Skip to content
BranchesTags

Repository files navigation

Aether

Marketing site — vision, architecture visuals, two-year roadmap. Static HTML from site/; published by GitHub Actions to Pages (kernel docs/ are untouched).

Sell pack (one page): docs/SELL_PACK.md — what you get today. Commands that exist. Ask: bring your opcode table. Week 1 call (20 min): docs/WEEK1_CALL.md. Site: #sell · #roadmap. Next year: docs/YEAR_AHEAD.md.

An accelerator-first fabric kernel — a research prototype for how operating systems should look when the package is a mesh of CPU, NPU, GPU, and custom ASIC tiles rather than a host CPU with bolt-on devices.

Interfaces and refuse invariants for an AI-chip OS team. Isolation is the product (blast radius), not FLOPs. Not production silicon, not a vendor partnership. One-page leave-behind: docs/SELL_PACK.md. Week 1 call: docs/WEEK1_CALL.md. Eight-minute script: docs/PITCH.md (site #pitch). What to show next: isolation (make red-team) → packet (make partner-hello / cargo run -p aether-accel-client) → wait (Event in make diligence-demo) → admit class (fabric-class in make red-team) → sandbox hole (ATOMIC_ADD + [softsfi] heap=refused in make red-team).

make test         # host unit tests (caps, fabric, arenas, scheduler, SoftNPU, L)
make diligence-demo  # partner host clip (Path B; no QEMU; greps golden lines)
make partner-hello # host IreeHalCmd leave-behind (no QEMU rebuild)
make mp-shim      # MicroPerceptron-shaped thin IreeHalCmd consumer (research sketch)
make qemu         # boot Aether in QEMU (x86_64 ring-3 /init; embedded ramfs)
make qemu-blk     # same + virtio-blk AETHFS01 drive (seeds /init /probe)
make qemu-smp     # same + QEMU -smp 2 (INIT-SIPI / work-steal smoke)
make qemu-riscv   # RISC-V virt S-mode + U-mode /init + PLIC SoftNPU IRQ
make qemu-aarch64 # aarch64 virt EL1 + EL0 /init (svc/eret; documented subset)
make accel-test   # path-A QEMU device model + Soft-SMMU IOVA / wrong-SID (host; no QEMU rebuild)
make qemu-accel   # accel-test + path_a tests; attach -device aether-accel if QEMU_ACCEL is set
make red-team     # host diligence clip: named attacks refused (scripted stdout)
make design-win-check # admit a filled DESIGN_WIN worksheet (no QEMU)
make design-win-standin # admit the IREE HAL research stand-in (not a partner)

Why this exists

Accelerators are activities on a capability fabric, not devices behind ioctl. Traditional kernels treat GPUs and NPUs as PCIe endpoints: ioctl, a userspace runtime, and a hope that the driver got cache flushing right. That model is already strained on a discrete GPU. It breaks down on a package of chiplets where:

  • inference latency is a deadline, not a best-effort ioctl
  • weights and KV caches are multi-tenant secrets, not files
  • “shared memory” across tiles is often not cache-coherent
  • the expensive resource is HBM banks and NPU waves, not CPU time slices

Aether inverts the picture. Compute tiles are first-class peers on a capability-secured message fabric. CPU threads and accelerator waves are the same kind of scheduled job. Tensor memory is an arena with explicit ownership transfer. There is no IPC except capability-checked messages.

