Betrusted: Something-Something Secure

Betrusted: Being Secure

That's no Blackberry, it's a chat client!

bunnie - https://bunniestudios.com/ - @bunnievorpal

Tom Marble - https://info9.net/wiki/tmarble/

Xous: Why another kernel?

Betrusted Goals

<=4 MB RAM
Process Isolation
Safe language
Microkernel

With Betrusted, we wanted to reduce the code footprint. This will allow us to run with less RAM -- ideally 4 MB or less. We also wanted to have a full MMU, which is somewhat unusual in the embedded microcontroller space, where a more limited Memory Protection Unit is preferred. We would like to have full process isolation, so even if one process is compromised, attackers will have a harder time boring through the system to gain a more complete takeover. Therefore, we would like Betrusted to run a Microkernel-style operating system, with "servers" that provide features such as the display, keyboard, and even basic task switching. These should all run in userspace with the bare minimum permissions required to get the job done. Finally, we would like to have the operating system written in a safe systems language.

Rust: Safety, Speed, Concurrency

The Rust programming language promises the holy trifecta: Safety, Speed, Concurrency. Pick any three. If you're going to start over on a systems- level project, choose Rust. There will be a lot of wailing and gnashing of teeth to begin with, but the end result will be better. When we started Betrusted, we decided that it should primarily use Rust as the systems language. That way we can be sure that our code is sound. Additionally, Rust has the ability to produce efficient binaries, and the efficiency is only going to get better as time progresses. This eliminates non-Rust choices such as Linux or Minix.

A Survey of Rust-based Operating Systems

Rust-based Operating Systems: Tock

Tock is the most obvious choice, since it already has a RISC-V port and is supported by a well-documented ABI. Tock supports multiple tasks written in either Rust or C, which is a very nice feature. However, Tock does not support an MMU. It would be possible to adapt the MPU interface to work with an MMU, but a lot of design work has gone into Tock to make it work well with only the standard MPU that is present on most ARM chips. Using Tock would be asking it to do something that it's not designed for. Instead, it's better to pick the right tool for the job. Additionally, the Tock message passing infrastructure assumes only one server per process, which can limit flexibility.

Rust-based Operating Systems: Redox

Redox is the other large Rust-based operating system, and is the most compelling. Redox is currently limited to x86-64 (with a plan to port it to AArch64), so we would need to port it ourselves to RISC-V. The biggest problem with Redox is its size: It's a full Desktop operating system, and supporting it on Betrusted would require us to spend a lot of time cutting it down to just the bare microkernel, at which point we can start to recreate everything ourselves. The kernel itself is such a small part of Betrusted. Besides, we would like the freedom to experiment, to randomize the syscall numbers and have keepout areas of the screen and add IMEs to the input, which would quickly introduce incompatibility with Redox. Finally, we would like to be able to use stable Rust for our applications, which we can almost do with Xous. We're just waiting for either the "alloc_error_handler" attribute to be stabilized (issue 66740), or defaulting handle_alloc_error to panic (issue 66741), which would give us everything we'd need to use alloc on stable Rust. In short, Tock is too small, and Redox is too big.