37 posts
AppArmor's unprivileged_userns strips sys_admin from Electron's GPU process on Ubuntu 24.04, causing misleading Permission denied errors. Here is the fix.
Unix domain sockets can form reference cycles (A→B→C→A). The kernel performs mark-and-sweep GC to detect and reclaim unreachable socket cycles. Source analysis reveals the algorithm.
System V message queues are not slow legacy tech. The kernel uses READ_ONCE(r_msg) for lock-free receive, and MSG_BARRIER avoids taking the queue lock. Source analysis reveals the optimization.
pipe() is not just a kernel buffer. It uses a circular ring of page-sized buffers with head/tail indices. Page stealing enables zero-copy splice(). Source analysis reveals the mechanism.
Shared memory is not direct physical memory access. System V SHM is implemented on top of tmpfs — shmget() creates a tmpfs file, shmat() mmap()s it. Source analysis reveals the implementation.
iptables is not a chain of linked lists. Modern Netfilter uses compact arrays of hook functions for cache-efficient traversal. Source analysis reveals the optimization.
A socket is not a special object — it's a file descriptor backed by VFS. The kernel embeds struct socket in a VFS inode, allowing sockets to use the standard file descriptor table. Source analysis reveals the trick.
TCP is more than send/receive. The sender makes complex decisions: when to send, how much, and how to react to congestion. Source analysis reveals the complexity.
A packet from NIC to userspace goes through NAPI poll, IP layer, TCP layer, socket buffer, and finally recvmsg(). Source analysis reveals each step of the journey.
ext4 replaced the classic UNIX indirect block mapping with extent trees. A single extent can map 32KB of contiguous blocks, reducing metadata overhead. Source analysis reveals the evolution.
VFS has four core structures that work together: inode (identity), dentry (name cache), file (open context), super_block (filesystem instance). Source analysis reveals their hidden relationships.
Most file reads never reach the disk. The page cache serves data from RAM, readahead prefetches sequential access, and writeback delays disk writes. Source analysis reveals the mechanism.
open() does not read file content. The path goes: do_sys_openat2() → path_openat() → link_path_walk() → lookup_fast/slow(). RCU walk and dcache make it fast. Source analysis reveals each step.
CPU load is not CPU usage. PELT uses exponential moving average with 32ms half-life to track per-task load. Source analysis of __accumulate_pelt_segments() reveals the math.
Not all processes use CFS. Linux has 5 scheduling classes in a priority hierarchy: STOP > DL > RT > FAIR > IDLE. Source analysis reveals how pick_next_task() iterates classes.
Waking a process is more than setting it runnable. The kernel must choose which CPU to run on, considering cache affinity, NUMA topology, power, and load. Source analysis reveals the decision tree.
Context switch is more than saving/restoring registers. The full path involves runqueue locks, lazy TLB, memory barriers, PELT updates, and cache-aware data structures. Source analysis reveals each step.
Linux 6.6+ replaced CFS with EEVDF scheduler. Virtual lag and deadline ensure fairness beyond simple vruntime. Source analysis of pick_eevdf() reveals the real mechanism.
mmap anonymous memory does not allocate physical pages. Kernel uses zero page for reads, allocates on first write, copies on write-after-fork. Source reveals why.
malloc does not directly request memory from the OS. The path: glibc allocator → brk/mmap → alloc_pages() → Buddy → SLUB. Source analysis reveals why.
Buffers and Cache in /proc/meminfo are not the same. Buffers are block device metadata; Cache is page cache minus swapcache. Source analysis reveals why.
Linux swap is not failure — kswapd proactively swaps cold pages to keep the working set in RAM. Source analysis reveals the real vm_swappiness mechanism.
Linux OOM killer triggers after 5 progressive allocation failures, not at 100% memory. Source analysis of __alloc_pages_may_oom() reveals the real mechanism.
A 64GB SD card passed f3 with zero bad blocks, yet apt install was 9x slower. This deep-dive traces 4 dmesg errors through Linux kernel source to reveal a broken FTL.
Linux 7.2.0 adds 1800+ commits since 6.8. Learn to compile mainline kernel on Ubuntu with real aarch64 steps, config migration, GRUB internals, and troubleshooting.
The FUSE kernel module is the gatekeeper between VFS and userspace filesystems. This deep dive walks through fs/fuse/ — the request lifecycle, core data structures, /dev/fuse and io_uring transports, passthrough, and the growing gap between kernel and libfuse development.
libfuse powers sshfs, s3fs, mergerfs and thousands of FUSE filesystems. This deep dive walks through the source — the dispatch pipeline, session lifecycle, io_uring transport, and the two APIs — so you can read the code like an insider.
Ubuntu 24.04 Noble kernel 6.8.0-90.91 carries 5.8 MiB of Ubuntu patches atop upstream v6.8.12. Two complete build paths: Debian packaging and vanilla make.
Kernel 7.1 merged 15,849 changesets — each a regression risk. Build an automated QEMU-based test workflow with kselftest, LTP, KUnit, xfstests and AI assistance.
xfstests holds 4,369 tests across 13 filesystems. Learn to reproduce, bisect, verify, and report kernel filesystem regressions using xfstests as your oracle.
In 2026, 2,479 developers contributed to kernel 7.1 — 530 were first-timers. This guide shows amateur engineers how to contribute, with AI tools that accelerate the workflow.
# How to Submit Your First Linux Kernel Patch: A 2026 Step-by-Step Guide In 2026, the Linux kernel 7.1 release pulled in 15,849 non-merge changesets from 2,479
ftrace's parent_ip parameter lets you inspect the caller's address at hook time and selectively redirect one call site while leaving others untouched — a technique borrowed from the kernel's livepatch subsystem.
The Linux kernel 7.2 source spans ~30M lines across 68 directories. This overview maps the six core subsystems — interrupts, scheduler, memory, I/O, network, drivers — with code references and learning paths.
Over 350 billion ARM chips shipped to date. This guide walks through cross-compiling an aarch64 kernel and BusyBox rootfs, then booting the system in QEMU.
ARM chips power 99% of smartphones and 25% of cloud servers. This guide shows you how to cross-compile, emulate, and debug ARM64 assembly on x86 WSL using QEMU and GDB in under 15 minutes.
ARM64 page-table walks traverse 4 levels (PGD→PUD→PMD→PTE) per translation. An unmapped virtual address triggers a data-abort exception; the Linux kernel establishes the mapping via demand paging in fault.c.