The helix-core crate is the central nervous system of the kernel. It contains 21 source files organized into 10 modules totaling approximately 2,800 lines of Rust code.
core/src/ — Module Map 16N · 15E ▶ core/src/ 21 source files, 10 … 15 lib.rs Re-exports, KernelSt… 1 config.rs BootConfiguration — … 1 component.rs KernelComponent trai… 1 orchestrator.rs KernelOrchestrator —… 1 subsystem.rs Subsystem trait — in… 1 lifecycle.rs LifecycleManager, Sh… 1 capability.rs CapabilityBroker — g… 1 resource.rs ResourceBroker — all… 1 ipc/ IPC module — 4 files 1 syscall/ Syscall module — 4 f… 1 interrupts.rs InterruptDispatcher,… 1 hot_reload.rs HotReloadRegistry, H… 1 self_heal.rs SelfHealingManager —… 1 debug.rs ConsoleWriter, kprin… 1 panic.rs PanicHandler trait, … 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
The root lib.rs defines the fundamental types that every other module depends on:
The kernel state machine governs what operations are valid at any given time:
Kernel State Machine 6N · 7E suspend resume fatal fatal ▶ Boot Firmware handoff 1 Initializing Subsystems starting … 3 Running Normal operation — s… 4 ■ ShuttingDown Graceful shutdown 1 ■ Panic Unrecoverable fault … 2 Suspended Low-power state (fut… 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
EarlyBoot = 0 , // Firmware just handed control
Initializing = 1 , // Subsystems starting up
Running = 2 , // Normal operation — syscalls active
ShuttingDown = 3 , // Graceful shutdown in progress
Panic = 4 , // Unrecoverable fault — halt or reboot
Suspended = 5 , // Low-power state (future)
State transitions are managed exclusively by KernelOrchestrator. Invalid transitions (e.g., Panic → Running) are rejected at runtime.
pub struct KernelVersion {
pub suffix : & 'static str , // "alpha" for 0.1.0-alpha
pub const KERNEL_VERSION : KernelVersion = KernelVersion {
major : 0 , minor : 1 , patch : 0 , suffix : "alpha" ,
Index KernelVersion KERNEL_VERSION
A unified error type for all core operations:
CapabilityError ( CapabilityError ) ,
SubsystemError ( & 'static str ) ,
Events emitted during kernel lifecycle changes:
ModuleLoaded { name : String } ,
ModuleUnloaded { name : String } ,
StateChanged { old : KernelState , new : KernelState } ,
MemoryPressure { level : MemoryPressureLevel } ,
CpuHotplug { cpu : usize , online : bool } ,
TimerTick { timestamp : u64 } ,
Custom { id : u64 , data : Vec < u8 > } ,
Every major kernel component implements this trait to participate in the lifecycle:
pub trait KernelComponent : Send + Sync {
/// Unique name for logging and debugging
fn name ( & self ) -> & 'static str ;
/// Semantic version of this component
fn version ( & self ) -> & 'static str ;
/// Initialize the component. Called once during boot.
fn init ( & mut self ) -> KernelResult < ( ) > ;
/// Shut down the component gracefully.
fn shutdown ( & mut self ) -> KernelResult < ( ) > ;
/// Check if the component is healthy.
fn health_check ( & self ) -> bool { true }
/// Get component statistics.
fn stats ( & self ) -> Option < ComponentStats > { None }
Index KernelComponent name version init shutdown health_check stats
pub struct ComponentStats {
The self-healing system periodically calls health_check() on every registered component and triggers recovery actions for Unhealthy components.
The KernelOrchestrator is the kernel's central coordinator. It manages subsystem registration, initialization ordering, and lifecycle transitions.
impl KernelOrchestrator {
/// Register a subsystem with its metadata.
/// Dependencies are declared as subsystem names.
pub fn register ( & mut self , subsystem : Box < dyn Subsystem > ) -> Result < SubsystemId > ;
/// Initialize all registered subsystems in dependency order.
