This Month in Rust OSDev: October 2026

Welcome to a new issue of "This Month in Rust OSDev". In these posts, we give a regular overview of notable changes in the Rust operating system development ecosystem.

This series is openly developed on GitHub. Feel free to open pull requests there with content you would like to see in the next issue. If you find some issues on this page, please report them by creating an issue or using our comment form at the bottom of this page.

Please submit interesting posts and projects for the next issue by commenting on the draft pull request or via a PR on GitHub.

Announcements, News, and Blog Posts

Here we collect news, blog posts, etc. related to OS development in Rust.

OS Projects

• Announcing Asterinas 0.19.0
  • Asterinas is a Linux ABI-compatible OS kernel written from scratch in Rust.
  • 0.19.0 adds a DRM subsystem (Xorg and 3D games), AArch64 as its fourth architecture, Intel VMX hypervisor support in OSTD, a Rust-native device model, and self-hosting builds.
• Driving an NVIDIA GPU from a hobby Rust kernel: GSP-RM to Vulkan
  • The no_std UEFI hobby kernel constanos now boots NVIDIA's GSP-RM firmware on an RTX 3050 and runs a port of Mesa's NVK, so unmodified Vulkan code renders without Linux underneath.
  • Most of the code was written by Claude Code, with the author directing the work and running the hardware tests.
• Tock, a secure embedded operating system for microcontrollers written in Rust:
  • Tock 2.3.0: The first Tock release since early 2025 adds initial 64-bit RISC-V and x86 support, dynamic process loading, 8 new boards, and many soundness and MPU security fixes.
  • Talking Tock 66: RISC-V 64-bit Support on Tock
  • Talking Tock 65: Unsafe Documentation in the Core Tock Kernel: Tock's core kernel crate now denies clippy::missing_safety_doc and clippy::undocumented_unsafe_blocks.
• Redox OS, a Unix-like microkernel operating system written in Rust:
  • This Month in Redox - September 2026
  • Ring Buffers Project Summary: Wrap-up of Redox's NLnet-funded work on io_uring-like ring buffer support.
• Microsoft Issues First Release Of Their LiteBox Sandboxing Library OS
• The Documentation I Wish I Had: How I build drivers for Open Nexus OS
  • Bringing up the Rust microkernel OS Open Nexus OS on a Banana Pi BPI-F3: measuring the vendor's Linux system first and turning those measurements into pass/fail gates that drive the display, USB, and GPU driver work.
  • A large part of Open Nexus OS was built with AI coding agents, guided by the measured gates described in the post.
• Ginux
  • A userspace kernel that runs as an ordinary process on top of Linux and gives each workload a deliberately reduced, versioned subset of the Linux ABI by emulating, mediating, or denying its syscalls.
  • Ginux started as a standalone Rust kernel booting through UEFI and running a Rocky Linux userspace (preserved on the bootable-kernel branch).
  • Both versions were written by an AI coding agent directed by the author.

Linux-related

• 17k Lines Of New Rust Kernel Code Heading Into Linux 7.4
• Google's C Binder Driver Removed With Rust Binder Ready For "Few Billion Devices"
  • Follow-up to last month's item: the removal has now been merged for Linux 7.4.
• Upstreaming Tyr: Rust, DRM, and the Linux Kernel
  • Progress on upstreaming Tyr, the Rust DRM driver for Arm Mali GPUs.
• NVIDIA's Nova Driver Continues Leading The Way For Linux Rust GPU Drivers
• Nova Driver Continues Progressing With Long-Term Goal For Official NVIDIA Linux Use
  • Coverage of the LPC 2026 talk on the Rust Nova driver stack.
• LWN coverage of Kangrejos 2026, the Rust for Linux workshop:
  • Owning C types from Rust code
  • Safe self-referential data structures in kernel Rust
  • Cross-crate forward declarations in Rust
  • Discussing a rewrite of XArray
  • Rust features in the future
  • Guidelines for panics in kernel code

Embedded and Tooling

• Using TrustZone-M in Rust on the Raspberry Pi Pico 2
• Finding panics with Call Graph Analyzer
  • A tool that extracts the call graph from monomorphized MIR to find which functions in a firmware binary can panic.
• Wild 0.11.0
  • The Rust-based Wild linker gained considerably better linker script support and a Wasm port.
• The Embedded Rustacean Issue #82 and Issue #83

Infrastructure and Tooling

In this section, we collect recent updates to rustc, cargo, and other tooling that are relevant to Rust OS development.

