1 /*
   2  * CDDL HEADER START
   3  *
   4  * The contents of this file are subject to the terms of the
   5  * Common Development and Distribution License (the "License").
   6  * You may not use this file except in compliance with the License.
   7  *
   8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
   9  * or http://www.opensolaris.org/os/licensing.
  10  * See the License for the specific language governing permissions
  11  * and limitations under the License.
  12  *
  13  * When distributing Covered Code, include this CDDL HEADER in each
  14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
  15  * If applicable, add the following below this CDDL HEADER, with the
  16  * fields enclosed by brackets "[]" replaced with your own identifying
  17  * information: Portions Copyright [yyyy] [name of copyright owner]
  18  *
  19  * CDDL HEADER END
  20  */
  21 /*
  22  * Copyright 2009 Sun Microsystems, Inc.  All rights reserved.
  23  * Use is subject to license terms.
  24  */
  25 
  26 /*
  27  * Copyright (c) 2012 by Delphix. All rights reserved.
  28  * Copyright (c) 2012 Joyent, Inc. All rights reserved.
  29  */
  30 
  31 #include <mdb/mdb_modapi.h>
  32 #include <mdb/mdb_target.h>
  33 #include <mdb/mdb_argvec.h>
  34 #include <mdb/mdb_string.h>
  35 #include <mdb/mdb_stdlib.h>
  36 #include <mdb/mdb_err.h>
  37 #include <mdb/mdb_debug.h>
  38 #include <mdb/mdb_fmt.h>
  39 #include <mdb/mdb_ctf.h>
  40 #include <mdb/mdb_ctf_impl.h>
  41 #include <mdb/mdb.h>
  42 #include <mdb/mdb_tab.h>
  43 
  44 #include <sys/isa_defs.h>
  45 #include <sys/param.h>
  46 #include <sys/sysmacros.h>
  47 #include <netinet/in.h>
  48 #include <strings.h>
  49 #include <libctf.h>
  50 #include <ctype.h>
  51 
  52 typedef struct holeinfo {
  53         ulong_t hi_offset;              /* expected offset */
  54         uchar_t hi_isunion;             /* represents a union */
  55 } holeinfo_t;
  56 
  57 typedef struct printarg {
  58         mdb_tgt_t *pa_tgt;              /* current target */
  59         mdb_tgt_t *pa_realtgt;          /* real target (for -i) */
  60         mdb_tgt_t *pa_immtgt;           /* immediate target (for -i) */
  61         mdb_tgt_as_t pa_as;             /* address space to use for i/o */
  62         mdb_tgt_addr_t pa_addr;         /* base address for i/o */
  63         ulong_t pa_armemlim;            /* limit on array elements to print */
  64         ulong_t pa_arstrlim;            /* limit on array chars to print */
  65         const char *pa_delim;           /* element delimiter string */
  66         const char *pa_prefix;          /* element prefix string */
  67         const char *pa_suffix;          /* element suffix string */
  68         holeinfo_t *pa_holes;           /* hole detection information */
  69         int pa_nholes;                  /* size of holes array */
  70         int pa_flags;                   /* formatting flags (see below) */
  71         int pa_depth;                   /* previous depth */
  72         int pa_nest;                    /* array nesting depth */
  73         int pa_tab;                     /* tabstop width */
  74         uint_t pa_maxdepth;             /* Limit max depth */
  75 } printarg_t;
  76 
  77 #define PA_SHOWTYPE     0x001           /* print type name */
  78 #define PA_SHOWBASETYPE 0x002           /* print base type name */
  79 #define PA_SHOWNAME     0x004           /* print member name */
  80 #define PA_SHOWADDR     0x008           /* print address */
  81 #define PA_SHOWVAL      0x010           /* print value */
  82 #define PA_SHOWHOLES    0x020           /* print holes in structs */
  83 #define PA_INTHEX       0x040           /* print integer values in hex */
  84 #define PA_INTDEC       0x080           /* print integer values in decimal */
  85 #define PA_NOSYMBOLIC   0x100           /* don't print ptrs as func+offset */
  86 
  87 #define IS_CHAR(e) \
  88         (((e).cte_format & (CTF_INT_CHAR | CTF_INT_SIGNED)) == \
  89         (CTF_INT_CHAR | CTF_INT_SIGNED) && (e).cte_bits == NBBY)
  90 
  91 #define COMPOSITE_MASK  ((1 << CTF_K_STRUCT) | \
  92                         (1 << CTF_K_UNION) | (1 << CTF_K_ARRAY))
  93 #define IS_COMPOSITE(k) (((1 << k) & COMPOSITE_MASK) != 0)
  94 
  95 #define SOU_MASK        ((1 << CTF_K_STRUCT) | (1 << CTF_K_UNION))
  96 #define IS_SOU(k)       (((1 << k) & SOU_MASK) != 0)
  97 
  98 #define MEMBER_DELIM_ERR        -1
  99 #define MEMBER_DELIM_DONE       0
 100 #define MEMBER_DELIM_PTR        1
 101 #define MEMBER_DELIM_DOT        2
 102 #define MEMBER_DELIM_LBR        3
 103 
 104 typedef int printarg_f(const char *, const char *,
 105     mdb_ctf_id_t, mdb_ctf_id_t, ulong_t, printarg_t *);
 106 
 107 static int elt_print(const char *, mdb_ctf_id_t, mdb_ctf_id_t, ulong_t, int,
 108     void *);
 109 static void print_close_sou(printarg_t *, int);
 110 
 111 /*
 112  * Given an address, look up the symbol ID of the specified symbol in its
 113  * containing module.  We only support lookups for exact matches.
 114  */
 115 static const char *
 116 addr_to_sym(mdb_tgt_t *t, uintptr_t addr, char *name, size_t namelen,
 117     GElf_Sym *symp, mdb_syminfo_t *sip)
 118 {
 119         const mdb_map_t *mp;
 120         const char *p;
 121 
 122         if (mdb_tgt_lookup_by_addr(t, addr, MDB_TGT_SYM_EXACT, name,
 123             namelen, NULL, NULL) == -1)
 124                 return (NULL); /* address does not exactly match a symbol */
 125 
 126         if ((p = strrsplit(name, '`')) != NULL) {
 127                 if (mdb_tgt_lookup_by_name(t, name, p, symp, sip) == -1)
 128                         return (NULL);
 129                 return (p);
 130         }
 131 
 132         if ((mp = mdb_tgt_addr_to_map(t, addr)) == NULL)
 133                 return (NULL); /* address does not fall within a mapping */
 134 
 135         if (mdb_tgt_lookup_by_name(t, mp->map_name, name, symp, sip) == -1)
 136                 return (NULL);
 137 
 138         return (name);
 139 }
 140 
 141 /*
 142  * This lets dcmds be a little fancy with their processing of type arguments
 143  * while still treating them more or less as a single argument.
 144  * For example, if a command is invokes like this:
 145  *
 146  *   ::<dcmd> proc_t ...
 147  *
 148  * this function will just copy "proc_t" into the provided buffer. If the
 149  * command is instead invoked like this:
 150  *
 151  *   ::<dcmd> struct proc ...
 152  *
 153  * this function will place the string "struct proc" into the provided buffer
 154  * and increment the caller's argv and argc. This allows the caller to still
 155  * treat the type argument logically as it would an other atomic argument.
 156  */
 157 int
 158 args_to_typename(int *argcp, const mdb_arg_t **argvp, char *buf, size_t len)
 159 {
 160         int argc = *argcp;
 161         const mdb_arg_t *argv = *argvp;
 162 
 163         if (argc < 1 || argv->a_type != MDB_TYPE_STRING)
 164                 return (DCMD_USAGE);
 165 
 166         if (strcmp(argv->a_un.a_str, "struct") == 0 ||
 167             strcmp(argv->a_un.a_str, "enum") == 0 ||
 168             strcmp(argv->a_un.a_str, "union") == 0) {
 169                 if (argc <= 1) {
 170                         mdb_warn("%s is not a valid type\n", argv->a_un.a_str);
 171                         return (DCMD_ABORT);
 172                 }
 173 
 174                 if (argv[1].a_type != MDB_TYPE_STRING)
 175                         return (DCMD_USAGE);
 176 
 177                 (void) mdb_snprintf(buf, len, "%s %s",
 178                     argv[0].a_un.a_str, argv[1].a_un.a_str);
 179 
 180                 *argcp = argc - 1;
 181                 *argvp = argv + 1;
 182         } else {
 183                 (void) mdb_snprintf(buf, len, "%s", argv[0].a_un.a_str);
 184         }
 185 
 186         return (0);
 187 }
 188 
 189 /*ARGSUSED*/
 190 int
 191 cmd_sizeof(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 192 {
 193         mdb_ctf_id_t id;
 194         char tn[MDB_SYM_NAMLEN];
 195         int ret;
 196 
 197         if (flags & DCMD_ADDRSPEC)
 198                 return (DCMD_USAGE);
 199 
 200         if ((ret = args_to_typename(&argc, &argv, tn, sizeof (tn))) != 0)
 201                 return (ret);
 202 
 203         if (argc != 1)
 204                 return (DCMD_USAGE);
 205 
 206         if (mdb_ctf_lookup_by_name(tn, &id) != 0) {
 207                 mdb_warn("failed to look up type %s", tn);
 208                 return (DCMD_ERR);
 209         }
 210 
 211         if (flags & DCMD_PIPE_OUT)
 212                 mdb_printf("%#lr\n", mdb_ctf_type_size(id));
 213         else
 214                 mdb_printf("sizeof (%s) = %#lr\n", tn, mdb_ctf_type_size(id));
 215 
 216         return (DCMD_OK);
 217 }
 218 
 219 int
 220 cmd_sizeof_tab(mdb_tab_cookie_t *mcp, uint_t flags, int argc,
 221     const mdb_arg_t *argv)
 222 {
 223         char tn[MDB_SYM_NAMLEN];
 224         int ret;
 225 
 226         if (argc == 0 && !(flags & DCMD_TAB_SPACE))
 227                 return (0);
 228 
 229         if (argc == 0 && (flags & DCMD_TAB_SPACE))
 230                 return (mdb_tab_complete_type(mcp, NULL, MDB_TABC_NOPOINT));
 231 
 232         if ((ret = mdb_tab_typename(&argc, &argv, tn, sizeof (tn))) < 0)
 233                 return (ret);
 234 
 235         if (argc == 1)
 236                 return (mdb_tab_complete_type(mcp, tn, MDB_TABC_NOPOINT));
 237 
 238         return (0);
 239 }
 240 
 241 /*ARGSUSED*/
 242 int
 243 cmd_offsetof(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 244 {
 245         const char *member;
 246         mdb_ctf_id_t id;
 247         ulong_t off;
 248         char tn[MDB_SYM_NAMLEN];
 249         ssize_t sz;
 250         int ret;
 251 
 252         if (flags & DCMD_ADDRSPEC)
 253                 return (DCMD_USAGE);
 254 
 255         if ((ret = args_to_typename(&argc, &argv, tn, sizeof (tn))) != 0)
 256                 return (ret);
 257 
 258         if (argc != 2 || argv[1].a_type != MDB_TYPE_STRING)
 259                 return (DCMD_USAGE);
 260 
 261         if (mdb_ctf_lookup_by_name(tn, &id) != 0) {
 262                 mdb_warn("failed to look up type %s", tn);
 263                 return (DCMD_ERR);
 264         }
 265 
 266         member = argv[1].a_un.a_str;
 267 
 268         if (mdb_ctf_member_info(id, member, &off, &id) != 0) {
 269                 mdb_warn("failed to find member %s of type %s", member, tn);
 270                 return (DCMD_ERR);
 271         }
 272 
 273         if (flags & DCMD_PIPE_OUT) {
 274                 if (off % NBBY != 0) {
 275                         mdb_warn("member %s of type %s is not byte-aligned\n",
 276                             member, tn);
 277                         return (DCMD_ERR);
 278                 }
 279                 mdb_printf("%#lr", off / NBBY);
 280                 return (DCMD_OK);
 281         }
 282 
 283         mdb_printf("offsetof (%s, %s) = %#lr",
 284             tn, member, off / NBBY);
 285         if (off % NBBY != 0)
 286                 mdb_printf(".%lr", off % NBBY);
 287 
 288         if ((sz = mdb_ctf_type_size(id)) > 0)
 289                 mdb_printf(", sizeof (...->%s) = %#lr", member, sz);
 290 
 291         mdb_printf("\n");
 292 
 293         return (DCMD_OK);
 294 }
 295 
 296 /*ARGSUSED*/
 297 static int
 298 enum_prefix_scan_cb(const char *name, int value, void *arg)
 299 {
 300         char *str = arg;
 301 
 302         /*
 303          * This function is called with every name in the enum.  We make
 304          * "arg" be the common prefix, if any.
