Xen Summit 2026

Xen Summit 2026

arrow_back View All Dates

9:00am PDT

Robots Among Us: a Least-Privilege Xen Architecture for Safe Humanoid Robots

Wednesday September 16, 2026 9:00am - 9:30am PDT

HEADS office - Gold Room

Humanoid robots are poised to become one of the defining technologies of the next decade, with explosive growth projected across applications from hazardous industrial work to elderly care. They are also emerging as a promising new frontier for embedded virtualization. A single robot must fuse safety-critical motion control, real-time sensor processing, and rich AI workloads onto one heterogeneous platform. Real-time is critical: a humanoid robot that misses a deadline can fall, or injure someone. Safety is also essential; Xen must split responsibilities into separate domains, each granted only the permissions it needs.

This presentation will show how these pieces come together into a virtualization architecture for humanoid robots. It will detail the permissions assigned to each domain, and explain why minimizing privilege is essential to both Safety and Security in a machine that shares physical space with people. We will also discuss how Xen enforces strict isolation and bounded latency across multiple architectures to make the next generation of humanoid robots safe, responsive, and dependable.

Speakers

Stefano Stabellini

Fellow, AMD

Stefano Stabellini is a Fellow at AMD, where he leads system software architecture and the virtualization team. Previously, at Aporeto, he created a virtualization-based security solution for containers and authored several security articles. As Senior Principal Software Engineer... Read More →

Jason Andryuk

AMD, AMD

Senior Member of Technical Staff at AMD working on Xen.

Wednesday September 16, 2026 9:00am - 9:30am PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Embedded / Safety

9:30am PDT

Toward Reproducible OSS Reference Integration: Challenges in Automotive Xen-on-Arm BSP Integration

Wednesday September 16, 2026 9:30am - 10:00am PDT

HEADS office - Gold Room

Automotive SDV systems require multiple domains—IVI, instrument cluster, real-time, and service—to coexist on a single Arm SoC. Combining AGL, Zephyr, and Xen is a promising approach for OSS-based reference integration. The key challenge is turning this virtualized setup into a continuously buildable and reusable foundation.
In this talk, Kurokawa presents ongoing integration work with AGL, Zephyr, and Xen on an automotive Arm platform. He outlines key challenges, including Device Tree configuration, role separation among Dom0, the hardware domain, and driver domains, and VirtIO backend placement. A central question is how SoC-specific hardware should be assigned, shared, or abstracted across domains while maintaining consistency with BSP configurations.
He shares these challenges as practical feedback to the Xen community. Many are common issues as Xen expands into embedded and edge use cases. He discusses approaches in configuration, build, and testing, and provides actionable guidance for building maintainable OSS-based integration platforms.

Speakers

Harunobu Kurokawa

Senior Manager, Renesas Electronics Corporation

He has been involved in automotive Linux development since 2013 and actively contributes to Linux Foundation projects, including Automotive Grade Linux (AGL). At Renesas, a semiconductor company, he leads embedded Linux development and promotes OSS adoption. Since joining the AGL... Read More →

Wednesday September 16, 2026 9:30am - 10:00am PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Embedded / Safety

10:00am PDT

ARINC 653 on Xen: A Unikraft Safety Architecture

Wednesday September 16, 2026 10:00am - 10:30am PDT

HEADS office - Gold Room

This talk presents a safety-critical architecture built entirely on the open-source Xen hypervisor, Linux and Unikraft unikernel(s) as self-contained per-partition runtimes. We cover how this environment is a basis for implementing the ARINC 653 avionics standard, static configuration, and how a control domain pattern provides system management without Dom0 privileges. We discuss real challenges encountered — debug/trace without xl, scheduler extensions for fault tolerance scenarios, and device tree validation at boot — and identify areas where Xen community collaboration would accelerate safety-relevant capabilities.

Speakers

Matthew Weber

Chief Software Architect, The Boeing Company

Matthew Weber is the Chief Software Architect for Boeing Linux, leading certified Linux and hypervisor architectures across Boeing business units. He chairs the ELISA Aerospace Working Group, and sits on the governing boards of both the ELISA Project and the Xen Project. Matt holds... Read More →

Wednesday September 16, 2026 10:00am - 10:30am PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Embedded / Safety

10:30am PDT

Morning Coffee Break

Wednesday September 16, 2026 10:30am - 10:45am PDT

HEADS office - Gold Room

Morning coffee and networking break.

