Xous: A Pure-Rust Rethink of the Embedded Operating System

Xous: A Pure-Rust Rethink of the Embedded Operating System

Speakers: bunnie; Sean "xobs" Cross

Conference: 39C3

YouTube: https://www.youtube.com/watch?v=DaWkfSmIgRs

Overview

This talk introduces Xous, a groundbreaking embedded operating system (OS) written entirely in Rust, designed to address the pervasive memory insecurity in low-cost embedded and IoT devices. Developed by bunnie and Sean "xobs" Cross, Xous leverages a Memory Management Unit (MMU), a feature largely absent from the widely adopted ARM Cortex-M architecture due to what the speakers term the "Linux tax." The core innovation of Xous lies in its ability to use hardware-level MMU protections to enforce Rust's robust memory safety semantics, effectively creating an OS where memory access violations are caught by the hardware itself.

The talk delves into the historical context of MMUs, their deliberate exclusion from certain ARM lines, and the resulting "power cycle of poor memory security" in embedded systems. To break this cycle, the speakers advocate for open-source hardware, specifically RISC-V, which allows for MMU integration without proprietary restrictions. They present their solution: not just a new OS, but also a custom, partially open-source System-on-Chip (SOC) called the Bow Chip 1X, which "hitchhikes" on commercial tape-outs to achieve cost parity and enable the widespread adoption of secure embedded systems.

Ultimately, this presentation is a call to action for the embedded community to prioritize and demand hardware-enforced memory security. Xous and the Bow Chip 1X represent a full-stack approach—from silicon to software—to delivering affordable, auditable, and inherently safer embedded devices, challenging the status quo imposed by dominant proprietary architectures and fostering a new era of trust in IoT.

Background

▶ Watch: The vision: secure embedded OS with Rust and MMU (0:30)

The journey to Xous began with the observation that while Memory Management Units (MMUs) have been a cornerstone of general-purpose computing since the 1960s, offering critical features like page-level memory protection, virtual address spaces, and hypervisor support, they are conspicuously absent in the vast majority of low-cost embedded systems. The ARM Cortex-M line, which evolved from highly successful architectures like the ARM7TDMI (shipping 10 billion units), deliberately omits an MMU. This omission, while facilitating extremely low-cost, low-power applications (often with only kilobytes of RAM and dozens of kilobytes of ROM), has created a "power cycle of poor memory security." CPUs without MMUs led to OSes that didn't assume memory security, which the market accepted due to low cost, perpetuating the lack of demand for MMU-equipped embedded CPUs.

The speakers attribute this deliberate architectural split to ARM's "Linux tax." The higher-end Cortex-A line, which includes an MMU necessary for running sophisticated OSes like Linux (and Android), commands significantly higher upfront costs and royalties. ARM, in their view, intentionally prevents MMU integration in Cortex-M cores to protect these profits, forcing developers who require memory security to pay the premium for Cortex-A or resort to proprietary solutions like ARM's Memory Protection Unit (MPU). While MPUs offer some memory isolation, they are less flexible than MMUs, often target-specific, and further entrench vendor lock-in, failing to address the fundamental problem of open, hardware-enforced memory safety.

This entrenched status quo motivated the development of Xous. Recalling an era before ARM's dominance and the DMCA, bunnie emphasized the open-source community's strength and the emergence of RISC-V. As an open architecture specification, RISC-V allows anyone to design and implement a CPU core with an MMU, offering an escape from ARM's proprietary control. The initial step was to build an FPGA-based SOC with a RISC-V core and an MMU. However, this immediately highlighted another gap: a robust, MMU-aware embedded OS designed for such hardware simply didn't exist in the open-source ecosystem. This laid the groundwork for Xous, a pure-Rust OS conceived to leverage the full capabilities of an MMU from the ground up.

Key Findings

▶ Watch: ARM's 'Linux tax' blocks MMUs in Cortex-M (4:10)

The central discovery and contribution of the Xous project is the successful creation of a pure-Rust embedded operating system that utilizes hardware MMU capabilities to enforce Rust's memory safety guarantees. This moves memory safety from a compile-time semantic check to a runtime hardware-enforced protection, drastically enhancing security in embedded contexts where traditional MMUs are often absent.

