1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 
  22 /*
  23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
  24  * Use is subject to license terms.
  25  */
  26 /*
  27  * Copyright 2018 Joyent, Inc.
  28  * Copyright (c) 2014 by Delphix. All rights reserved.
  29  */
  30 
  31 /*
  32  * User Process Target
  33  *
  34  * The user process target is invoked when the -u or -p command-line options
  35  * are used, or when an ELF executable file or ELF core file is specified on
  36  * the command-line.  This target is also selected by default when no target
  37  * options are present.  In this case, it defaults the executable name to
  38  * "a.out".  If no process or core file is currently attached, the target
  39  * functions as a kind of virtual /dev/zero (in accordance with adb(1)
  40  * semantics); reads from the virtual address space return zeroes and writes
  41  * fail silently.  The proc target itself is designed as a wrapper around the
  42  * services provided by libproc.so: t->t_pshandle is set to the struct
  43  * ps_prochandle pointer returned as a handle by libproc.  The target also
  44  * opens the executable file itself using the MDB GElf services, for
  45  * interpreting the .symtab and .dynsym if no libproc handle has been
  46  * initialized, and for handling i/o to and from the object file.  Currently,
  47  * the only ISA-dependent portions of the proc target are the $r and ::fpregs
  48  * dcmds, the callbacks for t_next() and t_step_out(), and the list of named
  49  * registers; these are linked in from the proc_isadep.c file for each ISA and
  50  * called from the common code in this file.
  51  *
  52  * The user process target implements complete user process control using the
  53  * facilities provided by libproc.so.  The MDB execution control model and
  54  * an overview of software event management is described in mdb_target.c.  The
  55  * proc target implements breakpoints by replacing the instruction of interest
  56  * with a trap instruction, and then restoring the original instruction to step
  57  * over the breakpoint.  The idea of replacing program text with instructions
  58  * that transfer control to the debugger dates back as far as 1951 [1].  When
  59  * the target stops, we replace each breakpoint with the original instruction
  60  * as part of the disarm operation.  This means that no special processing is
  61  * required for t_vread() because the instrumented instructions will never be
  62  * seen by the debugger once the target stops.  Some debuggers have improved
  63  * start/stop performance by leaving breakpoint traps in place and then
  64  * handling a read from a breakpoint address as a special case.  Although this
  65  * improves efficiency for a source-level debugger, it runs somewhat contrary
  66  * to the philosophy of the low-level debugger.  Since we remove the
  67  * instructions, users can apply other external debugging tools to the process
  68  * once it has stopped (e.g. the proc(1) tools) and not be misled by MDB
  69  * instrumentation.  The tracing of faults, signals, system calls, and
  70  * watchpoints and general process inspection is implemented directly using
  71  * the mechanisms provided by /proc, as described originally in [2] and [3].
  72  *
  73  * References
  74  *
  75  * [1] S. Gill, "The Diagnosis Of Mistakes In Programmes on the EDSAC",
  76  *     Proceedings of the Royal Society Series A Mathematical and Physical
  77  *     Sciences, Cambridge University Press, 206(1087), May 1951, pp. 538-554.
  78  *
  79  * [2] T.J. Killian, "Processes as Files", Proceedings of the USENIX Association
  80  *     Summer Conference, Salt Lake City, June 1984, pp. 203-207.
  81  *
  82  * [3] Roger Faulkner and Ron Gomes, "The Process File System and Process
  83  *     Model in UNIX System V", Proceedings of the USENIX Association
  84  *     Winter Conference, Dallas, January 1991, pp. 243-252.
  85  */
  86 
  87 #include <mdb/mdb_proc.h>
  88 #include <mdb/mdb_disasm.h>
  89 #include <mdb/mdb_signal.h>
  90 #include <mdb/mdb_string.h>
  91 #include <mdb/mdb_module.h>
  92 #include <mdb/mdb_debug.h>
  93 #include <mdb/mdb_conf.h>
  94 #include <mdb/mdb_err.h>
  95 #include <mdb/mdb_types.h>
  96 #include <mdb/mdb.h>
  97 
  98 #include <sys/utsname.h>
  99 #include <sys/wait.h>
 100 #include <sys/stat.h>
 101 #include <termio.h>
 102 #include <signal.h>
 103 #include <stdio_ext.h>
 104 #include <stdlib.h>
 105 #include <string.h>
 106 
 107 #define PC_FAKE         -1UL                    /* illegal pc value unequal 0 */
 108 #define PANIC_BUFSIZE   1024
 109 
 110 static const char PT_EXEC_PATH[] = "a.out";     /* Default executable */
 111 static const char PT_CORE_PATH[] = "core";      /* Default core file */
 112 
 113 static const pt_ptl_ops_t proc_lwp_ops;
 114 static const pt_ptl_ops_t proc_tdb_ops;
 115 static const mdb_se_ops_t proc_brkpt_ops;
 116 static const mdb_se_ops_t proc_wapt_ops;
 117 
 118 static int pt_setrun(mdb_tgt_t *, mdb_tgt_status_t *, int);
 119 static void pt_activate_common(mdb_tgt_t *);
 120 static mdb_tgt_vespec_f pt_ignore_sig;
 121 static mdb_tgt_se_f pt_fork;
 122 static mdb_tgt_se_f pt_exec;
 123 
 124 static int pt_lookup_by_name_thr(mdb_tgt_t *, const char *,
 125     const char *, GElf_Sym *, mdb_syminfo_t *, mdb_tgt_tid_t);
 126 static int tlsbase(mdb_tgt_t *, mdb_tgt_tid_t, Lmid_t, const char *,
 127     psaddr_t *);
 128 
 129 /*
 130  * When debugging postmortem, we don't resolve names as we may very well not
 131  * be on a system on which those names resolve.
 132  */
 133 #define PT_LIBPROC_RESOLVE(P) \
 134         (!(mdb.m_flags & MDB_FL_LMRAW) && Pstate(P) != PS_DEAD)
 135 
 136 /*
 137  * The Perror_printf() function interposes on the default, empty libproc
 138  * definition.  It will be called to report additional information on complex
 139  * errors, such as a corrupt core file.  We just pass the args to vwarn.
 140  */
 141 /*ARGSUSED*/
 142 void
 143 Perror_printf(struct ps_prochandle *P, const char *format, ...)
 144 {
 145         va_list alist;
 146 
 147         va_start(alist, format);
 148         vwarn(format, alist);
 149         va_end(alist);
 150 }
 151 
 152 /*
 153  * Open the specified i/o backend as the a.out executable file, and attempt to
 154  * load its standard and dynamic symbol tables.  Note that if mdb_gelf_create
 155  * succeeds, io is assigned to p_fio and is automatically held by gelf_create.
 156  */
 157 static mdb_gelf_file_t *
 158 pt_open_aout(mdb_tgt_t *t, mdb_io_t *io)
 159 {
 160         pt_data_t *pt = t->t_data;
 161         GElf_Sym s1, s2;
 162 
 163         if ((pt->p_file = mdb_gelf_create(io, ET_NONE, GF_FILE)) == NULL)
 164                 return (NULL);
 165 
 166         pt->p_symtab = mdb_gelf_symtab_create_file(pt->p_file,
 167             SHT_SYMTAB, MDB_TGT_SYMTAB);
 168         pt->p_dynsym = mdb_gelf_symtab_create_file(pt->p_file,
 169             SHT_DYNSYM, MDB_TGT_DYNSYM);
 170 
 171         /*
 172          * If we've got an _start symbol with a zero size, prime the private
 173          * symbol table with a copy of _start with its size set to the distance
 174          * between _mcount and _start.  We do this because DevPro has shipped
 175          * the Intel crt1.o without proper .size directives for years, which
 176          * precludes proper identification of _start in stack traces.
 177          */
 178         if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, "_start", &s1,
 179             NULL) == 0 && s1.st_size == 0 &&
 180             GELF_ST_TYPE(s1.st_info) == STT_FUNC) {
 181                 if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, "_mcount",
 182                     &s2, NULL) == 0 && GELF_ST_TYPE(s2.st_info) == STT_FUNC) {
 183                         s1.st_size = s2.st_value - s1.st_value;
 184                         mdb_gelf_symtab_insert(mdb.m_prsym, "_start", &s1);
 185                 }
 186         }
 187 
 188         pt->p_fio = io;
 189         return (pt->p_file);
 190 }
 191 
 192 /*
 193  * Destroy the symbol tables and GElf file object associated with p_fio.  Note
 194  * that we do not need to explicitly free p_fio: its reference count is
 195  * automatically decremented by mdb_gelf_destroy, which will free it if needed.
 196  */
 197 static void
 198 pt_close_aout(mdb_tgt_t *t)
 199 {
 200         pt_data_t *pt = t->t_data;
 201 
 202         if (pt->p_symtab != NULL) {
 203                 mdb_gelf_symtab_destroy(pt->p_symtab);
 204                 pt->p_symtab = NULL;
 205         }
 206 
 207         if (pt->p_dynsym != NULL) {
 208                 mdb_gelf_symtab_destroy(pt->p_dynsym);
 209                 pt->p_dynsym = NULL;
 210         }
 211 
 212         if (pt->p_file != NULL) {
 213                 mdb_gelf_destroy(pt->p_file);
 214                 pt->p_file = NULL;
 215         }
 216 
 217         mdb_gelf_symtab_delete(mdb.m_prsym, "_start", NULL);
 218         pt->p_fio = NULL;
 219 }
 220 
 221 typedef struct tdb_mapping {
 222         const char *tm_thr_lib;
 223         const char *tm_db_dir;
 224         const char *tm_db_name;
 225 } tdb_mapping_t;
 226 
 227 static const tdb_mapping_t tdb_map[] = {
 228         { "/lwp/amd64/libthread.so",    "/usr/lib/lwp/", "libthread_db.so" },
 229         { "/lwp/sparcv9/libthread.so",  "/usr/lib/lwp/", "libthread_db.so" },
 230         { "/lwp/libthread.so",          "/usr/lib/lwp/", "libthread_db.so" },
 231         { "/libthread.so",              "/lib/", "libthread_db.so" },
 232         { "/libc_hwcap",                "/lib/", "libc_db.so" },
 233         { "/libc.so",                   "/lib/", "libc_db.so" }
 234 };
 235 
 236 /*
 237  * Pobject_iter callback that we use to search for the presence of libthread in
 238  * order to load the corresponding libthread_db support.  We derive the
 239  * libthread_db path dynamically based on the libthread path.  If libthread is
 240  * found, this function returns 1 (and thus Pobject_iter aborts and returns 1)
 241  * regardless of whether it was successful in loading the libthread_db support.
 242  * If we iterate over all objects and no libthread is found, 0 is returned.
 243  * Since libthread_db support was then merged into libc_db, we load either
 244  * libc_db or libthread_db, depending on which library we see first.
 245  */
 246 /*ARGSUSED*/
 247 static int
 248 thr_check(mdb_tgt_t *t, const prmap_t *pmp, const char *name)
 249 {
 250         pt_data_t *pt = t->t_data;
 251         const mdb_tdb_ops_t *ops;
 252         char *p;
 253 
 254         char path[MAXPATHLEN];
 255 
 256         int libn;
 257 
 258         if (name == NULL)
 259                 return (0); /* no rtld_db object name; keep going */
 260 
 261         for (libn = 0; libn < sizeof (tdb_map) / sizeof (tdb_map[0]); libn++) {
 262                 if ((p = strstr(name, tdb_map[libn].tm_thr_lib)) != NULL)
 263                         break;
 264         }
 265 
 266         if (p == NULL)
 267                 return (0); /* no match; keep going */
 268 
 269         path[0] = '\0';
 270         (void) strlcat(path, mdb.m_root, sizeof (path));
 271         (void) strlcat(path, tdb_map[libn].tm_db_dir, sizeof (path));
 272 #if !defined(_ILP32)
 273         (void) strlcat(path, "64/", sizeof (path));
 274 #endif /* !_ILP32 */
 275         (void) strlcat(path, tdb_map[libn].tm_db_name, sizeof (path));
 276 
 277         /* Append the trailing library version number. */
 278         (void) strlcat(path, strrchr(name, '.'), sizeof (path));
 279 
 280         if ((ops = mdb_tdb_load(path)) == NULL) {
 281                 if (libn != 0 || errno != ENOENT)
 282                         warn("failed to load %s", path);
 283                 goto err;
 284         }
 285 
 286         if (ops == pt->p_tdb_ops)
 287                 return (1); /* no changes needed */
 288 
 289         PTL_DTOR(t);
 290         pt->p_tdb_ops = ops;
 291         pt->p_ptl_ops = &proc_tdb_ops;
 292         pt->p_ptl_hdl = NULL;
 293 
 294         if (PTL_CTOR(t) == -1) {
 295                 warn("failed to initialize %s", path);
 296                 goto err;
 297         }
 298 
 299         mdb_dprintf(MDB_DBG_TGT, "loaded %s for debugging %s\n", path, name);
 300         (void) mdb_tgt_status(t, &t->t_status);
 301         return (1);
 302 err:
 303         PTL_DTOR(t);
 304         pt->p_tdb_ops = NULL;
 305         pt->p_ptl_ops = &proc_lwp_ops;
 306         pt->p_ptl_hdl = NULL;
 307 
 308         if (libn != 0 || errno != ENOENT) {
 309                 warn("warning: debugger will only be able to "
 310                     "examine raw LWPs\n");
 311         }
 312 
 313         (void) mdb_tgt_status(t, &t->t_status);
 314         return (1);
 315 }
 316 
 317 /*
 318  * Whenever the link map is consistent following an add or delete event, we ask
 319  * libproc to update its mappings, check to see if we need to load libthread_db,
 320  * and then update breakpoints which have been mapped or unmapped.
 321  */
 322 /*ARGSUSED*/
 323 static void
 324 pt_rtld_event(mdb_tgt_t *t, int vid, void *private)
 325 {
 326         struct ps_prochandle *P = t->t_pshandle;
 327         pt_data_t *pt = t->t_data;
 328         rd_event_msg_t rdm;
 329         int docontinue = 1;
 330 
 331         if (rd_event_getmsg(pt->p_rtld, &rdm) == RD_OK) {
 332 
 333                 mdb_dprintf(MDB_DBG_TGT, "rtld event type 0x%x state 0x%x\n",
 334                     rdm.type, rdm.u.state);
 335 
 336                 if (rdm.type == RD_DLACTIVITY && rdm.u.state == RD_CONSISTENT) {
 337                         mdb_sespec_t *sep, *nsep = mdb_list_next(&t->t_active);
 338                         pt_brkpt_t *ptb;
 339 
 340                         Pupdate_maps(P);
 341 
 342                         if (Pobject_iter(P, (proc_map_f *)thr_check, t) == 0 &&
 343                             pt->p_ptl_ops != &proc_lwp_ops) {
 344                                 mdb_dprintf(MDB_DBG_TGT, "unloading thread_db "
 345                                     "support after dlclose\n");
 346                                 PTL_DTOR(t);
 347                                 pt->p_tdb_ops = NULL;
 348                                 pt->p_ptl_ops = &proc_lwp_ops;
 349                                 pt->p_ptl_hdl = NULL;
 350                                 (void) mdb_tgt_status(t, &t->t_status);
 351                         }
 352 
 353                         for (sep = nsep; sep != NULL; sep = nsep) {
 354                                 nsep = mdb_list_next(sep);
 355                                 ptb = sep->se_data;
 356 
 357                                 if (sep->se_ops == &proc_brkpt_ops &&
 358                                     Paddr_to_map(P, ptb->ptb_addr) == NULL)
 359                                         mdb_tgt_sespec_idle_one(t, sep,
 360                                             EMDB_NOMAP);
 361                         }
 362 
 363                         if (!mdb_tgt_sespec_activate_all(t) &&
 364                             (mdb.m_flags & MDB_FL_BPTNOSYMSTOP) &&
 365                             pt->p_rtld_finished) {
 366                                 /*
 367                                  * We weren't able to activate the breakpoints.
 368                                  * If so requested, we'll return without
 369                                  * calling continue, thus throwing the user into
 370                                  * the debugger.
 371                                  */
 372                                 docontinue = 0;
 373                         }
 374 
 375                         if (pt->p_rdstate == PT_RD_ADD)
 376                                 pt->p_rdstate = PT_RD_CONSIST;
 377                 }
 378 
 379                 if (rdm.type == RD_PREINIT)
 380                         (void) mdb_tgt_sespec_activate_all(t);
 381 
 382                 if (rdm.type == RD_POSTINIT) {
 383                         pt->p_rtld_finished = TRUE;
 384                         if (!mdb_tgt_sespec_activate_all(t) &&
 385                             (mdb.m_flags & MDB_FL_BPTNOSYMSTOP)) {
 386                                 /*
 387                                  * Now that rtld has been initialized, we
 388                                  * should be able to initialize all deferred
 389                                  * breakpoints.  If we can't, don't let the
 390                                  * target continue.
 391                                  */
 392                                 docontinue = 0;
 393                         }
 394                 }
 395 
 396                 if (rdm.type == RD_DLACTIVITY && rdm.u.state == RD_ADD &&
 397                     pt->p_rtld_finished)
 398                         pt->p_rdstate = MAX(pt->p_rdstate, PT_RD_ADD);
 399         }
 400 
 401         if (docontinue)
 402                 (void) mdb_tgt_continue(t, NULL);
 403 }
 404 
 405 static void
 406 pt_post_attach(mdb_tgt_t *t)
 407 {
 408         struct ps_prochandle *P = t->t_pshandle;
 409         const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
 410         pt_data_t *pt = t->t_data;
 411         int hflag = MDB_TGT_SPEC_HIDDEN;
 412 
 413         mdb_dprintf(MDB_DBG_TGT, "attach pr_flags=0x%x pr_why=%d pr_what=%d\n",
 414             psp->pr_flags, psp->pr_why, psp->pr_what);
 415 
 416         /*
 417          * When we grab a process, the initial setting of p_rtld_finished
 418          * should be false if the process was just created by exec; otherwise
 419          * we permit unscoped references to resolve because we do not know how
 420          * far the process has proceeded through linker initialization.
 421          */
 422         if ((psp->pr_flags & PR_ISTOP) && psp->pr_why == PR_SYSEXIT &&
 423             psp->pr_errno == 0 && psp->pr_what == SYS_execve) {
 424                 if (mdb.m_target == NULL) {
 425                         warn("target performed exec of %s\n",
 426                             IOP_NAME(pt->p_fio));
 427                 }
 428                 pt->p_rtld_finished = FALSE;
 429         } else
 430                 pt->p_rtld_finished = TRUE;
 431 
 432         /*
 433          * When we grab a process, if it is stopped by job control and part of
 434          * the same session (i.e. same controlling tty), set MDB_FL_JOBCTL so
 435          * we will know to bring it to the foreground when we continue it.
 436          */
 437         if (mdb.m_term != NULL && (psp->pr_flags & PR_STOPPED) &&
 438             psp->pr_why == PR_JOBCONTROL && getsid(0) == Pstatus(P)->pr_sid)
 439                 mdb.m_flags |= MDB_FL_JOBCTL;
 440 
 441         /*
 442          * When we grab control of a live process, set F_RDWR so that the
 443          * target layer permits writes to the target's address space.
 444          */
 445         t->t_flags |= MDB_TGT_F_RDWR;
 446 
 447         (void) Pfault(P, FLTBPT, TRUE);         /* always trace breakpoints */
 448         (void) Pfault(P, FLTWATCH, TRUE);       /* always trace watchpoints */
 449         (void) Pfault(P, FLTTRACE, TRUE);       /* always trace single-step */
 450 
 451         (void) Punsetflags(P, PR_ASYNC);        /* require synchronous mode */
 452         (void) Psetflags(P, PR_BPTADJ);         /* always adjust eip on x86 */
 453         (void) Psetflags(P, PR_FORK);           /* inherit tracing on fork */
 454 
 455         /*
 456          * Install event specifiers to track fork and exec activities:
 457          */
 458         (void) mdb_tgt_add_sysexit(t, SYS_vfork, hflag, pt_fork, NULL);
 459         (void) mdb_tgt_add_sysexit(t, SYS_forksys, hflag, pt_fork, NULL);
 460         (void) mdb_tgt_add_sysexit(t, SYS_execve, hflag, pt_exec, NULL);
 461 
 462         /*
 463          * Attempt to instantiate the librtld_db agent and set breakpoints
 464          * to track rtld activity.  We will legitimately fail to instantiate
 465          * the rtld_db agent if the target is statically linked.
 466          */
 467         if (pt->p_rtld == NULL && (pt->p_rtld = Prd_agent(P)) != NULL) {
 468                 rd_notify_t rdn;
 469                 rd_err_e err;
 470 
 471                 if ((err = rd_event_enable(pt->p_rtld, TRUE)) != RD_OK) {
 472                         warn("failed to enable rtld_db event tracing: %s\n",
 473                             rd_errstr(err));
 474                         goto out;
 475                 }
 476 
 477                 if ((err = rd_event_addr(pt->p_rtld, RD_PREINIT,
 478                     &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
 479                         (void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
 480                             hflag, pt_rtld_event, NULL);
 481                 } else {
 482                         warn("failed to install rtld_db preinit tracing: %s\n",
 483                             rd_errstr(err));
 484                 }
 485 
 486                 if ((err = rd_event_addr(pt->p_rtld, RD_POSTINIT,
 487                     &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
 488                         (void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
 489                             hflag, pt_rtld_event, NULL);
 490                 } else {
 491                         warn("failed to install rtld_db postinit tracing: %s\n",
 492                             rd_errstr(err));
 493                 }
 494 
 495                 if ((err = rd_event_addr(pt->p_rtld, RD_DLACTIVITY,
 496                     &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
 497                         (void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
 498                             hflag, pt_rtld_event, NULL);
 499                 } else {
 500                         warn("failed to install rtld_db activity tracing: %s\n",
 501                             rd_errstr(err));
 502                 }
 503         }
 504 out:
 505         Pupdate_maps(P);
 506         Psync(P);
 507 
 508         /*
 509          * If librtld_db failed to initialize due to an error or because we are
 510          * debugging a statically linked executable, allow unscoped references.
 511          */
 512         if (pt->p_rtld == NULL)
 513                 pt->p_rtld_finished = TRUE;
 514 
 515         (void) mdb_tgt_sespec_activate_all(t);
 516 }
 517 
 518 /*ARGSUSED*/
 519 static int
 520 pt_vespec_delete(mdb_tgt_t *t, void *private, int id, void *data)
 521 {
 522         if (id < 0) {
 523                 ASSERT(data == NULL); /* we don't use any ve_data */
 524                 (void) mdb_tgt_vespec_delete(t, id);
 525         }
 526         return (0);
 527 }
 528 
 529 static void
 530 pt_pre_detach(mdb_tgt_t *t, int clear_matched)
 531 {
 532         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
 533         pt_data_t *pt = t->t_data;
 534         long cmd = 0;
 535 
 536         /*
 537          * If we are about to release the process and it is stopped on a traced
 538          * SIGINT, breakpoint fault, single-step fault, or watchpoint, make
 539          * sure to clear this event prior to releasing the process so that it
 540          * does not subsequently reissue the fault and die from SIGTRAP.
 541          */
 542         if (psp->pr_flags & PR_ISTOP) {
 543                 if (psp->pr_why == PR_FAULTED && (psp->pr_what == FLTBPT ||
 544                     psp->pr_what == FLTTRACE || psp->pr_what == FLTWATCH))
 545                         cmd = PCCFAULT;
 546                 else if (psp->pr_why == PR_SIGNALLED && psp->pr_what == SIGINT)
 547                         cmd = PCCSIG;
 548 
 549                 if (cmd != 0)
 550                         (void) write(Pctlfd(t->t_pshandle), &cmd, sizeof (cmd));
 551         }
 552 
 553         if (Pstate(t->t_pshandle) == PS_UNDEAD)
 554                 (void) waitpid(Pstatus(t->t_pshandle)->pr_pid, NULL, WNOHANG);
 555 
 556         (void) mdb_tgt_vespec_iter(t, pt_vespec_delete, NULL);
 557         mdb_tgt_sespec_idle_all(t, EMDB_NOPROC, clear_matched);
 558 
 559         if (pt->p_fio != pt->p_aout_fio) {
 560                 pt_close_aout(t);
 561                 (void) pt_open_aout(t, pt->p_aout_fio);
 562         }
 563 
 564         PTL_DTOR(t);
 565         pt->p_tdb_ops = NULL;
 566         pt->p_ptl_ops = &proc_lwp_ops;
 567         pt->p_ptl_hdl = NULL;
 568 
 569         pt->p_rtld = NULL;
 570         pt->p_signal = 0;
 571         pt->p_rtld_finished = FALSE;
 572         pt->p_rdstate = PT_RD_NONE;
 573 }
 574 
 575 static void
 576 pt_release_parents(mdb_tgt_t *t)
 577 {
 578         struct ps_prochandle *P = t->t_pshandle;
 579         pt_data_t *pt = t->t_data;
 580 
 581         mdb_sespec_t *sep;
 582         pt_vforkp_t *vfp;
 583 
 584         while ((vfp = mdb_list_next(&pt->p_vforkp)) != NULL) {
 585                 mdb_dprintf(MDB_DBG_TGT, "releasing vfork parent %d\n",
 586                     (int)Pstatus(vfp->p_pshandle)->pr_pid);
 587 
 588                 /*
 589                  * To release vfork parents, we must also wipe out any armed
 590                  * events in the parent by switching t_pshandle and calling
 591                  * se_disarm().  Do not change states or lose the matched list.
 592                  */
 593                 t->t_pshandle = vfp->p_pshandle;
 594 
 595                 for (sep = mdb_list_next(&t->t_active); sep != NULL;
 596                     sep = mdb_list_next(sep)) {
 597                         if (sep->se_state == MDB_TGT_SPEC_ARMED)
 598                                 (void) sep->se_ops->se_disarm(t, sep);
 599                 }
 600 
 601                 t->t_pshandle = P;
 602 
 603                 Prelease(vfp->p_pshandle, PRELEASE_CLEAR);
 604                 mdb_list_delete(&pt->p_vforkp, vfp);
 605                 mdb_free(vfp, sizeof (pt_vforkp_t));
 606         }
 607 }
 608 
 609 /*ARGSUSED*/
 610 static void
 611 pt_fork(mdb_tgt_t *t, int vid, void *private)
 612 {
 613         struct ps_prochandle *P = t->t_pshandle;
 614         const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
 615         pt_data_t *pt = t->t_data;
 616         mdb_sespec_t *sep;
 617 
 618         int follow_parent = mdb.m_forkmode != MDB_FM_CHILD;
 619         int is_vfork = (psp->pr_what == SYS_vfork ||
 620             (psp->pr_what == SYS_forksys && psp->pr_sysarg[0] == 2));
 621 
 622         struct ps_prochandle *C;
 623         const lwpstatus_t *csp;
 624         char sysname[32];
 625         int gcode;
 626         char c;
 627 
 628         mdb_dprintf(MDB_DBG_TGT, "parent %s: errno=%d rv1=%ld rv2=%ld\n",
 629             proc_sysname(psp->pr_what, sysname, sizeof (sysname)),
 630             psp->pr_errno, psp->pr_rval1, psp->pr_rval2);
 631 
 632         if (psp->pr_errno != 0) {
 633                 (void) mdb_tgt_continue(t, NULL);
 634                 return; /* fork failed */
 635         }
 636 
 637         /*
 638          * If forkmode is ASK and stdout is a terminal, then ask the user to
 639          * explicitly set the fork behavior for this particular fork.