/// Uses topological sort to resolve initialization sequence.
pub fn init_all ( & mut self ) -> Result < ( ) > ;
/// Shut down all subsystems in reverse initialization order.
pub fn shutdown_all ( & mut self ) -> Result < ( ) > ;
Index KernelOrchestrator register init_all shutdown_all
Build a dependency graph from all registered subsystems
Perform topological sort to determine initialization order
Detect cycles — if found, return KernelError::DependencyCycle
Initialize subsystems in sorted order, passing the BootConfiguration
If any subsystem fails, attempt recovery via self-heal
If recovery fails, shut down already-initialized subsystems in reverse order
Every subsystem implements this trait:
pub trait Subsystem : Send + Sync {
fn name ( & self ) -> & 'static str ;
fn version ( & self ) -> & 'static str ;
fn dependencies ( & self ) -> & [ & 'static str ] { & [ ] }
fn init ( & self ) -> KernelResult < ( ) > ;
fn shutdown ( & self ) -> KernelResult < ( ) > ;
/// Suspend/resume for power management.
fn suspend ( & self ) -> KernelResult < ( ) > { Ok ( ( ) ) }
fn resume ( & self ) -> KernelResult < ( ) > { Ok ( ( ) ) }
/// Health monitoring — called periodically by self-heal.
fn is_healthy ( & self ) -> bool { true }
Index Subsystem name version dependencies init shutdown suspend resume is_healthy
The boot configuration is built from bootloader-provided data and passed to every subsystem during init:
pub struct BootConfiguration {
pub command_line : String ,
pub memory_map : Vec < MemoryMapEntry > ,
pub boot_modules : Vec < BootModule > ,
The syscall framework provides a structured path from userspace into kernel services.
Syscall Architecture — Pipeline 6N · 5E int 0x80 validated dispatch Result<usize> sysretq ▶ User Process syscall instruction 1 SyscallGateway helix_syscall_entry(… 2 SyscallDispatcher dispatch(number, arg… 2 SyscallHandler handle(args) → Resul… 2 Return Path Post-hooks + result 2 ■ User Resumes sysretq 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
The registry holds up to 512 syscall handlers :
pub struct SyscallRegistry {
handlers : [ Option < Box < dyn SyscallHandler >> ; 512 ] ,
names : [ Option < & 'static str > ; 512 ] ,
pub fn register ( & mut self , number : u16 , name : & 'static str ,
handler : Box < dyn SyscallHandler > ) -> Result < ( ) > ;
pub fn unregister ( & mut self , number : u16 ) -> Result < ( ) > ;
pub fn lookup ( & self , number : u16 ) -> Option < & dyn SyscallHandler > ;
Index SyscallRegistry SyscallRegistry register unregister lookup
pub trait SyscallHandler : Send + Sync {
fn handle ( & self , args : & SyscallArgs ) -> SyscallReturn ;
fn name ( & self ) -> & 'static str ;
fn arg_count ( & self ) -> usize ;
fn validate ( & self , _args : & SyscallArgs ) -> Result < ( ) , SyscallError > {
pub args : [ u64 ; MAX_SYSCALL_ARGS ] , // up to 6 register args
Index SyscallHandler handle name arg_count validate SyscallArgs
POSIX-compatible error codes:
The dispatcher supports pre-hooks and post-hooks for cross-cutting concerns:
pub fn add_pre_hook ( & mut self , hook : Box < dyn SyscallHook > ) ;
pub fn add_post_hook ( & mut self , hook : Box < dyn SyscallHook > ) ;
Index SyscallDispatcher add_pre_hook add_post_hook
Typical hooks include:
SecurityHook — checks caller capabilities before dispatch
AuditHook — logs all syscall invocations for debugging
MetricsHook — collects timing and frequency statistics
The Inter-Process Communication module provides four complementary communication primitives:
▶ IPC Module 4 communication prim… 4 Channels MPSC ring buffer 1 OneShot Single-use channel 1 EventBus Pub/Sub broadcasting 1 MessageRouter Point-to-Point RPC 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
The primary IPC mechanism is a lock-free multi-producer, single-consumer channel built on a ring buffer:
pub fn channel < T : Send > ( capacity : usize ) -> ( Sender < T > , Receiver < T > ) ;
impl < T : Send > Sender < T > {
pub fn send ( & self , item : T ) -> IpcResult < ( ) > ;
pub fn try_send ( & self , item : T ) -> IpcResult < ( ) > ;
pub fn is_closed ( & self ) -> bool ;
impl < T : Send > Receiver < T > {
pub fn try_recv ( & self ) -> IpcResult < T > ;
pub fn drain ( & self ) -> Vec < T > ;
pub fn is_empty ( & self ) -> bool ;
Index channel Sender send try_send is_closed Receiver try_recv drain is_empty
The Sender<T> is cloneable (multi-producer). The Receiver<T> is not (single-consumer). When the last sender drops, the channel closes automatically.
