• Stars
    star
    127
  • Rank 282,790 (Top 6 %)
  • Language
    Assembly
  • License
    GNU General Publi...
  • Created about 4 years ago
  • Updated 3 months ago

Reviews

There are no reviews yet. Be the first to send feedback to the community and the maintainers!

Repository Details

A RISC-V emulator for the 8051 (MCS-51) microcontroller.

rv51

What is this?

rv51 is an emulator that can execute bare-metal RISC-V RV32IM firmware on microcontrollers that use the 8051 (MCS-51) instruction set.

But why?

The 8051 is an extremely popular CPU core, used in everything from LCD controllers, to wireless microcontrollers, to USB device, hub, and host controllers, laptop embedded controllers, and more. It's popular in part due to the simplicity of its design, the lack of patent-encumberance, its flexibility, and ease of implementation.

However, for better or for worse, it's a 40 year old design, and it really shows its age:

  • 8-bit registers, ALU, and data bus.
  • 16-bit pointers (but some implementations support paged data access).
  • Only 256 bytes of "fast" memory built-in, with all other memory accessed over the much slower external memory bus (both due to access latency and the number of instructions required to read from it).
  • Many instructions require first moving data into the Accumulator (A/ACC) register in order to operate on it.
  • Multiple memory regions, with directly and indirectly accessed internal memory, special function registers (SFRs), bitmapped registers, banked registers, external memory, and read-only code memory.
  • Internal stack space is shared with the internal data memory, which is also shared with the register memory.

Due to these and other limitations, it is very difficult to target C compilers for the device, and those that have been ported (like SDCC) tend to lack many of the useful features modern compilers like GCC and LLVM have, like advanced, configurable warnings, robust dead code elimitation and other optimization techniques, and more. In addition, without support from either LLVM or a dedicated compiler project, LLVM-based languages like Rust can't be compiled for the device. One way to fix these problems is to do the difficult software development work needed to add the 8051 as a target to GCC and LLVM.

Another way is to emulate on the 8051 a simple, patent-unencumbered CPU architecture that already has excellent compiler support--namely, RISC-V.

Due to my inexperience with compiler development, and having recently read about someone else's experience writing an ARM Cortex-M23 emulator in assembly for the Sega VMU, I decided to take the latter approach. Wanting to avoid having to fight with a C compiler to produce efficient, working assembly, I decided to write this emulator in assembly directly. Surprisingly this was much easier than I imagined it would be, and I was able to emulate some simple programs in just a few hours.

So, really the "Why?" comes down to several factors. In no particular order:

  • Frustration with the user experience of 8051 compilers.
    • "Why is the generated assembly so bloated with all these extra moves?"
    • "Why were these unused functions not removed from the assembly?"
    • "Why is my code not working? Oh, it's because the compiler silently converted a 32-bit int to a 16-bit one, and now the conditional it's a part of is always false."
  • A desire to build Rust code for the 8051.
  • A desire to try programming a microcontroller the way it was originally intended (to my knowledge, there were no C compilers targeting the 8051 when it was released in 1980).
  • An interest in emulators and their construction.
  • An interest in the RISC-V ISA.
  • "Because why not? It sounds like fun and I'll probably learn something."

How do I use it?

  1. Install SDCC.
  2. cd to the src directory.
  3. Run make.
  4. cat rv51.bin your-risc-v-program.bin > firmware.bin
  5. Write firmware.bin to your 8051's program memory.
  6. Power on the 8051 and release it from reset.

Example RISC-V programs that can run on rv51 in an 8051 simulator can be found in the examples directory.

What are the limitations?

The target 8051-family microcontroller must have at least 256 bytes of internal data memory, since the emulator uses the upper 128 bytes as the register file. And while having some additional XDATA-attached RAM is not strictly required, operating exclusively on registers will severely limit the kinds of RISC-V code that can be built and executed (no global variables, no nested function calls, and no stack usage in general).

Only the RV32IM instruction set is supported at this time. Support for the "C" extension may be added if it's not too difficult to implement and doesn't require much additional code and data memory. Support for 64-bit (RV64I) and floating point (the "F" extension) will never be added. The rationale for this can be found in CONTRIBUTING.md.

All 40 instructions of the RV32I Base Instruction Set and all eight instructions of the RV32M Standard Extension have been implemented. The full list of supported instructions can be found in Instruction Support.

