Introduce vnet module registration / initialization framework with

dependency tracking and ordering enforcement.

With this change, per-vnet initialization functions introduced with
r190787 are no longer directly called from traditional initialization
functions (which cc in most cases inlined to pre-r190787 code), but are
instead registered via the vnet framework first, and are invoked only
after all prerequisite modules have been initialized.  In the long run,
this framework should allow us to both initialize and dismantle
multiple vnet instances in a correct order.

The problem this change aims to solve is how to replay the
initialization sequence of various network stack components, which
have been traditionally triggered via different mechanisms (SYSINIT,
protosw).  Note that this initialization sequence was and still can be
subtly different depending on whether certain pieces of code have been
statically compiled into the kernel, loaded as modules by boot
loader, or kldloaded at run time.

The approach is simple - we record the initialization sequence
established by the traditional mechanisms whenever vnet_mod_register()
is called for a particular vnet module.  The vnet_mod_register_multi()
variant allows a single initializer function to be registered multiple
times but with different arguments - currently this is only used in
kern/uipc_domain.c by net_add_domain() with different struct domain *
as arguments, which allows for protosw-registered initialization
routines to be invoked in a correct order by the new vnet
initialization framework.

For the purpose of identifying vnet modules, each vnet module has to
have a unique ID, which is statically assigned in sys/vimage.h.
Dynamic assignment of vnet module IDs is not supported yet.

A vnet module may specify a single prerequisite module at registration
time by filling in the vmi_dependson field of its vnet_modinfo struct
with the ID of the module it depends on.  Unless specified otherwise,
all vnet modules depend on VNET_MOD_NET (container for ifnet list head,
rt_tables etc.), which thus has to and will always be initialized
first.  The framework will panic if it detects any unresolved
dependencies before completing system initialization.  Detection of
unresolved dependencies for vnet modules registered after boot
(kldloaded modules) is not provided.

Note that the fact that each module can specify only a single
prerequisite may become problematic in the long run.  In particular,
INET6 depends on INET being already instantiated, due to TCP / UDP
structures residing in INET container.  IPSEC also depends on INET,
which will in turn additionally complicate making INET6-only kernel
configs a reality.

The entire registration framework can be compiled out by turning on the
VIMAGE_GLOBALS kernel config option.

Reviewed by:	bz
Approved by:	julian (mentor)

5 files changed, 67 insertions, 0 deletions

diff --git a/sys/netipsec/ipsec.c b/sys/netipsec/ipsec.c
index 85d2897..a76afd2 100644
--- a/sys/netipsec/ipsec.c
+++ b/sys/netipsec/ipsec.c
@@ -244,6 +244,15 @@ static void vshiftl __P((unsigned char *, int, int));
 
 MALLOC_DEFINE(M_IPSEC_INPCB, "inpcbpolicy", "inpcb-resident ipsec policy");
 
+#ifndef VIMAGE_GLOBALS
+static const vnet_modinfo_t vnet_ipsec_modinfo = {
+	.vmi_id		= VNET_MOD_IPSEC,
+	.vmi_name	= "ipsec",
+	.vmi_dependson	= VNET_MOD_INET,	/* XXX revisit - INET6 ? */
+	.vmi_iattach	= ipsec_iattach
+};
+#endif /* !VIMAGE_GLOBALS */
+
 void
 ipsec_init(void)
 {
@@ -1760,7 +1769,12 @@ static void
 ipsec_attach(void)
 {
 
+#ifndef VIMAGE_GLOBALS
+	vnet_mod_register(&vnet_ipsec_modinfo);
+#else
 	ipsec_iattach(NULL);
+#endif
+
 }
 
 static int
diff --git a/sys/netipsec/xform_ah.c b/sys/netipsec/xform_ah.c
index 365ac13..07d7001 100644
--- a/sys/netipsec/xform_ah.c
+++ b/sys/netipsec/xform_ah.c
@@ -75,6 +75,15 @@
 
 static int ah_iattach(const void *);
 
+#ifndef VIMAGE_GLOBALS
+static const vnet_modinfo_t vnet_ah_modinfo = {
+	.vmi_id		= VNET_MOD_AH,
+	.vmi_name	= "ipsec_ah",
+	.vmi_dependson	= VNET_MOD_IPSEC,
+	.vmi_iattach	= ah_iattach
+};
+#endif /* !VIMAGE_GLOBALS */
+
 /*
  * Return header size in bytes.  The old protocol did not support
  * the replay counter; the new protocol always includes the counter.
@@ -1223,7 +1232,11 @@ ah_attach(void)
 {
 
 	xform_register(&ah_xformsw);
+#ifndef VIMAGE_GLOBALS
+	vnet_mod_register(&vnet_ah_modinfo);
+#else
 	ah_iattach(NULL);
+#endif
 }
 
 static int
diff --git a/sys/netipsec/xform_esp.c b/sys/netipsec/xform_esp.c
index 46ab8d8..6508c14 100644
--- a/sys/netipsec/xform_esp.c
+++ b/sys/netipsec/xform_esp.c
@@ -92,6 +92,15 @@ static int esp_input_cb(struct cryptop *op);
 static int esp_output_cb(struct cryptop *crp);
 static int esp_iattach(const void *);
 
