Think Like an OS§

Authors: Shrey Patel and Jay Patel, Coconut Labs
Status: In progress. Structure locked; chapters land in batches. Every factual claim web-verified at authoring time; sources cited inline.
What this is: A hands-on book that teaches the fundamental building blocks of operating systems, from the hardware contract through kernel internals to shipping a distro, through the lens of what Coconut OS is actually building. One place for the concepts, the skills, and the prerequisites.

§1 Who this book is for§

Every abstraction you use daily is a fiction the kernel maintains for you: a file, a socket, a thread, a stretch of memory that looks like it belongs to you alone. The fictions are good ones. They are not free. This book takes them apart in runnable pieces and puts them back together.

Two destinations bring people here, and the book is built for both.

You are heading toward kernel or systems work. You want to open mm/memory.c and read it instead of bouncing off it, send a patch a maintainer accepts, and know a subsystem well enough to change it. Your spine is Ch 6 to 9 (boot, syscalls, processes, scheduling), then Part III for memory, then Part V, where Coconut OS's own kernel work lives. Part IX is the workflow you will be in every day.

You are heading toward low-latency work: trading systems, market data, anything judged on its worst response rather than its average. Your question is not what the machine does. It is when. Every stall you will chase is one of the mechanisms in here, and each one has a chapter that takes it apart:

A cache miss walks a hierarchy with measurable costs, and a TLB miss triggers a page walk before the load can even start (Ch 3).
Two cores writing to the same cache line serialize without sharing a single variable. That is false sharing (Ch 3).
A page fault is a trap into the kernel, and demand paging means the first touch of a fresh mapping is the one that pays (Ch 11).
A syscall is a privilege transition, which is why clock_gettime was moved into the vDSO so the common calls skip the crossing entirely (Ch 7).
A SCHED_FIFO spinner takes a CPU and does not hand it back on its own. What 6.12's fair server still guarantees to everything else is the interesting half (Ch 9).
An interrupt arrives when the device says so, not when your code is ready, and it preempts whatever was running (Ch 2).

None of those six are exotic. They are ordinary machinery that most working engineers were never shown, which is why timing reads as luck until you have read them. This is not a trading book: no strategy, no microstructure, nothing about markets. It is the layer underneath, taught until you can name the mechanism behind a number instead of guessing at it. Some of the chapters named above are written and some are still outlines; §3 marks which.

Where to start: Chapter 0, and do its lab rather than reading it. It ends with a Linux 6.12 kernel you compiled yourself, booting your own PID 1 in QEMU on your own machine. If you have never built a kernel, build that one before you read further. Every chapter after it lands differently.

Those two destinations are about where you are going. The three tracks below are about what you are bringing. Every chapter unfolds complex machinery into longer-but-simpler prose, and no prior kernel or CPU knowledge is assumed by the text itself. The tracks differ only in pace and which bridge sections you skip.

Track	Reader	Path
A. Bridge (the curated track, §4 below)	BS+MS CS; has taken compiler design + microprocessor/microcontroller coursework; no Linux-kernel internals yet	Fast bridge notes through Part I, then linear. Compiler background pays off directly in Ch 7, 24, 30.
B. Full path	Anyone in the CS industry (web dev, data, SRE, mobile) with no CPU or kernel exposure	Chapter 0 first, then all of Part F (the prerequisite layer), then linear. Read every "Unfolded" section; do every lab.
C. Reference	Engineers already working on Coconut OS subsystems	Jump per-chapter via §3; each chapter is self-contained with a source map.

§2 How every chapter works§

Fixed template, so you always know where you are:

The problem. What breaks without this mechanism. Every OS structure is a solution; we start from the pain.
Unfolded. The core idea in longer-but-simpler prose. No jargon before it is defined. This is the section that makes the book readable by someone who has never seen a page table.
The real thing in Linux. Actual file paths, structs, and code paths in the 6.12 tree Coconut OS forks.
Coconut tie-in. What Coconut OS changes, replaces, or adds here, cross-referenced to the spec (04-HLD, 05-LLD section numbers).
Lab. Runnable, QEMU-based where possible, on a macOS or Linux host. Red-then-green: you predict, you run, you compare.
Bridge notes. The "if you know compilers/microcontrollers, here is the mapping" callouts for Track A.
Depth gauge. Each section is marked [fundamental], [working], or [advanced], so you can bail out of a deep dive without losing the thread. An [advanced] section is one you have permission to skip on the first pass.
Sources. The URLs actually consulted and verified at authoring time.

