The article walks through libbpf’s step‑by‑step process for opening the vfsstat.bpf.o ELF object, validating options, parsing ELF headers, collecting sections, initializing maps and programs, and preparing the eBPF program for later kernel loading and attachment.
This article explains the Management Component Transport Protocol (MCTP), its Linux address family implementation AF_MCTP, driver and network configuration steps, socket programming examples, debugging techniques, and real‑world applications for component monitoring and management in firmware ecosystems.
This comprehensive guide explores Linux kernel debugging essentials, covering pseudo filesystems like procfs, sysfs, debugfs, relayfs, and advanced tracing tools such as ftrace, kprobe, systemtap, perf, KGTP, and LTTng, with practical commands and reference links.
This article explains key GNU C extensions used in the Linux kernel—including typeof, zero‑length (flexible) arrays, case ranges, labeled initializers, variadic macros, function and variable attributes, built‑in functions, asmlinkage, and UL suffixes—showing why they exist, how to use them safely, and providing concrete code examples.
This article traces the evolution of eBPF from its BPF predecessor, explains its kernel requirements, security model, probe mechanisms, performance impact, tracing capabilities, and potential event‑loss risks, and looks ahead to its expanding role in networking and system observability.
This comprehensive guide walks beginners through the Linux kernel’s architecture, source acquisition, configuration, compilation, installation, key subsystems, essential programming knowledge, and how to join the kernel community, providing practical code examples and curated learning resources.
This article explains what the Linux kernel is, explores its different architectures—including microkernel, monolithic, and hybrid designs—covers kernel file locations, module handling, and offers a comprehensive learning roadmap with recommended books and hands‑on advice for anyone wanting to understand operating system fundamentals.
This article explains the virtio framework for para‑virtualized hypervisors, comparing full and para‑virtualization, detailing the architecture, buffer model, core API, driver examples, and future directions, providing a comprehensive overview of Linux I/O virtualization.
This article explains the concept of sockets using a plug analogy, details their usage in TCP/UDP communication, explores the kernel's sock structures and inheritance tricks, and describes how sockets expose network functionality to user‑space programs through file descriptors and queues.
Linux kernel introduced the struct folio abstraction to replace ad‑hoc compound‑page tricks, giving a clear collection‑oriented representation for power‑of‑two page groups such as THP and HugeTLB, and providing dedicated APIs that eliminate naming confusion, unify reference handling, and make memory‑management code safer and easier to understand.
The article explores how Rust's memory‑safety and efficiency are driving major companies like Microsoft, Google, and Amazon to rewrite operating‑system components and cloud services, while also tracing Rust’s quirky origins, rapid rise in popularity, and the challenges it still faces.
This article explains essential GNU C extensions used in the Linux kernel—including typeof, zero‑length (flexible) arrays, case range labels, designated initializers, variadic macros, function and variable attributes, built‑in functions, asmlinkage, and UL suffixes—showing why they matter and how to apply them safely.
This article reviews Linux disk‑encryption technologies, explaining data‑at‑rest security concepts, comparing full‑disk encryption (hardware and dm‑crypt/LUKS) with filesystem‑based encryption (stacked eCryptfs and native fscrypt), and providing an in‑depth analysis of eCryptfs architecture, key management, and implementation details.
TencentOS “Wujing” provides a server‑memory multi‑level offloading framework that uses kernel‑side reclamation, heat‑aware page classification, SWAP balancing, and CXL promotion to shift cold pages to cheaper storage, cutting data‑center memory use by up to 50 % while preserving performance.
Linux introduced the read‑write semaphore (rwsem) as a sleep lock that lets multiple readers hold the lock concurrently, improving read‑heavy workload performance, and the article details its internal state representation, acquisition paths for reads and writes, optimistic spinning, handoff mechanisms, and trade‑offs, noting that mobile kernels may need further tuning.
This article details a systematic investigation and multi‑stage optimization of TencentOS network latency, uncovering kernel soft‑interrupt bottlenecks, proposing and upstreaming patches to net_rx_action, RPS handling, and ksoftirqd scheduling, ultimately reducing handshake failures by over 80% while sharing practical insights for Linux kernel developers.
This article analyzes the EROFS cluster modes (INFLIGHT, HOOKED, FOLLOWED, FOLLOWED_NOINPLACE) in Linux kernel 6.x, explaining how they determine whether in-place I/O can be used based on the current status of pclusters in the chain.
