Step 1.5 of importing the network stack virtualization infrastructure

from the vimage project, as per plan established at devsummit 08/08:
http://wiki.freebsd.org/Image/Notes200808DevSummit

Introduce INIT_VNET_*() initializer macros, VNET_FOREACH() iterator
macros, and CURVNET_SET() context setting macros, all currently
resolving to NOPs.

Prepare for virtualization of selected SYSCTL objects by introducing a
family of SYSCTL_V_*() macros, currently resolving to their global
counterparts, i.e. SYSCTL_V_INT() == SYSCTL_INT().

Move selected #defines from sys/sys/vimage.h to newly introduced header
files specific to virtualized subsystems (sys/net/vnet.h,
sys/netinet/vinet.h etc.).

All the changes are verified to have zero functional impact at this
point in time by doing MD5 comparision between pre- and post-change
object files(*).

(*) netipsec/keysock.c did not validate depending on compile time options.

Implemented by:	julian, bz, brooks, zec
Reviewed by:	julian, bz, brooks, kris, rwatson, ...
Approved by:	julian (mentor)
Obtained from:	//depot/projects/vimage-commit2/...
X-MFC after:	never
Sponsored by:	NLnet Foundation, The FreeBSD Foundation

21 files changed, 260 insertions, 35 deletions

diff --git a/sys/net/bridgestp.c b/sys/net/bridgestp.c
index aa9671e..99ad32e 100644
--- a/sys/net/bridgestp.c
+++ b/sys/net/bridgestp.c
@@ -2017,6 +2017,7 @@ bstp_same_bridgeid(uint64_t id1, uint64_t id2)
 void
 bstp_reinit(struct bstp_state *bs)
 {
+	INIT_VNET_NET(curvnet);
 	struct bstp_port *bp;
 	struct ifnet *ifp, *mif;
 	u_char *e_addr;
diff --git a/sys/net/if.c b/sys/net/if.c
index 0e5821e..7bf1ecb 100644
--- a/sys/net/if.c
+++ b/sys/net/if.c
@@ -168,6 +168,7 @@ MALLOC_DEFINE(M_IFMADDR, "ether_multi", "link-level multicast address");
 struct ifnet *
 ifnet_byindex(u_short idx)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 
 	IFNET_RLOCK();
@@ -179,6 +180,7 @@ ifnet_byindex(u_short idx)
 static void
 ifnet_setbyindex(u_short idx, struct ifnet *ifp)
 {
+	INIT_VNET_NET(curvnet);
 
 	IFNET_WLOCK_ASSERT();
 
@@ -188,6 +190,7 @@ ifnet_setbyindex(u_short idx, struct ifnet *ifp)
 struct ifaddr *
 ifaddr_byindex(u_short idx)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifaddr *ifa;
 
 	IFNET_RLOCK();
@@ -199,6 +202,7 @@ ifaddr_byindex(u_short idx)
 struct cdev *
 ifdev_byindex(u_short idx)
 {
+	INIT_VNET_NET(curvnet);
 	struct cdev *cdev;
 
 	IFNET_RLOCK();
@@ -210,6 +214,7 @@ ifdev_byindex(u_short idx)
 static void
 ifdev_setbyindex(u_short idx, struct cdev *cdev)
 {
+	INIT_VNET_NET(curvnet);
 
 	IFNET_WLOCK();
 	V_ifindex_table[idx].ife_dev = cdev;
@@ -279,6 +284,7 @@ netioctl(struct cdev *dev, u_long cmd, caddr_t data, int flag, struct thread *td
 static int
 netkqfilter(struct cdev *dev, struct knote *kn)
 {
+	INIT_VNET_NET(curvnet);
 	struct knlist *klist;
 	struct ifnet *ifp;
 	int idx;
@@ -348,6 +354,7 @@ filt_netdev(struct knote *kn, long hint)
 static void
 if_init(void *dummy __unused)
 {
+	INIT_VNET_NET(curvnet);
 
 	IFNET_LOCK_INIT();
 	TAILQ_INIT(&V_ifnet);
@@ -362,6 +369,7 @@ if_init(void *dummy __unused)
 static void
 if_grow(void)
 {
+	INIT_VNET_NET(curvnet);
 	u_int n;
 	struct ifindex_entry *e;
 
@@ -383,6 +391,7 @@ if_grow(void)
 struct ifnet*
 if_alloc(u_char type)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 
 	ifp = malloc(sizeof(struct ifnet), M_IFNET, M_WAITOK|M_ZERO);
@@ -445,6 +454,7 @@ if_free(struct ifnet *ifp)
 void
 if_free_type(struct ifnet *ifp, u_char type)
 {
+	INIT_VNET_NET(curvnet); /* ifp->if_vnet can be NULL here ! */
 
 	if (ifp != ifnet_byindex(ifp->if_index)) {
 		if_printf(ifp, "%s: value was not if_alloced, skipping\n",
@@ -482,6 +492,7 @@ if_free_type(struct ifnet *ifp, u_char type)
 void
 if_attach(struct ifnet *ifp)
 {
+	INIT_VNET_NET(curvnet);
 	unsigned socksize, ifasize;
 	int namelen, masklen;
 	struct sockaddr_dl *sdl;
@@ -595,6 +606,7 @@ if_attach(struct ifnet *ifp)
 static void
 if_attachdomain(void *dummy)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 	int s;
 