§3 Full structure§

Part 0   Orientation & the lab bench
Part F   Core fundamentals            (the prerequisite layer: bits → programs → memory → C → assembly → data structures → concurrency)
Part I   The machine beneath          (hardware contract)
Part II  The kernel's core loop       (boot, syscalls, processes, scheduling)
Part III Memory                       (virtual, physical, page cache)
Part IV  Persistence                  (VFS, filesystems, block, io_uring)
Part V   Identity & capability        (creds, namespaces, LSM, caps, audit)  ← Coconut heart
Part VI  Communication                (IPC, networking)
Part VII The userspace contract       (ELF, libc, init, packaging)
Part VIII The interaction surface     (DRM/KMS, Wayland, compositors)
Part IX  Building, testing, shipping  (kbuild, KUnit, QEMU gates, fork maintenance)
Part X   The frontier                 (Rust-for-Linux, eBPF, KVM, agents-as-primitives)

Part 0: Orientation & the lab bench§

Ch	Title	One-liner	Status
0	Think Like an OS	What an OS actually is (multiplexer, abstraction machine, protection referee); the Coconut OS north star; lab bench setup: QEMU, Docker cross-build, kernel tree navigation	done, fact-checked

Part F: Core fundamentals (the prerequisite layer)§

Everything the rest of the book assumes, in one place. Track B reads all of it after Chapter 0. Track A treats it as an optional refresher, with F.5 to F.7 recommended: intrusive kernel data structures and concurrency vocabulary are new even to most MS grads.

Ch	Title	One-liner	Status
F.0	The Unix survival kit	Shell fluency, filesystem hierarchy, permissions, processes from the user side, ssh, building software from source. The lab prerequisite	done, fact-checked
F.1	How a computer computes	Bits, binary/hex, two's complement, gates to ALU, clocks, the von Neumann fetch-decode-execute loop	done, fact-checked
F.2	Anatomy of a program	Source → compiler → assembler → linker → executable; registers, PC/SP, stack frames, calling conventions at machine level	done, fact-checked
F.3	Memory from first principles	The address space as a byte array; endianness; stack vs heap; pointers as addresses; layout and alignment	done, fact-checked
F.4	The C you need	The kernel-dialect working subset: pointers, structs, bit operations, function pointers, macros, goto error handling, container_of, undefined behavior	done, fact-checked
F.5	Reading assembly without fear	x86_64 + ARM64 reading fluency: prologues, calls, loops, syscall sites. Compiler Explorer as the lab	done, fact-checked
F.6	Data structures kernels love	Intrusive linked lists, hash tables, red-black trees, xarray, bitmaps, ring buffers, per-CPU data, and why kernels prefer intrusive forms	done, fact-checked
F.7	Concurrency, the mental model	Threads, data races, atomicity, critical sections, locks. The userspace mental model Part II's kernel concurrency builds on	done, fact-checked

Part I: The machine beneath§

Ch	Title	One-liner	Status
1	The CPU's contract	Privilege: x86_64 rings + long mode, ARM64 exception levels; the instructions only kernels may run; what "kernel mode" physically means	done, fact-checked
2	Interrupts & exceptions	The event-driven heart: vectors, IDT/GIC, faults vs traps vs aborts, nested interrupts, softirqs preview	done, fact-checked
3	Memory hardware	MMU, 4/5-level page tables, TLB, caches and coherence. Why virtual memory exists and what it costs	done, fact-checked
4	Time	Timers, clocksources, TSC/arch timers, APIC/GIC timers, tick vs tickless	planned
5	I/O at the wire	PCIe, MMIO vs port I/O, DMA, IOMMU, device discovery	planned

