# Marek Majkowski Published articles for Marek Majkowski. This is one page of public article previews, not the complete archive. Follow Next page to continue. Summaries are not the original full articles. ## Orange FTTH and IPv6 - part two DevFeed: [Orange FTTH and IPv6 - part two]() Original publisher: [Read original article]() Author: Marek Published: 2023-03-31T22:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Linux](), [Debian]() Tags: [debian](), [guide](), [ipv6](), [linux](), [pppoe](), [router]() ### AI overview A follow-up guide explains how to configure a custom Linux router for Orange FTTH with both IPv6 and IPv4. It describes why using two PPPoE sessions no longer works and presents the Funbox-compatible approach using an IPv6 PPPoE session and an IPIP DS-Lite tunnel. ### Source excerpt Orange FTTH and IPv6 - part two Three years ago I published a guide on how to configure a custom Linux router to work with Orange FTTH setup: The most important part was getting IPv6 working, since it wasn't possible with the "Funbox" router supplied by the carrier. This seem to have been fixed. In past when using "Funbox", and when setting the PPPoE username suffix to "/ipv6" to enable IPv6, the suffix was automatically dropped every ~24h, and reverted to IPv4-only. ## Diagnosing VR stutter with an eGPU on a laptop DevFeed: [Diagnosing VR stutter with an eGPU on a laptop]() Original publisher: [Read original article]() Author: Marek Published: 2022-09-04T22:00:00Z Content type: opinion Language: en Sources: [Marek Majkowski]() Topics: [GPU](), [Nvidia](), [pcie](), [webgpu](), [Windows](), [debug]() Tags: [debugging](), [gpu](), [graphics](), [laptop](), [nvidia](), [pcie](), [performance](), [thunderbolt](), [windows]() ### AI overview A laptop-based eGPU setup with an Nvidia 3080 caused severe stuttering in HTC Vive VR games despite the GPU functioning correctly. The article attributes the issue, with uncertainty, to Nvidia Optimus polling the laptop's other graphics hardware and interfering with smooth eGPU rendering. ### Source excerpt eGPU stutter from hell I was able to put my hands on an HTC Vive VR headset. Sadly, my computers don't have a strong enough GPU for VR. Since I only have laptops I decided to secure an eGPU (external GPU) - a box with PCIe bus, connected over thunderbolt, which can house a proper big graphics card. I got Razer Core X. ## Branch predictor: How many "if"s are too many? Including x86 and M1 benchmarks! DevFeed: [Branch predictor: How many "if"s are too many? Including x86 and M1 benchmarks!]() Original publisher: [Read original article]() Author: Marek Published: 2021-05-05T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [x86](), [Cloudflare]() Tags: [architecture](), [article](), [benchmarks](), [blog](), [cloudflare](), [discussion](), [hacker-news](), [travis](), [x86]() ### AI overview The article examines how many conditional branches affect branch prediction, with benchmarks covering x86 and M1 systems. It also points to discussions about BTB behavior, M1 branch-predictor interactions with the iCache prefetcher, and related commentary. ### Source excerpt Branch predictor: How many "if"s are too many? Including x86 and M1 benchmarks! I published an article on Cloudflare blog: Notable discussions mentioning this work: - Looking at BTB behavior and size: a comment on my work from Travis Downs, followed by response from Linus Torvalds. - Discussion on M1 architecture, with fascinating take on branch predictor interactions with iCache prefetcher. - Hacker News commentary ## Orange FTTH on a custom router DevFeed: [Orange FTTH on a custom router]() Original publisher: [Read original article]() Author: Marek Published: 2020-08-01T22:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Network Configuration](), [Debian](), [Network](), [Firewall](), [DHCP](), [huawei]() Tags: [debian](), [dhcp](), [firewall](), [ftth](), [huawei](), [interfaces](), [internet](), [iptables](), [ipv4](), [ipv6](), [mikrotik](), [network](), [pppoe](), [router](), [server](), [vlan]() ### AI overview A tutorial describing how to replace Orange's FunBox 3.0 with a custom Debian router for Orange FTTH in Poland. It covers obtaining an ONT and PPPoE