1*0Sstevel@tonic-gate /* 2*0Sstevel@tonic-gate * CDDL HEADER START 3*0Sstevel@tonic-gate * 4*0Sstevel@tonic-gate * The contents of this file are subject to the terms of the 5*0Sstevel@tonic-gate * Common Development and Distribution License, Version 1.0 only 6*0Sstevel@tonic-gate * (the "License"). You may not use this file except in compliance 7*0Sstevel@tonic-gate * with the License. 8*0Sstevel@tonic-gate * 9*0Sstevel@tonic-gate * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE 10*0Sstevel@tonic-gate * or http://www.opensolaris.org/os/licensing. 11*0Sstevel@tonic-gate * See the License for the specific language governing permissions 12*0Sstevel@tonic-gate * and limitations under the License. 13*0Sstevel@tonic-gate * 14*0Sstevel@tonic-gate * When distributing Covered Code, include this CDDL HEADER in each 15*0Sstevel@tonic-gate * file and include the License file at usr/src/OPENSOLARIS.LICENSE. 16*0Sstevel@tonic-gate * If applicable, add the following below this CDDL HEADER, with the 17*0Sstevel@tonic-gate * fields enclosed by brackets "[]" replaced with your own identifying 18*0Sstevel@tonic-gate * information: Portions Copyright [yyyy] [name of copyright owner] 19*0Sstevel@tonic-gate * 20*0Sstevel@tonic-gate * CDDL HEADER END 21*0Sstevel@tonic-gate */ 22*0Sstevel@tonic-gate /* 23*0Sstevel@tonic-gate * Copyright 2000-2003 Sun Microsystems, Inc. All rights reserved. 24*0Sstevel@tonic-gate * Use is subject to license terms. 25*0Sstevel@tonic-gate */ 26*0Sstevel@tonic-gate 27*0Sstevel@tonic-gate #pragma ident "%Z%%M% %I% %E% SMI" 28*0Sstevel@tonic-gate 29*0Sstevel@tonic-gate #include <sys/types.h> 30*0Sstevel@tonic-gate #include <sys/stream.h> 31*0Sstevel@tonic-gate #include <sys/sysmacros.h> 32*0Sstevel@tonic-gate #include <sys/callb.h> 33*0Sstevel@tonic-gate #include <sys/ddi.h> 34*0Sstevel@tonic-gate #include <sys/sunddi.h> 35*0Sstevel@tonic-gate #include <sys/proc.h> 36*0Sstevel@tonic-gate #include <sys/modctl.h> 37*0Sstevel@tonic-gate #include <sys/disp.h> 38*0Sstevel@tonic-gate #include <inet/ipsec_impl.h> 39*0Sstevel@tonic-gate 40*0Sstevel@tonic-gate /* 41*0Sstevel@tonic-gate * Loader commands.. 42*0Sstevel@tonic-gate */ 43*0Sstevel@tonic-gate #define IPSEC_LOADER_EXITNOW -1 44*0Sstevel@tonic-gate #define IPSEC_LOADER_LOADNOW 1 45*0Sstevel@tonic-gate 46*0Sstevel@tonic-gate /* 47*0Sstevel@tonic-gate * The following variables are kept because IPsec should be loaded only when 48*0Sstevel@tonic-gate * it is used. 49*0Sstevel@tonic-gate */ 50*0Sstevel@tonic-gate static kt_did_t ipsec_loader_tid; 51*0Sstevel@tonic-gate kmutex_t ipsec_loader_lock; 52*0Sstevel@tonic-gate static int ipsec_loader_sig = IPSEC_LOADER_WAIT; 53*0Sstevel@tonic-gate int ipsec_loader_state = IPSEC_LOADER_WAIT; 54*0Sstevel@tonic-gate static kcondvar_t ipsec_loader_sig_cv; /* For loader_sig conditions. */ 55*0Sstevel@tonic-gate 56*0Sstevel@tonic-gate 57*0Sstevel@tonic-gate /* 58*0Sstevel@tonic-gate * NOTE: This function is entered w/o holding any STREAMS perimeters. 