 305          */
 306         if (str[0] == 0) {
 307                 if (strlcpy(arg, name, MDB_SYM_NAMLEN) >= MDB_SYM_NAMLEN)
 308                         return (1);
 309                 return (0);
 310         }
 311 
 312         while (*name == *str) {
 313                 if (*str == 0) {
 314                         if (str != arg) {
 315                                 str--;  /* don't smother a name completely */
 316                         }
 317                         break;
 318                 }
 319                 name++;
 320                 str++;
 321         }
 322         *str = 0;
 323 
 324         return (str == arg);    /* only continue if prefix is non-empty */
 325 }
 326 
 327 struct enum_p2_info {
 328         intmax_t e_value;       /* value we're processing */
 329         char    *e_buf;         /* buffer for holding names */
 330         size_t  e_size;         /* size of buffer */
 331         size_t  e_prefix;       /* length of initial prefix */
 332         uint_t  e_allprefix;    /* apply prefix to first guy, too */
 333         uint_t  e_bits;         /* bits seen */
 334         uint8_t e_found;        /* have we seen anything? */
 335         uint8_t e_first;        /* does buf contain the first one? */
 336         uint8_t e_zero;         /* have we seen a zero value? */
 337 };
 338 
 339 static int
 340 enum_p2_cb(const char *name, int bit_arg, void *arg)
 341 {
 342         struct enum_p2_info *eiip = arg;
 343         uintmax_t bit = bit_arg;
 344 
 345         if (bit != 0 && !ISP2(bit))
 346                 return (1);     /* non-power-of-2; abort processing */
 347 
 348         if ((bit == 0 && eiip->e_zero) ||
 349             (bit != 0 && (eiip->e_bits & bit) != 0)) {
 350                 return (0);     /* already seen this value */
 351         }
 352 
 353         if (bit == 0)
 354                 eiip->e_zero = 1;
 355         else
 356                 eiip->e_bits |= bit;
 357 
 358         if (eiip->e_buf != NULL && (eiip->e_value & bit) != 0) {
 359                 char *buf = eiip->e_buf;
 360                 size_t prefix = eiip->e_prefix;
 361 
 362                 if (eiip->e_found) {
 363                         (void) strlcat(buf, "|", eiip->e_size);
 364 
 365                         if (eiip->e_first && !eiip->e_allprefix && prefix > 0) {
 366                                 char c1 = buf[prefix];
 367                                 char c2 = buf[prefix + 1];
 368                                 buf[prefix] = '{';
 369                                 buf[prefix + 1] = 0;
 370                                 mdb_printf("%s", buf);
 371                                 buf[prefix] = c1;
 372                                 buf[prefix + 1] = c2;
 373                                 mdb_printf("%s", buf + prefix);
 374                         } else {
 375                                 mdb_printf("%s", buf);
 376                         }
 377 
 378                 }
 379                 /* skip the common prefix as necessary */
 380                 if ((eiip->e_found || eiip->e_allprefix) &&
 381                     strlen(name) > prefix)
 382                         name += prefix;
 383 
 384                 (void) strlcpy(eiip->e_buf, name, eiip->e_size);
 385                 eiip->e_first = !eiip->e_found;
 386                 eiip->e_found = 1;
 387         }
 388         return (0);
 389 }
 390 
 391 static int
 392 enum_is_p2(mdb_ctf_id_t id)
 393 {
 394         struct enum_p2_info eii;
 395         bzero(&eii, sizeof (eii));
 396 
 397         return (mdb_ctf_type_kind(id) == CTF_K_ENUM &&
 398             mdb_ctf_enum_iter(id, enum_p2_cb, &eii) == 0 &&
 399             eii.e_bits != 0);
 400 }
 401 
 402 static int
 403 enum_value_print_p2(mdb_ctf_id_t id, intmax_t value, uint_t allprefix)
 404 {
 405         struct enum_p2_info eii;
 406         char prefix[MDB_SYM_NAMLEN + 2];
 407         intmax_t missed;
 408 
 409         bzero(&eii, sizeof (eii));
 410 
 411         eii.e_value = value;
 412         eii.e_buf = prefix;
 413         eii.e_size = sizeof (prefix);
 414         eii.e_allprefix = allprefix;
 415 
 416         prefix[0] = 0;
 417         if (mdb_ctf_enum_iter(id, enum_prefix_scan_cb, prefix) == 0)
 418                 eii.e_prefix = strlen(prefix);
 419 
 420         if (mdb_ctf_enum_iter(id, enum_p2_cb, &eii) != 0 || eii.e_bits == 0)
 421                 return (-1);
 422 
 423         missed = (value & ~(intmax_t)eii.e_bits);
 424 
 425         if (eii.e_found) {
 426                 /* push out any final value, with a | if we missed anything */
 427                 if (!eii.e_first)
 428                         (void) strlcat(prefix, "}", sizeof (prefix));
 429                 if (missed != 0)
 430                         (void) strlcat(prefix, "|", sizeof (prefix));
 431 
 432                 mdb_printf("%s", prefix);
 433         }
 434 
 435         if (!eii.e_found || missed) {
 436                 mdb_printf("%#llx", missed);
 437         }
 438 
 439         return (0);
 440 }
 441 
 442 struct enum_cbinfo {
 443         uint_t          e_flags;
 444         const char      *e_string;      /* NULL for value searches */
 445         size_t          e_prefix;
 446         intmax_t        e_value;
 447         uint_t          e_found;
 448         mdb_ctf_id_t    e_id;
 449 };
 450 #define E_PRETTY                0x01
 451 #define E_HEX                   0x02
 452 #define E_SEARCH_STRING         0x04
 453 #define E_SEARCH_VALUE          0x08
 454 #define E_ELIDE_PREFIX          0x10
 455 
 456 static void
 457 enum_print(struct enum_cbinfo *info, const char *name, int value)
 458 {
 459         uint_t flags = info->e_flags;
 460         uint_t elide_prefix = (info->e_flags & E_ELIDE_PREFIX);
 461 
 462         if (name != NULL && info->e_prefix && strlen(name) > info->e_prefix)
 463                 name += info->e_prefix;
 464 
 465         if (flags & E_PRETTY) {
 466                 uint_t indent = 5 + ((flags & E_HEX) ? 8 : 11);
 467 
 468                 mdb_printf((flags & E_HEX)? "%8x " : "%11d ", value);
 469                 (void) mdb_inc_indent(indent);
 470                 if (name != NULL) {
 471                         mdb_iob_puts(mdb.m_out, name);
 472                 } else {
 473                         (void) enum_value_print_p2(info->e_id, value,
 474                             elide_prefix);
 475                 }
 476                 (void) mdb_dec_indent(indent);
 477                 mdb_printf("\n");
 478         } else {
 479                 mdb_printf("%#r\n", value);
 480         }
 481 }
 482 
 483 static int
 484 enum_cb(const char *name, int value, void *arg)
 485 {
 486         struct enum_cbinfo *info = arg;
 487         uint_t flags = info->e_flags;
 488 
 489         if (flags & E_SEARCH_STRING) {
 490                 if (strcmp(name, info->e_string) != 0)
 491                         return (0);
 492 
 493         } else if (flags & E_SEARCH_VALUE) {
 494                 if (value != info->e_value)
 495                         return (0);
 496         }
 497 
 498         enum_print(info, name, value);
 499 
 500         info->e_found = 1;
 501         return (0);
 502 }
 503 
 504 void
 505 enum_help(void)
 506 {
 507         mdb_printf("%s",
 508 "Without an address and name, print all values for the enumeration \"enum\".\n"
 509 "With an address, look up a particular value in \"enum\".  With a name, look\n"
 510 "up a particular name in \"enum\".\n");
 511 
 512         (void) mdb_dec_indent(2);
 513         mdb_printf("\n%<b>OPTIONS%</b>\n");
 514         (void) mdb_inc_indent(2);
 515 
 516         mdb_printf("%s",
 517 "   -e    remove common prefixes from enum names\n"
 518 "   -x    report enum values in hexadecimal\n");
 519 }
 520 
 521 /*ARGSUSED*/
 522 int
 523 cmd_enum(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 524 {
 525         struct enum_cbinfo info;
 526 
 527         char type[MDB_SYM_NAMLEN + sizeof ("enum ")];
 528         char tn2[MDB_SYM_NAMLEN + sizeof ("enum ")];
 529         char prefix[MDB_SYM_NAMLEN];
 530         mdb_ctf_id_t id;
 531         mdb_ctf_id_t idr;
 532 
 533         int i;
 534         intmax_t search;
 535         uint_t isp2;
 536 
 537         info.e_flags = (flags & DCMD_PIPE_OUT)? 0 : E_PRETTY;
 538         info.e_string = NULL;
 539         info.e_value = 0;
 540         info.e_found = 0;
 541 
 542         i = mdb_getopts(argc, argv,
 543             'e', MDB_OPT_SETBITS, E_ELIDE_PREFIX, &info.e_flags,
 544             'x', MDB_OPT_SETBITS, E_HEX, &info.e_flags,
 545             NULL);
 546 
 547         argc -= i;
 548         argv += i;
 549 
 550         if ((i = args_to_typename(&argc, &argv, type, MDB_SYM_NAMLEN)) != 0)
 551                 return (i);
 552 
 553         if (strchr(type, ' ') == NULL) {
 554                 /*
 555                  * Check as an enumeration tag first, and fall back
 556                  * to checking for a typedef.  Yes, this means that
 557                  * anonymous enumerations whose typedefs conflict with
 558                  * an enum tag can't be accessed.  Don't do that.
 559                  */
 560                 (void) mdb_snprintf(tn2, sizeof (tn2), "enum %s", type);
 561 
 562                 if (mdb_ctf_lookup_by_name(tn2, &id) == 0) {
 563                         (void) strcpy(type, tn2);
 564                 } else if (mdb_ctf_lookup_by_name(type, &id) != 0) {
 565                         mdb_warn("types '%s', '%s'", tn2, type);
 566                         return (DCMD_ERR);
 567                 }
 568         } else {
 569                 if (mdb_ctf_lookup_by_name(type, &id) != 0) {
 570                         mdb_warn("'%s'", type);
 571                         return (DCMD_ERR);
 572                 }
 573         }
 574 
 575         /* resolve it, and make sure we're looking at an enumeration */
 576         if (mdb_ctf_type_resolve(id, &idr) == -1) {
 577                 mdb_warn("unable to resolve '%s'", type);
 578                 return (DCMD_ERR);
 579         }
 580         if (mdb_ctf_type_kind(idr) != CTF_K_ENUM) {
 581                 mdb_warn("'%s': not an enumeration\n", type);
 582                 return (DCMD_ERR);
 583         }
 584 
 585         info.e_id = idr;
 586 
 587         if (argc > 2)
 588                 return (DCMD_USAGE);
 589 
 590         if (argc == 2) {
 591                 if (flags & DCMD_ADDRSPEC) {
 592                         mdb_warn("may only specify one of: name, address\n");
 593                         return (DCMD_USAGE);
 594                 }
 595 
 596                 if (argv[1].a_type == MDB_TYPE_STRING) {
 597                         info.e_flags |= E_SEARCH_STRING;
 598                         info.e_string = argv[1].a_un.a_str;
 599                 } else if (argv[1].a_type == MDB_TYPE_IMMEDIATE) {
 600                         info.e_flags |= E_SEARCH_VALUE;
 601                         search = argv[1].a_un.a_val;
 602                 } else {
 603                         return (DCMD_USAGE);
 604                 }
 605         }
 606 
 607         if (flags & DCMD_ADDRSPEC) {
 608                 info.e_flags |= E_SEARCH_VALUE;
 609                 search = mdb_get_dot();
 610         }
 611 
 612         if (info.e_flags & E_SEARCH_VALUE) {
 613                 if ((int)search != search) {
 614                         mdb_warn("value '%lld' out of enumeration range\n",
 615                             search);
 616                 }
 617                 info.e_value = search;
 618         }
 619 
 620         isp2 = enum_is_p2(idr);
 621         if (isp2)
 622                 info.e_flags |= E_HEX;
 623 
 624         if (DCMD_HDRSPEC(flags) && (info.e_flags & E_PRETTY)) {
 625                 if (info.e_flags & E_HEX)
 626                         mdb_printf("%<u>%8s %-64s%</u>\n", "VALUE", "NAME");
 627                 else
 628                         mdb_printf("%<u>%11s %-64s%</u>\n", "VALUE", "NAME");
 629         }
 630 
 631         /* if the enum is a power-of-two one, process it that way */
 632         if ((info.e_flags & E_SEARCH_VALUE) && isp2) {
 633                 enum_print(&info, NULL, info.e_value);
 634                 return (DCMD_OK);
 635         }
 636 
 637         prefix[0] = 0;
 638         if ((info.e_flags & E_ELIDE_PREFIX) &&
 639             mdb_ctf_enum_iter(id, enum_prefix_scan_cb, prefix) == 0)
 640                 info.e_prefix = strlen(prefix);
 641 
 642         if (mdb_ctf_enum_iter(idr, enum_cb, &info) == -1) {
 643                 mdb_warn("cannot walk '%s' as enum", type);
 644                 return (DCMD_ERR);
 645         }
 646 
 647         if (info.e_found == 0 &&
 648             (info.e_flags & (E_SEARCH_STRING | E_SEARCH_VALUE)) != 0) {
 649                 if (info.e_flags & E_SEARCH_STRING)
 650                         mdb_warn("name \"%s\" not in '%s'\n", info.e_string,
 651                             type);
 652                 else
 653                         mdb_warn("value %#lld not in '%s'\n", info.e_value,
 654                             type);
 655 
 656                 return (DCMD_ERR);
 657         }
 658 
 659         return (DCMD_OK);
 660 }
 661 
 662 static int
 663 setup_vcb(const char *name, uintptr_t addr)
 664 {
 665         const char *p;
 666         mdb_var_t *v;
 667 
 668         if ((v = mdb_nv_lookup(&mdb.m_nv, name)) == NULL) {
 669                 if ((p = strbadid(name)) != NULL) {
 670                         mdb_warn("'%c' may not be used in a variable "
 671                             "name\n", *p);
 672                         return (DCMD_ABORT);
 673                 }
 674 
 675                 if ((v = mdb_nv_insert(&mdb.m_nv, name, NULL, addr, 0)) == NULL)
 676                         return (DCMD_ERR);
 677         } else {
 678                 if (v->v_flags & MDB_NV_RDONLY) {
 679                         mdb_warn("variable %s is read-only\n", name);
 680                         return (DCMD_ABORT);
 681                 }
 682         }
 683 
 684         /*
 685          * If there already exists a vcb for this variable, we may be
 686          * calling the dcmd in a loop.  We only create a vcb for this
 687          * variable on the first invocation.
 688          */
 689         if (mdb_vcb_find(v, mdb.m_frame) == NULL)
 690                 mdb_vcb_insert(mdb_vcb_create(v), mdb.m_frame);
 691 
 692         return (0);
 693 }
 694 
 695 /*ARGSUSED*/
 696 int
 697 cmd_list(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 698 {
 699         mdb_ctf_id_t id;
 700         ulong_t offset;
 701         uintptr_t a, tmp;
 702         int ret;
 703 
 704         if (!(flags & DCMD_ADDRSPEC) || argc == 0)
 705                 return (DCMD_USAGE);
 706 
 707         if (argv->a_type != MDB_TYPE_STRING) {
 708                 /*
 709                  * We are being given a raw offset in lieu of a type and
 710                  * member; confirm the arguments.
 711                  */
 712                 if (argv->a_type != MDB_TYPE_IMMEDIATE)
 713                         return (DCMD_USAGE);
 714 
 715                 offset = argv->a_un.a_val;
 716 
 717                 argv++;
 718                 argc--;
 719 
 720                 if (offset % sizeof (uintptr_t)) {
 721                         mdb_warn("offset must fall on a word boundary\n");
 722                         return (DCMD_ABORT);
 723                 }
 724         } else {
 725                 const char *member;
 726                 char buf[MDB_SYM_NAMLEN];
 727                 int ret;
 728 
 729                 ret = args_to_typename(&argc, &argv, buf, sizeof (buf));
 730                 if (ret != 0)
 731                         return (ret);
 732 
 733                 if (mdb_ctf_lookup_by_name(buf, &id) != 0) {
 734                         mdb_warn("failed to look up type %s", buf);
 735                         return (DCMD_ABORT);
 736                 }
 737 
 738                 argv++;
 739                 argc--;
 740 
 741                 if (argc < 1 || argv->a_type != MDB_TYPE_STRING)
 742                         return (DCMD_USAGE);
 743 
 744                 member = argv->a_un.a_str;
 745 
 746                 argv++;
 747                 argc--;
 748 
 749                 if (mdb_ctf_offsetof(id, member, &offset) != 0) {
 750                         mdb_warn("failed to find member %s of type %s",
 751                             member, buf);
 752                         return (DCMD_ABORT);
 753                 }
 754 
 755                 if (offset % (sizeof (uintptr_t) * NBBY) != 0) {
 756                         mdb_warn("%s is not a word-aligned member\n", member);
 757                         return (DCMD_ABORT);
 758                 }
 759 
 760                 offset /= NBBY;
 761         }
 762 
 763         /*
 764          * If we have any unchewed arguments, a variable name must be present.
