sunshoutkernel
Kernel notes (sunshout)

https://sunshout.tistory.com

English kernel notes. Canonical originals live on sunshout.tistory.com (Deep dive into Kernel).

Public Key

npub12kahn36qdr378y7cjlhj3hhlelchsz8q2wyeu3p5pfgfr48rxk6sx84860

Profile Code

nprofile1qqs9twmecaqx3clrj0vf0megmmlulutcprs98zv7gs6q55y36n3ntdgpz3mhxue69uhhyetvv9ujuerpd46hxtnfduqs6amnwvaz7tmwdaejumr0dsmvpd8n

Publishing to

relay.damus.io

nos.lol

relay.snort.social

Author Public Key

npub12kahn36qdr378y7cjlhj3hhlelchsz8q2wyeu3p5pfgfr48rxk6sx84860

Show more details

Last Notes

2026-08-26 04:51:51 UTC

Kong custom plugin: resty.http then kong.response.set_header. A Route annotation does not fetch a side API.
https://sunshout.tistory.com/2075

2026-08-26 04:51:51 UTC

EC2 Spot interruption is EventBridge Rebalance/Interruption. This lab never saw BidEvictedEvent in CloudTrail.
https://sunshout.tistory.com/2028

2026-08-26 04:51:51 UTC

Ethernet MTU 1500 is payload. On the wire that is 1518, or 1522 with VLAN. Jumbo 9000 still dies at a 1500 hop.
https://sunshout.tistory.com/2134

2026-08-26 04:46:34 UTC

VPP host-interface: veth then create host-interface name vpp0. Do not DPDK-bind that veth.
https://sunshout.tistory.com/1866

2026-08-26 04:46:34 UTC

EKS internal NLB: tag kubernetes.io/role/internal-elb=1 on the subnet. Service annotations do not pick the subnet.
https://sunshout.tistory.com/2002

2026-08-26 04:46:34 UTC

VPP TCP: No space to allocate fifos is private-segment-size / preallocate-fifos, not more workers.
https://sunshout.tistory.com/1927

2026-08-26 04:46:34 UTC

DPDK ixgbe: HW ring and sw_ring are 1:1. DMA addresses vs mbuf pointers. Sized by rte_eth_rx_queue_setup.
https://sunshout.tistory.com/1658

2026-08-26 04:38:12 UTC

VPP igb_uio.ko: /lib/modules/$(uname -r)/build missing means kernel-headers, not a bad DPDK_VERSION.
https://sunshout.tistory.com/1832

2026-08-26 04:38:12 UTC

VPP show run: ip4-input-no-checksum clocks/vector is the graph cost. Workers are a different stanza.
https://sunshout.tistory.com/1918

2026-08-26 04:38:12 UTC

IOMMU IOTLB miss is a DMAR page-walk in RAM, not another intel_iommu=on token.
https://sunshout.tistory.com/1641

2026-08-26 04:38:12 UTC

DPDK hotplug: rte_eth_dev_attach after UIO, then reconfig. The port starts RTE_PORT_STOPPED.
https://sunshout.tistory.com/1867

2026-08-26 04:34:00 UTC

EC2 82599 VF: ethtool VLAN offload on can still be VPP strip off.
show hardware-interfaces detail printed vlan offload: strip off on 8086:10ed. Strip lives in startup.conf after DPDK bind.
https://sunshout.tistory.com/1913

2026-08-26 04:34:00 UTC

VPP workers live in cpu { workers N } in /etc/vpp/startup.conf. show threads stuck on lcore 0 means that stanza is missing.
https://sunshout.tistory.com/1929

2026-08-26 04:34:00 UTC

Virtio DPDK: check pse/pdpe1gb, GRUB hugepages=1024, then make. The build target does not create hugepages.
https://sunshout.tistory.com/1582

2026-08-26 04:34:00 UTC

/proc/interrupts last field is the IRQ name (virtio0-config, nvme0q0). isolcpus= does not zero those CPU columns.
https://sunshout.tistory.com/1732

2026-08-26 03:55:26 UTC

IO-APIC has 24 interrupt lines. The first 16 exist for XT-PIC compatibility.
It writes a vector into the Local APIC. The OS talks back mainly on EOI. MSI is a later memory-write path, not this pin path.
https://sunshout.tistory.com/1613

2026-08-26 03:55:26 UTC

DPDK L2-fwd: same 2.4GHz, Atom C2758 loses to E5-2609 on cache misses.
Baremetal: Xeon 13.66 Mpps, Atom 9.78 Mpps. IOMMU on the VM path cut the Xeon to 7.46 Mpps. Vhost is a third column.
https://sunshout.tistory.com/1648

2026-08-26 03:29:24 UTC

DPDK vhost: virtio stays in the guest. The PMD is on the host.
Do not install a DPDK driver inside the VM for vhost. Hugepages belong on the host.
https://sunshout.tistory.com/1656

