xref: /titanic_41/usr/src/uts/common/os/modctl.c (revision da14cebe459d3275048785f25bd869cb09b5307f)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2008 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 /*
28  * modctl system call for loadable module support.
29  */
30 
31 #include <sys/param.h>
32 #include <sys/user.h>
33 #include <sys/systm.h>
34 #include <sys/exec.h>
35 #include <sys/file.h>
36 #include <sys/stat.h>
37 #include <sys/conf.h>
38 #include <sys/time.h>
39 #include <sys/reboot.h>
40 #include <sys/fs/ufs_fsdir.h>
41 #include <sys/kmem.h>
42 #include <sys/sysconf.h>
43 #include <sys/cmn_err.h>
44 #include <sys/ddi.h>
45 #include <sys/sunddi.h>
46 #include <sys/sunndi.h>
47 #include <sys/ndi_impldefs.h>
48 #include <sys/ddi_impldefs.h>
49 #include <sys/ddi_implfuncs.h>
50 #include <sys/bootconf.h>
51 #include <sys/dc_ki.h>
52 #include <sys/cladm.h>
53 #include <sys/dtrace.h>
54 #include <sys/kdi.h>
55 
56 #include <sys/devpolicy.h>
57 #include <sys/modctl.h>
58 #include <sys/kobj.h>
59 #include <sys/devops.h>
60 #include <sys/autoconf.h>
61 #include <sys/hwconf.h>
62 #include <sys/callb.h>
63 #include <sys/debug.h>
64 #include <sys/cpuvar.h>
65 #include <sys/sysmacros.h>
66 #include <sys/sysevent.h>
67 #include <sys/sysevent_impl.h>
68 #include <sys/instance.h>
69 #include <sys/modhash.h>
70 #include <sys/modhash_impl.h>
71 #include <sys/dacf_impl.h>
72 #include <sys/vfs.h>
73 #include <sys/pathname.h>
74 #include <sys/console.h>
75 #include <sys/policy.h>
76 #include <ipp/ipp_impl.h>
77 #include <sys/fs/dv_node.h>
78 #include <sys/strsubr.h>
79 #include <sys/fs/sdev_node.h>
80 
81 static int		mod_circdep(struct modctl *);
82 static int		modinfo(modid_t, struct modinfo *);
83 
84 static void		mod_uninstall_all(void);
85 static int		mod_getinfo(struct modctl *, struct modinfo *);
86 static struct modctl	*allocate_modp(const char *, const char *);
87 
88 static int		mod_load(struct modctl *, int);
89 static void		mod_unload(struct modctl *);
90 static int		modinstall(struct modctl *);
91 static int		moduninstall(struct modctl *);
92 
93 static struct modctl	*mod_hold_by_name_common(struct modctl *, const char *);
94 static struct modctl	*mod_hold_next_by_id(modid_t);
95 static struct modctl	*mod_hold_loaded_mod(struct modctl *, char *, int *);
96 static struct modctl	*mod_hold_installed_mod(char *, int, int, int *);
97 
98 static void		mod_release(struct modctl *);
99 static void		mod_make_requisite(struct modctl *, struct modctl *);
100 static int		mod_install_requisites(struct modctl *);
101 static void		check_esc_sequences(char *, char *);
102 static struct modctl	*mod_hold_by_name_requisite(struct modctl *, char *);
103 
104 /*
105  * module loading thread control structure. Calls to kobj_load_module()() are
106  * handled off to a separate thead using this structure.
107  */
108 struct loadmt {
109 	ksema_t		sema;
110 	struct modctl	*mp;
111 	int		usepath;
112 	kthread_t	*owner;
113 	int		retval;
114 };
115 
116 static void	modload_thread(struct loadmt *);
117 
118 kcondvar_t	mod_cv;
119 kcondvar_t	mod_uninstall_cv;	/* Communication between swapper */
120 					/* and the uninstall daemon. */
121 kmutex_t	mod_lock;		/* protects &modules insert linkage, */
122 					/* mod_busy, mod_want, and mod_ref. */
123 					/* blocking operations while holding */
124 					/* mod_lock should be avoided */
125 kmutex_t	mod_uninstall_lock;	/* protects mod_uninstall_cv */
126 kthread_id_t	mod_aul_thread;
127 
128 int		modunload_wait;
129 kmutex_t	modunload_wait_mutex;
130 kcondvar_t	modunload_wait_cv;
131 int		modunload_active_count;
132 int		modunload_disable_count;
133 
134 int	isminiroot;		/* set if running as miniroot */
135 int	modrootloaded;		/* set after root driver and fs are loaded */
136 int	moddebug = 0x0;		/* debug flags for module writers */
137 int	swaploaded;		/* set after swap driver and fs are loaded */
138 int	bop_io_quiesced = 0;	/* set when BOP I/O can no longer be used */
139 int	last_module_id;
140 clock_t	mod_uninstall_interval = 0;
141 int	ddi_modclose_unload = 1;	/* 0 -> just decrement reference */
142 
143 struct devnames *devnamesp;
144 struct devnames orphanlist;
145 
146 krwlock_t	devinfo_tree_lock;	/* obsolete, to be removed */
147 
148 #define	MAJBINDFILE "/etc/name_to_major"
149 #define	SYSBINDFILE "/etc/name_to_sysnum"
150 
151 static char	majbind[] = MAJBINDFILE;
152 static char	sysbind[] = SYSBINDFILE;
153 static uint_t	mod_autounload_key;	/* for module autounload detection */
154 
155 extern int obpdebug;
156 extern int make_mbind(char *, int, char *, struct bind **);
157 
158 #define	DEBUGGER_PRESENT	((boothowto & RB_DEBUG) || (obpdebug != 0))
159 
160 static int minorperm_loaded = 0;
161 
162 void
163 mod_setup(void)
164 {
165 	struct sysent *callp;
166 	int callnum, exectype;
167 	int	num_devs;
168 	int	i;
169 
170 	/*
171 	 * Initialize the list of loaded driver dev_ops.
172 	 * XXX - This must be done before reading the system file so that
173 	 * forceloads of drivers will work.
174 	 */
175 	num_devs = read_binding_file(majbind, mb_hashtab, make_mbind);
176 	/*
177 	 * Since read_binding_file is common code, it doesn't enforce that all
178 	 * of the binding file entries have major numbers <= MAXMAJ32.  Thus,
179 	 * ensure that we don't allocate some massive amount of space due to a
180 	 * bad entry.  We can't have major numbers bigger than MAXMAJ32
181 	 * until file system support for larger major numbers exists.
182 	 */
183 
184 	/*
185 	 * Leave space for expansion, but not more than L_MAXMAJ32
186 	 */
187 	devcnt = MIN(num_devs + 30, L_MAXMAJ32);
188 	devopsp = kmem_alloc(devcnt * sizeof (struct dev_ops *), KM_SLEEP);
189 	for (i = 0; i < devcnt; i++)
190 		devopsp[i] = &mod_nodev_ops;
191 
192 	init_devnamesp(devcnt);
193 
194 	/*
195 	 * Sync up with the work that the stand-alone linker has already done.
196 	 */
197 	(void) kobj_sync();
198 
199 	if (boothowto & RB_DEBUG)
200 		kdi_dvec_modavail();
201 
202 	make_aliases(mb_hashtab);
203 
204 	/*
205 	 * Initialize streams device implementation structures.
206 	 */
207 	devimpl = kmem_zalloc(devcnt * sizeof (cdevsw_impl_t), KM_SLEEP);
208 
209 	/*
210 	 * If the cl_bootstrap module is present,
211 	 * we should be configured as a cluster. Loading this module
212 	 * will set "cluster_bootflags" to non-zero.
213 	 */
214 	(void) modload("misc", "cl_bootstrap");
215 
216 	(void) read_binding_file(sysbind, sb_hashtab, make_mbind);
217 	init_syscallnames(NSYSCALL);
218 
219 	/*
220 	 * Start up dynamic autoconfiguration framework (dacf).
221 	 */
222 	mod_hash_init();
223 	dacf_init();
224 
225 	/*
226 	 * Start up IP policy framework (ipp).
227 	 */
228 	ipp_init();
229 
230 	/*
231 	 * Allocate loadable native system call locks.
232 	 */
233 	for (callnum = 0, callp = sysent; callnum < NSYSCALL;
234 	    callnum++, callp++) {
235 		if (LOADABLE_SYSCALL(callp)) {
236 			if (mod_getsysname(callnum) != NULL) {
237 				callp->sy_lock =
238 				    kobj_zalloc(sizeof (krwlock_t), KM_SLEEP);
239 				rw_init(callp->sy_lock, NULL, RW_DEFAULT, NULL);
240 			} else {
241 				callp->sy_flags &= ~SE_LOADABLE;
242 				callp->sy_callc = nosys;
243 			}
244 #ifdef DEBUG
245 		} else {
246 			/*
247 			 * Do some sanity checks on the sysent table
248 			 */
249 			switch (callp->sy_flags & SE_RVAL_MASK) {
250 			case SE_32RVAL1:
251 				/* only r_val1 returned */
252 			case SE_32RVAL1 | SE_32RVAL2:
253 				/* r_val1 and r_val2 returned */
254 			case SE_64RVAL:
255 				/* 64-bit rval returned */
256 				break;
257 			default:
258 				cmn_err(CE_WARN, "sysent[%d]: bad flags %x",
259 				    callnum, callp->sy_flags);
260 			}
261 #endif
262 		}
263 	}
264 
265 #ifdef _SYSCALL32_IMPL
266 	/*
267 	 * Allocate loadable system call locks for 32-bit compat syscalls
268 	 */
269 	for (callnum = 0, callp = sysent32; callnum < NSYSCALL;
270 	    callnum++, callp++) {
271 		if (LOADABLE_SYSCALL(callp)) {
272 			if (mod_getsysname(callnum) != NULL) {
273 				callp->sy_lock =
274 				    kobj_zalloc(sizeof (krwlock_t), KM_SLEEP);
275 				rw_init(callp->sy_lock, NULL, RW_DEFAULT, NULL);
276 			} else {
277 				callp->sy_flags &= ~SE_LOADABLE;
278 				callp->sy_callc = nosys;
279 			}
280 #ifdef DEBUG
281 		} else {
282 			/*
283 			 * Do some sanity checks on the sysent table
284 			 */
285 			switch (callp->sy_flags & SE_RVAL_MASK) {
286 			case SE_32RVAL1:
287 				/* only r_val1 returned */
288 			case SE_32RVAL1 | SE_32RVAL2:
289 				/* r_val1 and r_val2 returned */
290 			case SE_64RVAL:
291 				/* 64-bit rval returned */
292 				break;
293 			default:
294 				cmn_err(CE_WARN, "sysent32[%d]: bad flags %x",
295 				    callnum, callp->sy_flags);
296 				goto skip;
297 			}
298 
299 			/*
300 			 * Cross-check the native and compatibility tables.
301 			 */
302 			if (callp->sy_callc == nosys ||
303 			    sysent[callnum].sy_callc == nosys)
304 				continue;
305 			/*
306 			 * If only one or the other slot is loadable, then
307 			 * there's an error -- they should match!
308 			 */
309 			if ((callp->sy_callc == loadable_syscall) ^
310 			    (sysent[callnum].sy_callc == loadable_syscall)) {
311 				cmn_err(CE_WARN, "sysent[%d] loadable?",
312 				    callnum);
313 			}
314 			/*
315 			 * This is more of a heuristic test -- if the
316 			 * system call returns two values in the 32-bit
317 			 * world, it should probably return two 32-bit
318 			 * values in the 64-bit world too.
319 			 */
320 			if (((callp->sy_flags & SE_32RVAL2) == 0) ^
321 			    ((sysent[callnum].sy_flags & SE_32RVAL2) == 0)) {
322 				cmn_err(CE_WARN, "sysent[%d] rval2 mismatch!",
323 				    callnum);
324 			}
325 skip:;
326 #endif	/* DEBUG */
327 		}
328 	}
329 #endif	/* _SYSCALL32_IMPL */
330 
331 	/*
332 	 * Allocate loadable exec locks.  (Assumes all execs are loadable)
333 	 */
334 	for (exectype = 0; exectype < nexectype; exectype++) {
335 		execsw[exectype].exec_lock =
336 		    kobj_zalloc(sizeof (krwlock_t), KM_SLEEP);
337 		rw_init(execsw[exectype].exec_lock, NULL, RW_DEFAULT, NULL);
338 	}
339 
340 	read_class_file();
341 
342 	/* init thread specific structure for mod_uninstall_all */
343 	tsd_create(&mod_autounload_key, NULL);
344 }
345 
346 static int
347 modctl_modload(int use_path, char *filename, int *rvp)
348 {
349 	struct modctl *modp;
350 	int retval = 0;
351 	char *filenamep;
352 	int modid;
353 
354 	filenamep = kmem_zalloc(MOD_MAXPATH, KM_SLEEP);
355 
356 	if (copyinstr(filename, filenamep, MOD_MAXPATH, 0)) {
357 		retval = EFAULT;
358 		goto out;
359 	}
360 
361 	filenamep[MOD_MAXPATH - 1] = 0;
362 	modp = mod_hold_installed_mod(filenamep, use_path, 0, &retval);
363 
364 	if (modp == NULL)
365 		goto out;
366 
367 	modp->mod_loadflags |= MOD_NOAUTOUNLOAD;
368 	modid = modp->mod_id;
369 	mod_release_mod(modp);
370 	CPU_STATS_ADDQ(CPU, sys, modload, 1);
371 	if (rvp != NULL && copyout(&modid, rvp, sizeof (modid)) != 0)
372 		retval = EFAULT;
373 out:
374 	kmem_free(filenamep, MOD_MAXPATH);
375 
376 	return (retval);
377 }
378 
379 static int
380 modctl_modunload(modid_t id)
381 {
382 	int rval = 0;
383 
384 	if (id == 0) {
385 #ifdef DEBUG
386 		/*
387 		 * Turn on mod_uninstall_daemon
388 		 */
389 		if (mod_uninstall_interval == 0) {
390 			mod_uninstall_interval = 60;
391 			modreap();
392 			return (rval);
393 		}
394 #endif
395 		mod_uninstall_all();
396 	} else {
397 		rval = modunload(id);
398 	}
399 	return (rval);
400 }
401 
402 static int
403 modctl_modinfo(modid_t id, struct modinfo *umodi)
404 {
405 	int retval;
406 	struct modinfo modi;
407 #if defined(_SYSCALL32_IMPL)
408 	int nobase;
409 	struct modinfo32 modi32;
410 #endif
411 
412 	if (get_udatamodel() == DATAMODEL_NATIVE) {
413 		if (copyin(umodi, &modi, sizeof (struct modinfo)) != 0)
414 			return (EFAULT);
415 	}
416 #ifdef _SYSCALL32_IMPL
417 	else {
418 		bzero(&modi, sizeof (modi));
419 		if (copyin(umodi, &modi32, sizeof (struct modinfo32)) != 0)
420 			return (EFAULT);
421 		modi.mi_info = modi32.mi_info;
422 		modi.mi_id = modi32.mi_id;
423 		modi.mi_nextid = modi32.mi_nextid;
424 		nobase = modi.mi_info & MI_INFO_NOBASE;
425 	}
426 #endif
427 	/*
428 	 * This flag is -only- for the kernels use.
429 	 */
430 	modi.mi_info &= ~MI_INFO_LINKAGE;
431 
432 	retval = modinfo(id, &modi);
433 	if (retval)
434 		return (retval);
435 
436 	if (get_udatamodel() == DATAMODEL_NATIVE) {
437 		if (copyout(&modi, umodi, sizeof (struct modinfo)) != 0)
438 			retval = EFAULT;
439 #ifdef _SYSCALL32_IMPL
440 	} else {
441 		int i;
442 
443 		if (!nobase && (uintptr_t)modi.mi_base > UINT32_MAX)
444 			return (EOVERFLOW);
445 
446 		modi32.mi_info = modi.mi_info;
447 		modi32.mi_state = modi.mi_state;
448 		modi32.mi_id = modi.mi_id;
449 		modi32.mi_nextid = modi.mi_nextid;
450 		modi32.mi_base = (caddr32_t)(uintptr_t)modi.mi_base;
451 		modi32.mi_size = modi.mi_size;
452 		modi32.mi_rev = modi.mi_rev;
453 		modi32.mi_loadcnt = modi.mi_loadcnt;
454 		bcopy(modi.mi_name, modi32.mi_name, sizeof (modi32.mi_name));
455 		for (i = 0; i < MODMAXLINK32; i++) {
456 			modi32.mi_msinfo[i].msi_p0 = modi.mi_msinfo[i].msi_p0;
457 			bcopy(modi.mi_msinfo[i].msi_linkinfo,
458 			    modi32.mi_msinfo[i].msi_linkinfo,
459 			    sizeof (modi32.mi_msinfo[0].msi_linkinfo));
460 		}
461 		if (copyout(&modi32, umodi, sizeof (struct modinfo32)) != 0)
462 			retval = EFAULT;
463 #endif
464 	}
465 
466 	return (retval);
467 }
468 
469 /*
470  * Return the last major number in the range of permissible major numbers.
471  */
472 /*ARGSUSED*/
473 static int
474 modctl_modreserve(modid_t id, int *data)
475 {
476 	if (copyout(&devcnt, data, sizeof (devcnt)) != 0)
477 		return (EFAULT);
478 	return (0);
479 }
480 
481 static int
482 modctl_add_major(int *data)
483 {
484 	struct modconfig mc;
485 	int i, rv;
486 	struct aliases alias;
487 	struct aliases *ap;
488 	char name[MAXMODCONFNAME];
489 	char cname[MAXMODCONFNAME];
490 	char *drvname;
491 
492 	bzero(&mc, sizeof (struct modconfig));
493 	if (get_udatamodel() == DATAMODEL_NATIVE) {
494 		if (copyin(data, &mc, sizeof (struct modconfig)) != 0)
495 			return (EFAULT);
496 	}
497 #ifdef _SYSCALL32_IMPL
498 	else {
499 		struct modconfig32 modc32;
500 
501 		if (copyin(data, &modc32, sizeof (struct modconfig32)) != 0)
502 			return (EFAULT);
503 		else {
504 			bcopy(modc32.drvname, mc.drvname,
505 			    sizeof (modc32.drvname));
506 			bcopy(modc32.drvclass, mc.drvclass,
507 			    sizeof (modc32.drvclass));
508 			mc.major = modc32.major;
509 			mc.num_aliases = modc32.num_aliases;
510 			mc.ap = (struct aliases *)(uintptr_t)modc32.ap;
511 		}
512 	}
513 #endif
514 
515 	/*
516 	 * If the driver is already in the mb_hashtab, and the name given
517 	 * doesn't match that driver's name, fail.  Otherwise, pass, since
518 	 * we may be adding aliases.
519 	 */
520 	if ((drvname = mod_major_to_name(mc.major)) != NULL &&
521 	    strcmp(drvname, mc.drvname) != 0)
522 		return (EINVAL);
523 
524 	/*
525 	 * Add each supplied driver alias to mb_hashtab
526 	 */
527 	ap = mc.ap;
528 	for (i = 0; i < mc.num_aliases; i++) {
529 		bzero(&alias, sizeof (struct aliases));
530 
531 		if (get_udatamodel() == DATAMODEL_NATIVE) {
532 			if (copyin(ap, &alias, sizeof (struct aliases)) != 0)
533 				return (EFAULT);
534 
535 			if (alias.a_len > MAXMODCONFNAME)
536 				return (EINVAL);
537 
538 			if (copyin(alias.a_name, name, alias.a_len) != 0)
539 				return (EFAULT);
540 
541 			if (name[alias.a_len - 1] != '\0')
542 				return (EINVAL);
543 		}
544 #ifdef _SYSCALL32_IMPL
545 		else {
546 			struct aliases32 al32;
547 
548 			bzero(&al32, sizeof (struct aliases32));
549 			if (copyin(ap, &al32, sizeof (struct aliases32)) != 0)
550 				return (EFAULT);
551 
552 			if (al32.a_len > MAXMODCONFNAME)
553 				return (EINVAL);
554 
555 			if (copyin((void *)(uintptr_t)al32.a_name,
556 			    name, al32.a_len) != 0)
557 				return (EFAULT);
558 
559 			if (name[al32.a_len - 1] != '\0')
560 				return (EINVAL);
561 
562 			alias.a_next = (void *)(uintptr_t)al32.a_next;
563 		}
564 #endif
565 		check_esc_sequences(name, cname);
566 		(void) make_mbind(cname, mc.major, NULL, mb_hashtab);
567 		ap = alias.a_next;
568 	}
569 
570 	/*
571 	 * Try to establish an mbinding for mc.drvname, and add it to devnames.
