Think Like an OS: Full Syllabus#

Authors: Shrey Patel and Jay Patel, Coconut Labs
What this is: The section-level outline of every chapter in the book. The index is the map; this is the blueprint. Every written chapter is authored against live web research and an adversarial fact-check pass.

Every chapter uses the same fixed template: problem, then unfolded, then the real Linux, then the Coconut tie-in, then lab, bridge notes and sources. The outlines below list what goes inside each of those sections; "Unfolded" carries the concept sequence.

Use this file two ways. Before you spend a session on a chapter, read its outline; it tells you what that session buys you, in concepts and in labs. When you are chasing one mechanism (why a fault costs what it costs, where a credential is actually checked, what a syscall pays for the crossing), search here for the mechanism and go straight to the chapter that owns it. If you came for the timing questions rather than for kernel development, the index's opening section names the chapters where timing is decided.

Chapters you can read now#

These chapters exist as full text, linked from the index. The outline under each one describes what is actually in it.

Part 0: Orientation & the lab bench#

Ch 0: Think Like an OS#

• Goal: name the three jobs of an OS, place Linux/seL4/XNU on the design map, and have a working lab bench: a 6.12 kernel you built yourself booting in QEMU on your Mac.
• Unfolded: OS as hardware multiplexer, abstraction machine (process/file/socket are maintained fictions), and protection referee; kernel vs OS vs distribution; monolithic vs microkernel vs hybrid with Linux, seL4 (formally verified, roughly 10 to 16 kSLOC), XNU as the placed examples.
• Linux: source-tree geography; where to read code (elixir.bootlin.com, grep habits).
• Lab: brew-install QEMU; fetch 6.12 from kernel.org; Docker x86_64 cross-build; tinyconfig + serial console; boot with a hand-rolled initramfs.
• Coconut: the north-star mapped to the book. Each Coconut subsystem points at the chapter that teaches its foundations.

Part F: Core fundamentals (the prerequisite layer)#

Ch F.0: The Unix Survival Kit#

• Goal: live comfortably in a terminal: navigate, permission, process-manage, ssh, and build from source.
• Unfolded: shell as a programming environment (PATH, env, pipes, redirection, exit codes); filesystem hierarchy incl. /proc and /sys as kernel windows; users/groups/permission bits; processes from the user side (ps, signals, jobs); ssh; ./configure && make demystified plus cmake/meson at a glance; grep/find/less/tar.
• Lab: build a real C project from tarball; inspect a live process in /proc; answer a question about a log with a pipeline.

Ch F.1: How a Computer Computes#

• Goal: binary/hex fluency and the fetch-decode-execute loop as a mental movie.
• Unfolded: bits; two's complement and why it won (one adder for both signs); overflow; gates building a half-adder, then a full-adder, then an ALU, with ASCII diagrams; registers and the clock; von Neumann: code and data share memory; PC; a worked 3-instruction toy machine; code-is-data consequences (loaders, JITs, exploits).
• Lab: binary/hex/two's-complement predict-then-check drills; paper-execute the toy machine.

Ch F.2: Anatomy of a Program#

• Goal: watch one C file travel from preprocess to compile to assemble to link, and read a stack frame in a debugger.
• Unfolded: the four stages with real commands and real intermediates; x86_64 register set by name + rip/rflags; ARM64 x0-x30 at a glance; push/pop/call/ret physically; stack frames diagrammed; System V AMD64 calling convention (args rdi rsi rdx rcx r8 r9, return rax, caller/callee-saved); .text/.data/.bss/.rodata; static vs dynamic linking teaser (see Ch 24).
• Lab: run the four stages separately on a 10-line file; objdump the .o; watch frames in lldb/gdb.

Ch F.3: Memory from First Principles#

• Goal: pointers, layout, and the two classic memory bugs, cold.
• Unfolded: memory as one byte array; a pointer is an address is a number; endianness with a hexdump walk; classic process layout diagram (with the honesty note that Ch 11 replaces the cartoon); stack vs heap allocation physically; what free does and does not do; arrays/strings/structs in memory; padding and alignment; buffer overflow and use-after-free on sight; private-address-space teaser (see Ch 3 and Ch 11).
• Lab: print addresses vs /proc/self/maps; hexdump a struct (padding + endianness live); deliberate overflow and read the fault.

Ch F.4: The C You Need#

• Goal: read kernel C idiomatically: not tutorial C, the kernel dialect.
• Unfolded: why C owns this layer; the kernel's gnu11-era dialect; pointers in anger incl. function pointers and the ops-table idiom (file_operations as the real case); structs as the kernel's object system; container_of unfolded slowly with diagrams (the single most important idiom); bit-ops fluency with a flags-word worked example; macros and do{}while(0); goto-based error unwinding (out_free: pattern); undefined behavior with one striking example; kernel-specific types (u8 to u64) and what kernel C lacks (libc, floats).
• Lab: build an intrusive list with your own container_of, diff against the kernel's; 40-line ops-table plugin system.