 765          */
 766         if (argc == 1) {
 767                 if (argv->a_type != MDB_TYPE_STRING)
 768                         return (DCMD_USAGE);
 769 
 770                 if ((ret = setup_vcb(argv->a_un.a_str, addr)) != 0)
 771                         return (ret);
 772 
 773         } else if (argc != 0) {
 774                 return (DCMD_USAGE);
 775         }
 776 
 777         a = addr;
 778 
 779         do {
 780                 mdb_printf("%lr\n", a);
 781 
 782                 if (mdb_vread(&tmp, sizeof (tmp), a + offset) == -1) {
 783                         mdb_warn("failed to read next pointer from object %p",
 784                             a);
 785                         return (DCMD_ERR);
 786                 }
 787 
 788                 a = tmp;
 789         } while (a != addr && a != NULL);
 790 
 791         return (DCMD_OK);
 792 }
 793 
 794 int
 795 cmd_array(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
 796 {
 797         mdb_ctf_id_t id;
 798         ssize_t elemsize = 0;
 799         char tn[MDB_SYM_NAMLEN];
 800         int ret, nelem = -1;
 801 
 802         mdb_tgt_t *t = mdb.m_target;
 803         GElf_Sym sym;
 804         mdb_ctf_arinfo_t ar;
 805         mdb_syminfo_t s_info;
 806 
 807         if (!(flags & DCMD_ADDRSPEC))
 808                 return (DCMD_USAGE);
 809 
 810         if (argc >= 2) {
 811                 ret = args_to_typename(&argc, &argv, tn, sizeof (tn));
 812                 if (ret != 0)
 813                         return (ret);
 814 
 815                 if (argc == 1)  /* unquoted compound type without count */
 816                         return (DCMD_USAGE);
 817 
 818                 if (mdb_ctf_lookup_by_name(tn, &id) != 0) {
 819                         mdb_warn("failed to look up type %s", tn);
 820                         return (DCMD_ABORT);
 821                 }
 822 
 823                 if (argv[1].a_type == MDB_TYPE_IMMEDIATE)
 824                         nelem = argv[1].a_un.a_val;
 825                 else
 826                         nelem = mdb_strtoull(argv[1].a_un.a_str);
 827 
 828                 elemsize = mdb_ctf_type_size(id);
 829         } else if (addr_to_sym(t, addr, tn, sizeof (tn), &sym, &s_info)
 830             != NULL && mdb_ctf_lookup_by_symbol(&sym, &s_info, &id)
 831             == 0 && mdb_ctf_type_kind(id) == CTF_K_ARRAY &&
 832             mdb_ctf_array_info(id, &ar) != -1) {
 833                 elemsize = mdb_ctf_type_size(id) / ar.mta_nelems;
 834                 nelem = ar.mta_nelems;
 835         } else {
 836                 mdb_warn("no symbol information for %a", addr);
 837                 return (DCMD_ERR);
 838         }
 839 
 840         if (argc == 3 || argc == 1) {
 841                 if (argv[argc - 1].a_type != MDB_TYPE_STRING)
 842                         return (DCMD_USAGE);
 843 
 844                 if ((ret = setup_vcb(argv[argc - 1].a_un.a_str, addr)) != 0)
 845                         return (ret);
 846 
 847         } else if (argc > 3) {
 848                 return (DCMD_USAGE);
 849         }
 850 
 851         for (; nelem > 0; nelem--) {
 852                 mdb_printf("%lr\n", addr);
 853                 addr = addr + elemsize;
 854         }
 855 
 856         return (DCMD_OK);
 857 }
 858 
 859 /*
 860  * Print an integer bitfield in hexadecimal by reading the enclosing byte(s)
 861  * and then shifting and masking the data in the lower bits of a uint64_t.
 862  */
 863 static int
 864 print_bitfield(ulong_t off, printarg_t *pap, ctf_encoding_t *ep)
 865 {
 866         mdb_tgt_addr_t addr = pap->pa_addr + off / NBBY;
 867         size_t size = (ep->cte_bits + (NBBY - 1)) / NBBY;
 868         uint64_t mask = (1ULL << ep->cte_bits) - 1;
 869         uint64_t value = 0;
 870         uint8_t *buf = (uint8_t *)&value;
 871         uint8_t shift;
 872 
 873         const char *format;
 874 
 875         if (!(pap->pa_flags & PA_SHOWVAL))
 876                 return (0);
 877 
 878         if (ep->cte_bits > sizeof (value) * NBBY - 1) {
 879                 mdb_printf("??? (invalid bitfield size %u)", ep->cte_bits);
 880                 return (0);
 881         }
 882 
 883         /*
 884          * On big-endian machines, we need to adjust the buf pointer to refer
 885          * to the lowest 'size' bytes in 'value', and we need shift based on
 886          * the offset from the end of the data, not the offset of the start.
 887          */
 888 #ifdef _BIG_ENDIAN
 889         buf += sizeof (value) - size;
 890         off += ep->cte_bits;
 891 #endif
 892         if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as, buf, size, addr) != size) {
 893                 mdb_warn("failed to read %lu bytes at %llx",
 894                     (ulong_t)size, addr);
 895                 return (1);
 896         }
 897 
 898         shift = off % NBBY;
 899 
 900         /*
 901          * Offsets are counted from opposite ends on little- and
 902          * big-endian machines.
 903          */
 904 #ifdef _BIG_ENDIAN
 905         shift = NBBY - shift;
 906 #endif
 907 
 908         /*
 909          * If the bits we want do not begin on a byte boundary, shift the data
 910          * right so that the value is in the lowest 'cte_bits' of 'value'.
 911          */
 912         if (off % NBBY != 0)
 913                 value >>= shift;
 914         value &= mask;
 915 
 916         /*
 917          * We default to printing signed bitfields as decimals,
 918          * and unsigned bitfields in hexadecimal.  If they specify
 919          * hexadecimal, we treat the field as unsigned.
 920          */
 921         if ((pap->pa_flags & PA_INTHEX) ||
 922             !(ep->cte_format & CTF_INT_SIGNED)) {
 923                 format = (pap->pa_flags & PA_INTDEC)? "%#llu" : "%#llx";
 924         } else {
 925                 int sshift = sizeof (value) * NBBY - ep->cte_bits;
 926 
 927                 /* sign-extend value, and print as a signed decimal */
 928                 value = ((int64_t)value << sshift) >> sshift;
 929                 format = "%#lld";
 930         }
 931         mdb_printf(format, value);
 932 
 933         return (0);
 934 }
 935 
 936 /*
 937  * Print out a character or integer value.  We use some simple heuristics,
 938  * described below, to determine the appropriate radix to use for output.
 939  */
 940 static int
 941 print_int_val(const char *type, ctf_encoding_t *ep, ulong_t off,
 942     printarg_t *pap)
 943 {
 944         static const char *const sformat[] = { "%#d", "%#d", "%#d", "%#lld" };
 945         static const char *const uformat[] = { "%#u", "%#u", "%#u", "%#llu" };
 946         static const char *const xformat[] = { "%#x", "%#x", "%#x", "%#llx" };
 947 
 948         mdb_tgt_addr_t addr = pap->pa_addr + off / NBBY;
 949         const char *const *fsp;
 950         size_t size;
 951 
 952         union {
 953                 uint64_t i8;
 954                 uint32_t i4;
 955                 uint16_t i2;
 956                 uint8_t i1;
 957                 time_t t;
 958         } u;
 959 
 960         if (!(pap->pa_flags & PA_SHOWVAL))
 961                 return (0);
 962 
 963         if (ep->cte_format & CTF_INT_VARARGS) {
 964                 mdb_printf("...\n");
 965                 return (0);
 966         }
 967 
 968         /*
 969          * If the size is not a power-of-two number of bytes in the range 1-8
 970          * then we assume it is a bitfield and print it as such.
 971          */
 972         size = ep->cte_bits / NBBY;
 973         if (size > 8 || (ep->cte_bits % NBBY) != 0 || (size & (size - 1)) != 0)
 974                 return (print_bitfield(off, pap, ep));
 975 
 976         if (IS_CHAR(*ep)) {
 977                 mdb_printf("'");
 978                 if (mdb_fmt_print(pap->pa_tgt, pap->pa_as,
 979                     addr, 1, 'C') == addr)
 980                         return (1);
 981                 mdb_printf("'");
 982                 return (0);
 983         }
 984 
 985         if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as, &u.i8, size, addr) != size) {
 986                 mdb_warn("failed to read %lu bytes at %llx",
 987                     (ulong_t)size, addr);
 988                 return (1);
 989         }
 990 
 991         /*
 992          * We pretty-print time_t values as a calendar date and time.
 993          */
 994         if (!(pap->pa_flags & (PA_INTHEX | PA_INTDEC)) &&
 995             strcmp(type, "time_t") == 0 && u.t != 0) {
 996                 mdb_printf("%Y", u.t);
 997                 return (0);
 998         }
 999 
1000         /*
1001          * The default format is hexadecimal.
1002          */
1003         if (!(pap->pa_flags & PA_INTDEC))
1004                 fsp = xformat;
1005         else if (ep->cte_format & CTF_INT_SIGNED)
1006                 fsp = sformat;
1007         else
1008                 fsp = uformat;
1009 
1010         switch (size) {
1011         case sizeof (uint8_t):
1012                 mdb_printf(fsp[0], u.i1);
1013                 break;
1014         case sizeof (uint16_t):
1015                 mdb_printf(fsp[1], u.i2);
1016                 break;
1017         case sizeof (uint32_t):
1018                 mdb_printf(fsp[2], u.i4);
1019                 break;
1020         case sizeof (uint64_t):
1021                 mdb_printf(fsp[3], u.i8);
1022                 break;
1023         }
1024         return (0);
1025 }
1026 
1027 /*ARGSUSED*/
1028 static int
1029 print_int(const char *type, const char *name, mdb_ctf_id_t id,
1030     mdb_ctf_id_t base, ulong_t off, printarg_t *pap)
1031 {
1032         ctf_encoding_t e;
1033 
1034         if (!(pap->pa_flags & PA_SHOWVAL))
1035                 return (0);
1036 
1037         if (mdb_ctf_type_encoding(base, &e) != 0) {
1038                 mdb_printf("??? (%s)", mdb_strerror(errno));
1039                 return (0);
1040         }
1041 
1042         return (print_int_val(type, &e, off, pap));
1043 }
1044 
1045 /*
1046  * Print out a floating point value.  We only provide support for floats in
1047  * the ANSI-C float, double, and long double formats.
1048  */
1049 /*ARGSUSED*/
1050 static int
1051 print_float(const char *type, const char *name, mdb_ctf_id_t id,
1052     mdb_ctf_id_t base, ulong_t off, printarg_t *pap)
1053 {
1054 #ifndef _KMDB
1055         mdb_tgt_addr_t addr = pap->pa_addr + off / NBBY;
1056         ctf_encoding_t e;
1057 
1058         union {
1059                 float f;
1060                 double d;
1061                 long double ld;
1062         } u;
1063 
1064         if (!(pap->pa_flags & PA_SHOWVAL))
1065                 return (0);
1066 
1067         if (mdb_ctf_type_encoding(base, &e) == 0) {
1068                 if (e.cte_format == CTF_FP_SINGLE &&
1069                     e.cte_bits == sizeof (float) * NBBY) {
1070                         if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as, &u.f,
1071                             sizeof (u.f), addr) != sizeof (u.f)) {
1072                                 mdb_warn("failed to read float at %llx", addr);
1073                                 return (1);
1074                         }
1075                         mdb_printf("%s", doubletos(u.f, 7, 'e'));
1076 
1077                 } else if (e.cte_format == CTF_FP_DOUBLE &&
1078                     e.cte_bits == sizeof (double) * NBBY) {
1079                         if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as, &u.d,
1080                             sizeof (u.d), addr) != sizeof (u.d)) {
1081                                 mdb_warn("failed to read float at %llx", addr);
1082                                 return (1);
1083                         }
1084                         mdb_printf("%s", doubletos(u.d, 7, 'e'));
1085 
1086                 } else if (e.cte_format == CTF_FP_LDOUBLE &&
1087                     e.cte_bits == sizeof (long double) * NBBY) {
1088                         if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as, &u.ld,
1089                             sizeof (u.ld), addr) != sizeof (u.ld)) {
1090                                 mdb_warn("failed to read float at %llx", addr);
1091                                 return (1);
1092                         }
1093                         mdb_printf("%s", longdoubletos(&u.ld, 16, 'e'));
1094 
1095                 } else {
1096                         mdb_printf("??? (unsupported FP format %u / %u bits\n",
1097                             e.cte_format, e.cte_bits);
1098                 }
1099         } else
1100                 mdb_printf("??? (%s)", mdb_strerror(errno));
1101 #else
1102         mdb_printf("<FLOAT>");
1103 #endif
1104         return (0);
1105 }
1106 
1107 
1108 /*
1109  * Print out a pointer value as a symbol name + offset or a hexadecimal value.
1110  * If the pointer itself is a char *, we attempt to read a bit of the data
1111  * referenced by the pointer and display it if it is a printable ASCII string.
1112  */
1113 /*ARGSUSED*/
1114 static int
1115 print_ptr(const char *type, const char *name, mdb_ctf_id_t id,
1116     mdb_ctf_id_t base, ulong_t off, printarg_t *pap)
1117 {
1118         mdb_tgt_addr_t addr = pap->pa_addr + off / NBBY;
1119         ctf_encoding_t e;
1120         uintptr_t value;
1121         char buf[256];
1122         ssize_t len;
1123 
1124         if (!(pap->pa_flags & PA_SHOWVAL))
1125                 return (0);
1126 
1127         if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as,
1128             &value, sizeof (value), addr) != sizeof (value)) {
1129                 mdb_warn("failed to read %s pointer at %llx", name, addr);
1130                 return (1);
1131         }
1132 
1133         if (pap->pa_flags & PA_NOSYMBOLIC) {
1134                 mdb_printf("%#lx", value);
1135                 return (0);
1136         }
1137 
1138         mdb_printf("%a", value);
1139 
1140         if (value == NULL || strcmp(type, "caddr_t") == 0)
1141                 return (0);
1142 
1143         if (mdb_ctf_type_kind(base) == CTF_K_POINTER &&
1144             mdb_ctf_type_reference(base, &base) != -1 &&
1145             mdb_ctf_type_resolve(base, &base) != -1 &&
1146             mdb_ctf_type_encoding(base, &e) == 0 && IS_CHAR(e)) {
1147                 if ((len = mdb_tgt_readstr(pap->pa_realtgt, pap->pa_as,
1148                     buf, sizeof (buf), value)) >= 0 && strisprint(buf)) {
1149                         if (len == sizeof (buf))
1150                                 (void) strabbr(buf, sizeof (buf));
1151                         mdb_printf(" \"%s\"", buf);
1152                 }
1153         }
1154 
1155         return (0);
1156 }
1157 
1158 
1159 /*
1160  * Print out a fixed-size array.  We special-case arrays of characters
1161  * and attempt to print them out as ASCII strings if possible.  For other
1162  * arrays, we iterate over a maximum of pa_armemlim members and call
1163  * mdb_ctf_type_visit() again on each element to print its value.