Part II: The kernel's core loop§

Ch	Title	One-liner	Status
6	Boot	Power-on → UEFI → shim/bootloader → kernel decompression → init → PID 1; Secure Boot trust chain	done, fact-checked
7	The syscall boundary	The user/kernel crossing instruction by instruction; ABI; vDSO; strace; how a new syscall is added (Coconut's 472 to 479 family)	done, fact-checked
8	Processes & threads	task_struct, fork/clone/exec, process lifecycle, credentials intro, zombies and reaping	done, fact-checked
9	Scheduling	Timer tick to context switch; CFS → EEVDF; RT classes; cgroup weighting; where SCHED_AGENT slots in	done, fact-checked
10	Kernel concurrency	Spinlocks, mutexes, RCU, atomics, memory ordering, lockdep: the reasons kernel code is hard	planned

Part III: Memory§

Ch	Title	One-liner	Status
11	Virtual memory	mm_struct, VMAs, mmap, page faults, demand paging, COW	planned
12	Physical memory	Buddy allocator, slab/slub, vmalloc, reclaim, OOM killer	planned
13	Page cache & tiers	The unified page cache; readahead; writeback; NUMA + tiered memory (Coconut mm tier-aware hooks)	planned

Part IV: Persistence§

Ch	Title	One-liner	Status
14	VFS	Everything is a file: dentries, inodes, mounts, the syscall-to-driver path	planned
15	Real filesystems	ext4 journaling vs btrfs COW; overlayfs; what agentfs needs	planned
16	Block & io_uring	bio layer, schedulers, io_uring's shared-ring model	planned

Part V: Identity & capability (the Coconut heart)§

Ch	Title	One-liner	Status
17	Credentials & DAC	uids, struct cred, POSIX capabilities, setuid, and why "root" is a design failure we inherited	planned
18	Namespaces & cgroups	Containers deconstructed into their eight namespaces + resource controllers	planned
19	LSM & seccomp	The hook architecture under SELinux/AppArmor; seccomp filters; where security/coconut/ attaches	planned
20	Capability-based security	Object capabilities, seL4, Capsicum, Genode: the theory Coconut's cap tokens implement. v1 shim vs v2 replacement	planned
21	Audit	Kernel audit today; append-only logs, hash chains, tamper evidence; kernel/audit/coconut design	planned

Part VI: Communication§

Ch	Title	One-liner	Status
22	IPC	Pipes, unix sockets, shared memory, futex, signals, D-Bus, binder: the menu, and when each one wins	planned
23	Networking	sk_buff to socket API; netfilter; netlink (how userspace configures the kernel)	planned

Part VII: The userspace contract§

Ch	Title	One-liner	Status
24	ELF, linking, loading	From compiler output to running process. Your compiler coursework meets execve	planned
25	libc & the runtime	glibc/musl, syscall wrappers, TLS, the vDSO fast path, why static vs dynamic matters	planned
26	init & service management	PID 1 duties; systemd vs s6 vs dinit; the coconutd design (RC-3: s6-derived greenfield in Rust)	planned
27	Packaging & atomic updates	rpm, ostree, rpm-ostree; A/B updates + rollback; reproducible builds; coconutpkg	planned

Part VIII: The interaction surface§

Ch	Title	One-liner	Status
28	Pixels to glass	DRM/KMS, GEM buffers, where each GPU driver actually stands, NVIDIA blob + DKMS reality	planned
29	Wayland & compositors	The protocol, Smithay's architecture, XWayland compat, agent-aware window management	planned

Part IX: Building, testing, shipping§

Ch	Title	One-liner	Status
30	kbuild & cross-compilation	kconfig, defconfigs, cross toolchains, building on a macOS host via Docker	planned
31	Kernel testing	KUnit, kselftest, LTP; QEMU boot gates; designing CI that cannot silently pass (the 14-day silent-gap lesson)	planned
32	Debugging & observability	printk, ftrace, perf, eBPF tracing, kgdb, crash/kdump; KASAN/KCSAN/lockdep as truth machines	planned
33	Maintaining a fork	Patch hygiene, review flow, LKML etiquette, the every-2-years upstream merge event	planned

