The Pixel 10 series is the first Pixel device family to integrate a component written in the memory-safe Rust language into cellular modem software, according to a post on the Google Security Blog. The move involves introducing a Rust-based Domain Name System (DNS) resolver into the modem firmware, with the aim of reducing the risks of memory-safety vulnerabilities in a component that handles untrusted data.
The move is part of Google’s efforts to strengthen cellular communications modems against exploitation. The company had equipped the Pixel 9 with mitigations against a range of memory-safety vulnerabilities, but it believes that the complexity of modem firmware and the breadth of its attack surface require additional proactive measures. Google stated that Project Zero had previously managed to achieve remote code execution on Pixel modems over the internet, while the Pixel modem contains tens of megabytes of executable code.
Why Did Google Choose the DNS Resolver?
DNS is not used only to help browsers find websites. As modern cellular communications have moved to digital data networks, essential operations such as call routing also rely on DNS services. This complex protocol needs to parse data that may be untrusted, making it a sensitive point when implemented in a language that lacks memory protection—a category of risk that, according to the post, was associated with the CVE-2024-27227 vulnerability.
Google evaluated several open-source packages for implementing DNS in Rust and selected hickory-proto based on its maintenance level, test coverage exceeding 75%, and adoption within the Rust community. The library initially lacked the no_std support required for resource-constrained or operating-system-free environments, so Google added that support to the library and some of its dependencies. The work also resulted in no_std support for the URL parser in the rust-url project.
Size Cost and Integration with the Existing Software
A size study showed that the Rust-written intermediary component consumes 4 kilobytes, while the core, alloc, and compiler_builtins components require 17 kilobytes, and the hickory-proto library and its dependencies consume 350 kilobytes, for a total of 371 kilobytes. Google believes that the Pixel modem’s memory size does not impose strict limitations, so at this stage it prioritized community support and code quality over size optimization. However, it noted that the increase could pose an obstacle for other embedded systems and could be reduced in the future through compilation options that exclude unnecessary functionality.
To integrate Rust into the existing C and C++ codebase, the team used unit tests to verify basic arithmetic operations, dynamic memory allocation, and interlanguage linking interfaces. It also chose to integrate Rust compilation steps directly into the existing build system rather than create separate static libraries through Cargo, because this approach is easier to scale as additional Rust components are added and reduces the likelihood of symbol conflicts.
The core build system is based on Pigweed, while FFI interfaces were used to connect the firmware’s existing memory allocator to Rust’s alloc component and to unify panic handling between Rust and C/C++. During linking, a performance and power-consumption problem emerged because the modem’s optimized implementations of the memset and memcpy functions were replaced with implementations from compiler_builtins. The team addressed the problem by removing the compiler_builtins files from the static library before the linking stage.
The DNS Interface and the Next Step
Google defined a C API for processing DNS responses and then implemented it in Rust. After analyzing a response, the component calls the existing C functions to update the data structures used by the original software. The bindgen tool was used to generate the linking code required for complex conversions between data types.
According to Google, the Pixel 10 series represents an important milestone because it is the first Pixel device family to integrate a memory-safe language into the modem. The goal is not limited to replacing a single resolver; the company believes that the project lays the foundation for introducing other parsers and components written in memory-safe languages into the cellular connectivity stack in the future.