This article explores the Linux kernel’s network stack architecture, detailing each layer from the application’s socket interface through transport, network, and link layers, and explains the complete inbound and outbound data flow with code examples illustrating packet reception, processing, routing, and transmission.
This article provides a comprehensive overview of Linux internals, covering the kernel’s core components, memory and process management, the virtual file system layer, ext4 inode structures, caching strategies, direct I/O, and kernel parameter tuning for performance optimization.
Modern operating systems prevent user‑level programs from directly managing memory, executing privileged CPU instructions, or accessing hardware I/O, because such actions would break isolation, corrupt kernel data structures, and compromise system security, leading the OS to terminate the offending process.
This article explains how the Linux kernel discovers physical memory during boot by invoking the BIOS interrupt 0x15 with the E820 function, how firmware (ACPI) provides the memory map, and how the kernel stores, prints, and later manages those memory regions using e820 tables, memblock, and the buddy allocator.
This article explains the evolution of Linux kernel tracepoints, the design of the TRACE_EVENT() macro, its six parameters, and how to define, compile, and use tracepoints such as sched_switch for efficient, low‑overhead kernel tracing across various tracers.
Linux kernel I/O mechanisms, from basic file operations and descriptors to advanced models like blocking, non‑blocking, multiplexed, signal‑driven, and asynchronous I/O, are explained in depth, covering their structures, system calls, caching strategies, and performance optimizations such as io_uring.
This article explains the role of the interrupt system in ARM‑based Linux platforms, covering hardware modes, vector tables, exception handling, GIC architecture, and kernel integration, and provides detailed code examples and optimization techniques for developers working on embedded and high‑performance systems.
This article explains the Linux Completely Fair Scheduler (CFS), covering its design goals, core concepts such as virtual runtime, weight, red‑black tree management, load‑balancing mechanisms, scheduling policies, and answers common questions about its operation and kernel code.
This article provides a comprehensive overview of Linux memory management, detailing the roles and mechanisms of the early boot memory allocator, the memblock subsystem, the buddy allocator for physical pages, and the slab allocator for small objects, including their data structures, algorithms, and practical usage scenarios.
This guide walks through the Linux boot sequence on CentOS 8, detailing the BIOS/UEFI stage, GRUB2 configuration, kernel loading, initramfs, systemd target units, and essential commands for inspecting kernel version, CPU info, network parameters, and service management.
This article explains Linux process states stored in task_struct, how to interpret them with ps commands, the nature of zombie and orphan processes, priority handling via nice and top, and the inner workings of the Linux 2.6 O(1) scheduler including runqueues, active/expired queues, and bitmap optimizations.
This article explains how the eBPF verifier checks user‑supplied BPF programs, details register types, instruction encoding, and the verification workflow, and illustrates typical verifier errors with concrete code examples and the exact kernel checks that trigger them.
Netlink is a Linux‑specific inter‑process communication mechanism that provides asynchronous, full‑duplex, and multicast communication between user space and kernel space, offering advantages over traditional IPC methods and serving a wide range of networking, monitoring, and system‑management scenarios.
This guide explains four practical techniques—parsing System.map, using vmlinux with nm/objdump/readelf, reading /proc/kallsyms, and calling kernel lookup APIs—to locate the exact address of any Linux kernel function for deeper debugging.
This article explains the ZRAM technology in Linux, covering its principles, configuration steps, kernel integration, performance optimizations, and practical use cases for improving memory utilization on embedded devices, Android, and legacy PCs.
This guide explains four practical ways to obtain Linux kernel function addresses—using the System.map symbol table, inspecting the vmlinux image with tools like nm, objdump and readelf, reading the live /proc/kallsyms file, and calling kernel APIs such as kallsyms_lookup_name and sprint_symbol.
This article explains how Linux manages memory through page reclamation, detailing the role of LRU algorithms, page classification, reverse mapping, direct and asynchronous reclaim paths, and the OOM killer, while providing code examples and practical tuning advice.