572 	 * Add class if any after establishing the major number
573 	 */
574 	(void) make_mbind(mc.drvname, mc.major, NULL, mb_hashtab);
575 	rv = make_devname(mc.drvname, mc.major);
576 
577 	if (rv == 0) {
578 		if (mc.drvclass[0] != '\0')
579 			add_class(mc.drvname, mc.drvclass);
580 		(void) i_ddi_load_drvconf(mc.major);
581 		i_ddi_bind_devs();
582 		i_ddi_di_cache_invalidate(KM_SLEEP);
583 	}
584 	return (rv);
585 }
586 
587 static int
588 modctl_rem_major(major_t major)
589 {
590 	struct devnames *dnp;
591 
592 	if (major >= devcnt)
593 		return (EINVAL);
594 
595 	/* mark devnames as removed */
596 	dnp = &devnamesp[major];
597 	LOCK_DEV_OPS(&dnp->dn_lock);
598 	if (dnp->dn_name == NULL ||
599 	    (dnp->dn_flags & (DN_DRIVER_REMOVED | DN_TAKEN_GETUDEV))) {
600 		UNLOCK_DEV_OPS(&dnp->dn_lock);
601 		return (EINVAL);
602 	}
603 	dnp->dn_flags |= DN_DRIVER_REMOVED;
604 	pm_driver_removed(major);
605 	UNLOCK_DEV_OPS(&dnp->dn_lock);
606 
607 	(void) i_ddi_unload_drvconf(major);
608 	i_ddi_unbind_devs(major);
609 	i_ddi_di_cache_invalidate(KM_SLEEP);
610 	return (0);
611 }
612 
613 static struct vfs *
614 path_to_vfs(char *name)
615 {
616 	vnode_t *vp;
617 	struct vfs *vfsp;
618 
619 	if (lookupname(name, UIO_SYSSPACE, FOLLOW, NULLVPP, &vp))
620 		return (NULL);
621 
622 	vfsp = vp->v_vfsp;
623 	VN_RELE(vp);
624 	return (vfsp);
625 }
626 
627 static int
628 new_vfs_in_modpath()
629 {
630 	static int n_modpath = 0;
631 	static char *modpath_copy;
632 	static struct pathvfs {
633 		char *path;
634 		struct vfs *vfsp;
635 	} *pathvfs;
636 
637 	int i, new_vfs = 0;
638 	char *tmp, *tmp1;
639 	struct vfs *vfsp;
640 
641 	if (n_modpath != 0) {
642 		for (i = 0; i < n_modpath; i++) {
643 			vfsp = path_to_vfs(pathvfs[i].path);
644 			if (vfsp != pathvfs[i].vfsp) {
645 				pathvfs[i].vfsp = vfsp;
646 				if (vfsp)
647 					new_vfs = 1;
648 			}
649 		}
650 		return (new_vfs);
651 	}
652 
653 	/*
654 	 * First call, initialize the pathvfs structure
655 	 */
656 	modpath_copy = i_ddi_strdup(default_path, KM_SLEEP);
657 	tmp = modpath_copy;
658 	n_modpath = 1;
659 	tmp1 = strchr(tmp, ' ');
660 	while (tmp1) {
661 		*tmp1 = '\0';
662 		n_modpath++;
663 		tmp = tmp1 + 1;
664 		tmp1 = strchr(tmp, ' ');
665 	}
666 
667 	pathvfs = kmem_zalloc(n_modpath * sizeof (struct pathvfs), KM_SLEEP);
668 	tmp = modpath_copy;
669 	for (i = 0; i < n_modpath; i++) {
670 		pathvfs[i].path = tmp;
671 		vfsp = path_to_vfs(tmp);
672 		pathvfs[i].vfsp = vfsp;
673 		tmp += strlen(tmp) + 1;
674 	}
675 	return (1);	/* always reread driver.conf the first time */
676 }
677 
678 static int
679 modctl_load_drvconf(major_t major)
680 {
681 	int ret;
682 
683 	if (major != DDI_MAJOR_T_NONE) {
684 		ret = i_ddi_load_drvconf(major);
685 		if (ret == 0)
686 			i_ddi_bind_devs();
687 		return (ret);
688 	}
689 
690 	/*
691 	 * We are invoked to rescan new driver.conf files. It is
692 	 * only necessary if a new file system was mounted in the
693 	 * module_path. Because rescanning driver.conf files can
694 	 * take some time on older platforms (sun4m), the following
695 	 * code skips unnecessary driver.conf rescans to optimize
696 	 * boot performance.
697 	 */
698 	if (new_vfs_in_modpath()) {
699 		(void) i_ddi_load_drvconf(DDI_MAJOR_T_NONE);
700 		/*
701 		 * If we are still initializing io subsystem,
702 		 * load drivers with ddi-forceattach property
703 		 */
704 		if (!i_ddi_io_initialized())
705 			i_ddi_forceattach_drivers();
706 	}
707 	return (0);
708 }
709 
710 static int
711 modctl_unload_drvconf(major_t major)
712 {
713 	int ret;
714 
715 	if (major >= devcnt)
716 		return (EINVAL);
717 
718 	ret = i_ddi_unload_drvconf(major);
719 	if (ret != 0)
720 		return (ret);
721 	(void) i_ddi_unbind_devs(major);
722 
723 	return (0);
724 }
725 
726 static void
727 check_esc_sequences(char *str, char *cstr)
728 {
729 	int i;
730 	size_t len;
731 	char *p;
732 
733 	len = strlen(str);
734 	for (i = 0; i < len; i++, str++, cstr++) {
735 		if (*str != '\\') {
736 			*cstr = *str;
737 		} else {
738 			p = str + 1;
739 			/*
740 			 * we only handle octal escape sequences for SPACE
741 			 */
742 			if (*p++ == '0' && *p++ == '4' && *p == '0') {
743 				*cstr = ' ';
744 				str += 3;
745 			} else {
746 				*cstr = *str;
747 			}
748 		}
749 	}
750 	*cstr = 0;
751 }
752 
753 static int
754 modctl_getmodpathlen(int *data)
755 {
756 	int len;
757 	len = strlen(default_path);
758 	if (copyout(&len, data, sizeof (len)) != 0)
759 		return (EFAULT);
760 	return (0);
761 }
762 
763 static int
764 modctl_getmodpath(char *data)
765 {
766 	if (copyout(default_path, data, strlen(default_path) + 1) != 0)
767 		return (EFAULT);
768 	return (0);
769 }
770 
771 static int
772 modctl_read_sysbinding_file(void)
773 {
774 	(void) read_binding_file(sysbind, sb_hashtab, make_mbind);
775 	return (0);
776 }
777 
778 static int
779 modctl_getmaj(char *uname, uint_t ulen, int *umajorp)
780 {
781 	char name[256];
782 	int retval;
783 	major_t major;
784 
785 	if (ulen == 0)
786 		return (EINVAL);
787 	if ((retval = copyinstr(uname, name,
788 	    (ulen < 256) ? ulen : 256, 0)) != 0)
789 		return (retval);
790 	if ((major = mod_name_to_major(name)) == DDI_MAJOR_T_NONE)
791 		return (ENODEV);
792 	if (copyout(&major, umajorp, sizeof (major_t)) != 0)
793 		return (EFAULT);
794 	return (0);
795 }
796 
797 static char **
798 convert_constraint_string(char *constraints, size_t len)
799 {
800 	int	i;
801 	int	n;
802 	char	*p;
803 	char	**array;
804 
805 	ASSERT(constraints != NULL);
806 	ASSERT(len > 0);
807 
808 	for (i = 0, p = constraints; strlen(p) > 0; i++, p += strlen(p) + 1)
809 		;
810 
811 	n = i;
812 
813 	if (n == 0) {
814 		kmem_free(constraints, len);
815 		return (NULL);
816 	}
817 
818 	array = kmem_alloc((n + 1) * sizeof (char *), KM_SLEEP);
819 
820 	for (i = 0, p = constraints; i < n; i++, p += strlen(p) + 1) {
821 		array[i] = i_ddi_strdup(p, KM_SLEEP);
822 	}
823 	array[n] = NULL;
824 
825 	kmem_free(constraints, len);
826 
827 	return (array);
828 }
829 /*ARGSUSED*/
830 static int
831 modctl_retire(char *path, char *uconstraints, size_t ulen)
832 {
833 	char	*pathbuf;
834 	char	*devpath;
835 	size_t	pathsz;
836 	int	retval;
837 	char	*constraints;
838 	char	**cons_array;
839 
840 	if (path == NULL)
841 		return (EINVAL);
842 
843 	if ((uconstraints == NULL) ^ (ulen == 0))
844 		return (EINVAL);
845 
846 	pathbuf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
847 	retval = copyinstr(path, pathbuf, MAXPATHLEN, &pathsz);
848 	if (retval != 0) {
849 		kmem_free(pathbuf, MAXPATHLEN);
850 		return (retval);
851 	}
852 	devpath = i_ddi_strdup(pathbuf, KM_SLEEP);
853 	kmem_free(pathbuf, MAXPATHLEN);
854 
855 	/*
856 	 * First check if the device is already retired.
857 	 * If it is, this becomes a NOP
858 	 */
859 	if (e_ddi_device_retired(devpath)) {
860 		cmn_err(CE_NOTE, "Device: already retired: %s", devpath);
861 		kmem_free(devpath, strlen(devpath) + 1);
862 		return (0);
863 	}
864 
865 	cons_array = NULL;
866 	if (uconstraints) {
867 		constraints = kmem_alloc(ulen, KM_SLEEP);
868 		if (copyin(uconstraints, constraints, ulen)) {
869 			kmem_free(constraints, ulen);
870 			kmem_free(devpath, strlen(devpath) + 1);
871 			return (EFAULT);
872 		}
873 		cons_array = convert_constraint_string(constraints, ulen);
874 	}
875 
876 	/*
877 	 * Try to retire the device first. The following
878 	 * routine will return an error only if the device
879 	 * is not retireable i.e. retire constraints forbid
880 	 * a retire. A return of success from this routine
881 	 * indicates that device is retireable.
882 	 */
883 	retval = e_ddi_retire_device(devpath, cons_array);
884 	if (retval != DDI_SUCCESS) {
885 		cmn_err(CE_WARN, "constraints forbid retire: %s", devpath);
886 		kmem_free(devpath, strlen(devpath) + 1);
887 		return (ENOTSUP);
888 	}
889 
890 	/*
891 	 * Ok, the retire succeeded. Persist the retire.
892 	 * If retiring a nexus, we need to only persist the
893 	 * nexus retire. Any children of a retired nexus
894 	 * are automatically covered by the retire store
895 	 * code.
896 	 */
897 	retval = e_ddi_retire_persist(devpath);
898 	if (retval != 0) {
899 		cmn_err(CE_WARN, "Failed to persist device retire: error %d: "
900 		    "%s", retval, devpath);
901 		kmem_free(devpath, strlen(devpath) + 1);
902 		return (retval);
903 	}
904 	if (moddebug & MODDEBUG_RETIRE)
905 		cmn_err(CE_NOTE, "Persisted retire of device: %s", devpath);
906 
907 	kmem_free(devpath, strlen(devpath) + 1);
908 	return (0);
909 }
910 
911 static int
912 modctl_is_retired(char *path, int *statep)
913 {
914 	char	*pathbuf;
915 	char	*devpath;
916 	size_t	pathsz;
917 	int	error;
918 	int	status;
919 
920 	if (path == NULL || statep == NULL)
921 		return (EINVAL);
922 
923 	pathbuf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
924 	error = copyinstr(path, pathbuf, MAXPATHLEN, &pathsz);
925 	if (error != 0) {
926 		kmem_free(pathbuf, MAXPATHLEN);
927 		return (error);
928 	}
929 	devpath = i_ddi_strdup(pathbuf, KM_SLEEP);
930 	kmem_free(pathbuf, MAXPATHLEN);
931 
932 	if (e_ddi_device_retired(devpath))
933 		status = 1;
934 	else
935 		status = 0;
936 	kmem_free(devpath, strlen(devpath) + 1);
937 
938 	return (copyout(&status, statep, sizeof (status)) ? EFAULT : 0);
939 }
940 
941 static int
942 modctl_unretire(char *path)
943 {
944 	char	*pathbuf;
945 	char	*devpath;
946 	size_t	pathsz;
947 	int	retired;
948 	int	retval;
949 
950 	if (path == NULL)
951 		return (EINVAL);
952 
953 	pathbuf = kmem_alloc(MAXPATHLEN, KM_SLEEP);
954 	retval = copyinstr(path, pathbuf, MAXPATHLEN, &pathsz);
955 	if (retval != 0) {
956 		kmem_free(pathbuf, MAXPATHLEN);
957 		return (retval);
958 	}
959 	devpath = i_ddi_strdup(pathbuf, KM_SLEEP);
960 	kmem_free(pathbuf, MAXPATHLEN);
961 
962 	/*
963 	 * We check if a device is retired (first) before
964 	 * unpersisting the retire, because we use the
965 	 * retire store to determine if a device is retired.
966 	 * If we unpersist first, the device will always appear
967 	 * to be unretired. For the rationale behind unpersisting
968 	 * a device that is not retired, see the next comment.
969 	 */
970 	retired = e_ddi_device_retired(devpath);
971 
972 	/*
973 	 * We call unpersist unconditionally because the lookup
974 	 * for retired devices (e_ddi_device_retired()), skips "bypassed"
975 	 * devices. We still want to be able remove "bypassed" entries
976 	 * from the persistent store, so we unpersist unconditionally
977 	 * i.e. whether or not the entry is found on a lookup.
978 	 *
979 	 * e_ddi_retire_unpersist() returns 1 if it found and cleared
980 	 * an entry from the retire store or 0 otherwise.
981 	 */
982 	if (e_ddi_retire_unpersist(devpath))
983 		if (moddebug & MODDEBUG_RETIRE) {
984 			cmn_err(CE_NOTE, "Unpersisted retire of device: %s",
985 			    devpath);
986 		}
987 
988 	/*
989 	 * Check if the device is already unretired. If so,
990 	 * the unretire becomes a NOP
991 	 */
992 	if (!retired) {
993 		cmn_err(CE_NOTE, "Not retired: %s", devpath);
994 		kmem_free(devpath, strlen(devpath) + 1);
995 		return (0);
996 	}
997 
998 	retval = e_ddi_unretire_device(devpath);
999 	if (retval != 0) {
1000 		cmn_err(CE_WARN, "cannot unretire device: error %d, path %s\n",
1001 		    retval, devpath);
1002 	}
1003 
1004 	kmem_free(devpath, strlen(devpath) + 1);
1005 
1006 	return (retval);
1007 }
1008 
1009 static int
1010 modctl_getname(char *uname, uint_t ulen, int *umajorp)
1011 {
1012 	char *name;
1013 	major_t major;
1014 
1015 	if (copyin(umajorp, &major, sizeof (major)) != 0)
1016 		return (EFAULT);
1017 	if ((name = mod_major_to_name(major)) == NULL)
1018 		return (ENODEV);
1019 	if ((strlen(name) + 1) > ulen)
1020 		return (ENOSPC);
1021 	return (copyoutstr(name, uname, ulen, NULL));
1022 }
1023 
1024 static int
1025 modctl_devt2instance(dev_t dev, int *uinstancep)
1026 {
1027 	int	instance;
1028 
1029 	if ((instance = dev_to_instance(dev)) == -1)
1030 		return (EINVAL);
1031 
1032 	return (copyout(&instance, uinstancep, sizeof (int)));
1033 }
1034 
1035 /*
1036  * Return the sizeof of the device id.
1037  */
1038 static int
1039 modctl_sizeof_devid(dev_t dev, uint_t *len)
1040 {
1041 	uint_t		sz;
1042 	ddi_devid_t	devid;
1043 
1044 	/* get device id */
1045 	if (ddi_lyr_get_devid(dev, &devid) == DDI_FAILURE)
1046 		return (EINVAL);
1047 
1048 	sz = ddi_devid_sizeof(devid);
1049 	ddi_devid_free(devid);
1050 
1051 	/* copyout device id size */
1052 	if (copyout(&sz, len, sizeof (sz)) != 0)
1053 		return (EFAULT);
1054 
1055 	return (0);
1056 }
1057 
1058 /*
1059  * Return a copy of the device id.
1060  */
1061 static int
1062 modctl_get_devid(dev_t dev, uint_t len, ddi_devid_t udevid)
1063 {
1064 	uint_t		sz;
1065 	ddi_devid_t	devid;
1066 	int		err = 0;
1067 
1068 	/* get device id */
1069 	if (ddi_lyr_get_devid(dev, &devid) == DDI_FAILURE)
1070 		return (EINVAL);
1071 
1072 	sz = ddi_devid_sizeof(devid);
1073 
1074 	/* Error if device id is larger than space allocated */
1075 	if (sz > len) {
1076 		ddi_devid_free(devid);
1077 		return (ENOSPC);
1078 	}
1079 
1080 	/* copy out device id */
1081 	if (copyout(devid, udevid, sz) != 0)
1082 		err = EFAULT;
1083 	ddi_devid_free(devid);
1084 	return (err);
1085 }
1086 
1087 /*
1088  * return the /devices paths associated with the specified devid and
1089  * minor name.
1090  */
1091 /*ARGSUSED*/
1092 static int
1093 modctl_devid2paths(ddi_devid_t udevid, char *uminor_name, uint_t flag,
1094 	size_t *ulensp, char *upaths)
1095 {
1096 	ddi_devid_t	devid = NULL;
1097 	int		devid_len;
1098 	char		*minor_name = NULL;
1099 	dev_info_t	*dip = NULL;
1100 	int		circ;
1101 	struct ddi_minor_data   *dmdp;
1102 	char		*path = NULL;
1103 	int		ulens;
1104 	int		lens;
1105 	int		len;
1106 	dev_t		*devlist = NULL;
1107 	int		ndevs;
1108 	int		i;
1109 	int		ret = 0;
1110 
1111 	/*
1112 	 * If upaths is NULL then we are only computing the amount of space
1113 	 * needed to hold the paths and returning the value in *ulensp. If we
1114 	 * are copying out paths then we get the amount of space allocated by
1115 	 * the caller. If the actual space needed for paths is larger, or
1116 	 * things are changing out from under us, then we return EAGAIN.
1117 	 */
1118 	if (upaths) {
1119 		if (ulensp == NULL)
1120 			return (EINVAL);
1121 		if (copyin(ulensp, &ulens, sizeof (ulens)) != 0)
1122 			return (EFAULT);
1123 	}
1124 
1125 	/*
1126 	 * copyin enough of the devid to determine the length then
1127 	 * reallocate and copy in the entire devid.
1128 	 */
1129 	devid_len = ddi_devid_sizeof(NULL);
1130 	devid = kmem_alloc(devid_len, KM_SLEEP);
1131 	if (copyin(udevid, devid, devid_len)) {
1132 		ret = EFAULT;
1133 		goto out;
1134 	}
1135 	len = devid_len;
1136 	devid_len = ddi_devid_sizeof(devid);
1137 	kmem_free(devid, len);
1138 	devid = kmem_alloc(devid_len, KM_SLEEP);
1139 	if (copyin(udevid, devid, devid_len)) {
1140 		ret = EFAULT;
1141 		goto out;
1142 	}
1143 
1144 	/* copyin the minor name if specified. */
1145 	minor_name = uminor_name;
1146 	if ((minor_name != DEVID_MINOR_NAME_ALL) &&
1147 	    (minor_name != DEVID_MINOR_NAME_ALL_CHR) &&
1148 	    (minor_name != DEVID_MINOR_NAME_ALL_BLK)) {
1149 		minor_name = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1150 		if (copyinstr(uminor_name, minor_name, MAXPATHLEN, 0)) {
1151 			ret = EFAULT;
1152 			goto out;
1153 		}
1154 	}
1155 
1156 	/*
1157 	 * Use existing function to resolve the devid into a devlist.
1158 	 *
1159 	 * NOTE: there is a loss of spectype information in the current
1160 	 * ddi_lyr_devid_to_devlist implementation. We work around this by not
1161 	 * passing down DEVID_MINOR_NAME_ALL here, but reproducing all minor
1162 	 * node forms in the loop processing the devlist below. It would be
1163 	 * best if at some point the use of this interface here was replaced
1164 	 * with a path oriented call.
1165 	 */
1166 	if (ddi_lyr_devid_to_devlist(devid,
1167 	    (minor_name == DEVID_MINOR_NAME_ALL) ?