 640          */
 641         if (mdb.m_forkmode == MDB_FM_ASK && mdb.m_term != NULL) {
 642                 mdb_iob_printf(mdb.m_err, "%s: %s detected: follow (p)arent "
 643                     "or (c)hild? ", mdb.m_pname, sysname);
 644                 mdb_iob_flush(mdb.m_err);
 645 
 646                 while (IOP_READ(mdb.m_term, &c, sizeof (c)) == sizeof (c)) {
 647                         if (c == 'P' || c == 'p') {
 648                                 mdb_iob_printf(mdb.m_err, "%c\n", c);
 649                                 follow_parent = TRUE;
 650                                 break;
 651                         } else if (c == 'C' || c == 'c') {
 652                                 mdb_iob_printf(mdb.m_err, "%c\n", c);
 653                                 follow_parent = FALSE;
 654                                 break;
 655                         }
 656                 }
 657         }
 658 
 659         /*
 660          * The parent is now stopped on exit from its fork call.  We must now
 661          * grab the child on its return from fork in order to manipulate it.
 662          */
 663         if ((C = Pgrab(psp->pr_rval1, PGRAB_RETAIN, &gcode)) == NULL) {
 664                 warn("failed to grab forked child process %ld: %s\n",
 665                     psp->pr_rval1, Pgrab_error(gcode));
 666                 return; /* just stop if we failed to grab the child */
 667         }
 668 
 669         /*
 670          * We may have grabbed the child and stopped it prematurely before it
 671          * stopped on exit from fork.  If so, wait up to 1 sec for it to settle.
 672          */
 673         if (Pstatus(C)->pr_lwp.pr_why != PR_SYSEXIT)
 674                 (void) Pwait(C, MILLISEC);
 675 
 676         csp = &Pstatus(C)->pr_lwp;
 677 
 678         if (csp->pr_why != PR_SYSEXIT ||
 679             (csp->pr_what != SYS_vfork && csp->pr_what != SYS_forksys)) {
 680                 warn("forked child process %ld did not stop on exit from "
 681                     "fork as expected\n", psp->pr_rval1);
 682         }
 683 
 684         warn("target forked child process %ld (debugger following %s)\n",
 685             psp->pr_rval1, follow_parent ? "parent" : "child");
 686 
 687         (void) Punsetflags(C, PR_ASYNC);        /* require synchronous mode */
 688         (void) Psetflags(C, PR_BPTADJ);         /* always adjust eip on x86 */
 689         (void) Prd_agent(C);                    /* initialize librtld_db */
 690 
 691         /*
 692          * At the time pt_fork() is called, the target event engine has already
 693          * disarmed the specifiers on the active list, clearing out events in
 694          * the parent process.  However, this means that events that change
 695          * the address space (e.g. breakpoints) have not been effectively
 696          * disarmed in the child since its address space reflects the state of
 697          * the process at the time of fork when events were armed.  We must
 698          * therefore handle this as a special case and re-invoke the disarm
 699          * callback of each active specifier to clean out the child process.
 700          */
 701         if (!is_vfork) {
 702                 for (t->t_pshandle = C, sep = mdb_list_next(&t->t_active);
 703                     sep != NULL; sep = mdb_list_next(sep)) {
 704                         if (sep->se_state == MDB_TGT_SPEC_ACTIVE)
 705                                 (void) sep->se_ops->se_disarm(t, sep);
 706                 }
 707 
 708                 t->t_pshandle = P; /* restore pshandle to parent */
 709         }
 710 
 711         /*
 712          * If we're following the parent process, we need to temporarily change
 713          * t_pshandle to refer to the child handle C so that we can clear out
 714          * all the events in the child prior to releasing it below.  If we are
 715          * tracing a vfork, we also need to explicitly wait for the child to
 716          * exec, exit, or die before we can reset and continue the parent.  We
 717          * avoid having to deal with the vfork child forking again by clearing
 718          * PR_FORK and setting PR_RLC; if it does fork it will effectively be
 719          * released from our control and we will continue following the parent.
 720          */
 721         if (follow_parent) {
 722                 if (is_vfork) {
 723                         mdb_tgt_status_t status;
 724 
 725                         ASSERT(psp->pr_flags & PR_VFORKP);
 726                         mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
 727                         t->t_pshandle = C;
 728 
 729                         (void) Psysexit(C, SYS_execve, TRUE);
 730 
 731                         (void) Punsetflags(C, PR_FORK | PR_KLC);
 732                         (void) Psetflags(C, PR_RLC);
 733 
 734                         do {
 735                                 if (pt_setrun(t, &status, 0) == -1 ||
 736                                     status.st_state == MDB_TGT_UNDEAD ||
 737                                     status.st_state == MDB_TGT_LOST)
 738                                         break; /* failure or process died */
 739 
 740                         } while (csp->pr_why != PR_SYSEXIT ||
 741                             csp->pr_errno != 0 || csp->pr_what != SYS_execve);
 742                 } else
 743                         t->t_pshandle = C;
 744         }
 745 
 746         /*
 747          * If we are following the child, destroy any active libthread_db
 748          * handle before we release the parent process.
 749          */
 750         if (!follow_parent) {
 751                 PTL_DTOR(t);
 752                 pt->p_tdb_ops = NULL;
 753                 pt->p_ptl_ops = &proc_lwp_ops;
 754                 pt->p_ptl_hdl = NULL;
 755         }
 756 
 757         /*
 758          * Idle all events to make sure the address space and tracing flags are
 759          * restored, and then release the process we are not tracing.  If we
 760          * are following the child of a vfork, we push the parent's pshandle
 761          * on to a list of vfork parents to be released when we exec or exit.
 762          */
 763         if (is_vfork && !follow_parent) {
 764                 pt_vforkp_t *vfp = mdb_alloc(sizeof (pt_vforkp_t), UM_SLEEP);
 765 
 766                 ASSERT(psp->pr_flags & PR_VFORKP);
 767                 vfp->p_pshandle = P;
 768                 mdb_list_append(&pt->p_vforkp, vfp);
 769                 mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
 770 
 771         } else {
 772                 mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
 773                 Prelease(t->t_pshandle, PRELEASE_CLEAR);
 774                 if (!follow_parent)
 775                         pt_release_parents(t);
 776         }
 777 
 778         /*
 779          * Now that all the hard stuff is done, switch t_pshandle back to the
 780          * process we are following and reset our events to the ACTIVE state.
 781          * If we are following the child, reset the libthread_db handle as well
 782          * as the rtld agent.
 783          */
 784         if (follow_parent)
 785                 t->t_pshandle = P;
 786         else {
 787                 t->t_pshandle = C;
 788                 pt->p_rtld = Prd_agent(C);
 789                 (void) Pobject_iter(t->t_pshandle, (proc_map_f *)thr_check, t);
 790         }
 791 
 792         (void) mdb_tgt_sespec_activate_all(t);
 793         (void) mdb_tgt_continue(t, NULL);
 794 }
 795 
 796 /*ARGSUSED*/
 797 static void
 798 pt_exec(mdb_tgt_t *t, int vid, void *private)
 799 {
 800         struct ps_prochandle *P = t->t_pshandle;
 801         const pstatus_t *psp = Pstatus(P);
 802         pt_data_t *pt = t->t_data;
 803         int follow_exec = mdb.m_execmode == MDB_EM_FOLLOW;
 804         pid_t pid = psp->pr_pid;
 805 
 806         char execname[MAXPATHLEN];
 807         mdb_sespec_t *sep, *nsep;
 808         mdb_io_t *io;
 809         char c;
 810 
 811         mdb_dprintf(MDB_DBG_TGT, "exit from %s: errno=%d\n", proc_sysname(
 812             psp->pr_lwp.pr_what, execname, sizeof (execname)),
 813             psp->pr_lwp.pr_errno);
 814 
 815         if (psp->pr_lwp.pr_errno != 0) {
 816                 (void) mdb_tgt_continue(t, NULL);
 817                 return; /* exec failed */
 818         }
 819 
 820         /*
 821          * If execmode is ASK and stdout is a terminal, then ask the user to
 822          * explicitly set the exec behavior for this particular exec.  If
 823          * Pstate() still shows PS_LOST, we are being called from pt_setrun()
 824          * directly and therefore we must resume the terminal since it is still
 825          * in the suspended state as far as tgt_continue() is concerned.
 826          */
 827         if (mdb.m_execmode == MDB_EM_ASK && mdb.m_term != NULL) {
 828                 if (Pstate(P) == PS_LOST)
 829                         IOP_RESUME(mdb.m_term);
 830 
 831                 mdb_iob_printf(mdb.m_err, "%s: %s detected: (f)ollow new "
 832                     "program or (s)top? ", mdb.m_pname, execname);
 833                 mdb_iob_flush(mdb.m_err);
 834 
 835                 while (IOP_READ(mdb.m_term, &c, sizeof (c)) == sizeof (c)) {
 836                         if (c == 'F' || c == 'f') {
 837                                 mdb_iob_printf(mdb.m_err, "%c\n", c);
 838                                 follow_exec = TRUE;
 839                                 break;
 840                         } else if (c == 'S' || c == 's') {
 841                                 mdb_iob_printf(mdb.m_err, "%c\n", c);
 842                                 follow_exec = FALSE;
 843                                 break;
 844                         }
 845                 }
 846 
 847                 if (Pstate(P) == PS_LOST)
 848                         IOP_SUSPEND(mdb.m_term);
 849         }
 850 
 851         pt_release_parents(t);  /* release any waiting vfork parents */
 852         pt_pre_detach(t, FALSE); /* remove our breakpoints and idle events */
 853         Preset_maps(P);         /* libproc must delete mappings and symtabs */
 854         pt_close_aout(t);       /* free pt symbol tables and GElf file data */
 855 
 856         /*
 857          * If we lost control of the process across the exec and are not able
 858          * to reopen it, we have no choice but to clear the matched event list
 859          * and wait for the user to quit or otherwise release the process.
 860          */
 861         if (Pstate(P) == PS_LOST && Preopen(P) == -1) {
 862                 int error = errno;
 863 
 864                 warn("lost control of PID %d due to exec of %s executable\n",
 865                     (int)pid, error == EOVERFLOW ? "64-bit" : "set-id");
 866 
 867                 for (sep = t->t_matched; sep != T_SE_END; sep = nsep) {
 868                         nsep = sep->se_matched;
 869                         sep->se_matched = NULL;
 870                         mdb_tgt_sespec_rele(t, sep);
 871                 }
 872 
 873                 if (error != EOVERFLOW)
 874                         return; /* just stop if we exec'd a set-id executable */
 875         }
 876 
 877         if (Pstate(P) != PS_LOST) {
 878                 if (Pexecname(P, execname, sizeof (execname)) == NULL) {
 879                         (void) mdb_iob_snprintf(execname, sizeof (execname),
 880                             "/proc/%d/object/a.out", (int)pid);
 881                 }
 882 
 883                 if (follow_exec == FALSE || psp->pr_dmodel == PR_MODEL_NATIVE)
 884                         warn("target performed exec of %s\n", execname);
 885 
 886                 io = mdb_fdio_create_path(NULL, execname, pt->p_oflags, 0);
 887                 if (io == NULL) {
 888                         warn("failed to open %s", execname);
 889                         warn("a.out symbol tables will not be available\n");
 890                 } else if (pt_open_aout(t, io) == NULL) {
 891                         (void) mdb_dis_select(pt_disasm(NULL));
 892                         mdb_io_destroy(io);
 893                 } else
 894                         (void) mdb_dis_select(pt_disasm(&pt->p_file->gf_ehdr));
 895         }
 896 
 897         /*
 898          * We reset our libthread_db state here, but deliberately do NOT call
 899          * PTL_DTOR because we do not want to call libthread_db's td_ta_delete.
 900          * This interface is hopelessly broken in that it writes to the process
 901          * address space (which we do not want it to do after an exec) and it
 902          * doesn't bother deallocating any of its storage anyway.
 903          */
 904         pt->p_tdb_ops = NULL;
 905         pt->p_ptl_ops = &proc_lwp_ops;
 906         pt->p_ptl_hdl = NULL;
 907 
 908         if (follow_exec && psp->pr_dmodel != PR_MODEL_NATIVE) {
 909                 const char *argv[3];
 910                 char *state, *env;
 911                 char pidarg[16];
 912                 size_t envlen;
 913 
 914                 if (realpath(getexecname(), execname) == NULL) {
 915                         warn("cannot follow PID %d -- failed to resolve "
 916                             "debugger pathname for re-exec", (int)pid);
 917                         return;
 918                 }
 919 
 920                 warn("restarting debugger to follow PID %d ...\n", (int)pid);
 921                 mdb_dprintf(MDB_DBG_TGT, "re-exec'ing %s\n", execname);
 922 
 923                 (void) mdb_snprintf(pidarg, sizeof (pidarg), "-p%d", (int)pid);
 924 
 925                 state = mdb_get_config();
 926                 envlen = strlen(MDB_CONFIG_ENV_VAR) + 1 + strlen(state) + 1;
 927                 env = mdb_alloc(envlen, UM_SLEEP);
 928                 (void) snprintf(env, envlen,
 929                     "%s=%s", MDB_CONFIG_ENV_VAR, state);
 930 
 931                 (void) putenv(env);
 932 
 933                 argv[0] = mdb.m_pname;
 934                 argv[1] = pidarg;
 935                 argv[2] = NULL;
 936 
 937                 if (mdb.m_term != NULL)
 938                         IOP_SUSPEND(mdb.m_term);
 939 
 940                 Prelease(P, PRELEASE_CLEAR | PRELEASE_HANG);
 941                 (void) execv(execname, (char *const *)argv);
 942                 warn("failed to re-exec debugger");
 943 
 944                 if (mdb.m_term != NULL)
 945                         IOP_RESUME(mdb.m_term);
 946 
 947                 t->t_pshandle = pt->p_idlehandle;
 948                 return;
 949         }
 950 
 951         pt_post_attach(t);      /* install tracing flags and activate events */
 952         pt_activate_common(t);  /* initialize librtld_db and libthread_db */
 953 
 954         if (psp->pr_dmodel != PR_MODEL_NATIVE && mdb.m_term != NULL) {
 955                 warn("loadable dcmds will not operate on non-native %d-bit "
 956                     "data model\n", psp->pr_dmodel == PR_MODEL_ILP32 ? 32 : 64);
 957                 warn("use ::release -a and then run mdb -p %d to restart "
 958                     "debugger\n", (int)pid);
 959         }
 960 
 961         if (follow_exec)
 962                 (void) mdb_tgt_continue(t, NULL);
 963 }
 964 
 965 static int
 966 pt_setflags(mdb_tgt_t *t, int flags)
 967 {
 968         pt_data_t *pt = t->t_data;
 969 
 970         if ((flags ^ t->t_flags) & MDB_TGT_F_RDWR) {
 971                 int mode = (flags & MDB_TGT_F_RDWR) ? O_RDWR : O_RDONLY;
 972                 mdb_io_t *io;
 973 
 974                 if (pt->p_fio == NULL)
 975                         return (set_errno(EMDB_NOEXEC));
 976 
 977                 io = mdb_fdio_create_path(NULL, IOP_NAME(pt->p_fio), mode, 0);
 978 
 979                 if (io == NULL)
 980                         return (-1); /* errno is set for us */
 981 
 982                 t->t_flags = (t->t_flags & ~MDB_TGT_F_RDWR) |
 983                     (flags & MDB_TGT_F_RDWR);
 984 
 985                 pt->p_fio = mdb_io_hold(io);
 986                 mdb_io_rele(pt->p_file->gf_io);
 987                 pt->p_file->gf_io = pt->p_fio;
 988         }
 989 
 990         if (flags & MDB_TGT_F_FORCE) {
 991                 t->t_flags |= MDB_TGT_F_FORCE;
 992                 pt->p_gflags |= PGRAB_FORCE;
 993         }
 994 
 995         return (0);
 996 }
 997 
 998 /*ARGSUSED*/
 999 static int
1000 pt_frame(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1001     const mdb_tgt_gregset_t *gregs)
1002 {
1003         argc = MIN(argc, (uint_t)(uintptr_t)arglim);
1004         mdb_printf("%a(", pc);
1005 
1006         if (argc != 0) {
1007                 mdb_printf("%lr", *argv++);
1008                 for (argc--; argc != 0; argc--)
1009                         mdb_printf(", %lr", *argv++);
1010         }
1011 
1012         mdb_printf(")\n");
1013         return (0);
1014 }
1015 
1016 static int
1017 pt_framev(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1018     const mdb_tgt_gregset_t *gregs)
1019 {
1020         argc = MIN(argc, (uint_t)(uintptr_t)arglim);
1021 #if defined(__i386) || defined(__amd64)
1022         mdb_printf("%0?lr %a(", gregs->gregs[R_FP], pc);
1023 #else
1024         mdb_printf("%0?lr %a(", gregs->gregs[R_SP], pc);
1025 #endif
1026         if (argc != 0) {
1027                 mdb_printf("%lr", *argv++);
1028                 for (argc--; argc != 0; argc--)
1029                         mdb_printf(", %lr", *argv++);
1030         }
1031 
1032         mdb_printf(")\n");
1033         return (0);
1034 }
1035 
1036 static int
1037 pt_framer(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1038     const mdb_tgt_gregset_t *gregs)
1039 {
1040         if (pt_frameregs(arglim, pc, argc, argv, gregs, pc == PC_FAKE) == -1) {
1041                 /*
1042                  * Use verbose format if register format is not supported.
1043                  */
1044                 return (pt_framev(arglim, pc, argc, argv, gregs));
1045         }
1046 
1047         return (0);
1048 }
1049 
1050 /*ARGSUSED*/
1051 static int
1052 pt_stack_common(uintptr_t addr, uint_t flags, int argc,
1053     const mdb_arg_t *argv, mdb_tgt_stack_f *func, prgreg_t saved_pc)
1054 {
1055         void *arg = (void *)(uintptr_t)mdb.m_nargs;
1056         mdb_tgt_t *t = mdb.m_target;
1057         mdb_tgt_gregset_t gregs;
1058 
1059         if (argc != 0) {
1060                 if (argv->a_type == MDB_TYPE_CHAR || argc > 1)
1061                         return (DCMD_USAGE);
1062 
1063                 if (argv->a_type == MDB_TYPE_STRING)
1064                         arg = (void *)(uintptr_t)mdb_strtoull(argv->a_un.a_str);
1065                 else
1066                         arg = (void *)(uintptr_t)argv->a_un.a_val;
1067         }
1068 
1069         if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE) {
1070                 mdb_warn("no process active\n");
1071                 return (DCMD_ERR);
1072         }
1073 
1074         /*
1075          * In the universe of sparcv7, sparcv9, ia32, and amd64 this code can be
1076          * common: <sys/procfs_isa.h> conveniently #defines R_FP to be the
1077          * appropriate register we need to set in order to perform a stack
1078          * traceback from a given frame address.
1079          */
1080         if (flags & DCMD_ADDRSPEC) {
1081                 bzero(&gregs, sizeof (gregs));
1082                 gregs.gregs[R_FP] = addr;
1083 #ifdef __sparc
1084                 gregs.gregs[R_I7] = saved_pc;
1085 #endif /* __sparc */
1086         } else if (PTL_GETREGS(t, PTL_TID(t), gregs.gregs) != 0) {
1087                 mdb_warn("failed to get current register set");
1088                 return (DCMD_ERR);
1089         }
1090 
1091         (void) mdb_tgt_stack_iter(t, &gregs, func, arg);
1092         return (DCMD_OK);
1093 }
1094 
1095 static int
1096 pt_stack(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1097 {
1098         return (pt_stack_common(addr, flags, argc, argv, pt_frame, 0));
1099 }
1100 
1101 static int
1102 pt_stackv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1103 {
1104         return (pt_stack_common(addr, flags, argc, argv, pt_framev, 0));
1105 }
1106 
1107 static int
1108 pt_stackr(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1109 {
1110         /*
1111          * Force printing of first register window, by setting  the
1112          * saved pc (%i7) to PC_FAKE.
1113          */
1114         return (pt_stack_common(addr, flags, argc, argv, pt_framer, PC_FAKE));
1115 }
1116 
1117 /*ARGSUSED*/
1118 static int
1119 pt_ignored(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1120 {
1121         struct ps_prochandle *P = mdb.m_target->t_pshandle;
1122         char buf[PRSIGBUFSZ];
1123 
1124         if ((flags & DCMD_ADDRSPEC) || argc != 0)
1125                 return (DCMD_USAGE);
1126 
1127         if (P == NULL) {
1128                 mdb_warn("no process is currently active\n");
1129                 return (DCMD_ERR);
1130         }
1131 
1132         mdb_printf("%s\n", proc_sigset2str(&Pstatus(P)->pr_sigtrace, " ",
1133             FALSE, buf, sizeof (buf)));
1134 
1135         return (DCMD_OK);
1136 }
1137 
1138 /*ARGSUSED*/
1139 static int
1140 pt_lwpid(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1141 {
1142         struct ps_prochandle *P = mdb.m_target->t_pshandle;
1143 
1144         if ((flags & DCMD_ADDRSPEC) || argc != 0)
1145                 return (DCMD_USAGE);
1146 
1147         if (P == NULL) {
1148                 mdb_warn("no process is currently active\n");
1149                 return (DCMD_ERR);
1150         }
1151 
1152         mdb_printf("%d\n", Pstatus(P)->pr_lwp.pr_lwpid);
1153         return (DCMD_OK);
1154 }
1155 
1156 static int
1157 pt_print_lwpid(int *n, const lwpstatus_t *psp)
1158 {
1159         struct ps_prochandle *P = mdb.m_target->t_pshandle;
1160         int nlwp = Pstatus(P)->pr_nlwp;
1161 
1162         if (*n == nlwp - 2)
1163                 mdb_printf("%d and ", (int)psp->pr_lwpid);
1164         else if (*n == nlwp - 1)
1165                 mdb_printf("%d are", (int)psp->pr_lwpid);
1166         else
1167                 mdb_printf("%d, ", (int)psp->pr_lwpid);
1168 
1169         (*n)++;
1170         return (0);
1171 }
1172 
1173 /*ARGSUSED*/
1174 static int
1175 pt_lwpids(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1176 {
1177         struct ps_prochandle *P = mdb.m_target->t_pshandle;
1178         int n = 0;
1179 
1180         if (P == NULL) {
1181                 mdb_warn("no process is currently active\n");
1182                 return (DCMD_ERR);
1183         }
1184 
1185         switch (Pstatus(P)->pr_nlwp) {
1186         case 0:
1187                 mdb_printf("no lwps are");
1188                 break;
1189         case 1:
1190                 mdb_printf("lwpid %d is the only lwp",
1191                     Pstatus(P)->pr_lwp.pr_lwpid);
1192                 break;
1193         default:
1194                 mdb_printf("lwpids ");
1195                 (void) Plwp_iter(P, (proc_lwp_f *)pt_print_lwpid, &n);
1196         }
1197 
1198         switch (Pstate(P)) {
1199         case PS_DEAD:
1200                 mdb_printf(" in core of process %d.\n", Pstatus(P)->pr_pid);
1201                 break;
1202         case PS_IDLE:
1203                 mdb_printf(" in idle target.\n");
1204                 break;
1205         default:
1206                 mdb_printf(" in process %d.\n", (int)Pstatus(P)->pr_pid);
1207                 break;
1208         }
1209 
1210         return (DCMD_OK);
1211 }
1212 
1213 /*ARGSUSED*/
1214 static int
1215 pt_ignore(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1216 {
1217         pt_data_t *pt = mdb.m_target->t_data;
1218 
1219         if (!(flags & DCMD_ADDRSPEC) || argc != 0)
1220                 return (DCMD_USAGE);
1221 
1222         if (addr < 1 || addr > pt->p_maxsig) {
1223                 mdb_warn("invalid signal number -- 0t%lu\n", addr);
1224                 return (DCMD_ERR);
1225         }
1226 
1227         (void) mdb_tgt_vespec_iter(mdb.m_target, pt_ignore_sig, (void *)addr);
1228         return (DCMD_OK);
1229 }
1230 
1231 /*ARGSUSED*/
1232 static int
1233 pt_attach(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1234 {
1235         mdb_tgt_t *t = mdb.m_target;
1236         pt_data_t *pt = t->t_data;
1237         int state, perr;
1238 
1239         if (!(flags & DCMD_ADDRSPEC) && argc == 0)
1240                 return (DCMD_USAGE);
1241 
1242         if (((flags & DCMD_ADDRSPEC) && argc != 0) || argc > 1 ||
1243             (argc != 0 && argv->a_type != MDB_TYPE_STRING))
1244                 return (DCMD_USAGE);
1245 
1246         if (t->t_pshandle != NULL && Pstate(t->t_pshandle) != PS_IDLE) {
1247                 mdb_warn("debugger is already attached to a %s\n",
1248                     (Pstate(t->t_pshandle) == PS_DEAD) ? "core" : "process");
1249                 return (DCMD_ERR);
1250         }
1251 
1252         if (pt->p_fio == NULL) {
1253                 mdb_warn("attach requires executable to be specified on "
1254                     "command-line (or use -p)\n");
1255                 return (DCMD_ERR);
1256         }
1257 
1258         if (flags & DCMD_ADDRSPEC)
1259                 t->t_pshandle = Pgrab((pid_t)addr, pt->p_gflags, &perr);
1260         else
1261                 t->t_pshandle = proc_arg_grab(argv->a_un.a_str,
1262                     PR_ARG_ANY, pt->p_gflags, &perr);
1263 
1264         if (t->t_pshandle == NULL) {
1265                 t->t_pshandle = pt->p_idlehandle;
1266                 mdb_warn("cannot attach: %s\n", Pgrab_error(perr));
1267                 return (DCMD_ERR);
1268         }
1269 
1270         state = Pstate(t->t_pshandle);
1271         if (state != PS_DEAD && state != PS_IDLE) {
1272                 (void) Punsetflags(t->t_pshandle, PR_KLC);
1273                 (void) Psetflags(t->t_pshandle, PR_RLC);
1274                 pt_post_attach(t);
1275                 pt_activate_common(t);
1276         }
1277 
1278         (void) mdb_tgt_status(t, &t->t_status);
1279         mdb_module_load_all(0);
1280         return (DCMD_OK);
1281 }
1282 
1283 static int
1284 pt_regstatus(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1285 {
1286         mdb_tgt_t *t = mdb.m_target;
1287 
1288         if (t->t_pshandle != NULL) {
1289                 const pstatus_t *psp = Pstatus(t->t_pshandle);
1290                 int cursig = psp->pr_lwp.pr_cursig;
1291                 char signame[SIG2STR_MAX];
1292                 int state = Pstate(t->t_pshandle);
1293 
1294                 if (state != PS_DEAD && state != PS_IDLE)
1295                         mdb_printf("process id = %d\n", psp->pr_pid);
1296                 else
1297                         mdb_printf("no process\n");
1298 
1299                 if (cursig != 0 && sig2str(cursig, signame) == 0)
1300                         mdb_printf("SIG%s: %s\n", signame, strsignal(cursig));
1301         }
1302 
1303         return (pt_regs(addr, flags, argc, argv));
1304 }
1305 
1306 static void
1307 pt_thread_name(mdb_tgt_t *t, mdb_tgt_tid_t tid, char *buf, size_t bufsize)
1308 {
1309         char name[THREAD_NAME_MAX];
1310 
1311         buf[0] = '\0';
1312 
1313         if (t->t_pshandle == NULL ||
1314             Plwp_getname(t->t_pshandle, tid, name, sizeof (name)) != 0 ||
1315             name[0] == '\0') {
1316                 (void) mdb_snprintf(buf, bufsize, "%lu", tid);
1317                 return;
1318         }
1319 
1320         (void) mdb_snprintf(buf, bufsize, "%lu [%s]", tid, name);
1321 }
1322 
1323 static int
1324 pt_findstack(uintptr_t tid, uint_t flags, int argc, const mdb_arg_t *argv)
1325 {
1326         mdb_tgt_t *t = mdb.m_target;
1327         mdb_tgt_gregset_t gregs;
1328         int showargs = 0;
1329         int count;
1330         uintptr_t pc, sp;
1331         char name[128];
1332 
1333         if (!(flags & DCMD_ADDRSPEC))
1334                 return (DCMD_USAGE);
1335 
1336         count = mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &showargs,
1337             NULL);
1338         argc -= count;
1339         argv += count;
1340 
1341         if (argc > 1 || (argc == 1 && argv->a_type != MDB_TYPE_STRING))
1342                 return (DCMD_USAGE);
1343 
1344         if (PTL_GETREGS(t, tid, gregs.gregs) != 0) {
1345                 mdb_warn("failed to get register set for thread %p", tid);
1346                 return (DCMD_ERR);
1347         }
1348 
1349         pc = gregs.gregs[R_PC];
1350 #if defined(__i386) || defined(__amd64)
1351         sp = gregs.gregs[R_FP];
1352 #else
1353         sp = gregs.gregs[R_SP];
1354 #endif
1355 
1356         pt_thread_name(t, tid, name, sizeof (name));
1357 
1358         mdb_printf("stack pointer for thread %s: %p\n", name, sp);
1359         if (pc != 0)
1360                 mdb_printf("[ %0?lr %a() ]\n", sp, pc);
1361 
1362         (void) mdb_inc_indent(2);
1363         mdb_set_dot(sp);
1364 
1365         if (argc == 1)
1366                 (void) mdb_eval(argv->a_un.a_str);
1367         else if (showargs)
1368                 (void) mdb_eval("<.$C");
1369         else
1370                 (void) mdb_eval("<.$C0");
1371 
1372         (void) mdb_dec_indent(2);
1373         return (DCMD_OK);
1374 }
1375 
1376 /*ARGSUSED*/
1377 static int
1378 pt_gcore(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1379 {
1380         mdb_tgt_t *t = mdb.m_target;
1381         char *prefix = "core";
1382         char *content_str = NULL;
1383         core_content_t content = CC_CONTENT_DEFAULT;
1384         size_t size;
1385         char *fname;
1386         pid_t pid;
1387 
1388         if (flags & DCMD_ADDRSPEC)
1389                 return (DCMD_USAGE);
1390 
1391         if (mdb_getopts(argc, argv,
1392             'o', MDB_OPT_STR, &prefix,
1393             'c', MDB_OPT_STR, &content_str, NULL) != argc)
1394                 return (DCMD_USAGE);
1395 
1396         if (content_str != NULL &&
1397             (proc_str2content(content_str, &content) != 0 ||
1398             content == CC_CONTENT_INVALID)) {
1399                 mdb_warn("invalid content string '%s'\n", content_str);
1400                 return (DCMD_ERR);
1401         }
1402 
1403         if (t->t_pshandle == NULL) {
1404                 mdb_warn("no process active\n");
1405                 return (DCMD_ERR);
1406         }
1407 
1408         pid = Pstatus(t->t_pshandle)->pr_pid;
1409         size = 1 + mdb_snprintf(NULL, 0, "%s.%d", prefix, (int)pid);
1410         fname = mdb_alloc(size, UM_SLEEP | UM_GC);
1411         (void) mdb_snprintf(fname, size, "%s.%d", prefix, (int)pid);
1412 
1413         if (Pgcore(t->t_pshandle, fname, content) != 0) {
1414                 /*
1415                  * Short writes during dumping are specifically described by
1416                  * EBADE, just as ZFS uses this otherwise-unused code for
1417                  * checksum errors.  Translate to and mdb errno.
