Hardening Hypervisors with Ombro
summary
Ombro implements a compiler-targeted virtual ISA (extending SVA/LLVM IR) and ports Xen 4.12 to run under Intel VMX, enforcing CFI plus a first protected shadow (split) stack for x86 hypervisors. It uses software fault isolation to make control-stack pages tamper‑proof, supports unmodified Linux HVM/PVH guests, and reports near-zero end-to-end overhead on most benchmarks while exposing 12–22% slowdowns on sync‑heavy workloads (memcached) due to extra VM entry/exit work.
AI-written summary · about
chapters (13)
- 0:00Intro
- 1:07Security in Hypervisors
- 1:42Low-Level Security Is Hard
- 3:09Strong CFI for Hypervisors
- 4:57Virtual Instruction Set Computing (VISC)
- 6:14Secure Virtual Architecture
- 7:39Hardware Virtualization Challenges
- 9:49Protecting Memory from the Hypervisor
- 12:05Shadow Stack Design
- 14:22Performance Evaluation - Experimental Setup
- 15:58Performance: Phoronix macrobenchmarks
- 17:41Performance: Microbenchmarks
- 21:37Summary
related talks
40mUpcoming x86 Technologies for Malicious Hypervisor Protection
18mZVM: Zephyr-based Virtual Machine
25mHigh Performance VM Introspection
30mHA-IOV: Applying Hardware-assisted Techniques to IO Virtualization Framework
19mSecuring the Hypervisor with Control-Flow Integrity
41mSecuring Your Xen-Based Cloud
38mKernel Hardening: Protecting the Protection Mechanisms
23mHyper-V's Virtual Secure Mode in KVM project update