ARMULET is a C ARMv6M / ARMv8M-baseline emulator by Raspberry Pi. Raspberry Pi is using Armulet to run Arm code on RISC-V in the RP2350 bootrom. The effort could be augmented to run legacy Arm code on a RISC-V only architecture.

VARMULET is a ARMv6M / ARMv8M-baseline ARMv6M emulator

The goals of VARMULET:

• small code size (currently 3K) and it can be placed in ROM
• ? fast enough to run USB boot code under RISC-V (which will also be a non-secure ARMv6M binary under ARM). VARMULET seems to be about 3x faster than ARMULET on RISC-V for now for one particular use case which is printf heavy. We will need to test with the boot code (and also SVC calls for things like memcpy, memset)
• TODO extensible by non ROM code, with no ROM specific functionality baked in (e.g. handling of priv mode, IRQ, breakpoints, SVC etc). It should basically be possible to use the emulator on Amy RISC-V programs, and also to extend it to support other 32 bit instructions for example

Per the RP2350 bootrom details:

“Because of limited space, we cannot duplicate a lot of code in RISC-V, so ARM code is emulated (varmulet) on RISC-V. We emulate (roughly) Arm8-M Baseline not Arm8-M Mainline as it has many fewer less complex instructions (Arm8-M Baseline adds a small number of, but very handy instructions over m0-plus)

• ‘a lot of’ is perhaps an understatement… pretty much everything is emulated now, including the main boot path, and API functions.
• there are a huge number of “asm hacks” where we drop into assembly, and a bunch of other tricks we use to save instruction/data space.
• Other than glue code, the only RISC-V code is really for RISC-V only APIs/setup, and stuff that needs to be optimized for speed.
• Unused ARM hardware hint instructions (and/or RCP instructions) are used to make code behave differently under real ARM or emulation.
• ARM only code is compiled for Arm8-M Mainline (m33).
• Emulatable code is compiled for Arm8-M Baseline (m23), though emulation of UDIV and SDIV is not included in the bootrom, since they are unused by emulated code. The actual instructions included are (over Arm6m0-plus)
  1. b.w, cbz, cbnz, movw, movt from Arm8-M Baseline.
  2. RCP instructions (they are NOPs).
  3. Special cases of mov.w. This is a Arm8-M Mainline instruction, but we want efficient loads of constants 0xmm00mm00, 0x00nn00nn and 0xpppppppp which are used by the RCP
  4. MSPLIM (also Arm8-M Mainline)
  5. SG (Arm8-M Mainline) we can redirect Arm NS->S calls to different code on RISC-V.”

See more on the Armulet GitHub.