1164  */
1165 /*ARGSUSED*/
1166 static int
1167 print_array(const char *type, const char *name, mdb_ctf_id_t id,
1168     mdb_ctf_id_t base, ulong_t off, printarg_t *pap)
1169 {
1170         mdb_tgt_addr_t addr = pap->pa_addr + off / NBBY;
1171         printarg_t pa = *pap;
1172         ssize_t eltsize;
1173         mdb_ctf_arinfo_t r;
1174         ctf_encoding_t e;
1175         uint_t i, kind, limit;
1176         int d, sou;
1177         char buf[8];
1178         char *str;
1179 
1180         if (!(pap->pa_flags & PA_SHOWVAL))
1181                 return (0);
1182 
1183         if (pap->pa_depth == pap->pa_maxdepth) {
1184                 mdb_printf("[ ... ]");
1185                 return (0);
1186         }
1187 
1188         /*
1189          * Determine the base type and size of the array's content.  If this
1190          * fails, we cannot print anything and just give up.
1191          */
1192         if (mdb_ctf_array_info(base, &r) == -1 ||
1193             mdb_ctf_type_resolve(r.mta_contents, &base) == -1 ||
1194             (eltsize = mdb_ctf_type_size(base)) == -1) {
1195                 mdb_printf("[ ??? ] (%s)", mdb_strerror(errno));
1196                 return (0);
1197         }
1198 
1199         /*
1200          * Read a few bytes and determine if the content appears to be
1201          * printable ASCII characters.  If so, read the entire array and
1202          * attempt to display it as a string if it is printable.
1203          */
1204         if ((pap->pa_arstrlim == MDB_ARR_NOLIMIT ||
1205             r.mta_nelems <= pap->pa_arstrlim) &&
1206             mdb_ctf_type_encoding(base, &e) == 0 && IS_CHAR(e) &&
1207             mdb_tgt_readstr(pap->pa_tgt, pap->pa_as, buf,
1208             MIN(sizeof (buf), r.mta_nelems), addr) > 0 && strisprint(buf)) {
1209 
1210                 str = mdb_alloc(r.mta_nelems + 1, UM_SLEEP | UM_GC);
1211                 str[r.mta_nelems] = '\0';
1212 
1213                 if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as, str,
1214                     r.mta_nelems, addr) != r.mta_nelems) {
1215                         mdb_warn("failed to read char array at %llx", addr);
1216                         return (1);
1217                 }
1218 
1219                 if (strisprint(str)) {
1220                         mdb_printf("[ \"%s\" ]", str);
1221                         return (0);
1222                 }
1223         }
1224 
1225         if (pap->pa_armemlim != MDB_ARR_NOLIMIT)
1226                 limit = MIN(r.mta_nelems, pap->pa_armemlim);
1227         else
1228                 limit = r.mta_nelems;
1229 
1230         if (limit == 0) {
1231                 mdb_printf("[ ... ]");
1232                 return (0);
1233         }
1234 
1235         kind = mdb_ctf_type_kind(base);
1236         sou = IS_COMPOSITE(kind);
1237 
1238         pa.pa_addr = addr;              /* set base address to start of array */
1239         pa.pa_maxdepth = pa.pa_maxdepth - pa.pa_depth - 1;
1240         pa.pa_nest += pa.pa_depth + 1;  /* nesting level is current depth + 1 */
1241         pa.pa_depth = 0;                /* reset depth to 0 for new scope */
1242         pa.pa_prefix = NULL;
1243 
1244         if (sou) {
1245                 pa.pa_delim = "\n";
1246                 mdb_printf("[\n");
1247         } else {
1248                 pa.pa_flags &= ~(PA_SHOWTYPE | PA_SHOWNAME | PA_SHOWADDR);
1249                 pa.pa_delim = ", ";
1250                 mdb_printf("[ ");
1251         }
1252 
1253         for (i = 0; i < limit; i++, pa.pa_addr += eltsize) {
1254                 if (i == limit - 1 && !sou) {
1255                         if (limit < r.mta_nelems)
1256                                 pa.pa_delim = ", ... ]";
1257                         else
1258                                 pa.pa_delim = " ]";
1259                 }
1260 
1261                 if (mdb_ctf_type_visit(r.mta_contents, elt_print, &pa) == -1) {
1262                         mdb_warn("failed to print array data");
1263                         return (1);
1264                 }
1265         }
1266 
1267         if (sou) {
1268                 for (d = pa.pa_depth - 1; d >= 0; d--)
1269                         print_close_sou(&pa, d);
1270 
1271                 if (limit < r.mta_nelems) {
1272                         mdb_printf("%*s... ]",
1273                             (pap->pa_depth + pap->pa_nest) * pap->pa_tab, "");
1274                 } else {
1275                         mdb_printf("%*s]",
1276                             (pap->pa_depth + pap->pa_nest) * pap->pa_tab, "");
1277                 }
1278         }
1279 
1280         /* copy the hole array info, since it may have been grown */
1281         pap->pa_holes = pa.pa_holes;
1282         pap->pa_nholes = pa.pa_nholes;
1283 
1284         return (0);
1285 }
1286 
1287 /*
1288  * Print out a struct or union header.  We need only print the open brace
1289  * because mdb_ctf_type_visit() itself will automatically recurse through
1290  * all members of the given struct or union.
1291  */
1292 /*ARGSUSED*/
1293 static int
1294 print_sou(const char *type, const char *name, mdb_ctf_id_t id,
1295     mdb_ctf_id_t base, ulong_t off, printarg_t *pap)
1296 {
1297         if (pap->pa_depth == pap->pa_maxdepth)
1298                 mdb_printf("{ ... }");
1299         else
1300                 mdb_printf("{");
1301         pap->pa_delim = "\n";
1302         return (0);
1303 }
1304 
1305 /*
1306  * Print an enum value.  We attempt to convert the value to the corresponding
1307  * enum name and print that if possible.
1308  */
1309 /*ARGSUSED*/
1310 static int
1311 print_enum(const char *type, const char *name, mdb_ctf_id_t id,
1312     mdb_ctf_id_t base, ulong_t off, printarg_t *pap)
1313 {
1314         mdb_tgt_addr_t addr = pap->pa_addr + off / NBBY;
1315         const char *ename;
1316         int value;
1317         int isp2 = enum_is_p2(base);
1318         int flags = pap->pa_flags | (isp2 ? PA_INTHEX : 0);
1319 
1320         if (!(flags & PA_SHOWVAL))
1321                 return (0);
1322 
1323         if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as,
1324             &value, sizeof (value), addr) != sizeof (value)) {
1325                 mdb_warn("failed to read %s integer at %llx", name, addr);
1326                 return (1);
1327         }
1328 
1329         if (flags & PA_INTHEX)
1330                 mdb_printf("%#x", value);
1331         else
1332                 mdb_printf("%#d", value);
1333 
1334         (void) mdb_inc_indent(8);
1335         mdb_printf(" (");
1336 
1337         if (!isp2 || enum_value_print_p2(base, value, 0) != 0) {
1338                 ename = mdb_ctf_enum_name(base, value);
1339                 if (ename == NULL) {
1340                         ename = "???";
1341                 }
1342                 mdb_printf("%s", ename);
1343         }
1344         mdb_printf(")");
1345         (void) mdb_dec_indent(8);
1346 
1347         return (0);
1348 }
1349 
1350 /*
1351  * This will only get called if the structure isn't found in any available CTF
1352  * data.
1353  */
1354 /*ARGSUSED*/
1355 static int
1356 print_tag(const char *type, const char *name, mdb_ctf_id_t id,
1357     mdb_ctf_id_t base, ulong_t off, printarg_t *pap)
1358 {
1359         char basename[MDB_SYM_NAMLEN];
1360 
1361         if (pap->pa_flags & PA_SHOWVAL)
1362                 mdb_printf("; ");
1363 
1364         if (mdb_ctf_type_name(base, basename, sizeof (basename)) != NULL)
1365                 mdb_printf("<forward declaration of %s>", basename);
1366         else
1367                 mdb_printf("<forward declaration of unknown type>");
1368 
1369         return (0);
1370 }
1371 
1372 static void
1373 print_hole(printarg_t *pap, int depth, ulong_t off, ulong_t endoff)
1374 {
1375         ulong_t bits = endoff - off;
1376         ulong_t size = bits / NBBY;
1377         ctf_encoding_t e;
1378 
1379         static const char *const name = "<<HOLE>>";
1380         char type[MDB_SYM_NAMLEN];
1381 
1382         int bitfield =
1383             (off % NBBY != 0 ||
1384             bits % NBBY != 0 ||
1385             size > 8 ||
1386             (size & (size - 1)) != 0);
1387 
1388         ASSERT(off < endoff);
1389 
1390         if (bits > NBBY * sizeof (uint64_t)) {
1391                 ulong_t end;
1392 
1393                 /*
1394                  * The hole is larger than the largest integer type.  To
1395                  * handle this, we split up the hole at 8-byte-aligned
1396                  * boundaries, recursing to print each subsection.  For
1397                  * normal C structures, we'll loop at most twice.
1398                  */
1399                 for (; off < endoff; off = end) {
1400                         end = P2END(off, NBBY * sizeof (uint64_t));
1401                         if (end > endoff)
1402                                 end = endoff;
1403 
1404                         ASSERT((end - off) <= NBBY * sizeof (uint64_t));
1405                         print_hole(pap, depth, off, end);
1406                 }
1407                 ASSERT(end == endoff);
1408 
1409                 return;
1410         }
1411 
1412         if (bitfield)
1413                 (void) mdb_snprintf(type, sizeof (type), "unsigned");
1414         else
1415                 (void) mdb_snprintf(type, sizeof (type), "uint%d_t", bits);
1416 
1417         if (pap->pa_flags & (PA_SHOWTYPE | PA_SHOWNAME | PA_SHOWADDR))
1418                 mdb_printf("%*s", (depth + pap->pa_nest) * pap->pa_tab, "");
1419 
1420         if (pap->pa_flags & PA_SHOWADDR) {
1421                 if (off % NBBY == 0)
1422                         mdb_printf("%llx ", pap->pa_addr + off / NBBY);
1423                 else
1424                         mdb_printf("%llx.%lx ",
1425                             pap->pa_addr + off / NBBY, off % NBBY);
1426         }
1427 
1428         if (pap->pa_flags & PA_SHOWTYPE)
1429                 mdb_printf("%s ", type);
1430 
1431         if (pap->pa_flags & PA_SHOWNAME)
1432                 mdb_printf("%s", name);
1433 
1434         if (bitfield && (pap->pa_flags & PA_SHOWTYPE))
1435                 mdb_printf(" :%d", bits);
1436 
1437         mdb_printf("%s ", (pap->pa_flags & PA_SHOWVAL)? " =" : "");
1438 
1439         /*
1440          * We fake up a ctf_encoding_t, and use print_int_val() to print
1441          * the value.  Holes are always processed as unsigned integers.
1442          */
1443         bzero(&e, sizeof (e));
1444         e.cte_format = 0;
1445         e.cte_offset = 0;
1446         e.cte_bits = bits;
1447 
1448         if (print_int_val(type, &e, off, pap) != 0)
1449                 mdb_iob_discard(mdb.m_out);
1450         else
1451                 mdb_iob_puts(mdb.m_out, pap->pa_delim);
1452 }
1453 
1454 /*
1455  * The print_close_sou() function is called for each structure or union
1456  * which has been completed.  For structures, we detect and print any holes
1457  * before printing the closing brace.
1458  */
1459 static void
1460 print_close_sou(printarg_t *pap, int newdepth)
1461 {
1462         int d = newdepth + pap->pa_nest;
1463 
1464         if ((pap->pa_flags & PA_SHOWHOLES) && !pap->pa_holes[d].hi_isunion) {
1465                 ulong_t end = pap->pa_holes[d + 1].hi_offset;
1466                 ulong_t expected = pap->pa_holes[d].hi_offset;
1467 
1468                 if (end < expected)
1469                         print_hole(pap, newdepth + 1, end, expected);
1470         }
1471         /* if the struct is an array element, print a comma after the } */
1472         mdb_printf("%*s}%s\n", d * pap->pa_tab, "",
1473             (newdepth == 0 && pap->pa_nest > 0)? "," : "");
1474 }
1475 
1476 static printarg_f *const printfuncs[] = {
1477         print_int,      /* CTF_K_INTEGER */
1478         print_float,    /* CTF_K_FLOAT */
1479         print_ptr,      /* CTF_K_POINTER */
1480         print_array,    /* CTF_K_ARRAY */
1481         print_ptr,      /* CTF_K_FUNCTION */
1482         print_sou,      /* CTF_K_STRUCT */
1483         print_sou,      /* CTF_K_UNION */
1484         print_enum,     /* CTF_K_ENUM */
1485         print_tag       /* CTF_K_FORWARD */
1486 };
1487 
1488 /*
1489  * The elt_print function is used as the mdb_ctf_type_visit callback.  For
1490  * each element, we print an appropriate name prefix and then call the
1491  * print subroutine for this type class in the array above.
1492  */
1493 static int
1494 elt_print(const char *name, mdb_ctf_id_t id, mdb_ctf_id_t base,
1495     ulong_t off, int depth, void *data)
1496 {
1497         char type[MDB_SYM_NAMLEN + sizeof (" <<12345678...>>")];
1498         int kind, rc, d;
1499         printarg_t *pap = data;
1500 
1501         for (d = pap->pa_depth - 1; d >= depth; d--)
1502                 print_close_sou(pap, d);
1503 
1504         if (depth > pap->pa_maxdepth)
1505                 return (0);
1506 
1507         if (!mdb_ctf_type_valid(base) ||
1508             (kind = mdb_ctf_type_kind(base)) == -1)
1509                 return (-1); /* errno is set for us */
1510 
1511         if (mdb_ctf_type_name(id, type, MDB_SYM_NAMLEN) == NULL)
1512                 (void) strcpy(type, "(?)");
1513 
1514         if (pap->pa_flags & PA_SHOWBASETYPE) {
1515                 /*
1516                  * If basetype is different and informative, concatenate
1517                  * <<basetype>> (or <<baset...>> if it doesn't fit)
1518                  *
1519                  * We just use the end of the buffer to store the type name, and
1520                  * only connect it up if that's necessary.
