A hard real-time, preemptive, bare-metal AArch64 open-source operating system for ARMv8-A / Rockchip RK3328. Initial design done for Orange Pi R1 Plus LTS.
OROS is a from-scratch operating system kernel and hardware stack integrating selected open-source industrial components targeting the ARMv8-A (AArch64) architecture. It runs entirely in EL1, is independent of Linux (no glibc, no linux/*.h, no Linux syscalls), and is built with a bare-metal GCC toolchain and newlib. The system implements a critically-partitioned SMP model across the four Cortex-A53 cores, a PLC-style cyclic execution engine for hard real-time tasks, and a full industrial feature set including an EtherCAT master, TCP/IP + SSH, FAT32, and USB host support.
- Overview
- Why OROS?
- Project Scope
- Key Features
- Architecture
- Hardware Target
- Getting Started
- Building
- Running on QEMU
- Running on Hardware
- Documentation
- Project Status Roadmap
- License
OROS is a hard real-time operating system designed for deterministic, industrial-grade control applications. It is written in C (C11), compiled with GCC, and runs bare-metal on the Rockchip RK3328 SoC. The design philosophy is a fully independent bare-metal software stack: the entire kernel, drivers, and services are implemented from scratch, with only newlib providing the standard C library (linked through custom bare-metal stubs). No hidden runtime services or Linux-based components are involved. The system is intentionally minimal: no background services, no hidden policies, and no unnecessary abstractions between the application and the hardware. Because of this design, the source code and APIs remain simple to understand and extend according to application requirements.
The system is organized around a critically-partitioned SMP architecture: each of the four Cortex-A53 cores is statically assigned a scheduling partition with a fixed scheduling role, strict affinity, and no migration. OROS uses SMP hardware initialization, but scheduling is intentionally partitioned and non-migrating, providing deterministic behavior similar to statically partitioned AMP systems, while using SMP hardware initialization. This isolates hard real-time workloads from I/O and best-effort traffic, providing deterministic execution and enabling bounded WCET analysis for hard real-time workloads.
The initial feature set includes a modified EtherLab EtherCAT Master integration (API-compatible with EtherLab IgH 1.6.8), a TCP/IP stack (lwIP) with SSH (wolfSSH/wolfSSL), a unified shell available over UART, telnet, and SSH, FAT32 file system support, and a full USB host stack (xHCI/EHCI/OHCI) with USB-Ethernet and HID keyboard drivers.
Existing RTOS solutions provide excellent portability and ecosystem support. OROS focuses on a different goal: maximum determinism through a fully controlled execution environment on a fixed industrial platform. OROS is designed for hard real-time control applications where timing determinism and measurable latency are primary requirements.
Design choices:
- no dynamic scheduling migration
- no Linux dependency
- static system composition
- direct hardware ownership
- measurable execution behavior
OROS is a research and engineering real-time operating system targeting deterministic industrial control platforms.
It is not intended to replace general-purpose operating systems. The architecture prioritizes timing determinism, static configuration, and direct hardware control over portability and dynamic resource management.
- Hard real-time, preemptive, bare-metal AArch64 (ARMv8-A) running in EL1.
- "Zero Linux" — no glibc, no
linux/*.h, no Linux syscalls; only custom newlib stubs. - Critically-partitioned SMP: 4 cores, each with a dedicated scheduling partition and strict affinity:
- Core 0 —
RT_HARD: dedicated EtherCAT master (permanent cyclic task, timer-driven, no scheduler tick dependency). - Core 1 —
RT_HARD: critical PLC tasks (WCET-oriented execution model). - Core 2 —
IO_SOFT: USB, USB-Ethernet, lwIP, SSH, shell, logs. - Core 3 —
RT_SOFT: soft real-time periodic tasks.
- Core 0 —
- PLC-style cyclic execution engine: fixed-period scan cycle, run-to-completion, overrun detection.
- Lock-free inter-core logging: per-core ring buffers drained by Core 2.
