All articles

Tech / 19 Sep 2026 / 5 min read

PCIe PASID Lets One Device Carry Multiple Address-Space Contexts

PCIe PASID Lets One Device Carry Multiple Address-Space Contexts A PCIe function normally has a Requester ID derived from its bus, device, and function identity. That identifier tells platform components which function issued a transaction, but it is too coarse when one device serves work from several process address spaces at the same time. Process Address Space ID (PASID) adds another identity field to the transaction path. A PASID can select an address-space context beneath the same device function, allowing the IOMMU to distinguish memory traffic that belongs to different processes without requiring a separate PCIe function for each one.

PCIe PASID

Tech / 19 Sep 2026 / 5 min read

PCIe ATS Moves Address Translation Caching Into the Device

PCIe ATS Moves Address Translation Caching Into the Device An IOMMU can translate DMA addresses on behalf of a device, but that arrangement puts translation machinery in the path of device memory traffic. PCIe Address Translation Services (ATS) adds another option: a capable device can request a translation and retain the result in its own translation cache. Later transactions can carry the translated address instead of requiring the same translation work at the IOMMU for every access.

PCIe ATS

Tech / 19 Sep 2026 / 6 min read

PCIe ASPM Link States Trade Idle Power for Exit Latency

A PCI Express link does not need to keep every transmitter and receiver block fully active when no packets are moving. Active State Power Management, or ASPM, lets a link enter lower-power states during idle periods and return to L0 when traffic resumes. The mechanism sits below application I/O. Software can issue the same storage, network, or device operation regardless of the current link state, but the first transaction after an idle interval can encounter extra delay as the link returns to active operation.

PCIe Power Management

Tech / 19 Sep 2026 / 6 min read

PCIe ACS Controls Whether Peer Traffic Can Bypass the IOMMU

PCIe ACS Controls Whether Peer Traffic Can Bypass the IOMMU An IOMMU can restrict DMA only for transactions that reach its translation and permission checks. PCI Express complicates that boundary because two endpoints under the same hierarchy can exchange peer-to-peer traffic without sending every transaction through the root complex. A switch may be able to route a request directly from one downstream port to another. PCIe Access Control Services (ACS) adds controls for that routing boundary. Depending on the component and supported ACS features, the fabric can validate a request, block selected translated traffic, redirect peer requests or completions upstream, or constrain their egress. The result is not merely a routing preference. ACS can determine whether two devices are separable at the IOMMU boundary.

PCIe ACS

Cybersecurity / 19 Sep 2026 / 6 min read

PASETO Public and Local Tokens Do Not Solve Session Revocation

A PASETO token can protect claims cryptographically without knowing whether the user has logged out. That boundary matters more than the usual JWT-versus-PASETO comparison: changing the token format does not create session revocation. PASETO gives each token an explicit version and purpose. With Version 4, v4.public signs a message with Ed25519, while v4.local encrypts and authenticates a message with symmetric cryptography. Those choices determine who can read a token and who can create or verify it. They do not determine whether a previously valid token should still be accepted after a session changes.

PASETO Authentication

Linux / 19 Sep 2026 / 6 min read

PAGEMAP_SCAN Batches Page-Table State into Address Ranges

A large virtual address range may contain only a small number of page-state transitions. Reading one pagemap entry for every virtual page exposes that state at page granularity, but it also makes user space inspect a long sequence of entries. Linux PAGEMAP_SCAN moves the filtering into the kernel and reports matching spans as struct page_region records. The interface is an ioctl() on /proc/PID/pagemap. A request supplies an address interval, category predicates, a return mask, and an output vector. The kernel walks page tables and emits contiguous regions whose selected page properties match the request. This changes the shape of page-table inspection from a stream of per-page values into a filtered range query.

Software Engineering Linux

Linux / 19 Sep 2026 / 6 min read

openat2 Constrains Path Resolution at the Kernel Boundary

A pathname that begins inside a trusted directory can resolve somewhere else before open() returns. Parent components, symbolic links, magic links, mount points, and concurrent namespace changes all participate in Linux pathname lookup. Checking a string before opening it therefore does not establish where the kernel will finish resolution. Linux openat2() places restrictions inside the lookup operation itself. A caller supplies a directory file descriptor, ordinary open flags, and a resolve policy in struct open_how. The kernel then applies those constraints while walking every relevant path component. This moves a security boundary from pre-validation of pathname text into the operation that actually resolves the pathname.

Linux Filesystem

Linux / 19 Sep 2026 / 5 min read

openat2 Constrains Linux Path Resolution at the Open Boundary

A pathname can change meaning while a process is resolving it. Directory renames, symbolic links, mount points, and .. components can redirect lookup away from the directory a program intended to treat as its boundary. Linux openat2() attaches resolution policy to the lookup itself. Its struct open_how contains a resolve bit mask, so the kernel can reject a path when resolution violates a caller-selected constraint instead of relying only on checks performed before open().

