A portable virtual accelerator, in Rust.

virtio-accel concentrates on the portable majority of the system: protocol wire structures, transport ports, device-owned state, a guest client, a mock backend, and a transport-free conformance suite — without Linux ioctls, macOS frameworks, Windows APIs, guest physical addresses, vendor command formats, or a claimed Virtio device ID.

Those adapters are meant to be written against these layers rather than inside them. What ships here is the part that should not have to be rewritten per platform.

Ten crates, published together in dependency order. Each one is pinned to a portability tier that CI enforces on bare-metal aarch64, riscv64, and wasm32 targets, so a crate cannot quietly acquire a host dependency. Every crate is #![forbid(unsafe_code)].

virtio-accel

Facade re-exporting the portable layers.

virtio-accel-proto

Pointer-free, little-endian protocol 1.0 wire structures.

virtio-accel-transport

Dependency-free descriptor-chain, queue, reset, and notification ports.

virtio-accel-core

Backend lifecycle, memory, program, queue, and event contracts.

virtio-accel-split-queue

Bounded in-memory split-ring reference model.

virtio-accel-guest

Typed reference client with bounded request tracking.

virtio-accel-device

Device-owned state, including bounded generational IDs.

virtio-accel-mock

In-memory backend with deterministic artifacts and scripted faults.

virtio-accel-conformance

Transport-free semantic backend suite.

virtio-accel-cleanroom

Independent codec, written without the shared protocol types.

The protocol defines fixed headers and payloads for discovery, contexts, buffers, programs, execution queues, submissions, and events. Unknown opcodes, statuses, and event states stay raw integers until validated, so decoding untrusted bytes never constructs an invalid Rust enum.

Failure still returns an event: a successful submit yields one, and an indeterminate failure must yield one too, because the operation's resources are still owned by the device. Object IDs are opaque, kind-tagged, generational, and never reused after generation exhaustion.

The primary zerocopy ABI and a manual clean-room codec both decode and re-encode every canonical frame, exchanging bytes only. That gives an independent implementation check without making the conformance codec a production dependency.

The repository is public and the workspace publishes at 0.1.x. The Cargo version tracks the Rust API, which is young and expected to change as adapter authors build against it; the protocol version tracks wire compatibility, which is frozen by the v1.0 freeze audit. A pre-1.0 crate version is not a statement about protocol stability.

This remains pre-standardization work and claims no Virtio device ID. Protocol 1.0 opcodes, statuses, and payload layouts are versioned review inputs for independent implementation — frozen for the portable baseline, with incompatible changes requiring a new protocol major version.