Trailing whitespace

Many years ago someone created a new __link_set_sysctl_funcs to hold
the list of routines that need to be called for setting up sysctl
variables. This worked great for all code included in the kernel
itself, but didn't deal with modules that want to create their own
sysctl data. So, we ended up with a lot of #ifdef _MODULE blocks
so modules could explicitly call their setup functions when loaded
as non-built-in modules.

So today, we complete the task that was started so many years ago.

When modules are loaded, after we've called xxx_modcmd(INIT...) we
check if the module contains its own __link_set_sysctl_funcs, and
if so we call the functions listed. We add a struct sysctllog member
to the struct module so we can call sysctl_teardown() when the module
gets unloaded. (The sequence of events ensures that the sysctl stuff
doesn't get created until the rest of the module's init code does any
required memory allocation.)

So, no more need to explicitly call the sysctl setup routines when
built as a loadable module.

Improve kernel module validation. First, set a limit on how much of the
module name field to check when validation name's length. Second, check
the module's mi_class to ensure it is valid.

Update the commenet in sys/module.h to indicate that the module classes
are now being validated.

Add a MODULE_CLASS_MAX value to the enum

- autoload the compat_80 for modstat
- move compat struct to a compat header

Merge the [pgoyette-compat] branch

branches: 1.42.2;
add more accessor functions for various struct module fields.
add a mechanism for registering callbacks to be called upon module load/unload.

branches: 1.41.14;
Define a new module class for the bufq_strategy modules. These need to
be loaded and intialized before autoconfigure runs, since some devices
(like disks and floppy drives) want to call bufq_alloc().

branches: 1.40.2;
Fix dlopen()/dlclose()+RUMP_USE_CTOR to not leave dangling pointers around.

Export module flags to userland

Make module_machine const char *

Make handle_modctl_load() usable from compat/netbsd32.

use __COMPAT so that we get argument expansion.

branches: 1.35.4;
Add a RUMP_USE_CTOR compile-time switch. If defined, use
__attribute__((constructor)) to determine which rump kernel components
and kernel modules are linked into the rump kernel. If not defined
(default), use the regular approach with link sets.

This option is aimed to fix problems with toolchains where using link
sets is not possible because the linker does not generate the requisite
__start/__stop symbols for the link set sections (e.g. GNU gold, OS X, ...).

branches: 1.34.2;
use MODULE_CLASS_MISC for Lua modules

add MODULE_CLASS_LUA_BINDING

branches: 1.32.2;
Correct spelling: entrie -> entry.

branches: 1.31.2;
Add -A, -a, and -e options to modstat(8) along with kernel
changes required to support these options. The -e option was
requested by martin@ in private chat in order to make writing tests
easier (i.e. don't bother testing MODULAR functionaility if it
doesn't exist). While there, I added -A and -a since those were
quite similar.

-A Tells you whether or not modules can be autoloaded at the moment.
This option does take into consideration the sysctl
kern.module.autoload.

-a Tells you whether or not modules can be autoloaded at the moment.
This option does not take into consideration the sysctl
kern.module.autoload.

-e Tells you whether or not you may load a module at the moment.

change printf gcc attribute to __printflike(), requested by joerg.

add more missing printf attributes.

branches: 1.28.2;
Don't try to auto-unload modules unless they were auto-loaded.

Always provide a meaningful short name for the kobj in the error message,
as well as the function name and the linenumber, without extra line feeds.

add a "module_machine", that defaults to machine.
allows MD code to override the default subdir for modules.

branches: 1.25.2;
Define a set of new kernel locking primitives to implement the recursive
kernconfig_mutex. Update module subsystem to use this mutex rather than
its own internal (non-recursive) mutex. Make module_autoload() do its
own locking to be consistent with the rest of the module_xxx() calls.
Update module(9) man page appropriately.

As discussed on tech-kern over the last few weeks.

Welcome to NetBSD 5.99.39 !

1. Add an allocator for 'struct module *' and use it instead of local
allocations.

2. Add a new member mod_flags to the 'struct module *' and define
MODFLG_MUST_FORCE. If this flag is set and the entry is on the list
of builtins, it means that the module has been explicitly unloaded
and any re-loads will require the MODCTL_LOAD_FORCE flag. Provide a
module_require_force() method to set this flag; once set, it should
never be unset.

3. Rename original module_init2() to module_start_unload_thread() to be
more descriptive of what it does.

4. Add a new module_builtin_require_force() routine that sets the
MODFLG_MUST_FORCE flag for any module that has not yet successfully
been initialized. Call it after module_init_class(MODULE_CLASS_ANY)
to disable remaining built-in modules.

This makes built-in versions of the xxxVERBOSE modules work once more,
resolving breakage reported by jruoho@ and njoly@.