Wednesday September 16, 2026 10:30am - 10:45am PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Break

10:45am PDT

Managing per-guest resources in Xen

Wednesday September 16, 2026 10:45am - 11:15am PDT

HEADS office - Gold Room

The Xen hypervisor needs to manage several resources for each guest, each of those requiring the hypervisor to allocate memory for this task. In order to limit the amount of memory needed, most resources are limited, e.g. via guest configuration.
There is an alternative approach: instead of limiting each resource individually, manage all resources via a common resource management, allowing more flexibility for the guests.
This presentation is a followup of a related design session at the Xen summit 2022.

Speakers

Juergen Gross

Wednesday September 16, 2026 10:45am - 11:15am PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Cloud / Infrastructure

11:15am PDT

Secure Inter-Domain Communication: Implementing VSOCK over Xen Argo

Wednesday September 16, 2026 11:15am - 11:45am PDT

HEADS office - Gold Room

Xen Argo provides a robust mechanism for inter-domain communication, offering strong isolation compared to traditional shared memory approaches. However, its message-based API creates a portability barrier for standard POSIX applications. In this session, I will present the realization of a new Linux kernel module that solves this challenge by implementing a complete VSOCK transport layer over Xen Argo. By exposing Argo through the standard AF_VSOCK interface, we enable existing socket-based applications to run over Argo channels, supporting both datagrams and reliable data streams (SOCK_STREAM) without code modification.
Building upon initial designs, we will dive deep into the kernel-level challenges to achieve a fully functional TCP-like stream over Argo's asynchronous rings. Key technical topics include:

Realizing the Connection-Oriented Handshake: Mapping the POSIX TCP state machine (SYN/SYN-ACK) onto Argo, including dynamic ring allocation with asymmetric hypervisor permissions to enable bidirectional traffic.

Socket multiplexing: allowing concurrent logical connections over a single ring, bypassing the strict 1:1 port-to-ring limitation.

Speakers

Matei Stănuca

Student at Computer Science, Politehnica University Bucharest

I am a student at Politehnica University Bucharest and I’ve been working for XEN for almost a year now. I am very passionate about kernel development and eager to understand everything about how computers work.

Wednesday September 16, 2026 11:15am - 11:45am PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Cloud / Infrastructure

11:45am PDT

Improving Xen Traceability: More Than Just Livepatching

Wednesday September 16, 2026 11:45am - 12:15pm PDT

HEADS office - Gold Room

The Xen livepatch framework provides a way to redirect calls to functions at runtime. It is useful when a running system needs to be updated without being stopped, for example to apply security fixes.

This session explores the possibility of extending this mechanism into a more tracing/debugging-friendly feature. Such an extension could allow more flexible use of existing Xen tracing tools such as xentrace. We will showcase this idea by sharing our recent experience using xentrace, and discuss how a callback-based extension could make similar investigations easier in general.

We would also like to discuss possible future extensions inspired by Linux tracing mechanisms such as kprobes/ftrace/eBPF which could make the feature more useful in practice.

Speakers

Ryo Takakura

Kernel Engineer, VA Linux Systems Japan

Linux kernel enthusiast with a recent focus on Xen and a growing interest in hypervisor technologies.

Wednesday September 16, 2026 11:45am - 12:15pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Cloud / Infrastructure

12:15pm PDT

Compiler assisted Xen code elimination

Wednesday September 16, 2026 12:15pm - 12:45pm PDT

HEADS office - Gold Room

Xen makes use of various techniques to conditionally remove code from the final binary. From Kconfig, to preprocessor tricks and DCE. This session explains a number of exotic key techniques used at AMD to drastically reduce code footprint with minimal changes to the source code. It highlights the set of constraints and requirements behind the new techniques and specific examples where they apply, with metrics showing the gains.

Speakers

Alejandro García Vallejo

Wednesday September 16, 2026 12:15pm - 12:45pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Cloud / Infrastructure

12:45pm PDT

Lunch Break

Wednesday September 16, 2026 12:45pm - 1:45pm PDT

HEADS office - Gold Room

Lunch and networking break.

Wednesday September 16, 2026 12:45pm - 1:45pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Break

1:45pm PDT

Xen Functional Safety Certification (an update)

Wednesday September 16, 2026 1:45pm - 2:15pm PDT

HEADS office - Gold Room

As AMD advances efforts to safety-certify the upstream Xen hypervisor, this presentation provides an update on the past year's progress and roadmap. Xen, a type-1 hypervisor with a self-contained codebase, continues to gain traction in automotive and industrial applications due to its robust isolation, security, and virtualization capabilities.

A central theme this year is reducing the certifiable code footprint through changes we intend to upstream in the near future. We apply several dead-code-elimination techniques, such as gating management hypercalls (`MGMT_HYPERCALLS`), adding AMD restricted-feature configurations (`AMD_RESTRICTED_*`), and enabling linker garbage collection of unused sections.