1418                  */
1419                 if (errno == EBADE)
1420                         (void) set_errno(EMDB_SHORTWRITE);
1421                 mdb_warn("couldn't dump core");
1422                 return (DCMD_ERR);
1423         }
1424 
1425         mdb_warn("%s dumped\n", fname);
1426 
1427         return (DCMD_OK);
1428 }
1429 
1430 /*ARGSUSED*/
1431 static int
1432 pt_kill(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1433 {
1434         mdb_tgt_t *t = mdb.m_target;
1435         pt_data_t *pt = t->t_data;
1436         int state;
1437 
1438         if ((flags & DCMD_ADDRSPEC) || argc != 0)
1439                 return (DCMD_USAGE);
1440 
1441         if (t->t_pshandle != NULL &&
1442             (state = Pstate(t->t_pshandle)) != PS_DEAD && state != PS_IDLE) {
1443                 mdb_warn("victim process PID %d forcibly terminated\n",
1444                     (int)Pstatus(t->t_pshandle)->pr_pid);
1445                 pt_pre_detach(t, TRUE);
1446                 pt_release_parents(t);
1447                 Prelease(t->t_pshandle, PRELEASE_KILL);
1448                 t->t_pshandle = pt->p_idlehandle;
1449                 (void) mdb_tgt_status(t, &t->t_status);
1450                 mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
1451         } else
1452                 mdb_warn("no victim process is currently under control\n");
1453 
1454         return (DCMD_OK);
1455 }
1456 
1457 /*ARGSUSED*/
1458 static int
1459 pt_detach(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1460 {
1461         mdb_tgt_t *t = mdb.m_target;
1462         pt_data_t *pt = t->t_data;
1463         int rflags = pt->p_rflags;
1464 
1465         if (argc != 0 && argv->a_type == MDB_TYPE_STRING &&
1466             strcmp(argv->a_un.a_str, "-a") == 0) {
1467                 rflags = PRELEASE_HANG | PRELEASE_CLEAR;
1468                 argv++;
1469                 argc--;
1470         }
1471 
1472         if ((flags & DCMD_ADDRSPEC) || argc != 0)
1473                 return (DCMD_USAGE);
1474 
1475         if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE) {
1476                 mdb_warn("debugger is not currently attached to a process "
1477                     "or core file\n");
1478                 return (DCMD_ERR);
1479         }
1480 
1481         pt_pre_detach(t, TRUE);
1482         pt_release_parents(t);
1483         Prelease(t->t_pshandle, rflags);
1484         t->t_pshandle = pt->p_idlehandle;
1485         (void) mdb_tgt_status(t, &t->t_status);
1486         mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
1487 
1488         return (DCMD_OK);
1489 }
1490 
1491 static uintmax_t
1492 reg_disc_get(const mdb_var_t *v)
1493 {
1494         mdb_tgt_t *t = MDB_NV_COOKIE(v);
1495         mdb_tgt_tid_t tid = PTL_TID(t);
1496         mdb_tgt_reg_t r = 0;
1497 
1498         if (tid != (mdb_tgt_tid_t)-1L)
1499                 (void) mdb_tgt_getareg(t, tid, mdb_nv_get_name(v), &r);
1500 
1501         return (r);
1502 }
1503 
1504 static void
1505 reg_disc_set(mdb_var_t *v, uintmax_t r)
1506 {
1507         mdb_tgt_t *t = MDB_NV_COOKIE(v);
1508         mdb_tgt_tid_t tid = PTL_TID(t);
1509 
1510         if (tid != (mdb_tgt_tid_t)-1L && mdb_tgt_putareg(t, tid,
1511             mdb_nv_get_name(v), r) == -1)
1512                 mdb_warn("failed to modify %%%s register", mdb_nv_get_name(v));
1513 }
1514 
1515 static void
1516 pt_print_reason(const lwpstatus_t *psp)
1517 {
1518         char name[SIG2STR_MAX + 4]; /* enough for SIG+name+\0, syscall or flt */
1519         const char *desc;
1520 
1521         switch (psp->pr_why) {
1522         case PR_REQUESTED:
1523                 mdb_printf("stopped by debugger");
1524                 break;
1525         case PR_SIGNALLED:
1526                 mdb_printf("stopped on %s (%s)", proc_signame(psp->pr_what,
1527                     name, sizeof (name)), strsignal(psp->pr_what));
1528                 break;
1529         case PR_SYSENTRY:
1530                 mdb_printf("stopped on entry to %s system call",
1531                     proc_sysname(psp->pr_what, name, sizeof (name)));
1532                 break;
1533         case PR_SYSEXIT:
1534                 mdb_printf("stopped on exit from %s system call",
1535                     proc_sysname(psp->pr_what, name, sizeof (name)));
1536                 break;
1537         case PR_JOBCONTROL:
1538                 mdb_printf("stopped by job control");
1539                 break;
1540         case PR_FAULTED:
1541                 if (psp->pr_what == FLTBPT) {
1542                         mdb_printf("stopped on a breakpoint");
1543                 } else if (psp->pr_what == FLTWATCH) {
1544                         switch (psp->pr_info.si_code) {
1545                         case TRAP_RWATCH:
1546                                 desc = "read";
1547                                 break;
1548                         case TRAP_WWATCH:
1549                                 desc = "write";
1550                                 break;
1551                         case TRAP_XWATCH:
1552                                 desc = "execute";
1553                                 break;
1554                         default:
1555                                 desc = "unknown";
1556                         }
1557                         mdb_printf("stopped %s a watchpoint (%s access to %p)",
1558                             psp->pr_info.si_trapafter ? "after" : "on",
1559                             desc, psp->pr_info.si_addr);
1560                 } else if (psp->pr_what == FLTTRACE) {
1561                         mdb_printf("stopped after a single-step");
1562                 } else {
1563                         mdb_printf("stopped on a %s fault",
1564                             proc_fltname(psp->pr_what, name, sizeof (name)));
1565                 }
1566                 break;
1567         case PR_SUSPENDED:
1568         case PR_CHECKPOINT:
1569                 mdb_printf("suspended by the kernel");
1570                 break;
1571         default:
1572                 mdb_printf("stopped for unknown reason (%d/%d)",
1573                     psp->pr_why, psp->pr_what);
1574         }
1575 }
1576 
1577 /*ARGSUSED*/
1578 static int
1579 pt_status_dcmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1580 {
1581         mdb_tgt_t *t = mdb.m_target;
1582         struct ps_prochandle *P = t->t_pshandle;
1583         pt_data_t *pt = t->t_data;
1584 
1585         if (P != NULL) {
1586                 const psinfo_t *pip = Ppsinfo(P);
1587                 const pstatus_t *psp = Pstatus(P);
1588                 int cursig = 0, bits = 0, coredump = 0;
1589                 int state;
1590                 GElf_Sym sym;
1591                 uintptr_t panicstr;
1592                 char *panicbuf = mdb_alloc(PANIC_BUFSIZE, UM_SLEEP);
1593                 const siginfo_t *sip = &(psp->pr_lwp.pr_info);
1594 
1595                 char execname[MAXPATHLEN], buf[BUFSIZ];
1596                 char signame[SIG2STR_MAX + 4]; /* enough for SIG+name+\0 */
1597 
1598                 mdb_tgt_spec_desc_t desc;
1599                 mdb_sespec_t *sep;
1600 
1601                 struct utsname uts;
1602                 prcred_t cred;
1603                 psinfo_t pi;
1604 
1605                 (void) strcpy(uts.nodename, "unknown machine");
1606                 (void) Puname(P, &uts);
1607 
1608                 if (pip != NULL) {
1609                         bcopy(pip, &pi, sizeof (psinfo_t));
1610                         proc_unctrl_psinfo(&pi);
1611                 } else
1612                         bzero(&pi, sizeof (psinfo_t));
1613 
1614                 bits = pi.pr_dmodel == PR_MODEL_ILP32 ? 32 : 64;
1615 
1616                 state = Pstate(P);
1617                 if (psp != NULL && state != PS_UNDEAD && state != PS_IDLE)
1618                         cursig = psp->pr_lwp.pr_cursig;
1619 
1620                 if (state == PS_DEAD && pip != NULL) {
1621                         mdb_printf("debugging core file of %s (%d-bit) "
1622                             "from %s\n", pi.pr_fname, bits, uts.nodename);
1623 
1624                 } else if (state == PS_DEAD) {
1625                         mdb_printf("debugging core file\n");
1626 
1627                 } else if (state == PS_IDLE) {
1628                         const GElf_Ehdr *ehp = &pt->p_file->gf_ehdr;
1629 
1630                         mdb_printf("debugging %s file (%d-bit)\n",
1631                             ehp->e_type == ET_EXEC ? "executable" : "object",
1632                             ehp->e_ident[EI_CLASS] == ELFCLASS32 ? 32 : 64);
1633 
1634                 } else if (state == PS_UNDEAD && pi.pr_pid == 0) {
1635                         mdb_printf("debugging defunct process\n");
1636 
1637                 } else {
1638                         mdb_printf("debugging PID %d (%d-bit)\n",
1639                             pi.pr_pid, bits);
1640                 }
1641 
1642                 if (Pexecname(P, execname, sizeof (execname)) != NULL)
1643                         mdb_printf("file: %s\n", execname);
1644 
1645                 if (pip != NULL && state == PS_DEAD)
1646                         mdb_printf("initial argv: %s\n", pi.pr_psargs);
1647 
1648                 if (state != PS_UNDEAD && state != PS_IDLE) {
1649                         mdb_printf("threading model: ");
1650                         if (pt->p_ptl_ops == &proc_lwp_ops)
1651                                 mdb_printf("raw lwps\n");
1652                         else
1653                                 mdb_printf("native threads\n");
1654                 }
1655 
1656                 mdb_printf("status: ");
1657                 switch (state) {
1658                 case PS_RUN:
1659                         ASSERT(!(psp->pr_flags & PR_STOPPED));
1660                         mdb_printf("process is running");
1661                         if (psp->pr_flags & PR_DSTOP)
1662                                 mdb_printf(", debugger stop directive pending");
1663                         mdb_printf("\n");
1664                         break;
1665 
1666                 case PS_STOP:
1667                         ASSERT(psp->pr_flags & PR_STOPPED);
1668                         pt_print_reason(&psp->pr_lwp);
1669 
1670                         if (psp->pr_flags & PR_DSTOP)
1671                                 mdb_printf(", debugger stop directive pending");
1672                         if (psp->pr_flags & PR_ASLEEP)
1673                                 mdb_printf(", sleeping in %s system call",
1674                                     proc_sysname(psp->pr_lwp.pr_syscall,
1675                                     signame, sizeof (signame)));
1676 
1677                         mdb_printf("\n");
1678 
1679                         for (sep = t->t_matched; sep != T_SE_END;
1680                             sep = sep->se_matched) {
1681                                 mdb_printf("event: %s\n", sep->se_ops->se_info(
1682                                     t, sep, mdb_list_next(&sep->se_velist),
1683                                     &desc, buf, sizeof (buf)));
1684                         }
1685                         break;
1686 
1687                 case PS_LOST:
1688                         mdb_printf("debugger lost control of process\n");
1689                         break;
1690 
1691                 case PS_UNDEAD:
1692                         coredump = WIFSIGNALED(pi.pr_wstat) &&
1693                             WCOREDUMP(pi.pr_wstat);
1694                         /*FALLTHRU*/
1695 
1696                 case PS_DEAD:
1697                         if (cursig == 0 && WIFSIGNALED(pi.pr_wstat))
1698                                 cursig = WTERMSIG(pi.pr_wstat);
1699                         /*
1700                          * We can only use pr_wstat == 0 as a test for gcore if
1701                          * an NT_PRCRED note is present; these features were
1702                          * added at the same time in Solaris 8.
1703                          */
1704                         if (pi.pr_wstat == 0 && Pstate(P) == PS_DEAD &&
1705                             Pcred(P, &cred, 1) == 0) {
1706                                 mdb_printf("process core file generated "
1707                                     "with gcore(1)\n");
1708                         } else if (cursig != 0) {
1709                                 mdb_printf("process terminated by %s (%s)",
1710                                     proc_signame(cursig, signame,
1711                                     sizeof (signame)), strsignal(cursig));
1712 
1713                                 if (sip->si_signo != 0 && SI_FROMUSER(sip) &&
1714                                     sip->si_pid != 0) {
1715                                         mdb_printf(", pid=%d uid=%u",
1716                                             (int)sip->si_pid, sip->si_uid);
1717                                         if (sip->si_code != 0) {
1718                                                 mdb_printf(" code=%d",
1719                                                     sip->si_code);
1720                                         }
1721                                 } else {
1722                                         switch (sip->si_signo) {
1723                                         case SIGILL:
1724                                         case SIGTRAP:
1725                                         case SIGFPE:
1726                                         case SIGSEGV:
1727                                         case SIGBUS:
1728                                         case SIGEMT:
1729                                                 mdb_printf(", addr=%p",
1730                                                     sip->si_addr);
1731                                         default:
1732                                                 break;
1733                                         }
1734                                 }
1735 
1736                                 if (coredump)
1737                                         mdb_printf(" - core file dumped");
1738                                 mdb_printf("\n");
1739                         } else {
1740                                 mdb_printf("process terminated with exit "
1741                                     "status %d\n", WEXITSTATUS(pi.pr_wstat));
1742                         }
1743 
1744                         if (Plookup_by_name(t->t_pshandle, "libc.so",
1745                             "panicstr", &sym) == 0 &&
1746                             Pread(t->t_pshandle, &panicstr, sizeof (panicstr),
1747                             sym.st_value) == sizeof (panicstr) &&
1748                             Pread_string(t->t_pshandle, panicbuf,
1749                             PANIC_BUFSIZE, panicstr) > 0) {
1750                                 mdb_printf("panic message: %s",
1751                                     panicbuf);
1752                         }
1753 
1754 
1755                         break;
1756 
1757                 case PS_IDLE:
1758                         mdb_printf("idle\n");
1759                         break;
1760 
1761                 default:
1762                         mdb_printf("unknown libproc Pstate: %d\n", Pstate(P));
1763                 }
1764                 mdb_free(panicbuf, PANIC_BUFSIZE);
1765 
1766         } else if (pt->p_file != NULL) {
1767                 const GElf_Ehdr *ehp = &pt->p_file->gf_ehdr;
1768 
1769                 mdb_printf("debugging %s file (%d-bit)\n",
1770                     ehp->e_type == ET_EXEC ? "executable" : "object",
1771                     ehp->e_ident[EI_CLASS] == ELFCLASS32 ? 32 : 64);
1772                 mdb_printf("executable file: %s\n", IOP_NAME(pt->p_fio));
1773                 mdb_printf("status: idle\n");
1774         }
1775 
1776         return (DCMD_OK);
1777 }
1778 
1779 static int
1780 pt_tls(uintptr_t tid, uint_t flags, int argc, const mdb_arg_t *argv)
1781 {
1782         const char *name;
1783         const char *object;
1784         GElf_Sym sym;
1785         mdb_syminfo_t si;
1786         mdb_tgt_t *t = mdb.m_target;
1787 
1788         if (!(flags & DCMD_ADDRSPEC) || argc > 1)
1789                 return (DCMD_USAGE);
1790 
1791         if (argc == 0) {
1792                 psaddr_t b;
1793 
1794                 if (tlsbase(t, tid, PR_LMID_EVERY, MDB_TGT_OBJ_EXEC, &b) != 0) {
1795                         mdb_warn("failed to lookup tlsbase for %r", tid);
1796                         return (DCMD_ERR);
1797                 }
1798 
1799                 mdb_printf("%lr\n", b);
1800                 mdb_set_dot(b);
1801 
1802                 return (DCMD_OK);
1803         }
1804 
1805         name = argv[0].a_un.a_str;
1806         object = MDB_TGT_OBJ_EVERY;
1807 
1808         if (pt_lookup_by_name_thr(t, object, name, &sym, &si, tid) != 0) {
1809                 mdb_warn("failed to lookup %s", name);
1810                 return (DCMD_ABORT); /* avoid repeated failure */
1811         }
1812 
1813         if (GELF_ST_TYPE(sym.st_info) != STT_TLS && DCMD_HDRSPEC(flags))
1814                 mdb_warn("%s does not refer to thread local storage\n", name);
1815 
1816         mdb_printf("%llr\n", sym.st_value);
1817         mdb_set_dot(sym.st_value);
1818 
1819         return (DCMD_OK);
1820 }
1821 
1822 /*ARGSUSED*/
1823 static int
1824 pt_tmodel(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1825 {
1826         mdb_tgt_t *t = mdb.m_target;
1827         pt_data_t *pt = t->t_data;
1828         const pt_ptl_ops_t *ptl_ops;
1829 
1830         if (argc != 1 || argv->a_type != MDB_TYPE_STRING)
1831                 return (DCMD_USAGE);
1832 
1833         if (strcmp(argv->a_un.a_str, "thread") == 0)
1834                 ptl_ops = &proc_tdb_ops;
1835         else if (strcmp(argv->a_un.a_str, "lwp") == 0)
1836                 ptl_ops = &proc_lwp_ops;
1837         else
1838                 return (DCMD_USAGE);
1839 
1840         if (t->t_pshandle != NULL && pt->p_ptl_ops != ptl_ops) {
1841                 PTL_DTOR(t);
1842                 pt->p_tdb_ops = NULL;
1843                 pt->p_ptl_ops = &proc_lwp_ops;
1844                 pt->p_ptl_hdl = NULL;
1845 
1846                 if (ptl_ops == &proc_tdb_ops) {
1847                         (void) Pobject_iter(t->t_pshandle, (proc_map_f *)
1848                             thr_check, t);
1849                 }
1850         }
1851 
1852         (void) mdb_tgt_status(t, &t->t_status);
1853         return (DCMD_OK);
1854 }
1855 
1856 static const char *
1857 env_match(const char *cmp, const char *nameval)
1858 {
1859         const char *loc;
1860         size_t cmplen = strlen(cmp);
1861 
1862         loc = strchr(nameval, '=');
1863         if (loc != NULL && (loc - nameval) == cmplen &&
1864             strncmp(nameval, cmp, cmplen) == 0) {
1865                 return (loc + 1);
1866         }
1867 
1868         return (NULL);
1869 }
1870 
1871 /*ARGSUSED*/
1872 static int
1873 print_env(void *data, struct ps_prochandle *P, uintptr_t addr,
1874     const char *nameval)
1875 {
1876         const char *value;
1877 
1878         if (nameval == NULL) {
1879                 mdb_printf("<0x%p>\n", addr);
1880         } else {
1881                 if (data == NULL)
1882                         mdb_printf("%s\n", nameval);
1883                 else if ((value = env_match(data, nameval)) != NULL)
1884                         mdb_printf("%s\n", value);
1885         }
1886 
1887         return (0);
1888 }
1889 
1890 /*ARGSUSED*/
1891 static int
1892 pt_getenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1893 {
1894         mdb_tgt_t *t = mdb.m_target;
1895         pt_data_t *pt = t->t_data;
1896         int i;
1897         uint_t opt_t = 0;
1898         mdb_var_t *v;
1899 
1900         i = mdb_getopts(argc, argv,
1901             't', MDB_OPT_SETBITS, TRUE, &opt_t, NULL);
1902 
1903         argc -= i;
1904         argv += i;
1905 
1906         if ((flags & DCMD_ADDRSPEC) || argc > 1)
1907                 return (DCMD_USAGE);
1908 
1909         if (argc == 1 && argv->a_type != MDB_TYPE_STRING)
1910                 return (DCMD_USAGE);
1911 
1912         if (opt_t && t->t_pshandle == NULL) {
1913                 mdb_warn("no process active\n");
1914                 return (DCMD_ERR);
1915         }
1916 
1917         if (opt_t && (Pstate(t->t_pshandle) == PS_IDLE ||
1918             Pstate(t->t_pshandle) == PS_UNDEAD)) {
1919                 mdb_warn("-t option requires target to be running\n");
1920                 return (DCMD_ERR);
1921         }
1922 
1923         if (opt_t != 0) {
1924                 if (Penv_iter(t->t_pshandle, print_env,
1925                     argc == 0 ? NULL : (void *)argv->a_un.a_str) != 0)
1926                         return (DCMD_ERR);
1927         } else if (argc == 1) {
1928                 if ((v = mdb_nv_lookup(&pt->p_env, argv->a_un.a_str)) == NULL)
1929                         return (DCMD_ERR);
1930 
1931                 ASSERT(strchr(mdb_nv_get_cookie(v), '=') != NULL);
1932                 mdb_printf("%s\n", strchr(mdb_nv_get_cookie(v), '=') + 1);
1933         } else {
1934 
1935                 mdb_nv_rewind(&pt->p_env);
1936                 while ((v = mdb_nv_advance(&pt->p_env)) != NULL)
1937                         mdb_printf("%s\n", mdb_nv_get_cookie(v));
1938         }
1939 
1940         return (DCMD_OK);
1941 }
1942 
1943 /*
1944  * Function to set a variable in the internal environment, which is used when
1945  * creating new processes.  Note that it is possible that 'nameval' can refer to
1946  * read-only memory, if mdb calls putenv() on an existing value before calling
1947  * this function.  While we should avoid this situation, this function is
1948  * designed to be robust in the face of such changes.
1949  */
1950 static void
1951 pt_env_set(pt_data_t *pt, const char *nameval)
1952 {
1953         mdb_var_t *v;
1954         char *equals, *val;
1955         const char *name;
1956         size_t len;
1957 
1958         if ((equals = strchr(nameval, '=')) != NULL) {
1959                 val = strdup(nameval);
1960                 equals = val + (equals - nameval);
1961         } else {
1962                 /*
1963                  * nameval doesn't contain an equals character.  Convert this to
1964                  * be 'nameval='.
1965                  */
1966                 len = strlen(nameval);
1967                 val = mdb_alloc(len + 2, UM_SLEEP);
1968                 (void) mdb_snprintf(val, len + 2, "%s=", nameval);
1969                 equals = val + len;
1970         }
1971 
1972         /* temporary truncate the string for lookup/insert */
1973         *equals = '\0';
1974         v = mdb_nv_lookup(&pt->p_env, val);
1975 
1976         if (v != NULL) {
1977                 char *old = mdb_nv_get_cookie(v);
1978                 mdb_free(old, strlen(old) + 1);
1979                 name = mdb_nv_get_name(v);
1980         } else {
1981                 /*
1982                  * The environment is created using MDB_NV_EXTNAME, so we must
1983                  * provide external storage for the variable names.
1984                  */
1985                 name = strdup(val);
1986         }
1987 
1988         *equals = '=';
1989 
1990         (void) mdb_nv_insert(&pt->p_env, name, NULL, (uintptr_t)val,
1991             MDB_NV_EXTNAME);
1992 
1993         *equals = '=';
1994 }
1995 
1996 /*
1997  * Clears the internal environment.
1998  */
1999 static void
2000 pt_env_clear(pt_data_t *pt)
2001 {
2002         mdb_var_t *v;
2003         char *val, *name;
2004 
2005         mdb_nv_rewind(&pt->p_env);
2006         while ((v = mdb_nv_advance(&pt->p_env)) != NULL) {
2007 
2008                 name = (char *)mdb_nv_get_name(v);
2009                 val = mdb_nv_get_cookie(v);
2010 
2011                 mdb_nv_remove(&pt->p_env, v);
2012 
2013                 mdb_free(name, strlen(name) + 1);
2014                 mdb_free(val, strlen(val) + 1);
2015         }
2016 }
2017 
2018 /*ARGSUSED*/
2019 static int
2020 pt_setenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
2021 {
2022         mdb_tgt_t *t = mdb.m_target;
2023         pt_data_t *pt = t->t_data;
2024         char *nameval;
2025         size_t len;
2026         int alloc;
2027 
2028         if ((flags & DCMD_ADDRSPEC) || argc == 0 || argc > 2)
2029                 return (DCMD_USAGE);
2030 
2031         if ((argc > 0 && argv[0].a_type != MDB_TYPE_STRING) ||
2032             (argc > 1 && argv[1].a_type != MDB_TYPE_STRING))
2033                 return (DCMD_USAGE);
2034 
2035         if (t->t_pshandle == NULL) {
2036                 mdb_warn("no process active\n");
2037                 return (DCMD_ERR);
2038         }
2039 
2040         /*
2041          * If the process is in some sort of running state, warn the user that
2042          * changes won't immediately take effect.
2043          */
2044         if (Pstate(t->t_pshandle) == PS_RUN ||
2045             Pstate(t->t_pshandle) == PS_STOP) {
2046                 mdb_warn("warning: changes will not take effect until process"
2047                     " is restarted\n");
2048         }
2049 
2050         /*
2051          * We allow two forms of operation.  The first is the usual "name=value"
2052          * parameter.  We also allow the user to specify two arguments, where
2053          * the first is the name of the variable, and the second is the value.