Discussed on tech-kern, and comments and suggestions implemented. No
additional discussion for last week. Tested only on amd64 systems, but
there's nothing here that should be port- or architecture-specific (no
more specific than existing module implementation) so others should not
break.

Protect against attempting to load modules from the filesystem until we
have mounted the root file-system. This allows us to load built-in and
boot-loader-provided modules much earlier during startup.

Allow everyone in the kernel to see module_base.

branches: 1.21.2;
DTrace: Add the Function Boundary Trace (FBT) provider moduile. This
module instruments every function in the kernel with entry and exit
probes. These probes are true zero-effect probes in that they don't
exist in the code until they are enabled. The probes are enabled by
directly patching the function entry and exit points to make jumps into
the dtrace framework.
This gives us over 29,000 trace points in the kernel.

Make module_{lookup,enqueue}() static now that it's possible again
(effectively reverts my kern_module rev. 1.53 from some months ago)

Move builtin modules to a list in init and load them from there
instead of using linksets directly. This has two implications:

1) It is now possible to "unload" a builtin module provided it is
not busy. This is useful e.g. to disable a kernel feature as
an immediate workaround to a security problem. To re-initialize
the module, modload -f <name> is required.
2) It is possible to use builtin modules which were linked at
runtime with an external linker (dlopen + rump).

branches: 1.18.2;
* make it possible to include kern_module in a kernel without vfs
support, i.e. move vfs functionality to a separate module
(kern_module_vfs.c)
* make module proplist size an MI constant (now 8k) instead of PAGE_SIZE
* change some error values to something else than the karmic EINVAL

expose module_{lookup,enqueue}()

First part of secmodel cleanup and other misc. changes:

- Separate the suser part of the bsd44 secmodel into its own secmodel
and directory, pending even more cleanups. For revision history
purposes, the original location of the files was

src/sys/secmodel/bsd44/secmodel_bsd44_suser.c
src/sys/secmodel/bsd44/suser.h

- Add a man-page for secmodel_suser(9) and update the one for
secmodel_bsd44(9).

- Add a "secmodel" module class and use it. Userland program and
documentation updated.

- Manage secmodel count (nsecmodels) through the module framework.
This eliminates the need for secmodel_{,de}register() calls in
secmodel code.

- Prepare for secmodel modularization by adding relevant module bits.
The secmodels don't allow auto unload. The bsd44 secmodel depends
on the suser and securelevel secmodels. The overlay secmodel depends
on the bsd44 secmodel. As the module class is only cosmetic, and to
prevent ambiguity, the bsd44 and overlay secmodels are prefixed with
"secmodel_".

- Adapt the overlay secmodel to recent changes (mainly vnode scope).

- Stop using link-sets for the sysctl node(s) creation.

- Keep sysctl variables under nodes of their relevant secmodels. In
other words, don't create duplicates for the suser/securelevel
secmodels under the bsd44 secmodel, as the latter is merely used
for "grouping".

- For the suser and securelevel secmodels, "advertise presence" in
relevant sysctl nodes (sysctl.security.models.{suser,securelevel}).

- Get rid of the LKM preprocessor stuff.

- As secmodels are now modules, there's no need for an explicit call
to secmodel_start(); it's handled by the module framework. That
said, the module framework was adjusted to properly load secmodels
early during system startup.

- Adapt rump to changes: Instead of using empty stubs for securelevel,
simply use the suser secmodel. Also replace secmodel_start() with a
call to secmodel_suser_start().

- 5.99.20.

Testing was done on i386 ("release" build). Spearated module_init()
changes were tested on sparc and sparc64 as well by martin@ (thanks!).

Mailing list reference:

http://mail-index.netbsd.org/tech-kern/2009/09/25/msg006135.html

Add the MODCTL_NO_PROP flag to tell the kernel to ignore <module>.prop.

Add the '-P' option to modload(8) to set this flag.

branches: 1.14.4;
Add some basic DDB stuff for modules.

Unused header.

Some modules may want to avoid autounload because their use is transient.
Their FINI routine may legitimately succeed even though the module is likely
to be used soon again, for example: exec_script. Add a MODULE_CMD_AUTOUNLOAD
to query whether a module wants to avoid autounload.

- If the system encounters a severe memory shortage, start unloading
unused kernel modules.
- Try to unload any autoloaded kernel modules 10 seconds after their
load was successful.
- Keep a counter to track module load/unload events.

branches: 1.10.2;
- Be clear about whether module load is explicit or system initiated (auto).
- Require that module_lock is held to autoload, so that any preconditions
can be safely checked.

expose module_compatible()

branches: 1.8.4;
- Put in place module compatibility check against __NetBSD_Version__,
as discussed on tech-kern.

- Remove unused module_jettison().

If autoloading a module, don't consider the current working directory.

