Linux Kernel Journey
This article explains how the Linux kernel implements heap memory management, covering the heap data structure, the mm_struct fields start_brk and brk, the brk/sbrk and malloc/free allocation methods, the brk and mmap system calls, and the internal glibc structures heap_info and malloc_state that track heap state.
This article explains the inner workings of rtla timerlat’s latency testing, contrasting it with cyclictest, detailing kernel‑mode tracer setup, timer handling, context differentiation, and how the collected trace events are processed by the user‑space rtla application to produce detailed IRQ and thread latency metrics.
This article introduces rtla timerlat, a Linux scheduling‑latency analysis tool that breaks latency into detailed phases, explains how to cross‑compile its libtracefs and libtraceevent dependencies, compile the tool, enable the kernel timerlat tracer, configure common parameters, and run a typical command with sample output.
During a gray‑release, a Go‑Rust service repeatedly crashed when a dependent process was hot‑upgraded; the root cause was an unhandled SIGPIPE signal generated by the kernel on a broken TCP connection, which terminated the process without a core dump, and the article explains the kernel mechanics and the solution of ignoring SIGPIPE.
When a small 2 CPU / 2 GB Alibaba Cloud instance runs Java, Nginx, MySQL, and Redis, memory quickly exhausts; this guide shows how to create and configure a swap file, set appropriate permissions, enable it at boot, and tune the swappiness parameter to mitigate out‑of‑memory failures.
This guide explains why and how to implement MDIO over GPIO on a Linux system, covering MDIO fundamentals, Clause22/Clause45 frame structures, YT8521 PHY pinout, required kernel drivers, device‑tree configuration, log verification, and command‑line usage.
This article demonstrates how to use eBPF together with BTF to trace BPF map update and delete functions, shows concrete command‑line output, explains the code that identifies target kernel functions, and details the data‑dumping logic for debugging map contents.
This article explains how China Mobile built a hybrid‑cloud production environment for its customer‑service LLM, using eBPF and WebAssembly plugins from DeepFlow to achieve zero‑intrusion observability, automatically capture full‑stack topology, application/network metrics, and key LLM business indicators such as TTFT, TPOT, and token throughput.
The article details how a long‑standing bug that displayed incorrect call‑address information in bpftool’s JIT disassembly was reproduced, analyzed, and fixed by correcting the PC parameter to use the function’s kernel symbol address, with patches applied to both LLVM and libbfd back‑ends.
The article analyzes how attackers can abuse eBPF to steal data, elevate privileges, execute commands, and hide processes, then presents concrete eBPF code for such attacks and outlines practical protection, detection, and auditing techniques—including file analysis, bpftool usage, and kernel tracing—to mitigate these threats.
