ctos (ctsOS)

ctos is a small operating-system kernel you can study. It is written in Rust for 64-bit ARM (AArch64). You run it in the QEMU emulator, not as a desktop or phone OS. The nickname ctsOS is only for display; the repo and crate stay ctos.

This book is the website. The same markdown lives under docs/ in the GitHub repo. There is no second marketing copy.

It is not a product site. Do not say “secure OS,” “production ready,” or “EL0 isolated.” Status words need a probe.

What it is

ctos boots under QEMU’s virt machine and prints on a serial port (the PL011 UART). After that it grows one honest mile at a time: exceptions, paging, a heap, a tiny scheduler, then measured security and performance cuts.

Core principles drive. Roadmap tracks (A = loader and syscall ABI, B = later slots and a filesystem) are subordinate. A track does not outrank a principle.

Primary path: QEMU virt + UART (ADR-003). Frozen requirement IDs: FR-01–FR-15 and NFR-01–NFR-14.

Driving principles

Everyday meaning first; frozen IDs second. Same list as the pillars hub. This landing is the visitor-facing source. docs/framework/ stays for deep links — do not keep a second marketing copy.

flowchart TD
  P["Core principles<br/>honesty · antifragility · security<br/>performance · document-first"]
  L["Three pillars<br/>antifragility · security · performance"]
  T["Tracks A / B<br/>loader, ABI, later slots / FS<br/>subordinate — not the driver"]
  P --> L --> T

Principles sit above pillars. Tracks sit below both. Not a claim that Track A or B is built.

What runs today

Three samples that already have probes. Details: What can run today.

1. Two kernel tasks that take turns — they print on the serial port and yield. Not preemptive. Not two CPUs.
2. A serial echo gadget — one byte in, a line out. No terminal, no line editor.
3. A short lower-privilege stub — a few instructions in the CPU’s user mode, then a call back into the kernel. Not a process. No libc, no files, no apps.

Cannot run: Linux programs, a shell, Python, network servers, filesystem apps, extra CPUs, or containers.

flowchart LR
  subgraph today ["Verified today"]
    W["Two UART workers"]
    E["Serial echo gadget"]
    S["Short user-mode stub"]
  end
  subgraph no ["Cannot run"]
    L["Linux binaries / shell / Python"]
    N["Network / files / extra CPUs"]
    C["Containers"]
  end
  today -.-> no

Left side matches existing smoke markers. Right side is out of scope. Do not say “apps run.”

How to build

You need nightly Rust and QEMU. Pages is not required for kernel work. Full list: Prerequisites.

rustup toolchain install nightly
rustup component add rust-src llvm-tools-preview
cargo build                 # ELF at target/aarch64-ctos/debug/ctos
./scripts/qemu-smoke.sh     # fail-closed serial + tests

flowchart LR
  R["rustup nightly"] --> B["cargo build"] --> Q["qemu-smoke"]

That rebuilds the kernel, including any in-tree code you add. It is not “port an app.”

Read next

Kernel build notes also live in the GitHub README.

URLs

Publish mechanics: Docs website + DNS.