 @@ -1,14 +1,14 @@
-/*	$NetBSD: ipsec.c,v 1.113 2017/08/02 01:28:03 ozaki-r Exp $	*/
+/*	$NetBSD: ipsec.c,v 1.114 2017/08/02 03:45:57 ozaki-r Exp $	*/
 /*	$FreeBSD: /usr/local/www/cvsroot/FreeBSD/src/sys/netipsec/ipsec.c,v 1.2.2.2 2003/07/01 01:38:13 sam Exp $	*/
 /*	$KAME: ipsec.c,v 1.103 2001/05/24 07:14:18 sakane Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *	notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -22,27 +22,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.113 2017/08/02 01:28:03 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: ipsec.c,v 1.114 2017/08/02 03:45:57 ozaki-r Exp $");
 /*
  * IPsec controller part.
  */
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
 #include "opt_ipsec.h"
 #endif
 #include <sys/param.h>
 #include <sys/systm.h>
 #include <sys/mbuf.h>
 @@ -1243,36 +1243,38 @@ ipsec_init_policy(struct socket *so, str
 		IPSECLOG(LOG_DEBUG, "No more memory.\n");
 		return ENOBUFS;
+	}
 	if (IPSEC_PRIVILEGED_SO(so))
 		new->priv = 1;
 	else
 		new->priv = 0;
 	/*
 	 * These SPs are dummy. Never be used because the policy
 	 * is ENTRUST. See ipsec_getpolicybysock.
 	 */
-	if ((new->sp_in = KEY_NEWSP()) == NULL) {
+	new->sp_in = kmem_intr_zalloc(sizeof(struct secpolicy), KM_NOSLEEP);
 	if (new->sp_in == NULL) {
 		ipsec_delpcbpolicy(new);
 		return ENOBUFS;
+	}
 	new->sp_in->state = IPSEC_SPSTATE_ALIVE;
 	new->sp_in->policy = IPSEC_POLICY_ENTRUST;
 	new->sp_in->created = 0; /* Indicates dummy */
-	if ((new->sp_out = KEY_NEWSP()) == NULL) {
+	new->sp_out = kmem_intr_zalloc(sizeof(struct secpolicy), KM_NOSLEEP);
-		KEY_SP_UNREF(&new->sp_in);
+	if (new->sp_out == NULL) {
 		kmem_intr_free(new->sp_in, sizeof(struct secpolicy));
 		ipsec_delpcbpolicy(new);
 		return ENOBUFS;
+	}
 	new->sp_out->state = IPSEC_SPSTATE_ALIVE;
 	new->sp_out->policy = IPSEC_POLICY_ENTRUST;
 	new->sp_out->created = 0; /* Indicates dummy */
 	*policy = new;
 	return 0;
+}
 /* copy old ipsec policy into new */
 @@ -1341,27 +1343,27 @@ ipsec_deepcopy_policy(const struct secpo
 	dst->state = src->state;
 	dst->policy = src->policy;
 	/* do not touch the refcnt fields */
 	return dst;
+}
 static void
 ipsec_destroy_policy(struct secpolicy *sp)
+{
 	if (sp->created == 0)
 		/* It's dummy. We can simply free it */
-		key_free_sp(sp);
+		kmem_intr_free(sp, sizeof(*sp));
 	else {
 		/*
 		 * We cannot destroy here because it can be called in
 		 * softint. So mark the SP as DEAD and let the timer
 		 * destroy it. See key_timehandler_spd.
 		 */
 		sp->state = IPSEC_SPSTATE_DEAD;
+	}
+}
 /* set policy and ipsec request if present. */
 static int
 ipsec_set_policy(

 @@ -1,14 +1,14 @@
-/*	$NetBSD: key.c,v 1.199 2017/08/02 02:12:42 ozaki-r Exp $	*/
+/*	$NetBSD: key.c,v 1.200 2017/08/02 03:45:57 ozaki-r Exp $	*/
 /*	$FreeBSD: src/sys/netipsec/key.c,v 1.3.2.3 2004/02/14 22:23:23 bms Exp $	*/
 /*	$KAME: key.c,v 1.191 2001/06/27 10:46:49 sakane Exp $	*/
 /*
  * Copyright (C) 1995, 1996, 1997, and 1998 WIDE Project.
  * All rights reserved.
+ *
  * Redistribution and use in source and binary forms, with or without
  * modification, are permitted provided that the following conditions
  * are met:
  * 1. Redistributions of source code must retain the above copyright
  *    notice, this list of conditions and the following disclaimer.
  * 2. Redistributions in binary form must reproduce the above copyright
 @@ -22,27 +22,27 @@
  * ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE
  * IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE
  * ARE DISCLAIMED.  IN NO EVENT SHALL THE PROJECT OR CONTRIBUTORS BE LIABLE
  * FOR ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL
  * DAMAGES (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS
  * OR SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
  * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT
  * LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY
  * OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF
  * SUCH DAMAGE.
  */
 #include <sys/cdefs.h>
-__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.199 2017/08/02 02:12:42 ozaki-r Exp $");
+__KERNEL_RCSID(0, "$NetBSD: key.c,v 1.200 2017/08/02 03:45:57 ozaki-r Exp $");
 /*
  * This code is referd to RFC 2367
  */
 #if defined(_KERNEL_OPT)
 #include "opt_inet.h"
 #include "opt_ipsec.h"
 #include "opt_gateway.h"
 #include "opt_net_mpsafe.h"
 #endif
 #include <sys/types.h>
 @@ -1366,31 +1366,31 @@ key_destroy_sp(struct secpolicy *sp)
 	key_free_sp(sp);
 	key_update_used();
+}
 void
 key_free_sp(struct secpolicy *sp)
+{
 	struct ipsecrequest *isr = sp->req, *nextisr;
 	while (isr != NULL) {
 		nextisr = isr->next;
-		kmem_intr_free(isr, sizeof(*isr));
+		kmem_free(isr, sizeof(*isr));
 		isr = nextisr;
+	}
-	kmem_intr_free(sp, sizeof(*sp));
+	kmem_free(sp, sizeof(*sp));
+}
 void
 key_socksplist_add(struct secpolicy *sp)
+{
 	mutex_enter(&key_sp_mtx);
 	PSLIST_WRITER_INSERT_HEAD(&key_socksplist, sp, pslist_entry);
 	mutex_exit(&key_sp_mtx);
 	key_update_used();
+}
 @@ -1506,27 +1506,27 @@ key_lookupbyid_and_remove_sp(u_int32_t i
+	}
 out:
 	if (sp != NULL)
 		key_unlink_sp(sp);
 	mutex_exit(&key_sp_mtx);
 	return sp;
+}
 struct secpolicy *
 key_newsp(const char* where, int tag)
+{
 	struct secpolicy *newsp = NULL;
-	newsp = kmem_intr_zalloc(sizeof(struct secpolicy), KM_NOSLEEP);
+	newsp = kmem_zalloc(sizeof(struct secpolicy), KM_SLEEP);
 	KEYDEBUG_PRINTF(KEYDEBUG_IPSEC_STAMP,
 	    "DP from %s:%u return SP:%p\n", where, tag, newsp);
 	return newsp;
+}
 /*
  * create secpolicy structure from sadb_x_policy structure.
  * NOTE: `state', `secpolicyindex' in secpolicy structure are not set,
  * so must be set properly later.
  */
 struct secpolicy *
 key_msg2sp(const struct sadb_x_policy *xpl0, size_t len, int *error)