2054          */
2055         alloc = 0;
2056         if (argc == 1) {
2057                 nameval = (char *)argv->a_un.a_str;
2058         } else {
2059                 len = strlen(argv[0].a_un.a_str) +
2060                     strlen(argv[1].a_un.a_str) + 2;
2061                 nameval = mdb_alloc(len, UM_SLEEP);
2062                 (void) mdb_snprintf(nameval, len, "%s=%s", argv[0].a_un.a_str,
2063                     argv[1].a_un.a_str);
2064                 alloc = 1;
2065         }
2066 
2067         pt_env_set(pt, nameval);
2068 
2069         if (alloc)
2070                 mdb_free(nameval, strlen(nameval) + 1);
2071 
2072         return (DCMD_OK);
2073 }
2074 
2075 /*ARGSUSED*/
2076 static int
2077 pt_unsetenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
2078 {
2079         mdb_tgt_t *t = mdb.m_target;
2080         pt_data_t *pt = t->t_data;
2081         mdb_var_t *v;
2082         char *value, *name;
2083 
2084         if ((flags & DCMD_ADDRSPEC) || argc > 1)
2085                 return (DCMD_USAGE);
2086 
2087         if (argc == 1 && argv->a_type != MDB_TYPE_STRING)
2088                 return (DCMD_USAGE);
2089 
2090         if (t->t_pshandle == NULL) {
2091                 mdb_warn("no process active\n");
2092                 return (DCMD_ERR);
2093         }
2094 
2095         /*
2096          * If the process is in some sort of running state, warn the user that
2097          * changes won't immediately take effect.
2098          */
2099         if (Pstate(t->t_pshandle) == PS_RUN ||
2100             Pstate(t->t_pshandle) == PS_STOP) {
2101                 mdb_warn("warning: changes will not take effect until process"
2102                     " is restarted\n");
2103         }
2104 
2105         if (argc == 0) {
2106                 pt_env_clear(pt);
2107         } else {
2108                 if ((v = mdb_nv_lookup(&pt->p_env, argv->a_un.a_str)) != NULL) {
2109                         name = (char *)mdb_nv_get_name(v);
2110                         value = mdb_nv_get_cookie(v);
2111 
2112                         mdb_nv_remove(&pt->p_env, v);
2113 
2114                         mdb_free(name, strlen(name) + 1);
2115                         mdb_free(value, strlen(value) + 1);
2116                 }
2117         }
2118 
2119         return (DCMD_OK);
2120 }
2121 
2122 void
2123 getenv_help(void)
2124 {
2125         mdb_printf("-t  show current process environment"
2126             " instead of initial environment.\n");
2127 }
2128 
2129 static const mdb_dcmd_t pt_dcmds[] = {
2130         { "$c", "?[cnt]", "print stack backtrace", pt_stack },
2131         { "$C", "?[cnt]", "print stack backtrace", pt_stackv },
2132         { "$i", NULL, "print signals that are ignored", pt_ignored },
2133         { "$l", NULL, "print the representative thread's lwp id", pt_lwpid },
2134         { "$L", NULL, "print list of the active lwp ids", pt_lwpids },
2135         { "$r", "?[-u]", "print general-purpose registers", pt_regs },
2136         { "$x", "?", "print floating point registers", pt_fpregs },
2137         { "$X", "?", "print floating point registers", pt_fpregs },
2138         { "$y", "?", "print floating point registers", pt_fpregs },
2139         { "$Y", "?", "print floating point registers", pt_fpregs },
2140         { "$?", "?", "print status and registers", pt_regstatus },
2141         { ":A", "?[core|pid]", "attach to process or core file", pt_attach },
2142         { ":i", ":", "ignore signal (delete all matching events)", pt_ignore },
2143         { ":k", NULL, "forcibly kill and release target", pt_kill },
2144         { ":R", "[-a]", "release the previously attached process", pt_detach },
2145         { "attach", "?[core|pid]",
2146             "attach to process or core file", pt_attach },
2147         { "findstack", ":[-v]", "find user thread stack", pt_findstack },
2148         { "gcore", "[-o prefix] [-c content]",
2149             "produce a core file for the attached process", pt_gcore },
2150         { "getenv", "[-t] [name]", "display an environment variable",
2151                 pt_getenv, getenv_help },
2152         { "kill", NULL, "forcibly kill and release target", pt_kill },
2153         { "release", "[-a]",
2154             "release the previously attached process", pt_detach },
2155         { "regs", "?[-u]", "print general-purpose registers", pt_regs },
2156         { "fpregs", "?[-dqs]", "print floating point registers", pt_fpregs },
2157         { "setenv", "name=value", "set an environment variable", pt_setenv },
2158         { "stack", "?[cnt]", "print stack backtrace", pt_stack },
2159         { "stackregs", "?", "print stack backtrace and registers", pt_stackr },
2160         { "status", NULL, "print summary of current target", pt_status_dcmd },
2161         { "tls", ":symbol",
2162             "lookup TLS data in the context of a given thread", pt_tls },
2163         { "tmodel", "{thread|lwp}", NULL, pt_tmodel },
2164         { "unsetenv", "[name]", "clear an environment variable", pt_unsetenv },
2165         { NULL }
2166 };
2167 
2168 static void
2169 pt_thr_walk_fini(mdb_walk_state_t *wsp)
2170 {
2171         mdb_addrvec_destroy(wsp->walk_data);
2172         mdb_free(wsp->walk_data, sizeof (mdb_addrvec_t));
2173 }
2174 
2175 static int
2176 pt_thr_walk_init(mdb_walk_state_t *wsp)
2177 {
2178         wsp->walk_data = mdb_zalloc(sizeof (mdb_addrvec_t), UM_SLEEP);
2179         mdb_addrvec_create(wsp->walk_data);
2180 
2181         if (PTL_ITER(mdb.m_target, wsp->walk_data) == -1) {
2182                 mdb_warn("failed to iterate over threads");
2183                 pt_thr_walk_fini(wsp);
2184                 return (WALK_ERR);
2185         }
2186 
2187         return (WALK_NEXT);
2188 }
2189 
2190 static int
2191 pt_thr_walk_step(mdb_walk_state_t *wsp)
2192 {
2193         if (mdb_addrvec_length(wsp->walk_data) != 0) {
2194                 return (wsp->walk_callback(mdb_addrvec_shift(wsp->walk_data),
2195                     NULL, wsp->walk_cbdata));
2196         }
2197         return (WALK_DONE);
2198 }
2199 
2200 static const mdb_walker_t pt_walkers[] = {
2201         { "thread", "walk list of valid thread identifiers",
2202             pt_thr_walk_init, pt_thr_walk_step, pt_thr_walk_fini },
2203         { NULL }
2204 };
2205 
2206 static int
2207 pt_agent_check(boolean_t *agent, const lwpstatus_t *psp)
2208 {
2209         if (psp->pr_flags & PR_AGENT)
2210                 *agent = B_TRUE;
2211 
2212         return (0);
2213 }
2214 
2215 static void
2216 pt_activate_common(mdb_tgt_t *t)
2217 {
2218         pt_data_t *pt = t->t_data;
2219         boolean_t hasagent = B_FALSE;
2220         GElf_Sym sym;
2221 
2222         /*
2223          * If we have a libproc handle and AT_BASE is set, the process or core
2224          * is dynamically linked.  We call Prd_agent() to force libproc to
2225          * try to initialize librtld_db, and issue a warning if that fails.
2226          */
2227         if (t->t_pshandle != NULL && Pgetauxval(t->t_pshandle,
2228             AT_BASE) != -1L && Prd_agent(t->t_pshandle) == NULL) {
2229                 mdb_warn("warning: librtld_db failed to initialize; shared "
2230                     "library information will not be available\n");
2231         }
2232 
2233         if (t->t_pshandle != NULL) {
2234                 (void) Plwp_iter(t->t_pshandle,
2235                     (proc_lwp_f *)pt_agent_check, &hasagent);
2236         }
2237 
2238         if (hasagent) {
2239                 mdb_warn("agent lwp detected; forcing "
2240                     "lwp thread model (use ::tmodel to change)\n");
2241         } else if (t->t_pshandle != NULL && Pstate(t->t_pshandle) != PS_IDLE) {
2242                 /*
2243                  * If we have a libproc handle and we do not have an agent LWP,
2244                  * look for the correct thread debugging library.  (If we have
2245                  * an agent LWP, we leave the model as the raw LWP model to
2246                  * allow the agent LWP to be visible to the debugger.)
2247                  */
2248                 (void) Pobject_iter(t->t_pshandle, (proc_map_f *)thr_check, t);
2249         }
2250 
2251         /*
2252          * If there's a global object named '_mdb_abort_info', assuming we're
2253          * debugging mdb itself and load the developer support module.
2254          */
2255         if (mdb_gelf_symtab_lookup_by_name(pt->p_symtab, "_mdb_abort_info",
2256             &sym, NULL) == 0 && GELF_ST_TYPE(sym.st_info) == STT_OBJECT) {
2257                 if (mdb_module_load("mdb_ds", MDB_MOD_SILENT) < 0)
2258                         mdb_warn("warning: failed to load developer support\n");
2259         }
2260 
2261         mdb_tgt_elf_export(pt->p_file);
2262 }
2263 
2264 static void
2265 pt_activate(mdb_tgt_t *t)
2266 {
2267         static const mdb_nv_disc_t reg_disc = { reg_disc_set, reg_disc_get };
2268 
2269         pt_data_t *pt = t->t_data;
2270         struct utsname u1, u2;
2271         mdb_var_t *v;
2272         core_content_t content;
2273 
2274         if (t->t_pshandle) {
2275                 mdb_prop_postmortem = (Pstate(t->t_pshandle) == PS_DEAD);
2276                 mdb_prop_kernel = FALSE;
2277         } else
2278                 mdb_prop_kernel = mdb_prop_postmortem = FALSE;
2279 
2280         mdb_prop_datamodel = MDB_TGT_MODEL_NATIVE;
2281 
2282         /*
2283          * If we're examining a core file that doesn't contain program text,
2284          * and uname(2) doesn't match the NT_UTSNAME note recorded in the
2285          * core file, issue a warning.
2286          */
2287         if (mdb_prop_postmortem == TRUE &&
2288             ((content = Pcontent(t->t_pshandle)) == CC_CONTENT_INVALID ||
2289             !(content & CC_CONTENT_TEXT)) &&
2290             uname(&u1) >= 0 && Puname(t->t_pshandle, &u2) == 0 &&
2291             (strcmp(u1.release, u2.release) != 0 ||
2292             strcmp(u1.version, u2.version) != 0)) {
2293                 mdb_warn("warning: core file is from %s %s %s; shared text "
2294                     "mappings may not match installed libraries\n",
2295                     u2.sysname, u2.release, u2.version);
2296         }
2297 
2298         /*
2299          * Perform the common initialization tasks -- these are shared with
2300          * the pt_exec() and pt_run() subroutines.
2301          */
2302         pt_activate_common(t);
2303 
2304         (void) mdb_tgt_register_dcmds(t, &pt_dcmds[0], MDB_MOD_FORCE);
2305         (void) mdb_tgt_register_walkers(t, &pt_walkers[0], MDB_MOD_FORCE);
2306 
2307         /*
2308          * Iterate through our register description list and export
2309          * each register as a named variable.
2310          */
2311         mdb_nv_rewind(&pt->p_regs);
2312         while ((v = mdb_nv_advance(&pt->p_regs)) != NULL) {
2313                 ushort_t rd_flags = MDB_TGT_R_FLAGS(mdb_nv_get_value(v));
2314 
2315                 if (!(rd_flags & MDB_TGT_R_EXPORT))
2316                         continue; /* Don't export register as a variable */
2317 
2318                 (void) mdb_nv_insert(&mdb.m_nv, mdb_nv_get_name(v), &reg_disc,
2319                     (uintptr_t)t, MDB_NV_PERSIST);
2320         }
2321 }
2322 
2323 static void
2324 pt_deactivate(mdb_tgt_t *t)
2325 {
2326         pt_data_t *pt = t->t_data;
2327         const mdb_dcmd_t *dcp;
2328         const mdb_walker_t *wp;
2329         mdb_var_t *v, *w;
2330 
2331         mdb_nv_rewind(&pt->p_regs);
2332         while ((v = mdb_nv_advance(&pt->p_regs)) != NULL) {
2333                 ushort_t rd_flags = MDB_TGT_R_FLAGS(mdb_nv_get_value(v));
2334 
2335                 if (!(rd_flags & MDB_TGT_R_EXPORT))
2336                         continue; /* Didn't export register as a variable */
2337 
2338                 if (w = mdb_nv_lookup(&mdb.m_nv, mdb_nv_get_name(v))) {
2339                         w->v_flags &= ~MDB_NV_PERSIST;
2340                         mdb_nv_remove(&mdb.m_nv, w);
2341                 }
2342         }
2343 
2344         for (wp = &pt_walkers[0]; wp->walk_name != NULL; wp++) {
2345                 if (mdb_module_remove_walker(t->t_module, wp->walk_name) == -1)
2346                         warn("failed to remove walk %s", wp->walk_name);
2347         }
2348 
2349         for (dcp = &pt_dcmds[0]; dcp->dc_name != NULL; dcp++) {
2350                 if (mdb_module_remove_dcmd(t->t_module, dcp->dc_name) == -1)
2351                         warn("failed to remove dcmd %s", dcp->dc_name);
2352         }
2353 
2354         mdb_prop_postmortem = FALSE;
2355         mdb_prop_kernel = FALSE;
2356         mdb_prop_datamodel = MDB_TGT_MODEL_UNKNOWN;
2357 }
2358 
2359 static void
2360 pt_periodic(mdb_tgt_t *t)
2361 {
2362         pt_data_t *pt = t->t_data;
2363 
2364         if (pt->p_rdstate == PT_RD_CONSIST) {
2365                 if (t->t_pshandle != NULL && Pstate(t->t_pshandle) < PS_LOST &&
2366                     !(mdb.m_flags & MDB_FL_NOMODS)) {
2367                         mdb_printf("%s: You've got symbols!\n", mdb.m_pname);
2368                         mdb_module_load_all(0);
2369                 }
2370                 pt->p_rdstate = PT_RD_NONE;
2371         }
2372 }
2373 
2374 static void
2375 pt_destroy(mdb_tgt_t *t)
2376 {
2377         pt_data_t *pt = t->t_data;
2378 
2379         if (pt->p_idlehandle != NULL && pt->p_idlehandle != t->t_pshandle)
2380                 Prelease(pt->p_idlehandle, 0);
2381 
2382         if (t->t_pshandle != NULL) {
2383                 PTL_DTOR(t);
2384                 pt_release_parents(t);
2385                 pt_pre_detach(t, TRUE);
2386                 Prelease(t->t_pshandle, pt->p_rflags);
2387         }
2388 
2389         mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
2390         pt_close_aout(t);
2391 
2392         if (pt->p_aout_fio != NULL)
2393                 mdb_io_rele(pt->p_aout_fio);
2394 
2395         pt_env_clear(pt);
2396         mdb_nv_destroy(&pt->p_env);
2397 
2398         mdb_nv_destroy(&pt->p_regs);
2399         mdb_free(pt, sizeof (pt_data_t));
2400 }
2401 
2402 /*ARGSUSED*/
2403 static const char *
2404 pt_name(mdb_tgt_t *t)
2405 {
2406         return ("proc");
2407 }
2408 
2409 static const char *
2410 pt_platform(mdb_tgt_t *t)
2411 {
2412         pt_data_t *pt = t->t_data;
2413 
2414         if (t->t_pshandle != NULL &&
2415             Pplatform(t->t_pshandle, pt->p_platform, MAXNAMELEN) != NULL)
2416                 return (pt->p_platform);
2417 
2418         return (mdb_conf_platform());
2419 }
2420 
2421 static int
2422 pt_uname(mdb_tgt_t *t, struct utsname *utsp)
2423 {
2424         if (t->t_pshandle != NULL)
2425                 return (Puname(t->t_pshandle, utsp));
2426 
2427         return (uname(utsp) >= 0 ? 0 : -1);
2428 }
2429 
2430 static int
2431 pt_dmodel(mdb_tgt_t *t)
2432 {
2433         if (t->t_pshandle == NULL)
2434                 return (MDB_TGT_MODEL_NATIVE);
2435 
2436         switch (Pstatus(t->t_pshandle)->pr_dmodel) {
2437         case PR_MODEL_ILP32:
2438                 return (MDB_TGT_MODEL_ILP32);
2439         case PR_MODEL_LP64:
2440                 return (MDB_TGT_MODEL_LP64);
2441         }
2442 
2443         return (MDB_TGT_MODEL_UNKNOWN);
2444 }
2445 
2446 static ssize_t
2447 pt_vread(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
2448 {
2449         ssize_t n;
2450 
2451         /*
2452          * If no handle is open yet, reads from virtual addresses are
2453          * allowed to succeed but return zero-filled memory.
2454          */
2455         if (t->t_pshandle == NULL) {
2456                 bzero(buf, nbytes);
2457                 return (nbytes);
2458         }
2459 
2460         if ((n = Pread(t->t_pshandle, buf, nbytes, addr)) <= 0)
2461                 return (set_errno(EMDB_NOMAP));
2462 
2463         return (n);
2464 }
2465 
2466 static ssize_t
2467 pt_vwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, uintptr_t addr)
2468 {
2469         ssize_t n;
2470 
2471         /*
2472          * If no handle is open yet, writes to virtual addresses are
2473          * allowed to succeed but do not actually modify anything.
2474          */
2475         if (t->t_pshandle == NULL)
2476                 return (nbytes);
2477 
2478         n = Pwrite(t->t_pshandle, buf, nbytes, addr);
2479 
2480         if (n == -1 && errno == EIO)
2481                 return (set_errno(EMDB_NOMAP));
2482 
2483         return (n);
2484 }
2485 
2486 static ssize_t
2487 pt_fread(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
2488 {
2489         pt_data_t *pt = t->t_data;
2490 
2491         if (pt->p_file != NULL) {
2492                 return (mdb_gelf_rw(pt->p_file, buf, nbytes, addr,
2493                     IOPF_READ(pt->p_fio), GIO_READ));
2494         }
2495 
2496         bzero(buf, nbytes);
2497         return (nbytes);
2498 }
2499 
2500 static ssize_t
2501 pt_fwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, uintptr_t addr)
2502 {
2503         pt_data_t *pt = t->t_data;
2504 
2505         if (pt->p_file != NULL) {
2506                 return (mdb_gelf_rw(pt->p_file, (void *)buf, nbytes, addr,
2507                     IOPF_WRITE(pt->p_fio), GIO_WRITE));
2508         }
2509 
2510         return (nbytes);
2511 }
2512 
2513 static const char *
2514 pt_resolve_lmid(const char *object, Lmid_t *lmidp)
2515 {
2516         Lmid_t lmid = PR_LMID_EVERY;
2517         const char *p;
2518 
2519         if (object == MDB_TGT_OBJ_EVERY || object == MDB_TGT_OBJ_EXEC)
2520                 lmid = LM_ID_BASE; /* restrict scope to a.out's link map */
2521         else if (object != MDB_TGT_OBJ_RTLD && strncmp(object, "LM", 2) == 0 &&
2522             (p = strchr(object, '`')) != NULL) {
2523                 object += 2;    /* skip past initial "LM" prefix */
2524                 lmid = strntoul(object, (size_t)(p - object), mdb.m_radix);
2525                 object = p + 1; /* skip past link map specifier */
2526         }
2527 
2528         *lmidp = lmid;
2529         return (object);
2530 }
2531 
2532 static int
2533 tlsbase(mdb_tgt_t *t, mdb_tgt_tid_t tid, Lmid_t lmid, const char *object,
2534     psaddr_t *basep)
2535 {
2536         pt_data_t *pt = t->t_data;
2537         const rd_loadobj_t *loadobjp;
2538         td_thrhandle_t th;
2539         td_err_e err;
2540 
2541         if (object == MDB_TGT_OBJ_EVERY)
2542                 return (set_errno(EINVAL));
2543 
2544         if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE)
2545                 return (set_errno(EMDB_NOPROC));
2546 
2547         if (pt->p_tdb_ops == NULL)
2548                 return (set_errno(EMDB_TDB));
2549 
2550         err = pt->p_tdb_ops->td_ta_map_id2thr(pt->p_ptl_hdl, tid, &th);
2551         if (err != TD_OK)
2552                 return (set_errno(tdb_to_errno(err)));
2553 
2554         /*
2555          * If this fails, rtld_db has failed to initialize properly.
2556          */
2557         if ((loadobjp = Plmid_to_loadobj(t->t_pshandle, lmid, object)) == NULL)
2558                 return (set_errno(EMDB_NORTLD));
2559 
2560         /*
2561          * This will fail if the TLS block has not been allocated for the
2562          * object that contains the TLS symbol in question.
2563          */
2564         err = pt->p_tdb_ops->td_thr_tlsbase(&th, loadobjp->rl_tlsmodid, basep);
2565         if (err != TD_OK)
2566                 return (set_errno(tdb_to_errno(err)));
2567 
2568         return (0);
2569 }
2570 
2571 typedef struct {
2572         mdb_tgt_t       *pl_tgt;
2573         const char      *pl_name;
2574         Lmid_t          pl_lmid;
2575         GElf_Sym        *pl_symp;
2576         mdb_syminfo_t   *pl_sip;
2577         mdb_tgt_tid_t   pl_tid;
2578         mdb_bool_t      pl_found;
2579 } pt_lookup_t;
2580 
2581 /*ARGSUSED*/
2582 static int
2583 pt_lookup_cb(void *data, const prmap_t *pmp, const char *object)
2584 {
2585         pt_lookup_t *plp = data;
2586         struct ps_prochandle *P = plp->pl_tgt->t_pshandle;
2587         prsyminfo_t si;
2588         GElf_Sym sym;
2589 
2590         if (Pxlookup_by_name(P, plp->pl_lmid, object, plp->pl_name, &sym,
2591             &si) != 0)
2592                 return (0);
2593 
2594         /*
2595          * If we encounter a match with SHN_UNDEF, keep looking for a
2596          * better match. Return the first match with SHN_UNDEF set if no
2597          * better match is found.
2598          */
2599         if (sym.st_shndx == SHN_UNDEF) {
2600                 if (!plp->pl_found) {
2601                         plp->pl_found = TRUE;
2602                         *plp->pl_symp = sym;
2603                         plp->pl_sip->sym_table = si.prs_table;
2604                         plp->pl_sip->sym_id = si.prs_id;
2605                 }
2606 
2607                 return (0);
2608         }
2609 
2610         /*
2611          * Note that if the symbol's st_shndx is SHN_UNDEF we don't have the
2612          * TLS offset anyway, so adding in the tlsbase would be worthless.
2613          */
2614         if (GELF_ST_TYPE(sym.st_info) == STT_TLS &&
2615             plp->pl_tid != (mdb_tgt_tid_t)-1) {
2616                 psaddr_t base;
2617 
2618                 if (tlsbase(plp->pl_tgt, plp->pl_tid, plp->pl_lmid, object,
2619                     &base) != 0)
2620                         return (-1); /* errno is set for us */
2621 
2622                 sym.st_value += base;
2623         }
2624 
2625         plp->pl_found = TRUE;
2626         *plp->pl_symp = sym;
2627         plp->pl_sip->sym_table = si.prs_table;
2628         plp->pl_sip->sym_id = si.prs_id;
2629 
2630         return (1);
2631 }
2632 
2633 /*
2634  * Lookup the symbol with a thread context so that we can adjust TLS symbols
2635  * to get the values as they would appear in the context of the given thread.
2636  */
2637 static int
2638 pt_lookup_by_name_thr(mdb_tgt_t *t, const char *object,
2639     const char *name, GElf_Sym *symp, mdb_syminfo_t *sip, mdb_tgt_tid_t tid)
2640 {
2641         struct ps_prochandle *P = t->t_pshandle;
2642         pt_data_t *pt = t->t_data;
2643         Lmid_t lmid;
2644         uint_t i;
2645         const rd_loadobj_t *aout_lop;
2646 
2647         object = pt_resolve_lmid(object, &lmid);
2648 
2649         if (P != NULL) {
2650                 pt_lookup_t pl;
2651 
2652                 pl.pl_tgt = t;
2653                 pl.pl_name = name;
2654                 pl.pl_lmid = lmid;
2655                 pl.pl_symp = symp;
2656                 pl.pl_sip = sip;
2657                 pl.pl_tid = tid;
2658                 pl.pl_found = FALSE;
2659 
2660                 if (object == MDB_TGT_OBJ_EVERY) {
2661                         if (Pobject_iter_resolved(P, pt_lookup_cb, &pl) == -1)
2662                                 return (-1); /* errno is set for us */
2663                         if ((!pl.pl_found) &&
2664                             (Pobject_iter(P, pt_lookup_cb, &pl) == -1))
2665                                 return (-1); /* errno is set for us */
2666                 } else {
2667                         const prmap_t *pmp;
2668 
2669                         /*
2670                          * This can fail either due to an invalid lmid or
2671                          * an invalid object. To determine which is
2672                          * faulty, we test the lmid against known valid
2673                          * lmids and then see if using a wild-card lmid
2674                          * improves ths situation.
2675                          */
2676                         if ((pmp = Plmid_to_map(P, lmid, object)) == NULL) {
2677                                 if (lmid != PR_LMID_EVERY &&
2678                                     lmid != LM_ID_BASE &&
2679                                     lmid != LM_ID_LDSO &&
2680                                     Plmid_to_map(P, PR_LMID_EVERY, object)
2681                                     != NULL)
2682                                         return (set_errno(EMDB_NOLMID));
2683                                 else
2684                                         return (set_errno(EMDB_NOOBJ));
2685                         }
2686 
2687                         if (pt_lookup_cb(&pl, pmp, object) == -1)
2688                                 return (-1); /* errno is set for us */
2689                 }
2690 
2691                 if (pl.pl_found)
2692                         return (0);
2693         }
2694 
2695         /*
2696          * If libproc doesn't have the symbols for rtld, we're cooked --
2697          * mdb doesn't have those symbols either.
2698          */
2699         if (object == MDB_TGT_OBJ_RTLD)
2700                 return (set_errno(EMDB_NOSYM));
2701 
2702         if (object != MDB_TGT_OBJ_EXEC && object != MDB_TGT_OBJ_EVERY) {
2703                 int status = mdb_gelf_symtab_lookup_by_file(pt->p_symtab,
2704                     object, name, symp, &sip->sym_id);
2705 
2706                 if (status != 0) {
2707                         if (P != NULL &&
2708                             Plmid_to_map(P, PR_LMID_EVERY, object) != NULL)
2709                                 return (set_errno(EMDB_NOSYM));
2710                         else
2711                                 return (-1); /* errno set from lookup_by_file */
2712                 }
2713 
2714                 goto found;
2715         }
2716 
2717         if (mdb_gelf_symtab_lookup_by_name(pt->p_symtab, name, symp, &i) == 0) {
2718                 sip->sym_table = MDB_TGT_SYMTAB;
2719                 sip->sym_id = i;
2720                 goto local_found;
2721         }
2722 
2723         if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, name, symp, &i) == 0) {
2724                 sip->sym_table = MDB_TGT_DYNSYM;
2725                 sip->sym_id = i;
2726                 goto local_found;
2727         }
2728 
2729         return (set_errno(EMDB_NOSYM));
2730 
2731 local_found:
2732         if (pt->p_file != NULL &&
2733             pt->p_file->gf_ehdr.e_type == ET_DYN &&
2734             P != NULL &&
2735             (aout_lop = Pname_to_loadobj(P, PR_OBJ_EXEC)) != NULL)
2736                 symp->st_value += aout_lop->rl_base;
2737 
2738 found:
2739         /*
2740          * If the symbol has type TLS, libproc should have found the symbol
2741          * if it exists and has been allocated.
