xref: /illumos-gate/usr/src/uts/common/os/modctl.c (revision 97088f6e9a2eb4c0085fb27842bd398fcba75846)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright (c) 1990, 2010, Oracle and/or its affiliates. All rights reserved.
24  * Copyright (c) 2017 Joyent, Inc.
25  * Copyright 2025 Oxide Computer Company
26  */
27 
28 /*
29  * modctl system call for loadable module support.
30  */
31 
32 #include <sys/param.h>
33 #include <sys/user.h>
34 #include <sys/systm.h>
35 #include <sys/exec.h>
36 #include <sys/file.h>
37 #include <sys/stat.h>
38 #include <sys/conf.h>
39 #include <sys/time.h>
40 #include <sys/reboot.h>
41 #include <sys/fs/ufs_fsdir.h>
42 #include <sys/kmem.h>
43 #include <sys/sysconf.h>
44 #include <sys/cmn_err.h>
45 #include <sys/ddi.h>
46 #include <sys/sunddi.h>
47 #include <sys/sunndi.h>
48 #include <sys/ndi_impldefs.h>
49 #include <sys/ddi_impldefs.h>
50 #include <sys/ddi_implfuncs.h>
51 #include <sys/bootconf.h>
52 #include <sys/dc_ki.h>
53 #include <sys/cladm.h>
54 #include <sys/dtrace.h>
55 #include <sys/kdi.h>
56 
57 #include <sys/devpolicy.h>
58 #include <sys/modctl.h>
59 #include <sys/kobj.h>
60 #include <sys/devops.h>
61 #include <sys/autoconf.h>
62 #include <sys/hwconf.h>
63 #include <sys/callb.h>
64 #include <sys/debug.h>
65 #include <sys/cpuvar.h>
66 #include <sys/sysmacros.h>
67 #include <sys/sysevent.h>
68 #include <sys/sysevent_impl.h>
69 #include <sys/instance.h>
70 #include <sys/modhash.h>
71 #include <sys/modhash_impl.h>
72 #include <sys/dacf_impl.h>
73 #include <sys/vfs.h>
74 #include <sys/pathname.h>
75 #include <sys/console.h>
76 #include <sys/policy.h>
77 #include <ipp/ipp_impl.h>
78 #include <sys/fs/dv_node.h>
79 #include <sys/strsubr.h>
80 #include <sys/fs/sdev_impl.h>
81 
82 static int		mod_circdep(struct modctl *);
83 static int		modinfo(modid_t, struct modinfo *);
84 
85 static void		mod_uninstall_all(void);
86 static int		mod_getinfo(struct modctl *, struct modinfo *);
87 static struct modctl	*allocate_modp(const char *, const char *);
88 
89 static int		mod_load(struct modctl *, int);
90 static void		mod_unload(struct modctl *);
91 static int		modinstall(struct modctl *);
92 static int		moduninstall(struct modctl *);
93 
94 static struct modctl	*mod_hold_by_name_common(struct modctl *, const char *);
95 static struct modctl	*mod_hold_next_by_id(modid_t);
96 static struct modctl	*mod_hold_loaded_mod(struct modctl *, char *, int *);
97 static struct modctl	*mod_hold_installed_mod(char *, int, int, int *);
98 static struct modctl	*mod_find_by_name(const char *);
99 
100 static void		mod_release(struct modctl *);
101 static void		mod_make_requisite(struct modctl *, struct modctl *);
102 static int		mod_install_requisites(struct modctl *);
103 static void		check_esc_sequences(char *, char *);
104 static struct modctl	*mod_hold_by_name_requisite(struct modctl *, char *);
105 
106 /*
107  * module loading thread control structure. Calls to kobj_load_module()() are
108  * handled off to a separate thead using this structure.
109  */
110 struct loadmt {
111 	ksema_t		sema;
112 	struct modctl	*mp;
113 	int		usepath;
114 	kthread_t	*owner;
115 	int		retval;
116 };
117 
118 static void	modload_thread(struct loadmt *);
119 
120 kcondvar_t	mod_cv;
121 kcondvar_t	mod_uninstall_cv;	/* Communication between swapper */
122 					/* and the uninstall daemon. */
123 kmutex_t	mod_lock;		/* protects &modules insert linkage, */
124 					/* mod_busy, mod_want, and mod_ref. */
125 					/* blocking operations while holding */
126 					/* mod_lock should be avoided */
127 kmutex_t	mod_uninstall_lock;	/* protects mod_uninstall_cv */
128 kthread_id_t	mod_aul_thread;
129 
130 int		modunload_wait;
131 kmutex_t	modunload_wait_mutex;
132 kcondvar_t	modunload_wait_cv;
133 int		modunload_active_count;
134 int		modunload_disable_count;
135 
136 int	isminiroot;		/* set if running as miniroot */
137 int	modrootloaded;		/* set after root driver and fs are loaded */
138 int	moddebug = 0x0;		/* debug flags for module writers */
139 int	swaploaded;		/* set after swap driver and fs are loaded */
140 int	bop_io_quiesced = 0;	/* set when BOP I/O can no longer be used */
141 int	last_module_id;
142 clock_t	mod_uninstall_interval = 0;
143 int	mod_uninstall_pass_max = 6;
144 int	mod_uninstall_ref_zero;	/* # modules that went mod_ref == 0 */
145 int	mod_uninstall_pass_exc;	/* mod_uninstall_all left new stuff */
146 
147 int	ddi_modclose_unload = 1;	/* 0 -> just decrement reference */
148 
149 int	devcnt_incr	= 256;		/* allow for additional drivers */
150 int	devcnt_min	= 512;		/* and always at least this number */
151 
152 struct devnames *devnamesp;
153 struct devnames orphanlist;
154 
155 krwlock_t	devinfo_tree_lock;	/* obsolete, to be removed */
156 
157 #define	MAJBINDFILE "/etc/name_to_major"
158 #define	SYSBINDFILE "/etc/name_to_sysnum"
159 
160 static char	majbind[] = MAJBINDFILE;
161 static char	sysbind[] = SYSBINDFILE;
162 static uint_t	mod_autounload_key;	/* for module autounload detection */
163 
164 extern int obpdebug;
165 
166 #define	DEBUGGER_PRESENT	((boothowto & RB_DEBUG) || (obpdebug != 0))
167 
168 static int minorperm_loaded = 0;
169 
170 void
mod_setup(void)171 mod_setup(void)
172 {
173 	struct sysent *callp;
174 	int callnum, exectype;
175 	int	num_devs;
176 	int	i;
177 
178 	/*
179 	 * Initialize the list of loaded driver dev_ops.
180 	 * XXX - This must be done before reading the system file so that
181 	 * forceloads of drivers will work.
182 	 */
183 	num_devs = read_binding_file(majbind, mb_hashtab, make_mbind);
184 	/*
185 	 * Since read_binding_file is common code, it doesn't enforce that all
186 	 * of the binding file entries have major numbers <= MAXMAJ32.	Thus,
187 	 * ensure that we don't allocate some massive amount of space due to a
188 	 * bad entry.  We can't have major numbers bigger than MAXMAJ32
189 	 * until file system support for larger major numbers exists.
190 	 */
191 
192 	/*
193 	 * Leave space for expansion, but not more than L_MAXMAJ32
194 	 */
195 	devcnt = MIN(num_devs + devcnt_incr, L_MAXMAJ32);
196 	devcnt = MAX(devcnt, devcnt_min);
197 	devopsp = kmem_alloc(devcnt * sizeof (struct dev_ops *), KM_SLEEP);
198 	for (i = 0; i < devcnt; i++)
199 		devopsp[i] = &mod_nodev_ops;
200 
201 	init_devnamesp(devcnt);
202 
203 	/*
204 	 * Sync up with the work that the stand-alone linker has already done.
205 	 */
206 	(void) kobj_sync();
207 
208 	if (boothowto & RB_DEBUG)
209 		kdi_dvec_modavail();
210 
211 	make_aliases(mb_hashtab);
212 
213 	/*
214 	 * Initialize streams device implementation structures.
215 	 */
216 	devimpl = kmem_zalloc(devcnt * sizeof (cdevsw_impl_t), KM_SLEEP);
217 
218 	/*
219 	 * If the cl_bootstrap module is present,
220 	 * we should be configured as a cluster. Loading this module
221 	 * will set "cluster_bootflags" to non-zero.
222 	 */
223 	(void) modload("misc", "cl_bootstrap");
224 
225 	(void) read_binding_file(sysbind, sb_hashtab, make_mbind);
226 	init_syscallnames(NSYSCALL);
227 
228 	/*
229 	 * Start up dynamic autoconfiguration framework (dacf).
230 	 */
231 	mod_hash_init();
232 	dacf_init();
233 
234 	/*
235 	 * Start up IP policy framework (ipp).
236 	 */
237 	ipp_init();
238 
239 	/*
240 	 * Allocate loadable native system call locks.
241 	 */
242 	for (callnum = 0, callp = sysent; callnum < NSYSCALL;
243 	    callnum++, callp++) {
244 		if (LOADABLE_SYSCALL(callp)) {
245 			if (mod_getsysname(callnum) != NULL) {
246 				callp->sy_lock =
247 				    kobj_zalloc(sizeof (krwlock_t), KM_SLEEP);
248 				rw_init(callp->sy_lock, NULL, RW_DEFAULT, NULL);
249 			} else {
250 				callp->sy_flags &= ~SE_LOADABLE;
251 				callp->sy_callc = nosys;
252 			}
253 #ifdef DEBUG
254 		} else {
255 			/*
256 			 * Do some sanity checks on the sysent table
257 			 */
258 			switch (callp->sy_flags & SE_RVAL_MASK) {
259 			case SE_32RVAL1:
260 				/* only r_val1 returned */
261 			case SE_32RVAL1 | SE_32RVAL2:
262 				/* r_val1 and r_val2 returned */
263 			case SE_64RVAL:
264 				/* 64-bit rval returned */
265 				break;
266 			default:
267 				cmn_err(CE_WARN, "sysent[%d]: bad flags %x",
268 				    callnum, callp->sy_flags);
269 			}
270 #endif
271 		}
272 	}
273 
274 #ifdef _SYSCALL32_IMPL
275 	/*
276 	 * Allocate loadable system call locks for 32-bit compat syscalls
277 	 */
278 	for (callnum = 0, callp = sysent32; callnum < NSYSCALL;
279 	    callnum++, callp++) {
280 		if (LOADABLE_SYSCALL(callp)) {
281 			if (mod_getsysname(callnum) != NULL) {
282 				callp->sy_lock =
283 				    kobj_zalloc(sizeof (krwlock_t), KM_SLEEP);
284 				rw_init(callp->sy_lock, NULL, RW_DEFAULT, NULL);
285 			} else {
286 				callp->sy_flags &= ~SE_LOADABLE;
287 				callp->sy_callc = nosys;
288 			}
289 #ifdef DEBUG
290 		} else {
291 			/*
292 			 * Do some sanity checks on the sysent table
293 			 */
294 			switch (callp->sy_flags & SE_RVAL_MASK) {
295 			case SE_32RVAL1:
296 				/* only r_val1 returned */
297 			case SE_32RVAL1 | SE_32RVAL2:
298 				/* r_val1 and r_val2 returned */
299 			case SE_64RVAL:
300 				/* 64-bit rval returned */
301 				break;
302 			default:
303 				cmn_err(CE_WARN, "sysent32[%d]: bad flags %x",
304 				    callnum, callp->sy_flags);
305 				goto skip;
306 			}
307 
308 			/*
309 			 * Cross-check the native and compatibility tables.
310 			 */
311 			if (callp->sy_callc == nosys ||
312 			    sysent[callnum].sy_callc == nosys)
313 				continue;
314 			/*
315 			 * If only one or the other slot is loadable, then
316 			 * there's an error -- they should match!
317 			 */
318 			if ((callp->sy_callc == loadable_syscall) ^
319 			    (sysent[callnum].sy_callc == loadable_syscall)) {
320 				cmn_err(CE_WARN, "sysent[%d] loadable?",
321 				    callnum);
322 			}
323 			/*
324 			 * This is more of a heuristic test -- if the
325 			 * system call returns two values in the 32-bit
326 			 * world, it should probably return two 32-bit
327 			 * values in the 64-bit world too.
328 			 */
329 			if (((callp->sy_flags & SE_32RVAL2) == 0) ^
330 			    ((sysent[callnum].sy_flags & SE_32RVAL2) == 0)) {
331 				cmn_err(CE_WARN, "sysent[%d] rval2 mismatch!",
332 				    callnum);
333 			}
334 skip:;
335 #endif	/* DEBUG */
336 		}
337 	}
338 #endif	/* _SYSCALL32_IMPL */
339 
340 	/*
341 	 * Allocate loadable exec locks.  (Assumes all execs are loadable)
342 	 */
343 	for (exectype = 0; exectype < nexectype; exectype++) {
344 		execsw[exectype].exec_lock =
345 		    kobj_zalloc(sizeof (krwlock_t), KM_SLEEP);
346 		rw_init(execsw[exectype].exec_lock, NULL, RW_DEFAULT, NULL);
347 	}
348 
349 	read_class_file();
350 
351 	/* init thread specific structure for mod_uninstall_all */
352 	tsd_create(&mod_autounload_key, NULL);
353 }
354 
355 static int
modctl_modload(int use_path,char * filename,int * rvp)356 modctl_modload(int use_path, char *filename, int *rvp)
357 {
358 	struct modctl *modp;
359 	int retval = 0;
360 	char *filenamep;
361 	int modid;
362 
363 	filenamep = kmem_zalloc(MOD_MAXPATH, KM_SLEEP);
364 
365 	if (copyinstr(filename, filenamep, MOD_MAXPATH, 0)) {
366 		retval = EFAULT;
367 		goto out;
368 	}
369 
370 	filenamep[MOD_MAXPATH - 1] = 0;
371 	modp = mod_hold_installed_mod(filenamep, use_path, 0, &retval);
372 
373 	if (modp == NULL)
374 		goto out;
375 
376 	modp->mod_loadflags |= MOD_NOAUTOUNLOAD;
377 	modid = modp->mod_id;
378 	mod_release_mod(modp);
379 	CPU_STATS_ADDQ(CPU, sys, modload, 1);
380 	if (rvp != NULL && copyout(&modid, rvp, sizeof (modid)) != 0)
381 		retval = EFAULT;
382 out:
383 	kmem_free(filenamep, MOD_MAXPATH);
384 
385 	return (retval);
386 }
387 
388 static int
modctl_modunload(modid_t id)389 modctl_modunload(modid_t id)
390 {
391 	int rval = 0;
392 
393 	if (id == 0) {
394 #ifdef DEBUG
395 		/*
396 		 * Turn on mod_uninstall_daemon
397 		 */
398 		if (mod_uninstall_interval == 0) {
399 			mod_uninstall_interval = 60;
400 			modreap();
401 			return (rval);
402 		}
403 #endif
404 		mod_uninstall_all();
405 	} else {
406 		rval = modunload(id);
407 	}
408 	return (rval);
409 }
410 
411 static int
modctl_modinfo(modid_t id,struct modinfo * umodi)412 modctl_modinfo(modid_t id, struct modinfo *umodi)
413 {
414 	int retval;
415 	struct modinfo modi;
416 #if defined(_SYSCALL32_IMPL)
417 	int nobase;
418 	struct modinfo32 modi32;
419 #endif
420 
421 	nobase = 0;
422 	if (get_udatamodel() == DATAMODEL_NATIVE) {
423 		if (copyin(umodi, &modi, sizeof (struct modinfo)) != 0)
424 			return (EFAULT);
425 	}
426 #ifdef _SYSCALL32_IMPL
427 	else {
428 		bzero(&modi, sizeof (modi));
429 		if (copyin(umodi, &modi32, sizeof (struct modinfo32)) != 0)
430 			return (EFAULT);
431 		modi.mi_info = modi32.mi_info;
432 		modi.mi_id = modi32.mi_id;
433 		modi.mi_nextid = modi32.mi_nextid;
434 		if (modi.mi_info & MI_INFO_BY_NAME) {
435 			bcopy(modi32.mi_name, modi.mi_name,
436 			    sizeof (modi.mi_name));
437 			CTASSERT(sizeof (modi.mi_name) ==
438 			    sizeof (modi32.mi_name));
439 		}
440 		nobase = modi.mi_info & MI_INFO_NOBASE;
441 	}
442 #endif
443 	/*
444 	 * This flag is -only- for the kernels use.
445 	 */
446 	modi.mi_info &= ~MI_INFO_LINKAGE;
447 
448 	if (modi.mi_info & MI_INFO_BY_NAME) {
449 		/* By-name search string must be NUL-terminated */
450 		if (strnlen(modi.mi_name, sizeof (modi.mi_name)) ==
451 		    sizeof (modi.mi_name)) {
452 			return (EINVAL);
453 		}
454 	}
455 
456 	retval = modinfo(id, &modi);
457 	if (retval)
458 		return (retval);
459 
460 	if (get_udatamodel() == DATAMODEL_NATIVE) {
461 		if (copyout(&modi, umodi, sizeof (struct modinfo)) != 0)
462 			retval = EFAULT;
463 #ifdef _SYSCALL32_IMPL
464 	} else {
465 		int i;
466 
467 		if (!nobase && (uintptr_t)modi.mi_base > UINT32_MAX)
468 			return (EOVERFLOW);
469 
470 		modi32.mi_info = modi.mi_info;
471 		modi32.mi_state = modi.mi_state;
472 		modi32.mi_id = modi.mi_id;
473 		modi32.mi_nextid = modi.mi_nextid;
474 		modi32.mi_base = (caddr32_t)(uintptr_t)modi.mi_base;
475 		modi32.mi_size = modi.mi_size;
476 		modi32.mi_rev = modi.mi_rev;
477 		modi32.mi_loadcnt = modi.mi_loadcnt;
478 		bcopy(modi.mi_name, modi32.mi_name, sizeof (modi32.mi_name));
479 		for (i = 0; i < MODMAXLINK32; i++) {
480 			modi32.mi_msinfo[i].msi_p0 = modi.mi_msinfo[i].msi_p0;
481 			bcopy(modi.mi_msinfo[i].msi_linkinfo,
482 			    modi32.mi_msinfo[i].msi_linkinfo,
483 			    sizeof (modi32.mi_msinfo[0].msi_linkinfo));
484 		}
485 		if (copyout(&modi32, umodi, sizeof (struct modinfo32)) != 0)
486 			retval = EFAULT;
487 #endif
488 	}
489 
490 	return (retval);
491 }
492 
493 /*
494  * Return the last major number in the range of permissible major numbers.
495  */
496 /*ARGSUSED*/
497 static int
modctl_modreserve(modid_t id,int * data)498 modctl_modreserve(modid_t id, int *data)
499 {
500 	if (copyout(&devcnt, data, sizeof (devcnt)) != 0)
501 		return (EFAULT);
502 	return (0);
503 }
504 
505 /* Add/Remove driver and binding aliases */
506 static int
modctl_update_driver_aliases(int add,int * data)507 modctl_update_driver_aliases(int add, int *data)
508 {
509 	struct modconfig	mc;
510 	int			i, n, rv = 0;
511 	struct aliases		alias;
512 	struct aliases		*ap;
513 	char			name[MAXMODCONFNAME];
514 	char			cname[MAXMODCONFNAME];
515 	char			*drvname;
516 	int			resid;
517 	struct alias_info {
518 		char	*alias_name;
519 		int	alias_resid;
520 	} *aliases, *aip;
521 
522 	aliases = NULL;
523 	bzero(&mc, sizeof (struct modconfig));
524 	if (get_udatamodel() == DATAMODEL_NATIVE) {
525 		if (copyin(data, &mc, sizeof (struct modconfig)) != 0)
526 			return (EFAULT);
527 	}
528 #ifdef _SYSCALL32_IMPL
529 	else {
530 		struct modconfig32 modc32;
531 		if (copyin(data, &modc32, sizeof (struct modconfig32)) != 0)
532 			return (EFAULT);
533 		else {
534 			bcopy(modc32.drvname, mc.drvname,
535 			    sizeof (modc32.drvname));
536 			bcopy(modc32.drvclass, mc.drvclass,
537 			    sizeof (modc32.drvclass));
538 			mc.major = modc32.major;
539 			mc.flags = modc32.flags;
540 			mc.num_aliases = modc32.num_aliases;
541 			mc.ap = (struct aliases *)(uintptr_t)modc32.ap;
542 		}
543 	}
544 #endif
545 
546 	/*
547 	 * If the driver is already in the mb_hashtab, and the name given
548 	 * doesn't match that driver's name, fail.  Otherwise, pass, since
549 	 * we may be adding aliases.
550 	 */
551 	drvname = mod_major_to_name(mc.major);
552 	if ((drvname != NULL) && strcmp(drvname, mc.drvname) != 0)
553 		return (EINVAL);
554 
555 	/*
556 	 * Precede alias removal by unbinding as many devices as possible.
557 	 */
558 	if (add == 0) {
559 		(void) i_ddi_unload_drvconf(mc.major);
560 		i_ddi_unbind_devs(mc.major);
561 	}
562 
563 	/*
564 	 * Add/remove each supplied driver alias to/from mb_hashtab
565 	 */
566 	ap = mc.ap;
567 	if (mc.num_aliases > 0)
568 		aliases = kmem_zalloc(
569 		    mc.num_aliases * sizeof (struct alias_info), KM_SLEEP);
570 	aip = aliases;
571 	for (i = 0; i < mc.num_aliases; i++) {
572 		bzero(&alias, sizeof (struct aliases));
573 		if (get_udatamodel() == DATAMODEL_NATIVE) {
574 			if (copyin(ap, &alias, sizeof (struct aliases)) != 0) {
575 				rv = EFAULT;
576 				goto error;
577 			}
578 			if (alias.a_len > MAXMODCONFNAME) {
579 				rv = EINVAL;
580 				goto error;
581 			}
582 			if (copyin(alias.a_name, name, alias.a_len) != 0) {
583 				rv = EFAULT;
584 				goto error;
585 			}
586 			if (name[alias.a_len - 1] != '\0') {
587 				rv = EINVAL;
588 				goto error;
589 			}
590 		}
591 #ifdef _SYSCALL32_IMPL
592 		else {
593 			struct aliases32 al32;
594 			bzero(&al32, sizeof (struct aliases32));
595 			if (copyin(ap, &al32, sizeof (struct aliases32)) != 0) {
596 				rv = EFAULT;
597 				goto error;
598 			}
599 			if (al32.a_len > MAXMODCONFNAME) {
600 				rv = EINVAL;
601 				goto error;
602 			}
603 			if (copyin((void *)(uintptr_t)al32.a_name,
604 			    name, al32.a_len) != 0) {
605 				rv = EFAULT;
606 				goto error;
607 			}
608 			if (name[al32.a_len - 1] != '\0') {
609 				rv = EINVAL;
610 				goto error;
611 			}
612 			alias.a_next = (void *)(uintptr_t)al32.a_next;
613 		}
614 #endif
615 		check_esc_sequences(name, cname);
616 		aip->alias_name = strdup(cname);
617 		ap = alias.a_next;
618 		aip++;
619 	}
620 
621 	if (add == 0) {
622 		ap = mc.ap;
623 		resid = 0;
624 		aip = aliases;
625 		/* attempt to unbind all devices bound to each alias */
626 		for (i = 0; i < mc.num_aliases; i++) {
627 			n = i_ddi_unbind_devs_by_alias(
628 			    mc.major, aip->alias_name);
629 			resid += n;
630 			aip->alias_resid = n;
631 		}
632 
633 		/*
634 		 * If some device bound to an alias remains in use,
635 		 * and override wasn't specified, no change is made to
636 		 * the binding state and we fail the operation.
