#kernel
Wiki 10
- eBPF sock_ops Linux's per-cgroup BPF hook into the kernel TCP socket lifecycle — fires at SYN-sent, established, retransmit, and other transitions
- Huge pages 2 MB / 1 GB Linux memory pages instead of the 4 KB default — fewer page faults, far less TLB pressure, at the cost of upfront reservation
- Kernel self-patching Three Linux runtime-rewriting mechanisms — jump_label, static_call, alternative_instructions — that let one vmlinux boot optimally on dozens of CPU generations
- Linux 7.0 cuts PostgreSQL throughput in half Removing PREEMPT_NONE in Linux 7.0 lets the scheduler preempt processes mid-page-fault while holding a PostgreSQL spinlock, melting CPU on contended workloads
- Linux boot phases The six-phase x86_64 Linux boot model — assembly trampoline, early C, setup_arch, start_kernel, rest_init, kernel_init — each phase unlocking the capabilities the next one needs
- Linux Kernel Startup Espino's six-phase x86_64 boot map — assembly trampoline, early C, setup_arch, start_kernel, rest_init splitting into PID 0/1/2, kernel_init exec'ing /sbin/init
- Linux preemption models PREEMPT_NONE, PREEMPT_FULL, and PREEMPT_LAZY — when the kernel is allowed to take the CPU away from a running thread
- macOS TCP Time Bomb: 49-Day Kernel Overflow XNU kernel's 32-bit tcp_now overflows after 49.7 days, freezing TIME_WAIT and killing TCP
- Profiling eBPF Code Srinivasan's method for measuring what an eBPF file-open hook costs — C harness, perf, JIT symbols
- Spinlock Locking by busy-waiting in a tight loop instead of sleeping; cheap when critical sections are short, catastrophic when they aren't
Toolbox 1
- gobee Go-to-BPF-C transpiler that reuses clang's BPF backend and generates typed cilium/ebpf bindings