Gunyah is a Type-1 hypervisor designed for strong security, performance and modularity.

Overview

Qualcomm Innovation Center.

Gunyah Hypervisor

Gunyah is an Australian Aboriginal word. See: https://en.wiktionary.org/wiki/gunyah

The Gunyah Hypervisor was developed by Qualcomm in Sydney Australia.

Type-1 Hypervisor Concept

Gunyah is a Type-1 hypervisor, meaning that it is independent of any high-level OS kernel, and runs in a higher CPU privilege level. It does not depend on any lower-privileged OS kernel/code for its core functionality. This increases its security and can support a much smaller trusted computing base than a Type-2 hypervisor.

Gunyah's design principle is not dissimilar to a traditional microkernel in that it provides only a minimal set of critical services to its clients, and delegates the provision of non-critical services to non-privileged (or less-privileged) processes, wherever this is possible without an adverse impact on performance or security.

The hypervisor uses the CPU's virtualization mode and features to isolate itself from OS kernels in VMs. On ARM, this includes trapping privileged registers, using GIC virtualization support, and the Stage-2 MMU to provide isolated VMs in EL1/0.

Why Gunyah

  • strong security: Mobile payments, secure user-interface, and many more security sensitive use-cases all require strong security. Gunyah's design is suited to providing strong isolation guarantees and its small size is conducive to audit.
  • performance: Mobile devices are particularly demanding. Battery powered devices demand low software overheads to get the most performance per-watt. Gunyah is designed to have high performance with minimal impact to high-level operating systems.
  • modularity: The hypervisor is designed to be modular, allowing customization and enhancement by swapping out module implementations and adding new feature via new modules.

Features

  • Threads and Scheduling: The scheduler schedules virtual CPUs (VCPUs) on physical CPUs and enables time-sharing of the CPUs.
  • Memory Management: Gunyah tracks memory ownership and use of all memory under its control. Memory partitioning between VMs is a fundamental security feature.
  • Interrupt Virtualization: All interrupts are handled in the hypervisor and routed to the assigned VM.
  • Inter-VM Communication: There are several different mechanisms provided for communicating between VMs.
  • Device Virtualization: Para-virtualization of devices is supported using inter-VM communication. Low level system features and devices such as interrupt controllers are supported with emulation where required.

Platform Support

Gunyah is architected to support other CPU architectures, so its core design ensures architecture independence and portability in non-architecture specific areas.

Gunyah currently supports ARMv8.2+ platforms as it uses AArch64 EL2 in VHE mode. Some porting is required to support ARMv8.0.

We have developed an initial port of Gunyah to the QEMU ARMv8 simulator. Note QMEU v5+ is required. Additional platforms are expected to be supported in future contributions.

Getting Started

Contributions

Thank you for your interest in contributing to Gunyah!

Please read our Contributions Page for more information on contributing features or bug fixes.

Team

Gunyah was developed by Qualcomm and aims to be an open and community supported project.

Check out the AUTHORS for major contributors.

License

Gunyah is licensed on the BSD 3-clause "New" or "Revised" License. Check out the LICENSE for more details.

Comments
  • No responding after luanching hypvm.elf in qemu

    No responding after luanching hypvm.elf in qemu

    I have built the environment using provided Dockerfile on a Ubuntu 16.04 machine without errors. The image is on dockerhub: ml2558/gunyah:gunyah. However, when I follow the rest process building the hypervisor, resource manger and c runtime and pack them into single hypvm.elf binary and try to run them using qemu, it does not have any output. Is it normal?

    Edit: here is what it looks like:

    (gunyah-venv) root@a12fdfadd046:/home/gunyah-hypervisor# qemu-system-aarch64 -machine virt,virtualization=on,gic-version=3,highmem=off \

    -cpu max -m size=2G -smp cpus=8 -nographic
    -kernel /home/hypvm.elf
    -device loader,file=$OUTPUT_DIR/Image,addr=$LINUX_BASE
    -device loader,file=$OUTPUT_DIR/virt.dtb,addr=$DT_BASE
    -device loader,file=$OUTPUT_DIR/initrd.img,addr=$INITRD_BASE

    after entering the above command, the terminal just hangs (no errors, crashes, etc).

