+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ![]()
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ ![]()
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+
+ Betrusted: Being Secure
+That's no Blackberry, it's a chat client!
++ Sean Cross - https://xobs.io/ - @xobs +
+Betrusted: A Security Chip with I/O
+
+ 
+
Xous: Why another kernel?
+ +Betrusted Goals
+-
+
- <=4 MiB RAM +
- Safe language +
- Process Isolation +
-
+
- Microkernel +
- Auditable by one person +
Microkernels
+
+ FlexSC: Flexible System Call Scheduling with Exception-Less System
+ Calls
+
+ Too Many Cooks
+
+ 
+ |
+
+ if there is one primary + contributor, the chances for a file to be buggy decreases + significantly+ |
+
| Source: Microsoft + Research | +|
Felix' Rule of Thumb
+
+ 
+ |
+
+ + The largest amount of security-related code that one person can reasonably audit is + about 64 KiB of binary data ++ |
+
Principles of Software
+
+ 
+ |
+
+
|
+
Rust OS Landscape
+
+
+ Rust-based OS: Tock
+
+ 
+ |
+ |
+
|
+
+
|
+
Rust-based OS: Redox
+
+ 
+ |
+ |
+
|
+
+
|
+
Rust-based OS: Tifflin
+| ? | +|
+
|
+
+
|
+
Other Alternatives and Inspirations
+-
+
- ChibiOS - Embedded RTOS +
- HelenOS - Everything is a message +
- Solaris - Doors +
- QNX - Traditional Microkernel +
Microkernels isolate and make IPC cheap
+
+ Betrusted Goals
+-
+
- <=4 MB RAM +
- Process Isolation +
- Safe language +
- Microkernel +
Xous: System Design
+ +Xous: Memory Model
+
+ 
+ |
+
+
|
+
Xous: Memory Model
+-
+
- Mutable Borrow
+
-
+
- draw() +
+ - Immutable Borrow
+
-
+
- Mapping font database +
+ - Move
+
-
+
- Encrypting a string +
+
Xous: Interrupts
+fn setup_int2() -> xous::Result {
+ let gpio = xous::syscall::map_physical(
+ Some(0xe0000000), None, 4096)?;
+
+ xous::syscall::claim_interrupt(2, |_int_num, gpio| {
+ unsafe {
+ let val = gpio.read_volatile();
+ gpio.write_volatile(val + 1);
+ };
+ }, gpio)
+}All in userspace
+
+ Xous: Missing Features
+
+ 
+ |
+
+
|
+
Xous: Everything in Userspace
+-
+
- Small Kernel +
- Message Passing +
- Protected Memory +
+
+
Understandable by one human
+ Made by many
+
+ 
+ |
+ + + | +
+ + + + +
|
+