- EtherCAT master ( Modified derivative work based on EtherLab EtherCAT Master 1.6.8,
ecrt_*API compatible with IgH 1.6.8): ESM INIT→PREOP→SAFEOP→OP, cyclic PDO (LRW), SII/EEPROM SyncManager configuration. - Two separate network planes:
- Native GMAC (DWMAC 1000 + Motorcomm YT8531C PHY) → dedicated EtherCAT L2 (raw, EtherType 0x88A4).
- USB-Ethernet RTL8153B (USB 2.0) → TCP/IP + SSH (lwIP + wolfSSH).
- Unified shell: same command interpreter over UART console, telnet:23, and SSH:22.
- USB host stack: xHCI/DWC3 (USB3), EHCI/OHCI (USB2), RTL8153B USB-Ethernet, HID keyboard.
- FAT32 file system (FatFs R0.15) on micro-SD (DesignWare MSHC).
- GPIO, UART (interrupt-driven RX), SDMMC drivers.
- PMU-based WCET instrumentation.
- Static task loading: adding a task = write the routine + recompile.
The software is organized in layers:
┌──────────────────────────────────────────────────────────────┐
│ Application tasks (statically compiled into the image) │
├──────────────────────────────────────────────────────────────┤
│ Services: Shell CLI (UART/TCP/SSH) │ SSH server │ FAT32 │
│ │ EtherCAT master │ network apps │
├───────────────┬───────────────┬──────────────┬───────────────┤
│ TCP/IP (lwIP)│ FS (FatFs) │ EtherCAT │ USB HID │
├───────────────┴───────────────┴──────────────┴───────────────┤
│ Drivers: GMAC │ SDMMC │ GPIO │ UART │ USB host (xHCI/EHCI/ │
│ OHCI) + RTL8153B │
├──────────────────────────────────────────────────────────────┤
│ RTOS kernel: per-partition scheduler, threads, mailbox, │
│ spinlocks, mutex (PI), semaphores, PLC, klog │
├──────────────────────────────────────────────────────────────┤
│ AArch64 HAL: boot (start.S), MMU, caches, GIC-400, │
│ exceptions/vectors, generic timer, context │
│ switch, PMU, SMP boot (PSCI) │
├──────────────────────────────────────────────────────────────┤
│ Newlib + bare-metal stubs (_sbrk, _write→UART, ...) │
└──────────────────────────────────────────────────────────────┘
- Per-core run queues with fixed priorities (0 = highest) and round-robin at equal priority.
- Preemption on timer tick or IPI reschedule;
thread_yield()for voluntary yield. - Hard-RT cores (0/1) follow a PLC scan cycle at a fixed period: read inputs → execute logic → write outputs → wait for next tick. Run-to-completion within a cycle, with overrun detection.
- Core 0 runs the permanent EtherCAT master cycle (Generic Timer, absolute cadence, GMAC polling with RX IRQ disabled) — the most deterministic configuration.
- Core 2 runs the I/O loop: lwIP polling, telnet:23, SSH:22, UART console, and log draining.
- Inter-core communication: lock-free SPSC mailboxes + IPI notification, shared
ecat_diagsnapshot, priority-inheritance mutexes.
- MMU: identity mapping (VA==PA). RAM in Normal, Inner-Shareable, Write-Back; MMIO in Device-nGnRE.
- Cache coherence: lock-free structures use Inner-Shareable memory + barriers; DMA buffers use explicit
dc cvac/dc ivac; secondary-core stacks published at the Point of Coherency before PSCI CPU_ON.