Part X: The frontier§

Ch	Title	One-liner	Status
34	Rust in the kernel	Rust-for-Linux status, unsafe boundaries, pin-init, why Coconut writes new subsystems in Rust where it can	planned
35	eBPF	The in-kernel VM: verifier, maps, program types. The other "safe kernel extension" story	planned
36	Virtualization	KVM internals, virtio, how QEMU actually runs your lab kernels	planned
37	Agents as kernel primitives	The Coconut thesis end-to-end: agent_* syscalls, SCHED_AGENT, cap enforcement, audit-everything. What "think like an OS" means for the agentic era	planned

Appendices§

App	Title	Status
A	x86_64 ↔ ARM64 cheat sheet	planned
B	Kernel source-tree map (where everything lives)	planned
C	Lab solutions	planned
D	Glossary	planned
E	Annotated reading list (books, papers, LWN, lectures)	planned

§4 Track A: the curated course (your track)§

What you already have and what it buys you:

Your coursework	Direct payoff	Where
Microprocessor/microcontroller	You know registers, interrupts, memory-mapped I/O on small cores. Part I is a bridge, not an intro: the delta is protection (rings/ELs), virtual memory hardware, and multi-core coherence, none of which an 8051/AVR/Cortex-M ever showed you	Ch 1 to 5, fast
Compiler design	You know codegen, linking concepts, calling conventions. This makes Ch 7 (ABI), Ch 24 (ELF/loading), Ch 30 (toolchains) fast lanes	Ch 7, 24, 30
MS CS coursework	OS-course theory (you likely saw scheduling/VM at whiteboard level). The book's job is to replace whiteboard understanding with source-level + lab-verified understanding	everywhere

Recommended order and pacing (assumes roughly 5 to 8 hours a week; a "session" is one sitting with the lab done):

Phase	Chapters	Sessions	Goal
0. Refresh (optional)	F.5, F.6, F.7	2	Assembly reading fluency, intrusive kernel data structures, concurrency vocabulary. Skim the rest of Part F only if rusty
1. Re-ground	0, 1, 2, 3	4	Bridge micro-scale hardware knowledge to server-class x86_64/ARM64 with protection + paging
2. The spine	6, 7, 8, 9	5 to 6	Boot a kernel you built; trace a syscall end-to-end; this is the minimum "I think like an OS" bar
3. Memory truth	10, 11, 12, 13	5	Concurrency and VM: the two hardest ideas. Do not rush 10
4. The Coconut core	17, 18, 19, 20, 21	6	Everything in Part V. This is the subject matter of our kernel work
5. Round out	14, 15, 16, 22, 23, 24, 25, 26, 27	8	Persistence, IPC, userspace contract
6. Ship it	30, 31, 32, 33	4	The dev workflow you will actually live in
7. Frontier	28, 29, 34, 35, 36, 37	6	Graphics, Rust, eBPF, KVM, and the thesis chapter last

Skip rules for Track A: skip nothing in Part V or Part IX; skim "Unfolded" sections where the depth gauge says [fundamental] and you already hold the idea. The labs are the non-skippable part.

§5 Fact discipline§

Every chapter is authored against live web research; the Sources section lists what was actually consulted.
Version-sensitive claims (kernel versions, syscall numbers, scheduler names, project status) are pinned to a date and source.
A second, adversarial fact-check pass re-verifies each chapter's riskiest claims before it is marked done in §3.
Where the truth is contested or moving (Rust-for-Linux pace, Asahi status), the chapter says so instead of pretending certainty.

§6 File layout§

book/
├── 00-INDEX.md                    this file
├── 01-SYLLABUS.md                 section-level outline of every chapter, written and planned
├── part-0/ch00-think-like-an-os.md
├── part-f/chF0-unix-survival.md … chF7-concurrency-mental-model.md
├── part-1/ch01-cpu-contract.md
├── part-1/ch02-interrupts-exceptions.md
├── part-1/ch03-memory-hardware.md
├── part-2/ch06-boot.md
├── part-2/ch07-syscall-boundary.md
├── part-2/ch08-processes-threads.md
├── part-2/ch09-scheduling.md
└── ...                            batches land here as authored

The directory doubles as a docsify site. Serve it with any static file server and read it with the sidebar and search instead of scrolling raw Markdown:

bash

python3 -m http.server 8000 --directory book/
# then open http://localhost:8000/

Verified on this tree at authoring time; the docsify assets load from a CDN, so that view wants a network connection. Reading the .md files directly needs nothing.