Breaking Changes and Warnings

• FCW (future-compatibility warning) for #[panic_handler] on unsafe fn.
  • The compiler can call the panic handler from anywhere, so declaring it as unsafe fn is going to become an error.
• Deny partial -Z stack-protector by default in all editions
  • Enabling stack protection for only some crates of a binary now triggers a future-compatibility warning unless -Z allow-partial-mitigations=stack-protector is passed (RFC 3855).
• Remove some #[linkage] options
  • The unstable #[linkage] attribute no longer accepts common, external, or internal.
• Nuke Unique (and ptr_internals)
  • Removes the internal core::ptr::Unique type and the ptr_internals feature, which some older nightly kernel code still uses.

Library Stabilizations

The following APIs were stabilized this month and are expected to be available in Rust 1.101:

• <*const T>::try_cast_aligned, <*mut T>::try_cast_aligned, and NonNull::try_cast_aligned
  • Checked pointer casts that return None if the pointer is not aligned for the target type.
  • Stabilization PR: Stabilize ptr::try_cast_aligned
• <*const T>::cast_slice, <*mut T>::cast_slice, and NonNull::cast_slice
  • Postfix versions of ptr::slice_from_raw_parts{_mut} that turn a pointer and a length into a slice pointer.
  • Stabilization PR: stabilize ptr_cast_slice
• vec::IntoIter::allocator, together with the allocator parameter of vec::IntoIter<T, A>
  • A follow-up to last month's Allocator stabilization.
  • Stabilization PR: vec: stabilise allocators for into_iter

Unstable core APIs

• core: Rename abort_immediate to crash
  • Renames the single-instruction abort in core::process, which also works without an OS or libc. Stabilizing it as crash is proposed in #164731.
• add core::process::resumable_breakpoint
  • An unstable breakpoint function in core that is documented as safe to continue past. See the Zulip discussion for background.

Target Support

• aarch64: Use neon registers for ABI on targets that require `neon"
  • The aarch64 version of last month's x86 SSE change: on hard-float aarch64 targets, vectors are now passed in NEON registers and disabling the neon target feature is a hard error. Kernels that disable NEON need a soft-float target such as aarch64-unknown-none-softfloat.
• tier 3 target policy: target CPU and features must be supported by upstream backend
  • New tier 3 targets must use CPU and feature names that upstream LLVM recognizes.
• Add aarch64-unknown-qtee as a tier 3 target
  • A new target for Qualcomm's Trusted Execution Environment (QTEE).
• Add the movdir64b and movdiri x86 target features
  • Adds unstable target features for x86 direct-store instructions, which are used to submit work to devices through MMIO.
• Fix RISC-V inline ASM clobber_abi when extra target features are enabled
  • Fixes which registers clobber_abi("C") clobbers for the ilp32e/lp64e ABIs and for floating-point registers.

Cargo

• feat(build-std): Add build.build-std.when and crates config keys
  • Adds the config keys proposed in the build-std=always RFC (not functional yet). Related: builtin package ID spec parsing (builtin://.#core) for RFC 3875.

rust-osdev Projects

In this section, we give an overview of notable changes to the projects hosted under the rust-osdev organization.

uart_16550

Maintained by @phip1611

Simple yet highly configurable low-level driver for 16550 UART devices, typically known and used as serial ports or COM ports.

v0.9.0 makes the driver considerably more robust on real hardware. The driver is now tested against a model of a 16550A that follows the flows of the Linux 8250 driver. The model was created with LLM assistance and careful human review, and it found 12 bugs, all fixed in this release. Most notably, devices without working FIFOs, such as the 16450, overran the transmitter and hung the loopback self-test that Uart16550Tty always runs. Also, internal register reads lost line errors and modem status changes, which lsr() and msr() now report.

