treVM: Tiny Rust Embedded Virtual Machines with WASM on Variable Resource-Constrained Hardware

TL;DR

treVM is a Rust-based embedded virtual machine that hosts WebAssembly capsules, enabling secure, high-level code deployment and updates on resource-constrained microcontroller hardware.

Contribution

It introduces a novel scheme to run high-level WebAssembly code on microcontrollers using Rust, supporting secure remote updates and broad hardware compatibility.

Findings

Successfully implemented treVM on various microcontrollers including Arm Cortex-M, RISC-V, and Xtensa.

Demonstrated the feasibility of hosting and updating WebAssembly capsules on embedded devices.

Provided extensive benchmarks validating performance across heterogeneous hardware.

Abstract

Software stacks embedded on microcontroller-based hardware typically provide rudimentary APIs programmed in C/C++, basic connectivity and, sometimes, a firmware update mechanism. Such coarse mechanisms contrast with widely used APIs and more advanced networked interaction expected from software stacks deployed on less resource-constrained hardware (microprocessor-based). In this paper, we aim to bridge this gap by designing treVM, a generic scheme to host high-level WebAssembly code capsules, bolted on a general-purpose Rust embedded software platform, able to run on a large variety of 32-bit microcontrollers. Not only can treVM capsules host highly customizable business logic, but capsules can also be securely updated on demand over the network, on devices already deployed in the field. We implement treVM in Rust, on top of Ariel OS, a general-purpose RTOS, and we publish the code as open source. Based on our implementation, we validate the feasibility of treVM on commonly available boards, and we report on extensive benchmarks we performed on heterogeneous hardware including Arm Cortex-M, RISC-V, and Xtensa microcontroller architectures. As such, treVM provides a promising new framework to secure continuous deployment of embedded software on low-power networked devices.