Overview

BitVisor is a small, lightweight hypervisor originally designed to mediate I/O access from a single guest OS. It is developed and maintained as an open-source community project.

Architecture: Parapass-through

The central design principle of BitVisor is the parapass-through architecture.

Most I/O accesses from the guest OS pass directly through to hardware, while only security-critical I/O is intercepted and mediated by the hypervisor. Because it reuses the guest OS’s own device drivers, BitVisor requires no large device emulation layer, keeping the TCB (Trusted Computing Base) as small as possible.

BitVisor is a single-VM design and does not support running multiple VMs simultaneously. This eliminates the need for inter-VM resource management, further reducing code size and complexity.

Key Features

Small Trusted Computing Base (TCB)
The parapass-through architecture and single-VM design keep BitVisor’s codebase extremely compact. A smaller codebase means a reduced attack surface and lower cost for verification and auditing.

Transparent Operation
BitVisor runs beneath an unmodified guest OS (Windows, Linux, etc.). Security features are enforced at the hypervisor layer without requiring any changes to existing software.

Research and Education Platform
Thanks to its simple, well-structured codebase, BitVisor is widely used as a platform for hypervisor research and OS security education. It is freely available under the BSD license.

Hardware Virtualization Support
BitVisor supports Intel VT-x and AMD-V on x86_64 (Intel/AMD PC). Starting with BitVisor 3.0, AArch64 (ARM) is also supported.