This article explains the Linux kernel reverse‑mapping (RMAP) mechanism, covering its historical background, core concepts, key data structures such as anon_vma and anon_vma_chain, and the detailed workflow for page creation, fork handling, and page reclaim or migration, with full code examples.
The article outlines Kalle Valo's decade‑long contributions to Linux wireless drivers, his unexpected resignation, the community’s concerns about succession, and the urgent need for new maintainers to ensure the long‑term health of the kernel’s Wi‑Fi subsystem.
This article explains the Linux boot sequence, covering the BIOS/UEFI hardware check, GRUB2 bootloader configuration, kernel loading with initramfs, root filesystem mounting, systemd target units, essential services, and a CentOS 8 example with GRUB settings and module inspection.
The article analyzes how the Linux kernel decides the CPU for a task that has just been woken, detailing the roles of wake_affine and select_idle_sibling, and examining factors such as cache affinity, idle status, load, and hardware topology that influence the final placement.
This article explains how the Linux kernel ensures safe concurrent access to shared resources through various synchronization mechanisms such as atomic operations, spinlocks, mutexes, read‑write locks, and semaphores, illustrating their concepts, APIs, and practical usage with code examples.
This article explains Linux process states, how the kernel manages them with linked lists and queues, details commands for inspecting states, discusses zombie and orphan processes, and covers priority concepts and the O(1) scheduler algorithm in depth.
This article provides an in‑depth, step‑by‑step analysis of Linux GICv3 interrupt architecture, the kernel driver initialization, hardware‑to‑virtual interrupt mapping, the full interrupt handling state machine, and the workqueue subsystem including its data structures, initialization, and usage patterns.
Linux does not expose all physical memory to users; this article explains why the kernel reserves memory, detailing the early memblock allocator, crash kernel reservations, page structure overhead, and the handoff to the buddy system, illustrating how these mechanisms consume several hundred megabytes of RAM.
This article explains how Linux-like operating systems use virtual memory and the MMU to map virtual addresses to physical memory, describes the data structures (vma_struct and mm_struct) used by uCore, details the page‑fault handling flow, classifies fault types, and shows how these mechanisms affect system performance.
This article explains how Linux memory barriers work, why they are needed on SMP systems, the different barrier types, their kernel implementations, and practical examples showing their impact on multithreaded performance and driver development.
This article explains how Linux’s real‑time scheduler works, covering the underlying concepts, key kernel data structures such as rt_rq and rt_prio_array, the SCHED_FIFO and SCHED_RR policies, practical code examples, configuration APIs, and optimization tips for industrial and multimedia applications.
This article explains how to use high‑resolution timers to inject clock interrupts and force a pre‑emptive schedule inside a QEMU/KVM virtual machine monitor, detailing the design, register saving/restoring, code implementation, and hardware constraints for reliable testing of kernel paths.
This article explains the core principles of I/O read/write operations, detailing the data preparation and copying stages, the roles of kernel and user buffers, synchronization models, and performance optimizations such as double buffering, circular buffers, zero‑copy, read‑ahead, and delayed write.
This article explains the design of Linux file systems, the role of inodes, data blocks, superblocks, and the Virtual File System layer that provides a unified interface for diverse storage back‑ends, detailing core structures, registration, mounting, and file operation workflows.
The article explains how Linux kernel scheduling uses a hierarchical topology—balancing load and preserving cache affinity—by mapping real‑world multi‑core hardware structures such as sockets, dies, clusters, and NUMA nodes to sched_domain and sched_group, and shows how to inspect and tune this layout with CONFIG_SCHED_DEBUG and QEMU simulation.
This guide explains the Linux kernel TCP parameters located under /proc/sys/net/ipv4/ and /proc/sys/net/core/, shows how to tune them with sysctl, and provides practical examples and recommended values for improving network performance and security.
The article explains a kernel‑space memory profiler that uses a compile‑time code‑tagging library and special linker sections to record allocation callers and byte counts with minimal CPU overhead, allowing the tool to be deployed in production.