Key findings and contributions include:

1. MMU-Enforced Rust Semantics: Xous demonstrates that a hardware MMU can directly enforce Rust's ownership model (move, borrow, mutable borrow) for inter-process communication, causing a hardware violation and program crash if semantics are broken. This is a novel approach to embedded security.
2. Robust Message Passing Architecture: A carefully designed message passing system, inspired by HelenOS and QNX, enables secure and isolated communication between processes and the kernel. It supports both scalar and page-aligned memory transfers, with non-blocking move operations and blocking borrow operations, directly reflecting Rust's ownership model.
3. User-Space Preemption: A significant architectural choice is the implementation of OS preemption from user space. The tick-timer-server, a user-space process, owns the hardware timer and periodically informs the kernel to switch processes, simplifying kernel design and demonstrating the power of the message-passing primitive.
4. RISC-V as the Liberator: The project validates RISC-V as a viable open alternative to proprietary architectures, enabling the integration of MMUs into embedded SOCs without licensing restrictions or "Linux tax."
5. The "Hitchhiking" Silicon Strategy: Recognizing the cost prohibitive nature of FPGA solutions and custom tape-outs, the project pioneers a strategy of "hitchhiking" open-source RISC-V cores onto commercial SOC tape-outs. This allows for the creation of affordable, partially open-source silicon like the Bow Chip 1X, which integrates a VEX CPU with an MMU alongside other open-source elements, achieving cost parity with traditional embedded chips.
6. Open-Source Hardware Debugging and IO Innovation: The development of tools like God Mode Time Travel Debugging with Verilator and BIO (BIO IO Protocol Emulator), a patent-free, open-source alternative to proprietary PIO blocks, further demonstrates the benefits and capabilities of an open hardware approach.

These findings collectively present a compelling vision for a more secure and transparent embedded ecosystem, challenging the prevailing economic and architectural constraints that have long perpetuated insecurity in IoT devices.

Technical Deep Dive

▶ Watch: RISC-V: The open architecture solution for MMUs (5:30)

Xous is built on the premise that an MMU is fundamental for secure embedded systems. The developers defined specific MMU requirements: it must manage the entire address space (not just specific regions), operate with page-size granularity (typically 4KB), support multiple levels of page tables to efficiently manage sparse memory maps in microcontrollers, provide process isolation where arbitrary processes cannot alter their memory mappings, and enable fast switching between processes without extensive page table rewrites.

In the RISC-V architecture, this memory management is controlled by the SATP (Supervisory Address Translation and Protection) register. This register points to a 4KB page that serves as the root of a multi-level page table, allowing virtual memory addresses used by processes to map to arbitrary physical memory locations. A key architectural decision in Xous is that all processes, including the kernel, are completely isolated; the kernel itself cannot directly access a process's memory without explicitly rewriting its page tables. This creates a system where "every bubble is completely isolated," necessitating a robust inter-process communication (IPC) mechanism.

The chosen IPC mechanism is message passing, drawing inspiration from HelenOS, QNX, and Solaris doors. The core idea is to define how processes communicate when they cannot directly share memory. Xous's message passing supports two primary data types:

1. Scalars: Simple integer values.
2. Memory: Specifically, page-aligned, page-sized blocks of memory.

The genius of Xous lies in using the MMU to enforce Rust's fundamental ownership semantics: move, borrow, and mutable borrow.

• Move: When memory (a 4KB page) is "moved" from Process A to Process B, the MMU detaches that page from Process A's virtual address space (by disabling its valid bit in the page table) and reattaches it to Process B's. Process A can no longer access that memory, reflecting Rust's move semantic at a hardware level. This operation, along with scalar moves, is non-blocking because the sender relinquishes all ownership.
• Borrow: When memory is "borrowed" (lent) to Process B, the MMU attaches the page to Process B's address space but clears the W (write) bit in Process B's page table entry. This makes the memory read-only for Process B. If Process B attempts to write to it, the MMU will trigger a hardware violation. The original process (Process A) cannot access the memory while it's borrowed. This operation is blocking; Process A waits until Process B returns the borrowed memory.
• Mutable Borrow: Similar to a borrow, but the W bit is set, allowing Process B to modify the memory. Again, this is a blocking operation.

This MMU-enforced ownership model extends naturally to hardware peripherals. Since peripherals are often just memory-mapped addresses, the "single owner of a memory address" rule means that drivers are managed by one process at a time, preventing contention and race conditions inherent in multi-threaded or multi-process access to hardware.

The message passing architecture utilizes 128-bit server addresses, which can be well-known or random. The use of random 128-bit addresses allows for the creation of "completely hidden services" that are undiscoverable without prior knowledge of the address, enhancing security. Servers are created via create_server and continuously receive_message calls. Clients connect to a server, and this operation blocks until the server is available, simplifying system startup and concurrency management. Messages are sent via functions like scalar_message or lend.