The Backend trait is no longer sealed, so users can bring their own register access, e.g., port I/O via tdcall or the GHCB in confidential VMs. Together with the new const fn constructors, devices can now live in a static. The driver also gained enable_interrupts() and disable_interrupts(), e.g., for interrupt-driven transmission.

The release comes with several breaking changes, most notably a new MSRV of 1.91, a smaller Backend trait with only read() and write(), and calc_divisor() reporting divisors that don't fit into 16 bits instead of panicking. The changelog has all details.

As mentioned in previous issues, Anthropic sponsors @phip1611 with a Max plan as part of their open source program. The 16550A model and the testing above happened under that sponsorship, and we are happy that it helps us improve the robustness and reliability of the ecosystem.

We merged the following PRs this month:

• Allow custom backends (e.g., TDX/SNP port I/O) and const construction
• Make port I/O and MMIO constructors const
• Make the Backend trait offset-based
• Split the backend out of config()
• Add Uart16550Tty::new_mmio_from_address() and Uart16550::backend_mut(), document register offset checks
• Test the driver against a 16550A model, following Linux
• Small fixes found by testing against a 16550A model
• Report divisors that don't fit into 16 bits instead of panicking
• Add enable_interrupts() and disable_interrupts()
• Keep LSR and MSR status across internal reads, like Linux
• Detect whether the FIFOs are really enabled
• Make the loopback test robust
• Inline ISR::interrupt_type() and InterruptType::from_bits()
• doc: drop remarks about const fn and statics
• Fix misleading statements in the docs
• Streamline the changelog for v0.9.0

x86_64

Maintained by @phil-opp, @josephlr, and @Freax13

The x86_64 crate provides various abstractions for x86_64 systems, including wrappers for CPU instructions, access to processor-specific registers, and abstraction types for architecture-specific structures such as page tables and descriptor tables.

We merged the following changes this month:

• feat(addr): add 57-bit and runtime-validated VirtAddr types
• Add checked arithmetic functions to addresses, pages, and frames
• feat(instructions): Add lldt and sldt
• Make mxcsr::write and mxcsr::update unsafe
• Don't panic when displaying a page tables with pages directly before and after the address gap
• Document the virtualization exception

Thanks to @aarkegz, @mkroening, @adityuhkapoor, @Garfield1002, and @llp42 for their contributions!

acpi

Maintained by @IsaacWoods

The acpi repository contains crates for parsing the ACPI tables – data structures that the firmware of modern computers uses to relay information about the hardware to the OS.

We merged the following changes this month:

• Add types for parsing DMAR
• Add simple docs for DMAR table.
• Support the Match expression
• Add BufferField support for Increment/Decrement.
• Default _OSI can be passed a string reference
• Rework GAS accesses to fixed register blocks
• fix: Do unaligned reads for table entries
• Make PhysicalMapping safely Send / Sync
• Constrain NativeMethod to Send + Sync

Thanks to @gierens, @dewyatt, @martin-hughes, and @mkroening for their contributions!

spinning_top

Maintained by @phil-opp and @mkroening

The spinning_top crate provides a simple spinlock implementation based on the abstractions of the lock_api crate.

This month, we fixed a race condition in RwSpinlock when upgrading a lock, released as v0.3.1. Afterwards, we published v0.4.0 with the following breaking changes: an upgrade to lock_api 0.5, a minimum supported Rust version of 1.95, and the removal of the owning_ref feature, since owning_ref is unmaintained and unsound (RUSTSEC-2022-0040).

