RFC: Enabling VIMAGE in GENERIC

[Willem Jan Withagen]

On 17-11-2014 12:02, Warner Losh wrote:
> 
> On Nov 17, 2014, at 12:46 AM, Craig Rodrigues <rodrigc at FreeBSD.org>
> wrote:
> 
>> Hi,
>> 
>> PROPOSAL ========== I would like to get feedback on the following
>> proposal. In the head branch (CURRENT), I would like to enable 
>> VIMAGE with this commit:
>> 
>> 
>> PATCH ======
>> 
>> Index: sys/conf/NOTES 
>> ===================================================================
>>
>> 
--- sys/conf/NOTES      (revision 274300)
>> +++ sys/conf/NOTES      (working copy) @@ -784,8 +784,8 @@ device
>> mn      # Munich32x/Falc54 Nx64kbit/sec cards.
>> 
>> # Network stack virtualization. -#options       VIMAGE -#options
>> VNET_DEBUG      # debug for VIMAGE +options        VIMAGE +options
>> VNET_DEBUG      # debug for VIMAGE
>> 
>> # # Network interfaces:
>> 
>> 
>> 
>> I would like to enable VIMAGE for the following reasons:
>> 
>> REASONS ========
>> 
>> (1)  VIMAGE cannot be enabled off to the side in a separate library
>> or kernel module.  When enabled, it is a kernel ABI incompatible
>> change. This has impact on 3rd party code such as the kernel
>> modules which come with VirtualBox. So the time to do it in CURRENT
>> is now, otherwise we can't consider doing it until FreeBSD-12
>> timeframe, which is quite a while away.
>> 
>> (2)  VIMAGE is used in some  3rd party products, such as FreeNAS. 
>> These 3rd party products are mostly happy with VIMAGE, but
>> sometimes they encounter problems, and FreeBSD doesn't see these
>> problems because it is disabled by default.
>> 
>> (3)  Most of the major subsystems like ipfw and pf have been fixed
>> for VIMAGE, and the only way to shake out the last few issues is to
>> make it the default and get feedback from the community.  ipfilter
>> still needs to be VIMAGE-ified.
>> 
>> 
>> (4)  Not everyone uses bhyve.  FreeBSD jails are an excellent
>> virtualization platform for FreeBSD.  Jails are still very popular
>> and performant.  VIMAGE makes jails even better by allowing
>> per-jail network stacks.
>> 
>> (5)  Olivier Cochard-Labbe has provided good network performance
>> results in VIMAGE vs. non-VIMAGE kernels:
>> 
>> 
>> https://lists.freebsd.org/pipermail/freebsd-net/2014-October/040091.html
>>
>>
>> 
(6)  Certain people like Vitaly "wishmaster" <artemrts at ukr.net> have been
>> running VIMAGE jails in a production environment for quite a while,
>> and would like to see it be the default.
>> 
>> 
>> ACTION PLAN ===========
>> 
>> (1)  Coordinate/communicate with portmgr, since this has kernel
>> ABI implications
>> 
>> (2)  Work with clusteradm@, and try to get a test instance of one
>> of the PF firewalls in the cluster working with a VIMAGE enabled
>> kernel.
>> 
>> (3)   Take a pass through http://wiki.freebsd.org/VIMAGE/TODO and 
>> https://bugs.freebsd.org/bugzilla/buglist.cgi?quicksearch=vimage%20or%20vnet
>>
>> 
and try to clean things up.  Get help from net@ developers to do
>> this.
> 
> And if these don’t get cleaned up?
> 
>> (4)   Take a pass on trying to VIMAGE-ify ipfilter.  I'll need help
>> from the ipfilter maintainers for this and some net@ developers.
> 
> And if this doesn’t happen?
> 
>> (5)   Enable VIMAGE by default in CURRENT on January 5, 2015. This
>> will *not* be enabled in STABLE.
>> 
>> What do people think?
> 
> How do you plan to address the problems seen by FreeNAS in #2 above?
> I don’t see that in the action plan. Without it, we’re enabling an
> option that has know, serious issue making 11 potentially a more
> unstable release.

Hi Warner,

I think I understand your critique, but then on the other hand I wonder
where the reluctance is.... As I read it, things are going to be enabled
in CURRENT only (for the time). Which is exactly for the reasons you
worry about: Is it going to be reliable enough??

But for that it needs exposure... So I would expect it to be turned off
as a default IF things are not in a stable state that warrants a default
enabling of the options.

Things need to move forward, and taking this step is going to be
required.. Otherwise I see a big risk of bit-rot somewhere down in the
dungeons.

--Willem Jan