Ch F.5: Reading Assembly Without Fear#

• Goal: read (never write) disassembly: recognize prologues, loops, calls, syscall sites at a glance.
• Unfolded: why reading-only is the right goal; AT&T vs Intel once, then AT&T throughout; the 12-word vocabulary (mov/lea/cmp+jcc/call/ret/push/pop/xor-zeroing) each with a C equivalent; shape recognition: prologue/epilogue, loop triangle, jump table, base+index*scale, base+offset; two fully annotated walkthroughs (a 10-line C function; a real syscall site, covered in Ch 7); ARM64 in 90 seconds (load-store architecture, bl/ret, svc); objdump, gcc -S, -O0 vs -O2, Compiler Explorer.
• Lab: five predict-then-check godbolt exercises; objdump a real binary and find main.

Ch F.6: Data Structures Kernels Love#

• Goal: think intrusively. That is the gap between CS-course containers and kernel containers.
• Unfolded: intrusive vs external containers diagrammed; struct list_head circular doubly-linked design + list_for_each_entry; hlist and hashtable.h bucket design; red-black trees as the ordered workhorse (and where 6.12 actually uses them, with the maple-tree migration for VMAs taught honestly); xarray and the page cache; bitmaps/cpumask; ring buffers (dmesg, io_uring, trace); per-CPU data and why it sidesteps locking; a closing chooser table with columns for structure, header, flagship user, and when you would pick it.
• Lab: working intrusive list + iterators in userspace; line-by-line accounting of the real list.h (WRITE_ONCE, poison); cache-behavior benchmark tying back to Ch 3.

Ch F.7: Concurrency, the Mental Model#

• Goal: the userspace concurrency model (races, atomicity, locks, deadlock) that Ch 10 hardens into the kernel version.
• Unfolded: concurrency vs parallelism; threads vs processes; the canonical lost-update interleaving diagrammed; atomicity and hardware atomics (x86 lock prefix, ARM64 LSE) with C11 atomics as the portable face; mutexes and critical-section discipline; the four deadlock conditions + ABBA example; the menu: rwlocks, condition variables (why the while-recheck), semaphores, spin vs sleep; memory ordering as an honest teaser only (full story Ch 10); hygiene: small sections, lock data not code, message passing and the Rust note (see Ch 34).
• Lab: a racy counter, then a mutex fix, then an atomic fix, all measured; construct and then break an ABBA deadlock; ThreadSanitizer run.

Part I: The machine beneath#

Ch 1: The CPU's Contract#

• Unfolded: why hardware-enforced privilege; rings 0/3 and long mode; ARM64 EL0-EL3; privileged operations concretely (CR3, MSRs, hlt, in/out; MSR/MRS); SMEP/SMAP and PXN/PAN; Meltdown/Spectre as the leak case study + KPTI cost; transition preview.
• Lab: hlt/rdmsr from userspace and catch the signals; cpuinfo flags; gdb-to-QEMU CPL observation.

Ch 2: Interrupts & Exceptions#

• Unfolded: polling vs interrupts; IDT and the exception zoo (vectors 0/8/13/14); faults vs traps vs aborts; ARM64 vector table + IRQ/FIQ/SError; APIC/IO-APIC/MSI-X and GIC; request_irq, hardirq rules, softirq/tasklet/workqueue/threaded IRQs; the timer heartbeat.
• Lab: /proc/interrupts under load; ftrace irq events; deliberate faults, read dmesg.

Ch 3: Memory Hardware#

• Unfolded: the four VM problems; paging over segmentation; 4-level and 5-level walks diagrammed; PTE bits; TLB/ASID/PCID/shootdowns; huge pages; ARM64 granules + TTBR0/1; cache hierarchy with measured latencies; MESI intuition; false sharing.
• Lab: pointer-chase latency cliffs; pagemap virtual to physical translation; dTLB miss counting.

Part II: The kernel's core loop#

Ch 6: Boot#

• Unfolded: reset vector to firmware; BIOS vs UEFI; ESP/GPT/NVRAM entries; Secure Boot chain (PK/KEK/db, Microsoft third-party CA, shim, MOK); bootloader to bzImage to decompression; initramfs (cpio) and switch_root; start_kernel reaching PID 1; ARM64: device tree vs ACPI, m1n1 note.
• Lab: from-scratch initramfs; boot with init=/bin/sh; break init and read the panic.