1521                  */
1522 
1523                 char *type_end = type + strlen(type);
1524                 char *basetype;
1525                 size_t sz;
1526 
1527                 (void) strlcat(type, " <<", sizeof (type));
1528 
1529                 basetype = type + strlen(type);
1530                 sz = sizeof (type) - (basetype - type);
1531 
1532                 *type_end = '\0'; /* restore the end of type for strcmp() */
1533 
1534                 if (mdb_ctf_type_name(base, basetype, sz) != NULL &&
1535                     strcmp(basetype, type) != 0 &&
1536                     strcmp(basetype, "struct ") != 0 &&
1537                     strcmp(basetype, "enum ") != 0 &&
1538                     strcmp(basetype, "union ") != 0) {
1539                         type_end[0] = ' ';      /* reconnect */
1540                         if (strlcat(type, ">>", sizeof (type)) >= sizeof (type))
1541                                 (void) strlcpy(
1542                                     type + sizeof (type) - 6, "...>>", 6);
1543                 }
1544         }
1545 
1546         if (pap->pa_flags & PA_SHOWHOLES) {
1547                 ctf_encoding_t e;
1548                 ssize_t nsize;
1549                 ulong_t newoff;
1550                 holeinfo_t *hole;
1551                 int extra = IS_COMPOSITE(kind)? 1 : 0;
1552 
1553                 /*
1554                  * grow the hole array, if necessary
1555                  */
1556                 if (pap->pa_nest + depth + extra >= pap->pa_nholes) {
1557                         int new = MAX(MAX(8, pap->pa_nholes * 2),
1558                             pap->pa_nest + depth + extra + 1);
1559 
1560                         holeinfo_t *nhi = mdb_zalloc(
1561                             sizeof (*nhi) * new, UM_NOSLEEP | UM_GC);
1562 
1563                         bcopy(pap->pa_holes, nhi,
1564                             pap->pa_nholes * sizeof (*nhi));
1565 
1566                         pap->pa_holes = nhi;
1567                         pap->pa_nholes = new;
1568                 }
1569 
1570                 hole = &pap->pa_holes[depth + pap->pa_nest];
1571 
1572                 if (depth != 0 && off > hole->hi_offset)
1573                         print_hole(pap, depth, hole->hi_offset, off);
1574 
1575                 /* compute the next expected offset */
1576                 if (kind == CTF_K_INTEGER &&
1577                     mdb_ctf_type_encoding(base, &e) == 0)
1578                         newoff = off + e.cte_bits;
1579                 else if ((nsize = mdb_ctf_type_size(base)) >= 0)
1580                         newoff = off + nsize * NBBY;
1581                 else {
1582                         /* something bad happened, disable hole checking */
1583                         newoff = -1UL;          /* ULONG_MAX */
1584                 }
1585 
1586                 hole->hi_offset = newoff;
1587 
1588                 if (IS_COMPOSITE(kind)) {
1589                         hole->hi_isunion = (kind == CTF_K_UNION);
1590                         hole++;
1591                         hole->hi_offset = off;
1592                 }
1593         }
1594 
1595         if (pap->pa_flags & (PA_SHOWTYPE | PA_SHOWNAME | PA_SHOWADDR))
1596                 mdb_printf("%*s", (depth + pap->pa_nest) * pap->pa_tab, "");
1597 
1598         if (pap->pa_flags & PA_SHOWADDR) {
1599                 if (off % NBBY == 0)
1600                         mdb_printf("%llx ", pap->pa_addr + off / NBBY);
1601                 else
1602                         mdb_printf("%llx.%lx ",
1603                             pap->pa_addr + off / NBBY, off % NBBY);
1604         }
1605 
1606         if ((pap->pa_flags & PA_SHOWTYPE)) {
1607                 mdb_printf("%s", type);
1608                 /*
1609                  * We want to avoid printing a trailing space when
1610                  * dealing with pointers in a structure, so we end
1611                  * up with:
1612                  *
1613                  *      label_t *t_onfault = 0
1614                  *
1615                  * If depth is zero, always print the trailing space unless
1616                  * we also have a prefix.
1617                  */
1618                 if (type[strlen(type) - 1] != '*' ||
1619                     (depth == 0 && (!(pap->pa_flags & PA_SHOWNAME) ||
1620                     pap->pa_prefix == NULL)))
1621                         mdb_printf(" ");
1622         }
1623 
1624         if (pap->pa_flags & PA_SHOWNAME) {
1625                 if (pap->pa_prefix != NULL && depth <= 1)
1626                         mdb_printf("%s%s", pap->pa_prefix,
1627                             (depth == 0) ? "" : pap->pa_suffix);
1628                 mdb_printf("%s", name);
1629         }
1630 
1631         if ((pap->pa_flags & PA_SHOWTYPE) && kind == CTF_K_INTEGER) {
1632                 ctf_encoding_t e;
1633 
1634                 if (mdb_ctf_type_encoding(base, &e) == 0) {
1635                         ulong_t bits = e.cte_bits;
1636                         ulong_t size = bits / NBBY;
1637 
1638                         if (bits % NBBY != 0 ||
1639                             off % NBBY != 0 ||
1640                             size > 8 ||
1641                             size != mdb_ctf_type_size(base))
1642                                 mdb_printf(" :%d", bits);
1643                 }
1644         }
1645 
1646         if (depth != 0 ||
1647             ((pap->pa_flags & PA_SHOWNAME) && pap->pa_prefix != NULL))
1648                 mdb_printf("%s ", pap->pa_flags & PA_SHOWVAL ? " =" : "");
1649 
1650         if (depth == 0 && pap->pa_prefix != NULL)
1651                 name = pap->pa_prefix;
1652 
1653         pap->pa_depth = depth;
1654         if (kind <= CTF_K_UNKNOWN || kind >= CTF_K_TYPEDEF) {
1655                 mdb_warn("unknown ctf for %s type %s kind %d\n",
1656                     name, type, kind);
1657                 return (-1);
1658         }
1659         rc = printfuncs[kind - 1](type, name, id, base, off, pap);
1660 
1661         if (rc != 0)
1662                 mdb_iob_discard(mdb.m_out);
1663         else
1664                 mdb_iob_puts(mdb.m_out, pap->pa_delim);
1665 
1666         return (rc);
1667 }
1668 
1669 /*
1670  * Special semantics for pipelines.
1671  */
1672 static int
1673 pipe_print(mdb_ctf_id_t id, ulong_t off, void *data)
1674 {
1675         printarg_t *pap = data;
1676         ssize_t size;
1677         static const char *const fsp[] = { "%#r", "%#r", "%#r", "%#llr" };
1678         uintptr_t value;
1679         uintptr_t addr = pap->pa_addr + off / NBBY;
1680         mdb_ctf_id_t base;
1681         ctf_encoding_t e;
1682 
1683         union {
1684                 uint64_t i8;
1685                 uint32_t i4;
1686                 uint16_t i2;
1687                 uint8_t i1;
1688         } u;
1689 
1690         if (mdb_ctf_type_resolve(id, &base) == -1) {
1691                 mdb_warn("could not resolve type");
1692                 return (-1);
1693         }
1694 
1695         /*
1696          * If the user gives -a, then always print out the address of the
1697          * member.
1698          */
1699         if ((pap->pa_flags & PA_SHOWADDR)) {
1700                 mdb_printf("%#lr\n", addr);
1701                 return (0);
1702         }
1703 
1704 again:
1705         switch (mdb_ctf_type_kind(base)) {
1706         case CTF_K_POINTER:
1707                 if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as,
1708                     &value, sizeof (value), addr) != sizeof (value)) {
1709                         mdb_warn("failed to read pointer at %p", addr);
1710                         return (-1);
1711                 }
1712                 mdb_printf("%#lr\n", value);
1713                 break;
1714 
1715         case CTF_K_INTEGER:
1716         case CTF_K_ENUM:
1717                 if (mdb_ctf_type_encoding(base, &e) != 0) {
1718                         mdb_printf("could not get type encoding\n");
1719                         return (-1);
1720                 }
1721 
1722                 /*
1723                  * For immediate values, we just print out the value.
1724                  */
1725                 size = e.cte_bits / NBBY;
1726                 if (size > 8 || (e.cte_bits % NBBY) != 0 ||
1727                     (size & (size - 1)) != 0) {
1728                         return (print_bitfield(off, pap, &e));
1729                 }
1730 
1731                 if (mdb_tgt_aread(pap->pa_tgt, pap->pa_as, &u.i8, size,
1732                     addr) != size) {
1733                         mdb_warn("failed to read %lu bytes at %p",
1734                             (ulong_t)size, pap->pa_addr);
1735                         return (-1);
1736                 }
1737 
1738                 switch (size) {
1739                 case sizeof (uint8_t):
1740                         mdb_printf(fsp[0], u.i1);
1741                         break;
1742                 case sizeof (uint16_t):
1743                         mdb_printf(fsp[1], u.i2);
1744                         break;
1745                 case sizeof (uint32_t):
1746                         mdb_printf(fsp[2], u.i4);
1747                         break;
1748                 case sizeof (uint64_t):
1749                         mdb_printf(fsp[3], u.i8);
1750                         break;
1751                 }
1752                 mdb_printf("\n");
1753                 break;
1754 
1755         case CTF_K_FUNCTION:
1756         case CTF_K_FLOAT:
1757         case CTF_K_ARRAY:
1758         case CTF_K_UNKNOWN:
1759         case CTF_K_STRUCT:
1760         case CTF_K_UNION:
1761         case CTF_K_FORWARD:
1762                 /*
1763                  * For these types, always print the address of the member
1764                  */
1765                 mdb_printf("%#lr\n", addr);
1766                 break;
1767 
1768         default:
1769                 mdb_warn("unknown type %d", mdb_ctf_type_kind(base));
1770                 break;
1771         }
1772 
1773         return (0);
1774 }
1775 
1776 static int
1777 parse_delimiter(char **strp)
1778 {
1779         switch (**strp) {
1780         case '\0':
1781                 return (MEMBER_DELIM_DONE);
1782 
1783         case '.':
1784                 *strp = *strp + 1;
1785                 return (MEMBER_DELIM_DOT);
1786 
1787         case '[':
1788                 *strp = *strp + 1;
1789                 return (MEMBER_DELIM_LBR);
1790 
1791         case '-':
1792                 *strp = *strp + 1;
1793                 if (**strp == '>') {
1794                         *strp = *strp + 1;
1795                         return (MEMBER_DELIM_PTR);
1796                 }
1797                 *strp = *strp - 1;
1798                 /*FALLTHROUGH*/
1799         default:
1800                 return (MEMBER_DELIM_ERR);
1801         }
1802 }
1803 
1804 static int
1805 deref(printarg_t *pap, size_t size)
1806 {
1807         uint32_t a32;
1808         mdb_tgt_as_t as = pap->pa_as;
1809         mdb_tgt_addr_t *ap = &pap->pa_addr;
1810 
1811         if (size == sizeof (mdb_tgt_addr_t)) {
1812                 if (mdb_tgt_aread(mdb.m_target, as, ap, size, *ap) == -1) {
1813                         mdb_warn("could not dereference pointer %llx\n", *ap);
1814                         return (-1);
1815                 }
1816         } else {
1817                 if (mdb_tgt_aread(mdb.m_target, as, &a32, size, *ap) == -1) {
1818                         mdb_warn("could not dereference pointer %x\n", *ap);
1819                         return (-1);
1820                 }
1821 
1822                 *ap = (mdb_tgt_addr_t)a32;
1823         }
1824 
1825         /*
1826          * We've dereferenced at least once, we must be on the real
1827          * target. If we were in the immediate target, reset to the real
1828          * target; it's reset as needed when we return to the print
1829          * routines.
1830          */
1831         if (pap->pa_tgt == pap->pa_immtgt)
1832                 pap->pa_tgt = pap->pa_realtgt;
1833 
1834         return (0);
1835 }
1836 
1837 static int
1838 parse_member(printarg_t *pap, const char *str, mdb_ctf_id_t id,
1839     mdb_ctf_id_t *idp, ulong_t *offp, int *last_deref)
1840 {
1841         int delim;
1842         char member[64];
1843         char buf[128];
1844         uint_t index;
1845         char *start = (char *)str;
1846         char *end;
1847         ulong_t off = 0;
1848         mdb_ctf_arinfo_t ar;
1849         mdb_ctf_id_t rid;
1850         int kind;
1851         ssize_t size;
1852         int non_array = FALSE;
1853 
1854         /*
1855          * id always has the unresolved type for printing error messages
1856          * that include the type; rid always has the resolved type for
1857          * use in mdb_ctf_* calls.  It is possible for this command to fail,
1858          * however, if the resolved type is in the parent and it is currently
1859          * unavailable.  Note that we also can't print out the name of the
1860          * type, since that would also rely on looking up the resolved name.
1861          */
1862         if (mdb_ctf_type_resolve(id, &rid) != 0) {
1863                 mdb_warn("failed to resolve type");
1864                 return (-1);
1865         }
1866 
1867         delim = parse_delimiter(&start);
1868         /*
1869          * If the user fails to specify an initial delimiter, guess -> for
1870          * pointer types and . for non-pointer types.
1871          */
1872         if (delim == MEMBER_DELIM_ERR)
1873                 delim = (mdb_ctf_type_kind(rid) == CTF_K_POINTER) ?
