Kernel Architecture & Source Navigation

A guided tour of the kernel tree: how it is organised, how subsystems relate, and how to find the code you need.

Foundation 3 days in person6 half-days online Max 14 in person

Who this course is for

Engineers newly expected to read or change kernel code — driver, BSP and platform developers who currently bounce off the tree's size and need a reliable way to find what matters.

Prerequisites

Ability to read CCommand-line LinuxBasic git (clone, log)

Course outline

Day 1 — The tree and its boundaries

Top-level layout: kernel/, mm/, fs/, drivers/, arch/, include/, Documentation/, tools/
Subsystem boundaries and who owns what: reading MAINTAINERS
How an architecture port plugs into the generic code
Kernel coding style and core idioms: list_head, container_of, ERR_PTR error pointers
Kbuild and Kconfig as a map of what actually gets compiled

Day 2 — Following execution through the source

A system call's path: libc wrapper, syscall instruction, arch entry code, the implementation
Syscall tables and where prototypes live
initcalls and boot-time ordering
Where printk output originates and how to find the emitter
Guided source walk: one full path read end to end with the class

Day 3 — Reading like a maintainer

git log, blame and describe as documentation
Documentation/ — what is current, what is stale, how to tell
Following a real bug report to its fix commit
Indexing the tree with cscope, ctags and modern LSP-based tools
Building a personal map of a subsystem you have never entered

Hands-on labs

Labs follow the academy model — 35% principles, 20% guided investigation, 45% engineering studio. Every claim you make in a lab is backed by a trace, a counter or a measurement you captured yourself. How we teach

Lab: follow a real syscall from userspace entry to its kernel implementation, recording every file and function on the path
Lab: index the tree with cscope/ctags and answer a set of where-is-it-defined and who-calls-this questions against the source
Lab: trace the git history of one real fix from report to merged commit and extract the reasoning
Lab: map one unfamiliar subsystem — directories, MAINTAINERS entry, Kconfig symbols, init path — into a one-page briefing

Capstone project

Produce a source-level navigation dossier for a subsystem you have never worked in: its directory layout and MAINTAINERS entry, the Kconfig symbols that gate it, its init path, the entry points userspace reaches, and a worked example of locating one specific behaviour in code. You keep the dossier and the method — both transfer to any subsystem you meet next.

What you leave with

A repeatable method for finding any code path in the kernel tree
Working fluency with cscope, ctags and git archaeology
Reading fluency for kernel idioms (list_head, container_of, ERR_PTR)
A subsystem map you built yourself and can rebuild for any other

How it runs

Every course follows the same model: 35% principles, 20% guided investigation, 45% engineering studio. You leave with working code, raw measurements and an evidence-based report — not a certificate of attendance. Read the methodology or see a full sample lesson.

Material is adapted to your kernel version, hardware and workload before a private delivery. For public cohorts, the environment is provided and configured.

Questions

Who is this course for?

Engineers newly expected to read or change kernel code — driver, BSP and platform developers who currently bounce off the tree's size and need a reliable way to find what matters. It sits at foundation level within the Linux Kernel Core track.

What do I need to know already?

Specific prerequisites for this course: Ability to read C; Command-line Linux; Basic git (clone, log). We confirm levels before the cohort starts and adapt if a group is stronger or weaker than expected.

Can this run privately for my team?

Yes. Any course runs on-site at your offices anywhere, or live online for a distributed team, with labs adapted to your hardware and codebase.

What is the difference between in-person and online?

In person is 3 full days with hardware on your desk, capped at 14. Online is 6 half-day sessions across about two weeks so you can keep working, capped at 20, with remote lab access.

Do you invoice companies?

Yes. Purchase orders are accepted and invoicing is available in USD, EUR, GBP, SAR and CAD.