This article provides a comprehensive overview of the Linux process scheduler, explaining why scheduling is needed, how it works, the various scheduling policies such as real‑time and CFS, the mechanisms for priority and load balancing, and the historical evolution of Linux schedulers with code examples.
This article explains the Linux kernel's four‑level page‑table mechanism, the performance impact of TLB misses, why using 2 MB HugePages improves address‑translation efficiency, and provides step‑by‑step instructions for reserving and allocating HugePages via boot parameters, sysfs, and mmap.
The article explains how the Earliest Eligible Virtual Deadline First (EEVDF) scheduler, introduced in Linux 6.6, replaces CFS by using virtual deadlines and a lag concept to achieve both fairness and interactivity, and walks through concrete formulas, parameter settings, and step‑by‑step scheduling examples.
This article provides a comprehensive analysis of the Linux kernel's task_struct data structure, detailing its members such as task IDs, parent‑child relationships, state flags, credentials, scheduling information, signal handling, memory and file management, kernel stack layout, and its role in process creation via system calls like fork.
This article explains how the Linux kernel implements heap memory management, covering the heap data structure, the mm_struct fields start_brk and brk, the brk/sbrk and malloc/free allocation methods, the brk and mmap system calls, and the internal glibc structures heap_info and malloc_state that track heap state.
This guide explains how to optimize Linux kernel parameters, increase file descriptor limits, and choose appropriate disk scheduling strategies to improve server performance, with practical examples for network tuning, Nginx configuration, and system resource adjustments.
This article provides a comprehensive overview of Linux process management, covering fundamental concepts such as tasks and states, the internal task_struct representation, process creation via fork/vfork/clone, execution with execve, lifecycle transitions, scheduling policies, copy‑on‑write optimization, resource limits, and practical tools for monitoring and controlling processes.
The article describes a kernel‑level hot‑key detection module for Redis that tracks per‑second access counts via an O(1) LRU queue, flags keys exceeding configurable thresholds, and provides real‑time subscription alerts and queryable logs, overcoming the latency and overhead limitations of existing detection methods.
This article explains how the SIGPIPE signal is generated in Linux, why it can cause Go‑Rust services to crash without a core dump, and how to prevent it by configuring the signal handler to ignore SIGPIPE.
In a candid interview at the Linux Foundation Open Source Summit, Linus Torvalds and Verizon open‑source lead Dirk Hohndel discuss the Linux kernel's release cadence, security patching, the delayed integration of Rust, and Torvalds' cautious view of AI's role in software development.
Linus Torvalds merged a kernel patch that modifies the 64‑bit copy_from_user() implementation to avoid the slow barrier_nospec() call, achieving a 2.6% performance improvement in the "will it scale" benchmark and will be included in the upcoming Linux 6.12 stable release.
This article explains the Linux kernel architecture, breaks it into three layers and five key subsystems—process scheduling, memory management, virtual file system, network interface, and inter‑process communication—detailing their responsibilities, inter‑dependencies, and providing concrete code examples and diagrams.
This article provides a comprehensive overview of Linux's task_struct, explaining how the kernel represents and manages processes and threads, detailing its internal fields, state handling, scheduling, credentials, memory layout, and special mechanisms such as hung‑task detection.
Linux founder Linus Torvalds confirmed that the kernel project has recently stripped more than ten maintainers linked to Russia, citing compliance requirements and U.S. sanctions, while the removed contributors' driver code remains in the source tree.
This article provides a comprehensive overview of how Linux kernel system calls are implemented on the x86-64 architecture, covering the conceptual differences from regular function calls, register conventions, initialization processes, syscall tables, and practical assembly examples such as write and getpid.
This article explains Linux swap fundamentals, detailing how the kernel uses swap partitions or files, the role of the swappiness parameter in balancing cache reclamation versus anonymous page swapping, the operation of kswapd, and the impact of memory watermarks on reclamation decisions.
The article explains how Linux manages memory page watermarks, when the allocator falls back to kswapd, and the exact conditions that trigger direct compaction via __alloc_pages_direct_compact, then walks through the core compaction functions—try_to_compact_pages, compact_zone_order, compact_zone, and the page‑migration helpers—illustrated with flow diagrams and real kernel code.
