IMO, the premise that hypervisors can have a smaller (thus more assurance-friendly) attack surface relative to a monolithic or microkernel-based operating syste

IMO, the premise that hypervisors can have a smaller (thus more assurance-friendly) attack surface relative to a monolithic or microkernel-based operating system is not challenged by any attack against xen. Xen has a very feature-rich interface as far as hypervisors go (hello grant tables!). The interface to the hypervisor on x86_64 can be small while still being performant and functional (EPT and posted interrupts are very nice). That said, I work for a company that sells a hypervisor built on the idea that hypervisors need not be complex to solve real problems. We look at hypercalls that include data structures (even ones as simple as C strings) with great skepticism.