Renode: Easy Emulation for your Weird Hardware
Sean Cross
Follow along at https://p.xobs.io/fa22
About Me: I Do Weird Hardware
Renode
I find it a useful tool. Maybe you will, too!
What is "Weird Hardware"?
- Hardware that there is only one of (because you just made it)
- Hardware that you're trying to understand
- Hardware that uses ARM, i386, PowerPC, Risc-V, Sparc, or Xtensa
About Renode
- Multi-Node Emulator
- Extensible with C# and Python
- Windows, Mac, Linux
- MIT Licensed
What Is an Emulator?
Whole-System Emulator
Whole-System Emulator
What is an Emulator?
What is an Emulator?
What is an Emulator?
Emulation Depends on your Goals!
Emulation is a lie
What is a Computer?
- A system of devices
- One or more processors
- One or more buses
- One or more blocks of memory
- Some I/O
What is a Computer?
What is a Computer?
What is a Computer?
What is a Computer?
What is a Computer?
What is a Computer?
What is a Computer?
Defining a Computer in Renode
flash: Memory.MappedMemory @ sysbus 0x00000000
size: 0x00008000
sram: Memory.MappedMemory @ sysbus 0x20000000
size: 0x00001000
cpu: CPU.CortexM @ sysbus
cpuType: "cortex-m0+"
PerformanceInMips: 24
nvic: nvic
nvic: IRQControllers.NVIC @ sysbus 0xE000E000
IRQ -> cpu@0
That's Nice, but What About...
- Loading firmware?
- Adding peripherals?
What is "Firmware"?
Firmware is a series of instructions executed by the CPU in order to accomplish a task
Firmware is Memory
Loading Firmware in Renode
sysbus LoadELF @firmware.elf
sysbus LoadBinary @rom.bin 0x20000000
How does Renode Interact With $VENDOR_TOOL?
- Hopefully your vendor tool produces ELF files
- HEX? BIN? Just use
LoadBinary! - Custom firmware format? Need to unpack first.
What About Boot ROMs?
- Initialize peripherals
- Check for boot override
- Check for low-power state
- Load firmware into RAM
- Validate firmware
- Jump to loaded program
sysbus LoadBinary @rom.bin 0x20000000
sysbus.cpu VectorTableOffset 0x20000000
sysbus.cpu SP `sysbus ReadDoubleWord 0x20000000`
sysbus.cpu PC `sysbus ReadDoubleWord 0x20000004`
start
What about New Peripherals?
It's All About Small Victories
- Serial ports are super rewarding
- They're also usually simple!
- They are easy to script
What is a Computer?
What is a Register?
What is a Register?
What is a Register?
What is a Register?
What is a Register?
Reuse an Existing Block!
flash: Memory.MappedMemory @ sysbus 0x00000000
size: 0x00008000
sram: Memory.MappedMemory @ sysbus 0x20000000
size: 0x00001000
nvic: IRQControllers.NVIC @ sysbus 0xE000E000
IRQ -> cpu@0
// 👇 Add a UART with IRQ #10 at address 0x40300000
uart: UART.PL011 @ sysbus 0x40300000
-> nvic@10
cpu: CPU.CortexM @ sysbus
nvic: nvic
cpuType: "cortex-m0+"
PerformanceInMips: 24
Setting up Renode
machine LoadPlatformDescription @bluenrg-1.repl
sysbus LoadBinary @BLE_Chat_Server.bin 0x10040000
cpu VectorTableOffset 0x10040000
cpu SP `sysbus ReadDoubleWord 0x10040000`
cpu PC `sysbus ReadDoubleWord 0x10040004`
start
BlueNRG-1.resc
Output Success!
Always Check for Block Reuse
Blocks are frequently reused across designs, and can save you from having to reimplement everything from scratch!Peripheral Rapid Development
Betrusted Prototype
Peripheral Documentation
ci.betrusted.io/betrusted-soc/doc/
Peripheral Rapid Development
Hackaday Supercon 2019
Advantages of Emulation
Advantages of Emulation
Getting Hardware to Users
Betrusted ENGINE
Getting Hardware to Users
Getting Hardware to Users
Emulation brings more eyes to the project
Robot Framework: Running Tests in CI
*** Settings ***
Suite Setup Setup
Suite Teardown Teardown
Test Setup Reset Emulation
Test Teardown Test Teardown
Resource ${RENODEKEYWORDS}
*** Variables ***
${UART} sysbus.uart0
${URI} @https://dl.antmicro.com/projects/renode
${LIS2DS12}= SEPARATOR=
... """ ${\n}
... using "platforms/cpus/nrf52840.repl" ${\n}
... ${\n}
... lis2ds12: Sensors.LIS2DS12 @ twi1 0x1c ${\n}
... ${SPACE*4}IRQ -> gpio0@28 ${\n}
... """
*** Keywords ***
Create Machine
Execute Command mach create
Execute Command machine
... LoadPlatformDescriptionFromString ${LIS2DS12}
Execute Command sysbus LoadELF
... ${URI}/nrf52840--zephyr_lis2dh.elf
*** Test Cases ***
Should Read Acceleration
Create Machine
Create Terminal Tester ${UART}
Execute Command sysbus.twi1.lis2ds12 AccelerationX 10
Execute Command sysbus.twi1.lis2ds12 AccelerationY 5
Execute Command sysbus.twi1.lis2ds12 AccelerationZ -5
Start Emulation
Wait For Line On Uart
... x 9.997213 , y 4.997410 , z -4.999803
LIS2DS12.robot
Github Actions
Renode for Reverse Engineering
SVD: Standard Chip Documentation
BlueNRG2.svd
SVD: Using with Renode
sysbus ApplySVD @BlueNRG2.svd
Logging Memory Accesses
Debugging with GDB
Creating ELF Files
Multi-System Emulation
Multi-System Emulation
Other Things Renode can Do
Loading Peripherals at Runtime
path add $ORIGIN
i @peripherals/trng_server.cs
Loading Peripherals at Runtime
private enum Registers
{
STATUS = 0x0,
DATA = 0x4,
URANDOM = 0x8,
URANDOM_VALID = 0xc,
EV_STATUS = 0x10,
EV_PENDING = 0x14,
EV_ENABLE = 0x18,
}
private void DefineRegisters()
{
Registers.STATUS.Define(this) // RDY is set on reset
.WithFlag(0, name: "ready",
valueProviderCallback: _ => true)
.WithFlag(1, name: "avail",
valueProviderCallback: _ => true)
;
Registers.DATA.Define(this)
.WithValueField(0, 32, FieldMode.Read,
valueProviderCallback: _ =>
{
return (uint)rng.Next();
},
name: "DATA"
);
}
Visual Studio Code Lens
Auto-complete and contextual popups
Networking with Tap
emulation CreateSwitch "switch"
emulation CreateTap "renodetap" "tap"
connector Connect host.tap switch
connector Connect sysbus.wifi.wf200 switch
Networking with Tap
SoC → COM-SOC → COM → COM-EC → EC → EC-WIFI → WF200 → Tap → Internet