This article walks through the Linux kernel's slab allocator, explaining how kmem_cache and kmem_cache_node structures are created, how slab objects are laid out in memory, how the required number of pages is calculated, and how the allocator is bootstrapped to avoid circular dependencies.
By profiling the OCI runtime with hyperfine and applying a series of kernel patches, seccomp hash optimizations, and BPF compilation caching, the author reduced container start‑up time from roughly 160 ms in 2017 to just over 5 ms today—a near 30‑fold speedup.
This article explains key GNU C extensions used throughout the Linux kernel—including typeof, zero‑length (flexible) arrays, case range labels, designated initializers, variadic macros, function and variable attributes, built‑in functions, asmlinkage and UL suffixes—showing why they exist and how to apply them safely with concrete code examples.
Linux kernel synchronization requires protecting shared mutable state from concurrent access using primitives such as spinlocks, mutexes, read‑write locks, or lock‑less techniques like RCU, which copies data and waits for a grace period, each offering distinct performance, latency, and complexity trade‑offs.
This article introduces the Linux kernel, explains its role and different architectures—including microkernel, monolithic, and hybrid designs—covers their advantages and disadvantages, describes kernel file locations, modules, and offers practical learning tips and reference resources for system programmers.
This article explores Linux kernel TCP connection handling by examining socket data structures, port range and file descriptor tuning, core functions like tcp_v4_rcv, and lookup mechanisms, while offering practical tips to boost client-side concurrent connections beyond traditional limits.
This article, based on ByteDance STE’s 2022 Linux Kernel Developer Conference talk, explains the HVO (HugeTLB vmemmap Optimization) feature that dramatically reduces struct page memory for huge pages, details its latest enhancements, cross‑architecture support, usage steps, performance trade‑offs, and future plans.
Intel’s Linear Address Masking (LAM) feature, which repurposes unused bits of 64‑bit virtual addresses for metadata, was proposed for Linux 6.2 but faced strong criticism from Linus Torvalds and was ultimately not merged, prompting Intel to rewrite the code for a future kernel release.
The article explains why Linux’s Completely Fair Scheduler introduced group scheduling, how Android configures task groups via cpu.shares and Process.java, and details the kernel structures (task_group, sched_entity, cfs_rq) and algorithms for weight calculation, load measurement, propagation, and hierarchical load balancing.
Bilibili’s video CDN replaced its traditional TCP‑based gateway with a QUIC/HTTP‑3 gateway and, to curb the extra CPU load caused by complex UDP handling, adopted AF_XDP kernel‑bypass sockets that redirect packets via XDP, cutting CPU usage by about half, raising peak bandwidth to roughly 9 Gbps and improving per‑bandwidth efficiency by up to 30 %.
This article provides a comprehensive overview of eBPF, explaining its origins, core concepts, comparison with SystemTap and DTrace, common use cases such as network monitoring, security filtering, and performance analysis, and includes step‑by‑step Python examples with BCC for tracing and latency measurement.
A Xiaomi engineer submitted a set of Linux kernel patches to implement JEDEC’s UFS File‑Based Optimization (UFS FBO) for better storage performance, but kernel maintainer Christoph Hellwig harshly criticized the proposal as completely misguided and unrelated to the kernel, making acceptance unlikely.
Linux’s Direct Rendering Manager (DRM) replaces the legacy framebuffer by providing a kernel subsystem that unifies GPU and display control through libdrm, KMS, and GEM, tracing its evolution from 1999 DRI origins to atomic APIs, and illustrating usage via a step‑by‑step modeset example.
This article analyzes a Kubernetes‑Docker environment where Java pods encounter “fork: Resource temporarily unavailable” errors, tracing the issue through kernel event logs, ulimit settings, PID limits, and related sysctl parameters, and provides detailed recommendations for kernel and user‑level configuration to prevent such failures.
From 2010 to 2022 the Linux kernel moved from reactive, out‑of‑tree hardening to a proactive KSPP‑driven era, integrating probabilistic and deterministic mitigations, hardware‑backed defenses, and compiler‑level checks, while Android’s adoption and emerging Rust‑based components accelerated mainstream security hardening.
This interview reveals how ByteDance’s STE team, a youthful group of Linux kernel engineers, identified and solved memory‑management redundancy, contributed the HVO and VDUSE projects to the open‑source community, and leveraged these advances to boost cloud‑native performance and reliability across the company.