Ch 7: The Syscall Boundary#

• Unfolded: the syscall instruction + MSR_LSTAR entry path; the register ABI (rax; rdi rsi rdx r10 r8 r9, and why r10); errno convention; syscall_64.tbl + SYSCALL_DEFINE; the vDSO fast path (6.12's real export list); strace; adding a syscall step-by-step with agent_* 472 to 479 as the worked example; "we do not break userspace."
• Lab: raw syscall via inline asm; strace accounting of a hello-world; grep the table in the tree.

Ch 8: Processes & Threads#

• Unfolded: process = ownership bundle; task_struct tour by concern; threads share the mm; fork/vfork/clone/clone3 + flags table; COW; execve preview; states R/S/D/Z/T; orphans/reaping/subreapers; zombies; pidfd; signals essentials.
• Lab: 60-line mini-shell; deliberate zombie; COW observed via smaps.

Ch 9: Scheduling#

• Unfolded: fairness/latency/throughput; tick to preemption to context switch (cost included); the verified history from O(1) to CFS in 2.6.23 to EEVDF in 6.6; vruntime and EEVDF lag/eligibility in plain words; policy zoo table; 6.12's deadline-class fair server reservation; per-CPU runqueues, load balancing, domains.
• Lab: burn tasks vs CPUs; chrt FIFO starvation with the 6.12-correct fair-server variant; perf sched latency.

Chapters still in outline#

These chapters are not written yet. What follows is the plan for each: the concept sequence, the labs, the Linux reading, and the Coconut tie-in. Part I and Part II pick up here where they stopped above.

Part I: The machine beneath, continued#

Ch 4: Time#

• Unfolded: wall vs monotonic vs boottime clocks; hardware: TSC (and its invariant-TSC redemption arc), HPET, ARM generic timers, APIC/GIC timers; clocksource vs clockevent abstractions; jiffies and the tick; tickless NO_HZ; hrtimers; timekeeping and NTP nudging vs stepping; timestamping pitfalls.
• Linux: kernel/time/, /sys/devices/system/clocksource, clock_gettime paths (vDSO tie-back to Ch 7).
• Lab: compare CLOCK_REALTIME/MONOTONIC/BOOTTIME under clock changes; read TSC directly; observe timer slack and NO_HZ on an idle CPU.
• Coconut: audit-record timestamps (ordering + tamper evidence needs monotonic + wall); agent scheduling deadlines.

Ch 5: I/O at the Wire#

• Unfolded: the speed mismatch; MMIO vs port I/O; PCIe: config space, BARs, enumeration; polling vs interrupts vs DMA; the IOMMU (VT-d/SMMU): DMA remapping as memory protection for devices; the driver model: bus/device/driver matching, probe.
• Linux: /sys/bus/pci, /proc/iomem, lspci; driver core (drivers/base/).
• Lab: lspci -vvv guided walk; map /proc/iomem to BARs; watch /proc/interrupts during disk and network I/O.
• Coconut: IOMMU posture for GPU workloads (kvwarden); device access as a capability question.

Part II: The kernel's core loop, continued#

Ch 10: Kernel Concurrency#

• Unfolded: why kernel concurrency is harder: preemption, interrupts, true multi-CPU parallelism; process vs atomic context and the may-I-sleep rule; spinlocks (disable-preemption semantics) vs mutexes vs semaphores; RCU unfolded slowly (read-mostly data, grace periods, why it powers the dcache); atomics; the real memory-ordering story (store buffers, barriers, acquire/release) that F.7 deferred; per-CPU revisited; lockdep as the always-on proof assistant.
• Linux: spinlock.h, rcupdate.h, Documentation/memory-barriers.txt; lockdep splat anatomy.
• Lab: provoke and read a lockdep splat in a test module under QEMU; RCU reader/updater toy; a two-CPU store-buffer litmus test via herd7 or in-guest demonstration.
• Coconut: cap-table and agent-registry locking design; audit ring concurrency; why conformance tests must drive real ops.

Part III: Memory#

Ch 11: Virtual Memory#

• Unfolded: mm_struct and VMAs (maple tree in 6.1 and later); mmap end-to-end; the page-fault path unfolded (from CPU fault to handle_mm_fault to a mapped page); demand paging; COW mechanics at fault time; ASLR; stack growth; the cartoon from F.3 replaced by the real map.
• Linux: mm/memory.c fault path, mm/mmap.c, /proc/PID/maps + smaps semantics.
• Lab: ftrace a page fault; mmap experiments (lazy allocation observed via RSS); measure fork+COW cost vs writes.
• Coconut: mm tier-aware hooks (v1 additive): what they observe and steer.

