Three primitives cover almost every locking decision: spinlocks, mutexes, and futexes. They solve the same problem with very different cost models — burning CPU vs trapping to the kernel vs the hybrid approach modern mutexes actually use.
eBPF programs are stateless — maps are how they remember. A walk through the five map types that cover most real programs: hash, array, per-CPU, ring buffer, and LRU, with concrete code for each.
Kernel modules sound intimidating, but the ceremony is small. In about a hundred lines: a working /dev/echo0 character device, with proper error unwinding, copy_to_user, and the patterns the rest of the kernel uses everywhere.
When recv() returns, dozens of layers ran behind your back — DMA, NAPI, sk_buff, protocol demux, the socket queue. A trace of the entire receive path with the cost of each hop and where the latency actually lives.
select and poll were O(n). epoll is O(1). The reason isn't smarter scanning — it's that the kernel pushes ready events into a list as they happen. A walk through the data structures that make it work.
How eBPF changed production debugging — attaching probes to kernel functions, tracing syscalls, measuring latency histograms, and XDP packet processing, all without touching application code or rebooting.
The first 512 bytes that run when your machine powers on. A walkthrough of x86 real mode, the BIOS interrupt interface, segment:offset addressing, and what it takes to load a second stage.