Comprehensive Glossary & Frequently Asked Questions
A Complete Reference Guide to the Terms Used Across PangeaOS — Explained Clearly With Context, Examples, and Answers to Common Questions
How to Use This Page
Operating system literature is often filled with three-letter acronyms (SASOS, MPK, SFI, IST, PFN, TLB) that can make even simple ideas feel obscure. This page is organized into six thematic categories explaining over 30 terms in detail, followed by a Frequently Asked Questions (FAQ) section at the bottom.
Part 1: Fundamental Operating System Concepts
1. Kernel (Domain 0)
The core supervisor program of an operating system that stays in memory at all times. The kernel is responsible for scheduling which program runs on the processor, handing out memory pages, setting up hardware protection tables, and handling hardware interrupts. In PangeaOS, the core kernel is called Domain 0, and its private memory is protected by hardware Key K0.
2. Service Domain (Domains 1 through 12)
An isolated compartment inside PangeaOS where a system service, device driver, or task executes. PangeaOS supports up to 12 concurrent service domains (Domain 1 to Domain 12). Each domain is given its own 1-Terabyte slice of the virtual address space and its own hardware memory protection key (K1 to K12), ensuring that a bug or crash inside one domain cannot corrupt other domains or Domain 0.
3. Virtual Address Space
The map of memory addresses that programs see when they read or write data. Rather than letting programs use raw physical RAM addresses directly, the processor translates virtual addresses into physical RAM locations using a lookup table called a Page Table.
4. Single Address Space Operating System (SASOS)
An operating system architecture in which the kernel and all isolated services inhabit one shared virtual address space using a single shared page table, rather than placing each program into a separate virtual address map. This eliminates the need to swap page tables (CR3) and flush address caches when switching between tasks.
5. Context Switch
The process of pausing one running program and switching the processor to run another program. In a traditional operating system, a context switch requires saving registers, switching privilege rings, loading a new page-table root (CR3), and invalidating cached address translations. In PangeaOS, switching between domains keeps the same CR3 address map and only switches the stack pointer and the 32-bit PKRU keycard register.
6. Trusted Computing Base (TCB)
The small set of hardware and software components that must work correctly for the operating system's security guarantees to hold. In PangeaOS, the software TCB consists of the bootloader, Domain 0 core crates, the pre-launch binary verifier (bincheck-core / domain-verify), the assembly gates (gate-asm), and the exception entry stubs (pangea-irq). Sixteen of the 26 crates in PangeaOS are written with #![forbid(unsafe_code)] to keep the low-level TCB as small and auditable as possible.
Part 2: Processor Privilege Levels & Code Verification
7. Ring 0 (CPL=0 / Supervisor Mode) vs. Ring 3 (CPL=3 / User Mode)
Hardware privilege levels built into x86-64 processors. CPL stands for Current Privilege Level. Mainstream operating systems run applications in Ring 3 (where hardware-control instructions are blocked by the CPU) and the kernel in Ring 0. PangeaOS runs both the kernel and all verified service domains in Ring 0 (CPL=0) to avoid ring-transition overhead, relying instead on pre-launch code verification (SFI) and hardware protection keys (MPK) for isolation.
8. Software Fault Isolation (SFI)
A technique for sandboxing machine code before or during execution so that it can safely run inside a shared address space. In PangeaOS, every service domain $d \in {1..12}$ is restricted to a 1-Terabyte virtual address window where (address >> 40) == d. Our verifier checks that memory accesses inside a domain binary stay within that 1-Terabyte window.
9. Positive Instruction Allowlist (bincheck-core)
Because x86-64 instructions have variable lengths (from 1 to 15 bytes), simply searching a binary file for forbidden byte sequences is unsafe—an attacker could jump into the middle of a multi-byte instruction to execute a hidden opcode. Instead, bincheck-core decodes executable sections from start to finish along exact instruction boundaries and only accepts instructions on a positive allowlist (safe arithmetic, moves, comparisons, and verified branches). Privileged opcodes (cli, sti, popfq, iretq, hlt, wrmsr, mov crX, wrpkru) are rejected before boot.
