CVS log for src/sys/kern/kern_module.c

Up to [cvs.NetBSD.org] / src / sys / kern

Request diff between arbitrary revisions

Keyword substitution: kv
Default branch: MAIN

Allow MODDULAR_AUTOUNLOAD_UNSAFE as a kernel build option.  Defaults to
false, so no change in current behaviour if not selected.

Consistently capitalize the beginning of a kernel message.  NFCI

And fix the formatting.

/me needs to stop committing when severely sleep-deprived

and add the trailing "

One more debug message to different manual vs auto unload

Be consistent in formatting `module' names in diagnostic messages

NFCI

More detailed debug messages.  Especially for module_load where we now
print the load request info before we try anything, rather than only if
we takea particulaar exit path.  (Several other exit paths resulted in
no messages at all;  they are now covered.)

s/signficant/significant/ in comment.

Pull up following revision(s) (requested by riastradh in ticket #100):

	sys/kern/kern_module.c: revision 1.161

module(9): Make error message for multiple MODULE decls more obvious.

module(9): Make error message for multiple MODULE decls more obvious.

sys/*: Get module_map consistently from sys/module.h.

Resequence the sysctl_setup and evcnt stuff so that they always occur
_before_ the module's MODULE_CMD_INIT call.  Also update the unload
code to invoke the sysctl_setup and evcnt stuff _after_ the module's
MODULE_CMD_FINI call.  This makes the behaviour and order consistent
whether the module is built-in or loaded at run-time.

As reported by riastradh@

module(9): Don't autounload unaudited modules by default.

Modules that have not been audited for autounload safety don't
recognize the command MODULE_CMD_AUTOUNLOAD and return ENOTTY.  These
modules are not safe to autounload, so don't autounload them.  Since
unload is risky business (if not careful, can lead to use-after-free,
kernel memory corruption, &c.), it needs to be opt-in by default, not
opt-out.

Modules that have been audited can return 0 or EBUSY to explicitly
allow or deny autounload.  Users who want to live on the edge to try
to exercise module autounload even for unaudited modules -- and are
willing to accept the consequences, and maybe contribute to auditing!
-- can set the new sysctl knob kern.module.autounload_unsafe=1.

Discussed on tech-kern:
https://mail-index.netbsd.org/tech-kern/2022/08/08/msg028282.html

Revert "module(9): Disable module autounload by default."

Needs more discussion.  Maybe better with an opt-in mechanism to
replace the opt-out mechanism than by disabling it altogether by
default.

module(9): Disable module autounload by default.

I don't know why this was ever enabled by default; many modules are
still not safe to unload, let alone autounload.  If any autounload is
to happen by default, it should only be for modules that have opted
into it in some way after audit.

module(9): Call callbacks in topological order on load.

They are called in reverse topological order on unload.

dtrace_sdt will rely on this soon to ensure provider definitions are
processed before their uses.

ok chs@

Add MODULAR_DEFAULT_VERBOSE option.

fix typos in word "successfully", mainly s/succesfully/successfully/.

Sync w/ HEAD.

Remove extraneous '\n' from debug message.

uvm_availmem(): give it a boolean argument to specify whether a recent
cached value will do, or if the very latest total must be fetched.  It can
be called thousands of times a second and fetching the totals impacts not
only the calling LWP but other CPUs doing unrelated activity in the VM
system.

Update for proplib(3) API changes.

Mostly merge changes from HEAD upto 20200411

Infrastructure for putting kernel+modules in /netbsd/kernel and
/netbsd/modules respectively instead of /netbsd and
/stand/<arch>/<version>/modules.  This is only supported for x86,
and is turned off by default. To try it, add KERNEL_DIR=yes in your
/mk.conf and install a system from that build.

Improve error message - at least indicate which value comes from the
module vs which was requested/wanted by the caller.

Sync with head.

Teach module infrastructure to attach any static evcnts that might be
defined in a module, similar to the automatic invocation of sysctl(9)
setup functions.  As requested by riastradh@

Sync with head.

Enhance debug message when autoloading a module.  Identify the pid
of the process that triggered the autoload, as well as its p_comm
and the status.

This is only triggered if you've requested DEBUG messages by setting
the kern.module.verbose sysctl(8) variable.

oops, undo this (committed accidentally)

Don't crash if we are on a hippie trail, head full of zombie

Rename uvm_free() -> uvm_availmem().

uvmexp.free -> uvm_free()

Eliminate per-hook duplication of common code as suggested by
(and with major contributions from) riastradh@

Welcome to 9.99.23

Make sure to #include to get required definitions.

Should fix the build break reported by martin@

Rather than keeping a separate mutex, condvar, and pserialize for each
module hook, we can share a common set of synchronization structures.
This cuts the amount of cacheline_aligned data for these structures by
50%.

Note that we still have a per-hook localcount, since we need to count
individual references.

As discussed with riastradh@

Welcome to 9.99.22 !

When modules are unloaded, we call sysctl_teardown() before calling
the module's modcmd(CMD_FINI) code.  If the modcmd() call returns an
error, we attempted to re-instate the module's sysctl stuff.