637 		 */
638 		if (resid > 0 && ((mc.flags & MOD_UNBIND_OVERRIDE) == 0)) {
639 			rv = EBUSY;
640 			goto error;
641 		}
642 
643 		/*
644 		 * No device remains bound of any of the aliases,
645 		 * or force was requested.  Mark each alias as
646 		 * inactive via delete_mbind so no future binds
647 		 * to this alias take place and that a new
648 		 * binding can be established.
649 		 */
650 		aip = aliases;
651 		for (i = 0; i < mc.num_aliases; i++) {
652 			if (moddebug & MODDEBUG_BINDING)
653 				cmn_err(CE_CONT, "Removing binding for %s "
654 				    "(%d active references)\n",
655 				    aip->alias_name, aip->alias_resid);
656 			delete_mbind(aip->alias_name, mb_hashtab);
657 			aip++;
658 		}
659 		rv = 0;
660 	} else {
661 		aip = aliases;
662 		for (i = 0; i < mc.num_aliases; i++) {
663 			if (moddebug & MODDEBUG_BINDING)
664 				cmn_err(CE_NOTE, "Adding binding for '%s'\n",
665 				    aip->alias_name);
666 			(void) make_mbind(aip->alias_name,
667 			    mc.major, NULL, mb_hashtab);
668 			aip++;
669 		}
670 		/*
671 		 * Try to establish an mbinding for mc.drvname, and add it to
672 		 * devnames. Add class if any after establishing the major
673 		 * number.
674 		 */
675 		(void) make_mbind(mc.drvname, mc.major, NULL, mb_hashtab);
676 		if ((rv = make_devname(mc.drvname, mc.major,
677 		    (mc.flags & MOD_ADDMAJBIND_UPDATE) ?
678 		    DN_DRIVER_INACTIVE : 0)) != 0) {
679 			goto error;
680 		}
681 
682 		if (mc.drvclass[0] != '\0')
683 			add_class(mc.drvname, mc.drvclass);
684 		if ((mc.flags & MOD_ADDMAJBIND_UPDATE) == 0) {
685 			(void) i_ddi_load_drvconf(mc.major);
686 		}
687 	}
688 
689 	/*
690 	 * Ensure that all nodes are bound to the most appropriate driver
691 	 * possible, attempting demotion and rebind when a more appropriate
692 	 * driver now exists.  But not when adding a driver update-only.
693 	 */
694 	if ((add == 0) || ((mc.flags & MOD_ADDMAJBIND_UPDATE) == 0)) {
695 		i_ddi_bind_devs();
696 		i_ddi_di_cache_invalidate();
697 	}
698 
699 error:
700 	if (mc.num_aliases > 0) {
701 		aip = aliases;
702 		for (i = 0; i < mc.num_aliases; i++) {
703 			if (aip->alias_name != NULL)
704 				strfree(aip->alias_name);
705 			aip++;
706 		}
707 		kmem_free(aliases, mc.num_aliases * sizeof (struct alias_info));
708 	}
709 	return (rv);
710 }
711 
712 static int
modctl_add_driver_aliases(int * data)713 modctl_add_driver_aliases(int *data)
714 {
715 	return (modctl_update_driver_aliases(1, data));
716 }
717 
718 static int
modctl_remove_driver_aliases(int * data)719 modctl_remove_driver_aliases(int *data)
720 {
721 	return (modctl_update_driver_aliases(0, data));
722 }
723 
724 static int
modctl_rem_major(major_t major)725 modctl_rem_major(major_t major)
726 {
727 	struct devnames *dnp;
728 
729 	if (major >= devcnt)
730 		return (EINVAL);
731 
732 	/* mark devnames as removed */
733 	dnp = &devnamesp[major];
734 	LOCK_DEV_OPS(&dnp->dn_lock);
735 	if (dnp->dn_name == NULL ||
736 	    (dnp->dn_flags & (DN_DRIVER_REMOVED | DN_TAKEN_GETUDEV))) {
737 		UNLOCK_DEV_OPS(&dnp->dn_lock);
738 		return (EINVAL);
739 	}
740 	dnp->dn_flags |= DN_DRIVER_REMOVED;
741 	pm_driver_removed(major);
742 	UNLOCK_DEV_OPS(&dnp->dn_lock);
743 
744 	(void) i_ddi_unload_drvconf(major);
745 	i_ddi_unbind_devs(major);
746 	i_ddi_bind_devs();
747 	i_ddi_di_cache_invalidate();
748 
749 	/* purge all the bindings to this driver */
750 	purge_mbind(major, mb_hashtab);
751 	return (0);
752 }
753 
754 static struct vfs *
path_to_vfs(char * name)755 path_to_vfs(char *name)
756 {
757 	vnode_t *vp;
758 	struct vfs *vfsp;
759 
760 	if (lookupname(name, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp))
761 		return (NULL);
762 
763 	vfsp = vp->v_vfsp;
764 	VN_RELE(vp);
765 	return (vfsp);
766 }
767 
768 static int
new_vfs_in_modpath()769 new_vfs_in_modpath()
770 {
771 	static int n_modpath = 0;
772 	static char *modpath_copy;
773 	static struct pathvfs {
774 		char *path;
775 		struct vfs *vfsp;
776 	} *pathvfs;
777 
778 	int i, new_vfs = 0;
779 	char *tmp, *tmp1;
780 	struct vfs *vfsp;
781 
782 	if (n_modpath != 0) {
783 		for (i = 0; i < n_modpath; i++) {
784 			vfsp = path_to_vfs(pathvfs[i].path);
785 			if (vfsp != pathvfs[i].vfsp) {
786 				pathvfs[i].vfsp = vfsp;
787 				if (vfsp)
788 					new_vfs = 1;
789 			}
790 		}
791 		return (new_vfs);
792 	}
793 
794 	/*
795 	 * First call, initialize the pathvfs structure
796 	 */
797 	modpath_copy = i_ddi_strdup(default_path, KM_SLEEP);
798 	tmp = modpath_copy;
799 	n_modpath = 1;
800 	tmp1 = strchr(tmp, ' ');
801 	while (tmp1) {
802 		*tmp1 = '\0';
803 		n_modpath++;
804 		tmp = tmp1 + 1;
805 		tmp1 = strchr(tmp, ' ');
806 	}
807 
808 	pathvfs = kmem_zalloc(n_modpath * sizeof (struct pathvfs), KM_SLEEP);
809 	tmp = modpath_copy;
810 	for (i = 0; i < n_modpath; i++) {
811 		pathvfs[i].path = tmp;
812 		vfsp = path_to_vfs(tmp);
813 		pathvfs[i].vfsp = vfsp;
814 		tmp += strlen(tmp) + 1;
815 	}
816 	return (1);	/* always reread driver.conf the first time */
817 }
818 
819 static int
modctl_load_drvconf(major_t major,int flags)820 modctl_load_drvconf(major_t major, int flags)
821 {
822 	int ret;
823 
824 	/*
825 	 * devfsadm -u - read all new driver.conf files
826 	 * and bind and configure devices for new drivers.
827 	 */
828 	if (flags & MOD_LOADDRVCONF_RECONF) {
829 		(void) i_ddi_load_drvconf(DDI_MAJOR_T_NONE);
830 		i_ddi_bind_devs();
831 		i_ddi_di_cache_invalidate();
832 		return (0);
833 	}
834 
835 	/*
836 	 * update_drv <drv> - reload driver.conf for the specified driver
837 	 */
838 	if (major != DDI_MAJOR_T_NONE) {
839 		ret = i_ddi_load_drvconf(major);
840 		if (ret == 0)
841 			i_ddi_bind_devs();
842 		return (ret);
843 	}
844 
845 	/*
846 	 * We are invoked to rescan new driver.conf files. It is
847 	 * only necessary if a new file system was mounted in the
848 	 * module_path. Because rescanning driver.conf files can
849 	 * take some time on older platforms (sun4m), the following
850 	 * code skips unnecessary driver.conf rescans to optimize
851 	 * boot performance.
852 	 */
853 	if (new_vfs_in_modpath()) {
854 		(void) i_ddi_load_drvconf(DDI_MAJOR_T_NONE);
855 		/*
856 		 * If we are still initializing io subsystem,
857 		 * load drivers with ddi-forceattach property
858 		 */
859 		if (!i_ddi_io_initialized())
860 			i_ddi_forceattach_drivers();
861 	}
862 	return (0);
863 }
864 
865 /*
866  * Unload driver.conf file and follow up by attempting
867  * to rebind devices to more appropriate driver.
868  */
869 static int
modctl_unload_drvconf(major_t major)870 modctl_unload_drvconf(major_t major)
871 {
872 	int ret;
873 
874 	if (major >= devcnt)
875 		return (EINVAL);
876 
877 	ret = i_ddi_unload_drvconf(major);
878 	if (ret != 0)
879 		return (ret);
880 	(void) i_ddi_unbind_devs(major);
881 	i_ddi_bind_devs();
882 
883 	return (0);
884 }
885 
886 static void
check_esc_sequences(char * str,char * cstr)887 check_esc_sequences(char *str, char *cstr)
888 {
889 	int i;
890 	size_t len;
891 	char *p;
892 
893 	len = strlen(str);
894 	for (i = 0; i < len; i++, str++, cstr++) {
895 		if (*str != '\\') {
896 			*cstr = *str;
897 		} else {
898 			p = str + 1;
899 			/*
900 			 * we only handle octal escape sequences for SPACE
901 			 */
902 			if (*p++ == '0' && *p++ == '4' && *p == '0') {
903 				*cstr = ' ';
904 				str += 3;
905 			} else {
906 				*cstr = *str;
907 			}
908 		}
909 	}
910 	*cstr = 0;
911 }
912 
913 static int
modctl_getmodpathlen(int * data)914 modctl_getmodpathlen(int *data)
915 {
916 	int len;
917 	len = strlen(default_path);
918 	if (copyout(&len, data, sizeof (len)) != 0)
919 		return (EFAULT);
920 	return (0);
921 }
922 
923 static int
modctl_getmodpath(char * data)924 modctl_getmodpath(char *data)
925 {
926 	if (copyout(default_path, data, strlen(default_path) + 1) != 0)
927 		return (EFAULT);
928 	return (0);
929 }
930 
931 static int
modctl_read_sysbinding_file(void)932 modctl_read_sysbinding_file(void)
933 {
934 	(void) read_binding_file(sysbind, sb_hashtab, make_mbind);
935 	return (0);
936 }
937 
938 static int
modctl_getmaj(char * uname,uint_t ulen,int * umajorp)939 modctl_getmaj(char *uname, uint_t ulen, int *umajorp)
940 {
941 	char name[256];
942 	int retval;
943 	major_t major;
944 
945 	if (ulen == 0)
946 		return (EINVAL);
947 	if ((retval = copyinstr(uname, name,
948 	    (ulen < 256) ? ulen : 256, 0)) != 0)
949 		return (retval);
950 	if ((major = mod_name_to_major(name)) == DDI_MAJOR_T_NONE)
951 		return (ENODEV);
952 	if (copyout(&major, umajorp, sizeof (major_t)) != 0)
953 		return (EFAULT);
954 	return (0);
955 }
956 
957 static char **
convert_constraint_string(char * constraints,size_t len)958 convert_constraint_string(char *constraints, size_t len)
959 {
960 	int	i;
961 	int	n;
962 	char	*p;
963 	char	**array;
964 
965 	ASSERT(constraints != NULL);
966 	ASSERT(len > 0);
967 
968 	for (i = 0, p = constraints; strlen(p) > 0; i++, p += strlen(p) + 1)
969 		;
970 
971 	n = i;
972 
973 	if (n == 0) {
974 		kmem_free(constraints, len);
975 		return (NULL);
976 	}
977 
978 	array = kmem_alloc((n + 1) * sizeof (char *), KM_SLEEP);
979 
980 	for (i = 0, p = constraints; i < n; i++, p += strlen(p) + 1) {
981 		array[i] = i_ddi_strdup(p, KM_SLEEP);
982 	}
983 	array[n] = NULL;
984 
985 	kmem_free(constraints, len);
986 
987 	return (array);
988 }
989 /*ARGSUSED*/
990 static int
modctl_retire(char * path,char * uconstraints,size_t ulen)991 modctl_retire(char *path, char *uconstraints, size_t ulen)
992 {
993 	char	*pathbuf;
994 	char	*devpath;
995 	size_t	pathsz;
996 	int	retval;
997 	char	*constraints;
998 	char	**cons_array;
999 
1000 	if (path == NULL)
1001 		return (EINVAL);
1002 
1003 	if ((uconstraints == NULL) ^ (ulen == 0))
1004 		return (EINVAL);
1005 
1006 	pathbuf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1007 	retval = copyinstr(path, pathbuf, MAXPATHLEN, &pathsz);
1008 	if (retval != 0) {
1009 		kmem_free(pathbuf, MAXPATHLEN);
1010 		return (retval);
1011 	}
1012 	devpath = i_ddi_strdup(pathbuf, KM_SLEEP);
1013 	kmem_free(pathbuf, MAXPATHLEN);
1014 
1015 	/*
1016 	 * First check if the device is already retired.
1017 	 * If it is, then persist the retire anyway, just in case the retire
1018 	 * store has got out of sync with the boot archive.
1019 	 */
1020 	if (e_ddi_device_retired(devpath)) {
1021 		cmn_err(CE_NOTE, "Device: already retired: %s", devpath);
1022 		(void) e_ddi_retire_persist(devpath);
1023 		kmem_free(devpath, strlen(devpath) + 1);
1024 		return (0);
1025 	}
1026 
1027 	cons_array = NULL;
1028 	if (uconstraints) {
1029 		constraints = kmem_alloc(ulen, KM_SLEEP);
1030 		if (copyin(uconstraints, constraints, ulen)) {
1031 			kmem_free(constraints, ulen);
1032 			kmem_free(devpath, strlen(devpath) + 1);
1033 			return (EFAULT);
1034 		}
1035 		cons_array = convert_constraint_string(constraints, ulen);
1036 	}
1037 
1038 	/*
1039 	 * Try to retire the device first. The following
1040 	 * routine will return an error only if the device
1041 	 * is not retireable i.e. retire constraints forbid
1042 	 * a retire. A return of success from this routine
1043 	 * indicates that device is retireable.
1044 	 */
1045 	retval = e_ddi_retire_device(devpath, cons_array);
1046 	if (retval != DDI_SUCCESS) {
1047 		cmn_err(CE_WARN, "constraints forbid retire: %s", devpath);
1048 		kmem_free(devpath, strlen(devpath) + 1);
1049 		return (ENOTSUP);
1050 	}
1051 
1052 	/*
1053 	 * Ok, the retire succeeded. Persist the retire.
1054 	 * If retiring a nexus, we need to only persist the
1055 	 * nexus retire. Any children of a retired nexus
1056 	 * are automatically covered by the retire store
1057 	 * code.
1058 	 */
1059 	retval = e_ddi_retire_persist(devpath);
1060 	if (retval != 0) {
1061 		cmn_err(CE_WARN, "Failed to persist device retire: error %d: "
1062 		    "%s", retval, devpath);
1063 		kmem_free(devpath, strlen(devpath) + 1);
1064 		return (retval);
1065 	}
1066 	if (moddebug & MODDEBUG_RETIRE)
1067 		cmn_err(CE_NOTE, "Persisted retire of device: %s", devpath);
1068 
1069 	kmem_free(devpath, strlen(devpath) + 1);
1070 	return (0);
1071 }
1072 
1073 static int
modctl_is_retired(char * path,int * statep)1074 modctl_is_retired(char *path, int *statep)
1075 {
1076 	char	*pathbuf;
1077 	char	*devpath;
1078 	size_t	pathsz;
1079 	int	error;
1080 	int	status;
1081 
1082 	if (path == NULL || statep == NULL)
1083 		return (EINVAL);
1084 
1085 	pathbuf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1086 	error = copyinstr(path, pathbuf, MAXPATHLEN, &pathsz);
1087 	if (error != 0) {
1088 		kmem_free(pathbuf, MAXPATHLEN);
1089 		return (error);
1090 	}
1091 	devpath = i_ddi_strdup(pathbuf, KM_SLEEP);
1092 	kmem_free(pathbuf, MAXPATHLEN);
1093 
1094 	if (e_ddi_device_retired(devpath))
1095 		status = 1;
1096 	else
1097 		status = 0;
1098 	kmem_free(devpath, strlen(devpath) + 1);
1099 
1100 	return (copyout(&status, statep, sizeof (status)) ? EFAULT : 0);
1101 }
1102 
1103 static int
modctl_unretire(char * path)1104 modctl_unretire(char *path)
1105 {
1106 	char	*pathbuf;
1107 	char	*devpath;
1108 	size_t	pathsz;
1109 	int	retired;
1110 	int	retval;
1111 
1112 	if (path == NULL)
1113 		return (EINVAL);
1114 
1115 	pathbuf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1116 	retval = copyinstr(path, pathbuf, MAXPATHLEN, &pathsz);
1117 	if (retval != 0) {
1118 		kmem_free(pathbuf, MAXPATHLEN);
1119 		return (retval);
1120 	}
1121 	devpath = i_ddi_strdup(pathbuf, KM_SLEEP);
1122 	kmem_free(pathbuf, MAXPATHLEN);
1123 
1124 	/*
1125 	 * We check if a device is retired (first) before
1126 	 * unpersisting the retire, because we use the
1127 	 * retire store to determine if a device is retired.
1128 	 * If we unpersist first, the device will always appear
1129 	 * to be unretired. For the rationale behind unpersisting
1130 	 * a device that is not retired, see the next comment.
1131 	 */
1132 	retired = e_ddi_device_retired(devpath);
1133 
1134 	/*
1135 	 * We call unpersist unconditionally because the lookup
1136 	 * for retired devices (e_ddi_device_retired()), skips "bypassed"
1137 	 * devices. We still want to be able remove "bypassed" entries
1138 	 * from the persistent store, so we unpersist unconditionally
1139 	 * i.e. whether or not the entry is found on a lookup.
1140 	 *
1141 	 * e_ddi_retire_unpersist() returns 1 if it found and cleared
1142 	 * an entry from the retire store or 0 otherwise.
1143 	 */
1144 	if (e_ddi_retire_unpersist(devpath))
1145 		if (moddebug & MODDEBUG_RETIRE) {
1146 			cmn_err(CE_NOTE, "Unpersisted retire of device: %s",
1147 			    devpath);
1148 		}
1149 
1150 	/*
1151 	 * Check if the device is already unretired. If so,
1152 	 * the unretire becomes a NOP
1153 	 */
1154 	if (!retired) {
1155 		cmn_err(CE_NOTE, "Not retired: %s", devpath);
1156 		kmem_free(devpath, strlen(devpath) + 1);
1157 		return (0);
1158 	}
1159 
1160 	retval = e_ddi_unretire_device(devpath);
1161 	if (retval != 0) {
1162 		cmn_err(CE_WARN, "cannot unretire device: error %d, path %s\n",
1163 		    retval, devpath);
1164 	}
1165 
1166 	kmem_free(devpath, strlen(devpath) + 1);
1167 
1168 	return (retval);
1169 }
1170 
1171 static int
modctl_getname(char * uname,uint_t ulen,int * umajorp)1172 modctl_getname(char *uname, uint_t ulen, int *umajorp)
1173 {
1174 	char *name;
1175 	major_t major;
1176 
1177 	if (copyin(umajorp, &major, sizeof (major)) != 0)
1178 		return (EFAULT);
1179 	if ((name = mod_major_to_name(major)) == NULL)
1180 		return (ENODEV);
1181 	if ((strlen(name) + 1) > ulen)
1182 		return (ENOSPC);
1183 	return (copyoutstr(name, uname, ulen, NULL));
1184 }
1185 
1186 static int
modctl_devt2instance(dev_t dev,int * uinstancep)1187 modctl_devt2instance(dev_t dev, int *uinstancep)
1188 {
1189 	int	instance;
1190 
1191 	if ((instance = dev_to_instance(dev)) == -1)
1192 		return (EINVAL);
1193 
1194 	return (copyout(&instance, uinstancep, sizeof (int)));
1195 }
1196 
1197 /*
1198  * Return the sizeof of the device id.
1199  */
1200 static int
modctl_sizeof_devid(dev_t dev,uint_t * len)1201 modctl_sizeof_devid(dev_t dev, uint_t *len)
1202 {
1203 	uint_t		sz;
1204 	ddi_devid_t	devid;
1205 
1206 	/* get device id */
1207 	if (ddi_lyr_get_devid(dev, &devid) == DDI_FAILURE)
1208 		return (EINVAL);
1209 
1210 	sz = ddi_devid_sizeof(devid);
1211 	ddi_devid_free(devid);
1212 
1213 	/* copyout device id size */
1214 	if (copyout(&sz, len, sizeof (sz)) != 0)
1215 		return (EFAULT);
1216 
1217 	return (0);
1218 }
1219 
1220 /*
1221  * Return a copy of the device id.
1222  */
1223 static int
modctl_get_devid(dev_t dev,uint_t len,ddi_devid_t udevid)1224 modctl_get_devid(dev_t dev, uint_t len, ddi_devid_t udevid)
1225 {
1226 	uint_t		sz;
1227 	ddi_devid_t	devid;
1228 	int		err = 0;
1229 
1230 	/* get device id */
1231 	if (ddi_lyr_get_devid(dev, &devid) == DDI_FAILURE)
1232 		return (EINVAL);
1233 
1234 	sz = ddi_devid_sizeof(devid);
1235 
1236 	/* Error if device id is larger than space allocated */
1237 	if (sz > len) {
1238 		ddi_devid_free(devid);
1239 		return (ENOSPC);
1240 	}
1241 
1242 	/* copy out device id */
1243 	if (copyout(devid, udevid, sz) != 0)
1244 		err = EFAULT;
1245 	ddi_devid_free(devid);
1246 	return (err);
1247 }
1248 
1249 /*
1250  * return the /devices paths associated with the specified devid and
1251  * minor name.
1252  */
1253 /*ARGSUSED*/
1254 static int
modctl_devid2paths(ddi_devid_t udevid,char * uminor_name,uint_t flag,size_t * ulensp,char * upaths)1255 modctl_devid2paths(ddi_devid_t udevid, char *uminor_name, uint_t flag,
1256     size_t *ulensp, char *upaths)
1257 {
1258 	ddi_devid_t	devid = NULL;
1259 	int		devid_len;
1260 	char		*minor_name = NULL;
1261 	dev_info_t	*dip = NULL;
1262 	struct ddi_minor_data	*dmdp;
1263 	char		*path = NULL;
1264 	int		ulens;
1265 	int		lens;
1266 	int		len;
1267 	dev_t		*devlist = NULL;
1268 	int		ndevs;
1269 	int		i;
1270 	int		ret = 0;
1271 
1272 	/*
1273 	 * If upaths is NULL then we are only computing the amount of space
1274 	 * needed to hold the paths and returning the value in *ulensp. If we
1275 	 * are copying out paths then we get the amount of space allocated by
1276 	 * the caller. If the actual space needed for paths is larger, or
1277 	 * things are changing out from under us, then we return EAGAIN.