This article provides a comprehensive analysis of how JDK NIO performs file read and write operations by examining the underlying Linux kernel mechanisms, including the differences between Buffered and Direct IO, the structure and management of the page cache, file readahead algorithms, and the kernel parameters governing dirty page writeback.
JEDEC’s new UFS File‑Based Optimization (FBO) 1.0 standard defines an interface for host‑device communication to defragment file‑related LBA ranges, but a Xiaomi engineer’s Linux kernel patch implementing it was sharply criticized by kernel veteran Christoph Hellwig as impractical and unrelated to the kernel.
JEDEC’s new UFS File‑Based Optimization (FBO) 1.0 standard aims to improve flash storage performance by defragmenting LBA ranges tied to specific files, but a Xiaomi engineer’s patch proposal to implement it in Linux was sharply rejected by kernel veteran Christoph Hellwig, who called the idea fundamentally flawed.
Using eBPF to bypass traditional bridge, netfilter, and routing steps, this article demonstrates how container network packet forwarding can be accelerated, reducing receive and transmit latency by around 40‑82%, with detailed perf‑ftrace analysis, code examples, and performance comparisons of three forwarding modes.
Linus Torvalds warns kernel developers against waiting until the last days of the two‑week merge window to submit patches for Linux 6.0, urging early preparation to reduce review pressure and improve code quality.
DirtyPipe (CVE‑2022‑0847) is a high‑severity Linux kernel flaw that lets attackers arbitrarily overwrite any readable file via an uninitialized pipe‑buffer flag, enabling privilege escalation on Android and other systems by patching shared libraries, bypassing SELinux, loading malicious modules, and ultimately gaining root, highlighting urgent need for patches and integrity protections.
This article deeply explores the Linux kernel's handling of JDK NIO file reads and writes, detailing the role of page cache, radix trees, buffered versus direct I/O, prefetch algorithms, dirty‑page write‑back mechanisms, and the key sysctl parameters that control performance and data safety.
This article deeply explores JDK NIO's file reading and writing mechanisms, revealing how Buffered and Direct IO interact with Linux's page cache, the kernel's radix tree, prefetch algorithms, and dirty page management, while providing practical code examples and performance insights for developers.
Linux rwsem is a read‑write semaphore that lets multiple readers or a single writer hold the lock, using a count field, owner pointer, optimistic‑spin queue (osq), and protected wait list; it provides fast, medium, and slow acquisition paths with handoff and optimistic spinning to reduce sleep latency compared to mutexes and spinlocks.
The article explains how Uber replaced CPU quota enforcement with cpusets (CPU pinning) for stateful workloads, reducing P99 latency, improving performance consistency, and saving about 11% of cores across the cluster by eliminating throttling.
This article explains how Linux kernel version numbers have evolved—from Linus Torvalds’s early simple increment scheme to the modern three‑component “major.minor.revision” format—detailing the meaning of each segment, the role of patch and release‑candidate identifiers, and how to identify kernel versions using uname.
The article explains how the Linux kernel implements the TCP three‑way handshake, detailing server listen queue allocation, client connect port selection and SYN transmission, SYN‑ACK processing, state transitions, request‑socket management, full‑connection queue handling, and the final accept call, plus tuning tips.
Netfilter, the Linux kernel’s packet‑processing framework, uses a series of hook points and the NF_HOOK macro to let user‑space tools like iptables register callback functions that inspect, modify, or drop packets, with detailed structures for tables, chains, rules, priorities, and connection tracking.
This guide walks you through checking your current CentOS 8 environment, downloading the Oracle‑provided centos2ol.sh script, executing it to replace packages and switch kernels, and verifying the successful migration to Oracle Linux Server with the Unbreakable Enterprise Kernel.
pwru, Cilium’s eBPF‑based packet tracing utility, offers fine‑grained network diagnostics; this guide covers kernel requirements, installation steps, command‑line options, real‑world iptables drop detection examples, and an in‑depth look at its eBPF map configuration and perf‑event output mechanism.
This comprehensive guide explains Linux kernel performance profiling—both on‑CPU and off‑CPU—by stressing the need to target the critical 3 % of code, covering throughput, latency and power metrics, scalability laws, flame‑graph visualizations, perf and eBPF tools, lock‑contention analysis, and further reading recommendations.
