GLOSSARY.md

Abbreviations and Acronyms of GodspeedOS

This file expands the abbreviations and acronyms that appear across the GodspeedOS codebase, specification, and docs, with a one-line meaning grounded in how the project actually uses each one.

It is deliberately scoped to abbreviations and short forms. For architectural terms (capability, endpoint, generation, placement, routing table, supervisor, name directory, delegated resource capability, TCB, and so on) the authority is the Glossary in CLAUDE.md section 24 - read that for the prose definitions of the model itself. Where this file and CLAUDE.md disagree, CLAUDE.md wins.

Only abbreviations the repository genuinely uses are listed. Each was verified by grep before inclusion.

The table below is also read by a program: ask "what is MISCIS?" answers from it, read when ask is built (services/ask/build.rs), so a row's shape - three cells, the abbreviation first - is load-bearing, and a definition has one copy, this one.


Alphabetical list

AbbreviationExpansionMeaning in GodspeedOS
ABIApplication Binary InterfaceThe syscall ABI follows System V AMD64; it is part of the SDK's audited unsafe boundary (section 18.1) and any freestanding-ELF language can call it (Appendix B.2).
ACPIAdvanced Configuration and Power InterfaceFirmware tables; the kernel walks RSDP then RSDT/XSDT to the IVRS for IOMMU detection (H1). The kernel does not parse ACPI/MADT for SMP topology - Limine supplies that.
AHCIAdvanced Host Controller InterfaceThe SATA block-driver backend used on real hardware (the T630 SSD is AHCI-only); MMIO plus DMA, with command list / FIS / PRDT (docs/ahci.md).
AMD-ViAMD Virtualization (AMD's IOMMU)The IOMMU implementation behind H1 DMA-confinement; a per-device translation domain confines each DMA-capable driver to its granted arena.
APApplication ProcessorAny core other than the BSP; brought up via a real-mode trampoline (arch/x86_64/ap_boot.rs), then jumps to long mode and enters the idle scheduler loop.
APIApplication Programming InterfaceGeneral term for a service or supervisor call surface (e.g. the supervisor restart API, section 14.4).
APICAdvanced Programmable Interrupt Controllerx86 interrupt controller; Limine supplies APIC IDs of all cores so the kernel needs no MADT probe.
ATAAT AttachmentLegacy disk interface; the ATA PIO (no-DMA, least-privilege) block backend works under QEMU's legacy IDE, superseded by AHCI for real hardware.
BARBase Address RegisterPCI register locating a device's MMIO region; read during controller enumeration.
BDFBus / Device / FunctionA PCI device's address; the IOMMU confines a specific BDF to its DMA arena (boot prints confined BDF ..., section 6.4).
BIOSBasic Input/Output SystemLegacy firmware boot path; Limine supports both BIOS (via MBR stage-1) and UEFI from one bootloader.
BOOTX64.EFI(UEFI boot executable name)The Limine UEFI loader binary placed at /EFI/BOOT/BOOTX64.EFI on the ESP; firmware loads it, it loads Limine, which loads the kernel (Appendix A.4).
BSPBootstrap ProcessorThe first core to execute kernel code; performs kernel init and brings the APs online.
CASCompare-And-SwapScheduler Running-to-Ready transitions use CAS so a cross-core kill's Dead state is preserved (not clobbered by a plain store).
CLICommand-Line Interfaceosdev, the host-side CLI that builds, runs, publishes, and controls the OS in QEMU (section 17).
CMOSComplementary Metal-Oxide-SemiconductorThe MC146818 CMOS RTC chip the kernel reads for wall-clock date/time (arch/x86_64/rtc.rs).
COM1 / COM2Serial communication port 1 / 2COM1 carries the interactive shell console; COM2 is the control/harness channel used by osdev tests.
CRC3232-bit Cyclic Redundancy CheckChecksum used for disk-image and GPT integrity (osdev/src/crc32.rs).
DMADirect Memory AccessDevice-driven memory access; the unstated exception to "no ambient authority" (invariant 1) because a DMA engine can reach any physical address. Closed by IOMMU confinement (H1, section 6.4).
DoSDenial of ServiceA failure mode the design guards against - e.g. the supervisor respawn is unbounded deliberately so killing it N times cannot force a reboot (section 6.2).