For request-response patterns where exactly one value is exchanged:
pub fn oneshot < T : Send > ( ) -> ( OneShotSender < T > , OneShotReceiver < T > ) ;
The sender can only send() once. The receiver can only recv() once. Both types are !Clone.
A topic-based publish-subscribe system for broadcasting events to multiple subscribers:
pub struct EventBus { /* ... */ }
pub fn subscribe ( & mut self , sub : EventSubscription ) -> SubscriptionId ;
pub fn publish ( & self , event : Event ) -> EventDispatchResult ;
pub fn unsubscribe ( & mut self , id : SubscriptionId ) ;
pub struct EventSubscription {
pub topics : Vec < EventTopic > ,
pub callback : Box < dyn Fn ( & Event ) -> EventResponse + Send + Sync > ,
Tick , Shutdown , MemoryPressure , CpuHotplug ,
Process , Interrupt , Custom ( String ) , All ,
Index EventBus EventBus subscribe publish unsubscribe EventSubscription EventTopic
Common topics:
"kernel.state" — kernel state transitions
"subsystem.health" — health status changes
"module.lifecycle" — module load/unload/reload
"syscall.audit" — syscall invocation log
For direct inter-subsystem communication with named mailboxes:
pub struct MessageRouter { /* ... */ }
pub fn register ( & mut self , addr : ModuleAddress ,
handler : Box < dyn MessageHandler > ) -> IpcResult < ( ) > ;
pub fn send ( & self , to : & ModuleAddress , req : Request ) -> IpcResult < Response > ;
pub fn send_to ( & self , to : & ModuleAddress , msg : MessageEnvelope ) -> IpcResult < ( ) > ;
Index MessageRouter MessageRouter register send send_to ModuleAddress
Each module registers its address during init and receives messages directly. Requests carry a MessagePriority (Low, Normal, High, Critical).
The SelfHealingManager provides automatic fault detection and recovery for kernel subsystems.
Self-Heal — Recovery Architecture 4N · 4E Unhealthy under limit over limit retry cycle ▶ Health Monitor Periodic timer callb… 2 ◆ Recovery Decision Check restart count 3 Factory-Based Recovery Create fresh instanc… 2 ■ Escalation Critical failure 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
pub enum RecoveryAction {
None , // Healthy — no action
Restart , // Restart the module
Failover , // Replace with backup module
Panic , // Unrecoverable — escalate
pub struct SelfHealingManager { /* ... */ }
impl SelfHealingManager {
pub fn register_module ( & self , slot_id : SlotId , name : & str ,
factory : Option < ModuleFactory > ) -> Result < ( ) > ;
pub fn check_health ( & self , slot_id : SlotId ) -> HealthStatus ;
pub fn trigger_recovery ( & self , slot_id : SlotId ) -> RecoveryAction ;
pub fn stats ( & self ) -> RecoveryStats ;
Index HealthStatus RecoveryAction SelfHealingManager SelfHealingManager register_module check_health trigger_recovery stats
Parameter Default Description Max restart attempts 3 Restarts before permanent failure Health check interval 1000 ticks How often to poll health Recovery timeout 5000 ticks Max time for recovery to complete Cooldown period 2000 ticks Min time between restart attempts
The hot-reload system enables replacing module binaries at runtime without losing state.