Upcoming dates

Dates	Where	Seats	Early bird	Regular
18 Oct – 20 Oct 20263 full days	RiyadhIn person · KAFD Conference Centre	3 of 14	—	SAR 6,750
25 Oct – 27 Oct 20263 full days	Kuwait CityIn person · Al Hamra Tower	8 of 14	—	KWD 560
25 Oct – 27 Oct 20263 full days	MuscatIn person · Knowledge Oasis Muscat	3 of 14	—	OMR 690
1 Nov – 8 Nov 20266 half-days	Gulf bandLive online · 09:00–13:00 GMT+3	15 of 20	—	US$1,300
2 Nov – 4 Nov 20263 full days	OttawaIn person · Kanata North Tech Park	8 of 14	—	CAD 2,450
2 Nov – 9 Nov 20266 half-days	Europe bandLive online · 09:00–13:00 CET	4 of 20	—	US$1,300
9 Nov – 11 Nov 20263 full days	TorontoIn person · MaRS Discovery District	3 of 14	CAD 2,200until 10 Oct	~~CAD 2,450~~
9 Nov – 11 Nov 20263 full days	LondonIn person · Shoreditch Works	8 of 14	GBP 1,260until 10 Oct	~~GBP 1,400~~
9 Nov – 16 Nov 20266 half-days	Americas bandLive online · 13:00–17:00 ET	9 of 20	US$1,170until 10 Oct	~~US$1,300~~
16 Nov – 18 Nov 20263 full days	BerlinIn person · Factory Görlitzer Park	3 of 14	EUR 1,490until 17 Oct	~~EUR 1,660~~

Dates shown for the next few months. If nothing fits, tell us where and when — cohorts are added on demand, and private delivery can be scheduled any week.

More in Linux Kernel Core

KRN-1022 days Building & Configuring the Kernel Configure, build, install and boot a kernel you compiled yourself, and understand what the thousands of config options actually do. Foundation Practitioner-taught SAR 4,500Next 18 Oct

KRN-1103 days Modules & the Kernel Build System Kbuild, module loading, symbol resolution and the module lifecycle from insmod to rmmod. Foundation Practitioner-taught SAR 6,750Next 15 Nov

KRN-2014 days Process Lifecycle & Scheduling How processes are created, scheduled and destroyed, and how scheduling decisions show up as latency in your application. Practitioner Practitioner-taught SAR 10,500Next 8 Nov

KRN-2103 days CFS to EEVDF Internals The fair scheduler in depth, the move to EEVDF, and what changed for latency-sensitive workloads. Advanced Practitioner-taught SAR 9,000Next 18 Oct

KRN-2112 days CPU Isolation & Affinity Taking CPUs away from the kernel for latency-critical work: isolcpus, nohz_full, RCU offload and the gotchas. Advanced Practitioner-taught SAR 6,000Next 25 Oct

KRN-2204 days Virtual Memory & Page Tables Address spaces, page tables, faults and mappings — the machinery behind every memory access your program makes. Practitioner Practitioner-taught SAR 10,500Next 22 Nov

KRN-2213 days Allocators: Buddy, Slab, vmalloc How the kernel allocates memory at every scale, and how allocator behaviour surfaces as fragmentation and latency. Advanced Practitioner-taught SAR 9,000Next 22 Nov

KRN-2223 days Memory Pressure, OOM & cgroup v2 What happens when memory runs out: reclaim, swap, the OOM killer, and cgroup v2 limits that throttle silently. Advanced Practitioner-taught SAR 9,000Next 22 Nov

KRN-2303 days Kernel Locking Primitives Every locking primitive the kernel offers, when each is correct, and the deadlocks that follow from choosing wrong. Practitioner Practitioner-taught SAR 7,880Next 8 Nov

KRN-2313 days RCU in Depth Read-copy-update from first principles: grace periods, publish-subscribe, and why RCU is everywhere in the kernel. Advanced Practitioner-taught SAR 9,000Next 8 Nov

KRN-2323 days Memory Barriers & the Kernel Memory Model The hardest correctness topic in the kernel: reordering, barriers, and reasoning about concurrent code that actually holds. Expert Practitioner-taught SAR 10,120Next 8 Nov