This doesn't work well for built-in modulesi (where "unload" actually
means "disable"), since they don't have any ``struct kobj''.

So check first, and don't try to find the __link_set_sysctl_funcs for
built-in modules.

Many years ago someone created a new __link_set_sysctl_funcs to hold
the list of routines that need to be called for setting up sysctl
variables.  This worked great for all code included in the kernel
itself, but didn't deal with modules that want to create their own
sysctl data.  So, we ended up with a lot of #ifdef _MODULE blocks
so modules could explicitly call their setup functions when loaded
as non-built-in modules.

So today, we complete the task that was started so many years ago.

When modules are loaded, after we've called xxx_modcmd(INIT...) we
check if the module contains its own __link_set_sysctl_funcs, and
if so we call the functions listed.  We add a struct sysctllog member
to the struct module so we can call sysctl_teardown() when the module
gets unloaded.  (The sequence of events ensures that the sysctl stuff
doesn't get created until the rest of the module's init code does any
required memory allocation.)

So, no more need to explicitly call the sysctl setup routines when
built as a loadable module.

In case of error resolving symbol references, we cannot rely on the
module's name still being available - it may be destroyed when
kobj_affix() unloads the object.  So make a copy of the name first
so we can use it in a useful error message.

(Without this, I've have affix errors go into an infinite loop
trying to print the error message!)

Improve error message

Sync with HEAD

Improve kernel module validation.  First, set a limit on how much of the
module name field to check when validation name's length.  Second, check
the module's mi_class to ensure it is valid.

Update the commenet in sys/module.h to indicate that the module classes
are now being validated.

Merge the [pgoyette-compat] branch

Better diagnostic message

When freeing the required list, make sure we calculate its size based
on the size of the contained elements, not on the size of a pointer to
those elements.

At the request of reviewers, remove the module alias functionality.

We will rely only on module names and duplicate-symbol detection to
detect module conflicts.

Sync with HEAD

Resolve a couple of conflicts (result of the uimin/uimax changes)

One more time - let's get this right!

After releasing the resources, make sure we don't retain pointer to them!

ooppss - don't forget the structure pointer!

If a built-in module is "unloaded", release all the resources associated
with the "required" list.  The list will be re-parsed if the module is
later re-enabled.

Use correct structure member for module's name.

Add some helpful error messages when things fail.

If loading a built-in module fails, make sure we reset all the stuff
related to its pre-requisite modules.  Otherwise if we try to load it
again we will panic.

Rename min/max -> uimin/uimax for better honesty.

These functions are defined on unsigned int.  The generic name
min/max should not silently truncate to 32 bits on 64-bit systems.
This is purely a name change -- no functional change intended.

HOWEVER!  Some subsystems have

	#define min(a, b)	((a) < (b) ? (a) : (b))
	#define max(a, b)	((a) > (b) ? (a) : (b))

even though our standard name for that is MIN/MAX.  Although these
may invite multiple evaluation bugs, these do _not_ cause integer
truncation.

To avoid `fixing' these cases, I first changed the name in libkern,
and then compile-tested every file where min/max occurred in order to
confirm that it failed -- and thus confirm that nothing shadowed
min/max -- before changing it.

I have left a handful of bootloaders that are too annoying to
compile-test, and some dead code:

cobalt ews4800mips hp300 hppa ia64 luna68k vax
acorn32/if_ie.c (not included in any kernels)
macppc/if_gm.c (superseded by gem(4))

It should be easy to fix the fallout once identified -- this way of
doing things fails safe, and the goal here, after all, is to _avoid_
silent integer truncations, not introduce them.

Maybe one day we can reintroduce min/max as type-generic things that
never silently truncate.  But we should avoid doing that for a while,
so that existing code has a chance to be detected by the compiler for
conversion to uimin/uimax without changing the semantics until we can
properly audit it all.  (Who knows, maybe in some cases integer
truncation is actually intended!)

Put the checks back in the original order, and remove extra ')'

Thanks to soda for finding the real error.

Reverse order of flags checking to appease compiler.  It seems
that gcc doesn't like

	if (expr && !ISSET(t, f)) ...

Use SET, CLR, ISSET macros from types.h

NFCI

Finish de-confliction

Resolve conflicts with HEAD

add more accessor functions for various struct module fields.
add a mechanism for registering callbacks to be called upon module load/unload.

Typos (new = old, not old = new!), whitespace, and consistency in
references to the dynamically allocated array of required modules.

Remove fixed limit on number of modules which can be "required" by
a module.  Instead, allocate the array dynamically, and expand it
when needed.

XXX Note the modctl(2)'s MODCTL_STAT routine needs to be updated
(and versioned) to handle the unlimited size.  For now, the kernel
will simply truncate the required list if it doesn't fit in the
existing export structure.

Rather than allocating and freeing the recursion stack entry from the pool,
just use an entry allocated on the procedure's stack.  The recursion entry
is very short-lived anyway, and always gets freed before the procedure
exits.

Use an SLIST-based stack rather than a statically-allocated array for
recursion control.  This eliminates the MAXDEPTH constraint.