1278 	 */
1279 	if (upaths) {
1280 		if (ulensp == NULL)
1281 			return (EINVAL);
1282 		if (copyin(ulensp, &ulens, sizeof (ulens)) != 0)
1283 			return (EFAULT);
1284 	}
1285 
1286 	/*
1287 	 * copyin enough of the devid to determine the length then
1288 	 * reallocate and copy in the entire devid.
1289 	 */
1290 	devid_len = ddi_devid_sizeof(NULL);
1291 	devid = kmem_alloc(devid_len, KM_SLEEP);
1292 	if (copyin(udevid, devid, devid_len)) {
1293 		ret = EFAULT;
1294 		goto out;
1295 	}
1296 	len = devid_len;
1297 	devid_len = ddi_devid_sizeof(devid);
1298 	kmem_free(devid, len);
1299 	devid = kmem_alloc(devid_len, KM_SLEEP);
1300 	if (copyin(udevid, devid, devid_len)) {
1301 		ret = EFAULT;
1302 		goto out;
1303 	}
1304 
1305 	/* copyin the minor name if specified. */
1306 	minor_name = uminor_name;
1307 	if ((minor_name != DEVID_MINOR_NAME_ALL) &&
1308 	    (minor_name != DEVID_MINOR_NAME_ALL_CHR) &&
1309 	    (minor_name != DEVID_MINOR_NAME_ALL_BLK)) {
1310 		minor_name = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1311 		if (copyinstr(uminor_name, minor_name, MAXPATHLEN, 0)) {
1312 			ret = EFAULT;
1313 			goto out;
1314 		}
1315 	}
1316 
1317 	/*
1318 	 * Use existing function to resolve the devid into a devlist.
1319 	 *
1320 	 * NOTE: there is a loss of spectype information in the current
1321 	 * ddi_lyr_devid_to_devlist implementation. We work around this by not
1322 	 * passing down DEVID_MINOR_NAME_ALL here, but reproducing all minor
1323 	 * node forms in the loop processing the devlist below. It would be
1324 	 * best if at some point the use of this interface here was replaced
1325 	 * with a path oriented call.
1326 	 */
1327 	if (ddi_lyr_devid_to_devlist(devid,
1328 	    (minor_name == DEVID_MINOR_NAME_ALL) ?
1329 	    DEVID_MINOR_NAME_ALL_CHR : minor_name,
1330 	    &ndevs, &devlist) != DDI_SUCCESS) {
1331 		ret = EINVAL;
1332 		goto out;
1333 	}
1334 
1335 	/*
1336 	 * loop over the devlist, converting each devt to a path and doing
1337 	 * a copyout of the path and computation of the amount of space
1338 	 * needed to hold all the paths
1339 	 */
1340 	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1341 	for (i = 0, lens = 0; i < ndevs; i++) {
1342 
1343 		/* find the dip associated with the dev_t */
1344 		if ((dip = e_ddi_hold_devi_by_dev(devlist[i], 0)) == NULL)
1345 			continue;
1346 
1347 		/* loop over all the minor nodes, skipping ones we don't want */
1348 		ndi_devi_enter(dip);
1349 		for (dmdp = DEVI(dip)->devi_minor; dmdp; dmdp = dmdp->next) {
1350 			if ((dmdp->ddm_dev != devlist[i]) ||
1351 			    (dmdp->type != DDM_MINOR))
1352 				continue;
1353 
1354 			if ((minor_name != DEVID_MINOR_NAME_ALL) &&
1355 			    (minor_name != DEVID_MINOR_NAME_ALL_CHR) &&
1356 			    (minor_name != DEVID_MINOR_NAME_ALL_BLK) &&
1357 			    strcmp(minor_name, dmdp->ddm_name))
1358 				continue;
1359 			else {
1360 				if ((minor_name == DEVID_MINOR_NAME_ALL_CHR) &&
1361 				    (dmdp->ddm_spec_type != S_IFCHR))
1362 					continue;
1363 				if ((minor_name == DEVID_MINOR_NAME_ALL_BLK) &&
1364 				    (dmdp->ddm_spec_type != S_IFBLK))
1365 					continue;
1366 			}
1367 
1368 			(void) ddi_pathname_minor(dmdp, path);
1369 			len = strlen(path) + 1;
1370 			*(path + len) = '\0';	/* set double termination */
1371 			lens += len;
1372 
1373 			/* copyout the path with double terminations */
1374 			if (upaths) {
1375 				if (lens > ulens) {
1376 					ret = EAGAIN;
1377 					goto out;
1378 				}
1379 				if (copyout(path, upaths, len + 1)) {
1380 					ret = EFAULT;
1381 					goto out;
1382 				}
1383 				upaths += len;
1384 			}
1385 		}
1386 		ndi_devi_exit(dip);
1387 		ddi_release_devi(dip);
1388 		dip = NULL;
1389 	}
1390 	lens++;		/* add one for double termination */
1391 
1392 	/* copy out the amount of space needed to hold the paths */
1393 	if (ulensp && copyout(&lens, ulensp, sizeof (lens))) {
1394 		ret = EFAULT;
1395 		goto out;
1396 	}
1397 	ret = 0;
1398 
1399 out:	if (dip) {
1400 		ndi_devi_exit(dip);
1401 		ddi_release_devi(dip);
1402 	}
1403 	if (path)
1404 		kmem_free(path, MAXPATHLEN);
1405 	if (devlist)
1406 		ddi_lyr_free_devlist(devlist, ndevs);
1407 	if (minor_name &&
1408 	    (minor_name != DEVID_MINOR_NAME_ALL) &&
1409 	    (minor_name != DEVID_MINOR_NAME_ALL_CHR) &&
1410 	    (minor_name != DEVID_MINOR_NAME_ALL_BLK))
1411 		kmem_free(minor_name, MAXPATHLEN);
1412 	if (devid)
1413 		kmem_free(devid, devid_len);
1414 	return (ret);
1415 }
1416 
1417 /*
1418  * Return the size of the minor name.
1419  */
1420 static int
modctl_sizeof_minorname(dev_t dev,int spectype,uint_t * len)1421 modctl_sizeof_minorname(dev_t dev, int spectype, uint_t *len)
1422 {
1423 	uint_t	sz;
1424 	char	*name;
1425 
1426 	/* get the minor name */
1427 	if (ddi_lyr_get_minor_name(dev, spectype, &name) == DDI_FAILURE)
1428 		return (EINVAL);
1429 
1430 	sz = strlen(name) + 1;
1431 	kmem_free(name, sz);
1432 
1433 	/* copy out the size of the minor name */
1434 	if (copyout(&sz, len, sizeof (sz)) != 0)
1435 		return (EFAULT);
1436 
1437 	return (0);
1438 }
1439 
1440 /*
1441  * Return the minor name.
1442  */
1443 static int
modctl_get_minorname(dev_t dev,int spectype,uint_t len,char * uname)1444 modctl_get_minorname(dev_t dev, int spectype, uint_t len, char *uname)
1445 {
1446 	uint_t	sz;
1447 	char	*name;
1448 	int	err = 0;
1449 
1450 	/* get the minor name */
1451 	if (ddi_lyr_get_minor_name(dev, spectype, &name) == DDI_FAILURE)
1452 		return (EINVAL);
1453 
1454 	sz = strlen(name) + 1;
1455 
1456 	/* Error if the minor name is larger than the space allocated */
1457 	if (sz > len) {
1458 		kmem_free(name, sz);
1459 		return (ENOSPC);
1460 	}
1461 
1462 	/* copy out the minor name */
1463 	if (copyout(name, uname, sz) != 0)
1464 		err = EFAULT;
1465 	kmem_free(name, sz);
1466 	return (err);
1467 }
1468 
1469 /*
1470  * Return the size of the (dev_t,spectype) devfspath name.
1471  */
1472 static int
modctl_devfspath_len(dev_t dev,int spectype,uint_t * len)1473 modctl_devfspath_len(dev_t dev, int spectype, uint_t *len)
1474 {
1475 	uint_t	sz;
1476 	char	*name;
1477 
1478 	/* get the path name */
1479 	name = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1480 	if (ddi_dev_pathname(dev, spectype, name) == DDI_FAILURE) {
1481 		kmem_free(name, MAXPATHLEN);
1482 		return (EINVAL);
1483 	}
1484 
1485 	sz = strlen(name) + 1;
1486 	kmem_free(name, MAXPATHLEN);
1487 
1488 	/* copy out the size of the path name */
1489 	if (copyout(&sz, len, sizeof (sz)) != 0)
1490 		return (EFAULT);
1491 
1492 	return (0);
1493 }
1494 
1495 /*
1496  * Return the (dev_t,spectype) devfspath name.
1497  */
1498 static int
modctl_devfspath(dev_t dev,int spectype,uint_t len,char * uname)1499 modctl_devfspath(dev_t dev, int spectype, uint_t len, char *uname)
1500 {
1501 	uint_t	sz;
1502 	char	*name;
1503 	int	err = 0;
1504 
1505 	/* get the path name */
1506 	name = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1507 	if (ddi_dev_pathname(dev, spectype, name) == DDI_FAILURE) {
1508 		kmem_free(name, MAXPATHLEN);
1509 		return (EINVAL);
1510 	}
1511 
1512 	sz = strlen(name) + 1;
1513 
1514 	/* Error if the path name is larger than the space allocated */
1515 	if (sz > len) {
1516 		kmem_free(name, MAXPATHLEN);
1517 		return (ENOSPC);
1518 	}
1519 
1520 	/* copy out the path name */
1521 	if (copyout(name, uname, sz) != 0)
1522 		err = EFAULT;
1523 	kmem_free(name, MAXPATHLEN);
1524 	return (err);
1525 }
1526 
1527 /*
1528  * Return the size of the (major,instance) devfspath name.
1529  */
1530 static int
modctl_devfspath_mi_len(major_t major,int instance,uint_t * len)1531 modctl_devfspath_mi_len(major_t major, int instance, uint_t *len)
1532 {
1533 	uint_t	sz;
1534 	char	*name;
1535 
1536 	/* get the path name */
1537 	name = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1538 	if (e_ddi_majorinstance_to_path(major, instance, name) != DDI_SUCCESS) {
1539 		kmem_free(name, MAXPATHLEN);
1540 		return (EINVAL);
1541 	}
1542 
1543 	sz = strlen(name) + 1;
1544 	kmem_free(name, MAXPATHLEN);
1545 
1546 	/* copy out the size of the path name */
1547 	if (copyout(&sz, len, sizeof (sz)) != 0)
1548 		return (EFAULT);
1549 
1550 	return (0);
1551 }
1552 
1553 /*
1554  * Return the (major_instance) devfspath name.
1555  * NOTE: e_ddi_majorinstance_to_path does not require the device to attach to
1556  * return a path - it uses the instance tree.
1557  */
1558 static int
modctl_devfspath_mi(major_t major,int instance,uint_t len,char * uname)1559 modctl_devfspath_mi(major_t major, int instance, uint_t len, char *uname)
1560 {
1561 	uint_t	sz;
1562 	char	*name;
1563 	int	err = 0;
1564 
1565 	/* get the path name */
1566 	name = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1567 	if (e_ddi_majorinstance_to_path(major, instance, name) != DDI_SUCCESS) {
1568 		kmem_free(name, MAXPATHLEN);
1569 		return (EINVAL);
1570 	}
1571 
1572 	sz = strlen(name) + 1;
1573 
1574 	/* Error if the path name is larger than the space allocated */
1575 	if (sz > len) {
1576 		kmem_free(name, MAXPATHLEN);
1577 		return (ENOSPC);
1578 	}
1579 
1580 	/* copy out the path name */
1581 	if (copyout(name, uname, sz) != 0)
1582 		err = EFAULT;
1583 	kmem_free(name, MAXPATHLEN);
1584 	return (err);
1585 }
1586 
1587 static int
modctl_get_fbname(char * path)1588 modctl_get_fbname(char *path)
1589 {
1590 	extern dev_t fbdev;
1591 	char *pathname = NULL;
1592 	int rval = 0;
1593 
1594 	/* make sure fbdev is set before we plunge in */
1595 	if (fbdev == NODEV)
1596 		return (ENODEV);
1597 
1598 	pathname = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1599 	if ((rval = ddi_dev_pathname(fbdev, S_IFCHR,
1600 	    pathname)) == DDI_SUCCESS) {
1601 		if (copyout(pathname, path, strlen(pathname)+1) != 0) {
1602 			rval = EFAULT;
1603 		}
1604 	}
1605 	kmem_free(pathname, MAXPATHLEN);
1606 	return (rval);
1607 }
1608 
1609 /*
1610  * modctl_reread_dacf()
1611  *	Reread the dacf rules database from the named binding file.
1612  *	If NULL is specified, pass along the NULL, it means 'use the default'.
1613  */
1614 static int
modctl_reread_dacf(char * path)1615 modctl_reread_dacf(char *path)
1616 {
1617 	int rval = 0;
1618 	char *filename, *filenamep;
1619 
1620 	filename = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1621 
1622 	if (path == NULL) {
1623 		filenamep = NULL;
1624 	} else {
1625 		if (copyinstr(path, filename, MAXPATHLEN, 0) != 0) {
1626 			rval = EFAULT;
1627 			goto out;
1628 		}
1629 		filenamep = filename;
1630 		filenamep[MAXPATHLEN - 1] = '\0';
1631 	}
1632 
1633 	rval = read_dacf_binding_file(filenamep);
1634 out:
1635 	kmem_free(filename, MAXPATHLEN);
1636 	return (rval);
1637 }
1638 
1639 /*ARGSUSED*/
1640 static int
modctl_modevents(int subcmd,uintptr_t a2,uintptr_t a3,uintptr_t a4,uint_t flag)1641 modctl_modevents(int subcmd, uintptr_t a2, uintptr_t a3, uintptr_t a4,
1642     uint_t flag)
1643 {
1644 	int error = 0;
1645 	char *filenamep;
1646 
1647 	switch (subcmd) {
1648 
1649 	case MODEVENTS_FLUSH:
1650 		/* flush all currently queued events */
1651 		log_sysevent_flushq(subcmd, flag);
1652 		break;
1653 
1654 	case MODEVENTS_SET_DOOR_UPCALL_FILENAME:
1655 		/*
1656 		 * bind door_upcall to filename
1657 		 * this should only be done once per invocation
1658 		 * of the event daemon.
1659 		 */
1660 
1661 		filenamep = kmem_zalloc(MOD_MAXPATH, KM_SLEEP);
1662 
1663 		if (copyinstr((char *)a2, filenamep, MOD_MAXPATH, 0)) {
1664 			error = EFAULT;
1665 		} else {
1666 			error = log_sysevent_filename(filenamep);
1667 		}
1668 		kmem_free(filenamep, MOD_MAXPATH);
1669 		break;
1670 
1671 	case MODEVENTS_GETDATA:
1672 		error = log_sysevent_copyout_data((sysevent_id_t *)a2,
1673 		    (size_t)a3, (caddr_t)a4);
1674 		break;
1675 
1676 	case MODEVENTS_FREEDATA:
1677 		error = log_sysevent_free_data((sysevent_id_t *)a2);
1678 		break;
1679 	case MODEVENTS_POST_EVENT:
1680 		error = log_usr_sysevent((sysevent_t *)a2, (uint32_t)a3,
1681 		    (sysevent_id_t *)a4);
1682 		break;
1683 	case MODEVENTS_REGISTER_EVENT:
1684 		error = log_sysevent_register((char *)a2, (char *)a3,
1685 		    (se_pubsub_t *)a4);
1686 		break;
1687 	default:
1688 		error = EINVAL;
1689 	}
1690 
1691 	return (error);
1692 }
1693 
1694 static void
free_mperm(mperm_t * mp)1695 free_mperm(mperm_t *mp)
1696 {
1697 	int len;
1698 
1699 	if (mp->mp_minorname) {
1700 		len = strlen(mp->mp_minorname) + 1;
1701 		kmem_free(mp->mp_minorname, len);
1702 	}
1703 	kmem_free(mp, sizeof (mperm_t));
1704 }
1705 
1706 #define	MP_NO_DRV_ERR	\
1707 	"/etc/minor_perm: no driver for %s\n"
1708 
1709 #define	MP_EMPTY_MINOR	\
1710 	"/etc/minor_perm: empty minor name for driver %s\n"
1711 
1712 #define	MP_NO_MINOR	\
1713 	"/etc/minor_perm: no minor matching %s for driver %s\n"
1714 
1715 /*
1716  * Remove mperm entry with matching minorname
1717  */
1718 static void
rem_minorperm(major_t major,char * drvname,mperm_t * mp,int is_clone)1719 rem_minorperm(major_t major, char *drvname, mperm_t *mp, int is_clone)
1720 {
1721 	mperm_t **mp_head;
1722 	mperm_t *freemp = NULL;
1723 	struct devnames *dnp = &devnamesp[major];
1724 	mperm_t **wildmp;
1725 
1726 	ASSERT(mp->mp_minorname && strlen(mp->mp_minorname) > 0);
1727 
1728 	LOCK_DEV_OPS(&dnp->dn_lock);
1729 	if (strcmp(mp->mp_minorname, "*") == 0) {
1730 		wildmp = ((is_clone == 0) ?
1731 		    &dnp->dn_mperm_wild : &dnp->dn_mperm_clone);
1732 		if (*wildmp)
1733 			freemp = *wildmp;
1734 		*wildmp = NULL;
1735 	} else {
1736 		mp_head = &dnp->dn_mperm;
1737 		while (*mp_head) {
1738 			if (strcmp((*mp_head)->mp_minorname,
1739 			    mp->mp_minorname) != 0) {
1740 				mp_head = &(*mp_head)->mp_next;
1741 				continue;
1742 			}
1743 			/* remove the entry */
1744 			freemp = *mp_head;
1745 			*mp_head = freemp->mp_next;
1746 			break;
1747 		}
1748 	}
1749 	if (freemp) {
1750 		if (moddebug & MODDEBUG_MINORPERM) {
1751 			cmn_err(CE_CONT, "< %s %s 0%o %d %d\n",
1752 			    drvname, freemp->mp_minorname,
1753 			    freemp->mp_mode & 0777,
1754 			    freemp->mp_uid, freemp->mp_gid);
1755 		}
1756 		free_mperm(freemp);
1757 	} else {
1758 		if (moddebug & MODDEBUG_MINORPERM) {
1759 			cmn_err(CE_CONT, MP_NO_MINOR,
1760 			    drvname, mp->mp_minorname);
1761 		}
1762 	}
1763 
1764 	UNLOCK_DEV_OPS(&dnp->dn_lock);
1765 }
1766 
1767 /*
1768  * Add minor perm entry
1769  */
1770 static void
add_minorperm(major_t major,char * drvname,mperm_t * mp,int is_clone)1771 add_minorperm(major_t major, char *drvname, mperm_t *mp, int is_clone)
1772 {
1773 	mperm_t **mp_head;
1774 	mperm_t *freemp = NULL;
1775 	struct devnames *dnp = &devnamesp[major];
1776 	mperm_t **wildmp;
1777 
1778 	ASSERT(mp->mp_minorname && strlen(mp->mp_minorname) > 0);
1779 
1780 	/*
1781 	 * Note that update_drv replace semantics require
1782 	 * replacing matching entries with the new permissions.
1783 	 */
1784 	LOCK_DEV_OPS(&dnp->dn_lock);
1785 	if (strcmp(mp->mp_minorname, "*") == 0) {
1786 		wildmp = ((is_clone == 0) ?
1787 		    &dnp->dn_mperm_wild : &dnp->dn_mperm_clone);
1788 		if (*wildmp)
1789 			freemp = *wildmp;
1790 		*wildmp = mp;
1791 	} else {
1792 		mperm_t *p, *v = NULL;
1793 		for (p = dnp->dn_mperm; p; v = p, p = p->mp_next) {
1794 			if (strcmp(p->mp_minorname, mp->mp_minorname) == 0) {
1795 				if (v == NULL)
1796 					dnp->dn_mperm = mp;
1797 				else
1798 					v->mp_next = mp;
1799 				mp->mp_next = p->mp_next;
1800 				freemp = p;
1801 				goto replaced;
1802 			}
1803 		}
1804 		if (p == NULL) {
1805 			mp_head = &dnp->dn_mperm;
1806 			if (*mp_head == NULL) {
1807 				*mp_head = mp;
1808 			} else {
1809 				mp->mp_next = *mp_head;
1810 				*mp_head = mp;
1811 			}
1812 		}
1813 	}
1814 replaced:
1815 	if (freemp) {
1816 		if (moddebug & MODDEBUG_MINORPERM) {
1817 			cmn_err(CE_CONT, "< %s %s 0%o %d %d\n",
1818 			    drvname, freemp->mp_minorname,
1819 			    freemp->mp_mode & 0777,
1820 			    freemp->mp_uid, freemp->mp_gid);
1821 		}
1822 		free_mperm(freemp);
1823 	}
1824 	if (moddebug & MODDEBUG_MINORPERM) {
1825 		cmn_err(CE_CONT, "> %s %s 0%o %d %d\n",
1826 		    drvname, mp->mp_minorname, mp->mp_mode & 0777,
1827 		    mp->mp_uid, mp->mp_gid);
1828 	}
1829 	UNLOCK_DEV_OPS(&dnp->dn_lock);
1830 }
1831 
1832 
1833 static int
process_minorperm(int cmd,nvlist_t * nvl)1834 process_minorperm(int cmd, nvlist_t *nvl)
1835 {
1836 	char *minor;
1837 	major_t major;
1838 	mperm_t *mp;
1839 	nvpair_t *nvp;
1840 	char *name;
1841 	int is_clone;
1842 	major_t minmaj;
1843 
1844 	ASSERT(cmd == MODLOADMINORPERM ||
1845 	    cmd == MODADDMINORPERM || cmd == MODREMMINORPERM);
1846 
1847 	nvp = NULL;
1848 	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
1849 		name = nvpair_name(nvp);
1850 
1851 		is_clone = 0;
1852 		(void) nvpair_value_string(nvp, &minor);
1853 		major = ddi_name_to_major(name);
1854 		if (major != DDI_MAJOR_T_NONE) {
1855 			mp = kmem_zalloc(sizeof (*mp), KM_SLEEP);
1856 			if (minor == NULL || strlen(minor) == 0) {
1857 				if (moddebug & MODDEBUG_MINORPERM) {
1858 					cmn_err(CE_CONT, MP_EMPTY_MINOR, name);
1859 				}
1860 				minor = "*";
1861 			}
1862 
1863 			/*
1864 			 * The minor name of a node using the clone
1865 			 * driver must be the driver name.  To avoid
1866 			 * multiple searches, we map entries in the form
1867 			 * clone:<driver> to <driver>:*.  This also allows us
1868 			 * to filter out some of the litter in /etc/minor_perm.
1869 			 * Minor perm alias entries where the name is not
1870 			 * the driver kept on the clone list itself.
