►
From YouTube: RustFest Zürich 2017 - A Rust-based Runtime for the Internet of Things by Niklas Adolfsson
Description
In this talk, I’ll share my experience evaluating Rust as a basis for building Internet of Things (IoT) applications down to the bare metal.
In principle, Rust’s combination of memory safety and low runtime overhead makes it an ideal candidate for building IoT applications which currently are almost the exclusive domain of C and C++. As part of my master’s studies, we ported Tock, an embedded operating system written in Rust, to a Bluetooth Low Energy SoC processor.
In the end, we found that Rust is usable for building IoT applications with similar power consumption as production C implementations.
About Niklas Adolfsson:
Niklas Adolfsson is embedded software developer at Cybercom in Sweden. He received a B.S. degree at in Electrical at University of Borås and is currently pursing a MSc. in Computer Science at Chalmers University. He is also a contributor to Tock and has worked as a dependability engineer at SP Technical Research Institute of Sweden.
B
B
And
what
is
this
talk
about?
This
talk
is
about
my
experience
using
rust
to
build
Bluetooth,
Low
Energy
firmware,
and
we
have
used
a
new
IOT
operating
system
named
thought
which
is
written
in
rust
actually,
and
we
are
ported
to
development
kits
for
IOT
prototyping
named
NR,
51,
DK
and
NRF
52
DK
and
we
have
implemented
a
couple
of
drivers,
including
Bluetooth
Low,
Energy
and
I
will
focus
on
an
RF,
51
DK.
In
this
talk,
because
I
will
show
you
some
benchmarks
on
it
that
we
have
performed
further
along
I.
B
Don't
I,
don't
I
will
not
explain
what
was
this
and
how
it
achieves
speed,
safety
and
concurrency,
and
that
stuff,
because
I
assume
you're
all
familiar
with
that.
And
if
you
have
any
questions,
I'll
be
happy
to
answer
them.
After
this
talk
and
if
you
run
out
of
time
come
see
me
be
happy
to
talk
to
you,
but
what
is
really
Internet
of
Things,
well,
its
traditional
physical
systems
that
are
now
gaining
connected,
such
as
course,
light
bulbs,
refrigerators,
small
fitness,
bracelet
and
so
on.
B
B
For
a
reason
of
low
power
and
low
cost,
and
but
some
of
you
may
not
be
familiar,
what
really
a
microcontroller
is
it's
an
entire
computer
integrated
on
a
single
chip
which
typically
has
one
one
core
CPU
with
tens
of
megahertz
tens
of
kilobytes
of
RAM
hundreds
of
kilobytes
of
flash,
but
but
like
memory,
a
memory
management
unit
which
means
that
they
don't
have
any
notion
or
virtual
address
space,
and
also
these
are
getting
equipped
with
radio
ships
integrated
such
as
this
board
here
and
I
commonly
use
protocol
for
this.
It's
Bluetooth
Low
Energy.
B
Some
of
you
may
be
familiar
with
Bluetooth
classic
bluetooth,
but
you
can
think
about
Bluetooth
Low
Energy
as
as
Bluetooth
classics,
little
brother,
which
focus
on
low-end
devices
and
low-power
applications.
For
example,
IOT
device
running
running
on
a
battery
can
run
for
months
using
Bluetooth,
Low
Energy
and
its
support
arrange
less
than
hundred
meters.
I
will
show
you
an
example
later,
so
maybe
we
can
try
if
you
can
reach
it
at
the
back,
but
Bluetooth
Low
Energy
has
two
type
of
packets.
It
has
advertisement
packets,
which
are
essentially
broadcasting,
for
example.
B
This
can
be
used
for
a
device
to
advertise
I'm
device
X,
and
you
can
connect
to
me
and
I
provide
these
services
or
it
can
also
be
used
for
arbitrary
broadcasting,
such
as
advertising,
GPS,
coordinates
or
something
like
that,
and
these
are
sent
on
three
dedicated
channels
periodically,
and
then
we
have
something
called
data,
packets
and
data,
packets
or
packets,
which
support
a
bigger
pelo
or
use
the
in
connections.
But
I
will
not
talk
anymore
about
this
because
we
have
not
focused
on
it.
B
I
just
want
you
to
see
this
tact
to
follow
along
with
this
talk,
but
let's
continue
about
the
IOT
characteristics
and
because
these
devices
are
located
in
areas
with
limited
physical
access
or
no
physical
access
at
all.