This article introduces pwru, Cilium’s eBPF‑based network packet tracing utility, covering installation prerequisites, command‑line options, real‑world debugging scenarios, and the underlying implementation that leverages kprobes, eBPF maps, and perf events to filter and display packet data.
This article provides a comprehensive overview of the Linux kernel, explaining its purpose, different kernel architectures (microkernel, monolithic, hybrid), file locations, loadable modules, and offers practical learning advice and resource recommendations for anyone seeking to grasp operating‑system fundamentals.
Researchers dissect the DirtyPipe (CVE‑2022‑0847) Linux kernel flaw affecting Android, explaining its uninitialized flag bug in splice, the patch changes, and detailed exploitation techniques that modify read‑only .so files to achieve arbitrary writes, bypass SELinux, and ultimately obtain root privileges.
The article explains Linux’s Related Thread Group (RTG) mechanism—its struct definition, default Android grouping, core‑selection logic that boosts whole groups to big‑core clusters, load‑aggregation for DCVS frequency decisions, and the newer busy‑hysteresis feature that delays low‑power entry to improve performance and power efficiency.
The Linux kernel’s mutex is a sleeping lock that serializes access by sleeping threads, enforces strict ownership rules, uses a state flag with a wait list and per‑CPU optimistic spin queue, offers APIs like mutex_init, lock, unlock and trylock, and employs handoff and MCS‑style spinning to improve performance, with OPPO’s team optimizing it to reduce UI jank.
This article explains how the Linux kernel’s likely and unlikely macros, which wrap GCC’s __builtin_expect, guide branch prediction to improve cache utilization and pipeline efficiency, and demonstrates their impact with sample code and assembly analysis.
This guide explains how to configure VSCode with Remote‑SSH and GNU Global to edit and navigate large Linux kernel source code on a powerful remote Linux server, overcoming local machine performance limits and platform dependencies for a smooth, scalable development experience.
The article delivers a comprehensive, code‑level examination of Linux’s schedutil (sugov) CPU‑frequency governor, detailing its architecture, key data structures, registration with the cpufreq core, utilization‑driven frequency calculation (including iowait boost and limit handling), and the start‑stop lifecycle, while noting its default status and remaining mobile‑platform challenges.
BUS DCVS dynamically scales DDR bus frequency and voltage using bandwidth‑monitor (bw_hwmon) and memory‑latency (memlat) governors within the Linux devfreq framework, aggregating votes from CPU, GPU, and other masters to balance performance and power across varied workloads such as audio playback and high‑definition video streaming.
Arnd Bergmann's new patch lets the Linux kernel default to the GNU11 dialect, enabling modern C99/C11 features, with Linus Torvalds' backing, and the change is set to be tested in the upcoming v5.18 release.
The Linux kernel community is debating moving from the outdated C89 standard to a modern C standard—likely C11—for the upcoming 5.18 release, driven by bug fixes, macro safety concerns, and support from key developers.
This comprehensive guide walks through the fundamentals of process scheduling in operating systems, covering scheduling concepts, OS classifications, process types, priority mechanisms, preemptive vs cooperative models, design goals, classic algorithms such as FCFS, SJF, RR, MLFQ, and the evolution of Linux schedulers from O(n) and O(1) to the modern CFS, complete with code excerpts and practical examples.
The 2021 Linux kernel saw a surge of new features and hardware support but recorded fewer commits and lines of code than previous years, with detailed Phoronix statistics highlighting author contributions, code churn, and the impact of release schedules.
This article explains the purpose of the TCP RST flag, how the kernel and application layers detect it, the various scenarios that trigger RST, why an RST may not terminate a connection, and the security implications of RST attacks.
The article delves into Linux 5.10.61’s CFS task placement code, explaining the Energy‑Model framework, key data structures, and energy calculations, then walks through select_task_rq_fair’s wake‑up, fork, and exec paths, detailing EAS CPU selection, wake‑affine logic, fast and slow CPU‑selection algorithms, and how they balance performance with power on heterogeneous mobile platforms.
This article explores the evolution of BPF from its origins as a packet‑filtering mechanism to the modern eBPF engine, detailing its architecture, security and performance benefits, core features such as hooks, maps and helper functions, and real‑world cloud‑native use cases like Cilium, Falco and kubectl‑trace.