| Component | Detail |
|---|---|
| SoC | Rockchip RK3328 |
| CPU | 4× ARM Cortex-A53 (ARMv8-A, AArch64), ~600 MHz (measured/calibrated) |
| Interrupt controller | GIC-400 |
| Timer | ARM Generic Timer (CNTP) |
| PMU | Performance Monitoring Unit (cycle counter) |
| RAM | 1 GiB DDR4 |
| Board | Orange Pi R1 Plus LTS |
| Network port 1 | Native GMAC (Synopsys DWMAC 1000) + Motorcomm YT8531C PHY (rgmii-id) → EtherCAT master |
| Network port 2 | USB-Ethernet RTL8153B (USB 2.0) → TCP/IP + SSH |
| USB | xHCI/DWC3 USB3 (RTL8153B), EHCI/OHCI USB2 (HID keyboard) |
| Storage | micro-SD (DesignWare MSHC) + FAT32 |
| Console | UART (DesignWare 8250) |
| Boot | Rockchip ROM → SPL/DDR → U-Boot → OS image from SD |
- Arm GNU Toolchain
arm-gnu-toolchain-13.3.rel1-x86_64-aarch64-none-elf(bare-metal + newlib, prefixaarch64-none-elf-). Notaarch64-linux-gnu.- Download: https://developer.arm.com/-/media/Files/downloads/gnu/13.3.rel1/binrel/arm-gnu-toolchain-13.3.rel1-x86_64-aarch64-none-elf.tar.xz
- Install (e.g. Fedora):
cd ~/Downloads tar -xf arm-gnu-toolchain-*-aarch64-none-elf.tar.xz sudo mv arm-gnu-toolchain-*-aarch64-none-elf /opt/aarch64-none-elf echo 'export PATH=/opt/aarch64-none-elf/bin:$PATH' >> ~/.bashrc source ~/.bashrc aarch64-none-elf-gcc --version
- GNU Make (build orchestration).
- Optional:
qemu-system-aarch64(QEMU testing),u-boot-tools(mkimagefor U-Boot image).
The following upstream components are vendored in the repository (.git removed) — no network access is needed at build time:
| Component | Version | License | Role |
|---|---|---|---|
| newlib | 4.4.0 (from toolchain) | Various permissives licenses | Bare-metal libc |
| FatFs (ChaN) | R0.15 | BSD-like | FAT32 file system |
| lwIP | 2.2.1 | BSD | TCP/IP stack (NO_SYS=1) |
| wolfSSL / wolfCrypt | 5.9.2 | GPLv3 / commercial | SSH crypto |
| wolfSSH | 1.5.0 | GPLv3 / commercial | SSH server |
| EtherCAT master | Modified derivative work based on EtherLab EtherCAT Master 1.6.8 (ecrt_* API compatible with IgH 1.6.8 ) |
GPLv2 | EtherCAT master (ESM/PDO) |
License note: The final firmware image may contain statically linked GPL-covered components. Their respective licenses remain applicable to those components. For a proprietary product, a commercial license from wolfSSL (and IgH) is required, or these components must be isolated. lwIP and FatFs are BSD (no copyleft constraint). U-Boot (GPL) remains an external bootloader and does not affect the OS license.
make # build for the board (UART DW8250, GIC RK3328, PSCI SMC/ATF)
make qemu # build + run in QEMU virt (PL011, GIC QEMU, PSCI HVC)
make uimage # build a U-Boot image (uImage)
make clean # clean build/If your toolchain has a different prefix:
make CROSS=aarch64-elf- # or
make CROSS=aarch64-linux-gnu-Outputs: build/kernel.elf, build/kernel.bin, build/kernel.map.
make qemuExpected console output (summary):
OROS - Phase 1 : kernel + RT
[boot] EL2, MMU on, vecteurs on
[timer] frequency = ... Hz
[testA] OK : 5 ticks received
[testB] cycles=2000 overruns=0
[testC] starting preemptive scheduler...
[ts c0] thread A count=...
[ts c0] thread B count=...
QEMU uses a PL011 UART (
-DUART_PL011) and RAM at0x40000000. The MMIO drivers for RK3328 hardware (GPIO/SDMMC/USB/GMAC/EtherCAT/network) are neutralized under-DMMU_QEMUsince the hardware is absent. QEMU boots in EL1 and the demo auto-shuts down via PSCI SYSTEM_OFF.
- USB-UART 3.3 V adapter on the board's serial header (UART2).