XXX We still have a static limit on MAXMODDEPS

Clean up the EXIST paths (module and/or alias already exists) and make
sure we always return a pointer to the duplicate.

Since we use pointer semantics when walking the alias lists, declare
the pointer variable accordingly.

(Re)implement the alias list as a "const char * const (*list)[]" and
store a pointer to this list in the mod_info structure (which lives
in the modules' linkset data).  Don't allow any duplication of module
names _or_ aliases when loading; for dependencies, they will be met
if the required module name matches any loaded module name or alias.

Store the aliases list in the mod_info struct, since it is totally
static data.  This saves us having to make a special xxx_modcmd()
call to retrieve the data.  Update module(9) man page accordingly.

Pull up following revision(s) (requested by pgoyette in ticket #449):
	sys/kern/kern_module.c: 1.126-1.130
Add additional duplicate-module-name check in case we have two modules
with the same internal name but no conflicting symbol definitions.
When we load a module from the file system, the filename may have no
relationship to the internal module's name.  Furthermore, comparing
the module's filename is insufficient if the file is loaded from an
absolute path.
--
Use KASSERT to ensure that the newly-added module's name can be found.
--
Change a KASSERTMSG into a regular module_error - not nice for the
kernel
to panic when I try to modload the 'ntfs' module.
--
When looking for a duplicate module name, also check the pending list.
--
Remove the check for duplicate-module-name-on-pending-list since it really
doesn't help.  The check really cannot fail, and it only looks at the list
belonging to the current level of recursion.
Instead, verify that the module's modcmd(MODULE_CMD_INIT, ...) does not
introduce a duplicate module name as a result of recursively calling
module_do_load().

Remove the check for duplicate-module-name-on-pending-list since it really
doesn't help.  The check really cannot fail, and it only looks at the list
belonging to the current level of recursion.

Instead, verify that the module's modcmd(MODULE_CMD_INIT, ...) does not
introduce a duplicate module name as a result of recursively calling
module_do_load().

When looking for a duplicate module name, also check the pending list.

Change a KASSERTMSG into a regular module_error - not nice for the kernel
to panic when I try to modload the 'ntfs' module.

Use KASSERT to ensure that the newly-added module's name can be found.

XXX Pull-up to -8

Add additional duplicate-module-name check in case we have two modules
with the same internal name but no conflicting symbol definitions.

When we load a module from the file system, the filename may have no
relationship to the internal module's name.  Furthermore, comparing
the module's filename is insufficient if the file is loaded from an
absolute path.

XXX pullup to netbsd-8

update from HEAD

Sync with HEAD

remove checks for failure after memory allocation calls that cannot fail:

  kmem_alloc() with KM_SLEEP
  kmem_zalloc() with KM_SLEEP
  percpu_alloc()
  pserialize_create()
  psref_class_create()

all of these paths include an assertion that the allocation has not failed,
so callers should not assert that again.

Sync with HEAD

Sync with HEAD

PR/52174: Remove root test, it is too verbose. XXX: need to come up with
something better.

use a different root vnode variable to appease the rump gods.

return EPERM like the other failures.

Don't try to autoload modules before root is mounted.

Sync with HEAD

Sync with HEAD

restore r1.118

Sync with HEAD.  (Note that most of these changes are simply $NetBSD$
tag issues.)

Revert previous commit (to r1.117)

Superfluous warnings in simple userland programs is not a valid reason to
break a security model.

When loading a kernel, test if it's already loaded before authorizing.
This allows us to return EEXIST instead of EPERM for higher secure levels.

My use case was to stop npfctl complaining that it could not load bpfjit
on ERLITE when it was compiled into the kernel.
It then went on to complain that NPF performance would be de-graded,
but this is clearly not the case.

Sync with HEAD

tidy up messages and indentation

Sync with HEAD

Print the parent module that asked for the builtin to be loaded and failed.
XXX: if a driver is built-in why can't it ask for a filesystem module to
be loaded?

Pull up following revision(s) (requested by pgoyette in ticket #1183):
	sys/kern/kern_module.c: revision 1.111
Check for duplicate module names before loading modules that were
"pushed" by the boot loader.  The boot loader pushes the module
name for the root file system (unless the root file system is ffs)
even if the file system module is built into the kernel.  When
this happens, we get a lot of "redefined symbol" error messages.
This fix does not alter the behavior of pushing the file system
name.  It simply avoids the redefined symbol errors by detecting
that the module is already built-in to the kernel and not trying
to load another copy.
While here, differentiate the error message text between "failed
to load" and "failed to fetch_info" conditions.
Addresses PR kern/50357

Sync with HEAD

KNF. Remove extra spaces. No functional change.

Don't declare module_verbose_on or module_autoload_on static.  It is useful
for these variables to be global, so they can be modified by ddb(4)
(entered via "boot -d") early in startup.

Simplfy insertion of newly-activated modules into the list.  There's no
good reason to treat modules without dependencies differently from those
which do require other modules.

When importing modules from the boot loader we should check for duplicate
module names both in the built-in list and in the list of previously
"pushed" modules.

