A secure embedded operating system for microcontrollers

by udev4096 • 2 years ago

115 67 2 years ago

Is this for if you are writing firmware that has non-cooperative processes (eg installable applications)? It sounds like it from the description. Of note, it seems like in C and C++, it is common use an RTOS for any project. In rust, you can get away with a lot (including complex programs with lots of IO) without one. Eg, using interrupts, DMA, timers etc to build an event loop and manage asynchronous events.

therein• 2 years ago

A loop that puts you into a deeper sleep that you can be woken up by interrupts from DMA, timers, GPIO etc. would provide the same.

I like Rust as much as the next guy but let's not pretend we couldn't do this with C, C++ or assembly.

ladyanita222• 2 years ago

Technically you could do the same in all three: C, C++ and Rust.

the__alchemist3• 2 years ago

You can do this in C, C++, assembly, but my observation is that many projects are started with an RTOS, even if they are cooperative and/or simple.

RetroTechie• 2 years ago

How common are these Memory Protection Units (MPU) in microcontrollers today?

the__alchemist3• 2 years ago

There are certain lines that include security features designed for IoT. Becoming more popular. Arm Cortex-m33 etc. so, stm32 L5, U5, nRF-53 etc. Lots of options if you want this. But most MCUs don't have them.

bajsejohannes• 2 years ago

There's also MPU in even simpler/cheaper MCUs. For instance, ARM Cortex M0+ sports an MPU, and this architecture is used in STM32C0 ($0.24 in bulk) and RP2040.

I have no idea how the landscape looks in general, though.

ctz• 2 years ago

It's technically optional on Cortex-M0+ and above, but in practice everyone includes one.

ladyanita222• 2 years ago

Is it mandatory?

all2• 2 years ago

Is there any way this works with Zephyr?

AlotOfReading• 2 years ago

It's an OS at the same layer as zephyr. They're not compatible, but you'll see similarities between them.

michaelt• 2 years ago

Security critical devices, like TPMs and USB authentication fobs, are actually multiprogramming environments running applications written by different people.

Eh, that doesn't sound like the design of a security-critical device to me.

Many a "secure execution environment" has failed to deliver its security guarantees after some third-party clown was given access to run their DRM module or whatever, and introduced vulnerabilities while doing so.

Devices that are serious about security tell the third party clowns to get their own chip. Although they may use a secure operating system as an extra layer of security, if it promises that.

beardyw• 2 years ago

The term "microcontroller" covers about a gazillion different chips, most of which this doesn't address. (The one which makes your Christmas tree lights flash?) It needs to be qualified.

Animats• 2 years ago

That's reasonable. There's a lack of good, free OSs for the space above Arduino and below Linux on Raspberry Pi. That's the land of VXworks and QNX, which are good, but not free. So people end up running an entire Linux environment, with all its vulnerabilities, on something that doesn't need it.

ducktective• 2 years ago

It would be nice if any NASA engineer could weigh in on why they used Linux for that Mars helicopter instead of an RTOS like mentioned above.

https://spectrum.ieee.org/nasa-designed-perseverance-helicop...

farseer2• 2 years ago

Because it's easy to work with. Even low end processors support it as long as they have an mmu.

kibwen• 2 years ago

Ingenuity had a relatively shoe-string budget and leaned heavily on off-the-shelf components. It was also a technology demonstration rather than anything mission-critical, so it didn't need absolute reliability.

Which isn't to say that NASA wouldn't necessarily use Linux in mission-critical applications; there exist real-time patches for Linux.

6SixTy• 2 years ago

That space is usually filled by FreeRTOS, no?

roland35• 2 years ago

FreeRTOS, and zephyr now

squarefoot• 2 years ago

There's a good number of them, although most aren't widely known outside of the embedded world.

Here's a list: https://www.osrtos.com/

farseer2• 2 years ago

Yocto Linux can be stripped down to the bare minimum for embedded applications. You can reduce your attack surface by a lot. The advantage of Linux on embedded is your new developers are up and running immediately. Something not possible with all the rest of os/rtos. Additionally lots of packages for diagnostic utilities like iperf etc are available even for obscure processors that run Linux. As long as battery life isn't a concern, let embedded Linux be an overkill, the advantages are just too great.

thebruce87m• 2 years ago

immediately

I love yocto, but ‘immediately’ can sometimes take a while!

RobotToaster3• 2 years ago

Microsoft ThreadX is open source.

I guess minix is kinda in that space too.

FreeRTOS has already been mentioned, but there's also NuttX/Vela.

efrecon• 2 years ago

Isn't contiki-ng another one?

buescher• 2 years ago

Micrium (uC/os-ii, uC/os-iii) is open source now. Best dead-trees book for an RTOS. I haven't shipped anything on it, so I have no other opinion.

https://github.com/weston-embedded/uC-OS3

tonetegeatinst• 2 years ago

Wouldn't something like tiny core Linux be the best compromise? Its the Linux kernal + bare essentials. You could probably harden it and modify it for this scenario

spiritplumber2• 2 years ago

I recommend TAQOZ for the Parallax Propeller 2.

RobotToaster3• 2 years ago

They made a second one? That's a blast from the past.

spiritplumber2• 2 years ago

yep. while it's less "a decade ahead" than the prop1 was back then, it's still a powerhouse. we use it for autopilots.

hoc• 2 years ago

For that Nordic 52 dongle... the ones I bought early on had locked bootloaders and only allowed apps on top of that, AFAIR, and needed at least some HW debugger connection to remove it.

Is this still necessary, included for TOCK or is not needed at all?

bongodongobob3• 2 years ago

I feel like if your microcontroller needs an OS you should be using an SoC? Genuinely wondering why'd you'd need an OS on a microcontroller.