Ch 12: Physical Memory#

• Unfolded: zones and why DMA/normal split exists; the buddy allocator unfolded (orders, split/merge); fragmentation; slab/slub on top of buddy (kmalloc caches, per-object recycling); vmalloc vs kmalloc; reclaim: watermarks, kswapd, LRU generations (MGLRU in modern kernels, verified treatment); the OOM killer's scoring.
• Linux: mm/page_alloc.c, mm/slub.c, /proc/buddyinfo, /proc/slabinfo, vmstat counters.
• Lab: watch buddyinfo under fragmentation pressure; slabtop while creating/destroying objects (dentries); trigger a contained OOM in a memory-limited cgroup and read the kill report.
• Coconut: agent memory accounting and tier budgets ride on these mechanisms.

Ch 13: Page Cache & Tiers#

• Unfolded: the unified page cache: reads, writes, and mmap all meet in one cache (xarray-indexed, the F.6 payoff); readahead; writeback: dirty ratios, flusher threads, fsync truth; drop_caches; NUMA locality and policies; the tiered-memory era (CXL, demotion/promotion, DAMON) surveyed honestly.
• Linux: mm/filemap.c, mm/readahead.c, /proc/sys/vm/ knobs, cgroup memory.stat.
• Lab: hot vs cold read timing with drop_caches between; watch writeback respond to dirty_ratio; fio through the cache vs O_DIRECT.
• Coconut: the v1 mm hooks are tier-aware precisely here: inference working sets vs cold agent state.

Part IV: Persistence#

Ch 14: VFS#

• Unfolded: the abstraction that makes "everything is a file" true enough: superblock, inode, dentry, file objects and their ops tables (F.4's idiom across a whole subsystem); the dcache as the hot path; path lookup walked component by component; mounts and the mount tree; procfs/sysfs/tmpfs as filesystems with no disk at all.
• Linux: fs/namei.c walk, include/linux/fs.h ops tables, /proc/mounts.
• Lab: strace the open of a deep path; dcache hit/miss via stats; write a toy FUSE filesystem (userspace, safe) to feel the ops-table contract.
• Coconut: agentfs will be a VFS citizen; its design constraints follow directly.

Ch 15: Real Filesystems#

• Unfolded: the on-disk problem (find bytes again after power loss); ext4: block groups, extents, and journaling modes unfolded (what data=ordered actually promises); btrfs: COW trees, snapshots, checksums (a genuinely different answer); overlayfs: how container images stack read-only layers + one writable; crash consistency and what fsync actually guarantees; xfs/f2fs one paragraph each.
• Linux: fs/ext4/, fs/btrfs/, fs/overlayfs/; dumpe2fs; btrfs subvolume tooling.
• Lab: build a tiny ext4 image in a file, hexdump the superblock; snapshot a btrfs subvolume and diff; assemble an overlay mount by hand (lower/upper/work).
• Coconut: ostree's hardlink model (Ch 27) and agentfs journaling choices both trade against these designs.

Ch 16: Block Layer & io_uring#

• Unfolded: from filesystem to disk: bios, requests, the multi-queue block layer (why NVMe forced blk-mq); I/O schedulers (none/mq-deadline/bfq) and when each matters; then io_uring unfolded slowly: submission/completion rings in shared memory, why batching + no-syscall-per-I/O wins, liburing shape.
• Linux: block/, /sys/block/*/queue/scheduler; io_uring_setup/enter man pages.
• Lab: fio across schedulers on the QEMU disk; write cat with liburing; count syscalls vs read(2) cat.
• Coconut: the audit writer's 100k-events/sec budget makes io_uring a serious candidate. Evaluate it alongside Ch 21.

Part V: Identity & capability (the Coconut heart)#

Ch 17: Credentials & DAC#

• Unfolded: struct cred walked field by field; ruid/euid/suid and the setuid dance unfolded (why it's subtle enough to have caused decades of CVEs); file permission bits + ACLs; POSIX capabilities: the five sets (permitted/effective/inheritable/bounding/ambient) unfolded with transition rules; file capabilities; no_new_privs; why "root or not" was the design failure: ambient authority everywhere.
• Linux: kernel/cred.c, security/commoncap.c, capability(7).
• Lab: capsh experiments; give a binary CAP_NET_BIND_SERVICE and bind :80 unprivileged; write a setuid program that drops privilege correctly and verify with getresuid.
• Coconut: the v1 cred shim appends agent identity to struct cred, additive by design, so glibc, sudo, sshd and the NVIDIA driver keep working unmodified; this chapter is its prerequisite.