Linux Filesystems

Software Engineering / 19 Sep 2026 / 8 min read

Open File Description Locks Bind Byte Ranges to File Instances

A byte-range lock can protect the same inode yet have radically different lifetime semantics depending on what owns the lock. Traditional fcntl() record locks are process-associated. Open file description locks instead attach to the kernel open file description referenced by a descriptor. That shift changes which close operation releases a lock, what survives fork(), and whether two threads in one process can contend on the same file region. Linux exposes this model through F_OFD_SETLK, F_OFD_SETLKW, and F_OFD_GETLK. The range model remains familiar: struct flock specifies a read lock, write lock, or unlock together with an offset and length. The significant difference is ownership.

Software Engineering Linux

Artificial Intelligence / 19 Sep 2026 / 6 min read

Ollama Gemma 3 270M Memory Is More Than the Model File

Ollama lists gemma3:270m at about 292 MB. That number is useful for storage planning, but it is not a RAM requirement. It describes the packaged model data for the default Ollama variant, which uses Q8_0 quantization. Once inference starts, the runtime also needs memory for model metadata, execution buffers, token state, and the key-value cache used by attention. That distinction matters on small machines. A device with 512 MB of RAM may appear large enough when compared only with a 292 MB model file, yet the remaining memory must also accommodate Ollama and the operating system. The context configuration can move the total substantially.

Artificial Intelligence Ollama

Cybersecurity / 19 Sep 2026 / 7 min read

OCSP Stapling Moves Revocation Evidence into the TLS Handshake

OCSP Stapling Moves Revocation Evidence into the TLS Handshake A TLS certificate can remain within its validity period after its issuer has marked it revoked. The certificate’s dates and signature do not encode that later status change, so a client that cares about revocation needs status information from another mechanism. OCSP provides signed status responses for identified certificates. OCSP stapling changes the delivery path: the TLS server obtains a response and sends that signed evidence to the client during the handshake.

Cybersecurity TLS

Cybersecurity / 19 Sep 2026 / 7 min read

OAuth mTLS Certificate Binding Moves Token Proof into the TLS Connection

OAuth mTLS Certificate Binding Moves Token Proof into the TLS Connection An OAuth access token can pass every syntactic and cryptographic check at a resource server and still be insufficient for access. With a mutual-TLS certificate-bound token, the server also needs evidence from the TLS connection: the client presenting the token must possess the private key corresponding to the certificate associated with that token. That changes the security boundary. A bearer token is usable by a party that obtains the token value, subject to the token’s other restrictions. A certificate-bound token adds a separate possession requirement tied to the TLS client certificate. The token and the private key become two pieces of the same authorization path.

Cybersecurity OAuth

Cybersecurity / 19 Sep 2026 / 5 min read

no_new_privs Blocks Exec-Time Privilege Gain

A service may need to execute helper programs after it has accepted untrusted input. If one of those programs is set-user-ID, set-group-ID, or carries file capabilities, a normal execve() can cross a privilege boundary even when the calling process itself has no intent to acquire extra authority. Linux no_new_privs changes that transition: once set for a thread, later execve() calls cannot grant privileges that were absent from the caller at the point of execution.

Cybersecurity Linux

Tech / 19 Sep 2026 / 5 min read

NIC Interrupt Moderation Trades Wakeup Rate for Packet Latency

A network adapter does not need to interrupt a CPU for every received packet or completed transmission. Many NICs can hold interrupt delivery briefly and report several completion events together. This interrupt moderation reduces interrupt traffic and CPU entry overhead, but it can also delay the moment software notices newly completed work. The mechanism sits between packet DMA and the driver’s receive or transmit processing. It changes notification timing; it does not change the packet’s wire format, Ethernet ordering rules, or the basic requirement that the driver eventually process completed descriptors.

Networking Linux

Tech / 19 Sep 2026 / 7 min read

MSI-X Per-Vector Masking Separates Interrupt Control Across Device Queues

MSI-X Per-Vector Masking Separates Interrupt Control Across Device Queues A PCI function using MSI-X can expose multiple interrupt vectors whose delivery state is controlled independently. Software can mask one MSI-X table entry while other enabled entries remain able to signal interrupts. That property matters for devices with multiple queues because interrupt control can follow the same partitioning as the I/O work instead of collapsing every notification source behind one device-wide interrupt state.

PCIe MSI-X

Tech / 19 Sep 2026 / 7 min read

MSI-X Lets Device Queues Target Separate CPU Interrupt Paths

MSI-X Lets Device Queues Target Separate CPU Interrupt Paths A multiqueue PCIe device can move data through many queues at once, yet a single interrupt path would funnel completion handling back through one signal. MSI-X removes that device-wide bottleneck from the interrupt interface. Each allocated MSI-X entry represents an independently configurable message-signaled interrupt, so a driver can associate different queues or event classes with different Linux IRQs and CPU affinity policies.