Allow module class to be passed to module_load(), as a basic sanity check
that we are loading the right kind of module.

branches: 1.5.2;
- Add module_find_section(), allows a module to look up data in its object.
- Work around build failure.

Get the pre-loaded module code working.

Remove clause 3 and 4 from TNF licenses

branches: 1.2.2; 1.2.4; 1.2.6;
Add support for load-time parameters for modules, which are passed through
a dictionary. As discussed in tech-kern@.

branches: 1.1.2; 1.1.4; 1.1.6; 1.1.8; 1.1.12;
Pull in my modules code for review/test/hacking.

Many years ago someone created a new __link_set_sysctl_funcs to hold
the list of routines that need to be called for setting up sysctl
variables. This worked great for all code included in the kernel
itself, but didn't deal with modules that want to create their own
sysctl data. So, we ended up with a lot of #ifdef _MODULE blocks
so modules could explicitly call their setup functions when loaded
as non-built-in modules.

So today, we complete the task that was started so many years ago.

When modules are loaded, after we've called xxx_modcmd(INIT...) we
check if the module contains its own __link_set_sysctl_funcs, and
if so we call the functions listed. We add a struct sysctllog member
to the struct module so we can call sysctl_teardown() when the module
gets unloaded. (The sequence of events ensures that the sysctl stuff
doesn't get created until the rest of the module's init code does any
required memory allocation.)

So, no more need to explicitly call the sysctl setup routines when
built as a loadable module.

Improve kernel module validation. First, set a limit on how much of the
module name field to check when validation name's length. Second, check
the module's mi_class to ensure it is valid.

Update the commenet in sys/module.h to indicate that the module classes
are now being validated.

Add a MODULE_CLASS_MAX value to the enum

- autoload the compat_80 for modstat
- move compat struct to a compat header

Merge the [pgoyette-compat] branch

branches: 1.42.2;
add more accessor functions for various struct module fields.
add a mechanism for registering callbacks to be called upon module load/unload.

branches: 1.41.14;
Define a new module class for the bufq_strategy modules. These need to
be loaded and intialized before autoconfigure runs, since some devices
(like disks and floppy drives) want to call bufq_alloc().

branches: 1.40.2;
Fix dlopen()/dlclose()+RUMP_USE_CTOR to not leave dangling pointers around.

Export module flags to userland

Make module_machine const char *

Make handle_modctl_load() usable from compat/netbsd32.

use __COMPAT so that we get argument expansion.

branches: 1.35.4;
Add a RUMP_USE_CTOR compile-time switch. If defined, use
__attribute__((constructor)) to determine which rump kernel components
and kernel modules are linked into the rump kernel. If not defined
(default), use the regular approach with link sets.

This option is aimed to fix problems with toolchains where using link
sets is not possible because the linker does not generate the requisite
__start/__stop symbols for the link set sections (e.g. GNU gold, OS X, ...).

branches: 1.34.2;
use MODULE_CLASS_MISC for Lua modules

add MODULE_CLASS_LUA_BINDING

branches: 1.32.2;
Correct spelling: entrie -> entry.

branches: 1.31.2;
Add -A, -a, and -e options to modstat(8) along with kernel
changes required to support these options. The -e option was
requested by martin@ in private chat in order to make writing tests
easier (i.e. don't bother testing MODULAR functionaility if it
doesn't exist). While there, I added -A and -a since those were
quite similar.

-A Tells you whether or not modules can be autoloaded at the moment.
This option does take into consideration the sysctl
kern.module.autoload.

-a Tells you whether or not modules can be autoloaded at the moment.
This option does not take into consideration the sysctl
kern.module.autoload.

-e Tells you whether or not you may load a module at the moment.

change printf gcc attribute to __printflike(), requested by joerg.

add more missing printf attributes.

branches: 1.28.2;
Don't try to auto-unload modules unless they were auto-loaded.

Always provide a meaningful short name for the kobj in the error message,
as well as the function name and the linenumber, without extra line feeds.

add a "module_machine", that defaults to machine.
allows MD code to override the default subdir for modules.

branches: 1.25.2;
Define a set of new kernel locking primitives to implement the recursive
kernconfig_mutex. Update module subsystem to use this mutex rather than
its own internal (non-recursive) mutex. Make module_autoload() do its
own locking to be consistent with the rest of the module_xxx() calls.
Update module(9) man page appropriately.

As discussed on tech-kern over the last few weeks.

Welcome to NetBSD 5.99.39 !

1. Add an allocator for 'struct module *' and use it instead of local
allocations.

2. Add a new member mod_flags to the 'struct module *' and define
MODFLG_MUST_FORCE. If this flag is set and the entry is on the list
of builtins, it means that the module has been explicitly unloaded
and any re-loads will require the MODCTL_LOAD_FORCE flag. Provide a
module_require_force() method to set this flag; once set, it should
never be unset.