Ch 18: Namespaces & cgroups#

• Unfolded: each namespace unfolded with a one-command demo: mnt, pid (nested trees, PID 1 illusions), net, ipc, uts, user (uid mapping, the interesting one), cgroup, time; how user namespaces changed the security calculus; cgroup v2's unified hierarchy: controllers (cpu, memory, io, pids), the no-internal-processes rule; how Docker/Podman are namespace+cgroup+overlayfs compositions, nothing more.
• Linux: namespaces(7), cgroups(7), /sys/fs/cgroup layout, clone3 flags.
• Lab: the classic: build a container by hand (unshare + pivot_root + cgroup memory limit + veth) with no Docker involved; then inspect what Docker actually creates.
• Coconut: the agent sandbox composes these primitives; SCHED_AGENT and cgroup cpu.weight interplay.

Ch 19: LSM & seccomp#

• Unfolded: the LSM architecture: security_* hook call sites threaded through the kernel, hook lists, stacking rules; SELinux in working terms (labels, type enforcement, policy compile) vs AppArmor (path profiles), a philosophy contrast; Landlock (unprivileged sandboxing); seccomp-bpf unfolded: filtering the syscall boundary itself, filter programs, TSYNC.
• Linux: security/security.c hook dispatch, include/linux/lsm_hooks.h; seccomp(2).
• Lab: write a seccomp filter denying openat and watch a program fail politely; read a real AppArmor profile; getenforce/setenforce on a Fedora VM with audit2allow.
• Coconut: security/coconut/ attaches here in v1: hook budget, stacking with distro LSMs, and the lesson that green conformance does not mean bypass-proof; security review pairs with the shadow gate.

Ch 20: Capability-Based Security#

• Unfolded: ambient authority as THE bug class; object capabilities: designation IS authorization, no global namespace to confuse; the confused deputy walked with Hardy's compiler-billing story; the lineage from KeyKOS and EROS to seL4 (caps and CNodes), Capsicum (capability mode, rights-refined fds), Genode, Fuchsia handles; why POSIX "capabilities" (Ch 17) are not capabilities; delegation and the revocation problem honestly; capability myths (equally vulnerable to leakage? the literature's answers).
• Linux/real systems: Capsicum's cap_enter/cap_rights_limit; seL4 CNode ops; SCM_RIGHTS as Unix's accidental capability transfer (see Ch 22).
• Lab: simulate a confused deputy with Unix perms then fix it capability-style with fd passing; design exercise: cap-ify a file API on paper; optional FreeBSD VM Capsicum run.
• Coconut: cap tokens (Ed25519-signed, payload-hash-bound), the v1 shim mapping caps onto DAC+LSM vs the v2 replacement; this chapter is the book's thesis-carrier with Ch 37.

Ch 21: Audit#

• Unfolded: logging as a security control (detection, forensics, non-repudiation); the kernel audit subsystem today: auditd, rules, record format, its costs; tamper evidence unfolded: hash chains (each record binds its predecessor), signed checkpoints, what an attacker with root can and cannot rewrite; append-only postures; the performance problem: 100k events/sec budgets, ring buffers, userspace drain, backpressure choices (drop vs block vs sample, and each of the three is a security decision).
• Linux: kernel/audit.c, auditctl, ausearch; the netlink transport (see Ch 23).
• Lab: auditctl an execve watch and read the records; build a toy hash-chained log + verifier and then tamper with it to watch verification fail.
• Coconut: kernel/audit/coconut: JSON-lines + zstd + BLAKE3 chain, coconutd-signed rotation; per-cap-op emission (every Ch 20 decision leaves a Ch 21 record).

Part VI: Communication#

Ch 22: IPC#

• Unfolded: the menu with mechanics: pipes/FIFOs (kernel buffer, SIGPIPE); Unix domain sockets + SCM_RIGHTS fd passing unfolded carefully (it is capability transfer, the Ch 20 payoff); shared memory: shm, memfd + seals; futex unfolded (userspace fast path, kernel wait queue slow path, which is how every mutex you have ever used actually works); signals as IPC and why they're the worst option; eventfd/signalfd/timerfd; POSIX mqueues; D-Bus survey; Android binder contrast; a chooser table.
• Linux: unix(7), pipe(7), futex(2), memfd_create(2).
• Lab: pass an open fd over a Unix socket with SCM_RIGHTS; build a mutex from raw futex; seal a memfd and prove the seal holds.
• Coconut: agent IPC design inherits fd-passing-as-cap-transfer; audit hooks on the channels.