1168 	    DEVID_MINOR_NAME_ALL_CHR : minor_name,
1169 	    &ndevs, &devlist) != DDI_SUCCESS) {
1170 		ret = EINVAL;
1171 		goto out;
1172 	}
1173 
1174 	/*
1175 	 * loop over the devlist, converting each devt to a path and doing
1176 	 * a copyout of the path and computation of the amount of space
1177 	 * needed to hold all the paths
1178 	 */
1179 	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1180 	for (i = 0, lens = 0; i < ndevs; i++) {
1181 
1182 		/* find the dip associated with the dev_t */
1183 		if ((dip = e_ddi_hold_devi_by_dev(devlist[i], 0)) == NULL)
1184 			continue;
1185 
1186 		/* loop over all the minor nodes, skipping ones we don't want */
1187 		ndi_devi_enter(dip, &circ);
1188 		for (dmdp = DEVI(dip)->devi_minor; dmdp; dmdp = dmdp->next) {
1189 			if ((dmdp->ddm_dev != devlist[i]) ||
1190 			    (dmdp->type != DDM_MINOR))
1191 				continue;
1192 
1193 			if ((minor_name != DEVID_MINOR_NAME_ALL) &&
1194 			    (minor_name != DEVID_MINOR_NAME_ALL_CHR) &&
1195 			    (minor_name != DEVID_MINOR_NAME_ALL_BLK) &&
1196 			    strcmp(minor_name, dmdp->ddm_name))
1197 				continue;
1198 			else {
1199 				if ((minor_name == DEVID_MINOR_NAME_ALL_CHR) &&
1200 				    (dmdp->ddm_spec_type != S_IFCHR))
1201 					continue;
1202 				if ((minor_name == DEVID_MINOR_NAME_ALL_BLK) &&
1203 				    (dmdp->ddm_spec_type != S_IFBLK))
1204 					continue;
1205 			}
1206 
1207 			(void) ddi_pathname_minor(dmdp, path);
1208 			len = strlen(path) + 1;
1209 			*(path + len) = '\0';	/* set double termination */
1210 			lens += len;
1211 
1212 			/* copyout the path with double terminations */
1213 			if (upaths) {
1214 				if (lens > ulens) {
1215 					ret = EAGAIN;
1216 					goto out;
1217 				}
1218 				if (copyout(path, upaths, len + 1)) {
1219 					ret = EFAULT;
1220 					goto out;
1221 				}
1222 				upaths += len;
1223 			}
1224 		}
1225 		ndi_devi_exit(dip, circ);
1226 		ddi_release_devi(dip);
1227 		dip = NULL;
1228 	}
1229 	lens++;		/* add one for double termination */
1230 
1231 	/* copy out the amount of space needed to hold the paths */
1232 	if (ulensp && copyout(&lens, ulensp, sizeof (lens))) {
1233 		ret = EFAULT;
1234 		goto out;
1235 	}
1236 	ret = 0;
1237 
1238 out:	if (dip) {
1239 		ndi_devi_exit(dip, circ);
1240 		ddi_release_devi(dip);
1241 	}
1242 	if (path)
1243 		kmem_free(path, MAXPATHLEN);
1244 	if (devlist)
1245 		ddi_lyr_free_devlist(devlist, ndevs);
1246 	if (minor_name &&
1247 	    (minor_name != DEVID_MINOR_NAME_ALL) &&
1248 	    (minor_name != DEVID_MINOR_NAME_ALL_CHR) &&
1249 	    (minor_name != DEVID_MINOR_NAME_ALL_BLK))
1250 		kmem_free(minor_name, MAXPATHLEN);
1251 	if (devid)
1252 		kmem_free(devid, devid_len);
1253 	return (ret);
1254 }
1255 
1256 /*
1257  * Return the size of the minor name.
1258  */
1259 static int
1260 modctl_sizeof_minorname(dev_t dev, int spectype, uint_t *len)
1261 {
1262 	uint_t	sz;
1263 	char	*name;
1264 
1265 	/* get the minor name */
1266 	if (ddi_lyr_get_minor_name(dev, spectype, &name) == DDI_FAILURE)
1267 		return (EINVAL);
1268 
1269 	sz = strlen(name) + 1;
1270 	kmem_free(name, sz);
1271 
1272 	/* copy out the size of the minor name */
1273 	if (copyout(&sz, len, sizeof (sz)) != 0)
1274 		return (EFAULT);
1275 
1276 	return (0);
1277 }
1278 
1279 /*
1280  * Return the minor name.
1281  */
1282 static int
1283 modctl_get_minorname(dev_t dev, int spectype, uint_t len, char *uname)
1284 {
1285 	uint_t	sz;
1286 	char	*name;
1287 	int	err = 0;
1288 
1289 	/* get the minor name */
1290 	if (ddi_lyr_get_minor_name(dev, spectype, &name) == DDI_FAILURE)
1291 		return (EINVAL);
1292 
1293 	sz = strlen(name) + 1;
1294 
1295 	/* Error if the minor name is larger than the space allocated */
1296 	if (sz > len) {
1297 		kmem_free(name, sz);
1298 		return (ENOSPC);
1299 	}
1300 
1301 	/* copy out the minor name */
1302 	if (copyout(name, uname, sz) != 0)
1303 		err = EFAULT;
1304 	kmem_free(name, sz);
1305 	return (err);
1306 }
1307 
1308 /*
1309  * Return the size of the (dev_t,spectype) devfspath name.
1310  */
1311 static int
1312 modctl_devfspath_len(dev_t dev, int spectype, uint_t *len)
1313 {
1314 	uint_t	sz;
1315 	char	*name;
1316 
1317 	/* get the path name */
1318 	name = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1319 	if (ddi_dev_pathname(dev, spectype, name) == DDI_FAILURE) {
1320 		kmem_free(name, MAXPATHLEN);
1321 		return (EINVAL);
1322 	}
1323 
1324 	sz = strlen(name) + 1;
1325 	kmem_free(name, MAXPATHLEN);
1326 
1327 	/* copy out the size of the path name */
1328 	if (copyout(&sz, len, sizeof (sz)) != 0)
1329 		return (EFAULT);
1330 
1331 	return (0);
1332 }
1333 
1334 /*
1335  * Return the (dev_t,spectype) devfspath name.
1336  */
1337 static int
1338 modctl_devfspath(dev_t dev, int spectype, uint_t len, char *uname)
1339 {
1340 	uint_t	sz;
1341 	char	*name;
1342 	int	err = 0;
1343 
1344 	/* get the path name */
1345 	name = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1346 	if (ddi_dev_pathname(dev, spectype, name) == DDI_FAILURE) {
1347 		kmem_free(name, MAXPATHLEN);
1348 		return (EINVAL);
1349 	}
1350 
1351 	sz = strlen(name) + 1;
1352 
1353 	/* Error if the path name is larger than the space allocated */
1354 	if (sz > len) {
1355 		kmem_free(name, MAXPATHLEN);
1356 		return (ENOSPC);
1357 	}
1358 
1359 	/* copy out the path name */
1360 	if (copyout(name, uname, sz) != 0)
1361 		err = EFAULT;
1362 	kmem_free(name, MAXPATHLEN);
1363 	return (err);
1364 }
1365 
1366 /*
1367  * Return the size of the (major,instance) devfspath name.
1368  */
1369 static int
1370 modctl_devfspath_mi_len(major_t major, int instance, uint_t *len)
1371 {
1372 	uint_t	sz;
1373 	char	*name;
1374 
1375 	/* get the path name */
1376 	name = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1377 	if (e_ddi_majorinstance_to_path(major, instance, name) != DDI_SUCCESS) {
1378 		kmem_free(name, MAXPATHLEN);
1379 		return (EINVAL);
1380 	}
1381 
1382 	sz = strlen(name) + 1;
1383 	kmem_free(name, MAXPATHLEN);
1384 
1385 	/* copy out the size of the path name */
1386 	if (copyout(&sz, len, sizeof (sz)) != 0)
1387 		return (EFAULT);
1388 
1389 	return (0);
1390 }
1391 
1392 /*
1393  * Return the (major_instance) devfspath name.
1394  * NOTE: e_ddi_majorinstance_to_path does not require the device to attach to
1395  * return a path - it uses the instance tree.
1396  */
1397 static int
1398 modctl_devfspath_mi(major_t major, int instance, uint_t len, char *uname)
1399 {
1400 	uint_t	sz;
1401 	char	*name;
1402 	int	err = 0;
1403 
1404 	/* get the path name */
1405 	name = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1406 	if (e_ddi_majorinstance_to_path(major, instance, name) != DDI_SUCCESS) {
1407 		kmem_free(name, MAXPATHLEN);
1408 		return (EINVAL);
1409 	}
1410 
1411 	sz = strlen(name) + 1;
1412 
1413 	/* Error if the path name is larger than the space allocated */
1414 	if (sz > len) {
1415 		kmem_free(name, MAXPATHLEN);
1416 		return (ENOSPC);
1417 	}
1418 
1419 	/* copy out the path name */
1420 	if (copyout(name, uname, sz) != 0)
1421 		err = EFAULT;
1422 	kmem_free(name, MAXPATHLEN);
1423 	return (err);
1424 }
1425 
1426 static int
1427 modctl_get_fbname(char *path)
1428 {
1429 	extern dev_t fbdev;
1430 	char *pathname = NULL;
1431 	int rval = 0;
1432 
1433 	/* make sure fbdev is set before we plunge in */
1434 	if (fbdev == NODEV)
1435 		return (ENODEV);
1436 
1437 	pathname = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1438 	if ((rval = ddi_dev_pathname(fbdev, S_IFCHR,
1439 	    pathname)) == DDI_SUCCESS) {
1440 		if (copyout(pathname, path, strlen(pathname)+1) != 0) {
1441 			rval = EFAULT;
1442 		}
1443 	}
1444 	kmem_free(pathname, MAXPATHLEN);
1445 	return (rval);
1446 }
1447 
1448 /*
1449  * modctl_reread_dacf()
1450  *	Reread the dacf rules database from the named binding file.
1451  *	If NULL is specified, pass along the NULL, it means 'use the default'.
1452  */
1453 static int
1454 modctl_reread_dacf(char *path)
1455 {
1456 	int rval = 0;
1457 	char *filename, *filenamep;
1458 
1459 	filename = kmem_zalloc(MAXPATHLEN, KM_SLEEP);
1460 
1461 	if (path == NULL) {
1462 		filenamep = NULL;
1463 	} else {
1464 		if (copyinstr(path, filename, MAXPATHLEN, 0) != 0) {
1465 			rval = EFAULT;
1466 			goto out;
1467 		}
1468 		filenamep = filename;
1469 		filenamep[MAXPATHLEN - 1] = '\0';
1470 	}
1471 
1472 	rval = read_dacf_binding_file(filenamep);
1473 out:
1474 	kmem_free(filename, MAXPATHLEN);
1475 	return (rval);
1476 }
1477 
1478 /*ARGSUSED*/
1479 static int
1480 modctl_modevents(int subcmd, uintptr_t a2, uintptr_t a3, uintptr_t a4,
1481     uint_t flag)
1482 {
1483 	int error = 0;
1484 	char *filenamep;
1485 
1486 	switch (subcmd) {
1487 
1488 	case MODEVENTS_FLUSH:
1489 		/* flush all currently queued events */
1490 		log_sysevent_flushq(subcmd, flag);
1491 		break;
1492 
1493 	case MODEVENTS_SET_DOOR_UPCALL_FILENAME:
1494 		/*
1495 		 * bind door_upcall to filename
1496 		 * this should only be done once per invocation
1497 		 * of the event daemon.
1498 		 */
1499 
1500 		filenamep = kmem_zalloc(MOD_MAXPATH, KM_SLEEP);
1501 
1502 		if (copyinstr((char *)a2, filenamep, MOD_MAXPATH, 0)) {
1503 			error = EFAULT;
1504 		} else {
1505 			error = log_sysevent_filename(filenamep);
1506 		}
1507 		kmem_free(filenamep, MOD_MAXPATH);
1508 		break;
1509 
1510 	case MODEVENTS_GETDATA:
1511 		error = log_sysevent_copyout_data((sysevent_id_t *)a2,
1512 		    (size_t)a3, (caddr_t)a4);
1513 		break;
1514 
1515 	case MODEVENTS_FREEDATA:
1516 		error = log_sysevent_free_data((sysevent_id_t *)a2);
1517 		break;
1518 	case MODEVENTS_POST_EVENT:
1519 		error = log_usr_sysevent((sysevent_t *)a2, (uint32_t)a3,
1520 		    (sysevent_id_t *)a4);
1521 		break;
1522 	case MODEVENTS_REGISTER_EVENT:
1523 		error = log_sysevent_register((char *)a2, (char *)a3,
1524 		    (se_pubsub_t *)a4);
1525 		break;
1526 	default:
1527 		error = EINVAL;
1528 	}
1529 
1530 	return (error);
1531 }
1532 
1533 static void
1534 free_mperm(mperm_t *mp)
1535 {
1536 	int len;
1537 
1538 	if (mp->mp_minorname) {
1539 		len = strlen(mp->mp_minorname) + 1;
1540 		kmem_free(mp->mp_minorname, len);
1541 	}
1542 	kmem_free(mp, sizeof (mperm_t));
1543 }
1544 
1545 #define	MP_NO_DRV_ERR	\
1546 	"/etc/minor_perm: no driver for %s\n"
1547 
1548 #define	MP_EMPTY_MINOR	\
1549 	"/etc/minor_perm: empty minor name for driver %s\n"
1550 
1551 #define	MP_NO_MINOR	\
1552 	"/etc/minor_perm: no minor matching %s for driver %s\n"
1553 
1554 /*
1555  * Remove mperm entry with matching minorname
1556  */
1557 static void
1558 rem_minorperm(major_t major, char *drvname, mperm_t *mp, int is_clone)
1559 {
1560 	mperm_t **mp_head;
1561 	mperm_t *freemp = NULL;
1562 	struct devnames *dnp = &devnamesp[major];
1563 	mperm_t **wildmp;
1564 
1565 	ASSERT(mp->mp_minorname && strlen(mp->mp_minorname) > 0);
1566 
1567 	LOCK_DEV_OPS(&dnp->dn_lock);
1568 	if (strcmp(mp->mp_minorname, "*") == 0) {
1569 		wildmp = ((is_clone == 0) ?
1570 		    &dnp->dn_mperm_wild : &dnp->dn_mperm_clone);
1571 		if (*wildmp)
1572 			freemp = *wildmp;
1573 		*wildmp = NULL;
1574 	} else {
1575 		mp_head = &dnp->dn_mperm;
1576 		while (*mp_head) {
1577 			if (strcmp((*mp_head)->mp_minorname,
1578 			    mp->mp_minorname) != 0) {
1579 				mp_head = &(*mp_head)->mp_next;
1580 				continue;
1581 			}
1582 			/* remove the entry */
1583 			freemp = *mp_head;
1584 			*mp_head = freemp->mp_next;
1585 			break;
1586 		}
1587 	}
1588 	if (freemp) {
1589 		if (moddebug & MODDEBUG_MINORPERM) {
1590 			cmn_err(CE_CONT, "< %s %s 0%o %d %d\n",
1591 			    drvname, freemp->mp_minorname,
1592 			    freemp->mp_mode & 0777,
1593 			    freemp->mp_uid, freemp->mp_gid);
1594 		}
1595 		free_mperm(freemp);
1596 	} else {
1597 		if (moddebug & MODDEBUG_MINORPERM) {
1598 			cmn_err(CE_CONT, MP_NO_MINOR,
1599 			    drvname, mp->mp_minorname);
1600 		}
1601 	}
1602 
1603 	UNLOCK_DEV_OPS(&dnp->dn_lock);
1604 }
1605 
1606 /*
1607  * Add minor perm entry
1608  */
1609 static void
1610 add_minorperm(major_t major, char *drvname, mperm_t *mp, int is_clone)
1611 {
1612 	mperm_t **mp_head;
1613 	mperm_t *freemp = NULL;
1614 	struct devnames *dnp = &devnamesp[major];
1615 	mperm_t **wildmp;
1616 
1617 	ASSERT(mp->mp_minorname && strlen(mp->mp_minorname) > 0);
1618 
1619 	/*
1620 	 * Note that update_drv replace semantics require
1621 	 * replacing matching entries with the new permissions.
1622 	 */
1623 	LOCK_DEV_OPS(&dnp->dn_lock);
1624 	if (strcmp(mp->mp_minorname, "*") == 0) {
1625 		wildmp = ((is_clone == 0) ?
1626 		    &dnp->dn_mperm_wild : &dnp->dn_mperm_clone);
1627 		if (*wildmp)
1628 			freemp = *wildmp;
1629 		*wildmp = mp;
1630 	} else {
1631 		mperm_t *p, *v = NULL;
1632 		for (p = dnp->dn_mperm; p; v = p, p = p->mp_next) {
1633 			if (strcmp(p->mp_minorname, mp->mp_minorname) == 0) {
1634 				if (v == NULL)
1635 					dnp->dn_mperm = mp;
1636 				else
1637 					v->mp_next = mp;
1638 				mp->mp_next = p->mp_next;
1639 				freemp = p;
1640 				goto replaced;
1641 			}
1642 		}
1643 		if (p == NULL) {
1644 			mp_head = &dnp->dn_mperm;
1645 			if (*mp_head == NULL) {
1646 				*mp_head = mp;
1647 			} else {
1648 				mp->mp_next = *mp_head;
1649 				*mp_head = mp;
1650 			}
1651 		}
1652 	}
1653 replaced:
1654 	if (freemp) {
1655 		if (moddebug & MODDEBUG_MINORPERM) {
1656 			cmn_err(CE_CONT, "< %s %s 0%o %d %d\n",
1657 			    drvname, freemp->mp_minorname,
1658 			    freemp->mp_mode & 0777,
1659 			    freemp->mp_uid, freemp->mp_gid);
1660 		}
1661 		free_mperm(freemp);
1662 	}
1663 	if (moddebug & MODDEBUG_MINORPERM) {
1664 		cmn_err(CE_CONT, "> %s %s 0%o %d %d\n",
1665 		    drvname, mp->mp_minorname, mp->mp_mode & 0777,
1666 		    mp->mp_uid, mp->mp_gid);
1667 	}
1668 	UNLOCK_DEV_OPS(&dnp->dn_lock);
1669 }
1670 
1671 
1672 static int
1673 process_minorperm(int cmd, nvlist_t *nvl)
1674 {
1675 	char *minor;
1676 	major_t major;
1677 	mperm_t *mp;
1678 	nvpair_t *nvp;
1679 	char *name;
1680 	int is_clone;
1681 	major_t minmaj;
1682 
1683 	ASSERT(cmd == MODLOADMINORPERM ||
1684 	    cmd == MODADDMINORPERM || cmd == MODREMMINORPERM);
1685 
1686 	nvp = NULL;
1687 	while ((nvp = nvlist_next_nvpair(nvl, nvp)) != NULL) {
1688 		name = nvpair_name(nvp);
1689 
1690 		is_clone = 0;
1691 		(void) nvpair_value_string(nvp, &minor);
1692 		major = ddi_name_to_major(name);
1693 		if (major != DDI_MAJOR_T_NONE) {
1694 			mp = kmem_zalloc(sizeof (*mp), KM_SLEEP);
1695 			if (minor == NULL || strlen(minor) == 0) {
1696 				if (moddebug & MODDEBUG_MINORPERM) {
1697 					cmn_err(CE_CONT, MP_EMPTY_MINOR, name);
1698 				}
1699 				minor = "*";
1700 			}
1701 
1702 			/*
1703 			 * The minor name of a node using the clone
1704 			 * driver must be the driver name.  To avoid
1705 			 * multiple searches, we map entries in the form
1706 			 * clone:<driver> to <driver>:*.  This also allows us
1707 			 * to filter out some of the litter in /etc/minor_perm.
1708 			 * Minor perm alias entries where the name is not
1709 			 * the driver kept on the clone list itself.
1710 			 * This all seems very fragile as a driver could
1711 			 * be introduced with an existing alias name.
