This article explains the architecture and implementation of the Linux kernel kmalloc memory pool, detailing slab cache creation, size selection rules, cache initialization, allocation and free paths, and how different memory zones are handled, with code examples and diagrams.
This article explains how the Linux kernel supplements its buddy system with the slab allocator to efficiently manage tiny memory blocks, covering slab’s design, memory layout, red‑zone protection, poisoning, per‑CPU caches, NUMA node warehouses, allocation fast‑paths, slow‑paths, and release strategies.
This article reviews the fundamentals of eBPF, explains its architecture and tracing mechanisms such as USDT, uprobes, and TC hooks, provides practical code examples, discusses security aspects, and lists notable open‑source projects that leverage eBPF for performance and observability.
Linus Torvalds announced the Linux 6.4-rc6 kernel, highlighting extensive XFS filesystem fixes, numerous driver updates—including GPU and network drivers—architectural patches for arm64, and a projected stable release around June 25, with a possible delay to July 2 if issues arise.
This article explains the step‑by‑step process Linux uses to receive and transmit network packets, covering the initialization of the network subsystem, the role of the ring buffer, interrupt handling, and the layered processing through the TCP/IP stack from the NIC up to the application.
This article explains Linux process states, how the scheduler puts a running task to sleep with TASK_INTERRUPTIBLE or TASK_UNINTERRUPTIBLE, how wake_up_process() restores TASK_RUNNING, why invalid wakeups occur due to race conditions, and the kernel techniques used to prevent them.
This comprehensive guide explains Linux memory management, covering physical and virtual memory concepts, allocation and release methods, related kernel functions, process switching interactions, performance tuning, leak detection, fragmentation handling, and real‑world application scenarios for servers, embedded systems, and driver development.
This article provides a comprehensive overview of the Linux kernel, explaining its core components, memory and process management, device drivers, system calls, and security, while detailing essential commands such as uname, lsmod, modinfo, modprobe, depmod, insmod, rmmod, sysctl, and guiding readers through kernel compilation and configuration using /proc and /sys.
This article walks through the Linux kernel's slab cache memory‑freeing path, explaining the kmem_cache_free API, validation steps, fast‑path and slow‑path reclamation, CPU‑local and NUMA‑node handling, and the final destruction of slab caches with detailed code examples.
This article explains Linux process states, how the scheduler puts processes to sleep and wakes them, describes the problem of invalid wake‑ups caused by race conditions, and provides kernel‑level coding patterns to prevent such issues while illustrating with concrete code examples.
The Linux 6.2 kernel series has been marked end‑of‑life on kernel.org, ending security patches and bug fixes, and users are urged to migrate promptly to the newer 6.3 series which brings several new features and will itself be supported only until mid‑2024.
This article explains the concepts and mechanisms behind Linux kernel tracing tools—including ftrace, perf, kprobes, uprobes, tracepoints, ftrace, perf events, and eBPF—showing how probes are injected, how trace data is collected, and which technology to choose for different debugging and performance scenarios.
This article explains the various Linux kernel synchronization mechanisms—including inter‑process communication, semaphores, mutexes, message queues, shared memory, and thread pools—detailing how they work, when to use them, and their role in ensuring coordinated execution within the kernel.
This guide explains why dual-machine debugging is needed, outlines the two main scenarios (virtual machine and physical machine), and provides step‑by‑step instructions for configuring VirtualKD as well as network‑based kernel debugging on Windows systems, including common test cases and useful commands.
When no runnable processes are available, the kernel switches to an idle loop that repeatedly executes the HLT instruction until an interrupt occurs, after which it resumes normal scheduling by switching from the idle process to a ready task.
Linux kernel 6.3, released after two months of development, brings a host of new power‑management drivers for ARM and RISC‑V, filesystem enhancements, expanded Thunderbolt and HID support, and numerous hardware driver updates, offering developers fresh capabilities while requiring manual compilation for immediate use.
Linux handles network traffic through a layered TCP/IP stack, where incoming packets travel from the NIC’s DMA‑filled ring buffer through interrupt handling, protocol layers, and finally to the application, while outgoing packets follow the reverse path, with each layer adding its own headers and processing.