credentials, configuring VLAN 35 and PPP, setting up iptables, and providing DHCP for the local network. ### Source excerpt Orange FTTH on a custom router Here in Poland, Orange has a decent FTTH offer - less than $16 for 300Mbit down, 50Mbit up. People reversed it over the years, most impressively Pierre Kim in 2016: Recently, it has been possible to replace the router the provider gives, called "FunBox 3.0", with a custom one. There are couple of reasons for that: - My understanding it's impossible to get a stable IPv6 on FunBox 3. - FunBox is proprietary and evil. ## Why is there a "V" in SIGSEGV Segmentation Fault? DevFeed: [Why is there a "V" in SIGSEGV Segmentation Fault?]() Original publisher: [Read original article]() Author: Marek Published: 2020-06-17T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [C](), [Linux](), [Unix](), [Kernel](), [cpu]() Tags: [article](), [bug](), [c](), [kernel](), [linux](), [unix]() ### AI overview The article explains that the V in SIGSEGV stands for "Segmentation Violation," tracing the name from early memory-segmentation faults and the SIGSEG designation to its later adoption as SIGSEGV in Unix userspace and the kernel. ### Source excerpt Why is there a "V" in SIGSEGV Segmentation Fault? This article is also co-published on Cloudflare blog: Another long night. I was working on my perfect, bug-free program in C, when the predictable thing happened: Oh, well... Maybe I'll be more lucky taking over the world another night. But then it struck me. My program received a SIGSEGV signal and crashed with "Segmentation Fault" message. Where does the "V" come from? Did I read it wrong? Was there a "Segmentation Vault?"? ## Addressing DevFeed: [Addressing]() Original publisher: [Read original article]() Author: Marek Published: 2019-12-05T23:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Linux](), [Unix](), [systems](), [Parameter]() Tags: [linux](), [parameter](), [socket](), [unix]() ### AI overview A tutorial on socket addressing on Linux, covering AF_INET, AF_INET6, and AF_UNIX address families, socket address structures, and converting IPv4 and IPv6 addresses between text and binary forms. The supplied text is truncated before the IPv6 discussion is complete. ### Source excerpt Addressing Articles from this series: - Creating sockets on Linux. - Addressing of AF_INET, AF_INET6 and AF_UNIX sockets. A freshly created socket isn't very useful. We have to tell it to either listen for incoming data, or connect to a remote peer. To achieve anything useful we need to perform a syscall dance, which involves either or or both. Among others, and syscalls take a socket address as a parameter. Before going into these syscalls we must discuss what exactly the address is. ## Creating sockets DevFeed: [Creating sockets]() Original publisher: [Read original article]() Author: Marek Published: 2019-11-05T23:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Linux](), [networking](), [API](), [Unix](), [Internet]() Tags: [api](), [domain](), [ipv4](), [ipv6](), [linux](), [networking](), [tcp](), [udp](), [unix]() ### AI overview A tutorial on creating sockets on Linux. It explains the socket syscall's domain, type, and protocol arguments, then introduces IPv4, IPv6, and Unix sockets, including when AF_UNIX is appropriate for communication between processes on the same host. ### Source excerpt Creating sockets Articles from this series: - Creating sockets on Linux. - Addressing of AF_INET, AF_INET6 and AF_UNIX sockets. Our journey into the Linux networking API starts with the common syscall: It takes three arguments: - domain specifies an address family. Most commonly used are IPv4, IPv6 and Unix sockets - AF_INET, AF_INET6 and AF_UNIX families. Linux supports more families, notably AF_PACKET, AF_NETLINK, AF_ALG and AF_VSOCK are sometimes handy. ## TCP Puzzles 1-2 DevFeed: [TCP Puzzles 1-2]() Original publisher: [Read original article]() Author: Marek Published: 2019-09-29T22:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Linux](), [networking](), [Python]() Tags: [implementation](), [linux](), [networking](), [python](), [tcp]() ### AI overview This tutorial presents two TCP puzzles based on Linux networking behavior. It examines write buffering versus POLLOUT and the effects of statement ordering on TIME-WAIT socket behavior, using small Python programs to illustrate implementation details and system-dependent outcomes. ### Source excerpt TCP Puzzles 1-2 Recently I've been spending more time looking into Linux TCP implementation, trying to better understand some corner cases. Here are two TCP puzzles. Using obvious, almost trivial, Python snippets, we can show really important design choices made deep in the networking stack. All we need is a bit of time... and courage to go into the Linux internals! 