- On the PC:
sudo dnf install -y tio # or 'picocom' / 'screen' tio /dev/ttyUSB0 -b 112500 # RK3328 U-Boot: often 1500000 baud by default, change to 112500 if adapter cannot manage high baud
The SD card must already have a working U-Boot (standard Armbian/official image/or follow my repo: u-boot-aarch64-none-elf). Copy build/kernel.bin to the boot partition (usually FAT):
cp build/kernel.bin /run/media/$USER/<boot-partition>/
syncInterrupt autoboot (any key), then at the => prompt:
fatload mmc 1:1 0x00200000 kernel.bin
go 0x00200000
gojumps directly to the raw binary. Ifgofails (CPU state), use the U-Boot image variant below.
make uimage # -> build/uImageCopy build/uImage to the SD, then in U-Boot:
fatload mmc 1:1 0x00200000 uImage
bootm 0x00200000
| Document | Description |
|---|---|
ARCHITECTURE.md |
Architecture document: layered view, boot pipeline, execution/scheduling model, memory model, diagrams. |
API.md |
Programming reference: public functions, signatures, call constraints, config macros, "add a task" procedure. |
All phases 0 → 8 are validated on hardware (board). The actual initial build is complete. Order of development phases done and tested.
| Phase | Description | Status |
|---|---|---|
| 0 | Environment & bring-up (UART, newlib) | ✅ Validated (QEMU + board) |
| 1 | Single-core kernel (MMU, GIC, timer, scheduler, PLC, logging) | ✅ Validated (QEMU + board) |
| 2 | SMP 4-core partitioned + RT primitives | ✅ Validated (QEMU + board) |
| 3 | GPIO, UART RX, SDMMC | ✅ Validated (board) |
| 4 | FAT32 (FatFs) | ✅ Validated (board) |
| 5 | USB host (xHCI/EHCI/OHCI) + RTL8153B + HID keyboard | ✅ Validated (board) |
| 6 | GMAC L2 + EtherCAT master | ✅ Validated (board) |
| 7 | lwIP + TCP shell + SSH | ✅ Validated (board) |
| 8 | Unified shell + WCET campaign | ✅ Validated (board) |
The WCET campaign measured the EtherCAT cycle on Core 0 under various load scenarios on Core 2 (idle, ping flood, telnet, SSH, combined). CPU calibrated at 600 MHz. The EtherCAT master was used to toggle the outputs of an AMSAMOTION EC1A-IO16R (Hardware version 0.1, Software version 0.1 (but ESI file tells revision number : 0x00010001. Label on device tells : v1.1), the same slave from my repo YAEMAA, at 0.5 hz (1s ON / 1s OFF) and reading the inputs.
| EtherCAT period | Max processing (cycle load) | Overruns | Wake-up jitter |
|---|---|---|---|
| 1000 µs | 27.8 → 32.6 µs (2.7–3.2 %) | 0 | 100 % in [0-1) µs |
| 500 µs | 32.3 µs (6.4 %) | 0 | 100 % in [0-1) µs |
| 250 µs | 29.9 → 33.2 µs (11.9–13.2 %) | 0 | 100 % in [0-1) µs |
| 100 µs | 29.9 µs (29.8 %) | 1 (warm-up) | 100 % in [0-1) µs |
Isolation demonstrated by measurement: Under all tested periods and workload scenarios, the EtherCAT cycle wake-up jitter on Core 0 remains 100 % within [0-1) µs — the network/USB/SSH load on Core 2 does not perturb the determinism of Core 0. The minimum sustained tested EtherCAT cycle period is 100 µs (10 kHz).
OROS is composed of original software developed specifically for a bare-metal AArch64 real-time operating system and third-party components.
The original OROS kernel, HAL, scheduler, drivers, and real-time services are licensed separately under the OROS project license.
Third-party components retain their original licenses:
-
EtherCAT master: modified derivative work based on EtherLab EtherCAT Master 1.6.8. Licensed under GNU General Public License version 2 (GPLv2).
The OROS port includes modifications such as:
- removal of Linux kernel dependencies
- replacement of Linux synchronization primitives
- replacement of Linux networking interfaces
- integration with OROS hardware abstraction and real-time execution model
-
lwIP: BSD licensed.
-
newlib: Various permissives licenses.
-
FatFs: BSD-like licensed.
-
wolfSSL/wolfCrypt and wolfSSH: GPLv3 or commercial licensing depending on the distribution model.
U-Boot remains an external GPL-licensed bootloader component and is not part of the OROS operating system source tree.
For proprietary products, GPL-covered components must either be used in compliance with their licenses or replaced with separately licensed alternatives.