1871 			 * This all seems very fragile as a driver could
1872 			 * be introduced with an existing alias name.
1873 			 */
1874 			if (strcmp(name, "clone") == 0) {
1875 				minmaj = ddi_name_to_major(minor);
1876 				if (minmaj != DDI_MAJOR_T_NONE) {
1877 					if (moddebug & MODDEBUG_MINORPERM) {
1878 						cmn_err(CE_CONT,
1879 						    "mapping %s:%s to %s:*\n",
1880 						    name, minor, minor);
1881 					}
1882 					major = minmaj;
1883 					name = minor;
1884 					minor = "*";
1885 					is_clone = 1;
1886 				}
1887 			}
1888 
1889 			if (mp) {
1890 				mp->mp_minorname =
1891 				    i_ddi_strdup(minor, KM_SLEEP);
1892 			}
1893 		} else {
1894 			mp = NULL;
1895 			if (moddebug & MODDEBUG_MINORPERM) {
1896 				cmn_err(CE_CONT, MP_NO_DRV_ERR, name);
1897 			}
1898 		}
1899 
1900 		/* mode */
1901 		nvp = nvlist_next_nvpair(nvl, nvp);
1902 		ASSERT(strcmp(nvpair_name(nvp), "mode") == 0);
1903 		if (mp)
1904 			(void) nvpair_value_int32(nvp, (int *)&mp->mp_mode);
1905 		/* uid */
1906 		nvp = nvlist_next_nvpair(nvl, nvp);
1907 		ASSERT(strcmp(nvpair_name(nvp), "uid") == 0);
1908 		if (mp)
1909 			(void) nvpair_value_uint32(nvp, &mp->mp_uid);
1910 		/* gid */
1911 		nvp = nvlist_next_nvpair(nvl, nvp);
1912 		ASSERT(strcmp(nvpair_name(nvp), "gid") == 0);
1913 		if (mp) {
1914 			(void) nvpair_value_uint32(nvp, &mp->mp_gid);
1915 
1916 			if (cmd == MODREMMINORPERM) {
1917 				rem_minorperm(major, name, mp, is_clone);
1918 				free_mperm(mp);
1919 			} else {
1920 				add_minorperm(major, name, mp, is_clone);
1921 			}
1922 		}
1923 	}
1924 
1925 	if (cmd == MODLOADMINORPERM)
1926 		minorperm_loaded = 1;
1927 
1928 	/*
1929 	 * Reset permissions of cached dv_nodes
1930 	 */
1931 	(void) devfs_reset_perm(DV_RESET_PERM);
1932 
1933 	return (0);
1934 }
1935 
1936 static int
modctl_minorperm(int cmd,char * usrbuf,size_t buflen)1937 modctl_minorperm(int cmd, char *usrbuf, size_t buflen)
1938 {
1939 	int error;
1940 	nvlist_t *nvl;
1941 	char *buf = kmem_alloc(buflen, KM_SLEEP);
1942 
1943 	if ((error = ddi_copyin(usrbuf, buf, buflen, 0)) != 0) {
1944 		kmem_free(buf, buflen);
1945 		return (error);
1946 	}
1947 
1948 	error = nvlist_unpack(buf, buflen, &nvl, KM_SLEEP);
1949 	kmem_free(buf, buflen);
1950 	if (error)
1951 		return (error);
1952 
1953 	error = process_minorperm(cmd, nvl);
1954 	nvlist_free(nvl);
1955 	return (error);
1956 }
1957 
1958 struct walk_args {
1959 	char		*wa_drvname;
1960 	list_t		wa_pathlist;
1961 };
1962 
1963 struct path_elem {
1964 	char		*pe_dir;
1965 	char		*pe_nodename;
1966 	list_node_t	pe_node;
1967 	int		pe_dirlen;
1968 };
1969 
1970 /*ARGSUSED*/
1971 static int
modctl_inst_walker(const char * path,in_node_t * np,in_drv_t * dp,void * arg)1972 modctl_inst_walker(const char *path, in_node_t *np, in_drv_t *dp, void *arg)
1973 {
1974 	struct walk_args *wargs = (struct walk_args *)arg;
1975 	struct path_elem *pe;
1976 	char *nodename;
1977 
1978 	/*
1979 	 * Search may be restricted to a single driver in the case of rem_drv
1980 	 */
1981 	if (wargs->wa_drvname &&
1982 	    strcmp(dp->ind_driver_name, wargs->wa_drvname) != 0)
1983 		return (INST_WALK_CONTINUE);
1984 
1985 	pe = kmem_zalloc(sizeof (*pe), KM_SLEEP);
1986 	pe->pe_dir = i_ddi_strdup((char *)path, KM_SLEEP);
1987 	pe->pe_dirlen = strlen(pe->pe_dir) + 1;
1988 	ASSERT(strrchr(pe->pe_dir, '/') != NULL);
1989 	nodename = strrchr(pe->pe_dir, '/');
1990 	*nodename++ = 0;
1991 	pe->pe_nodename = nodename;
1992 	list_insert_tail(&wargs->wa_pathlist, pe);
1993 
1994 	return (INST_WALK_CONTINUE);
1995 }
1996 
1997 /*
1998  * /devices attribute nodes clean-up optionally performed
1999  * when removing a driver (rem_drv -C).
2000  *
2001  * Removing attribute nodes allows a machine to be reprovisioned
2002  * without the side-effect of inadvertently picking up stale
2003  * device node ownership or permissions.
2004  *
2005  * Preserving attributes (not performing cleanup) allows devices
2006  * attribute changes to be preserved across upgrades, as
2007  * upgrade rather heavy-handedly does a rem_drv/add_drv cycle.
2008  */
2009 static int
modctl_remdrv_cleanup(const char * u_drvname)2010 modctl_remdrv_cleanup(const char *u_drvname)
2011 {
2012 	struct walk_args *wargs;
2013 	struct path_elem *pe;
2014 	char *drvname;
2015 	int err, rval = 0;
2016 
2017 	drvname = kmem_alloc(MAXMODCONFNAME, KM_SLEEP);
2018 	if ((err = copyinstr(u_drvname, drvname, MAXMODCONFNAME, 0))) {
2019 		kmem_free(drvname, MAXMODCONFNAME);
2020 		return (err);
2021 	}
2022 
2023 	/*
2024 	 * First go through the instance database.  For each
2025 	 * instance of a device bound to the driver being
2026 	 * removed, remove any underlying devfs attribute nodes.
2027 	 *
2028 	 * This is a two-step process.	First we go through
2029 	 * the instance data itself, constructing a list of
2030 	 * the nodes discovered.  The second step is then
2031 	 * to find and remove any devfs attribute nodes
2032 	 * for the instances discovered in the first step.
2033 	 * The two-step process avoids any difficulties
2034 	 * which could arise by holding the instance data
2035 	 * lock with simultaneous devfs operations.
2036 	 */
2037 	wargs = kmem_zalloc(sizeof (*wargs), KM_SLEEP);
2038 
2039 	wargs->wa_drvname = drvname;
2040 	list_create(&wargs->wa_pathlist,
2041 	    sizeof (struct path_elem), offsetof(struct path_elem, pe_node));
2042 
2043 	(void) e_ddi_walk_instances(modctl_inst_walker, (void *)wargs);
2044 
2045 	for (pe = list_head(&wargs->wa_pathlist); pe != NULL;
2046 	    pe = list_next(&wargs->wa_pathlist, pe)) {
2047 		err = devfs_remdrv_cleanup((const char *)pe->pe_dir,
2048 		    (const char *)pe->pe_nodename);
2049 		if (rval == 0)
2050 			rval = err;
2051 	}
2052 
2053 	while ((pe = list_head(&wargs->wa_pathlist)) != NULL) {
2054 		list_remove(&wargs->wa_pathlist, pe);
2055 		kmem_free(pe->pe_dir, pe->pe_dirlen);
2056 		kmem_free(pe, sizeof (*pe));
2057 	}
2058 	kmem_free(wargs, sizeof (*wargs));
2059 
2060 	/*
2061 	 * Pseudo nodes aren't recorded in the instance database
2062 	 * so any such nodes need to be handled separately.
2063 	 */
2064 	err = devfs_remdrv_cleanup("pseudo", (const char *)drvname);
2065 	if (rval == 0)
2066 		rval = err;
2067 
2068 	kmem_free(drvname, MAXMODCONFNAME);
2069 	return (rval);
2070 }
2071 
2072 /*
2073  * Perform a cleanup of non-existent /devices attribute nodes,
2074  * similar to rem_drv -C, but for all drivers/devices.
2075  * This is also optional, performed as part of devfsadm -C.
2076  */
2077 void
dev_devices_cleanup()2078 dev_devices_cleanup()
2079 {
2080 	struct walk_args *wargs;
2081 	struct path_elem *pe;
2082 	dev_info_t *devi;
2083 	char *path;
2084 	int err;
2085 
2086 	/*
2087 	 * It's expected that all drivers have been loaded and
2088 	 * module unloading disabled while performing cleanup.
2089 	 */
2090 	ASSERT(modunload_disable_count > 0);
2091 
2092 	wargs = kmem_zalloc(sizeof (*wargs), KM_SLEEP);
2093 	wargs->wa_drvname = NULL;
2094 	list_create(&wargs->wa_pathlist,
2095 	    sizeof (struct path_elem), offsetof(struct path_elem, pe_node));
2096 
2097 	(void) e_ddi_walk_instances(modctl_inst_walker, (void *)wargs);
2098 
2099 	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
2100 
2101 	for (pe = list_head(&wargs->wa_pathlist); pe != NULL;
2102 	    pe = list_next(&wargs->wa_pathlist, pe)) {
2103 		(void) snprintf(path, MAXPATHLEN, "%s/%s",
2104 		    pe->pe_dir, pe->pe_nodename);
2105 		devi = e_ddi_hold_devi_by_path(path, 0);
2106 		if (devi != NULL) {
2107 			ddi_release_devi(devi);
2108 		} else {
2109 			err = devfs_remdrv_cleanup((const char *)pe->pe_dir,
2110 			    (const char *)pe->pe_nodename);
2111 			if (err) {
2112 				cmn_err(CE_CONT,
2113 				    "devfs: %s: clean-up error %d\n",
2114 				    path, err);
2115 			}
2116 		}
2117 	}
2118 
2119 	while ((pe = list_head(&wargs->wa_pathlist)) != NULL) {
2120 		list_remove(&wargs->wa_pathlist, pe);
2121 		kmem_free(pe->pe_dir, pe->pe_dirlen);
2122 		kmem_free(pe, sizeof (*pe));
2123 	}
2124 	kmem_free(wargs, sizeof (*wargs));
2125 	kmem_free(path, MAXPATHLEN);
2126 }
2127 
2128 static int
modctl_allocpriv(const char * name)2129 modctl_allocpriv(const char *name)
2130 {
2131 	char *pstr = kmem_alloc(PRIVNAME_MAX, KM_SLEEP);
2132 	int error;
2133 
2134 	if ((error = copyinstr(name, pstr, PRIVNAME_MAX, 0))) {
2135 		kmem_free(pstr, PRIVNAME_MAX);
2136 		return (error);
2137 	}
2138 	error = priv_getbyname(pstr, PRIV_ALLOC);
2139 	if (error < 0)
2140 		error = -error;
2141 	else
2142 		error = 0;
2143 	kmem_free(pstr, PRIVNAME_MAX);
2144 	return (error);
2145 }
2146 
2147 static int
modctl_devexists(const char * upath,int pathlen)2148 modctl_devexists(const char *upath, int pathlen)
2149 {
2150 	char	*path;
2151 	int	ret;
2152 
2153 	/*
2154 	 * copy in the path, including the terminating null
2155 	 */
2156 	pathlen++;
2157 	if (pathlen <= 1 || pathlen > MAXPATHLEN)
2158 		return (EINVAL);
2159 	path = kmem_zalloc(pathlen + 1, KM_SLEEP);
2160 	if ((ret = copyinstr(upath, path, pathlen, NULL)) == 0) {
2161 		ret = sdev_modctl_devexists(path);
2162 	}
2163 
2164 	kmem_free(path, pathlen + 1);
2165 	return (ret);
2166 }
2167 
2168 static int
modctl_devreaddir(const char * udir,int udirlen,char * upaths,int64_t * ulensp)2169 modctl_devreaddir(const char *udir, int udirlen,
2170     char *upaths, int64_t *ulensp)
2171 {
2172 	char	*paths = NULL;
2173 	char	**dirlist = NULL;
2174 	char	*dir;
2175 	int64_t	ulens;
2176 	int64_t	lens;
2177 	int	i, n;
2178 	int	ret = 0;
2179 	char	*p;
2180 	int	npaths;
2181 	int	npaths_alloc;
2182 
2183 	/*
2184 	 * If upaths is NULL then we are only computing the amount of space
2185 	 * needed to return the paths, with the value returned in *ulensp. If we
2186 	 * are copying out paths then we get the amount of space allocated by
2187 	 * the caller. If the actual space needed for paths is larger, or
2188 	 * things are changing out from under us, then we return EAGAIN.
2189 	 */
2190 	if (upaths) {
2191 		if (ulensp == NULL)
2192 			return (EINVAL);
2193 		if (copyin(ulensp, &ulens, sizeof (ulens)) != 0)
2194 			return (EFAULT);
2195 	}
2196 
2197 	/*
2198 	 * copyin the /dev path including terminating null
2199 	 */
2200 	udirlen++;
2201 	if (udirlen <= 1 || udirlen > MAXPATHLEN)
2202 		return (EINVAL);
2203 	dir = kmem_zalloc(udirlen + 1, KM_SLEEP);
2204 	if ((ret = copyinstr(udir, dir, udirlen, NULL)) != 0)
2205 		goto err;
2206 
2207 	if ((ret = sdev_modctl_readdir(dir, &dirlist,
2208 	    &npaths, &npaths_alloc, 0)) != 0) {
2209 		ASSERT(dirlist == NULL);
2210 		goto err;
2211 	}
2212 
2213 	lens = 0;
2214 	for (i = 0; i < npaths; i++) {
2215 		lens += strlen(dirlist[i]) + 1;
2216 	}
2217 	lens++;		/* add one for double termination */
2218 
2219 	if (upaths) {
2220 		if (lens > ulens) {
2221 			ret = EAGAIN;
2222 			goto out;
2223 		}
2224 
2225 		paths = kmem_alloc(lens, KM_SLEEP);
2226 
2227 		p = paths;
2228 		for (i = 0; i < npaths; i++) {
2229 			n = strlen(dirlist[i]) + 1;
2230 			bcopy(dirlist[i], p, n);
2231 			p += n;
2232 		}
2233 		*p = 0;
2234 
2235 		if (copyout(paths, upaths, lens)) {
2236 			ret = EFAULT;
2237 			goto err;
2238 		}
2239 	}
2240 
2241 out:
2242 	/* copy out the amount of space needed to hold the paths */
2243 	if (copyout(&lens, ulensp, sizeof (lens)))
2244 		ret = EFAULT;
2245 
2246 err:
2247 	if (dirlist)
2248 		sdev_modctl_readdir_free(dirlist, npaths, npaths_alloc);
2249 	if (paths)
2250 		kmem_free(paths, lens);
2251 	kmem_free(dir, udirlen + 1);
2252 	return (ret);
2253 }
2254 
2255 static int
modctl_devemptydir(const char * udir,int udirlen,int * uempty)2256 modctl_devemptydir(const char *udir, int udirlen, int *uempty)
2257 {
2258 	char	*dir;
2259 	int	ret;
2260 	char	**dirlist = NULL;
2261 	int	npaths;
2262 	int	npaths_alloc;
2263 	int	empty;
2264 
2265 	/*
2266 	 * copyin the /dev path including terminating null
2267 	 */
2268 	udirlen++;
2269 	if (udirlen <= 1 || udirlen > MAXPATHLEN)
2270 		return (EINVAL);
2271 	dir = kmem_zalloc(udirlen + 1, KM_SLEEP);
2272 	if ((ret = copyinstr(udir, dir, udirlen, NULL)) != 0)
2273 		goto err;
2274 
2275 	if ((ret = sdev_modctl_readdir(dir, &dirlist,
2276 	    &npaths, &npaths_alloc, 1)) != 0) {
2277 		goto err;
2278 	}
2279 
2280 	empty = npaths ? 0 : 1;
2281 	if (copyout(&empty, uempty, sizeof (empty)))
2282 		ret = EFAULT;
2283 
2284 err:
2285 	if (dirlist)
2286 		sdev_modctl_readdir_free(dirlist, npaths, npaths_alloc);
2287 	kmem_free(dir, udirlen + 1);
2288 	return (ret);
2289 }
2290 
2291 static int
modctl_hp(int subcmd,const char * path,char * cn_name,uintptr_t arg,uintptr_t rval)2292 modctl_hp(int subcmd, const char *path, char *cn_name, uintptr_t arg,
2293     uintptr_t rval)
2294 {
2295 	int error = 0;
2296 	size_t pathsz, namesz;
2297 	char *devpath, *cn_name_str;
2298 
2299 	if (path == NULL)
2300 		return (EINVAL);
2301 
2302 	devpath = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
2303 	error = copyinstr(path, devpath, MAXPATHLEN, &pathsz);
2304 	if (error != 0) {
2305 		kmem_free(devpath, MAXPATHLEN);
2306 		return (EFAULT);
2307 	}
2308 
2309 	cn_name_str = kmem_zalloc(MAXNAMELEN, KM_SLEEP);
2310 	error = copyinstr(cn_name, cn_name_str, MAXNAMELEN, &namesz);
2311 	if (error != 0) {
2312 		kmem_free(devpath, MAXPATHLEN);
2313 		kmem_free(cn_name_str, MAXNAMELEN);
2314 
2315 		return (EFAULT);
2316 	}
2317 
2318 	switch (subcmd) {
2319 	case MODHPOPS_CHANGE_STATE:
2320 		error = ddihp_modctl(DDI_HPOP_CN_CHANGE_STATE, devpath,
2321 		    cn_name_str, arg, 0);
2322 		break;
2323 	case MODHPOPS_CREATE_PORT:
2324 		/* Create an empty PORT */
2325 		error = ddihp_modctl(DDI_HPOP_CN_CREATE_PORT, devpath,
2326 		    cn_name_str, 0, 0);
2327 		break;
2328 	case MODHPOPS_REMOVE_PORT:
2329 		/* Remove an empty PORT */
2330 		error = ddihp_modctl(DDI_HPOP_CN_REMOVE_PORT, devpath,
2331 		    cn_name_str, 0, 0);
2332 		break;
2333 	case MODHPOPS_BUS_GET:
2334 		error = ddihp_modctl(DDI_HPOP_CN_GET_PROPERTY, devpath,
2335 		    cn_name_str, arg, rval);
2336 		break;
2337 	case MODHPOPS_BUS_SET:
2338 		error = ddihp_modctl(DDI_HPOP_CN_SET_PROPERTY, devpath,
2339 		    cn_name_str, arg, rval);
2340 		break;
2341 	default:
2342 		error = ENOTSUP;
2343 		break;
2344 	}
2345 
2346 	kmem_free(devpath, MAXPATHLEN);
2347 	kmem_free(cn_name_str, MAXNAMELEN);
2348 
2349 	return (error);
2350 }
2351 
2352 int
modctl_moddevname(int subcmd,uintptr_t a1,uintptr_t a2)2353 modctl_moddevname(int subcmd, uintptr_t a1, uintptr_t a2)
2354 {
2355 	int error = 0;
2356 
2357 	switch (subcmd) {
2358 	case MODDEVNAME_LOOKUPDOOR:
2359 		error = devname_filename_register((char *)a1);
2360 		break;
2361 	case MODDEVNAME_PROFILE:
2362 		error = devname_profile_update((char *)a1, (size_t)a2);
2363 		break;
2364 	case MODDEVNAME_RECONFIG:
2365 		i_ddi_set_reconfig();
2366 		break;
2367 	case MODDEVNAME_SYSAVAIL:
2368 		i_ddi_set_sysavail();
2369 		break;
2370 	default:
2371 		error = EINVAL;
2372 		break;
2373 	}
2374 
2375 	return (error);
2376 }
2377 
2378 /*ARGSUSED5*/
2379 int
modctl(int cmd,uintptr_t a1,uintptr_t a2,uintptr_t a3,uintptr_t a4,uintptr_t a5)2380 modctl(int cmd, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4,
2381     uintptr_t a5)
2382 {
2383 	int	error = EINVAL;
2384 	dev_t	dev;
2385 
2386 	if (secpolicy_modctl(CRED(), cmd) != 0)
2387 		return (set_errno(EPERM));
2388 
2389 	switch (cmd) {
2390 	case MODLOAD:		/* load a module */
2391 		error = modctl_modload((int)a1, (char *)a2, (int *)a3);
2392 		break;
2393 
2394 	case MODUNLOAD:		/* unload a module */
2395 		error = modctl_modunload((modid_t)a1);
2396 		break;
2397 
2398 	case MODINFO:		/* get module status */
2399 		error = modctl_modinfo((modid_t)a1, (struct modinfo *)a2);
2400 		break;
2401 
2402 	case MODRESERVED:	/* get last major number in range */
2403 		error = modctl_modreserve((modid_t)a1, (int *)a2);
2404 		break;
2405 
2406 	case MODSETMINIROOT:	/* we are running in miniroot */
2407 		isminiroot = 1;
2408 		error = 0;
2409 		break;
2410 
2411 	case MODADDMAJBIND:	/* add major / driver alias bindings */
2412 		error = modctl_add_driver_aliases((int *)a2);
2413 		break;
2414 
2415 	case MODGETPATHLEN:	/* get modpath length */
2416 		error = modctl_getmodpathlen((int *)a2);
2417 		break;
2418 
2419 	case MODGETPATH:	/* get modpath */
2420 		error = modctl_getmodpath((char *)a2);
2421 		break;
2422 
2423 	case MODREADSYSBIND:	/* read system call binding file */
2424 		error = modctl_read_sysbinding_file();
2425 		break;
2426 
2427 	case MODGETMAJBIND:	/* get major number for named device */
2428 		error = modctl_getmaj((char *)a1, (uint_t)a2, (int *)a3);
2429 		break;
2430 
2431 	case MODGETNAME:	/* get name of device given major number */
2432 		error = modctl_getname((char *)a1, (uint_t)a2, (int *)a3);
2433 		break;
2434 
2435 	case MODDEVT2INSTANCE:
2436 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2437 			dev = (dev_t)a1;
2438 		}
2439 #ifdef _SYSCALL32_IMPL
2440 		else {
2441 			dev = expldev(a1);
2442 		}
2443 #endif
2444 		error = modctl_devt2instance(dev, (int *)a2);
2445 		break;
2446 
2447 	case MODSIZEOF_DEVID:	/* sizeof device id of device given dev_t */
2448 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2449 			dev = (dev_t)a1;
2450 		}
2451 #ifdef _SYSCALL32_IMPL
2452 		else {
2453 			dev = expldev(a1);
2454 		}
2455 #endif
2456 		error = modctl_sizeof_devid(dev, (uint_t *)a2);
2457 		break;
2458 
2459 	case MODGETDEVID:	/* get device id of device given dev_t */
2460 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2461 			dev = (dev_t)a1;
2462 		}
2463 #ifdef _SYSCALL32_IMPL
2464 		else {
2465 			dev = expldev(a1);
2466 		}
2467 #endif
2468 		error = modctl_get_devid(dev, (uint_t)a2, (ddi_devid_t)a3);
2469 		break;
2470 
2471 	case MODSIZEOF_MINORNAME:	/* sizeof minor nm (dev_t,spectype) */
2472 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2473 			error = modctl_sizeof_minorname((dev_t)a1, (int)a2,
