Deep dives, investigations, and things I figured out the hard way.
Multi-threaded bugs vanish under the debugger. Stack traces lie. Variables seem to change value between two prints. The GDB techniques that actually find races: thread-pinned breakpoints, non-stop mode, watchpoints, TSan-then-GDB, and rr.
You type ./a.out and a program runs. Behind that: a four-byte magic number, two parallel header tables, mmap-and-fault, and a dynamic linker that bootstraps itself. A guided tour of ELF and what execve actually does.
The Linux network stack tops out at ~2 Mpps per core. DPDK reaches 20 Mpps. The difference isn't speed — it's removing work: no syscalls, no allocations, no demux, no locks. Why kernel-bypass exists and when it earns its complexity.
eBPF programs are stateless — maps are how they remember. A walk through the five map types that cover most real programs: hash, array, per-CPU, ring buffer, and LRU, with concrete code for each.
Kernel modules sound intimidating, but the ceremony is small. In about a hundred lines: a working /dev/echo0 character device, with proper error unwinding, copy_to_user, and the patterns the rest of the kernel uses everywhere.
When recv() returns, dozens of layers ran behind your back — DMA, NAPI, sk_buff, protocol demux, the socket queue. A trace of the entire receive path with the cost of each hop and where the latency actually lives.
Compilers reorder. CPUs reorder. Single-threaded code never notices — multi-threaded code crashes mysteriously. A clear walk through acquire and release semantics, what the hardware actually does, and the spinlock that ties it all together.
Two threads, two variables, no shared state — and a 4x slowdown. False sharing is the cache coherence tax you pay when unrelated data lands on the same 64-byte line. How to spot it and fix it.
select and poll were O(n). epoll is O(1). The reason isn't smarter scanning — it's that the kernel pushes ready events into a list as they happen. A walk through the data structures that make it work.
How eBPF changed production debugging — attaching probes to kernel functions, tracing syscalls, measuring latency histograms, and XDP packet processing, all without touching application code or rebooting.
Using an ESP32 and ESP-IDF to build a network-aware Wake-on-LAN trigger — power on machines remotely over MQTT without an always-on server in between.
The first 512 bytes that run when your machine powers on. A walkthrough of x86 real mode, the BIOS interrupt interface, segment:offset addressing, and what it takes to load a second stage.
Inside ThreadSafeCLogger: how to build a high-performance logging library that doesn't serialize your threads, using per-thread SPSC ring buffers and careful memory ordering.
A deep dive into implementing a functional TCP/IP stack entirely in software — covering Ethernet framing, ARP, IP routing, TCP state machines, and the painful lessons learned along the way.