linux machine receives the ping reply, how do...

Overview Linux bridge can set flags on a port. The defined flags (until Linux 4.0) are: #define BR_HAIRPIN_MODE BIT(0) #define BR_BPDU_GUARD BIT(1) #define BR_ROOT_BLOCK BIT(2) #de...

Overview We talked about what is a bridge (switch) and how it works here and here. However, we only saw the topology in which one bridge is used to merge LANs. In real life, redundancy is always ne...