2474 			    (uint_t *)a3);
2475 		}
2476 #ifdef _SYSCALL32_IMPL
2477 		else {
2478 			error = modctl_sizeof_minorname(expldev(a1), (int)a2,
2479 			    (uint_t *)a3);
2480 		}
2481 
2482 #endif
2483 		break;
2484 
2485 	case MODGETMINORNAME:		/* get minor name of (dev_t,spectype) */
2486 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2487 			error = modctl_get_minorname((dev_t)a1, (int)a2,
2488 			    (uint_t)a3, (char *)a4);
2489 		}
2490 #ifdef _SYSCALL32_IMPL
2491 		else {
2492 			error = modctl_get_minorname(expldev(a1), (int)a2,
2493 			    (uint_t)a3, (char *)a4);
2494 		}
2495 #endif
2496 		break;
2497 
2498 	case MODGETDEVFSPATH_LEN:	/* sizeof path nm of (dev_t,spectype) */
2499 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2500 			error = modctl_devfspath_len((dev_t)a1, (int)a2,
2501 			    (uint_t *)a3);
2502 		}
2503 #ifdef _SYSCALL32_IMPL
2504 		else {
2505 			error = modctl_devfspath_len(expldev(a1), (int)a2,
2506 			    (uint_t *)a3);
2507 		}
2508 
2509 #endif
2510 		break;
2511 
2512 	case MODGETDEVFSPATH:		/* get path name of (dev_t,spec) type */
2513 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2514 			error = modctl_devfspath((dev_t)a1, (int)a2,
2515 			    (uint_t)a3, (char *)a4);
2516 		}
2517 #ifdef _SYSCALL32_IMPL
2518 		else {
2519 			error = modctl_devfspath(expldev(a1), (int)a2,
2520 			    (uint_t)a3, (char *)a4);
2521 		}
2522 #endif
2523 		break;
2524 
2525 	case MODGETDEVFSPATH_MI_LEN:	/* sizeof path nm of (major,instance) */
2526 		error = modctl_devfspath_mi_len((major_t)a1, (int)a2,
2527 		    (uint_t *)a3);
2528 		break;
2529 
2530 	case MODGETDEVFSPATH_MI:	/* get path name of (major,instance) */
2531 		error = modctl_devfspath_mi((major_t)a1, (int)a2,
2532 		    (uint_t)a3, (char *)a4);
2533 		break;
2534 
2535 
2536 	case MODEVENTS:
2537 		error = modctl_modevents((int)a1, a2, a3, a4, (uint_t)a5);
2538 		break;
2539 
2540 	case MODGETFBNAME:	/* get the framebuffer name */
2541 		error = modctl_get_fbname((char *)a1);
2542 		break;
2543 
2544 	case MODREREADDACF:	/* reread dacf rule database from given file */
2545 		error = modctl_reread_dacf((char *)a1);
2546 		break;
2547 
2548 	case MODLOADDRVCONF:	/* load driver.conf file for major */
2549 		error = modctl_load_drvconf((major_t)a1, (int)a2);
2550 		break;
2551 
2552 	case MODUNLOADDRVCONF:	/* unload driver.conf file for major */
2553 		error = modctl_unload_drvconf((major_t)a1);
2554 		break;
2555 
2556 	case MODREMMAJBIND:	/* remove a major binding */
2557 		error = modctl_rem_major((major_t)a1);
2558 		break;
2559 
2560 	case MODREMDRVALIAS:	/* remove a major/alias binding */
2561 		error = modctl_remove_driver_aliases((int *)a2);
2562 		break;
2563 
2564 	case MODDEVID2PATHS:	/* get paths given devid */
2565 		error = modctl_devid2paths((ddi_devid_t)a1, (char *)a2,
2566 		    (uint_t)a3, (size_t *)a4, (char *)a5);
2567 		break;
2568 
2569 	case MODSETDEVPOLICY:	/* establish device policy */
2570 		error = devpolicy_load((int)a1, (size_t)a2, (devplcysys_t *)a3);
2571 		break;
2572 
2573 	case MODGETDEVPOLICY:	/* get device policy */
2574 		error = devpolicy_get((int *)a1, (size_t)a2,
2575 		    (devplcysys_t *)a3);
2576 		break;
2577 
2578 	case MODALLOCPRIV:
2579 		error = modctl_allocpriv((const char *)a1);
2580 		break;
2581 
2582 	case MODGETDEVPOLICYBYNAME:
2583 		error = devpolicy_getbyname((size_t)a1,
2584 		    (devplcysys_t *)a2, (char *)a3);
2585 		break;
2586 
2587 	case MODLOADMINORPERM:
2588 	case MODADDMINORPERM:
2589 	case MODREMMINORPERM:
2590 		error = modctl_minorperm(cmd, (char *)a1, (size_t)a2);
2591 		break;
2592 
2593 	case MODREMDRVCLEANUP:
2594 		error = modctl_remdrv_cleanup((const char *)a1);
2595 		break;
2596 
2597 	case MODDEVEXISTS:	/* non-reconfiguring /dev lookup */
2598 		error = modctl_devexists((const char *)a1, (size_t)a2);
2599 		break;
2600 
2601 	case MODDEVREADDIR:	/* non-reconfiguring /dev readdir */
2602 		error = modctl_devreaddir((const char *)a1, (size_t)a2,
2603 		    (char *)a3, (int64_t *)a4);
2604 		break;
2605 
2606 	case MODDEVEMPTYDIR:	/* non-reconfiguring /dev emptydir */
2607 		error = modctl_devemptydir((const char *)a1, (size_t)a2,
2608 		    (int *)a3);
2609 		break;
2610 
2611 	case MODDEVNAME:
2612 		error = modctl_moddevname((int)a1, a2, a3);
2613 		break;
2614 
2615 	case MODRETIRE:	/* retire device named by physpath a1 */
2616 		error = modctl_retire((char *)a1, (char *)a2, (size_t)a3);
2617 		break;
2618 
2619 	case MODISRETIRED:  /* check if a device is retired. */
2620 		error = modctl_is_retired((char *)a1, (int *)a2);
2621 		break;
2622 
2623 	case MODUNRETIRE:	/* unretire device named by physpath a1 */
2624 		error = modctl_unretire((char *)a1);
2625 		break;
2626 
2627 	case MODHPOPS:	/* hotplug operations */
2628 		/* device named by physpath a2 and Connection name a3 */
2629 		error = modctl_hp((int)a1, (char *)a2, (char *)a3, a4, a5);
2630 		break;
2631 
2632 	default:
2633 		error = EINVAL;
2634 		break;
2635 	}
2636 
2637 	return (error ? set_errno(error) : 0);
2638 }
2639 
2640 /*
2641  * Calls to kobj_load_module()() are handled off to this routine in a
2642  * separate thread.
2643  */
2644 static void
modload_thread(struct loadmt * ltp)2645 modload_thread(struct loadmt *ltp)
2646 {
2647 	/* load the module and signal the creator of this thread */
2648 	kmutex_t	cpr_lk;
2649 	callb_cpr_t	cpr_i;
2650 
2651 	mutex_init(&cpr_lk, NULL, MUTEX_DEFAULT, NULL);
2652 	CALLB_CPR_INIT(&cpr_i, &cpr_lk, callb_generic_cpr, "modload");
2653 	/* borrow the devi lock from thread which invoked us */
2654 	pm_borrow_lock(ltp->owner);
2655 	ltp->retval = kobj_load_module(ltp->mp, ltp->usepath);
2656 	pm_return_lock();
2657 	sema_v(&ltp->sema);
2658 	mutex_enter(&cpr_lk);
2659 	CALLB_CPR_EXIT(&cpr_i);
2660 	mutex_destroy(&cpr_lk);
2661 	thread_exit();
2662 }
2663 
2664 /*
2665  * load a module, adding a reference if caller specifies rmodp.  If rmodp
2666  * is specified then an errno is returned, otherwise a module index is
2667  * returned (-1 on error).
2668  */
2669 static int
modrload(const char * subdir,const char * filename,struct modctl ** rmodp)2670 modrload(const char *subdir, const char *filename, struct modctl **rmodp)
2671 {
2672 	struct modctl *modp;
2673 	size_t size;
2674 	char *fullname;
2675 	int retval = EINVAL;
2676 	int id = -1;
2677 
2678 	if (rmodp)
2679 		*rmodp = NULL;			/* avoid garbage */
2680 
2681 	if (subdir != NULL) {
2682 		/*
2683 		 * refuse / in filename to prevent "../" escapes.
2684 		 */
2685 		if (strchr(filename, '/') != NULL)
2686 			return (rmodp ? retval : id);
2687 
2688 		/*
2689 		 * allocate enough space for <subdir>/<filename><NULL>
2690 		 */
2691 		size = strlen(subdir) + strlen(filename) + 2;
2692 		fullname = kmem_zalloc(size, KM_SLEEP);
2693 		(void) sprintf(fullname, "%s/%s", subdir, filename);
2694 	} else {
2695 		fullname = (char *)filename;
2696 	}
2697 
2698 	modp = mod_hold_installed_mod(fullname, 1, 0, &retval);
2699 	if (modp != NULL) {
2700 		id = modp->mod_id;
2701 		if (rmodp) {
2702 			/* add mod_ref and return *rmodp */
2703 			mutex_enter(&mod_lock);
2704 			modp->mod_ref++;
2705 			mutex_exit(&mod_lock);
2706 			*rmodp = modp;
2707 		}
2708 		mod_release_mod(modp);
2709 		CPU_STATS_ADDQ(CPU, sys, modload, 1);
2710 	}
2711 
2712 	if (subdir != NULL)
2713 		kmem_free(fullname, size);
2714 	return (rmodp ? retval : id);
2715 }
2716 
2717 /*
2718  * This is the primary kernel interface to load a module. It loads and
2719  * installs the named module.  It does not hold mod_ref of the module, so
2720  * a module unload attempt can occur at any time - it is up to the
2721  * _fini/mod_remove implementation to determine if unload will succeed.
2722  */
2723 int
modload(const char * subdir,const char * filename)2724 modload(const char *subdir, const char *filename)
2725 {
2726 	return (modrload(subdir, filename, NULL));
2727 }
2728 
2729 /*
2730  * Load a module using a series of qualified names from most specific to least
2731  * specific, e.g. for subdir "foo", p1 "bar", p2 "baz", we might try:
2732  *			Value returned in *chosen
2733  * foo/bar.baz.1.2.3	3
2734  * foo/bar.baz.1.2	2
2735  * foo/bar.baz.1	1
2736  * foo/bar.baz		0
2737  *
2738  * Return the module ID on success; -1 if no module was loaded.  On success
2739  * and if 'chosen' is not NULL we also return the number of suffices that
2740  * were in the module we chose to load.
2741  */
2742 int
modload_qualified(const char * subdir,const char * p1,const char * p2,const char * delim,uint_t suffv[],int suffc,int * chosen)2743 modload_qualified(const char *subdir, const char *p1,
2744     const char *p2, const char *delim, uint_t suffv[], int suffc, int *chosen)
2745 {
2746 	char path[MOD_MAXPATH];
2747 	size_t n, resid = sizeof (path);
2748 	char *p = path;
2749 
2750 	char **dotv;
2751 	int i, rc, id;
2752 	modctl_t *mp;
2753 
2754 	if (p2 != NULL)
2755 		n = snprintf(p, resid, "%s/%s%s%s", subdir, p1, delim, p2);
2756 	else
2757 		n = snprintf(p, resid, "%s/%s", subdir, p1);
2758 
2759 	if (n >= resid)
2760 		return (-1);
2761 
2762 	p += n;
2763 	resid -= n;
2764 	dotv = kmem_alloc(sizeof (char *) * (suffc + 1), KM_SLEEP);
2765 
2766 	for (i = 0; i < suffc; i++) {
2767 		dotv[i] = p;
2768 		n = snprintf(p, resid, "%s%u", delim, suffv[i]);
2769 
2770 		if (n >= resid) {
2771 			kmem_free(dotv, sizeof (char *) * (suffc + 1));
2772 			return (-1);
2773 		}
2774 
2775 		p += n;
2776 		resid -= n;
2777 	}
2778 
2779 	dotv[suffc] = p;
2780 
2781 	for (i = suffc; i >= 0; i--) {
2782 		dotv[i][0] = '\0';
2783 		mp = mod_hold_installed_mod(path, 1, 1, &rc);
2784 
2785 		if (mp != NULL) {
2786 			kmem_free(dotv, sizeof (char *) * (suffc + 1));
2787 			id = mp->mod_id;
2788 			mod_release_mod(mp);
2789 			if (chosen != NULL)
2790 				*chosen = i;
2791 			return (id);
2792 		}
2793 	}
2794 
2795 	kmem_free(dotv, sizeof (char *) * (suffc + 1));
2796 	return (-1);
2797 }
2798 
2799 /*
2800  * Load a module.
2801  */
2802 int
modloadonly(const char * subdir,const char * filename)2803 modloadonly(const char *subdir, const char *filename)
2804 {
2805 	struct modctl *modp;
2806 	char *fullname;
2807 	size_t size;
2808 	int id, retval;
2809 
2810 	if (subdir != NULL) {
2811 		/*
2812 		 * allocate enough space for <subdir>/<filename><NULL>
2813 		 */
2814 		size = strlen(subdir) + strlen(filename) + 2;
2815 		fullname = kmem_zalloc(size, KM_SLEEP);
2816 		(void) sprintf(fullname, "%s/%s", subdir, filename);
2817 	} else {
2818 		fullname = (char *)filename;
2819 	}
2820 
2821 	id = -1;
2822 	modp = mod_hold_loaded_mod(NULL, fullname, &retval);
2823 	if (modp) {
2824 		id = modp->mod_id;
2825 		mod_release_mod(modp);
2826 	}
2827 
2828 	if (subdir != NULL)
2829 		kmem_free(fullname, size);
2830 
2831 	if (retval == 0)
2832 		return (id);
2833 	return (-1);
2834 }
2835 
2836 /*
2837  * Try to uninstall and unload a module, removing a reference if caller
2838  * specifies rmodp.
2839  */
2840 static int
modunrload(modid_t id,struct modctl ** rmodp,int unload)2841 modunrload(modid_t id, struct modctl **rmodp, int unload)
2842 {
2843 	struct modctl	*modp;
2844 	int		retval;
2845 
2846 	if (rmodp)
2847 		*rmodp = NULL;			/* avoid garbage */
2848 
2849 	if ((modp = mod_hold_by_id((modid_t)id)) == NULL)
2850 		return (EINVAL);
2851 
2852 	if (rmodp) {
2853 		mutex_enter(&mod_lock);
2854 		modp->mod_ref--;
2855 		if (modp->mod_ref == 0)
2856 			mod_uninstall_ref_zero++;
2857 		mutex_exit(&mod_lock);
2858 		*rmodp = modp;
2859 	}
2860 
2861 	if (unload) {
2862 		retval = moduninstall(modp);
2863 		if (retval == 0) {
2864 			mod_unload(modp);
2865 			CPU_STATS_ADDQ(CPU, sys, modunload, 1);
2866 		} else if (retval == EALREADY)
2867 			retval = 0;	/* already unloaded, not an error */
2868 	} else
2869 		retval = 0;
2870 
2871 	mod_release_mod(modp);
2872 	return (retval);
2873 }
2874 
2875 /*
2876  * Uninstall and unload a module.
2877  */
2878 int
modunload(modid_t id)2879 modunload(modid_t id)
2880 {
2881 	int		retval;
2882 
2883 	/* synchronize with any active modunload_disable() */
2884 	modunload_begin();
2885 	if (ddi_root_node())
2886 		(void) devfs_clean(ddi_root_node(), NULL, 0);
2887 	retval = modunrload(id, NULL, 1);
2888 	modunload_end();
2889 	return (retval);
2890 }
2891 
2892 /*
2893  * Return status of a loaded module.
2894  */
2895 static int
modinfo(modid_t id,struct modinfo * modinfop)2896 modinfo(modid_t id, struct modinfo *modinfop)
2897 {
2898 	struct modctl	*modp;
2899 
2900 	if (modinfop->mi_info & MI_INFO_ALL) {
2901 		modid_t mid = modinfop->mi_id;
2902 		while ((modp = mod_hold_next_by_id(mid++)) != NULL) {
2903 			if ((modinfop->mi_info & MI_INFO_CNT) ||
2904 			    modp->mod_installed)
2905 				break;
2906 			mod_release_mod(modp);
2907 		}
2908 	} else if (modinfop->mi_info & MI_INFO_BY_NAME) {
2909 		mutex_enter(&mod_lock);
2910 		modp = mod_find_by_name(modinfop->mi_name);
2911 		if (modp != NULL) {
2912 			(void) mod_hold_by_modctl(modp,
2913 			    MOD_LOCK_HELD | MOD_WAIT_FOREVER);
2914 		}
2915 		mutex_exit(&mod_lock);
2916 	} else {
2917 		modp = mod_hold_by_id(id);
2918 	}
2919 
2920 	if (modp == NULL) {
2921 		return (EINVAL);
2922 	}
2923 	if (!(modinfop->mi_info & MI_INFO_ALL)) {
2924 		if (!(modinfop->mi_info & MI_INFO_CNT) &&
2925 		    modp->mod_installed == 0) {
2926 			mod_release_mod(modp);
2927 			return (EINVAL);
2928 		}
2929 	}
2930 
2931 	modinfop->mi_rev = 0;
2932 	modinfop->mi_state = 0;
2933 	for (uint_t i = 0; i < MODMAXLINK; i++) {
2934 		modinfop->mi_msinfo[i].msi_p0 = -1;
2935 		modinfop->mi_msinfo[i].msi_linkinfo[0] = 0;
2936 	}
2937 	if (modp->mod_loaded) {
2938 		modinfop->mi_state = MI_LOADED;
2939 		kobj_getmodinfo(modp->mod_mp, modinfop);
2940 	}
2941 	if (modp->mod_installed) {
2942 		modinfop->mi_state |= MI_INSTALLED;
2943 
2944 		(void) mod_getinfo(modp, modinfop);
2945 	}
2946 
2947 	modinfop->mi_id = modp->mod_id;
2948 	modinfop->mi_loadcnt = modp->mod_loadcnt;
2949 	(void) strlcpy(modinfop->mi_name, modp->mod_modname,
2950 	    sizeof (modinfop->mi_name));
2951 
2952 	mod_release_mod(modp);
2953 	return (0);
2954 }
2955 
2956 static char mod_stub_err[] = "mod_hold_stub: Couldn't load stub module %s";
2957 static char no_err[] = "No error function for weak stub %s";
2958 
2959 /*
2960  * used by the stubs themselves to load and hold a module.
2961  * Returns  0 if the module is successfully held;
2962  *	    the stub needs to call mod_release_stub().
2963  *	    -1 if the stub should just call the err_fcn.
2964  * Note that this code is stretched out so that we avoid subroutine calls
2965  * and optimize for the most likely case.  That is, the case where the
2966  * module is loaded and installed and not held.  In that case we just inc
2967  * the mod_ref count and continue.
2968  */
2969 int
mod_hold_stub(struct mod_stub_info * stub)2970 mod_hold_stub(struct mod_stub_info *stub)
2971 {
2972 	struct modctl *mp;
2973 	struct mod_modinfo *mip;
2974 
2975 	mip = stub->mods_modinfo;
2976 
2977 	mutex_enter(&mod_lock);
2978 
2979 	/* we do mod_hold_by_modctl inline for speed */
2980 
2981 mod_check_again:
2982 	if ((mp = mip->mp) != NULL) {
2983 		if (mp->mod_busy == 0) {
2984 			if (mp->mod_installed) {
2985 				/* increment the reference count */
2986 				mp->mod_ref++;
2987 				ASSERT(mp->mod_ref && mp->mod_installed);
2988 				mutex_exit(&mod_lock);
2989 				return (0);
2990 			} else {
2991 				mp->mod_busy = 1;
2992 				mp->mod_inprogress_thread =
2993 				    (curthread == NULL ?
2994 				    (kthread_id_t)-1 : curthread);
2995 			}
2996 		} else {
2997 			/*
2998 			 * wait one time and then go see if someone
2999 			 * else has resolved the stub (set mip->mp).
3000 			 */
3001 			if (mod_hold_by_modctl(mp,
3002 			    MOD_WAIT_ONCE | MOD_LOCK_HELD))
3003 				goto mod_check_again;
3004 
3005 			/*
3006 			 * what we have now may have been unloaded!, in
3007 			 * that case, mip->mp will be NULL, we'll hit this
3008 			 * module and load again..
3009 			 */
3010 			cmn_err(CE_PANIC, "mod_hold_stub should have blocked");
3011 		}
3012 		mutex_exit(&mod_lock);
3013 	} else {
3014 		/* first time we've hit this module */
3015 		mutex_exit(&mod_lock);
3016 		mp = mod_hold_by_name(mip->modm_module_name);
3017 		mip->mp = mp;
3018 	}
3019 
3020 	/*
3021 	 * If we are here, it means that the following conditions
3022 	 * are satisfied.
3023 	 *
3024 	 * mip->mp != NULL
3025 	 * this thread has set the mp->mod_busy = 1
3026 	 * mp->mod_installed = 0
3027 	 *
3028 	 */
3029 	ASSERT(mp != NULL);
3030 	ASSERT(mp->mod_busy == 1);
3031 
3032 	if (mp->mod_installed == 0) {
3033 		/* Module not loaded, if weak stub don't load it */
3034 		if (stub->mods_flag & MODS_WEAK) {
3035 			if (stub->mods_errfcn == NULL) {
3036 				mod_release_mod(mp);
3037 				cmn_err(CE_PANIC, no_err,
3038 				    mip->modm_module_name);
3039 			}
3040 		} else {
3041 			/* Not a weak stub so load the module */
3042 
3043 			if (mod_load(mp, 1) != 0 || modinstall(mp) != 0) {
3044 				/*
3045 				 * If mod_load() was successful
3046 				 * and modinstall() failed, then
3047 				 * unload the module.
3048 				 */
3049 				if (mp->mod_loaded)
3050 					mod_unload(mp);
3051 
3052 				mod_release_mod(mp);
3053 				if (stub->mods_errfcn == NULL) {
3054 					cmn_err(CE_PANIC, mod_stub_err,
3055 					    mip->modm_module_name);
3056 				} else {
3057 					return (-1);
3058 				}
3059 			}
3060 		}
3061 	}
3062 
3063 	/*
3064 	 * At this point module is held and loaded. Release
3065 	 * the mod_busy and mod_inprogress_thread before
3066 	 * returning. We actually call mod_release() here so
3067 	 * that if another stub wants to access this module,
3068 	 * it can do so. mod_ref is incremented before mod_release()
3069 	 * is called to prevent someone else from snatching the
3070 	 * module from this thread.