10. Control-Flow Integrity (CFI) & endbr64
Protections that prevent an attacker or bug from redirecting a function call or jump to an unintended location in memory. PangeaOS requires every valid function and gate entry point to begin with the 4-byte x86-64 CET instruction endbr64 (F3 0F 1E FA), and bincheck-core verifies that all branch targets land on valid decoded instruction boundaries.
Part 3: Hardware Memory Protection Keys & Page Tables
11. Memory Protection Keys (MPK / PKU / PKS)
A hardware feature on modern x86-64 processors that attaches a 4-bit key number (0 through 15, called K0 to K15) to every page-table entry (in bits 62:59). This allows the processor to instantly enable or disable read/write access to entire groups of pages by changing a single register (PKRU), without modifying page tables or flushing the TLB.
12. PKRU (Protection Key Rights for User Pages)
A 32-bit register inside each CPU core (enabled when CR4.PKE = 1) that holds the current access permissions for all 16 protection keys (K0–K15). Each key uses 2 bits:
- Access Disable (
AD, bit $2k$): When set to1, neither reading nor writing is allowed on pages tagged with key $k$. - Write Disable (
WD, bit $2k+1$): When set to1, writing is blocked on pages tagged with key $k$. In PangeaOS, the default kernelPKRUmask is0xCBFF_FFFC(K0 = Read/Write,K13 = Read-Only,K14 = Read/Write, and all domain keysK1..K12plusK15=No Access).
13. Profile P-PKU (U/S Bit and SMEP Harmony)
On standard x86-64 CPUs (CR4.PKE=1), the PKRU register only polices pages whose page-table entry has the U/S=1 (User/Supervisor) bit set. At the same time, x86-64 SMEP (CR4.SMEP=1) blocks Ring-0 instruction fetches from pages with U/S=1. Profile P-PKU is PangeaOS's page-mapping rule that harmonizes both features:
- All executable code pages and emergency IST stacks are mapped
U/S=0, W=0(so Ring-0 instruction fetches and exception pushes never fault). - All key-protected data pages, heaps, and domain stacks (
K0–K15) are mappedU/S=1, NX=1(soPKRUpolices every data access in Ring 0, whileNX=1andSMEP=1doubly forbid executing data as code).
14. W^X (Write XOR Execute)
A fundamental memory security rule stating that no memory page may ever be both writable (W=1) and executable (NX=0) at the same time. The encode_pte function in pangea-mmu enforces this rule on every page-table entry.
15. K13 Page-Table Update Gate (gate_pt_update_write_pte)
If page tables are writable during normal execution, a stray kernel pointer could corrupt the address map. If they are permanently read-only, the OS can never allocate or unmap pages. PangeaOS solves this by tagging page-table pages with Key K13 (normally locked as Read-Only in 0xCBFF_FFFC) and unlocking K13 (0xC3FF_FFFC) for a single instruction inside gate_pt_update_write_pte after validating the new PTE.
Part 4: Crash Containment, Descriptors & Exception Recovery
16. Local Faults (L0–L3) vs. Fatal Faults (F1–F3)
PangeaOS's seven-tier fault classification model:
L0Request: Malformed input or expired capability token → Reject request withErr, increment caller strike count.L1Domain: CPU exception (#UD,#PF,#GP) or panic inside Domains 1–12 → Quarantine only the faulting domain and resume scheduler.L2Resource: CPU quantum overrun, memory quota exceeded, or IPC queue full → Preempt domain or return backpressure error.L3Subsystem: Device fault storm or domain restart limit reached → Isolate device (BME=0) or enter Restricted Mode.F1CoreIntegrity/F2HardwareFatal/F3ProtectionUncertain: Loss ofDomain 0integrity, physical hardware MCA failure, or unconfirmed TLB/IOTLB shootdown → Pin frames in quarantine (F3) or execute Global Fail-Stop.
