feat: add /sys/module

One directory per loaded kernel extension, carrying the attribute files
Linux exposes: refcnt, coresize, version and initstate.

Structurally this is /sys/devices again: a single shared SFSmodule node
backs every module directory, with the kext's OSBundleLoadTag standing in
nodeid_regid - unique among loaded kexts and stable while one stays
loaded, the role IORegistryEntryID plays for a device - and
nodeid_objectid selecting either the directory itself or one attribute.

The kext list is captured on the refresh thread with the registry
snapshot, never in a vnop: OSKext::copyLoadedKextInfo() takes the kext
lock and builds a dictionary describing every loaded kext, far too heavy
and too lock-entangled to run while holding VFS locks. It is asked for
only the four keys published rather than the full per-kext dictionary, to
keep the work - and the time the kext lock is held - proportional to what
is actually used.

initstate always reads "live": a kext in the loaded-kext list has
finished starting, and Linux's transient coming/going states have no
observable equivalent.

Author: somestupidgirl

include/fs/sysfs/sysfs.h

@@ -177,6 +177,14 @@ typedef int (*sysfs_read_data_fn)(sfsnode_t *snp, uio_t uio, vfs_context_t ctx);
  */
 #define SSN_FLAG_WHOLE_ONLY (1 << 1)
 
+/*
+ * The directory expands to the list of loaded kernel extensions (/sys/module).
+ * Like SSN_FLAG_DYNAMIC this marks the directory itself; its single SFSmodule
+ * child is the shared node every module is presented through, distinguished
+ * per-vnode by the module's load tag.
+ */
+#define SSN_FLAG_MODULES    (1 << 2)
+
 /*
  * Special values for the nodeid_regid and nodeid_objectid fields.
  */

include/fs/sysfs/sysfs_iokit.h

@@ -125,6 +125,41 @@ int sysfs_iokit_class_child_named(uint32_t class_id, uint32_t match_flags,
  */
 size_t sysfs_iokit_path(uint64_t regid, char *buf, size_t buflen);
 
+/*
+ * Loaded kernel extensions, for /sys/module.
+ *
+ * The kext list is captured with the registry snapshot on the refresh thread,
+ * never in a vnop: OSKext::copyLoadedKextInfo() takes the kext lock and builds
+ * a dictionary describing every loaded kext, far too heavy - and too
+ * lock-entangled - to do while holding VFS locks. These accessors only read the
+ * published snapshot.
+ *
+ * load_tag is the kext's OSBundleLoadTag: unique among loaded kexts and stable
+ * while the kext stays loaded, so it keys a /sys/module node the way
+ * IORegistryEntryID keys a /sys/devices node.
+ */
+struct sysfs_module_info {
+    uint64_t load_tag;
+    uint64_t load_size;       /* OSBundleLoadSize, bytes */
+    uint64_t refcnt;          /* OSBundleRetainCount */
+    char     name[128];       /* CFBundleIdentifier */
+    char     version[32];     /* CFBundleVersion */
+};
+
+/*
+ * Fill *out with the index-th loaded kext; returns 1 while modules remain, 0
+ * past the end. Enumeration order is whatever the kext list yields and is
+ * stable for the life of one snapshot.
+ */
+int sysfs_iokit_module_at(unsigned int index, struct sysfs_module_info *out);
+
+/* Resolve a module by bundle identifier. Returns 1 if found. */
+int sysfs_iokit_module_named(const char *name, size_t namelen,
+                             struct sysfs_module_info *out);
+
+/* Resolve a module by its load tag (the per-node key). Returns 1 if found. */
+int sysfs_iokit_module_by_tag(uint64_t load_tag, struct sysfs_module_info *out);
+
 #ifdef __cplusplus
 }
 #endif