Hot-Reload — State Machine 8N · 7E failure ▶ Idle Waiting for reload t… 1 Preparing Validate module, che… 2 SavingState module.get_state() 2 Unloading Remove old binary 2 Loading Load new binary, ver… 3 RestoringState module.restore_state… 2 ■ Completed Module resumes 1 ■ RollbackFailed Recovery failed 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
pub trait HotReloadableModule : Send + Sync {
fn name ( & self ) -> & 'static str ;
fn version ( & self ) -> ModuleVersion ;
fn category ( & self ) -> ModuleCategory ;
fn init ( & mut self ) -> Result < ( ) , HotReloadError > ;
fn prepare_unload ( & mut self ) -> Result < ( ) , HotReloadError > ;
/// Export current state for migration
fn export_state ( & self ) -> Option < Box < dyn ModuleState >> ;
/// Import state from previous module
fn import_state ( & mut self , state : & dyn ModuleState ) -> Result < ( ) , HotReloadError > ;
/// Check if module can be safely unloaded now
fn can_unload ( & self ) -> bool ;
Index HotReloadableModule name version category init prepare_unload export_state import_state can_unload
Preparing — Notify dependents, quiesce in-flight operations
SavingState — Call get_state() on the old module instance
Unloading — Remove old binary from memory, update registry
Loading — Load new binary, verify ABI compatibility via AbiChecker
RestoringState — Call restore_state() on the new module instance
Completed — Resume normal operation, notify dependents
The AbiChecker validates that the new module binary is compatible:
pub struct ModuleVersion {
pub major : u16 , // Breaking changes
pub minor : u16 , // New features
pub patch : u16 , // Bug fixes
/// Same major version = compatible
pub fn compatible_with ( & self , other : & Self ) -> bool {
self . major == other . major
Empty , Loading , Active , Unloading , Swapping , Failed ,
Index ModuleVersion ModuleVersion compatible_with SlotStatus
Module Purpose State Preserved RoundRobinSchedulerThread scheduling Run queue, thread priorities PrioritySchedulerPriority-based scheduling Priority queues, statistics
The interrupt subsystem provides a unified interface for hardware and software interrupts across all architectures.
pub type InterruptHandlerFn = dyn Fn ( InterruptVector ) + Send + Sync ;
pub struct InterruptDispatcher {
handlers : RwLock < [ Vec < InterruptHandler > ; 256 ] > ,
impl InterruptDispatcher {
/// Register a handler for a specific vector.
/// If shared=false, no other handlers can be registered.
pub fn register ( & self , vector : InterruptVector , name : & 'static str ,
handler : Arc < InterruptHandlerFn > , shared : bool ) -> Result < ( ) , & 'static str > ;
/// Unregister a handler by name.
pub fn unregister ( & self , vector : InterruptVector , name : & 'static str ) ;
/// Dispatch an interrupt — calls all registered handlers for the vector.
