Hardening Hypervisors with Ombro

This paper presents Ombro, a low-level virtual instruction set architecture (vISA) which enforces compiler-based security policies on real-world commodity hypervisors. We extend the Secure Virtual Architecture (which itself extends the LLVM compiler's Intermediate Representation) to support the full set of hardware operations needed to run an x86 commodity hypervisor used in some of the world's largest public clouds, namely, the Xen 4.12 hypervisor, running in full hardware-accelerated mode using Intel's Virtual Machine Extensions (VMX). We have ported Xen 4.12 to the Ombro vISA and demonstrated that it can run unmodified guest VMs of real-world relevance (namely, Linux guests under Xen's HVM and PVH modes). Furthermore, to demonstrate Ombro's ability to harden hypervisors from attack, Ombro implements control flow integrity and the first protected shadow (split) stack for x86 hypervisors. Our performance results show that Ombro achieves this protection without imposing measurable overheads on most application benchmarks.