PCIe MSI-X

Software Engineering / 19 Sep 2026 / 8 min read

MQTT and QUIC Solve Different Parts of a Chat Transport

MQTT and QUIC Solve Different Parts of a Chat Transport MQTT and QUIC are often placed in the same comparison table when discussing real-time chat. That comparison is convenient, but it collapses two different protocol layers into one choice. MQTT is an application-layer messaging protocol. It defines concepts such as clients, brokers, topics, subscriptions, retained messages, session state, and delivery quality of service. QUIC is a secure transport protocol over UDP. It provides connections, streams, flow control, loss recovery, encryption, and connection migration mechanisms.

Software Engineering MQTT

Artificial Intelligence / 19 Sep 2026 / 7 min read

Monocular Depth Estimation with MiDaS and DPT

A single RGB camera records image coordinates and color, not the physical distance from the lens to every visible surface. Monocular depth models infer the missing depth structure from visual evidence learned during training. That distinction matters when using MiDaS or DPT: a convincing depth map does not automatically mean that pixel values are distances in meters. MiDaS is an open-source project for robust monocular relative depth estimation. DPT, or Dense Prediction Transformer, is an architecture for dense prediction that has also been used as a backbone in MiDaS models. Both make single-camera depth estimation practical, but neither changes the geometric ambiguity inherent in one unconstrained RGB image.

Artificial Intelligence Computer Vision

Cybersecurity / 19 Sep 2026 / 6 min read

memfd Seals Turn Shared Memory into a Kernel-Enforced Immutable Payload

Shared memory is efficient partly because two processes can observe the same storage without copying it. That property becomes a security problem when one side validates bytes and later consumes them while another side still holds authority to mutate the same object. Linux memfd sealing can narrow that race by making selected mutations fail in the kernel before the file descriptor crosses a trust boundary. memfd_create() creates an anonymous file and returns an ordinary file descriptor. The object can be sized, written, mapped, and transferred over a UNIX domain socket. With MFD_ALLOW_SEALING, the inode starts with an empty seal set, allowing the producer to add irreversible restrictions after population.

Cybersecurity Linux

Linux / 19 Sep 2026 / 4 min read

memfd Seals Constrain Shared-Memory Mutation After Handoff

A memfd_create() descriptor names an anonymous file whose storage lives in memory-backed filesystem infrastructure. By itself, descriptor handoff does not freeze that object: a process retaining suitable access can still write bytes, truncate the file, or extend it. Linux file seals add kernel-enforced restrictions that can make selected mutations fail after the producer declares the object complete. This changes shared-memory handoff from a convention into a state transition enforced at the file object.

Linux Memory

Tech / 19 Sep 2026 / 7 min read

Measure Electronic Components with a Digital Multimeter

A digital multimeter combines several electrical measurements in one instrument, but each mode answers a different question. A resistance reading can confirm that a resistor is near its marked value. A diode test can show a plausible forward-voltage drop. A voltage measurement can reveal whether a circuit node is being powered. None of those readings, by itself, proves that an entire circuit is healthy. That distinction matters when testing electronic components. A multimeter is excellent for static and low-frequency checks, especially when the expected electrical condition is known. It is much less informative when the fault depends on waveform shape, switching behavior, noise, timing, or operation under load.

Electronics Multimeter

Web Development / 19 Sep 2026 / 7 min read

Markdown Containers as a Lightweight UI DSL

A content file does not need a component tree to express that one region is a hero, callout, card, or gallery. A small extension to Markdown can carry that intent while ordinary headings, paragraphs, links, and lists remain ordinary Markdown. With markdown-it-container, the author-facing syntax can stay as small as: :::hero # Ship the next release A short description stays normal Markdown. ::: That is already enough to create a lightweight UI DSL: hero has a meaning defined by the application, while the content inside it continues through the Markdown parser. The useful boundary is narrow. Once the format starts exposing rows, columns, padding values, CSS classes, event handlers, and deeply nested components, the content file stops behaving like content and starts becoming source code in another notation.

Web Development Markdown

Linux / 19 Sep 2026 / 4 min read

MADV_FREE Marks Anonymous Pages for Lazy Reclaim

MADV_FREE does not immediately replace a private anonymous page with zeros. It marks eligible pages as disposable, allowing Linux to reclaim them later. Until reclaim actually occurs, existing bytes can remain observable. A write before reclaim cancels the disposable state for the affected page. That timing makes MADV_FREE distinct from advice that immediately changes the process-visible state of a range. It is a lazy reclamation contract: the application declares that old contents are expendable, while the kernel chooses when physical memory is recovered.

Linux Memory

Web Development / 19 Sep 2026 / 6 min read

Logo-Derived Theme Tokens for Brand-Driven Web Interfaces

A logo palette is not a design system. Copying its dominant color into buttons, cards, backgrounds, borders, and gradients usually produces a page that feels saturated rather than branded. The useful step is to translate the logo into semantic theme tokens: a small set of roles that components can consume consistently. That distinction matters even more when the interface uses expressive patterns such as bento grids, oversized typography, translucent surfaces, and scroll motion. Those techniques can create a strong identity, but only when color, hierarchy, and movement come from one coherent system rather than a collection of effects.

Web Development Design Systems