While here, delay allocating the new 'struct module' until we've passed
the duplicate-name checks.

Check for duplicate module names before loading modules that were
"pushed" by the boot loader.  The boot loader pushes the module
name for the root file system (unless the root file system is ffs)
even if the file system module is built into the kernel.  When
this happens, we get a lot of "redefined symbol" error messages.

This fix does not alter the behavior of pushing the file system
name.  It simply avoids the redefined symbol errors by detecting
that the module is already built-in to the kernel and not trying
to load another copy.

While here, differentiate the error message text between "failed
to load" and "failed to fetch_info" conditions.

Addresses PR kern/50357

Sync with HEAD

Pull up following revision(s) (requested by pgoyette in ticket #1108):
	sys/kern/kern_module.c: revision 1.107-1.110
	sys/kern/kern_ksyms.c: revision 1.82
Add some additional status messages for kern.module.verbose=TRUE

Remove extraneous ')' from previous.

KNF

In module_do_load(), consolidate checking for a pre-existing module,
and return a single error value EEXIST.  When making a recursive
call (to load required modules), treat a pre-existing module as
success.

Without this change, when a module was loaded by specific request
(as opposed to being loaded as a requirement of some other module),
we would always load the module from the file-system, and then
after making various sanity/compatability checks we would destroy
the new copy if there was a pre-existing copy.

Fixes PR kern/40764

XXX Note that if the module exists, we bypass all of the various
XXX "compatability" checks, including whether or not the existing
XXX module is of any particular class!  (In the previous code, we
XXX checked to see if the newly-loaded copy had the correct class,
XXX but not the pre-existing copy, which could have been loaded
XXX from a different path/filename.)

Pull up following revision(s) (requested by pgoyette in ticket #1108):
	sys/kern/kern_module.c: revision 1.107-1.110
	sys/kern/kern_ksyms.c: revision 1.82
Add some additional status messages for kern.module.verbose=TRUE

Remove extraneous ')' from previous.

KNF

In module_do_load(), consolidate checking for a pre-existing module,
and return a single error value EEXIST.  When making a recursive
call (to load required modules), treat a pre-existing module as
success.

Without this change, when a module was loaded by specific request
(as opposed to being loaded as a requirement of some other module),
we would always load the module from the file-system, and then
after making various sanity/compatability checks we would destroy
the new copy if there was a pre-existing copy.

Fixes PR kern/40764

XXX Note that if the module exists, we bypass all of the various
XXX "compatability" checks, including whether or not the existing
XXX module is of any particular class!  (In the previous code, we
XXX checked to see if the newly-loaded copy had the correct class,
XXX but not the pre-existing copy, which could have been loaded
XXX from a different path/filename.)

In module_do_load(), consolidate checking for a pre-existing module,
and return a single error value EEXIST.  When making a recursive
call (to load required modules), treat a pre-existing module as
success.

Without this change, when a module was loaded by specific request
(as opposed to being loaded as a requirement of some other module),
we would always load the module from the file-system, and then
after making various sanity/compatability checks we would destroy
the new copy if there was a pre-existing copy.

Fixes PR kern/40764

XXX Note that if the module exists, we bypass all of the various
XXX "compatability" checks, including whether or not the existing
XXX module is of any particular class!  (In the previous code, we
XXX checked to see if the newly-loaded copy had the correct class,
XXX but not the pre-existing copy, which could have been loaded
XXX from a different path/filename.)

Sync with HEAD (as of 26th Dec)

KNF

Remove extraneous ')' from previous.

Add some additional status messages for kern.module.verbose=TRUE

Sync with HEAD

Make module_machine const char *

Pull up following revision(s) (requested by jnemeth in ticket #762):
	share/man/man4/options.4: revision 1.442
	sys/arch/amd64/conf/ALL: revision 1.18
	sys/arch/amd64/conf/GENERIC: revision 1.396
	sys/arch/dreamcast/conf/GENERIC: revision 1.119
	sys/arch/epoc32/conf/GENERIC: revision 1.6
	sys/arch/evbarm/conf/BCM5301X: revision 1.24
	sys/arch/evbarm/conf/BCM56340: revision 1.9
	sys/arch/evbarm/conf/IMX23_OLINUXINO: revision 1.9
	sys/arch/evbarm/conf/std.beagle: revision 1.13
	sys/arch/evbarm/conf/std.kobo: revision 1.2
	sys/arch/evbarm/conf/std.netwalker: revision 1.10
	sys/arch/evbppc/conf/P2020DS: revision 1.25
	sys/arch/evbppc/conf/RB800: revision 1.30
	sys/arch/evbppc/conf/TWRP1025: revision 1.18
	sys/arch/hp300/conf/GENERIC: revision 1.187
	sys/arch/hpcsh/conf/GENERIC: revision 1.104
	sys/arch/i386/conf/GENERIC: revision 1.1111
	sys/arch/i386/conf/MONOLITHIC: revision 1.17
	sys/arch/landisk/conf/GENERIC: revision 1.43
	sys/arch/luna68k/conf/GENERIC: revision 1.117
	sys/arch/macppc/conf/GENERIC: revision 1.316
	sys/arch/macppc/conf/GENERIC_601: revision 1.5
	sys/arch/mmeye/conf/MMEYE_WLF: revision 1.16
	sys/arch/news68k/conf/GENERIC: revision 1.123
	sys/arch/sandpoint/conf/GENERIC: revision 1.85
	sys/arch/shark/conf/GENERIC: revision 1.119
	sys/arch/sparc/conf/GENERIC: revision 1.246
	sys/arch/sparc64/conf/GENERIC: revision 1.174
	sys/arch/sun3/conf/GENERIC3X: revision 1.125
	sys/arch/sun3/conf/GENERIC: revision 1.169
	sys/arch/x68k/conf/GENERIC: revision 1.177
	sys/arch/zaurus/conf/GENERIC: revision 1.62
	sys/conf/files: revision 1.1099
	sys/kern/kern_module.c: revisions 1.98, 1.99
Create an "options MODULAR_DEFAULT_AUTOLOAD" config option and add
it to all kernel configs that contain "options MODULAR".  This
option turns on module autoloading by default (which is the current
default).  This allows people who don't want module autoloading on
by default to disable it by simply removing/commentting this line.
--
fix typo. (s/MODULE_DEFAULT_AUTOLOAD/MODULAR_DEFAULT_AUTOLOAD/)

