Hacker News Reader

Comment by Thaxll | Hacker News Reader

I forgot about Xen, is it still popular I thought everything moved to KVM in the last 10years?

Xen and KVM are different beasts.

Xen can implement things like a CPU scheduler exclusively focused on VMs, while KVM has to deal with the normal Linux scheduler for processes.

Xen can do advanced defense-in-depth techniques like driver domains -- something impossible to implement on KVM.

Xen has a mature security response process; if you're a cloud provider, or ship anything with Xen inside of it, you can be notified of security issues typically two weeks before the public disclosure; and we're quite thorough about what we issue security alerts for. For KVM, you just have to hope that your functionality is worth issuing a CVE about, and unless you're a distro, you're only going to be told after it's been made public.

Xen is a microkernel, so you can run it on tiny embedded devices for which Linux / KVM would be too big. Xen is small enough that it's actually feasible to do Functional Safety Certification on it.

That's why Xen is still used by QubesOS, the NSA, and various defense contractors; why a number of cloud providers (including say, Ghandi.net) use Xen; why Xilinx has their own Xen distribution; and why Xen is in the reference implementation for ARM's automotive stack -- in addition to being officially supported by SUSE, and being the driving engine behind Citrix Hypervisor and XCP-ng.

Not really. VMware vSphere and KVM based virtualisations are by far the most popular. Xen's last holdout was AWS' custom version of it, but that has been replaced since a few generations ago with the KVM-based Nitro.

So it's basically a niche thing, mostly used by those who already had it/know it (VMware vSphere is going down that road as well, it's basically legacy today).

"The reports of my death are greatly exaggerated"

Regards,

Xen.

It must be Delphi's brother then: not quite dead, but calling them alive too would be a stretch. What a wonderful world full of undead technologies we live in.

QubesOS uses Xen

Yes it's still popular in some places, and lots of new development is going on. Xen is superior to KVM in my opinion.

I'd actually _like_ to use Xen, but as far as I can see is just dead in all but name.

To name one example, nested virtualization support is not only hopelessly broken, it's MORE broken in recent releases than it was a decade ago. You can see right here how the feature kept getting broken by every other release until nothing worked anymore: https://wiki.xenproject.org/wiki/Nested_Virtualization_in_Xe....

And Xen is literally the only virtualizer out there that does not support nested virtualization, which is a rather critical feature since many (dev) stacks assume one has hardware virtualization, and Windows is going to require it sooner than later.

If nested virtualization isn't used by their main customers I'm not sure it's that critical to them

Xen Project is far being dead (there's a lot of activity in the mailing list, and now, thanks to new contributors like Vates/XCP-ng, there's also more initiatives to have a decent project tracking, see https://gitlab.com/groups/xen-project/-/epics?state=opened&p... for example).

Regarding nested virt, you are mostly right: it's only "working-ish" for basic things, but indeed, it's broken when you start to use anything heavy in your nested VM. The main reason nobody fixed it is because it's not really used: as any other open source project, you find what you need if you contribute. Obviously, as soon someone will need this and willing to contribute, it will change :)

Spin up an EC2 node recently?

I was under the impression that Amazon has a custom, proprietary hypervisor these days that's simply compatible with Xen's hypervisor<->guest interfaces.

The Xen project members list suggests otherwise: https://xenproject.org/about-us/project-members/

Even if it is a custom hypervisor, AWS likely derived it from Xen and sponsors the project to continue doing so.

It's not a custom Xen: it's *is* Xen (AFAIK, with possibly their own patch queue for some specific needs on top of it). What's custom is the toolstack around it :)

nitro is KVM based

Yeah that's what I thought, but I couldn't find definitive proof besides old posts from the early days.

Since 2017, all new aws instance types have been "nitro", which is based on kvm https://www.brendangregg.com/blog/2017-11-29/aws-ec2-virtual...

AWS does continue to support older instance types, however, but only legacy workloads are using them. They actually now even run the XEN based legacy instance types on nitro. https://perspectives.mvdirona.com/2021/11/xen-on-nitro-aws-n...

These days Amazon emulates the Xen hypercall interface on top of KVM. It's pretty much their sole substantial contribution to upstream KVM (by David Woodhouse that's mentioned elsewhere in the comments in fact).

The implementation is split between KVM and their proprietary equivalent of QEMU.

We should remember to credit Oracle for starting the Xen-on-KVM work. I did start from their old patch set, even if what got merged was significantly different in the end.

I do still want to flesh out the Xen guest support in Rust-VMM at some point.

Reply on news.ycombinator.com