Ch 23: Networking#

• Unfolded: an sk_buff's life from NIC RX to recv(2), unfolded stage by stage; the socket API layer map; TCP state machine at working level; netfilter's hook points + nftables; netlink sockets, which is how ip(8), auditd, and friends configure the kernel (the other syscall boundary); network namespaces + veth pairs (container networking mechanics); XDP/eBPF at the driver edge (see Ch 35).
• Linux: net/core/, netfilter hooks diagram, ss/tcpdump/nft.
• Lab: trace one HTTP request with tcpdump + ss state transitions; build a two-namespace network with veth and route between them; write one nft rule and watch counters.
• Coconut: the server profile's :8443 dashboard; network access as a capability grant; the AF_UNSPEC bind-bypass lesson as a worked cautionary tale.

Part VII: The userspace contract#

Ch 24: ELF, Linking & Loading#

• Unfolded: ELF anatomy: headers, sections vs segments (the two views); the kernel's execve path (binfmt handlers, mapping PT_LOAD); static loading end-to-end; dynamic loading, where PT_INTERP hands off to ld.so, then relocations, then PLT and GOT unfolded slowly (lazy binding walked instruction by instruction, the F.5 payoff), symbol resolution order, LD_PRELOAD interposition; PIE + ASLR; what the compiler coursework called "linking," completed.
• Linux: fs/binfmt_elf.c, readelf/objdump, ld.so(8), LD_DEBUG.
• Lab: full readelf dissection of a hello-world; write a ~40-byte true ELF by hand or via minimal asm; LD_PRELOAD a malloc logger; watch lazy binding resolve with LD_DEBUG=bindings.
• Coconut: agent_attest's payload-hash measures exactly what this chapter teaches gets mapped.

Ch 25: libc & the Runtime#

• Unfolded: what libc actually is: syscall wrappers + errno (per-thread, in TLS), stdio buffering (the classic surprise), malloc as a userspace allocator over brk/mmap, pthreads, startup before main, where _start calls __libc_start_main, which runs the constructors; glibc vs musl philosophy and size; static vs dynamic tradeoffs today; vDSO interplay (Ch 7 payoff); why the kernel ABI is syscalls, not libc, and what that means for Go/Rust runtimes.
• Linux: glibc source pointers, musl, /lib64/ld-linux-x86-64.so.2.
• Lab: the stdio-buffering strace surprise (printf with and without \n through a pipe); build one binary against musl and glibc, compare; override malloc via LD_PRELOAD (Ch 24 payoff).
• Coconut: the compat promise, that glibc, sudo and sshd run unmodified in v1, is a promise about this layer.

Ch 26: init & Service Management#

• Unfolded: PID 1's non-negotiable duties (reaping, signal defaults, it must not die); the lineage from SysV scripts to upstart to systemd, what systemd actually is (units, dependency graph, cgroup-per-service, socket activation, journald) at working level; the supervision-tree philosophy: s6/runit (small PID 1, supervised longruns, no PID files) and dinit; an honest comparison table; what a service manager owes an agent-native OS.
• Linux: systemd unit anatomy, s6-svscan/s6-supervise, /proc/1.
• Lab: write a systemd service + socket-activated pair; run an s6 supervision tree in Docker and kill things to watch restarts.
• Coconut: coconutd, an s6-derived greenfield in Rust: supervision trees for agents, PID 1 minimalism, audit-signed rotation duty (Ch 21).

Ch 27: Packaging & Atomic Updates#

• Unfolded: the packaging problem (files, deps, scriptlets, trust); rpm anatomy + dnf solving at a glance; the image-based turn: ostree unfolded (content-addressed object store, hardlink checkouts, deployments, /etc merge), rpm-ostree hybrid (base image + package layering); A/B semantics and rollback truth; bootloader integration; reproducible builds working level (SOURCE_DATE_EPOCH, toolchain pinning, diffoscope); signing: GPG lineage and sigstore/cosign; why "the OS is an image" changes ops.
• Linux: rpm-ostree status/deploy, ostree admin, treefiles.
• Lab: rpmbuild a toy package; walk a Fedora Silverblue VM's ostree deployments and roll back; make a build reproducible and byte-verify with diffoscope.
• Coconut: coconutpkg = rpm-ostree fork + cap-metadata RPM extension; single ISO / two profiles; the update path is the trust path.

Part VIII: The interaction surface#

Ch 28: Pixels to Glass#

• Unfolded: DRM/KMS unfolded: framebuffers, planes, CRTCs, encoders, connectors, atomic modesetting; GEM buffers + dma-buf sharing (how a rendered frame travels processes); the Mesa/EGL/Vulkan stack shape; where each driver actually stands, told honestly: amdgpu, i915/xe, nouveau, and NVIDIA proprietary (DKMS rebuild reality, GSP firmware era, open-gpu-kernel-modules status, verified at authoring time); fbdev as the legacy floor.
• Linux: drivers/gpu/drm/, /sys/class/drm, modetest/drm_info.
• Lab: enumerate the display pipeline with drm_info; kmscube in a VM; walk a dma-buf export/import example.
• Coconut: NVIDIA-blob coexistence is a v1 hardware-target requirement; Coconut Shell renders onto exactly this stack.

