Rust SIG Meeting - 2026-03-03

[PLeVasseur]

Hey folks 👋 welcome to our fourth meeting of 2026.

Rust SIG Meeting 2026-03-03

Agenda

1. Solicitation of notetaker
   • @PLeVasseur
2. Rust Watercooler Chat Topic - Measuring the gap between C and Rust; Daniel Silverstone - Codethink
3. Review GitHub repo content and discuss how to enrich (Pete)
   1. Issues
   2. Discussions are now active! We'll take meeting notes here based on previous agreement in the SIG.
4. Office hours - Rust + Automotive questions - come chat! (All)
5. Discuss upcoming events / news related to Rust & Automotive (All)
6. Meeting close

Check-in area

(24 people at max, even if not everyone left their GitHub handles)

• @PLeVasseur
• @AnotherDaniel
• @danielsilverstone-ct
• @jordanbailes
• @perrymcmanis144
• @krucod3
• @bharatGoswami8
• @mhatzl
• @mmi-dot
• @cpetig
• @arvindr19
• @darkwisebear
• @thatdevsherry
• @TomFleischmann
• @rama492
• @danutza77

Housekeeping section, please add

• Document space: https://drive.google.com/drive/folders/1Ub0qTLKvTFilPC9TFVEdTyWn_9qJ-vYD?usp=drive_link
• GitHub repo: https://github.com/rust-sig/rust-sig
• Eclipse SDV Slack channel: #rust-sig

Tasks

• <task>

Meeting Minutes

Daniel Silverstone - Codethink: Measuring the gap between C and Rust

Discussed with exida; suggested to Daniel to take a test suite writen for C programming language static analysis tooling

• led to a talk at an exida safety symposium
• less "why to switch to Rust" more "here are gaps with managed languages, justify why needing to continue to use C"
• "using C because of x, y, z" but if a single language there's not a choice and this could be a challenge

exida asked to replicate C programming language suite into Rust

• picked this up in earnest for talk that was given at OxidizeConf; helpful for Trustable Software Framework (TSF) demonstration too

Begins sharing Exida Ctools in Rust

• repo is public:
• Every single ctools item mapped to Rust
• Of the 117 items, 105 are entirely mitigated (!)
• 12 are not mitigated
  • 6 not detected
  • 4 unimplemented
  • 2 IEEE-754 floating point defined

Outcomes

• Rust code likely to not be "just as good", but "potentially better"

Discussion

S-CORE is aiming for safety-critical with Rust

• Came to conclusion somewhat recently that some decisions C made make sense
• e.g. need to tackle cases in unsafe and mitigate them
• If all/many cases in C are mitigated, why use C?

Layering/mitigation

• Most software written in Rust would be safe code
• There may be certain crates which use unsafe, but these will be the exception and not the majority certainly
• Very valuable to have the ability to say "this crate contains no unsafe"

Interop between Rust <=> C and/or C++

• Challenges with safe Rust
• rsvg library: https://gitlab.gnome.org/GNOME/librsvg
  • Froze C API; will not change this
  • Rewrote modules underneath from C to Rust
  • Rust code exposing same API as before
  • Eventually subtracting the APIs once completed for full safe library

Some on-the-way work for production-intent software

• Interfacing with C++ a lot
• Variation on WebAssembly component model which makes clear "who owns what" when it comes to memory via the interface: C++ or Rust
• Compile component to WebAssembly
• Available publicly: https://github.com/cpetig/wit-bindgen
• Works up to even being able to use futures in C++
• Gave a talk about this at WebAssembly conference 1.5 years back
• Would need to specify ABI in a way that's well-defined
  • Up till now getting code running with streams between C++, want to upstream :)
• How to square one maintainer with the work?
  • This is the public version of internal work :)

Challenges in production with interop

• In fast-paths, where cannot afford to heap-allocate things on stack when working between C, C++ <=> Rust
• Standard types need ABI compatible types
  • Depends on standard library you're using
• C++ has non-destructive customizable moves
  • Rust has the opposite
• Challenges with corner cases; can

Who has tried to safety-certify Rust code? Have we seen other lessons learned?

• Range-limited types in Rust would be good / needed; currently limited
• Can be very important in safety-critical software for making safety-case
• There are some ecosystem solutions, but not baked into the core:
  • https://github.com/disiamylborane/ranged_integers
  • https://crates.io/crates/bounded-integer

What about fault-induction support in Rust code?