3071 	 */
3072 	mutex_enter(&mod_lock);
3073 	mp->mod_ref++;
3074 	ASSERT(mp->mod_ref &&
3075 	    (mp->mod_loaded || (stub->mods_flag & MODS_WEAK)));
3076 	mod_release(mp);
3077 	mutex_exit(&mod_lock);
3078 	return (0);
3079 }
3080 
3081 void
mod_release_stub(struct mod_stub_info * stub)3082 mod_release_stub(struct mod_stub_info *stub)
3083 {
3084 	struct modctl *mp = stub->mods_modinfo->mp;
3085 
3086 	/* inline mod_release_mod */
3087 	mutex_enter(&mod_lock);
3088 	ASSERT(mp->mod_ref &&
3089 	    (mp->mod_loaded || (stub->mods_flag & MODS_WEAK)));
3090 	mp->mod_ref--;
3091 	if (mp->mod_ref == 0)
3092 		mod_uninstall_ref_zero++;
3093 	if (mp->mod_want) {
3094 		mp->mod_want = 0;
3095 		cv_broadcast(&mod_cv);
3096 	}
3097 	mutex_exit(&mod_lock);
3098 }
3099 
3100 static struct modctl *
mod_hold_loaded_mod(struct modctl * dep,char * filename,int * status)3101 mod_hold_loaded_mod(struct modctl *dep, char *filename, int *status)
3102 {
3103 	struct modctl *modp;
3104 	int retval;
3105 
3106 	/*
3107 	 * Hold the module.
3108 	 */
3109 	modp = mod_hold_by_name_requisite(dep, filename);
3110 	if (modp) {
3111 		retval = mod_load(modp, 1);
3112 		if (retval != 0) {
3113 			mod_release_mod(modp);
3114 			modp = NULL;
3115 		}
3116 		*status = retval;
3117 	} else {
3118 		*status = ENOSPC;
3119 	}
3120 
3121 	/*
3122 	 * if dep is not NULL, clear the module dependency information.
3123 	 * This information is set in mod_hold_by_name_common().
3124 	 */
3125 	if (dep != NULL && dep->mod_requisite_loading != NULL) {
3126 		ASSERT(dep->mod_busy);
3127 		dep->mod_requisite_loading = NULL;
3128 	}
3129 
3130 	return (modp);
3131 }
3132 
3133 /*
3134  * hold, load, and install the named module
3135  */
3136 static struct modctl *
mod_hold_installed_mod(char * name,int usepath,int forcecheck,int * r)3137 mod_hold_installed_mod(char *name, int usepath, int forcecheck, int *r)
3138 {
3139 	struct modctl *modp;
3140 	int retval;
3141 
3142 	/*
3143 	 * Verify that that module in question actually exists on disk
3144 	 * before allocation of module structure by mod_hold_by_name.
3145 	 */
3146 	if (modrootloaded && swaploaded || forcecheck) {
3147 		if (!kobj_path_exists(name, usepath)) {
3148 			*r = ENOENT;
3149 			return (NULL);
3150 		}
3151 	}
3152 
3153 	/*
3154 	 * Hold the module.
3155 	 */
3156 	modp = mod_hold_by_name(name);
3157 	if (modp) {
3158 		retval = mod_load(modp, usepath);
3159 		if (retval != 0) {
3160 			mod_release_mod(modp);
3161 			modp = NULL;
3162 			*r = retval;
3163 		} else {
3164 			if ((*r = modinstall(modp)) != 0) {
3165 				/*
3166 				 * We loaded it, but failed to _init() it.
3167 				 * Be kind to developers -- force it
3168 				 * out of memory now so that the next
3169 				 * attempt to use the module will cause
3170 				 * a reload.  See 1093793.
3171 				 */
3172 				mod_unload(modp);
3173 				mod_release_mod(modp);
3174 				modp = NULL;
3175 			}
3176 		}
3177 	} else {
3178 		*r = ENOSPC;
3179 	}
3180 	return (modp);
3181 }
3182 
3183 static char mod_excl_msg[] =
3184 	"module %s(%s) is EXCLUDED and will not be loaded\n";
3185 static char mod_init_msg[] = "loadmodule:%s(%s): _init() error %d\n";
3186 
3187 /*
3188  * This routine is needed for dependencies.  Users specify dependencies
3189  * by declaring a character array initialized to filenames of dependents.
3190  * So the code that handles dependents deals with filenames (and not
3191  * module names) because that's all it has.  We load by filename and once
3192  * we've loaded a file we can get the module name.
3193  * Unfortunately there isn't a single unified filename/modulename namespace.
3194  * C'est la vie.
3195  *
3196  * We allow the name being looked up to be prepended by an optional
3197  * subdirectory e.g. we can lookup (NULL, "fs/ufs") or ("fs", "ufs")
3198  */
3199 struct modctl *
mod_find_by_filename(char * subdir,char * filename)3200 mod_find_by_filename(char *subdir, char *filename)
3201 {
3202 	struct modctl	*mp;
3203 	size_t		sublen;
3204 
3205 	ASSERT(!MUTEX_HELD(&mod_lock));
3206 	if (subdir != NULL)
3207 		sublen = strlen(subdir);
3208 	else
3209 		sublen = 0;
3210 
3211 	mutex_enter(&mod_lock);
3212 	mp = &modules;
3213 	do {
3214 		if (sublen) {
3215 			char *mod_filename = mp->mod_filename;
3216 
3217 			if (strncmp(subdir, mod_filename, sublen) == 0 &&
3218 			    mod_filename[sublen] == '/' &&
3219 			    strcmp(filename, &mod_filename[sublen + 1]) == 0) {
3220 				mutex_exit(&mod_lock);
3221 				return (mp);
3222 			}
3223 		} else if (strcmp(filename, mp->mod_filename) == 0) {
3224 			mutex_exit(&mod_lock);
3225 			return (mp);
3226 		}
3227 	} while ((mp = mp->mod_next) != &modules);
3228 	mutex_exit(&mod_lock);
3229 	return (NULL);
3230 }
3231 
3232 /*
3233  * Find a loaded module by name.
3234  * Must be called with `mod_lock` held.
3235  */
3236 static struct modctl *
mod_find_by_name(const char * modname)3237 mod_find_by_name(const char *modname)
3238 {
3239 	ASSERT(MUTEX_HELD(&mod_lock));
3240 
3241 	struct modctl *mp = &modules;
3242 	do {
3243 		if (strcmp(modname, mp->mod_modname) == 0) {
3244 			return (mp);
3245 		}
3246 	} while ((mp = mp->mod_next) != &modules);
3247 	return (NULL);
3248 }
3249 
3250 /*
3251  * Check for circular dependencies.  This is called from do_dependents()
3252  * in kobj.c.  If we are the thread already loading this module, then
3253  * we're trying to load a dependent that we're already loading which
3254  * means the user specified circular dependencies.
3255  */
3256 static int
mod_circdep(struct modctl * modp)3257 mod_circdep(struct modctl *modp)
3258 {
3259 	struct modctl	*rmod;
3260 
3261 	ASSERT(MUTEX_HELD(&mod_lock));
3262 
3263 	/*
3264 	 * Check the mod_inprogress_thread first.
3265 	 * mod_inprogress_thread is used in mod_hold_stub()
3266 	 * directly to improve performance.
3267 	 */
3268 	if (modp->mod_inprogress_thread == curthread)
3269 		return (1);
3270 
3271 	/*
3272 	 * Check the module circular dependencies.
3273 	 */
3274 	for (rmod = modp; rmod != NULL; rmod = rmod->mod_requisite_loading) {
3275 		/*
3276 		 * Check if there is a module circular dependency.
3277 		 */
3278 		if (rmod->mod_requisite_loading == modp)
3279 			return (1);
3280 	}
3281 	return (0);
3282 }
3283 
3284 static int
mod_getinfo(struct modctl * modp,struct modinfo * modinfop)3285 mod_getinfo(struct modctl *modp, struct modinfo *modinfop)
3286 {
3287 	int (*func)(struct modinfo *);
3288 	int retval;
3289 
3290 	ASSERT(modp->mod_busy);
3291 
3292 	/* primary modules don't do getinfo */
3293 	if (modp->mod_prim)
3294 		return (0);
3295 
3296 	func = (int (*)(struct modinfo *))kobj_lookup(modp->mod_mp, "_info");
3297 
3298 	if (kobj_addrcheck(modp->mod_mp, (caddr_t)func)) {
3299 		cmn_err(CE_WARN, "_info() not defined properly in %s",
3300 		    modp->mod_filename);
3301 		/*
3302 		 * The semantics of mod_info(9F) are that 0 is failure
3303 		 * and non-zero is success.
3304 		 */
3305 		retval = 0;
3306 	} else
3307 		retval = (*func)(modinfop);	/* call _info() function */
3308 
3309 	if (moddebug & MODDEBUG_USERDEBUG)
3310 		printf("Returned from _info, retval = %x\n", retval);
3311 
3312 	return (retval);
3313 }
3314 
3315 static void
modadd(struct modctl * mp)3316 modadd(struct modctl *mp)
3317 {
3318 	ASSERT(MUTEX_HELD(&mod_lock));
3319 
3320 	mp->mod_id = last_module_id++;
3321 	mp->mod_next = &modules;
3322 	mp->mod_prev = modules.mod_prev;
3323 	modules.mod_prev->mod_next = mp;
3324 	modules.mod_prev = mp;
3325 }
3326 
3327 /*ARGSUSED*/
3328 static struct modctl *
allocate_modp(const char * filename,const char * modname)3329 allocate_modp(const char *filename, const char *modname)
3330 {
3331 	struct modctl *mp;
3332 
3333 	mp = kobj_zalloc(sizeof (*mp), KM_SLEEP);
3334 	mp->mod_modname = kobj_zalloc(strlen(modname) + 1, KM_SLEEP);
3335 	(void) strcpy(mp->mod_modname, modname);
3336 	return (mp);
3337 }
3338 
3339 /*
3340  * Get the value of a symbol.  This is a wrapper routine that
3341  * calls kobj_getsymvalue().  kobj_getsymvalue() may go away but this
3342  * wrapper will prevent callers from noticing.
3343  */
3344 uintptr_t
modgetsymvalue(char * name,int kernelonly)3345 modgetsymvalue(char *name, int kernelonly)
3346 {
3347 	return (kobj_getsymvalue(name, kernelonly));
3348 }
3349 
3350 /*
3351  * Get the symbol nearest an address.  This is a wrapper routine that
3352  * calls kobj_getsymname().  kobj_getsymname() may go away but this
3353  * wrapper will prevent callers from noticing.
3354  */
3355 char *
modgetsymname(uintptr_t value,ulong_t * offset)3356 modgetsymname(uintptr_t value, ulong_t *offset)
3357 {
3358 	return (kobj_getsymname(value, offset));
3359 }
3360 
3361 /*
3362  * Lookup a symbol in a specified module.  These are wrapper routines that
3363  * call kobj_lookup().	kobj_lookup() may go away but these wrappers will
3364  * prevent callers from noticing.
3365  */
3366 uintptr_t
modlookup(const char * modname,const char * symname)3367 modlookup(const char *modname, const char *symname)
3368 {
3369 	struct modctl *modp;
3370 	uintptr_t val;
3371 
3372 	if ((modp = mod_hold_by_name(modname)) == NULL)
3373 		return (0);
3374 	val = kobj_lookup(modp->mod_mp, symname);
3375 	mod_release_mod(modp);
3376 	return (val);
3377 }
3378 
3379 uintptr_t
modlookup_by_modctl(modctl_t * modp,const char * symname)3380 modlookup_by_modctl(modctl_t *modp, const char *symname)
3381 {
3382 	ASSERT(modp->mod_ref > 0 || modp->mod_busy);
3383 
3384 	return (kobj_lookup(modp->mod_mp, symname));
3385 }
3386 
3387 /*
3388  * Ask the user for the name of the system file and the default path
3389  * for modules.
3390  */
3391 void
mod_askparams()3392 mod_askparams()
3393 {
3394 	static char s0[64];
3395 	intptr_t fd;
3396 
3397 	if ((fd = kobj_open(systemfile)) != -1L)
3398 		kobj_close(fd);
3399 	else
3400 		systemfile = self_assembly = NULL;
3401 
3402 	/*CONSTANTCONDITION*/
3403 	while (1) {
3404 		printf("Name of system file [%s]:  ",
3405 		    systemfile ? systemfile : "/dev/null");
3406 
3407 		console_gets(s0, sizeof (s0));
3408 
3409 		if (s0[0] == '\0')
3410 			break;
3411 		else if (strcmp(s0, "/dev/null") == 0) {
3412 			systemfile = self_assembly = NULL;
3413 			break;
3414 		} else {
3415 			if ((fd = kobj_open(s0)) != -1L) {
3416 				kobj_close(fd);
3417 				systemfile = s0;
3418 				self_assembly = NULL;
3419 				break;
3420 			}
3421 		}
3422 		printf("can't find file %s\n", s0);
3423 	}
3424 }
3425 
3426 static char loading_msg[] = "loading '%s' id %d\n";
3427 static char load_msg[] = "load '%s' id %d loaded @ 0x%p/0x%p size %d/%d\n";
3428 
3429 /*
3430  * Common code for loading a module (but not installing it).
3431  * Handoff the task of module loading to a separate thread
3432  * with a large stack if possible, since this code may recurse a few times.
3433  * Return zero if there are no errors or an errno value.
3434  */
3435 static int
mod_load(struct modctl * mp,int usepath)3436 mod_load(struct modctl *mp, int usepath)
3437 {
3438 	int		retval;
3439 	struct modinfo	*modinfop = NULL;
3440 	struct loadmt	lt;
3441 
3442 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3443 	ASSERT(mp->mod_busy);
3444 
3445 	if (mp->mod_loaded)
3446 		return (0);
3447 
3448 	if (mod_sysctl(SYS_CHECK_EXCLUDE, mp->mod_modname) != 0 ||
3449 	    mod_sysctl(SYS_CHECK_EXCLUDE, mp->mod_filename) != 0) {
3450 		if (moddebug & MODDEBUG_LOADMSG) {
3451 			printf(mod_excl_msg, mp->mod_filename,
3452 			    mp->mod_modname);
3453 		}
3454 		return (ENXIO);
3455 	}
3456 	if (moddebug & MODDEBUG_LOADMSG2)
3457 		printf(loading_msg, mp->mod_filename, mp->mod_id);
3458 
3459 	if (curthread != &t0) {
3460 		lt.mp = mp;
3461 		lt.usepath = usepath;
3462 		lt.owner = curthread;
3463 		sema_init(&lt.sema, 0, NULL, SEMA_DEFAULT, NULL);
3464 
3465 		/* create thread to hand of call to */
3466 		(void) thread_create(NULL, DEFAULTSTKSZ * 2,
3467 		    modload_thread, &lt, 0, &p0, TS_RUN, maxclsyspri);
3468 
3469 		/* wait for thread to complete kobj_load_module */
3470 		sema_p(&lt.sema);
3471 
3472 		sema_destroy(&lt.sema);
3473 		retval = lt.retval;
3474 	} else
3475 		retval = kobj_load_module(mp, usepath);
3476 
3477 	if (mp->mod_mp) {
3478 		ASSERT(retval == 0);
3479 		mp->mod_loaded = 1;
3480 		mp->mod_loadcnt++;
3481 		if (moddebug & MODDEBUG_LOADMSG) {
3482 			printf(load_msg, mp->mod_filename, mp->mod_id,
3483 			    (void *)((struct module *)mp->mod_mp)->text,
3484 			    (void *)((struct module *)mp->mod_mp)->data,
3485 			    ((struct module *)mp->mod_mp)->text_size,
3486 			    ((struct module *)mp->mod_mp)->data_size);
3487 		}
3488 
3489 		/*
3490 		 * XXX - There should be a better way to get this.
3491 		 */
3492 		modinfop = kmem_zalloc(sizeof (struct modinfo), KM_SLEEP);
3493 		modinfop->mi_info = MI_INFO_LINKAGE;
3494 		if (mod_getinfo(mp, modinfop) == 0)
3495 			mp->mod_linkage = NULL;
3496 		else {
3497 			mp->mod_linkage = (void *)modinfop->mi_base;
3498 			ASSERT(mp->mod_linkage->ml_rev == MODREV_1);
3499 		}
3500 
3501 		/*
3502 		 * DCS: bootstrapping code. If the driver is loaded
3503 		 * before root mount, it is assumed that the driver
3504 		 * may be used before mounting root. In order to
3505 		 * access mappings of global to local minor no.'s
3506 		 * during installation/open of the driver, we load
3507 		 * them into memory here while the BOP_interfaces
3508 		 * are still up.
3509 		 */
3510 		if ((cluster_bootflags & CLUSTER_BOOTED) && !modrootloaded) {
3511 			retval = clboot_modload(mp);
3512 		}
3513 
3514 		kmem_free(modinfop, sizeof (struct modinfo));
3515 		(void) mod_sysctl(SYS_SET_MVAR, (void *)mp);
3516 		retval = install_stubs_by_name(mp, mp->mod_modname);
3517 
3518 		/*
3519 		 * Perform hotinlines before module is started.
3520 		 */
3521 		do_hotinlines(mp->mod_mp);
3522 
3523 		/*
3524 		 * Now that the module is loaded, we need to give DTrace
3525 		 * a chance to notify its providers.  This is done via
3526 		 * the dtrace_modload function pointer.
3527 		 */
3528 		if (strcmp(mp->mod_modname, "dtrace") != 0) {
3529 			struct modctl *dmp = mod_hold_by_name("dtrace");
3530 
3531 			if (dmp != NULL && dtrace_modload != NULL)
3532 				(*dtrace_modload)(mp);
3533 
3534 			mod_release_mod(dmp);
3535 		}
3536 
3537 	} else {
3538 		/*
3539 		 * If load failed then we need to release any requisites
3540 		 * that we had established.
3541 		 */
3542 		ASSERT(retval);
3543 		mod_release_requisites(mp);
3544 
3545 		if (moddebug & MODDEBUG_ERRMSG)
3546 			printf("error loading '%s', error %d\n",
3547 			    mp->mod_filename, retval);
3548 	}
3549 	return (retval);
3550 }
3551 
3552 static char unload_msg[] = "unloading %s, module id %d, loadcnt %d.\n";
3553 
3554 static void
mod_unload(struct modctl * mp)3555 mod_unload(struct modctl *mp)
3556 {
3557 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3558 	ASSERT(mp->mod_busy);
3559 	ASSERT((mp->mod_loaded && (mp->mod_installed == 0)) &&
3560 	    ((mp->mod_prim == 0) && (mp->mod_ref >= 0)));
3561 
3562 	if (moddebug & MODDEBUG_LOADMSG)
3563 		printf(unload_msg, mp->mod_modname,
3564 		    mp->mod_id, mp->mod_loadcnt);
3565 
3566 	/*
3567 	 * If mod_ref is not zero, it means some modules might still refer
3568 	 * to this module. Then you can't unload this module right now.
3569 	 * Instead, set 1 to mod_delay_unload to notify the system of
3570 	 * unloading this module later when it's not required any more.
3571 	 */
3572 	if (mp->mod_ref > 0) {
3573 		mp->mod_delay_unload = 1;
3574 		if (moddebug & MODDEBUG_LOADMSG2) {
3575 			printf("module %s not unloaded,"
3576 			    " non-zero reference count (%d)",
3577 			    mp->mod_modname, mp->mod_ref);
3578 		}
3579 		return;
3580 	}
3581 
3582 	if (((mp->mod_loaded == 0) || mp->mod_installed) ||
3583 	    (mp->mod_ref || mp->mod_prim)) {
3584 		/*
3585 		 * A DEBUG kernel would ASSERT panic above, the code is broken
3586 		 * if we get this warning.
3587 		 */
3588 		cmn_err(CE_WARN, "mod_unload: %s in incorrect state: %d %d %d",
3589 		    mp->mod_filename, mp->mod_installed, mp->mod_loaded,
3590 		    mp->mod_ref);
3591 		return;
3592 	}
3593 
3594 	/* reset stub functions to call the binder again */
3595 	reset_stubs(mp);
3596 
3597 	/*
3598 	 * mark module as unloaded before the modctl structure is freed.
3599 	 * This is required not to reuse the modctl structure before
3600 	 * the module is marked as unloaded.
3601 	 */
3602 	mp->mod_loaded = 0;
3603 	mp->mod_linkage = NULL;
3604 
3605 	/* free the memory */
3606 	kobj_unload_module(mp);
3607 
3608 	if (mp->mod_delay_unload) {
3609 		mp->mod_delay_unload = 0;
3610 		if (moddebug & MODDEBUG_LOADMSG2) {
3611 			printf("deferred unload of module %s"
3612 			    " (id %d) successful",
3613 			    mp->mod_modname, mp->mod_id);
3614 		}
3615 	}
3616 
3617 	/* release hold on requisites */
3618 	mod_release_requisites(mp);
3619 
3620 	/*
3621 	 * Now that the module is gone, we need to give DTrace a chance to
3622 	 * remove any probes that it may have had in the module.  This is
3623 	 * done via the dtrace_modunload function pointer.
3624 	 */
3625 	if (strcmp(mp->mod_modname, "dtrace") != 0) {
3626 		struct modctl *dmp = mod_hold_by_name("dtrace");
3627 
3628 		if (dmp != NULL && dtrace_modunload != NULL)
3629 			(*dtrace_modunload)(mp);
3630 
3631 		mod_release_mod(dmp);
3632 	}
3633 }
3634 
3635 static int
modinstall(struct modctl * mp)3636 modinstall(struct modctl *mp)
3637 {
3638 	int val;
3639 	int (*func)(void);
3640 
3641 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3642 	ASSERT(mp->mod_busy && mp->mod_loaded);
3643 
3644 	if (mp->mod_installed)
3645 		return (0);
3646 	/*
3647 	 * If mod_delay_unload is on, it means the system chose the deferred
3648 	 * unload for this module. Then you can't install this module until
3649 	 * it's unloaded from the system.
3650 	 */
3651 	if (mp->mod_delay_unload)
3652 		return (ENXIO);
3653 
3654 	if (moddebug & MODDEBUG_LOADMSG)
3655 		printf("installing %s, module id %d.\n",
3656 		    mp->mod_modname, mp->mod_id);
3657 
3658 	ASSERT(mp->mod_mp != NULL);
3659 	if (mod_install_requisites(mp) != 0) {
3660 		/*
3661 		 * Note that we can't call mod_unload(mp) here since
3662 		 * if modinstall() was called by mod_install_requisites(),
3663 		 * we won't be able to hold the dependent modules
3664 		 * (otherwise there would be a deadlock).