Quickstart

Host tests (any x86_64-unknown-linux-gnu rustc 1.83+):

cargo test --workspace
make partner-hello   # frozen IreeHalCmd → IreeShapedCp; no QEMU

Partner diligence clip (host Path B, no QEMU rebuild; a few minutes including the first compile):

make diligence-demo
# same binary: cargo diligence-demo

Stdout is the thesis: [blast] CrossCut + wrong-SID refuse, [pjrt] frozen IreeHalCmd submit + wait (research opcodes, not FLOPs), [event] SoftChipletSync create/record/wait plus fence counts, [softcct] package fences ≪ broadcast, [firewall] mutation-during-validate fails, [greenctx] 70/30 SM/WQ partition and interference vs unpartitioned, then a short what this proves / what it does not block. CI greps examples/diligence-demo/expected.txt. See docs/DILIGENCE.md. Soft SMMU is software. Path B is canonical. No fake NVIDIA, no tape-out. The call fill-in is docs/DESIGN_WIN.md; check a filled copy with cargo run -p aether-design-win-check or make design-win-check. A research stand-in (public IREE HAL nouns, not a partner) lives in docs/design-win/iree-hal-standin.md; make design-win-standin admits it. Week 1 call pack: docs/WEEK1_CALL.md.

QEMU demo (also needs qemu-system-x86_64, GNU as/ld with elf_i386, objcopy, and rustup target add x86_64-unknown-none):

make qemu

Exact machine:

qemu-system-x86_64 \
  -kernel build/aether.elf \
  -serial stdio -display none \
  -no-reboot -no-shutdown -m 128M

You should see the trampoline enter long mode, a kernel self-check of the host-identical fabric demo, then ring-3 /init over syscall:

[init] ring-3 /init (static ELF64 non-PIE @ 0x2000000)
[init] clone ok (shared aspace)
[init] user-thread share-aspace
[sched] kthread-B tick=…
FABRIC IPC + TENSOR ARENA + ACCEL JOB COMPLETE
  CUT BIND + HODGE FLOW CLASS ENFORCED
  TYPED SPACE + ACTIVITY ENDPOINT + FENCE-ORDERED JOB
  RING-3 /init VIA SYSCALL/SYSRET

The guest then exits QEMU via isa-debug-exit (status 1 means success). make qemu treats that as a clean run. CI runs make qemu-ci (45s timeout). The kernel self-check also prints [blast] two-tenant blast radius sealed (CrossCut + wrong-SID refuse) and [sid] two-SID Host1x-shaped submit sealed (SET_SID at submit, not only at map) and [firewall] copy-then-validate race sealed (Host1x copy-then-validate; command-stream integrity, not confidential GPU) and [softsfi] two-tenant SFI+SID sandbox sealed (GPU-AToLL-shaped toy ISA; not NVVM) and [sva] mm↔ssid Soft-SMMU SVA sealed (Linux SVA/PASID inspiration; not hardware SMMU, not CUDA UVA) and [opinject] resident worker + hot-add sealed (GPUOS / Mirage MPK-shaped; not NVRTC). Diligence clips, not a track. See docs/BLAST.md and docs/ACCEL.md. The host sell-path is make red-team: same refuse paths, stdout [redteam] attack=… result=refused, plus fabric-class admit/refuse and ATOMIC_ADD accept/reject plus [softsfi] heap=refused on the same SoftNoI / SoftSFI clips, and an explicit “what this is not” closer (not confidential GPU, not HW MIG, Soft SMMU is software).

RISC-V virt (qemu-system-riscv64, rustup target add riscv64gc-unknown-none-elf):

make qemu-riscv
qemu-system-riscv64 \
  -machine virt -cpu rv64 -m 128M -nographic \
  -no-reboot -kernel build/aether-riscv.elf

OpenSBI loads the ELF at 0x80200000. The trampoline identity-maps 4 GiB (Sv39), the same kernel self-check runs, then sret drops to U-mode /init at 0x82000000 (ecall syscalls, own satp). SoftNPU is the in-kernel virtqueue (path B). Completions are claimed on the PLIC (UART THRE software doorbell, source 10) — not a virtio-mmio -device. This is a documented subset, not a product-class second architecture. Success writes 0x5555 to the virt test finisher. make qemu-riscv-ci greps [plic] claim irq=10 SoftNPU used-ring plus [init] U-mode /init and U-MODE /init VIA ECALL/SRET.

