Cloud Parts

Xen Project hypervisor

The open-source type-1 hypervisor from Cambridge that ran the first Amazon EC2 instances: a small microkernel-style core that boots first, with drivers and management in a privileged VM called dom0.

What it is
Hypervisors
Used for
Virtual machines
Type
Open source
Made by
Xen Project (Linux Foundation), started at the University of Cambridge
License
GPL-2.0 (version 2 only)
Facts checked
11 October 2026
Website Source code

What it is

Xen boots straight from the bootloader and handles only CPU, memory, timers and interrupts. It is about 1 MB, under 300,000 lines of code on x86 and under 65,000 on Arm, and knows nothing about disks or networks. Those live in domain 0 (dom0), the first VM started, usually a Linux kernel: it holds the real device drivers, the backend half of every virtual disk and network card, the XenStore configuration database and the toolstack. Ordinary guests are unprivileged domains (domU) with no direct access to hardware. A guest’s frontend driver talks to its backend in dom0 over shared-memory rings, and drivers can also move into separate driver domains so that a crashed driver doesn’t take the host down.

On x86 a guest runs in one of three modes, set with type= in its config file. PV (paravirtualized) guests run a Xen-aware kernel and need no hardware virtualization support. HVM guests use Intel VT or AMD-V and a QEMU device model, normally in dom0, that emulates a PC (BIOS, IDE, VGA, USB, network card), so unmodified Windows runs; they switch to PV drivers when the guest has them. PVH guests use the hardware extensions but no QEMU, with PV drivers for I/O; it is the default on Arm, where there is a single mode. The default toolstack is xl, a command-line tool built on the libxl (libxenlight) library, which reads one config file per guest. libvirt and XAPI are the main alternatives. XAPI is the stack behind XenServer and XCP-ng, the two full platforms built on Xen. Citrix agreed to buy XenSource in 2007 and sold XenServer, later renamed Citrix Hypervisor. After Cloud Software Group took over Citrix it was relaunched as XenServer 8 in March 2024, and in 2026 it moved back under the Citrix brand with XenServer 9 (on Xen 4.21). XCP-ng is a community-driven fork of XenServer started by Olivier Lambert.

Xen 4.22, tagged in July 2026, is the latest release. New versions arrive roughly every 6 to 9 months (4.20 in March 2025, 4.21 in November 2025), and from 4.20 on each gets three years of full support plus two years of security fixes. Much current work targets Arm, embedded and automotive systems: “dom0less” boots several guests straight from a device tree, in parallel, with no control domain at all, and the project is working toward functional safety certification with MISRA C checks in CI and an Armv8-R port for chips without an MMU. Amazon EC2 ran on Xen from its first instances until AWS moved new instance types to its KVM-based Nitro hypervisor in 2017. Since 2022 AWS has also run older instance types on Nitro hardware, and an engineer on Amazon’s EC2 Nitro team has described emulating Xen in KVM and QEMU for customer VMs that “still think they’re running under real Xen”.

Why teams pick it

  • A small hypervisor with the drivers outside it: device drivers live in dom0 or driver domains, and an HVM guest’s QEMU can run in its own stub domain rather than in dom0
  • Runs where a full Linux host doesn’t fit: Arm boards, automotive and real-time systems, with dom0less static partitioning, cache coloring and work toward safety certification
  • Long, predictable maintenance: from 4.20, five years of security support for every release, without separate LTS branches
  • Long production history and broad guest support: it ran the first EC2 instances, powers XenServer and XCP-ng, and Linux and the BSDs ship Xen PV drivers upstream

Watch out for

  • Nothing works without dom0: it is a full OS with the drivers, backends, toolstack and (for HVM) QEMU, so it is a large trusted component you must patch and size
  • Less mainstream than KVM on Linux servers: RHEL stopped including the hypervisor after RHEL 5, and AWS moved new EC2 instance types to its KVM-based Nitro hypervisor in 2017
  • Many moving parts to choose between: three x86 guest modes, several toolstacks, and with xl you set up host networking (such as a xenbr0 bridge) yourself and have no image import or export
  • RISC-V and PowerPC ports are still early: the 4.22 notes say RISC-V guest virtualization isn’t production-ready yet

Alternatives

What all hypervisors have in common →
Cloud HypervisorOpen sourceA Rust virtual machine monitor for modern cloud VMs on KVM or Microsoft’s hypervisor: virtio devices only, plus hotplug, VFIO passthrough, live migration, snapshots and Windows guests.KVM (Kernel-based Virtual Machine)Open sourceThe hypervisor built into the Linux kernel: it runs guest code directly on the CPU through `/dev/kvm`, and leaves device emulation to a user-space program such as QEMU or Firecracker.libvirtOpen sourceA stable API, daemon and `virsh` command line for managing virtual machines, storage and networks, with drivers for QEMU/KVM, Xen, LXC, Cloud Hypervisor, VMware ESX, Hyper-V and more.Microsoft Hyper-VCommercialMicrosoft’s type-1 hypervisor, built into Windows Server and Windows 10 and 11 Pro and Enterprise: a thin hypervisor under a Windows root partition, which also underpins Azure’s hypervisor and Windows features like VBS, WSL 2 and Windows Sandbox.Oracle VirtualBoxOpen sourceOracle’s free, open-source desktop hypervisor: a type-2 hypervisor that runs VMs as an application on Windows, macOS, Linux and Solaris, scriptable with `VBoxManage` and the default provider for Vagrant.Proxmox Virtual EnvironmentOpen sourceA Debian-based server platform from Vienna that runs KVM virtual machines and LXC containers, with clustering, high availability, Ceph and ZFS storage, backups and a web interface in one free ISO.QEMUOpen sourceThe open-source machine emulator and virtualizer: it emulates whole computers in software, or runs them at native speed on a hypervisor such as KVM, and supplies the virtual devices either way.VMware ESXiCommercialVMware’s bare-metal hypervisor (called ESX again since VCF 9), whose own kernel runs VMs directly on servers while vCenter adds vMotion, HA, DRS and vSAN; since Broadcom bought VMware in 2023 it is sold only as per-core subscriptions.

