A strong answer
A strong candidate frames How does epoll improve on select/poll? around the exact memory layout, compiler semantics, and hardware execution model covered in High-Performance Event Multiplexing: Linux epoll Architecture. Explain O(1) event readiness notification, interest list in kernel, and edge-triggered versus level-triggered modes.
In the previous lesson, we analyzed synchronous multiplexing with select() and poll(). While both interfaces prevent head-of-line blocking by allowing a single thread to monitor multiple file descriptors, both suffer from an identical scalability limit: $O(N)$ linear complexity.
Cost per event loop cycle:
- User space passes an array of 100,000 struct pollfd to the kernel. (800 KB memory copy)
- Kernel iterates through all 100,000 sockets to check status. (O(N) CPU scan)
- Kernel copies all 100,000 structs back to user space. (800 KB memory copy)
- Application iterates through all 100,000 structs to locate the 2! (O(N) user scan)
In a production interview, always connect the specification rule to its concrete runtime consequence: state what lives on the stack versus the heap or static storage segment, how the compiler or operating system validates alignments, lifetimes, and error codes, and what happens under adversarial or boundary inputs (such as zero-length buffers, integer overflow, concurrent mutation, or partial I/O). Backing your explanation with a small trace of register/memory state transitions immediately separates senior systems engineers from candidates who only memorized syntax.
## What the interviewer is listening for
- **Mastery of core invariant:** Instantiate and configure epoll instances using epoll_create1, epoll_ctl, and epoll_wait.
- **Mastery of core invariant:** Trace kernel data structures: Red-Black tree interest lists and ready list doubly linked lists.
- **Mastery of core invariant:** Differentiate Level-Triggered (LT) from Edge-Triggered (ET) event delivery semantics.
- **Hardware and ABI awareness:** Explaining how sizes, alignments, calling conventions, or kernel boundaries behave on real 64-bit targets rather than relying on implementation-defined assumptions.
- **Defensive engineering:** Naming the exact compiler flags (`-Wall -Wextra -Werror`), static analyzers, or runtime sanitizers (`-fsanitize=address,undefined,thread`) that verify correctness in CI.
## Common mistakes
- Explaining only surface syntax without tracing the underlying memory addresses, ownership lifetime, or kernel/user-space state transitions.
- Assuming undefined behavior (such as signed overflow, uninitialized reads, strict-aliasing violations, or dangling pointers) will "just work" because it passed an unoptimized `-O0` debug build.
- Ignoring return codes, partial reads/writes, alignment padding, or cleanup paths when an allocation or syscall fails midway through a function.