PROC(4) File Formats and Configurations PROC(4) NNAAMMEE proc - /proc, the process file system DDEESSCCRRIIPPTTIIOONN //pprroocc is a file system that provides access to the state of each process and light-weight process (lwp) in the system. The name of each entry in the //pprroocc directory is a decimal number corresponding to a process-ID. These entries are themselves subdirectories. Access to process state is provided by additional files contained within each subdirectory; the hierarchy is described more completely below. In this document, ``//pprroocc file'' refers to a non-directory file within the hierarchy rooted at //pprroocc. The owner of each //pprroocc file and subdirectory is determined by the user-ID of the process. //pprroocc can be mounted on any mount point, in addition to the standard //pprroocc mount point, and can be mounted several places at once. Such additional mounts are allowed in order to facilitate the confinement of processes to subtrees of the file system via cchhrroooott(1M) and yet allow such processes access to commands like ppss(1). Standard system calls are used to access //pprroocc files: ooppeenn(2), cclloossee(2), rreeaadd(2), and wwrriittee(2) (including rreeaaddvv(2), wwrriitteevv(2), pprreeaadd(2), and ppwwrriittee(2)). Most files describe process state and can only be opened for reading. ccttll and llwwppccttll (control) files permit manipulation of process state and can only be opened for writing. aass (address space) files contain the image of the running process and can be opened for both reading and writing. An open for writing allows process control; a read-only open allows inspection but not control. In this document, we refer to the process as open for reading or writing if any of its associated //pprroocc files is open for reading or writing. In general, more than one process can open the same //pprroocc file at the same time. _E_x_c_l_u_s_i_v_e _o_p_e_n is an advisory mechanism provided to allow controlling processes to avoid collisions with each other. A process can obtain exclusive control of a target process, with respect to other cooperating processes, if it successfully opens any //pprroocc file in the target process for writing (the aass or ccttll files, or the llwwppccttll file of any lwp) while specifying OO__EEXXCCLL in the ooppeenn(2). Such an open will fail if the target process is already open for writing (that is, if an aass, ccttll, or llwwppccttll file is already open for writing). There can be any number of concurrent read-only opens; OO__EEXXCCLL is ignored on opens for reading. It is recommended that the first open for writing by a controlling process use the OO__EEXXCCLL flag; multiple controlling processes usually result in chaos. If a process opens one of its own //pprroocc files for writing, the open succeeds regardless of OO__EEXXCCLL and regardless of whether some other process has the process open for writing. Self-opens do not count when another process attempts an exclusive open. (A process cannot exclude a debugger by opening itself for writing and the application of a debugger cannot prevent a process from opening itself.) All self-opens for writing are forced to be close-on-exec (see the FF__SSEETTFFDD operation of ffccnnttll(2)). Data may be transferred from or to any locations in the address space of the traced process by applying llsseeeekk(2) to position the aass file at the virtual address of interest followed by rreeaadd(2) or wwrriittee(2) (or by using pprreeaadd(2) or ppwwrriittee(2) for the combined operation). The address- map files //pprroocc//_p_i_d//mmaapp and //pprroocc//_p_i_d//xxmmaapp can be read to determine the accessible areas (mappings) of the address space. II//OO transfers may span contiguous mappings. An II//OO request extending into an unmapped area is truncated at the boundary. A write request beginning at an unmapped virtual address fails with EEIIOO; a read request beginning at an unmapped virtual address returns zero (an end-of-file indication). Information and control operations are provided through additional files. <
> contains definitions of data structures and message
formats used with these files. Some of these definitions involve the
use of sets of flags. The set types ssiiggsseett__tt, ffllttsseett__tt, and ssyysssseett__tt
correspond, respectively, to signal, fault, and system call
enumerations defined in <>, <>, and
<>. Each set type is large enough to hold flags for its
own enumeration. Although they are of different sizes, they have a
common structure and can be manipulated by these macros:
prfillset(&set); /* turn on all flags in set */
premptyset(&set); /* turn off all flags in set */
praddset(&set, flag); /* turn on the specified flag */
prdelset(&set, flag); /* turn off the specified flag */
r = prismember(&set, flag); /* != 0 iff flag is turned on */
One of pprrffiillllsseett(()) or pprreemmppttyysseett(()) must be used to initialize sseett
before it is used in any other operation. ffllaagg must be a member of the
enumeration corresponding to sseett.
Every process contains at least one _l_i_g_h_t_-_w_e_i_g_h_t _p_r_o_c_e_s_s, or _l_w_p. Each
lwp represents a flow of execution that is independently scheduled by
the operating system. All lwps in a process share its address space as
well as many other attributes. Through the use of llwwppccttll and ccttll files
as described below, it is possible to affect individual lwps in a
process or to affect all of them at once, depending on the operation.
When the process has more than one lwp, a representative lwp is chosen
by the system for certain process status files and control operations.