Ubuntu 23.04 “Lunar Lobster”, the latest short‑term support release, brings the Linux 6.2 kernel with Rust module support, systemd v252.5, upgraded toolchains (OpenJDK 17, .Net 7, Go 1.20, Rust 1.67, Python 3.11), security enhancements, Netplan improvements, and a refreshed desktop installer with GNOME 44 and updated applications.
This article walks you through the complete process of compiling pure‑C eBPF programs using the Linux 4.18 kernel source, covering environment setup, kernel source acquisition, essential build steps, detailed make command analysis, and verification of both user‑space and kernel‑space components.
This article walks through the Linux kernel boot sequence, the initialization of the kernel networking stack, the registration and initialization steps of the Intel I350 (IGB) network driver, and demonstrates how to inspect the resulting network interface using ifconfig and ethtool commands.
This article explains the problem of memory fragmentation in Linux, describes the compaction algorithm that moves free pages together, and walks through the key kernel functions—alloc_pages_node, __alloc_pages_direct_compact, try_to_compact_pages, isolate_migratepages, migrate_pages, and unmap_and_move—detailing their roles in gathering movable pages and relocating them to create contiguous memory blocks.
This article revisits Linux memory allocation, then dives deep into the slab allocator—explaining its relationship with the buddy system, its internal layout, the differences between slab, slub and slob, and how the kernel uses slab caches, per‑CPU caches, and NUMA nodes to efficiently allocate and free small memory objects.
This article explains why Linux’s native networking stack falls short of line‑speed, analyzes the core latency sources such as DMA, memory copying, routing look‑ups and lock contention, and proposes a comprehensive set of kernel‑level redesigns—including VOQ queues, lock‑free data structures, and user‑space stacks—to achieve near‑wire‑speed forwarding.
Linux’s memory allocation mechanisms—Buddy for main memory and Slab/Slub for CPU cache—aim to maximize memory utilization, minimize fragmentation, and boost allocation efficiency, with detailed explanations of their structures, operation steps, and how to inspect them via /proc interfaces.
This article explains Linux huge pages, their performance benefits, implementation details, configuration steps, and the impact on memory reporting, including guidance on using and disabling Transparent Huge Pages for optimal system tuning.
This article explains how Linux computes CPU utilization shown by the top command, detailing the role of /proc/stat, kernel_cpustat, timer interrupts, sampling intervals, and how user, nice, system, irq, softirq, iowait, and idle times are accumulated and reported.
The article explains how different storage media affect I/O speed, describes kernel and user mode separation, introduces DMA and zero‑copy techniques such as mmap + write and sendfile, and discusses PageCache behavior, advantages, drawbacks, and tuning for high‑performance file transfers.
This article explains core Linux kernel networking concepts such as the sk_buff packet buffer, net_device representation of NICs, the relationship between socket and sock structures, layer registration mechanisms, and how Netfilter and routing tables process packets within the stack.
A detailed post‑mortem explains how excessive cgroup files, kubelet's sys‑CPU usage, soft‑interrupt scheduling delays, and a buggy page‑free routine caused intermittent hundreds‑of‑milliseconds network latency in an Alibaba Cloud ACK cluster, and how targeted CPU binding and kernel patches resolved the issue.
Linus Torvalds opened the Linux 6.3 merge window and sharply criticized numerous pull requests lacking clear log messages, calling them garbage and urging developers to always explain their changes, warning that undocumented merges clutter the code history and hinder readability.
The article explains Linux cgroup architecture and initialization in kernel 5.10, covering its hierarchical composition, key data structures like css_set, the two‑phase boot‑time setup, creation of cgroups, and task assignment mechanisms for both cgroup v1 and v2.
This article explains the core principles of Linux file systems, detailing how ext4 organizes data with blocks and inodes, uses indexing, extents, directory storage, bitmap management, meta block groups, and caching mechanisms, including buffered and direct I/O paths.
The article explains Linux’s Virtual File System (VFS) as an interface layer that treats all objects as files, illustrates the concept with Java‑style interface examples, then details the underlying C structures—file, file_operations, dentry, inode—and shows how the kernel links them to enable diverse file systems.
This article introduces eBPF, explains its origins, compares it with SystemTap and DTrace, outlines its core use cases such as network monitoring, security filtering, performance analysis and virtualization, and provides step‑by‑step examples and tooling for Linux kernel tracing.