Alongside the code, we have formalized Xen's domain-facing behavior into requirements and architecture specification, both of which we plan to upstream as a shared, verifiable baseline for the community.

On verification, we will share tests spanning domain-based tests, a self-test framework, GDB fault-injection test framework, and QEMU qtest-based cases. Finally, we present the current structural coverage on Arm64 and x86_64, along with our roadmap to close the remaining gaps.

Speakers

Penny Zheng

Staff Software Engineer, AMD

Penny Zheng is s staff software engineer on AMD, focusing on virtualization on automotive scenario, especially for GPU virtualization.

Ayan Kumar Halder

Wednesday September 16, 2026 1:45pm - 2:15pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Embedded / Safety

2:15pm PDT

Flight-Grade Xen: DO-178C Reverse Engineering for an example in list.h

Wednesday September 16, 2026 2:15pm - 2:45pm PDT

HEADS office - Gold Room

What does the term “Low Level Requirement” (LLR) mean to Xen? This talk provides an update to the ongoing work of Xen’s Functional Safety Working Group in the form of a worked case study for a challenging example: list.h We will show

1) When we should use a technique called “requirements mapping” (to reuse requirements rather than invent them ourselves)
2) How to test the preprocessor macros and occasional static inline functions in our list.h example to satisfy the DO-178C’s LLR-to-verification “trace data” obligations
3) How to produce a subject matter expert (SME) to review list.h LLRs (i.e., for “necessary and complete LLR”), via a training course about its RCU algorithm and the requirements behind that algorithm.

We hope to engage the broader Xen community’s SMEs by focusing not on “FuSa” specifically, but more broadly on “How does Xen really work?”

Speakers

Mark Brown

Parry Labs, Parry Labs

Mark Brown is the Director of Safety Critical Systems at Parry Labs. Parry Labs develops multiple types of soft-updatable modularity for vehicles and avionics, in order to promote a Modular Open Systems Approach (MOSA). Mark has worked with a range of operating systems, type-1 hypervisors... Read More →

Wednesday September 16, 2026 2:15pm - 2:45pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Embedded / Safety

2:45pm PDT

Safety Cases as Data: The SPDX Functional Safety Profile and Lessons from Zephyr

Wednesday September 16, 2026 2:45pm - 3:15pm PDT

HEADS office - Gold Room

Xen and Zephyr are walking parallel paths toward functional safety within the Linux Foundation, and both face the same problem: a safety case is a large, manually maintained argument that drifts the moment the design changes, and is hard to exchange between the projects, suppliers, and integrators who depend on it. This talk shares where Zephyr has gotten with a data-driven approach, and opens a conversation about what it could mean for Xen.
We start with SPDX 3.1's Functional Safety profile, which gives the safety case a machine-readable form: requirements and their refinement, verification activities, pass/fail evaluations, evidence, and assumptions of use, expressed as a graph that tools can produce, exchange, and check. We then show how Zephyr leverages it in practice—generating a "safety SBOM" from project content rather than assembling a safety case by hand, recomputing verdicts as code evolves, and detecting which evidence has gone stale.

Speakers

Nicole Pappler

Senior Safety Expert, AlektoMetis.com

Nicole has worked in different projects developing safety relevant embedded software before starting as an independent assessor.
With now more than twenty years of experience in the industry, she supported several customers to show their compliance with safety, security and quality standards. Currently she is utilizing her experience regarding the development of highly reliable software to enable open source... Read More →

Wednesday September 16, 2026 2:45pm - 3:15pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Embedded / Safety

3:15pm PDT

Formal Methods for Xen's Safety and Security

Wednesday September 16, 2026 3:15pm - 3:45pm PDT

HEADS office - Gold Room

We will explore how different formal methods like model checking and theorem proving can be used to certify the correctness of Xen's working. We will also discuss the different benefits of a verified kernel, especially for embedded systems, and the various certifications.

Speakers

Thomas Courrege

Student Researcher

Student at EPITA, a French engineering school, specializing in security, networks, and industrial systems, with a particular interest in formal methods and kernel verification.

Wednesday September 16, 2026 3:15pm - 3:45pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Embedded / Safety

3:45pm PDT

Afternoon Coffee Break

Wednesday September 16, 2026 3:45pm - 4:00pm PDT

HEADS office - Gold Room

Afternoon coffee and networking break.

