Current mainline development

01 / SCOPE

This is a main-branch snapshot, not a new version number

02 / VIRTUALIZATION

The resident VMM now survives, and the R-1 layer is built on it

Before this round, the RESIDENT_VMM capability bit only proved that the driver could enter and leave VMX non-root correctly: the first MSR access after entry revoked the hypervisor. The foundation work closed that gap — an MSR bitmap (primary bit 28 plus VMCS 0x2004), an exit engine that treats emulable exits as handled, #UD injection for non-private VMCALL (previously any user-mode code could tear the hypervisor down with one instruction), and a SOAK residency self-test.

AMD parts are no longer misreported as an unsupported CPU. Capability probing now reports SVM, NPT, nRIP, decode assists, flush-by-ASID, and the VM_CR.SVMDIS firmware lock, and returns BACKEND_NOT_IMPLEMENTED — the hardware is capable, the software is not written yet. The SVM backend itself was deliberately left unwritten: two thousand lines of never-executed hypervisor written on an Intel machine would only produce code that looks complete and has never run.

Read the virtualization capability roadmap →

03 / NESTED

It can run as L1 under nesting, and the downgrade is explicit

The original roadmap assumed validation would happen on bare metal. Measurement overturned that: on a development machine with memory integrity enabled, HVCI brings up Hyper-V, and Hyper-V hides CPUID.1:ECX[5] from the root partition. VT-x cannot even be detected, so PREPARE fails outright. Resident start is therefore explicit opt-in: with an outer hypervisor present and no ALLOW_NESTED in the request, the driver refuses; on success it sets RESIDENT_NESTED and the UI states plainly that it is running as L1 with degraded performance and capabilities.

The fix is a private VMX-root IDT plus a broadcast NMI — and the private IDT is a precondition for sending the NMI, not an optimization: a first attempt with only NMI broadcast hit 0x80 NMI_HARDWARE_FAILURE. The fix depends on VPID being disabled; enabling VPID for performance would silently break it, so the two changes must be made together.

See the Nested HVM topology demo →　Read the nested architecture doc →

04 / R-1

R-1 process disposition and the memory channel

“Terminate a process from R-1” has no direct counterpart at the hypervisor layer — it does not know about processes, only CR3 values and guest physical pages. What this path actually does is refuse execution inside the target address space; the two operations differ only in what gets injected on refusal.

05 / KERNEL

Kernel, driver, and diagnostics

These pages remain subject to Driver Status, Capability, DynData, and target-identity gating; a visible button does not mean the corresponding R0 capability is ready.

06 / LIGHT

KswordARKLight became an investigation workbench

Light moved this round from a set of read-only pages to an investigation workflow with workspace state: an evidence session inspector, a versioned window-state model, a bounded registry search workspace, a static navigation palette, and — for memory — immutable read snapshots, staged write plans, and guarded diff writeback. The window, startup, service, system-tools, handle, driver, and ETW pages gained “go to the holder process details” routing, and callback file events are now linked to entities.

Actions that write, delete, restore, or discard records continue to use explicit confirmation, generation checks, and result write-back; export paths are unified as snapshot exports of visible results.

07 / UI & RUNTIME

UI and runtime

A KVM button joins the privilege button row in the title bar. It is a three-state indicator of residency and the single entry point for every R-1 capability: left click toggles residency, and the context menu carries the soak self-test, the write-permission gate, memory operations, and fault reset. The button can be renamed to KVM, HVM, or R-1 in settings, and the privilege buttons can be hidden individually.

Elsewhere: ADS tab bars scroll horizontally and no longer collapse to zero width; detail reports use a unified structured report widget; the process page gained per-core CPU attribution with expandable charts, thread CPU affinity settings, dynamic history snapshots and table snapshot comparison; startup entries support multi-select; and the bugcheck diagnostics page was rebuilt around explicit installation.

08 / EVIDENCE

Acceptance status: what has evidence and what does not

This round produced the first runtime readings, on a 2 vCPU nested Hyper-V target: cross-core TLB violations 97% → 0; a kernel-mode read in the CLOAK direction transparently redirected to the shadow page by EPTP switching without dropping residency; an R-1 freeze that stopped the heartbeat at tick 15 and held it, then resumed at 16 after release rather than restarting from 0; an R-1 terminate that removed the process; and a routine 30-second SOAK still passing.

The earlier next-phase acceptance report keeps the same honest counting: 2 of 116 items PASS, 114 NOT_RUN, with none of the six target environments exercised. Read the acceptance final report →

09 / OPERATOR NOTES

Minimum checks before testing on main

1. 1
   The whole build must come from one commit.

   Do not replace only the EXE, SYS, language pack, profiles, or plugins.

2. 2
   Check Driver Status, DynData, and Capability first.

   Unsupported means a protocol, driver, or capability mismatch — not that the page has no data.

3. 3
   Start resident HVM only in an authorized, rollback-capable environment.

   Save your work before every start. While resident, sc stop returns 1052 because the unload guard is holding it; residency must be stopped first. EPT rules, split views, and R-1 dispositions can also only be installed while residency is stopped.

4. 4
   Test high-risk actions only where they can be rolled back.

   System time, disk writes, driver unload, kernel modification, process protection, and delete actions all need a snapshot or a recovery path.

5. 5
   Preserve pre-change evidence.

   Export target identity, addresses, owning module, configuration, and timestamps; refresh afterwards and keep both results.

10 / COMMIT INDEX

Key commits