    opened by lmlaaron 7
  • How to Add a test Application/Image into the VM running in gunyah

    How to Add a test Application/Image into the VM running in gunyah

    Following the Guide, I can successfully run gunyah and the VM, but I want do some more study about it, so, I want to add A Test App( A image) into the VM, then I can run some test. But I failed. I tried the below two ways:

    1. add the image as the qemu-system-aarch64 with "--drive " option like below:
    qemu-system-aarch64 \
    -machine virt,virtualization=on,gic-version=3,highmem=off \
    -cpu max -m size=2G -smp cpus=8 -nographic \
    -kernel ../gunyah/gunyah-hypervisor/hypvm.elf \
    -device loader,file=/usr/local/src/out/Image,addr=0x41080000 \
    -device loader,file=/usr/local/src/out/virt.dtb,addr=0x44200000 \
    -device loader,file=/usr/local/src/out/initrd.img,addr=0x44400000 \
    **-drive  format=raw,index=0,file=../gunyah/myAPP.squashfs**
    

    The command runs successfully without error, but after login to VM OS, there nothing can be seen in any folders in the VM OS

    1. Try add my APP into the initram disk image, and got error below: [ 36.559017] Initramfs unpacking failed: read error ....... ..... [ 55.419495] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0) [ 55.435487] CPU: 5 PID: 1 Comm: swapper/0 Not tainted 5.14.0-rc1-00199-g45312bd762d3-dirty [ 55.441980] Hardware name: linux,dummy-virt (DT) [ 55.445334] Call trace: [ 55.448231] dump_backtrace+0x0/0x1d4 [ 55.461203] show_stack+0x1c/0x28 [ 55.467446] dump_stack_lvl+0x68/0x80 [ 55.480107] dump_stack+0x18/0x3c [ 55.481206] panic+0x17c/0x36c [ 55.482637] mount_block_root+0x1d4/0x200 [ 55.484015] mount_root+0x60/0x6c [ 55.488445] prepare_namespace+0x11c/0x198 [ 55.489134] kernel_init_freeable+0x154/0x184 [ 55.489837] kernel_init+0x24/0x19c [ 55.490759] ret_from_fork+0x10/0x18 [ 55.494631] SMP: stopping secondary CPUs [ 55.514051] Kernel Offset: 0x4396b0c80000 from 0xffff800010000000 [ 55.517683] PHYS_OFFSET: 0x40000000 [ 55.524732] CPU features: 0x000002d1,6d300c47 [ 55.533291] Memory Limit: none [ 55.552053] ---[ end Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(1,0) ]---

    Any advice would be greatly appreciated.

    opened by H-H-bin 1
  • Add missing documentation to strip packaged ELF files

    Add missing documentation to strip packaged ELF files

    Update build.md to specify that the boot image needs to be generated using the stripped version of the Resource Manager and C Runtime output binaries.

    opened by quic-cvanscha 0
  • Link error while building Resource manager

    Link error while building Resource manager

    Hi,

    I get the following error while building the resource manager. Any pointers would be very helpful.

    cheers, Achin

    [50/50] ld build/resource-manager FAILED: build/resource-manager /home/achgup01/work/tools/llvm/llvm-musl-install/bin/clang -target aarch64-linux-gnu -fuse-ld=lld -mcpu=cortex-a75 -static-pie -Wl,--gc-sections -static -fuse-ld=lld --rtlib=compiler-rt -Wl,-z,max-page-size=4096 -Wl,-z,separate-loadable-segments -lfdt -Wl,-Bstatic -L /home/achgup01/work/tools/sysroot/lib --sysroot=/home/achgup01/work/tools/llvm/llvm-musl-install//aarch64-linux-gnu/libc/ build/arch/armv8/obj/src/smc.c .o build/platform/qemu/obj/src/uart_qemu.c.o build/src/obj/dt/dt_overlay.c.o build/src/obj/event/event-isr.c.o build/src/obj/exit/exit.c.o build/src/obj/guest_interface.c.o build/src/obj/hyp/memextent.c.o build/ src/obj/irq_manager/irq_manager.c.o build/src/obj/memparcel/memparcel.c.o build/src/obj/preempt/preempt.c.o build/src/obj/resource-manager.c.o build/src/obj/rpc/rm-rpc-fifo.c.o build/src/obj/rpc/rm-rpc-msgqueue. c.o build/src/obj/rpc/rm-rpc.c.o build/src/obj/uart/uart.c.o build/src/obj/utils/address_range_allocator.c.o build/src/obj/utils/circular_buf.c.o build/src/obj/utils/dict.c.o build/src/obj/utils/vector.c.o build /src/obj/vm_config/dtb_parser.c.o build/src/obj/vm_config/vm_config.c.o build/src/obj/vm_config/vm_config_parser.c.o build/src/obj/vm_config/vm_get_resources.c.o build/src/obj/vm_console/vm_console_simple.c.o bu ild/src/obj/vm_creation/dto_construct.c.o build/src/obj/vm_creation/hlos_vm.c.o build/src/obj/vm_creation/second_vm.c.o build/src/obj/vm_creation/vm_creation.c.o build/src/obj/vm_mgnt/vm_mgnt.c.o -o build/resour ce-manager ld.lld: error: cannot preempt symbol: __init_array_start

