Think Like an OS#

Authors: Shrey Patel and Jay Patel, Coconut Labs
What this is: A hands-on book on how operating systems work, from the hardware contract through kernel internals to shipping a distro, through the lens of what Coconut OS is actually building. It keeps the concepts and their prerequisites in the same place as the labs that exercise them.
Fact discipline: Every factual claim is web-verified at authoring time, with sources cited inline.

Who this book is for#

Every abstraction you use daily is a fiction the kernel maintains for you: a file, a socket, a thread, a stretch of memory that looks like it belongs to you alone. The fictions are good ones. They are not free. This book takes them apart in runnable pieces and puts them back together.

Two destinations bring people here, and the book is built for both.

You are heading toward kernel or systems work. You want to open mm/memory.c and read it instead of bouncing off it, send a patch a maintainer accepts, and know a subsystem well enough to change it. Your spine is Ch 6 to 9 (boot, syscalls, processes, scheduling), then Part III for memory, then Part V, where Coconut OS's own kernel work lives. Part IX is the workflow you will be in every day.

You are heading toward low-latency work: trading systems, market data, anything judged on its worst response rather than its average. Your question is not what the machine does. It is when. Every stall you will chase is one of the mechanisms in here, and each one has a chapter that takes it apart:

• A cache miss walks a hierarchy with measurable costs, and a TLB miss triggers a page walk before the load can even start (Ch 3).
• Two cores writing to the same cache line serialize without sharing a single variable. That is false sharing (Ch 3).
• A page fault is a trap into the kernel, and demand paging means the first touch of a fresh mapping is the one that pays (Ch 11).
• A syscall is a privilege transition, which is why clock_gettime was moved into the vDSO so the common calls skip the crossing entirely (Ch 7).
• A SCHED_FIFO spinner takes a CPU and does not hand it back on its own. What 6.12's fair server still guarantees to everything else is the interesting half (Ch 9).
• An interrupt arrives when the device says so, not when your code is ready, and it preempts whatever was running (Ch 2).

None of those six are exotic. They are ordinary machinery that most working engineers were never shown, which is why timing reads as luck until you have read them. This is not a trading book: no strategy, no microstructure, nothing about markets. It is the layer underneath, taught until you can name the mechanism behind a number instead of guessing at it. Some of the chapters named above are written and some are still outlines; the chapter list below marks which.

Where to start: Chapter 0, and do its lab rather than reading it. It ends with a Linux 6.12 kernel you compiled yourself, booting your own PID 1 in QEMU on your own machine. If you have never built a kernel, build that one before you read further. Every chapter after it lands differently.

Those two destinations are about where you are going. The three tracks below are about what you are bringing. Every chapter unfolds complex machinery into longer-but-simpler prose, and no prior kernel or CPU knowledge is assumed by the text itself. The tracks differ only in pace and which bridge sections you skip.

How every chapter works#

Fixed template, so you always know where you are:

1. The problem. What breaks without this mechanism. Every OS structure is a solution; we start from the pain.
2. Unfolded. The core idea in longer-but-simpler prose. No jargon before it is defined. This is the section that makes the book readable by someone who has never seen a page table.
3. The real thing in Linux. Actual file paths, structs, and code paths in the 6.12 tree Coconut OS forks.
4. Coconut tie-in. What Coconut OS changes, replaces, or adds here, cross-referenced to the high-level and low-level design documents.
5. Lab. Runnable, QEMU-based where possible, on a macOS or Linux host. Red-then-green: you predict, you run, you compare.
6. Bridge notes. The "if you know compilers/microcontrollers, here is the mapping" callouts for Track A.
7. Sources. The URLs actually consulted and verified at authoring time.

The full structure#

The book runs in twelve parts.

• Part 0: Orientation & the lab bench.
• Part F: Core fundamentals. The prerequisite layer, where bits become programs become memory, then C, assembly, data structures and concurrency.
• Part I: The machine beneath. The hardware contract.
• Part II: The kernel's core loop. Boot, syscalls, processes, scheduling.
• Part III: Memory. Virtual, physical, page cache.
• Part IV: Persistence. VFS, filesystems, block, io_uring.
• Part V: Identity & capability. Creds, namespaces, LSM, caps, audit. This is the Coconut heart.
• Part VI: Communication. IPC, networking.
• Part VII: The userspace contract. ELF, libc, init, packaging.
• Part VIII: The interaction surface. DRM/KMS, Wayland, compositors.
• Part IX: Building, testing, shipping. kbuild, KUnit, QEMU gates, fork maintenance.
• Part X: The frontier. Rust-for-Linux, eBPF, KVM, agents-as-primitives.

