Skip to content
STIMSMITH

ARM Instruction Set Architecture

Concept WIKI v2 · 8/9/2026

The ARM Instruction Set Architecture (ISA) is a processor architecture that has long dominated embedded processors in IoT devices. It includes multiple instruction encodings (A32, T32, T16) across historical versions (ARMv5, ARMv6, ARMv7) and extends to a 64-bit form via ARMv8. The complexity of the ARM ISA makes simulator validation difficult, and automated testing tools such as SearchSYS and differential testing approaches have been used to uncover missimulations and unimplemented functionality in gem5's ARM backend. RISC-V has emerged as a free and open competitor, particularly for IoT, where security and root-of-trust solutions are being actively researched.

ARM Instruction Set Architecture

Overview

For decades, embedded processors, which serve as the processing engines of smart IoT devices, were mainly based on the ARM Instruction Set Architecture (ISA) [arxiv:2107.04175v1]. The ARM ISA has historically been the dominant architecture for embedded computing, and its complexity makes manual coverage testing of simulators a slow process: generating test cases for gem5's ARM ISA simulation from documentation alone would take a skilled engineer weeks [1].

Versions and Instruction Lengths

ARM instruction sets include A32 (with 32-bit fixed-length instructions), T32 (a mix of 16-bit and 32-bit Thumb-2 instructions), and T16 (Thumb-1 with 16-bit instruction length). These are supported across previous ARM architectures including ARMv5, ARMv6, and ARMv7 [2]. The ARMv8 architecture, a 64-bit extension, is also a common simulation target and is the specific ISA used in the most recent SearchSYS evaluation against gem5 [bbdf0567-6813-461a-8559-2de726b5f5c9; ec3999b8-1a88-4162-b2aa-a6d402cb642a].

Role in Simulator Testing

The complexity of the ARM ISA makes comprehensive manual testing infeasible. As noted in the SearchSYS paper, in the context of the ARM ISA, it can take weeks for a skilled engineer to manually code programs to test each part of the ISA from ARM hardware documentation [3]. Automated approaches such as SearchSYS and differential testing are used to compare simulator execution against real ARM hardware to detect missimulations and unimplemented functionality [ec3999b8-1a88-4162-b2aa-a6d402cb642a; 3989fb4a-78b7-4c3c-878f-88e8037a1226].

SearchSYS on the ARM ISA

SearchSYS combines Large Language Models (LLMs), coverage-guided fuzzing with AFL++, and differential testing. It uses LLM-generated C programs as compiled seeds, mutates the binary and its arguments with custom operators, and then runs differential testing by comparing outputs from gem5 against outputs from real ARMv8 hardware [e38fdac5-3762-4996-9a24-361f22ab785e; 14a4bba7-f034-4ec3-8c59-404b1c55776d; ec3999b8-1a88-4162-b2aa-a6d402cb642a].

When adapted to ARM, SearchSYS was passed ARM as the ISA parameter, with minor linker/TinyLlama data issues fixed and bug-fixing edits applied to the C/C++ components between the prior X86 and ARM versions [14a4bba7-f034-4ec3-8c59-404b1c55776d; e38fdac5-3762-4996-9a24-361f22ab785e]. The fuzzing experiments ran for 24 hours per campaign with five independent repetitions per minimized input corpus, without Docker, on ARMv8 hardware [2b249840-b014-42c6-bbca-918458289c23; 42080535-2838-48e3-8101-729675049e16].

Key Findings from ARM ISA Testing Research

  • SearchSYS generated more than 30,000 test cases for gem5 in total, with the majority of bugs (excluding panic errors, out-of-memory and timeouts) identified through differential testing [4].
  • From LLM-generated test inputs, SearchSYS identified 74 bug-activating test cases (9 panic and 65 timeouts, plus additional differential testing matches) and reported 4 unique bugs (#1527, #1544, #1547, #1629) to the gem5 bug tracker under the arch-arm tag [461b54ef-c92d-4216-b80b-3356406631ba; ad00e544-c371-46ba-983a-12d101c3fd53].
  • After incorporating fuzzing, an additional 93 bug-activating cases were found within 24 hours; differential testing identified 624 bugs with LLM-generated cases and 126 with fuzzed inputs [461b54ef-c92d-4216-b80b-3356406631ba; ec3999b8-1a88-4162-b2aa-a6d402cb642a].
  • ARM ISA simulation was found to be no more stable than X86 ISA simulation in gem5, contrary to prior expectations: roughly 630 missimulation/error instances and over 60 optimization/timeout instances on ARM versus ~530 and ~30 on X86, respectively, with the X86 instances not being a subset of the ARM instances [5].
  • Fourteen distinct types of bugs were identified in gem5's simulation of ARM, including panic errors, performance bugs, and differential bugs [6].
  • Notable ARM-specific gaps in gem5 included unimplemented system calls (dup3, pipe2, clock_getres, clock_nanosleep, wait4), unimplemented bti instruction support, missing time functionality (Bug #1629), random variable values in ARM vs. fixed in simulation, and unimplemented thread functionality in SE mode [ad00e544-c371-46ba-983a-12d101c3fd53; 0067592d-cc7c-40f0-a060-58b36a5dd228].
  • GPT-3.5-turbo (2024 zero-shot) found the highest number of issues (286), followed by Magicoder (175), Llama2 (102), CodeBooga (87), TinyLlama (22), and Phi2 (21); GPT-3.5-turbo (SSBSE 2023, few-shot) found the fewest (5) [7].
  • Examiner, a separate differential testing tool, found 171,858 inconsistent instruction streams between real ARM devices and CPU emulators, generating test cases covering 1,998 encodings across 1,070 instructions in approximately 4 minutes [2].