@@ -705,6 +717,7 @@ if_purgemaddrs(struct ifnet *ifp)
 void
 if_detach(struct ifnet *ifp)
 {
+	INIT_VNET_NET(ifp->if_vnet);
 	struct ifaddr *ifa;
 	struct radix_node_head	*rnh;
 	int s;
@@ -820,6 +833,7 @@ if_detach(struct ifnet *ifp)
 int
 if_addgroup(struct ifnet *ifp, const char *groupname)
 {
+	INIT_VNET_NET(ifp->if_vnet);
 	struct ifg_list		*ifgl;
 	struct ifg_group	*ifg = NULL;
 	struct ifg_member	*ifgm;
@@ -889,6 +903,7 @@ if_addgroup(struct ifnet *ifp, const char *groupname)
 int
 if_delgroup(struct ifnet *ifp, const char *groupname)
 {
+	INIT_VNET_NET(ifp->if_vnet);
 	struct ifg_list		*ifgl;
 	struct ifg_member	*ifgm;
 
@@ -978,6 +993,7 @@ if_getgroup(struct ifgroupreq *data, struct ifnet *ifp)
 static int
 if_getgroupmembers(struct ifgroupreq *data)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifgroupreq	*ifgr = data;
 	struct ifg_group	*ifg;
 	struct ifg_member	*ifgm;
@@ -1087,6 +1103,7 @@ if_rtdel(struct radix_node *rn, void *arg)
 struct ifaddr *
 ifa_ifwithaddr(struct sockaddr *addr)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 	struct ifaddr *ifa;
 
@@ -1117,6 +1134,7 @@ done:
 struct ifaddr *
 ifa_ifwithbroadaddr(struct sockaddr *addr)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 	struct ifaddr *ifa;
 
@@ -1144,6 +1162,7 @@ done:
 struct ifaddr *
 ifa_ifwithdstaddr(struct sockaddr *addr)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 	struct ifaddr *ifa;
 
@@ -1172,6 +1191,7 @@ done:
 struct ifaddr *
 ifa_ifwithnet(struct sockaddr *addr)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 	struct ifaddr *ifa;
 	struct ifaddr *ifa_maybe = (struct ifaddr *) 0;
@@ -1415,6 +1435,7 @@ do_link_state_change(void *arg, int pending)
 	struct ifnet *ifp = (struct ifnet *)arg;
 	int link_state = ifp->if_link_state;
 	int link;
+	CURVNET_SET(ifp->if_vnet);
 
 	/* Notify that the link state has changed. */
 	rt_ifmsg(ifp);
@@ -1451,6 +1472,7 @@ do_link_state_change(void *arg, int pending)
 	if (log_link_state_change)
 		log(LOG_NOTICE, "%s: link state changed to %s\n", ifp->if_xname,
 		    (link_state == LINK_STATE_UP) ? "UP" : "DOWN" );
+	CURVNET_RESTORE();
 }
 
 /*
@@ -1513,16 +1535,24 @@ if_qflush(struct ifaltq *ifq)
 static void
 if_slowtimo(void *arg)
 {
+	VNET_ITERATOR_DECL(vnet_iter);
 	struct ifnet *ifp;
 	int s = splimp();
 
 	IFNET_RLOCK();
-	TAILQ_FOREACH(ifp, &V_ifnet, if_link) {
-		if (ifp->if_timer == 0 || --ifp->if_timer)
-			continue;
-		if (ifp->if_watchdog)
-			(*ifp->if_watchdog)(ifp);
+	VNET_LIST_RLOCK();
+	VNET_FOREACH(vnet_iter) {
+		CURVNET_SET(vnet_iter);
+		INIT_VNET_NET(vnet_iter);
+		TAILQ_FOREACH(ifp, &V_ifnet, if_link) {
+			if (ifp->if_timer == 0 || --ifp->if_timer)
+				continue;
+			if (ifp->if_watchdog)
+				(*ifp->if_watchdog)(ifp);
+		}
+		CURVNET_RESTORE();
 	}
+	VNET_LIST_RUNLOCK();
 	IFNET_RUNLOCK();
 	splx(s);
 	timeout(if_slowtimo, (void *)0, hz / IFNET_SLOWHZ);
@@ -1535,6 +1565,7 @@ if_slowtimo(void *arg)
 struct ifnet *
 ifunit(const char *name)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 
 	IFNET_RLOCK();
@@ -2107,6 +2138,7 @@ ifpromisc(struct ifnet *ifp, int pswitch)
 static int
 ifconf(u_long cmd, caddr_t data)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifconf *ifc = (struct ifconf *)data;
 #ifdef __amd64__
 	struct ifconf32 *ifc32 = (struct ifconf32 *)data;
@@ -2466,6 +2498,7 @@ if_delmulti(struct ifnet *ifp, struct sockaddr *sa)
 	int lastref;
 #ifdef INVARIANTS
 	struct ifnet *oifp;
+	INIT_VNET_NET(ifp->if_vnet);
 