1712 			 */
1713 			if (strcmp(name, "clone") == 0) {
1714 				minmaj = ddi_name_to_major(minor);
1715 				if (minmaj != DDI_MAJOR_T_NONE) {
1716 					if (moddebug & MODDEBUG_MINORPERM) {
1717 						cmn_err(CE_CONT,
1718 						    "mapping %s:%s to %s:*\n",
1719 						    name, minor, minor);
1720 					}
1721 					major = minmaj;
1722 					name = minor;
1723 					minor = "*";
1724 					is_clone = 1;
1725 				}
1726 			}
1727 
1728 			if (mp) {
1729 				mp->mp_minorname =
1730 				    i_ddi_strdup(minor, KM_SLEEP);
1731 			}
1732 		} else {
1733 			mp = NULL;
1734 			if (moddebug & MODDEBUG_MINORPERM) {
1735 				cmn_err(CE_CONT, MP_NO_DRV_ERR, name);
1736 			}
1737 		}
1738 
1739 		/* mode */
1740 		nvp = nvlist_next_nvpair(nvl, nvp);
1741 		ASSERT(strcmp(nvpair_name(nvp), "mode") == 0);
1742 		if (mp)
1743 			(void) nvpair_value_int32(nvp, (int *)&mp->mp_mode);
1744 		/* uid */
1745 		nvp = nvlist_next_nvpair(nvl, nvp);
1746 		ASSERT(strcmp(nvpair_name(nvp), "uid") == 0);
1747 		if (mp)
1748 			(void) nvpair_value_uint32(nvp, &mp->mp_uid);
1749 		/* gid */
1750 		nvp = nvlist_next_nvpair(nvl, nvp);
1751 		ASSERT(strcmp(nvpair_name(nvp), "gid") == 0);
1752 		if (mp) {
1753 			(void) nvpair_value_uint32(nvp, &mp->mp_gid);
1754 
1755 			if (cmd == MODREMMINORPERM) {
1756 				rem_minorperm(major, name, mp, is_clone);
1757 				free_mperm(mp);
1758 			} else {
1759 				add_minorperm(major, name, mp, is_clone);
1760 			}
1761 		}
1762 	}
1763 
1764 	if (cmd == MODLOADMINORPERM)
1765 		minorperm_loaded = 1;
1766 
1767 	/*
1768 	 * Reset permissions of cached dv_nodes
1769 	 */
1770 	(void) devfs_reset_perm(DV_RESET_PERM);
1771 
1772 	return (0);
1773 }
1774 
1775 static int
1776 modctl_minorperm(int cmd, char *usrbuf, size_t buflen)
1777 {
1778 	int error;
1779 	nvlist_t *nvl;
1780 	char *buf = kmem_alloc(buflen, KM_SLEEP);
1781 
1782 	if ((error = ddi_copyin(usrbuf, buf, buflen, 0)) != 0) {
1783 		kmem_free(buf, buflen);
1784 		return (error);
1785 	}
1786 
1787 	error = nvlist_unpack(buf, buflen, &nvl, KM_SLEEP);
1788 	kmem_free(buf, buflen);
1789 	if (error)
1790 		return (error);
1791 
1792 	error = process_minorperm(cmd, nvl);
1793 	nvlist_free(nvl);
1794 	return (error);
1795 }
1796 
1797 struct walk_args {
1798 	char		*wa_drvname;
1799 	list_t		wa_pathlist;
1800 };
1801 
1802 struct path_elem {
1803 	char		*pe_dir;
1804 	char		*pe_nodename;
1805 	list_node_t	pe_node;
1806 	int		pe_dirlen;
1807 };
1808 
1809 /*ARGSUSED*/
1810 static int
1811 modctl_inst_walker(const char *path, in_node_t *np, in_drv_t *dp, void *arg)
1812 {
1813 	struct walk_args *wargs = (struct walk_args *)arg;
1814 	struct path_elem *pe;
1815 	char *nodename;
1816 
1817 	/*
1818 	 * Search may be restricted to a single driver in the case of rem_drv
1819 	 */
1820 	if (wargs->wa_drvname &&
1821 	    strcmp(dp->ind_driver_name, wargs->wa_drvname) != 0)
1822 		return (INST_WALK_CONTINUE);
1823 
1824 	pe = kmem_zalloc(sizeof (*pe), KM_SLEEP);
1825 	pe->pe_dir = i_ddi_strdup((char *)path, KM_SLEEP);
1826 	pe->pe_dirlen = strlen(pe->pe_dir) + 1;
1827 	ASSERT(strrchr(pe->pe_dir, '/') != NULL);
1828 	nodename = strrchr(pe->pe_dir, '/');
1829 	*nodename++ = 0;
1830 	pe->pe_nodename = nodename;
1831 	list_insert_tail(&wargs->wa_pathlist, pe);
1832 
1833 	return (INST_WALK_CONTINUE);
1834 }
1835 
1836 /*
1837  * /devices attribute nodes clean-up optionally performed
1838  * when removing a driver (rem_drv -C).
1839  *
1840  * Removing attribute nodes allows a machine to be reprovisioned
1841  * without the side-effect of inadvertently picking up stale
1842  * device node ownership or permissions.
1843  *
1844  * Preserving attributes (not performing cleanup) allows devices
1845  * attribute changes to be preserved across upgrades, as
1846  * upgrade rather heavy-handedly does a rem_drv/add_drv cycle.
1847  */
1848 static int
1849 modctl_remdrv_cleanup(const char *u_drvname)
1850 {
1851 	struct walk_args *wargs;
1852 	struct path_elem *pe;
1853 	char *drvname;
1854 	int err, rval = 0;
1855 
1856 	drvname = kmem_alloc(MAXMODCONFNAME, KM_SLEEP);
1857 	if ((err = copyinstr(u_drvname, drvname, MAXMODCONFNAME, 0))) {
1858 		kmem_free(drvname, MAXMODCONFNAME);
1859 		return (err);
1860 	}
1861 
1862 	/*
1863 	 * First go through the instance database.  For each
1864 	 * instance of a device bound to the driver being
1865 	 * removed, remove any underlying devfs attribute nodes.
1866 	 *
1867 	 * This is a two-step process.  First we go through
1868 	 * the instance data itself, constructing a list of
1869 	 * the nodes discovered.  The second step is then
1870 	 * to find and remove any devfs attribute nodes
1871 	 * for the instances discovered in the first step.
1872 	 * The two-step process avoids any difficulties
1873 	 * which could arise by holding the instance data
1874 	 * lock with simultaneous devfs operations.
1875 	 */
1876 	wargs = kmem_zalloc(sizeof (*wargs), KM_SLEEP);
1877 
1878 	wargs->wa_drvname = drvname;
1879 	list_create(&wargs->wa_pathlist,
1880 	    sizeof (struct path_elem), offsetof(struct path_elem, pe_node));
1881 
1882 	(void) e_ddi_walk_instances(modctl_inst_walker, (void *)wargs);
1883 
1884 	for (pe = list_head(&wargs->wa_pathlist); pe != NULL;
1885 	    pe = list_next(&wargs->wa_pathlist, pe)) {
1886 		err = devfs_remdrv_cleanup((const char *)pe->pe_dir,
1887 		    (const char *)pe->pe_nodename);
1888 		if (rval == 0)
1889 			rval = err;
1890 	}
1891 
1892 	while ((pe = list_head(&wargs->wa_pathlist)) != NULL) {
1893 		list_remove(&wargs->wa_pathlist, pe);
1894 		kmem_free(pe->pe_dir, pe->pe_dirlen);
1895 		kmem_free(pe, sizeof (*pe));
1896 	}
1897 	kmem_free(wargs, sizeof (*wargs));
1898 
1899 	/*
1900 	 * Pseudo nodes aren't recorded in the instance database
1901 	 * so any such nodes need to be handled separately.
1902 	 */
1903 	err = devfs_remdrv_cleanup("pseudo", (const char *)drvname);
1904 	if (rval == 0)
1905 		rval = err;
1906 
1907 	kmem_free(drvname, MAXMODCONFNAME);
1908 	return (rval);
1909 }
1910 
1911 /*
1912  * Perform a cleanup of non-existent /devices attribute nodes,
1913  * similar to rem_drv -C, but for all drivers/devices.
1914  * This is also optional, performed as part of devfsadm -C.
1915  */
1916 void
1917 dev_devices_cleanup()
1918 {
1919 	struct walk_args *wargs;
1920 	struct path_elem *pe;
1921 	dev_info_t *devi;
1922 	char *path;
1923 	int err;
1924 
1925 	/*
1926 	 * It's expected that all drivers have been loaded and
1927 	 * module unloading disabled while performing cleanup.
1928 	 */
1929 	ASSERT(modunload_disable_count > 0);
1930 
1931 	wargs = kmem_zalloc(sizeof (*wargs), KM_SLEEP);
1932 	wargs->wa_drvname = NULL;
1933 	list_create(&wargs->wa_pathlist,
1934 	    sizeof (struct path_elem), offsetof(struct path_elem, pe_node));
1935 
1936 	(void) e_ddi_walk_instances(modctl_inst_walker, (void *)wargs);
1937 
1938 	path = kmem_alloc(MAXPATHLEN, KM_SLEEP);
1939 
1940 	for (pe = list_head(&wargs->wa_pathlist); pe != NULL;
1941 	    pe = list_next(&wargs->wa_pathlist, pe)) {
1942 		(void) snprintf(path, MAXPATHLEN, "%s/%s",
1943 		    pe->pe_dir, pe->pe_nodename);
1944 		devi = e_ddi_hold_devi_by_path(path, 0);
1945 		if (devi != NULL) {
1946 			ddi_release_devi(devi);
1947 		} else {
1948 			err = devfs_remdrv_cleanup((const char *)pe->pe_dir,
1949 			    (const char *)pe->pe_nodename);
1950 			if (err) {
1951 				cmn_err(CE_CONT,
1952 				    "devfs: %s: clean-up error %d\n",
1953 				    path, err);
1954 			}
1955 		}
1956 	}
1957 
1958 	while ((pe = list_head(&wargs->wa_pathlist)) != NULL) {
1959 		list_remove(&wargs->wa_pathlist, pe);
1960 		kmem_free(pe->pe_dir, pe->pe_dirlen);
1961 		kmem_free(pe, sizeof (*pe));
1962 	}
1963 	kmem_free(wargs, sizeof (*wargs));
1964 	kmem_free(path, MAXPATHLEN);
1965 }
1966 
1967 static int
1968 modctl_allocpriv(const char *name)
1969 {
1970 	char *pstr = kmem_alloc(PRIVNAME_MAX, KM_SLEEP);
1971 	int error;
1972 
1973 	if ((error = copyinstr(name, pstr, PRIVNAME_MAX, 0))) {
1974 		kmem_free(pstr, PRIVNAME_MAX);
1975 		return (error);
1976 	}
1977 	error = priv_getbyname(pstr, PRIV_ALLOC);
1978 	if (error < 0)
1979 		error = -error;
1980 	else
1981 		error = 0;
1982 	kmem_free(pstr, PRIVNAME_MAX);
1983 	return (error);
1984 }
1985 
1986 static int
1987 modctl_devexists(const char *upath, int pathlen)
1988 {
1989 	char	*path;
1990 	int	ret;
1991 
1992 	/*
1993 	 * copy in the path, including the terminating null
1994 	 */
1995 	pathlen++;
1996 	if (pathlen <= 1 || pathlen > MAXPATHLEN)
1997 		return (EINVAL);
1998 	path = kmem_zalloc(pathlen + 1, KM_SLEEP);
1999 	if ((ret = copyinstr(upath, path, pathlen, NULL)) == 0) {
2000 		ret = sdev_modctl_devexists(path);
2001 	}
2002 
2003 	kmem_free(path, pathlen + 1);
2004 	return (ret);
2005 }
2006 
2007 static int
2008 modctl_devreaddir(const char *udir, int udirlen,
2009     char *upaths, int64_t *ulensp)
2010 {
2011 	char	*paths = NULL;
2012 	char	**dirlist = NULL;
2013 	char	*dir;
2014 	int64_t	ulens;
2015 	int64_t	lens;
2016 	int	i, n;
2017 	int	ret = 0;
2018 	char	*p;
2019 	int	npaths;
2020 	int	npaths_alloc;
2021 
2022 	/*
2023 	 * If upaths is NULL then we are only computing the amount of space
2024 	 * needed to return the paths, with the value returned in *ulensp. If we
2025 	 * are copying out paths then we get the amount of space allocated by
2026 	 * the caller. If the actual space needed for paths is larger, or
2027 	 * things are changing out from under us, then we return EAGAIN.
2028 	 */
2029 	if (upaths) {
2030 		if (ulensp == NULL)
2031 			return (EINVAL);
2032 		if (copyin(ulensp, &ulens, sizeof (ulens)) != 0)
2033 			return (EFAULT);
2034 	}
2035 
2036 	/*
2037 	 * copyin the /dev path including terminating null
2038 	 */
2039 	udirlen++;
2040 	if (udirlen <= 1 || udirlen > MAXPATHLEN)
2041 		return (EINVAL);
2042 	dir = kmem_zalloc(udirlen + 1, KM_SLEEP);
2043 	if ((ret = copyinstr(udir, dir, udirlen, NULL)) != 0)
2044 		goto err;
2045 
2046 	if ((ret = sdev_modctl_readdir(dir, &dirlist,
2047 	    &npaths, &npaths_alloc, 0)) != 0) {
2048 		ASSERT(dirlist == NULL);
2049 		goto err;
2050 	}
2051 
2052 	lens = 0;
2053 	for (i = 0; i < npaths; i++) {
2054 		lens += strlen(dirlist[i]) + 1;
2055 	}
2056 	lens++;		/* add one for double termination */
2057 
2058 	if (upaths) {
2059 		if (lens > ulens) {
2060 			ret = EAGAIN;
2061 			goto out;
2062 		}
2063 
2064 		paths = kmem_alloc(lens, KM_SLEEP);
2065 
2066 		p = paths;
2067 		for (i = 0; i < npaths; i++) {
2068 			n = strlen(dirlist[i]) + 1;
2069 			bcopy(dirlist[i], p, n);
2070 			p += n;
2071 		}
2072 		*p = 0;
2073 
2074 		if (copyout(paths, upaths, lens)) {
2075 			ret = EFAULT;
2076 			goto err;
2077 		}
2078 	}
2079 
2080 out:
2081 	/* copy out the amount of space needed to hold the paths */
2082 	if (copyout(&lens, ulensp, sizeof (lens)))
2083 		ret = EFAULT;
2084 
2085 err:
2086 	if (dirlist)
2087 		sdev_modctl_readdir_free(dirlist, npaths, npaths_alloc);
2088 	if (paths)
2089 		kmem_free(paths, lens);
2090 	kmem_free(dir, udirlen + 1);
2091 	return (ret);
2092 }
2093 
2094 static int
2095 modctl_devemptydir(const char *udir, int udirlen, int *uempty)
2096 {
2097 	char	*dir;
2098 	int	ret;
2099 	char	**dirlist = NULL;
2100 	int	npaths;
2101 	int	npaths_alloc;
2102 	int	empty;
2103 
2104 	/*
2105 	 * copyin the /dev path including terminating null
2106 	 */
2107 	udirlen++;
2108 	if (udirlen <= 1 || udirlen > MAXPATHLEN)
2109 		return (EINVAL);
2110 	dir = kmem_zalloc(udirlen + 1, KM_SLEEP);
2111 	if ((ret = copyinstr(udir, dir, udirlen, NULL)) != 0)
2112 		goto err;
2113 
2114 	if ((ret = sdev_modctl_readdir(dir, &dirlist,
2115 	    &npaths, &npaths_alloc, 1)) != 0) {
2116 		goto err;
2117 	}
2118 
2119 	empty = npaths ? 0 : 1;
2120 	if (copyout(&empty, uempty, sizeof (empty)))
2121 		ret = EFAULT;
2122 
2123 err:
2124 	if (dirlist)
2125 		sdev_modctl_readdir_free(dirlist, npaths, npaths_alloc);
2126 	kmem_free(dir, udirlen + 1);
2127 	return (ret);
2128 }
2129 
2130 int
2131 modctl_moddevname(int subcmd, uintptr_t a1, uintptr_t a2)
2132 {
2133 	int error = 0;
2134 
2135 	switch (subcmd) {
2136 	case MODDEVNAME_LOOKUPDOOR:
2137 	case MODDEVNAME_DEVFSADMNODE:
2138 		error = devname_filename_register(subcmd, (char *)a1);
2139 		break;
2140 	case MODDEVNAME_NSMAPS:
2141 		error = devname_nsmaps_register((char *)a1, (size_t)a2);
2142 		break;
2143 	case MODDEVNAME_PROFILE:
2144 		error = devname_profile_update((char *)a1, (size_t)a2);
2145 		break;
2146 	case MODDEVNAME_RECONFIG:
2147 		i_ddi_set_reconfig();
2148 		break;
2149 	case MODDEVNAME_SYSAVAIL:
2150 		i_ddi_set_sysavail();
2151 		break;
2152 	default:
2153 		error = EINVAL;
2154 		break;
2155 	}
2156 
2157 	return (error);
2158 }
2159 
2160 /*ARGSUSED5*/
2161 int
2162 modctl(int cmd, uintptr_t a1, uintptr_t a2, uintptr_t a3, uintptr_t a4,
2163     uintptr_t a5)
2164 {
2165 	int	error = EINVAL;
2166 	dev_t	dev;
2167 
2168 	if (secpolicy_modctl(CRED(), cmd) != 0)
2169 		return (set_errno(EPERM));
2170 
2171 	switch (cmd) {
2172 	case MODLOAD:		/* load a module */
2173 		error = modctl_modload((int)a1, (char *)a2, (int *)a3);
2174 		break;
2175 
2176 	case MODUNLOAD:		/* unload a module */
2177 		error = modctl_modunload((modid_t)a1);
2178 		break;
2179 
2180 	case MODINFO:		/* get module status */
2181 		error = modctl_modinfo((modid_t)a1, (struct modinfo *)a2);
2182 		break;
2183 
2184 	case MODRESERVED:	/* get last major number in range */
2185 		error = modctl_modreserve((modid_t)a1, (int *)a2);
2186 		break;
2187 
2188 	case MODSETMINIROOT:	/* we are running in miniroot */
2189 		isminiroot = 1;
2190 		error = 0;
2191 		break;
2192 
2193 	case MODADDMAJBIND:	/* read major binding file */
2194 		error = modctl_add_major((int *)a2);
2195 		break;
2196 
2197 	case MODGETPATHLEN:	/* get modpath length */
2198 		error = modctl_getmodpathlen((int *)a2);
2199 		break;
2200 
2201 	case MODGETPATH:	/* get modpath */
2202 		error = modctl_getmodpath((char *)a2);
2203 		break;
2204 
2205 	case MODREADSYSBIND:	/* read system call binding file */
2206 		error = modctl_read_sysbinding_file();
2207 		break;
2208 
2209 	case MODGETMAJBIND:	/* get major number for named device */
2210 		error = modctl_getmaj((char *)a1, (uint_t)a2, (int *)a3);
2211 		break;
2212 
2213 	case MODGETNAME:	/* get name of device given major number */
2214 		error = modctl_getname((char *)a1, (uint_t)a2, (int *)a3);
2215 		break;
2216 
2217 	case MODDEVT2INSTANCE:
2218 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2219 			dev = (dev_t)a1;
2220 		}
2221 #ifdef _SYSCALL32_IMPL
2222 		else {
2223 			dev = expldev(a1);
2224 		}
2225 #endif
2226 		error = modctl_devt2instance(dev, (int *)a2);
2227 		break;
2228 
2229 	case MODSIZEOF_DEVID:	/* sizeof device id of device given dev_t */
2230 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2231 			dev = (dev_t)a1;
2232 		}
2233 #ifdef _SYSCALL32_IMPL
2234 		else {
2235 			dev = expldev(a1);
2236 		}
2237 #endif
2238 		error = modctl_sizeof_devid(dev, (uint_t *)a2);
2239 		break;
2240 
2241 	case MODGETDEVID:	/* get device id of device given dev_t */
2242 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2243 			dev = (dev_t)a1;
2244 		}
2245 #ifdef _SYSCALL32_IMPL
2246 		else {
2247 			dev = expldev(a1);
2248 		}
2249 #endif
2250 		error = modctl_get_devid(dev, (uint_t)a2, (ddi_devid_t)a3);
2251 		break;
2252 
2253 	case MODSIZEOF_MINORNAME:	/* sizeof minor nm (dev_t,spectype) */
2254 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2255 			error = modctl_sizeof_minorname((dev_t)a1, (int)a2,
2256 			    (uint_t *)a3);
2257 		}
2258 #ifdef _SYSCALL32_IMPL
2259 		else {
2260 			error = modctl_sizeof_minorname(expldev(a1), (int)a2,
2261 			    (uint_t *)a3);
2262 		}
2263 
2264 #endif
2265 		break;
2266 
2267 	case MODGETMINORNAME:		/* get minor name of (dev_t,spectype) */
2268 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2269 			error = modctl_get_minorname((dev_t)a1, (int)a2,
2270 			    (uint_t)a3, (char *)a4);
2271 		}
2272 #ifdef _SYSCALL32_IMPL
2273 		else {
2274 			error = modctl_get_minorname(expldev(a1), (int)a2,
2275 			    (uint_t)a3, (char *)a4);
2276 		}
2277 #endif
2278 		break;
2279 
2280 	case MODGETDEVFSPATH_LEN:	/* sizeof path nm of (dev_t,spectype) */
2281 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2282 			error = modctl_devfspath_len((dev_t)a1, (int)a2,
2283 			    (uint_t *)a3);
2284 		}
2285 #ifdef _SYSCALL32_IMPL
2286 		else {
2287 			error = modctl_devfspath_len(expldev(a1), (int)a2,
2288 			    (uint_t *)a3);
2289 		}
2290 
2291 #endif
2292 		break;
2293 
2294 	case MODGETDEVFSPATH:   	/* get path name of (dev_t,spec) type */
2295 		if (get_udatamodel() == DATAMODEL_NATIVE) {
2296 			error = modctl_devfspath((dev_t)a1, (int)a2,
2297 			    (uint_t)a3, (char *)a4);
2298 		}
2299 #ifdef _SYSCALL32_IMPL
2300 		else {
2301 			error = modctl_devfspath(expldev(a1), (int)a2,
2302 			    (uint_t)a3, (char *)a4);
2303 		}
2304 #endif
2305 		break;
2306 
2307 	case MODGETDEVFSPATH_MI_LEN:	/* sizeof path nm of (major,instance) */
2308 		error = modctl_devfspath_mi_len((major_t)a1, (int)a2,
2309 		    (uint_t *)a3);
2310 		break;
2311 
2312 	case MODGETDEVFSPATH_MI:   	/* get path name of (major,instance) */
2313 		error = modctl_devfspath_mi((major_t)a1, (int)a2,
2314 		    (uint_t)a3, (char *)a4);
2315 		break;
2316 
2317 
2318 	case MODEVENTS:
2319 		error = modctl_modevents((int)a1, a2, a3, a4, (uint_t)a5);
2320 		break;
2321 
2322 	case MODGETFBNAME:	/* get the framebuffer name */
2323 		error = modctl_get_fbname((char *)a1);
2324 		break;
2325 
2326 	case MODREREADDACF:	/* reread dacf rule database from given file */
2327 		error = modctl_reread_dacf((char *)a1);
2328 		break;
2329 
2330 	case MODLOADDRVCONF:	/* load driver.conf file for major */
2331 		error = modctl_load_drvconf((major_t)a1);
2332 		break;
2333 
2334 	case MODUNLOADDRVCONF:	/* unload driver.conf file for major */
2335 		error = modctl_unload_drvconf((major_t)a1);
2336 		break;
2337 
2338 	case MODREMMAJBIND:	/* remove a major binding */
2339 		error = modctl_rem_major((major_t)a1);
2340 		break;
2341 
2342 	case MODDEVID2PATHS:	/* get paths given devid */
2343 		error = modctl_devid2paths((ddi_devid_t)a1, (char *)a2,
2344 		    (uint_t)a3, (size_t *)a4, (char *)a5);
2345 		break;
2346 
2347 	case MODSETDEVPOLICY:	/* establish device policy */
2348 		error = devpolicy_load((int)a1, (size_t)a2, (devplcysys_t *)a3);
2349 		break;
2350 
2351 	case MODGETDEVPOLICY:	/* get device policy */
2352 		error = devpolicy_get((int *)a1, (size_t)a2,
2353 		    (devplcysys_t *)a3);
2354 		break;
2355 
2356 	case MODALLOCPRIV:
2357 		error = modctl_allocpriv((const char *)a1);
2358 		break;
2359 
2360 	case MODGETDEVPOLICYBYNAME:
2361 		error = devpolicy_getbyname((size_t)a1,
2362 		    (devplcysys_t *)a2, (char *)a3);
2363 		break;
2364 
2365 	case MODLOADMINORPERM:
2366 	case MODADDMINORPERM:
2367 	case MODREMMINORPERM:
2368 		error = modctl_minorperm(cmd, (char *)a1, (size_t)a2);
2369 		break;
2370 
2371 	case MODREMDRVCLEANUP:
2372 		error = modctl_remdrv_cleanup((const char *)a1);
2373 		break;
2374 
2375 	case MODDEVEXISTS:	/* non-reconfiguring /dev lookup */
2376 		error = modctl_devexists((const char *)a1, (size_t)a2);
2377 		break;
2378 
2379 	case MODDEVREADDIR:	/* non-reconfiguring /dev readdir */
2380 		error = modctl_devreaddir((const char *)a1, (size_t)a2,
2381 		    (char *)a3, (int64_t *)a4);
2382 		break;
2383 
2384 	case MODDEVEMPTYDIR:	/* non-reconfiguring /dev emptydir */
2385 		error = modctl_devemptydir((const char *)a1, (size_t)a2,
2386 		    (int *)a3);
2387 		break;
2388 
2389 	case MODDEVNAME:
2390 		error = modctl_moddevname((int)a1, a2, a3);
2391 		break;
2392 
2393 	case MODRETIRE:	/* retire device named by physpath a1 */
2394 		error = modctl_retire((char *)a1, (char *)a2, (size_t)a3);
2395 		break;
2396 
2397 	case MODISRETIRED:  /* check if a device is retired. */
2398 		error = modctl_is_retired((char *)a1, (int *)a2);
2399 		break;
2400 
2401 	case MODUNRETIRE:	/* unretire device named by physpath a1 */
2402 		error = modctl_unretire((char *)a1);
2403 		break;
2404 
2405 	default:
2406 		error = EINVAL;
2407 		break;
2408 	}
2409 
2410 	return (error ? set_errno(error) : 0);
2411 }
2412 
2413 /*
2414  * Calls to kobj_load_module()() are handled off to this routine in a
2415  * separate thread.