3665 		 */
3666 		return (ENXIO);
3667 	}
3668 
3669 	if (moddebug & MODDEBUG_ERRMSG) {
3670 		printf("init '%s' id %d loaded @ 0x%p/0x%p size %lu/%lu\n",
3671 		    mp->mod_filename, mp->mod_id,
3672 		    (void *)((struct module *)mp->mod_mp)->text,
3673 		    (void *)((struct module *)mp->mod_mp)->data,
3674 		    ((struct module *)mp->mod_mp)->text_size,
3675 		    ((struct module *)mp->mod_mp)->data_size);
3676 	}
3677 
3678 	func = (int (*)())kobj_lookup(mp->mod_mp, "_init");
3679 
3680 	if (kobj_addrcheck(mp->mod_mp, (caddr_t)func)) {
3681 		cmn_err(CE_WARN, "_init() not defined properly in %s",
3682 		    mp->mod_filename);
3683 		return (EFAULT);
3684 	}
3685 
3686 	if (moddebug & MODDEBUG_USERDEBUG) {
3687 		printf("breakpoint before calling %s:_init()\n",
3688 		    mp->mod_modname);
3689 		if (DEBUGGER_PRESENT)
3690 			debug_enter("_init");
3691 	}
3692 
3693 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3694 	ASSERT(mp->mod_busy && mp->mod_loaded);
3695 	val = (*func)();		/* call _init */
3696 
3697 	if (moddebug & MODDEBUG_USERDEBUG)
3698 		printf("Returned from _init, val = %x\n", val);
3699 
3700 	if (val == 0) {
3701 		/*
3702 		 * Set the MODS_INSTALLED flag to enable this module
3703 		 * being called now.
3704 		 */
3705 		install_stubs(mp);
3706 		mp->mod_installed = 1;
3707 	} else if (moddebug & MODDEBUG_ERRMSG)
3708 		printf(mod_init_msg, mp->mod_filename, mp->mod_modname, val);
3709 
3710 	return (val);
3711 }
3712 
3713 int	detach_driver_unconfig = 0;
3714 
3715 static int
detach_driver(char * name)3716 detach_driver(char *name)
3717 {
3718 	major_t major;
3719 	int error;
3720 
3721 	/*
3722 	 * If being called from mod_uninstall_all() then the appropriate
3723 	 * driver detaches (leaf only) have already been done.
3724 	 */
3725 	if (mod_in_autounload())
3726 		return (0);
3727 
3728 	major = ddi_name_to_major(name);
3729 	if (major == DDI_MAJOR_T_NONE)
3730 		return (0);
3731 
3732 	error = ndi_devi_unconfig_driver(ddi_root_node(),
3733 	    NDI_DETACH_DRIVER | detach_driver_unconfig, major);
3734 	return (error == NDI_SUCCESS ? 0 : -1);
3735 }
3736 
3737 static char finiret_msg[] = "Returned from _fini for %s, status = %x\n";
3738 
3739 static int
moduninstall(struct modctl * mp)3740 moduninstall(struct modctl *mp)
3741 {
3742 	int status = 0;
3743 	int (*func)(void);
3744 
3745 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3746 	ASSERT(mp->mod_busy);
3747 
3748 	/*
3749 	 * Verify that we need to do something and can uninstall the module.
3750 	 *
3751 	 * If we should not uninstall the module or if the module is not in
3752 	 * the correct state to start an uninstall we return EBUSY to prevent
3753 	 * us from progressing to mod_unload.  If the module has already been
3754 	 * uninstalled and unloaded we return EALREADY.
3755 	 */
3756 	if (mp->mod_prim || mp->mod_ref || mp->mod_nenabled != 0)
3757 		return (EBUSY);
3758 	if ((mp->mod_installed == 0) || (mp->mod_loaded == 0))
3759 		return (EALREADY);
3760 
3761 	/*
3762 	 * To avoid devinfo / module deadlock we must release this module
3763 	 * prior to initiating the detach_driver, otherwise the detach_driver
3764 	 * might deadlock on a devinfo node held by another thread
3765 	 * coming top down and involving the module we have locked.
3766 	 *
3767 	 * When we regrab the module we must reverify that it is OK
3768 	 * to proceed with the uninstall operation.
3769 	 */
3770 	mod_release_mod(mp);
3771 	status = detach_driver(mp->mod_modname);
3772 	(void) mod_hold_by_modctl(mp, MOD_WAIT_FOREVER | MOD_LOCK_NOT_HELD);
3773 
3774 	/* check detach status and reverify state with lock */
3775 	mutex_enter(&mod_lock);
3776 	if ((status != 0) || mp->mod_prim || mp->mod_ref) {
3777 		mutex_exit(&mod_lock);
3778 		return (EBUSY);
3779 	}
3780 	if ((mp->mod_installed == 0) || (mp->mod_loaded == 0)) {
3781 		mutex_exit(&mod_lock);
3782 		return (EALREADY);
3783 	}
3784 	mutex_exit(&mod_lock);
3785 
3786 	if (moddebug & MODDEBUG_LOADMSG2)
3787 		printf("uninstalling %s\n", mp->mod_modname);
3788 
3789 	/*
3790 	 * lookup _fini, return EBUSY if not defined.
3791 	 *
3792 	 * The MODDEBUG_FINI_EBUSY is usefull in resolving leaks in
3793 	 * detach(9E) - it allows bufctl addresses to be resolved.
3794 	 */
3795 	func = (int (*)())kobj_lookup(mp->mod_mp, "_fini");
3796 	if ((func == NULL) || (mp->mod_loadflags & MOD_NOUNLOAD) ||
3797 	    (moddebug & MODDEBUG_FINI_EBUSY))
3798 		return (EBUSY);
3799 
3800 	/* verify that _fini is in this module */
3801 	if (kobj_addrcheck(mp->mod_mp, (caddr_t)func)) {
3802 		cmn_err(CE_WARN, "_fini() not defined properly in %s",
3803 		    mp->mod_filename);
3804 		return (EFAULT);
3805 	}
3806 
3807 	/* call _fini() */
3808 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3809 	ASSERT(mp->mod_busy && mp->mod_loaded && mp->mod_installed);
3810 
3811 	status = (*func)();
3812 
3813 	if (status == 0) {
3814 		/* _fini returned success, the module is no longer installed */
3815 		if (moddebug & MODDEBUG_LOADMSG)
3816 			printf("uninstalled %s\n", mp->mod_modname);
3817 
3818 		/*
3819 		 * Even though we only set mod_installed to zero here, a zero
3820 		 * return value means we are committed to a code path were
3821 		 * mod_loaded will also end up as zero - we have no other
3822 		 * way to get the module data and bss back to the pre _init
3823 		 * state except a reload. To ensure this, after return,
3824 		 * mod_busy must stay set until mod_loaded is cleared.
3825 		 */
3826 		mp->mod_installed = 0;
3827 
3828 		/*
3829 		 * Clear the MODS_INSTALLED flag not to call functions
3830 		 * in the module directly from now on.
3831 		 */
3832 		uninstall_stubs(mp);
3833 	} else {
3834 		if (moddebug & MODDEBUG_USERDEBUG)
3835 			printf(finiret_msg, mp->mod_filename, status);
3836 		/*
3837 		 * By definition _fini is only allowed to return EBUSY or the
3838 		 * result of mod_remove (EBUSY or EINVAL).  In the off chance
3839 		 * that a driver returns EALREADY we convert this to EINVAL
3840 		 * since to our caller EALREADY means module was already
3841 		 * removed.
3842 		 */
3843 		if (status == EALREADY)
3844 			status = EINVAL;
3845 	}
3846 
3847 	return (status);
3848 }
3849 
3850 /*
3851  * Uninstall all modules.
3852  */
3853 static void
mod_uninstall_all(void)3854 mod_uninstall_all(void)
3855 {
3856 	struct modctl	*mp;
3857 	int		pass;
3858 	modid_t		modid;
3859 
3860 	/* synchronize with any active modunload_disable() */
3861 	modunload_begin();
3862 
3863 	/* mark this thread as doing autounloading */
3864 	(void) tsd_set(mod_autounload_key, (void *)1);
3865 
3866 	(void) devfs_clean(ddi_root_node(), NULL, 0);
3867 	(void) ndi_devi_unconfig(ddi_root_node(), NDI_AUTODETACH);
3868 
3869 	/*
3870 	 * Loop up to max times if we keep producing unreferenced modules.
3871 	 * A new unreferenced module is an opportunity to unload.
3872 	 */
3873 	for (pass = 0; pass < mod_uninstall_pass_max; pass++) {
3874 
3875 		/* zero count of modules that go unreferenced during pass */
3876 		mod_uninstall_ref_zero = 0;
3877 
3878 		modid = 0;
3879 		while ((mp = mod_hold_next_by_id(modid)) != NULL) {
3880 			modid = mp->mod_id;
3881 
3882 			/*
3883 			 * Skip modules with the MOD_NOAUTOUNLOAD flag set
3884 			 */
3885 			if (mp->mod_loadflags & MOD_NOAUTOUNLOAD) {
3886 				mod_release_mod(mp);
3887 				continue;
3888 			}
3889 
3890 			if (moduninstall(mp) == 0) {
3891 				mod_unload(mp);
3892 				CPU_STATS_ADDQ(CPU, sys, modunload, 1);
3893 			}
3894 			mod_release_mod(mp);
3895 		}
3896 
3897 		/* break if no modules went unreferenced during pass */
3898 		if (mod_uninstall_ref_zero == 0)
3899 			break;
3900 	}
3901 	if (pass >= mod_uninstall_pass_max)
3902 		mod_uninstall_pass_exc++;
3903 
3904 	(void) tsd_set(mod_autounload_key, NULL);
3905 	modunload_end();
3906 }
3907 
3908 /* wait for unloads that have begun before registering disable */
3909 void
modunload_disable(void)3910 modunload_disable(void)
3911 {
3912 	mutex_enter(&modunload_wait_mutex);
3913 	while (modunload_active_count) {
3914 		modunload_wait++;
3915 		cv_wait(&modunload_wait_cv, &modunload_wait_mutex);
3916 		modunload_wait--;
3917 	}
3918 	modunload_disable_count++;
3919 	mutex_exit(&modunload_wait_mutex);
3920 }
3921 
3922 /* mark end of disable and signal waiters */
3923 void
modunload_enable(void)3924 modunload_enable(void)
3925 {
3926 	mutex_enter(&modunload_wait_mutex);
3927 	modunload_disable_count--;
3928 	if ((modunload_disable_count == 0) && modunload_wait)
3929 		cv_broadcast(&modunload_wait_cv);
3930 	mutex_exit(&modunload_wait_mutex);
3931 }
3932 
3933 /* wait for disables to complete before begining unload */
3934 void
modunload_begin()3935 modunload_begin()
3936 {
3937 	mutex_enter(&modunload_wait_mutex);
3938 	while (modunload_disable_count) {
3939 		modunload_wait++;
3940 		cv_wait(&modunload_wait_cv, &modunload_wait_mutex);
3941 		modunload_wait--;
3942 	}
3943 	modunload_active_count++;
3944 	mutex_exit(&modunload_wait_mutex);
3945 }
3946 
3947 /* mark end of unload and signal waiters */
3948 void
modunload_end()3949 modunload_end()
3950 {
3951 	mutex_enter(&modunload_wait_mutex);
3952 	modunload_active_count--;
3953 	if ((modunload_active_count == 0) && modunload_wait)
3954 		cv_broadcast(&modunload_wait_cv);
3955 	mutex_exit(&modunload_wait_mutex);
3956 }
3957 
3958 void
mod_uninstall_daemon(void)3959 mod_uninstall_daemon(void)
3960 {
3961 	callb_cpr_t	cprinfo;
3962 	clock_t		ticks;
3963 
3964 	mod_aul_thread = curthread;
3965 
3966 	CALLB_CPR_INIT(&cprinfo, &mod_uninstall_lock, callb_generic_cpr, "mud");
3967 	for (;;) {
3968 		mutex_enter(&mod_uninstall_lock);
3969 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
3970 		/*
3971 		 * In DEBUG kernels, unheld drivers are uninstalled periodically
3972 		 * every mod_uninstall_interval seconds.  Periodic uninstall can
3973 		 * be disabled by setting mod_uninstall_interval to 0 which is
3974 		 * the default for a non-DEBUG kernel.
3975 		 */
3976 		if (mod_uninstall_interval) {
3977 			ticks = drv_usectohz(mod_uninstall_interval * 1000000);
3978 			(void) cv_reltimedwait(&mod_uninstall_cv,
3979 			    &mod_uninstall_lock, ticks, TR_CLOCK_TICK);
3980 		} else {
3981 			cv_wait(&mod_uninstall_cv, &mod_uninstall_lock);
3982 		}
3983 		/*
3984 		 * The whole daemon is safe for CPR except we don't want
3985 		 * the daemon to run if FREEZE is issued and this daemon
3986 		 * wakes up from the cv_wait above. In this case, it'll be
3987 		 * blocked in CALLB_CPR_SAFE_END until THAW is issued.
3988 		 *
3989 		 * The reason of calling CALLB_CPR_SAFE_BEGIN twice is that
3990 		 * mod_uninstall_lock is used to protect cprinfo and
3991 		 * CALLB_CPR_SAFE_BEGIN assumes that this lock is held when
3992 		 * called.
3993 		 */
3994 		CALLB_CPR_SAFE_END(&cprinfo, &mod_uninstall_lock);
3995 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
3996 		mutex_exit(&mod_uninstall_lock);
3997 		if ((modunload_disable_count == 0) &&
3998 		    ((moddebug & MODDEBUG_NOAUTOUNLOAD) == 0)) {
3999 			mod_uninstall_all();
4000 		}
4001 	}
4002 }
4003 
4004 /*
4005  * Unload all uninstalled modules.
4006  */
4007 void
modreap(void)4008 modreap(void)
4009 {
4010 	mutex_enter(&mod_uninstall_lock);
4011 	cv_broadcast(&mod_uninstall_cv);
4012 	mutex_exit(&mod_uninstall_lock);
4013 }
4014 
4015 /*
4016  * Hold the specified module. This is the module holding primitive.
4017  *
4018  * If MOD_LOCK_HELD then the caller already holds the mod_lock.
4019  *
4020  * Return values:
4021  *	 0 ==> the module is held
4022  *	 1 ==> the module is not held and the MOD_WAIT_ONCE caller needs
4023  *		to determine how to retry.
4024  */
4025 int
mod_hold_by_modctl(struct modctl * mp,int f)4026 mod_hold_by_modctl(struct modctl *mp, int f)
4027 {
4028 	ASSERT((f & (MOD_WAIT_ONCE | MOD_WAIT_FOREVER)) &&
4029 	    ((f & (MOD_WAIT_ONCE | MOD_WAIT_FOREVER)) !=
4030 	    (MOD_WAIT_ONCE | MOD_WAIT_FOREVER)));
4031 	ASSERT((f & (MOD_LOCK_HELD | MOD_LOCK_NOT_HELD)) &&
4032 	    ((f & (MOD_LOCK_HELD | MOD_LOCK_NOT_HELD)) !=
4033 	    (MOD_LOCK_HELD | MOD_LOCK_NOT_HELD)));
4034 	ASSERT((f & MOD_LOCK_NOT_HELD) || MUTEX_HELD(&mod_lock));
4035 
4036 	if (f & MOD_LOCK_NOT_HELD)
4037 		mutex_enter(&mod_lock);
4038 
4039 	while (mp->mod_busy) {
4040 		mp->mod_want = 1;
4041 		cv_wait(&mod_cv, &mod_lock);
4042 		/*
4043 		 * Module may be unloaded by daemon.
4044 		 * Nevertheless, modctl structure is still in linked list
4045 		 * (i.e., off &modules), not freed!
4046 		 * Caller is not supposed to assume "mp" is valid, but there
4047 		 * is no reasonable way to detect this but using
4048 		 * mp->mod_modinfo->mp == NULL check (follow the back pointer)
4049 		 *   (or similar check depending on calling context)
4050 		 * DON'T free modctl structure, it will be very very
4051 		 * problematic.
4052 		 */
4053 		if (f & MOD_WAIT_ONCE) {
4054 			if (f & MOD_LOCK_NOT_HELD)
4055 				mutex_exit(&mod_lock);
4056 			return (1);	/* caller decides how to retry */
4057 		}
4058 	}
4059 
4060 	mp->mod_busy = 1;
4061 	mp->mod_inprogress_thread =
4062 	    (curthread == NULL ? (kthread_id_t)-1 : curthread);
4063 
4064 	if (f & MOD_LOCK_NOT_HELD)
4065 		mutex_exit(&mod_lock);
4066 	return (0);
4067 }
4068 
4069 static struct modctl *
mod_hold_by_name_common(struct modctl * dep,const char * filename)4070 mod_hold_by_name_common(struct modctl *dep, const char *filename)
4071 {
4072 	const char	*modname;
4073 	struct modctl	*mp;
4074 	char		*curname, *newname;
4075 	int		found = 0;
4076 
4077 	mutex_enter(&mod_lock);
4078 
4079 	if ((modname = strrchr(filename, '/')) == NULL)
4080 		modname = filename;
4081 	else
4082 		modname++;
4083 
4084 	mp = &modules;
4085 	do {
4086 		if (strcmp(modname, mp->mod_modname) == 0) {
4087 			found = 1;
4088 			break;
4089 		}
4090 	} while ((mp = mp->mod_next) != &modules);
4091 
4092 	if (found == 0) {
4093 		mp = allocate_modp(filename, modname);
4094 		modadd(mp);
4095 	}
4096 
4097 	/*
4098 	 * if dep is not NULL, set the mp in mod_requisite_loading for
4099 	 * the module circular dependency check. This field is used in
4100 	 * mod_circdep(), but it's cleard in mod_hold_loaded_mod().
4101 	 */
4102 	if (dep != NULL) {
4103 		ASSERT(dep->mod_busy && dep->mod_requisite_loading == NULL);
4104 		dep->mod_requisite_loading = mp;
4105 	}
4106 
4107 	/*
4108 	 * If the module was held, then it must be us who has it held.
4109 	 */
4110 	if (mod_circdep(mp))
4111 		mp = NULL;
4112 	else {
4113 		(void) mod_hold_by_modctl(mp, MOD_WAIT_FOREVER | MOD_LOCK_HELD);
4114 
4115 		/*
4116 		 * If the name hadn't been set or has changed, allocate
4117 		 * space and set it.  Free space used by previous name.
4118 		 *
4119 		 * Do not change the name of primary modules, for primary
4120 		 * modules the mod_filename was allocated in standalone mode:
4121 		 * it is illegal to kobj_alloc in standalone mode and kobj_free
4122 		 * in non-standalone mode.
4123 		 */
4124 		curname = mp->mod_filename;
4125 		if (curname == NULL ||
4126 		    ((mp->mod_prim == 0) &&
4127 		    (curname != filename) &&
4128 		    (modname != filename) &&
4129 		    (strcmp(curname, filename) != 0))) {
4130 			newname = kobj_zalloc(strlen(filename) + 1, KM_SLEEP);
4131 			(void) strcpy(newname, filename);
4132 			mp->mod_filename = newname;
4133 			if (curname != NULL)
4134 				kobj_free(curname, strlen(curname) + 1);
4135 		}
4136 	}
4137 
4138 	mutex_exit(&mod_lock);
4139 	if (mp && moddebug & MODDEBUG_LOADMSG2)
4140 		printf("Holding %s\n", mp->mod_filename);
4141 	if (mp == NULL && moddebug & MODDEBUG_LOADMSG2)
4142 		printf("circular dependency loading %s\n", filename);
4143 	return (mp);
4144 }
4145 
4146 static struct modctl *
mod_hold_by_name_requisite(struct modctl * dep,char * filename)4147 mod_hold_by_name_requisite(struct modctl *dep, char *filename)
4148 {
4149 	return (mod_hold_by_name_common(dep, filename));
4150 }
4151 
4152 struct modctl *
mod_hold_by_name(const char * filename)4153 mod_hold_by_name(const char *filename)
4154 {
4155 	return (mod_hold_by_name_common(NULL, filename));
4156 }
4157 
4158 struct modctl *
mod_hold_by_id(modid_t modid)4159 mod_hold_by_id(modid_t modid)
4160 {
4161 	struct modctl	*mp;
4162 	int		found = 0;
4163 
4164 	mutex_enter(&mod_lock);
4165 	mp = &modules;
4166 	do {
4167 		if (mp->mod_id == modid) {
4168 			found = 1;
4169 			break;
4170 		}
4171 	} while ((mp = mp->mod_next) != &modules);
4172 
4173 	if ((found == 0) || mod_circdep(mp))
4174 		mp = NULL;
4175 	else
4176 		(void) mod_hold_by_modctl(mp, MOD_WAIT_FOREVER | MOD_LOCK_HELD);
4177 
4178 	mutex_exit(&mod_lock);
4179 	return (mp);
4180 }
4181 
4182 static struct modctl *
mod_hold_next_by_id(modid_t modid)4183 mod_hold_next_by_id(modid_t modid)
4184 {
4185 	struct modctl	*mp;
4186 	int		found = 0;
4187 
4188 	if (modid < -1)
4189 		return (NULL);
4190 
4191 	mutex_enter(&mod_lock);
4192 
4193 	mp = &modules;
4194 	do {
4195 		if (mp->mod_id > modid) {
4196 			found = 1;
4197 			break;
4198 		}
4199 	} while ((mp = mp->mod_next) != &modules);
4200 
4201 	if ((found == 0) || mod_circdep(mp))
4202 		mp = NULL;
4203 	else
4204 		(void) mod_hold_by_modctl(mp, MOD_WAIT_FOREVER | MOD_LOCK_HELD);
4205 
4206 	mutex_exit(&mod_lock);
4207 	return (mp);
4208 }
4209 
4210 static void
mod_release(struct modctl * mp)4211 mod_release(struct modctl *mp)
4212 {
4213 	ASSERT(MUTEX_HELD(&mod_lock));
4214 	ASSERT(mp->mod_busy);
4215 
4216 	mp->mod_busy = 0;
4217 	mp->mod_inprogress_thread = NULL;
4218 	if (mp->mod_want) {
4219 		mp->mod_want = 0;
4220 		cv_broadcast(&mod_cv);
4221 	}
4222 }
4223 
4224 void
mod_release_mod(struct modctl * mp)4225 mod_release_mod(struct modctl *mp)
4226 {
4227 	if (moddebug & MODDEBUG_LOADMSG2)
4228 		printf("Releasing %s\n", mp->mod_filename);
4229 	mutex_enter(&mod_lock);
4230 	mod_release(mp);
4231 	mutex_exit(&mod_lock);
4232 }
4233 
4234 modid_t
mod_name_to_modid(const char * filename)4235 mod_name_to_modid(const char *filename)
4236 {
4237 	const char	*modname;
4238 	struct modctl	*mp;
4239 
4240 	mutex_enter(&mod_lock);
4241 
4242 	if ((modname = strrchr(filename, '/')) == NULL)
4243 		modname = filename;
4244 	else
4245 		modname++;
4246 
4247 	mp = &modules;
4248 	do {
4249 		if (strcmp(modname, mp->mod_modname) == 0) {
4250 			mutex_exit(&mod_lock);
4251 			return (mp->mod_id);
4252 		}
4253 	} while ((mp = mp->mod_next) != &modules);
4254 
4255 	mutex_exit(&mod_lock);
4256 	return (-1);
4257 }
4258 
4259 
4260 int
mod_remove_by_name(char * name)4261 mod_remove_by_name(char *name)
4262 {
4263 	struct modctl *mp;
4264 	int retval;
4265 
4266 	mp = mod_hold_by_name(name);
4267 
4268 	if (mp == NULL)
4269 		return (EINVAL);
4270 
4271 	if (mp->mod_loadflags & MOD_NOAUTOUNLOAD) {
4272 		/*
4273 		 * Do not unload forceloaded modules
4274 		 */
4275 		mod_release_mod(mp);
4276 		return (0);
4277 	}
4278 
4279 	if ((retval = moduninstall(mp)) == 0) {
4280 		mod_unload(mp);
4281 		CPU_STATS_ADDQ(CPU, sys, modunload, 1);
4282 	} else if (retval == EALREADY)
4283 		retval = 0;		/* already unloaded, not an error */
4284 	mod_release_mod(mp);
4285 	return (retval);
4286 }
4287 
4288 /*
4289  * Record that module "dep" is dependent on module "on_mod."