Chapters you can read now#

Each title links straight to the chapter.

Part 0: Orientation & the lab bench#

• Ch 0: Think Like an OS. What an OS actually is (multiplexer, abstraction machine, protection referee); the Coconut OS north star; lab bench setup: QEMU, Docker cross-build, kernel tree navigation.

Part F: Core fundamentals (the prerequisite layer)#

Everything the rest of the book assumes, in one place. Track B reads all of it after Chapter 0. Track A treats it as an optional refresher, with F.5 to F.7 recommended: intrusive kernel data structures and concurrency vocabulary are new even to most MS grads.

• F.0: The Unix survival kit. Shell fluency, filesystem hierarchy, permissions, processes from the user side, ssh, building software from source. The lab prerequisite.
• F.1: How a computer computes. Bits, binary/hex, two's complement, gates to ALU, clocks, the von Neumann fetch-decode-execute loop.
• F.2: Anatomy of a program. Source becomes compiler output, then assembler output, then a linked executable; registers, PC/SP, stack frames, calling conventions at machine level.
• F.3: Memory from first principles. The address space as a byte array; endianness; stack vs heap; pointers as addresses; layout and alignment.
• F.4: The C you need. The kernel-dialect working subset: pointers, structs, bit operations, function pointers, macros, goto error handling, container_of, undefined behavior.
• F.5: Reading assembly without fear. x86_64 + ARM64 reading fluency: prologues, calls, loops, syscall sites. Compiler Explorer as the lab.
• F.6: Data structures kernels love. Intrusive linked lists, hash tables, red-black trees, xarray, bitmaps, ring buffers, per-CPU data, and why kernels prefer intrusive forms.
• F.7: Concurrency, the mental model. Threads, data races, atomicity, critical sections, locks. The userspace mental model Part II's kernel concurrency builds on.

Part I: The machine beneath#

• Ch 1: The CPU's contract. Privilege: x86_64 rings + long mode, ARM64 exception levels; the instructions only kernels may run; what "kernel mode" physically means.
• Ch 2: Interrupts & exceptions. The event-driven heart: vectors, IDT/GIC, faults vs traps vs aborts, nested interrupts, softirqs preview.
• Ch 3: Memory hardware. MMU, 4/5-level page tables, TLB, caches and coherence. Why virtual memory exists and what it costs.

Part II: The kernel's core loop#

• Ch 6: Boot. Power-on through UEFI, shim and bootloader, kernel decompression, init, and finally PID 1; Secure Boot trust chain.
• Ch 7: The syscall boundary. The user/kernel crossing instruction by instruction; ABI; vDSO; strace; how a new syscall is added (Coconut's 472 to 479 family).
• Ch 8: Processes & threads. task_struct, fork/clone/exec, process lifecycle, credentials intro, zombies and reaping.
• Ch 9: Scheduling. Timer tick to context switch; CFS to EEVDF; RT classes; cgroup weighting; where SCHED_AGENT slots in.

Chapters still in outline#

These are outlined section by section in the full syllabus. None of them is written yet. Part I and Part II pick up here where they stopped above.

Part I: The machine beneath, continued#

• Ch 4: Time. Timers, clocksources, TSC/arch timers, APIC/GIC timers, tick vs tickless.
• Ch 5: I/O at the wire. PCIe, MMIO vs port I/O, DMA, IOMMU, device discovery.

Part II: The kernel's core loop, continued#

• Ch 10: Kernel concurrency. Spinlocks, mutexes, RCU, atomics, memory ordering, lockdep: the reasons kernel code is hard.

Part III: Memory#

• Ch 11: Virtual memory. mm_struct, VMAs, mmap, page faults, demand paging, COW.
• Ch 12: Physical memory. Buddy allocator, slab/slub, vmalloc, reclaim, OOM killer.
• Ch 13: Page cache & tiers. The unified page cache; readahead; writeback; NUMA + tiered memory (Coconut mm tier-aware hooks).

