Rust for Embedded Systems: Current State and Open Problems

Embedded software is used in safety-critical systems such as medical devices and autonomous vehicles, where software defects, including security vulnerabilities, have severe consequences. Most embedded codebases are developed in unsafe languages, specifically C/C++, and are riddled with memory safety vulnerabilities. To prevent such vulnerabilities, Rust, a performant memory-safe systems language, provides an optimal choice for developing embedded software. Rust interoperability enables developing Rust applications on top of existing C codebases. Despite this, even the most resourceful organizations continue to develop embedded software in C/C++. This paper performs the first systematic study to holistically understand the current state and challenges of using Rust for embedded systems. Our study is organized across three research questions. We collected a dataset of 6,408 Rust embedded software spanning various categories and 6 Static Application Security Testing (SAST) tools. We performed a systematic analysis of our dataset and surveys with 225 developers to investigate our research questions. We found that existing Rust software support is inadequate, SAST tools cannot handle certain features of Rust embedded software, resulting in failures, and the prevalence of advanced types in existing Rust software makes it challenging to engineer interoperable code. In addition, we found various challenges faced by developers in using Rust for embedded systems development. CCS CONCEPTS • Security and privacy → Embedded systems security; • Computer systems organization → Embedded software; Real-time operating systems; • Hardware → Safety critical systems.