TEMU 5.1.0

TEMU 5.1.0 was released on 2026-11-05.

TEMU 5.1.0 is a feature release.

Important

The following changes may require action from integrators.

  • Install location. The default install location for DEB and RPMs will no longer be /opt/temu/5.1.n, but will be installed in /opt/temu/5.1/. This change will simplify the updating of TEMU in place, and as patch releases are binary compatible, no relinking or rebuilding with different rpath settings need to be done.

  • Relocatable tarballs. The tarballs (.tar.xz) will no longer unpack into opt/temu/5.n but will unpack directly into the working directory to ensure they are fully relocatable.

  • Python wrappers. The Python bindings are now generated with SWIG, and the old ctypes-based wrappers are deprecated, see Python. Code that manipulates the ctypes objects directly may need updating. The old wrappers can still be selected with the python/legacy-wrappers config setting. See Python ctypes Wrappers.

  • Multi-level scheduler API. The MLS C API has been split into a stable header (temu-c/Scheduler/MultiLevelScheduler.h) and an unstable header (temu-c/Scheduler/MultiLevelSchedulerUnstable.h). The legacy temu_CpuSchedIface and temu_SyncIface based registration is deprecated in favour of temu_schedAddLeaf() and the scheduler sync notifications. Define TEMU_ALLOW_DEPRECATED to silence the deprecation warnings. See Multi-Level Scheduler Legacy CPU and Sync Interfaces.

  • temu_MemoryIface is deprecated (since 5.0.1), see Memory Interface (temu_MemoryIface).

  • The GRLIB IrqAMP property config.experimentalDisableExtIrqBit has been removed.

  • SpwCcsdsAdapter: config.ecssHeader now defaults to 1.

  • A property path that is both a property and a property namespace is deprecated and will not be supported in TEMU 6.

Features

The following features have been added to TEMU 5.1.0.

  • Major Features

    • ARM target support, see ARM.

    • Guest thread sanitizer (race detector), see Thread Sanitizers.

    • Storage modelling (flash, EEPROMs, SD-cards), see Storage Models.

    • USB bus modelling (experimental).

    • LCD / display modelling APIs with PPM and VNC back-ends (experimental).

    • Python support, see Python.

    • Plugin reloading. Classes are now namespaced by the plugin that registered them, and the command line language supports :: qualified names.

  • Simulator Core

    • Multi-level scheduler (MLS)

      • Wall-clock pacing with a speed factor (set-speed-factor).

      • The GDB server now works with the multi-level scheduler.

    • Memory

      • New MemorySnooper model, a man-in-the-middle memory model that can observe accesses between a memory space and a device, including a snoop-between command and a capability adaptor mode.

      • Code patterns can now be removed.

    • TEMU Script and Components

      • TEMU scripts can subscribe to notifications.

      • TEMU scripts support while loops.

      • YAML components support a setup section and hexadecimal array indices.

    • C API

      • Enumerate global and class commands and their options, retrieve the last command error (temu_cmdTakeError()), and fetch positional command line arguments.

      • temu_printf() and temu_printerr() no longer truncate output at 1023 bytes.

      • temu_getConfDir() returns the user configuration directory.

      • Static symbol lookup through the C API, with a symbol lookup cache.

      • Iterate objects by interface and class type.

      • Notification on class registration.

  • Debugging

    • GDB server

      • RISC-V support.

      • XML target descriptions, register window shadowing fixes and re-attach support.

      • Attaching a debugger now reports the resulting stop.

      • The server can pick a free port (port 0).

      • cpu.break-on-trap is now usable from GDB, and is also available on PowerPC.

    • OS awareness

      • Common terminology for software / OS events, emitted as CTF trace events.

      • Stack tracing and stack overflow detection.

      • A software analysis TCF service for querying OS-level properties.

      • Global breakpoint and watchpoint commands are context aware.

      • Additional CTF dumping commands; traces can be peeked without consuming them.

    • TCF

      • Bidirectional serial consoles in the System Debugger. Connected serial consoles are automatically exported as temu.serial streams.

    • MCP server

      • Tools for individual properties, scheduler control and UART output.

      • Thread sanitizer analysis reports are served over MCP.

    • Assemblers and disassemblers

      • ARM (A32, T32 and A64) assembler and disassembler, including register lists and aliases.

      • SPARC assembler supports the %hi and %lo operators.

    • --no-color now applies to diagnostics as well.

  • Models

    • ARM processors, see ARM.

    • SoC support

      • Microchip SAMRH71, with all SoC peripherals modelled (PIO, FLEXCOM, XDMAC, GMAC, MCAN, IP1553, SpaceWire, QSPI, HEFC flash, TC, PWM, TRNG, SHA, ICM, HEMC/HSMC/HSDRAMC with ECC and more).

      • STMicroelectronics STM32F4 (STM32F407VG and STM32F429ZI), including GPIO, USART, SPI, I2C, timers, DMA, DMA2D, ADC, DAC, RTC, watchdogs, CAN, Ethernet, SDIO, FMC SDRAM controller, LTDC, DCMI, SAI, HASH, CRC, RNG and USB OTG. The 32F429I-Discovery board peripherals are wired into the F429 component.

      • TI TMS570LC43 component (ARMv7-R).

      • Cortex-M4, Cortex-M7 and Cortex-A72 (single and dual core) components.

    • Storage and memory devices

      • Micron MT25Q serial NOR flash.

      • GRLIB SPIMCTRL with memory mapped execution from SPI flash.

      • I2C and SPI EEPROMs.

      • SD / MMC card.

    • USB (experimental)

      • USB fabric, hub and generic device.