 	IFNET_RLOCK();
 	TAILQ_FOREACH(oifp, &V_ifnet, if_link)
@@ -2510,6 +2543,9 @@ if_delmulti(struct ifnet *ifp, struct sockaddr *sa)
 void
 if_delmulti_ifma(struct ifmultiaddr *ifma)
 {
+#ifdef DIAGNOSTIC
+	INIT_VNET_NET(curvnet);
+#endif
 	struct ifnet *ifp;
 	int lastref;
 
diff --git a/sys/net/if_bridge.c b/sys/net/if_bridge.c
index 4e124d2..0a53265 100644
--- a/sys/net/if_bridge.c
+++ b/sys/net/if_bridge.c
@@ -3039,6 +3039,8 @@ bridge_pfil(struct mbuf **mp, struct ifnet *bifp, struct ifnet *ifp, int dir)
 	}
 
 	if (IPFW_LOADED && pfil_ipfw != 0 && dir == PFIL_OUT && ifp != NULL) {
+		INIT_VNET_IPFW(curvnet);
+
 		error = -1;
 		args.rule = ip_dn_claim_rule(*mp);
 		if (args.rule != NULL && V_fw_one_pass)
@@ -3223,6 +3225,7 @@ bad:
 static int
 bridge_ip_checkbasic(struct mbuf **mp)
 {
+	INIT_VNET_INET(curvnet);
 	struct mbuf *m = *mp;
 	struct ip *ip;
 	int len, hlen;
@@ -3318,6 +3321,7 @@ bad:
 static int
 bridge_ip6_checkbasic(struct mbuf **mp)
 {
+	INIT_VNET_INET6(curvnet);
 	struct mbuf *m = *mp;
 	struct ip6_hdr *ip6;
 
@@ -3372,6 +3376,7 @@ static int
 bridge_fragment(struct ifnet *ifp, struct mbuf *m, struct ether_header *eh,
     int snap, struct llc *llc)
 {
+	INIT_VNET_INET(curvnet);
 	struct mbuf *m0;
 	struct ip *ip;
 	int error = -1;
diff --git a/sys/net/if_ef.c b/sys/net/if_ef.c
index c60e615..59d4556 100644
--- a/sys/net/if_ef.c
+++ b/sys/net/if_ef.c
@@ -484,43 +484,51 @@ ef_clone(struct ef_link *efl, int ft)
 static int
 ef_load(void)
 {
+	VNET_ITERATOR_DECL(vnet_iter);
 	struct ifnet *ifp;
 	struct efnet *efp;
 	struct ef_link *efl = NULL, *efl_temp;
 	int error = 0, d;
 
-	IFNET_RLOCK();
-	TAILQ_FOREACH(ifp, &V_ifnet, if_link) {
-		if (ifp->if_type != IFT_ETHER) continue;
-		EFDEBUG("Found interface %s\n", ifp->if_xname);
-		efl = (struct ef_link*)malloc(sizeof(struct ef_link), 
-		    M_IFADDR, M_WAITOK | M_ZERO);
-		if (efl == NULL) {
-			error = ENOMEM;
-			break;
-		}
+	VNET_LIST_RLOCK();
+	VNET_FOREACH(vnet_iter) {
+		CURVNET_SET(vnet_iter);
+		INIT_VNET_NET(vnet_iter);
+		IFNET_RLOCK();
+		TAILQ_FOREACH(ifp, &V_ifnet, if_link) {
+			if (ifp->if_type != IFT_ETHER) continue;
+			EFDEBUG("Found interface %s\n", ifp->if_xname);
+			efl = (struct ef_link*)malloc(sizeof(struct ef_link), 
+			    M_IFADDR, M_WAITOK | M_ZERO);
+			if (efl == NULL) {
+				error = ENOMEM;
+				break;
+			}
 
-		efl->el_ifp = ifp;
+			efl->el_ifp = ifp;
 #ifdef ETHER_II
-		error = ef_clone(efl, ETHER_FT_EII);
-		if (error) break;
+			error = ef_clone(efl, ETHER_FT_EII);
+			if (error) break;
 #endif
 #ifdef ETHER_8023
-		error = ef_clone(efl, ETHER_FT_8023);
-		if (error) break;
+			error = ef_clone(efl, ETHER_FT_8023);
+			if (error) break;
 #endif
 #ifdef ETHER_8022
-		error = ef_clone(efl, ETHER_FT_8022);
-		if (error) break;
+			error = ef_clone(efl, ETHER_FT_8022);
+			if (error) break;
 #endif
 #ifdef ETHER_SNAP
-		error = ef_clone(efl, ETHER_FT_SNAP);
-		if (error) break;
+			error = ef_clone(efl, ETHER_FT_SNAP);
+			if (error) break;
 #endif
-		efcount++;
-		SLIST_INSERT_HEAD(&efdev, efl, el_next);
+			efcount++;
+			SLIST_INSERT_HEAD(&efdev, efl, el_next);
+		}
+		IFNET_RUNLOCK();
+		CURVNET_RESTORE();
 	}
-	IFNET_RUNLOCK();
+	VNET_LIST_RUNLOCK();
 	if (error) {
 		if (efl)
 			SLIST_INSERT_HEAD(&efdev, efl, el_next);
diff --git a/sys/net/if_ethersubr.c b/sys/net/if_ethersubr.c
index d20fb65..c51b331 100644
--- a/sys/net/if_ethersubr.c
+++ b/sys/net/if_ethersubr.c
@@ -393,6 +393,7 @@ ether_output_frame(struct ifnet *ifp, struct mbuf *m)
 {
 	int error;
 #if defined(INET) || defined(INET6)
+	INIT_VNET_NET(ifp->if_vnet);
 	struct ip_fw *rule = ip_dn_claim_rule(m);
 