This article introduces eBPF as a register‑based virtual machine inside the Linux kernel, explains its non‑Turing‑complete design, shows how programs are loaded, verified, and attached to events, and provides a complete C example that counts TCP, UDP, and ICMP packets on a loopback interface.
This article explains how CPUs receive interrupt numbers through hardware, exceptions, or the INT instruction, describes the structure and purpose of the Interrupt Descriptor Table, and details the stack operations and control‑flow steps the processor performs to handle and return from an interrupt.
eCryptfs is a Linux kernel‑integrated stacked filesystem that encrypts both file names and contents using per‑file symmetric keys protected by passphrase‑or public‑key‑encrypted key wrappers, managed by a user‑space daemon and kernel keyring, with Ubuntu installation via ecryptfs‑utils, mount commands, and a read/write flow that incurs performance overhead and cache‑based security risks.
This article dives deep into the Linux kernel implementation of the TCP three‑way handshake, explaining the roles of listen, connect, SYN/ACK processing, queue management, timers, and accept, while providing concrete code snippets and diagrams to help backend engineers master the underlying mechanics.
This article explains the inner workings of KernelAddressSanitizer (KASAN) in the Linux kernel, covering how to enable it, the shadow‑memory mechanism, redzone handling for heap, global and stack allocations, and how to interpret the detailed KASAN bug reports generated at runtime.
At the recent Linaro Connect virtual conference, Linux kernel maintainer Miguel Ojeda, a Google employee, detailed the ongoing Rust for Linux project, noting existing RFC patches for Rust infrastructure and a basic virtual driver, the progress of three compiler back‑ends, and the roadmap toward integrating Rust into the kernel.
Linus Torvalds publicly condemned a GitHub merge in a Linux kernel pull request, explaining his long‑standing opposition to GitHub’s pull‑request workflow, the importance of proper PR signing, and the conditions under which such contributions may be accepted.
Linus Torvalds criticizes the use of GitHub’s merge interface for Linux kernel contributions, arguing that its commit messages lack essential details such as what is being merged, why, and proper author attribution, and he emphasizes the need for signed, well‑documented PRs despite his past reluctance to use GitHub.
dm‑verity is a Linux device‑mapper target that protects a data partition’s integrity by using a compile‑time hash‑tree stored on a separate hash device, with Android employing it for verified boot; user‑space creates the dm device, loads the verity table, activates it, while the kernel’s dev_create, table_load, and suspend handlers set up mapped_device structures and enforce per‑block hash verification during I/O.
Linus Torvalds lambasts GitHub’s merge interface as generating useless commit messages while still merging Paragon’s NTFS driver, and Lenovo announces a new end‑to‑end PaaS service that bundles hardware, software and support into a subscription model.
This article explains the principles behind Linux's epoll mechanism, how IO multiplexing enables a single thread to manage many file descriptors efficiently, the role of non‑blocking sockets, and why epoll outperforms select and poll for high‑concurrency network services.
This article explains how eBPF evolved from classic packet filtering to a powerful, programmable kernel virtual machine that enables high‑performance networking, hardware offload, and flexible security, making it increasingly vital for operators, system administrators, and enterprise solution providers.
This article examines common TCP handshake anomalies in backend systems, detailing how client port exhaustion and server-side connection queue overflows cause packet loss and latency spikes, while providing kernel-level insights and practical configuration strategies to optimize network performance and ensure reliable service availability.
The Intelligent Power Allocation (IPA) governor, introduced in Linux kernel 4.2, uses a PID‑based closed‑loop controller and a dynamic power allocator to distribute sustainable power among CPU, GPU and other IP cores, maximizing performance while respecting temperature limits, but requires careful PID tuning and device‑tree configuration.
This article introduces the fundamentals of BPF and its extended version eBPF, explains their kernel‑resident virtual machine architecture, demonstrates simple packet‑filtering examples, outlines the eBPF program lifecycle, describes key BPF system‑call commands, and surveys the various eBPF map types used for efficient data handling in Linux.
This article explains how U‑Boot loads the device‑tree blob into memory, transfers its address via the r2 register using either bootm_header_t or legacy boot parameters, and describes the kernel’s two‑stage parsing process that validates, scans, and unflattens the tree into device nodes.
The Linux cpufreq framework, organized into generic, driver, and governor layers, manages dynamic frequency and voltage scaling for big‑LITTLE CPUs by exposing sysfs controls, using policies like Interactive (periodic sampling) and Schedutil (event‑driven) to balance performance and battery life on modern smartphones.