Reliability
is
more
important
than
in
general-purpose
computers,
because
we
cannot
rely
on
humans
to
recover
from
failures
and
also
these
are
integrated
in
safety,
critical
systems
and
these
can
endanger
human
life.
B
At
the
same
time,
they
need
to
provide
complex
drivers
as
IP
stack
or
something
like
that,
and
for
those
reasons
in
general
and
special
purpose
operating
system
is
used
in
general.
These
operating
systems
trade-off
memory
and
power
efficiency
over
safety
features,
and
that
means
that
these
operating
systems
don't
provide
any
memory
solution.
But
what
does
that
mean?
Well,
it
means
that
they're
all
essentially
no
net,
no
separation
between
applications
and
kernel,
and-
and
that
means
that
the
entire
computing
base
needs
to
be
trusted.
B
So,
let's
consider
this:
if
we
have
a
faulty
application
with
a
buffer
overflow,
for
example,
what
will
happen?
Will
disable,
for
example,
no,
it's
much
worse
than
a
seg
fault,
it's
actually
undefined
behavior,
because
we
have
no
notion
of
virtual
address
space,
and
this
can,
for
example,
write
over
the
kernel
and
crash
the
entire
thing.
And
yes,
it's
not
surprised
that
IOT
is
insecure.
B
During
this
summer,
security
researchers
found
a
buffer
overflow
vulnerability
in
an
open
source
library.
We'd
made
hundreds
millions
of
devices
vulnerable.
But
what
can
we
do
about
this?
Well,
we
can
use
a
new,
safe
programming
language,
such
a
trust
or
rust
and
rust.
Actually,
the
benefits
of
having
memory
safety
prevents
these
memory.
Corruption
attacks
completely
along
with
fine-grained
memory,
control
and
low
runtime
overhead
makes
Rost
an
ideal
candidate
to
implement
IOT
applications
in
and
andross
can
actually
reduce
the
number
of
rely
on
vulnerable
IOT
devices.
This
sounds
great
right.
Why
don't?
B
We
write
an
IOT
operating
system
in
rust?
Well,
it
turns
out
that
somebody's
already
done
this,
which
leads
us
into
talk
talk,
is
a
new,
secure,
LTE
operating
system
which
actually
provides
memory
solution.
I
will
come
back
to
that
in
the
next
slide,
how
but
it
focused
on
reliability
and
safety
security.
Sorry,
it's
it's
part
of
a
research
project
where
they
rethink
the
entire
IOT
domain
from
the
ground
up
and
talk
actually
support
at
the
moment.
Talk
support,
arm,
cortex-m
microcontrollers,
which
you
can
see
here
to
the
right,
and
this
is
one
of
them.
B
Let's
continue
and
talk
about
textual
talk,
because
I
think
it's
very
interesting.
As
I
said,
it
provides
actually
memory
solution
and
it
talked
actually
use
a
process
based
abstraction
where
they
have
something
called
user
space
processes
that
are
all
restricted
and
executed
outside
the
kernel
with
restricted
privileges
and,
for
example,
it
a
process
only
has
access
to
its
own
heap
stack
in
data
segment,
and
it
uses
this
by
using
a
new
memory
feature
in
arm
cortex-m
microcontrollers,
which
is
called
an
MP
you
a
memory
protection
unit.
B
You
can
view
it
as
a
very
lightweight
MMU,
but
we
know
virtual
address
space
and
moving
on
to
the
kernel
itself,
it's
kind
of
a
microkernel,
but
not
really
because
it
has
two
two
components.
First
of
all,
they
have
the
dicobalt
kernel,
which
has
a
hardware,
abstraction
layer,
scheduler
and
so
on,
and
then
top
you
actually
have
something
called
capsules
and
capsules,
or
essentially
device
drivers,
but
because
tox
targets
very
tiny
computers.
B
This
cannot
be
executed
as
separate
uses
based
processes
and
instead
they
are
integrated
in
kernel,
but
relies
on
the
type
system,
a
rust,
which
makes
it
very
unlikely
that
they
will
fail
along
with
that,
the
kernel
itself
is
statically
allocated
for
safety
reasons,
but
that's
all
I
want
to
say
about
talk
which
moves
which
moves
on
to
what
we
have
done.
We
have
used
this
micro
controller.
I
will
not
touch
this
because
they
didn't
work
that
well
before,
which
is
an
RF
51.