 	if (IPFW_LOADED && V_ether_ipfw != 0) {
@@ -424,6 +425,7 @@ int
 ether_ipfw_chk(struct mbuf **m0, struct ifnet *dst,
 	struct ip_fw **rule, int shared)
 {
+	INIT_VNET_IPFW(dst->if_vnet);
 	struct ether_header *eh;
 	struct ether_header save_eh;
 	struct mbuf *m;
@@ -716,6 +718,7 @@ ether_demux(struct ifnet *ifp, struct mbuf *m)
 	KASSERT(ifp != NULL, ("%s: NULL interface pointer", __func__));
 
 #if defined(INET) || defined(INET6)
+	INIT_VNET_NET(ifp->if_vnet);
 	/*
 	 * Allow dummynet and/or ipfw to claim the frame.
 	 * Do not do this for PROMISC frames in case we are re-entered.
@@ -937,8 +940,8 @@ ether_ifdetach(struct ifnet *ifp)
 SYSCTL_DECL(_net_link);
 SYSCTL_NODE(_net_link, IFT_ETHER, ether, CTLFLAG_RW, 0, "Ethernet");
 #if defined(INET) || defined(INET6)
-SYSCTL_INT(_net_link_ether, OID_AUTO, ipfw, CTLFLAG_RW,
-	    &ether_ipfw,0,"Pass ether pkts through firewall");
+SYSCTL_V_INT(V_NET, vnet_net, _net_link_ether, OID_AUTO, ipfw, CTLFLAG_RW,
+	     ether_ipfw, 0, "Pass ether pkts through firewall");
 #endif
 
 #if 0
diff --git a/sys/net/if_faith.c b/sys/net/if_faith.c
index 6388820..6fdb72b 100644
--- a/sys/net/if_faith.c
+++ b/sys/net/if_faith.c
@@ -324,6 +324,7 @@ static int
 faithprefix(in6)
 	struct in6_addr *in6;
 {
+	INIT_VNET_INET6(curvnet);
 	struct rtentry *rt;
 	struct sockaddr_in6 sin6;
 	int ret;
diff --git a/sys/net/if_gif.c b/sys/net/if_gif.c
index 685f282..8e0363c 100644
--- a/sys/net/if_gif.c
+++ b/sys/net/if_gif.c
@@ -123,9 +123,17 @@ SYSCTL_NODE(_net_link, IFT_GIF, gif, CTLFLAG_RW, 0,
  */
 #define MAX_GIF_NEST 1
 #endif
+#ifndef VIMAGE
 static int max_gif_nesting = MAX_GIF_NEST;
-SYSCTL_INT(_net_link_gif, OID_AUTO, max_nesting, CTLFLAG_RW,
-    &max_gif_nesting, 0, "Max nested tunnels");
+#endif
+SYSCTL_V_INT(V_NET, vnet_gif, _net_link_gif, OID_AUTO, max_nesting,
+    CTLFLAG_RW, max_gif_nesting, 0, "Max nested tunnels");
+
+#ifdef INET6
+SYSCTL_DECL(_net_inet6_ip6);
+SYSCTL_V_INT(V_NET, vnet_gif, _net_inet6_ip6, IPV6CTL_GIF_HLIM,
+    gifhlim, CTLFLAG_RW, ip6_gif_hlim, 0, "");
+#endif
 
 /*
  * By default, we disallow creation of multiple tunnels between the same
@@ -137,8 +145,8 @@ static int parallel_tunnels = 1;
 #else
 static int parallel_tunnels = 0;
 #endif
-SYSCTL_INT(_net_link_gif, OID_AUTO, parallel_tunnels, CTLFLAG_RW,
-    &parallel_tunnels, 0, "Allow parallel tunnels?");
+SYSCTL_V_INT(V_NET, vnet_gif, _net_link_gif, OID_AUTO, parallel_tunnels,
+    CTLFLAG_RW, parallel_tunnels, 0, "Allow parallel tunnels?");
 