2416  */
2417 static void
2418 modload_thread(struct loadmt *ltp)
2419 {
2420 	/* load the module and signal the creator of this thread */
2421 	kmutex_t	cpr_lk;
2422 	callb_cpr_t	cpr_i;
2423 
2424 	mutex_init(&cpr_lk, NULL, MUTEX_DEFAULT, NULL);
2425 	CALLB_CPR_INIT(&cpr_i, &cpr_lk, callb_generic_cpr, "modload");
2426 	/* borrow the devi lock from thread which invoked us */
2427 	pm_borrow_lock(ltp->owner);
2428 	ltp->retval = kobj_load_module(ltp->mp, ltp->usepath);
2429 	pm_return_lock();
2430 	sema_v(&ltp->sema);
2431 	mutex_enter(&cpr_lk);
2432 	CALLB_CPR_EXIT(&cpr_i);
2433 	mutex_destroy(&cpr_lk);
2434 	thread_exit();
2435 }
2436 
2437 /*
2438  * load a module, adding a reference if caller specifies rmodp.  If rmodp
2439  * is specified then an errno is returned, otherwise a module index is
2440  * returned (-1 on error).
2441  */
2442 static int
2443 modrload(const char *subdir, const char *filename, struct modctl **rmodp)
2444 {
2445 	struct modctl *modp;
2446 	size_t size;
2447 	char *fullname;
2448 	int retval = EINVAL;
2449 	int id = -1;
2450 
2451 	if (rmodp)
2452 		*rmodp = NULL;			/* avoid garbage */
2453 
2454 	if (subdir != NULL) {
2455 		/*
2456 		 * refuse / in filename to prevent "../" escapes.
2457 		 */
2458 		if (strchr(filename, '/') != NULL)
2459 			return (rmodp ? retval : id);
2460 
2461 		/*
2462 		 * allocate enough space for <subdir>/<filename><NULL>
2463 		 */
2464 		size = strlen(subdir) + strlen(filename) + 2;
2465 		fullname = kmem_zalloc(size, KM_SLEEP);
2466 		(void) sprintf(fullname, "%s/%s", subdir, filename);
2467 	} else {
2468 		fullname = (char *)filename;
2469 	}
2470 
2471 	modp = mod_hold_installed_mod(fullname, 1, 0, &retval);
2472 	if (modp != NULL) {
2473 		id = modp->mod_id;
2474 		if (rmodp) {
2475 			/* add mod_ref and return *rmodp */
2476 			mutex_enter(&mod_lock);
2477 			modp->mod_ref++;
2478 			mutex_exit(&mod_lock);
2479 			*rmodp = modp;
2480 		}
2481 		mod_release_mod(modp);
2482 		CPU_STATS_ADDQ(CPU, sys, modload, 1);
2483 	}
2484 
2485 done:	if (subdir != NULL)
2486 		kmem_free(fullname, size);
2487 	return (rmodp ? retval : id);
2488 }
2489 
2490 /*
2491  * This is the primary kernel interface to load a module. It loads and
2492  * installs the named module.  It does not hold mod_ref of the module, so
2493  * a module unload attempt can occur at any time - it is up to the
2494  * _fini/mod_remove implementation to determine if unload will succeed.
2495  */
2496 int
2497 modload(const char *subdir, const char *filename)
2498 {
2499 	return (modrload(subdir, filename, NULL));
2500 }
2501 
2502 /*
2503  * Load a module using a series of qualified names from most specific to least
2504  * specific, e.g. for subdir "foo", p1 "bar", p2 "baz", we might try:
2505  *			Value returned in *chosen
2506  * foo/bar.baz.1.2.3	3
2507  * foo/bar.baz.1.2	2
2508  * foo/bar.baz.1	1
2509  * foo/bar.baz		0
2510  *
2511  * Return the module ID on success; -1 if no module was loaded.  On success
2512  * and if 'chosen' is not NULL we also return the number of suffices that
2513  * were in the module we chose to load.
2514  */
2515 int
2516 modload_qualified(const char *subdir, const char *p1,
2517     const char *p2, const char *delim, uint_t suffv[], int suffc, int *chosen)
2518 {
2519 	char path[MOD_MAXPATH];
2520 	size_t n, resid = sizeof (path);
2521 	char *p = path;
2522 
2523 	char **dotv;
2524 	int i, rc, id;
2525 	modctl_t *mp;
2526 
2527 	if (p2 != NULL)
2528 		n = snprintf(p, resid, "%s/%s%s%s", subdir, p1, delim, p2);
2529 	else
2530 		n = snprintf(p, resid, "%s/%s", subdir, p1);
2531 
2532 	if (n >= resid)
2533 		return (-1);
2534 
2535 	p += n;
2536 	resid -= n;
2537 	dotv = kmem_alloc(sizeof (char *) * (suffc + 1), KM_SLEEP);
2538 
2539 	for (i = 0; i < suffc; i++) {
2540 		dotv[i] = p;
2541 		n = snprintf(p, resid, "%s%u", delim, suffv[i]);
2542 
2543 		if (n >= resid) {
2544 			kmem_free(dotv, sizeof (char *) * (suffc + 1));
2545 			return (-1);
2546 		}
2547 
2548 		p += n;
2549 		resid -= n;
2550 	}
2551 
2552 	dotv[suffc] = p;
2553 
2554 	for (i = suffc; i >= 0; i--) {
2555 		dotv[i][0] = '\0';
2556 		mp = mod_hold_installed_mod(path, 1, 1, &rc);
2557 
2558 		if (mp != NULL) {
2559 			kmem_free(dotv, sizeof (char *) * (suffc + 1));
2560 			id = mp->mod_id;
2561 			mod_release_mod(mp);
2562 			if (chosen != NULL)
2563 				*chosen = i;
2564 			return (id);
2565 		}
2566 	}
2567 
2568 	kmem_free(dotv, sizeof (char *) * (suffc + 1));
2569 	return (-1);
2570 }
2571 
2572 /*
2573  * Load a module.
2574  */
2575 int
2576 modloadonly(const char *subdir, const char *filename)
2577 {
2578 	struct modctl *modp;
2579 	char *fullname;
2580 	size_t size;
2581 	int id, retval;
2582 
2583 	if (subdir != NULL) {
2584 		/*
2585 		 * allocate enough space for <subdir>/<filename><NULL>
2586 		 */
2587 		size = strlen(subdir) + strlen(filename) + 2;
2588 		fullname = kmem_zalloc(size, KM_SLEEP);
2589 		(void) sprintf(fullname, "%s/%s", subdir, filename);
2590 	} else {
2591 		fullname = (char *)filename;
2592 	}
2593 
2594 	modp = mod_hold_loaded_mod(NULL, fullname, &retval);
2595 	if (modp) {
2596 		id = modp->mod_id;
2597 		mod_release_mod(modp);
2598 	}
2599 
2600 	if (subdir != NULL)
2601 		kmem_free(fullname, size);
2602 
2603 	if (retval == 0)
2604 		return (id);
2605 	return (-1);
2606 }
2607 
2608 /*
2609  * Try to uninstall and unload a module, removing a reference if caller
2610  * specifies rmodp.
2611  */
2612 static int
2613 modunrload(modid_t id, struct modctl **rmodp, int unload)
2614 {
2615 	struct modctl	*modp;
2616 	int		retval;
2617 
2618 	if (rmodp)
2619 		*rmodp = NULL;			/* avoid garbage */
2620 
2621 	if ((modp = mod_hold_by_id((modid_t)id)) == NULL)
2622 		return (EINVAL);
2623 
2624 	if (rmodp) {
2625 		mutex_enter(&mod_lock);
2626 		modp->mod_ref--;
2627 		mutex_exit(&mod_lock);
2628 		*rmodp = modp;
2629 	}
2630 
2631 	if (unload) {
2632 		retval = moduninstall(modp);
2633 		if (retval == 0) {
2634 			mod_unload(modp);
2635 			CPU_STATS_ADDQ(CPU, sys, modunload, 1);
2636 		} else if (retval == EALREADY)
2637 			retval = 0;	/* already unloaded, not an error */
2638 	} else
2639 		retval = 0;
2640 
2641 	mod_release_mod(modp);
2642 	return (retval);
2643 }
2644 
2645 /*
2646  * Uninstall and unload a module.
2647  */
2648 int
2649 modunload(modid_t id)
2650 {
2651 	int		retval;
2652 
2653 	/* synchronize with any active modunload_disable() */
2654 	modunload_begin();
2655 	if (ddi_root_node())
2656 		(void) devfs_clean(ddi_root_node(), NULL, 0);
2657 	retval = modunrload(id, NULL, 1);
2658 	modunload_end();
2659 	return (retval);
2660 }
2661 
2662 /*
2663  * Return status of a loaded module.
2664  */
2665 static int
2666 modinfo(modid_t id, struct modinfo *modinfop)
2667 {
2668 	struct modctl	*modp;
2669 	modid_t		mid;
2670 	int		i;
2671 
2672 	mid = modinfop->mi_id;
2673 	if (modinfop->mi_info & MI_INFO_ALL) {
2674 		while ((modp = mod_hold_next_by_id(mid++)) != NULL) {
2675 			if ((modinfop->mi_info & MI_INFO_CNT) ||
2676 			    modp->mod_installed)
2677 				break;
2678 			mod_release_mod(modp);
2679 		}
2680 		if (modp == NULL)
2681 			return (EINVAL);
2682 	} else {
2683 		modp = mod_hold_by_id(id);
2684 		if (modp == NULL)
2685 			return (EINVAL);
2686 		if (!(modinfop->mi_info & MI_INFO_CNT) &&
2687 		    (modp->mod_installed == 0)) {
2688 			mod_release_mod(modp);
2689 			return (EINVAL);
2690 		}
2691 	}
2692 
2693 	modinfop->mi_rev = 0;
2694 	modinfop->mi_state = 0;
2695 	for (i = 0; i < MODMAXLINK; i++) {
2696 		modinfop->mi_msinfo[i].msi_p0 = -1;
2697 		modinfop->mi_msinfo[i].msi_linkinfo[0] = 0;
2698 	}
2699 	if (modp->mod_loaded) {
2700 		modinfop->mi_state = MI_LOADED;
2701 		kobj_getmodinfo(modp->mod_mp, modinfop);
2702 	}
2703 	if (modp->mod_installed) {
2704 		modinfop->mi_state |= MI_INSTALLED;
2705 
2706 		(void) mod_getinfo(modp, modinfop);
2707 	}
2708 
2709 	modinfop->mi_id = modp->mod_id;
2710 	modinfop->mi_loadcnt = modp->mod_loadcnt;
2711 	(void) strcpy(modinfop->mi_name, modp->mod_modname);
2712 
2713 	mod_release_mod(modp);
2714 	return (0);
2715 }
2716 
2717 static char mod_stub_err[] = "mod_hold_stub: Couldn't load stub module %s";
2718 static char no_err[] = "No error function for weak stub %s";
2719 
2720 /*
2721  * used by the stubs themselves to load and hold a module.
2722  * Returns  0 if the module is successfully held;
2723  *	    the stub needs to call mod_release_stub().
2724  *	    -1 if the stub should just call the err_fcn.
2725  * Note that this code is stretched out so that we avoid subroutine calls
2726  * and optimize for the most likely case.  That is, the case where the
2727  * module is loaded and installed and not held.  In that case we just inc
2728  * the mod_ref count and continue.
2729  */
2730 int
2731 mod_hold_stub(struct mod_stub_info *stub)
2732 {
2733 	struct modctl *mp;
2734 	struct mod_modinfo *mip;
2735 
2736 	mip = stub->mods_modinfo;
2737 
2738 	mutex_enter(&mod_lock);
2739 
2740 	/* we do mod_hold_by_modctl inline for speed */
2741 
2742 mod_check_again:
2743 	if ((mp = mip->mp) != NULL) {
2744 		if (mp->mod_busy == 0) {
2745 			if (mp->mod_installed) {
2746 				/* increment the reference count */
2747 				mp->mod_ref++;
2748 				ASSERT(mp->mod_ref && mp->mod_installed);
2749 				mutex_exit(&mod_lock);
2750 				return (0);
2751 			} else {
2752 				mp->mod_busy = 1;
2753 				mp->mod_inprogress_thread =
2754 				    (curthread == NULL ?
2755 				    (kthread_id_t)-1 : curthread);
2756 			}
2757 		} else {
2758 			/*
2759 			 * wait one time and then go see if someone
2760 			 * else has resolved the stub (set mip->mp).
2761 			 */
2762 			if (mod_hold_by_modctl(mp,
2763 			    MOD_WAIT_ONCE | MOD_LOCK_HELD))
2764 				goto mod_check_again;
2765 
2766 			/*
2767 			 * what we have now may have been unloaded!, in
2768 			 * that case, mip->mp will be NULL, we'll hit this
2769 			 * module and load again..
2770 			 */
2771 			cmn_err(CE_PANIC, "mod_hold_stub should have blocked");
2772 		}
2773 		mutex_exit(&mod_lock);
2774 	} else {
2775 		/* first time we've hit this module */
2776 		mutex_exit(&mod_lock);
2777 		mp = mod_hold_by_name(mip->modm_module_name);
2778 		mip->mp = mp;
2779 	}
2780 
2781 	/*
2782 	 * If we are here, it means that the following conditions
2783 	 * are satisfied.
2784 	 *
2785 	 * mip->mp != NULL
2786 	 * this thread has set the mp->mod_busy = 1
2787 	 * mp->mod_installed = 0
2788 	 *
2789 	 */
2790 	ASSERT(mp != NULL);
2791 	ASSERT(mp->mod_busy == 1);
2792 
2793 	if (mp->mod_installed == 0) {
2794 		/* Module not loaded, if weak stub don't load it */
2795 		if (stub->mods_flag & MODS_WEAK) {
2796 			if (stub->mods_errfcn == NULL) {
2797 				mod_release_mod(mp);
2798 				cmn_err(CE_PANIC, no_err,
2799 				    mip->modm_module_name);
2800 			}
2801 		} else {
2802 			/* Not a weak stub so load the module */
2803 
2804 			if (mod_load(mp, 1) != 0 || modinstall(mp) != 0) {
2805 				/*
2806 				 * If mod_load() was successful
2807 				 * and modinstall() failed, then
2808 				 * unload the module.
2809 				 */
2810 				if (mp->mod_loaded)
2811 					mod_unload(mp);
2812 
2813 				mod_release_mod(mp);
2814 				if (stub->mods_errfcn == NULL) {
2815 					cmn_err(CE_PANIC, mod_stub_err,
2816 					    mip->modm_module_name);
2817 				} else {
2818 					return (-1);
2819 				}
2820 			}
2821 		}
2822 	}
2823 
2824 	/*
2825 	 * At this point module is held and loaded. Release
2826 	 * the mod_busy and mod_inprogress_thread before
2827 	 * returning. We actually call mod_release() here so
2828 	 * that if another stub wants to access this module,
2829 	 * it can do so. mod_ref is incremented before mod_release()
2830 	 * is called to prevent someone else from snatching the
2831 	 * module from this thread.
2832 	 */
2833 	mutex_enter(&mod_lock);
2834 	mp->mod_ref++;
2835 	ASSERT(mp->mod_ref &&
2836 	    (mp->mod_loaded || (stub->mods_flag & MODS_WEAK)));
2837 	mod_release(mp);
2838 	mutex_exit(&mod_lock);
2839 	return (0);
2840 }
2841 
2842 void
2843 mod_release_stub(struct mod_stub_info *stub)
2844 {
2845 	struct modctl *mp = stub->mods_modinfo->mp;
2846 
2847 	/* inline mod_release_mod */
2848 	mutex_enter(&mod_lock);
2849 	ASSERT(mp->mod_ref &&
2850 	    (mp->mod_loaded || (stub->mods_flag & MODS_WEAK)));
2851 	mp->mod_ref--;
2852 	if (mp->mod_want) {
2853 		mp->mod_want = 0;
2854 		cv_broadcast(&mod_cv);
2855 	}
2856 	mutex_exit(&mod_lock);
2857 }
2858 
2859 static struct modctl *
2860 mod_hold_loaded_mod(struct modctl *dep, char *filename, int *status)
2861 {
2862 	struct modctl *modp;
2863 	int retval;
2864 
2865 	/*
2866 	 * Hold the module.
2867 	 */
2868 	modp = mod_hold_by_name_requisite(dep, filename);
2869 	if (modp) {
2870 		retval = mod_load(modp, 1);
2871 		if (retval != 0) {
2872 			mod_release_mod(modp);
2873 			modp = NULL;
2874 		}
2875 		*status = retval;
2876 	} else {
2877 		*status = ENOSPC;
2878 	}
2879 
2880 	/*
2881 	 * if dep is not NULL, clear the module dependency information.
2882 	 * This information is set in mod_hold_by_name_common().
2883 	 */
2884 	if (dep != NULL && dep->mod_requisite_loading != NULL) {
2885 		ASSERT(dep->mod_busy);
2886 		dep->mod_requisite_loading = NULL;
2887 	}
2888 
2889 	return (modp);
2890 }
2891 
2892 /*
2893  * hold, load, and install the named module
2894  */
2895 static struct modctl *
2896 mod_hold_installed_mod(char *name, int usepath, int forcecheck, int *r)
2897 {
2898 	struct modctl *modp;
2899 	int retval;
2900 
2901 	/*
2902 	 * Verify that that module in question actually exists on disk
2903 	 * before allocation of module structure by mod_hold_by_name.
2904 	 */
2905 	if (modrootloaded && swaploaded || forcecheck) {
2906 		if (!kobj_path_exists(name, usepath)) {
2907 			*r = ENOENT;
2908 			return (NULL);
2909 		}
2910 	}
2911 
2912 	/*
2913 	 * Hold the module.