Ch 29: Wayland & Compositors#

• Unfolded: X11's architectural debt stated fairly; Wayland's model: the compositor is the server, clients render into buffers, surfaces/roles, frame callbacks, every-frame-is-perfect; security defaults (no universal screen-scraping/input-snooping) and the portal escape hatches; the extension protocols (xdg-shell, layer-shell); what a compositor must actually do (input routing, layout, damage, present); Smithay's architecture for building one in Rust (vs wlroots); XWayland's bridge and its papercuts.
• Linux: wayland-protocols, WAYLAND_DEBUG, Smithay's anvil example.
• Lab: run a compositor nested; WAYLAND_DEBUG=1 trace of one window's life; write a minimal Wayland client that draws a colored window (shared-memory buffer).
• Coconut: Coconut Shell: agent-aware window management, top-bar agent indicator, the audit-log workspace as a first-class surface; alpha-parity posture for v1.

Part IX: Building, testing, shipping#

Ch 30: kbuild & Cross-Compilation#

• Unfolded: Kconfig as a constraint language (Kconfig files, .config, defconfig/olddefconfig/menuconfig); kbuild's recursive make and obj-y mechanics at reading level; in-tree vs out-of-tree modules; cross toolchains: CROSS_COMPILE, LLVM=1; ccache; the macOS-host reality: Docker/case-sensitivity traps (xt_DSCP.h collisions) and why we build in containers; vmlinux vs bzImage vs modules vs dtbs.
• Linux: Makefile, scripts/kconfig/, Documentation/kbuild/.
• Lab: start from tinyconfig, enable one feature via menuconfig, then measure the rebuild delta; full x86_64 build in Docker on the Mac; cross-build the same tree for ARM64 and boot it in qemu-system-aarch64.
• Coconut: coconut_defconfig, the /tmp/kgate.sh local rung, and why the CI image builds the way it does.

Ch 31: Kernel Testing#

• Unfolded: the kernel testing pyramid; KUnit unfolded (in-kernel unit tests, kunit.py runner, UML vs QEMU, and the silent-failure lesson that forced --arch=x86_64); kselftest (userspace harness, TAP); LTP; fault injection; syzkaller surveyed; CI design as an engineering discipline: per-push vs scheduled, why a gate that can silently skip is worse than no gate (the zero-job schedule bug + 14-day gap), proof-of-execution closes.
• Linux: lib/kunit/, tools/testing/selftests/, Documentation/dev-tools/kunit/.
• Lab: write a KUnit test for a list helper, run it via kunit.py under QEMU, break it red-then-green; run one kselftest suite and read its TAP.
• Coconut: the kunit-coconut gate, the 17-invariant cap conformance suite, and the rule that a conformance test must drive the real op.

Ch 32: Debugging & Observability#

• Unfolded: the ladder from printk (levels, dynamic debug) to ftrace (function tracer, tracepoints, trace-cmd) to perf (sampling, flamegraphs) to eBPF tracing (bpftrace one-liners) to kgdb and crash/kdump (vmcore autopsy); decode_stacktrace; then the truth machines: KASAN, KCSAN, UBSAN, KFENCE, lockdep, and what each one proves and costs; pstore for the crash you can't reproduce.
• Linux: Documentation/trace/, tools/perf/, bpftrace repo, Documentation/dev-tools/.
• Lab: ftrace one syscall end-to-end; bpftrace histogram of syscall latency; build a test module with a deliberate UAF and read the KASAN splat cold.
• Coconut: the suspicion to verdict loop (static review names a race, dynamic tooling convicts it) as standing practice.

Ch 33: Maintaining a Fork#

• Unfolded: patch discipline (one logical change, subject conventions, Fixes:, Signed-off-by/DCO); review culture and LKML norms (plain text, inline reply, b4/git send-email); stable-tree rules and backports; fork strategy: merge vs rebase cadence, keeping the delta small and extractable, subsystem quarantine (our new dirs vs touched core files); the every-2-years upstream merge as a scheduled engineering event; upstream-first vs fork-only rubric; syscall-number reservation politics.
• Linux: Documentation/process/submitting-patches.rst, checkpatch, get_maintainer.
• Lab: produce a clean 3-patch series with b4 + checkpatch; mock-rebase a small delta across a base bump and resolve honestly; write the LKML-style cover letter.
• Coconut: the post-GA rebase plan from 6.12 to 6.18; the LKML syscall reservation note; how we quarantine kernel/agent/ + security/coconut/ to survive merges.

