svn commit: r323770 - in stable/11/sys: amd64/conf arm64/conf i386/conf powerpc/conf riscv/conf sparc64/conf

[Gleb Smirnoff]

On Wed, Sep 20, 2017 at 05:21:45PM +0000, Alexey Dokuchaev wrote:
A> On Wed, Sep 20, 2017 at 08:58:59AM -0500, Josh Paetzel wrote:
A> > On Wed, Sep 20, 2017, at 02:41 AM, Ngie Cooper (yaneurabeya) wrote:
A> > > > On Sep 19, 2017, at 09:51, Josh Paetzel <jpaetzel at FreeBSD.org> wrote:
A> > > > New Revision: 323770
A> > > > URL: https://svnweb.freebsd.org/changeset/base/323770
A> > > > 
A> > > > Log:
A> > > >  MFC: 323068
A> > > > 
A> > > >    Allow kldload tcpmd5
A> > > 
A> > > Wasn't this reverted on ^/head ?
A> > 
A> > Not this one.  What was reverted on HEAD was the removal of options
A> > IPSEC from GENERIC.
A> > 
A> > The endgoal is options IPSEC and options IPSEC_SUPPORT in GENERIC, which
A> > will allow someone running GENERIC to kldload tcpmd5.
A> 
A> I'll shamelessly steal this thread to ask somewhat related question that
A> was bothering me since the original botched commit: what is the reason
A> behind IPSEC_SUPPORT option?  If it does not cost anything, why not just
A> optimize it away; if it does imply something more, can you shed some
A> light on why is it needed (and/or might not be)?  Thanks,

The reason is to make loadable ipsec.ko. I actually don't understand
why do we still have IPSEC in GENERIC once it is loadable. Doesn't it
still have performance impact?

-- 
Gleb Smirnoff