Skip to content
KitploitKITPLOIT
ToolsExploitsBlog
Log in
Submit
ToolsExploitsBlog
Submit

Hacking, PenTest, and Cybersecurity Tools for Your Security Arsenal!

Kitploit is a directory of hacking, cybersecurity, and pentesting tools. Discover the latest project updates to find vulnerabilities, analyze systems, automate testing, and strengthen your security.

··Feeds·Contact·Privacy·© 2026 Kitploit

Tool Directory

Categories

View all categories
Loading categories
qrv — QRV Operating System | Kitploit
Tools/GitHubGitHub/r-tty/qrv
Embedded Systems SecurityHardware SecurityPapers & ResearchLearning & EducationCurated Resources
GitHubr-tty/qrv

qrv

QRV Operating System

View Repository
24144 months agoReviewed by Kitploit

Most Popular

View all →

Discover the most used tools by our community.

Explore all tools

Browse our collection of tools

View all tools →
Share

QRV — a QNX Neutrino-based operating system, re-imagined for 64-bit RISC-V

QRV is a ground-up adaptation and re-implementation of the QNX Neutrino 6.4 operating system for modern 64-bit hardware, with RISC-V (rv64g) as the primary architecture and x86-64 as a secondary target. The project started on Christmas Eve 2020. The name QRV deliberately avoids any association with the QNX trademark.

QRV is a whole operating system, not merely a kernel. The microkernel is its heart — but the larger share of the work has gone into everything that surrounds it. Most notable is taskman, the user-mode process / memory / path manager (QNX's procnto), which has been deeply reworked and lifted out of the kernel into user space; alongside it the C library, the device drivers, the filesystem, the dynamic loader, and the system servers have all been ported, made 64-bit clean, and in many places substantially rewritten. The microkernel is small by design; the operating system around it is where most of QRV lives.

This is not a fork that merely compiles old code on a new compiler. It is a careful, module-by-module port to a true LP64 model, with the proprietary procnto boundary dismantled, the IFS/startup machinery replaced, and — as of the most recent releases — the kernel's Big Kernel Lock removed entirely and the process/memory/path manager moved out of the kernel into a user-mode server.

This README describes QRV v0.43.

The development blog, with the full story of the port, is at https://r-tty.blogspot.com. A book-length narrative, The QRV Porting Story, lives in the source tree under doc/tex/PortingStory/.

QRV has been developed in close collaboration with Claude Code, Anthropic's agentic coding tool — much of the porting, the SMP debugging, and the documentation (including this README) was carried out as a human–AI pair-programming effort, working alongside the author.


Contents

  1. What is QRV
  2. Licensing
  3. Obtaining the sources: obtain_proj.sh and the os/ tree
  4. System architecture
  5. Taskman and the TM_PRIV privileged syscall
  6. The Big Kernel Lock — and its removal
  7. Storage: devb-nvme and fs-qrv
  8. User space
  9. Building and running
  10. Running on real hardware
  11. Closing remarks: why a free clone matters

1. What is QRV

QNX is a microkernel real-time operating system whose defining idea is synchronous message passing. In QNX, the kernel itself is tiny — it knows how to schedule threads, pass messages, deliver signals, handle timers and interrupts, and very little else. Everything that a monolithic OS would put inside the kernel — the process manager, the memory manager, the filesystem, the device drivers, the network stack — runs in ordinary user processes called resource managers, and they talk to one another and to their clients through the same send / receive / reply IPC primitive.

This architecture is what makes QNX elegant, and it is exactly what QRV preserves. A program that wants to open a file sends a message; the filesystem server receives it, does the work, and replies. The kernel only brokers the rendezvous. The result is a system where a driver can crash and be restarted without taking the kernel down, where the trusted computing base is measured in tens of kilobytes, and where the boundary between "kernel" and "application" is a message, not a privilege wall full of syscalls.

QRV takes the 2009-era QNX Neutrino 6.4 community sources and brings that design forward:

  • 64-bit clean (LP64). Every pointer and size type is 64-bit; the port hunts down and fixes the int/uint32_t/pid_t-on-a-pointer truncations that 32-bit code is riddled with.
  • RISC-V first. The primary target is qemu-system-riscv64 (the virt machine) and the SiFive Unmatched (FU740) development board. x86-64 is kept building as the portability check.
  • No proprietary boundaries. There is no IFS and no mkifs (QRV uses the standard CPIO format instead); there is no separate startup/kernel split (startup is linked directly with the kernel); there are no callouts and no mini-drivers.
  • A modern build. A Linux-style Kconfig configuration, an incremental kernel link (modules are added and tested one at a time, not thrown at the linker as a 32→64 monolith), and a cross-compiler toolchain (riscv64-linux-gnu-gcc).
  • A renamed, de-trademarked vocabulary. procnto is taskman (the Task Manager) throughout; all "Neutrino" references are purged.

QRV does not implement fork() (programs start via posix_spawn()), and it has no demand paging and no swap — the same choices QNX itself made in its 8.0 generation.


2. Licensing

QRV is governed by two licenses at once, and understanding which is which is essential before you build or redistribute anything.

  • QRV's own code is Apache License 2.0. Everything written from scratch for this project — the RISC-V port, the new build system, the user-mode taskman split, the lock-free kernel rework, the drivers and tooling we authored — is Apache 2.0. The full text is in LICENSE.txt.

  • QNX-derived code is the BlackBerry QNX Community License (QCL) 2.0. The parts of QRV that descend from the 2009 QNX Neutrino community sources remain under the QCL, which permits non-commercial and academic use of the derived sources. QRV does not, and cannot, relicense QNX's code.

This dual-license reality is precisely why this repository does not contain a ready-to-build source tree. We are not permitted to redistribute the QNX-derived sources. So instead of shipping the code, this repository ships a recipe (see the next section): a map of where each QNX file goes, plus the QRV patches that transform it. You obtain the upstream QNX community sources yourself, from their public mirror, and the recipe reconstructs the QRV tree on your machine. Your copy is yours; we redistribute only our own Apache-licensed patches and metadata.

QRV also incorporates code under other permissive licenses — for example BSD-licensed components adopted from FreeBSD (replacing aged QNX modules), an MIT-licensed virtio block driver of xv6 ancestry, and the MirBSD Korn shell (mksh) as the system shell. WHAT_IS_WHAT.md is the authoritative, component-by-component breakdown of what is under which license and where it came from — consult it whenever you are unsure about a particular file or subsystem.

Finally, the repository contains PETITION.md: an open request to QNX Software Systems and BlackBerry to relicense the historical 2007–2009 Neutrino sources under a permissive OSI-approved license. If you would like the foundations of this work to one day be fully free, that document is where to add your name.


3. Obtaining the sources: obtain_proj.sh and the os/ tree

Because the QNX-derived sources cannot be redistributed here, this repository is a source-reconstruction distribution. It contains:

Download Tool