3. Rename original module_init2() to module_start_unload_thread() to be
more descriptive of what it does.

4. Add a new module_builtin_require_force() routine that sets the
MODFLG_MUST_FORCE flag for any module that has not yet successfully
been initialized. Call it after module_init_class(MODULE_CLASS_ANY)
to disable remaining built-in modules.

This makes built-in versions of the xxxVERBOSE modules work once more,
resolving breakage reported by jruoho@ and njoly@.

Discussed on tech-kern, and comments and suggestions implemented. No
additional discussion for last week. Tested only on amd64 systems, but
there's nothing here that should be port- or architecture-specific (no
more specific than existing module implementation) so others should not
break.

Protect against attempting to load modules from the filesystem until we
have mounted the root file-system. This allows us to load built-in and
boot-loader-provided modules much earlier during startup.

Allow everyone in the kernel to see module_base.

branches: 1.21.2;
DTrace: Add the Function Boundary Trace (FBT) provider moduile. This
module instruments every function in the kernel with entry and exit
probes. These probes are true zero-effect probes in that they don't
exist in the code until they are enabled. The probes are enabled by
directly patching the function entry and exit points to make jumps into
the dtrace framework.
This gives us over 29,000 trace points in the kernel.

Make module_{lookup,enqueue}() static now that it's possible again
(effectively reverts my kern_module rev. 1.53 from some months ago)

Move builtin modules to a list in init and load them from there
instead of using linksets directly. This has two implications:

1) It is now possible to "unload" a builtin module provided it is
not busy. This is useful e.g. to disable a kernel feature as
an immediate workaround to a security problem. To re-initialize
the module, modload -f <name> is required.
2) It is possible to use builtin modules which were linked at
runtime with an external linker (dlopen + rump).

branches: 1.18.2;
* make it possible to include kern_module in a kernel without vfs
support, i.e. move vfs functionality to a separate module
(kern_module_vfs.c)
* make module proplist size an MI constant (now 8k) instead of PAGE_SIZE
* change some error values to something else than the karmic EINVAL

expose module_{lookup,enqueue}()

First part of secmodel cleanup and other misc. changes:

- Separate the suser part of the bsd44 secmodel into its own secmodel
and directory, pending even more cleanups. For revision history
purposes, the original location of the files was

src/sys/secmodel/bsd44/secmodel_bsd44_suser.c
src/sys/secmodel/bsd44/suser.h

- Add a man-page for secmodel_suser(9) and update the one for
secmodel_bsd44(9).

- Add a "secmodel" module class and use it. Userland program and
documentation updated.

- Manage secmodel count (nsecmodels) through the module framework.
This eliminates the need for secmodel_{,de}register() calls in
secmodel code.

- Prepare for secmodel modularization by adding relevant module bits.
The secmodels don't allow auto unload. The bsd44 secmodel depends
on the suser and securelevel secmodels. The overlay secmodel depends
on the bsd44 secmodel. As the module class is only cosmetic, and to
prevent ambiguity, the bsd44 and overlay secmodels are prefixed with
"secmodel_".

- Adapt the overlay secmodel to recent changes (mainly vnode scope).

- Stop using link-sets for the sysctl node(s) creation.

- Keep sysctl variables under nodes of their relevant secmodels. In
other words, don't create duplicates for the suser/securelevel
secmodels under the bsd44 secmodel, as the latter is merely used
for "grouping".

- For the suser and securelevel secmodels, "advertise presence" in
relevant sysctl nodes (sysctl.security.models.{suser,securelevel}).

- Get rid of the LKM preprocessor stuff.

- As secmodels are now modules, there's no need for an explicit call
to secmodel_start(); it's handled by the module framework. That
said, the module framework was adjusted to properly load secmodels
early during system startup.

- Adapt rump to changes: Instead of using empty stubs for securelevel,
simply use the suser secmodel. Also replace secmodel_start() with a
call to secmodel_suser_start().

- 5.99.20.

Testing was done on i386 ("release" build). Spearated module_init()
changes were tested on sparc and sparc64 as well by martin@ (thanks!).

Mailing list reference:

http://mail-index.netbsd.org/tech-kern/2009/09/25/msg006135.html

Add the MODCTL_NO_PROP flag to tell the kernel to ignore <module>.prop.

Add the '-P' option to modload(8) to set this flag.

branches: 1.14.4;
Add some basic DDB stuff for modules.

Unused header.

Some modules may want to avoid autounload because their use is transient.
Their FINI routine may legitimately succeed even though the module is likely
to be used soon again, for example: exec_script. Add a MODULE_CMD_AUTOUNLOAD
to query whether a module wants to avoid autounload.