 /* copy from src/sys/net/if_ethersubr.c */
 static const u_char etherbroadcastaddr[ETHER_ADDR_LEN] =
@@ -154,6 +162,7 @@ gif_clone_create(ifc, unit, params)
 	int unit;
 	caddr_t params;
 {
+	INIT_VNET_GIF(curvnet);
 	struct gif_softc *sc;
 
 	sc = malloc(sizeof(struct gif_softc), M_GIF, M_WAITOK | M_ZERO);
@@ -364,6 +373,7 @@ gif_output(ifp, m, dst, rt)
 	struct sockaddr *dst;
 	struct rtentry *rt;	/* added in net2 */
 {
+	INIT_VNET_GIF(ifp->if_vnet);
 	struct gif_softc *sc = ifp->if_softc;
 	struct m_tag *mtag;
 	int error = 0;
@@ -854,6 +864,7 @@ gif_set_tunnel(ifp, src, dst)
 	struct sockaddr *src;
 	struct sockaddr *dst;
 {
+	INIT_VNET_GIF(ifp->if_vnet);
 	struct gif_softc *sc = ifp->if_softc;
 	struct gif_softc *sc2;
 	struct sockaddr *osrc, *odst, *sa;
diff --git a/sys/net/if_gif.h b/sys/net/if_gif.h
index 4e417fd..c2fcc8c 100644
--- a/sys/net/if_gif.h
+++ b/sys/net/if_gif.h
@@ -110,6 +110,30 @@ int gif_set_tunnel(struct ifnet *, struct sockaddr *, struct sockaddr *);
 void gif_delete_tunnel(struct ifnet *);
 int gif_encapcheck(const struct mbuf *, int, int, void *);
 
+/*
+ * Virtualization support
+ */
+#ifdef VIMAGE
+struct vnet_gif {
+	LIST_HEAD(, gif_softc) _gif_softc_list;
+	int	_max_gif_nesting;
+	int	_parallel_tunnels;
+	int	_ip_gif_ttl;
+	int	_ip6_gif_hlim;
+};
+#endif
+
+#define	INIT_VNET_GIF(vnet) \
+	INIT_FROM_VNET(vnet, VNET_MOD_GIF, struct vnet_gif, vnet_gif)
+
+#define	VNET_GIF(sym)	VSYM(vnet_gif, sym)
+
+#define	V_gif_softc_list	VNET_GIF(gif_softc_list)
+#define	V_max_gif_nesting	VNET_GIF(max_gif_nesting)
+#define	V_parallel_tunnels	VNET_GIF(parallel_tunnels)
+#define	V_ip_gif_ttl		VNET_GIF(ip_gif_ttl)
+#define	V_ip6_gif_hlim		VNET_GIF(ip6_gif_hlim)
+
 #endif /* _KERNEL */
 
 #endif /* _NET_IF_GIF_H_ */
diff --git a/sys/net/if_gre.c b/sys/net/if_gre.c
index c3ec001..6b5e739 100644
--- a/sys/net/if_gre.c
+++ b/sys/net/if_gre.c
@@ -241,6 +241,9 @@ static int
 gre_output(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
 	   struct rtentry *rt)
 {
+#ifdef INET6
+	INIT_VNET_INET(ifp->if_vnet);
+#endif
 	int error = 0;
 	struct gre_softc *sc = ifp->if_softc;
 	struct greip *gh;
diff --git a/sys/net/if_loop.c b/sys/net/if_loop.c
index eebae0c..09bbb55 100644
--- a/sys/net/if_loop.c
+++ b/sys/net/if_loop.c
@@ -115,6 +115,7 @@ lo_clone_destroy(struct ifnet *ifp)
 static int
 lo_clone_create(struct if_clone *ifc, int unit, caddr_t params)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 
 	ifp = if_alloc(IFT_LOOP);
@@ -214,6 +215,7 @@ looutput(struct ifnet *ifp, struct mbuf *m, struct sockaddr *dst,
 int
 if_simloop(struct ifnet *ifp, struct mbuf *m, int af, int hlen)
 {
+	INIT_VNET_NET(ifp->if_vnet);
 	int isr;
 
 	M_ASSERTPKTHDR(m);
diff --git a/sys/net/if_mib.c b/sys/net/if_mib.c
index 736c099..0902599 100644
--- a/sys/net/if_mib.c
+++ b/sys/net/if_mib.c
@@ -65,12 +65,15 @@
 SYSCTL_DECL(_net_link_generic);
 SYSCTL_NODE(_net_link_generic, IFMIB_SYSTEM, system, CTLFLAG_RW, 0,
 	    "Variables global to all interfaces");
-SYSCTL_INT(_net_link_generic_system, IFMIB_IFCOUNT, ifcount, CTLFLAG_RD,
-	   &if_index, 0, "Number of configured interfaces");
+
+SYSCTL_V_INT(V_NET, vnet_net, _net_link_generic_system, IFMIB_IFCOUNT,
+	     ifcount, CTLFLAG_RD, if_index, 0,
+	     "Number of configured interfaces");
 
 static int
 sysctl_ifdata(SYSCTL_HANDLER_ARGS) /* XXX bad syntax! */
 {
+	INIT_VNET_NET(curvnet);
 	int *name = (int *)arg1;
 	int error;
 	u_int namelen = arg2;
diff --git a/sys/net/if_spppsubr.c b/sys/net/if_spppsubr.c
index c7814e5..99dad77 100644
--- a/sys/net/if_spppsubr.c
+++ b/sys/net/if_spppsubr.c
@@ -4875,6 +4875,7 @@ sppp_get_ip_addrs(struct sppp *sp, u_long *src, u_long *dst, u_long *srcmask)
 static void
 sppp_set_ip_addr(struct sppp *sp, u_long src)
 {
+	INIT_VNET_INET(curvnet);
 	STDDCL;
 	struct ifaddr *ifa;
 	struct sockaddr_in *si;
diff --git a/sys/net/if_stf.c b/sys/net/if_stf.c
index 4e365d5..d3c0d75 100644
--- a/sys/net/if_stf.c
+++ b/sys/net/if_stf.c
@@ -375,6 +375,7 @@ static struct in6_ifaddr *
 stf_getsrcifa6(ifp)
 	struct ifnet *ifp;
 {
+	INIT_VNET_INET(ifp->if_vnet);
 	struct ifaddr *ia;
 	struct in_ifaddr *ia4;
 	struct sockaddr_in6 *sin6;
@@ -584,6 +585,7 @@ stf_checkaddr4(sc, in, inifp)
 	struct in_addr *in;
 	struct ifnet *inifp;	/* incoming interface */
 {
+	INIT_VNET_INET(curvnet);
 	struct in_ifaddr *ia4;
 