At the recent virtual eBPF summit, Isovalent CTO Thomas Graf revealed that Microsoft is developing a Windows version of eBPF, aiming for cross‑platform compatibility with Linux, while the IETF works on standardizing the eBPF ISA and verifier to ensure secure, portable kernel bytecode execution.
When a computer finishes loading a webpage and the user does nothing, the CPU appears idle, but the operating system runs a special idle process that repeatedly executes the halt instruction, managing power consumption and illustrating core concepts of processes, scheduling, and hardware‑software interaction.
In September 2024, TencentOS sent two kernel engineers to Vienna to attend the Linux Plumbers Conference and the Linux Kernel Developers' Netconf, where they presented cutting‑edge research on network diagnostics, SWAP allocation, and memory management, fostering collaboration with leading open‑source contributors.
This article walks through the Linux kernel mechanisms for creating and destroying processes, covering copy‑on‑write, the fork/vfork/clone system calls, the kernel_clone implementation in kernels 5.0 and 6.5, the copy_process workflow, and the steps the kernel takes to wake up a new task and clean up a terminated one.
At the Open Source Summit Europe, Linus Torvalds warned that the Linux kernel’s aging maintainers and a shrinking pool of interested developers threaten succession, stressing that future leaders must earn community trust through sustained contributions, while better mentorship, documentation, and outreach are needed to attract new talent.
This article explains why Linux kernel network packet loss occurs, covering causes such as UDP checksum errors, firewall misconfigurations, rp_filter settings, buffer overflows, and hardware faults, and provides detailed diagnostic steps and practical solutions to identify and resolve each issue in Linux environments.
This article provides a thorough overview of Linux kernel debugging techniques, covering pseudo‑filesystems such as procfs, sysfs, debugfs and relayfs, as well as essential tools like printk, ftrace, trace‑cmd, kprobe, systemtap, kgdb, kgtp, perf, and other modern tracers, helping developers diagnose and optimise kernel behavior.
An in‑depth post‑mortem of a recurring midnight kernel panic caused by a malformed sk_buff structure, detailing how vmcore analysis, packet inspection, and netfilter hook tracing pinpointed a third‑party module bug in Linux 5.10, and outlining remediation steps.
The article explains how Linux separates board‑level information from drivers using a bus‑device‑driver model, illustrating high cohesion and low coupling with concrete code examples, matching mechanisms, and the evolution toward device trees for scalable hardware abstraction.
The article examines the role of various locks in Linux kernel memory management, explains their APIs and sleeping constraints, presents detailed case studies of lock‑related performance patches—including per‑memcg LRU, mmap_lock IO‑fault path, SPF, PVL, fault‑around, unmap, and rmap lockless optimizations—and summarizes common strategies for reducing lock contention and improving scalability.
This article explains core operating system concepts—including its main functions, the distinction between user and kernel modes, process and thread management, and semaphore-based synchronization—providing clear definitions, code examples, and practical usage scenarios for developers.
This article provides a comprehensive guide on how to employ GDB for debugging programs that lack symbol information, covering basic commands, breakpoint techniques, core‑dump analysis, reverse debugging, and a practical example of integrating VSCode, GDB, and QEMU to debug an ARM64 Linux kernel.
This article demystifies the Linux free command’s “buffers” and “cached” fields by tracing their origins through /proc/meminfo, kernel source functions such as meminfo_proc_show, nr_blockdev_pages, and page‑cache mechanisms, and demonstrates the differences with practical experiments.
A newly disclosed Linux kernel vulnerability called "indler"—a 0‑day memory‑corruption bug hidden since 2012—was uncovered by security researcher Zhang Yinkui, who detailed its discovery via a random kernel oops, KASAN detection, and its potential for massive remote code execution across billions of devices.
This guide walks you through obtaining the Linux kernel source, configuring key options, compiling and installing the kernel, tuning sysctl parameters, and continuously monitoring system metrics to achieve higher performance, stability, and security in high‑load environments.