59*0Sstevel@tonic-gate */ 60*0Sstevel@tonic-gate /* ARGSUSED */ 61*0Sstevel@tonic-gate static void 62*0Sstevel@tonic-gate ipsec_loader(void *ignoreme) 63*0Sstevel@tonic-gate { 64*0Sstevel@tonic-gate extern int keysock_plumb_ipsec(void); 65*0Sstevel@tonic-gate callb_cpr_t cprinfo; 66*0Sstevel@tonic-gate boolean_t ipsec_failure = B_FALSE; 67*0Sstevel@tonic-gate 68*0Sstevel@tonic-gate CALLB_CPR_INIT(&cprinfo, &ipsec_loader_lock, callb_generic_cpr, 69*0Sstevel@tonic-gate "ipsec_loader"); 70*0Sstevel@tonic-gate mutex_enter(&ipsec_loader_lock); 71*0Sstevel@tonic-gate for (;;) { 72*0Sstevel@tonic-gate 73*0Sstevel@tonic-gate /* 74*0Sstevel@tonic-gate * Wait for someone to tell me to continue. 75*0Sstevel@tonic-gate */ 76*0Sstevel@tonic-gate while (ipsec_loader_sig == IPSEC_LOADER_WAIT) { 77*0Sstevel@tonic-gate CALLB_CPR_SAFE_BEGIN(&cprinfo); 78*0Sstevel@tonic-gate cv_wait(&ipsec_loader_sig_cv, &ipsec_loader_lock); 79*0Sstevel@tonic-gate CALLB_CPR_SAFE_END(&cprinfo, &ipsec_loader_lock); 80*0Sstevel@tonic-gate } 81*0Sstevel@tonic-gate 82*0Sstevel@tonic-gate /* IPSEC_LOADER_EXITNOW implies signal by _fini(). */ 83*0Sstevel@tonic-gate if (ipsec_loader_sig == IPSEC_LOADER_EXITNOW) { 84*0Sstevel@tonic-gate /* 85*0Sstevel@tonic-gate * Let user patch ipsec_loader_tid to 86*0Sstevel@tonic-gate * 0 to try again. 87*0Sstevel@tonic-gate */ 88*0Sstevel@tonic-gate ipsec_loader_state = IPSEC_LOADER_FAILED; 89*0Sstevel@tonic-gate ipsec_loader_sig = IPSEC_LOADER_WAIT; 90*0Sstevel@tonic-gate 91*0Sstevel@tonic-gate /* ipsec_loader_lock is held at this point! */ 92*0Sstevel@tonic-gate ASSERT(MUTEX_HELD(&ipsec_loader_lock)); 93*0Sstevel@tonic-gate CALLB_CPR_EXIT(&cprinfo); 94*0Sstevel@tonic-gate ASSERT(!MUTEX_HELD(&ipsec_loader_lock)); 95*0Sstevel@tonic-gate thread_exit(); 96*0Sstevel@tonic-gate } 97*0Sstevel@tonic-gate mutex_exit(&ipsec_loader_lock); 98*0Sstevel@tonic-gate 99*0Sstevel@tonic-gate /* 100*0Sstevel@tonic-gate * Load IPsec, which is done by modloading keysock and calling 101*0Sstevel@tonic-gate * keysock_plumb_ipsec(). 102*0Sstevel@tonic-gate */ 103*0Sstevel@tonic-gate 104*0Sstevel@tonic-gate /* Pardon my hardcoding... */ 105*0Sstevel@tonic-gate if (modload("drv", "keysock") == -1) { 106*0Sstevel@tonic-gate cmn_err(CE_WARN, "IP: Cannot load keysock."); 107*0Sstevel@tonic-gate /* 108*0Sstevel@tonic-gate * Only this function can set ipsec_failure. If the 109*0Sstevel@tonic-gate * damage can be repaired, use adb to set this to 110*0Sstevel@tonic-gate * B_FALSE and try again. 111*0Sstevel@tonic-gate */ 112*0Sstevel@tonic-gate ipsec_failure = B_TRUE; 113*0Sstevel@tonic-gate } else if (keysock_plumb_ipsec() != 0) { 114*0Sstevel@tonic-gate cmn_err(CE_WARN, "IP: Cannot plumb IPsec."); 115*0Sstevel@tonic-gate /* 116*0Sstevel@tonic-gate * Only this function can set ipsec_failure. If the 117*0Sstevel@tonic-gate * damage can be repaired, use adb to set this to 118*0Sstevel@tonic-gate * B_FALSE and try again. 