Hacker News Reader

Hacker News

Comment by walterbell | Hacker News Reader

Full thread

walterbell

In addition to a new VMM, why not enable OpenBSD to run as a guest VM on AWS/Xen?

View on HN

Ravello claims to do that:

https://www.ravellosystems.com/blog/legacy-freedom-choose-ru...

Haven't used them: just found them looking for OpenBSD on AWS.

Indeed. Why not?

This March 2015 post lists some known work items, http://www.joelroberts.org/openbsd/

  - Kernel hangs when bringing online additional cpus--no working SMP
  - PV drivers for net and disk needed. Probably easy to take from NetBSD
  - System needs testing for stability

An old (2012?) comparison of 4 BSDs on Xen and KVM: https://gmplib.org/~tege/virt.html

I believe that Xen SMP hang was fixed in 5.8:

http://comments.gmane.org/gmane.os.openbsd.cvs/143877

From the link above comparing BSDs on Xen:

"OpenBSD probably works poorly by design, since its lead developer despises virtualisation."

I have seen this before. Can someone summarise the reasons why Theo de Raadt hates virtualisation?

Basically he thinks any hypervisor that isn't OpenBSD is not secure.

"x86 virtualization is about basically placing another nearly full kernel, full of new bugs, on top of a nasty x86 architecture which barely has correct page protection. Then running your operating system on the other side of this brand new pile of shit." http://marc.info/?l=openbsd-misc&m=119318909016582

(I see justinsaccount already posted this below.)

That's quite true, except that even OpenBSD is not _necessarily_ secure as a hypervisor.

The mailing list post discusses the use of virtio for drivers.

That gets you a lot of the way to KVM support.

OpenBSD has had VirtIO (supported by KVM, VMWare and now virtualbox too) guest support for a while now.

AWS uses Xen and domU support is a lot more invasive - OpenBSD had supported it in the past but I believe it was dropped?

Well PV domU support is more invasive, but HVM is not (it is just like kvm), and Amazon supports both. The middle ground is the pvhvm mode which requires some Xen drivers for additional support, rather than the virtio drivers that kvm/bhyve use - Xen has a different driver model.

Reply on news.ycombinator.com