1874                     MEMBER_DELIM_PTR : MEMBER_DELIM_DOT;
1875 
1876         *last_deref = FALSE;
1877 
1878         while (delim != MEMBER_DELIM_DONE) {
1879                 switch (delim) {
1880                 case MEMBER_DELIM_PTR:
1881                         kind = mdb_ctf_type_kind(rid);
1882                         if (kind != CTF_K_POINTER) {
1883                                 mdb_warn("%s is not a pointer type\n",
1884                                     mdb_ctf_type_name(id, buf, sizeof (buf)));
1885                                 return (-1);
1886                         }
1887 
1888                         size = mdb_ctf_type_size(id);
1889                         if (deref(pap, size) != 0)
1890                                 return (-1);
1891 
1892                         (void) mdb_ctf_type_reference(rid, &id);
1893                         (void) mdb_ctf_type_resolve(id, &rid);
1894 
1895                         off = 0;
1896                         break;
1897 
1898                 case MEMBER_DELIM_DOT:
1899                         kind = mdb_ctf_type_kind(rid);
1900                         if (kind != CTF_K_STRUCT && kind != CTF_K_UNION) {
1901                                 mdb_warn("%s is not a struct or union type\n",
1902                                     mdb_ctf_type_name(id, buf, sizeof (buf)));
1903                                 return (-1);
1904                         }
1905                         break;
1906 
1907                 case MEMBER_DELIM_LBR:
1908                         end = strchr(start, ']');
1909                         if (end == NULL) {
1910                                 mdb_warn("no trailing ']'\n");
1911                                 return (-1);
1912                         }
1913 
1914                         (void) mdb_snprintf(member, end - start + 1, "%s",
1915                             start);
1916 
1917                         index = mdb_strtoull(member);
1918 
1919                         switch (mdb_ctf_type_kind(rid)) {
1920                         case CTF_K_POINTER:
1921                                 size = mdb_ctf_type_size(rid);
1922 
1923                                 if (deref(pap, size) != 0)
1924                                         return (-1);
1925 
1926                                 (void) mdb_ctf_type_reference(rid, &id);
1927                                 (void) mdb_ctf_type_resolve(id, &rid);
1928 
1929                                 size = mdb_ctf_type_size(id);
1930                                 if (size <= 0) {
1931                                         mdb_warn("cannot dereference void "
1932                                             "type\n");
1933                                         return (-1);
1934                                 }
1935 
1936                                 pap->pa_addr += index * size;
1937                                 off = 0;
1938 
1939                                 if (index == 0 && non_array)
1940                                         *last_deref = TRUE;
1941                                 break;
1942 
1943                         case CTF_K_ARRAY:
1944                                 (void) mdb_ctf_array_info(rid, &ar);
1945 
1946                                 if (index >= ar.mta_nelems) {
1947                                         mdb_warn("index %r is outside of "
1948                                             "array bounds [0 .. %r]\n",
1949                                             index, ar.mta_nelems - 1);
1950                                 }
1951 
1952                                 id = ar.mta_contents;
1953                                 (void) mdb_ctf_type_resolve(id, &rid);
1954 
1955                                 size = mdb_ctf_type_size(id);
1956                                 if (size <= 0) {
1957                                         mdb_warn("cannot dereference void "
1958                                             "type\n");
1959                                         return (-1);
1960                                 }
1961 
1962                                 pap->pa_addr += index * size;
1963                                 off = 0;
1964                                 break;
1965 
1966                         default:
1967                                 mdb_warn("cannot index into non-array, "
1968                                     "non-pointer type\n");
1969                                 return (-1);
1970                         }
1971 
1972                         start = end + 1;
1973                         delim = parse_delimiter(&start);
1974                         continue;
1975 
1976                 case MEMBER_DELIM_ERR:
1977                 default:
1978                         mdb_warn("'%c' is not a valid delimiter\n", *start);
1979                         return (-1);
1980                 }
1981 
1982                 *last_deref = FALSE;
1983                 non_array = TRUE;
1984 
1985                 /*
1986                  * Find the end of the member name; assume that a member
1987                  * name is at least one character long.
1988                  */
1989                 for (end = start + 1; isalnum(*end) || *end == '_'; end++)
1990                         continue;
1991 
1992                 (void) mdb_snprintf(member, end - start + 1, "%s", start);
1993 
1994                 if (mdb_ctf_member_info(rid, member, &off, &id) != 0) {
1995                         mdb_warn("failed to find member %s of %s", member,
1996                             mdb_ctf_type_name(id, buf, sizeof (buf)));
1997                         return (-1);
1998                 }
1999                 (void) mdb_ctf_type_resolve(id, &rid);
2000 
2001                 pap->pa_addr += off / NBBY;
2002 
2003                 start = end;
2004                 delim = parse_delimiter(&start);
2005         }
2006 
2007         *idp = id;
2008         *offp = off;
2009 
2010         return (0);
2011 }
2012 
2013 int
2014 cmd_print_tab(mdb_tab_cookie_t *mcp, uint_t flags, int argc,
2015     const mdb_arg_t *argv)
2016 {
2017         char tn[MDB_SYM_NAMLEN];
2018         char member[64];
2019         int i, dummy, delim, kind;
2020         int ret = 0;
2021         mdb_ctf_id_t id, rid;
2022         mdb_ctf_arinfo_t ar;
2023         char *start, *end;
2024         ulong_t dul;
2025 
2026         /*
2027          * This getopts is only here to make the tab completion work better when
2028          * including options in the ::print arguments. None of the values should
2029          * be used. This should only be updated with additional arguments, if
2030          * they are added to cmd_print.
2031          */
2032         i = mdb_getopts(argc, argv,
2033             'a', MDB_OPT_SETBITS, PA_SHOWADDR, &dummy,
2034             'C', MDB_OPT_SETBITS, TRUE, &dummy,
2035             'c', MDB_OPT_UINTPTR, &dummy,
2036             'd', MDB_OPT_SETBITS, PA_INTDEC, &dummy,
2037             'h', MDB_OPT_SETBITS, PA_SHOWHOLES, &dummy,
2038             'i', MDB_OPT_SETBITS, TRUE, &dummy,
2039             'L', MDB_OPT_SETBITS, TRUE, &dummy,
2040             'l', MDB_OPT_UINTPTR, &dummy,
2041             'n', MDB_OPT_SETBITS, PA_NOSYMBOLIC, &dummy,
2042             'p', MDB_OPT_SETBITS, TRUE, &dummy,
2043             's', MDB_OPT_UINTPTR, &dummy,
2044             'T', MDB_OPT_SETBITS, PA_SHOWTYPE | PA_SHOWBASETYPE, &dummy,
2045             't', MDB_OPT_SETBITS, PA_SHOWTYPE, &dummy,
2046             'x', MDB_OPT_SETBITS, PA_INTHEX, &dummy,
2047             NULL);
2048 
2049         argc -= i;
2050         argv += i;
2051 
2052         if (argc == 0 && !(flags & DCMD_TAB_SPACE))
2053                 return (0);
2054 
2055         if (argc == 0 && (flags & DCMD_TAB_SPACE))
2056                 return (mdb_tab_complete_type(mcp, NULL, MDB_TABC_NOPOINT |
2057                     MDB_TABC_NOARRAY));
2058 
2059         if ((ret = mdb_tab_typename(&argc, &argv, tn, sizeof (tn))) < 0)
2060                 return (ret);
2061 
2062         if (argc == 1 && (!(flags & DCMD_TAB_SPACE) || ret == 1))
2063                 return (mdb_tab_complete_type(mcp, tn, MDB_TABC_NOPOINT |
2064                     MDB_TABC_NOARRAY));
2065 
2066         if (argc == 1 && (flags & DCMD_TAB_SPACE))
2067                 return (mdb_tab_complete_member(mcp, tn, NULL));
2068 
2069         /*
2070          * This is the reason that tab completion was created. We're going to go
2071          * along and walk the delimiters until we find something a member that
2072          * we don't recognize, at which point we'll try and tab complete it.
2073          * Note that ::print takes multiple args, so this is going to operate on
2074          * whatever the last arg that we have is.
2075          */
2076         if (mdb_ctf_lookup_by_name(tn, &id) != 0)
2077                 return (1);
2078 
2079         (void) mdb_ctf_type_resolve(id, &rid);
2080         start = (char *)argv[argc-1].a_un.a_str;
2081         delim = parse_delimiter(&start);
2082 
2083         /*
2084          * If we hit the case where we actually have no delimiters, than we need
2085          * to make sure that we properly set up the fields the loops would.
2086          */
2087         if (delim == MEMBER_DELIM_DONE)
2088                 (void) mdb_snprintf(member, sizeof (member), "%s", start);
2089 
2090         while (delim != MEMBER_DELIM_DONE) {
2091                 switch (delim) {
2092                 case MEMBER_DELIM_PTR:
2093                         kind = mdb_ctf_type_kind(rid);
2094                         if (kind != CTF_K_POINTER)
2095                                 return (1);
2096 
2097                         (void) mdb_ctf_type_reference(rid, &id);
2098                         (void) mdb_ctf_type_resolve(id, &rid);
2099                         break;
2100                 case MEMBER_DELIM_DOT:
2101                         kind = mdb_ctf_type_kind(rid);
2102                         if (kind != CTF_K_STRUCT && kind != CTF_K_UNION)
2103                                 return (1);
2104                         break;
2105                 case MEMBER_DELIM_LBR:
2106                         end = strchr(start, ']');
2107                         /*
2108                          * We're not going to try and tab complete the indexes
2109                          * here. So for now, punt on it. Also, we're not going
2110                          * to try and validate you're within the bounds, just
2111                          * that you get the type you asked for.
2112                          */
2113                         if (end == NULL)
2114                                 return (1);
2115 
2116                         switch (mdb_ctf_type_kind(rid)) {
2117                         case CTF_K_POINTER:
2118                                 (void) mdb_ctf_type_reference(rid, &id);
2119                                 (void) mdb_ctf_type_resolve(id, &rid);
2120                                 break;
2121                         case CTF_K_ARRAY:
2122                                 (void) mdb_ctf_array_info(rid, &ar);
2123                                 id = ar.mta_contents;
2124                                 (void) mdb_ctf_type_resolve(id, &rid);
2125                                 break;
2126                         default:
2127                                 return (1);
2128                         }
2129 
2130                         start = end + 1;
2131                         delim = parse_delimiter(&start);
2132                         break;
2133                 case MEMBER_DELIM_ERR:
2134                 default:
2135                         break;
2136                 }
2137 
2138                 for (end = start + 1; isalnum(*end) || *end == '_'; end++)
2139                         continue;
2140 
2141                 (void) mdb_snprintf(member, end - start + 1, start);
2142 
2143                 /*
2144                  * We are going to try to resolve this name as a member. There
2145                  * are a few two different questions that we need to answer. The
2146                  * first is do we recognize this member. The second is are we at
2147                  * the end of the string. If we encounter a member that we don't
2148                  * recognize before the end, then we have to error out and can't
2149                  * complete it. But if there are no more delimiters then we can
2150                  * try and complete it.
2151                  */
2152                 ret = mdb_ctf_member_info(rid, member, &dul, &id);
2153                 start = end;
2154                 delim = parse_delimiter(&start);
2155                 if (ret != 0 && errno == EMDB_CTFNOMEMB) {
2156                         if (delim != MEMBER_DELIM_DONE)
2157                                 return (1);
2158                         continue;
2159                 } else if (ret != 0)
2160                         return (1);
2161 
2162                 if (delim == MEMBER_DELIM_DONE)
2163                         return (mdb_tab_complete_member_by_id(mcp, rid,
2164                             member));
2165 
2166                 (void) mdb_ctf_type_resolve(id, &rid);
2167         }
2168 
2169         /*
2170          * If we've reached here, then we need to try and tab complete the last
2171          * field, which is currently member, based on the ctf type id that we
2172          * already have in rid.
2173          */
2174         return (mdb_tab_complete_member_by_id(mcp, rid, member));
2175 }
2176 
2177 /*
2178  * Recursively descend a print a given data structure.  We create a struct of
2179  * the relevant print arguments and then call mdb_ctf_type_visit() to do the
2180  * traversal, using elt_print() as the callback for each element.
2181  */
2182 /*ARGSUSED*/
2183 int
2184 cmd_print(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
2185 {
2186         uintptr_t opt_c = MDB_ARR_NOLIMIT, opt_l = MDB_ARR_NOLIMIT;
2187         uint_t opt_C = FALSE, opt_L = FALSE, opt_p = FALSE, opt_i = FALSE;
2188         uintptr_t opt_s = (uintptr_t)-1ul;
2189         int uflags = (flags & DCMD_ADDRSPEC) ? PA_SHOWVAL : 0;
2190         mdb_ctf_id_t id;
2191         int err = DCMD_OK;
2192 
2193         mdb_tgt_t *t = mdb.m_target;
2194         printarg_t pa;
2195         int d, i;
2196 
2197         char s_name[MDB_SYM_NAMLEN];
2198         mdb_syminfo_t s_info;
2199         GElf_Sym sym;
2200 
2201         /*
2202          * If a new option is added, make sure the getopts above in
2203          * cmd_print_tab is also updated.
