Support Matrix
Lambda OS runs on five targets. Not every capability exists on every one of them. This page says which.
| Done | It works. Real silicon or emulator: see the last table |
| Planned | The design is settled and it is on the remaining-work list |
| Per target | There is no generic implementation. We write it for your hardware as part of an engagement — this is a bare-metal OS, so the driver for your board has to be written |
| No | Not planned: a deliberate non-goal, something that belongs in a different role, or a limit of the chip |
Node roles
In a distributed actor system, nodes have roles. "No" in the MCU columns does not mean "not done yet."
- An orchestrator node (x86_64, riscv64, aarch64) — holding many actors. Dynamic spawn, supervision and a local name registry earn their keep here, because there are enough actors for indices to become fragile.
- An edge node (an MMU-less MCU) — one or two actors, coordinating over the network. Putting the machinery for managing many actors on a chip this small is the very thing distributed actors exist to avoid.
Isolation
| x86_64 | riscv64 | aarch64 | RV32 MMU-less | ARMv6-M MMU-less | |
|---|---|---|---|---|---|
| Actor runs unprivileged | Done ring 3 | Done U-mode | Done EL0 | Done U-mode | Done ¹ |
| One syscall gate to the kernel | Done int 0x80 | Done ecall | Done svc | Done ecall | Done svc ¹ |
| Actor cannot reach another actor's memory | Done address space per actor | Done address space per actor | Done address space per actor | Done PMP region per actor | Done MPU region per actor ¹ |
| A boot probe proves it | Done #PF | Done store fault | Done EL0 fault | Done store fault | Done HardFault |
| Actor cannot reach the kernel's memory either | Done ³ | Done | Done | Planned ⁴ | Planned ⁴ |
| FP state saved across a preempt | Done FXSAVE | Planned ⁵ | Planned ⁵ | Done if the chip has an FPU | No no FPU |
| Isolation that holds against hostile bytecode | No ⁶ | No ⁶ | No ⁶ | No ⁶ | No ⁶ |
¹ In the images that carry confined actors. On the Cortex-M0+, isolation, Wi-Fi and distribution fit in one image (measured at 208 KB of 256 KB), and so do the control loop and confined actors. See The Cortex-M0+ images below. ³ All three MMU targets now keep the actor layer's shared bookkeeping — the name registry, the pid→context table, the lock words — in kernel memory, reachable from the FFI (ring 0) but not from ring 3. The VM's per-core run-state block is likewise confined: an actor is pinned to one core, so its address space grants exactly that core's block and denies the rest. ⁴ On the real-silicon MMU-less parts (the RP2350's NAPOT-only PMP, the RP2040's few MPU regions) the region count is too small for deny-by-default, so the confinement grants broadly then denies the sibling. An actor cannot reach a sibling, but it can still reach the kernel's bookkeeping. (The bare-RV32 QEMU build's TOR-based PMP is deny-by-default.) Deny-by-default on the silicon parts is remaining work. ⁵ The hooks are stubs today. Safe for as long as no task holds live floating-point across a preemption, which is the case now. ⁶ A deliberate non-goal. All bytecode arrives from the operator's own compiler over a trusted channel. Isolation here is a robustness boundary — it contains a bug — not a multi-tenancy boundary.
Scheduling and real-time
| x86_64 | riscv64 | aarch64 | RV32 | ARMv6-M | |
|---|---|---|---|---|---|
| Preemptive fixed-priority scheduler, tasks pinned to a core | Done | Done | Done | Done | Done |
| RTOS primitives (priority inheritance, bounded timed wait, deadline-miss, CPU accounting, CPU reservation, watchdog, RM analysis) | Done | Done | Done | Done the deadline set ⁷ | Planned ⁷ |
| Deadline timer: the clock is in ns, the timer is armed at the next event | Done | Done | Done | Done | Done |
| An RM-schedulable set meets every deadline, scheduler in the loop | Done | Done | Done | Done on silicon | Planned ⁷ |
| The real control law as a scheduled 1 kHz task, meeting its deadlines | — | — | — | Done on silicon ⁹ | Done on silicon ⁹ |
| Multi-core | Done up to 4 (ACPI MADT) | Done SBI HSM | Done PSCI CPU_ON | Done 2 cores | Done 2 cores |
| Sub-µs busy-wait | Done | Done | Done | Planned ⁷ | No ¹⁰ |
| Instruction-count watchdog on a VM frame | Done | Done | Done | Done | Done |
⁷ The primitives are arch-neutral code in the scheduler and compile into every target. x86_64, riscv64 and aarch64 start and run the whole set. The RP2350 starts the deadline-satisfaction pair — its task table is capped at 8 and the full set wants 12. The RP2040 starts none of them.