Part IV: Persistence#

• Ch 14: VFS. Everything is a file: dentries, inodes, mounts, the syscall-to-driver path.
• Ch 15: Real filesystems. ext4 journaling vs btrfs COW; overlayfs; what agentfs needs.
• Ch 16: Block & io_uring. bio layer, schedulers, io_uring's shared-ring model.

Part V: Identity & capability (the Coconut heart)#

• Ch 17: Credentials & DAC. uids, struct cred, POSIX capabilities, setuid, and why "root" is a design failure we inherited.
• Ch 18: Namespaces & cgroups. Containers deconstructed into their eight namespaces + resource controllers.
• Ch 19: LSM & seccomp. The hook architecture under SELinux/AppArmor; seccomp filters; where security/coconut/ attaches.
• Ch 20: Capability-based security. Object capabilities, seL4, Capsicum, Genode: the theory Coconut's cap tokens implement. v1 shim vs v2 replacement.
• Ch 21: Audit. Kernel audit today; append-only logs, hash chains, tamper evidence; kernel/audit/coconut design.

Part VI: Communication#

• Ch 22: IPC. Pipes, unix sockets, shared memory, futex, signals, D-Bus, binder: the menu, and when each one wins.
• Ch 23: Networking. sk_buff to socket API; netfilter; netlink (how userspace configures the kernel).

Part VII: The userspace contract#

• Ch 24: ELF, linking, loading. From compiler output to running process. Your compiler coursework meets execve.
• Ch 25: libc & the runtime. glibc/musl, syscall wrappers, TLS, the vDSO fast path, why static vs dynamic matters.
• Ch 26: init & service management. PID 1 duties; systemd vs s6 vs dinit; the coconutd design, an s6-derived greenfield in Rust.
• Ch 27: Packaging & atomic updates. rpm, ostree, rpm-ostree; A/B updates + rollback; reproducible builds; coconutpkg.

Part VIII: The interaction surface#

• Ch 28: Pixels to glass. DRM/KMS, GEM buffers, where each GPU driver actually stands, NVIDIA blob + DKMS reality.
• Ch 29: Wayland & compositors. The protocol, Smithay's architecture, XWayland compat, agent-aware window management.

Part IX: Building, testing, shipping#

• Ch 30: kbuild & cross-compilation. kconfig, defconfigs, cross toolchains, building on a macOS host via Docker.
• Ch 31: Kernel testing. KUnit, kselftest, LTP; QEMU boot gates; designing CI that cannot silently pass (the 14-day silent-gap lesson).
• Ch 32: Debugging & observability. printk, ftrace, perf, eBPF tracing, kgdb, crash/kdump; KASAN/KCSAN/lockdep as truth machines.
• Ch 33: Maintaining a fork. Patch hygiene, review flow, LKML etiquette, the every-2-years upstream merge event.

Part X: The frontier#

• Ch 34: Rust in the kernel. Rust-for-Linux status, unsafe boundaries, pin-init, why Coconut writes new subsystems in Rust where it can.
• Ch 35: eBPF. The in-kernel VM: verifier, maps, program types. The other "safe kernel extension" story.
• Ch 36: Virtualization. KVM internals, virtio, how QEMU actually runs your lab kernels.
• Ch 37: Agents as kernel primitives. The Coconut thesis end-to-end: agent_* syscalls, SCHED_AGENT, cap enforcement, audit-everything. What "think like an OS" means for the agentic era.

Appendices#

• x86_64 and ARM64 cheat sheet
• Kernel source-tree map (where everything lives)
• Lab solutions
• Glossary
• Annotated reading list (books, papers, LWN, lectures)

Track A: the curated course#

Take this track if you can already read a stack frame in assembly and have written code against a microcontroller's registers and interrupts. If either of those is a no, Track B is not the slow track, it is the complete one.

What that background buys you:

Recommended order and pacing (assumes roughly 5 to 8 hours a week; a "session" is one sitting with the lab done):

Skip rules for Track A: skip nothing in Part V or Part IX; skim any "Unfolded" section whose idea you already hold. The labs are the non-skippable part.

Fact discipline#

• Every chapter is authored against live web research; the Sources section lists what was actually consulted.
• Version-sensitive claims (kernel versions, syscall numbers, scheduler names, project status) are pinned to a date and source.
• A second, adversarial fact-check pass re-verifies each chapter's riskiest claims before it ships.
• Where the truth is contested or moving (Rust-for-Linux pace, Asahi status), the chapter says so instead of pretending certainty.