Simulate, validate, and test embedded systems before hardware is ready.

EoSim is the simulation and validation platform for the EmbeddedOS ecosystem — supporting 52+ platforms across 12 architectures with native Python simulation engine, Renode support, GUI dashboard, cluster simulation, and CI-native configuration-driven testing.

pip install git+https://github.com/embeddedos-org/eosim.git

eosim list                        # show available platforms
eosim info arm64-linux            # platform details
eosim run arm64-linux             # launch simulation
eosim test arm64-linux            # run validation tests
eosim doctor                      # check environment
eosim stats                       # platform registry statistics
eosim gui stm32f4                 # open GUI dashboard

eosim/
├── eosim/
│   ├── cli/              CLI entry point (click-based)
│   ├── core/             Core simulation logic
│   ├── engine/           Backend engines (EoSim native, Renode)
│   ├── gui/              Tkinter GUI dashboard
│   ├── integrations/     External tool integrations
│   ├── artifacts/        Simulation artifact management
│   └── platforms/        Platform abstraction
├── platforms/            52+ platform definitions (YAML + Renode .repl/.resc)
│   ├── stm32f4/          STM32F4 Discovery
│   ├── raspi4/           Raspberry Pi 4
│   ├── esp32/            ESP32
│   ├── riscv64/          RISC-V 64-bit
│   ├── jetson-orin/      NVIDIA Jetson Orin
│   └── ...               + 47 more
├── tests/                Unit + integration + scenario tests
├── examples/             Demo scenarios (cluster-demo)
├── pyproject.toml        Python package configuration
└── pytest.ini            Test configuration

name: arm64-linux
display_name: ARM64 Generic Linux
arch: arm64
engine: renode
simulation:
  machine: virt
  cpu: cortex-a57
boot:
  kernel: images/arm64-Image
  rootfs: images/arm64-rootfs.ext4
runtime:
  memory_mb: 2048
  headless: true
  uart: sysbus.uart0

The optional Tkinter GUI provides:

• GPIO panel — pin visualizer with click-to-toggle
• UART terminal — real-time serial output
• CPU state panel — registers, PC, SP, flags, clock
• Memory view — hex dump of RAM/Flash regions
• Peripheral registers — TIM, ADC, SPI, I2C config
• 3D renderers — drone, robot, vehicle, aircraft, medical, satellite

The QMP (QEMU Machine Protocol) client connects to QEMU over TCP or Unix sockets. QMP has no built-in authentication. To use it securely:

• Always bind QMP to localhost (-qmp tcp:127.0.0.1:4444,server,wait=off). Never expose QMP on 0.0.0.0 or a public interface.
• If remote QMP access is required, use an SSH tunnel or VPN — never expose QMP directly.
• The QMPClient.connect_tcp() method logs a warning when connecting to non-localhost hosts.
• Use Unix domain sockets (-qmp unix:/tmp/qmp.sock,server,wait=off) when possible for stronger isolation via filesystem permissions.

The SerialBridge sanitizes all data received from physical serial ports before forwarding to the simulated UART:

• Control characters (except \t, \n, \r) are stripped to prevent terminal escape injection.
• Input is truncated to 4096 bytes per read to prevent buffer-based attacks.
• When bridging to a VM UART, never pass serial data directly to a shell exec() or os.system() call.

The Dockerfile follows container security best practices:

• Non-root user: The container runs as the eosim user (UID 1000), not root.
• Minimal image: Uses python:3.11-slim to reduce attack surface.
• Multi-stage build: Build tools are not included in the final image.
• HEALTHCHECK: Container health is monitored via eosim doctor.
• No unnecessary ports: No ports are EXPOSEd by default — map only what you need at runtime.

Automated security scanning runs on multiple schedules:

See SECURITY.md for vulnerability reporting procedures.

This project is part of the EoS ecosystem and aligns with international standards including ISO/IEC/IEEE 15288:2023, ISO/IEC 12207, ISO/IEC/IEEE 42010, ISO/IEC 25000, ISO/IEC 25010, ISO/IEC 27001, ISO/IEC 15408, IEC 61508, ISO 26262, DO-178C, FIPS 140-3, POSIX (IEEE 1003), WCAG 2.1, and more. See the EoS Compliance Documentation for full details including NTIA SBOM, SPDX, CycloneDX, and OpenChain compliance.

master is the line of development; every PR lands here. release is a rolling pointer to the latest released vX.Y.Z tag, updated automatically by .github/workflows/sync-release-branch.yml. Tags are immutable.

See embeddedos-org/.github/STANDARDS.md for the org-wide tag scheme, release model, and the compliance frameworks every product targets.

MIT License — see LICENSE for details.