• For safety-monitor written for CTRL OS needed to write their own
• Easy way out: Interface between WebAssembly components; can simply have strict contract via it.
  • Can modify communications at any point; have to make modules small enough
  • Since compiled to native, no real down-side to this
• For software written at ASIL B; seems like "real" fault injection may not be necessary
  • have interfaces defined
  • inject faulty data
  • currently exploring fuzzed data injection as well
  • for unit tests simply using mocking framework
  • still have to handle and suffer under things like jitter, single challenging non-deterministic failures and so on
• For the safety-monitor the goal was at test time: "what if a cosmic ray flipped exactly this bit?"
  • Need to detect and mitigate
  • Was very difficult to achieve in a multi-threaded Rust environment
  • Needed to make a precise fault, e.g. flip bit three in this field, of this structure held by that hashmap behind that synchronization

What happens if my configuration data gets corrupted in-memory (e.g. hardware went wrong due to cosmic ray and/or software that I'm linked to went wrong)?

• Safety-related stuff at ASIL B need to have it be in some "safe" range
  • If provided at initialization time have CRC32 to confirm it's reasonable
  • Effectively double-storing and make sure to have it be in known good state or default to "perhaps not as smooth, but reasonable"
  • co-located and/or cross-verified data seems quite nice
  • If RAM is not safe enough, then have "real" and XOR'ed data
    • After loaded into register and then XOR with the safe "real" data in e.g. NVRAM or ROM
    • Not necessary unless ECC is not available / enabled at hardware level
  • The CRC32 can help with recovering some damaged data
• There are some encoding states with higher Hamming distances which could be useful. ECC RAM is most common or CRC32. Depends on business case vs hardware cost and so on.

For folks interested in looking at a C++/Rust integration example with some security considerations, Mozilla's Firefox Desktop has a lot of viewable docs. Firefox remains a very large C++ codebase, and has significant Rust in it both in terms of modules as well as internals:

• codebase: https://searchfox.org/
• development docs: https://firefox-source-docs.mozilla.org/build/buildsystem/rust.html
• wiki with some info/history: https://wiki.mozilla.org/Oxidation
• Ralph Giles' discussion of shipping Rust in Firefox: https://medium.com/mozilla-tech/deploying-rust-in-a-large-codebase-7e50328074e8

Stuff coming up for Rust

• Rust Nation UK
  • Talks are now live!
  • Here's the talk I gave on why some in safety-critical industries see promise in Rust.
• ACC US US
  • Pete and Florian will be there talking about Rust for safety-critical systems
• Embedded World
  • Come out to see folks working on Rust + Safety-Critical
  • Eclipse Foundation will be there too
• State of Rust Survey Results
• OCX Coming up
  • Rust + Safety-Critical Discussions

Rust for AUTOSAR Classic

• Come out and chat with Christof if interested
• https://code.autosar.org/users/sign_in (AUTOSAR Consortium members only)

Rust-first safety open-ish RTL eval board:

• https://www.crowdsupply.com/baochip/dabao
• https://media.ccc.de/v/39c3-xous-a-pure-rust-rethink-of-the-embedded-operating-system was the talk about it at the CCC

Requested topics

Projects originally written in another language that were ported to Rust

• Advantages / disadvantages
• Slides from a talk given about porting librsvg to rust -- https://viruta.org/docs/fmq-porting-c-to-rust.pdf

Material

Any material to read before the meeting should be included here.

[AnotherDaniel]

AnotherDaniel

[danielsilverstone-ct]

danielsilverstone-ct

[jordanbailes]

@jordanbailes

[charcoalfrostmetallic]

@perrymcmanis144

[krucod3]

@krucod3

[bharatGoswami8]

@bharatGoswami8

[mhatzl]

@mhatzl

[mmi-dot]

@mmi-dot

[cpetig]

@cpetig

[arvindr19]

@arvindr19

[darkwisebear]

@darkwisebear

[thatdevsherry]

@thatdevsherry

[quarterbit]

@TomFleischmann

[rama492]

@rama492

[masc2023]

@masc2023

[charcoalfrostmetallic]

For folks interested in looking at a C++/Rust integration example with some security considerations, Mozilla's Firefox Desktop has a lot of viewable docs. Firefox remains a very large C++ codebase, and has significant Rust in it both in terms of modules as well as internals:

codebase: https://searchfox.org/
development docs: https://firefox-source-docs.mozilla.org/build/buildsystem/rust.html
wiki with some info/history: https://wiki.mozilla.org/Oxidation
Ralph Giles' discussion of shipping Rust in Firefox: https://medium.com/mozilla-tech/deploying-rust-in-a-large-codebase-7e50328074e8

[danutza77]

@danutza77

[danielsilverstone-ct]

https://www.crowdsupply.com/baochip/dabao <-- rust-first safety open-ish RTL eval board

https://media.ccc.de/v/39c3-xous-a-pure-rust-rethink-of-the-embedded-operating-system was the talk about it at the CCC

[danielsilverstone-ct]

Slides from a talk given about porting librsvg to rust -- https://viruta.org/docs/fmq-porting-c-to-rust.pdf

I can't find the talk for now

[cpetig]

Re: AUTOSAR classic platform and Rust: The unbroken direct link is https://code.autosar.org/wg-saf-rust1/classic-rust-rfc (the Rust based arxml parser and code generator is in a submodule)