- If the system encounters a severe memory shortage, start unloading
unused kernel modules.
- Try to unload any autoloaded kernel modules 10 seconds after their
load was successful.
- Keep a counter to track module load/unload events.

branches: 1.10.2;
- Be clear about whether module load is explicit or system initiated (auto).
- Require that module_lock is held to autoload, so that any preconditions
can be safely checked.

expose module_compatible()

branches: 1.8.4;
- Put in place module compatibility check against __NetBSD_Version__,
as discussed on tech-kern.

- Remove unused module_jettison().

If autoloading a module, don't consider the current working directory.

Allow module class to be passed to module_load(), as a basic sanity check
that we are loading the right kind of module.

branches: 1.5.2;
- Add module_find_section(), allows a module to look up data in its object.
- Work around build failure.

Get the pre-loaded module code working.

Remove clause 3 and 4 from TNF licenses

branches: 1.2.2; 1.2.4; 1.2.6;
Add support for load-time parameters for modules, which are passed through
a dictionary. As discussed in tech-kern@.

branches: 1.1.2; 1.1.4; 1.1.6; 1.1.8; 1.1.12;
Pull in my modules code for review/test/hacking.

Improve kernel module validation. First, set a limit on how much of the
module name field to check when validation name's length. Second, check
the module's mi_class to ensure it is valid.

Update the commenet in sys/module.h to indicate that the module classes
are now being validated.

Add a MODULE_CLASS_MAX value to the enum

- autoload the compat_80 for modstat
- move compat struct to a compat header

Merge the [pgoyette-compat] branch

add more accessor functions for various struct module fields.
add a mechanism for registering callbacks to be called upon module load/unload.

branches: 1.41.14;
Define a new module class for the bufq_strategy modules. These need to
be loaded and intialized before autoconfigure runs, since some devices
(like disks and floppy drives) want to call bufq_alloc().

branches: 1.40.2;
Fix dlopen()/dlclose()+RUMP_USE_CTOR to not leave dangling pointers around.

Export module flags to userland

Make module_machine const char *

Make handle_modctl_load() usable from compat/netbsd32.

use __COMPAT so that we get argument expansion.

branches: 1.35.4;
Add a RUMP_USE_CTOR compile-time switch. If defined, use
__attribute__((constructor)) to determine which rump kernel components
and kernel modules are linked into the rump kernel. If not defined
(default), use the regular approach with link sets.

This option is aimed to fix problems with toolchains where using link
sets is not possible because the linker does not generate the requisite
__start/__stop symbols for the link set sections (e.g. GNU gold, OS X, ...).

branches: 1.34.2;
use MODULE_CLASS_MISC for Lua modules

add MODULE_CLASS_LUA_BINDING

branches: 1.32.2;
Correct spelling: entrie -> entry.

branches: 1.31.2;
Add -A, -a, and -e options to modstat(8) along with kernel
changes required to support these options. The -e option was
requested by martin@ in private chat in order to make writing tests
easier (i.e. don't bother testing MODULAR functionaility if it
doesn't exist). While there, I added -A and -a since those were
quite similar.

-A Tells you whether or not modules can be autoloaded at the moment.
This option does take into consideration the sysctl
kern.module.autoload.

-a Tells you whether or not modules can be autoloaded at the moment.
This option does not take into consideration the sysctl
kern.module.autoload.

-e Tells you whether or not you may load a module at the moment.

change printf gcc attribute to __printflike(), requested by joerg.

add more missing printf attributes.

branches: 1.28.2;
Don't try to auto-unload modules unless they were auto-loaded.

Always provide a meaningful short name for the kobj in the error message,
as well as the function name and the linenumber, without extra line feeds.

add a "module_machine", that defaults to machine.
allows MD code to override the default subdir for modules.

branches: 1.25.2;
Define a set of new kernel locking primitives to implement the recursive
kernconfig_mutex. Update module subsystem to use this mutex rather than
its own internal (non-recursive) mutex. Make module_autoload() do its
own locking to be consistent with the rest of the module_xxx() calls.
Update module(9) man page appropriately.

As discussed on tech-kern over the last few weeks.

Welcome to NetBSD 5.99.39 !

1. Add an allocator for 'struct module *' and use it instead of local
allocations.

2. Add a new member mod_flags to the 'struct module *' and define
MODFLG_MUST_FORCE. If this flag is set and the entry is on the list
of builtins, it means that the module has been explicitly unloaded
and any re-loads will require the MODCTL_LOAD_FORCE flag. Provide a
module_require_force() method to set this flag; once set, it should
never be unset.

3. Rename original module_init2() to module_start_unload_thread() to be
more descriptive of what it does.

4. Add a new module_builtin_require_force() routine that sets the
MODFLG_MUST_FORCE flag for any module that has not yet successfully
been initialized. Call it after module_init_class(MODULE_CLASS_ANY)
to disable remaining built-in modules.