1. Write buffer vs POLLOUT Imagine a TCP server and a client connected to it. The server has plenty of data available. ## When TCP sockets refuse to die DevFeed: [When TCP sockets refuse to die]() Original publisher: [Read original article]() Author: Marek Published: 2019-09-19T22:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Linux](), [Kernel](), [Server]() Tags: [article](), [blog](), [bug](), [cloudflare](), [commands](), [kernel](), [retries](), [scripts](), [tcp](), [timeout]() ### AI overview A technical tutorial explains when Linux TCP sockets time out and how TCP keepalives and the TCP_USER_TIMEOUT socket option interact. It discusses connection establishment, SYN retries, kernel behavior, and a possible bug observed on Linux kernel 5.2. ### Source excerpt When TCP sockets refuse to die This article was first published on Cloudflare blog: While working on our Spectrum server, we noticed something weird: the TCP sockets which we thought should have been closed were lingering around. We realized we don't really understand when TCP sockets are supposed to time out! In our code, we wanted to make sure we don't hold connections to dead hosts. In our early code we naively thought enabling TCP keepalives would be enough... but it isn't. ## A gentle introduction to Linux Kernel fuzzing DevFeed: [A gentle introduction to Linux Kernel fuzzing]() Original publisher: [Read original article]() Author: Marek Published: 2019-07-09T22:00:00Z Content type: tutorial Language: en Sources: [Marek Majkowski]() Topics: [Fuzzing/Fuzz testing](), [Linux Kernel](), [Kernel](), [Testing](), [networking](), [virtualization]() Tags: [c](), [c-plus-plus](), [coverage](), [fuzzing](), [kernel](), [kvm](), [linux](), [linux-kernel](), [security](), [testing]() ### AI overview A tutorial on coverage-guided fuzzing of the Linux Kernel's netlink machinery. It explains how to use AFL with a custom kernel and a netlink shim inside KVM virtualization to explore kernel internals and find bugs. ### Source excerpt A gentle introduction to Linux Kernel fuzzing This article was first published on Cloudflare blog: For some time I've wanted to play with coverage-guided fuzzing. Fuzzing is a powerful testing technique where an automated program feeds semi-random inputs to a tested program. The intention is to find such inputs that trigger bugs. Fuzzing is especially useful in finding memory corruption bugs in C or C++ programs. ## Postmortem: An Incident Caused by Resolver Code DevFeed: [Postmortem: An Incident Caused by Resolver Code]() Original publisher: [Read original article]() Author: Marek Published: 2018-05-31T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [incident](), [Post Mortem](), [Code]() Tags: [code](), [incident](), [post-mortem]() ### AI overview A postmortem describes an incident caused by code the author was working on and states that the resolver was mitigated. ### Source excerpt Today we mitigated the resolver 01 June 2018 Not a thing to be proud of, but here is a post mortem from an incident caused by the code I was working on: ## Building mmproxy with Linux TPROXY and iptables to preserve client IP addresses DevFeed: [Building mmproxy with Linux TPROXY and iptables to preserve client IP addresses]() Original publisher: [Read original article]() Author: Marek Published: 2018-04-16T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [Linux](), [proxy](), [Protocol (disambiguation)](), [networking](), [Cloudflare]() Tags: [client](), [cloudflare](), [iptables](), [linux](), [protocol](), [proxy](), [v1]() ### AI overview This article describes building mmproxy with Linux's TPROXY iptables module: a simple