This article explains the principles of virtual memory, the data structures and functions used in uCore to manage page faults, and how the operating system handles demand paging, page swapping, and invalid accesses through detailed code examples and workflow descriptions.
This article provides a comprehensive overview of the Linux /proc virtual filesystem, detailing how to mount it, the structure of its directories and files such as /proc/pid, /proc/self, and various system information files, and includes practical command examples and security considerations.
This article walks through Android Binder IPC on Android 14 and Linux 6.1, detailing client‑side service registration and lookup, the kernel driver’s handling of parcels, reference management, and how ServiceManager maps names to IBinder objects, culminating in a diagram of the full native‑to‑kernel transaction flow.
This guide explains how to fine‑tune Linux kernel settings—including sysctl network parameters, shared memory limits, local port ranges, and disk scheduler options—using configuration files and command‑line tools to improve system stability and throughput.
This article details the investigation of a "directory not empty" failure when using Go's os.RemoveAll on a self‑built FUSE‑based distributed filesystem, describing the kernel readdir offset issue, the debugging steps taken, and the final fix applied.
This article walks through a real Linux kernel hard lockup case, explaining what hard lockup is, analyzing stack traces and register values, identifying a spinlock contention on a per‑CPU runqueue, and showing how an inappropriate GFP flag caused interrupts to be enabled at the wrong time, leading to a deadlock and the eventual fix.
This article introduces eBPF, explains its zero‑intrusion observability advantages, describes its architecture and runtime workflow, outlines development prerequisites and compilation steps, and provides concrete Go‑based examples for tracing bash commands and measuring TCP connection latency.
This guide compiles practical Nginx performance‑tuning directives, FastCGI settings, Linux kernel parameter adjustments, security hardening tips, and monitoring configurations, providing concrete examples and command‑line snippets to help sysadmins and developers optimize high‑concurrency web services.
This article explains the design and implementation of file readahead in the Linux 3.12 kernel, using sequential, random, and multithreaded read scenarios to show how the kernel initializes readahead windows, triggers synchronous and asynchronous prefetches, and updates the page cache.
The article provides a comprehensive guide to the Linux /proc virtual filesystem, explaining its purpose, how to mount it, and detailing the most important files and directories such as /proc/pid, /proc/self, security attributes, memory maps, and network information, along with practical commands for inspection.
This article explains the Linux /proc virtual filesystem, detailing its purpose as a kernel interface, how to mount it, and describing the most important files and directories—such as /proc/[pid], /proc/self, /proc/net, and security‑related entries—along with example commands for inspecting process information.
The article provides a comprehensive guide to Linux’s /proc virtual filesystem, detailing its purpose, mounting methods, key directories such as /proc/pid, /proc/self, and numerous files that expose process, thread, memory, and kernel information, along with practical command examples.
Linux kernel 6.9’s first stable release brings Rust support on AArch64, expanded hardware drivers, performance optimizations, filesystem enhancements, BPF and perf tool upgrades, as well as network and security improvements, while previewing the upcoming 6.10 development cycle.
Linux’s “watchdog: BUG: soft lockup – CPU#1 stuck” warning indicates a CPU soft lockup, caused by driver bugs, hardware faults, or kernel issues, and can be resolved by updating software, monitoring hardware, analyzing logs, and implementing preventive performance and hardware checks.
This comprehensive guide explains Linux memory fundamentals, address space layout, fragmentation, the buddy and slab allocators, kernel and user‑mode memory pools, DMA handling, common programming pitfalls, and practical tools for monitoring memory usage.
This comprehensive guide explores Linux memory architecture, address spaces, allocation strategies like the buddy and slab allocators, user‑ and kernel‑level memory management, DMA, and practical tips to avoid common memory bugs and performance issues.
This article provides a comprehensive guide to Linux memory management, covering memory fundamentals, address spaces, MMU translation, segmentation and paging, the buddy and slab allocation algorithms, kernel and user memory pools, typical usage scenarios, common bugs, and practical tools for monitoring and debugging memory usage.