2742          */
2743         if (GELF_ST_TYPE(symp->st_info) == STT_TLS)
2744                 return (set_errno(EMDB_TLS));
2745 
2746         return (0);
2747 }
2748 
2749 static int
2750 pt_lookup_by_name(mdb_tgt_t *t, const char *object,
2751     const char *name, GElf_Sym *symp, mdb_syminfo_t *sip)
2752 {
2753         return (pt_lookup_by_name_thr(t, object, name, symp, sip, PTL_TID(t)));
2754 }
2755 
2756 static int
2757 pt_lookup_by_addr(mdb_tgt_t *t, uintptr_t addr, uint_t flags,
2758     char *buf, size_t nbytes, GElf_Sym *symp, mdb_syminfo_t *sip)
2759 {
2760         struct ps_prochandle *P = t->t_pshandle;
2761         pt_data_t *pt = t->t_data;
2762         rd_plt_info_t rpi = { 0 };
2763 
2764         const char *pltsym;
2765         int rv, match, i;
2766 
2767         mdb_gelf_symtab_t *gsts[3];     /* mdb.m_prsym, .symtab, .dynsym */
2768         int gstc = 0;                   /* number of valid gsts[] entries */
2769 
2770         mdb_gelf_symtab_t *gst = NULL;  /* set if 'sym' is from a gst */
2771         const prmap_t *pmp = NULL;      /* set if 'sym' is from libproc */
2772         GElf_Sym sym;                   /* best symbol found so far if !exact */
2773         prsyminfo_t si;
2774 
2775         /*
2776          * Fill in our array of symbol table pointers with the private symbol
2777          * table, static symbol table, and dynamic symbol table if applicable.
2778          * These are done in order of precedence so that if we match and
2779          * MDB_TGT_SYM_EXACT is set, we need not look any further.
2780          */
2781         if (mdb.m_prsym != NULL)
2782                 gsts[gstc++] = mdb.m_prsym;
2783         if (P == NULL && pt->p_symtab != NULL)
2784                 gsts[gstc++] = pt->p_symtab;
2785         if (P == NULL && pt->p_dynsym != NULL)
2786                 gsts[gstc++] = pt->p_dynsym;
2787 
2788         /*
2789          * Loop through our array attempting to match the address.  If we match
2790          * and we're in exact mode, we're done.  Otherwise save the symbol in
2791          * the local sym variable if it is closer than our previous match.
2792          * We explicitly watch for zero-valued symbols since DevPro insists
2793          * on storing __fsr_init_value's value as the symbol value instead
2794          * of storing it in a constant integer.
2795          */
2796         for (i = 0; i < gstc; i++) {
2797                 if (mdb_gelf_symtab_lookup_by_addr(gsts[i], addr, flags, buf,
2798                     nbytes, symp, &sip->sym_id) != 0 || symp->st_value == 0)
2799                         continue;
2800 
2801                 if (flags & MDB_TGT_SYM_EXACT) {
2802                         gst = gsts[i];
2803                         goto found;
2804                 }
2805 
2806                 if (gst == NULL || mdb_gelf_sym_closer(symp, &sym, addr)) {
2807                         gst = gsts[i];
2808                         sym = *symp;
2809                 }
2810         }
2811 
2812         /*
2813          * If we have no libproc handle active, we're done: fail if gst is
2814          * NULL; otherwise copy out our best symbol and skip to the end.
2815          * We also skip to found if gst is the private symbol table: we
2816          * want this to always take precedence over PLT re-vectoring.
2817          */
2818         if (P == NULL || (gst != NULL && gst == mdb.m_prsym)) {
2819                 if (gst == NULL)
2820                         return (set_errno(EMDB_NOSYMADDR));
2821                 *symp = sym;
2822                 goto found;
2823         }
2824 
2825         /*
2826          * Check to see if the address is in a PLT: if it is, use librtld_db to
2827          * attempt to resolve the PLT entry.  If the entry is bound, reset addr
2828          * to the bound address, add a special prefix to the caller's buf,
2829          * forget our previous guess, and then continue using the new addr.
2830          * If the entry is not bound, copy the corresponding symbol name into
2831          * buf and return a fake symbol for the given address.
2832          */
2833         if ((pltsym = Ppltdest(P, addr)) != NULL) {
2834                 const rd_loadobj_t *rlp;
2835                 rd_agent_t *rap;
2836 
2837                 if ((rap = Prd_agent(P)) != NULL &&
2838                     (rlp = Paddr_to_loadobj(P, addr)) != NULL &&
2839                     rd_plt_resolution(rap, addr, Pstatus(P)->pr_lwp.pr_lwpid,
2840                     rlp->rl_plt_base, &rpi) == RD_OK &&
2841                     (rpi.pi_flags & RD_FLG_PI_PLTBOUND)) {
2842                         size_t n;
2843                         n = mdb_iob_snprintf(buf, nbytes, "PLT=");
2844                         addr = rpi.pi_baddr;
2845                         if (n > nbytes) {
2846                                 buf += nbytes;
2847                                 nbytes = 0;
2848                         } else {
2849                                 buf += n;
2850                                 nbytes -= n;
2851                         }
2852                         gst = NULL;
2853                 } else {
2854                         (void) mdb_iob_snprintf(buf, nbytes, "PLT:%s", pltsym);
2855                         bzero(symp, sizeof (GElf_Sym));
2856                         symp->st_value = addr;
2857                         symp->st_info = GELF_ST_INFO(STB_GLOBAL, STT_FUNC);
2858                         return (0);
2859                 }
2860         }
2861 
2862         /*
2863          * Ask libproc to convert the address to the closest symbol for us.
2864          * Once we get the closest symbol, we perform the EXACT match or
2865          * smart-mode or absolute distance check ourself:
2866          */
2867         if (PT_LIBPROC_RESOLVE(P)) {
2868                 rv = Pxlookup_by_addr_resolved(P, addr, buf, nbytes,
2869                     symp, &si);
2870         } else {
2871                 rv = Pxlookup_by_addr(P, addr, buf, nbytes,
2872                     symp, &si);
2873         }
2874         if ((rv == 0) && (symp->st_value != 0) &&
2875             (gst == NULL || mdb_gelf_sym_closer(symp, &sym, addr))) {
2876 
2877                 if (flags & MDB_TGT_SYM_EXACT)
2878                         match = (addr == symp->st_value);
2879                 else if (mdb.m_symdist == 0)
2880                         match = (addr >= symp->st_value &&
2881                             addr < symp->st_value + symp->st_size);
2882                 else
2883                         match = (addr >= symp->st_value &&
2884                             addr < symp->st_value + mdb.m_symdist);
2885 
2886                 if (match) {
2887                         pmp = Paddr_to_map(P, addr);
2888                         gst = NULL;
2889                         sip->sym_table = si.prs_table;
2890                         sip->sym_id = si.prs_id;
2891                         goto found;
2892                 }
2893         }
2894 
2895         /*
2896          * If we get here, Plookup_by_addr has failed us.  If we have no
2897          * previous best symbol (gst == NULL), we've failed completely.
2898          * Otherwise we copy out that symbol and continue on to 'found'.
2899          */
2900         if (gst == NULL)
2901                 return (set_errno(EMDB_NOSYMADDR));
2902         *symp = sym;
2903 found:
2904         /*
2905          * Once we've found something, copy the final name into the caller's
2906          * buffer and prefix it with the mapping name if appropriate.
2907          */
2908         if (pmp != NULL && pmp != Pname_to_map(P, PR_OBJ_EXEC)) {
2909                 const char *prefix = pmp->pr_mapname;
2910                 Lmid_t lmid;
2911 
2912                 if (PT_LIBPROC_RESOLVE(P)) {
2913                         if (Pobjname_resolved(P, addr, pt->p_objname,
2914                             MDB_TGT_MAPSZ))
2915                                 prefix = pt->p_objname;
2916                 } else {
2917                         if (Pobjname(P, addr, pt->p_objname, MDB_TGT_MAPSZ))
2918                                 prefix = pt->p_objname;
2919                 }
2920 
2921                 if (buf != NULL && nbytes > 1) {
2922                         (void) strncpy(pt->p_symname, buf, MDB_TGT_SYM_NAMLEN);
2923                         pt->p_symname[MDB_TGT_SYM_NAMLEN - 1] = '\0';
2924                 } else {
2925                         pt->p_symname[0] = '\0';
2926                 }
2927 
2928                 if (prefix == pt->p_objname && Plmid(P, addr, &lmid) == 0 && (
2929                     (lmid != LM_ID_BASE && lmid != LM_ID_LDSO) ||
2930                     (mdb.m_flags & MDB_FL_SHOWLMID))) {
2931                         (void) mdb_iob_snprintf(buf, nbytes, "LM%lr`%s`%s",
2932                             lmid, strbasename(prefix), pt->p_symname);
2933                 } else {
2934                         (void) mdb_iob_snprintf(buf, nbytes, "%s`%s",
2935                             strbasename(prefix), pt->p_symname);
2936                 }
2937 
2938         } else if (gst != NULL && buf != NULL && nbytes > 0) {
2939                 (void) strncpy(buf, mdb_gelf_sym_name(gst, symp), nbytes);
2940                 buf[nbytes - 1] = '\0';
2941         }
2942 
2943         return (0);
2944 }
2945 
2946 
2947 static int
2948 pt_symbol_iter_cb(void *arg, const GElf_Sym *sym, const char *name,
2949     const prsyminfo_t *sip)
2950 {
2951         pt_symarg_t *psp = arg;
2952 
2953         psp->psym_info.sym_id = sip->prs_id;
2954 
2955         return (psp->psym_func(psp->psym_private, sym, name, &psp->psym_info,
2956             psp->psym_obj));
2957 }
2958 
2959 static int
2960 pt_objsym_iter(void *arg, const prmap_t *pmp, const char *object)
2961 {
2962         Lmid_t lmid = PR_LMID_EVERY;
2963         pt_symarg_t *psp = arg;
2964 
2965         psp->psym_obj = object;
2966 
2967         (void) Plmid(psp->psym_targ->t_pshandle, pmp->pr_vaddr, &lmid);
2968         (void) Pxsymbol_iter(psp->psym_targ->t_pshandle, lmid, object,
2969             psp->psym_which, psp->psym_type, pt_symbol_iter_cb, arg);
2970 
2971         return (0);
2972 }
2973 
2974 static int
2975 pt_symbol_filt(void *arg, const GElf_Sym *sym, const char *name, uint_t id)
2976 {
2977         pt_symarg_t *psp = arg;
2978 
2979         if (mdb_tgt_sym_match(sym, psp->psym_type)) {
2980                 psp->psym_info.sym_id = id;
2981                 return (psp->psym_func(psp->psym_private, sym, name,
2982                     &psp->psym_info, psp->psym_obj));
2983         }
2984 
2985         return (0);
2986 }
2987 
2988 static int
2989 pt_symbol_iter(mdb_tgt_t *t, const char *object, uint_t which,
2990     uint_t type, mdb_tgt_sym_f *func, void *private)
2991 {
2992         pt_data_t *pt = t->t_data;
2993         mdb_gelf_symtab_t *gst;
2994         pt_symarg_t ps;
2995         Lmid_t lmid;
2996 
2997         object = pt_resolve_lmid(object, &lmid);
2998 
2999         ps.psym_targ = t;
3000         ps.psym_which = which;
3001         ps.psym_type = type;
3002         ps.psym_func = func;
3003         ps.psym_private = private;
3004         ps.psym_obj = object;
3005 
3006         if (t->t_pshandle != NULL) {
3007                 if (object != MDB_TGT_OBJ_EVERY) {
3008                         if (Plmid_to_map(t->t_pshandle, lmid, object) == NULL)
3009                                 return (set_errno(EMDB_NOOBJ));
3010                         (void) Pxsymbol_iter(t->t_pshandle, lmid, object,
3011                             which, type, pt_symbol_iter_cb, &ps);
3012                         return (0);
3013                 } else if (Prd_agent(t->t_pshandle) != NULL) {
3014                         if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
3015                                 (void) Pobject_iter_resolved(t->t_pshandle,
3016                                     pt_objsym_iter, &ps);
3017                         } else {
3018                                 (void) Pobject_iter(t->t_pshandle,
3019                                     pt_objsym_iter, &ps);
3020                         }
3021                         return (0);
3022                 }
3023         }
3024 
3025         if (lmid != LM_ID_BASE && lmid != PR_LMID_EVERY)
3026                 return (set_errno(EMDB_NOLMID));
3027 
3028         if (object != MDB_TGT_OBJ_EXEC && object != MDB_TGT_OBJ_EVERY &&
3029             pt->p_fio != NULL &&
3030             strcmp(object, IOP_NAME(pt->p_fio)) != 0)
3031                 return (set_errno(EMDB_NOOBJ));
3032 
3033         if (which == MDB_TGT_SYMTAB)
3034                 gst = pt->p_symtab;
3035         else
3036                 gst = pt->p_dynsym;
3037 
3038         if (gst != NULL) {
3039                 ps.psym_info.sym_table = gst->gst_tabid;
3040                 mdb_gelf_symtab_iter(gst, pt_symbol_filt, &ps);
3041         }
3042 
3043         return (0);
3044 }
3045 
3046 static const mdb_map_t *
3047 pt_prmap_to_mdbmap(mdb_tgt_t *t, const prmap_t *prp, mdb_map_t *mp)
3048 {
3049         struct ps_prochandle *P = t->t_pshandle;
3050         char *rv, name[MAXPATHLEN];
3051         Lmid_t lmid;
3052 
3053         if (PT_LIBPROC_RESOLVE(P)) {
3054                 rv = Pobjname_resolved(P, prp->pr_vaddr, name, sizeof (name));
3055         } else {
3056                 rv = Pobjname(P, prp->pr_vaddr, name, sizeof (name));
3057         }
3058 
3059         if (rv != NULL) {
3060                 if (Plmid(P, prp->pr_vaddr, &lmid) == 0 && (
3061                     (lmid != LM_ID_BASE && lmid != LM_ID_LDSO) ||
3062                     (mdb.m_flags & MDB_FL_SHOWLMID))) {
3063                         (void) mdb_iob_snprintf(mp->map_name, MDB_TGT_MAPSZ,
3064                             "LM%lr`%s", lmid, name);
3065                 } else {
3066                         (void) strncpy(mp->map_name, name, MDB_TGT_MAPSZ - 1);
3067                         mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3068                 }
3069         } else {
3070                 (void) strncpy(mp->map_name, prp->pr_mapname,
3071                     MDB_TGT_MAPSZ - 1);
3072                 mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3073         }
3074 
3075         mp->map_base = prp->pr_vaddr;
3076         mp->map_size = prp->pr_size;
3077         mp->map_flags = 0;
3078 
3079         if (prp->pr_mflags & MA_READ)
3080                 mp->map_flags |= MDB_TGT_MAP_R;
3081         if (prp->pr_mflags & MA_WRITE)
3082                 mp->map_flags |= MDB_TGT_MAP_W;
3083         if (prp->pr_mflags & MA_EXEC)
3084                 mp->map_flags |= MDB_TGT_MAP_X;
3085 
3086         if (prp->pr_mflags & MA_SHM)
3087                 mp->map_flags |= MDB_TGT_MAP_SHMEM;
3088         if (prp->pr_mflags & MA_BREAK)
3089                 mp->map_flags |= MDB_TGT_MAP_HEAP;
3090         if (prp->pr_mflags & MA_STACK)
3091                 mp->map_flags |= MDB_TGT_MAP_STACK;
3092         if (prp->pr_mflags & MA_ANON)
3093                 mp->map_flags |= MDB_TGT_MAP_ANON;
3094 
3095         return (mp);
3096 }
3097 
3098 /*ARGSUSED*/
3099 static int
3100 pt_map_apply(void *arg, const prmap_t *prp, const char *name)
3101 {
3102         pt_maparg_t *pmp = arg;
3103         mdb_map_t map;
3104 
3105         return (pmp->pmap_func(pmp->pmap_private,
3106             pt_prmap_to_mdbmap(pmp->pmap_targ, prp, &map), map.map_name));
3107 }
3108 
3109 static int
3110 pt_mapping_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
3111 {
3112         if (t->t_pshandle != NULL) {
3113                 pt_maparg_t pm;
3114 
3115                 pm.pmap_targ = t;
3116                 pm.pmap_func = func;
3117                 pm.pmap_private = private;
3118 
3119                 if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
3120                         (void) Pmapping_iter_resolved(t->t_pshandle,
3121                             pt_map_apply, &pm);
3122                 } else {
3123                         (void) Pmapping_iter(t->t_pshandle,
3124                             pt_map_apply, &pm);
3125                 }
3126                 return (0);
3127         }
3128 
3129         return (set_errno(EMDB_NOPROC));
3130 }
3131 
3132 static int
3133 pt_object_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
3134 {
3135         pt_data_t *pt = t->t_data;
3136 
3137         /*
3138          * If we have a libproc handle, we can just call Pobject_iter to
3139          * iterate over its list of load object information.
3140          */
3141         if (t->t_pshandle != NULL) {
3142                 pt_maparg_t pm;
3143 
3144                 pm.pmap_targ = t;
3145                 pm.pmap_func = func;
3146                 pm.pmap_private = private;
3147 
3148                 if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
3149                         (void) Pobject_iter_resolved(t->t_pshandle,
3150                             pt_map_apply, &pm);
3151                 } else {
3152                         (void) Pobject_iter(t->t_pshandle,
3153                             pt_map_apply, &pm);
3154                 }
3155                 return (0);
3156         }
3157 
3158         /*
3159          * If we're examining an executable or other ELF file but we have no
3160          * libproc handle, fake up some information based on DT_NEEDED entries.
3161          */
3162         if (pt->p_dynsym != NULL && pt->p_file->gf_dyns != NULL &&
3163             pt->p_fio != NULL) {
3164                 mdb_gelf_sect_t *gsp = pt->p_dynsym->gst_ssect;
3165                 GElf_Dyn *dynp = pt->p_file->gf_dyns;
3166                 mdb_map_t *mp = &pt->p_map;
3167                 const char *s = IOP_NAME(pt->p_fio);
3168                 size_t i;
3169 
3170                 (void) strncpy(mp->map_name, s, MDB_TGT_MAPSZ);
3171                 mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3172                 mp->map_flags = MDB_TGT_MAP_R | MDB_TGT_MAP_X;
3173                 mp->map_base = NULL;
3174                 mp->map_size = 0;
3175 
3176                 if (func(private, mp, s) != 0)
3177                         return (0);
3178 
3179                 for (i = 0; i < pt->p_file->gf_ndyns; i++, dynp++) {
3180                         if (dynp->d_tag == DT_NEEDED) {
3181                                 s = (char *)gsp->gs_data + dynp->d_un.d_val;
3182                                 (void) strncpy(mp->map_name, s, MDB_TGT_MAPSZ);
3183                                 mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3184                                 if (func(private, mp, s) != 0)
3185                                         return (0);
3186                         }
3187                 }
3188 
3189                 return (0);
3190         }
3191 
3192         return (set_errno(EMDB_NOPROC));
3193 }
3194 
3195 static const mdb_map_t *
3196 pt_addr_to_map(mdb_tgt_t *t, uintptr_t addr)
3197 {
3198         pt_data_t *pt = t->t_data;
3199         const prmap_t *pmp;
3200 
3201         if (t->t_pshandle == NULL) {
3202                 (void) set_errno(EMDB_NOPROC);
3203                 return (NULL);
3204         }
3205 
3206         if ((pmp = Paddr_to_map(t->t_pshandle, addr)) == NULL) {
3207                 (void) set_errno(EMDB_NOMAP);
3208                 return (NULL);
3209         }
3210 
3211         return (pt_prmap_to_mdbmap(t, pmp, &pt->p_map));
3212 }
3213 
3214 static const mdb_map_t *
3215 pt_name_to_map(mdb_tgt_t *t, const char *object)
3216 {
3217         pt_data_t *pt = t->t_data;
3218         const prmap_t *pmp;
3219         Lmid_t lmid;
3220 
3221         if (t->t_pshandle == NULL) {
3222                 (void) set_errno(EMDB_NOPROC);
3223                 return (NULL);
3224         }
3225 
3226         object = pt_resolve_lmid(object, &lmid);
3227 
3228         if ((pmp = Plmid_to_map(t->t_pshandle, lmid, object)) == NULL) {
3229                 (void) set_errno(EMDB_NOOBJ);
3230                 return (NULL);
3231         }
3232 
3233         return (pt_prmap_to_mdbmap(t, pmp, &pt->p_map));
3234 }
3235 
3236 static ctf_file_t *
3237 pt_addr_to_ctf(mdb_tgt_t *t, uintptr_t addr)
3238 {
3239         ctf_file_t *ret;
3240 
3241         if (t->t_pshandle == NULL) {
3242                 (void) set_errno(EMDB_NOPROC);
3243                 return (NULL);
3244         }
3245 
3246         if ((ret = Paddr_to_ctf(t->t_pshandle, addr)) == NULL) {
3247                 (void) set_errno(EMDB_NOOBJ);
3248                 return (NULL);
3249         }
3250 
3251         return (ret);
3252 }
3253 
3254 static ctf_file_t *
3255 pt_name_to_ctf(mdb_tgt_t *t, const char *name)
3256 {
3257         ctf_file_t *ret;
3258 
3259         if (t->t_pshandle == NULL) {
3260                 (void) set_errno(EMDB_NOPROC);
3261                 return (NULL);
3262         }
3263 
3264         if ((ret = Pname_to_ctf(t->t_pshandle, name)) == NULL) {
3265                 (void) set_errno(EMDB_NOOBJ);
3266                 return (NULL);
3267         }
3268 
3269         return (ret);
3270 }
3271 
3272 static int
3273 pt_status(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3274 {
3275         const pstatus_t *psp;
3276         prgregset_t gregs;
3277         int state;
3278 
3279         bzero(tsp, sizeof (mdb_tgt_status_t));
3280 
3281         if (t->t_pshandle == NULL) {
3282                 tsp->st_state = MDB_TGT_IDLE;
3283                 return (0);
3284         }
3285 
3286         switch (state = Pstate(t->t_pshandle)) {
3287         case PS_RUN:
3288                 tsp->st_state = MDB_TGT_RUNNING;
3289                 break;
3290 
3291         case PS_STOP:
3292                 tsp->st_state = MDB_TGT_STOPPED;
3293                 psp = Pstatus(t->t_pshandle);
3294 
3295                 tsp->st_tid = PTL_TID(t);
3296                 if (PTL_GETREGS(t, tsp->st_tid, gregs) == 0)
3297                         tsp->st_pc = gregs[R_PC];
3298 
3299                 if (psp->pr_flags & PR_ISTOP)
3300                         tsp->st_flags |= MDB_TGT_ISTOP;
3301                 if (psp->pr_flags & PR_DSTOP)
3302                         tsp->st_flags |= MDB_TGT_DSTOP;
3303 
3304                 break;
3305 
3306         case PS_LOST:
3307                 tsp->st_state = MDB_TGT_LOST;
3308                 break;
3309         case PS_UNDEAD:
3310                 tsp->st_state = MDB_TGT_UNDEAD;
3311                 break;
3312         case PS_DEAD:
3313                 tsp->st_state = MDB_TGT_DEAD;
3314                 break;
3315         case PS_IDLE:
3316                 tsp->st_state = MDB_TGT_IDLE;
3317                 break;
3318         default:
3319                 fail("unknown libproc state (%d)\n", state);
3320         }
3321 
3322         if (t->t_flags & MDB_TGT_F_BUSY)
3323                 tsp->st_flags |= MDB_TGT_BUSY;
3324 
3325         return (0);
3326 }
3327 
3328 static void
3329 pt_dupfd(const char *file, int oflags, mode_t mode, int dfd)
3330 {
3331         int fd;
3332 
3333         if ((fd = open(file, oflags, mode)) >= 0) {
3334                 (void) fcntl(fd, F_DUP2FD, dfd);
3335                 (void) close(fd);
3336         } else
3337                 warn("failed to open %s as descriptor %d", file, dfd);
3338 }
3339 
3340 /*
3341  * The Pcreate_callback() function interposes on the default, empty libproc
3342  * definition.  It will be called following a fork of a new child process by
3343  * Pcreate() below, but before the exec of the new process image.  We use this
3344  * callback to optionally redirect stdin and stdout and reset the dispositions
3345  * of SIGPIPE and SIGQUIT from SIG_IGN back to SIG_DFL.
3346  */
3347 /*ARGSUSED*/
3348 void
3349 Pcreate_callback(struct ps_prochandle *P)
3350 {
3351         pt_data_t *pt = mdb.m_target->t_data;
3352 
3353         if (pt->p_stdin != NULL)
3354                 pt_dupfd(pt->p_stdin, O_RDWR, 0, STDIN_FILENO);
3355         if (pt->p_stdout != NULL)
3356                 pt_dupfd(pt->p_stdout, O_CREAT | O_WRONLY, 0666, STDOUT_FILENO);
3357 
3358         (void) mdb_signal_sethandler(SIGPIPE, SIG_DFL, NULL);
3359         (void) mdb_signal_sethandler(SIGQUIT, SIG_DFL, NULL);
3360 }
3361 
3362 static int
3363 pt_run(mdb_tgt_t *t, int argc, const mdb_arg_t *argv)
3364 {
3365         pt_data_t *pt = t->t_data;
3366         struct ps_prochandle *P;
3367         char execname[MAXPATHLEN];
3368         const char **pargv;
3369         int pargc = 0;
3370         int i, perr;
3371         char **penv;
3372         mdb_var_t *v;
3373 
3374         if (pt->p_aout_fio == NULL) {
3375                 warn("run requires executable to be specified on "
3376                     "command-line\n");
3377                 return (set_errno(EMDB_TGT));
3378         }
3379 
3380         pargv = mdb_alloc(sizeof (char *) * (argc + 2), UM_SLEEP);
3381         pargv[pargc++] = strbasename(IOP_NAME(pt->p_aout_fio));
3382 
3383         for (i = 0; i < argc; i++) {
3384                 if (argv[i].a_type != MDB_TYPE_STRING) {
3385                         mdb_free(pargv, sizeof (char *) * (argc + 2));
3386                         return (set_errno(EINVAL));
3387                 }
3388                 if (argv[i].a_un.a_str[0] == '<')
3389                         pt->p_stdin = argv[i].a_un.a_str + 1;
3390                 else if (argv[i].a_un.a_str[0] == '>')
3391                         pt->p_stdout = argv[i].a_un.a_str + 1;
3392                 else
3393                         pargv[pargc++] = argv[i].a_un.a_str;
3394         }
3395         pargv[pargc] = NULL;
3396 
3397         /*
3398          * Since Pcreate() uses execvp() and "." may not be present in $PATH,
3399          * we must manually prepend "./" when the executable is a simple name.
3400          */
3401         if (strchr(IOP_NAME(pt->p_aout_fio), '/') == NULL) {
3402                 (void) snprintf(execname, sizeof (execname), "./%s",
3403                     IOP_NAME(pt->p_aout_fio));
3404         } else {
3405                 (void) snprintf(execname, sizeof (execname), "%s",
3406                     IOP_NAME(pt->p_aout_fio));
3407         }
3408 
3409         penv = mdb_alloc((mdb_nv_size(&pt->p_env)+ 1) * sizeof (char *),
3410             UM_SLEEP);
3411         for (mdb_nv_rewind(&pt->p_env), i = 0;
3412             (v = mdb_nv_advance(&pt->p_env)) != NULL; i++)
3413                 penv[i] = mdb_nv_get_cookie(v);
3414         penv[i] = NULL;
3415 
3416         P = Pxcreate(execname, (char **)pargv, penv, &perr, NULL, 0);
3417         mdb_free(pargv, sizeof (char *) * (argc + 2));
3418         pt->p_stdin = pt->p_stdout = NULL;
3419 
3420         mdb_free(penv, i * sizeof (char *));
3421 
3422         if (P == NULL) {
3423                 warn("failed to create process: %s\n", Pcreate_error(perr));
3424                 return (set_errno(EMDB_TGT));
3425         }
3426 
3427         if (t->t_pshandle != NULL) {
3428                 pt_pre_detach(t, TRUE);
3429                 if (t->t_pshandle != pt->p_idlehandle)
3430                         Prelease(t->t_pshandle, pt->p_rflags);
3431         }
3432 
3433         (void) Punsetflags(P, PR_RLC);  /* make sure run-on-last-close is off */
3434         (void) Psetflags(P, PR_KLC);    /* kill on last close by debugger */
3435         pt->p_rflags = PRELEASE_KILL;        /* kill on debugger Prelease */
3436         t->t_pshandle = P;
3437 
3438         pt_post_attach(t);
3439         pt_activate_common(t);
3440         (void) mdb_tgt_status(t, &t->t_status);
3441         mdb.m_flags |= MDB_FL_VCREATE;
3442 
3443         return (0);
3444 }
3445 
3446 /*
3447  * Forward a signal to the victim process in order to force it to stop or die.