 	/*
diff --git a/sys/net/if_tun.c b/sys/net/if_tun.c
index b057b79..a1ec495 100644
--- a/sys/net/if_tun.c
+++ b/sys/net/if_tun.c
@@ -43,6 +43,7 @@
 #include <sys/uio.h>
 #include <sys/malloc.h>
 #include <sys/random.h>
+#include <sys/vimage.h>
 
 #include <net/if.h>
 #include <net/if_clone.h>
@@ -224,6 +225,7 @@ tunclone(void *arg, struct ucred *cred, char *name, int namelen,
 	else
 		append_unit = 0;
 
+	CURVNET_SET(TD_TO_VNET(curthread));
 	/* find any existing device, or allocate new unit number */
 	i = clone_create(&tunclones, &tun_cdevsw, &u, dev, 0);
 	if (i) {
@@ -242,6 +244,7 @@ tunclone(void *arg, struct ucred *cred, char *name, int namelen,
 	}
 
 	if_clone_create(name, namelen, NULL);
+	CURVNET_RESTORE();
 }
 
 static void
@@ -253,6 +256,7 @@ tun_destroy(struct tun_softc *tp)
 	KASSERT((tp->tun_flags & TUN_OPEN) == 0,
 	    ("tununits is out of sync - unit %d", TUN2IFP(tp)->if_dunit));
 
+	CURVNET_SET(TUN2IFP(tp)->if_vnet);
 	dev = tp->tun_dev;
 	bpfdetach(TUN2IFP(tp));
 	if_detach(TUN2IFP(tp));
@@ -261,6 +265,7 @@ tun_destroy(struct tun_softc *tp)
 	knlist_destroy(&tp->tun_rsel.si_note);
 	mtx_destroy(&tp->tun_mtx);
 	free(tp, M_TUN);
+	CURVNET_RESTORE();
 }
 
 static void
@@ -447,6 +452,7 @@ tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
 	/*
 	 * junk all pending output
 	 */
+	CURVNET_SET(ifp->if_vnet);
 	s = splimp();
 	IFQ_PURGE(&ifp->if_snd);
 	splx(s);
@@ -476,6 +482,7 @@ tunclose(struct cdev *dev, int foo, int bar, struct thread *td)
 		ifp->if_drv_flags &= ~IFF_DRV_RUNNING;
 		splx(s);
 	}
+	CURVNET_RESTORE();
 
 	funsetown(&tp->tun_sigio);
 	selwakeuppri(&tp->tun_rsel, PZERO + 1);
@@ -924,7 +931,9 @@ tunwrite(struct cdev *dev, struct uio *uio, int flag)
 		random_harvest(m, 16, 3, 0, RANDOM_NET);
 	ifp->if_ibytes += m->m_pkthdr.len;
 	ifp->if_ipackets++;
+	CURVNET_SET(ifp->if_vnet);
 	netisr_dispatch(isr, m);
+	CURVNET_RESTORE();
 	return (0);
 }
 
diff --git a/sys/net/if_var.h b/sys/net/if_var.h
index 593d9a2..3f7a008 100644
--- a/sys/net/if_var.h
+++ b/sys/net/if_var.h
@@ -713,6 +713,8 @@ int    ether_poll_register(poll_handler_t *h, struct ifnet *ifp);
 int    ether_poll_deregister(struct ifnet *ifp);
 #endif /* DEVICE_POLLING */
 
+#include <net/vnet.h>
+
 #endif /* _KERNEL */
 
 #endif /* !_NET_IF_VAR_H_ */
diff --git a/sys/net/if_vlan.c b/sys/net/if_vlan.c
index 3f93883..af164e3 100644
--- a/sys/net/if_vlan.c
+++ b/sys/net/if_vlan.c
@@ -422,6 +422,8 @@ vlan_setmulti(struct ifnet *ifp)
 	sc = ifp->if_softc;
 	ifp_p = PARENT(sc);
 
+	CURVNET_SET_QUIET(ifp_p->if_vnet);
+
 	bzero((char *)&sdl, sizeof(sdl));
 	sdl.sdl_len = sizeof(sdl);
 	sdl.sdl_family = AF_LINK;
@@ -456,6 +458,7 @@ vlan_setmulti(struct ifnet *ifp)
 			return (error);
 	}
 