119*0Sstevel@tonic-gate */ 120*0Sstevel@tonic-gate ipsec_failure = B_TRUE; 121*0Sstevel@tonic-gate } else { 122*0Sstevel@tonic-gate ipsec_failure = B_FALSE; 123*0Sstevel@tonic-gate } 124*0Sstevel@tonic-gate 125*0Sstevel@tonic-gate mutex_enter(&ipsec_loader_lock); 126*0Sstevel@tonic-gate if (ipsec_failure) { 127*0Sstevel@tonic-gate if (ipsec_loader_sig == IPSEC_LOADER_LOADNOW) 128*0Sstevel@tonic-gate ipsec_loader_sig = IPSEC_LOADER_WAIT; 129*0Sstevel@tonic-gate ipsec_loader_state = IPSEC_LOADER_FAILED; 130*0Sstevel@tonic-gate } else { 131*0Sstevel@tonic-gate ipsec_loader_state = IPSEC_LOADER_SUCCEEDED; 132*0Sstevel@tonic-gate } 133*0Sstevel@tonic-gate mutex_exit(&ipsec_loader_lock); 134*0Sstevel@tonic-gate 135*0Sstevel@tonic-gate ip_ipsec_load_complete(); 136*0Sstevel@tonic-gate 137*0Sstevel@tonic-gate mutex_enter(&ipsec_loader_lock); 138*0Sstevel@tonic-gate if (!ipsec_failure) { 139*0Sstevel@tonic-gate CALLB_CPR_EXIT(&cprinfo); 140*0Sstevel@tonic-gate ASSERT(!MUTEX_HELD(&ipsec_loader_lock)); 141*0Sstevel@tonic-gate ipsec_register_prov_update(); 142*0Sstevel@tonic-gate thread_exit(); 143*0Sstevel@tonic-gate } 144*0Sstevel@tonic-gate } 145*0Sstevel@tonic-gate } 146*0Sstevel@tonic-gate 147*0Sstevel@tonic-gate /* 148*0Sstevel@tonic-gate * Called from ip_ddi_init() to initialize ipsec loader thread. 149*0Sstevel@tonic-gate */ 150*0Sstevel@tonic-gate void 151*0Sstevel@tonic-gate ipsec_loader_init(void) 152*0Sstevel@tonic-gate { 153*0Sstevel@tonic-gate mutex_init(&ipsec_loader_lock, NULL, MUTEX_DEFAULT, NULL); 154*0Sstevel@tonic-gate cv_init(&ipsec_loader_sig_cv, NULL, CV_DEFAULT, NULL); 155*0Sstevel@tonic-gate } 156*0Sstevel@tonic-gate 157*0Sstevel@tonic-gate /* 158*0Sstevel@tonic-gate * Called from ip_ddi_destroy() to take down ipsec loader thread. 159*0Sstevel@tonic-gate */ 160*0Sstevel@tonic-gate void 161*0Sstevel@tonic-gate ipsec_loader_destroy(void) 162*0Sstevel@tonic-gate { 163*0Sstevel@tonic-gate kt_did_t tid; 164*0Sstevel@tonic-gate 165*0Sstevel@tonic-gate mutex_enter(&ipsec_loader_lock); 166*0Sstevel@tonic-gate tid = ipsec_loader_tid; 167*0Sstevel@tonic-gate if (tid != 0) { 168*0Sstevel@tonic-gate ipsec_loader_sig = IPSEC_LOADER_EXITNOW; 169*0Sstevel@tonic-gate cv_signal(&ipsec_loader_sig_cv); 170*0Sstevel@tonic-gate ipsec_loader_tid = 0; 171*0Sstevel@tonic-gate } 172*0Sstevel@tonic-gate mutex_exit(&ipsec_loader_lock); 173*0Sstevel@tonic-gate 174*0Sstevel@tonic-gate /* 175*0Sstevel@tonic-gate * Wait for ipsec_loader() to finish before we destroy 176*0Sstevel@tonic-gate * cvs and mutexes. 177*0Sstevel@tonic-gate */ 178*0Sstevel@tonic-gate if (tid != 0) 179*0Sstevel@tonic-gate thread_join(tid); 180*0Sstevel@tonic-gate 181*0Sstevel@tonic-gate mutex_destroy(&ipsec_loader_lock); 182*0Sstevel@tonic-gate cv_destroy(&ipsec_loader_sig_cv); 183*0Sstevel@tonic-gate } 184*0Sstevel@tonic-gate 185*0Sstevel@tonic-gate void 186*0Sstevel@tonic-gate ipsec_loader_start(void) 187*0Sstevel@tonic-gate { 188*0Sstevel@tonic-gate kthread_t *tp; 189*0Sstevel@tonic-gate 190*0Sstevel@tonic-gate mutex_enter(&ipsec_loader_lock); 191*0Sstevel@tonic-gate 192*0Sstevel@tonic-gate if (ipsec_loader_tid == 0) { 193*0Sstevel@tonic-gate tp = thread_create(NULL, 0, ipsec_loader, NULL, 0, &p0, 194*0Sstevel@tonic-gate TS_RUN, MAXCLSYSPRI); 195*0Sstevel@tonic-gate ipsec_loader_tid = tp->t_did; 196*0Sstevel@tonic-gate } 197*0Sstevel@tonic-gate /* Else we lost the race, oh well. */ 198*0Sstevel@tonic-gate mutex_exit(&ipsec_loader_lock); 199*0Sstevel@tonic-gate } 200*0Sstevel@tonic-gate 201*0Sstevel@tonic-gate void 202*0Sstevel@tonic-gate ipsec_loader_loadnow() 203*0Sstevel@tonic-gate { 204*0Sstevel@tonic-gate /* 205*0Sstevel@tonic-gate * It is possible that an algorithm update message was 206*0Sstevel@tonic-gate * received before IPsec is loaded. Such messages are 207*0Sstevel@tonic-gate * saved in spdsock for later processing. Since IPsec 208*0Sstevel@tonic-gate * loading can be initiated by interfaces different 209*0Sstevel@tonic-gate * than spdsock, we must trigger the processing of 210*0Sstevel@tonic-gate * update messages from the ipsec loader. 