A secure embedded operating system for microcontrollers
tockos.org
tockos.org
I love yocto, but ‘immediately’ can sometimes take a while!
Here's a list: https://www.osrtos.com/
Zephyr, is an OS. And imo will be eclipsed by embedded variants of Linux quickly as chips are coming up in performance. There is just no path for co-existence I see.
https://spectrum.ieee.org/nasa-designed-perseverance-helicop...
1. You can apply patches which turn Linux into RTOS.
2. You can offload RTOS-specific tasks into separate simpler MCUs and use ordinary OS to communicate with them in a more relaxed way.
It's running F´ (F Prime) flight control software,[1] which can run under Linux, as well as on MCUs with no OS. I'm not sure on which processors it's running.
"The two redundant TI Hercules safety processors serve as the low-level flight controller (FC); each has dual-core lockstep ARM Cortex-R5F and ECC protected Flash and RAM. The two processors run in sync and are provided with the same clock and data by the FPGA, which handles all the sensors and actuators interface. The lockstep mechanism does cycle by cycle error detection. If a fault is detected, it signals the error to the FPGA; the FPGA switches to the other processor and power cycles the faulty one, so the flight control software continues to run without disruption.
..
At the heart of the helicopter avionics is a Field-Programmable Gate Array (FPGA). The FPGA implements the custom digital functions not implemented in software due to resource limitations of the processors (e.g. I/O or bandwidth limits), timing requirements, power considerations, or fault tolerance considerations. The FPGA device is a military-grade version of MicroSemi’s ProASIC3L, which uses the same silicon as the radiation-tolerant device from the same family. The FPGA perform all critical I/O to the sensors and actuators, and fault managment functions including detecting error flags from the MCU and hot-swapping to the functioning MCU in case of an error. The FPGA performs vehicle flight control including an attitude control loop operating at 500 Hz, an outer motor control loop, waypoint guidance, sensor I/O from the IMU, altimeter and inclinometer, and analog telemetry for current and temperature sensing. It is responsible for system time management, interfaces to the IMU, altimeter and inclinometer sensors. It implements the “inner” motor control loop used for the two brushless rotor motors and the six brushed motor servos (three at each rotor swashplate), as well as power management and thermal control functions."[0]
[0] https://rotorcraft.arc.nasa.gov/Publications/files/Balaram_A...
Which isn't to say that NASA wouldn't necessarily use Linux in mission-critical applications; there exist real-time patches for Linux.
I guess minix is kinda in that space too.
FreeRTOS has already been mentioned, but there's also NuttX/Vela.
For some context, Tock has been around for a number of years now (we first built it in 2015). Beyond it's intended original purpose (naval gazing academic research) it runs the Chromebook embedded controller, has similar other similar applicatioms in data center root-of-trust, Microsoft's Pluton (rumor has it, for some future version anyway), and others.
I humbly suggest adding that to the home page (being careful to mention that the ChromiumOS EC repo has not been updated to reflect that fact and to mention that before about a year ago, something else ran the EC).
"Starting roughly in July of 2021, Chromebooks switched from the original Google Chrome EC to an application based on the Zephyr Project RTOS."[0]
[0] https://chromium.googlesource.com/chromiumos/platform/ec/+/H...
EDIT: looks like there's something about Tock running on OpenTitan
I don't know of a public announcement. Tock's license is acknowledged in Chromebook's licenses and those involved in Tock know simply because that team talks to us (a few of us interned on that team back when we were PhD students to help the effort at various stages as well).
It's not a secret, but it's also not something that seems to be high on anyone's todo list over there to announce.
The cannonical thing is an environment sensor (so a temperature et al sensor). Unfortunately, often a larger HVAC system will integrate with sensors through some proprietary protocol (even Thread based systems like Nest don't necessarily work with just any thread-based sensor, but you could of course hack something with Home assistant).
One of the maintainers has been using it on the side for a plan monitoring system.
All of these require some sensors beyond just the dev kit, which are typically pretty bare bones.
You can build a two factor auth device with the nrf52840 dongle (OpenSK is built with Tock), which requires basically no extra peripherals.