17. GDT (Global Descriptor Table) & IDT (Interrupt Descriptor Table)
Hardware lookup tables loaded into the CPU via the lgdt and lidt instructions. The GDT defines memory segment attributes and points to the Task State Segment (TSS). The 256-entry IDT tells the processor which assembly stub to jump to when any CPU exception (vectors 0..31) or hardware interrupt (vectors 32..255) occurs.
18. TSS (64-Bit Task State Segment) & IST 1..4 (Interrupt Stack Table)
A 104-byte hardware structure (TaskStateSegment64) that holds up to seven emergency stack pointers (IST 1 through IST 7). Because CPL=0 to CPL=0 exceptions do not switch stacks automatically unless an IST index is set in the IDT, PangeaOS configures:
IST 1: General exceptions (#DE,#UD,#GP,#PF,#CP) and timer IRQs (0x20).IST 2: Double Faults (#DF, vector 8).IST 3: Non-Maskable Interrupts (NMI, vector 2).IST 4: Hardware Machine Check Exceptions (#MC, vector 18).
19. Two-Stack Pivot (IST 1 → k0_priv_rsp)
If an exception handler stayed on IST 1 while running complex code, a second nested exception would start at the top of IST 1 and overwrite the first exception's saved registers. Therefore, PangeaOS uses IST 1 only as a tiny bootstrap landing pad: the assembly stub saves registers on IST 1, unlocks K0 (0xCBFF_FFFC), verifies the "PANGEAK0" canary, and immediately copies the 184-byte TrustedExceptionFrame onto the kernel's larger private stack (k0_priv_rsp) before calling Rust code.
20. TrustedPerCpuState (GS_BASE) & SchedulerContinuation
Each CPU core has a pinned 4 KB TrustedPerCpuState structure in K0 memory whose address is stored in the hardware IA32_GS_BASE MSR (0xC000_0101). When the scheduler enters a service domain via invoke_domain_live, it saves its own stack pointer, callee-saved registers, and return instruction pointer into TrustedPerCpuState.sched_cont (SchedulerContinuation at GS:[0x28..0x60]). If the domain crashes, gate_restore_continuation reloads those saved registers and jumps back to the scheduler without touching the crashed domain's stack.
Part 5: Memory Lifecycle, Allocators, IPC & Devices
21. Physical Frame Number Database (pangea-pfndb)
A state table that tracks every physical 4 KB RAM frame through five strict states: Free → Allocated (or DmaPinned) → Quarantine → Erased → Free. It guarantees that no physical frame is ever freed or reassigned while any CPU TLB or device IOTLB still holds a cached translation to it.
22. TLB / IOTLB Shootdown & Policy F3
When a page is unmapped or its protection key is changed, other CPU cores (TLB) and hardware devices (IOTLB) might still hold the old permission in their internal caches. A shootdown sends an Inter-Processor Interrupt (IPI) or IOMMU command requiring every core/device to flush its cache and send back an acknowledgement (ACK). Under Policy F3, if any core or device fails to acknowledge the flush within the timeout window, PangeaOS keeps that physical frame permanently pinned in PfnState::Quarantine so it can never be reused.
23. CMEE (Cryptographic / Software Memory Erasure Engine)
Before a quarantined physical frame (PfnState::Quarantine) can return to PfnState::Free, the cmee crate overwrites all 512 64-bit words (4,096 bytes) with 0 using compiler-fence-protected volatile writes and issues a linear proof token (ErasedFrameProof) required by the page allocator (alloc-buddy).
24. Guarded Buddy Allocator (alloc-buddy) & Out-of-Band Slab (alloc-slab)
PangeaOS's two hardened memory allocators:
alloc-buddy: Selects free physical frames using ChaCha20 random numbers and brackets every 4 KB virtual data page with an unmapped 4 KB front guard page and an unmapped 4 KB back guard page, catching sequential buffer overflows and underflows immediately.alloc-slab: Stores freelist metadata completely outside the data slots (out-of-band), XOR-masks freelist pointers with a secret ChaCha20 key and the slot's virtual address, delays slot reuse through a quarantine ring, and fills free slots with0xDFpoison bytes (checked on allocation to catch Use-After-Free writes).
