This article explains the principles, applications, and Linux kernel implementation of connection tracking (conntrack), covering its role in NAT, L4 load balancing, key data structures, hook mechanisms, and performance considerations with detailed code examples.
This article explains how to adjust Linux kernel port ranges and file descriptor limits, explores the internal structures of TCP sockets, and walks through key kernel functions such as tcp_v4_rcv and __inet_lookup that locate sockets based on IP and port tuples, providing practical guidance for increasing TCP concurrency.
This article chronicles Linus Torvalds' journey from a graduate student tinkering with a 386 PC and Minix to creating the Linux kernel, highlighting the technical, historical, and community factors that propelled Linux to become the leading open‑source operating system.
Linus Torvalds explains that developers often overestimate delegation and code importance, emphasizing that user needs trump code quality, that appropriate workflows matter more than tools, and that trust, proper use of SCM, and open communication via mailing lists are key to successful large‑scale projects.
KASAN, the Kernel Address Sanitizer, is a built‑in Linux kernel tool that uses shadow memory to mark each 8‑byte block’s accessibility, enabling detection of out‑of‑bounds and use‑after‑free errors while consuming about one‑eighth of RAM and requiring kernel configuration changes to activate.
This article provides a detailed quantitative analysis of TCP connection establishment latency, examining normal handshake processes, abnormal scenarios like queue overflows and TIME_WAIT exhaustion, and offering practical optimization strategies for backend systems.
FUSE implements a user‑space file‑system framework where a kernel module creates the /dev/fuse device and forwards VFS requests into kernel queues, while a multi‑threaded daemon reads these requests, optionally uses splice for zero‑copy, processes them, and writes replies back, enabling simple file‑system development without kernel recompilation.
This article explains the architecture, core components, and operation flow of the Linux FUSE (Filesystem in Userspace) framework, details kernel module loading, mount parameters, request handling, and provides practical optimization tips for building efficient user‑space file systems.
A high‑traffic Java service using MongoDB experienced intermittent latency spikes and a full‑scale outage caused by excessive connection churn, kernel‑level random‑number generation bottlenecks, and mis‑configured client timeouts, which were diagnosed through log analysis, packet captures, and performance testing, leading to concrete mitigation steps.
The article thoroughly examines the Linux SCSI subsystem architecture, illustrating how abstract hardware topology—hosts, channels, IDs, and LUNs—is modeled in software through structs such as scsi_host and scsi_device, and detailing initialization, scanning, path establishment, power management, and block‑layer integration to guide kernel storage driver design.
Linux Kernel 5.9-rc3 has been released, featuring a massive introduction of over two thousand fallthrough macro instances, numerous driver and architecture updates—including AMD Sienna Cichlid and Navy Flounder GPU support, Intel Rocket Lake and SERIALIZE instructions, RISC‑V enhancements, NVMe ZNS, and other improvements—while the stable 5.9 version is expected in early to mid‑October.
DiDi Cloud reduced GPU VM provisioning latency by over 90% through kernel‑level pre‑zeroing of idle pages, transparent huge pages, optimized VFIO DMA mapping, and boot‑sequence streamlining, turning GPU instance creation faster than CPU‑only VMs and meeting strict latency demands.
This article walks through the path from a Java program to the Linux kernel, detailing how the JVM is launched, how libjvm.so is loaded, how pthread_create maps to the clone system call, and what kernel resources are shared by Java threads.
This article explains the core synchronization mechanisms used in modern Linux kernels—including atomic operations, spinlocks, semaphores, and mutexes—detailing their definitions, underlying implementations, API usage, performance characteristics, and appropriate usage scenarios across different execution contexts such as process, interrupt, and soft‑interrupt contexts.
Linus Torvalds publicly denounced Intel’s AVX‑512 instruction set, calling it a ‘power‑virus’ that bloats CPUs for niche benchmark gains, urging Intel to abandon it in favor of simpler, more efficient code that benefits everyday users rather than specialized high‑performance scenarios.
The article reviews USB 3.0’s higher 5 Gbps (10 Gbps Gen 2) bandwidth, asynchronous transfers, burst and stream capabilities, explains the reversible Type‑C connector’s power‑delivery, dual‑lane data and DisplayPort alternate mode, and details USB 3.0 OTG role negotiation via CC pins together with Linux kernel and ConfigFS support.