2204          */
2205         i = mdb_getopts(argc, argv,
2206             'a', MDB_OPT_SETBITS, PA_SHOWADDR, &uflags,
2207             'C', MDB_OPT_SETBITS, TRUE, &opt_C,
2208             'c', MDB_OPT_UINTPTR, &opt_c,
2209             'd', MDB_OPT_SETBITS, PA_INTDEC, &uflags,
2210             'h', MDB_OPT_SETBITS, PA_SHOWHOLES, &uflags,
2211             'i', MDB_OPT_SETBITS, TRUE, &opt_i,
2212             'L', MDB_OPT_SETBITS, TRUE, &opt_L,
2213             'l', MDB_OPT_UINTPTR, &opt_l,
2214             'n', MDB_OPT_SETBITS, PA_NOSYMBOLIC, &uflags,
2215             'p', MDB_OPT_SETBITS, TRUE, &opt_p,
2216             's', MDB_OPT_UINTPTR, &opt_s,
2217             'T', MDB_OPT_SETBITS, PA_SHOWTYPE | PA_SHOWBASETYPE, &uflags,
2218             't', MDB_OPT_SETBITS, PA_SHOWTYPE, &uflags,
2219             'x', MDB_OPT_SETBITS, PA_INTHEX, &uflags,
2220             NULL);
2221 
2222         if (uflags & PA_INTHEX)
2223                 uflags &= ~PA_INTDEC;       /* -x and -d are mutually exclusive */
2224 
2225         uflags |= PA_SHOWNAME;
2226 
2227         if (opt_p && opt_i) {
2228                 mdb_warn("-p and -i options are incompatible\n");
2229                 return (DCMD_ERR);
2230         }
2231 
2232         argc -= i;
2233         argv += i;
2234 
2235         if (argc != 0 && argv->a_type == MDB_TYPE_STRING) {
2236                 const char *t_name = s_name;
2237                 int ret;
2238 
2239                 if (strchr("+-", argv->a_un.a_str[0]) != NULL)
2240                         return (DCMD_USAGE);
2241 
2242                 if ((ret = args_to_typename(&argc, &argv, s_name,
2243                     sizeof (s_name))) != 0)
2244                         return (ret);
2245 
2246                 if (mdb_ctf_lookup_by_name(t_name, &id) != 0) {
2247                         if (!(flags & DCMD_ADDRSPEC) || opt_i ||
2248                             addr_to_sym(t, addr, s_name, sizeof (s_name),
2249                             &sym, &s_info) == NULL ||
2250                             mdb_ctf_lookup_by_symbol(&sym, &s_info, &id) != 0) {
2251 
2252                                 mdb_warn("failed to look up type %s", t_name);
2253                                 return (DCMD_ABORT);
2254                         }
2255                 } else {
2256                         argc--;
2257                         argv++;
2258                 }
2259 
2260         } else if (!(flags & DCMD_ADDRSPEC) || opt_i) {
2261                 return (DCMD_USAGE);
2262 
2263         } else if (addr_to_sym(t, addr, s_name, sizeof (s_name),
2264             &sym, &s_info) == NULL) {
2265                 mdb_warn("no symbol information for %a", addr);
2266                 return (DCMD_ERR);
2267 
2268         } else if (mdb_ctf_lookup_by_symbol(&sym, &s_info, &id) != 0) {
2269                 mdb_warn("no type data available for %a [%u]", addr,
2270                     s_info.sym_id);
2271                 return (DCMD_ERR);
2272         }
2273 
2274         pa.pa_tgt = mdb.m_target;
2275         pa.pa_realtgt = pa.pa_tgt;
2276         pa.pa_immtgt = NULL;
2277         pa.pa_as = opt_p ? MDB_TGT_AS_PHYS : MDB_TGT_AS_VIRT;
2278         pa.pa_armemlim = mdb.m_armemlim;
2279         pa.pa_arstrlim = mdb.m_arstrlim;
2280         pa.pa_delim = "\n";
2281         pa.pa_flags = uflags;
2282         pa.pa_nest = 0;
2283         pa.pa_tab = 4;
2284         pa.pa_prefix = NULL;
2285         pa.pa_suffix = NULL;
2286         pa.pa_holes = NULL;
2287         pa.pa_nholes = 0;
2288         pa.pa_depth = 0;
2289         pa.pa_maxdepth = opt_s;
2290 
2291         if ((flags & DCMD_ADDRSPEC) && !opt_i)
2292                 pa.pa_addr = opt_p ? mdb_get_dot() : addr;
2293         else
2294                 pa.pa_addr = NULL;
2295 
2296         if (opt_i) {
2297                 const char *vargv[2];
2298                 uintmax_t dot = mdb_get_dot();
2299                 size_t outsize = mdb_ctf_type_size(id);
2300                 vargv[0] = (const char *)&dot;
2301                 vargv[1] = (const char *)&outsize;
2302                 pa.pa_immtgt = mdb_tgt_create(mdb_value_tgt_create,
2303                     0, 2, vargv);
2304                 pa.pa_tgt = pa.pa_immtgt;
2305         }
2306 
2307         if (opt_c != MDB_ARR_NOLIMIT)
2308                 pa.pa_arstrlim = opt_c;
2309         if (opt_C)
2310                 pa.pa_arstrlim = MDB_ARR_NOLIMIT;
2311         if (opt_l != MDB_ARR_NOLIMIT)
2312                 pa.pa_armemlim = opt_l;
2313         if (opt_L)
2314                 pa.pa_armemlim = MDB_ARR_NOLIMIT;
2315 
2316         if (argc > 0) {
2317                 for (i = 0; i < argc; i++) {
2318                         mdb_ctf_id_t mid;
2319                         int last_deref;
2320                         ulong_t off;
2321                         int kind;
2322                         char buf[MDB_SYM_NAMLEN];
2323 
2324                         mdb_tgt_t *oldtgt = pa.pa_tgt;
2325                         mdb_tgt_as_t oldas = pa.pa_as;
2326                         mdb_tgt_addr_t oldaddr = pa.pa_addr;
2327 
2328                         if (argv->a_type == MDB_TYPE_STRING) {
2329                                 const char *member = argv[i].a_un.a_str;
2330                                 mdb_ctf_id_t rid;
2331 
2332                                 if (parse_member(&pa, member, id, &mid,
2333                                     &off, &last_deref) != 0) {
2334                                         err = DCMD_ABORT;
2335                                         goto out;
2336                                 }
2337 
2338                                 /*
2339                                  * If the member string ends with a "[0]"
2340                                  * (last_deref * is true) and the type is a
2341                                  * structure or union, * print "->" rather
2342                                  * than "[0]." in elt_print.
2343                                  */
2344                                 (void) mdb_ctf_type_resolve(mid, &rid);
2345                                 kind = mdb_ctf_type_kind(rid);
2346                                 if (last_deref && IS_SOU(kind)) {
2347                                         char *end;
2348                                         (void) mdb_snprintf(buf, sizeof (buf),
2349                                             "%s", member);
2350                                         end = strrchr(buf, '[');
2351                                         *end = '\0';
2352                                         pa.pa_suffix = "->";
2353                                         member = &buf[0];
2354                                 } else if (IS_SOU(kind)) {
2355                                         pa.pa_suffix = ".";
2356                                 } else {
2357                                         pa.pa_suffix = "";
2358                                 }
2359 
2360                                 pa.pa_prefix = member;
2361                         } else {
2362                                 ulong_t moff;
2363 
2364                                 moff = (ulong_t)argv[i].a_un.a_val;
2365 
2366                                 if (mdb_ctf_offset_to_name(id, moff * NBBY,
2367                                     buf, sizeof (buf), 0, &mid, &off) == -1) {
2368                                         mdb_warn("invalid offset %lx\n", moff);
2369                                         err = DCMD_ABORT;
2370                                         goto out;
2371                                 }
2372 
2373                                 pa.pa_prefix = buf;
2374                                 pa.pa_addr += moff - off / NBBY;
2375                                 pa.pa_suffix = strlen(buf) == 0 ? "" : ".";
2376                         }
2377 
2378                         off %= NBBY;
2379                         if (flags & DCMD_PIPE_OUT) {
2380                                 if (pipe_print(mid, off, &pa) != 0) {
2381                                         mdb_warn("failed to print type");
2382                                         err = DCMD_ERR;
2383                                         goto out;
2384                                 }
2385                         } else if (off != 0) {
2386                                 mdb_ctf_id_t base;
2387                                 (void) mdb_ctf_type_resolve(mid, &base);
2388 
2389                                 if (elt_print("", mid, base, off, 0,
2390                                     &pa) != 0) {
2391                                         mdb_warn("failed to print type");
2392                                         err = DCMD_ERR;
2393                                         goto out;
2394                                 }
2395                         } else {
2396                                 if (mdb_ctf_type_visit(mid, elt_print,
2397                                     &pa) == -1) {
2398                                         mdb_warn("failed to print type");
2399                                         err = DCMD_ERR;
2400                                         goto out;
2401                                 }
2402 
2403                                 for (d = pa.pa_depth - 1; d >= 0; d--)
2404                                         print_close_sou(&pa, d);
2405                         }
2406 
2407                         pa.pa_depth = 0;
2408                         pa.pa_tgt = oldtgt;
2409                         pa.pa_as = oldas;
2410                         pa.pa_addr = oldaddr;
2411                         pa.pa_delim = "\n";
2412                 }
2413 
2414         } else if (flags & DCMD_PIPE_OUT) {
2415                 if (pipe_print(id, 0, &pa) != 0) {
2416                         mdb_warn("failed to print type");
2417                         err = DCMD_ERR;
2418                         goto out;
2419                 }
2420         } else {
2421                 if (mdb_ctf_type_visit(id, elt_print, &pa) == -1) {
2422                         mdb_warn("failed to print type");
2423                         err = DCMD_ERR;
2424                         goto out;
2425                 }
2426 
2427                 for (d = pa.pa_depth - 1; d >= 0; d--)
2428                         print_close_sou(&pa, d);
2429         }
2430 
2431         mdb_set_dot(addr + mdb_ctf_type_size(id));
2432         err = DCMD_OK;
2433 out:
2434         if (pa.pa_immtgt)
2435                 mdb_tgt_destroy(pa.pa_immtgt);
2436         return (err);
2437 }
2438 
2439 void
2440 print_help(void)
2441 {
2442         mdb_printf(
2443             "-a         show address of object\n"
2444             "-C         unlimit the length of character arrays\n"
2445             "-c limit   limit the length of character arrays\n"
2446             "-d         output values in decimal\n"
2447             "-h         print holes in structures\n"
2448             "-i         interpret address as data of the given type\n"
2449             "-L         unlimit the length of standard arrays\n"
2450             "-l limit   limit the length of standard arrays\n"
2451             "-n         don't print pointers as symbol offsets\n"
2452             "-p         interpret address as a physical memory address\n"
2453             "-s depth   limit the recursion depth\n"
2454             "-T         show type and <<base type>> of object\n"
2455             "-t         show type of object\n"
2456             "-x         output values in hexadecimal\n"
2457             "\n"
2458             "type may be omitted if the C type of addr can be inferred.\n"
2459             "\n"
2460             "Members may be specified with standard C syntax using the\n"
2461             "array indexing operator \"[index]\", structure member\n"
2462             "operator \".\", or structure pointer operator \"->\".\n"
2463             "\n"
2464             "Offsets must use the $[ expression ] syntax\n");
2465 }
2466 
2467 static int
2468 printf_signed(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt,
2469     boolean_t sign)
2470 {
2471         ssize_t size;
2472         mdb_ctf_id_t base;
2473         ctf_encoding_t e;
2474 
2475         union {
2476                 uint64_t ui8;
2477                 uint32_t ui4;
2478                 uint16_t ui2;
2479                 uint8_t ui1;
2480                 int64_t i8;
2481                 int32_t i4;
2482                 int16_t i2;
2483                 int8_t i1;
2484         } u;
2485 
2486         if (mdb_ctf_type_resolve(id, &base) == -1) {
2487                 mdb_warn("could not resolve type");
2488                 return (DCMD_ABORT);
2489         }
2490 
2491         if (mdb_ctf_type_kind(base) != CTF_K_INTEGER) {
2492                 mdb_warn("expected integer type\n");
2493                 return (DCMD_ABORT);
2494         }
2495 
2496         if (mdb_ctf_type_encoding(base, &e) != 0) {
2497                 mdb_warn("could not get type encoding");
2498                 return (DCMD_ABORT);
2499         }
2500 
2501         if (sign)
2502                 sign = e.cte_format & CTF_INT_SIGNED;
2503 
2504         size = e.cte_bits / NBBY;
2505 
2506         /*
2507          * Check to see if our life has been complicated by the presence of
2508          * a bitfield.  If it has, we will print it using logic that is only
2509          * slightly different than that found in print_bitfield(), above.  (In
2510          * particular, see the comments there for an explanation of the
2511          * endianness differences in this code.)
2512          */
2513         if (size > 8 || (e.cte_bits % NBBY) != 0 ||
2514             (size & (size - 1)) != 0) {
2515                 uint64_t mask = (1ULL << e.cte_bits) - 1;
2516                 uint64_t value = 0;
2517                 uint8_t *buf = (uint8_t *)&value;
2518                 uint8_t shift;
2519 
2520                 /*
2521                  * Round our size up one byte.
2522                  */
2523                 size = (e.cte_bits + (NBBY - 1)) / NBBY;
2524 
2525                 if (e.cte_bits > sizeof (value) * NBBY - 1) {
2526                         mdb_printf("invalid bitfield size %u", e.cte_bits);
2527                         return (DCMD_ABORT);
2528                 }
2529 
2530 #ifdef _BIG_ENDIAN
2531                 buf += sizeof (value) - size;
2532                 off += e.cte_bits;
2533 #endif
2534 
2535                 if (mdb_vread(buf, size, addr) == -1) {
2536                         mdb_warn("failed to read %lu bytes at %p", size, addr);
2537                         return (DCMD_ERR);
2538                 }
2539 
2540                 shift = off % NBBY;
2541 #ifdef _BIG_ENDIAN
2542                 shift = NBBY - shift;
2543 #endif
2544 
2545                 /*
2546                  * If we have a bit offset within the byte, shift it down.
2547                  */
2548                 if (off % NBBY != 0)
2549                         value >>= shift;
2550                 value &= mask;
2551 
2552                 if (sign) {
2553                         int sshift = sizeof (value) * NBBY - e.cte_bits;
2554                         value = ((int64_t)value << sshift) >> sshift;
2555                 }
2556 
2557                 mdb_printf(fmt, value);
2558                 return (0);
2559         }
2560 
2561         if (mdb_vread(&u.i8, size, addr) == -1) {
2562                 mdb_warn("failed to read %lu bytes at %p", (ulong_t)size, addr);
2563                 return (DCMD_ERR);
2564         }
2565 
2566         switch (size) {
2567         case sizeof (uint8_t):
2568                 mdb_printf(fmt, (uint64_t)(sign ? u.i1 : u.ui1));
2569                 break;
2570         case sizeof (uint16_t):
2571                 mdb_printf(fmt, (uint64_t)(sign ? u.i2 : u.ui2));
2572                 break;
2573         case sizeof (uint32_t):
2574                 mdb_printf(fmt, (uint64_t)(sign ? u.i4 : u.ui4));
2575                 break;
2576         case sizeof (uint64_t):
2577                 mdb_printf(fmt, (uint64_t)(sign ? u.i8 : u.ui8));
2578                 break;
2579         }
2580 
2581         return (0);
2582 }
2583 
2584 static int
2585 printf_int(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt)
2586 {
2587         return (printf_signed(id, addr, off, fmt, B_TRUE));
2588 }
2589 
2590 static int
2591 printf_uint(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt)
2592 {
2593         return (printf_signed(id, addr, off, fmt, B_FALSE));
2594 }
2595 
2596 /*ARGSUSED*/
2597 static int
2598 printf_uint32(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt)
2599 {
2600         mdb_ctf_id_t base;
2601         ctf_encoding_t e;
2602         uint32_t value;
2603 
2604         if (mdb_ctf_type_resolve(id, &base) == -1) {
2605                 mdb_warn("could not resolve type\n");
2606                 return (DCMD_ABORT);
2607         }
2608 
2609         if (mdb_ctf_type_kind(base) != CTF_K_INTEGER ||
2610             mdb_ctf_type_encoding(base, &e) != 0 ||
2611             e.cte_bits / NBBY != sizeof (value)) {
2612                 mdb_warn("expected 32-bit integer type\n");
2613                 return (DCMD_ABORT);
2614         }
2615 
2616         if (mdb_vread(&value, sizeof (value), addr) == -1) {
2617                 mdb_warn("failed to read 32-bit value at %p", addr);
2618                 return (DCMD_ERR);
2619         }
2620 
2621         mdb_printf(fmt, value);
2622 
2623         return (0);
2624 }
2625 
2626 /*ARGSUSED*/
2627 static int
2628 printf_ptr(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt)
2629 {
2630         uintptr_t value;
2631         mdb_ctf_id_t base;
2632 
2633         if (mdb_ctf_type_resolve(id, &base) == -1) {
2634                 mdb_warn("could not resolve type\n");
2635                 return (DCMD_ABORT);
2636         }
2637 
2638         if (mdb_ctf_type_kind(base) != CTF_K_POINTER) {
2639                 mdb_warn("expected pointer type\n");
2640                 return (DCMD_ABORT);
2641         }
2642 
2643         if (mdb_vread(&value, sizeof (value), addr) == -1) {
2644                 mdb_warn("failed to read pointer at %llx", addr);
2645                 return (DCMD_ERR);
2646         }
2647 
2648         mdb_printf(fmt, value);
2649 
2650         return (0);
2651 }
2652 
2653 /*ARGSUSED*/
2654 static int
2655 printf_string(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt)
2656 {
2657         mdb_ctf_id_t base;
2658         mdb_ctf_arinfo_t r;
2659         char buf[1024];
2660         ssize_t size;
2661 
2662         if (mdb_ctf_type_resolve(id, &base) == -1) {
2663                 mdb_warn("could not resolve type");
2664                 return (DCMD_ABORT);
2665         }
2666 
2667         if (mdb_ctf_type_kind(base) == CTF_K_POINTER) {
2668                 uintptr_t value;
2669 
2670                 if (mdb_vread(&value, sizeof (value), addr) == -1) {
2671                         mdb_warn("failed to read pointer at %llx", addr);
2672                         return (DCMD_ERR);
2673                 }
2674 
2675                 if (mdb_readstr(buf, sizeof (buf) - 1, value) < 0) {
2676                         mdb_warn("failed to read string at %llx", value);
2677                         return (DCMD_ERR);
2678                 }
2679 
2680                 mdb_printf(fmt, buf);
2681                 return (0);
2682         }
2683 
2684         if (mdb_ctf_type_kind(base) != CTF_K_ARRAY) {
2685                 mdb_warn("exepected pointer or array type\n");
2686                 return (DCMD_ABORT);
2687         }
2688 
2689         if (mdb_ctf_array_info(base, &r) == -1 ||
2690             mdb_ctf_type_resolve(r.mta_contents, &base) == -1 ||
2691             (size = mdb_ctf_type_size(base)) == -1) {
2692                 mdb_warn("can't determine array type");
2693                 return (DCMD_ABORT);
2694         }
2695 
2696         if (size != 1) {
2697                 mdb_warn("string format specifier requires "
2698                     "an array of characters\n");
2699                 return (DCMD_ABORT);
2700         }
2701 
2702         bzero(buf, sizeof (buf));
2703 
2704         if (mdb_vread(buf, MIN(r.mta_nelems, sizeof (buf) - 1), addr) == -1) {
2705                 mdb_warn("failed to read array at %p", addr);
2706                 return (DCMD_ERR);
2707         }
2708 
2709         mdb_printf(fmt, buf);
2710 
2711         return (0);
2712 }
2713 
2714 /*ARGSUSED*/
2715 static int
2716 printf_ipv6(mdb_ctf_id_t id, uintptr_t addr, ulong_t off, char *fmt)
2717 {
2718         mdb_ctf_id_t base;
2719         mdb_ctf_id_t ipv6_type, ipv6_base;
2720         in6_addr_t ipv6;
2721 
2722         if (mdb_ctf_lookup_by_name("in6_addr_t", &ipv6_type) == -1) {
2723                 mdb_warn("could not resolve in6_addr_t type\n");
2724                 return (DCMD_ABORT);
2725         }
2726 
2727         if (mdb_ctf_type_resolve(id, &base) == -1) {
2728                 mdb_warn("could not resolve type\n");
2729                 return (DCMD_ABORT);
2730         }
2731 
2732         if (mdb_ctf_type_resolve(ipv6_type, &ipv6_base) == -1) {
2733                 mdb_warn("could not resolve in6_addr_t type\n");
2734                 return (DCMD_ABORT);
2735         }
2736 
2737         if (mdb_ctf_type_cmp(base, ipv6_base) != 0) {
2738                 mdb_warn("requires argument of type in6_addr_t\n");
2739                 return (DCMD_ABORT);
2740         }
2741 
2742         if (mdb_vread(&ipv6, sizeof (ipv6), addr) == -1) {
2743                 mdb_warn("couldn't read in6_addr_t at %p", addr);
2744                 return (DCMD_ERR);
2745         }
2746 
2747         mdb_printf(fmt, &ipv6);
2748 
2749         return (0);
2750 }
2751 
2752 /*
2753  * To validate the format string specified to ::printf, we run the format
2754  * string through a very simple state machine that restricts us to a subset
2755  * of mdb_printf() functionality.
