EL3 boots the system, EL2 runs the hypervisor, EL1 the microkernel, and EL0 the system services and applications. Layers interact only through capabilities, IPC and shared memory.
Boot moves upward through EL3 → EL2 → EL1 → EL0; runtime communication uses capabilities, IPC and SHM.
Each process stores accessible kernel objects in a CNode. A 64-bit cref combines a cnode ID and slot; the kernel checks object type and rights before dispatch.
| Syscall path | Flag | Purpose |
|---|---|---|
| Capability call | CAP_CALL_MASK | Routed to capability objects (VSpace, CNode, Endpoint, Timer…) |
| Fast call | FAST_CALL_MASK | High-performance kernel-inline calls (currently a stub) |
| Compact syscall | — | Linux-compatible table; unknown calls are forwarded to userspace libsyscall via upcall |
Upcall is the reverse path: the kernel hands syscalls it cannot handle, page faults and similar events to a handler registered by the process — policy stays in userspace.
Synchronous IPC migrates the caller's context into the callee's address space—no server-thread scheduling wait.
Thanks to the scontext/xcontext split, the kernel constructs the target process's execute_context_s on IPC: arguments go into x0–x7 per the AAPCS, the entry address into pc, and a trampoline address into lr — when the handler returns, the trampoline issues a REPLY call that switches back to the caller. Scheduling metadata stays under the scheduler's control the whole time, so even heavy IPC never starves other threads.
An endpoint is single-threaded — one handler thread per endpoint. An endpoint pool load-balances across pre-allocated endpoints for multi-threaded services (elastic IPC), while the client API stays identical in both modes. A kernel name service lives at cref 0x1: services register with sys_register_service(), clients look them up with sys_get_service().
The client allocates shared memory from SystemDaemon.
Map the SHM and write the request data.
Issue the IPC call, passing the SHM handle as an argument.
The service maps the same SHM region.
Operate directly on the shared data — zero copy.
Reply; the client frees the SHM.
SHM is the only data channel between processes — TranquilOS has no message-copying IPC. All bulk data moves through shared memory; IPC argument slots carry handles and scalars only.
The TCB is split into scheduling and execution entities. Each CPU schedules locally and touches register state only on real switches; CFS plugs in as a kernel module.
schedule_context_s // scheduling metadata
· priority / timeslice
· runqueue node / CPU affinity
· driven by the scheduler and its policy
execute_context_s // execution state
· x0–x30 · sp · pc · pstate
· built/restored only on real context switches
· constructed independently on IPC migrationThe kernel keeps only a boot allocator. Memory policy lives in SystemDaemon across four components: procmgr, memmgr, ipcmgr and virtmgr.
| Component | Responsibility |
|---|---|
| procmgr | Spawn ELF, process/thread teardown, PID lookup |
| memmgr | Buddy physical pages, virtual address spaces, SHM |
| ipcmgr | Endpoint/pool creation, name service, capability cloning |
| virtmgr | VM creation and lifecycle |
The linker places initialization functions into dedicated sections for levels LV0–LV7, and the kernel runs them in order; the bootloader decides whether to start the hypervisor first or enter the kernel directly, based on CurrentEL.
| LV | Macro | Purpose |
|---|---|---|
| 0 | early_device_init | Earliest device init |
| 1 | early_device_percpu_init | Per-CPU early devices |
| 2 | key_device_init | Key devices (GIC, timer…) |
| 3 | key_device_percpu_init | Per-CPU key devices |
| 4 | normal_device_init | Normal devices |
| 5 | normal_device_percpu_init | Per-CPU normal devices |
| 6 | module_init | Kernel modules (e.g. CFS) |
| 7 | module_percpu_init | Per-CPU module init |
boot.img (64MB)
offset 0 Bootloader 8MB
offset 2048 DTB 8MB
offset 4096 Hypervisor 16MB
offset 8192 Kernel 16MB
offset 12288 SystemDaemon 8MB
offset 14336 Ramdisk cpio 8MB
system.img (128MB, ext2)
bin/ framework services
apps/ user applications
etc/ fonts · icons · init configFirst userspace process. Finds the ramdisk via the device tree, starts devmgr and fsmgr, then runs /root/etc/init.rc.
Reads init.json, loads service ELFs from ext2 into SHM and starts framework services via start_process_from_shm().
Manages the app registry from applist.json and launches app processes on demand.
main.c registers, service.c dispatches, and client/ wraps IPC; generation also validates the ABI.
// service.c — the same dispatch pattern in every service
static handler_fn handlers[] = {
[IPC_SERVICE_FUNCTION_CREATE] = handler_create,
[IPC_SERVICE_FUNCTION_DESTROY] = handler_destroy,
// ...
};
IPC_ENDPOINT void service_entry(
uint64_t cref, uint64_t method,
uint64_t a1, uint64_t a2, uint64_t a3) {
if (method < HANDLERS_COUNT && handlers[method])
OSIpcEndPointPoolReply(handlers[method](a1, a2, a3));
else
OSIpcEndPointPoolReply(0);
}// statemgr_ipc.idl
service statemgr_ipc {
id = 0x9;
struct query { version = 1; char key[64]; };
struct result { version = 1; uint32_t found; };
uint64_t get(in query *request,
out result *response) id = 0x1;
};Struct pointers use server-owned fixed receive buffers. The first call establishes SHM authorization per caller, method and parameter slot; later calls reuse the connection-level CRef and mapped address. A per-method lock covers copying, IPC and copy-back. Transport structs must declare a version; the generator adds abi_size / abi_version fields validated by the server. Variable-length data passes an explicit SHM handle and length.