3448  * Refer to the comments above pt_setrun(), below, for more info.
3449  */
3450 /*ARGSUSED*/
3451 static void
3452 pt_sigfwd(int sig, siginfo_t *sip, ucontext_t *ucp, mdb_tgt_t *t)
3453 {
3454         struct ps_prochandle *P = t->t_pshandle;
3455         const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
3456         pid_t pid = Pstatus(P)->pr_pid;
3457         long ctl[2];
3458 
3459         if (getpgid(pid) != mdb.m_pgid) {
3460                 mdb_dprintf(MDB_DBG_TGT, "fwd SIG#%d to %d\n", sig, (int)pid);
3461                 (void) kill(pid, sig);
3462         }
3463 
3464         if (Pwait(P, 1) == 0 && (psp->pr_flags & PR_STOPPED) &&
3465             psp->pr_why == PR_JOBCONTROL && Pdstop(P) == 0) {
3466                 /*
3467                  * If we're job control stopped and our DSTOP is pending, the
3468                  * victim will never see our signal, so undo the kill() and
3469                  * then send SIGCONT the victim to kick it out of the job
3470                  * control stop and force our DSTOP to take effect.
3471                  */
3472                 if ((psp->pr_flags & PR_DSTOP) &&
3473                     prismember(&Pstatus(P)->pr_sigpend, sig)) {
3474                         ctl[0] = PCUNKILL;
3475                         ctl[1] = sig;
3476                         (void) write(Pctlfd(P), ctl, sizeof (ctl));
3477                 }
3478 
3479                 mdb_dprintf(MDB_DBG_TGT, "fwd SIGCONT to %d\n", (int)pid);
3480                 (void) kill(pid, SIGCONT);
3481         }
3482 }
3483 
3484 /*
3485  * Common code for step and continue: if no victim process has been created,
3486  * call pt_run() to create one.  Then set the victim running, clearing any
3487  * pending fault.  One special case is that if the victim was previously
3488  * stopped on reception of SIGINT, we know that SIGINT was traced and the user
3489  * requested the victim to stop, so clear this signal before continuing.
3490  * For all other traced signals, the signal will be delivered on continue.
3491  *
3492  * Once the victim process is running, we wait for it to stop on an event of
3493  * interest.  Although libproc provides the basic primitive to wait for the
3494  * victim, we must be careful in our handling of signals.  We want to allow the
3495  * user to issue a SIGINT or SIGQUIT using the designated terminal control
3496  * character (typically ^C and ^\), and have these signals stop the target and
3497  * return control to the debugger if the signals are traced.  There are three
3498  * cases to be considered in our implementation:
3499  *
3500  * (1) If the debugger and victim are in the same process group, both receive
3501  * the signal from the terminal driver.  The debugger returns from Pwait() with
3502  * errno = EINTR, so we want to loop back and continue waiting until the victim
3503  * stops on receipt of its SIGINT or SIGQUIT.
3504  *
3505  * (2) If the debugger and victim are in different process groups, and the
3506  * victim is a member of the foreground process group, it will receive the
3507  * signal from the terminal driver and the debugger will not.  As such, we
3508  * will remain blocked in Pwait() until the victim stops on its signal.
3509  *
3510  * (3) If the debugger and victim are in different process groups, and the
3511  * debugger is a member of the foreground process group, it will receive the
3512  * signal from the terminal driver, and the victim will not.  The debugger
3513  * returns from Pwait() with errno = EINTR, so we need to forward the signal
3514  * to the victim process directly and then Pwait() again for it to stop.
3515  *
3516  * We can observe that all three cases are handled by simply calling Pwait()
3517  * repeatedly if it fails with EINTR, and forwarding SIGINT and SIGQUIT to
3518  * the victim if it is in a different process group, using pt_sigfwd() above.
3519  *
3520  * An additional complication is that the process may not be able to field
3521  * the signal if it is currently stopped by job control.  In this case, we
3522  * also DSTOP the process, and then send it a SIGCONT to wake it up from
3523  * job control and force it to re-enter stop() under the control of /proc.
3524  *
3525  * Finally, we would like to allow the user to suspend the process using the
3526  * terminal suspend character (typically ^Z) if both are in the same session.
3527  * We again employ pt_sigfwd() to forward SIGTSTP to the victim, wait for it to
3528  * stop from job control, and then capture it using /proc.  Once the process
3529  * has stopped, normal SIGTSTP processing is restored and the user can issue
3530  * another ^Z in order to suspend the debugger and return to the parent shell.
3531  */
3532 static int
3533 pt_setrun(mdb_tgt_t *t, mdb_tgt_status_t *tsp, int flags)
3534 {
3535         struct ps_prochandle *P = t->t_pshandle;
3536         pt_data_t *pt = t->t_data;
3537         pid_t old_pgid = -1;
3538 
3539         mdb_signal_f *intf, *quitf, *tstpf;
3540         const lwpstatus_t *psp;
3541         void *intd, *quitd, *tstpd;
3542 
3543         int sig = pt->p_signal;
3544         int error = 0;
3545         int pgid = -1;
3546 
3547         pt->p_signal = 0; /* clear pending signal */
3548 
3549         if (P == NULL && pt_run(t, 0, NULL) == -1)
3550                 return (-1); /* errno is set for us */
3551 
3552         P = t->t_pshandle;
3553         psp = &Pstatus(P)->pr_lwp;
3554 
3555         if (sig == 0 && psp->pr_why == PR_SIGNALLED && psp->pr_what == SIGINT)
3556                 flags |= PRCSIG; /* clear pending SIGINT */
3557         else
3558                 flags |= PRCFAULT; /* clear any pending fault (e.g. BPT) */
3559 
3560         intf = mdb_signal_gethandler(SIGINT, &intd);
3561         quitf = mdb_signal_gethandler(SIGQUIT, &quitd);
3562         tstpf = mdb_signal_gethandler(SIGTSTP, &tstpd);
3563 
3564         (void) mdb_signal_sethandler(SIGINT, (mdb_signal_f *)pt_sigfwd, t);
3565         (void) mdb_signal_sethandler(SIGQUIT, (mdb_signal_f *)pt_sigfwd, t);
3566         (void) mdb_signal_sethandler(SIGTSTP, (mdb_signal_f *)pt_sigfwd, t);
3567 
3568         if (sig != 0 && Pstate(P) == PS_RUN &&
3569             kill(Pstatus(P)->pr_pid, sig) == -1) {
3570                 error = errno;
3571                 goto out;
3572         }
3573 
3574         /*
3575          * If we attached to a job stopped background process in the same
3576          * session, make its pgid the foreground process group before running
3577          * it.  Ignore SIGTTOU while doing this to avoid being suspended.
3578          */
3579         if (mdb.m_flags & MDB_FL_JOBCTL) {
3580                 (void) mdb_signal_sethandler(SIGTTOU, SIG_IGN, NULL);
3581                 (void) IOP_CTL(mdb.m_term, TIOCGPGRP, &old_pgid);
3582                 (void) IOP_CTL(mdb.m_term, TIOCSPGRP,
3583                     (void *)&Pstatus(P)->pr_pgid);
3584                 (void) mdb_signal_sethandler(SIGTTOU, SIG_DFL, NULL);
3585         }
3586 
3587         if (Pstate(P) != PS_RUN && Psetrun(P, sig, flags) == -1) {
3588                 error = errno;
3589                 goto out;
3590         }
3591 
3592         /*
3593          * If the process is stopped on job control, resume its process group
3594          * by sending it a SIGCONT if we are in the same session.  Otherwise
3595          * we have no choice but to wait for someone else to foreground it.
3596          */
3597         if (psp->pr_why == PR_JOBCONTROL) {
3598                 if (mdb.m_flags & MDB_FL_JOBCTL)
3599                         (void) kill(-Pstatus(P)->pr_pgid, SIGCONT);
3600                 else if (mdb.m_term != NULL)
3601                         warn("process is still suspended by job control ...\n");
3602         }
3603 
3604         /*
3605          * Wait for the process to stop.  As described above, we loop around if
3606          * we are interrupted (EINTR).  If we lose control, attempt to re-open
3607          * the process, or call pt_exec() if that fails to handle a re-exec.
3608          * If the process dies (ENOENT) or Pwait() fails, break out of the loop.
3609          */
3610         while (Pwait(P, 0) == -1) {
3611                 if (errno != EINTR) {
3612                         if (Pstate(P) == PS_LOST) {
3613                                 if (Preopen(P) == 0)
3614                                         continue; /* Pwait() again */
3615                                 else
3616                                         pt_exec(t, 0, NULL);
3617                         } else if (errno != ENOENT)
3618                                 warn("failed to wait for event");
3619                         break;
3620                 }
3621         }
3622 
3623         /*
3624          * If we changed the foreground process group, restore the old pgid
3625          * while ignoring SIGTTOU so we are not accidentally suspended.
3626          */
3627         if (old_pgid != -1) {
3628                 (void) mdb_signal_sethandler(SIGTTOU, SIG_IGN, NULL);
3629                 (void) IOP_CTL(mdb.m_term, TIOCSPGRP, &pgid);
3630                 (void) mdb_signal_sethandler(SIGTTOU, SIG_DFL, NULL);
3631         }
3632 
3633         /*
3634          * If we're now stopped on exit from a successful exec, release any
3635          * vfork parents and clean out their address space before returning
3636          * to tgt_continue() and perturbing the list of armed event specs.
3637          * If we're stopped for any other reason, just update the mappings.
3638          */
3639         switch (Pstate(P)) {
3640         case PS_STOP:
3641                 if (psp->pr_why == PR_SYSEXIT && psp->pr_errno == 0 &&
3642                     psp->pr_what == SYS_execve)
3643                         pt_release_parents(t);
3644                 else
3645                         Pupdate_maps(P);
3646                 break;
3647 
3648         case PS_UNDEAD:
3649         case PS_LOST:
3650                 pt_release_parents(t);
3651                 break;
3652         }
3653 
3654 out:
3655         (void) mdb_signal_sethandler(SIGINT, intf, intd);
3656         (void) mdb_signal_sethandler(SIGQUIT, quitf, quitd);
3657         (void) mdb_signal_sethandler(SIGTSTP, tstpf, tstpd);
3658         (void) pt_status(t, tsp);
3659 
3660         return (error ? set_errno(error) : 0);
3661 }
3662 
3663 static int
3664 pt_step(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3665 {
3666         return (pt_setrun(t, tsp, PRSTEP));
3667 }
3668 
3669 static int
3670 pt_continue(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3671 {
3672         return (pt_setrun(t, tsp, 0));
3673 }
3674 
3675 static int
3676 pt_signal(mdb_tgt_t *t, int sig)
3677 {
3678         pt_data_t *pt = t->t_data;
3679 
3680         if (sig > 0 && sig <= pt->p_maxsig) {
3681                 pt->p_signal = sig; /* pending until next pt_setrun */
3682                 return (0);
3683         }
3684 
3685         return (set_errno(EMDB_BADSIGNUM));
3686 }
3687 
3688 static int
3689 pt_sysenter_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3690 {
3691         struct ps_prochandle *P = t->t_pshandle;
3692 
3693         if (P != NULL && Pstate(P) < PS_LOST) {
3694                 sep->se_data = args; /* data is raw system call number */
3695                 return (Psysentry(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3696         }
3697 
3698         return (set_errno(EMDB_NOPROC));
3699 }
3700 
3701 static void
3702 pt_sysenter_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3703 {
3704         (void) Psysentry(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3705 }
3706 
3707 /*ARGSUSED*/
3708 static char *
3709 pt_sysenter_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3710     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3711 {
3712         char name[32];
3713         int sysnum;
3714 
3715         if (vep != NULL)
3716                 sysnum = (intptr_t)vep->ve_args;
3717         else
3718                 sysnum = (intptr_t)sep->se_data;
3719 
3720         (void) proc_sysname(sysnum, name, sizeof (name));
3721         (void) mdb_iob_snprintf(buf, nbytes, "stop on entry to %s", name);
3722 
3723         return (buf);
3724 }
3725 
3726 /*ARGSUSED*/
3727 static int
3728 pt_sysenter_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3729 {
3730         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3731         int sysnum = (intptr_t)sep->se_data;
3732 
3733         return (psp->pr_why == PR_SYSENTRY && psp->pr_what == sysnum);
3734 }
3735 
3736 static const mdb_se_ops_t proc_sysenter_ops = {
3737         pt_sysenter_ctor,       /* se_ctor */
3738         pt_sysenter_dtor,       /* se_dtor */
3739         pt_sysenter_info,       /* se_info */
3740         no_se_secmp,            /* se_secmp */
3741         no_se_vecmp,            /* se_vecmp */
3742         no_se_arm,              /* se_arm */
3743         no_se_disarm,           /* se_disarm */
3744         no_se_cont,             /* se_cont */
3745         pt_sysenter_match       /* se_match */
3746 };
3747 
3748 static int
3749 pt_sysexit_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3750 {
3751         struct ps_prochandle *P = t->t_pshandle;
3752 
3753         if (P != NULL && Pstate(P) < PS_LOST) {
3754                 sep->se_data = args; /* data is raw system call number */
3755                 return (Psysexit(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3756         }
3757 
3758         return (set_errno(EMDB_NOPROC));
3759 }
3760 
3761 static void
3762 pt_sysexit_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3763 {
3764         (void) Psysexit(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3765 }
3766 
3767 /*ARGSUSED*/
3768 static char *
3769 pt_sysexit_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3770     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3771 {
3772         char name[32];
3773         int sysnum;
3774 
3775         if (vep != NULL)
3776                 sysnum = (intptr_t)vep->ve_args;
3777         else
3778                 sysnum = (intptr_t)sep->se_data;
3779 
3780         (void) proc_sysname(sysnum, name, sizeof (name));
3781         (void) mdb_iob_snprintf(buf, nbytes, "stop on exit from %s", name);
3782 
3783         return (buf);
3784 }
3785 
3786 /*ARGSUSED*/
3787 static int
3788 pt_sysexit_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3789 {
3790         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3791         int sysnum = (intptr_t)sep->se_data;
3792 
3793         return (psp->pr_why == PR_SYSEXIT && psp->pr_what == sysnum);
3794 }
3795 
3796 static const mdb_se_ops_t proc_sysexit_ops = {
3797         pt_sysexit_ctor,        /* se_ctor */
3798         pt_sysexit_dtor,        /* se_dtor */
3799         pt_sysexit_info,        /* se_info */
3800         no_se_secmp,            /* se_secmp */
3801         no_se_vecmp,            /* se_vecmp */
3802         no_se_arm,              /* se_arm */
3803         no_se_disarm,           /* se_disarm */
3804         no_se_cont,             /* se_cont */
3805         pt_sysexit_match        /* se_match */
3806 };
3807 
3808 static int
3809 pt_signal_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3810 {
3811         struct ps_prochandle *P = t->t_pshandle;
3812 
3813         if (P != NULL && Pstate(P) < PS_LOST) {
3814                 sep->se_data = args; /* data is raw signal number */
3815                 return (Psignal(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3816         }
3817 
3818         return (set_errno(EMDB_NOPROC));
3819 }
3820 
3821 static void
3822 pt_signal_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3823 {
3824         (void) Psignal(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3825 }
3826 
3827 /*ARGSUSED*/
3828 static char *
3829 pt_signal_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3830     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3831 {
3832         char name[SIG2STR_MAX];
3833         int signum;
3834 
3835         if (vep != NULL)
3836                 signum = (intptr_t)vep->ve_args;
3837         else
3838                 signum = (intptr_t)sep->se_data;
3839 
3840         (void) proc_signame(signum, name, sizeof (name));
3841         (void) mdb_iob_snprintf(buf, nbytes, "stop on %s", name);
3842 
3843         return (buf);
3844 }
3845 
3846 /*ARGSUSED*/
3847 static int
3848 pt_signal_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3849 {
3850         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3851         int signum = (intptr_t)sep->se_data;
3852 
3853         return (psp->pr_why == PR_SIGNALLED && psp->pr_what == signum);
3854 }
3855 
3856 static const mdb_se_ops_t proc_signal_ops = {
3857         pt_signal_ctor,         /* se_ctor */
3858         pt_signal_dtor,         /* se_dtor */
3859         pt_signal_info,         /* se_info */
3860         no_se_secmp,            /* se_secmp */
3861         no_se_vecmp,            /* se_vecmp */
3862         no_se_arm,              /* se_arm */
3863         no_se_disarm,           /* se_disarm */
3864         no_se_cont,             /* se_cont */
3865         pt_signal_match         /* se_match */
3866 };
3867 
3868 static int
3869 pt_fault_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3870 {
3871         struct ps_prochandle *P = t->t_pshandle;
3872 
3873         if (P != NULL && Pstate(P) < PS_LOST) {
3874                 sep->se_data = args; /* data is raw fault number */
3875                 return (Pfault(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3876         }
3877 
3878         return (set_errno(EMDB_NOPROC));
3879 }
3880 
3881 static void
3882 pt_fault_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3883 {
3884         int fault = (intptr_t)sep->se_data;
3885 
3886         if (fault != FLTBPT && fault != FLTTRACE && fault != FLTWATCH)
3887                 (void) Pfault(t->t_pshandle, fault, FALSE);
3888 }
3889 
3890 /*ARGSUSED*/
3891 static char *
3892 pt_fault_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3893     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3894 {
3895         char name[32];
3896         int fltnum;
3897 
3898         if (vep != NULL)
3899                 fltnum = (intptr_t)vep->ve_args;
3900         else
3901                 fltnum = (intptr_t)sep->se_data;
3902 
3903         (void) proc_fltname(fltnum, name, sizeof (name));
3904         (void) mdb_iob_snprintf(buf, nbytes, "stop on %s", name);
3905 
3906         return (buf);
3907 }
3908 
3909 /*ARGSUSED*/
3910 static int
3911 pt_fault_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3912 {
3913         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3914         int fltnum = (intptr_t)sep->se_data;
3915 
3916         return (psp->pr_why == PR_FAULTED && psp->pr_what == fltnum);
3917 }
3918 
3919 static const mdb_se_ops_t proc_fault_ops = {
3920         pt_fault_ctor,          /* se_ctor */
3921         pt_fault_dtor,          /* se_dtor */
3922         pt_fault_info,          /* se_info */
3923         no_se_secmp,            /* se_secmp */
3924         no_se_vecmp,            /* se_vecmp */
3925         no_se_arm,              /* se_arm */
3926         no_se_disarm,           /* se_disarm */
3927         no_se_cont,             /* se_cont */
3928         pt_fault_match          /* se_match */
3929 };
3930 
3931 /*
3932  * Callback for pt_ignore() dcmd above: for each VID, determine if it
3933  * corresponds to a vespec that traces the specified signal, and delete it.
3934  */
3935 /*ARGSUSED*/
3936 static int
3937 pt_ignore_sig(mdb_tgt_t *t, void *sig, int vid, void *data)
3938 {
3939         mdb_vespec_t *vep = mdb_tgt_vespec_lookup(t, vid);
3940 
3941         if (vep->ve_se->se_ops == &proc_signal_ops && vep->ve_args == sig)
3942                 (void) mdb_tgt_vespec_delete(t, vid);
3943 
3944         return (0);
3945 }
3946 
3947 static int
3948 pt_brkpt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3949 {
3950         pt_data_t *pt = t->t_data;
3951         pt_bparg_t *pta = args;
3952         pt_brkpt_t *ptb;
3953         GElf_Sym s;
3954 
3955         if (t->t_pshandle == NULL || Pstate(t->t_pshandle) >= PS_LOST)
3956                 return (set_errno(EMDB_NOPROC));
3957 
3958         if (pta->pta_symbol != NULL) {
3959                 if (!pt->p_rtld_finished &&
3960                     strchr(pta->pta_symbol, '`') == NULL)
3961                         return (set_errno(EMDB_NOSYM));
3962                 if (mdb_tgt_lookup_by_scope(t, pta->pta_symbol, &s,
3963                     NULL) == -1) {
3964                         if (errno != EMDB_NOOBJ && !(errno == EMDB_NOSYM &&
3965                             (!(mdb.m_flags & MDB_FL_BPTNOSYMSTOP) ||
3966                             !pt->p_rtld_finished))) {
3967                                 warn("breakpoint %s activation failed",
3968                                     pta->pta_symbol);
3969                         }
3970                         return (-1); /* errno is set for us */
3971                 }
3972 
3973                 pta->pta_addr = (uintptr_t)s.st_value;
3974         }
3975 
3976 #ifdef __sparc
3977         if (pta->pta_addr & 3)
3978                 return (set_errno(EMDB_BPALIGN));
3979 #endif
3980 
3981         if (Paddr_to_map(t->t_pshandle, pta->pta_addr) == NULL)
3982                 return (set_errno(EMDB_NOMAP));
3983 
3984         ptb = mdb_alloc(sizeof (pt_brkpt_t), UM_SLEEP);
3985         ptb->ptb_addr = pta->pta_addr;
3986         ptb->ptb_instr = NULL;
3987         sep->se_data = ptb;
3988 
3989         return (0);
3990 }
3991 
3992 /*ARGSUSED*/
3993 static void
3994 pt_brkpt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3995 {
3996         mdb_free(sep->se_data, sizeof (pt_brkpt_t));
3997 }
3998 
3999 /*ARGSUSED*/
4000 static char *
4001 pt_brkpt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
4002     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
4003 {
4004         uintptr_t addr = NULL;
4005 
4006         if (vep != NULL) {
4007                 pt_bparg_t *pta = vep->ve_args;
4008 
4009                 if (pta->pta_symbol != NULL) {
4010                         (void) mdb_iob_snprintf(buf, nbytes, "stop at %s",
4011                             pta->pta_symbol);
4012                 } else {
4013                         (void) mdb_iob_snprintf(buf, nbytes, "stop at %a",
4014                             pta->pta_addr);
4015                         addr = pta->pta_addr;
4016                 }
4017 
4018         } else {
4019                 addr = ((pt_brkpt_t *)sep->se_data)->ptb_addr;
4020                 (void) mdb_iob_snprintf(buf, nbytes, "stop at %a", addr);
4021         }
4022 
4023         sp->spec_base = addr;
4024         sp->spec_size = sizeof (instr_t);
4025 
4026         return (buf);
4027 }
4028 
4029 static int
4030 pt_brkpt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4031 {
4032         pt_brkpt_t *ptb = sep->se_data;
4033         pt_bparg_t *pta = args;
4034         GElf_Sym sym;
4035 
4036         if (pta->pta_symbol != NULL) {
4037                 return (mdb_tgt_lookup_by_scope(t, pta->pta_symbol,
4038                     &sym, NULL) == 0 && sym.st_value == ptb->ptb_addr);
4039         }
4040 
4041         return (pta->pta_addr == ptb->ptb_addr);
4042 }
4043 
4044 /*ARGSUSED*/
4045 static int
4046 pt_brkpt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
4047 {
4048         pt_bparg_t *pta1 = vep->ve_args;
4049         pt_bparg_t *pta2 = args;
4050 
4051         if (pta1->pta_symbol != NULL && pta2->pta_symbol != NULL)
4052                 return (strcmp(pta1->pta_symbol, pta2->pta_symbol) == 0);
4053 
4054         if (pta1->pta_symbol == NULL && pta2->pta_symbol == NULL)
4055                 return (pta1->pta_addr == pta2->pta_addr);
4056 
4057         return (0); /* fail if one is symbolic, other is an explicit address */
4058 }
4059 
4060 static int
4061 pt_brkpt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
4062 {
4063         pt_brkpt_t *ptb = sep->se_data;
4064         return (Psetbkpt(t->t_pshandle, ptb->ptb_addr, &ptb->ptb_instr));
4065 }
4066 
4067 /*
4068  * In order to disarm a breakpoint, we replace the trap instruction at ptb_addr
4069  * with the saved instruction.  However, if we have stopped after a successful
4070  * exec(2), we do not want to restore ptb_instr because the address space has
4071  * now been replaced with the text of a different executable, and so restoring
4072  * the saved instruction would be incorrect.  The exec itself has effectively
4073  * removed all breakpoint trap instructions for us, so we can just return.
4074  */
4075 static int
4076 pt_brkpt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
4077 {
4078         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4079         pt_brkpt_t *ptb = sep->se_data;
4080 
4081         if (psp->pr_why == PR_SYSEXIT && psp->pr_errno == 0 &&
4082             psp->pr_what == SYS_execve)
4083                 return (0); /* do not restore saved instruction */
4084 
4085         return (Pdelbkpt(t->t_pshandle, ptb->ptb_addr, ptb->ptb_instr));
4086 }
4087 
4088 /*
4089  * Determine whether the specified sespec is an armed watchpoint that overlaps
4090  * with the given breakpoint and has the given flags set.  We use this to find
4091  * conflicts with breakpoints, below.
4092  */
4093 static int
4094 pt_wp_overlap(mdb_sespec_t *sep, pt_brkpt_t *ptb, int flags)
4095 {
4096         const prwatch_t *wp = sep->se_data;
4097 
4098         return (sep->se_state == MDB_TGT_SPEC_ARMED &&
4099             sep->se_ops == &proc_wapt_ops && (wp->pr_wflags & flags) &&
4100             ptb->ptb_addr - wp->pr_vaddr < wp->pr_size);
4101 }
4102 
4103 /*
4104  * We step over breakpoints using Pxecbkpt() in libproc.  If a conflicting
4105  * watchpoint is present, we must temporarily remove it before stepping over
4106  * the breakpoint so we do not immediately re-trigger the watchpoint.  We know
4107  * the watchpoint has already triggered on our trap instruction as part of
4108  * fetching it.  Before we return, we must re-install any disabled watchpoints.
4109  */
4110 static int
4111 pt_brkpt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4112 {
4113         pt_brkpt_t *ptb = sep->se_data;
4114         int status = -1;
4115         int error;
4116         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4117 
4118         /*
4119          * If the PC no longer matches our original address, then the user has
4120          * changed it while we have been stopped. In this case, it no longer
4121          * makes any sense to continue over this breakpoint.  We return as if we
4122          * continued normally.
