Multi-threaded bugs vanish under the debugger. Stack traces lie. Variables seem to change value between two prints. The GDB techniques that actually find races: thread-pinned breakpoints, non-stop mode, watchpoints, TSan-then-GDB, and rr.
Three primitives cover almost every locking decision: spinlocks, mutexes, and futexes. They solve the same problem with very different cost models — burning CPU vs trapping to the kernel vs the hybrid approach modern mutexes actually use.
You type ./a.out and a program runs. Behind that: a four-byte magic number, two parallel header tables, mmap-and-fault, and a dynamic linker that bootstraps itself. A guided tour of ELF and what execve actually does.
The Linux network stack tops out at ~2 Mpps per core. DPDK reaches 20 Mpps. The difference isn't speed — it's removing work: no syscalls, no allocations, no demux, no locks. Why kernel-bypass exists and when it earns its complexity.
eBPF programs are stateless — maps are how they remember. A walk through the five map types that cover most real programs: hash, array, per-CPU, ring buffer, and LRU, with concrete code for each.
Kernel modules sound intimidating, but the ceremony is small. In about a hundred lines: a working /dev/echo0 character device, with proper error unwinding, copy_to_user, and the patterns the rest of the kernel uses everywhere.
When recv() returns, dozens of layers ran behind your back — DMA, NAPI, sk_buff, protocol demux, the socket queue. A trace of the entire receive path with the cost of each hop and where the latency actually lives.
select and poll were O(n). epoll is O(1). The reason isn't smarter scanning — it's that the kernel pushes ready events into a list as they happen. A walk through the data structures that make it work.
How eBPF changed production debugging — attaching probes to kernel functions, tracing syscalls, measuring latency histograms, and XDP packet processing, all without touching application code or rebooting.
The first 512 bytes that run when your machine powers on. A walkthrough of x86 real mode, the BIOS interrupt interface, segment:offset addressing, and what it takes to load a second stage.