aarch64 virt (qemu-system-aarch64, rustup target add aarch64-unknown-none):

make qemu-aarch64
qemu-system-aarch64 \
  -machine virt,gic-version=2 -cpu cortex-a72 -m 128M -nographic \
  -no-reboot -nic none -kernel build/aether-aarch64.elf -semihosting

QEMU loads the ELF at 0x40080000. The trampoline identity-maps 4 GiB (TTBR0, 1 GiB blocks), the same kernel self-check runs, then eret drops to EL0 /init at 0x42000000 (svc syscalls, own TTBR0). SoftNPU is the in-kernel virtqueue (path B), drained on the CNTV tick / kthread poll — not a GIC doorbell and not virtio-mmio. This is a documented subset, not a product-class second architecture. Success is Angel semihosting SYS_EXIT. make qemu-aarch64-ci greps [init] EL0 /init and EL0 /init VIA SVC/ERET.

Architecture

flowchart TB
  subgraph tasks [Tasks / tenants]
    TA[Tenant A<br/>init / runtime]
    TB[Tenant B<br/>isolated]
  end

  subgraph kernel [Aether kernel]
    Caps[Capability spaces]
    Fabric[Fabric IPC<br/>sync + async endpoints]
    Sched[Tile scheduler<br/>prio + deadline + steal]
    Arena[Tensor arenas<br/>bank-aware / pinned DMA]
    HAL[Accel HAL]
    Obs[Event ring]
  end

  subgraph tiles [Tiles on the package]
    CPU[CPU tiles]
    NPU[NPU / wave engine]
    GPU[GPU]
    ASIC[Custom ASIC]
  end

  TA -->|CPtr only| Caps
  TB -->|cannot forge A's caps| Caps
  Caps --> Fabric
  Fabric --> Sched
  Arena -->|ownership transfer| Fabric
  Sched --> CPU
  Sched --> NPU
  HAL --> NPU
  HAL --> GPU
  HAL --> ASIC
  Fabric --> Obs
  Sched --> Obs
  HAL --> Obs
Loading
Piece Role in v0.1
Fabric IPC seL4-inspired caps; sync/async endpoints; cap grants; chiplet route tags; FlowClass + Hodge quotas
Tile scheduler CPU Thread and NPU AccelWave jobs; priority + deadline boost; bank affinity; work-steal; SpectralCut placement refusal
Tensor arenas NUMA/bank first-fit; 4K / 2M align; pinned DMA; explicit owner tile/tenant
Accel HAL probe / submit / poll / map; virtqueue MMIO + SoftNPU (I32 + software F16/F32); SoftCommandProcessor (CpCmd + SoftGreenCtx SM/WQ); IreeShapedCp (IreeHalCmd, IREE HAL nouns, backend = 4); host consumers: aether-pjrt + doorbell examples/accel-client + MP-shaped host/aether-mp-shim; Soft SMMU IOVAs; (place, local) map refuses silent remote load
Typed spaces HOST | DEVICE_HBM | TILE_SRAM | CXL_REGION | SCRATCH | STREAMING; UNIFIED is a cap bit. TypedWindow is a CXL.mem-inspired pin stub (not silicon)
Activity / partition / fence Uniform endpoint; spatial slice + QoS + blast radius; submit → wait → complete (CP-shaped seq; timeout is software)
Caps Unforgeable CPtr slots; monotonic derive; cross-tenant mint rejected; revoke empties descendants
Observability COM1 console + structured EventRing

