microhypervisor

Microhypervisor is a type of virtualization layer that is deliberately small in size and scope, intended to minimize the trusted computing base and surface for security. It runs either directly on hardware (bare-metal) or atop a microkernel, and provides the essential services needed to execute multiple virtual machines in isolation. Its primary responsibilities include CPU scheduling, memory isolation, and mediation of access to I/O devices and other hardware resources.

Compared with monolithic or traditional Type-1 hypervisors, a microhypervisor keeps most control logic outside the hypervisor, either in the guest VMs or in separate components in user space, reducing the code base that runs with high privilege. It typically relies on hardware virtualization extensions for performance and on the microkernel's isolation primitives for protection.

Common features include a small, auditable code base; modular driver arrangements that may use separate domains or driver domains; IOMMU-based device virtualization; and support for lifecycle management of VMs, including boot, pause, resume, and migration in some designs. Many microhypervisor implementations emphasize formal verification or rigorous testing to improve security guarantees.

Use cases include security-sensitive systems, embedded and automotive platforms, and research environments where a small, verifiable TCB is desirable. In practice, microhypervisors are often part of a larger virtualization stack that uses microkernel-based systems such as seL4 or L4-derived platforms, and may coexist with guest operating systems that run in their own protected VMs.