+#ifndef VIMAGE_GLOBALS
+static const vnet_modinfo_t vnet_esp_modinfo = {
+	.vmi_id		= VNET_MOD_ESP,
+	.vmi_name	= "ipsec_esp",
+	.vmi_dependson	= VNET_MOD_IPSEC,
+	.vmi_iattach	= esp_iattach
+};
+#endif /* !VIMAGE_GLOBALS */
+
 /*
  * NB: this is public for use by the PF_KEY support.
  * NB: if you add support here; be sure to add code to esp_attach below!
@@ -993,7 +1002,11 @@ esp_attach(void)
 {
 
 	xform_register(&esp_xformsw);
+#ifndef VIMAGE_GLOBALS
+	vnet_mod_register(&vnet_esp_modinfo);
+#else
 	esp_iattach(NULL);
+#endif
 }
 
 static int
diff --git a/sys/netipsec/xform_ipcomp.c b/sys/netipsec/xform_ipcomp.c
index c4f0591..8e2f1c4 100644
--- a/sys/netipsec/xform_ipcomp.c
+++ b/sys/netipsec/xform_ipcomp.c
@@ -82,6 +82,15 @@ static int ipcomp_input_cb(struct cryptop *crp);
 static int ipcomp_output_cb(struct cryptop *crp);
 static int ipcomp_iattach(const void *);
 
+#ifndef VIMAGE_GLOBALS
+static const vnet_modinfo_t vnet_ipcomp_modinfo = {
+	.vmi_id		= VNET_MOD_IPCOMP,
+	.vmi_name	= "ipsec_ipcomp",
+	.vmi_dependson	= VNET_MOD_IPSEC,
+	.vmi_iattach	= ipcomp_iattach
+};
+#endif /* !VIMAGE_GLOBALS */
+
 struct comp_algo *
 ipcomp_algorithm_lookup(int alg)
 {
@@ -602,7 +611,11 @@ ipcomp_attach(void)
 {
 
 	xform_register(&ipcomp_xformsw);
+#ifndef VIMAGE_GLOBALS
+	vnet_mod_register(&vnet_ipcomp_modinfo);
+#else
 	ipcomp_iattach(NULL);
+#endif
 }
 
 static int
diff --git a/sys/netipsec/xform_ipip.c b/sys/netipsec/xform_ipip.c
index f7949ec..4d97168 100644
--- a/sys/netipsec/xform_ipip.c
+++ b/sys/netipsec/xform_ipip.c
@@ -108,6 +108,16 @@ SYSCTL_V_STRUCT(V_NET, vnet_ipsec, _net_inet_ipip, IPSECCTL_STATS,
 #define	M_IPSEC	(M_AUTHIPHDR|M_AUTHIPDGM|M_DECRYPTED)
 
 static void _ipip_input(struct mbuf *m, int iphlen, struct ifnet *gifp);
+static int ipe4_iattach(const void *);
+
+#ifndef VIMAGE_GLOBALS
+static const vnet_modinfo_t vnet_ipip_modinfo = {
+	.vmi_id		= VNET_MOD_IPIP,
+	.vmi_name	= "ipsec_ipip",
+	.vmi_dependson	= VNET_MOD_IPSEC,
+	.vmi_iattach	= ipe4_iattach
+};
+#endif /* !VIMAGE_GLOBALS */
 
 #ifdef INET6
 /*
@@ -719,7 +729,11 @@ ipe4_attach(void)
 	(void) encap_attach_func(AF_INET6, -1,
 		ipe4_encapcheck, (struct protosw *)&ipe6_protosw, NULL);
 #endif
+#ifndef VIMAGE_GLOBALS
+	vnet_mod_register(&vnet_ipip_modinfo);
+#else
 	ipe4_iattach(NULL);
+#endif
 }
 SYSINIT(ipe4_xform_init, SI_SUB_PROTO_DOMAIN, SI_ORDER_MIDDLE, ipe4_attach, NULL);
 #endif	/* IPSEC */