EHCIEnhanced Host Controller InterfaceThe USB 2.0 controller driver; runs in transparent IOMMU passthrough (it legitimately reaches firmware/hub regions, section 6.4).
ELFExecutable and Linkable FormatService binary format; the spawner maps an ELF into a new address space; bit-flip-mutated ELFs are a fuzz surface (F3).
EOTEnd Of TransmissionThe 0x04 marker that ends one stream in a capability-mediated pipe (docs/pipes.md, Appendix D.3).
ESPEFI System PartitionThe FAT boot partition holding BOOTX64.EFI and the kernel; the boot region of a bootable GodspeedOS drive.
FAT / FAT32File Allocation Table (32-bit)The filesystem of the ESP boot region (Limine can read FAT but not GSFS); also the size-class GSFS sits in today because Phase-1 chose 32-bit fields.
FISFrame Information StructureAn AHCI command/data frame in the SATA transport.
FSFFree Software FoundationSteward of the GPL; the kernel is GPL-2.0-only, "the same license as the Linux kernel" (LICENSE, docs/licensing.md).
GDTGlobal Descriptor Tablex86 segment descriptor table set up during BSP init.
GPLGNU General Public LicenseThe kernel license (GPL-2.0-only copyleft); the SDK is permissive Apache-2.0, with the capability/IPC boundary as the license boundary.
GPTGUID Partition TableThe partitioning scheme of build/os.img (a UEFI GPT disk image).
GSFSGodspeed File SystemThe project's own on-disk filesystem (magic GSFS); the kernel never learns what a file is, fs owns it. GSFS0008 is the 8th on-disk format version (superblock + backup, free bitmap, self-describing file-record tree, crash-consistent redo-journal).
gshGodspeed shell (language)The .gsh shell scripting language (design sketch, docs/scripting.md); no_std, no heap, fixed/bounded storage by design.
HHDMHigher-Half Direct MapLimine pre-maps physical memory at a known high virtual address; the kernel uses the HHDM to read ACPI tables and physical frames.
HIDHuman Interface DeviceThe USB keyboard/mouse device class; the xHCI and EHCI drivers share sdk/rust/src/hid.rs.
IDTInterrupt Descriptor Tablex86 interrupt-vector table installed at BSP init.
IFInterrupt Flagx86 flag enabling interrupts; the supervisor respawn must run in the scheduler loop (IF=1), not inside a timer ISR (IF=0), so it can ACK TLB-shootdown IPIs.
IOMMUInput/Output Memory Management UnitTranslates every device DMA through a per-device page table; a domain mapping only the driver's arena confines a compromised driver and lets it leave the TCB (H1, docs/iommu.md).
IPCInter-Process CommunicationSynchronous, bounded-queue message passing between services; the core kernel primitive (section 8).
IPIInter-Processor InterruptOne core signaling another - used to wake a blocked cross-core recv and to drive TLB shootdowns.
IRQInterrupt RequestA hardware interrupt line; the kernel routes IRQs to userspace driver endpoints via IPC (section 12).
ISRInterrupt Service RoutineA kernel interrupt handler (e.g. the per-core timer ISR that enforces the quantum).
IVRSI/O Virtualization Reporting StructureThe AMD ACPI table describing AMD-Vi; if there is no IVRS the machine has no IOMMU, so DMA drivers stay in the TCB (reported loudly at boot, section 6.4).
JSONJavaScript Object NotationThe schema format (contracts/schema/service.schema.json) osdev uses to validate service contracts.
KVMKernel-based Virtual MachineQEMU hardware acceleration, enabled by the harness when /dev/kvm is available.
LAPICLocal APICThe per-core APIC; its periodic timer drives the 10 ms preemption quantum.
LBALogical Block AddressA disk block index; the block-IPC LBA field is u64 (docs/persistence.md).
MADTMultiple APIC Description TableThe ACPI table that would enumerate cores; not parsed in v1 because Limine supplies APIC IDs directly.
MBRMaster Boot RecordBIOS boot sector; limine bios-install writes Limine's stage-1 there.
MISCISMemory isolation, IPC, Scheduling, Capabilities, Interrupts, SMP routingThe kernel's six responsibilities, said like "misses" (CLAUDE.md 4.3). "Do not expand MISCIS" is the short form of 4.4: a seventh responsibility is a change to what the kernel IS, and scripts/commandments.py derives the six from that list.
