Ferros

What is Ferros?

Ferros is a mobile-first operating system engineered for instant power loss tolerance by default. Built entirely in Rust and based on the Redox OS microkernel, Ferros eliminates entire bug classes and security vulnerabilities thru architectural decisions rather than runtime checks.

Traditional operating systems think in rectangles: fixed memory blocks, linear address spaces, predictable layouts. Ferros thinks in rings: memory and storage flow continuously with no beginning, no end, no boundaries. Battery removal at any moment isn't a failure case—it's just pausing the flow.

Why Rust?

For ferros, Rust isn't a choice—it's a requirement. No other language provides the compile-time guarantees necessary for instant power-loss tolerance.

When power can disappear at any microsecond, memory corruption isn't an option. Buffer overflows, use-after-free, dangling pointers, data races—every single one of these bugs can corrupt state during power loss. Traditional operating systems rely on runtime checks, recovery procedures, and filesystem journals to handle these failures.
ferros eliminates the failures entirely.

Rust's borrow checker, ownership model, and fearless concurrency aren't nice-to-have features. They're the literal bedrock that makes 0ms shutdown possible. The compiler proves memory safety before a single instruction executes.
No runtime overhead. No defensive programming.
Just mathematical certainty that your data structures remain valid even if power vanishes mid-instruction.

C and C++ cannot provide these guarantees. Go and Java require garbage collection and runtime overhead. Python and JavaScript are a hard no. Friends don't let friends write Python. Rust is the only production language that combines zero-cost abstractions with compile-time memory safety.
For ferros, that's not negotiable. Ever.

Ring Memory Architecture

Everything in Ferros—RAM, storage, allocations—exists in continuously rotating rings. Not metaphorically. Literally.

• No Beginning or End
  Memory addresses wrap around via two's complement. There is no "first byte" or "last byte"—just positions in the ring.
• 2-Instruction Access Control
  Subtract-compare replaces page tables. One subtract, one compare. That's your entire memory protection system.
• Continuous Rotation
  Process memory locations rotate constantly. By the time an attacker finds your data, it's already moved.
• Stochastic Allocation
  Files and memory land at random ring positions. No predictable patterns, natural wear leveling.
• Header Ring Buffer
  Hundreds of rolling filesystem headers. Power loss mid-write? Boot finds the latest valid generation and continues.
• Offset Dual-SSD Mirroring
  Vendor diversity (Micron + Samsung) at different ring positions prevents common-mode failures.

Technical Innovations

Why Ferros Exists

Traditional mobile operating systems (Android, iOS) assume:

• Memory in fixed blocks with predictable layouts
• Graceful shutdown with cleanup procedures
• Trust in proprietary baseband firmware
• Runtime mitigations for memory bugs
• Filesystem recovery after unclean shutdown

Ferros assumes:

• Memory flows in rings with no fixed positions
• Power loss at any moment (0ms shutdown latency)
• Hardware kill-switches as first-class features
• Compile-time elimination of memory bugs
• Every state is valid—nothing to recover

This isn't defensive programming.
It's thinking in circles instead of rectangles.

Project Status

Ferros is in early architecture design phase.
This documentation establishes prior art for:

• Ring memory architecture with continuous rotation
• Subtract-compare access control
• Stochastic allocation for exploit resistance
• Kill-switch ready mobile OS in pure Rust
• Zero-cleanup driver model

First Published: January 1, 2025

License: MIT (Ferros modifications)
+
MIT (original Redox OS code)

Technical Documentation

Coming soon:

• Memory management specification
• Hardware kill-switch integration
• Security model documentation