TweakTools

tweaktools / tweakos / 0x03

0x03 // hypervisorexperimental · lab only

TweakVisor

A security-first type-1 hypervisor project for the TweakOS ecosystem.

target
AMD x86-64 · SVM
language
C11
policy
deny by default
stage
lab-tested
I.

About

TweakVisor is built for authenticated management, auditable VM isolation, bounded guest introspection and defensive recovery. It's meant to launch through an explicit, measured boot path, never slipped invisibly beneath a running OS.

Everything starts from deny: hypercalls, memory regions, DMA and interrupts are refused unless an owner has authorized them.

It's experimental. All work so far runs in disposable QEMU labs and nested guests. A production type-1 hypervisor, standalone UEFI boot and isolation of physical hardware are not established yet.

II.

Where it stands

today
  • Deny-by-default policy core and hypercall validation
  • AMD SVM VMRUN with real VM exits and a bounded, deny-first exit dispatcher
  • Owner-checked nested page tables, separate ASIDs and 256 parallel synthetic guest entries
  • DMA and interrupt mediation against an emulated AMD-Vi IOMMU, with device quarantine
  • Signed, TPM-measured diagnostic boot children
  • Signed management commands, replay protection, audit history and two-of-three recovery approvals (prototypes)
next
  • Verified owner management and boot integrity
  • Standalone UEFI boot as an independent hypervisor
  • Isolation of physical devices
  • Defensive introspection and recovery