01 / ABI
Syscall / ELF
Traces how a C function call passes through the syscall instruction and ELF loader to reach the kernel ABI.
From the libc wrapper to the syscall
Traces how a single write() call passes through the calling convention, syscall number, registers, and kernel entry code before reaching a file object.
02From typing ./xxx to main() and process exit
Follows the complete sequence after ./xxx is entered in a shell: command interpretation, child creation, execve, ELF loading, the dynamic linker, _start, main, exit_group, and wait.
03errno, EINTR, and short returns
Explains how to decide from both the amount of work completed and the syscall restart policy, rather than applying a blanket rule to retry every error.
04ELF loading and _start
Examines the sequence after execve through ELF program headers, the interpreter, initial stack, _start, __libc_start_main, and main.
05The dynamic linker, PLT/GOT, and relocations
Examines how DT_NEEDED lookup, symbol resolution, GOT updates, lazy binding, and symbol interposition change startup time and call addresses.
02 / PROCESS
Process
Covers the sequence in which processes are created, replaced, and reaped, including fork, execve, wait, sessions, and service lifetimes.
fork and copy-on-write
Explains how fork duplicates page tables and object references without immediately copying the address space, then separates physical pages on a write fault.
07execve and process-image replacement
Examines how the address space, signal dispositions, credentials, and fd inheritance are rebuilt for a new executable while the PID remains unchanged.
08waitpid, zombie, pidfd
Explains why a child's termination status is retained as a zombie and how pidfds reduce PID-reuse races.
09process group, session, controlling terminal
Explains why shell job control sends signals to a process group rather than one PID and changes the terminal's foreground group.
10Service supervision instead of daemonization
Compares the double-fork convention with a foreground service under a supervisor such as systemd, and designs signal, readiness, fd, and shutdown ordering.
03 / FILE I/O
File Descriptor / I/O
Examines open file descriptions, short I/O, pathname resolution, metadata changes, and ioctl together with file-descriptor lifetimes.
fd table, open file description, openat2
Distinguishes a small integer fd from struct file, and shows how dirfd-relative resolution plus openat2 resolve flags reduce pathname races.
12Completion loops for read/write
Explains why one read/write is not guaranteed to process the full request even on a blocking fd, and separates EOF, EAGAIN, and EINTR.
13dup3, pipes, and standard-I/O redirection
Shows how a shell connects the pipe buffer and fd tables for cmd1 | cmd2, and which ends must close for EOF to occur.
14inode, link, unlink, atomic rename
Separates pathname and inode lifetimes, and lays out atomic replacement and durability procedures using unlink on open files and temporary-file rename.
15Directory traversal and getdents64
Explains that readdir does not provide a snapshot of directory entries and shows how to handle d_type, telldir cookies, and concurrent changes safely.
16fcntl locks and the ioctl ABI
Separates ownership and ABI for advisory record locks, open-file-description locks, and device-specific ioctls instead of treating all fd control commands alike.
04 / MEMORY
Virtual Memory
Distinguishes the address space, mmap, page faults, protection, and the point where an allocator meets actual pages.
The process address space and /proc/maps
Distinguishes how ELF segments, the heap, shared objects, the stack, and vDSO are placed as VMAs from the later faults that attach actual pages.
18mmap with MAP_SHARED and MAP_PRIVATE
Uses a real two-process example to compare mappings that share the same file page with copy-on-write private mappings and their dirty/writeback paths.
19mprotect, madvise, mlock
Separates page protection, reclaim hints, and residency guarantees by purpose, and examines their TLB, fault, and resource-limit costs.
20malloc, arena, brk, mmap
Separates malloc-object lifetimes from kernel VMA lifetimes and explains persistent RSS after free through allocator caches and fragmentation.
05 / EVENT
Signal / Event / IPC
Collects asynchronous notifications in file-descriptor-based event loops and explains how bytes and permissions move between processes.
Where do interrupts, events, and signals originate?
Separates hardware IRQs, kernel state changes and wakeups, and process signals into distinct boundaries, then traces signal generation from kill, faults, timers, TTY input, and child termination.
22signal mask, pending, delivery
Connects signal generation, pending queues, thread selection, masks, handler frames, and sigreturn in one flow, and summarizes handler-safety rules.
23epoll readiness and edge-triggered loops
Demonstrates in code that readiness is the possibility of progress on the next nonblocking I/O operation, not completion notification, and applies the EPOLLET drain rule.
24timerfd and eventfd
Represents timer expiration and cross-thread wakeups as 8-byte counter fds integrated into an epoll loop, then examines counter accumulation and overflow rules.
25Unix sockets and SCM_RIGHTS
Explains, control message by control message, how a Unix domain socket installs not just bytes but an open file reference in another process's fd table.
26POSIX shared memory and process-shared semaphores
Uses shm_open to attach a name to an inode-like object and coordinates data publication with a semaphore inside MAP_SHARED memory.
27inotify and directory change tracking
Separates watch-descriptor and pathname lifetimes, and treats rename cookies, queue overflow, and recursive-watch gaps as a recoverable protocol.
06 / THREAD
Thread / Synchronization
Explains pthread objects, mutexes, condition variables, futexes, and C atomic memory order in terms of the data actually shared.
pthread creation, join, detach, and TLS
Separately tracks the lifetimes of a pthread_t handle, kernel task, user stack, thread-local storage, and joinable termination state.
29Mutexes and condition variables
Uses a bounded queue to explain a mutex-protected predicate, cond_wait's unlock-and-sleep operation, spurious wakeups, and lost wakeups.
30C atomic memory order and futexes
Distinguishes atomicity of an atomic value from visibility of surrounding data, then connects acquire/release publication to futex sleep.
07 / NETWORK
Socket
Follows the failure points of network programs from socket creation through nonblocking connect, stream framing, UDP, and name resolution.
The socket, bind, listen, and accept lifecycle
Treats listening and accepted sockets as different kernel objects, and distinguishes the bound address, two queues, close, and half-close.
32Nonblocking connect and SO_ERROR
Explains why writability after EINPROGRESS does not mean only success, and how getsockopt(SO_ERROR) consumes final connection state.
33TCP framing and backpressure
Explains how to build a length-prefix parser and partial-send queue over a byte stream without mistaking TCP for a message queue.
34UDP datagram boundaries and errors
Examines UDP message boundaries, truncation, connected UDP, path MTU, and packet loss, duplication, and reordering together with recvmsg metadata.
35getaddrinfo and name resolution
Separates connection attempts from NSS policy, IPv4/IPv6 address lists, service names, and the blocking resolver rather than treating resolution as DNS alone.
08 / OBSERVE
Observe / Harden
Uses io_uring, seccomp, /proc, strace, and perf to shorten, constrain, and observe execution paths.
io_uring ring and request lifetimes
Examines how shared SQ/CQ rings, submission entries, kernel requests, completion entries, user buffers, and fd lifetimes overlap in asynchronous I/O.
37seccomp and capability boundaries
Keeps syscall allowlists distinct from privilege decomposition, and explains the order of no_new_privs, filter installation, and acquiring fds in advance.
38Verifying execution paths with /proc, strace, and perf
Cross-checks source interpretation against syscall traces, process snapshots, and hardware/software counters, while separating tool effects and observation races.