• fix(rwlock): Fix race when upgrading RW lock
• Release v0.3.1
• feat: Upgrade to lock_api 0.5
• Declare MSRV 1.95 and test it in CI
• Remove the owning_ref feature
• Upgrade to Rust 2024
• Test concurrent lock operations under Miri
• Release v0.4.0

uefi-rs

Maintained by @nicholasbishop and @phip1611

uefi makes it easy to develop Rust software that leverages safe, convenient, and performant abstractions for UEFI functionality.

We merged the following changes this month:

• uefi/time: add monotonic counter services
• Add EdidActive protocol

Thanks to @RaitoBezarius and @the-shank for their contributions!

Other Projects

In this section, we describe updates to Rust OS projects that are not directly related to the rust-osdev organization. Feel free to create a pull request with the updates of your OS project for the next post.

open-nexus-OS/open-nexus-OS

(Section written by @jenningschaefer)

Open Nexus OS is a capability-based microkernel operating system written in Rust and targeting RISC-V. (A large part of it is built with AI coding agents.)

Update: Open Nexus OS now runs on real hardware. This month the OS booted on a Banana Pi BPI-F3 (SpacemiT K1) for the first time: it boots from eMMC through the vendor boot chain and shows the desktop at 1920x1080 on HDMI via the SoC's display controller. A new userspace USB host stack (a reactive xHCI driver plus HID parsers) lets a USB keyboard and mouse drive the desktop on the board, with the pointer riding the display controller's hardware layer.

Work then moved to the K1's GPU. The gpud service gained a Rust driver for it with multiple GPU contexts, a render queue, and a scanout contract, together with an in-house shader toolchain that compiles WGSL into the project's own IR and emits code for both the board's GPU and the virgl path on QEMU. The compositor now redraws only the damaged regions of a frame on the GPU, and since mid-October the board's display is no longer composited on the CPU at all.

On the desktop side, window tiling became the default model, a clipboard service with text editing and an IME landed, and the shell gained a screenshot tool. The bring-up method behind all of this is described in the blog post The Documentation I Wish I Had.

Website · Repository · Changelog

EmiBSD/Kernel

(Section written by @enavarre-cl)

EmiBSD is an experiment carrying the OpenBSD kernel into safe Rust. It keeps a byte-identical ABI to run OpenBSD's unmodified userland, porting the C file by file (LandingZone) before redesigning it to confine unsafe code to a single hardware layer, hal. The code is written by AI coding agents under written rules, with one maintainer reviewing and approving every commit. It is pre-alpha, runs on arm64 in QEMU only, and is not affiliated with the OpenBSD project.

This month, the redesign moved its first core subsystems out of the inherited port: the string, compression and crypto primitives, virtual memory, and processes and scheduling. File descriptors, kqueue, signals, the scheduler and terminals now live in the #![forbid(unsafe_code)] kernel crate. hal holds 184 proven unsafe sites against 9,490 remaining in the port, and 105 of OpenBSD's 331 system calls are handled natively.

The test suite passes on two and four CPUs, the OpenBSD installer runs end to end, and the comparison against a real OpenBSD shows no new behavioural difference. Performance tuning is scheduled after the redesign. Next up: the VFS and file systems.

Website · Status · Process

phip1611/noto-sans-mono-bitmap-rs

(Section written by @phip1611)

Pre-rasterized no_std bitmap font for framebuffers in bootloaders and kernels, without allocations or floating point operations.

v0.4.0 renders the characters about 7% larger, on a pixel-aligned baseline, and auto-hinted. Wide characters, such as �, are no longer cut off. The raster widths are unchanged.

The glyphs are now flat binary blobs (via include_bytes!) instead of ~3800 generated Rust source files with one fat pointer per glyph row:

The row pointers alone made up about 3.5 MB with all features, including their relocations in position-independent binaries. Breaking changes: RasterizedChar::raster() is replaced by pixels(), rows(), and pixel(x, y), FontWeight::val() is removed, and the MSRV is 1.85. See the changelog.

Join Us?

Are you interested in Rust-based operating system development? Our rust-osdev organization is always open to new members and new projects. Just let us know if you want to join! A good way to get in touch is our Zulip chat.

Comments