Sync with HEAD

Fix thinko

Fix compilation.

if the root file-system is not yet mounted, hide "vfs load failed" spam with options DEBUG

print kernel module path only in kernels which support paths

Missed a C++ keyword (DEBUG case)

Don't next structure and enum definitions.
Don't use C++ keywords new, try, class, private, etc.

fix typo. (s/MODULE_DEFAULT_AUTOLOAD/MODULAR_DEFAULT_AUTOLOAD/)

Create an "options MODULAR_DEFAULT_AUTOLOAD" config option and add
it to all kernel configs that contain "options MODULAR".  This
option turns on module autoloading by default (which is the current
default).  This allows people who don't want module autoloading on
by default to disable it by simply removing/commentting this line.

Rebase to HEAD as of a few days ago.

Add the infrastructure for MODULAR support for Xen kernels.  At
the moment, this can only load very simple modules due to missing
symbols.  It is being add at this time to make pullups to the
netbsd-7 branch easier.  It is not enabled by default in any kernels.

Rebase.

Tell which dependency has failed

sync with head.

for a reference, the tree before this commit was tagged
as yamt-pagecache-tag8.

this commit was splitted into small chunks to avoid
a limitation of cvs.  ("Protocol error: too many arguments")

sync with head

Ensure that the top level sysctl nodes (kern, vfs, net, ...) exist before
the sysctl link sets are processed, and remove redundancy.

Shaves >13kB off of an amd64 GENERIC, not to mention >1k duplicate
lines of code.

Make the auto-unload timeout configurable via sysctl, and if the timeout
is set to zero, disable all auto-unloads (even those that were "scheduled"
previously).

fix compilation error; hi christos!

Silence some common module load errors and explain why.

resync from head

downgrade an error to debug.

more detailed/consistent error messages.

remove extra chatty messages

more debugging

resync with head

Can you please tell us the module name that had the wrong version? Thanks.

sync with head

merge to -current.

Implement the register/deregister/evaluation API for secmodel(9). It
allows registration of callbacks that can be used later for
cross-secmodel "safe" communication.

When a secmodel wishes to know a property maintained by another
secmodel, it has to submit a request to it so the other secmodel can
proceed to evaluating the request. This is done through the
secmodel_eval(9) call; example:

    bool isroot;
    error = secmodel_eval("org.netbsd.secmodel.suser", "is-root",
        cred, &isroot);
    if (error == 0 && !isroot)
            result = KAUTH_RESULT_DENY;

This one asks the suser module if the credentials are assumed to be root
when evaluated by suser module. If the module is present, it will
respond. If absent, the call will return an error.

Args and command are arbitrarily defined; it's up to the secmodel(9) to
document what it expects.

Typical example is securelevel testing: when someone wants to know
whether securelevel is raised above a certain level or not, the caller
has to request this property to the secmodel_securelevel(9) module.
Given that securelevel module may be absent from system's context (thus
making access to the global "securelevel" variable impossible or
unsafe), this API can cope with this absence and return an error.

We are using secmodel_eval(9) to implement a secmodel_extensions(9)
module, which plugs with the bsd44, suser and securelevel secmodels
to provide the logic behind curtain, usermount and user_set_cpu_affinity
modes, without adding hooks to traditional secmodels. This solves a
real issue with the current secmodel(9) code, as usermount or
user_set_cpu_affinity are not really tied to secmodel_suser(9).

The secmodel_eval(9) is also used to restrict security.models settings
when securelevel is above 0, through the "is-securelevel-above"
evaluation:
- curtain can be enabled any time, but cannot be disabled if
securelevel is above 0.
- usermount/user_set_cpu_affinity can be disabled any time, but cannot
be enabled if securelevel is above 0.