    defined in referenced by __libc_start_main.c:13 (../src/env/__libc_start_main.c:13) __libc_start_main.o:(.rodata+0x18) in archive /home/achgup01/work/tools/llvm/llvm-musl-install//aarch64-linux-gnu/libc//lib/libc.a

    ld.lld: error: cannot preempt symbol: __init_array_end

    defined in referenced by __libc_start_main.c:13 (../src/env/__libc_start_main.c:13) __libc_start_main.o:(.rodata+0x20) in archive /home/achgup01/work/tools/llvm/llvm-musl-install//aarch64-linux-gnu/libc//lib/libc.a

    ld.lld: error: cannot preempt symbol: _DYNAMIC

    defined in referenced by __init_tls.c:80 (../src/env/__init_tls.c:80) __init_tls.o:(.rodata+0x0) in archive /home/achgup01/work/tools/llvm/llvm-musl-install//aarch64-linux-gnu/libc//lib/libc.a

    ld.lld: error: cannot preempt symbol: __fini_array_end

    defined in referenced by exit.c:15 (../src/exit/exit.c:15) exit.o:(.rodata+0x0) in archive /home/achgup01/work/tools/llvm/llvm-musl-install//aarch64-linux-gnu/libc//lib/libc.a

    ld.lld: error: cannot preempt symbol: __fini_array_start

    defined in referenced by exit.c:15 (../src/exit/exit.c:15) exit.o:(.rodata+0x8) in archive /home/achgup01/work/tools/llvm/llvm-musl-install//aarch64-linux-gnu/libc//lib/libc.a clang-10: error: linker command failed with exit code 1 (use -v to see invocation) ninja: build stopped: subcommand failed.

    opened by achingupta 1
  • A prebuilt docker instance would be really nice

    A prebuilt docker instance would be really nice

    I'm teaching a class at UCSD Ext and thinking of using Gunyah for students to play around. Some are Windows users and only have WSL - Windows Subsystem for Linux.

    We could not get "docker build -f gunyah/Dockerfile -t user:gunyah ." to complete because the gcc compiler or ninja ran out of memory on WSL.

    Is it possible to host a prebuilt docker instance on hub.docker.com? I found a lot of Android and KVM dockers, but no Gunyah docker there.

    opened by zengtm 1
  • There are no

    There are no ".githooks" ...

    There are no shared ".githooks" files: .githooks/pre-commit .githooks/commit-msg mentioned in Contribution page (same with C Runtime and Resource Manager)

    opened by malus-brandywine 1
Owner
Qualcomm Innovation Center
Qualcomm Innovation Center
Leo Hypervisor. Type 1 hypervisor on Raspberry Pi 4 machine.

Leo Hypervisor Leo. Type 1 hypervisor on Raspberry Pi 4 machine. Set Up This setup was tested on Debian Install Required Dependencies and Toolchain su

Mushahid Hussain 15 Dec 5, 2022
type 2 hypervisor written in c++

Hypervisor : RU Краткое описание. Hypervisor - это гипервизор второго типа, который виртуализирует уже запущенную систему. Для запуска данного гиперви

null 7 Oct 18, 2022
weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.

weggli is a fast and robust semantic search tool for C and C++ codebases. It is designed to help security researchers identify interesting functionality in large codebases.