This article explains the architecture of Mach virtual memory in iOS, details its page‑based management, describes the core data structures and kernel APIs, analyzes the Objective‑C alloc implementation, and walks through the memory‑pressure (Jetsam) mechanism that triggers low‑memory warnings.
This article explores iOS memory optimization by enabling the 'com.apple.developer.kernel.extended-virtual-addressing' entitlement to expand virtual address space and the 'com.apple.developer.kernel.increased-memory-limit' entitlement to raise memory caps, detailing implementation steps, kernel analysis, test results, and practical implications for app stability.
Linux load average, a key performance metric, is computed by periodically aggregating per‑CPU runnable and uninterruptible task counts into a global instantaneous load, then applying an exponential weighted moving average to produce 1‑, 5‑, and 15‑minute averages, which are exposed to user space via the /proc/loadavg pseudo‑file.
This comprehensive guide explains Linux's core components—including the kernel, shell, memory and process management, virtual file system, device drivers, networking, and mounting—while detailing filesystem types, directory structures, link types, and practical commands for managing partitions and mounts.
This article explains Linux's Pressure Stall Information (PSI) mechanism, its /proc and cgroup interfaces, how to monitor CPU, memory, and I/O pressure, and presents code‑level optimizations to reduce PSI overhead and improve system performance.
This article explains Android's Alarm mechanism, covering its overall architecture, the four alarm types, framework and kernel workflows, batch alignment, wake‑up handling, suspend processing, and a real‑world power‑debugging case to help developers optimize battery consumption.
This article explains the implementation of fragment deduplication in the erofs-utils mkfs tool, describing the hash‑based fragment lookup, the conditions for fixing fragments during compression, the generation of additional extents, and the integration of these steps into the existing packing workflow.
This article introduces eBPF, explains its origins and how it extends BPF for kernel‑level observability, compares it with SystemTap and DTrace, outlines common use cases, details its loading‑compile‑execute workflow, and provides step‑by‑step Python/BCC examples with installation instructions and advanced latency measurement code.
This article explains the Linux OOM Killer’s trigger and selection process, walks through the key kernel functions and heuristics that choose a victim process, and clarifies why out‑of‑memory conditions occur under different overcommit settings.
eBPF lets developers run custom, safe code inside the Linux kernel, enabling dynamic networking, load‑balancing, security policies, and observability without restarting services, and its integration with Kubernetes through tools like Cilium and XDP is revolutionizing cloud‑native deployments.
This article explains the distinction between user and kernel space, outlines the steps involved in a process switch, and compares several Linux I/O models—including blocking, non‑blocking, multiplexing, and asynchronous approaches—highlighting their advantages and drawbacks.
This article provides a deep, step‑by‑step exploration of Linux process creation, using Nginx’s worker forking as a concrete example, and walks through the task_struct layout, process states, PID management, address‑space handling, file system structures, namespaces, and the internal logic of the fork system call.
The article discusses Linus Torvalds' push to remove i486 CPU support from the Linux kernel, outlining historical context, technical reasons like the need for the cmpxchg8b instruction, and the diminishing relevance of 32‑bit x86 hardware in modern development.
A remote code execution vulnerability (CVE-2022-42721) affecting Linux kernel versions 5.1 through 5.19.14 allows local attackers to inject malicious WLAN frames that corrupt the mac80211 BSS handling list, enabling execution of arbitrary code, and can be mitigated by upgrading to kernel 5.19.15 or later.
Users of Fedora 35 reported severe screen flickering after upgrading to Linux kernel 5.19.12‑100.fc35, a problem not seen in the previous 5.19.11‑100.fc35 kernel, which Intel engineers identified as a potential LCD power‑sequencing delay and fixed in kernel 5.19.13.
This article explains the fundamentals of Linux interrupt handling, covering the distinction between hardware and software interrupts, the processing flow of hard IRQs, maskable versus non‑maskable interrupts, the need for deferred execution, and a deep dive into softirqs, tasklets, and workqueues with code examples and performance considerations.
Linux kernel 6.0, released on October 2 by Linus Torvalds, brings major enhancements such as Rust support, ARM and RISC‑V improvements, CPU fault detection, better ACPI power management, SMB3 performance, Intel Arc GPU certification, and even Atari PC optimizations, marking it as one of the most commit‑heavy releases in recent history.