Regarding sysctl(7) entries:
curtain and usermount are now found under security.models.extensions
tree. The security.curtain and vfs.generic.usermount are still
accessible for backwards compat.

Documentation is incoming, I am proof-reading my writings.

Written by elad@, reviewed and tested (anita test + interact for rights
tests) by me. ok elad@.

See also
http://mail-index.netbsd.org/tech-security/2011/11/29/msg000422.html

XXX might consider va0 mapping too.

XXX Having a secmodel(9) specific printf (like aprint_*) for reporting
secmodel(9) errors might be a good idea, but I am not sure on how
to design such a function right now.

Move "unloaded module" debug message higher as it appears that name
sometimes points to memory that gets freed causing the system to crash.

Pull up the following revisions(s) (requested by tron in ticket #1688):
	sys/kern/kern_module.c:	revision 1.84

Return ENOEXEC instead of 0 if the info of a kernel module doesn't have the
expected size. This prevents kernel panics when loading broken modules.

sync with head

Return ENOEXEC instead of 0 if the info of a kernel module doesn't have the
expected size. This prevents kernel panics when loading broken modules.

Don't try to auto-unload modules unless they were auto-loaded.

When "loading" a built-in module needs to autoload a dependant module
which is not already loaded (or was loaded, and then unloaded), make
sure we return a pointer to the built-in module.  Otherwise, when the
initial module tries to update its dependancies' reference counts, we
trigger a KASSERT in module_enqueue().

don't increment the number of referenced module as a side effect if we fail.
From jmcneill

Always provide a meaningful short name for the kobj in the error message,
as well as the function name and the linenumber, without extra line feeds.

Retire varargs.h support. Move machine/stdarg.h logic into MI
sys/stdarg.h and expect compiler to provide proper builtins, defaulting
to the GCC interface. lint still has a special fallback.
Reduce abuse of _BSD_VA_LIST_ by defining __va_list by default and
derive va_list as required by standards.

Sync with HEAD.

sync with head

add a "module_machine", that defaults to machine.
allows MD code to override the default subdir for modules.

Fix misplaced parenthesis.  From henning.petersen@t-online.de, thanks.

sync with head

Sync with HEAD

Don't allow disabling a builtin secmodel: too many questionable
security implications.

Using "int" variables with sysctl's CTLTYPE_BOOL is a simple receipt to
loose on big endian machines. So make the variables "bool".

Pass potential prop dictionary to modcmd when reenabling a builtin
module.

Sync with HEAD (-D20101022).

Remove double-inclusion of <sys/kauth.c>

sync with head

Define a set of new kernel locking primitives to implement the recursive
kernconfig_mutex.  Update module subsystem to use this mutex rather than
its own internal (non-recursive) mutex.  Make module_autoload() do its
own locking to be consistent with the rest of the module_xxx() calls.
Update module(9) man page appropriately.

As discussed on tech-kern over the last few weeks.

Welcome to NetBSD 5.99.39 !

Sync with HEAD.

sync with head.

Keep condvar wmesg within 8 char limit

sync with head

1. Add an allocator for 'struct module *' and use it instead of local
   allocations.

2. Add a new member mod_flags to the 'struct module *' and define
   MODFLG_MUST_FORCE.  If this flag is set and the entry is on the list
   of builtins, it means that the module has been explicitly unloaded
   and any re-loads will require the MODCTL_LOAD_FORCE flag. Provide a
   module_require_force() method to set this flag;  once set, it should
   never be unset.

3. Rename original module_init2() to module_start_unload_thread() to be
   more descriptive of what it does.

4. Add a new module_builtin_require_force() routine that sets the
   MODFLG_MUST_FORCE flag for any module that has not yet successfully
   been initialized.  Call it after module_init_class(MODULE_CLASS_ANY)
   to disable remaining built-in modules.

This makes built-in versions of the xxxVERBOSE modules work once more,
resolving breakage reported by jruoho@ and njoly@.

Discussed on tech-kern, and comments and suggestions implemented.  No
additional discussion for last week.  Tested only on amd64 systems, but
there's nothing here that should be port- or architecture-specific (no
more specific than existing module implementation) so others should not
break.

sync with head

Feed dust to a few linkset uses and explicitly call the constructor.

Move definition of module_load_vfs_vec from kern_module_vfs.c to
kern_module.c - keeps rump happy.

Thanks, pooka!

Clean up kern_module.c rev 1.66, thanks to pooka@ for review & suggestions

Protect against attempting to load modules from the filesystem until we
have mounted the root file-system.  This allows us to load built-in and
boot-loader-provided modules much earlier during startup.

If a builtin dependency is missing, error instead of panic.  As
pointed out by martin, configurations like builtin nfsserver can
be succesfully linked without including all dependencies (specifically,
nfs).  Until all such weirdosities are fixed, opt for at least a
semifunctional system.

Sync with HEAD.

Use CTLTYPE_BOOL.

Don't loop eternal if init of a builtin module fails.

Print builtin "use -f" message only if not autoloading.  Otherwise
it'll get spammy.

XXX: this should probably be printed iff the toplevel module is
not being autoloaded (i.e. there is a human to interpret the error).
Otherwise disabled dependencies give a misleading EPERM.