Google Project Zero 2k Dec 28, 2022
Quake Enhanced mod where one player (The Juggernaut) is very strong and all other players have to kill the Juggernaut

QE Juggernaut Quake Enhanced Juggernaut (A modification of the QEHunter mod by JPiolho.) This is a multiplayer mod where one player is the Juggernaut.

null 2 Jun 6, 2022
Unix pager (with very rich functionality) designed for work with tables. Designed for PostgreSQL, but MySQL is supported too. Works well with pgcli too. Can be used as CSV or TSV viewer too. It supports searching, selecting rows, columns, or block and export selected area to clipboard.

Unix pager (with very rich functionality) designed for work with tables. Designed for PostgreSQL, but MySQL is supported too. Works well with pgcli too. Can be used as CSV or TSV viewer too. It supports searching, selecting rows, columns, or block and export selected area to clipboard.

Pavel Stehule 1.9k Jan 4, 2023
An Open-source Strong Baseline for SE(3) Planning in Autonomous Drone Racing

Fast-Racing An Open-source Strong Baseline for SE(3) Planning in Autonomous Drone Racing 0. Overview Fast-Racing is a strong baseline that focuses on

ZJU FAST Lab 109 Dec 6, 2022
Some hypervisor research notes. There is also a useful exploit template that you can use to verify / falsify any assumptions you may make while auditing code, and for exploit development.

Introduction Over the past few weeks, I've been doing some hypervisor research here and there, with most of my focus being on PCI device emulation cod

Faith 130 Nov 18, 2022
USENIX 2021 - Nyx: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types

Nyx: Greybox Hypervisor Fuzzing using Fast Snapshots and Affine Types Nyx is fast full-VM snapshot fuzzer for type-2 hypervisors. It's built upon kAFL

Chair for Sys­tems Se­cu­ri­ty 161 Dec 7, 2022
User-mode trap-and-emulate hypervisor for RISC-V

URVirt URVirt is a U-mode trap-and-emulate hypervisor for RISC-V. Related projects RVirt is an S-mode trap-and-emulate hypervisor for RISC-V. It runs

null 12 Sep 16, 2022
Little driver for detect UM/KM debugger and Hypervisor

MAJESTY-technologies Little driver for protecthion. The driver is still under development, so you can submit your ideas! I write it's for manual map d

null 59 Jan 5, 2023
This Program Enables And Disables Hyper-V Hypervisor So You Can Use Other Virtualisation Tools Such As (VMware, VirtualBox) Simultaneously.

Hyper-V-Switch This Program Enables And Disables Hyper-V Hypervisor So You Can Use Other Virtualisation Tools Such As (VMware, VirtualBox) Simultaneou

RaynerSec 4 Nov 10, 2022
Kit: a magical, high performance programming language, designed for game development

Kit: a magical, high performance programming language, designed for game development

Kit Programming Language 988 Dec 10, 2022
The purpose of these streams is to be educational and entertaining for viewers to learn about systems architecture, reverse engineering, software security, etc., and NOT to encourage nor endorse malicious game hacking.

Memestream This repository holds the code that I develop during my live game "modding" ?? sessions. When I stream, I like to speedrun making a success

Stephen Tong 28 Jul 6, 2022
mimikatz is a tool I've made to learn C and make somes experiments with Windows security

mimikatz is a tool I've made to learn C and make somes experiments with Windows security

Benjamin DELPY 16.6k Dec 31, 2022
anthemtotheego 402 Dec 26, 2022
A list of excellent resources for anyone to deepen their understanding with regards to Windows Kernel Exploitation and general low level security.

WinKernel-Resources A list of excellent resources for anyone trying to deepen their understanding with regards to Windows Kernel Exploitation and gene

Vector Security 55 Nov 12, 2022
Linux v4.14 with the latest security patches and PS4 patches.

Patches are from https://github.com/Ps3itaTeam/ps4-linux Linux kernel ============ This file was moved to Documentation/admin-guide/README.rst Plea

kquote03 2 Oct 12, 2021