This article explains the fundamentals of Linux interrupt handling, covering hardware and software interrupt types, the IRQ processing flow, maskable versus non‑maskable interrupts, the need for deferred execution, and detailed mechanisms of softirqs, tasklets, and workqueues with practical code examples.
This article compares macOS and Linux by exploring their histories, kernel architectures, openness, hardware requirements, software ecosystems, user experience, customizability, gaming support, package management, and update policies, helping readers decide which operating system best fits their needs.
Linux futexes provide a fast userspace lock backed by a kernel wait queue, using atomic operations when uncontended and system calls such as FUTEX_WAIT, FUTEX_WAKE, and priority‑inheritance variants to manage contention, requeueing, and priority inversion via rt‑mutex structures.
This article summarizes a series of technical Q&A from an OSChina event covering Linux networking fundamentals such as port limits, network namespaces, TCP connection handling, C10K problem, packet loss troubleshooting, TCP memory usage, high CPU causes, useful monitoring tools, kernel parameters, and practical socket examples.
The upcoming Linux 6.0 kernel hints at future Rust driver support, but significant hurdles remain such as compiler compatibility, LLVM vs GCC toolchains, and limited architecture support, making widespread Rust integration unlikely until later releases.
Linus Torvalds released the fifth release candidate of Linux 6.0, highlighting numerous driver updates, documentation improvements, filesystem patches, and assorted bug fixes, while noting that the stable version is slated for an October launch.
This guide introduces Linux Device Tree concepts, explains why it was added to the kernel, details its syntax and standard properties, describes common nodes, and provides practical examples of OF functions for accessing nodes and properties in kernel code.
Linus Torvalds announced the fourth release candidate of Linux 6.0, describing it as a regular mid‑cycle test version with various bug and regression fixes, and confirming that the stable 6.0 release is on track for October.
This article explains the four Linux kernel I/O schedulers—NOOP, Anticipatory, Deadline, and CFQ—covering their design goals, how they manage request queues through merging and sorting, and when each scheduler is best suited for different storage hardware and workloads.
This article explains the fundamental concepts of Linux processes, their relationship to programs, threads, kernels, and memory, details the internal task_struct implementation, and walks through the full lifecycle from creation with fork, loading via execve, execution, and termination including exit_group and zombie handling.
The article explains Linus Torvalds' decision to label the next Linux kernel release as 6.0 instead of 5.20, outlines the major code additions—including support for AMD GPUs, Intel Habana Gaudi2, RISC‑V, and new power‑management features—while noting missing Rust patches and performance improvements.
The article explains why computers appear to freeze by describing how the CPU, pre‑emptive multitasking, interrupt handling, and kernel‑level deadlocks interact, showing that simple infinite loops rarely cause a crash while kernel bugs can make the system unresponsive.
Linus Torvalds announced the stable Linux 5.19 kernel, built on an Apple M2‑based ARM64 MacBook with Asahi Linux support, highlighting new features such as LoongArch support, FAT32 timestamps, AMD BRS sampling, RISC‑V 32‑bit compatibility, Zstd firmware compression, and a substantial increase in graphics driver code.
ByteDance engineers have contributed a series of Linux kernel patches that enable uncompressed kernels and other optimizations, reducing Kexec reboot latency from roughly 500 ms to just 15 ms, thereby minimizing server downtime for their high‑traffic services like Douyin.
This article explains the Linux boot sequence on x86 hardware, covering BIOS ROM loading, real‑mode memory layout, the MBR, the setup() assembly routine, transition to protected mode, and the startup_32() function that prepares paging before the kernel begins execution.
The article explains how Linux’s cpuidle framework manages idle CPUs by selecting multi‑level C‑states through core, driver, and governor modules—detailing ladder and menu governor algorithms, latency‑based state selection, and a real‑world case where mis‑configured latency requests prevent deepest idle entry.
This article provides a detailed analysis of Linux kernel spinlocks, focusing on the evolution from ticket‑based locks to the modern queued spinlock (qspinlock), explaining its code hierarchy, data structures, state machine, and the acquisition/release algorithms with accompanying diagrams.