pub fn dispatch ( & self , vector : InterruptVector ) ;
Index InterruptHandlerFn InterruptDispatcher InterruptDispatcher register unregister dispatch
Handles CPU exceptions (divide-by-zero, page fault, general protection fault, etc.):
pub struct ExceptionDispatcher {
pub fn register ( & mut self , exception : ExceptionType ,
handler : Box < dyn ExceptionHandler > ) -> Result < ( ) > ;
pub fn dispatch ( & self , exception : ExceptionType , frame : & ExceptionFrame ) ;
Index ExceptionDispatcher register dispatch
Provides different routing strategies for interrupt distribution across CPUs:
pub enum RoutingStrategy {
FixedCpu ( CpuId ) , // Always route to specific CPU
RoundRobin , // Distribute evenly
LowestPriority , // Route to least-busy CPU
Broadcast , // Send to all CPUs
acknowledged vector lookup Handled Reschedule Panic ▶ Hardware Interrupt IDT / GIC / PLIC 1 HAL Handler Save CPU state, ackn… 2 InterruptDispatcher dispatch(vector, fra… 2 InterruptHandler handle(frame) → Acti… 4 ■ Handled Return to interrupte… 1 ■ Reschedule Trigger context swit… 1 ■ Panic Invoke panic handler 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
The debug module provides kernel-wide logging and diagnostic output.
pub trait ConsoleWriter : Send + Sync {
fn write_byte ( & mut self , byte : u8 ) ;
fn write_string ( & mut self , s : & str ) ;
Index ConsoleWriter write_byte write_string flush
Implementations include:
SerialConsoleWriter — outputs to COM1 (0x3F8) on x86_64
FramebufferConsoleWriter — renders text to the framebuffer
NullConsoleWriter — discards all output (for benchmarks)
// Standard output (always enabled)
kprintln! ( "boot complete" ) ;
kdebug! ( "allocator: free frames = {}" , count ) ;
kinfo! ( "scheduler: thread {} started" , tid ) ;
kwarn! ( "memory: low watermark reached" ) ;
kerror! ( "syscall: invalid number {}" , num ) ;
Each macro includes the source file and line number in debug builds. In release builds, kdebug! is compiled out entirely.
pub struct DebugInterface {
pub fn register_writer ( & mut self , writer : Box < dyn ConsoleWriter > ) ;
pub fn set_log_level ( & mut self , level : LogLevel ) ;
pub fn dump_state ( & self ) ; // Print all registered component states
Index DebugInterface register_writer set_log_level dump_state
When the kernel encounters an unrecoverable error, the panic handler provides structured crash reporting.
pub trait PanicHandler : Send + Sync {
fn handle_panic ( & self , ctx : & PanicContext ) -> PanicAction ;
Index PanicHandler handle_panic
pub struct PanicContext {
pub message : & 'static str ,
pub location : Option < PanicLocation > , // file, line, column
pub backtrace : Option < Backtrace > ,
pub cpu_state : Option < CpuState > ,
pub thread_id : Option < ThreadId > ,
pub kernel_state : KernelState ,
Halt , // HLT loop — stop the CPU entirely
Reboot , // Triple fault or ACPI reboot
DebugBreak , // int3 — break into GDB if attached
Continue , // Attempt to continue (dangerous, debug only)
When a panic occurs, the handler:
Panic Handler Flow 6N · 5E step 1 step 2 step 3 step 4 step 5 ▶ Panic Triggered Unrecoverable fault 1 Disable Interrupts Prevent re-entrant p… 2 Print Message Location, thread, ke… 2 Dump Registers CPU register snapsho… 2 Stack Trace Walk stack frames if… 2 ■ PanicAction Halt / Reboot / Debu… 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
Disables interrupts (prevent re-entrant panics)
Prints the panic message and location to serial console
Dumps CPU register state if available
Prints a stack trace if symbols are available
Executes the chosen PanicAction
Example output:
=== KERNEL PANIC ===
Message: index out of bounds: the len is 5 but the index is 10
Location: core/src/orchestrator.rs:142:25
Thread: kernel_init (tid=1)
State: Initializing
Register Dump:
RAX=0x0000000000000005 RBX=0x000000000000000A
RCX=0xFFFFFFFF80012345 RDX=0x0000000000000000
...
Stack Trace:
#0 core::panicking::panic_bounds_check
#1 helix_core::orchestrator::init_all
#2 helix_minimal_os::kernel_main
#3 _start
Action: Halt
The CapabilityBroker implements capability-based access control for all kernel resources.