25. Double-Fetch (TOCTOU) Prevention & Dual-Class IPC (ring-ipc)
A Double-Fetch bug occurs when kernel code reads an untrusted counter from shared memory twice—once to validate it and a second time to use it—allowing an attacker to change the value in between. pangea-ring prevents this by snapshotting head and tail into local registers once (checked_pending). ring-ipc provides Class S (Brokered Copy) for small messages and Class B (Re-Keyed Zero-Copy) for large buffers (moving the frame through PfnState::Quarantine during ownership transfer).
26. IOMMU (Intel VT-d / AMD-Vi) & Default-Deny BME (hal-iommu)
Hardware on the motherboard that restricts which physical RAM pages a PCIe device (like a network card or NVMe drive) can access via Direct Memory Access (DMA). PangeaOS initializes all PCIe devices with Bus Master Enable turned off (BME = false) and refuses to enable BME = true until the device's IOVA mappings are pinned in pangea-pfndb and the IOTLB flush has completed.
Part 6: Frequently Asked Questions (FAQ)
Q1: Is PangeaOS a Linux distribution, or a brand-new kernel?
A: PangeaOS is a brand-new operating system kernel written from scratch in #![no_std] Rust. It does not use the Linux kernel or C standard libraries.
Q2: Why run services in Ring 0 instead of Ring 3?
A: In traditional operating systems, crossing between Ring 3 and Ring 0 and swapping page tables (CR3) adds overhead to every system call and inter-process message. By running verified services in Ring 0 inside a single address space (SASOS), PangeaOS eliminates page-table swaps and ring transitions, using pre-launch code verification (SFI) and hardware Memory Protection Keys (MPK) to enforce compartment boundaries instead.
Q3: If a program runs in Ring 0, couldn't it just execute wrpkru to unlock the kernel's memory?
A: No, because PangeaOS never executes unverified binaries. Before any service domain is allowed to run, bincheck-core and domain-verify decode its machine code along exact instruction boundaries against a strict positive allowlist. If the binary contains wrpkru, xrstor (with bit 9 set), cli, mov cr3, or any unverified indirect jump, the binary is rejected before execution.
Q4: What happens if a service has a bug and crashes (for example, divides by zero or dereferences a bad pointer)?
A: The computer does not panic or reboot. As proven live in boot self-test #14 ([H2-H4]), the CPU traps onto emergency stack IST 1, resets PKRU to 0xCBFF_FFFC, pivots onto k0_priv_rsp, records the fault against that specific domain, quarantines the domain, revokes its capability tokens, and jumps back to the scheduler bookmark (SchedulerContinuation) so all other services keep running.
Q5: What happens if a service gets stuck in an infinite loop (loop {})?
A: PangeaOS uses preemptive scheduling driven by the hardware Local APIC timer (1 ms quantum) plus a Non-Maskable Interrupt (NMI) watchdog. When a looping domain exceeds its 1 ms budget, the timer interrupt preempts it so other ready domains continue running. On repeated budget overruns, the domain is automatically quarantined.
Q6: What is "Restricted Mode"?
A: When a non-core service domain crashes repeatedly and exhausts its restart limit (or when a hardware device suffers an unrecoverable fault storm), PangeaOS marks that specific service or device as PermanentlyDisabled and transitions to SystemOperatingMode::Restricted. Requests to the disabled service return a clean error (Err(ServiceUnavailableInRestrictedMode)), while the core kernel and all independent services continue operating normally.
Q7: Can I build and run PangeaOS on my own computer right now?
A: Yes! Anyone with Rust Nightly, QEMU (qemu-system-x86_64), and OVMF firmware installed on Linux can clone https://github.com/forestnote/PangeaOS and run cargo test --workspace --lib, cargo xtask audit, and cargo xtask qemu to see all 37 unit tests, static/reproducibility checks, and 14 live bare-metal boot tests pass in seconds.