The Linux kernel’s generic crypto framework, introduced in version 2.5.45, defines core structures such as crypto_template, crypto_alg, crypto_instance and crypto_tfm to dynamically register and combine algorithms (e.g., ecb(aes)), providing a uniform API for symmetric, asymmetric, hash and other primitives, supporting user‑space access via AF_ALG and practical use cases like Android file‑based encryption with built‑in self‑tests for correctness.
Linux Kernel 5.8 RC1 has been released, featuring extensive code changes—including updates to AMD Radeon drivers, SELinux optimizations, power management, new hardware support like Intel Tiger Lake Thunderbolt and Habana Labs Gaudi accelerators, as well as numerous filesystem improvements and documentation clean‑ups, with the stable release slated for mid‑August.
The article explains how the Linux CFS scheduler places newly created or awakened tasks—during fork, exec, or wake‑up—by using sched domains and flags to invoke select_task_rq_fair, which then chooses among energy‑aware, least‑loaded, or idle‑sibling CPUs based on capacity, energy impact, and affinity.
The Linux kernel’s page‑cache indexing migrated from the classic radix‑tree structure—using shift‑based multi‑way nodes, RCU‑protected insert, lookup, and delete operations—to the newer XArray API introduced in 4.20, which retains the radix layout while offering automatic resizing, built‑in locking, richer marking, and a cleaner, safer interface.
Linux’s devfreq framework provides a generic DVFS subsystem for non‑CPU devices, defining standardized kernel‑space structures (devfreq_profile, devfreq_governor, devfreq_device) and sysfs user‑space interfaces, and managing device initialization, frequency scaling via governors, and clean removal, enabling flexible power‑performance optimization across heterogeneous SoC components.
This article details the development, testing, and patch contributions for Netfilter and Mellanox flowtable hardware offload, showing how offloading conntrack and NAT functions dramatically improves bandwidth and packet‑per‑second metrics while exposing remaining challenges such as neighbor handling and port mangling.
This article thoroughly examines Linux's epoll mechanism, detailing its SLAB memory management, middle‑layer design, edge and level triggering, comparison with select/poll, and related advanced polling technologies such as /dev/poll and kqueue, while also discussing C10K/C10M challenges and practical solutions.
This article explains what an IDT is, how it is initialized, the structure of interrupt descriptor entries and gates, the implementation of traditional system calls via int 0x80, and the setup and handling of hardware interrupts in the Linux kernel.
Meituan's security team explains cloud‑native architecture, outlines container‑escape threats from kernel bugs, vulnerable runtimes and misconfigurations, and recommends mitigation through hardened kernels, secure‑container runtimes like gVisor or Kata, rigorous patch management, and collaborative feature development to strengthen runtime protection.
This article explains what CPU interrupts are, distinguishes synchronous and asynchronous types, describes the role of APIC controllers, and details the step‑by‑step initialization of the Interrupt Descriptor Table and related interrupt handling mechanisms in the Linux kernel.
This article chronicles the Linux kernel’s development from its 0.01 inception through version 5.4, highlights key milestones and features, introduces the openEuler distribution and its ARM/Kunpeng support, and outlines a forthcoming series that will dive deeper into kernel internals and system security.
This guide walks you through using an automated script to download dependencies, build QEMU 4.1.1, compile the Linux 4.19.1 kernel and BusyBox for ARM64, and install openEuler 1.0 in a virtual machine, including optional GDB debugging and snapshot tips.
This article explains how Linux kernel abstracts diverse GPIO hardware through a layered software framework, covering hardware variations, pin control, GPIO subsystem design, and practical considerations for embedded engineers handling new boards and drivers.
This article explores the physical structure of RAM, compares random and sequential memory I/O performance, examines real‑world bandwidth versus advertised specs, delves into NUMA latency differences, and shows practical optimization techniques for PHP7 and Redis based on deep hardware and kernel knowledge.
This article explains how embedded Linux on Exynos4 determines which peripheral clocks are enabled or disabled, describes the struct clk representation, shows the registration process in Clock‑exynos4.c, and provides the APIs (clk_get, clk_enable, clk_disable, etc.) for querying and managing module clocks such as the LCD controller.
A user reported extremely slow first SSH login on a UCloud “High‑Kernel Ubuntu 18.04” instance, which was traced to slow entropy‑pool initialization in the Linux kernel, a libssl 1.1.1 bug, and a kernel configuration issue, leading to a fix involving disabling MOTD or enabling CONFIG_RANDOM_TRUST_CPU.
