From owner-freebsd-virtualization@FreeBSD.ORG Mon Nov 17 17:47:53 2014 Return-Path: Delivered-To: freebsd-virtualization@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id B8DFAF99; Mon, 17 Nov 2014 17:47:53 +0000 (UTC) Received: from elvis.mu.org (elvis.mu.org [IPv6:2001:470:1f05:b76::196]) by mx1.freebsd.org (Postfix) with ESMTP id 9D325B9E; Mon, 17 Nov 2014 17:47:53 +0000 (UTC) Received: from AlfredMacbookAir.local (c-76-21-10-192.hsd1.ca.comcast.net [76.21.10.192]) by elvis.mu.org (Postfix) with ESMTPSA id 177B7341F872; Mon, 17 Nov 2014 09:47:53 -0800 (PST) Message-ID: <546A34C8.6060004@freebsd.org> Date: Mon, 17 Nov 2014 09:47:52 -0800 From: Alfred Perlstein Organization: FreeBSD User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.10; rv:24.0) Gecko/20100101 Thunderbird/24.6.0 MIME-Version: 1.0 To: Warner Losh , Craig Rodrigues Subject: Re: RFC: Enabling VIMAGE in GENERIC References: <1423616F-F44D-47E5-8595-DE862DC04464@bsdimp.com> In-Reply-To: <1423616F-F44D-47E5-8595-DE862DC04464@bsdimp.com> Content-Type: text/plain; charset=windows-1252; format=flowed Content-Transfer-Encoding: 8bit Cc: FreeBSD Net , "freebsd-virtualization@freebsd.org" , freebsd-arch X-BeenThere: freebsd-virtualization@freebsd.org X-Mailman-Version: 2.1.18-1 Precedence: list List-Id: "Discussion of various virtualization techniques FreeBSD supports." List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Mon, 17 Nov 2014 17:47:53 -0000 On 11/17/14, 3:02 AM, Warner Losh wrote: > On Nov 17, 2014, at 12:46 AM, Craig Rodrigues wrote: > >> Hi, >> >> PROPOSAL >> ========== >> I would like to get feedback on the following proposal. >> In the head branch (CURRENT), I would like to enable >> VIMAGE with this commit: >> >> >> PATCH >> ====== >> >> Index: sys/conf/NOTES >> =================================================================== >> --- sys/conf/NOTES (revision 274300) >> +++ sys/conf/NOTES (working copy) >> @@ -784,8 +784,8 @@ >> device mn # Munich32x/Falc54 Nx64kbit/sec cards. >> >> # Network stack virtualization. >> -#options VIMAGE >> -#options VNET_DEBUG # debug for VIMAGE >> +options VIMAGE >> +options VNET_DEBUG # debug for VIMAGE >> >> # >> # Network interfaces: >> >> >> >> I would like to enable VIMAGE for the following reasons: >> >> REASONS >> ======== >> >> (1) VIMAGE cannot be enabled off to the side in a separate library or >> kernel module. When enabled, it is a kernel ABI incompatible change. >> This has impact on 3rd party code such as the kernel modules >> which come with VirtualBox. >> So the time to do it in CURRENT is now, otherwise we can't consider >> doing it until FreeBSD-12 timeframe, which is quite a while away. >> >> (2) VIMAGE is used in some 3rd party products, such as FreeNAS. >> These 3rd party products are mostly happy with VIMAGE, >> but sometimes they encounter problems, and FreeBSD doesn't >> see these problems because it is disabled by default. >> >> (3) Most of the major subsystems like ipfw and pf have been fixed for >> VIMAGE, and the only >> way to shake out the last few issues is to make it the default and >> get feedback from the community. ipfilter still needs to be >> VIMAGE-ified. >> >> >> (4) Not everyone uses bhyve. FreeBSD jails are an excellent virtualization >> platform for FreeBSD. Jails are still very popular and >> performant. VIMAGE makes jails even better by allowing per-jail >> network stacks. >> >> (5) Olivier Cochard-Labbe has provided good network performance results >> in VIMAGE vs. non-VIMAGE kernels: >> >> >> https://lists.freebsd.org/pipermail/freebsd-net/2014-October/040091.html >> >> (6) Certain people like Vitaly "wishmaster" have been >> running VIMAGE >> jails in a production environment for quite a while, and would like >> to see it >> be the default. >> >> >> ACTION PLAN >> =========== >> >> (1) Coordinate/communicate with portmgr, since this has kernel ABI >> implications >> >> (2) Work with clusteradm@, and try to get a test instance of one of the >> PF firewalls in the cluster working with a VIMAGE enabled kernel. >> >> (3) Take a pass through http://wiki.freebsd.org/VIMAGE/TODO >> and >> https://bugs.freebsd.org/bugzilla/buglist.cgi?quicksearch=vimage%20or%20vnet >> and try to clean things up. Get help from net@ developers to do >> this. > And if these don’t get cleaned up? If they are not cleaned/stable up by 11-RELEASE then we turn it off. That is simple. > >> (4) Take a pass on trying to VIMAGE-ify ipfilter. I'll need help from >> the ipfilter maintainers for this and some net@ developers. > And if this doesn’t happen? Well we do have 2 other firewalls in the kernel to pick, but we do need VIMAGE so I will let you draw your own conclusions. -Alfred