Framekernel: A Safe and Efficient Kernel Architecture via Rust-based Intra-kernel Privilege Separation

This paper introduces the framekernel architecture, a novel approach to operating system (OS) design that utilizes safe language-based, intra-kernel privilege separation. This architecture combines the security advantages of microkernels with the performance efficiencies of monolithic kernels. A framekernel is composed of a privileged OS Framework and de-privileged OS Services. The Framework encapsulates all low-level, unsafe operations into high-level, safe abstractions, thereby enabling the Services to implement a wide array of functionalities in a safe language. The primary challenge in designing framekernels lies in maintaining a minimal Trusted Computing Base (TCB)-the Framework- while supporting extensive functionalities. This paper outlines the design principle and rules that facilitate this balance. Our Rust-based framekernel prototype, Asterinas, validates the framekernel concept by supporting over 130 Linux system calls and a broad range of OS features and device drivers, based on a significantly reduced TCB.