Relationship with RISC-V

In recent years, the free and open RISC-V ISA standard has attracted attention from industry and academia and is becoming a mainstream alternative to ARM, particularly for IoT devices [arxiv:2107.04175v1]. The RISC-V community is actively studying security solutions aimed at achieving a root of trust (RoT) for RISC-V devices [arxiv:2107.04175v1].

Tools and Techniques for ARM ISA Validation

  • SearchSYS: LLM + AFL++-based fuzzing tool with differential testing, applied to gem5's ARM ISA backend [3989fb4a-78b7-4c3c-878f-88e8037a1226; ec3999b8-1a88-4162-b2aa-a6d402cb642a].
  • Examiner: Differential testing tool that automatically locates inconsistent instructions between real ARM devices and CPU emulators [2].
  • Differential Testing: A technique used to compare simulator execution results against real ARM hardware to detect missimulations [8].

LINKED ENTITIES

4 links
SearchSYS EVALUATES
gem5 IMPLEMENTS
ARMv8 DERIVED_FROM
RISC-V COMPETES_WITH

CITATIONS

14 sources
14 citations
[1] For decades, embedded processors were mainly based on the ARM ISA, especially for IoT devices. A Survey on RISC-V Security: Hardware and Architecture
[2] ARM instruction sets include A32 (32-bit fixed-length), T32 (mix of 16-bit and 32-bit Thumb-2 instructions), and T16 (Thumb-1 with 16-bit instruction length), supported across ARMv5, ARMv6, and ARMv7. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[3] ARMv8 is the 64-bit extension of ARM and was used as the simulation target in the SearchSYS ARM evaluation. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[4] Manually generating test cases for gem5's ARM ISA simulation from documentation would take a skilled engineer weeks. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[5] SearchSYS combines LLMs, AFL++-based fuzzing, and differential testing against real ARMv8 hardware to find bugs in gem5. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[6] Adapting SearchSYS to ARM required passing ARM as the ISA parameter, with minor linker and TinyLlama data fixes plus C/C++ bug-fixing edits. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[7] SearchSYS generated over 30,000 test cases for gem5 and reported 4 unique bugs (#1527, #1544, #1547, #1629) under the arch-arm tag. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[8] SearchSYS identified 74 bug-activating test cases from LLM inputs and 93 additional cases from fuzzing within 24 hours, with differential testing finding 624 LLM-generated and 126 fuzzed bug cases, and 4 unique bugs acknowledged by developers. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[9] ARM ISA simulation in gem5 was no more stable than X86 ISA simulation, with ~630 missimulations/errors and 60+ timeouts on ARM vs. ~530 and ~30 on X86. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[10] SearchSYS identified 14 distinct bug types in gem5's ARM simulation, including panic errors, performance bugs, and differential bugs. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[11] GPT-3.5-turbo (2024) found the most LLM-stage issues (286), followed by Magicoder (175), Llama2 (102), CodeBooga (87), TinyLlama (22), and Phi2 (21); GPT-3.5-turbo (SSBSE 2023) found only 5. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[12] Notable ARM gaps in gem5 included unimplemented syscalls (dup3, pipe2, clock_getres, clock_nanosleep, wait4), unimplemented bti instruction, missing time functionality (Bug #1629), random vs. fixed variable values, and unimplemented thread functionality in SE mode. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[13] Examiner found 171,858 inconsistent instruction streams between real ARM devices and CPU emulators, covering 1,998 encodings across 1,070 instructions in about 4 minutes. Search+LLM-based Testing for ARM Simulators - SOLAR UCL
[14] The free and open RISC-V ISA is becoming a mainstream alternative to ARM for IoT, with active research on root-of-trust security solutions. A Survey on RISC-V Security: Hardware and Architecture

VERSION HISTORY

v2 · 8/9/2026 · minimax/minimax-m3 (current)
v1 · 8/4/2026 · minimax/minimax-m3