Traps (interrupts and exceptions) are partially supported. Deliberate synchronous exceptions (e.g., EBREAK and ECALL) are confirmed to work, and asynchronous interrupts appear to work in simple cases, but other exceptions have not yet been implemented. For example, because the illegal instruction exception has not been implemented, illegal instructions will either put rv51 into an infinite loop or execute undefined behavior. For this reason, please be sure your RISC-V code doesn't try to execute any instructions that are unsupported by rv51.

What's the license?

This software is licensed under the GNU General Public License, version 3 or later.

More Repositories

1

python-vipaccess

A free software implementation of Symantec's VIP Access application and protocol
Python
186
star
2

mediatek-lte-baseband-re

Notes and utilities for reverse engineering the MediaTek LTE baseband and its Coresonic DSP.
Python
178
star
3

HDMI-to-MIPI

Design files for an HDMI to MIPI-DSI adapter with support for the LG LH550WF1-SD01 LCD panel
62
star
4

usb-to-pcie-re

Notes and utilities for reverse engineering USB-to-PCIe/NVMe controllers.
Python
38
star
5

osdvu

Verilog
36
star
6

iCEstick-UART-Demo

This is a simple UART echo test for the iCEstick Evaluation Kit
Verilog
36
star
7

python-bsdl-parser

A Grako-based parser for IEEE 1149.1 Boundary-Scan Description Language (BSDL) files
Python
24
star
8

openocd-xilinx-loader

Some Python scripts to program Xilinx FPGAs using OpenOCD
Python
23
star
9

asmedia-xhc-re

Notes and utilities for reverse engineering ASMedia xHC (USB 3.x) Host Controllers.
Python
21
star
10

libcyusbserial

This library enables userspace programs to control Cypress USB-Serial bridge chips.
C
16
star
11

python-boundary-scan-tools

Python tools to interact with boundary scan-capable devices. Useful for reverse engineering, testing, etc.
Python
16
star
12

Pano-Logic-Zero-Client-G2-FPGA-Demo

Constraints file and Verilog demo code for the Pano Logic Zero Client G2
Verilog
16
star
13

mediatek-wifi-re

Notes and utilities for reverse engineering the firmware used in MediaTek's WiFi cores. This includes the cores used in PCIe/USB/SDIO-attached chips, standalone WiFi microcontrollers, and SoCs with built-in WiFi.
Python
16
star
14

TVKiller

**PROJECT ABANDONED** It's a universal TV off-switch, like the TV-B-Gone kit, but the TV off-codes are stored as an audio file and are sent out the audio port through IR LEDs.
Objective-C
14
star
15

mct-usb-display-adapter-re

Notes and utilities for reverse engineering the Magic Control Technology (MCT) "Trigger" USB display adapter protocol.
C
12
star
16

ghidra-md32

MediaTek MD32 processor module for Ghidra.
11
star
17

psoc-bitstream-parsing-tools

Parse the programmable logic configuration of PSoC devices
Go
11
star
18

ghidra-ccpu

MediaTek CCPU (GCPU) processor module for Ghidra.
11
star
19

KiCad

My personal set of KiCad component and module libraries
10
star
20

glitchcore

An FPGA core for glitching circuits, written with Amaranth HDL.
Python
9
star
21

agilent-pcie-analyzer-re

Notes and utilities for reverse engineering Agilent PCIe Protocol Analyzers and their host software.
C
9
star
22

jmb58x-re

Notes and utilities for reverse engineering JMicron's JMB582 / JMB585 SATA host controllers.
Python
9
star
23

Cypress-HID-Bootloader-Host

This is my own implementation of a host for Cypress Semi's PSoC USB HID bootloader.
Python
8
star
24

Mimas-V2-UART-Demo

This is a simple UART echo test using the Mimas V2 FPGA development board
Makefile
8
star
25

GPIB-to-USB

**PROJECT ABANDONED** A simple USB GPIB adapter that supports USBTMC USB488.
7
star
26

ftdi-unbricker

A simple tool to un-brick FTDI chip clones that had their PIDs set to zero by FTDI's Windows driver
C
7
star
27

ghidra-pcm

MediaTek PCM (SPM) processor module for Ghidra.
7
star
28

bl30-elf

Amlogic bl30 bin-to-elf scripts
Python
7
star
29

r4crypt

C++
6
star
30

Pano-Logic-TNP-Dissector

A Wireshark dissector for the Pano Logic Thin Network Protocol.
Lua
6
star
31

amlogic-video-codec-re

Reverse engineering Amlogic's video decoder/encoder hardware and its integrated AMRISC CPU.
Python
5
star
32

rockchip-dptx-re

Notes and utilities for reverse engineering the Rockchip RK3399 DisplayPort controller (DPTX) firmware.
Shell
5
star
33