Proxy Protocol v1 proxy that can preserve or locally spoof client IP addresses. It notes that the proxy is useful with Cloudflare Spectrum. ### Source excerpt mmproxy - creative linux routing hack 17 April 2018 I've published an article on how we abused TPROXY iptables module to build , a simple Proxy Protocol v1 proxy that can "preserve" (or locally spoof) client IP addreses. It's pretty useful together with Cloudflare Spectrum: ## Using TPROXY for Spectrum product DevFeed: [Using TPROXY for Spectrum product]() Original publisher: [Read original article]() Author: Marek Published: 2018-04-11T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [Cloudflare]() Tags: [article](), [build](), [cloudflare](), [iptables](), [module](), [product](), [using]() ### AI overview The article describes using the TPROXY iptables module to build Cloudflare Spectrum. ### Source excerpt Using TPROXY for Spectrum product 12 April 2018 I've published an article on how we used TPROXY iptables module to build Cloudflare Spectrum product: ## IP Spoofing at Packet Hacking Village DevFeed: [IP Spoofing at Packet Hacking Village]() Original publisher: [Read original article]() Author: Marek Published: 2018-01-25T23:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [spoofing](), [Hacking]() Tags: [2017](), [hacking](), [ip](), [spoofing](), [talk]() ### AI overview A brief account of giving a talk about IP spoofing at the Packet Hacking Village in July 2017. ### Source excerpt IP Spoofing at Packet Hacking Village 26 January 2018 Back in July 2017 I went to Vegas and gave a short talk at the Packet Hacking Village. I was talking about my favorite subject - IP Spoofing. ## 5 talks in 5 weeks DevFeed: [5 talks in 5 weeks]() Original publisher: [Read original article]() Author: Marek Published: 2017-12-21T23:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [Cloudflare](), [DDoS](), [API](), [Programming](), [DevOps](), [reactive]() Tags: [api](), [cloudflare](), [ddos](), [devops](), [functional](), [golang](), [js](), [meetup](), [programming](), [reactive](), [sponsored](), [sysops](), [talk]() ### AI overview The author recaps five talks given at local meetups in Warsaw, covering the Service Worker API, Cloudflare's approach to large DDoS attacks, functional reactive programming, Golang, and Cloudbleed. ### Source excerpt 5 talks in 5 weeks Over last couple weeks I gave five talks on local meetups in Warsaw. Cloudflare is running a pizza program - for most of the meetups we were able to secure Cloudflare-sponsored pizza! Most of the talks went pretty well, here are the slides. ## Perfect locality and three SystemTap scripts DevFeed: [Perfect locality and three SystemTap scripts]() Original publisher: [Read original article]() Author: Marek Published: 2017-11-05T23:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [Linux Kernel](), [Linux](), [Script](), [Cloudflare]() Tags: [2017](), [article](), [blog](), [cloudflare](), [linux](), [linux-kernel](), [scripts]() ### AI overview An article announcement for a Cloudflare blog post about perfect locality and three SystemTap scripts. It describes the post as a continuation exploring the REUSEPORT feature in the Linux kernel. ### Source excerpt Perfect locality and three SystemTap scripts 06 November 2017 I've published an article on the Cloudflare blog: This is a continuation of the previous piece where I try to understand REUSEPORT Linux kernel feature. ## Sandboxing landscape DevFeed: [Sandboxing landscape]() Original publisher: [Read original article]() Author: Marek Published: 2017-03-27T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [Security](), [virtualization](), [Programming language](), [Process]() Tags: [isolation](), [javascript](), [lua](), [multi-tenancy](), [sandboxing](), [shouldn-t](), [virtualization]() ### AI overview This article surveys four approaches to isolating untrusted third-party code: programming-language runtimes, operating-system processes, software fault isolation, and virtual machines. It discusses requirements such as multi-tenancy, scheduling, memory limits, and restricting privileged operations, then examines Lua and JavaScript as examples. ### Source excerpt Sandboxing landscape Some time ago