This article provides a comprehensive walkthrough of Linux kernel memory management, covering process address space layout, memory allocation mechanisms, OOM selection criteria, where allocated memory resides, and both manual and automatic memory reclamation techniques, complete with code examples and diagrams.
This article provides a comprehensive analysis of the Linux USB core architecture, detailing the device and interface layers, the struct usb_device model, USB Request Block handling, hub driver operations, EHCI host controller scheduling, and a complete example of a USB mouse client driver, complete with code snippets.
This article explains the Linux FS‑Cache subsystem, detailing how it creates local disk caches called cookies, the structures and workflows of volume, data‑file, and cache cookies, and the mechanisms for allocation, hashing, state‑machine transitions, and cleanup.
This article explains why traditional select and poll struggle with many file descriptors, how epoll redesigns the workflow by registering descriptors once via epoll_ctl, the kernel data structures (eventpoll, epitem) that manage events, and walks through the core functions epoll_create, epoll_ctl, epoll_wait, and their callbacks.
Linux kernel 5.19, announced by Linus Torvalds on June 6, marks a multi‑platform milestone with extensive driver updates, AMD GPU support, new LoongArch64, Apple NVMe, Intel GPU groundwork, and HPE GXP architecture, while preserving stability and signed pull‑request integrity.
This article explains how NFS represents files with file handles, details the generation and decoding mechanisms via export_operations, examines the exportfs API implementation, and explores practical applications such as overlayfs integration and the name_to_handle_at/open_by_handle_at syscalls, providing code examples and kernel‑level insights.
This article provides a comprehensive guide to Linux memory management on x86‑32 systems, covering virtual address spaces, physical address translation, memory zones, user and kernel space layouts, the buddy and slab allocators, malloc/kmalloc/vmalloc mechanisms, and useful commands for inspecting memory usage.
This guide presents a comprehensive set of Linux server optimization techniques—from kernel I/O scheduling and daemon reduction to filesystem choices, TCP tuning, and essential performance commands—helping system administrators boost efficiency, security, and reliability across diverse workloads.
The article argues that programs can indeed run without an operating system by treating the OS itself as a program, discusses the challenges of bootstrapping, memory management, multitasking, device drivers, and concludes that bare‑metal programming lets developers fully control hardware, effectively creating their own minimal OS.
This article explains how the Linux kernel’s kswapd thread is created, when it is awakened, and the detailed steps it follows—including LRU management, zone migration, balance_pgdat, and shrink functions—to reclaim memory efficiently on memory‑constrained devices.
The article dissects Linux’s epoll I/O multiplexing, tracing the flow from socket creation with accept through epoll_create, epoll_ctl registration, and epoll_wait sleeping, detailing the kernel’s eventpoll object, red‑black tree, per‑socket wait‑queue callbacks that enable O(log N) registration and O(1) event delivery for tens of thousands of connections.
This article explains the copy‑on‑write mechanism in Linux by examining page‑table structures, the fork process, and the page‑fault handling code in Linux 0.11, illustrating how the kernel uses read‑only page mappings and page‑fault interrupts to lazily duplicate memory pages.
This guide provides a detailed, step‑by‑step hardening strategy for Linux systems, covering distro selection, kernel choices, extensive sysctl tweaks, boot‑loader parameters, MAC policies, sandboxing, memory allocator hardening, compile‑time mitigations, root account protection, firewall rules, swap configuration, PAM policies, microcode updates, IPv6 privacy, partition mounting options, entropy sources, and physical security measures.
This article explains the Linux file I/O stack by outlining the path from user space through system calls to the kernel layers—VFS, filesystem, block layer, and SCSI—detailing each layer's role, page cache mechanisms, writeback processes, and direct I/O implementations with code examples.
A Linux server repeatedly reports “fork: cannot allocate memory” not because RAM is exhausted but due to excessive Java threads causing PID allocation failures, and the kernel mistakenly maps those failures to the ENOMEM error code.
In this interview‑style tutorial, an Alibaba P7 engineer walks through the limitations of BIO, the non‑blocking NIO API, kernel‑level select/poll mechanisms, and the design of epoll, illustrating how each solves the C10K problem and how they are used in Java.