Wednesday September 16, 2026 3:45pm - 4:00pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Break

4:00pm PDT

Display Para-Virtualization

Wednesday September 16, 2026 4:00pm - 4:30pm PDT

HEADS office - Gold Room

In recent years, GPU para-virtualization on Xen has evolved to support increasingly complex automotive workloads. While prior work focused on graphics and compute virtualization, display para-virtualization introduces new challenges due to its interaction with hardware composition pipelines and real-time requirements. In this session, Ray presents his team’s latest work on display para-virtualization, focusing on Multi-Plane Overlay (MPO) virtualization and the Virtual Primary Plane (vPP). These mechanisms extend the VirtIO GPU model to enable guest VMs to utilize host display hardware. He explains how MPO virtualization exposes multiple display planes to guest VMs, allowing composition to be offloaded to hardware. The vPP abstraction provides a stable primary display surface, decoupling guest behavior from host specifics. He also discusses GPU recovery integration and outlines validation approaches and future directions.

Speakers

Ray Huang

Principal Software Engineer, AMD

Ray Huang (Huang Rui) is a kernel developer and leads AMD Linux platform solution team that works on AMD CPU, APU, and GPU enabling. He works on multiple components in the Linux kernel including GPU kernel DRM graphic and CPU power management support. Recently, he and his team focus... Read More →

Wednesday September 16, 2026 4:00pm - 4:30pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Embedded / Safety

4:30pm PDT

Preparing Xen on Arm for VHE-Always Hardware

Wednesday September 16, 2026 4:30pm - 5:00pm PDT

HEADS office - Gold Room

Future Arm CPUs are evolving toward systems where Virtualization Host Extensions (VHEs) are always enabled. This talk shows how Xen can adapt to the next generation of Arm hardware while continuing to support today’s programmable-VHE and non-VHE systems.
We will walk through the engineering work required to make Xen bootable, and upstreamable on VHE-always platforms. The challenge goes far beyond early boot. We’ll cover VHE changes assumptions around EL2 bring-up, system-register access, MMU setup, exception and trap routing, timers, interrupts, and host/guest world switching.
Attendees will learn how Xen detects and selects VHE policy during boot and secondary CPU bring-up; how vhe=on/off/auto supports different platform capabilities; and how EL1/EL2 system-register abstractions help reduce fragile VHE-specific conditionals. We will also cover the areas most likely to expose hidden assumptions, including MMU state, timer delivery, GICv2/GICv3 virtualization, and VHE-sensitive save/restore paths.
Finally, we will discuss the path from an initial homogeneous Dom0-boot prototype with basic timer and interrupt support to product-quality SMP, testing, and platform validation.

Speakers

Luca Fancellu

Engineer, Arm

Luca Fancellu is a Staff software engineer in the Software group at Arm, working on the Xen Hypervisor from few years. Luca has experience in safety-critical and embedded software from the Automotive area, you will probably find most of the products he worked on running on wheels... Read More →

Michael Peter

Principal Engineer

Years of experience in virtualization and microkernel technologies.

Wednesday September 16, 2026 4:30pm - 5:00pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Cloud / Infrastructure

5:00pm PDT

Xen on RISC-V: From Dom0less to xl

Wednesday September 16, 2026 5:00pm - 5:30pm PDT

HEADS office - Gold Room

The RISC-V port of the Xen hypervisor has been progressing over the past year. This session gives a practical status update on where the port stands today, covering the two main use cases: dom0less deployments for embedded and safety-critical workloads, and dom0 with the xl toolstack for more traditional virtualization scenarios.

We will walk through what works, what is still in progress, and what the remaining gaps are with a live demo to show the port running.

Speakers

Oleksii Kurochko

Software Engineer, Vates

Oleksii Kurochko is a Systems Engineer at Vates, the company behind XCP-ng and Xen Orchestra. He specializes in virtualization, systems programming, and open-source technologies, with experience spanning low-level software development, infrastructure, and reverse engineering. An active... Read More →

Baptiste Le Duc

Hypervisor and Kernel Engineer, Vates

Baptiste joined Vates as an intern of the Hypervisor & Kernel team, where he focused on enabling guest domain creation support via the xl toolstack from dom0 on RISC-V.

He is now a full-time engineer at Vates and continues to contribute to the Xen RISC-V port alongside Oleksii, working toward full dom0 and dom0less support upstream... Read More →

Wednesday September 16, 2026 5:00pm - 5:30pm PDT
HEADS office - Gold Room Einsteinring 30, 85609 Aschheim, Germany

Cloud / Infrastructure

6:00pm PDT

Xen Project Social Dinner

Wednesday September 16, 2026 6:00pm - 10:00pm PDT

Social Dinner - TBD

Wednesday September 16, 2026 6:00pm - 10:00pm PDT
Social Dinner - TBD

Social