This article explains the fundamentals of Linux epoll as a high‑performance IO multiplexing tool, compares it with select and poll, shows why non‑blocking file descriptors are required, and details the kernel‑level data structures and callbacks that make epoll efficient for backend services.
This article explains why reading Linux kernel source matters, advocates starting from real‑world problems, contrasts a "carpet‑bombing" approach with a precision‑guided method, and shares concrete tools, resources, and step‑by‑step tips for efficiently exploring kernel code.
This article explains how computer buses work, the different types of buses, the role of I/O device interfaces, device controllers, DMA and interrupt controllers, and how Linux implements device drivers to provide a unified I/O subsystem.
This article provides a comprehensive analysis of the Linux kernel's handling of localhost network I/O, detailing how packets destined for 127.0.0.1 bypass physical network interfaces, traverse the routing table, and utilize the loopback virtual device and soft interrupts for efficient intra-machine communication.
This article explains the true nature of a file descriptor (fd) in Linux, tracing how the kernel represents open files through task_struct, files_struct, fdtable, and inode structures, and shows how these layers interact with system calls like open, read, write, dup, and fork.
This article explains the Linux kernel's heap memory allocation process, covering the vm_area_struct and mm_struct data structures, the brk system call implementation, and the page‑fault handling that maps virtual addresses to physical memory, while also mentioning other allocation mechanisms such as mmap and HugePages.
AWS introduces a new EMR Studio IDE to accelerate data science workflows, while the Linux community bans University of Minnesota contributions over malicious patches and Google Chrome adopts Intel‑Microsoft hardware‑enforced stack protection to harden browser security.
Linus Torvalds, the creator of Linux, publicly denounced C++ as a terrible language while supporting the inclusion of Rust in the kernel, sparking heated debate among developers about language choice, safety, and the future of low‑level system programming.
This article introduces the Linux kernel, explains its purpose and different architectures—including microkernel, monolithic, and hybrid designs—covers where kernel files reside, describes kernel modules and their management, and shares practical learning strategies and resources for newcomers.
This article explains the origins and evolution of BPF into eBPF, compares it with classic kernel modules, describes eBPF tracing mechanisms, and shows how eBPF can be leveraged to secure container runtimes against escape and other cloud‑native threats.
The article examines how Rust is entering the Linux ecosystem, detailing discussions between Linus Torvalds and Greg Kroah‑Hartman, the motivations for using Rust in kernel development, and the potential impact on safety and driver programming.
This article provides an in‑depth exploration of Linux’s epoll mechanism, covering its blocking behavior, kernel‑level processing, NAPI optimization, comparisons with select/poll, and practical insights into I/O multiplexing, helping backend engineers understand performance characteristics and design efficient network services.
Learn how to compile the Linux 4.19.172 kernel on CentOS, create a rootfs with BusyBox, and set up QEMU‑based debugging using GDB, including required kernel boot parameters, troubleshooting static linking errors, and optional Eclipse visual debugging.
Understanding CPU power management involves static and dynamic power, the cpufreq framework’s core, governor, driver, and stats components, and common governors, while the schedutil governor—introduced in Linux 4.7—leverages scheduler utilization data, fast‑switching, and tunable parameters to compute and apply per‑cluster frequencies instantly for low‑latency, fine‑grained scaling.
This article introduces the Linux kernel, explains its role as the core of the operating system, details version‑naming conventions and how to interpret kernel version strings, and outlines its main functions such as process, memory, file, device, and network management.
This article explains how Linux manages TCP sockets at the kernel level, demonstrates how to adjust port ranges and file‑descriptor limits, and shows the key data structures and lookup functions that enable high‑concurrency TCP connections, providing practical guidance for scaling client connections.
This article explains the differences and interactions between the SO_REUSEADDR and SO_REUSEPORT socket options, shows how they behave on BSD and Linux kernels across versions, and provides code examples and tables to illustrate binding rules, TIME_WAIT handling, and the evolution of reuse‑port support.
The article explains eBPF’s evolution from packet filtering to a C‑compiled, sandboxed kernel framework, describes its core concepts of bytecode, JIT, and maps, and walks through building, loading, and using an Android eBPF program that counts system calls per PID via tracepoint hooks.
