Glossary

Glossary

Terms used throughout this wiki and in the NyxOS source. Project-specific terms are marked (NyxOS); the rest are standard but included because their meaning here is precise.

See also: Architecture, Kernel-Data-Structures, FAQ

A

AEAD — Authenticated Encryption with Associated Data. Encrypts and authenticates in one operation. NyxOS provides AES-128-GCM and, since v6.4, ChaCha20-Poly1305. See Cryptography-and-TLS.

Aero Snap (NyxOS) — Drag-to-edge window snapping in the compositor, with a live snap-preview overlay (v6.4.174, v6.4.178). See GUI-Subsystem.

AP — Application Processor. Any CPU core that is not the boot core. Started by INIT–SIPI–SIPI from the BSP. See SMP.

APIC — Advanced Programmable Interrupt Controller. The Local APIC is per-core (0xFEE00000); the I/O APIC routes device interrupts (0xFEC00000). Replaces the legacy PIC, which NyxOS masks entirely.

ARP — Address Resolution Protocol. Maps an IPv4 address to a MAC address. 16-entry cache with TTL.

B

BLAKE2s (NyxOS) — A fast cryptographic hash (RFC 7693), with a keyed MAC mode, added in the v6.4 crypto run. See Cryptography-and-TLS#the-general-purpose-crypto-library.

BSP — Bootstrap Processor. CPU 0, the core the firmware starts. It brings up the APs and owns the PIT.

C

cc (NyxOS) — The kernel-shell builtin that drives the in-OS C compiler /tcc.elf: cc [-c] [--self-libc] <in.c/.o …> [-o out]. Links a freestanding static NyxOS executable by default. See Toolchain.

ChaCha20-Poly1305 (NyxOS) — A modern AEAD (RFC 8439) — the ChaCha20 stream cipher with the Poly1305 authenticator — added in the v6.4 crypto run. See Cryptography-and-TLS#the-general-purpose-crypto-library.

CLONE_VM — The clone() flag that makes the new task share the caller's address space rather than receive fork's copy — that is, a real thread. Without it, clone fails. See Process-Management.

Constant-time compare (NyxOS) — ct_memcmp (ct.c, v6.4.156): a comparison whose timing does not depend on where two buffers first differ, used on the crypto/TLS verify paths to avoid leaking secrets through timing.

Compositor — The window manager (compositor.c). Runs as a scheduled kernel thread at weight 4.

Context switch (NyxOS) — Swapping the running task. NyxOS does it inside the timer ISR (irq_common), not through a dedicated call: SAVE_REGS pushes 15 GPRs, the scheduler picks the next task, then RSP/CR3 are swapped and iretq resumes it. See Process-Management#Context switching.

COW — Copy-on-write. Pages shared read-only after fork, copied privately on the first write. Marked with PTE_COW (bit 10). See Memory-Management.

CPIO newc — The archive format of the initramfs (magic 070701), embedded in the kernel as a C byte array.

CR3 — The register holding the physical address of the active PML4. Switching address spaces means loading CR3.

CSPRNG (NyxOS) — csprng_bytes(), an HMAC_DRBG-SHA256 seeded from RDSEED/RDRAND. Distinct from /dev/random, which is a plain xorshift PRNG.

D

Demand paging — Deferring page allocation until first touch. Marked with PTE_DEMAND (bit 9), resolved by vm_handle_fault.

DEFLATE — The compression algorithm behind zlib and PNG's IDAT stream. Implemented in inflate.c.

Design grid (NyxOS) — The fixed 1024×768 coordinate space GUI code lays out in. The compositor scales it to the live framebuffer; deriving coordinates from fb_get_width() applies the scale twice.

DRBG — Deterministic Random Bit Generator. See CSPRNG.

E

Ed25519 (NyxOS) — An EdDSA public-key scheme over Curve25519 (RFC 8032, a TweetNaCl port); public-key derivation (v6.4.182) and signature verify (v6.4.183). See Cryptography-and-TLS#the-general-purpose-crypto-library.

Erebus (NyxOS) — The NyxOS terminal (v1.x), in the Nyx family with Hemera and Selene. See GUI-Subsystem.

ECDHE — Elliptic Curve Diffie–Hellman Ephemeral. The TLS key agreement. NyxOS supports x25519, secp256r1 and secp384r1.

EFER.SCE — The MSR bit enabling the syscall instruction. Without it, syscall raises #UD in ring 3.

EXT2 — The on-disk filesystem NyxOS reads and writes, mounted at /mnt.

F

Futex — Fast userspace mutex. futex_wait(addr, val) sleeps only while *addr == val; that compare-and-sleep is what makes a lock race-free. See Process-Management.

G

Guard page (NyxOS) — The never-mapped page below the user stack's growth ceiling, so an overflow faults rather than running into other mappings.

H

Higher half — The top of the canonical address space, where the kernel is mapped. KERNEL_BASE is 0xFFFFFF8000000000. All physical RAM is aliased there.

