Renode

I find it a useful tool. Maybe you will, too!

About Me: I Do Weird Hardware

• Simmel: Contact Tracing with Audio
• Chibitronics: Programming Stickers with Audio
• Novena: Open Source Laptop
• Senoko: Open Source Power Board for Novena

Hardware with Embedded Software

• Software needs to be written
• Software needs to be tested
• Software needs to be debugged

About Renode

• Whole-System Emulator
• Supports concurrent emulation
• Extensible with C# and Python
• Windows, Mac, Linux
• MIT Licensed

About This Talk

• Overview of Emulators
• Oevrview of Weird Hardware
• Cool things you can do

Who will find this interesting?

• Creators: Those making new boards or hardware
• Integrators: Running CI on firmware files
• Reverse Engineers: Understanding new hardware and firmware

Creators: Making New Things!

• Reusing an existing platform
• Reusing an existing microcontroller
• New microcontroller fron existing family

Integrators: Making Sure Nothing Broke!

• Hardware testing incompatible with cloud
• ...it sure is effective, though
• Hardware crunch makes it difficult to get hardware
• Downloading software is much cheaper than shipping
• Can run tests on every code push

Reverse Engineers: What Is This Blob Doing?

• Staring at code flow is enlightening, but time-consuming
• What is it doing and how does it get there?
• How can we make it do $x?

What is an Emulator?

What is an Emulator?

What is an Emulator?

Whole-System Emulator

Whole-System Emulator

Transparent Emulator

• WSL2/Docker
• qemu on Linux
• Rosetta on Mac

Renode Is Many of These

• Console: Able to present an interactive environment
• Transparent: Can run in CI via Robot commands
• Debugger: Has a GDB server built in

What is a Computer?

What is a Computer?

• A system of devices
• One or more CPU
• One or more buses
• One or more blocks of memory
• Some I/O

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

What is a Computer?

Defining a Computer in Renode

						flash: Memory.MappedMemory @ sysbus 0x00000000
							size: 0x00008000

						sram: Memory.MappedMemory @ sysbus 0x20000000
							size: 0x00001000
	
						nvic: IRQControllers.NVIC @ sysbus 0xE000E000
							IRQ -> cpu@0

						cpu: CPU.CortexM @ sysbus
							nvic: nvic
							cpuType: "cortex-m0+"
							PerformanceInMips: 24
					

What is "Firmware"?

Firmware is a series of instructions executed by the CPU in order to accomplish a task

Firmware is Memory

Loading Firmware in Renode

						sysbus LoadELF @firmware.elf
					

						sysbus LoadBinary @rom.bin 0x20000000
					

						sysbus LoadSymbolsFrom @rom.elf
					

How does Renode Interact With $VENDOR_TOOL?

• Hopefully your vendor tool produces ELF files
• At the end of the day, it's all bytes. Just use LoadBinary!

What About Boot ROMs?

1. Initialize peripherals
2. Check for boot override
3. Check for low-power state
4. Load firmware into RAM
5. Validate firmware
6. Jump to loaded program

						sysbus.cpu VectorTableOffset 0x20000000
						sysbus.cpu PC 0x20000c00
					

What about New Peripherals?

It's All About Small Victories

• Serial ports are super rewarding
• They're also usually simple!
• They are easy to script

Reusing an Existing Port

Steps to Set Up a Serial Port

1. Enable peripheral
2. Set up clock
3. Mux GPIOs
4. Calculate baud rate
5. Write to UART TX register

Steps to Set Up a Serial Port

Steps to Set Up a Serial Port

• Interrupt Support
• DMA

Example Serial Port

						{(long)Registers.RxTx, new DoubleWordRegister(this)
							.WithValueField(0, 8,
								writeCallback: (_, value) => {
									this.TransmitCharacter((byte)value);
								},
								valueProviderCallback: _ => {
									if(!TryGetCharacter(out var character))
									{
										this.Log(LogLevel.Warning, "Empty Rx FIFO.");
									}
									return character;
								})
						},
					

What about Missing Definitions?

• Most registers are unused
• Most writes can be ignored

Advantages of Emulation

Advantages of Emulation

Robot Framework: Running Tests in CI

							*** Test Cases ***
							Should Read Acceleration
								Create Machine
								Create Terminal Tester    ${UART}
							
								Execute Command   sysbus.twi1.lis2ds12 AccelerationX 10
								Execute Command   sysbus.twi1.lis2ds12 AccelerationY 5
								Execute Command   sysbus.twi1.lis2ds12 AccelerationZ -5
							
								Start Emulation
							
								Wait For Line On Uart  x 9.997213 , y 4.997410 , z -4.999803
						

SVD Files

Logging Memory Accesses

Debugging with GDB

Software Assumes Hardware Works

• Rarely checks for sane ranges (why would you?)
• TOC-TOU

Incremental Changes

• Small changes are very rewrding
• Device will work with only partial implementation