Resource Limits The Linux kernel has protective mechanisms to prevent processes from consuming excessive memory. Since BPF maps can consume a significant amount of memory, they are also subject to these mechanisms. rlimit (Resource Limit) <span>rlimit</span> (resource limit) is a system mechanism used to track and limit the amount of specific resources that a process … Read more
Abstract The BPF subsystem in Linux has gained two significant capabilities before the 6.18 merge window:BPF Program Signing (signed BPF) and Deferred Task Context Execution. The signing mechanism provides assurance of the source and integrity of BPF programs loaded into the kernel, paving the way for allowing unprivileged users to load audited BPF programs in … Read more
More content can be added to the Linux system knowledge base package (tutorials + videos + Q&A). Table of Contents 1. Specifying the ftrace Tracer 2. Setting the Functions to Trace 3. ftrace Switches 4. Viewing the Trace 5. Using trace-cmd 6. Common Options for trace-cmd 6.1. Viewing Available Trace Events 6.2. Tracing Function Calls … Read more
Previously, in the article on easily hooking Linux kernel functions using Ftrace, we introduced how to use ftrace (function trace) to hook kernel functions. Through the ftrace mechanism, we can specify a callback function that we write for the kernel function we want to hook. When the target function is called, the kernel automatically invokes … Read more
Previously, an article analyzed the reasons for packet loss in bonded network interfaces and their solutions. This article will detail the root causes of packet loss in bonded network interfaces and dynamically analyze the kernel using the bpftrace tool. We will also use dropwatch to observe packet loss in the kernel: Packet loss occurs in … Read more