RFC: Enabling VIMAGE in GENERIC

[Warner Losh]

On Nov 17, 2014, at 12:46 AM, Craig Rodrigues <rodrigc at FreeBSD.org> wrote:

> Hi,
> 
> PROPOSAL
> ==========
> I would like to get feedback on the following proposal.
> In the head branch (CURRENT), I would like to enable
> VIMAGE with this commit:
> 
> 
> PATCH
> ======
> 
> Index: sys/conf/NOTES
> ===================================================================
> --- sys/conf/NOTES      (revision 274300)
> +++ sys/conf/NOTES      (working copy)
> @@ -784,8 +784,8 @@
> device         mn      # Munich32x/Falc54 Nx64kbit/sec cards.
> 
> # Network stack virtualization.
> -#options       VIMAGE
> -#options       VNET_DEBUG      # debug for VIMAGE
> +options        VIMAGE
> +options        VNET_DEBUG      # debug for VIMAGE
> 
> #
> # Network interfaces:
> 
> 
> 
> I would like to enable VIMAGE for the following reasons:
> 
> REASONS
> ========
> 
> (1)  VIMAGE cannot be enabled off to the side in a separate library or
>       kernel module.  When enabled, it is a kernel ABI incompatible change.
>       This has impact on 3rd party code such as the kernel modules
>       which come with VirtualBox.
>       So the time to do it in CURRENT is now, otherwise we can't consider
>       doing it until FreeBSD-12 timeframe, which is quite a while away.
> 
> (2)  VIMAGE is used in some  3rd party products, such as FreeNAS.
>       These 3rd party products are mostly happy with VIMAGE,
>       but sometimes they encounter problems, and FreeBSD doesn't
>       see these problems because it is disabled by default.
> 
> (3)  Most of the major subsystems like ipfw and pf have been fixed for
> VIMAGE, and the only
>       way to shake out the last few issues is to make it the default and
>       get feedback from the community.  ipfilter still needs to be
> VIMAGE-ified.
> 
> 
> (4)  Not everyone uses bhyve.  FreeBSD jails are an excellent virtualization
>       platform for FreeBSD.  Jails are still very popular and
>       performant.  VIMAGE makes jails even better by allowing per-jail
>       network stacks.
> 
> (5)  Olivier Cochard-Labbe has provided good network performance results
>       in VIMAGE vs. non-VIMAGE kernels:
> 
> 
> https://lists.freebsd.org/pipermail/freebsd-net/2014-October/040091.html
> 
> (6)  Certain people like Vitaly "wishmaster" <artemrts at ukr.net> have been
>      running VIMAGE
>      jails in a production environment for quite a while, and would like
> to see it
>      be the default.
> 
> 
> ACTION PLAN
> ===========
> 
> (1)  Coordinate/communicate with portmgr, since this has kernel ABI
> implications
> 
> (2)  Work with clusteradm@, and try to get a test instance of one of the
>       PF firewalls in the cluster working with a VIMAGE enabled kernel.
> 
> (3)   Take a pass through http://wiki.freebsd.org/VIMAGE/TODO
>        and
> https://bugs.freebsd.org/bugzilla/buglist.cgi?quicksearch=vimage%20or%20vnet
>         and try to clean things up.  Get help from net@ developers to do
> this.

And if these don’t get cleaned up?

> (4)   Take a pass on trying to VIMAGE-ify ipfilter.  I'll need help from
>        the ipfilter maintainers for this and some net@ developers.

And if this doesn’t happen?

> (5)   Enable VIMAGE by default in CURRENT on January 5, 2015.
>        This will *not* be enabled in STABLE.
> 
> What do people think?

How do you plan to address the problems seen by FreeNAS in #2 above? I don’t see that in the action plan. Without it, we’re enabling an option that has know, serious issue making 11 potentially a more unstable release.

Warner
-------------- next part --------------
A non-text attachment was scrubbed...
Name: signature.asc
Type: application/pgp-signature
Size: 842 bytes
Desc: Message signed with OpenPGP using GPGMail
URL: <http://lists.freebsd.org/pipermail/freebsd-net/attachments/20141117/97330827/attachment.sig>