kext/sysfs_iokit.cpp

@@ -30,6 +30,30 @@
 #include <libkern/c++/OSIterator.h>
 #include <libkern/c++/OSBoolean.h>
 #include <libkern/c++/OSString.h>
+#include <libkern/c++/OSSymbol.h>
+#include <libkern/c++/OSNumber.h>
+#include <libkern/c++/OSArray.h>
+#include <libkern/c++/OSDictionary.h>
+#include <libkern/c++/OSCollectionIterator.h>
+
+/*
+ * OSKext::copyLoadedKextInfo() is declared here rather than by including
+ * <libkern/c++/OSKext.h>, which is unusable from a kext build: it pulls in
+ * <libkern/OSKextLibPrivate.h>, a private header the SDK does not ship. A
+ * one-method declaration is enough - a static member call mangles from the
+ * class name and parameter types alone, so this emits exactly the same symbol
+ * reference the real header would, without vendoring private headers.
+ *
+ * The return type is spelled OSDictionary* because OSPtr<T> is a plain T* in
+ * kext builds, and the return type takes no part in C++ mangling regardless.
+ *
+ * Caller owns a reference to the returned dictionary.
+ */
+class OSKext {
+public:
+    static OSDictionary *copyLoadedKextInfo(OSArray *kextIdentifiers,
+                                            OSArray *keys);
+};
 #include <libkern/libkern.h>
 
 #include <string.h>
@@ -47,6 +71,12 @@ extern "C" {
 #define SYSFS_IOKIT_BSDNAMEMAX 32
 /* Sanity cap on service-plane entries in one snapshot. */
 #define SYSFS_IOKIT_MAXNODES  16384u
+
+/*
+ * Upper bound on loaded kexts recorded for /sys/module. A running system has a
+ * few hundred; the cap only stops a pathological case from unbounded growth.
+ */
+#define SYSFS_IOKIT_MAXMODULES 1024u
 /* How long a snapshot is reused before a rebuild (ns). */
 #define SYSFS_SNAP_TTL_NS     2000000000ULL   /* 2 seconds */
 
@@ -105,7 +135,30 @@ struct sysfs_hash_slot {
 };
 
 /* Container holding a full self-contained IOKit registry snapshot */
+/*
+ * One loaded kernel extension, as presented under /sys/module/<name>.
+ *
+ * Captured on the refresh thread with the rest of the snapshot, never in a
+ * vnop: OSKext::copyLoadedKextInfo() takes the kext lock and builds a
+ * dictionary describing every loaded kext, which is far too heavy - and too
+ * lock-entangled - to do while holding VFS locks.
+ *
+ * load_tag is the kext's OSBundleLoadTag: unique among loaded kexts and stable
+ * for as long as the kext stays loaded, which makes it the natural per-node key
+ * (the same role IORegistryEntryID plays for /sys/devices).
+ */
+struct sysfs_snap_module {
+    uint64_t load_tag;
+    uint64_t load_size;                 /* OSBundleLoadSize, bytes */
+    uint64_t refcnt;                    /* OSBundleRetainCount */
+    char     name[128];                 /* CFBundleIdentifier */
+    char     version[32];               /* CFBundleVersion */
+};
+
 struct sysfs_snapshot {
+    struct sysfs_snap_module *modules;
+    uint32_t                  module_count;
+    uint32_t                  module_cap;
     struct sysfs_snap_node *nodes;
     uint32_t               *child_idx;
     struct sysfs_hash_slot *hash;
@@ -217,6 +270,10 @@ sysfs_snap_free(struct sysfs_snapshot *snap)
     if (snap == nullptr) {
         return;
     }
+    if (snap->modules != nullptr) {
+        sysfs_free(snap->modules,
+                   (size_t)snap->module_cap * sizeof(*snap->modules));
+    }
     if (snap->nodes != nullptr) {
         sysfs_free(snap->nodes, (size_t)snap->node_cap * sizeof(*snap->nodes));
     }
@@ -300,6 +357,109 @@ sysfs_count_entries(void)
 }
 
