1. SEED: A RISC Architecture Simulator Scriptable, Extensible, Emulator, and Debugger An Undergraduate Senior Research Project By: Ryan Moore Mentor: Dr. C. David Shaffer

2. Why Simulate? Target CPU under development Target outside hardware under development Faster and cheaper to “rewire” a software product Facilitates team development Test hard to reproduce input/conditions

3. SEED’s Core A flexible framework for writing RISC architecture simulators  # Registers, types of, size of  # Pipeline stages or how they interact  Instruction size SEED Framework: Memory, registers, pipeline, ports Specific Architecture Implementation: Hardware ports, instructions, interrupts External Hardware Common Utilities: Time simulation Hooks Debugging

4. Implementing the ATtiny11 8-bit RISC Microcontroller 1 kilobyte of instruction memory 32 x 8 bit registers 6 I/O pins (with alternate functionality) No frills Harvard architecture Non-orthogonal instruction set 90 Instructions I also implemented a subset of the ARM7TDMI instruction set

5. Example Instruction AVR: “MOV” command Summary  Add a new instruction template That matches this bit pattern That has 2 variables That has 2 pipeline stages No forwarding function needed in AVR Here is how to translate it into a human readable string  Ease of implementation: Familiarity with architecture 1 ½ months for me to implement AVR (add-instruction-template ;MOV (define-instruction "001011..........“ (1 (7 12 rd) (rr (avr-get-rr bit-pattern))) ((1 (avr-stage-one)) (2 (pipeline-stage (set-register! rd (register-copy (find-register rr)))))) (forwarding-function '()) ("MOV" rd "," rr)))

6. Automated Testing: Assembly code: Expected state after finishing each line of code “LDI R20, 0xFF” “TST R16” (equal? (find-register ‘R20) “11111111”) (and (equal? (find-register ‘R16) “01110011”) (eq? zero-bit (get-SREG-flag ‘Z))) 81 tests total for AVR

7. “Real World” hardware simulation ATtiny11 interface with:  Analog to digital converter (ADCS7478)  Keypad (from Rentron Electronics)  Alarm (Piezo electric buzzer) Measure environment temperature and trigger an alarm if too warm  For keeping produce fresh (such as caviar)

8. Simplified Schematics

9. Debugging your code (run-for-seconds seconds) (s) – Step 1 cycle (add-event-at event time) (step-until- condition condition) Plus extensible via hooks Disassembled AVR memory: 04 - NOP 05 - LDI R17, 0x1c 06 - OUT 0x17, R17 07 - SBI 0x18, 0x4 08 * LDI R20, 0x9 09 - RCALL PC + 0x31 0a - RCALL PC + 0x10 0b - RCALL PC + 0x2f 0c - MOV R19, R16 Pipeline: Stage 1 IN R16, 0x16 Stage 2 RJMP PC - 0x2

10. Using Hooks to Extend Functionality: Read from memory Standard Memory (RAM) Read address 0x1000 Value: 0x54 Read from memory (original) Standard Memory (RAM) Client Read from memory (hook) External Memory Mapped Device Read address 0x1000 Value: 0x3A

11. Other Uses of Hooks: Debugging  Perform an action when a register has changed or is accessed Read only memory areas Perform some action on the start/end of a cycle

12. Conclusion: The SEED framework allows:  Flexible simulation of RISC architectures and external hardware As demonstrated by the simulation of two very different architectures and of one “real world” project Using hooks allows expansion of capabilities  Debugging capabilities Stepping Disassemble Find bugs in software

13. References: Shade: a fast instruction-set simulator for execution profiling - Bob Cmelik, David Keppel An efficient retargetable framework for instruction-set simulation - Mehrdad Reshadi, Nikhil Bansal, Prabhat Mishra, Nikil Dutt ARM7TDMI chip photo  http://www.glyn.de/Micronas.htm http://www.glyn.de/Micronas.htm ATtiny11 chip diagram  Atmel’s Datasheets - http://www.atmel.com/http://www.atmel.com/ Analog to Digital Converter  ADCS747678 – National Semiconductor Thermistor  PS102J2 – US Sensor 10 Button Keypad  Reynolds Electronics - http://www.rentron.com/http://www.rentron.com/

14. ARM7TDMI Another architecture to show flexibility of SEED framework  32-bit ARM von Neumann architecture vs 8-bit AVR  Byte order important Little Endian  Privileged instructions  Each instruction allows execution to depend on one of several conditions 52 ARM instructions 63 Thumb instructions  A subset of instructions was completed Enough to calculate Fibonacci numbers.

15. ARM Fibonacci Calculation: main: mov r0, #0 mov r1, #1 ;The temp mov r2, r0 loop: add r2, r1, r0 mov r0, r1 mov r1, r2 b loop ;jump into the loop again

16. SEED: A RISC Architecture Simulator Scriptable, Extensible, Emulator, and Debugger An Undergraduate Senior Research Project By: Ryan Moore Mentor: Dr. C. David Shaffer Sigma Xi Undergraduate Research Conference