⁸ All five targets bring up their secondary cores — INIT-SIPI-SIPI on x86, an SBI HSM hart_start on riscv64, a PSCI CPU_ON on aarch64, the SIO FIFO handshake on both Picos (the RP2350's verified on real silicon).
⁹ control() — the soft-float cascade-PID plus quaternion — runs as a scheduled task on one core at 1 kHz while the other runs the network. RP2350: 0 misses in 1,741,824 jobs (period 948.9–1056.5 µs), a full delivery flight with the mission running. RP2040: 0 misses in 113,664 jobs (period 998–1002 µs) — a measurement build without the VM mission, since a 264 KB chip cannot hold both; its ±2 µs is the 1 µs timer's resolution floor, not jitter.
¹⁰ The RP2040's counter is a microsecond TIMER. A limit of the chip: the floor is 1 µs.
Actors
| x86_64 | riscv64 | aarch64 | RV32 | ARMv6-M | |
|---|---|---|---|---|---|
Typed mailbox (send / recv / msg_from / msg_a / msg_b) | Done | Done | Done | Done | Done |
msg_tag | Done | Done | Done | Planned | Planned |
send_remote — address an actor on another machine | Done | Done | Done | Done | Done ¹¹ |
Dynamic spawn (an orchestrator mechanism) | Done | Done | Done | No ¹² | No ¹² |
Supervision — monitor → MSG_DOWN → re-spawn (an orchestrator mechanism) | Done | Done | Done | No ¹² | No ¹² |
Local name registry (register_name / whereis) | Done | No ¹³ | No ¹³ | No ¹³ | No ¹³ |
(node, pid) addressing (node_ip / send_node / reply_node) | Done | Planned | Planned | Planned | Planned |
| Bidirectional buffer ABI (pointers across the FFI) | Planned | Done TCP + files | Done files only | Planned | Planned |
| Frame-skip fault recovery (how an edge node recovers) | — | — | — | Done ¹⁴ | Done ¹⁴ |
| Cross-node supervision and re-provisioning (how an edge node recovers) | Planned ¹⁴ | Planned ¹⁴ | Planned ¹⁴ | Planned ¹⁴ | Planned ¹⁴ |
| Distributed name registry (name → node, pid) | Planned ¹⁵ | Planned ¹⁵ | Planned ¹⁵ | Planned ¹⁵ | Planned ¹⁵ |
| Hot code upgrade (swap a running actor's code) | No ¹⁶ | No ¹⁶ | No ¹⁶ | No ¹⁶ | No ¹⁶ |
| GC, closures, dynamic typing | No | No | No | No | No |
¹¹ Live in the node image (isolation + radio + distribution). In an image built without the radio the FFI is registered but has nowhere to send.
¹² Deliberately absent. Dynamic spawn and supervision are machinery for holding and managing many actors on one chip. An edge node holds one or two and coordinates over the network.
¹³ Deliberately absent. This is a local name → task-index registry: it removes the fragility of "the consumer is always index 1" on a node with many actors. On a two-actor edge node, self() already says which role you are. What distribution needs is not this but the distributed registry below.
¹⁴ Recovery matched to an edge node. Not an orchestrator's supervision (dynamic spawn). A runaway frame is unwound by the VM's watchdog; a frame that takes a hardware fault is skipped by the kernel, which keeps the actor's progress and resumes at the next frame. Verified on real silicon: a fault injected mid-flight did not down the drone. Cross-node supervision is not implemented.
¹⁵ Actors are addressed today by (node_ip, pid) on a well-known port. A registry that resolves which node an actor lives on is a different mechanism, and porting the local registry would not provide it.
¹⁶ Bytecode is replaced at boot (below). Swapping code in a running actor is not planned.
