Architecture
VirelaiOS is a layered, freestanding kernel with no libc and no heap in the boot-critical paths — bounded fixed-BSS storage is the norm. This page is the map; the satellites below carry the detail.
The stack, top to bottom
┌───────────────────────────────────────────────┐
│ EL0 user programs + desktop apps (GOCALC.ELF, │
│ GOTABWM.ELF, GO* Go apps, …) │
│ runtime linker LD.SO + LIBUI.SO/LIBFONT.SO │
│ syscalls: 80 implemented slots (of 128): │
│ IPC/window/events/files/net/time/memory … │
├───────────────────────────────────────────────┤
│ Monitor + shell (virelai>) │
│ Road Pops terminal · Driving Award compositor │
├───────────────────────────────────────────────┤
│ SMP scheduler (round-robin, 2 cores) │
│ EFI-map allocator · MMU (per-process roots, │
│ demand-zero paging + copy-on-write; no swap) │
├───────────────────────────────────────────────┤
│ Drivers: virtio console/entropy/gpu/net/snd/ │
│ custom + USB XHCI (HID + MSC) · GICv3 · timer │
├───────────────────────────────────────────────┤
│ UEFI boot loader (BOOTAA64.EFI) │
└───────────────────────────────────────────────┘
What owns what
- Kernel overview — boot,
ExitBootServices, exception vectors, the monitor and command registry. - Memory model — the physical allocator, identity-map page tables, per-task address spaces.
- Userspace & syscalls — EL0, the frozen syscall ABI, fault-safe uaccess, exec and processes.
- Device drivers — the virtio surface, the XHCI USB controller, and the MMIO contracts.
Design discipline
Three rules show up everywhere:
- Bounded static storage. Rings, FIFOs, window tables, and frame buffers use fixed-capacity storage. There is no general heap in the device paths; full queues refuse work or apply their documented overflow policy rather than growing.
- Per-device contracts. Queue capacity, request concurrency, and
completion handling vary by device. Hardware behavior is observed rather
than generalized, then recorded in
docs/hardware-contract.md. - Evidence over assertion. Every subsystem has host tests (deterministic) and, where hardware is involved, a live Virtualization.framework gate. See Evidence & testing.
Subsystem boundaries in one line each
| Subsystem | What it does |
|---|---|
| Boot loader | loads KERNEL.BIN, writes BOOTED.TXT/RC.TXT evidence, jumps to the kernel |
| MMU | identity-map TTBR0_EL1 tables (T0SZ=16), per-process user roots, EL1-only kernel overlay, demand-zero mmap pages and copy-on-write (M29) — no swap |
| Allocator | first-fit bitmap over the captured EFI map, with exclusion ranges |
| Scheduler | fixed 16-task pool, tick-driven scheduling, SMP support and per-core ready rings |
| Processes | bounded registry, lifecycle states, exit-status propagation, IPC mailboxes |
| SMP | PSCI CPU_ON core bringup, per-core schedulers, spinlocks, GICv3 SGI IPIs (M28) |
| Syscalls | ADR 0007: 128-slot table, 88 registered slots (0–87), deterministic counters |
| Networking | virtio-net → ARP → IPv4/ICMP → UDP → DHCP → DNS → TCP (client + GOHTTPD.ELF passive-open server), plus a NAT mode and the EL0 TCP seam |
| Graphics | virtio-gpu framebuffer → text → Road Pops → Driving Award compositor |
| Audio | virtio-snd → PCM playback → beep → the EL0 audio seam (slots 42–45) |
| Input | XHCI host controller → USB enumeration → HID boot protocol → event FIFO → per-process event queues |
| Events | keyboard/pointer/window events routed to focused EL0 apps (sys_poll_event/sys_wait_event), plus TIMER events from the app-timer facility |
| Shared services | the machine-global clipboard (slots 38/39) + per-process app timers (slots 40/41) |
| Dynamic linking | freestanding LD.SO runtime linker, LIBUI.SO/LIBFONT.SO, W^X multi-aperture userland (M30/M31) |
| Desktop | the zero-heap ui.zig widget toolkit + the Go seat (GOTABWM.ELF) and hosted clients (GOCALC.ELF, NOTE.ELF, GOTOP.ELF, GOFILES.ELF) |