Linux Kernel 5.4, the final major stable release of 2019, introduces a kernel lockdown feature enhancing security, native exFAT filesystem support, and a host of hardware and driver updates including Snapdragon 855, newer AMD/Intel GPUs, Icelake Thunderbolt, VirtIO‑FS, and various filesystem and UAV improvements.
This guide walks you through enabling Docker's experimental mode, installing CRIU, building a simple Node container, creating checkpoints, and restoring containers both on the same host and on a different host, highlighting the prerequisites and limitations of live migration.
UCloud’s external gateway redesign leverages Linux kernel 5.0 features—lightweight tunneling, VRF, and flow offload—to replace OVS/GRE tunnels, addressing IP tunnel complexity, tenant isolation overhead, and netns performance penalties, while contributing patches back to the open‑source community.
This article shares a comprehensive, experience‑based approach to learning the Linux kernel, emphasizing building a high‑level framework first, using key textbooks strategically, balancing theory with hands‑on coding, and understanding API design and hardware interactions to accelerate mastery.
This tribute honors the late Linux kernel developer Li Shaohua, highlighting his pivotal contributions to MD RAID, block I/O, NVMe, and storage performance, while sharing personal anecdotes and technical lessons that continue to inspire kernel engineers worldwide.
The article analyzes why Sysbench‑driven MySQL connections time out when concurrency exceeds 5 000, tracing the issue to TCP SYN‑cookie processing and a full accept queue, and proposes configuration‑level mitigations.
This article explores the motivations for analyzing Linux kernel source code and provides a comprehensive guide to navigating the 2.2.5 i386 kernel tree, detailing the boot sequence—from BIOS to real mode initialization, bootsect loader, setup, and protected‑mode startup—while highlighting key files, structures, and parameters.
This article examines the rapid adoption of 25G SmartNICs for cloud workloads, compares major vendor solutions, explains why an Open vSwitch‑based TC Flower offload design was chosen, and details the practical challenges and performance gains achieved when deploying the solution in a public‑cloud environment.
This article explains the architecture of Hadoop HDFS, identifies performance bottlenecks in page cache and metadata handling on DataNodes, and presents four practical optimization techniques—including cache‑buffer separation, barrier disabling, directory restructuring, and real‑time monitoring—demonstrating significant throughput and latency improvements in large‑scale clusters.
This article explains the classic Linux kernel list linked‑list data structure, covering its definition, file locations, core operations such as initialization, insertion, deletion, replacement, moving, splitting and merging, the list_entry macro, usage examples, and important multithreading considerations.
This article shares a personal yet systematic approach to learning the Linux kernel, emphasizing the importance of building a high‑level framework before diving into code, recommending key textbooks, discussing language considerations, API insights, and encouraging hands‑on experimentation to deepen understanding.
When clients frequently use short TCP connections they often encounter error 110 (connection timeout) and error 99 (cannot assign requested address), which stem from TIME‑WAIT port exhaustion and server listen‑queue overflow, and this article explains the causes and practical solutions.
The article explains the thundering herd problem where many processes wake for a single event, describes Linux’s kernel fixes for accept() and partial epoll solutions, and details how Nginx avoids the issue using a custom inter‑process accept mutex and lock design.
This article examines a Linux 3.10 kernel soft‑lockup bug where the ext4 extent‑status LRU spin‑lock is held for over 20 seconds under memory pressure, explains the ext4 delayed‑allocation mechanism, block lookup process, extent‑status cache shrinkage, and presents the community's mitigation approach.
This article reviews the historical C10K challenge, explains IO model improvements like epoll, kqueue and IOCP, and details practical Linux performance optimizations such as CPU and memory affinity, RSS/RPS/RFS/XPS, IRQ handling, kernel tuning, and hardware utilization for high‑concurrency servers.
The article investigates why massive Redis deployments experience network packet loss despite using 10 Gbps NICs, explains how Linux kernel counters such as net.if.in.dropped are derived from /proc/net/dev, walks through the driver‑to‑kernel processing path, and proposes CPU‑affinity, interrupt‑affinity and NUMA‑aware tuning to eliminate the drops.
Through kernel‑level analysis we discovered that Redis packet loss stemmed from rx_dropped buffer exhaustion caused by interrupt‑handling backlogs, and resolved it by assigning NIC interrupts to specific cores on one NUMA node while binding Redis processes to the other, eliminating loss under dual‑10 GbE load.
