Rust ESP32 emulator boots unmodified Xtensa and RISC-V firmware in the browser

A full ESP32 boot with no hardware attached

An emulator called esp32sim, shared on Hacker News, models Espressif's ESP32 microcontrollers instruction by instruction and runs them in the browser. According to the project's GitHub readme, it boots each chip's genuine mask ROM, the real second-stage bootloader and an unmodified application image — without patched firmware or stub routines standing in — and emulates enough of the surrounding chip that real projects run start to finish. The code is MIT-licensed, requires no account or cloud service, and a WebAssembly build hosts live demos that can be tried with no installation, including a Linux boot on the S3.

Two CPU families, four chips

Four SoCs are covered, spanning both of Espressif's CPU architectures. The ESP32-S3 is modelled with dual Xtensa LX7 cores, the classic ESP32 boots its ECO3 ROM on dual LX6 cores with GPIO, UART and timers, and the RISC-V C3 and C6 are emulated as single-core RV32IMC and RV32IMAC machines. Much of the SoC is shared code: the readme notes the C3 reuses the S3's UART, USB-Serial/JTAG, systimer, GPIO, SPI flash controller, DMA and crypto models unchanged, adding only its own memory map, cache controller and interrupt matrix, while the C6 plugs in a PLIC front-end, an L1 cache and always-on low-power blocks. Only the CPU implementations are written separately.

Virtual Wi-Fi, displays and cameras

Wi-Fi is emulated rather than ignored. A virtual access point handles WPA2 along with DHCP, DNS and NTP, and bridges to the host's real network via NAT — with HTTPS working on the S3; the RISC-V chips get the same virtual network with scanning, WPA2, DHCP and NAT for a single station. Board models sit on top of the SoC and interpret pin-level events. On the S3, the choices run from a bare module with console only, to a 480×480 touch panel, to a camera board whose OV5640 input — an uploaded image or the browser's webcam — flows through an esp-dl pedestrian detector executing on the emulated PIE SIMD unit and out through an emulated audio codec. The classic ESP32 gets a TTGO T-Display option with its ST7789 screen and buttons.

The fidelity claims, and their limits

The readme is unusually candid about how the emulator is verified. Earlier manual runs compared the instruction decoders against full objdump listings: 977,000 instructions with zero mismatches on the S3, 161,000 on the C3 and 126,000 on the C6. Against physical hardware, an S3 JTAG trace matched 8,000 steps once timing loops were realigned, and console output matched 205 of 208 lines on a real C3 and 203 of 204 on a C6. However, continuous integration runs only the checked-in sampled decoder corpora and golden-output regressions, and the hardware comparison normalizes Xtensa window exceptions and resynchronizes delay loops — so the results show functional agreement rather than uninterrupted cycle-by-cycle identity.

Speed and maturity

The S3 combines a basic-block interpreter with an AArch64 JIT and reaches roughly 150–240 million instructions per second, according to the project's own figures. The RISC-V chips still use a plain interpreter with no block cache or JIT, though the readme says even hello_world executes faster than real time. Maturity is uneven by design: the S3 is described as mature, while the C3 and C6 are labelled drafts, each with a status document in the repository.

Why it matters

Embedded work normally means a board on the desk, a USB cable and a flash-and-check loop. An emulator that boots the actual ROM, bootloader and application binary moves that loop onto a laptop or into CI: firmware can be exercised — Wi-Fi association, display rendering, even camera-driven inference — before any hardware is available or attached, and regressions can be caught by diffing console output against golden files, which this project already does. Instruction-level fidelity across both Xtensa and RISC-V makes the tool credible for more than smoke tests, and the browser build turns a firmware demo into something anyone can open. For a platform as widely deployed as the ESP32, that meaningfully lowers the cost of building, testing and teaching embedded software.