Beyond the core messaging, Xous implements fundamental OS primitives:

• Tick Timer: The tick-timer-server is a user-space process that takes ownership of the hardware timer. It sets interrupts to fire at specific intervals, sending a return_to_parent syscall to the kernel. This user-space process is the sole source of preemption in Xous, a unique design choice that simplifies the kernel. It also provides sleep functionality: a process sends a blocking scalar message (opcode 1, sleep_ms) to the tick-timer-server, which holds the message until the specified duration (e.g., milliseconds) has passed, then returns it, unblocking the calling process.
• Log Server: Demonstrates memory passing. A process allocates a page-aligned, page-sized (4KB) buffer on its stack, writes log data into it, and then "lends" this buffer to the log-server via a lend message, along with scalar values indicating the message length. The log-server then processes the log.

Xous boasts Rust standard library support, building the latest stable Rust toolchain every six weeks. It's a tier 3 Rust target and crucially, uses stable Rust exclusively, avoiding nightly features and ensuring compatibility. It requires no C compiler or linker for OS binaries, streamlining development. The hardware MMU directly enforces Rust semantics, causing crashes on violations, making bugs immediately apparent and improving system robustness.

The project recognized that while an FPGA-based MMU was possible, its high cost ($590, 5x premium, 5x power) made it impractical for widespread adoption. This led to the development of custom silicon: the Bow Chip 1X. This chip employs a "hitchhiking" strategy, where open-source RISC-V cores are integrated into a commercial tape-out, leveraging unused die area (logic is often sparse, occupying only ~20% of a modern SOC's area) at virtually no extra cost or royalty. The Bow Chip 1X includes a VEX CPU core with an MMU running at 350MHz, four PicoRV cores, 4 megabytes of on-chip ROM, and 2 megabytes of on-chip SRAM. It also features cryptography accelerators, a true random number generator (TRNG), USB high-speed, and various IOs.

The Bow Chip 1X offers partially open RTL (Register Transfer Level). Everything that "computes" is open-source: the RISC-V cores, IO accelerators, cryptographic accelerators, most IO interfaces, glue code, and all firmware (including the bootloader). Closed components include a fused-off Cortex M7 (for other product lines), memory models, bus frameworks (AXI, HB, APB, which primarily move data and shouldn't alter it), analog blocks (USB PHY), and the proprietary PDK. This balance provides transparency for critical security-relevant components while working within commercial constraints.

Further innovations include God Mode Time Travel Debugging using Verilator. This simulation environment allows developers to inspect the entire CPU state (registers, branch predictor, intermediate values) forward and backward in time. Integrated with GTK Wave, it can link program counter traces to assembly code, proving properties like constant-time execution for cryptographic routines with cycle-accurate precision.

Finally, the BIO (BIO IO Protocol Emulator) is presented as an open-source, patent-free alternative to proprietary programmable IO (PIO) blocks (like Raspberry Pi's). It consists of four PicoRV cores, each with 4 kilobytes of local RAM, communicating via FIFOs and directly accessing hardware. These cores run RV32EMC instructions, compatible with existing tools, and can be programmed using inline assembly in Rust. Direct GPIO control is achieved by moving values between registers (e.g., X1 to X21 for a GPIO register), ensuring cycle-accurate, jitter-free IO by avoiding potentially blocking AXI bus operations. FIFOs allow cores to synchronize, with a core blocking on an empty FIFO until another core writes to it, enabling lock-step execution and precise timing without complex cycle counting. This provides flexible, software-defined IO for protocols with toggle rates up to 25MHz.

Demo / Proof of Concept

▶ Watch: Introducing Xous: A pure-Rust OS for MMU-enabled hardware (6:15)

While the talk didn't feature a live software demonstration of Xous running a specific application, it presented compelling evidence of the project's progress and tangible hardware. The speakers showcased the Bow Chip 1X, the custom partially open-source SOC designed to run Xous. Crucially, they described its inspectability using **Iris (infrared in-situ)**, a technique developed by bunnie to visually inspect chips packaged with exposed silicon after assembly without damage. A video loop demonstrated Iris in action, showing the ghostly reflection of transistors within a mounted chip, highlighting the project's commitment to transparency and auditability even at the silicon level.

The talk also announced the availability of free development boards for attendees at the "failover full assembly" at the conference, with full production of the Bow Chip 1X expected in Spring 2026. This serves as a practical demonstration of the hardware platform Xous is targeting and provides a means for the community to engage directly with the project. These boards represent the physical manifestation of their efforts to make MMU-equipped, secure embedded hardware accessible.

Defensive Implications

▶ Watch: Key MMU requirements for the Xous operating system (6:35)

Xous and the Bow Chip 1X offer profound defensive implications for the embedded and IoT landscape, fundamentally shifting the paradigm from reactive security patches to proactive, hardware-enforced safety by design.