4123          */
4124         if ((uintptr_t)psp->pr_info.si_addr != psp->pr_reg[R_PC])
4125                 return (pt_status(t, tsp));
4126 
4127         for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4128                 if (pt_wp_overlap(sep, ptb, WA_EXEC))
4129                         (void) Pdelwapt(t->t_pshandle, sep->se_data);
4130         }
4131 
4132         if (Pxecbkpt(t->t_pshandle, ptb->ptb_instr) == 0 &&
4133             Pdelbkpt(t->t_pshandle, ptb->ptb_addr, ptb->ptb_instr) == 0)
4134                 status = pt_status(t, tsp);
4135 
4136         error = errno; /* save errno from Pxecbkpt, Pdelbkpt, or pt_status */
4137 
4138         for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4139                 if (pt_wp_overlap(sep, ptb, WA_EXEC) &&
4140                     Psetwapt(t->t_pshandle, sep->se_data) == -1) {
4141                         sep->se_state = MDB_TGT_SPEC_ERROR;
4142                         sep->se_errno = errno;
4143                 }
4144         }
4145 
4146         (void) set_errno(error);
4147         return (status);
4148 }
4149 
4150 /*ARGSUSED*/
4151 static int
4152 pt_brkpt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4153 {
4154         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4155         pt_brkpt_t *ptb = sep->se_data;
4156 
4157         return (psp->pr_why == PR_FAULTED && psp->pr_what == FLTBPT &&
4158             psp->pr_reg[R_PC] == ptb->ptb_addr);
4159 }
4160 
4161 static const mdb_se_ops_t proc_brkpt_ops = {
4162         pt_brkpt_ctor,          /* se_ctor */
4163         pt_brkpt_dtor,          /* se_dtor */
4164         pt_brkpt_info,          /* se_info */
4165         pt_brkpt_secmp,         /* se_secmp */
4166         pt_brkpt_vecmp,         /* se_vecmp */
4167         pt_brkpt_arm,           /* se_arm */
4168         pt_brkpt_disarm,        /* se_disarm */
4169         pt_brkpt_cont,          /* se_cont */
4170         pt_brkpt_match          /* se_match */
4171 };
4172 
4173 static int
4174 pt_wapt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4175 {
4176         if (t->t_pshandle == NULL || Pstate(t->t_pshandle) >= PS_LOST)
4177                 return (set_errno(EMDB_NOPROC));
4178 
4179         sep->se_data = mdb_alloc(sizeof (prwatch_t), UM_SLEEP);
4180         bcopy(args, sep->se_data, sizeof (prwatch_t));
4181         return (0);
4182 }
4183 
4184 /*ARGSUSED*/
4185 static void
4186 pt_wapt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
4187 {
4188         mdb_free(sep->se_data, sizeof (prwatch_t));
4189 }
4190 
4191 /*ARGSUSED*/
4192 static char *
4193 pt_wapt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
4194     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
4195 {
4196         prwatch_t *wp = vep != NULL ? vep->ve_args : sep->se_data;
4197         char desc[24];
4198 
4199         ASSERT(wp->pr_wflags != 0);
4200         desc[0] = '\0';
4201 
4202         switch (wp->pr_wflags) {
4203         case WA_READ:
4204                 (void) strcat(desc, "/read");
4205                 break;
4206         case WA_WRITE:
4207                 (void) strcat(desc, "/write");
4208                 break;
4209         case WA_EXEC:
4210                 (void) strcat(desc, "/exec");
4211                 break;
4212         default:
4213                 if (wp->pr_wflags & WA_READ)
4214                         (void) strcat(desc, "/r");
4215                 if (wp->pr_wflags & WA_WRITE)
4216                         (void) strcat(desc, "/w");
4217                 if (wp->pr_wflags & WA_EXEC)
4218                         (void) strcat(desc, "/x");
4219         }
4220 
4221         (void) mdb_iob_snprintf(buf, nbytes, "stop on %s of [%la, %la)",
4222             desc + 1, wp->pr_vaddr, wp->pr_vaddr + wp->pr_size);
4223 
4224         sp->spec_base = wp->pr_vaddr;
4225         sp->spec_size = wp->pr_size;
4226 
4227         return (buf);
4228 }
4229 
4230 /*ARGSUSED*/
4231 static int
4232 pt_wapt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4233 {
4234         prwatch_t *wp1 = sep->se_data;
4235         prwatch_t *wp2 = args;
4236 
4237         return (wp1->pr_vaddr == wp2->pr_vaddr &&
4238             wp1->pr_size == wp2->pr_size && wp1->pr_wflags == wp2->pr_wflags);
4239 }
4240 
4241 /*ARGSUSED*/
4242 static int
4243 pt_wapt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
4244 {
4245         prwatch_t *wp1 = vep->ve_args;
4246         prwatch_t *wp2 = args;
4247 
4248         return (wp1->pr_vaddr == wp2->pr_vaddr &&
4249             wp1->pr_size == wp2->pr_size && wp1->pr_wflags == wp2->pr_wflags);
4250 }
4251 
4252 static int
4253 pt_wapt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
4254 {
4255         return (Psetwapt(t->t_pshandle, sep->se_data));
4256 }
4257 
4258 static int
4259 pt_wapt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
4260 {
4261         return (Pdelwapt(t->t_pshandle, sep->se_data));
4262 }
4263 
4264 /*
4265  * Determine whether the specified sespec is an armed breakpoint at the
4266  * given %pc.  We use this to find conflicts with watchpoints below.
4267  */
4268 static int
4269 pt_bp_overlap(mdb_sespec_t *sep, uintptr_t pc)
4270 {
4271         pt_brkpt_t *ptb = sep->se_data;
4272 
4273         return (sep->se_state == MDB_TGT_SPEC_ARMED &&
4274             sep->se_ops == &proc_brkpt_ops && ptb->ptb_addr == pc);
4275 }
4276 
4277 /*
4278  * We step over watchpoints using Pxecwapt() in libproc.  If a conflicting
4279  * breakpoint is present, we must temporarily disarm it before stepping
4280  * over the watchpoint so we do not immediately re-trigger the breakpoint.
4281  * This is similar to the case handled in pt_brkpt_cont(), above.
4282  */
4283 static int
4284 pt_wapt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4285 {
4286         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4287         mdb_sespec_t *bep = NULL;
4288         int status = -1;
4289         int error;
4290 
4291         /*
4292          * If the PC no longer matches our original address, then the user has
4293          * changed it while we have been stopped. In this case, it no longer
4294          * makes any sense to continue over this instruction.  We return as if
4295          * we continued normally.
4296          */
4297         if ((uintptr_t)psp->pr_info.si_pc != psp->pr_reg[R_PC])
4298                 return (pt_status(t, tsp));
4299 
4300         if (psp->pr_info.si_code != TRAP_XWATCH) {
4301                 for (bep = mdb_list_next(&t->t_active); bep != NULL;
4302                     bep = mdb_list_next(bep)) {
4303                         if (pt_bp_overlap(bep, psp->pr_reg[R_PC])) {
4304                                 (void) bep->se_ops->se_disarm(t, bep);
4305                                 bep->se_state = MDB_TGT_SPEC_ACTIVE;
4306                                 break;
4307                         }
4308                 }
4309         }
4310 
4311         if (Pxecwapt(t->t_pshandle, sep->se_data) == 0)
4312                 status = pt_status(t, tsp);
4313 
4314         error = errno; /* save errno from Pxecwapt or pt_status */
4315 
4316         if (bep != NULL)
4317                 mdb_tgt_sespec_arm_one(t, bep);
4318 
4319         (void) set_errno(error);
4320         return (status);
4321 }
4322 
4323 /*ARGSUSED*/
4324 static int
4325 pt_wapt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4326 {
4327         const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4328         prwatch_t *wp = sep->se_data;
4329 
4330         return (psp->pr_why == PR_FAULTED && psp->pr_what == FLTWATCH &&
4331             (uintptr_t)psp->pr_info.si_addr - wp->pr_vaddr < wp->pr_size);
4332 }
4333 
4334 static const mdb_se_ops_t proc_wapt_ops = {
4335         pt_wapt_ctor,           /* se_ctor */
4336         pt_wapt_dtor,           /* se_dtor */
4337         pt_wapt_info,           /* se_info */
4338         pt_wapt_secmp,          /* se_secmp */
4339         pt_wapt_vecmp,          /* se_vecmp */
4340         pt_wapt_arm,            /* se_arm */
4341         pt_wapt_disarm,         /* se_disarm */
4342         pt_wapt_cont,           /* se_cont */
4343         pt_wapt_match           /* se_match */
4344 };
4345 
4346 static void
4347 pt_bparg_dtor(mdb_vespec_t *vep)
4348 {
4349         pt_bparg_t *pta = vep->ve_args;
4350 
4351         if (pta->pta_symbol != NULL)
4352                 strfree(pta->pta_symbol);
4353 
4354         mdb_free(pta, sizeof (pt_bparg_t));
4355 }
4356 
4357 static int
4358 pt_add_vbrkpt(mdb_tgt_t *t, uintptr_t addr,
4359     int spec_flags, mdb_tgt_se_f *func, void *data)
4360 {
4361         pt_bparg_t *pta = mdb_alloc(sizeof (pt_bparg_t), UM_SLEEP);
4362 
4363         pta->pta_symbol = NULL;
4364         pta->pta_addr = addr;
4365 
4366         return (mdb_tgt_vespec_insert(t, &proc_brkpt_ops, spec_flags,
4367             func, data, pta, pt_bparg_dtor));
4368 }
4369 
4370 static int
4371 pt_add_sbrkpt(mdb_tgt_t *t, const char *sym,
4372     int spec_flags, mdb_tgt_se_f *func, void *data)
4373 {
4374         pt_bparg_t *pta;
4375 
4376         if (sym[0] == '`') {
4377                 (void) set_errno(EMDB_NOOBJ);
4378                 return (0);
4379         }
4380 
4381         if (sym[strlen(sym) - 1] == '`') {
4382                 (void) set_errno(EMDB_NOSYM);
4383                 return (0);
4384         }
4385 
4386         pta = mdb_alloc(sizeof (pt_bparg_t), UM_SLEEP);
4387         pta->pta_symbol = strdup(sym);
4388         pta->pta_addr = NULL;
4389 
4390         return (mdb_tgt_vespec_insert(t, &proc_brkpt_ops, spec_flags,
4391             func, data, pta, pt_bparg_dtor));
4392 }
4393 
4394 static int
4395 pt_wparg_overlap(const prwatch_t *wp1, const prwatch_t *wp2)
4396 {
4397         if (wp2->pr_vaddr + wp2->pr_size <= wp1->pr_vaddr)
4398                 return (0); /* no range overlap */
4399 
4400         if (wp1->pr_vaddr + wp1->pr_size <= wp2->pr_vaddr)
4401                 return (0); /* no range overlap */
4402 
4403         return (wp1->pr_vaddr != wp2->pr_vaddr ||
4404             wp1->pr_size != wp2->pr_size || wp1->pr_wflags != wp2->pr_wflags);
4405 }
4406 
4407 static void
4408 pt_wparg_dtor(mdb_vespec_t *vep)
4409 {
4410         mdb_free(vep->ve_args, sizeof (prwatch_t));
4411 }
4412 
4413 static int
4414 pt_add_vwapt(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
4415     int spec_flags, mdb_tgt_se_f *func, void *data)
4416 {
4417         prwatch_t *wp = mdb_alloc(sizeof (prwatch_t), UM_SLEEP);
4418         mdb_sespec_t *sep;
4419 
4420         wp->pr_vaddr = addr;
4421         wp->pr_size = len;
4422         wp->pr_wflags = 0;
4423 
4424         if (wflags & MDB_TGT_WA_R)
4425                 wp->pr_wflags |= WA_READ;
4426         if (wflags & MDB_TGT_WA_W)
4427                 wp->pr_wflags |= WA_WRITE;
4428         if (wflags & MDB_TGT_WA_X)
4429                 wp->pr_wflags |= WA_EXEC;
4430 
4431         for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4432                 if (sep->se_ops == &proc_wapt_ops &&
4433                     mdb_list_next(&sep->se_velist) != NULL &&
4434                     pt_wparg_overlap(wp, sep->se_data))
4435                         goto dup;
4436         }
4437 
4438         for (sep = mdb_list_next(&t->t_idle); sep; sep = mdb_list_next(sep)) {
4439                 if (sep->se_ops == &proc_wapt_ops && pt_wparg_overlap(wp,
4440                     ((mdb_vespec_t *)mdb_list_next(&sep->se_velist))->ve_args))
4441                         goto dup;
4442         }
4443 
4444         return (mdb_tgt_vespec_insert(t, &proc_wapt_ops, spec_flags,
4445             func, data, wp, pt_wparg_dtor));
4446 
4447 dup:
4448         mdb_free(wp, sizeof (prwatch_t));
4449         (void) set_errno(EMDB_WPDUP);
4450         return (0);
4451 }
4452 
4453 static int
4454 pt_add_sysenter(mdb_tgt_t *t, int sysnum,
4455     int spec_flags, mdb_tgt_se_f *func, void *data)
4456 {
4457         if (sysnum <= 0 || sysnum > PRMAXSYS) {
4458                 (void) set_errno(EMDB_BADSYSNUM);
4459                 return (0);
4460         }
4461 
4462         return (mdb_tgt_vespec_insert(t, &proc_sysenter_ops, spec_flags,
4463             func, data, (void *)(uintptr_t)sysnum, no_ve_dtor));
4464 }
4465 
4466 static int
4467 pt_add_sysexit(mdb_tgt_t *t, int sysnum,
4468     int spec_flags, mdb_tgt_se_f *func, void *data)
4469 {
4470         if (sysnum <= 0 || sysnum > PRMAXSYS) {
4471                 (void) set_errno(EMDB_BADSYSNUM);
4472                 return (0);
4473         }
4474 
4475         return (mdb_tgt_vespec_insert(t, &proc_sysexit_ops, spec_flags,
4476             func, data, (void *)(uintptr_t)sysnum, no_ve_dtor));
4477 }
4478 
4479 static int
4480 pt_add_signal(mdb_tgt_t *t, int signum,
4481     int spec_flags, mdb_tgt_se_f *func, void *data)
4482 {
4483         pt_data_t *pt = t->t_data;
4484 
4485         if (signum <= 0 || signum > pt->p_maxsig) {
4486                 (void) set_errno(EMDB_BADSIGNUM);
4487                 return (0);
4488         }
4489 
4490         return (mdb_tgt_vespec_insert(t, &proc_signal_ops, spec_flags,
4491             func, data, (void *)(uintptr_t)signum, no_ve_dtor));
4492 }
4493 
4494 static int
4495 pt_add_fault(mdb_tgt_t *t, int fltnum,
4496     int spec_flags, mdb_tgt_se_f *func, void *data)
4497 {
4498         if (fltnum <= 0 || fltnum > PRMAXFAULT) {
4499                 (void) set_errno(EMDB_BADFLTNUM);
4500                 return (0);
4501         }
4502 
4503         return (mdb_tgt_vespec_insert(t, &proc_fault_ops, spec_flags,
4504             func, data, (void *)(uintptr_t)fltnum, no_ve_dtor));
4505 }
4506 
4507 static int
4508 pt_getareg(mdb_tgt_t *t, mdb_tgt_tid_t tid,
4509     const char *rname, mdb_tgt_reg_t *rp)
4510 {
4511         pt_data_t *pt = t->t_data;
4512         prgregset_t grs;
4513         mdb_var_t *v;
4514 
4515         if (t->t_pshandle == NULL)
4516                 return (set_errno(EMDB_NOPROC));
4517 
4518         if ((v = mdb_nv_lookup(&pt->p_regs, rname)) != NULL) {
4519                 uintmax_t rd_nval = mdb_nv_get_value(v);
4520                 ushort_t rd_num = MDB_TGT_R_NUM(rd_nval);
4521                 ushort_t rd_flags = MDB_TGT_R_FLAGS(rd_nval);
4522 
4523                 if (!MDB_TGT_R_IS_FP(rd_flags)) {
4524                         mdb_tgt_reg_t r = 0;
4525 
4526 #if defined(__sparc) && defined(_ILP32)
4527                         /*
4528                          * If we are debugging on 32-bit SPARC, the globals and
4529                          * outs can have 32 upper bits hiding in the xregs.
4530                          */
4531                         /* gcc doesn't like >= R_G0 because R_G0 == 0 */
4532                         int is_g = (rd_num == R_G0 ||
4533                             rd_num >= R_G1 && rd_num <= R_G7);
4534                         int is_o = (rd_num >= R_O0 && rd_num <= R_O7);
4535                         prxregset_t xrs;
4536 
4537                         if (is_g && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4538                             xrs.pr_type == XR_TYPE_V8P) {
4539                                 r |= (uint64_t)xrs.pr_un.pr_v8p.pr_xg[
4540                                     rd_num - R_G0 + XR_G0] << 32;
4541                         }
4542 
4543                         if (is_o && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4544                             xrs.pr_type == XR_TYPE_V8P) {
4545                                 r |= (uint64_t)xrs.pr_un.pr_v8p.pr_xo[
4546                                     rd_num - R_O0 + XR_O0] << 32;
4547                         }
4548 #endif  /* __sparc && _ILP32 */
4549 
4550                         /*
4551                          * Avoid sign-extension by casting: recall that procfs
4552                          * defines prgreg_t as a long or int and our native
4553                          * register handling uses uint64_t's.
4554                          */
4555                         if (PTL_GETREGS(t, tid, grs) == 0) {
4556                                 *rp = r | (ulong_t)grs[rd_num];
4557                                 if (rd_flags & MDB_TGT_R_32)
4558                                         *rp &= 0xffffffffULL;
4559                                 else if (rd_flags & MDB_TGT_R_16)
4560                                         *rp &= 0xffffULL;
4561                                 else if (rd_flags & MDB_TGT_R_8H)
4562                                         *rp = (*rp & 0xff00ULL) >> 8;
4563                                 else if (rd_flags & MDB_TGT_R_8L)
4564                                         *rp &= 0xffULL;
4565                                 return (0);
4566                         }
4567                         return (-1);
4568                 } else
4569                         return (pt_getfpreg(t, tid, rd_num, rd_flags, rp));
4570         }
4571 
4572         return (set_errno(EMDB_BADREG));
4573 }
4574 
4575 static int
4576 pt_putareg(mdb_tgt_t *t, mdb_tgt_tid_t tid, const char *rname, mdb_tgt_reg_t r)
4577 {
4578         pt_data_t *pt = t->t_data;
4579         prgregset_t grs;
4580         mdb_var_t *v;
4581 
4582         if (t->t_pshandle == NULL)
4583                 return (set_errno(EMDB_NOPROC));
4584 
4585         if ((v = mdb_nv_lookup(&pt->p_regs, rname)) != NULL) {
4586                 uintmax_t rd_nval = mdb_nv_get_value(v);
4587                 ushort_t rd_num = MDB_TGT_R_NUM(rd_nval);
4588                 ushort_t rd_flags = MDB_TGT_R_FLAGS(rd_nval);
4589 
4590                 if (!MDB_TGT_R_IS_FP(rd_flags)) {
4591 
4592                         if (rd_flags & MDB_TGT_R_32)
4593                                 r &= 0xffffffffULL;
4594                         else if (rd_flags & MDB_TGT_R_16)
4595                                 r &= 0xffffULL;
4596                         else if (rd_flags & MDB_TGT_R_8H)
4597                                 r = (r & 0xffULL) << 8;
4598                         else if (rd_flags & MDB_TGT_R_8L)
4599                                 r &= 0xffULL;
4600 
4601 #if defined(__sparc) && defined(_ILP32)
4602                         /*
4603                          * If we are debugging on 32-bit SPARC, the globals and
4604                          * outs can have 32 upper bits stored in the xregs.
4605                          */
4606                         int is_g = (rd_num == R_G0 ||
4607                             rd_num >= R_G1 && rd_num <= R_G7);
4608                         int is_o = (rd_num >= R_O0 && rd_num <= R_O7);
4609                         prxregset_t xrs;
4610 
4611                         if ((is_g || is_o) && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4612                             xrs.pr_type == XR_TYPE_V8P) {
4613                                 if (is_g) {
4614                                         xrs.pr_un.pr_v8p.pr_xg[rd_num -
4615                                             R_G0 + XR_G0] = (uint32_t)(r >> 32);
4616                                 } else if (is_o) {
4617                                         xrs.pr_un.pr_v8p.pr_xo[rd_num -
4618                                             R_O0 + XR_O0] = (uint32_t)(r >> 32);
4619                                 }
4620 
4621                                 if (PTL_SETXREGS(t, tid, &xrs) == -1)
4622                                         return (-1);
4623                         }
4624 #endif  /* __sparc && _ILP32 */
4625 
4626                         if (PTL_GETREGS(t, tid, grs) == 0) {
4627                                 grs[rd_num] = (prgreg_t)r;
4628                                 return (PTL_SETREGS(t, tid, grs));
4629                         }
4630                         return (-1);
4631                 } else
4632                         return (pt_putfpreg(t, tid, rd_num, rd_flags, r));
4633         }
4634 
4635         return (set_errno(EMDB_BADREG));
4636 }
4637 
4638 static int
4639 pt_stack_call(pt_stkarg_t *psp, const prgregset_t grs, uint_t argc, long *argv)
4640 {
4641         psp->pstk_gotpc |= (grs[R_PC] != 0);
4642 
4643         if (!psp->pstk_gotpc)
4644                 return (0); /* skip initial zeroed frames */
4645 
4646         return (psp->pstk_func(psp->pstk_private, grs[R_PC],
4647             argc, argv, (const struct mdb_tgt_gregset *)grs));
4648 }
4649 
4650 static int
4651 pt_stack_iter(mdb_tgt_t *t, const mdb_tgt_gregset_t *gsp,
4652     mdb_tgt_stack_f *func, void *arg)
4653 {
4654         if (t->t_pshandle != NULL) {
4655                 pt_stkarg_t pstk;
4656 
4657                 pstk.pstk_func = func;
4658                 pstk.pstk_private = arg;
4659                 pstk.pstk_gotpc = FALSE;
4660 
4661                 (void) Pstack_iter(t->t_pshandle, gsp->gregs,
4662                     (proc_stack_f *)pt_stack_call, &pstk);
4663 
4664                 return (0);
4665         }
4666 
4667         return (set_errno(EMDB_NOPROC));
4668 }
4669 
4670 static int
4671 pt_auxv(mdb_tgt_t *t, const auxv_t **auxvp)
4672 {
4673         if (t->t_pshandle != NULL) {
4674                 *auxvp = Pgetauxvec(t->t_pshandle);
4675                 return (0);
4676         }
4677 
4678         return (set_errno(EMDB_NOPROC));
4679 }
4680 
4681 
4682 static const mdb_tgt_ops_t proc_ops = {
4683         pt_setflags,                            /* t_setflags */
4684         (int (*)()) mdb_tgt_notsup,             /* t_setcontext */
4685         pt_activate,                            /* t_activate */
4686         pt_deactivate,                          /* t_deactivate */
4687         pt_periodic,                            /* t_periodic */
4688         pt_destroy,                             /* t_destroy */
4689         pt_name,                                /* t_name */
4690         (const char *(*)()) mdb_conf_isa,       /* t_isa */
4691         pt_platform,                            /* t_platform */
4692         pt_uname,                               /* t_uname */
4693         pt_dmodel,                              /* t_dmodel */
4694         (ssize_t (*)()) mdb_tgt_notsup,         /* t_aread */
4695         (ssize_t (*)()) mdb_tgt_notsup,         /* t_awrite */
4696         pt_vread,                               /* t_vread */
4697         pt_vwrite,                              /* t_vwrite */
4698         (ssize_t (*)()) mdb_tgt_notsup,         /* t_pread */
4699         (ssize_t (*)()) mdb_tgt_notsup,         /* t_pwrite */
4700         pt_fread,                               /* t_fread */
4701         pt_fwrite,                              /* t_fwrite */
4702         (ssize_t (*)()) mdb_tgt_notsup,         /* t_ioread */
4703         (ssize_t (*)()) mdb_tgt_notsup,         /* t_iowrite */
4704         (int (*)()) mdb_tgt_notsup,             /* t_vtop */
4705         pt_lookup_by_name,                      /* t_lookup_by_name */
4706         pt_lookup_by_addr,                      /* t_lookup_by_addr */
4707         pt_symbol_iter,                         /* t_symbol_iter */
4708         pt_mapping_iter,                        /* t_mapping_iter */
4709         pt_object_iter,                         /* t_object_iter */
4710         pt_addr_to_map,                         /* t_addr_to_map */
4711         pt_name_to_map,                         /* t_name_to_map */
4712         pt_addr_to_ctf,                         /* t_addr_to_ctf */
4713         pt_name_to_ctf,                         /* t_name_to_ctf */
4714         pt_status,                              /* t_status */
4715         pt_run,                                 /* t_run */
4716         pt_step,                                /* t_step */
4717         pt_step_out,                            /* t_step_out */
4718         pt_next,                                /* t_next */
4719         pt_continue,                            /* t_cont */
4720         pt_signal,                              /* t_signal */
4721         pt_add_vbrkpt,                          /* t_add_vbrkpt */
4722         pt_add_sbrkpt,                          /* t_add_sbrkpt */
4723         (int (*)()) mdb_tgt_null,               /* t_add_pwapt */
4724         pt_add_vwapt,                           /* t_add_vwapt */
4725         (int (*)()) mdb_tgt_null,               /* t_add_iowapt */
4726         pt_add_sysenter,                        /* t_add_sysenter */
4727         pt_add_sysexit,                         /* t_add_sysexit */
4728         pt_add_signal,                          /* t_add_signal */
4729         pt_add_fault,                           /* t_add_fault */
4730         pt_getareg,                             /* t_getareg */
4731         pt_putareg,                             /* t_putareg */
4732         pt_stack_iter,                          /* t_stack_iter */
4733         pt_auxv                                 /* t_auxv */
4734 };
4735 
4736 /*
4737  * Utility function for converting libproc errno values to mdb error values
4738  * for the ptl calls below.  Currently, we only need to convert ENOENT to
4739  * EMDB_NOTHREAD to produce a more useful error message for the user.