How it fits with other technologies

Define a PVH guest and start it with xl, from dom0 (written from the Xen docs, not run here) · bash

# /etc/xen/web1.cfg, adapted from Xen's tools/examples/xlexample.pvhlinux
cat > /etc/xen/web1.cfg <<'EOF'
type   = "pvh"
name   = "web1"
kernel = "/boot/vmlinuz"
extra  = "root=/dev/xvda1"
memory = 1024
vcpus  = 2
vif    = [ 'bridge=xenbr0' ]
disk   = [ '/dev/vg0/web1,raw,xvda,rw' ]
EOF

xl create -c /etc/xen/web1.cfg   # create the domain and attach to its console

# from another shell in dom0
xl list                          # Domain-0 and web1: ID, memory, vCPUs, state, CPU time
xl shutdown -w web1              # ask the guest to shut down, and wait for it

Guest types on x86#

Chosen per guest with type= in the xl config file. On Arm there is one mode, which works like PVH.

ModeNeeds VT-x or AMD-VDevice emulationGuest kernelTypical use
PVNoNone: PV drivers onlyMust be Xen-aware (Linux since 2.6.24, NetBSD, FreeBSD)Old hardware, old images, unikernels, Xen inside another VM without nested virtualization
HVMYesQEMU emulates a PC (BIOS, IDE, VGA, USB, NIC); PV drivers used when presentAny, including unmodified WindowsGeneral-purpose Linux, Windows and BSD guests
PVHYesNone: no QEMU, PV drivers for I/OMust support PVH (Linux 4.11 or later)Lightweight modern Linux guests; the default on Arm
  • type= replaced the older builder= option in Xen 4.10.

See it in a real stack

No architecture uses Xen Project hypervisor yet. Drop it into the playground and wire it up yourself.Open playground →
Where it came from2003–2026

In the early 2000s a team at the University of Cambridge Computer Laboratory wanted to host other people’s operating systems on shared servers at ISPs and Internet exchanges: the XenoServer project, where mutually untrusting users would pay for the VMs they ran. That needed a virtual machine monitor with strong isolation and low overhead, and x86 made that hard: some privileged instructions failed silently instead of trapping, so VMware had to rewrite guest code on the fly. Paul Barham, Boris Dragovic, Keir Fraser, Steven Hand, Tim Harris, Alex Ho, Rolf Neugebauer, Ian Pratt and Andrew Warfield described their answer at SOSP in October 2003 in “Xen and the Art of Virtualization”. Xen showed the guest an idealized machine that operating systems were ported to, aimed at about 100 VMs per server, and cost at most a few percent of performance.

The founders of XenSource came out of that Cambridge work, and Citrix agreed to buy the company in August 2007 for about $500 million. Xen also became the hypervisor of the first Amazon EC2 instances, launched in 2006. On April 15, 2013 Xen moved to the Linux Foundation as a Collaborative Project, with twelve founding members including Amazon Web Services, AMD, Citrix, Google, Intel and Oracle.

Once Intel and AMD added hardware virtualization to their CPUs (2005–2006), HVM guests became generally faster than PV ones, and Red Hat stopped including the Xen hypervisor after RHEL 5. AWS launched its KVM-based Nitro hypervisor with the C5 instances in 2017, and from 2022 began running older Xen instance types on Nitro hardware. Xen’s growth has moved toward Arm, embedded and automotive systems, with dom0less, safety-certification work and five-year security support from Xen 4.20.

Why it’s built this way

Paravirtualization instead of faithful hardware emulation
x86 wasn’t built to be virtualized, and emulating it exactly was slow and complex. Changing the guest kernel, but not the application ABI, made Xen fast on 2003 hardware, and the PV interfaces later came back as the drivers that HVM and PVH guests use.
Keep policy out of the hypervisor
The paper’s goal was to separate policy from mechanism: Xen does scheduling, memory and access checks, and a privileged Domain0 runs the management software that decides what to create and how to share resources. That kept the hypervisor small, and it is why a Xen host still needs dom0.
Simple virtual devices over shared-memory rings, with the drivers in a VM
Instead of emulating real network cards and disks, Xen gave guests clean device abstractions and moved data through asynchronous rings and event channels. Real drivers stayed in dom0 (or driver domains), so the hypervisor never needed them.
PVH: hardware virtualization without QEMU
HVM needed a QEMU device model per guest, and PV needed a heavily modified guest kernel. The project wanted the best of both and a simpler interface to the OS: PVH (fully supported since Xen 4.10) uses the hardware extensions for memory and privileged instructions and PV drivers for I/O, the same model Xen already used on Arm.

Timeline

  1. 2003

    “Xen and the Art of Virtualization” presented at SOSP by the Cambridge team

  2. 2006

    Amazon EC2 launches, its first instances running as Xen PV guests

  3. 2007

    Citrix agrees to buy XenSource for about $500 million (August 15)

  4. 2013

    Xen becomes a Linux Foundation Collaborative Project (April 15)

  5. 2017

    AWS introduces Nitro, a KVM-based hypervisor, for new EC2 instance types

  6. 2022

    AWS starts running older Xen-era EC2 instance types on Nitro hardware

  7. 2026

    Xen 4.22 released; releases from 4.20 on get five years of security support

Sources17 · facts checked 11 October 2026

Improve this page on GitHub