2914 	 */
2915 	modp = mod_hold_by_name(name);
2916 	if (modp) {
2917 		retval = mod_load(modp, usepath);
2918 		if (retval != 0) {
2919 			mod_release_mod(modp);
2920 			modp = NULL;
2921 			*r = retval;
2922 		} else {
2923 			if ((*r = modinstall(modp)) != 0) {
2924 				/*
2925 				 * We loaded it, but failed to _init() it.
2926 				 * Be kind to developers -- force it
2927 				 * out of memory now so that the next
2928 				 * attempt to use the module will cause
2929 				 * a reload.  See 1093793.
2930 				 */
2931 				mod_unload(modp);
2932 				mod_release_mod(modp);
2933 				modp = NULL;
2934 			}
2935 		}
2936 	} else {
2937 		*r = ENOSPC;
2938 	}
2939 	return (modp);
2940 }
2941 
2942 static char mod_excl_msg[] =
2943 	"module %s(%s) is EXCLUDED and will not be loaded\n";
2944 static char mod_init_msg[] = "loadmodule:%s(%s): _init() error %d\n";
2945 
2946 /*
2947  * This routine is needed for dependencies.  Users specify dependencies
2948  * by declaring a character array initialized to filenames of dependents.
2949  * So the code that handles dependents deals with filenames (and not
2950  * module names) because that's all it has.  We load by filename and once
2951  * we've loaded a file we can get the module name.
2952  * Unfortunately there isn't a single unified filename/modulename namespace.
2953  * C'est la vie.
2954  *
2955  * We allow the name being looked up to be prepended by an optional
2956  * subdirectory e.g. we can lookup (NULL, "fs/ufs") or ("fs", "ufs")
2957  */
2958 struct modctl *
2959 mod_find_by_filename(char *subdir, char *filename)
2960 {
2961 	struct modctl	*mp;
2962 	size_t		sublen;
2963 
2964 	ASSERT(!MUTEX_HELD(&mod_lock));
2965 	if (subdir != NULL)
2966 		sublen = strlen(subdir);
2967 	else
2968 		sublen = 0;
2969 
2970 	mutex_enter(&mod_lock);
2971 	mp = &modules;
2972 	do {
2973 		if (sublen) {
2974 			char *mod_filename = mp->mod_filename;
2975 
2976 			if (strncmp(subdir, mod_filename, sublen) == 0 &&
2977 			    mod_filename[sublen] == '/' &&
2978 			    strcmp(filename, &mod_filename[sublen + 1]) == 0) {
2979 				mutex_exit(&mod_lock);
2980 				return (mp);
2981 			}
2982 		} else if (strcmp(filename, mp->mod_filename) == 0) {
2983 			mutex_exit(&mod_lock);
2984 			return (mp);
2985 		}
2986 	} while ((mp = mp->mod_next) != &modules);
2987 	mutex_exit(&mod_lock);
2988 	return (NULL);
2989 }
2990 
2991 /*
2992  * Check for circular dependencies.  This is called from do_dependents()
2993  * in kobj.c.  If we are the thread already loading this module, then
2994  * we're trying to load a dependent that we're already loading which
2995  * means the user specified circular dependencies.
2996  */
2997 static int
2998 mod_circdep(struct modctl *modp)
2999 {
3000 	struct modctl	*rmod;
3001 
3002 	ASSERT(MUTEX_HELD(&mod_lock));
3003 
3004 	/*
3005 	 * Check the mod_inprogress_thread first.
3006 	 * mod_inprogress_thread is used in mod_hold_stub()
3007 	 * directly to improve performance.
3008 	 */
3009 	if (modp->mod_inprogress_thread == curthread)
3010 		return (1);
3011 
3012 	/*
3013 	 * Check the module circular dependencies.
3014 	 */
3015 	for (rmod = modp; rmod != NULL; rmod = rmod->mod_requisite_loading) {
3016 		/*
3017 		 * Check if there is a module circular dependency.
3018 		 */
3019 		if (rmod->mod_requisite_loading == modp)
3020 			return (1);
3021 	}
3022 	return (0);
3023 }
3024 
3025 static int
3026 mod_getinfo(struct modctl *modp, struct modinfo *modinfop)
3027 {
3028 	int (*func)(struct modinfo *);
3029 	int retval;
3030 
3031 	ASSERT(modp->mod_busy);
3032 
3033 	/* primary modules don't do getinfo */
3034 	if (modp->mod_prim)
3035 		return (0);
3036 
3037 	func = (int (*)(struct modinfo *))kobj_lookup(modp->mod_mp, "_info");
3038 
3039 	if (kobj_addrcheck(modp->mod_mp, (caddr_t)func)) {
3040 		cmn_err(CE_WARN, "_info() not defined properly in %s",
3041 		    modp->mod_filename);
3042 		/*
3043 		 * The semantics of mod_info(9F) are that 0 is failure
3044 		 * and non-zero is success.
3045 		 */
3046 		retval = 0;
3047 	} else
3048 		retval = (*func)(modinfop);	/* call _info() function */
3049 
3050 	if (moddebug & MODDEBUG_USERDEBUG)
3051 		printf("Returned from _info, retval = %x\n", retval);
3052 
3053 	return (retval);
3054 }
3055 
3056 static void
3057 modadd(struct modctl *mp)
3058 {
3059 	ASSERT(MUTEX_HELD(&mod_lock));
3060 
3061 	mp->mod_id = last_module_id++;
3062 	mp->mod_next = &modules;
3063 	mp->mod_prev = modules.mod_prev;
3064 	modules.mod_prev->mod_next = mp;
3065 	modules.mod_prev = mp;
3066 }
3067 
3068 /*ARGSUSED*/
3069 static struct modctl *
3070 allocate_modp(const char *filename, const char *modname)
3071 {
3072 	struct modctl *mp;
3073 
3074 	mp = kobj_zalloc(sizeof (*mp), KM_SLEEP);
3075 	mp->mod_modname = kobj_zalloc(strlen(modname) + 1, KM_SLEEP);
3076 	(void) strcpy(mp->mod_modname, modname);
3077 	return (mp);
3078 }
3079 
3080 /*
3081  * Get the value of a symbol.  This is a wrapper routine that
3082  * calls kobj_getsymvalue().  kobj_getsymvalue() may go away but this
3083  * wrapper will prevent callers from noticing.
3084  */
3085 uintptr_t
3086 modgetsymvalue(char *name, int kernelonly)
3087 {
3088 	return (kobj_getsymvalue(name, kernelonly));
3089 }
3090 
3091 /*
3092  * Get the symbol nearest an address.  This is a wrapper routine that
3093  * calls kobj_getsymname().  kobj_getsymname() may go away but this
3094  * wrapper will prevent callers from noticing.
3095  */
3096 char *
3097 modgetsymname(uintptr_t value, ulong_t *offset)
3098 {
3099 	return (kobj_getsymname(value, offset));
3100 }
3101 
3102 /*
3103  * Lookup a symbol in a specified module.  These are wrapper routines that
3104  * call kobj_lookup().  kobj_lookup() may go away but these wrappers will
3105  * prevent callers from noticing.
3106  */
3107 uintptr_t
3108 modlookup(const char *modname, const char *symname)
3109 {
3110 	struct modctl *modp;
3111 	uintptr_t val;
3112 
3113 	if ((modp = mod_hold_by_name(modname)) == NULL)
3114 		return (0);
3115 	val = kobj_lookup(modp->mod_mp, symname);
3116 	mod_release_mod(modp);
3117 	return (val);
3118 }
3119 
3120 uintptr_t
3121 modlookup_by_modctl(modctl_t *modp, const char *symname)
3122 {
3123 	ASSERT(modp->mod_ref > 0 || modp->mod_busy);
3124 
3125 	return (kobj_lookup(modp->mod_mp, symname));
3126 }
3127 
3128 /*
3129  * Ask the user for the name of the system file and the default path
3130  * for modules.
3131  */
3132 void
3133 mod_askparams()
3134 {
3135 	static char s0[64];
3136 	intptr_t fd;
3137 
3138 	if ((fd = kobj_open(systemfile)) != -1L)
3139 		kobj_close(fd);
3140 	else
3141 		systemfile = NULL;
3142 
3143 	/*CONSTANTCONDITION*/
3144 	while (1) {
3145 		printf("Name of system file [%s]:  ",
3146 		    systemfile ? systemfile : "/dev/null");
3147 
3148 		console_gets(s0, sizeof (s0));
3149 
3150 		if (s0[0] == '\0')
3151 			break;
3152 		else if (strcmp(s0, "/dev/null") == 0) {
3153 			systemfile = NULL;
3154 			break;
3155 		} else {
3156 			if ((fd = kobj_open(s0)) != -1L) {
3157 				kobj_close(fd);
3158 				systemfile = s0;
3159 				break;
3160 			}
3161 		}
3162 		printf("can't find file %s\n", s0);
3163 	}
3164 }
3165 
3166 static char loading_msg[] = "loading '%s' id %d\n";
3167 static char load_msg[] = "load '%s' id %d loaded @ 0x%p/0x%p size %d/%d\n";
3168 
3169 /*
3170  * Common code for loading a module (but not installing it).
3171  * Handoff the task of module loading to a separate thread
3172  * with a large stack if possible, since this code may recurse a few times.
3173  * Return zero if there are no errors or an errno value.
3174  */
3175 static int
3176 mod_load(struct modctl *mp, int usepath)
3177 {
3178 	int		retval;
3179 	struct modinfo	*modinfop = NULL;
3180 	struct loadmt	lt;
3181 
3182 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3183 	ASSERT(mp->mod_busy);
3184 
3185 	if (mp->mod_loaded)
3186 		return (0);
3187 
3188 	if (mod_sysctl(SYS_CHECK_EXCLUDE, mp->mod_modname) != 0 ||
3189 	    mod_sysctl(SYS_CHECK_EXCLUDE, mp->mod_filename) != 0) {
3190 		if (moddebug & MODDEBUG_LOADMSG) {
3191 			printf(mod_excl_msg, mp->mod_filename,
3192 			    mp->mod_modname);
3193 		}
3194 		return (ENXIO);
3195 	}
3196 	if (moddebug & MODDEBUG_LOADMSG2)
3197 		printf(loading_msg, mp->mod_filename, mp->mod_id);
3198 
3199 	if (curthread != &t0) {
3200 		lt.mp = mp;
3201 		lt.usepath = usepath;
3202 		lt.owner = curthread;
3203 		sema_init(&lt.sema, 0, NULL, SEMA_DEFAULT, NULL);
3204 
3205 		/* create thread to hand of call to */
3206 		(void) thread_create(NULL, DEFAULTSTKSZ * 2,
3207 		    modload_thread, &lt, 0, &p0, TS_RUN, maxclsyspri);
3208 
3209 		/* wait for thread to complete kobj_load_module */
3210 		sema_p(&lt.sema);
3211 
3212 		sema_destroy(&lt.sema);
3213 		retval = lt.retval;
3214 	} else
3215 		retval = kobj_load_module(mp, usepath);
3216 
3217 	if (mp->mod_mp) {
3218 		ASSERT(retval == 0);
3219 		mp->mod_loaded = 1;
3220 		mp->mod_loadcnt++;
3221 		if (moddebug & MODDEBUG_LOADMSG) {
3222 			printf(load_msg, mp->mod_filename, mp->mod_id,
3223 			    (void *)((struct module *)mp->mod_mp)->text,
3224 			    (void *)((struct module *)mp->mod_mp)->data,
3225 			    ((struct module *)mp->mod_mp)->text_size,
3226 			    ((struct module *)mp->mod_mp)->data_size);
3227 		}
3228 
3229 		/*
3230 		 * XXX - There should be a better way to get this.
3231 		 */
3232 		modinfop = kmem_zalloc(sizeof (struct modinfo), KM_SLEEP);
3233 		modinfop->mi_info = MI_INFO_LINKAGE;
3234 		if (mod_getinfo(mp, modinfop) == 0)
3235 			mp->mod_linkage = NULL;
3236 		else {
3237 			mp->mod_linkage = (void *)modinfop->mi_base;
3238 			ASSERT(mp->mod_linkage->ml_rev == MODREV_1);
3239 		}
3240 
3241 		/*
3242 		 * DCS: bootstrapping code. If the driver is loaded
3243 		 * before root mount, it is assumed that the driver
3244 		 * may be used before mounting root. In order to
3245 		 * access mappings of global to local minor no.'s
3246 		 * during installation/open of the driver, we load
3247 		 * them into memory here while the BOP_interfaces
3248 		 * are still up.
3249 		 */
3250 		if ((cluster_bootflags & CLUSTER_BOOTED) && !modrootloaded) {
3251 			retval = clboot_modload(mp);
3252 		}
3253 
3254 		kmem_free(modinfop, sizeof (struct modinfo));
3255 		(void) mod_sysctl(SYS_SET_MVAR, (void *)mp);
3256 		retval = install_stubs_by_name(mp, mp->mod_modname);
3257 
3258 		/*
3259 		 * Now that the module is loaded, we need to give DTrace
3260 		 * a chance to notify its providers.  This is done via
3261 		 * the dtrace_modload function pointer.
3262 		 */
3263 		if (strcmp(mp->mod_modname, "dtrace") != 0) {
3264 			struct modctl *dmp = mod_hold_by_name("dtrace");
3265 
3266 			if (dmp != NULL && dtrace_modload != NULL)
3267 				(*dtrace_modload)(mp);
3268 
3269 			mod_release_mod(dmp);
3270 		}
3271 
3272 	} else {
3273 		/*
3274 		 * If load failed then we need to release any requisites
3275 		 * that we had established.
3276 		 */
3277 		ASSERT(retval);
3278 		mod_release_requisites(mp);
3279 
3280 		if (moddebug & MODDEBUG_ERRMSG)
3281 			printf("error loading '%s', error %d\n",
3282 			    mp->mod_filename, retval);
3283 	}
3284 	return (retval);
3285 }
3286 
3287 static char unload_msg[] = "unloading %s, module id %d, loadcnt %d.\n";
3288 
3289 static void
3290 mod_unload(struct modctl *mp)
3291 {
3292 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3293 	ASSERT(mp->mod_busy);
3294 	ASSERT((mp->mod_loaded && (mp->mod_installed == 0)) &&
3295 	    ((mp->mod_prim == 0) && (mp->mod_ref >= 0)));
3296 
3297 	if (moddebug & MODDEBUG_LOADMSG)
3298 		printf(unload_msg, mp->mod_modname,
3299 		    mp->mod_id, mp->mod_loadcnt);
3300 
3301 	/*
3302 	 * If mod_ref is not zero, it means some modules might still refer
3303 	 * to this module. Then you can't unload this module right now.
3304 	 * Instead, set 1 to mod_delay_unload to notify the system of
3305 	 * unloading this module later when it's not required any more.
3306 	 */
3307 	if (mp->mod_ref > 0) {
3308 		mp->mod_delay_unload = 1;
3309 		if (moddebug & MODDEBUG_LOADMSG2) {
3310 			printf("module %s not unloaded,"
3311 			    " non-zero reference count (%d)",
3312 			    mp->mod_modname, mp->mod_ref);
3313 		}
3314 		return;
3315 	}
3316 
3317 	if (((mp->mod_loaded == 0) || mp->mod_installed) ||
3318 	    (mp->mod_ref || mp->mod_prim)) {
3319 		/*
3320 		 * A DEBUG kernel would ASSERT panic above, the code is broken
3321 		 * if we get this warning.
3322 		 */
3323 		cmn_err(CE_WARN, "mod_unload: %s in incorrect state: %d %d %d",
3324 		    mp->mod_filename, mp->mod_installed, mp->mod_loaded,
3325 		    mp->mod_ref);
3326 		return;
3327 	}
3328 
3329 	/* reset stub functions to call the binder again */
3330 	reset_stubs(mp);
3331 
3332 	/*
3333 	 * mark module as unloaded before the modctl structure is freed.
3334 	 * This is required not to reuse the modctl structure before
3335 	 * the module is marked as unloaded.
3336 	 */
3337 	mp->mod_loaded = 0;
3338 	mp->mod_linkage = NULL;
3339 
3340 	/* free the memory */
3341 	kobj_unload_module(mp);
3342 
3343 	if (mp->mod_delay_unload) {
3344 		mp->mod_delay_unload = 0;
3345 		if (moddebug & MODDEBUG_LOADMSG2) {
3346 			printf("deferred unload of module %s"
3347 			    " (id %d) successful",
3348 			    mp->mod_modname, mp->mod_id);
3349 		}
3350 	}
3351 
3352 	/* release hold on requisites */
3353 	mod_release_requisites(mp);
3354 
3355 	/*
3356 	 * Now that the module is gone, we need to give DTrace a chance to
3357 	 * remove any probes that it may have had in the module.  This is
3358 	 * done via the dtrace_modunload function pointer.
3359 	 */
3360 	if (strcmp(mp->mod_modname, "dtrace") != 0) {
3361 		struct modctl *dmp = mod_hold_by_name("dtrace");
3362 
3363 		if (dmp != NULL && dtrace_modunload != NULL)
3364 			(*dtrace_modunload)(mp);
3365 
3366 		mod_release_mod(dmp);
3367 	}
3368 }
3369 
3370 static int
3371 modinstall(struct modctl *mp)
3372 {
3373 	int val;
3374 	int (*func)(void);
3375 
3376 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3377 	ASSERT(mp->mod_busy && mp->mod_loaded);
3378 
3379 	if (mp->mod_installed)
3380 		return (0);
3381 	/*
3382 	 * If mod_delay_unload is on, it means the system chose the deferred
3383 	 * unload for this module. Then you can't install this module until
3384 	 * it's unloaded from the system.
3385 	 */
3386 	if (mp->mod_delay_unload)
3387 		return (ENXIO);
3388 
3389 	if (moddebug & MODDEBUG_LOADMSG)
3390 		printf("installing %s, module id %d.\n",
3391 		    mp->mod_modname, mp->mod_id);
3392 
3393 	ASSERT(mp->mod_mp != NULL);
3394 	if (mod_install_requisites(mp) != 0) {
3395 		/*
3396 		 * Note that we can't call mod_unload(mp) here since
3397 		 * if modinstall() was called by mod_install_requisites(),
3398 		 * we won't be able to hold the dependent modules
3399 		 * (otherwise there would be a deadlock).
3400 		 */
3401 		return (ENXIO);
3402 	}
3403 
3404 	if (moddebug & MODDEBUG_ERRMSG) {
3405 		printf("init '%s' id %d loaded @ 0x%p/0x%p size %lu/%lu\n",
3406 		    mp->mod_filename, mp->mod_id,
3407 		    (void *)((struct module *)mp->mod_mp)->text,
3408 		    (void *)((struct module *)mp->mod_mp)->data,
3409 		    ((struct module *)mp->mod_mp)->text_size,
3410 		    ((struct module *)mp->mod_mp)->data_size);
3411 	}
3412 
3413 	func = (int (*)())kobj_lookup(mp->mod_mp, "_init");
3414 
3415 	if (kobj_addrcheck(mp->mod_mp, (caddr_t)func)) {
3416 		cmn_err(CE_WARN, "_init() not defined properly in %s",
3417 		    mp->mod_filename);
3418 		return (EFAULT);
3419 	}
3420 
3421 	if (moddebug & MODDEBUG_USERDEBUG) {
3422 		printf("breakpoint before calling %s:_init()\n",
3423 		    mp->mod_modname);
3424 		if (DEBUGGER_PRESENT)
3425 			debug_enter("_init");
3426 	}
3427 
3428 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3429 	ASSERT(mp->mod_busy && mp->mod_loaded);
3430 	val = (*func)();		/* call _init */
3431 
3432 	if (moddebug & MODDEBUG_USERDEBUG)
3433 		printf("Returned from _init, val = %x\n", val);
3434 
3435 	if (val == 0) {
3436 		/*
3437 		 * Set the MODS_INSTALLED flag to enable this module
3438 		 * being called now.
3439 		 */
3440 		install_stubs(mp);
3441 		mp->mod_installed = 1;
3442 	} else if (moddebug & MODDEBUG_ERRMSG)
3443 		printf(mod_init_msg, mp->mod_filename, mp->mod_modname, val);
3444 
3445 	return (val);
3446 }
3447 
3448 int	detach_driver_unconfig = 0;
3449 
3450 static int
3451 detach_driver(char *name)
3452 {
3453 	major_t major;
3454 	int error;
3455 
3456 	/*
3457 	 * If being called from mod_uninstall_all() then the appropriate
3458 	 * driver detaches (leaf only) have already been done.
3459 	 */
3460 	if (mod_in_autounload())
3461 		return (0);
3462 
3463 	major = ddi_name_to_major(name);
3464 	if (major == DDI_MAJOR_T_NONE)
3465 		return (0);
3466 
3467 	error = ndi_devi_unconfig_driver(ddi_root_node(),
3468 	    NDI_DETACH_DRIVER | detach_driver_unconfig, major);
3469 	return (error == NDI_SUCCESS ? 0 : -1);
3470 }
3471 
3472 static char finiret_msg[] = "Returned from _fini for %s, status = %x\n";
3473 
3474 static int
3475 moduninstall(struct modctl *mp)
3476 {
3477 	int status = 0;
3478 	int (*func)(void);
3479 
3480 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3481 	ASSERT(mp->mod_busy);
3482 
3483 	/*
3484 	 * Verify that we need to do something and can uninstall the module.