AnimalMuppet2• 2 years ago

The line between "OS" and "not OS" is not binary. It's a blur. For that matter, there's not a clear line between "microcontroller" and "SoC", either.

Does your microcontroller have an external flash? Does it have a file system on that flash? Does that make it need an OS to support the file system?

Does it have enough memory to support allocation to different processes? Does that make it need an OS? And so on.

bongodongobob3• 2 years ago

Right, that's my question. You can use flash and display and whatnot without an OS. When are you using a microcontroller that you'd need the overhead of an OS where an SoC wouldn't be appropriate?

comradelion11• 2 years ago

It's the application that needs an OS, not the computer. It is possible (and isn't unheard of, though decreasingly common) to run software on a more featureful CPU with virtual memory and loads of RAM next door, without an OS, for example.

And it of course depends what one means by "a OS." But, generally, if you are running multiple tasks that might depend on shared resources, you might want an OS---after all, an OS is just something that mediates shared resources among different applications.

You might prefer to use a microcontroller because of power constraints, security (generally easier to mitigate physical attacks and side channels in simpler hardware), or cost and you don't need more resources.

bongodongobob3• 2 years ago

If you're even talking about virtual RAM, you're already in SoC territory. And the concept of an "application" on a microcontroller is foreign to me. I still don't get it.

krisoft• 2 years ago

This looks quite interesting and promising.

Just to illustrate how hard is to naming things without accidentally colliding with some meaning in some language: “tockos” in hungarian means a light smack, specifically one aimed at the back of the head. Luckily that is something I quite often want to give to computers (micro or otherwise). So all is well with the balance of the universe.

comradelion11• 2 years ago

One of the Tock maintainers here, happy to answer any questions.

For some context, Tock has been around for a number of years now (we first built it in 2015). Beyond it's intended original purpose (naval gazing academic research) it runs the Chromebook embedded controller, has similar other similar applicatioms in data center root-of-trust, Microsoft's Pluton (rumor has it, for some future version anyway), and others.

fanf22• 2 years ago

How does Tock compare to Oxide’s Hubris?

comradelion11• 2 years ago

Note bcantrill's comment below for corrections of my misstatements here.

Oxide was involved with Tock before building Hubris. They are similar in some ways with somewhat different "visions" for the end use case. Hubris compiles all "applications" into the "kernel", and relies exclusively on the type system for isolation---in this sense it is a much more traditional RTOS, just written in Rust (and well designed!). Whereas Tock targets applications that are not just in Rust, and may be dynamically load/replaced/removed separately from the kernel---in this sense it is much more similar to a traditional desktop/server OS but designed for significantly lower resourced settings. This also makes Tock more robust to applications that are actually untrusted or unreliable.

There is also of course a difference in development and evolution. Hubris is developed by Oxide and released open source, while Tock is more community based and, thus, more open to supporting a variety of use cases. This is both bad and good. If your use case is exactly Oxide's use case, it's likely Hubris is better than Tock (there is just no design decision baggage for other use cases). If you're use case is a bit different, Tock starts to be more appropriate.

A side note that I think the Hubris-Tock relationship is a real positive case for open source development. Oxide was very transparent and forthcoming when they decided to switch away and offered a lot of useful feedback. I hope they took some ideas from Tock and I think we took some ideas from following Hubris.

nevi-me• 2 years ago

What are practical applications that I can build for home use on Tock, using either ESP32-C3 or NRF52840 dongle?

comradelion11• 2 years ago

In principle many things, but you're mostly restricted by what you can meaningfully physically build with off the shelf parts. Prototyping with a bunch of wires on a bread board is one thing... Sticking that on your wall is another. And most off the shelf dev kits have very few useful sensors/actuators on board.

The cannonical thing is an environment sensor (so a temperature et al sensor). Unfortunately, often a larger HVAC system will integrate with sensors through some proprietary protocol (even Thread based systems like Nest don't necessarily work with just any thread-based sensor, but you could of course hack something with Home assistant).

One of the maintainers has been using it on the side for a plan monitoring system.

All of these require some sensors beyond just the dev kit, which are typically pretty bare bones.

You can build a two factor auth device with the nrf52840 dongle (OpenSK is built with Tock), which requires basically no extra peripherals.

I've used the nrf52840dk to control a garage door, which similarly only need a couple wires.

sillywalk4• 2 years ago

I thought the Chromebook embedded controllers run Zephyr?

comradelion11• 2 years ago

Nope. It used to be a home baked solution that was totally unrelated to (and pre-dates) Zephyr. I believe that is the one that is still in the ChromiumOS EC repo, but for the last year or so, it's a Tock-based system.

transpute2• 2 years ago

Microsoft's Pluton (rumor has it, for some future version anyway)

Which embedded OS does Pluton run today?

comradelion11• 2 years ago

Good question, I don't know! I would guess it's a home baked solution, but I believe Pluton, the hardware, is changing as well (I am not an authority on this, I only know a bit from talking with the developers at Microsoft who work on the next gen stuff).

hollerith• 2 years ago

I was unimpressed after reading Tock's home page (and I think I read it all), but then I was quite impressed by your "runs the Chromebook embedded controller" (because the ChromeOS team seems to me to be great at security).

I humbly suggest adding that to the home page (being careful to mention that the ChromiumOS EC repo has not been updated to reflect that fact and to mention that before about a year ago, something else ran the EC).

SandmanDP• 2 years ago

Previously discussed in 2017: https://news.ycombinator.com/item?id=15647452

comradelion11• 2 years ago

Shameless plug for anyone interested in these kinds of systems and near or able to travel to San Diego, that TockWolrd is happening at the end of this month and has general-audience oriented talks and tutorials for this first year! Please join us! https://world.tockos.org

A secure embedded operating system for microcontrollers

Related Stories