I started wondering - would it be possible for a CDN to run customer code on the edge servers? I read and asked around, over time I got acquainted to what is and what is not technically possible. But that didn't bring me closer to an useful answer. Fortunately exploring this subject has been enormous fun. In this blog post I'll describe my findings so far. ## Epoll's file descriptor and kernel object lifetime semantics DevFeed: [Epoll's file descriptor and kernel object lifetime semantics]() Original publisher: [Read original article]() Author: Marek Published: 2017-03-19T23:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [IO](), [Streams](), [Kernel](), [implementation]() Tags: [cleanup](), [file](), [issue](), [kernel](), [object]() ### AI overview This article examines epoll's handling of file descriptors and underlying kernel objects. It explains that epoll subscription lifetime is tied to the kernel object rather than the file descriptor, so closing a descriptor may leave subscriptions active and allow events to be reported for a closed descriptor. ### Source excerpt Epoll is fundamentally broken 2/2 I/O multiplexing part #4 Previous articles in this series: - The history of the Select(2) syscall - Select(2) is fundamentally broken - Epoll(2) is fundamentally broken In this post we'll discuss the second argument on why the is broken. The problem is best described in an LWN comment by Foom: And epoll certainly has a HUGE misdesign in it, that anyone who actually understood what a file descriptor is should've seen coming. ## Socket API thoughts DevFeed: [Socket API thoughts]() Original publisher: [Read original article]() Author: Marek Published: 2017-02-22T23:00:00Z Content type: opinion Language: en Sources: [Marek Majkowski]() Topics: [Unix](), [Processes](), [Concurrent Programming](), [IO](), [Streams](), [Erlang](), [Go Language]() Tags: [api](), [erlang](), [go](), [processes](), [stream](), [unix]() ### AI overview The article examines whether Unix processes, file descriptors, and select() were designed around CSP-style communication. It concludes that they were not, while discussing composability limits and buffering-related problems in Unix process and I/O models. ### Source excerpt Socket API thoughts I/O multiplexing, commentary Some time ago I wrote about a history of syscall. While that piece was a necessary introduction to the followup post, it triggered interesting discussions. It took me a while but I finally realized what is the core question I asked myself. Here it is: Were Unix processes intended to be CSP-style processes? Are file descriptors a CSP-derived "channels"? Is "select()" equivalent to ALT statement? The direct answer is "no". CSP is younger than Unix. ## Epoll's design limitations in multithreaded and load-balancing scenarios DevFeed: [Epoll's design limitations in multithreaded and load-balancing scenarios]() Original publisher: [Read original article]() Author: Marek Published: 2017-02-19T23:00:00Z Content type: opinion Language: en Sources: [Marek Majkowski]() Topics: [IO](), [Linux](), [Concurrency](), [Concurrent Programming](), [Programming](), [Kernel](), [Load Balancing]() Tags: [epoll](), [kernel](), [linux](), [load-balancing](), [threading](), [thundering-herd]() ### AI overview This article examines design limitations in Linux epoll, focusing on event delivery when file descriptors are shared across worker threads and on epoll's association with underlying kernel objects rather than file descriptors. It recommends defensive programming and avoiding several sharing, forking, and load-balancing patterns. ### Source excerpt Epoll is fundamentally broken 1/2 I/O multiplexing part #3 In previous articles we talked about: This time we'll focus on Linux's successor - the I/O multiplexing syscall. Epoll is relatively young. It was created by Davide Libenzi in 2002. For comparison: Windows did IOCP in 1994 and FreeBSD's kqueue was introduced in July 2000. Unfortunately, even though epoll is the youngest in the advanced IO multiplexing family, it's the worse in the bunch. ## Why the select I/O multiplexing model is considered broken by design DevFeed: [Why the select I/O multiplexing model is considered broken by design]() Original