Amazon-Affiliate-Link-Generator

A PHP-based affiliate link generator for Amazon
PHP
5
star
34

fx3-logic-analyzer-board

A simple PCB to make the Cypress Semiconductor EZ-USB FX3 SuperSpeed Explorer Kit (CYUSB3KIT-003) suitable for use as a 16-channel, 100 MSps logic analyzer.
5
star
35

mediatek-pcm-emu

MediaTek PCM (SPM CPU core) emulator.
Rust
4
star
36

optical-disc-drive-re

Reverse engineering notes and utilities for various models of DVD drives.
Python
4
star
37

realtek-nic-re

Notes and utilities for reverse engineering Realtek USB NICs.
Kaitai Struct
4
star
38

hdmi-to-displayport-converter-re

Notes and utilities for reverse engineering a Belfan HDMI to DisplayPort converter.
Shell
4
star
39

minimal-wireshark-dissector-rs

A minimal Wireshark dissector, written purely in Rust (no C whatsoever).
Rust
3
star
40

trendnet-teg-30284-re

Notes and utilities for reverse engineering the TRENDnet TEG-30284 managed Ethernet switch.
Python
3
star
41

gr-mwt1

GNU Radio decoder/encoder blocks for the Medtronic MWT1 wireless protocol
Python
3
star
42

bxl-rs

A Rust library for parsing Ultra Librarian ".bxl" files.
Rust
3
star
43

OpenOCD

Driver development for the OpenOCD project. Programmers: KitProg, Future Target: C8051F120.
C
3
star
44

camera-module-re

Reverse engineering smartphone camera modules.
3
star
45

broadcom-crystal-hd-re

Notes and utilities for reverse engineering Broadcom's Crystal HD video decoders.
Kaitai Struct
3
star
46

geniatech-tv-tuner-re

Notes and utilities for reverse engineering the Geniatech A681/PT681 ATSC/ClearQAM USB TV tuner dongles.
Lua
3
star
47

tamil-gpu-tools

Tools for Mali-Txxx (Midgard) GPU reverse engineering
JavaScript
3
star
48

Camera-Modules

Random cell phone camera-related designs go here.
KiCad Layout
3
star
49

poppler-pdf-key-dumper

A hack for poppler that enables it to dump the hashes of encrypted PDF files, which can then be cracked by hashcat. Inspired by pdf2hashcat.py and pdf2john.py.
2
star
50

mimas_v2_hex_display

A simple Verilog module that can output hexadecimal bytes to the Mimas V2's display
Verilog
2
star
51

BBB-Network-Ammeter

A simple Flask app that serves ammeter readings as an MTConnect agent
Python
2
star
52

8051-timing-db

A database containing counts of clock cycles per instruction for various 8051 (MCS-51) microcontrollers and microarchitectures.
2
star
53

iPod-touch-Cellular-Upgrade

**PROJECT ABANDONED** This is a cellular module that attaches to an iPod touch to make it have more iPhone features (phone calls, dial-up internet, GPS).
2
star
54

Saturn-UART-Demo

This is a simple UART echo test using the Numato Saturn FPGA development board
Makefile
2
star
55

ghidra-radeon-f32

AMD Radeon F32 processor module for Ghidra.
2
star
56

esp-jtag-spi

A simultaneous JTAG and SPI adapter based on the ESP-12E module.
1
star
57

Cypress-HID-Bootloader-Dissector

A Wireshark dissector for the Cypress Semi USB HID bootloader protocol
Lua
1
star
58

usb-hub-re

Notes and utilities for reverse engineering various USB hubs.
Python
1
star
59

Cypress-USB-Serial-Eagle-Library

An Eagle library for Cypress Semi's USB-Serial Bridge Controllers
1
star
60

gr-clicker

Shell
1
star
61

steam-controller-re

Steam Controller reverse engineering notes and utilities.
Shell
1
star
62

NavSparkDownload-Mac

Source for the NavSparkDownload utility that can be compiled on OS X
C++
1
star
63

freeclicker

A free (as in freedom) re-implementation of the firmware used on AVR-based i>clicker/iClicker devices.
C
1
star
64

phb-utils

Miscellaneous utilities for debugging the IBM Power Systems Host Bridge (PHB).
Python
1
star
65

Mimas-V2-Debug-Probe

Makefile
1
star
66

sigrok-scripts

Miscellaneous scripts for generating and processing sigrok data files.
Python
1
star
67

ath6kl-tools

Some simple utilities for parsing, packing, and unpacking firmware binaries for ath6kl WiFi chips.
Python
1
star