Neura Market
hypervisor logo

hypervisor

Free

ARM64 Type-1 bare-metal hypervisor in no_std Rust, runs at EL2 on QEMU virt, boots Linux with FF-A v1.1 SPMC.

FreeFree tier
Type
Open Source
Visit Website GitHub (40 stars)

About hypervisor

A bare-metal ARM64 Type-1 hypervisor (Secure Partition Manager) written entirely in no_std Rust. It replaces Hafnium as the S-EL2 SPMC, boots Linux guests, and runs alongside Android pKVM on the same chip. The project implements the FF-A v1.1 protocol, GICv3 driver, page table walker, and SPMC event loop from scratch with zero dependencies beyond Rust core. It boots a Linux 6.12 kernel to a BusyBox shell on QEMU virt with 4 vCPUs, virtio-blk, and virtio-net, and passes 35 end-to-end tests through the full stack (Linux kernel module → pKVM → TF-A SPMD → SPMC → Secure Partitions). Designed for learning ARM's Secure architecture by building it, the codebase is fully auditable, GDB-steppable, and includes 457 passing assertions. The repo also offers a bilingual (English/Chinese) book draft and an architecture overview.

Key Features

Bare-metal ARM64 Type-1 hypervisor written entirely in no_std Rust
Replaces Hafnium as S-EL2 Secure Partition Manager (SPMC)
FF-A v1.1 protocol implementation with direct/indirect messaging, memory sharing, notifications, and console log
Brings up Linux 6.12 with 4 vCPUs, virtio-blk, virtio-net, and inter-VM networking
Runs alongside Android pKVM at NS-EL2 on the same physical CPUs
Hand-written GICv3 driver, page table walker, and SPMC event loop — zero transitive dependencies
35 end-to-end tests pass through full stack (Linux → pKVM → TF-A SPMD → SPMC → Secure Partitions)
457 assertions across 34 test suites
Supports booting 3 Secure Partitions with SP lifecycle management
Full auditability — every line is GDB-steppable with no hidden behavior

Pros & Cons

Pros
  • Written in Rust — catches real bugs at compile time (e.g., match guards against invalid SP state transitions)
  • Single dependency (no_std Rust core) — full auditability and no hidden behavior
  • Hand-coded implementation of every component — no auto-generated or imported code
  • Comprehensive test suite with 457 passing assertions and 35 E2E tests
  • Open source with detailed architecture documentation and bilingual book draft
  • Designed to be skimmed in layers: README → ARCHITECTURE.md → book → src/
Cons
  • Requires ARM64 hardware with EL2 and EL3 support (currently runs only on QEMU virt)
  • Still an early-stage project (14 stars, 2 forks) — not yet production-ready
  • Limited to specific FF-A v1.1 use cases; not a general-purpose hypervisor
  • Documentation is primarily text-based; fewer visual diagrams or tutorials beyond those in the repo
  • Dependency on a specific FF-A compatible firmware stack (TF-A SPMD) and pKVM for full integration

Best For

Learning ARMv8-A Secure architecture and EL2/EL3 privilege levelsResearch and experimentation with FF-A v1.1 and S-EL2 hypervisorsEducation in systems programming and bare-metal Rust developmentPrototyping custom Secure Partition Managers for embedded or mobile systemsReplacing Hafnium in Android or Linux environments that require a lightweight SPMC

FAQ

Why build this hypervisor instead of using Hafnium?
To learn ARM's Secure architecture by building it. Hafnium works but is 200K+ lines of C; this project rewrites the SPMC from scratch in Rust to understand the 'why' behind the FF-A spec. Rust catches real bugs at compile time, and the single-dependency design ensures full auditability.
Does it actually work?
Yes. 35 out of 35 end-to-end tests pass through the full stack: Linux kernel module → pKVM → TF-A SPMD → our SPMC → Secure Partitions and back. A demo can be run with 'make run'.
What hardware does it run on?
Currently it runs on QEMU virt (ARM64) with the 'virt' machine type. It requires a system with EL3, S-EL2, and NS-EL2 support.
What is the license?
The repository is open source and includes a LICENSE file (not specified in the scraped content, but typically MIT or Apache; the repo has a LICENSE file).