The representative lwp is a stopped lwp only if all of the process's
lwps are stopped; is stopped on an event of interest only if all of the
lwps are so stopped (excluding PPRR__SSUUSSPPEENNDDEEDD lwps); is in a PPRR__RREEQQUUEESSTTEEDD
stop only if there are no other events of interest to be found; or,
failing everything else, is in a PPRR__SSUUSSPPEENNDDEEDD stop (implying that the
process is deadlocked). See the description of the ssttaattuuss file for
definitions of stopped states. See the PPCCSSTTOOPP control operation for the
definition of ``event of interest''.
The representative lwp remains fixed (it will be chosen again on the
next operation) as long as all of the lwps are stopped on events of
interest or are in a PPRR__SSUUSSPPEENNDDEEDD stop and the PPCCRRUUNN control operation
is not applied to any of them.
When applied to the process control file, every //pprroocc control operation
that must act on an lwp uses the same algorithm to choose which lwp to
act upon. Together with synchronous stopping (see PPCCSSEETT), this enables
a debugger to control a multiple-lwp process using only the process-
level status and control files if it so chooses. More fine-grained
control can be achieved using the lwp-specific files.
The system supports two process data models, the traditional 32-bit
data model in which ints, longs and pointers are all 32 bits wide (the
ILP32 data model), and on some platforms the 64-bit data model in which
longs and pointers, but not ints, are 64 bits in width (the LP64 data
model). In the LP64 data model some system data types, notably ssiizzee__tt,
ooffff__tt, ttiimmee__tt and ddeevv__tt, grow from 32 bits to 64 bits as well.
The //pprroocc interfaces described here are available to both 32-bit and
64-bit controlling processes. However, many operations attempted by a
32-bit controlling process on a 64-bit target process will fail with
EEOOVVEERRFFLLOOWW because the address space range of a 32-bit process cannot
encompass a 64-bit process or because the data in some 64-bit system
data type cannot be compressed to fit into the corresponding 32-bit
type without loss of information. Operations that fail in this
circumstance include reading and writing the address space, reading the
address-map files, and setting the target process's registers. There is
no restriction on operations applied by a 64-bit process to either a
32-bit or a 64-bit target processes.
The format of the contents of any //pprroocc file depends on the data model
of the observer (the controlling process), not on the data model of the
target process. A 64-bit debugger does not have to translate the
information it reads from a //pprroocc file for a 32-bit process from 32-bit
format to 64-bit format. However, it usually has to be aware of the
data model of the target process. The pprr__ddmmooddeell field of the ssttaattuuss
files indicates the target process's data model.
To help deal with system data structures that are read from 32-bit
processes, a 64-bit controlling program can be compiled with the C
preprocessor symbol __SSYYSSCCAALLLL3322 defined before system header files are
included. This makes explicit 32-bit fixed-width data structures (like
ccssttrruucctt ssttaatt3322) visible to the 64-bit program. See ttyyppeess3322..hh(3HEAD).
DDIIRREECCTTOORRYY SSTTRRUUCCTTUURREE
At the top level, the directory //pprroocc contains entries each of which
names an existing process in the system. These entries are themselves
directories. Except where otherwise noted, the files described below
can be opened for reading only. In addition, if a process becomes a
_z_o_m_b_i_e (one that has exited but whose parent has not yet performed a
wwaaiitt(3C) upon it), most of its associated //pprroocc files disappear from
the hierarchy; subsequent attempts to open them, or to read or write
files opened before the process exited, will elicit the error EENNOOEENNTT.
Although process state and consequently the contents of //pprroocc files can
change from instant to instant, a single rreeaadd(2) of a //pprroocc file is
guaranteed to return a sane representation of state; that is, the read
will be atomic with respect to the state of the process. No such
guarantee applies to successive reads applied to a //pprroocc file for a
running process. In addition, atomicity is not guaranteed for II//OO
applied to the aass (address-space) file for a running process or for a
process whose address space contains memory shared by another running
process.
A number of structure definitions are used to describe the files. These
structures may grow by the addition of elements at the end in future
releases of the system and it is not legitimate for a program to assume
that they will not.
SSTTRRUUCCTTUURREE OOFF //pprroocc//_p_i_d
A given directory //pprroocc//_p_i_d contains the following entries. A process
can use the invisible alias //pprroocc//sseellff if it wishes to open one of its
own //pprroocc files (invisible in the sense that the name ``self'' does not
appear in a directory listing of //pprroocc obtained from llss(1),
ggeettddeennttss(2), or rreeaaddddiirr(3C)).
ccoonnttrraaccttss
A directory containing references to the contracts held by the process.