This makes built-in versions of the xxxVERBOSE modules work once more,
resolving breakage reported by jruoho@ and njoly@.

Discussed on tech-kern, and comments and suggestions implemented. No
additional discussion for last week. Tested only on amd64 systems, but
there's nothing here that should be port- or architecture-specific (no
more specific than existing module implementation) so others should not
break.

Protect against attempting to load modules from the filesystem until we
have mounted the root file-system. This allows us to load built-in and
boot-loader-provided modules much earlier during startup.

Allow everyone in the kernel to see module_base.

branches: 1.21.2;
DTrace: Add the Function Boundary Trace (FBT) provider moduile. This
module instruments every function in the kernel with entry and exit
probes. These probes are true zero-effect probes in that they don't
exist in the code until they are enabled. The probes are enabled by
directly patching the function entry and exit points to make jumps into
the dtrace framework.
This gives us over 29,000 trace points in the kernel.

Make module_{lookup,enqueue}() static now that it's possible again
(effectively reverts my kern_module rev. 1.53 from some months ago)

Move builtin modules to a list in init and load them from there
instead of using linksets directly. This has two implications:

1) It is now possible to "unload" a builtin module provided it is
not busy. This is useful e.g. to disable a kernel feature as
an immediate workaround to a security problem. To re-initialize
the module, modload -f <name> is required.
2) It is possible to use builtin modules which were linked at
runtime with an external linker (dlopen + rump).

branches: 1.18.2;
* make it possible to include kern_module in a kernel without vfs
support, i.e. move vfs functionality to a separate module
(kern_module_vfs.c)
* make module proplist size an MI constant (now 8k) instead of PAGE_SIZE
* change some error values to something else than the karmic EINVAL

expose module_{lookup,enqueue}()

First part of secmodel cleanup and other misc. changes:

- Separate the suser part of the bsd44 secmodel into its own secmodel
and directory, pending even more cleanups. For revision history
purposes, the original location of the files was

src/sys/secmodel/bsd44/secmodel_bsd44_suser.c
src/sys/secmodel/bsd44/suser.h

- Add a man-page for secmodel_suser(9) and update the one for
secmodel_bsd44(9).

- Add a "secmodel" module class and use it. Userland program and
documentation updated.

- Manage secmodel count (nsecmodels) through the module framework.
This eliminates the need for secmodel_{,de}register() calls in
secmodel code.

- Prepare for secmodel modularization by adding relevant module bits.
The secmodels don't allow auto unload. The bsd44 secmodel depends
on the suser and securelevel secmodels. The overlay secmodel depends
on the bsd44 secmodel. As the module class is only cosmetic, and to
prevent ambiguity, the bsd44 and overlay secmodels are prefixed with
"secmodel_".

- Adapt the overlay secmodel to recent changes (mainly vnode scope).

- Stop using link-sets for the sysctl node(s) creation.

- Keep sysctl variables under nodes of their relevant secmodels. In
other words, don't create duplicates for the suser/securelevel
secmodels under the bsd44 secmodel, as the latter is merely used
for "grouping".

- For the suser and securelevel secmodels, "advertise presence" in
relevant sysctl nodes (sysctl.security.models.{suser,securelevel}).

- Get rid of the LKM preprocessor stuff.

- As secmodels are now modules, there's no need for an explicit call
to secmodel_start(); it's handled by the module framework. That
said, the module framework was adjusted to properly load secmodels
early during system startup.

- Adapt rump to changes: Instead of using empty stubs for securelevel,
simply use the suser secmodel. Also replace secmodel_start() with a
call to secmodel_suser_start().

- 5.99.20.

Testing was done on i386 ("release" build). Spearated module_init()
changes were tested on sparc and sparc64 as well by martin@ (thanks!).

Mailing list reference:

http://mail-index.netbsd.org/tech-kern/2009/09/25/msg006135.html

Add the MODCTL_NO_PROP flag to tell the kernel to ignore <module>.prop.

Add the '-P' option to modload(8) to set this flag.

branches: 1.14.4;
Add some basic DDB stuff for modules.

Unused header.

Some modules may want to avoid autounload because their use is transient.
Their FINI routine may legitimately succeed even though the module is likely
to be used soon again, for example: exec_script. Add a MODULE_CMD_AUTOUNLOAD
to query whether a module wants to avoid autounload.

- If the system encounters a severe memory shortage, start unloading
unused kernel modules.
- Try to unload any autoloaded kernel modules 10 seconds after their
load was successful.
- Keep a counter to track module load/unload events.

branches: 1.10.2;
- Be clear about whether module load is explicit or system initiated (auto).
- Require that module_lock is held to autoload, so that any preconditions
can be safely checked.

expose module_compatible()

branches: 1.8.4;
- Put in place module compatibility check against __NetBSD_Version__,
as discussed on tech-kern.

- Remove unused module_jettison().

If autoloading a module, don't consider the current working directory.

Allow module class to be passed to module_load(), as a basic sanity check
that we are loading the right kind of module.

branches: 1.5.2;
- Add module_find_section(), allows a module to look up data in its object.
- Work around build failure.

Get the pre-loaded module code working.

Remove clause 3 and 4 from TNF licenses

branches: 1.2.2; 1.2.4; 1.2.6;
Add support for load-time parameters for modules, which are passed through
a dictionary. As discussed in tech-kern@.

branches: 1.1.2; 1.1.4; 1.1.6; 1.1.8; 1.1.12;
Pull in my modules code for review/test/hacking.

Define a new module class for the bufq_strategy modules. These need to
be loaded and intialized before autoconfigure runs, since some devices
(like disks and floppy drives) want to call bufq_alloc().

Fix dlopen()/dlclose()+RUMP_USE_CTOR to not leave dangling pointers around.

Export module flags to userland

Make module_machine const char *

Make handle_modctl_load() usable from compat/netbsd32.

use __COMPAT so that we get argument expansion.

branches: 1.35.4;
Add a RUMP_USE_CTOR compile-time switch. If defined, use
__attribute__((constructor)) to determine which rump kernel components
and kernel modules are linked into the rump kernel. If not defined
(default), use the regular approach with link sets.

This option is aimed to fix problems with toolchains where using link
sets is not possible because the linker does not generate the requisite
__start/__stop symbols for the link set sections (e.g. GNU gold, OS X, ...).

branches: 1.34.2;
use MODULE_CLASS_MISC for Lua modules

add MODULE_CLASS_LUA_BINDING

branches: 1.32.2;
Correct spelling: entrie -> entry.

branches: 1.31.2;
Add -A, -a, and -e options to modstat(8) along with kernel
changes required to support these options. The -e option was
requested by martin@ in private chat in order to make writing tests
easier (i.e. don't bother testing MODULAR functionaility if it
doesn't exist). While there, I added -A and -a since those were
quite similar.

-A Tells you whether or not modules can be autoloaded at the moment.
This option does take into consideration the sysctl
kern.module.autoload.

-a Tells you whether or not modules can be autoloaded at the moment.
This option does not take into consideration the sysctl
kern.module.autoload.

-e Tells you whether or not you may load a module at the moment.

change printf gcc attribute to __printflike(), requested by joerg.

add more missing printf attributes.

branches: 1.28.2;
Don't try to auto-unload modules unless they were auto-loaded.

Always provide a meaningful short name for the kobj in the error message,
as well as the function name and the linenumber, without extra line feeds.

add a "module_machine", that defaults to machine.
allows MD code to override the default subdir for modules.

branches: 1.25.2;
Define a set of new kernel locking primitives to implement the recursive
kernconfig_mutex. Update module subsystem to use this mutex rather than
its own internal (non-recursive) mutex. Make module_autoload() do its
own locking to be consistent with the rest of the module_xxx() calls.
Update module(9) man page appropriately.

As discussed on tech-kern over the last few weeks.

Welcome to NetBSD 5.99.39 !

1. Add an allocator for 'struct module *' and use it instead of local
allocations.

2. Add a new member mod_flags to the 'struct module *' and define
MODFLG_MUST_FORCE. If this flag is set and the entry is on the list
of builtins, it means that the module has been explicitly unloaded
and any re-loads will require the MODCTL_LOAD_FORCE flag. Provide a
module_require_force() method to set this flag; once set, it should
never be unset.

3. Rename original module_init2() to module_start_unload_thread() to be
more descriptive of what it does.

4. Add a new module_builtin_require_force() routine that sets the
MODFLG_MUST_FORCE flag for any module that has not yet successfully
been initialized. Call it after module_init_class(MODULE_CLASS_ANY)
to disable remaining built-in modules.

This makes built-in versions of the xxxVERBOSE modules work once more,
resolving breakage reported by jruoho@ and njoly@.

Discussed on tech-kern, and comments and suggestions implemented. No
additional discussion for last week. Tested only on amd64 systems, but
there's nothing here that should be port- or architecture-specific (no
more specific than existing module implementation) so others should not
break.

Protect against attempting to load modules from the filesystem until we
have mounted the root file-system. This allows us to load built-in and
boot-loader-provided modules much earlier during startup.

Allow everyone in the kernel to see module_base.

branches: 1.21.2;
DTrace: Add the Function Boundary Trace (FBT) provider moduile. This
module instruments every function in the kernel with entry and exit
probes. These probes are true zero-effect probes in that they don't
exist in the code until they are enabled. The probes are enabled by
directly patching the function entry and exit points to make jumps into
the dtrace framework.
This gives us over 29,000 trace points in the kernel.

Make module_{lookup,enqueue}() static now that it's possible again
(effectively reverts my kern_module rev. 1.53 from some months ago)

Move builtin modules to a list in init and load them from there
instead of using linksets directly. This has two implications:

1) It is now possible to "unload" a builtin module provided it is
not busy. This is useful e.g. to disable a kernel feature as
an immediate workaround to a security problem. To re-initialize
the module, modload -f <name> is required.
2) It is possible to use builtin modules which were linked at
runtime with an external linker (dlopen + rump).

branches: 1.18.2;
* make it possible to include kern_module in a kernel without vfs
support, i.e. move vfs functionality to a separate module
(kern_module_vfs.c)
* make module proplist size an MI constant (now 8k) instead of PAGE_SIZE
* change some error values to something else than the karmic EINVAL

expose module_{lookup,enqueue}()

First part of secmodel cleanup and other misc. changes:

- Separate the suser part of the bsd44 secmodel into its own secmodel
and directory, pending even more cleanups. For revision history
purposes, the original location of the files was

src/sys/secmodel/bsd44/secmodel_bsd44_suser.c
src/sys/secmodel/bsd44/suser.h

- Add a man-page for secmodel_suser(9) and update the one for
secmodel_bsd44(9).

- Add a "secmodel" module class and use it. Userland program and
documentation updated.

- Manage secmodel count (nsecmodels) through the module framework.
This eliminates the need for secmodel_{,de}register() calls in
secmodel code.

- Prepare for secmodel modularization by adding relevant module bits.
The secmodels don't allow auto unload. The bsd44 secmodel depends
on the suser and securelevel secmodels. The overlay secmodel depends
on the bsd44 secmodel. As the module class is only cosmetic, and to
prevent ambiguity, the bsd44 and overlay secmodels are prefixed with
"secmodel_".

- Adapt the overlay secmodel to recent changes (mainly vnode scope).

- Stop using link-sets for the sysctl node(s) creation.

- Keep sysctl variables under nodes of their relevant secmodels. In
other words, don't create duplicates for the suser/securelevel
secmodels under the bsd44 secmodel, as the latter is merely used
for "grouping".

- For the suser and securelevel secmodels, "advertise presence" in
relevant sysctl nodes (sysctl.security.models.{suser,securelevel}).

- Get rid of the LKM preprocessor stuff.

- As secmodels are now modules, there's no need for an explicit call
to secmodel_start(); it's handled by the module framework. That
said, the module framework was adjusted to properly load secmodels
early during system startup.

- Adapt rump to changes: Instead of using empty stubs for securelevel,
simply use the suser secmodel. Also replace secmodel_start() with a
call to secmodel_suser_start().

- 5.99.20.

Testing was done on i386 ("release" build). Spearated module_init()
changes were tested on sparc and sparc64 as well by martin@ (thanks!).

Mailing list reference:

http://mail-index.netbsd.org/tech-kern/2009/09/25/msg006135.html

Add the MODCTL_NO_PROP flag to tell the kernel to ignore <module>.prop.

Add the '-P' option to modload(8) to set this flag.

branches: 1.14.4;
Add some basic DDB stuff for modules.

Unused header.

Some modules may want to avoid autounload because their use is transient.
Their FINI routine may legitimately succeed even though the module is likely
to be used soon again, for example: exec_script. Add a MODULE_CMD_AUTOUNLOAD
to query whether a module wants to avoid autounload.

- If the system encounters a severe memory shortage, start unloading
unused kernel modules.
- Try to unload any autoloaded kernel modules 10 seconds after their
load was successful.
- Keep a counter to track module load/unload events.

branches: 1.10.2;
- Be clear about whether module load is explicit or system initiated (auto).
- Require that module_lock is held to autoload, so that any preconditions
can be safely checked.

expose module_compatible()

branches: 1.8.4;
- Put in place module compatibility check against __NetBSD_Version__,
as discussed on tech-kern.

- Remove unused module_jettison().

If autoloading a module, don't consider the current working directory.

Allow module class to be passed to module_load(), as a basic sanity check
that we are loading the right kind of module.

branches: 1.5.2;
- Add module_find_section(), allows a module to look up data in its object.
- Work around build failure.

Get the pre-loaded module code working.

Remove clause 3 and 4 from TNF licenses

branches: 1.2.2; 1.2.4; 1.2.6;
Add support for load-time parameters for modules, which are passed through
a dictionary. As discussed in tech-kern@.

branches: 1.1.2; 1.1.4; 1.1.6; 1.1.8; 1.1.12;
Pull in my modules code for review/test/hacking.