Repository layout

boot/x86_64/     multiboot1 trampoline (32-bit → long mode) + linker scripts
boot/riscv64/    OpenSBI S-mode trampoline + Sv39 linker script
boot/aarch64/    QEMU virt EL1 trampoline + TTBR0 linker script
core/            aether-core — alloc-free logic, `cargo test`
hal/             AccelDevice / Console / Timer traits
drivers/         VirtIO-Accel queue + SoftNPU + SoftCommandProcessor + IreeShapedCp
qemu/            optional path-A `aether-accel` device (host-tested; QEMU patch)
host/aether-pjrt std host shim: abi nouns → IreeHalCmd → IreeShapedCp; Event wait on existing fences (not GetPjRtApi, not XLA)
host/aether-mp-shim  MicroPerceptron-shaped thin IreeHalCmd consumer (inspiration name only; secondary to PJRT; `make mp-shim`)
examples/diligence-demo  host Path B partner clip (`make diligence-demo`)
examples/red-team        host red-team clip (`make red-team`; named attacks refused)
examples/accel-client    doorbell client: same frozen IreeHalCmd (second caller; not a MicroPerceptron port)
examples/design-win-check filled DESIGN_WIN worksheet checker (`make design-win-check`)
examples/partner-hello  clone-and-run frozen IreeHalCmd (host; no QEMU rebuild)
kernel/          freestanding kernel (x86_64 ring-3 + riscv64 U-mode /init + aarch64 EL0 /init)
user/init/       `/init` (static ELF64; x86 @ 0x2000000, riscv @ 0x82000000, aarch64 @ 0x42000000)
user/probe/      optional second static ELF64 (own PML4 @ 0x2400000)
docs/            architecture, fabric, accel, security, diligence, sell pack, pitch, Week 1 call pack
docs/design-win/ IREE HAL research stand-in worksheet (`make design-win-standin`; not a partner)

The kernel and /init are separate Cargo projects so cargo test --workspace stays on the host. make qemu builds both for x86_64-unknown-none and embeds the init ELF.

What v0.1 is honest about

  • Research prototype. Soft SMMU (software STE→CD→Stage-1/2 IOVA walk + ATS-shaped invalidate) is in tree; there is no hardware SMMU, no verified cap derivation tree, no real silicon driver. Hardware SMMU still requires partner silicon. TypedWindow (CxlMemStub) is a CXL.mem-inspired pin stub, not a HDM decoder and not QEMU CXL. SMP is a QEMU -smp 2 smoke (INIT-SIPI, per-CPU gs, two-hart work-steal); APs do not run /init.
  • VirtIO-Accel path B is an in-kernel MMIO virtqueue, not a tree in upstream QEMU. make qemu stays on that BAR so the demo does not depend on a custom qemu. DMA uses Soft-SMMU IOVAs (not identity); QEMU does not emulate a hardware SMMU. Path A is an optional in-tree QEMU device (qemu/aether_accel.c, same frozen offsets) with a host unit test (make accel-test) that also proves Soft-SMMU IOVA on the path-A job wire and a wrong-SID abort. make qemu-accel attaches -device aether-accel only when QEMU_ACCEL names a patched binary; CI does not rebuild QEMU. See qemu/README.md.
  • /init is a static non-PIE ELF64 linked at 0x0200_0000. Boot seeds an in-kernel ramfs from virtio-blk (make qemu-blk / qemu-blk-ci, AETHFS01 image) or the embedded blob when no drive is present (make qemu-ci). The loader opens /init (and x86 /probe) by name. Not POSIX. SoftNPU path B is unchanged. Ring-3 entry is syscall/sysret; cap checks sit on send/recv/map/accel.
  • Per-task PML4 + higher-half + KASLR are documented subsets. Each ring-3 task has its own CR3; USER is only on that task's 2 MiB ELF window; SMEP/SMAP are on. The kernel is linked at 0xffffffff80400000 (classic -2 GiB map). The trampoline picks a 0 / 16 / 32 MiB slide (-append kaslr=1 in CI), dual-maps an 8 MiB kernel span, applies .rela.dyn (R_X86_64_RELATIVE), unmaps the unused link-time alias, and runs at the slid RIP. Kernel CR3 identity is torn down except SIPI / mailbox / trampoline / virtio-blk / APIC islands. SoftNPU DMA is Soft SMMU + HH (KernelDma). User CR3 is a KPTI subset: ELF window + 4 KiB supervisor trampoline, no HH, no identity DMA. PCID tags those CR3 switches when the CPU advertises it (-cpu qemu64,+pcid,+invpcid); otherwise mov cr3 still full-flushes. One shared 4 KiB COW page (0x0280_0000) is read-only in /init and /probe until a write fault. SYS_MMAP (nr 11) grows the caller aspace with anonymous 4 KiB USER pages in a reserved window (not POSIX mmap). Not Meltdown-complete / a secret slide / POSIX mmap. SMP is a QEMU -smp 2 smoke; APs do not run /init. make qemu-smp proves two harts; make qemu stays uniprocessor.
  • RISC-V userspace is a documented subset. make qemu-riscv srets into U-mode /init over ecall with a task-local Sv39 window. SoftNPU is in-kernel path B; used-ring completions go through a PLIC software doorbell (not virtio-mmio). aarch64 erets into EL0 /init over svc with a task-local TTBR0 window (in-kernel SoftNPU; no GIC doorbell). Neither is a product-class second architecture.

