Arrrggghhhh!!!
and:
"I wrote an interpreter for ASL, added in an ELF loader and hey presto, I had a simulator for the ARMv8 architecture. (Not a very fast simulator but a simulator all the same.)
I wrote a transpiler for ASL that converts ASL to C, wrote another ELF loader and I had a faster simulator for the architecture. (Still not all that fast: I am sure you can do better!) I used that to let me run ARM’s internal architecture conformance test suite on the spec: getting the ISA to pass was a lot of work - but it was nothing compared with getting all those fiddly parts of the different privilege levels working.
I modified my interpreter to generate a symbolic representation of its actions then used a symbolic expression solver (aka an SMT solver) to generate test inputs that would make the ASL take different paths through the code for each different input. In other words, I wrote a test-case generator that could get very high branch coverage through the code. (Someday I should write about why I gave up on doing this.)"
Wow!