No ambient authority
Every kernel-object access presents a capability, type and rights.
From boot to desktop.
A complete AArch64 object-capability microkernel system. EL1 keeps only scheduling, IPC and exceptions; everything else runs in isolated userspace services.
Three principles.
Userspace is the system
Files, networking, devices and graphics stay isolated and cooperate over IPC.
Reproducible end to end
Every layer from bootloader to desktop can be isolated and verified.
Six-stage boot.
- 01 / EL3
Bootloader
Initialize the platform and load images.
- 02 / EL2
Hypervisor
Establish stage-2 and virtual interrupts.
- 03 / EL1
Microkernel
Take over capabilities, IPC and scheduling.
- 04 / EL0
SystemDaemon
Create processes, memory and namespaces.
- 05 / EL0
Framework
Start independent userspace services.
- 06 / APP
Applications
Enter the complete graphical desktop.
The kernel boundary.
Object-capability
A 64-bit cref selects a CNode slot; object type and rights mask grant access.
Migrating-thread IPC
The caller's context migrates into the callee's address space—no queue wake-up.
Split schedule/execute contexts
Scheduling metadata and register state are separate; each CPU schedules locally.
Generated service bindings
.idl files generate clients, services, transport structures and ABI checks.
The complete system.
Graphics & applications
LVGL · FreeType · PortableGL · 14+ applications
System services
process · memory · file · network · device · window
Kernel core
exceptions · MMU · SMP · IPC · IRQ · timer · futex
Virtualization
Type-1 · stage-2 · vGIC · vTimer · hypcall
Boot
platform init · image loading · exception-level handoff
One command starts the system.
The script builds, assembles the images and launches QEMU.
Build guide →quick start
# requires toolchains/aarch64-elf (see Build page)
$ git clone https://github.com/nerossoft/TranquilOS kernel
$ cd kernel
$ source env_setup.sh && ./run_qemu_virt.sh
✓ boot.img · system.img assembled
✓ qemu: 4 cores · 2G · virtio blk/net/input/snd · ramfb