MMIOMemory-Mapped I/ODevice registers accessed as memory; granted to a driver by an hw_mmio capability and used only through the SDK's safe Mmio wrappers (section 18.1).
MSIMessage-Signaled InterruptPCI interrupt delivery via a memory write; the current USB drivers use pin-based IRQs, with MSI the basis of the interrupt-driven driver branch.
NICNetwork Interface ControllerThe network device in the (design-only) networking stack; an IOMMU-confined e1000 driver for QEMU/Intel (docs/networking.md).
PCIPeripheral Component InterconnectThe device bus enumerated to find controllers (arch/x86_64/pci.rs).
PFPage FaultA protection violation; an access outside a mapped region kills the service (section 10.4), and a guard-page PF catches stack overflow.
PIOProgrammed I/O (port I/O)The no-DMA ATA disk backend - least-privilege because it cannot reach arbitrary memory the way a DMA engine can.
PRDTPhysical Region Descriptor TableThe AHCI scatter-gather list describing DMA buffers for a command.
QEMUQuick EmulatorThe virtual machine osdev run / osdev test boots the OS in.
RCURead-Copy-UpdateA candidate v2 replacement for the v1 global capability-table RwLock (requires benchmarks first, section 7.8).
RTCReal-Time ClockThe CMOS battery-backed clock read for uptime and the date command; uptime uses rtc::now_epoch_monotonic to deglitch.
RwLockRead-Write LockThe single global lock guarding the capability table in v1 (a known, benchmarked perf cost; section 7.8, benchmark B7).
RX / TXReceive / TransmitSerial (and network) data directions (e.g. polling UART RX in the timer ISR).
SATASerial ATAThe disk interface driven by the AHCI block backend.
SDKSoftware Development Kitsdk/rust/ - the typed capability/IPC/MMIO/DMA wrappers services build against; the only place outside the kernel's four layers where unsafe is permitted (section 18.1).
SemVerSemantic VersioningThe versioning scheme for contracts and the contract schema (breaking changes need a major bump).
SMPSymmetric Multi-ProcessingMulti-core support with static placement and no migration - cores discovered at boot, services pinned for life (section 9).
SPDXSoftware Package Data ExchangePer-file SPDX-License-Identifier tags mark each license zone (kernel GPL-2.0-only vs SDK Apache-2.0).
TCBTrusted Computing BaseThe set of components trusted to enforce isolation; deliberately shrunk over time until the non-restartable floor is {kernel} alone (sections 6.1-6.3) - DMA drivers excepted only on a machine with no IOMMU.
TCGTiny Code GeneratorQEMU's pure-software (non-KVM) JIT; cross-core wake timing differs under TCG, so some tests poll rather than block-wait.
TLBTranslation Lookaside BufferOn unmap (service death, memory reclaim) the kernel issues a TLB shootdown via IPI to every core and resumes only after all acknowledge (section 10.5).
TOCTOUTime-Of-Check-To-Time-Of-UseThe send-during-restart race; caught atomically by the generation check inside the send syscall (section 8.7, adversarial test A5).
TOMLTom's Obvious Minimal LanguageThe format of a service contract (contracts/<name>.toml), validated structurally against the JSON Schema.
TSCTime-Stamp CounterThe CPU cycle counter (read_tsc) used for the performance benchmarks; note CORE_TOTAL_TICKS counts scheduler quanta, not time.
UARTUniversal Asynchronous Receiver/TransmitterThe serial-port hardware carrying the shell (COM1, 115200 8N1).
UBUndefined BehaviorWhat unsound unsafe would produce; the spec's rule is "undefined behavior in spec becomes bugs in system" (section 25).
UAFUse-After-FreeA class of memory bug guarded against in the kill-path reclaim walk (a defensive PTE-validity guard skips and logs corrupt entries).
UEFIUnified Extensible Firmware InterfaceThe primary firmware boot path: firmware loads BOOTX64.EFI, then Limine, then the kernel.
USBUniversal Serial BusKeyboard and mouse input, driven by the userspace xHCI and EHCI services.
W^XWrite XOR ExecuteA page-table hardening invariant - no page is both writable and executable (the H4 kstack-guard / W^X work, section 18.5).
xHCIeXtensible Host Controller InterfaceThe USB 3.0 controller driver; IOMMU-confined to its DMA arena (section 6.4, identity test 12).