+	CURVNET_RESTORE();
 	return (0);
 }
 
@@ -573,6 +576,7 @@ MODULE_DEPEND(if_vlan, miibus, 1, 1, 1);
 static struct ifnet *
 vlan_clone_match_ethertag(struct if_clone *ifc, const char *name, int *tag)
 {
+	INIT_VNET_NET(curvnet);
 	const char *cp;
 	struct ifnet *ifp;
 	int t = 0;
diff --git a/sys/net/raw_cb.c b/sys/net/raw_cb.c
index ee8628c..076d2f5 100644
--- a/sys/net/raw_cb.c
+++ b/sys/net/raw_cb.c
@@ -44,6 +44,7 @@
 #include <sys/systm.h>
 #include <sys/vimage.h>
 
+#include <net/if.h>
 #include <net/raw_cb.h>
 
 /*
@@ -75,6 +76,7 @@ SYSCTL_ULONG(_net_raw, OID_AUTO, recvspace, CTLFLAG_RW, &raw_recvspace, 0,
 int
 raw_attach(struct socket *so, int proto)
 {
+	INIT_VNET_NET(so->so_vnet);
 	struct rawcb *rp = sotorawcb(so);
 	int error;
 
diff --git a/sys/net/raw_usrreq.c b/sys/net/raw_usrreq.c
index 09752fc..633125a 100644
--- a/sys/net/raw_usrreq.c
+++ b/sys/net/raw_usrreq.c
@@ -46,6 +46,7 @@
 #include <sys/systm.h>
 #include <sys/vimage.h>
 
+#include <net/if.h>
 #include <net/raw_cb.h>
 
 MTX_SYSINIT(rawcb_mtx, &rawcb_mtx, "rawcb", MTX_DEF);
@@ -56,6 +57,7 @@ MTX_SYSINIT(rawcb_mtx, &rawcb_mtx, "rawcb", MTX_DEF);
 void
 raw_init(void)
 {
+	INIT_VNET_NET(curvnet);
 
 	LIST_INIT(&V_rawcb_list);
 }
@@ -70,6 +72,7 @@ raw_init(void)
 void
 raw_input(struct mbuf *m0, struct sockproto *proto, struct sockaddr *src)
 {
+	INIT_VNET_NET(curvnet);
 	struct rawcb *rp;
 	struct mbuf *m = m0;
 	struct socket *last;
diff --git a/sys/net/route.c b/sys/net/route.c
index 105c932..359ac8a 100644
--- a/sys/net/route.c
+++ b/sys/net/route.c
@@ -257,6 +257,7 @@ struct rtentry *
 rtalloc1_fib(struct sockaddr *dst, int report, u_long ignflags,
 		    u_int fibnum)
 {
+	INIT_VNET_NET(curvnet);
 	struct radix_node_head *rnh;
 	struct rtentry *rt;
 	struct radix_node *rn;
@@ -362,6 +363,7 @@ rtalloc1_fib(struct sockaddr *dst, int report, u_long ignflags,
 void
 rtfree(struct rtentry *rt)
 {
+	INIT_VNET_NET(curvnet);
 	struct radix_node_head *rnh;
 
 	KASSERT(rt != NULL,("%s: NULL rt", __func__));
@@ -462,6 +464,7 @@ rtredirect_fib(struct sockaddr *dst,
 	struct sockaddr *src,
 	u_int fibnum)
 {
+	INIT_VNET_NET(curvnet);
 	struct rtentry *rt, *rt0 = NULL;
 	int error = 0;
 	short *stat = NULL;
@@ -768,6 +771,7 @@ rt_getifa_fib(struct rt_addrinfo *info, u_int fibnum)
 int
 rtexpunge(struct rtentry *rt)
 {
+	INIT_VNET_NET(curvnet);
 	struct radix_node *rn;
 	struct radix_node_head *rnh;
 	struct ifaddr *ifa;
@@ -859,6 +863,7 @@ int
 rtrequest1_fib(int req, struct rt_addrinfo *info, struct rtentry **ret_nrt,
 				u_int fibnum)
 {
+	INIT_VNET_NET(curvnet);
 	int error = 0;
 	register struct rtentry *rt;
 	register struct radix_node *rn;
@@ -1289,6 +1294,7 @@ delete_rt:
 int
 rt_setgate(struct rtentry *rt, struct sockaddr *dst, struct sockaddr *gate)
 {
+	INIT_VNET_NET(curvnet);
 	/* XXX dst may be overwritten, can we move this to below */
 	struct radix_node_head *rnh =
 	    V_rt_tables[rt->rt_fibnum][dst->sa_family];
@@ -1431,6 +1437,7 @@ rt_maskedcopy(struct sockaddr *src, struct sockaddr *dst, struct sockaddr *netma
 static inline  int
 rtinit1(struct ifaddr *ifa, int cmd, int flags, int fibnum)
 {
+	INIT_VNET_NET(curvnet);
 	struct sockaddr *dst;
 	struct sockaddr *netmask;
 	struct rtentry *rt = NULL;
diff --git a/sys/net/rtsock.c b/sys/net/rtsock.c
index 34db369..7b610d6 100644
--- a/sys/net/rtsock.c
+++ b/sys/net/rtsock.c
@@ -314,6 +314,7 @@ static int
 route_output(struct mbuf *m, struct socket *so)
 {
 #define	sa_equal(a1, a2) (bcmp((a1), (a2), (a1)->sa_len) == 0)
+	INIT_VNET_NET(so->so_vnet);
 	struct rt_msghdr *rtm = NULL;
 	struct rtentry *rt = NULL;
 	struct radix_node_head *rnh;
@@ -1075,6 +1076,7 @@ rt_ifannouncemsg(struct ifnet *ifp, int what)
 static void
 rt_dispatch(struct mbuf *m, const struct sockaddr *sa)
 {
+	INIT_VNET_NET(curvnet);
 	struct m_tag *tag;
 