Hemera (NyxOS) — The NyxOS window compositor (v2.x), named in the Nyx family with the Erebus terminal and the Selene browser. See GUI-Subsystem.

HKDF (NyxOS) — HMAC-based extract-and-expand key-derivation function (RFC 5869), over HMAC-SHA256, added at v6.4.130. See Cryptography-and-TLS#the-general-purpose-crypto-library.

HMAC_DRBG — The NIST SP 800-90A construction behind NyxOS's CSPRNG.

I

Initramfs — The root filesystem image unpacked into the ramdisk at boot. Embedded in the kernel; regenerate with tools/mkinitramfs.py. See Filesystem.

IST — Interrupt Stack Table. Per-vector known-good stacks, used for double fault (IST1) and NMI (IST2). NyxOS allocates one pair per core.

K

KAT — Known-Answer Test. A self-test checking an implementation against published vectors. Every NyxOS crypto and image decoder has one.

KDF — Key Derivation Function. PBKDF2-HMAC-SHA256 for passwords; the TLS 1.2 PRF for session keys.

L

LFB — Linear Frame Buffer. The VBE display memory, mapped at 0xE0000000.

LSTAR — The MSR holding the syscall entry address. Must be the higher-half alias, because a ring-3 syscall runs under the user CR3 where the low link address is unmapped.

M

Mount-backed node (NyxOS) — A transient VFS node created by vfs_open on a path under a mount point, preloaded from the filesystem and flushed back on write. Freed at close; the node free-list exists so these do not exhaust the pool.

man (NyxOS) — The shell command that renders a formatted manual page (NAME/SYNOPSIS/DESCRIPTION) for any command, from the man_pages table in kernel.c (86 entries). See Command-Reference.

Multiboot — The bootloader handoff protocol. NyxOS publishes both a Multiboot 1 and a Multiboot 2 header; GRUB uses Multiboot 2.

N

N / N++ (NyxOS) — The native systems language of NyxOS (HolyC-to-TempleOS in spirit): syscalls are part of the language, the compiler knows the OS's ABI and memory map, and it runs inside the OS. N++ is its planned safety superset (every N program is a valid N++ program). See N-Language.

ncc (NyxOS) — The N bootstrap compiler (lang/ncc/ncc.c, single-file C99): transpiles N to freestanding strict-C99 for the in-OS tcc. xbm install ncc builds it in-OS. See N-Language.

NVMe (NyxOS) — The from-scratch NVMe block driver (nvme.c) for real-hardware disks — controller/queue bring-up, block I/O with PRP lists, and write-through/FUA for durable installs. See Drivers and Installation.

nwin (NyxOS) — An N program that opens a real desktop window, an own+#[drop] handle over the ring-3 window syscalls 57–60 — the P5 GUI proof. See N-Language.

nyxinstall (NyxOS) — The in-OS installer: partitions a disk, formats ext2 (+ a FAT32 ESP for UEFI), copies the OS and installs GRUB, so NyxOS boots standalone (BIOS or UEFI). See Installation.

NX — No-Execute. The page-table bit marking a page non-executable. Applied to user stack, heap and data.

Nyx C (NyxOS) — A Go/Zig-influenced typed subset of C that transpiles to C and links against the nyxrt runtime. See Userspace.

Nyx Voxels (NyxOS) — An in-kernel isometric voxel sandbox window (voxel) with block types, procedural worldgen and an orbiting camera, used as a fixed-point 3D-render performance testbed. Sibling to a family of render-perf demos (fire, matrix, lava, fractal, julia, rotor, fill, life). See Desktop-Applications#visual-effects-and-render-performance-demos.

nyxshim (NyxOS) — The user/tcc/nyxshim/ directory of freestanding shim headers + config.h that replace the host system headers, so the tcc port is host-header-free and can compile its own source in-OS. See Toolchain#the-tcc-port.

P

PBKDF2 — The password KDF. 10 000 iterations of HMAC-SHA256 with a random per-user salt.

Persistent home (NyxOS) — From v6.0.6 the logged-in user's home lives on the EXT2 disk at /mnt/home/<user>, so files survive a reboot. Falls back to the ramdisk when no disk is attached. See Filesystem#persistent-home-directory.

PIT — Programmable Interval Timer. Runs at 1000 Hz, delivered on I/O APIC pin 2 (not pin 0 — QEMU's ACPI override remaps ISA IRQ 0).

PML4 — Page Map Level 4, the top of the 4-level page-table hierarchy. Each process has its own; the top entry mirrors the kernel.

PRF — Pseudo-Random Function. The TLS 1.2 P_SHA256 key-derivation function.

Preempt count (NyxOS) — The per-CPU nesting counter behind preempt_disable()/preempt_enable(). Stops a context switch on the local core only — it is not a lock.

R

Red zone — The 128 bytes below RSP that the SysV ABI lets a leaf function use without adjusting the stack pointer. Interrupts would clobber it, so all NyxOS code is built -mno-red-zone.

