Overview
1.
About Ghaf
2.
Features
3.
Architecture
3.1.
Architectural Variants
3.2.
Architecture Decision Records
3.2.1.
Minimal Host
3.2.2.
Networking VM
3.2.3.
Intrusion Detection System VM
3.2.4.
Platform Bus for Rust VMM
3.3.
Hardening
3.4.
Secure Boot
3.5.
Stack
For Developers
4.
Contributing
5.
Reference Implementations
5.1.
Development
5.1.1.
Build and Run
5.1.2.
Running Remote Build on NixOS
5.1.3.
Installer
5.1.4.
Cross-Compilation
5.1.5.
Creating Application VM
5.1.6.
Hardware Configuration
5.1.7.
Profiles Configuration
5.1.8.
labwc Desktop Environment
5.1.9.
IDS VM Further Development
5.1.10.
systemd Service Hardening
5.2.
Ghaf as Library: Templates
5.2.1.
Example Project
5.2.2.
Modules Options
6.
Technologies
6.1.
Compartmentalization
6.2.
Passthrough
6.2.1.
Binding Device to VFIO Driver
6.2.2.
NVIDIA Jetson AGX Orin: UART Passthrough
6.2.3.
NVIDIA Jetson AGX Orin: PCIe Passthrough
6.2.4.
Generic x86: PCIe Passthrough on crosvm
6.2.5.
NVIDIA Jetson: UARTI Passthrough to netvm
6.2.6.
Device Tree Overlays for Passthrough
6.3.
Platform Bus Virtualization: NVIDIA BPMP
6.4.
Hypervisor Options
Build System and Supply Chain
7.
Continuous Integration and Distribution
8.
Supply Chain Security
8.1.
SLSA Framework
8.2.
Basic Security Measures
8.3.
Software Bill of Materials
8.4.
Public Key Infrastructure
8.5.
Security Fix Automation
9.
Release Notes
9.1.
Release ghaf-24.06
9.2.
Release ghaf-24.03
9.3.
Release ghaf-23.12
9.4.
Release ghaf-23.09
9.5.
Release ghaf-23.06
9.6.
Release ghaf-23.05
Ghaf Usage Scenarios
10.
Showcases
10.1.
Running Windows VM on Ghaf
10.2.
Running Cuttlefish on Ghaf
Appendices
11.
Glossary
12.
Research Notes
12.1.
i.MX 8QM Ethernet Passthrough
12.2.
System Installation
Light
Rust
Coal
Navy
Ayu
Ghaf Framework
Research Notes
Our experience in research, studies and lessons learned activities:
i.MX 8QM platform bus ethernet passthrough
System installation