Capabilities are fine-grained permissions represented as bitflags:
Capability Broker Flow 7N · 6E request access lookup has permission no permission transfer remove ▶ Subject Process / module req… 1 CapabilityBroker Permission managemen… 4 ◆ check() Verify permission 3 ■ Granted ✓ Access allowed 1 ■ Denied ✗ Access refused 1 delegate() Transfer permissions… 1 revoke() Remove permissions 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
pub struct Permissions : u64 {
// ... up to 64 distinct permissions
Index Permissions ResourceType
/// Grant permissions on a resource to a subject.
pub fn grant ( & mut self , subject : SubjectId , resource : ResourceId ,
permissions : Permissions ) -> Result < ( ) > ;
/// Delegate (subset of) permissions to another subject.
pub fn delegate ( & mut self , from : SubjectId , to : SubjectId ,
resource : ResourceId , permissions : Permissions ) -> Result < ( ) > ;
pub fn revoke ( & mut self , subject : SubjectId , resource : ResourceId ) -> Result < ( ) > ;
/// Check if a subject has the required permissions.
pub fn check ( & self , subject : SubjectId , resource : ResourceId ,
required : Permissions ) -> bool ;
Index CapabilityBroker grant delegate revoke check
The ResourceBroker manages kernel resource allocation and limits.
core/src/resource_broker.rs
Memory , // Physical/virtual memory pages
CpuTime , // Scheduler time slices
FileHandles , // Open file descriptors
Threads , // Thread count per process
NetworkPorts , // Bound network ports
Modules , // Loaded module count
core/src/resource_broker.rs
/// Register a resource provider for a class.
pub fn register_provider ( & mut self , class : ResourceClass ,
provider : Box < dyn ResourceProvider > ) -> Result < ( ) > ;
/// Allocate resources within limits.
pub fn allocate ( & mut self , owner : OwnerId , class : ResourceClass ,
amount : usize ) -> Result < ResourceHandle > ;
/// Release allocated resources.
pub fn release ( & mut self , handle : ResourceHandle ) -> Result < ( ) > ;
/// Set resource limits for an owner.
pub fn set_limit ( & mut self , owner : OwnerId , class : ResourceClass ,
limit : ResourceLimit ) -> Result < ( ) > ;
pub struct ResourceLimit {
pub soft : usize , // Warning threshold
pub hard : usize , // Absolute maximum
Index ResourceBroker register_provider allocate release set_limit ResourceLimit
The LifecycleManager tracks kernel lifecycle phases and notifies registered callbacks on transitions.
▶ Boot Firmware handoff 1 EarlyInit Pre-heap: GDT, IDT, … 2 CoreInit Orchestrator, interr… 2 LateInit Drivers, filesystem,… 2 Running Full system operatio… 2 ShuttingDown Graceful teardown 2 ■ Halted System stopped 1
☝ Drag to pan · 🤏 Pinch to zoom · Tap a node
Ctrl+F Search
P Path
S Stats
F Fullscreen
E Export
Shift+Drag Move node
↑↓ Navigate
+/− Zoom
pub enum LifecyclePhase {
pub enum ShutdownReason {
Index LifecyclePhase ShutdownReason
pub trait LifecycleCallback : Send + Sync {
fn on_phase_enter ( & self , phase : LifecyclePhase ) ;
fn on_phase_exit ( & self , phase : LifecyclePhase ) ;
fn on_shutdown ( & self , reason : ShutdownReason ) ;
pub fn register_callback ( & mut self , callback : Box < dyn LifecycleCallback > ) ;
pub fn transition_to ( & mut self , phase : LifecyclePhase ) -> Result < ( ) > ;
pub fn current_phase ( & self ) -> LifecyclePhase ;
pub fn request_shutdown ( & mut self , reason : ShutdownReason ) ;
Index LifecycleCallback on_phase_enter on_phase_exit on_shutdown LifecycleManager register_callback transition_to current_phase request_shutdown