Never autounload builtin modules (they will never be autoloaded if disabled).

sync with head

Make module_{lookup,enqueue}() static now that it's possible again
(effectively reverts my kern_module rev. 1.53 from some months ago)

Move builtin modules to a list in init and load them from there
instead of using linksets directly.  This has two implications:

1) It is now possible to "unload" a builtin module provided it is
   not busy.  This is useful e.g. to disable a kernel feature as
   an immediate workaround to a security problem.  To re-initialize
   the module, modload -f <name> is required.
2) It is possible to use builtin modules which were linked at
   runtime with an external linker (dlopen + rump).

Replace unsafe use of TAILQ_FOREACH: as the comment says, the
structures are pulled off the list in the loop and it's anyone's
guess where they go after that.

Update comment: unloaded modules which were pumped up by the
bootloader are not freed at the end of bootstrap (there should be
none, although this is not asserted.  maybe it should be?).

typo in comment

Move the listener plugging to module_init(), as it runs after kauth_init()
now. (Leaving only the module kthread creation in module_init2().)

* make it possible to include kern_module in a kernel without vfs
  support, i.e. move vfs functionality to a separate module
  (kern_module_vfs.c)
* make module proplist size an MI constant (now 8k) instead of PAGE_SIZE
* change some error values to something else than the karmic EINVAL

expose module_{lookup,enqueue}()

allow passing a NULL proplib dictionary to modctl(MODCTL_LOAD, ...)

Put module loading policy back in the subsystem.

Revisit: consider moving kauth_init() above module_init() in main().

First part of secmodel cleanup and other misc. changes:

  - Separate the suser part of the bsd44 secmodel into its own secmodel
    and directory, pending even more cleanups. For revision history
    purposes, the original location of the files was

        src/sys/secmodel/bsd44/secmodel_bsd44_suser.c
        src/sys/secmodel/bsd44/suser.h

  - Add a man-page for secmodel_suser(9) and update the one for
    secmodel_bsd44(9).

  - Add a "secmodel" module class and use it. Userland program and
    documentation updated.

  - Manage secmodel count (nsecmodels) through the module framework.
    This eliminates the need for secmodel_{,de}register() calls in
    secmodel code.

  - Prepare for secmodel modularization by adding relevant module bits.
    The secmodels don't allow auto unload. The bsd44 secmodel depends
    on the suser and securelevel secmodels. The overlay secmodel depends
    on the bsd44 secmodel. As the module class is only cosmetic, and to
    prevent ambiguity, the bsd44 and overlay secmodels are prefixed with
    "secmodel_".

  - Adapt the overlay secmodel to recent changes (mainly vnode scope).

  - Stop using link-sets for the sysctl node(s) creation.

  - Keep sysctl variables under nodes of their relevant secmodels. In
    other words, don't create duplicates for the suser/securelevel
    secmodels under the bsd44 secmodel, as the latter is merely used
    for "grouping".

  - For the suser and securelevel secmodels, "advertise presence" in
    relevant sysctl nodes (sysctl.security.models.{suser,securelevel}).

  - Get rid of the LKM preprocessor stuff.

  - As secmodels are now modules, there's no need for an explicit call
    to secmodel_start(); it's handled by the module framework. That
    said, the module framework was adjusted to properly load secmodels
    early during system startup.

  - Adapt rump to changes: Instead of using empty stubs for securelevel,
    simply use the suser secmodel. Also replace secmodel_start() with a
    call to secmodel_suser_start().

  - 5.99.20.

Testing was done on i386 ("release" build). Spearated module_init()
changes were tested on sparc and sparc64 as well by martin@ (thanks!).

Mailing list reference:

	http://mail-index.netbsd.org/tech-kern/2009/09/25/msg006135.html

Sync with HEAD.

sync with head

Make kobj_stat() return ENOSYS instead of panicking ("not modular")
on non-MODULAR kernels.  Make a few kobj_stat() callers check for
a non-zero return code and deal gracefully.

Add the MODCTL_NO_PROP flag to tell the kernel to ignore <module>.prop.

Add the '-P' option to modload(8) to set this flag.

Add code to merge the modload "command line" with <module>.prop.

Read in a <module>.prop file if it exists and internalize then pass it
to the <module> being loaded.

XXX A <module>.prop file will override anything on the "command line".
This will be fixed in the next commit.

Move all namei flags handling into kobj_load_file().

When I originally wrote this, I was going for maximum flexibility.
However, after a private discussion with dholland@, I see how this
will cause problems with the future world order of namei whenever
that might be.  At the moment, I don't need the extra flexibility,
but if something comes up this may have to be revisited.

Phase 0.5 of my options MODULAR enhancements.  As suggested by ad@,
these commits move all path handling into module_do_load() from
kobj_load_file().  This way the final path used to load a module
is available for loading <module>.plist, which will store parameters
for a module.  The end goal of this project is good support for
MODULAR device drivers.

ddb: don't try to stat builtin modules.

Sync with HEAD.

Commit is split, to avoid a "too many arguments" protocol error.

sync with head.