Networking and storage
| x86_64 | riscv64 | aarch64 | RV32 | ARMv6-M | |
|---|---|---|---|---|---|
| The same network stack (Ethernet → DNS, TCP client + server) | Done | Done | Done | Done over Wi-Fi ¹⁷ | Done over Wi-Fi ¹⁷ |
| NIC driver | Done e1000 | Done virtio-net | Done virtio-net | Done CYW43439 | Done CYW43439 |
| Interrupt-driven receive | Done | Planned ¹⁸ | Planned ¹⁸ | No ¹⁹ | No ¹⁹ |
| TCP: retransmit, congestion control, fast retransmit, SACK, 3 connections | Done ²⁰ | Done ²⁰ | Done ²⁰ | Done ²⁰ | Done ²⁰ |
| Checksum verified on receive (UDP / TCP) | Done ²¹ | Done ²¹ | Done ²¹ | Done ²¹ | Done ²¹ |
| Cross-machine actor messages | Done | Done | Done | Done ¹⁷ | Done ¹⁷ |
| Block device + filesystem surviving reboot | Planned | Done virtio-blk | Done virtio-blk | Per target | Per target |
| Bytecode delivered at boot (not baked in) | Done UART + TFTP ²² | Done UART | Done UART | Planned | Planned |
¹⁷ On real silicon. On both the Pico W (RP2040) and the Pico 2 W (RP2350) the network stack runs as a privileged task beside unprivileged, hardware-confined actors — all of it in one image.
¹⁸ The drivers have an interrupt hook, but nothing routes the interrupt controller to it. The network task polls the card.
¹⁹ The CYW43439 has no receive interrupt wired to the CPU. A limit of the chip: its frames come off the bus when the driver asks for them.
²⁰ Three simultaneous connections, each with its own sequence state, retransmit queue and windows, demultiplexed on the full 4-tuple (RFC 793). Congestion control is per-connection cwnd/ssthresh with slow start; three duplicate acknowledgements trigger fast retransmit; SACK is negotiated both ways so out-of-order arrivals are held rather than discarded. Window scaling is offered, and this end advertises a shift of zero — it keeps no large receive buffer. Retransmit timer 400 ms doubling to a 3 s cap; a connection silent for 20 s is torn down.
²¹ Both TCP and UDP checksums are computed on send over the pseudo-header and verified on receive — a TCP segment that does not clear is dropped, and a UDP datagram is checked whenever the sender supplied one (a zero field means "omitted", which IPv4 permits). The IPv4 header and ICMP checksums are verified too.
²² The TFTP fetch is gated on QEMU's fw_cfg device and does not fire on real x86 hardware.
The Cortex-M0+ images
Isolation, Wi-Fi and distribution fit in one image. Measured at 208 KB of 256 KB, with 48 KB to spare. The kernel ends at 107 KB, under the 128 KB the MPU split needs. The radio's 224 KB firmware streams from flash straight into the chip and never sits in the host's SRAM.
| Node (isolation + radio + distribution) | Flight control (mission actor) | |
|---|---|---|
| Mission unprivileged, MPU-confined | Done | Done ²³ |
| Network stack over Wi-Fi | Done | Done the HIL link |
| Cross-machine actor messages | Done | — |
| Native cascade-PID control loop and safety envelope | — | Done, in the kernel |
²³ The mission — the uploaded, per-job flight plan — is the one Lambda C actor, unprivileged and hardware-confined, on both the RP2040 (MPU) and the RP2350 (PMP). The safety envelope and the control loop are native, in the kernel, so a buggy mission cannot reach them at all — stronger than actor-vs-actor isolation. The mission is not spawned until the boundary is demonstrated: a pre-flight check attempts an unprivileged store into kernel memory, and if the hardware does not refuse it the board aborts and never arms the mission. When every check is READY the board holds until a human authorises launch. Both boards flew a full delivery mission over Wi-Fi on real silicon against a hardware-in-the-loop simulator.
Real silicon vs emulation
| Target | Real hardware | Emulator |
|---|---|---|
| x86_64 | Done AMD Ryzen laptop, real UEFI firmware, 4 cores | QEMU |
| RV32 (MMU-less) | Done Raspberry Pi Pico 2 / Pico 2 W (RP2350, RISC-V, soft-float) | QEMU |
| ARMv6-M (MMU-less) | Done Raspberry Pi Pico W (RP2040) | no QEMU path |
| riscv64 | not yet | QEMU |
| aarch64 | not yet | QEMU |
The measured numbers — the 1 kHz deadline record, and the control law's WCET (190 µs on the Cortex-M0+, 98 µs on the Hazard3) — come from the real-hardware rows. Everything on the emulated rows proves a mechanism, not a timing.