4290  */
4291 static void
mod_make_requisite(struct modctl * dependent,struct modctl * on_mod)4292 mod_make_requisite(struct modctl *dependent, struct modctl *on_mod)
4293 {
4294 	struct modctl_list **pmlnp;	/* previous next pointer */
4295 	struct modctl_list *mlp;
4296 	struct modctl_list *new;
4297 
4298 	ASSERT(dependent->mod_busy && on_mod->mod_busy);
4299 	mutex_enter(&mod_lock);
4300 
4301 	/*
4302 	 * Search dependent's requisite list to see if on_mod is recorded.
4303 	 * List is ordered by id.
4304 	 */
4305 	for (pmlnp = &dependent->mod_requisites, mlp = *pmlnp;
4306 	    mlp; pmlnp = &mlp->modl_next, mlp = *pmlnp)
4307 		if (mlp->modl_modp->mod_id >= on_mod->mod_id)
4308 			break;
4309 
4310 	/* Create and insert if not already recorded */
4311 	if ((mlp == NULL) || (mlp->modl_modp->mod_id != on_mod->mod_id)) {
4312 		new = kobj_zalloc(sizeof (*new), KM_SLEEP);
4313 		new->modl_modp = on_mod;
4314 		new->modl_next = mlp;
4315 		*pmlnp = new;
4316 
4317 		/*
4318 		 * Increment the mod_ref count in our new requisite module.
4319 		 * This is what keeps a module that has other modules
4320 		 * which are dependent on it from being uninstalled and
4321 		 * unloaded. "on_mod"'s mod_ref count decremented in
4322 		 * mod_release_requisites when the "dependent" module
4323 		 * unload is complete.	"on_mod" must be loaded, but may not
4324 		 * yet be installed.
4325 		 */
4326 		on_mod->mod_ref++;
4327 		ASSERT(on_mod->mod_ref && on_mod->mod_loaded);
4328 	}
4329 
4330 	mutex_exit(&mod_lock);
4331 }
4332 
4333 /*
4334  * release the hold associated with mod_make_requisite mod_ref++
4335  * as part of unload.
4336  */
4337 void
mod_release_requisites(struct modctl * modp)4338 mod_release_requisites(struct modctl *modp)
4339 {
4340 	struct modctl_list *modl;
4341 	struct modctl_list *next;
4342 	struct modctl *req;
4343 	struct modctl_list *start = NULL, *mod_garbage;
4344 
4345 	ASSERT(!quiesce_active);
4346 	ASSERT(modp->mod_busy);
4347 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
4348 
4349 	mutex_enter(&mod_lock);		/* needed for manipulation of req */
4350 	for (modl = modp->mod_requisites; modl; modl = next) {
4351 		next = modl->modl_next;
4352 		req = modl->modl_modp;
4353 		ASSERT(req->mod_ref >= 1 && req->mod_loaded);
4354 		req->mod_ref--;
4355 		if (req->mod_ref == 0)
4356 			mod_uninstall_ref_zero++;
4357 
4358 		/*
4359 		 * Check if the module has to be unloaded or not.
4360 		 */
4361 		if (req->mod_ref == 0 && req->mod_delay_unload) {
4362 			struct modctl_list *new;
4363 			/*
4364 			 * Allocate the modclt_list holding the garbage
4365 			 * module which should be unloaded later.
4366 			 */
4367 			new = kobj_zalloc(sizeof (struct modctl_list),
4368 			    KM_SLEEP);
4369 			new->modl_modp = req;
4370 
4371 			if (start == NULL)
4372 				mod_garbage = start = new;
4373 			else {
4374 				mod_garbage->modl_next = new;
4375 				mod_garbage = new;
4376 			}
4377 		}
4378 
4379 		/* free the list as we go */
4380 		kobj_free(modl, sizeof (*modl));
4381 	}
4382 	modp->mod_requisites = NULL;
4383 	mutex_exit(&mod_lock);
4384 
4385 	/*
4386 	 * Unload the garbage modules.
4387 	 */
4388 	for (mod_garbage = start; mod_garbage != NULL; /* nothing */) {
4389 		struct modctl_list *old = mod_garbage;
4390 		struct modctl *mp = mod_garbage->modl_modp;
4391 		ASSERT(mp != NULL);
4392 
4393 		/*
4394 		 * Hold this module until it's unloaded completely.
4395 		 */
4396 		(void) mod_hold_by_modctl(mp,
4397 		    MOD_WAIT_FOREVER | MOD_LOCK_NOT_HELD);
4398 		/*
4399 		 * Check if the module is not unloaded yet and nobody requires
4400 		 * the module. If it's unloaded already or somebody still
4401 		 * requires the module, don't unload it now.
4402 		 */
4403 		if (mp->mod_loaded && mp->mod_ref == 0)
4404 			mod_unload(mp);
4405 		ASSERT((mp->mod_loaded == 0 && mp->mod_delay_unload == 0) ||
4406 		    (mp->mod_ref > 0));
4407 		mod_release_mod(mp);
4408 
4409 		mod_garbage = mod_garbage->modl_next;
4410 		kobj_free(old, sizeof (struct modctl_list));
4411 	}
4412 }
4413 
4414 /*
4415  * Process dependency of the module represented by "dep" on the
4416  * module named by "on."
4417  *
4418  * Called from kobj_do_dependents() to load a module "on" on which
4419  * "dep" depends.
4420  */
4421 struct modctl *
mod_load_requisite(struct modctl * dep,char * on)4422 mod_load_requisite(struct modctl *dep, char *on)
4423 {
4424 	struct modctl *on_mod;
4425 	int retval;
4426 
4427 	if ((on_mod = mod_hold_loaded_mod(dep, on, &retval)) != NULL) {
4428 		mod_make_requisite(dep, on_mod);
4429 	} else if (moddebug & MODDEBUG_ERRMSG) {
4430 		printf("error processing %s on which module %s depends\n",
4431 		    on, dep->mod_modname);
4432 	}
4433 	return (on_mod);
4434 }
4435 
4436 static int
mod_install_requisites(struct modctl * modp)4437 mod_install_requisites(struct modctl *modp)
4438 {
4439 	struct modctl_list *modl;
4440 	struct modctl *req;
4441 	int status = 0;
4442 
4443 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
4444 	ASSERT(modp->mod_busy);
4445 
4446 	for (modl = modp->mod_requisites; modl; modl = modl->modl_next) {
4447 		req = modl->modl_modp;
4448 		(void) mod_hold_by_modctl(req,
4449 		    MOD_WAIT_FOREVER | MOD_LOCK_NOT_HELD);
4450 		status = modinstall(req);
4451 		mod_release_mod(req);
4452 
4453 		if (status != 0)
4454 			break;
4455 	}
4456 	return (status);
4457 }
4458 
4459 /*
4460  * returns 1 if this thread is doing autounload, 0 otherwise.
4461  * see mod_uninstall_all.
4462  */
4463 int
mod_in_autounload()4464 mod_in_autounload()
4465 {
4466 	return ((int)(uintptr_t)tsd_get(mod_autounload_key));
4467 }
4468 
4469 /*
4470  * gmatch adapted from libc, stripping the wchar stuff
4471  */
4472 #define	popchar(p, c)	{ \
4473 		c = *p++; \
4474 		if (c == 0) { \
4475 			return (0); \
4476 		} \
4477 	}
4478 
4479 int
gmatch(const char * s,const char * p)4480 gmatch(const char *s, const char *p)
4481 {
4482 	int c, sc;
4483 	int ok, lc, notflag;
4484 
4485 	sc = *s++;
4486 	c = *p++;
4487 	if (c == 0)
4488 		return (sc == c);	/* nothing matches nothing */
4489 
4490 	switch (c) {
4491 	case '\\':
4492 		/* skip to quoted character */
4493 		popchar(p, c);
4494 		/*FALLTHRU*/
4495 
4496 	default:
4497 		/* straight comparison */
4498 		if (c != sc)
4499 			return (0);
4500 		/*FALLTHRU*/
4501 
4502 	case '?':
4503 		/* first char matches, move to remainder */
4504 		return (sc != '\0' ? gmatch(s, p) : 0);
4505 
4506 
4507 	case '*':
4508 		while (*p == '*')
4509 			p++;
4510 
4511 		/* * matches everything */
4512 		if (*p == 0)
4513 			return (1);
4514 
4515 		/* undo skip at the beginning & iterate over substrings */
4516 		--s;
4517 		while (*s) {
4518 			if (gmatch(s, p))
4519 				return (1);
4520 			s++;
4521 		}
4522 		return (0);
4523 
4524 	case '[':
4525 		/* match any char within [] */
4526 		if (sc == 0)
4527 			return (0);
4528 
4529 		ok = lc = notflag = 0;
4530 
4531 		if (*p == '!') {
4532 			notflag = 1;
4533 			p++;
4534 		}
4535 		popchar(p, c);
4536 
4537 		do {
4538 			if (c == '-' && lc && *p != ']') {
4539 				/* test sc against range [c1-c2] */
4540 				popchar(p, c);
4541 				if (c == '\\') {
4542 					popchar(p, c);
4543 				}
4544 
4545 				if (notflag) {
4546 					/* return 0 on mismatch */
4547 					if (lc <= sc && sc <= c)
4548 						return (0);
4549 					ok++;
4550 				} else if (lc <= sc && sc <= c) {
4551 					ok++;
4552 				}
4553 				/* keep going, may get a match next */
4554 			} else if (c == '\\') {
4555 				/* skip to quoted character */
4556 				popchar(p, c);
4557 			}
4558 			lc = c;
4559 			if (notflag) {
4560 				if (sc == lc)
4561 					return (0);
4562 				ok++;
4563 			} else if (sc == lc) {
4564 				ok++;
4565 			}
4566 			popchar(p, c);
4567 		} while (c != ']');
4568 
4569 		/* recurse on remainder of string */
4570 		return (ok ? gmatch(s, p) : 0);
4571 	}
4572 	/*NOTREACHED*/
4573 }
4574 
4575 
4576 /*
4577  * Get default perm for device from /etc/minor_perm. Return 0 if match found.
4578  *
4579  * Pure wild-carded patterns are handled separately so the ordering of
4580  * these patterns doesn't matter.  We're still dependent on ordering
4581  * however as the first matching entry is the one returned.
4582  * Not ideal but all existing examples and usage do imply this
4583  * ordering implicitly.
4584  *
4585  * Drivers using the clone driver are always good for some entertainment.
4586  * Clone nodes under pseudo have the form clone@0:<driver>.  Some minor
4587  * perm entries have the form clone:<driver>, others use <driver>:*
4588  * Examples are clone:llc1 vs. llc2:*, for example.
4589  *
4590  * Minor perms in the clone:<driver> form are mapped to the drivers's
4591  * mperm list, not the clone driver, as wildcard entries for clone
4592  * reference only.  In other words, a clone wildcard will match
4593  * references for clone@0:<driver> but never <driver>@<minor>.
4594  *
4595  * Additional minor perms in the standard form are also supported,
4596  * for mixed usage, ie a node with an entry clone:<driver> could
4597  * provide further entries <driver>:<minor>.
4598  *
4599  * Finally, some uses of clone use an alias as the minor name rather
4600  * than the driver name, with the alias as the minor perm entry.
4601  * This case is handled by attaching the driver to bring its
4602  * minor list into existence, then discover the alias via DDI_ALIAS.
4603  * The clone device's minor perm list can then be searched for
4604  * that alias.
4605  */
4606 
4607 static int
dev_alias_minorperm(dev_info_t * dip,char * minor_name,mperm_t * rmp)4608 dev_alias_minorperm(dev_info_t *dip, char *minor_name, mperm_t *rmp)
4609 {
4610 	major_t			major;
4611 	struct devnames		*dnp;
4612 	mperm_t			*mp;
4613 	char			*alias = NULL;
4614 	dev_info_t		*cdevi;
4615 	struct ddi_minor_data	*dmd;
4616 
4617 	major = ddi_name_to_major(minor_name);
4618 
4619 	ASSERT(dip == clone_dip);
4620 	ASSERT(major != DDI_MAJOR_T_NONE);
4621 
4622 	/*
4623 	 * Attach the driver named by the minor node, then
4624 	 * search its first instance's minor list for an
4625 	 * alias node.
4626 	 */
4627 	if (ddi_hold_installed_driver(major) == NULL)
4628 		return (1);
4629 
4630 	dnp = &devnamesp[major];
4631 	LOCK_DEV_OPS(&dnp->dn_lock);
4632 
4633 	if ((cdevi = dnp->dn_head) != NULL) {
4634 		ndi_devi_enter(cdevi);
4635 		for (dmd = DEVI(cdevi)->devi_minor; dmd; dmd = dmd->next) {
4636 			if (dmd->type == DDM_ALIAS) {
4637 				alias = i_ddi_strdup(dmd->ddm_name, KM_SLEEP);
4638 				break;
4639 			}
4640 		}
4641 		ndi_devi_exit(cdevi);
4642 	}
4643 
4644 	UNLOCK_DEV_OPS(&dnp->dn_lock);
4645 	ddi_rele_driver(major);
4646 
4647 	if (alias == NULL) {
4648 		if (moddebug & MODDEBUG_MINORPERM)
4649 			cmn_err(CE_CONT, "dev_minorperm: "
4650 			    "no alias for %s\n", minor_name);
4651 		return (1);
4652 	}
4653 
4654 	major = ddi_driver_major(clone_dip);
4655 	dnp = &devnamesp[major];
4656 	LOCK_DEV_OPS(&dnp->dn_lock);
4657 
4658 	/*
4659 	 * Go through the clone driver's mperm list looking
4660 	 * for a match for the specified alias.
4661 	 */
4662 	for (mp = dnp->dn_mperm; mp; mp = mp->mp_next) {
4663 		if (strcmp(alias, mp->mp_minorname) == 0) {
4664 			break;
4665 		}
4666 	}
4667 
4668 	if (mp) {
4669 		if (moddebug & MODDEBUG_MP_MATCH) {
4670 			cmn_err(CE_CONT,
4671 			    "minor perm defaults: %s %s 0%o %d %d (aliased)\n",
4672 			    minor_name, alias, mp->mp_mode,
4673 			    mp->mp_uid, mp->mp_gid);
4674 		}
4675 		rmp->mp_uid = mp->mp_uid;
4676 		rmp->mp_gid = mp->mp_gid;
4677 		rmp->mp_mode = mp->mp_mode;
4678 	}
4679 	UNLOCK_DEV_OPS(&dnp->dn_lock);
4680 
4681 	kmem_free(alias, strlen(alias)+1);
4682 
4683 	return (mp == NULL);
4684 }
4685 
4686 int
dev_minorperm(dev_info_t * dip,char * name,mperm_t * rmp)4687 dev_minorperm(dev_info_t *dip, char *name, mperm_t *rmp)
4688 {
4689 	major_t major;
4690 	char *minor_name;
4691 	struct devnames *dnp;
4692 	mperm_t *mp;
4693 	int is_clone = 0;
4694 
4695 	if (!minorperm_loaded) {
4696 		if (moddebug & MODDEBUG_MINORPERM)
4697 			cmn_err(CE_CONT,
4698 			    "%s: minor perm not yet loaded\n", name);
4699 		return (1);
4700 	}
4701 
4702 	minor_name = strchr(name, ':');
4703 	if (minor_name == NULL)
4704 		return (1);
4705 	minor_name++;
4706 
4707 	/*
4708 	 * If it's the clone driver, search the driver as named
4709 	 * by the minor.  All clone minor perm entries other than
4710 	 * alias nodes are actually installed on the real driver's list.
4711 	 */
4712 	if (dip == clone_dip) {
4713 		major = ddi_name_to_major(minor_name);
4714 		if (major == DDI_MAJOR_T_NONE) {
4715 			if (moddebug & MODDEBUG_MINORPERM)
4716 				cmn_err(CE_CONT, "dev_minorperm: "
4717 				    "%s: no such driver\n", minor_name);
4718 			return (1);
4719 		}
4720 		is_clone = 1;
4721 	} else {
4722 		major = ddi_driver_major(dip);
4723 		ASSERT(major != DDI_MAJOR_T_NONE);
4724 	}
4725 
4726 	dnp = &devnamesp[major];
4727 	LOCK_DEV_OPS(&dnp->dn_lock);
4728 
4729 	/*
4730 	 * Go through the driver's mperm list looking for
4731 	 * a match for the specified minor.  If there's
4732 	 * no matching pattern, use the wild card.
4733 	 * Defer to the clone wild for clone if specified,
4734 	 * otherwise fall back to the normal form.
4735 	 */
4736 	for (mp = dnp->dn_mperm; mp; mp = mp->mp_next) {
4737 		if (gmatch(minor_name, mp->mp_minorname) != 0) {
4738 			break;
4739 		}
4740 	}
4741 	if (mp == NULL) {
4742 		if (is_clone)
4743 			mp = dnp->dn_mperm_clone;
4744 		if (mp == NULL)
4745 			mp = dnp->dn_mperm_wild;
4746 	}
4747 
4748 	if (mp) {
4749 		if (moddebug & MODDEBUG_MP_MATCH) {
4750 			cmn_err(CE_CONT,
4751 			    "minor perm defaults: %s %s 0%o %d %d\n",
4752 			    name, mp->mp_minorname, mp->mp_mode,
4753 			    mp->mp_uid, mp->mp_gid);
4754 		}
4755 		rmp->mp_uid = mp->mp_uid;
4756 		rmp->mp_gid = mp->mp_gid;
4757 		rmp->mp_mode = mp->mp_mode;
4758 	}
4759 	UNLOCK_DEV_OPS(&dnp->dn_lock);
4760 
4761 	/*
4762 	 * If no match can be found for a clone node,
4763 	 * search for a possible match for an alias.
4764 	 * One such example is /dev/ptmx -> /devices/pseudo/clone@0:ptm,
4765 	 * with minor perm entry clone:ptmx.
4766 	 */
4767 	if (mp == NULL && is_clone) {
4768 		return (dev_alias_minorperm(dip, minor_name, rmp));
4769 	}
4770 
4771 	return (mp == NULL);
4772 }
4773 
4774 /*
4775  * dynamicaly reference load a dl module/library, returning handle
4776  */
4777 /*ARGSUSED*/
4778 ddi_modhandle_t
ddi_modopen(const char * modname,int mode,int * errnop)4779 ddi_modopen(const char *modname, int mode, int *errnop)
4780 {
4781 	char		*subdir;
4782 	char		*mod;
4783 	int		subdirlen;
4784 	struct modctl	*hmodp = NULL;
4785 	int		retval = EINVAL;
4786 
4787 	ASSERT(modname && (mode == KRTLD_MODE_FIRST));
4788 	if ((modname == NULL) || (mode != KRTLD_MODE_FIRST))
4789 		goto out;
4790 
4791 	/* find last '/' in modname */
4792 	mod = strrchr(modname, '/');
4793 
4794 	if (mod) {
4795 		/* for subdir string without modification to argument */
4796 		mod++;
4797 		subdirlen = mod - modname;
4798 		subdir = kmem_alloc(subdirlen, KM_SLEEP);
4799 		(void) strlcpy(subdir, modname, subdirlen);
4800 	} else {
4801 		subdirlen = 0;
4802 		subdir = "misc";
4803 		mod = (char *)modname;
4804 	}
4805 
4806 	/* reference load with errno return value */
4807 	retval = modrload(subdir, mod, &hmodp);
4808 
4809 	if (subdirlen)
4810 		kmem_free(subdir, subdirlen);
4811 
4812 out:	if (errnop)
4813 		*errnop = retval;
4814 
4815 	if (moddebug & MODDEBUG_DDI_MOD)
4816 		printf("ddi_modopen %s mode %x: %s %p %d\n",
4817 		    modname ? modname : "<unknown>", mode,
4818 		    hmodp ? hmodp->mod_filename : "<unknown>",
4819 		    (void *)hmodp, retval);
4820 
4821 	return ((ddi_modhandle_t)hmodp);
4822 }
4823 
4824 /* lookup "name" in open dl module/library */
4825 void *
ddi_modsym(ddi_modhandle_t h,const char * name,int * errnop)4826 ddi_modsym(ddi_modhandle_t h, const char *name, int *errnop)
4827 {
4828 	struct modctl	*hmodp = (struct modctl *)h;
4829 	void		*f;
4830 	int		retval;
4831 
4832 	ASSERT(hmodp && name && hmodp->mod_installed && (hmodp->mod_ref >= 1));
4833 	if ((hmodp == NULL) || (name == NULL) ||
4834 	    (hmodp->mod_installed == 0) || (hmodp->mod_ref < 1)) {
4835 		f = NULL;
4836 		retval = EINVAL;
4837 	} else {
4838 		f = (void *)kobj_lookup(hmodp->mod_mp, (char *)name);
4839 		if (f)
4840 			retval = 0;
4841 		else
4842 			retval = ENOTSUP;
4843 	}
4844 
4845 	if (moddebug & MODDEBUG_DDI_MOD)
4846 		printf("ddi_modsym in %s of %s: %d %p\n",
4847 		    hmodp ? hmodp->mod_modname : "<unknown>",
4848 		    name ? name : "<unknown>", retval, f);
4849 
4850 	if (errnop)
4851 		*errnop = retval;
4852 	return (f);
4853 }
4854 
4855 /* dynamic (un)reference unload of an open dl module/library */
4856 int
ddi_modclose(ddi_modhandle_t h)4857 ddi_modclose(ddi_modhandle_t h)
4858 {
4859 	struct modctl	*hmodp = (struct modctl *)h;
4860 	struct modctl	*modp = NULL;
4861 	int		retval;
4862 
4863 	ASSERT(hmodp && hmodp->mod_installed && (hmodp->mod_ref >= 1));
4864 	if ((hmodp == NULL) ||
4865 	    (hmodp->mod_installed == 0) || (hmodp->mod_ref < 1)) {
4866 		retval = EINVAL;
4867 		goto out;
4868 	}
4869 
4870 	retval = modunrload(hmodp->mod_id, &modp, ddi_modclose_unload);
4871 	if (retval == EBUSY)
4872 		retval = 0;	/* EBUSY is not an error */
4873 
4874 	if (retval == 0) {
4875 		ASSERT(hmodp == modp);
4876 		if (hmodp != modp)
4877 			retval = EINVAL;
4878 	}
4879 
4880 out:	if (moddebug & MODDEBUG_DDI_MOD)
4881 		printf("ddi_modclose %s: %d\n",
4882 		    hmodp ? hmodp->mod_modname : "<unknown>", retval);
4883 
4884 	return (retval);
4885 }
4886