 	/*
@@ -1138,6 +1140,7 @@ sysctl_dumpentry(struct radix_node *rn, void *vw)
 static int
 sysctl_iflist(int af, struct walkarg *w)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 	struct ifaddr *ifa;
 	struct rt_addrinfo info;
@@ -1198,6 +1201,7 @@ done:
 int
 sysctl_ifmalist(int af, struct walkarg *w)
 {
+	INIT_VNET_NET(curvnet);
 	struct ifnet *ifp;
 	struct ifmultiaddr *ifma;
 	struct	rt_addrinfo info;
@@ -1247,6 +1251,7 @@ done:
 static int
 sysctl_rtsock(SYSCTL_HANDLER_ARGS)
 {
+	INIT_VNET_NET(curvnet);
 	int	*name = (int *)arg1;
 	u_int	namelen = arg2;
 	struct radix_node_head *rnh;
diff --git a/sys/net/vnet.h b/sys/net/vnet.h
new file mode 100644
index 0000000..f287bf9
--- /dev/null
+++ b/sys/net/vnet.h
@@ -0,0 +1,93 @@
+/*-
+ * Copyright (c) 2006-2008 University of Zagreb
+ * Copyright (c) 2006-2008 FreeBSD Foundation
+ *
+ * This software was developed by the University of Zagreb and the
+ * FreeBSD Foundation under sponsorship by the Stichting NLnet and the
+ * FreeBSD Foundation.
+ *
+ * Redistribution and use in source and binary forms, with or without
+ * modification, are permitted provided that the following conditions
+ * are met:
+ * 1. Redistributions of source code must retain the above copyright
+ *    notice, this list of conditions and the following disclaimer.
+ * 2. Redistributions in binary form must reproduce the above copyright
+ *    notice, this list of conditions and the following disclaimer in the
+ *    documentation and/or other materials provided with the distribution.
+ * 
+ * THIS SOFTWARE IS PROVIDED BY THE AUTHOR AND CONTRIBUTORS ``AS IS'' AND
+ * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
+ * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
+ * ARE DISCLAIMED.  IN NO EVENT SHALL THE AUTHOR OR CONTRIBUTORS BE LIABLE
+ * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
+ * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
+ * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
+ * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
+ * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
+ * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
+ * SUCH DAMAGE.
+ *
+ * $FreeBSD$
+ */
+
+#ifndef _NET_VNET_H_
+#define _NET_VNET_H_
+
+#ifdef VIMAGE
+#include "opt_route.h"
+
+#include <sys/proc.h>
+#include <sys/protosw.h>
+#include <sys/socket.h>
+
+#include <net/if.h>
+#include <net/if_var.h>
+#include <net/route.h>
+#include <net/raw_cb.h>
+
+struct vnet_net {
+	int	_if_index;
+	struct	ifindex_entry *_ifindex_table;
+	struct	ifnethead _ifnet;
+	struct	ifgrouphead _ifg_head;
+
+	int	_if_indexlim;
+	struct	knlist _ifklist;
+
+	struct	rtstat _rtstat;
+	struct	radix_node_head *_rt_tables[RT_MAXFIBS][AF_MAX+1];
+	int	_rttrash;
+
+	struct	ifnet *_loif;
+	LIST_HEAD(, lo_softc) _lo_list;
+
+	LIST_HEAD(, rawcb) _rawcb_list;
+
+	int	_ether_ipfw;
+};
+
+#endif
+
+/*
+ * Symbol translation macros
+ */
+#define	INIT_VNET_NET(vnet) \
+	INIT_FROM_VNET(vnet, VNET_MOD_NET, struct vnet_net, vnet_net)
+
+#define	VNET_NET(sym)	VSYM(vnet_net, sym)
+
+#define	V_ether_ipfw	VNET_NET(ether_ipfw)
+#define	V_if_index	VNET_NET(if_index)
+#define	V_if_indexlim	VNET_NET(if_indexlim)
+#define	V_ifg_head	VNET_NET(ifg_head)
+#define	V_ifindex_table	VNET_NET(ifindex_table)
+#define	V_ifklist	VNET_NET(ifklist)
+#define	V_ifnet		VNET_NET(ifnet)
+#define	V_lo_list	VNET_NET(lo_list)
+#define	V_loif		VNET_NET(loif)
+#define	V_rawcb_list	VNET_NET(rawcb_list)
+#define	V_rt_tables	VNET_NET(rt_tables)
+#define	V_rtstat	VNET_NET(rtstat)
+#define	V_rttrash	VNET_NET(rttrash)
+
+#endif /* !_NET_VNET_H_ */