3485 	 *
3486 	 * If we should not uninstall the module or if the module is not in
3487 	 * the correct state to start an uninstall we return EBUSY to prevent
3488 	 * us from progressing to mod_unload.  If the module has already been
3489 	 * uninstalled and unloaded we return EALREADY.
3490 	 */
3491 	if (mp->mod_prim || mp->mod_ref || mp->mod_nenabled != 0)
3492 		return (EBUSY);
3493 	if ((mp->mod_installed == 0) || (mp->mod_loaded == 0))
3494 		return (EALREADY);
3495 
3496 	/*
3497 	 * To avoid devinfo / module deadlock we must release this module
3498 	 * prior to initiating the detach_driver, otherwise the detach_driver
3499 	 * might deadlock on a devinfo node held by another thread
3500 	 * coming top down and involving the module we have locked.
3501 	 *
3502 	 * When we regrab the module we must reverify that it is OK
3503 	 * to proceed with the uninstall operation.
3504 	 */
3505 	mod_release_mod(mp);
3506 	status = detach_driver(mp->mod_modname);
3507 	(void) mod_hold_by_modctl(mp, MOD_WAIT_FOREVER | MOD_LOCK_NOT_HELD);
3508 
3509 	/* check detach status and reverify state with lock */
3510 	mutex_enter(&mod_lock);
3511 	if ((status != 0) || mp->mod_prim || mp->mod_ref) {
3512 		mutex_exit(&mod_lock);
3513 		return (EBUSY);
3514 	}
3515 	if ((mp->mod_installed == 0) || (mp->mod_loaded == 0)) {
3516 		mutex_exit(&mod_lock);
3517 		return (EALREADY);
3518 	}
3519 	mutex_exit(&mod_lock);
3520 
3521 	if (moddebug & MODDEBUG_LOADMSG2)
3522 		printf("uninstalling %s\n", mp->mod_modname);
3523 
3524 	/*
3525 	 * lookup _fini, return EBUSY if not defined.
3526 	 *
3527 	 * The MODDEBUG_FINI_EBUSY is usefull in resolving leaks in
3528 	 * detach(9E) - it allows bufctl addresses to be resolved.
3529 	 */
3530 	func = (int (*)())kobj_lookup(mp->mod_mp, "_fini");
3531 	if ((func == NULL) || (mp->mod_loadflags & MOD_NOUNLOAD) ||
3532 	    (moddebug & MODDEBUG_FINI_EBUSY))
3533 		return (EBUSY);
3534 
3535 	/* verify that _fini is in this module */
3536 	if (kobj_addrcheck(mp->mod_mp, (caddr_t)func)) {
3537 		cmn_err(CE_WARN, "_fini() not defined properly in %s",
3538 		    mp->mod_filename);
3539 		return (EFAULT);
3540 	}
3541 
3542 	/* call _fini() */
3543 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
3544 	ASSERT(mp->mod_busy && mp->mod_loaded && mp->mod_installed);
3545 
3546 	status = (*func)();
3547 
3548 	if (status == 0) {
3549 		/* _fini returned success, the module is no longer installed */
3550 		if (moddebug & MODDEBUG_LOADMSG)
3551 			printf("uninstalled %s\n", mp->mod_modname);
3552 
3553 		/*
3554 		 * Even though we only set mod_installed to zero here, a zero
3555 		 * return value means we are committed to a code path were
3556 		 * mod_loaded will also end up as zero - we have no other
3557 		 * way to get the module data and bss back to the pre _init
3558 		 * state except a reload. To ensure this, after return,
3559 		 * mod_busy must stay set until mod_loaded is cleared.
3560 		 */
3561 		mp->mod_installed = 0;
3562 
3563 		/*
3564 		 * Clear the MODS_INSTALLED flag not to call functions
3565 		 * in the module directly from now on.
3566 		 */
3567 		uninstall_stubs(mp);
3568 	} else {
3569 		if (moddebug & MODDEBUG_USERDEBUG)
3570 			printf(finiret_msg, mp->mod_filename, status);
3571 		/*
3572 		 * By definition _fini is only allowed to return EBUSY or the
3573 		 * result of mod_remove (EBUSY or EINVAL).  In the off chance
3574 		 * that a driver returns EALREADY we convert this to EINVAL
3575 		 * since to our caller EALREADY means module was already
3576 		 * removed.
3577 		 */
3578 		if (status == EALREADY)
3579 			status = EINVAL;
3580 	}
3581 
3582 	return (status);
3583 }
3584 
3585 /*
3586  * Uninstall all modules.
3587  */
3588 static void
3589 mod_uninstall_all(void)
3590 {
3591 	struct modctl	*mp;
3592 	modid_t		modid = 0;
3593 
3594 	/* synchronize with any active modunload_disable() */
3595 	modunload_begin();
3596 
3597 	/* mark this thread as doing autounloading */
3598 	(void) tsd_set(mod_autounload_key, (void *)1);
3599 
3600 	(void) devfs_clean(ddi_root_node(), NULL, 0);
3601 	(void) ndi_devi_unconfig(ddi_root_node(), NDI_AUTODETACH);
3602 
3603 	while ((mp = mod_hold_next_by_id(modid)) != NULL) {
3604 		modid = mp->mod_id;
3605 		/*
3606 		 * Skip modules with the MOD_NOAUTOUNLOAD flag set
3607 		 */
3608 		if (mp->mod_loadflags & MOD_NOAUTOUNLOAD) {
3609 			mod_release_mod(mp);
3610 			continue;
3611 		}
3612 
3613 		if (moduninstall(mp) == 0) {
3614 			mod_unload(mp);
3615 			CPU_STATS_ADDQ(CPU, sys, modunload, 1);
3616 		}
3617 		mod_release_mod(mp);
3618 	}
3619 
3620 	(void) tsd_set(mod_autounload_key, NULL);
3621 	modunload_end();
3622 }
3623 
3624 /* wait for unloads that have begun before registering disable */
3625 void
3626 modunload_disable(void)
3627 {
3628 	mutex_enter(&modunload_wait_mutex);
3629 	while (modunload_active_count) {
3630 		modunload_wait++;
3631 		cv_wait(&modunload_wait_cv, &modunload_wait_mutex);
3632 		modunload_wait--;
3633 	}
3634 	modunload_disable_count++;
3635 	mutex_exit(&modunload_wait_mutex);
3636 }
3637 
3638 /* mark end of disable and signal waiters */
3639 void
3640 modunload_enable(void)
3641 {
3642 	mutex_enter(&modunload_wait_mutex);
3643 	modunload_disable_count--;
3644 	if ((modunload_disable_count == 0) && modunload_wait)
3645 		cv_broadcast(&modunload_wait_cv);
3646 	mutex_exit(&modunload_wait_mutex);
3647 }
3648 
3649 /* wait for disables to complete before begining unload */
3650 void
3651 modunload_begin()
3652 {
3653 	mutex_enter(&modunload_wait_mutex);
3654 	while (modunload_disable_count) {
3655 		modunload_wait++;
3656 		cv_wait(&modunload_wait_cv, &modunload_wait_mutex);
3657 		modunload_wait--;
3658 	}
3659 	modunload_active_count++;
3660 	mutex_exit(&modunload_wait_mutex);
3661 }
3662 
3663 /* mark end of unload and signal waiters */
3664 void
3665 modunload_end()
3666 {
3667 	mutex_enter(&modunload_wait_mutex);
3668 	modunload_active_count--;
3669 	if ((modunload_active_count == 0) && modunload_wait)
3670 		cv_broadcast(&modunload_wait_cv);
3671 	mutex_exit(&modunload_wait_mutex);
3672 }
3673 
3674 void
3675 mod_uninstall_daemon(void)
3676 {
3677 	callb_cpr_t	cprinfo;
3678 	clock_t		ticks = 0;
3679 
3680 	mod_aul_thread = curthread;
3681 
3682 	CALLB_CPR_INIT(&cprinfo, &mod_uninstall_lock, callb_generic_cpr, "mud");
3683 	for (;;) {
3684 		mutex_enter(&mod_uninstall_lock);
3685 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
3686 		/*
3687 		 * In DEBUG kernels, unheld drivers are uninstalled periodically
3688 		 * every mod_uninstall_interval seconds.  Periodic uninstall can
3689 		 * be disabled by setting mod_uninstall_interval to 0 which is
3690 		 * the default for a non-DEBUG kernel.
3691 		 */
3692 		if (mod_uninstall_interval) {
3693 			ticks = ddi_get_lbolt() +
3694 			    drv_usectohz(mod_uninstall_interval * 1000000);
3695 			(void) cv_timedwait(&mod_uninstall_cv,
3696 			    &mod_uninstall_lock, ticks);
3697 		} else {
3698 			cv_wait(&mod_uninstall_cv, &mod_uninstall_lock);
3699 		}
3700 		/*
3701 		 * The whole daemon is safe for CPR except we don't want
3702 		 * the daemon to run if FREEZE is issued and this daemon
3703 		 * wakes up from the cv_wait above. In this case, it'll be
3704 		 * blocked in CALLB_CPR_SAFE_END until THAW is issued.
3705 		 *
3706 		 * The reason of calling CALLB_CPR_SAFE_BEGIN twice is that
3707 		 * mod_uninstall_lock is used to protect cprinfo and
3708 		 * CALLB_CPR_SAFE_BEGIN assumes that this lock is held when
3709 		 * called.
3710 		 */
3711 		CALLB_CPR_SAFE_END(&cprinfo, &mod_uninstall_lock);
3712 		CALLB_CPR_SAFE_BEGIN(&cprinfo);
3713 		mutex_exit(&mod_uninstall_lock);
3714 		if ((modunload_disable_count == 0) &&
3715 		    ((moddebug & MODDEBUG_NOAUTOUNLOAD) == 0)) {
3716 			mod_uninstall_all();
3717 		}
3718 	}
3719 }
3720 
3721 /*
3722  * Unload all uninstalled modules.
3723  */
3724 void
3725 modreap(void)
3726 {
3727 	mutex_enter(&mod_uninstall_lock);
3728 	cv_broadcast(&mod_uninstall_cv);
3729 	mutex_exit(&mod_uninstall_lock);
3730 }
3731 
3732 /*
3733  * Hold the specified module. This is the module holding primitive.
3734  *
3735  * If MOD_LOCK_HELD then the caller already holds the mod_lock.
3736  *
3737  * Return values:
3738  *	 0 ==> the module is held
3739  *	 1 ==> the module is not held and the MOD_WAIT_ONCE caller needs
3740  *		to determine how to retry.
3741  */
3742 int
3743 mod_hold_by_modctl(struct modctl *mp, int f)
3744 {
3745 	ASSERT((f & (MOD_WAIT_ONCE | MOD_WAIT_FOREVER)) &&
3746 	    ((f & (MOD_WAIT_ONCE | MOD_WAIT_FOREVER)) !=
3747 	    (MOD_WAIT_ONCE | MOD_WAIT_FOREVER)));
3748 	ASSERT((f & (MOD_LOCK_HELD | MOD_LOCK_NOT_HELD)) &&
3749 	    ((f & (MOD_LOCK_HELD | MOD_LOCK_NOT_HELD)) !=
3750 	    (MOD_LOCK_HELD | MOD_LOCK_NOT_HELD)));
3751 	ASSERT((f & MOD_LOCK_NOT_HELD) || MUTEX_HELD(&mod_lock));
3752 
3753 	if (f & MOD_LOCK_NOT_HELD)
3754 		mutex_enter(&mod_lock);
3755 
3756 	while (mp->mod_busy) {
3757 		mp->mod_want = 1;
3758 		cv_wait(&mod_cv, &mod_lock);
3759 		/*
3760 		 * Module may be unloaded by daemon.
3761 		 * Nevertheless, modctl structure is still in linked list
3762 		 * (i.e., off &modules), not freed!
3763 		 * Caller is not supposed to assume "mp" is valid, but there
3764 		 * is no reasonable way to detect this but using
3765 		 * mp->mod_modinfo->mp == NULL check (follow the back pointer)
3766 		 *   (or similar check depending on calling context)
3767 		 * DON'T free modctl structure, it will be very very
3768 		 * problematic.
3769 		 */
3770 		if (f & MOD_WAIT_ONCE) {
3771 			if (f & MOD_LOCK_NOT_HELD)
3772 				mutex_exit(&mod_lock);
3773 			return (1);	/* caller decides how to retry */
3774 		}
3775 	}
3776 
3777 	mp->mod_busy = 1;
3778 	mp->mod_inprogress_thread =
3779 	    (curthread == NULL ? (kthread_id_t)-1 : curthread);
3780 
3781 	if (f & MOD_LOCK_NOT_HELD)
3782 		mutex_exit(&mod_lock);
3783 	return (0);
3784 }
3785 
3786 static struct modctl *
3787 mod_hold_by_name_common(struct modctl *dep, const char *filename)
3788 {
3789 	const char	*modname;
3790 	struct modctl	*mp;
3791 	char		*curname, *newname;
3792 	int		found = 0;
3793 
3794 	mutex_enter(&mod_lock);
3795 
3796 	if ((modname = strrchr(filename, '/')) == NULL)
3797 		modname = filename;
3798 	else
3799 		modname++;
3800 
3801 	mp = &modules;
3802 	do {
3803 		if (strcmp(modname, mp->mod_modname) == 0) {
3804 			found = 1;
3805 			break;
3806 		}
3807 	} while ((mp = mp->mod_next) != &modules);
3808 
3809 	if (found == 0) {
3810 		mp = allocate_modp(filename, modname);
3811 		modadd(mp);
3812 	}
3813 
3814 	/*
3815 	 * if dep is not NULL, set the mp in mod_requisite_loading for
3816 	 * the module circular dependency check. This field is used in
3817 	 * mod_circdep(), but it's cleard in mod_hold_loaded_mod().
3818 	 */
3819 	if (dep != NULL) {
3820 		ASSERT(dep->mod_busy && dep->mod_requisite_loading == NULL);
3821 		dep->mod_requisite_loading = mp;
3822 	}
3823 
3824 	/*
3825 	 * If the module was held, then it must be us who has it held.
3826 	 */
3827 	if (mod_circdep(mp))
3828 		mp = NULL;
3829 	else {
3830 		(void) mod_hold_by_modctl(mp, MOD_WAIT_FOREVER | MOD_LOCK_HELD);
3831 
3832 		/*
3833 		 * If the name hadn't been set or has changed, allocate
3834 		 * space and set it.  Free space used by previous name.
3835 		 *
3836 		 * Do not change the name of primary modules, for primary
3837 		 * modules the mod_filename was allocated in standalone mode:
3838 		 * it is illegal to kobj_alloc in standalone mode and kobj_free
3839 		 * in non-standalone mode.
3840 		 */
3841 		curname = mp->mod_filename;
3842 		if (curname == NULL ||
3843 		    ((mp->mod_prim == 0) &&
3844 		    (curname != filename) &&
3845 		    (modname != filename) &&
3846 		    (strcmp(curname, filename) != 0))) {
3847 			newname = kobj_zalloc(strlen(filename) + 1, KM_SLEEP);
3848 			(void) strcpy(newname, filename);
3849 			mp->mod_filename = newname;
3850 			if (curname != NULL)
3851 				kobj_free(curname, strlen(curname) + 1);
3852 		}
3853 	}
3854 
3855 	mutex_exit(&mod_lock);
3856 	if (mp && moddebug & MODDEBUG_LOADMSG2)
3857 		printf("Holding %s\n", mp->mod_filename);
3858 	if (mp == NULL && moddebug & MODDEBUG_LOADMSG2)
3859 		printf("circular dependency loading %s\n", filename);
3860 	return (mp);
3861 }
3862 
3863 static struct modctl *
3864 mod_hold_by_name_requisite(struct modctl *dep, char *filename)
3865 {
3866 	return (mod_hold_by_name_common(dep, filename));
3867 }
3868 
3869 struct modctl *
3870 mod_hold_by_name(const char *filename)
3871 {
3872 	return (mod_hold_by_name_common(NULL, filename));
3873 }
3874 
3875 struct modctl *
3876 mod_hold_by_id(modid_t modid)
3877 {
3878 	struct modctl	*mp;
3879 	int		found = 0;
3880 
3881 	mutex_enter(&mod_lock);
3882 	mp = &modules;
3883 	do {
3884 		if (mp->mod_id == modid) {
3885 			found = 1;
3886 			break;
3887 		}
3888 	} while ((mp = mp->mod_next) != &modules);
3889 
3890 	if ((found == 0) || mod_circdep(mp))
3891 		mp = NULL;
3892 	else
3893 		(void) mod_hold_by_modctl(mp, MOD_WAIT_FOREVER | MOD_LOCK_HELD);
3894 
3895 	mutex_exit(&mod_lock);
3896 	return (mp);
3897 }
3898 
3899 static struct modctl *
3900 mod_hold_next_by_id(modid_t modid)
3901 {
3902 	struct modctl	*mp;
3903 	int		found = 0;
3904 
3905 	if (modid < -1)
3906 		return (NULL);
3907 
3908 	mutex_enter(&mod_lock);
3909 
3910 	mp = &modules;
3911 	do {
3912 		if (mp->mod_id > modid) {
3913 			found = 1;
3914 			break;
3915 		}
3916 	} while ((mp = mp->mod_next) != &modules);
3917 
3918 	if ((found == 0) || mod_circdep(mp))
3919 		mp = NULL;
3920 	else
3921 		(void) mod_hold_by_modctl(mp, MOD_WAIT_FOREVER | MOD_LOCK_HELD);
3922 
3923 	mutex_exit(&mod_lock);
3924 	return (mp);
3925 }
3926 
3927 static void
3928 mod_release(struct modctl *mp)
3929 {
3930 	ASSERT(MUTEX_HELD(&mod_lock));
3931 	ASSERT(mp->mod_busy);
3932 
3933 	mp->mod_busy = 0;
3934 	mp->mod_inprogress_thread = NULL;
3935 	if (mp->mod_want) {
3936 		mp->mod_want = 0;
3937 		cv_broadcast(&mod_cv);
3938 	}
3939 }
3940 
3941 void
3942 mod_release_mod(struct modctl *mp)
3943 {
3944 	if (moddebug & MODDEBUG_LOADMSG2)
3945 		printf("Releasing %s\n", mp->mod_filename);
3946 	mutex_enter(&mod_lock);
3947 	mod_release(mp);
3948 	mutex_exit(&mod_lock);
3949 }
3950 
3951 modid_t
3952 mod_name_to_modid(char *filename)
3953 {
3954 	char		*modname;
3955 	struct modctl	*mp;
3956 
3957 	mutex_enter(&mod_lock);
3958 
3959 	if ((modname = strrchr(filename, '/')) == NULL)
3960 		modname = filename;
3961 	else
3962 		modname++;
3963 
3964 	mp = &modules;
3965 	do {
3966 		if (strcmp(modname, mp->mod_modname) == 0) {
3967 			mutex_exit(&mod_lock);
3968 			return (mp->mod_id);
3969 		}
3970 	} while ((mp = mp->mod_next) != &modules);
3971 
3972 	mutex_exit(&mod_lock);
3973 	return (-1);
3974 }
3975 
3976 
3977 int
3978 mod_remove_by_name(char *name)
3979 {
3980 	struct modctl *mp;
3981 	int retval;
3982 
3983 	mp = mod_hold_by_name(name);
3984 
3985 	if (mp == NULL)
3986 		return (EINVAL);
3987 
3988 	if (mp->mod_loadflags & MOD_NOAUTOUNLOAD) {
3989 		/*
3990 		 * Do not unload forceloaded modules
3991 		 */
3992 		mod_release_mod(mp);
3993 		return (0);
3994 	}
3995 
3996 	if ((retval = moduninstall(mp)) == 0) {
3997 		mod_unload(mp);
3998 		CPU_STATS_ADDQ(CPU, sys, modunload, 1);
3999 	} else if (retval == EALREADY)
4000 		retval = 0;		/* already unloaded, not an error */
4001 	mod_release_mod(mp);
4002 	return (retval);
4003 }
4004 
4005 /*
4006  * Record that module "dep" is dependent on module "on_mod."
4007  */
4008 static void
4009 mod_make_requisite(struct modctl *dependent, struct modctl *on_mod)
4010 {
4011 	struct modctl_list **pmlnp;	/* previous next pointer */
4012 	struct modctl_list *mlp;
4013 	struct modctl_list *new;
4014 
4015 	ASSERT(dependent->mod_busy && on_mod->mod_busy);
4016 	mutex_enter(&mod_lock);
4017 
4018 	/*
4019 	 * Search dependent's requisite list to see if on_mod is recorded.
4020 	 * List is ordered by id.