See docs/ROADMAP.md and docs/SIX_MONTH_PLAN.md for landed status. The Month 1–2 spine (opcodes → PJRT shim) is done. Soft-CP XQueue is M4 done (PR #47; two software queues, queue-boundary suspend/resume; not a silicon queuing unit). M3 SID-at-submit is landed (Host1x-shaped SET_SID; StreamId inherits / sticks on the XQueue; not a Tegra driver). SoftChipletSync is landed (scoped timelines; Fleet inspiration; not Vulkan, not UCIe, not ChipletFleet placement). SoftCCT is landed (last-writer chiplet elision; CPElide inspiration; not a coherence protocol, not Vulkan / ROCm). SoftGreenCtx is landed (fake SM/WQ 70/30 partitions on Soft-CP; XQueue bind; memcpy interference vs unpartitioned; migrate-to-yield without SID change; Green Contexts / DetShare inspiration; not HW MIG, not a BAR firewall, not FLOPs). SoftSFI is landed (Month 5 digest 4; toy Soft-CP load/store/add/dma/atomic_add + SFI verifier; GPU-AToLL inspiration; not NVVM; tensor Unmodeled; heap/alloc is a named Unmodeled refuse, not a bump allocator; atomic_add is a sequential toy RMW, not a hardware atomic). Optional Soft SMMU kit is PR #48 (software tables). Path-A guest bind stays gated. Closed Month 5 record: docs/MONTH5_PLAN.md. Next-12-month industry calendar: docs/YEAR_AHEAD.md (Sep 2026 → Sep 2027). docs/SIX_MONTH_FORWARD.md is the closed Sep 2026 → Mar 2027 record (M0–M6 landed). Horizon: docs/TWO_YEAR_PLAN.md (Sep 2026 → Sep 2028). Partner demos: docs/SELL_GOALS.md. One-page leave-behind: docs/SELL_PACK.md. H2 2026 leftovers landed.

Docs

Website

The public site lives in site/ (HTML/CSS/JS, no build step) and deploys from .github/workflows/pages.yml on pushes to main that touch site/. After the first successful run, enable Settings → Pages → Source: GitHub Actions if it is not already on. The live URL is https://amineux.github.io/aether/ (sell / design-win: #sell; roadmap: #roadmap; 8-minute script: #pitch).

Open site/index.html locally, or python3 -m http.server -d site, to review offline.

License

MIT OR Apache-2.0.

About

Aether — fabric kernel for AI silicon: capability-secure, accelerator-first OS for heterogeneous chips

Resources

Readme

Security policy

Security policy
Activity

Stars

1 star

Watchers

0 watching

Forks

0 forks
Report repository

Releases

Packages

Contributors

Languages