Part X: The frontier#

Ch 34: Rust in the Kernel#

• Unfolded: the motivation with verified numbers (the ~70% memory-safety CVE figures from Microsoft/Chromium); Rust-for-Linux history and what is actually in-tree by 6.12 (verified, not vibes); the kernel crate model: bindings vs abstractions, no_std, fallible allocation (no panicking allocs); the pin-init problem unfolded (address-stable, self-referential kernel objects vs Rust moves); unsafe discipline at the FFI boundary; Send/Sync as kernel claims; the social reality of C and Rust maintenance side by side, told neutrally.
• Linux: rust/ directory, Documentation/rust/, samples/rust/.
• Lab: build a 6.12 tree with Rust enabled and write a hello-world module; read one real in-tree Rust driver and map every unsafe block to its justification.
• Coconut: Rust-where-possible for kernel/agent/ + security/coconut/; the FFI review lens applied to our own diffs.

Ch 35: eBPF#

• Unfolded: safe kernel extension without modules: the verifier unfolded (why unbounded loops were forbidden, pointer tracking, program size budgets); program types (kprobe, tracepoint, XDP, cgroup, BPF-LSM); maps as the data plane; CO-RE + BTF (compile once, run everywhere); libbpf skeleton workflow; bpftool; honest limits.
• Linux: kernel/bpf/, bpftool, libbpf-bootstrap.
• Lab: libbpf tool counting execve by uid; XDP drop program on a veth pair (Ch 23 payoff); bpftool map dump live.
• Coconut: the build-vs-attach contrast: why cap enforcement is an LSM + first-class subsystem rather than BPF-LSM programs (persistence, ABI stability, audit coupling), argued on the merits.

Ch 36: Virtualization#

• Unfolded: trap-and-emulate theory, then VT-x and AMD-V (root and non-root, VMCS, exits); EPT/NPT nested paging (Ch 3 payoff); KVM's architecture (a kernel module + an ioctl API, nothing mystical); QEMU's actual role (device models; TCG binary translation vs KVM accel, which is why our Mac gate runs TCG); virtio unfolded: paravirtual rings, virtio-net/blk, vhost; minimal VMMs (Firecracker, cloud-hypervisor); nested virt note.
• Linux: virt/kvm/, Documentation/virt/kvm/api.rst, /dev/kvm.
• Lab: the classic ~150-line KVM program: open /dev/kvm, create a VM + vCPU, run a few real-mode instructions; boot the Ch 0 kernel under TCG vs KVM on a Linux host and measure; enumerate virtio devices from inside the guest.
• Coconut: every CI gate and lab in this book runs on this machinery; kvwarden's GPU-passthrough context.

Ch 37: Agents as Kernel Primitives (the thesis chapter, written last)#

• Unfolded: why userspace agent frameworks plateau: identity, fairness, and audit are all advisory one layer up; the agent as a kernel object: registry, lifecycle, relation to the process tree; agent_spawn and agent_attest walked end-to-end using the whole book (syscall Ch 7, creds Ch 17, LSM Ch 19, caps Ch 20, audit Ch 21, scheduling Ch 9); the attestation chain (payload hash; MAC now, Ed25519 at v2, with the decision explained); SCHED_AGENT: fairness by construction, kvwarden lineage; audit-everything within a 100k/sec budget; the v1-shim honesty (compat with glibc, sudo, sshd and the NVIDIA driver) and the v2 replacement map; open problems stated plainly (revocation, cross-host agents, GPU-side enforcement); the closing argument: think like an OS = mechanisms over policies, ABI is forever, fail closed, evidence over vibes.
• Lab: a design review, not a keyboard lab: write a one-page threat model for a candidate agent_delegate syscall (the 474 to 479 family) and check it against the capability-invariant list; then run the conformance suite in the repo and read its evidence.
• Coconut: this chapter is the project.

Appendices#

• A. x86_64 and ARM64 cheat sheet: registers, calling conventions, syscall conventions, how rings map to exception levels, page-table shapes, the 12-word assembly vocabulary in both dialects.
• B. Kernel source-tree map: every top-level directory annotated in one line; where Coconut's kernel/agent/, security/coconut/, kernel/audit/coconut/ slot in.
• C. Lab solutions: worked solutions + expected-output transcripts per chapter, kept separate so labs stay honest.
• D. Glossary: every term the book defines, one-line each, with the chapter that unfolds it.
• E. Annotated reading list: OSTEP (free, the best companion theory text), Love's Linux Kernel Development, LDD3 (with its age caveat), Understanding the Linux Virtual Memory Manager, the seL4 and Capsicum papers, LWN kernel index, KernelNewbies, Bootlin training decks, each with why and when.