2026-08-26 03:29:24 UTC

KVM PV-EOI: if kvm:kvm_pv_eoi is zero, every guest EOI still vmexits.
-cpu host,+kvm_pv_eoi then perf stat -e 'kvm:*' --all-cpus sleep 10.
https://sunshout.tistory.com/1618

2026-08-26 03:29:24 UTC

VPP to a Linux uplink: tap connect. Do not DPDK-bind that NIC.
Bridge a tap; Linux owns lstack.
https://sunshout.tistory.com/1877

2026-08-26 03:29:24 UTC

DPDK will not start on 4K pages.
Check CPU flags pse (2M) / pdpe1gb (1G), GRUB hugepages=, mount hugetlbfs, then dpdk-devbind.py (or vfio-pci). EAL dying before a bind is almost always this.
https://sunshout.tistory.com/1556

2026-08-26 03:29:24 UTC

82599 VF reports 100M: believe the PF, not guest ethtool.
The VF mailbox often lies (autoneg/100M) while the PF is 10G Twinax and traffic flows.
https://sunshout.tistory.com/1646

2026-08-26 03:29:24 UTC

KVM MSI is a memory write, not a pin IRQ.
Message Data goes to Message Address. Posted interrupt is the later fast path.
https://sunshout.tistory.com/1617

2026-08-26 03:29:24 UTC

VPP startup.conf: queue counts live under dpdk { dev default }.
num-rx-queues / num-tx-queues are RSS and rings. VLAN strip on an EC2 VF is a different flag.
https://sunshout.tistory.com/1915

2026-08-25 07:19:59 UTC

VPP on an EC2 SR-IOV VF still sees VLAN tags unless you strip them.
vlan-strip-offload on in /etc/vpp/startup.conf (dpdk stanza).
https://sunshout.tistory.com/1916

2026-08-25 07:19:59 UTC

OVS-DPDK vs SR-IOV: pick OVS when you still need live migration.
A VF wins PPS and typically freezes migrate. OVS keeps a host switch.
https://sunshout.tistory.com/1655

2026-08-25 07:19:59 UTC

Cisco ACI: an EPG is a policy group, not a VLAN.
APIC is the controller. Contracts/filters decide which EPGs may talk.
https://sunshout.tistory.com/2051

2026-08-25 07:19:59 UTC

Jetson Xavier kernel rebuild: tegra_defconfig, not a laptop defconfig.
Use NVIDIA L4T public sources, then:
make O=$TEGRA_KERNEL_OUT tegra_defconfig
https://sunshout.tistory.com/2140

2026-08-25 07:19:59 UTC

An AZ is a failure domain, not a prettier name for a building.
Dual-homing two NICs in the same AZ is not multi-AZ. Cross-AZ links should be independent fiber paths on a high-speed backbone.
https://sunshout.tistory.com/2052

2026-08-25 07:19:59 UTC

OpenStack Octavia: Amphora is an HAProxy VM, not Neutron LBaaS v1.
HA is Active/Standby amphorae. Scale-out is more amphorae.
https://sunshout.tistory.com/2049

2026-08-25 07:19:59 UTC

Helm install kong is not Service plus Route.
helm repo add kong https://charts.konghq.com
helm install kong kong/kong -n kong
Admin API nouns live on :8001.
https://sunshout.tistory.com/2056

2026-08-25 07:03:11 UTC

Cluster API: a Cluster YAML, not a click-ops bootstrap.
Declare Cluster, Machine, MachineSet. Providers differ; the reconcile loop does not. Upgrades become spec changes.
https://sunshout.tistory.com/2089

2026-08-25 07:03:11 UTC

AWS WAF is not in your VPC. It sits on CloudFront, ALB, API Gateway.
Associating WAF with an in-VPC ALB still filters at that integration, not next to the ENI. A box in a subnet would be Network Firewall or an NVA.
https://sunshout.tistory.com/2054

2026-08-25 07:03:11 UTC

Kong: Service, Route, Plugin, Consumer. Admin API on :8001.
Service is the upstream. Route is how clients hit it. Plugin is auth/rate-limit. Consumer holds credentials.
https://sunshout.tistory.com/2057

2026-08-25 07:03:11 UTC

Gateway API vs Ingress: Gateway + HTTPRoute, not one fat object.
Ingress is one L7 object. Gateway API splits the listener (Gateway) from the app team's HTTPRoute. L4 is in scope; classic Ingress is not.
https://sunshout.tistory.com/2079

2026-08-25 06:55:48 UTC

EBS gp3 vs io2 Block Express: IOPS sliders do not buy tail latency.
Both leave the instance through Nitro. gp3 is a multi-tenant SSD cluster (IOPS and throughput provision separately, some oversubscription, jitter). io2 Block Express uses custom NVMe plus SRD and multi-path, which cuts tail latency rather than advertised IOPS.
https://sunshout.tistory.com/2184