      • Synopsys DWC2 USB OTG controller (host and device mode).

      • HID mouse, CDC-ACM (serial bridge) and NVM-backed mass-storage devices.

    • Display, audio and video (experimental)

      • PPM and VNC display sinks; VNC pointer events are forwarded to a pointer interface.

      • STMPE811 touch screen controller.

      • WM8994 audio codec and OV2640 camera models.

    • Signals and analog

      • SignalInjector, a commandable signal source.

      • SignalLogger (with period and duty cycle measurement), PwmLogger and SignalSplitter.

      • AnalogInjector and AnalogLogger.

      • CanProbe and a generic IrqCombiner.

    • Console Models

      • Bundled PTY model that works with any terminal emulator.

      • Telnet serial model.

      • TCF serial for the System Debugger.

    • GRLIB

      • GRSPW and GRSPFI now save their state, and model packet transmission timing. SpaceWire packet times now include parity and control bits, and SpaceFibre includes framing, FCT and CRC overhead.

      • GRSPW router AMBA port RP/TP bits.

      • SpaceWire discarded packets are reported rather than logged at debug level, and packet discarding is controllable.

    • P2020

      • PCIe bus errors raise a machine check exception.

      • MMIO address translation caching across the PCIe controller.

    • SpwCcsdsAdapter: support for the ECSS-E-ST-50-53C reserved and user application bytes.

Performance

  • PowerPC models now support binary translation.

  • ARM binary translation of A32 and T32 on the M- and R-profile cores, and of A64 and AArch32 on the Cortex-A72.

  • The address translation cache (ATC) now caches routes to MMIO devices, speeding up device register accesses.

  • Improved x86 code generation in the binary translators.

  • SPARC: more of the guest code is translated.

  • LEON ASI 1 stores now use the ATC fast path.

  • Floating point binary translation on RISC-V hosts.

  • Improved RISC-V host code generation.

  • MLS barrier improvements.

Bug Fixes

  • Processors

    • RISC-V hypervisor CSR privilege checks.

    • RISC-V VS mode CSR access.

    • RISC-V page table reads during the VS stage (hgatp).

    • RISC-V guest atomics and multicore boot races.

    • RISC-V LR/SC reservations are now broken by other harts' stores.

    • RISC-V binary translation: sign extension in fused auipc+addi, and set-less-than conditional jumps.

    • SPARC binary translation sdiv-overflow issues.

    • SPARC PC not spilled for ASI read and write calls.

    • Wrong time deviation for traps raised in delay slots.

    • Memory attribute in translated code.

    • Invalid accesses now report the real PC on RISC-V and SPARC.

  • Schedulers

    • MLS issues with halted CPUs.

    • MLS snapshotting issues.

    • Single-level scheduler breakpoints without GDB attached.

    • temu_eventDeschedule() racing the event owner.

    • Race condition in run control during reverse execution.

  • Models

    • Missing SMB VROM area for GR765.

    • GR765 RISC-V peripheral addresses and device trees.

    • GRETH reports a bad UDP checksum on the UDP error bit.

    • APBUART undefined behaviour on empty FIFO pop.

    • ERC32 MEC defects.

    • TI RTI live-lock and double counted time when disabling the counter.

    • TI VIM reports no pending interrupt as 0 in IRQINDEX / FIQINDEX.

    • Ethernet link negotiation and address registration.

    • Ethernet delay object uninitialised delays and leaked packets.

  • Debugging

    • GDB server shutdown and teardown issues.

    • RTEMS awareness stack sampling and sync object decoding.

    • ABI unwinder defects.

    • Line number lookup crash when no compilation unit is found.

    • TCF shutdown issues.

    • Reverse execution fixes: idle step behaviour, reversing to a breakpoint and delay-slot handling.

  • Other

    • Deadlock and undefined behaviour in async events.

    • Minor memory leak from global state, and other memory errors found by AddressSanitizer.

    • Out of bounds accesses to containers.

    • No warning is printed at plugin load time for deprecated properties.

    • Binary snapshots now carry blob properties and exact cycle-domain event deadlines. Previously restored cyclic events could drift in phase after a restore.

ARM

TEMU 5.1 adds support for ARM processors. The ARM models are split into three plugins: ARM-M, ARM-AArch32 and ARM-AArch64.

The following cores are supported:

  • Cortex-M4 and Cortex-M7 (ARMv7-M, including FPU, MPU and bit-banding).

  • ARMv7-R and Cortex-R52 (AArch32, with BE8 support).

  • Cortex-A72 (AArch64, with AArch32 at EL0), including Advanced SIMD and floating point.

Python

The Python bindings now wrap the public C API with SWIG. On top of these, a new pythonic layer maps TEMU objects to Python objects: properties are attributes and commands are methods.

cpu = temu.getObject("board0-cpu")
cpu.freq = 50_000_000
temu.init_scheduler(variant="multi-level")

It is also possible to subscribe to notifications with a Python function:

sub = cpu.subscribe("temu.cpuTrapEntry", lambda src, info: print(hex(info.PC)))
sub.unsubscribe()

Thread Sanitizers

TEMU now comes with thread sanitizer support. The thread sanitizers build on OS-awareness and add support for detecting race conditions in unmodified target binaries. Initial support includes sparc32-rtems6, but additional combinations can be added in the future.

Storage Models

TEMU now introduces storage models, built on a new experimental non-volatile memory (NVM) API. The NVM interfaces cover NOR and NAND flash semantics, and the first flash model is the Micron MT25Q serial NOR flash. EEPROM and SD-card models, as well as the STM32F4 and SAMRH71 on-chip flash, are built on the same API.