4021 	 */
4022 	for (pmlnp = &dependent->mod_requisites, mlp = *pmlnp;
4023 	    mlp; pmlnp = &mlp->modl_next, mlp = *pmlnp)
4024 		if (mlp->modl_modp->mod_id >= on_mod->mod_id)
4025 			break;
4026 
4027 	/* Create and insert if not already recorded */
4028 	if ((mlp == NULL) || (mlp->modl_modp->mod_id != on_mod->mod_id)) {
4029 		new = kobj_zalloc(sizeof (*new), KM_SLEEP);
4030 		new->modl_modp = on_mod;
4031 		new->modl_next = mlp;
4032 		*pmlnp = new;
4033 
4034 		/*
4035 		 * Increment the mod_ref count in our new requisite module.
4036 		 * This is what keeps a module that has other modules
4037 		 * which are dependent on it from being uninstalled and
4038 		 * unloaded. "on_mod"'s mod_ref count decremented in
4039 		 * mod_release_requisites when the "dependent" module
4040 		 * unload is complete.  "on_mod" must be loaded, but may not
4041 		 * yet be installed.
4042 		 */
4043 		on_mod->mod_ref++;
4044 		ASSERT(on_mod->mod_ref && on_mod->mod_loaded);
4045 	}
4046 
4047 	mutex_exit(&mod_lock);
4048 }
4049 
4050 /*
4051  * release the hold associated with mod_make_requisite mod_ref++
4052  * as part of unload.
4053  */
4054 void
4055 mod_release_requisites(struct modctl *modp)
4056 {
4057 	struct modctl_list *modl;
4058 	struct modctl_list *next;
4059 	struct modctl *req;
4060 	struct modctl_list *start = NULL, *mod_garbage;
4061 
4062 	ASSERT(modp->mod_busy);
4063 	ASSERT(!MUTEX_HELD(&mod_lock));
4064 
4065 	mutex_enter(&mod_lock);		/* needed for manipulation of req */
4066 	for (modl = modp->mod_requisites; modl; modl = next) {
4067 		next = modl->modl_next;
4068 		req = modl->modl_modp;
4069 		ASSERT(req->mod_ref >= 1 && req->mod_loaded);
4070 		req->mod_ref--;
4071 
4072 		/*
4073 		 * Check if the module has to be unloaded or not.
4074 		 */
4075 		if (req->mod_ref == 0 && req->mod_delay_unload) {
4076 			struct modctl_list *new;
4077 			/*
4078 			 * Allocate the modclt_list holding the garbage
4079 			 * module which should be unloaded later.
4080 			 */
4081 			new = kobj_zalloc(sizeof (struct modctl_list),
4082 			    KM_SLEEP);
4083 			new->modl_modp = req;
4084 
4085 			if (start == NULL)
4086 				mod_garbage = start = new;
4087 			else {
4088 				mod_garbage->modl_next = new;
4089 				mod_garbage = new;
4090 			}
4091 		}
4092 
4093 		/* free the list as we go */
4094 		kobj_free(modl, sizeof (*modl));
4095 	}
4096 	modp->mod_requisites = NULL;
4097 	mutex_exit(&mod_lock);
4098 
4099 	/*
4100 	 * Unload the garbage modules.
4101 	 */
4102 	for (mod_garbage = start; mod_garbage != NULL; /* nothing */) {
4103 		struct modctl_list *old = mod_garbage;
4104 		struct modctl *mp = mod_garbage->modl_modp;
4105 		ASSERT(mp != NULL);
4106 
4107 		/*
4108 		 * Hold this module until it's unloaded completely.
4109 		 */
4110 		(void) mod_hold_by_modctl(mp,
4111 		    MOD_WAIT_FOREVER | MOD_LOCK_NOT_HELD);
4112 		/*
4113 		 * Check if the module is not unloaded yet and nobody requires
4114 		 * the module. If it's unloaded already or somebody still
4115 		 * requires the module, don't unload it now.
4116 		 */
4117 		if (mp->mod_loaded && mp->mod_ref == 0)
4118 			mod_unload(mp);
4119 		ASSERT((mp->mod_loaded == 0 && mp->mod_delay_unload == 0) ||
4120 		    (mp->mod_ref > 0));
4121 		mod_release_mod(mp);
4122 
4123 		mod_garbage = mod_garbage->modl_next;
4124 		kobj_free(old, sizeof (struct modctl_list));
4125 	}
4126 }
4127 
4128 /*
4129  * Process dependency of the module represented by "dep" on the
4130  * module named by "on."
4131  *
4132  * Called from kobj_do_dependents() to load a module "on" on which
4133  * "dep" depends.
4134  */
4135 struct modctl *
4136 mod_load_requisite(struct modctl *dep, char *on)
4137 {
4138 	struct modctl *on_mod;
4139 	int retval;
4140 
4141 	if ((on_mod = mod_hold_loaded_mod(dep, on, &retval)) != NULL) {
4142 		mod_make_requisite(dep, on_mod);
4143 	} else if (moddebug & MODDEBUG_ERRMSG) {
4144 		printf("error processing %s on which module %s depends\n",
4145 		    on, dep->mod_modname);
4146 	}
4147 	return (on_mod);
4148 }
4149 
4150 static int
4151 mod_install_requisites(struct modctl *modp)
4152 {
4153 	struct modctl_list *modl;
4154 	struct modctl *req;
4155 	int status = 0;
4156 
4157 	ASSERT(MUTEX_NOT_HELD(&mod_lock));
4158 	ASSERT(modp->mod_busy);
4159 
4160 	for (modl = modp->mod_requisites; modl; modl = modl->modl_next) {
4161 		req = modl->modl_modp;
4162 		(void) mod_hold_by_modctl(req,
4163 		    MOD_WAIT_FOREVER | MOD_LOCK_NOT_HELD);
4164 		status = modinstall(req);
4165 		mod_release_mod(req);
4166 
4167 		if (status != 0)
4168 			break;
4169 	}
4170 	return (status);
4171 }
4172 
4173 /*
4174  * returns 1 if this thread is doing autounload, 0 otherwise.
4175  * see mod_uninstall_all.
4176  */
4177 int
4178 mod_in_autounload()
4179 {
4180 	return ((int)(uintptr_t)tsd_get(mod_autounload_key));
4181 }
4182 
4183 /*
4184  * gmatch adapted from libc, stripping the wchar stuff
4185  */
4186 #define	popchar(p, c)	{ \
4187 		c = *p++; \
4188 		if (c == 0) { \
4189 			return (0); \
4190 		} \
4191 	}
4192 
4193 int
4194 gmatch(const char *s, const char *p)
4195 {
4196 	int c, sc;
4197 	int ok, lc, notflag;
4198 
4199 	sc = *s++;
4200 	c = *p++;
4201 	if (c == 0)
4202 		return (sc == c);	/* nothing matches nothing */
4203 
4204 	switch (c) {
4205 	case '\\':
4206 		/* skip to quoted character */
4207 		popchar(p, c);
4208 		/*FALLTHRU*/
4209 
4210 	default:
4211 		/* straight comparison */
4212 		if (c != sc)
4213 			return (0);
4214 		/*FALLTHRU*/
4215 
4216 	case '?':
4217 		/* first char matches, move to remainder */
4218 		return (sc != '\0' ? gmatch(s, p) : 0);
4219 
4220 
4221 	case '*':
4222 		while (*p == '*')
4223 			p++;
4224 
4225 		/* * matches everything */
4226 		if (*p == 0)
4227 			return (1);
4228 
4229 		/* undo skip at the beginning & iterate over substrings */
4230 		--s;
4231 		while (*s) {
4232 			if (gmatch(s, p))
4233 				return (1);
4234 			s++;
4235 		}
4236 		return (0);
4237 
4238 	case '[':
4239 		/* match any char within [] */
4240 		if (sc == 0)
4241 			return (0);
4242 
4243 		ok = lc = notflag = 0;
4244 
4245 		if (*p == '!') {
4246 			notflag = 1;
4247 			p++;
4248 		}
4249 		popchar(p, c);
4250 
4251 		do {
4252 			if (c == '-' && lc && *p != ']') {
4253 				/* test sc against range [c1-c2] */
4254 				popchar(p, c);
4255 				if (c == '\\') {
4256 					popchar(p, c);
4257 				}
4258 
4259 				if (notflag) {
4260 					/* return 0 on mismatch */
4261 					if (lc <= sc && sc <= c)
4262 						return (0);
4263 					ok++;
4264 				} else if (lc <= sc && sc <= c) {
4265 					ok++;
4266 				}
4267 				/* keep going, may get a match next */
4268 			} else if (c == '\\') {
4269 				/* skip to quoted character */
4270 				popchar(p, c);
4271 			}
4272 			lc = c;
4273 			if (notflag) {
4274 				if (sc == lc)
4275 					return (0);
4276 				ok++;
4277 			} else if (sc == lc) {
4278 				ok++;
4279 			}
4280 			popchar(p, c);
4281 		} while (c != ']');
4282 
4283 		/* recurse on remainder of string */
4284 		return (ok ? gmatch(s, p) : 0);
4285 	}
4286 	/*NOTREACHED*/
4287 }
4288 
4289 
4290 /*
4291  * Get default perm for device from /etc/minor_perm. Return 0 if match found.
4292  *
4293  * Pure wild-carded patterns are handled separately so the ordering of
4294  * these patterns doesn't matter.  We're still dependent on ordering
4295  * however as the first matching entry is the one returned.
4296  * Not ideal but all existing examples and usage do imply this
4297  * ordering implicitly.
4298  *
4299  * Drivers using the clone driver are always good for some entertainment.
4300  * Clone nodes under pseudo have the form clone@0:<driver>.  Some minor
4301  * perm entries have the form clone:<driver>, others use <driver>:*
4302  * Examples are clone:llc1 vs. llc2:*, for example.
4303  *
4304  * Minor perms in the clone:<driver> form are mapped to the drivers's
4305  * mperm list, not the clone driver, as wildcard entries for clone
4306  * reference only.  In other words, a clone wildcard will match
4307  * references for clone@0:<driver> but never <driver>@<minor>.
4308  *
4309  * Additional minor perms in the standard form are also supported,
4310  * for mixed usage, ie a node with an entry clone:<driver> could
4311  * provide further entries <driver>:<minor>.
4312  *
4313  * Finally, some uses of clone use an alias as the minor name rather
4314  * than the driver name, with the alias as the minor perm entry.
4315  * This case is handled by attaching the driver to bring its
4316  * minor list into existence, then discover the alias via DDI_ALIAS.
4317  * The clone device's minor perm list can then be searched for
4318  * that alias.
4319  */
4320 
4321 static int
4322 dev_alias_minorperm(dev_info_t *dip, char *minor_name, mperm_t *rmp)
4323 {
4324 	major_t			major;
4325 	struct devnames		*dnp;
4326 	mperm_t			*mp;
4327 	char			*alias = NULL;
4328 	dev_info_t		*cdevi;
4329 	int			circ;
4330 	struct ddi_minor_data	*dmd;
4331 
4332 	major = ddi_name_to_major(minor_name);
4333 
4334 	ASSERT(dip == clone_dip);
4335 	ASSERT(major != DDI_MAJOR_T_NONE);
4336 
4337 	/*
4338 	 * Attach the driver named by the minor node, then
4339 	 * search its first instance's minor list for an
4340 	 * alias node.
4341 	 */
4342 	if (ddi_hold_installed_driver(major) == NULL)
4343 		return (1);
4344 
4345 	dnp = &devnamesp[major];
4346 	LOCK_DEV_OPS(&dnp->dn_lock);
4347 
4348 	if ((cdevi = dnp->dn_head) != NULL) {
4349 		ndi_devi_enter(cdevi, &circ);
4350 		for (dmd = DEVI(cdevi)->devi_minor; dmd; dmd = dmd->next) {
4351 			if (dmd->type == DDM_ALIAS) {
4352 				alias = i_ddi_strdup(dmd->ddm_name, KM_SLEEP);
4353 				break;
4354 			}
4355 		}
4356 		ndi_devi_exit(cdevi, circ);
4357 	}
4358 
4359 	UNLOCK_DEV_OPS(&dnp->dn_lock);
4360 	ddi_rele_driver(major);
4361 
4362 	if (alias == NULL) {
4363 		if (moddebug & MODDEBUG_MINORPERM)
4364 			cmn_err(CE_CONT, "dev_minorperm: "
4365 			    "no alias for %s\n", minor_name);
4366 		return (1);
4367 	}
4368 
4369 	major = ddi_driver_major(clone_dip);
4370 	dnp = &devnamesp[major];
4371 	LOCK_DEV_OPS(&dnp->dn_lock);
4372 
4373 	/*
4374 	 * Go through the clone driver's mperm list looking
4375 	 * for a match for the specified alias.
4376 	 */
4377 	for (mp = dnp->dn_mperm; mp; mp = mp->mp_next) {
4378 		if (strcmp(alias, mp->mp_minorname) == 0) {
4379 			break;
4380 		}
4381 	}
4382 
4383 	if (mp) {
4384 		if (moddebug & MODDEBUG_MP_MATCH) {
4385 			cmn_err(CE_CONT,
4386 			    "minor perm defaults: %s %s 0%o %d %d (aliased)\n",
4387 			    minor_name, alias, mp->mp_mode,
4388 			    mp->mp_uid, mp->mp_gid);
4389 		}
4390 		rmp->mp_uid = mp->mp_uid;
4391 		rmp->mp_gid = mp->mp_gid;
4392 		rmp->mp_mode = mp->mp_mode;
4393 	}
4394 	UNLOCK_DEV_OPS(&dnp->dn_lock);
4395 
4396 	kmem_free(alias, strlen(alias)+1);
4397 
4398 	return (mp == NULL);
4399 }
4400 
4401 int
4402 dev_minorperm(dev_info_t *dip, char *name, mperm_t *rmp)
4403 {
4404 	major_t major;
4405 	char *minor_name;
4406 	struct devnames *dnp;
4407 	mperm_t *mp;
4408 	int is_clone = 0;
4409 
4410 	if (!minorperm_loaded) {
4411 		if (moddebug & MODDEBUG_MINORPERM)
4412 			cmn_err(CE_CONT,
4413 			    "%s: minor perm not yet loaded\n", name);
4414 		return (1);
4415 	}
4416 
4417 	minor_name = strchr(name, ':');
4418 	if (minor_name == NULL)
4419 		return (1);
4420 	minor_name++;
4421 
4422 	/*
4423 	 * If it's the clone driver, search the driver as named
4424 	 * by the minor.  All clone minor perm entries other than
4425 	 * alias nodes are actually installed on the real driver's list.
4426 	 */
4427 	if (dip == clone_dip) {
4428 		major = ddi_name_to_major(minor_name);
4429 		if (major == DDI_MAJOR_T_NONE) {
4430 			if (moddebug & MODDEBUG_MINORPERM)
4431 				cmn_err(CE_CONT, "dev_minorperm: "
4432 				    "%s: no such driver\n", minor_name);
4433 			return (1);
4434 		}
4435 		is_clone = 1;
4436 	} else {
4437 		major = ddi_driver_major(dip);
4438 		ASSERT(major != DDI_MAJOR_T_NONE);
4439 	}
4440 
4441 	dnp = &devnamesp[major];
4442 	LOCK_DEV_OPS(&dnp->dn_lock);
4443 
4444 	/*
4445 	 * Go through the driver's mperm list looking for
4446 	 * a match for the specified minor.  If there's
4447 	 * no matching pattern, use the wild card.
4448 	 * Defer to the clone wild for clone if specified,
4449 	 * otherwise fall back to the normal form.
4450 	 */
4451 	for (mp = dnp->dn_mperm; mp; mp = mp->mp_next) {
4452 		if (gmatch(minor_name, mp->mp_minorname) != 0) {
4453 			break;
4454 		}
4455 	}
4456 	if (mp == NULL) {
4457 		if (is_clone)
4458 			mp = dnp->dn_mperm_clone;
4459 		if (mp == NULL)
4460 			mp = dnp->dn_mperm_wild;
4461 	}
4462 
4463 	if (mp) {
4464 		if (moddebug & MODDEBUG_MP_MATCH) {
4465 			cmn_err(CE_CONT,
4466 			    "minor perm defaults: %s %s 0%o %d %d\n",
4467 			    name, mp->mp_minorname, mp->mp_mode,
4468 			    mp->mp_uid, mp->mp_gid);
4469 		}
4470 		rmp->mp_uid = mp->mp_uid;
4471 		rmp->mp_gid = mp->mp_gid;
4472 		rmp->mp_mode = mp->mp_mode;
4473 	}
4474 	UNLOCK_DEV_OPS(&dnp->dn_lock);
4475 
4476 	/*
4477 	 * If no match can be found for a clone node,
4478 	 * search for a possible match for an alias.
4479 	 * One such example is /dev/ptmx -> /devices/pseudo/clone@0:ptm,
4480 	 * with minor perm entry clone:ptmx.
4481 	 */
4482 	if (mp == NULL && is_clone) {
4483 		return (dev_alias_minorperm(dip, minor_name, rmp));
4484 	}
4485 
4486 	return (mp == NULL);
4487 }
4488 
4489 /*
4490  * dynamicaly reference load a dl module/library, returning handle
4491  */
4492 /*ARGSUSED*/
4493 ddi_modhandle_t
4494 ddi_modopen(const char *modname, int mode, int *errnop)
4495 {
4496 	char		*subdir;
4497 	char		*mod;
4498 	int		subdirlen;
4499 	struct modctl	*hmodp = NULL;
4500 	int		retval = EINVAL;
4501 
4502 	ASSERT(modname && (mode == KRTLD_MODE_FIRST));
4503 	if ((modname == NULL) || (mode != KRTLD_MODE_FIRST))
4504 		goto out;
4505 
4506 	/* find last '/' in modname */
4507 	mod = strrchr(modname, '/');
4508 
4509 	if (mod) {
4510 		/* for subdir string without modification to argument */
4511 		mod++;
4512 		subdirlen = mod - modname;
4513 		subdir = kmem_alloc(subdirlen, KM_SLEEP);
4514 		(void) strlcpy(subdir, modname, subdirlen);
4515 	} else {
4516 		subdirlen = 0;
4517 		subdir = "misc";
4518 		mod = (char *)modname;
4519 	}
4520 
4521 	/* reference load with errno return value */
4522 	retval = modrload(subdir, mod, &hmodp);
4523 
4524 	if (subdirlen)
4525 		kmem_free(subdir, subdirlen);
4526 
4527 out:	if (errnop)
4528 		*errnop = retval;
4529 
4530 	if (moddebug & MODDEBUG_DDI_MOD)
4531 		printf("ddi_modopen %s mode %x: %s %p %d\n",
4532 		    modname ? modname : "<unknown>", mode,
4533 		    hmodp ? hmodp->mod_filename : "<unknown>",
4534 		    (void *)hmodp, retval);
4535 
4536 	return ((ddi_modhandle_t)hmodp);
4537 }
4538 
4539 /* lookup "name" in open dl module/library */
4540 void *
4541 ddi_modsym(ddi_modhandle_t h, const char *name, int *errnop)
4542 {
4543 	struct modctl	*hmodp = (struct modctl *)h;
4544 	void		*f;
4545 	int		retval;
4546 
4547 	ASSERT(hmodp && name && hmodp->mod_installed && (hmodp->mod_ref >= 1));
4548 	if ((hmodp == NULL) || (name == NULL) ||
4549 	    (hmodp->mod_installed == 0) || (hmodp->mod_ref < 1)) {
4550 		f = NULL;
4551 		retval = EINVAL;
4552 	} else {
4553 		f = (void *)kobj_lookup(hmodp->mod_mp, (char *)name);
4554 		if (f)
4555 			retval = 0;
4556 		else
4557 			retval = ENOTSUP;
4558 	}
4559 
4560 	if (moddebug & MODDEBUG_DDI_MOD)
4561 		printf("ddi_modsym in %s of %s: %d %p\n",
4562 		    hmodp ? hmodp->mod_modname : "<unknown>",
4563 		    name ? name : "<unknown>", retval, f);
4564 
4565 	if (errnop)
4566 		*errnop = retval;
4567 	return (f);
4568 }
4569 
4570 /* dynamic (un)reference unload of an open dl module/library */
4571 int
4572 ddi_modclose(ddi_modhandle_t h)
4573 {
4574 	struct modctl	*hmodp = (struct modctl *)h;
4575 	struct modctl	*modp = NULL;
4576 	int		retval;
4577 
4578 	ASSERT(hmodp && hmodp->mod_installed && (hmodp->mod_ref >= 1));
4579 	if ((hmodp == NULL) ||
4580 	    (hmodp->mod_installed == 0) || (hmodp->mod_ref < 1)) {
4581 		retval = EINVAL;
4582 		goto out;
4583 	}
4584 
4585 	retval = modunrload(hmodp->mod_id, &modp, ddi_modclose_unload);
4586 	if (retval == EBUSY)
4587 		retval = 0;	/* EBUSY is not an error */
4588 
4589 	if (retval == 0) {
4590 		ASSERT(hmodp == modp);
4591 		if (hmodp != modp)
4592 			retval = EINVAL;
4593 	}
4594 
4595 out:	if (moddebug & MODDEBUG_DDI_MOD)
4596 		printf("ddi_modclose %s: %d\n",
4597 		    hmodp ? hmodp->mod_modname : "<unknown>", retval);
4598 
4599 	return (retval);
4600 }
4601