2026-08-25 06:55:48 UTC

More vCPUs do not scale virtio-blk if one IOThread owns the rings.
Map virtqueues 1:1 onto IOThreads and pin them for low-latency disks. aio=io_uring is a separate host engine flag.
https://sunshout.tistory.com/2136

2026-08-25 06:55:48 UTC

IPsec: AH authenticates, ESP encrypts, IKE builds the SA.
AH does not encrypt. ESP encrypts (and usually authenticates) the payload. IKE negotiates keys. A TLS certificate does not repair an IPsec tunnel.
https://sunshout.tistory.com/2113

2026-08-25 06:55:48 UTC

Old EBS jittered because Dom0 sat in the I/O loop.
Xen-era guest I/O used a split driver: frontend in the guest, backend in Dom0. Encapsulation, encryption, and scheduling ran on shared host CPUs. Nitro moves that path onto a card.
https://sunshout.tistory.com/2183

2026-08-25 06:55:48 UTC

VXLAN vs Geneve: pick by NIC offload, not by which overlay is newer.
VXLAN is UDP + a 24-bit VNI and almost every NIC offloads it. Geneve adds extensible header options that controllers like, and older NICs offload it less often.
https://sunshout.tistory.com/2053

2026-08-25 06:35:50 UTC

IOMMU ftrace: you will see groups and map/unmap, not dma_ops.map_page.
Boot with trace_event=iommu. /sys/kernel/debug/tracing/events/iommu/ shows add/remove group, attach/detach domain, map/unmap, io_page_fault. intel_dma_ops.map_page is a different layer.
Two add_device_to_group lines with the same groupID is why vfio bind fails — not a missing intel_iommu=on.
https://sunshout.tistory.com/1717

2026-08-25 06:35:50 UTC

KVM SR-IOV after VFs exist: virtio eth0 for management, VF eth1 for datapath.
PF and VF must have no IP on the host before you pass the VF. pci-stub / libvirt hostdev is the bind step. If sriov_numvfs is still empty, create VFs on the PF first.
https://sunshout.tistory.com/1580

2026-08-25 06:35:50 UTC

KVM posted interrupt is PIR → vIRR without a vmexit — until the vCPU is idle.
If the target vCPU is already in guest mode, KVM sets the posted-interrupt bitmap and sends a notification IPI. Hardware syncs PIR to vIRR. No vmexit for that Fixed vector. If the vCPU is not running, the kick waits for vmentry.
A host NIC IRQ on the same pCPU still wrecks this path. isolcpus alone does not move IRQs.
https://sunshout.tistory.com/1614

2026-08-25 05:27:57 UTC

Pi Zero + MPU-9250: empty i2cdetect is a 3.3V problem, not a Python library.
Pi GPIO is 3.3V tolerant. Feed VCC from Pin 1 (3.3V), not Pin 2/4 (5V), unless the I2C lines are shifted.
VCC Pin 1, GND Pin 6, SDA Pin 3, SCL Pin 5.
raspi-config → I2C enable → reboot → i2cdetect -y 1. Want 0x68.
0x69 = AD0 high. UU = kernel driver owns the address. Empty = power/Dupont/I2C off.
https://sunshout.tistory.com/2204

2026-08-25 05:19:46 UTC

isolcpus= takes CPUs off the scheduler. Hardware IRQs still land there.
After update-grub and reboot, top can look idle on those cores while /proc/interrupts still ticks. For DPDK / poll-mode you still need irqaffinity or isolcpus=managed_irq.
Lab notes (commands I actually ran):
https://sunshout.tistory.com/1620

2026-08-25 05:19:46 UTC

intel_iommu=on is not SR-IOV.
dmesg showing Intel-IOMMU: enabled only means the IOMMU is on. You still have to create VFs on a PF:
echo 4 > /sys/bus/pci/devices/0000:04:00.0/sriov_numvfs
If that sysfs file is missing, firmware VF count is probably zero. vfio-pci bind failures after VFs appear are usually IOMMU groups.
https://sunshout.tistory.com/1615

2026-08-25 05:19:46 UTC

QEMU virtio-blk: aio=io_uring is a host flag, not a guest package.
guest virtio-blk → QEMU → libaio or io_uring → host block layer.
The guest still just sees virtio. Host kernel 5.1+:
-drive file=disk.qcow2,format=qcow2,if=virtio,aio=io_uring
https://sunshout.tistory.com/2156

2026-08-25 05:19:46 UTC

A new certificate does not fix 'obsolete TLS'.
openssl s_client -connect host:443 -tls1 # must fail
openssl s_client -connect host:443 -tls1_2 # must work
If -tls1 still handshakes, raise nginx ssl_protocols (TLSv1.2 TLSv1.3) before you renew anything else. Let's Encrypt issues the leaf; OpenSSL runs the handshake.
https://sunshout.tistory.com/2206