Naming schemes

A few families of identifiers are easier to understand as a scheme than as a list. Rather than enumerate every one, here is what each prefix means.

Amendment and program IDs (in CLAUDE.md)

- H-prefix (H1, H4, H11, ...) - numbered hardening / security amendments to the constitution. Each closes a specific gap with a written rationale. H1 = IOMMU DMA-confinement (closes the DMA hole in invariant 1); H4 = kstack-guard / W^X hardening; H11 = making registry a restartable userspace service (it left the TCB). - P-prefix (P2) - a feature/persistence amendment. P2 = file-as-capability (delegated resource capabilities, section 7.10). (Note: P1-P10 separately label the property tests - see below; context disambiguates.) - "Path C" - the chosen end-state of the naming-out-of-kernel redesign (docs/naming-design.md section 3.7): name policy lives in the supervisor while the kernel keeps only a minimal gated recovery directory. - Phases (Phase 4, Phase 5, Phase 6, Phase D, ...) - the ordered implementation steps within an amendment program. For example, in Path C: Phase 4 retires the registry service, Phase 5 removes init, Phase 6 makes the supervisor restartable; the "Phase D" amendment dropped block-driver and fs from the TCB once fs gained crash-consistent recovery.

Test-suite IDs (CLAUDE.md section 22, tests/qemu/)

The identity suite numbers its constitutional tests (Test 1 ... Test 15). The battle-hardening categories use a letter prefix plus a number:

- (Identity) - Tests 1-15, the executable constitution; a failure is a constitutional violation. - P - Property tests (P1-P10): universal invariants under randomized inputs. - F - Fuzz tests (F1-F8): the kernel must never panic on user-controllable input. - S - Stress tests (S1-S10): no drift, leak, or corruption under sustained load. - B - Performance Benchmarks (B1-B10): latency/throughput numbers tracked against a baseline. - BP - the Brutal Perf variant of the benchmarks (BP1-BP10): the same metrics run in a contended "perf-brutal" build, the form quoted in the hardware results table. - A - Adversarial / red-team tests (A1-A10): capability isolation under direct attack. - C - Chaos tests (C1-C7): graceful degradation under partial failures. - "brutal" - in general, the harsher contended variant of a suite (e.g. perf-brutal).

The name directory

Not an abbreviation but worth stating once: the name directory is the kernel's minimal name -> EndpointId map (ipc::names) plus a gated "mint a SEND cap by name" call (AcquireSendCap). It is the bounded recovery anchor that replaced the retired registry service (Path C / Phase 4): the supervisor wires services from a name -> cap map, and clients reacquire a service by name through this directory after a restart.

Amendment shorthand

CLAUDE.md and the docs refer to past amendments by short codes. This decodes the common ones; each is defined in full at its cited section.

CodeMeaningWhere
H1IOMMU DMA-confinement: an IOMMU (AMD-Vi) confines a DMA-capable driver to its granted arena, making it least-privilege and restartable, so it drops out of the TCB where an IOMMU exists.§6.4, docs/iommu.md
H11The registry left the TCB - it became a real userspace name service (holding only delegated caps), later retired entirely (see Path C / naming Phase 4).§6.1
P2File-as-capability: delegated resource capabilities - a service owns a resource's meaning while the kernel mints, validates, routes, and revokes its cap.§7.10
Phase Cfs gained crash-consistent recovery: every metadata mutation commits through a redo-journal, replayed on mount to a consistent state.§15, docs/persistence.md §6.8
Phase Dblock-driver + fs became restartable and left the TCB (made safe by Phase C's recovery); their death is a supervisor restart, not a reboot.§6.1
Path CNaming moved out of the kernel: the supervisor wires services from a name -> cap map; the kernel keeps only a minimal gated recovery directory. Reduced the unkillable set to {kernel}.§3.7, docs/naming-design.md
naming Phase 4The registry service was retired into the kernel's name -> EndpointId directory.Path C
naming Phase 5init was removed; the kernel spawns the supervisor directly.Path C
naming Phase 6The supervisor was made restartable - the kernel respawns it, unconditionally, forever.§6.2, Path C

Hardware and Systems Abbreviations

The short forms that appear throughout the kernel, the drivers, and the design docs. Each is listed because the repository genuinely uses it (verified by grep), and defined by how GodspeedOS uses it - not by its most general industry meaning. Architectural terms remain the province of CLAUDE.md section 24; these are the abbreviations you meet while reading the code.

