The classic Linux I/O model costs at least one system call per operation — and every syscall got materially more expensive after the Spectre/Meltdown mitigations. io_uring flips the model: two ring buffers shared between your app and the kernel, batching hundreds of operations into one syscall or, with a polling thread, zero. Here's the mechanism, why true async file I/O finally exists, and the honest security caveats that keep it off some production boxes.
There is a way to run your own code inside the Linux kernel — attached to a syscall, a network packet, a function entry — without writing a kernel module and without rebooting. That sounds like it should be impossible or insane, and it's neither. It's eBPF, and it's quietly become the foundation under nearly every observability, networking, and security tool you already use.