 
+
+/*
+ * Capture the loaded kext list into the snapshot, for /sys/module.
+ *
+ * copyLoadedKextInfo() is asked for only the four keys we publish rather than
+ * the full per-kext dictionary, which keeps the work (and the time the kext
+ * lock is held) proportional to what we actually use. A kext missing any of
+ * them is still listed - the value simply reads as zero or empty - because a
+ * present-but-incomplete module is more useful than a hidden one.
+ *
+ * Failure here is never fatal: the snapshot is published regardless and
+ * /sys/module reads as empty, exactly as it does before the first refresh.
+ */
+static void
+sysfs_snap_build_modules(struct sysfs_snapshot *snap)
+{
+    static const char * const wanted[] = {
+        "OSBundleLoadTag",
+        "OSBundleLoadSize",
+        "OSBundleRetainCount",
+        "CFBundleVersion",
+    };
+
+    OSArray *keys = OSArray::withCapacity(4);
+    if (keys == nullptr) {
+        return;
+    }
+    for (unsigned i = 0; i < 4; i++) {
+        const OSSymbol *sym = OSSymbol::withCString(wanted[i]);
+        if (sym != nullptr) {
+            keys->setObject(const_cast<OSSymbol *>(sym));
+            sym->release();
+        }
+    }
+
+    OSDictionary *info = OSKext::copyLoadedKextInfo(nullptr, keys);
+    keys->release();
+    if (info == nullptr) {
+        return;
+    }
+
+    uint32_t cap = info->getCount();
+    if (cap == 0) {
+        info->release();
+        return;
+    }
+    if (cap > SYSFS_IOKIT_MAXMODULES) {
+        cap = SYSFS_IOKIT_MAXMODULES;
+    }
+
+    size_t bytes = (size_t)cap * sizeof(struct sysfs_snap_module);
+    struct sysfs_snap_module *arr =
+        (struct sysfs_snap_module *)sysfs_alloc(bytes);
+    if (arr == nullptr) {
+        info->release();
+        return;
+    }
+
+    OSCollectionIterator *it = OSCollectionIterator::withCollection(info);
+    if (it == nullptr) {
+        sysfs_free(arr, bytes);
+        info->release();
+        return;
+    }
+
+    uint32_t n = 0;
+    OSObject *k;
+    while ((k = it->getNextObject()) != nullptr && n < cap) {
+        OSString *ident = OSDynamicCast(OSString, k);
+        if (ident == nullptr) {
+            continue;
+        }
+        OSDictionary *kd = OSDynamicCast(OSDictionary, info->getObject(ident));
+        if (kd == nullptr) {
+            continue;
+        }
+
+        struct sysfs_snap_module *m = &arr[n];
+        strlcpy(m->name, ident->getCStringNoCopy(), sizeof(m->name));
+
+        OSNumber *num = OSDynamicCast(OSNumber, kd->getObject("OSBundleLoadTag"));
+        m->load_tag = (num != nullptr) ? num->unsigned64BitValue() : 0;
+        num = OSDynamicCast(OSNumber, kd->getObject("OSBundleLoadSize"));
+        m->load_size = (num != nullptr) ? num->unsigned64BitValue() : 0;
+        num = OSDynamicCast(OSNumber, kd->getObject("OSBundleRetainCount"));
+        m->refcnt = (num != nullptr) ? num->unsigned64BitValue() : 0;
+
+        OSString *ver = OSDynamicCast(OSString, kd->getObject("CFBundleVersion"));
+        if (ver != nullptr) {
+            strlcpy(m->version, ver->getCStringNoCopy(), sizeof(m->version));
+        }
+        n++;
+    }
+    it->release();
+    info->release();
+
+    snap->modules      = arr;
+    snap->module_cap   = cap;
+    snap->module_count = n;
+    snap->bytes       += bytes;
+    OSAddAtomic64((int64_t)bytes, &sysfs_stat_snap_bytes);
+}
+
 /* Builds a fresh snapshot completely in isolation without holding global locks. */
 static struct sysfs_snapshot *
 sysfs_snap_build(void)
@@ -534,6 +694,8 @@ sysfs_snap_build(void)
         }
     }
 