CPU, interrupts, and time

- ARM - Advanced RISC Machines: the instruction set family GodspeedOS runs on besides x86_64. Two ports exist and they are genuinely different machines, not one with a flag: arm32 (ARMv7-A, Raspberry Pi 2, four Cortex-A7 cores) and AArch64 (ARMv8-A, Raspberry Pi 4). Each brings its own boot path, its own USB host controller, and its own timer. - APIC - Advanced Programmable Interrupt Controller. The interrupt hardware the kernel drives for timers and inter-core signalling. - LAPIC - the local APIC, one per core. Owns that core's timer and receives its interrupts. - IOAPIC - the I/O APIC: routes device interrupt lines (legacy INTx) to a core's vector. - LVT - Local Vector Table. The LAPIC registers that say which vector a local source (e.g. the timer) raises, and whether it is masked. - ISR - Interrupt Service Routine: the handler that runs when a vector fires. - IRQ - Interrupt ReQuest: a device's interrupt line or its assigned vector. - IPI - Inter-Processor Interrupt: one core interrupting another (used for wakeups and TLB shootdown). See also CLAUDE.md section 24. - NMI - Non-Maskable Interrupt: reaches a core even with interrupts disabled, which is why the panic path uses it to halt every core (SEC-18). - MSI / MSI-X - Message Signalled Interrupts: a device raises an interrupt by writing a message rather than asserting a pin, so it can be targeted at a chosen core. - TSC - Time Stamp Counter: the CPU's cycle counter. TSC-Deadline is a one-shot timer mode armed by writing a deadline; the kernel re-arms it every tick. - PIT - Programmable Interval Timer (i8254). Legacy but portable, so it is the ground truth the kernel calibrates the TSC and the LAPIC timer against. - ARAT - Always Running APIC Timer: a CPU flag meaning the LAPIC timer keeps ticking through deep C-states. Without it, halting an idle core can drop its wakeup. - C-state - a CPU idle power state. Deeper states save more power but can power-gate the APIC. - RTC / CMOS - the battery-backed real-time clock; the wall-clock source (date, uptime, and any pacing that must not trust the TSC). - SMP - Symmetric MultiProcessing: multiple cores running the same kernel.

Memory and addressing

- MMIO - Memory-Mapped I/O: device registers accessed as memory rather than I/O ports. - DMA - Direct Memory Access: a device reading or writing RAM itself. Unconfined DMA is kernel-equivalent power, which is why section 6.4 treats it so carefully. - IOMMU - I/O Memory Management Unit: translates and confines device DMA, so a driver's device reaches only its granted arena (H1). - TLB - Translation Lookaside Buffer: the CPU's cache of page-table translations; a stale entry must be shot down across cores. - CR3 - the x86 register holding the current address space's page-table root. - PML4 - the top-level x86-64 page table. - HHDM - Higher-Half Direct Map: all physical memory mapped at a known high virtual base, so the kernel can reach any frame without a temporary mapping.

Buses, devices, and storage

- PCI - the device bus the kernel enumerates. BDF = Bus/Device/Function, a device's address on it. - AHCI - the SATA controller interface the block driver drives. SATA is the disk interface itself. - USB - Universal Serial Bus. xHCI is the USB 3 host controller, EHCI the USB 2 one. - HID - Human Interface Device: the USB class for keyboards and mice. - qTD / QH - EHCI queue Transfer Descriptor and Queue Head: the DMA structures describing a USB transfer and the endpoint queue it belongs to. - NIC - Network Interface Controller. - UART - the serial port hardware behind the console (COM1) and the test control channel (COM2).

Boot, formats, and files

- UEFI / BIOS - the two firmware styles a machine may boot with. ESP = EFI System Partition, the FAT32 partition holding the bootloader. - GPT / MBR - GUID Partition Table and Master Boot Record: the two partition-table formats. - ELF - Executable and Linkable Format: the binary format of the kernel and every service. - GSFS - the GodspeedOS filesystem (GSFS0008). - CRC - Cyclic Redundancy Check: the checksum guarding superblocks, directories, and data blocks.

Networking

- TCP / UDP - the transport protocols. ICMP carries ping. ARP resolves an IP to a MAC. DHCP leases an address; DNS resolves names.