211*0Sstevel@tonic-gate */ 212*0Sstevel@tonic-gate spdsock_update_pending_algs(); 213*0Sstevel@tonic-gate 214*0Sstevel@tonic-gate mutex_enter(&ipsec_loader_lock); 215*0Sstevel@tonic-gate if ((ipsec_loader_state == IPSEC_LOADER_WAIT) && 216*0Sstevel@tonic-gate (ipsec_loader_sig == IPSEC_LOADER_WAIT)) { 217*0Sstevel@tonic-gate ipsec_loader_sig = IPSEC_LOADER_LOADNOW; 218*0Sstevel@tonic-gate cv_signal(&ipsec_loader_sig_cv); 219*0Sstevel@tonic-gate } 220*0Sstevel@tonic-gate mutex_exit(&ipsec_loader_lock); 221*0Sstevel@tonic-gate } 222*0Sstevel@tonic-gate 223*0Sstevel@tonic-gate /* 224*0Sstevel@tonic-gate * Dummy callback routine (placeholder) to avoid keysock plumbing 225*0Sstevel@tonic-gate * races. Used in conjunction with qtimeout() and qwait() to wait 226*0Sstevel@tonic-gate * until ipsec has loaded -- the qwait() in ipsec_loader_loadwait will 227*0Sstevel@tonic-gate * wake up once this routine returns. 228*0Sstevel@tonic-gate */ 229*0Sstevel@tonic-gate 230*0Sstevel@tonic-gate /* ARGSUSED */ 231*0Sstevel@tonic-gate static void 232*0Sstevel@tonic-gate loader_nop(void *ignoreme) 233*0Sstevel@tonic-gate { 234*0Sstevel@tonic-gate } 235*0Sstevel@tonic-gate 236*0Sstevel@tonic-gate /* 237*0Sstevel@tonic-gate * Called from keysock driver open to delay until ipsec is done loading. 238*0Sstevel@tonic-gate * Returns B_TRUE if it worked, B_FALSE if it didn't. 239*0Sstevel@tonic-gate */ 240*0Sstevel@tonic-gate boolean_t 241*0Sstevel@tonic-gate ipsec_loader_wait(queue_t *q) 242*0Sstevel@tonic-gate { 243*0Sstevel@tonic-gate /* 244*0Sstevel@tonic-gate * 30ms delay per loop is arbitrary; it takes ~300ms to 245*0Sstevel@tonic-gate * load and plumb ipsec on an ultra-1. 246*0Sstevel@tonic-gate */ 247*0Sstevel@tonic-gate 248*0Sstevel@tonic-gate while (ipsec_loader_state == IPSEC_LOADER_WAIT) { 249*0Sstevel@tonic-gate (void) qtimeout(q, loader_nop, 0, drv_usectohz(30000)); 250*0Sstevel@tonic-gate qwait(q); 251*0Sstevel@tonic-gate } 252*0Sstevel@tonic-gate 253*0Sstevel@tonic-gate return (ipsec_loader_state == IPSEC_LOADER_SUCCEEDED); 254*0Sstevel@tonic-gate } 255*0Sstevel@tonic-gate 256*0Sstevel@tonic-gate /* 257*0Sstevel@tonic-gate * Just check to see if IPsec is loaded (or not). 258*0Sstevel@tonic-gate */ 259*0Sstevel@tonic-gate boolean_t 260*0Sstevel@tonic-gate ipsec_loaded(void) 261*0Sstevel@tonic-gate { 262*0Sstevel@tonic-gate return (ipsec_loader_state == IPSEC_LOADER_SUCCEEDED); 263*0Sstevel@tonic-gate } 264*0Sstevel@tonic-gate 265*0Sstevel@tonic-gate /* 266*0Sstevel@tonic-gate * Check to see if IPsec loading failed. 267*0Sstevel@tonic-gate */ 268*0Sstevel@tonic-gate boolean_t 269*0Sstevel@tonic-gate ipsec_failed(void) 270*0Sstevel@tonic-gate { 271*0Sstevel@tonic-gate return (ipsec_loader_state == IPSEC_LOADER_FAILED); 272*0Sstevel@tonic-gate } 273