Renode

I find it a useful tool. Maybe you will, too!

About Me: I Do Weird Hardware

• Simmel: Contact Tracing with Audio
• Chibitronics: Programming Stickers with Audio
• Novena: Open Source Laptop
• Senoko: Open Source Power Board for Novena

About Renode

• Whole-System Emulator
• Supports concurrent emulation
• Extensible with C# and Python
• MIT Licensed
• Windows, Mac, Linux

About This Talk

• Overview of Emulators
• Oevrview of Weird Hardware
• Cool things you can do

Who will find this interesting?

• Creators: Those making new boards or hardware
• Integrators: Running CI on firmware files
• Reverse Engineers: Understanding new hardware and firmware

Creators: Making New Things!

• Reusing an existing platform
• Reusing an existing microcontroller
• New microcontroller fron existing family

Integrators: Making Sure Nothing Broke!

• Hardware testing incompatible with cloud
• ...it sure is effective, though
• Hardware crunch makes it difficult to get hardware
• Downloading software is much cheaper than shipping
• Can run tests on every code push

Reverse Engineers: What Is This Blob Doing?

• Staring at code flow is enlightening, but time-consuming
• What is it doing and how does it get there?
• How can we make it do $x?

What is an Emulator?

What is an Emulator?

Whole-System Emulator

Whole-System Emulator

Transparent Emulator

• HyperV
• WSL2/Docker
• qemu on Linux
• Rosetta on Mac

Debugger/Emulator

• FCEUX (Nintendo Entertainment System)
• Dolphin (Wii / Gamecube)

Renode Is All of These

• Console: Able to present an interactive environment
• Transparent: Can run in CI via Robot commands
• Debugger: Has a GDB server built in

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

Defining a Computer in Renode

						flash: Memory.MappedMemory @ sysbus 0x00000000
							size: 0x00008000

						sram: Memory.MappedMemory @ sysbus 0x20000000
							size: 0x00001000
	
						nvic: IRQControllers.NVIC @ sysbus 0xE000E000
							IRQ -> cpu@0

						cpu: CPU.CortexM @ sysbus
							nvic: nvic
							cpuType: "cortex-m0+"
							PerformanceInMips: 24
					

Example of Weird Hardware

• NRF52840
• LM74 Temperature Sensor

Example of Weird Hardware

• NRF52833
• LM74 Temperature Sensor

Example of Weird Hardware

• BlueNRG1
• LM74 Temperature Sensor

Example of Weird Hardware

• RISC-V
• FPGA-based framebuffer
• Initial graphical demo in 1 hour

What makes hardware "Weird"?

• Unusual CPU architecture
• Different model of chip than commonly found
• Additional hardware
• More CPUs per board

Unusual CPU architecture

Different model CPU

• Maybe it's just a variant
• Perhaps memory regions were shuffled
• Does it use the same hardware block as someone else?

New hardware version

• Do you use the new, specialized features?
• Lots of UARTs support Infrared. Do you need that?

Completely new hardware

• Time to break out C#

What is "Firmware"?

How does this interact with $VENDOR_TOOL?

What about boot ROMs?

What about missing registers?

• Very few projects use built-in blocks

It's All About Small Victories

• Serial ports are super rewarding
• They're also usually simple!
• They are easy to script

Steps to Set Up a Serial Port

1. Enable peripheral
2. Set up clock
3. Mux GPIOs
4. Calculate baud rate
5. Write to UART TX register

Steps to Set Up a Serial Port

Advantages of Emulation

Advantages of Emulation

Steps to Set Up a Serial Port

• Interrupt Support
• DMA

Example Serial Port

						{(long)Registers.RxTx, new DoubleWordRegister(this)
							.WithValueField(0, 8,
								writeCallback: (_, value) => {
									this.TransmitCharacter((byte)value);
								},
								valueProviderCallback: _ => {
									if(!TryGetCharacter(out var character))
									{
										this.Log(LogLevel.Warning, "Empty Rx FIFO.");
									}
									return character;
								})
						},		
					

Robot Framework: Running Tests in CI

							*** Test Cases ***
							Should Read Acceleration
								Create Machine
								Create Terminal Tester    ${UART}
							
								Execute Command   sysbus.twi1.lis2ds12 AccelerationX 10
								Execute Command   sysbus.twi1.lis2ds12 AccelerationY 5
								Execute Command   sysbus.twi1.lis2ds12 AccelerationZ -5
							
								Start Emulation
							
								Wait For Line On Uart  x 9.997213 , y 4.997410 , z -4.999803
						

SVD Files

Logging Memory Accesses

Debugging with GDB

Software Assumes Hardware Works

• Rarely checks for sane ranges (why would you?)
• TOC-TOU

Incremental Changes

• Small changes are very rewrding
• Device will work with only partial implementation