Tooling

- QEMU - the emulator used for development. TCG is its software (no-virtualisation) engine; KVM is hardware-accelerated virtualisation. - SDK - sdk/rust, the crate every service links against. - POSIX - the Unix interface standard GodspeedOS deliberately does not implement (section 2.2, Appendix B.3).

Buses and devices

- PCIe - PCI Express. Electrically different, same configuration model, so the same class-code lookup finds a device on either. The Pi 4 reaches its USB controller this way. - BDF - Bus/Device/Function: the three numbers that name one device on a PCI bus, packed here as (bus << 8) | (dev << 3) | func. It is an identifier, not an address - the kernel reads that device's own registers to learn what it is worth. - BAR - Base Address Register. Where a device's registers live in memory. Which BAR holds them is a property of the device, not its class: an xHCI uses BAR0, an AHCI controller uses BAR5. - SMMU - the ARM name for an IOMMU. Neither Raspberry Pi wires one up, which is recorded rather than glossed over. - INTx - the legacy PCI interrupt pin. Routed through the IOAPIC and, on this hardware, deliverable only to the boot processor - which is why the EHCI driver is pinned to core 0. - SoC - System on Chip. A controller soldered into the processor package rather than sitting on a bus, so no scan can find it: the Pi 4's ethernet is one, and is asked about separately.

Storage

- SATA - the drive attachment the T630 and Wyse boot from. - SSD - solid-state drive. - LBA - Logical Block Address: which 512-byte sector, counted from zero. The unit of the block protocol between fs and block-driver. - PIO - Programmed I/O: moving data through CPU register reads and writes instead of DMA. Slower, and needs no DMA authority at all. - MSC - USB Mass Storage Class: how a USB stick presents itself, driven over BOT. - BOT - Bulk-Only Transport: the command wrapper (CBW), data, status (CSW) sequence that carries SCSI commands over USB bulk endpoints. - SCSI - the command set inside those wrappers (READ(10), WRITE(10), INQUIRY).

USB

- xHCI - the USB 3 host controller interface. Class code 0x0C0330 everywhere, forever, which is what lets a driver name its device without the kernel being taught what one is. - EHCI - the USB 2 host controller interface (0x0C0320). Present on the T630, absent on the Wyse - both cases are exercised. - DWC2 - the DesignWare USB 2 controller in the Raspberry Pi 2. One controller carrying the keyboard, the disk and the network at once. - TRB - Transfer Request Block: one 16-byte entry on an xHCI ring - a command, a data stage, or a completion event. A completion event carries the address of the TRB it completes, which is what lets a reply be matched to the request that asked for it rather than merely to the same slot. - PHY - the physical-layer chip that actually drives the wire, addressed through MDIO. - MDIO - the two-wire management bus used to read and write PHY registers.

Serial, display, and boot

- PL011 - the ARM UART on both Raspberry Pis. On the Pi 4 the firmware routes it to Bluetooth unless dtoverlay=disable-bt says otherwise, which is why that line is in the boot config. - FIFO - the small hardware queue in front of a device, 16 bytes deep on the PL011. Writing past a full one drops bytes, so every write polls first. - ANSI / CSI - the escape sequences a terminal interprets for colour and cursor movement. Handled by the console service; the kernel's boot floor discards them deliberately. - ESP - EFI System Partition: the FAT partition UEFI firmware loads a bootloader from. - BSP / AP - Bootstrap Processor and Application Processor: the core that starts first, and every other core it then brings up. - EL0 / EL1 - AArch64 exception levels: user code and kernel code respectively.

Networking

- MAC - the six-byte hardware address of a network interface. - IP - Internet Protocol: the addressing net-stack routes on, alongside the TCP and UDP transports it speaks. - ARP - Address Resolution Protocol: finds the MAC address for an IP address. - ICMP - the protocol ping uses. - DHCP - how the machine is given an address when it comes up. - DNS - name resolution. - SNTP - the time protocol the clock is set from on a machine with no RTC. - RX / TX - receive and transmit, the two directions of a network ring.

The system

- IPC - Inter-Process Communication: the message passing that every operation in this system crosses. Synchronous, copied by the kernel, bounded queues, and always under a capability. - TCB - Trusted Computing Base: the parts whose compromise compromises everything. Here it is the kernel alone, plus DMA-capable drivers on a machine with no IOMMU. - ABI - the calling convention a service and the kernel agree on at the syscall boundary. - API - the operations one component offers another. - CPU / RAM - processor and memory.