Software
BitVisor Hypervisor
BitVisor is a Type-1 hypervisor that runs on x86_64 (Intel VT-x / AMD-V) and AArch64 (since v3.0). It operates transparently beneath an unmodified guest OS, supporting Windows and Linux as guest operating systems.
Source code is available on SourceForge. You can also browse the source code online via GNU global.
Architecture
BitVisor employs a parapass-through architecture. Most I/O accesses from the guest OS pass directly through to hardware, while only security-critical I/O is intercepted and mediated by the hypervisor. Because it reuses the guest OS’s own device drivers, BitVisor requires no large device emulation layer, keeping the TCB (Trusted Computing Base) as small as possible.
BitVisor is a single-VM design and does not support running multiple VMs simultaneously. This eliminates the need for inter-VM resource management, further reducing code size and complexity.
Components
Core
- CPU virtualization via Intel VT-x / AMD-V
- I/O virtualization and DMA protection via Intel VT-d / AMD-Vi (IOMMU)
- UEFI 64-bit bootloader (
loadvmm.efi) - Protection domain function: memory isolation between the hypervisor core and security modules
- Kconfig-based build configuration (
make config)
Storage Drivers
| Driver | Description |
|---|---|
| ATA / ATAPI | IDE interface; the original target for storage encryption |
| AHCI | SATA host controller support; added in v1.1 |
| NVMe | I/O filtering for NVMe SSDs |
Network Drivers
| Driver | Description |
|---|---|
| Intel PRO/1000 (e1000) | Supports many Intel GbE NICs including I210, I217-V, I350, etc. |
| Realtek RTL816x | Realtek NIC support (experimental) |
| virtio-net | Virtual NIC support |
| AQC107 | Aquantia 10GbE NIC support |
BitVisor includes the lwIP TCP/IP stack for its internal network layer.
USB
- USB device filtering and control via UHCI / EHCI drivers
VPN and Encrypted Communication
| Feature | Description |
|---|---|
| IPsec VPN | IPsec client module contributed by NICT (main mode supported) |
| WireGuard | Modern, lightweight VPN protocol; added around v3.0 |
| Mbed-TLS | Embedded TLS/SSL library (Long Term Support version) |
Security Features
- Storage Encryption: Transparent disk encryption at the ATA / AHCI / NVMe level
- Device Filtering: Access control for USB and network devices
- DMA Protection: Prevention of unauthorized DMA access using IOMMU
- PCI Device Concealment: Hide specified PCI devices from the guest OS
Download
See the Download page for the latest release (v3.0).
For build instructions, see Getting Started.