Reap — Freeing an exited process's address space and stacks. Done from a safe context by reap_zombies(), because a process cannot free the stack it is running on.

Ring — x86 privilege level. NyxOS uses ring 0 (kernel) and ring 3 (user) only.

S

Screen mode (NyxOS) — The terminal state entered on the first CSI sequence, where the line buffer becomes a fixed grid with a block cursor. Reverts when the command exits. What makes full-screen TUIs work.

Selene (NyxOS) — The NyxOS web browser. See Selene-Browser.

Self-hosting (NyxOS) — The property that the OS's own compiler can compile the OS's own source. NyxOS reaches it in Phase 2: the in-OS tcc compiles the libc, the shell, coreutils (byte-identically), and finally tcc's own ~40 000-line source (v6.4.9). See Toolchain#the-self-host-arc.

SGR — Select Graphic Rendition, the ESC[…m terminal sequences for colour and attributes.

SKE — ServerKeyExchange, the TLS handshake message carrying the server's ephemeral key and its signature.

Slab — Fixed-size object caches (8 B to 1024 B). kmalloc falls back to the heap when no class fits.

SMAP — Supervisor Mode Access Prevention. Blocks ring 0 from accessing ring-3 pages outside an explicit window.

SMEP — Supervisor Mode Execution Prevention. Blocks ring 0 from executing ring-3 pages.

SNI — Server Name Indication, the TLS extension carrying the hostname so a server can pick the right certificate.

Spinlock — The cross-core mutual-exclusion primitive (spinlock.h), taken with interrupts disabled. Unlike preempt_disable(), it actually works on SMP.

T

tgid (NyxOS) — Thread group id: the pid of the leader owning a group's shared heap, VMA table and fd table. CLONE_VM threads defer to it through tg_leader().

tcc / TinyCC (NyxOS) — The in-OS C compiler: a port of TinyCC 0.9.27 (user/tcc/), shipped as /tcc.elf, targeting x86-64/ELF with no JIT. Compiles, assembles and links C entirely in-OS. See Toolchain.

TLB shootdown — Broadcasting an IPI (vector 0x41) so every core invalidates a translation that has been removed or restricted. Required on munmap, mprotect and the COW remap.

TOTP / HOTP (NyxOS) — Time- and counter-based one-time passwords (RFC 6238 / 4226), implemented in totp.c over the existing HMAC-SHA1/SHA256 and locked with a KAT (v6.4.120). See Cryptography-and-TLS.

Toolchain (NyxOS) — The in-OS C toolchain as a whole: the compiler-complete libc, the cc builtin, and the tcc port. See Toolchain.

Trampoline (NyxOS) — The position-independent real-mode stub (trampoline.asm) an AP starts on, embedded as a flat binary. Also: the ring-3 __sigreturn stub a signal handler returns through.

TSS — Task State Segment. Holds RSP0 and the IST pointers. One per core, because a TSS may be busy on only one core at a time.

TTY_CANON / TTY_RAW — The two stdin disciplines. Canonical gives echoed, backspace-edited lines; raw gives byte-at-a-time input with arrows as ANSI escapes.

U

ufd (NyxOS) — User file descriptor. The opaque small integer (UFD_BASE + slot) userspace receives, indexed into a per-process table. Kernel VFS handles are never exposed.

V

VBE — VESA BIOS Extensions. NyxOS uses the Bochs VBE interface for mode setting.

VFS — Virtual File System. The unified namespace over ramdisk, EXT2, /proc and /dev.

VMA — Virtual Memory Area. One mmap region: base, length, protection, and optionally a file snapshot buffer. Partial munmap/mprotect split a VMA.

W

W^X — Write XOR Execute. A page is writable or executable, never both. Applied per ELF segment by the loader.

Workspace — One of four virtual desktops. Each window belongs to exactly one.

X

X.509 — The certificate format TLS uses. NyxOS parses it with a DER reader and verifies chains to pinned anchors. Verdicts are X509_OK, X509_INCOMPLETE (not anchored) and X509_FORGED (verification failed) — three outcomes, deliberately not two.

X25519 — The Curve25519 ECDH function (RFC 7748). The first cryptographic primitive NyxOS implemented.

xbm (NyxOS) — The in-OS package manager (v6.4.19, first named pkg). xbm install <name> compiles a package from its recipe with the in-OS cc; also remove/search/list, and an optional url: line to fetch a remote http:// source first. See Toolchain#packages--xbm.

Z

Zombie — A process that has exited but not yet been reaped. PROC_ZOMBIE. Its exit status is waiting to be collected by waitpid.

See also

• Architecture — where these pieces sit
• Kernel-Data-Structures — the structs behind the terms
• FAQ — common questions
• Wiki-Conventions — how these terms should be used in writing

External resources

• OSDev Wiki — general OS-development terminology
• Intel SDM — the authoritative source for the x86 terms above
• POSIX.1-2017 — The Open Group, for the process and signal vocabulary