Sync with HEAD.

Use "defopt MODULAR" in sys/conf/files, and #include "opt_modular.h"
in all kernel sources that use the MODULAR option.
Proposed in tech-kern on 18 Jan 2009.

Apply patch (requested by ad in ticket #403):
Disable module autoload in 5.0. It's not well enough tested with this
version of the code.

Revert path of modules back to "/stand".

Change path to kernel modules from "/stand" to "/kernel".
Needs to go in before 5.0.  Proposed on <tech-kern>.

add __gcc__ __format__ __string__ __attributes__ to catch mistakes early

Sync with HEAD.

Sync with HEAD.

- Don't autounload modules loaded during boot. In my case, ffs got unloaded
  because my cdrom takes too long to initialize.
- Consistently print error messages in all error cases.

Update haad-dm branch to haad-dm-base2.

Back out revision 1.35 which is no longer necessary and causes the system
to try autounloading modules perpetually.

PR kern/40110: null, overlay and umap modules loading -> panic (layerfs symbols not there)

PR/40097: bouyer@antioche.lip6.fr: MODULAR tries to unload non-module subsystems
Don't try to unload built-in modules, and if a module is busy don't retry
immediately.

Add a couple of sysctls:

kern.module.autoload = 1
kern.module.verbose = 0

Correct error messages added in revision 1.32. In part from drochner@.

better error messages, and more messages for DIAGNOSTIC.

Print the size as decimal.

Add some basic DDB stuff for modules.

module_autoload: disallow path seperators and magic symlinks.

Some modules may want to avoid autounload because their use is transient.
Their FINI routine may legitimately succeed even though the module is likely
to be used soon again, for example: exec_script. Add a MODULE_CMD_AUTOUNLOAD
to query whether a module wants to avoid autounload.

- Put modules that depend on others at the head of the queue so autounload
  can unload requisite modules with only one pass.

- If loading a requisite module, scan the global queue before checking the
  file system to see if it exists.  If it's already present we don't care.

- If the system encounters a severe memory shortage, start unloading
  unused kernel modules.
- Try to unload any autoloaded kernel modules 10 seconds after their
  load was successful.
- Keep a counter to track module load/unload events.

Remove LKMs and switch to the module framework, pass 1.

Proposed on tech-kern@.

Make MODCTL_LOAD_FORCE do something.

- Be clear about whether module load is explicit or system initiated (auto).
- Require that module_lock is held to autoload, so that any preconditions
  can be safely checked.

Sync with HEAD.

Sync with HEAD.

Sync with wrstuden-revivesa-base-2.

expose module_compatible()

Sync w/ -current. 34 merge conflicts to follow.

sync with head

Sync with HEAD.

- Put in place module compatibility check against __NetBSD_Version__,
  as discussed on tech-kern.

- Remove unused module_jettison().

If autoloading a module, don't consider the current working directory.

Remove stale comment.

Allow module class to be passed to module_load(), as a basic sanity check
that we are loading the right kind of module.

Take $MACHINE into account when looking for modules.

PR kern/38694 module dependencies do not work as expected

Autoload modules from the correct path based on kernel version.

- Do local relocs before loading requisite modules, and all others only
  after requisite modules have been loaded. For PR kern/38697.
- Simplify kobj interface slightly to make error handling easier.

sync with head.

sync with head.

Fix an error path that previously panicked when module_fetch_info failed.

Re-do yesterday's build fix to hook in the MD stuff if available.

- Add module_find_section(), allows a module to look up data in its object.
- Work around build failure.

Get the pre-loaded module code working.

Remove clause 3 and 4 from TNF licenses

Sync with HEAD.

sync with head.

sync with HEAD

sync with head.

file kern_module.c was added on branch matt-armv6 on 2008-03-23 02:04:59 +0000

Add support for load-time parameters for modules, which are passed through
a dictionary.  As discussed in tech-kern@.

Sync with HEAD.

sync with head

Sync with HEAD

file kern_module.c was added on branch mjf-devfs on 2008-02-18 21:06:46 +0000

file kern_module.c was added on branch yamt-lazymbuf on 2008-01-21 09:46:07 +0000

Ensure that if kobj_load fails we do not call kobj_close followed by
kobj_unload, as an unloaded kobj will already have been freed by an
implicit kobj_unload call in kobj_close. This fixes random panics when a
module fails to load.

Sync with HEAD

file kern_module.c was added on branch bouyer-xeni386 on 2008-01-19 12:15:21 +0000

Ensure that circular dependencies do not panic the machine by doubly
locking the same file. Remove the special self-dependant case previously
introduced, as the general case handles it properly.

Deal with braindead modules that depend on themselves, rather than inducing
an ambiguous panic later on.

Avoid NULL pointer deref.

Fix tyop in a KASSERT:  s/mod_required/mod->mod_required/

Fix a panic that occurs when a dependency had already been loaded and a
dependant module is loaded by setting modp when returning ENOENT.

Also, be stricter with regards to MAXMODNAME.

- Include lkm_map if !LKM. XXX
- Add a comment about dependencies.

Pull in my modules code for review/test/hacking.