2756  */
2757 enum {
2758         PRINTF_NOFMT = 1,               /* no current format specifier */
2759         PRINTF_PERC,                    /* processed '%' */
2760         PRINTF_FMT,                     /* processing format specifier */
2761         PRINTF_LEFT,                    /* processed '-', expecting width */
2762         PRINTF_WIDTH,                   /* processing width */
2763         PRINTF_QUES                     /* processed '?', expecting format */
2764 };
2765 
2766 int
2767 cmd_printf(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
2768 {
2769         char type[MDB_SYM_NAMLEN];
2770         int i, nfmts = 0, ret;
2771         mdb_ctf_id_t id;
2772         const char *fmt, *member;
2773         char **fmts, *last, *dest, f;
2774         int (**funcs)(mdb_ctf_id_t, uintptr_t, ulong_t, char *);
2775         int state = PRINTF_NOFMT;
2776         printarg_t pa;
2777 
2778         if (!(flags & DCMD_ADDRSPEC))
2779                 return (DCMD_USAGE);
2780 
2781         bzero(&pa, sizeof (pa));
2782         pa.pa_as = MDB_TGT_AS_VIRT;
2783         pa.pa_realtgt = pa.pa_tgt = mdb.m_target;
2784 
2785         if (argc == 0 || argv[0].a_type != MDB_TYPE_STRING) {
2786                 mdb_warn("expected a format string\n");
2787                 return (DCMD_USAGE);
2788         }
2789 
2790         /*
2791          * Our first argument is a format string; rip it apart and run it
2792          * through our state machine to validate that our input is within the
2793          * subset of mdb_printf() format strings that we allow.
2794          */
2795         fmt = argv[0].a_un.a_str;
2796         /*
2797          * 'dest' must be large enough to hold a copy of the format string,
2798          * plus a NUL and up to 2 additional characters for each conversion
2799          * in the format string.  This gives us a bloat factor of 5/2 ~= 3.
2800          *   e.g. "%d" (strlen of 2) --> "%lld\0" (need 5 bytes)
2801          */
2802         dest = mdb_zalloc(strlen(fmt) * 3, UM_SLEEP | UM_GC);
2803         fmts = mdb_zalloc(strlen(fmt) * sizeof (char *), UM_SLEEP | UM_GC);
2804         funcs = mdb_zalloc(strlen(fmt) * sizeof (void *), UM_SLEEP | UM_GC);
2805         last = dest;
2806 
2807         for (i = 0; fmt[i] != '\0'; i++) {
2808                 *dest++ = f = fmt[i];
2809 
2810                 switch (state) {
2811                 case PRINTF_NOFMT:
2812                         state = f == '%' ? PRINTF_PERC : PRINTF_NOFMT;
2813                         break;
2814 
2815                 case PRINTF_PERC:
2816                         state = f == '-' ? PRINTF_LEFT :
2817                             f >= '0' && f <= '9' ? PRINTF_WIDTH :
2818                             f == '?' ? PRINTF_QUES :
2819                             f == '%' ? PRINTF_NOFMT : PRINTF_FMT;
2820                         break;
2821 
2822                 case PRINTF_LEFT:
2823                         state = f >= '0' && f <= '9' ? PRINTF_WIDTH :
2824                             f == '?' ? PRINTF_QUES : PRINTF_FMT;
2825                         break;
2826 
2827                 case PRINTF_WIDTH:
2828                         state = f >= '0' && f <= '9' ? PRINTF_WIDTH :
2829                             PRINTF_FMT;
2830                         break;
2831 
2832                 case PRINTF_QUES:
2833                         state = PRINTF_FMT;
2834                         break;
2835                 }
2836 
2837                 if (state != PRINTF_FMT)
2838                         continue;
2839 
2840                 dest--;
2841 
2842                 /*
2843                  * Now check that we have one of our valid format characters.
2844                  */
2845                 switch (f) {
2846                 case 'a':
2847                 case 'A':
2848                 case 'p':
2849                         funcs[nfmts] = printf_ptr;
2850                         break;
2851 
2852                 case 'd':
2853                 case 'q':
2854                 case 'R':
2855                         funcs[nfmts] = printf_int;
2856                         *dest++ = 'l';
2857                         *dest++ = 'l';
2858                         break;
2859 
2860                 case 'I':
2861                         funcs[nfmts] = printf_uint32;
2862                         break;
2863 
2864                 case 'N':
2865                         funcs[nfmts] = printf_ipv6;
2866                         break;
2867 
2868                 case 'o':
2869                 case 'r':
2870                 case 'u':
2871                 case 'x':
2872                 case 'X':
2873                         funcs[nfmts] = printf_uint;
2874                         *dest++ = 'l';
2875                         *dest++ = 'l';
2876                         break;
2877 
2878                 case 's':
2879                         funcs[nfmts] = printf_string;
2880                         break;
2881 
2882                 case 'Y':
2883                         funcs[nfmts] = sizeof (time_t) == sizeof (int) ?
2884                             printf_uint32 : printf_uint;
2885                         break;
2886 
2887                 default:
2888                         mdb_warn("illegal format string at or near "
2889                             "'%c' (position %d)\n", f, i + 1);
2890                         return (DCMD_ABORT);
2891                 }
2892 
2893                 *dest++ = f;
2894                 *dest++ = '\0';
2895                 fmts[nfmts++] = last;
2896                 last = dest;
2897                 state = PRINTF_NOFMT;
2898         }
2899 
2900         argc--;
2901         argv++;
2902 
2903         /*
2904          * Now we expect a type name.
2905          */
2906         if ((ret = args_to_typename(&argc, &argv, type, sizeof (type))) != 0)
2907                 return (ret);
2908 
2909         argv++;
2910         argc--;
2911 
2912         if (mdb_ctf_lookup_by_name(type, &id) != 0) {
2913                 mdb_warn("failed to look up type %s", type);
2914                 return (DCMD_ABORT);
2915         }
2916 
2917         if (argc == 0) {
2918                 mdb_warn("at least one member must be specified\n");
2919                 return (DCMD_USAGE);
2920         }
2921 
2922         if (argc != nfmts) {
2923                 mdb_warn("%s format specifiers (found %d, expected %d)\n",
2924                     argc > nfmts ? "missing" : "extra", nfmts, argc);
2925                 return (DCMD_ABORT);
2926         }
2927 
2928         for (i = 0; i < argc; i++) {
2929                 mdb_ctf_id_t mid;
2930                 ulong_t off;
2931                 int ignored;
2932 
2933                 if (argv[i].a_type != MDB_TYPE_STRING) {
2934                         mdb_warn("expected only type member arguments\n");
2935                         return (DCMD_ABORT);
2936                 }
2937 
2938                 if (strcmp((member = argv[i].a_un.a_str), ".") == 0) {
2939                         /*
2940                          * We allow "." to be specified to denote the current
2941                          * value of dot.
2942                          */
2943                         if (funcs[i] != printf_ptr && funcs[i] != printf_uint &&
2944                             funcs[i] != printf_int) {
2945                                 mdb_warn("expected integer or pointer format "
2946                                     "specifier for '.'\n");
2947                                 return (DCMD_ABORT);
2948                         }
2949 
2950                         mdb_printf(fmts[i], mdb_get_dot());
2951                         continue;
2952                 }
2953 
2954                 pa.pa_addr = addr;
2955 
2956                 if (parse_member(&pa, member, id, &mid, &off, &ignored) != 0)
2957                         return (DCMD_ABORT);
2958 
2959                 if ((ret = funcs[i](mid, pa.pa_addr, off, fmts[i])) != 0) {
2960                         mdb_warn("failed to print member '%s'\n", member);
2961                         return (ret);
2962                 }
2963         }
2964 
2965         mdb_printf("%s", last);
2966 
2967         return (DCMD_OK);
2968 }
2969 
2970 static char _mdb_printf_help[] =
2971 "The format string argument is a printf(3C)-like format string that is a\n"
2972 "subset of the format strings supported by mdb_printf().  The type argument\n"
2973 "is the name of a type to be used to interpret the memory referenced by dot.\n"
2974 "The member should either be a field in the specified structure, or the\n"
2975 "special member '.', denoting the value of dot (and treated as a pointer).\n"
2976 "The number of members must match the number of format specifiers in the\n"
2977 "format string.\n"
2978 "\n"
2979 "The following format specifiers are recognized by ::printf:\n"
2980 "\n"
2981 "  %%    Prints the '%' symbol.\n"
2982 "  %a    Prints the member in symbolic form.\n"
2983 "  %d    Prints the member as a decimal integer.  If the member is a signed\n"
2984 "        integer type, the output will be signed.\n"
2985 "  %I    Prints the member a IPv4 address (must be a 32-bit integer type).\n"
2986 "  %N    Prints the member an IPv6 address (must be of type in6_addr_t).\n"
2987 "  %o    Prints the member as an unsigned octal integer.\n"
2988 "  %p    Prints the member as a pointer, in hexadecimal.\n"
2989 "  %q    Prints the member in signed octal.  Honk if you ever use this!\n"
2990 "  %r    Prints the member as an unsigned value in the current output radix.\n"
2991 "  %R    Prints the member as a signed value in the current output radix.\n"
2992 "  %s    Prints the member as a string (requires a pointer or an array of\n"
2993 "        characters).\n"
2994 "  %u    Prints the member as an unsigned decimal integer.\n"
2995 "  %x    Prints the member in hexadecimal.\n"
2996 "  %X    Prints the member in hexadecimal, using the characters A-F as the\n"
2997 "        digits for the values 10-15.\n"
2998 "  %Y    Prints the member as a time_t as the string "
2999             "'year month day HH:MM:SS'.\n"
3000 "\n"
3001 "The following field width specifiers are recognized by ::printf:\n"
3002 "\n"
3003 "  %n    Field width is set to the specified decimal value.\n"
3004 "  %?    Field width is set to the maximum width of a hexadecimal pointer\n"
3005 "        value.  This is 8 in an ILP32 environment, and 16 in an LP64\n"
3006 "        environment.\n"
3007 "\n"
3008 "The following flag specifers are recognized by ::printf:\n"
3009 "\n"
3010 "  %-    Left-justify the output within the specified field width.  If the\n"
3011 "        width of the output is less than the specified field width, the\n"
3012 "        output will be padded with blanks on the right-hand side.  Without\n"
3013 "        %-, values are right-justified by default.\n"
3014 "\n"
3015 "  %0    Zero-fill the output field if the output is right-justified and the\n"
3016 "        width of the output is less than the specified field width.  Without\n"
3017 "        %0, right-justified values are prepended with blanks in order to\n"
3018 "        fill the field.\n"
3019 "\n"
3020 "Examples: \n"
3021 "\n"
3022 "  ::walk proc | "
3023         "::printf \"%-6d %s\\n\" proc_t p_pidp->pid_id p_user.u_psargs\n"
3024 "  ::walk thread | "
3025         "::printf \"%?p %3d %a\\n\" kthread_t . t_pri t_startpc\n"
3026 "  ::walk zone | "
3027         "::printf \"%-40s %20s\\n\" zone_t zone_name zone_nodename\n"
3028 "  ::walk ire | "
3029         "::printf \"%Y %I\\n\" ire_t ire_create_time ire_u.ire4_u.ire4_addr\n"
3030 "\n";
3031 
3032 void
3033 printf_help(void)
3034 {
3035         mdb_printf("%s", _mdb_printf_help);
3036 }