I've used the nrf52840dk to control a garage door, which similarly only need a couple wires.
Oxide was involved with Tock before building Hubris. They are similar in some ways with somewhat different "visions" for the end use case. Hubris compiles all "applications" into the "kernel", and relies exclusively on the type system for isolation---in this sense it is a much more traditional RTOS, just written in Rust (and well designed!). Whereas Tock targets applications that are not just in Rust, and may be dynamically load/replaced/removed separately from the kernel---in this sense it is much more similar to a traditional desktop/server OS but designed for significantly lower resourced settings. This also makes Tock more robust to applications that are actually untrusted or unreliable.
There is also of course a difference in development and evolution. Hubris is developed by Oxide and released open source, while Tock is more community based and, thus, more open to supporting a variety of use cases. This is both bad and good. If your use case is exactly Oxide's use case, it's likely Hubris is better than Tock (there is just no design decision baggage for other use cases). If you're use case is a bit different, Tock starts to be more appropriate.
A side note that I think the Hubris-Tock relationship is a real positive case for open source development. Oxide was very transparent and forthcoming when they decided to switch away and offered a lot of useful feedback. I hope they took some ideas from Tock and I think we took some ideas from following Hubris.
It is definitely true that Hubris does not have (and never will have) a dynamic loading facility: dynamic loading is very important to Tock, but we saw that it was taking us not just away from our use case but directly contrary to it. In contrast, Hubris has exclusively static task assignment -- which has proved to be a very important constraint for overall system robustness as it allows things task restart to happen without fear of unavailability of resources. Cliff Biffle expands on more details of Hubris in his OSFC 2021 talk[0].
I also don't think it's accurate to speak of an "exact use case" for Hubris, as we ourselves use it in disparate applications: among other things, it runs our root-of-trust, our service processor, our power shelf controller, and on our manufacturing line to program parts. What these use cases have in common is that they are embedded microcontrollers in which robustness is essential. This is not to say that Hubris is a fit for all embedded use cases, of course -- but the fit is certainly more broad than how we happen to be using it.
In terms of other contrasts to other embedded systems, we have spent quite a bit of time on debugging infrastructure, with our debugger being co-designed with the operating system; more details on this in Matt Keeter's OSFC 2023 talk.[1]
[0] https://talks.osfc.io/osfc2021/talk/JTWYEH/
[1] https://talks.osfc.io/open-source-firmware-conference-2023/t...
Which embedded OS does Pluton run today?
Just to illustrate how hard is to naming things without accidentally colliding with some meaning in some language: “tockos” in hungarian means a light smack, specifically one aimed at the back of the head. Luckily that is something I quite often want to give to computers (micro or otherwise). So all is well with the balance of the universe.
I have no idea how the landscape looks in general, though.
Virtually anything with a radio these days (the MSPs were holdouts but mostly those are Cortex-M these days as well)
Eh, that doesn't sound like the design of a security-critical device to me.
Many a "secure execution environment" has failed to deliver its security guarantees after some third-party clown was given access to run their DRM module or whatever, and introduced vulnerabilities while doing so.
Devices that are serious about security tell the third party clowns to get their own chip. Although they may use a secure operating system as an extra layer of security, if it promises that.
I like Rust as much as the next guy but let's not pretend we couldn't do this with C, C++ or assembly.
Does your microcontroller have an external flash? Does it have a file system on that flash? Does that make it need an OS to support the file system?
Does it have enough memory to support allocation to different processes? Does that make it need an OS? And so on.
To your specific question: I'm not sure it goes that direction, because a full OS depends on the presence of certain features on the chip. I can think of some examples of it going the other way, though - of an SoC where you don't need or want a full OS.
And it of course depends what one means by "a OS." But, generally, if you are running multiple tasks that might depend on shared resources, you might want an OS---after all, an OS is just something that mediates shared resources among different applications.
You might prefer to use a microcontroller because of power constraints, security (generally easier to mitigate physical attacks and side channels in simpler hardware), or cost and you don't need more resources.
Is this still necessary, included for TOCK or is not needed at all?