This article lists a comprehensive series of 46 video lectures covering essential Linux kernel concepts such as scheduling, memory management, synchronization, file systems, networking, and device drivers, providing a valuable resource for embedded and systems programmers.
This guide lists 44 essential Linux kernel and sysctl parameters, providing their default values and recommended settings to improve memory management, networking, file handling, and overall system stability for production environments and reliability.
This comprehensive Q&A explains Linux system composition, kernel placement, core subsystems, address translation, paging structures, process concepts, scheduling algorithms, interrupt handling, system calls, synchronization, deadlock avoidance, and the virtual file system, providing a solid foundation for operating‑system fundamentals.
This article explains the architecture and implementation of the virtio/vhost device model, details how QEMU creates and initializes virtio‑net‑pci devices, describes the vhost‑user communication protocol and its integration with DPDK and the Linux vhost‑net kernel driver, and provides practical command‑line examples and code snippets.
This article explains the fundamentals of TCP RST packets, distinguishes active and passive resets, outlines common kernel scenarios that generate them, and provides practical debugging methods using tcpdump, bpftrace, and source‑code analysis to resolve real‑world network incidents.
This article explains the concept of system calls, how they provide a privileged interface between user programs and the kernel, distinguishes them from APIs and library functions, and describes their role in Linux operating‑system architecture and application development.
This article introduces IPVS, the Linux kernel‑level load balancer, explains its scheduling algorithms, forwarding modes (DR, NAT, IP tunneling), and provides step‑by‑step commands to configure virtual services, real servers, and routing in a virtualized environment.
Linus Torvalds sharply rebuked a Google contributor’s inode proposal on the Linux kernel mailing list, calling the 1970s‑era inode concept an outdated relic that need not serve as a unique file‑system identifier, warning it adds unnecessary complexity and dismissing the submitted patch as garbage code.
Linus Torvalds blasted a Google contributor’s proposal to make all file and directory inodes identical, calling the idea outdated, labeling the pull request as garbage, and urging that the inode concept be abandoned in favor of modern file‑system designs that no longer rely on unique identifiers.
Linus Torvalds unleashed a rare, scathing rebuke on the Linux kernel mailing list, denouncing Google contributor Steven Rostedt’s inode‑related patch as “garbage code” and arguing that the legacy practice of treating inodes as mandatory unique identifiers is outdated and should be abandoned.
The article investigates why BPF LSM programs fail to load on aarch64 kernels, uses ftrace‑based tools such as bpftrace and trace‑cmd to trace kernel execution, discovers missing arch_prepare_bpf_trampoline support in 5.15 and 6.1, and shows that a patch merged into the mainline kernel restores functionality for upcoming releases.
This article analyzes the XFS filesystem implementation in the Linux kernel, covering its on‑disk layout, superblock and allocation‑group structures, inode and free‑space B+ trees, operation sets (iops, fops, aops), file creation, write and read paths, logging, block layer interactions, and useful XFS utilities.
This article explains the Linux kernel boot sequence on ARM platforms, covering how the compressed kernel is decompressed, the role of the stext entry point, the preparation steps performed by __switch_data, and the detailed initialization performed by start_kernel and its key sub‑functions.
This article explains the Linux kernel boot sequence, covering the decompression of a compressed kernel, the early startup code in head.S, the preparation steps performed by U-Boot, and the detailed initialization phases—including architecture setup, memory management, process creation, and the start_kernel routine.
When a computer has no active user tasks, the CPU appears idle but actually runs a special system idle process that repeatedly executes the privileged halt instruction, allowing the processor to enter low‑power states while the operating system manages process queues and scheduling.
This article explains how the Linux kernel allocates dynamic memory, distinguishes kernel and user‑space allocation strategies, describes the mm_struct layout of a process address space, and shows how pages and page tables translate virtual addresses to physical memory.
This article explains how Linux processes can share large data efficiently by creating a memory file with memfd_create, mapping it with mmap, and transferring the file descriptor over a Unix Domain Socket, while detailing the kernel mechanisms that enable true cross‑process memory sharing.
