Constant Time Multiplication for Cryptography in Pure Software without Hardware Multiplier or Barrel Shifter
Constant-time multiplication in software without constant-time multiplier is easy. In C, this working code to compute $x\cdot y$ for 8-bit inputs is typically¹ constant-time:
unsigned mul(unsigned char x, unsigned char y) {
  unsigned r = x, s = x&amp;-(y&amp;1);
  s += (r += r)&amp;-((y &gt;&gt;= 1)&amp;1);
  s += (r += r)&amp;-((y &gt;&gt;= 1)&amp;1);
  s += (r += r)&amp;-((y &gt;&gt;= 1)&amp;1);
  s += (r += r)&amp;-((y &gt;&gt;= 1)&amp;1);
  s += (r += r)&amp;-((y &gt;&gt;= 1)&amp;1);
  s += (r += r)&amp;-((y &gt;&gt;= 1)&amp;1);
  return ((r+r)&amp;-(y&gt;&gt;1))+s;
}

On a $b$-bit CPU, it is required $O(b)$ instructions, compared to $O(1)$ with a constant-time $b$-bit multiplier. Assembly often makes it possible to do considerably better than the obvious translation of the above code, especially on architectures without built-in 16-bit addition.
It's possible to compute $(x\,y)+z$ where $0\le z&lt;2^b-1$ by the same method. This can be used to perform multiplication of arbitrarily large fixed-size quantities in constant time using the schoolbook algorithm, or others such a Karatsuba, translated to base $2^b$ rather than base $10$, with essentially the same $O(b)$ performance penalty compared to implementation with a constant-time multiplier.
The most serious difficulty is the same as on architectures with a constant-time multiplier: constant-time modular reduction.
I don't get how the lack of barrel shifter is an issue: in the arithmetic used in ECC cryptography, there's typically no computed shift involved, thus no opportunity that the lack of barrel shifter degenerates into a timing dependency. And the natural form of most algorithms uses shifts by one, thus a barrel shifter would not help much anyway.

One thing worth investigation on CPUs without hardware multiplier is Elliptic Curves over $GF(2^m)$, e.g. sect239k1. I know no reason this would be much less secure than secp224k1, and scalar multiplication no longer uses any integer multiplication, so the lack of hardware multiplier has low penalty.

¹ Except if the compiler introduces branches or if some of the instructions involved are not constant-time, but I've ever experienced that.