B
It's
arm
cortex-m
CRO
microcontroller,
which
has
a
CPU
of
60
megahertz
ram
of
32
kilobytes,
flash
256
kilobytes
comes
with
a
radio
integrated
on
the
on
the
ship
in
the
red
rectangle.
Actually,
that
is
an
RF,
fixed
ones
and
process.
The
microcontroller
itself
support
some
other
referrals,
such
as
AES,
true
random
generator,
temperature
sensor
and
similar.
B
But
what
have
you
really
done
to
illustrate
this?
This
blue,
this
blue
box,
is
actually
an
effect
one
microcontroller
where
we
have
implemented
some
device
drivers
for
actually,
which
is
a
temperature
sensor,
AES
encryption
through
random
generator
and
blue
to
flow
and
the
driver
over
the
radio
and
to
create
a
good
example
for
you
to
understand
what
this
really
is.
B
So
we
have
this
board
here,
it's
supposed
to
advertise.
Yes,
it
does
so,
for
example,
first
of
all
in
the
top
here
we
have
the
talk,
taco
voice,
which
is
the
advertisement
name.
This
is
nothing
cryptid,
and
then
we
have
the
encrypted
payload
down
here
down
here
and
and
the
app
actually
has
the
hard-coded
encryption
key
that
can
decrypt
these
things
and
that's
what
I
wanted
to
show
you.
B
B
B
So
therefore,
we
have
implemented
this
EC
at
the
moment,
but
this
is
this
is
this
is
really
not
that
complicated
and
most
of
the
complexities
actually
in
the
kernel
at
the
moment,
but
we
have
a
Bluetooth
Low
Energy
library,
for
example,
to
send
advertisement
to
configure
different
data,
configure
the
radio
to
send
on
a
given
advertisement,
interval
and
so
on,
and
also
we
can
use
it
to
do
passive
scanning.
But
we
don't
support,
connections
and
complicated
security
modes
at
the
moment.
B
But
let's
move
on
and
talk
about
what
we
have
done
in
the
kernel
and
we
have
something
called
ble
capsule,
which
is
essentially
the
logic
of
the
entire
beautiful,
oh
and
the
device
driver
it.
It
keeps
track
to
put
the
processor
to
sleep
between
advertisements
and
also
include
the
ble
bluetooth,
low
energy
state
machine
and
similar
things.
B
It's
written
in
approximately
400
lines
or
Russ
code
and
I
cannot
show
you
all
the
code,
of
course,
but
I
can
only
show
you
one
one
snippet,
that
we
have
that
for
configuring
data
in
advertisement
packet
and
as
you
can
see,
we
have
to
use
an
iterator
and
you
use
nested
closures
to
do
this
because
we
are
iterating
through
all
boys
here,
which
is
very,
which
is
very
dangerous,
but
in
rust
we
can
use
the
type
system
to
benefit
all
this,
and
this
is
actually
very
bug.
Bug
prone
in
C.
B
B
But
that's
all
I
want
to
give
you
about
actual
implementation
today,
and
but
we
also
wanted
to
evaluate
these
device
drivers
and
we
did
some
comparisons
with
with
the
state
current
state
or
thai
OTE
operating
systems.
We
elected
this
based
on
that
they
are
open
source,
they
provide
drivers
for
our
board
and
they
also
are
open
source
and
we
did.
We
did
actually
measure
the
power
on
the
board.
B
We
did
this
by
advertising
during
10
seconds
and
we
configured
each
operating
system
in
the
in
the
same
way,
which
was
that
we
used
advertisement
interval
or
150
milliseconds.
We
used
transmitting
power
of
0
DBM
and
we
used
the
payload
size
of
20,
2
bytes
and
for
each
operating
system
we
have
3
balls.
The
red
ball
illustrates
the
total
power
consumption
during
during
this
period.
B
B
First
of
all,
learning
an
IOT
operating
system
with
limited
documentation.
Is
it's
really
hard?
For
example,
how
do
the
system
calls
work?
How
do
we
pass
a
buffer
to
the
kernel?
How
do
we
iterate
over
raw
bytes
in
the
kernel?
You
saw
an
example
of
that
earlier,
which
which
was
kind
of
hard
for
for
us
to
understand,
and
but
the
tote
has
a
nice
community.