publisher: [Read original article]() Author: Marek Published: 2017-01-05T23:00:00Z Content type: opinion Language: en Sources: [Marek Majkowski]() Topics: [IO](), [TCP/IP](), [Linux](), [Kernel](), [file]() Tags: [article](), [async](), [blog](), [kernel](), [tcp-ip]() ### AI overview This article examines alternatives for I/O multiplexing and argues that the select model is broken by design because its semantics prevent effective kernel-side optimizations. It also discusses related technologies that inherit those semantics. ### Source excerpt Select is fundamentally broken I/O multiplexing part #2 In a previous blog post we discussed a brief history of the syscall. The article concludes that some I/O multiplexing was necessary to do console emulation, games and non-trivial TCP/IP applications. The BSD designers chose the multiplexing model and other Unixes followed. But is the only multiplexing model? A good explanation can be found in the old revision of "The Design and Implementation of the FreeBSD Operating System" book. ## A brief history of select(2) DevFeed: [A brief history of select(2)]() Original publisher: [Read original article]() Author: Marek Published: 2016-10-31T23:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [Unix](), [IO](), [Linux](), [Processes]() Tags: [block](), [cpu](), [file](), [history](), [linux](), [process](), [unix]() ### AI overview This article begins a historical discussion of select(2) I/O multiplexing in Linux. It places file descriptor multiplexing in the context of Unix design, time-sharing, batch processing, process blocking, and early inter-process communication mechanisms such as pipes. ### Source excerpt A brief history of select(2) I/O multiplexing part #1 Recently I've been thinking about the multiplexing in Linux, namely the syscall. I was curious if is better or worse than the or . I was wondering if there was a benefit in batching calls. But let's step back for a while, before we start a serious discussion we need to get some context. Most importantly - is file descriptor multiplexing an aberration or a gentle extension to the Unix design philosophy's? ## Strange Loop - IP Spoofing DevFeed: [Strange Loop - IP Spoofing]() Original publisher: [Read original article]() Author: Marek Published: 2016-09-19T22:00:00Z Content type: article Language: en Sources: [Marek Majkowski]() Topics: [DDoS](), [spoofing](), [Security](), [Cloudflare](), [Internet](), [proxy](), [centralization]() Tags: [centralization](), [cloudflare](), [ddos](), [internet](), [ip](), [recording](), [reverse-proxy](), [ruby](), [security](), [servers](), [spoofing](), [talk]() ### AI overview A transcript of a Strange Loop talk explaining large-scale DDoS attacks, how IP spoofing enables serious attacks and complicates tracing, and how mitigating them contributes to internet centralization. ### Source excerpt Strange Loop - IP Spoofing I recently gave a talk at the Strange Loop conference in St Louis. The recording and slides are available, but for easier consumption here's a transcript. Good morning! This is the DDoS talk. It's always hard to speak about DDoS. Many people mean very different things by it. Some say "DDoS" when their Ruby app can't handle more than five concurrent users. But slow Ruby servers are not the subject of this talk. ## Web archeology - itblog DevFeed: [Web archeology - itblog]() Original publisher: [Read original article]() Author: Marek Published: 2016-03-10T23:00:00Z Content type: opinion Language: en Sources: [Marek Majkowski]() Topics: [Web](), [Website]() Tags: [article](), [blog](), [posts](), [web]() ### AI overview The author revisits blog posts they published on the now-defunct Polish social network Grono.net, including posts about shortest-path search, 32-bit versus 64-bit systems, and memoization. ### Source excerpt Web archeology - itblog 11 March 2016 Long time ago I spent some time working at now defunct Polish social network - Grono.net. I published a couple of blog posts there. Allow me to performa a bit of web archeology: - Jak działa wyszukiwanie najkrótszych scieżek - 32 czy 64 bity - Memoize cichy przyjaciel programisty which coincidentally was the last article published on that blog. [Next page]()