4740  */
4741 static int
4742 ptl_err(int error)
4743 {
4744         if (error != 0 && errno == ENOENT)
4745                 return (set_errno(EMDB_NOTHREAD));
4746 
4747         return (error);
4748 }
4749 
4750 /*ARGSUSED*/
4751 static mdb_tgt_tid_t
4752 pt_lwp_tid(mdb_tgt_t *t, void *tap)
4753 {
4754         if (t->t_pshandle != NULL)
4755                 return (Pstatus(t->t_pshandle)->pr_lwp.pr_lwpid);
4756 
4757         return (set_errno(EMDB_NOPROC));
4758 }
4759 
4760 static int
4761 pt_lwp_add(mdb_addrvec_t *ap, const lwpstatus_t *psp)
4762 {
4763         mdb_addrvec_unshift(ap, psp->pr_lwpid);
4764         return (0);
4765 }
4766 
4767 /*ARGSUSED*/
4768 static int
4769 pt_lwp_iter(mdb_tgt_t *t, void *tap, mdb_addrvec_t *ap)
4770 {
4771         if (t->t_pshandle != NULL)
4772                 return (Plwp_iter(t->t_pshandle, (proc_lwp_f *)pt_lwp_add, ap));
4773 
4774         return (set_errno(EMDB_NOPROC));
4775 }
4776 
4777 /*ARGSUSED*/
4778 static int
4779 pt_lwp_getregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4780 {
4781         if (t->t_pshandle != NULL) {
4782                 return (ptl_err(Plwp_getregs(t->t_pshandle,
4783                     (lwpid_t)tid, gregs)));
4784         }
4785         return (set_errno(EMDB_NOPROC));
4786 }
4787 
4788 /*ARGSUSED*/
4789 static int
4790 pt_lwp_setregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4791 {
4792         if (t->t_pshandle != NULL) {
4793                 return (ptl_err(Plwp_setregs(t->t_pshandle,
4794                     (lwpid_t)tid, gregs)));
4795         }
4796         return (set_errno(EMDB_NOPROC));
4797 }
4798 
4799 #ifdef  __sparc
4800 
4801 /*ARGSUSED*/
4802 static int
4803 pt_lwp_getxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prxregset_t *xregs)
4804 {
4805         if (t->t_pshandle != NULL) {
4806                 return (ptl_err(Plwp_getxregs(t->t_pshandle,
4807                     (lwpid_t)tid, xregs)));
4808         }
4809         return (set_errno(EMDB_NOPROC));
4810 }
4811 
4812 /*ARGSUSED*/
4813 static int
4814 pt_lwp_setxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4815     const prxregset_t *xregs)
4816 {
4817         if (t->t_pshandle != NULL) {
4818                 return (ptl_err(Plwp_setxregs(t->t_pshandle,
4819                     (lwpid_t)tid, xregs)));
4820         }
4821         return (set_errno(EMDB_NOPROC));
4822 }
4823 
4824 #endif  /* __sparc */
4825 
4826 /*ARGSUSED*/
4827 static int
4828 pt_lwp_getfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4829     prfpregset_t *fpregs)
4830 {
4831         if (t->t_pshandle != NULL) {
4832                 return (ptl_err(Plwp_getfpregs(t->t_pshandle,
4833                     (lwpid_t)tid, fpregs)));
4834         }
4835         return (set_errno(EMDB_NOPROC));
4836 }
4837 
4838 /*ARGSUSED*/
4839 static int
4840 pt_lwp_setfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4841     const prfpregset_t *fpregs)
4842 {
4843         if (t->t_pshandle != NULL) {
4844                 return (ptl_err(Plwp_setfpregs(t->t_pshandle,
4845                     (lwpid_t)tid, fpregs)));
4846         }
4847         return (set_errno(EMDB_NOPROC));
4848 }
4849 
4850 static const pt_ptl_ops_t proc_lwp_ops = {
4851         (int (*)()) mdb_tgt_nop,
4852         (void (*)()) mdb_tgt_nop,
4853         pt_lwp_tid,
4854         pt_lwp_iter,
4855         pt_lwp_getregs,
4856         pt_lwp_setregs,
4857 #ifdef __sparc
4858         pt_lwp_getxregs,
4859         pt_lwp_setxregs,
4860 #endif
4861         pt_lwp_getfpregs,
4862         pt_lwp_setfpregs
4863 };
4864 
4865 static int
4866 pt_tdb_ctor(mdb_tgt_t *t)
4867 {
4868         pt_data_t *pt = t->t_data;
4869         td_thragent_t *tap;
4870         td_err_e err;
4871 
4872         if ((err = pt->p_tdb_ops->td_ta_new(t->t_pshandle, &tap)) != TD_OK)
4873                 return (set_errno(tdb_to_errno(err)));
4874 
4875         pt->p_ptl_hdl = tap;
4876         return (0);
4877 }
4878 
4879 static void
4880 pt_tdb_dtor(mdb_tgt_t *t, void *tap)
4881 {
4882         pt_data_t *pt = t->t_data;
4883 
4884         ASSERT(tap == pt->p_ptl_hdl);
4885         (void) pt->p_tdb_ops->td_ta_delete(tap);
4886         pt->p_ptl_hdl = NULL;
4887 }
4888 
4889 static mdb_tgt_tid_t
4890 pt_tdb_tid(mdb_tgt_t *t, void *tap)
4891 {
4892         pt_data_t *pt = t->t_data;
4893 
4894         td_thrhandle_t th;
4895         td_thrinfo_t ti;
4896         td_err_e err;
4897 
4898         if (t->t_pshandle == NULL)
4899                 return (set_errno(EMDB_NOPROC));
4900 
4901         if ((err = pt->p_tdb_ops->td_ta_map_lwp2thr(tap,
4902             Pstatus(t->t_pshandle)->pr_lwp.pr_lwpid, &th)) != TD_OK)
4903                 return (set_errno(tdb_to_errno(err)));
4904 
4905         if ((err = pt->p_tdb_ops->td_thr_get_info(&th, &ti)) != TD_OK)
4906                 return (set_errno(tdb_to_errno(err)));
4907 
4908         return (ti.ti_tid);
4909 }
4910 
4911 static int
4912 pt_tdb_add(const td_thrhandle_t *thp, pt_addarg_t *pap)
4913 {
4914         td_thrinfo_t ti;
4915 
4916         if (pap->pa_pt->p_tdb_ops->td_thr_get_info(thp, &ti) == TD_OK &&
4917             ti.ti_state != TD_THR_ZOMBIE)
4918                 mdb_addrvec_unshift(pap->pa_ap, ti.ti_tid);
4919 
4920         return (0);
4921 }
4922 
4923 static int
4924 pt_tdb_iter(mdb_tgt_t *t, void *tap, mdb_addrvec_t *ap)
4925 {
4926         pt_data_t *pt = t->t_data;
4927         pt_addarg_t arg;
4928         int err;
4929 
4930         if (t->t_pshandle == NULL)
4931                 return (set_errno(EMDB_NOPROC));
4932 
4933         arg.pa_pt = pt;
4934         arg.pa_ap = ap;
4935 
4936         if ((err = pt->p_tdb_ops->td_ta_thr_iter(tap, (td_thr_iter_f *)
4937             pt_tdb_add, &arg, TD_THR_ANY_STATE, TD_THR_LOWEST_PRIORITY,
4938             TD_SIGNO_MASK, TD_THR_ANY_USER_FLAGS)) != TD_OK)
4939                 return (set_errno(tdb_to_errno(err)));
4940 
4941         return (0);
4942 }
4943 
4944 static int
4945 pt_tdb_getregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4946 {
4947         pt_data_t *pt = t->t_data;
4948 
4949         td_thrhandle_t th;
4950         td_err_e err;
4951 
4952         if (t->t_pshandle == NULL)
4953                 return (set_errno(EMDB_NOPROC));
4954 
4955         if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4956                 return (set_errno(tdb_to_errno(err)));
4957 
4958         err = pt->p_tdb_ops->td_thr_getgregs(&th, gregs);
4959         if (err != TD_OK && err != TD_PARTIALREG)
4960                 return (set_errno(tdb_to_errno(err)));
4961 
4962         return (0);
4963 }
4964 
4965 static int
4966 pt_tdb_setregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4967 {
4968         pt_data_t *pt = t->t_data;
4969 
4970         td_thrhandle_t th;
4971         td_err_e err;
4972 
4973         if (t->t_pshandle == NULL)
4974                 return (set_errno(EMDB_NOPROC));
4975 
4976         if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4977                 return (set_errno(tdb_to_errno(err)));
4978 
4979         err = pt->p_tdb_ops->td_thr_setgregs(&th, gregs);
4980         if (err != TD_OK && err != TD_PARTIALREG)
4981                 return (set_errno(tdb_to_errno(err)));
4982 
4983         return (0);
4984 }
4985 
4986 #ifdef __sparc
4987 
4988 static int
4989 pt_tdb_getxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prxregset_t *xregs)
4990 {
4991         pt_data_t *pt = t->t_data;
4992 
4993         td_thrhandle_t th;
4994         td_err_e err;
4995 
4996         if (t->t_pshandle == NULL)
4997                 return (set_errno(EMDB_NOPROC));
4998 
4999         if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5000                 return (set_errno(tdb_to_errno(err)));
5001 
5002         err = pt->p_tdb_ops->td_thr_getxregs(&th, xregs);
5003         if (err != TD_OK && err != TD_PARTIALREG)
5004                 return (set_errno(tdb_to_errno(err)));
5005 
5006         return (0);
5007 }
5008 
5009 static int
5010 pt_tdb_setxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
5011     const prxregset_t *xregs)
5012 {
5013         pt_data_t *pt = t->t_data;
5014 
5015         td_thrhandle_t th;
5016         td_err_e err;
5017 
5018         if (t->t_pshandle == NULL)
5019                 return (set_errno(EMDB_NOPROC));
5020 
5021         if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5022                 return (set_errno(tdb_to_errno(err)));
5023 
5024         err = pt->p_tdb_ops->td_thr_setxregs(&th, xregs);
5025         if (err != TD_OK && err != TD_PARTIALREG)
5026                 return (set_errno(tdb_to_errno(err)));
5027 
5028         return (0);
5029 }
5030 
5031 #endif  /* __sparc */
5032 
5033 static int
5034 pt_tdb_getfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
5035     prfpregset_t *fpregs)
5036 {
5037         pt_data_t *pt = t->t_data;
5038 
5039         td_thrhandle_t th;
5040         td_err_e err;
5041 
5042         if (t->t_pshandle == NULL)
5043                 return (set_errno(EMDB_NOPROC));
5044 
5045         if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5046                 return (set_errno(tdb_to_errno(err)));
5047 
5048         err = pt->p_tdb_ops->td_thr_getfpregs(&th, fpregs);
5049         if (err != TD_OK && err != TD_PARTIALREG)
5050                 return (set_errno(tdb_to_errno(err)));
5051 
5052         return (0);
5053 }
5054 
5055 static int
5056 pt_tdb_setfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
5057     const prfpregset_t *fpregs)
5058 {
5059         pt_data_t *pt = t->t_data;
5060 
5061         td_thrhandle_t th;
5062         td_err_e err;
5063 
5064         if (t->t_pshandle == NULL)
5065                 return (set_errno(EMDB_NOPROC));
5066 
5067         if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5068                 return (set_errno(tdb_to_errno(err)));
5069 
5070         err = pt->p_tdb_ops->td_thr_setfpregs(&th, fpregs);
5071         if (err != TD_OK && err != TD_PARTIALREG)
5072                 return (set_errno(tdb_to_errno(err)));
5073 
5074         return (0);
5075 }
5076 
5077 static const pt_ptl_ops_t proc_tdb_ops = {
5078         pt_tdb_ctor,
5079         pt_tdb_dtor,
5080         pt_tdb_tid,
5081         pt_tdb_iter,
5082         pt_tdb_getregs,
5083         pt_tdb_setregs,
5084 #ifdef __sparc
5085         pt_tdb_getxregs,
5086         pt_tdb_setxregs,
5087 #endif
5088         pt_tdb_getfpregs,
5089         pt_tdb_setfpregs
5090 };
5091 
5092 static ssize_t
5093 pt_xd_auxv(mdb_tgt_t *t, void *buf, size_t nbytes)
5094 {
5095         struct ps_prochandle *P = t->t_pshandle;
5096         const auxv_t *auxp, *auxv = NULL;
5097         int auxn = 0;
5098 
5099         if (P != NULL && (auxv = Pgetauxvec(P)) != NULL &&
5100             auxv->a_type != AT_NULL) {
5101                 for (auxp = auxv, auxn = 1; auxp->a_type != NULL; auxp++)
5102                         auxn++;
5103         }
5104 
5105         if (buf == NULL && nbytes == 0)
5106                 return (sizeof (auxv_t) * auxn);
5107 
5108         if (auxn == 0)
5109                 return (set_errno(ENODATA));
5110 
5111         nbytes = MIN(nbytes, sizeof (auxv_t) * auxn);
5112         bcopy(auxv, buf, nbytes);
5113         return (nbytes);
5114 }
5115 
5116 static ssize_t
5117 pt_xd_cred(mdb_tgt_t *t, void *buf, size_t nbytes)
5118 {
5119         prcred_t cr, *crp;
5120         size_t cbytes = 0;
5121 
5122         if (t->t_pshandle != NULL && Pcred(t->t_pshandle, &cr, 1) == 0) {
5123                 cbytes = (cr.pr_ngroups <= 1) ? sizeof (prcred_t) :
5124                     (sizeof (prcred_t) + (cr.pr_ngroups - 1) * sizeof (gid_t));
5125         }
5126 
5127         if (buf == NULL && nbytes == 0)
5128                 return (cbytes);
5129 
5130         if (cbytes == 0)
5131                 return (set_errno(ENODATA));
5132 
5133         crp = mdb_alloc(cbytes, UM_SLEEP);
5134 
5135         if (Pcred(t->t_pshandle, crp, cr.pr_ngroups) == -1)
5136                 return (set_errno(ENODATA));
5137 
5138         nbytes = MIN(nbytes, cbytes);
5139         bcopy(crp, buf, nbytes);
5140         mdb_free(crp, cbytes);
5141         return (nbytes);
5142 }
5143 
5144 static ssize_t
5145 pt_xd_ehdr(mdb_tgt_t *t, void *buf, size_t nbytes)
5146 {
5147         pt_data_t *pt = t->t_data;
5148 
5149         if (buf == NULL && nbytes == 0)
5150                 return (sizeof (GElf_Ehdr));
5151 
5152         if (pt->p_file == NULL)
5153                 return (set_errno(ENODATA));
5154 
5155         nbytes = MIN(nbytes, sizeof (GElf_Ehdr));
5156         bcopy(&pt->p_file->gf_ehdr, buf, nbytes);
5157         return (nbytes);
5158 }
5159 
5160 static int
5161 pt_copy_lwp(lwpstatus_t **lspp, const lwpstatus_t *lsp)
5162 {
5163         bcopy(lsp, *lspp, sizeof (lwpstatus_t));
5164         (*lspp)++;
5165         return (0);
5166 }
5167 
5168 static ssize_t
5169 pt_xd_lwpstatus(mdb_tgt_t *t, void *buf, size_t nbytes)
5170 {
5171         lwpstatus_t *lsp, *lbuf;
5172         const pstatus_t *psp;
5173         int nlwp = 0;
5174 
5175         if (t->t_pshandle != NULL && (psp = Pstatus(t->t_pshandle)) != NULL)
5176                 nlwp = psp->pr_nlwp;
5177 
5178         if (buf == NULL && nbytes == 0)
5179                 return (sizeof (lwpstatus_t) * nlwp);
5180 
5181         if (nlwp == 0)
5182                 return (set_errno(ENODATA));
5183 
5184         lsp = lbuf = mdb_alloc(sizeof (lwpstatus_t) * nlwp, UM_SLEEP);
5185         nbytes = MIN(nbytes, sizeof (lwpstatus_t) * nlwp);
5186 
5187         (void) Plwp_iter(t->t_pshandle, (proc_lwp_f *)pt_copy_lwp, &lsp);
5188         bcopy(lbuf, buf, nbytes);
5189 
5190         mdb_free(lbuf, sizeof (lwpstatus_t) * nlwp);
5191         return (nbytes);
5192 }
5193 
5194 static ssize_t
5195 pt_xd_pshandle(mdb_tgt_t *t, void *buf, size_t nbytes)
5196 {
5197         if (buf == NULL && nbytes == 0)
5198                 return (sizeof (struct ps_prochandle *));
5199 
5200         if (t->t_pshandle == NULL || nbytes != sizeof (struct ps_prochandle *))
5201                 return (set_errno(ENODATA));
5202 
5203         bcopy(&t->t_pshandle, buf, nbytes);
5204         return (nbytes);
5205 }
5206 
5207 static ssize_t
5208 pt_xd_psinfo(mdb_tgt_t *t, void *buf, size_t nbytes)
5209 {
5210         const psinfo_t *psp;
5211 
5212         if (buf == NULL && nbytes == 0)
5213                 return (sizeof (psinfo_t));
5214 
5215         if (t->t_pshandle == NULL || (psp = Ppsinfo(t->t_pshandle)) == NULL)
5216                 return (set_errno(ENODATA));
5217 
5218         nbytes = MIN(nbytes, sizeof (psinfo_t));
5219         bcopy(psp, buf, nbytes);
5220         return (nbytes);
5221 }
5222 
5223 static ssize_t
5224 pt_xd_pstatus(mdb_tgt_t *t, void *buf, size_t nbytes)
5225 {
5226         const pstatus_t *psp;
5227 
5228         if (buf == NULL && nbytes == 0)
5229                 return (sizeof (pstatus_t));
5230 
5231         if (t->t_pshandle == NULL || (psp = Pstatus(t->t_pshandle)) == NULL)
5232                 return (set_errno(ENODATA));
5233 
5234         nbytes = MIN(nbytes, sizeof (pstatus_t));
5235         bcopy(psp, buf, nbytes);
5236         return (nbytes);
5237 }
5238 
5239 static ssize_t
5240 pt_xd_utsname(mdb_tgt_t *t, void *buf, size_t nbytes)
5241 {
5242         struct utsname uts;
5243 
5244         if (buf == NULL && nbytes == 0)
5245                 return (sizeof (struct utsname));
5246 
5247         if (t->t_pshandle == NULL || Puname(t->t_pshandle, &uts) != 0)
5248                 return (set_errno(ENODATA));
5249 
5250         nbytes = MIN(nbytes, sizeof (struct utsname));
5251         bcopy(&uts, buf, nbytes);
5252         return (nbytes);
5253 }
5254 
5255 int
5256 mdb_proc_tgt_create(mdb_tgt_t *t, int argc, const char *argv[])
5257 {
5258         pt_data_t *pt = mdb_zalloc(sizeof (pt_data_t), UM_SLEEP);
5259 
5260         const char *aout_path = argc > 0 ? argv[0] : PT_EXEC_PATH;
5261         const char *core_path = argc > 1 ? argv[1] : NULL;
5262 
5263         const mdb_tgt_regdesc_t *rdp;
5264         char execname[MAXPATHLEN];
5265         struct stat64 st;
5266         int perr;
5267         int state;
5268         struct rlimit rlim;
5269         int i;
5270 
5271         if (argc > 2) {
5272                 mdb_free(pt, sizeof (pt_data_t));
5273                 return (set_errno(EINVAL));
5274         }
5275 
5276         if (t->t_flags & MDB_TGT_F_RDWR)
5277                 pt->p_oflags = O_RDWR;
5278         else
5279                 pt->p_oflags = O_RDONLY;
5280 
5281         if (t->t_flags & MDB_TGT_F_FORCE)
5282                 pt->p_gflags |= PGRAB_FORCE;
5283         if (t->t_flags & MDB_TGT_F_NOSTOP)
5284                 pt->p_gflags |= PGRAB_NOSTOP;
5285 
5286         pt->p_ptl_ops = &proc_lwp_ops;
5287         pt->p_maxsig = sysconf(_SC_SIGRT_MAX);
5288 
5289         (void) mdb_nv_create(&pt->p_regs, UM_SLEEP);
5290         (void) mdb_nv_create(&pt->p_env, UM_SLEEP);
5291 
5292         t->t_ops = &proc_ops;
5293         t->t_data = pt;
5294 
5295         /*
5296          * If no core file name was specified, but the file ./core is present,
5297          * infer that we want to debug it.  I find this behavior confusing,
5298          * so we only do this when precise adb(1) compatibility is required.
5299          */
5300         if (core_path == NULL && (mdb.m_flags & MDB_FL_ADB) &&
5301             access(PT_CORE_PATH, F_OK) == 0)
5302                 core_path = PT_CORE_PATH;
5303 
5304         /*
5305          * For compatibility with adb(1), the special name "-" may be used
5306          * to suppress the loading of the executable or core file.
5307          */
5308         if (aout_path != NULL && strcmp(aout_path, "-") == 0)
5309                 aout_path = NULL;
5310         if (core_path != NULL && strcmp(core_path, "-") == 0)
5311                 core_path = NULL;
5312 
5313         /*
5314          * If a core file or pid was specified, attempt to grab it now using
5315          * proc_arg_grab(); otherwise we'll create a fresh process later.
5316          */
5317         if (core_path != NULL && (t->t_pshandle = proc_arg_xgrab(core_path,
5318             aout_path == PT_EXEC_PATH ? NULL : aout_path, PR_ARG_ANY,
5319             pt->p_gflags, &perr, NULL)) == NULL) {
5320                 mdb_warn("cannot debug %s: %s\n", core_path, Pgrab_error(perr));
5321                 goto err;
5322         }
5323 
5324         if (aout_path != NULL &&
5325             (pt->p_idlehandle = Pgrab_file(aout_path, &perr)) != NULL &&
5326             t->t_pshandle == NULL)
5327                 t->t_pshandle = pt->p_idlehandle;
5328 
5329         if (t->t_pshandle != NULL)
5330                 state = Pstate(t->t_pshandle);
5331 
5332         /*
5333          * Make sure we'll have enough file descriptors to handle a target
5334          * has many many mappings.
5335          */
5336         if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) {
5337                 rlim.rlim_cur = rlim.rlim_max;
5338                 (void) setrlimit(RLIMIT_NOFILE, &rlim);
5339                 (void) enable_extended_FILE_stdio(-1, -1);
5340         }
5341 
5342         /*
5343          * If we don't have an executable path or the executable path is the
5344          * /proc/<pid>/object/a.out path, but we now have a libproc handle,
5345          * attempt to derive the executable path using Pexecname().  We need
5346          * to do this in the /proc case in order to open the executable for
5347          * writing because /proc/object/<file> permission are masked with 0555.
5348          * If Pexecname() fails us, fall back to /proc/<pid>/object/a.out.
5349          */
5350         if (t->t_pshandle != NULL && (aout_path == NULL || (stat64(aout_path,
5351             &st) == 0 && strcmp(st.st_fstype, "proc") == 0))) {
5352                 GElf_Sym s;
5353                 aout_path = Pexecname(t->t_pshandle, execname, MAXPATHLEN);
5354                 if (aout_path == NULL && state != PS_DEAD && state != PS_IDLE) {
5355                         (void) mdb_iob_snprintf(execname, sizeof (execname),
5356                             "/proc/%d/object/a.out",
5357                             (int)Pstatus(t->t_pshandle)->pr_pid);
5358                         aout_path = execname;
5359                 }
5360                 if (aout_path == NULL &&
5361                     Plookup_by_name(t->t_pshandle, "a.out", "_start", &s) != 0)
5362                         mdb_warn("warning: failed to infer pathname to "
5363                             "executable; symbol table will not be available\n");
5364 
5365                 mdb_dprintf(MDB_DBG_TGT, "a.out is %s\n", aout_path);
5366         }
5367 
5368         /*
5369          * Attempt to open the executable file.  We only want this operation
5370          * to actually cause the constructor to abort if the executable file
5371          * name was given explicitly.  If we defaulted to PT_EXEC_PATH or
5372          * derived the executable using Pexecname, then we want to continue
5373          * along with p_fio and p_file set to NULL.
5374          */
5375         if (aout_path != NULL && (pt->p_aout_fio = mdb_fdio_create_path(NULL,
5376             aout_path, pt->p_oflags, 0)) == NULL && argc > 0) {
5377                 mdb_warn("failed to open %s", aout_path);
5378                 goto err;
5379         }
5380 
5381         /*
5382          * Now create an ELF file from the input file, if we have one.  Again,
5383          * only abort the constructor if the name was given explicitly.
5384          */
5385         if (pt->p_aout_fio != NULL && pt_open_aout(t,
5386             mdb_io_hold(pt->p_aout_fio)) == NULL && argc > 0)
5387                 goto err;
5388 
5389         /*
5390          * If we've successfully opened an ELF file, select the appropriate
5391          * disassembler based on the ELF header.
5392          */
5393         if (pt->p_file != NULL)
5394                 (void) mdb_dis_select(pt_disasm(&pt->p_file->gf_ehdr));
5395         else
5396                 (void) mdb_dis_select(pt_disasm(NULL));
5397 
5398         /*
5399          * Add each register described in the target ISA register description
5400          * list to our hash table of register descriptions and then add any
5401          * appropriate ISA-specific floating-point register descriptions.
5402          */
5403         for (rdp = pt_regdesc; rdp->rd_name != NULL; rdp++) {
5404                 (void) mdb_nv_insert(&pt->p_regs, rdp->rd_name, NULL,
5405                     MDB_TGT_R_NVAL(rdp->rd_num, rdp->rd_flags), MDB_NV_RDONLY);
5406         }
5407         pt_addfpregs(t);
5408 
5409         /*
5410          * Certain important /proc structures may be of interest to mdb
5411          * modules and their dcmds.  Export these using the xdata interface:
5412          */
5413         (void) mdb_tgt_xdata_insert(t, "auxv",
5414             "procfs auxv_t array", pt_xd_auxv);
5415         (void) mdb_tgt_xdata_insert(t, "cred",
5416             "procfs prcred_t structure", pt_xd_cred);
5417         (void) mdb_tgt_xdata_insert(t, "ehdr",
5418             "executable file GElf_Ehdr structure", pt_xd_ehdr);
5419         (void) mdb_tgt_xdata_insert(t, "lwpstatus",
5420             "procfs lwpstatus_t array", pt_xd_lwpstatus);
5421         (void) mdb_tgt_xdata_insert(t, "pshandle",
5422             "libproc proc service API handle", pt_xd_pshandle);
5423         (void) mdb_tgt_xdata_insert(t, "psinfo",
5424             "procfs psinfo_t structure", pt_xd_psinfo);
5425         (void) mdb_tgt_xdata_insert(t, "pstatus",
5426             "procfs pstatus_t structure", pt_xd_pstatus);
5427         (void) mdb_tgt_xdata_insert(t, "utsname",
5428             "utsname structure", pt_xd_utsname);
5429 
5430         /*
5431          * Force a status update now so that we fill in t_status with the
5432          * latest information based on any successful grab.
5433          */
5434         (void) mdb_tgt_status(t, &t->t_status);
5435 
5436         /*
5437          * If we're not examining a core file, trace SIGINT and all signals
5438          * that cause the process to dump core as part of our initialization.
5439          */
5440         if ((t->t_pshandle != NULL && state != PS_DEAD && state != PS_IDLE) ||
5441             (pt->p_file != NULL && pt->p_file->gf_ehdr.e_type == ET_EXEC)) {
5442 
5443                 int tflag = MDB_TGT_SPEC_STICKY; /* default sigs are sticky */
5444 
5445                 (void) mdb_tgt_add_signal(t, SIGINT, tflag, no_se_f, NULL);
5446                 (void) mdb_tgt_add_signal(t, SIGQUIT, tflag, no_se_f, NULL);
5447                 (void) mdb_tgt_add_signal(t, SIGILL, tflag, no_se_f, NULL);
5448                 (void) mdb_tgt_add_signal(t, SIGTRAP, tflag, no_se_f, NULL);
5449                 (void) mdb_tgt_add_signal(t, SIGABRT, tflag, no_se_f, NULL);
5450                 (void) mdb_tgt_add_signal(t, SIGEMT, tflag, no_se_f, NULL);
5451                 (void) mdb_tgt_add_signal(t, SIGFPE, tflag, no_se_f, NULL);
5452                 (void) mdb_tgt_add_signal(t, SIGBUS, tflag, no_se_f, NULL);
5453                 (void) mdb_tgt_add_signal(t, SIGSEGV, tflag, no_se_f, NULL);
5454                 (void) mdb_tgt_add_signal(t, SIGSYS, tflag, no_se_f, NULL);
5455                 (void) mdb_tgt_add_signal(t, SIGXCPU, tflag, no_se_f, NULL);
5456                 (void) mdb_tgt_add_signal(t, SIGXFSZ, tflag, no_se_f, NULL);
5457         }
5458 
5459         /*
5460          * If we've grabbed a live process, establish our initial breakpoints
5461          * and librtld_db agent so we can track rtld activity.  If FL_VCREATE
5462          * is set, this process was created by a previous instantiation of
5463          * the debugger, so reset pr_flags to kill it; otherwise we attached
5464          * to an already running process.  Pgrab() has already set the PR_RLC
5465          * flag appropriately based on whether the process was stopped when we
5466          * attached.
5467          */
5468         if (t->t_pshandle != NULL && state != PS_DEAD && state != PS_IDLE) {
5469                 if (mdb.m_flags & MDB_FL_VCREATE) {
5470                         (void) Punsetflags(t->t_pshandle, PR_RLC);
5471                         (void) Psetflags(t->t_pshandle, PR_KLC);
5472                         pt->p_rflags = PRELEASE_KILL;
5473                 } else {
5474                         (void) Punsetflags(t->t_pshandle, PR_KLC);
5475                 }
5476                 pt_post_attach(t);
5477         }
5478 
5479         /*
5480          * Initialize a local copy of the environment, which can be modified
5481          * before running the program.
5482          */
5483         for (i = 0; mdb.m_env[i] != NULL; i++)
5484                 pt_env_set(pt, mdb.m_env[i]);
5485 
5486         /*
5487          * If adb(1) compatibility mode is on, then print the appropriate
5488          * greeting message if we have grabbed a core file.
5489          */
5490         if ((mdb.m_flags & MDB_FL_ADB) && t->t_pshandle != NULL &&
5491             state == PS_DEAD) {
5492                 const pstatus_t *psp = Pstatus(t->t_pshandle);
5493                 int cursig = psp->pr_lwp.pr_cursig;
5494                 char signame[SIG2STR_MAX];
5495 
5496                 mdb_printf("core file = %s -- program ``%s'' on platform %s\n",
5497                     core_path, aout_path ? aout_path : "?", pt_platform(t));
5498 
5499                 if (cursig != 0 && sig2str(cursig, signame) == 0)
5500                         mdb_printf("SIG%s: %s\n", signame, strsignal(cursig));
5501         }
5502 
5503         return (0);
5504 
5505 err:
5506         pt_destroy(t);
5507         return (-1);
5508 }