+    sysfs_snap_build_modules(snap);
+
     clock_get_uptime(&snap->uptime);
     return snap;
 }
@@ -984,3 +1146,83 @@ sysfs_iokit_name(uint64_t regid, char *buf, size_t buflen)
     IOLockUnlock(g_lock);
     return n;
 }
+
+#pragma mark - loaded kernel extensions (/sys/module)
+
+/*
+ * Copy one snapshot module record out to the caller. Must hold g_lock.
+ */
+static void
+sysfs_module_copy_out(const struct sysfs_snap_module *m,
+                      struct sysfs_module_info *out)
+{
+    out->load_tag  = m->load_tag;
+    out->load_size = m->load_size;
+    out->refcnt    = m->refcnt;
+    strlcpy(out->name, m->name, sizeof(out->name));
+    strlcpy(out->version, m->version, sizeof(out->version));
+}
+
+extern "C" int
+sysfs_iokit_module_at(unsigned int index, struct sysfs_module_info *out)
+{
+    if (out == nullptr || g_lock == nullptr) {
+        return 0;
+    }
+    sysfs_snap_ensure();
+    IOLockLock(g_lock);
+    int ok = 0;
+    if (g_snapshot != nullptr && g_snapshot->modules != nullptr &&
+        index < g_snapshot->module_count) {
+        sysfs_module_copy_out(&g_snapshot->modules[index], out);
+        ok = 1;
+    }
+    IOLockUnlock(g_lock);
+    return ok;
+}
+
+extern "C" int
+sysfs_iokit_module_named(const char *name, size_t namelen,
+                         struct sysfs_module_info *out)
+{
+    if (name == nullptr || out == nullptr || g_lock == nullptr) {
+        return 0;
+    }
+    sysfs_snap_ensure();
+    IOLockLock(g_lock);
+    int ok = 0;
+    if (g_snapshot != nullptr && g_snapshot->modules != nullptr) {
+        for (uint32_t i = 0; i < g_snapshot->module_count; i++) {
+            const char *nm = g_snapshot->modules[i].name;
+            if (strlen(nm) == namelen && strncmp(nm, name, namelen) == 0) {
+                sysfs_module_copy_out(&g_snapshot->modules[i], out);
+                ok = 1;
+                break;
+            }
+        }
+    }
+    IOLockUnlock(g_lock);
+    return ok;
+}
+
+extern "C" int
+sysfs_iokit_module_by_tag(uint64_t load_tag, struct sysfs_module_info *out)
+{
+    if (out == nullptr || g_lock == nullptr) {
+        return 0;
+    }
+    sysfs_snap_ensure();
+    IOLockLock(g_lock);
+    int ok = 0;
+    if (g_snapshot != nullptr && g_snapshot->modules != nullptr) {
+        for (uint32_t i = 0; i < g_snapshot->module_count; i++) {
+            if (g_snapshot->modules[i].load_tag == load_tag) {
+                sysfs_module_copy_out(&g_snapshot->modules[i], out);
+                ok = 1;
+                break;
+            }
+        }
+    }
+    IOLockUnlock(g_lock);
+    return ok;
+}

kext/sysfs_structure.c

@@ -305,7 +305,18 @@ sysfs_structure_init(void)
         (void)add_directory(root_node, "hypervisor", SFSdir, next_node_id++, 0, 0, NULL, NULL);
         sfssnode_t *kernel_dir =
             add_directory(root_node, "kernel",     SFSdir, next_node_id++, 0, 0, NULL, NULL);
-        (void)add_directory(root_node, "module",     SFSdir, next_node_id++, 0, 0, NULL, NULL);
+        /*
+         * /sys/module/<name>/ - one directory per loaded kernel extension, with
+         * the attribute files Linux exposes (refcnt, coresize, initstate,
+         * version). The directory is dynamic and its single SFSmodule child is
+         * the shared marker every module is presented through; which module a
+         * node is stands in its load tag, exactly as a registry id identifies a
+         * /sys/devices node.
+         */
+        sfssnode_t *module_dir = add_directory(root_node, "module",
+                        SFSdir, next_node_id++, SSN_FLAG_MODULES, 0, NULL, NULL);
+        (void)add_node(module_dir, "__member__", SFSmodule, next_node_id++,
+                        SSN_FLAG_MODULES, 0, NULL, NULL);
         (void)add_directory(root_node, "power",      SFSdir, next_node_id++, 0, 0, NULL, NULL);
 
         /*

kext/sysfs_subr.c

@@ -31,9 +31,16 @@ sysfs_allocvp(sfstype sfs_type)
     case SFSsubsystem:
         return VDIR;
 
-    case SFSfile:           /* FALLTHROUGH */
-    case SFSattr:           /* FALLTHROUGH */
     case SFSmodule:
+        /*
+         * /sys/module/<name> is a directory, as on Linux. Its attribute files
+         * share this node type and are distinguished by nodeid_objectid, which
+         * sysfs_create_vnode() resolves to VREG.
+         */
+        return VDIR;
+
+    case SFSfile:           /* FALLTHROUGH */
+    case SFSattr:
         return VREG;
 
     case SFSlink: