ARM Instruction Set Architecture

Concept

The ARM Instruction Set Architecture (ISA) is a processor architecture that has long dominated embedded processors in IoT devices. It includes multiple instruction encodings (A32, T32, T16) across historical versions (ARMv5, ARMv6, ARMv7) and extends to a 64-bit form via ARMv8. The complexity of the ARM ISA makes simulator validation difficult, and automated testing tools such as SearchSYS and differential testing approaches have been used to uncover missimulations and unimplemented functionality in gem5's ARM backend. RISC-V has emerged as a free and open competitor, particularly for IoT, where security and root-of-trust solutions are being actively researched.

First seen 6/7/2026

Last seen 8/9/2026

Evidence 24 chunks

Wiki v2

WIKI

ARM Instruction Set Architecture

Overview

For decades, embedded processors, which serve as the processing engines of smart IoT devices, were mainly based on the ARM Instruction Set Architecture (ISA) [arxiv:2107.04175v1]. The ARM ISA has historically been the dominant architecture for embedded computing, and its complexity makes manual coverage testing of simulators a slow process: generating test cases for gem5's ARM ISA simulation from documentation alone would take a skilled engineer weeks ^[1].

READ FULL ARTICLE →

NEIGHBORHOOD

No graph connections found for this entity yet. It may appear in future ingestion runs.

explore full graph →

RELATIONSHIPS

6 connections

SearchSYS ← evaluates 100% 2e

SearchSYS is applied to evaluate gem5's simulation of the ARM Instruction Set Architecture.

gem5 ← implements 100% 2e

gem5 simulates the ARM Instruction Set Architecture.

ARMv8 ← derived from 95% 2e

ARMv8 is a specific version of the ARM Instruction Set Architecture.

SearchSYS ← uses 98% 2e

SearchSYS is applied to test gem5's simulation of the ARM Instruction Set Architecture.

Search+LLM-based Testing for ARM Simulators compares with → 95% 2e

The paper compares bug-finding effectiveness between the ARM ISA and X86 ISA.

differential testing ← uses 96% 2e

Differential testing compares results from running programs on ARM hardware versus gem5 with ARM ISA.

LINKED ENTITIES

4 links

SearchSYS EVALUATES Extracted graph relationship

gem5 IMPLEMENTS Extracted graph relationship

ARMv8 DERIVED_FROM Extracted graph relationship

RISC-V COMPETES_WITH RISC-V is described as an emerging mainstream open alternative to ARM for IoT devices, with ongoing security research.

CITATIONS

14 sources

14 citations — click to expand

[1] For decades, embedded processors were mainly based on the ARM ISA, especially for IoT devices. A Survey on RISC-V Security: Hardware and Architecture

[2] ARM instruction sets include A32 (32-bit fixed-length), T32 (mix of 16-bit and 32-bit Thumb-2 instructions), and T16 (Thumb-1 with 16-bit instruction length), supported across ARMv5, ARMv6, and ARMv7. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[3] ARMv8 is the 64-bit extension of ARM and was used as the simulation target in the SearchSYS ARM evaluation. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[4] Manually generating test cases for gem5's ARM ISA simulation from documentation would take a skilled engineer weeks. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[5] SearchSYS combines LLMs, AFL++-based fuzzing, and differential testing against real ARMv8 hardware to find bugs in gem5. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[6] Adapting SearchSYS to ARM required passing ARM as the ISA parameter, with minor linker and TinyLlama data fixes plus C/C++ bug-fixing edits. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[7] SearchSYS generated over 30,000 test cases for gem5 and reported 4 unique bugs (#1527, #1544, #1547, #1629) under the arch-arm tag. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[8] SearchSYS identified 74 bug-activating test cases from LLM inputs and 93 additional cases from fuzzing within 24 hours, with differential testing finding 624 LLM-generated and 126 fuzzed bug cases, and 4 unique bugs acknowledged by developers. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[9] ARM ISA simulation in gem5 was no more stable than X86 ISA simulation, with ~630 missimulations/errors and 60+ timeouts on ARM vs. ~530 and ~30 on X86. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[10] SearchSYS identified 14 distinct bug types in gem5's ARM simulation, including panic errors, performance bugs, and differential bugs. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[11] GPT-3.5-turbo (2024) found the most LLM-stage issues (286), followed by Magicoder (175), Llama2 (102), CodeBooga (87), TinyLlama (22), and Phi2 (21); GPT-3.5-turbo (SSBSE 2023) found only 5. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[12] Notable ARM gaps in gem5 included unimplemented syscalls (dup3, pipe2, clock_getres, clock_nanosleep, wait4), unimplemented bti instruction, missing time functionality (Bug #1629), random vs. fixed variable values, and unimplemented thread functionality in SE mode. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[13] Examiner found 171,858 inconsistent instruction streams between real ARM devices and CPU emulators, covering 1,998 encodings across 1,070 instructions in about 4 minutes. Search+LLM-based Testing for ARM Simulators - SOLAR UCL

[14] The free and open RISC-V ISA is becoming a mainstream alternative to ARM for IoT, with active research on root-of-trust security solutions. A Survey on RISC-V Security: Hardware and Architecture