This article explains in detail how Linux handles local network I/O for 127.0.0.1, comparing it with cross‑machine communication, describing the routing, device subsystem, driver code, and soft‑interrupt processing, and concluding with performance considerations and a discussion on eBPF acceleration.
This article analyzes why Linux reports "fork: cannot allocate memory" when the real issue is an excessive number of threads or PID allocation failures, explains the kernel's do_fork and alloc_pid implementations, and offers guidance for diagnosing and fixing such misleading ENOMEM errors.
This comprehensive guide explores the core components of a Linux system—including the kernel, memory management, process scheduling, file system architecture, device drivers, networking, and shell—while also covering disk partitions, mounting, and practical command examples for system administration.
This article explains the Linux file I/O stack by outlining its clear route from user space to hardware, detailing the roles of VFS, the filesystem, the block layer, and the SCSI driver, and then dives into page cache mechanisms and code paths for both buffered and direct I/O.
The article explains why Linux’s fork() can return a misleading “fork: cannot allocate memory” error, tracing the issue to PID allocation failures in the kernel’s do_fork and alloc_pid functions, and shows how excessive threads, not actual memory shortage, trigger the problem.
This article explains the Linux kernel’s internal process for binding a server socket to 0.0.0.0 (INADDR_ANY), covering the bind operation, handshake handling, and how the kernel matches incoming packets, with illustrative C code snippets.
Under Jason Donenfeld’s leadership, Linux kernel’s random number generator was overhauled in versions 5.17 and 5.18, replacing SHA1 with BLAKE2s and shifting from per‑NUMA to per‑CPU structures, delivering up to a 131% speed increase and an astonishing 8450% boost in getrandom() performance on multi‑core systems.
This article explains how Linux handles local network I/O for 127.0.0.1, detailing the differences from cross‑machine communication, the routing decisions, the loopback device driver, soft‑interrupt processing, and the complete kernel execution flow for both sending and receiving packets.
On arm64 Linux kernels (e.g., 5.10.27), the mlock system call marks VMAs with VM_LOCKED, forces page faults, sets the PG_mlocked flag and moves pages into the unevictable LRU so they cannot be reclaimed, while munlock clears these flags and returns pages to regular LRU lists, guaranteeing resident memory for latency‑sensitive applications.
This article provides an in‑depth overview of Linux memory architecture, including address spaces, segmentation and paging, memory allocation strategies such as the buddy and slab allocators, kernel and user‑space memory pools, DMA considerations, common pitfalls, and practical tools for monitoring and optimizing memory usage.
This article systematically explains the Linux driver ecosystem by covering the bus‑device‑driver model, the role of device trees in decoupling hardware description from driver code, and step‑by‑step guidance for creating a custom development board with full DTS and kernel integration.
The 2021 Linux roundup covers Richard Stallman's surprising return, Arch Linux's new installer script, Microsoft Edge arriving on Linux, the rise of CentOS alternatives, the Steam Deck's Linux‑based OS, Epic's Easy‑Anti‑Cheat Linux support, GNOME 40's redesign, kernel 5.15 native NTFS support, Linux turning 30, Linus Tech Tips' 30‑day Linux challenge, Asahi Linux's progress on Apple M1, and the impact of Windows 11 on Linux adoption.
The article explains the vague but important upstream/downstream terminology in Linux, illustrating its meaning with ISP traffic, kernel development, distribution packaging, application maintenance, and package‑manager automation, and shows why understanding data flow direction matters for developers and maintainers.
This article explains the reasons behind Linux's sophisticated memory management, covering virtual memory mechanisms, page tables, MMU/TLB interactions, page fault handling, the layout of a process's address space, glibc's malloc internals, memory reclamation techniques, and the OOM killer's decision process.
This article explains why Linux routing is essential for container networking, details how routing works during packet transmission and reception, explores routing tables and lookup mechanisms in the kernel, and provides practical commands for enabling forwarding, inspecting, modifying, and testing routing rules.
A concise roundup of the most impactful Linux events of 2021, covering Richard Stallman's comeback, Arch Linux's new installer script, Microsoft Edge's stable Linux release, CentOS alternatives, Steam Deck's Linux base, anti‑cheat support, GNOME 40, native NTFS driver, Linux's 30th anniversary, Linus Tech Tips' desktop experiment, Apple M1 Linux progress, and the implications of Windows 11.