The article examines how the Linux kernel community’s low security priority, corporate‑driven projects like KSPP, and contentious politics around PaX/Grsecurity have hindered timely fixes for critical vulnerabilities such as Stack Clash and CVE‑2017‑1000370.
This article explains the purpose and mechanics of process sleep in the Linux kernel, detailing how wait queues and wake‑up functions operate, why sleeping in atomic contexts such as interrupt handlers or while holding spinlocks is unsafe, and demonstrates the resulting deadlock with a sample driver.
Learn how to enable Google’s TCP BBR congestion control algorithm on Linux kernels 4.9+, including background, performance comparison with Reno/CUBIC, detailed deployment steps on CentOS via ELRepo, and verification commands, to dramatically improve bandwidth utilization on high‑latency, lossy networks.
The article recounts a half‑year investigation of a high‑performance proxy cluster whose Docker hosts repeatedly crashed due to kernel null‑pointer dereferences, detailing log analysis, three faulty hypotheses, extensive web research, kernel and Docker upgrades, and the final operational lessons learned.
An unauthenticated remote attacker can exploit a flaw in Linux kernel versions prior to 4.5’s udp.c, using crafted UDP packets with MSG_PEEK to trigger an unsafe checksum calculation, achieving arbitrary code execution and potential privilege escalation, though the vulnerability’s impact is limited due to rare MSG_PEEK usage.
This article explains the Android boot sequence, covering the bootloader's two stages, Linux kernel initialization, the Init process, the Zygote process that spawns application instances, and the role of ServiceManager and SystemServer in bringing the Android system to a ready state.
This article breaks down the Samsung clock implementation in the Linux kernel, explaining the key fields of the clk structure, its operation callbacks, and the lookup table, while providing annotated code snippets and screenshots to illustrate each component.
In this interview, Linus Torvalds shares hard‑earned lessons on software project management, emphasizing personal responsibility, the primacy of users over code quality, the limited role of tools, and how the Linux kernel mailing list keeps contributors aligned, offering timeless advice for developers and teams.
This article analyzes the nf_conntrack table‑full issue encountered during high‑concurrency OpenStack upgrades, explains how connection tracking works and is stored in a hash table, and provides practical parameter and iptables adjustments to improve memory usage and lookup performance.
A long‑standing Linux kernel bug causes the FIB routing hash table to shrink from 256 to 2 entries when multipath routing is enabled, leading to performance degradation; the article explains the faulty macros, traces the communication with the original authors, and advises applying the upstream fix or patching locally.
This article explains the design principles of Linux kernel RCU, details the implementation of rcu_read_lock, describes how interrupt handlers update shared data safely, and clarifies when old pointers can be reclaimed using call_rcu or synchronize_rcu.
This article explains the Linux kernel’s widely used container_of macro, showing how it converts a member’s address into the containing structure’s base address through examples, typeof and offsetof usage, and demonstrates the underlying calculations with clear code snippets and illustrations.
The article explains how Linux spinlocks, originally designed for SMP systems, operate in UP kernels, why CONFIG_DEBUG_SPINLOCK changes their behavior, and which spinlock variants should be used in different interrupt and preemption contexts.
A developer discovers that clearing the entire ISR register in the RTL8139 driver masks a pending Rx interrupt, causing the first TCP SYN packet to be lost, and resolves the issue by clearing only the TxOK bit.
The article revisits the historic Y2K panic and explains how the same kind of overflow, known as the 2038 Unix bug, threatens Linux systems as their 32‑bit time counters will roll over on January 19, 2038, potentially causing widespread date‑related failures.
This article examines three common TCP issues—missing client‑side socket timeouts leading to monitor‑killed processes, excessive TIME_WAIT sockets after service failures and their kernel tunables, and 40 ms keep‑alive latency caused by Nagle and delayed ACK—explaining kernel behavior and offering practical configuration fixes.
This article explains how the Linux kernel’s layered architecture, modular design, and well‑defined subsystems such as the process scheduler, memory manager, virtual file system, and network interface enable massive volunteer collaboration, extensibility, and continuous evolution of the operating system.
Linux cgroups are a kernel feature that organizes processes into hierarchical control groups, allowing fine‑grained limits, accounting, and isolation of CPU, memory, I/O, network and devices via subsystems such as cpu, memory, cpuset, blkio, and others, and are accessed through a virtual filesystem for configuring and managing resource constraints, underpinning containers and cloud platforms.