B
We
then
I
see
channel
where
you
can
go
and
ask
questions
and
we
have
got
a
lot
of
help
from
them
actually,
but
a
top
of
that
we
have
no
debugging
symbols
at
all
so
and
for
me,
I'm
not
really
that
familiar
with
or
assembly,
and
this
was
really
hard.
So
so
we
thought,
let's
not
do
debugging
with
gdb.
Let's
go,
do
printouts
in
the
kernel
instead,
but
that
didn't
work
either
so
the
first,
the
first
time
we
did
only
blinked
with
LEDs,
but
but
eventually
we
actually.
B
B
But
what
I
want
to
give
some
of
my
views
on
using
Ross,
because
I
only
use
Ross
for
one
year,
I
would
say
as
Maddi
others
that
the
learning
curve
is
ready,
steep
learning,
ownership,
interior
mutability,
lifetimes
and
similar
things.
It's
hard
to
get
your
head
around,
but
the
compiler
in
rust
is
awesome.
It
helps
you
give
you
good
good
error
messages
and
write
learned
educates
you
how
to
to
write
good
code.
B
Also
I
want
to
claim
that
the
using
rosters
actually
made
me
a
better
programmer,
especially
about
a
C
programmer,
because
now
I
know
exactly
which
which
operations
are
unsafe,
for
example,
the
reference
a
pointer
or
something
like
that,
and
that
has
helped
me
actually
writing
C
as
well
and
and
when
using
rust.
I
have
not
experienced
many
crashes,
but
I.
B
Advise
you
don't
do
unwrapped
on
option
types
because
then
then,
you're
on
your
own
and
I
just
want
to
give
a
shout
out
to
the
rust
IRC
channels,
because
I
have
never
experienced
something
like
that
in
another
community
and
it's
a
very
good
resource
to
learn
new
things
and
ask
questions
that
I
really
appreciate.
Keep
it
up
and
I
always
want
to
dream
a
little
bit
as
well.
B
What
I
want
to
see
in
the
future
and
I
want
to
see
rust
in
safety,
critical
applications
such
as
medical
devices
out
in
almost
vehicles
and
similar
fields,
because
I
know
how
hard
it
is
to
write
safe
and
secure
C
code.
For
example,
you
have
to
go
through
a
very
painful
process
and
it
costs
a
lot
of
money
which
I
think
Russ
can
reduce.
B
But
one
tricky
thing
that
rust
has
to
do
is
to
convince
the
embedded
community
to
adopt
rust.
So,
for
example,
if
you
try
talk
to
and
by
the
software
engineer,
he
or
she
will
say,
I've
been
written
C
for
20
years
and
it
works
just
fine,
but
clearly
it
doesn't,
because
we
have
a
lot
of
security
problems
and
also
when
nupro
grammars
coming
into
the
field.
Their
first
programming
language
is
probably
not
see.
B
They
go
to
more
high-level
programming
languages
which
rust
is
a
better
fit
for
and
the
less
the
last
thing
I
want
to
see
is
for
Fletch
I
des
with
integrated
debuggers
in
Ross,
especially
in
the
embedded
community,
because
everybody
doesn't
like
to
use
Rhodey
DB
with
a
text
prompt,
even
though
it's
very
powerful
I
just
want
to
leave
you
with
some
some
last
words.
We
would
like
to
see
more
country
abuses
talk,
so
if
you
want
to
get
get
into
that,
buy
some
board
by
some
of
the
supported
boards
or
put
your
own
favorite
processors.
C
B
A
B
Good
question
I
think
I,
don't
this,
but
I
didn't
want
to
show
this,
because
it's
as
much
more
to
do
with,
because
we
may
measure
the
efficiency
of
the
system,
calls
B
between
the
different
operating
systems
and
and
I
think
this
has
something
to
do
with
overhead
in
the
OSHA
texturally
different
operating
system,
not
nothing
to
do
with
which
C
versus
rust.
So
it's
hard
to
say!
So!
That's
why
I
didn't
want
to
show
this
picture,
but
I
figured
I
I
get
this
question
and
it's
better
yeah.
E
B
B
B
G
B
Think,
actually,
if
you
go
to
I,
think
his
name
is
Joel
gay
or
something
like
that.
Sorry,
if
I
pronounce
his
name
wrong
but
I
think
he
is
better
to
answer
that
question
because
he
has
done
a
lot
of
grace
in
rust
for
the
embedded
stuff.
So
ask
that
question
to
him
is
that
I
think
it's
more
more
appropriate
to
answer
that
question.