1. Hardware-Enforced Memory Safety: The primary defensive advantage is the MMU's ability to enforce Rust's memory safety guarantees at runtime. This means that common vulnerabilities like buffer overflows, use-after-free, and other memory corruption bugs, which plague C/C++ embedded systems, are immediately detected by the hardware. Instead of unpredictable behavior or exploitable conditions, the system will crash, providing a clear indication of a violation and preventing attackers from leveraging these flaws for privilege escalation or arbitrary code execution.
2. Strong Process Isolation: The complete isolation of processes, including the kernel, ensures that a compromise in one application cannot easily spread to others or the OS kernel. This "principle of least privilege" is enforced by the MMU, limiting the blast radius of any successful attack and making the system significantly more resilient.
3. Transparent and Auditable Hardware: The partially open RTL of the Bow Chip 1X addresses the "literal and figurative black box" problems of custom silicon. Open RISC-V cores, IO, and cryptographic accelerators allow for independent security audits, reducing the risk of hidden backdoors or subtle vulnerabilities in the hardware itself. The Iris inspection technique further enhances this transparency, allowing physical verification of the silicon.
4. Breaking Vendor Lock-in and the "Linux Tax": By providing a viable, affordable, and open alternative to ARM Cortex-M, Xous and the Bow Chip disrupt ARM's monopoly and the associated "Linux tax." This empowers developers to choose secure platforms without paying a premium or being locked into proprietary solutions like ARM's MPU, fostering a more competitive and innovation-driven embedded security market.
5. Secure Inter-Process Communication: The well-defined message passing architecture, with its MMU-enforced Rust semantics, provides a secure channel for communication between isolated processes. The option for random, undiscoverable server addresses enables truly hidden services, adding another layer of defense against network-based enumeration and attack.
6. Future-Proofing and Community Engagement: The project's commitment to stable Rust, open-source development, and the provision of development boards encourages broader community adoption and contribution. This collaborative environment can lead to faster bug discovery, more robust code, and continuous improvement in security features, making the platform more resilient over time.
7. Constant-Time Cryptography Verification: The "God Mode Time Travel Debugging" with Verilator and GTK Wave allows for cycle-accurate verification of constant-time execution in cryptographic routines. This is crucial for preventing timing side-channel attacks, ensuring that sensitive operations do not leak information through variable execution times.

In essence, Xous and the Bow Chip 1X represent a proactive defensive strategy: building security in from the ground up, at both the hardware and software layers, and making it accessible and auditable. It's a call for the market to demand and invest in true embedded security, rather than settling for insecure-by-design, low-cost alternatives.

Key Takeaways

• Hardware-Enforced Memory Safety: Xous uses a RISC-V MMU to enforce Rust's ownership model (move, borrow, mutable borrow) at runtime, preventing memory corruption vulnerabilities at the hardware level.
• Open-Source Hardware Liberation: The project leverages RISC-V to circumvent ARM's "Linux tax" and proprietary restrictions, enabling MMU integration in affordable embedded SOCs.
• Innovative Message Passing: A robust, MMU-aware message passing system provides secure inter-process communication, with non-blocking (move) and blocking (borrow) operations reflecting Rust's semantics.
• Affordable Secure Silicon: The "hitchhiking" strategy allows the Bow Chip 1X to integrate open-source RISC-V cores with MMUs onto commercial tape-outs, achieving cost parity for secure embedded devices.
• Transparency and Auditability: Partially open RTL, combined with tools like Iris for physical inspection and Verilator for time-travel debugging, enables unprecedented transparency and auditability of the hardware and software stack.
• User-Space Preemption: Xous innovates with a user-space process (tick-timer-server) responsible for OS preemption, simplifying kernel design and demonstrating the power of its message-passing primitives.

About the Speaker(s)

bunnie (Andrew Huang) is an independent hardware designer and open-source advocate with a deep understanding of hardware architecture and a passion for challenging established norms. In this talk, he identifies himself as "old and stubborn," recalling an internet before the DMCA and hardware before ARM's dominance. His doctoral thesis focused on capabilities and tag pointers, showing a long-standing interest in advanced memory safety concepts. He founded Bow Chip, the company responsible for the "hitchhiking" strategy to produce the Bow Chip 1X, demonstrating his commitment to making open and secure hardware a reality.

Sean "xobs" Cross is an embedded systems engineer and the primary architect of the Xous operating system. bunnie credits xobs with inventing Xous and making the crucial decision to use stable Rust, which bunnie praises for making the codebase "more fun to maintain over time." His work on Xous showcases his expertise in crafting secure, reliable, and maintainable embedded OSes from the ground up, leveraging modern programming languages and hardware features.