Each entry is a symlink to the contract's directory under
//ssyysstteemm//ccoonnttrraacctt. See ccoonnttrraacctt(4).
aass
Contains the address-space image of the process; it can be opened for
both reading and writing. llsseeeekk(2) is used to position the file at the
virtual address of interest and then the address space can be examined
or changed through rreeaadd(2) or wwrriittee(2) (or by using pprreeaadd(2) or
ppwwrriittee(2) for the combined operation).
ccttll
A write-only file to which structured messages are written directing
the system to change some aspect of the process's state or control its
behavior in some way. The seek offset is not relevant when writing to
this file. Individual lwps also have associated llwwppccttll files in the lwp
subdirectories. A control message may be written either to the
process's ccttll file or to a specific llwwppccttll file with operation-specific
effects. The effect of a control message is immediately reflected in
the state of the process visible through appropriate status and
information files. The types of control messages are described in
detail later. See CCOONNTTRROOLL MMEESSSSAAGGEESS.
ssttaattuuss
Contains state information about the process and the representative
lwp. The file contains a ppssttaattuuss structure which contains an embedded
llwwppssttaattuuss structure for the representative lwp, as follows:
typedef struct pstatus {
int pr_flags; /* flags (see below) */
int pr_nlwp; /* number of active lwps in the process */
int pr_nzomb; /* number of zombie lwps in the process */
pid_tpr_pid; /* process id */
pid_tpr_ppid; /* parent process id */
pid_tpr_pgid; /* process group id */
pid_tpr_sid; /* session id */
id_t pr_aslwpid; /* obsolete */
id_t pr_agentid; /* lwp-id of the agent lwp, if any */
sigset_t pr_sigpend; /* set of process pending signals */
uintptr_t pr_brkbase; /* virtual address of the process heap */
size_t pr_brksize; /* size of the process heap, in bytes */
uintptr_t pr_stkbase; /* virtual address of the process stack */
size_tpr_stksize; /* size of the process stack, in bytes */
timestruc_t pr_utime; /* process user cpu time */
timestruc_t pr_stime; /* process system cpu time */
timestruc_t pr_cutime; /* sum of children's user times */
timestruc_t pr_cstime; /* sum of children's system times */
sigset_t pr_sigtrace; /* set of traced signals */
fltset_t pr_flttrace; /* set of traced faults */
sysset_t pr_sysentry; /* set of system calls traced on entry */
sysset_t pr_sysexit; /* set of system calls traced on exit */
char pr_dmodel; /* data model of the process */
taskid_t pr_taskid; /* task id */
projid_t pr_projid; /* project id */
zoneid_t pr_zoneid; /* zone id */
lwpstatus_t pr_lwp; /* status of the representative lwp */
} pstatus_t;
pprr__ffllaaggss is a bit-mask holding the following process flags. For
convenience, it also contains the lwp flags for the representative lwp,
described later.
PPRR__IISSSSYYSS
process is a system process (see PPCCSSTTOOPP).
PPRR__VVFFOORRKKPP
process is the parent of a vforked child (see PPCCWWAATTCCHH).
PPRR__FFOORRKK
process has its inherit-on-fork mode set (see PPCCSSEETT).
PPRR__RRLLCC
process has its run-on-last-close mode set (see PPCCSSEETT).
PPRR__KKLLCC
process has its kill-on-last-close mode set (see PPCCSSEETT).
PPRR__AASSYYNNCC
process has its asynchronous-stop mode set (see PPCCSSEETT).
PPRR__MMSSAACCCCTT
Set by default in all processes to indicate that
microstate accounting is enabled. However, this flag has
been deprecated and no longer has any effect. Microstate
accounting may not be disabled; however, it is still
possible to toggle the flag.
PPRR__MMSSFFOORRKK
Set by default in all processes to indicate that
microstate accounting will be enabled for processes that
this parent forks(). However, this flag has been
deprecated and no longer has any effect. It is possible to
toggle this flag; however, it is not possible to disable
microstate accounting.
PPRR__BBPPTTAADDJJ
process has its breakpoint adjustment mode set (see
PPCCSSEETT).
PPRR__PPTTRRAACCEE
process has its ptrace-compatibility mode set (see PPCCSSEETT).
pprr__nnllwwpp is the total number of active lwps in the process. pr_nzomb is
the total number of zombie lwps in the process. A zombie lwp is a non-
detached lwp that has terminated but has not been reaped with
tthhrr__jjooiinn(3C) or pptthhrreeaadd__jjooiinn(3C).
pprr__ppiidd, pprr__ppppiidd, pprr__ppggiidd, and pprr__ssiidd are, respectively, the process ID,
the ID of the process's parent, the process's process group ID, and the
process's session ID.
pprr__aassllwwppiidd is obsolete and is always zero.
pprr__aaggeennttiidd is the lwp-ID for the //pprroocc agent lwp (see the PPCCAAGGEENNTT
control operation). It is zero if there is no agent lwp in the process.
pprr__ssiiggppeenndd identifies asynchronous signals pending for the process.
pprr__bbrrkkbbaassee is the virtual address of the process heap and pprr__bbrrkkssiizzee is
its size in bytes. The address formed by the sum of these values is the
process bbrreeaakk (see bbrrkk(2)). pprr__ssttkkbbaassee and pprr__ssttkkssiizzee are,
respectively, the virtual address of the process stack and its size in
bytes. (Each lwp runs on a separate stack; the distinguishing
characteristic of the process stack is that the operating system will
grow it when necessary.)
pprr__uuttiimmee, pprr__ssttiimmee, pprr__ccuuttiimmee, and pprr__ccssttiimmee are, respectively, the
user CCPPUU and system CCPPUU time consumed by the process, and the
cumulative user CCPPUU and system CCPPUU time consumed by the process's
children, in seconds and nanoseconds.
pprr__ssiiggttrraaccee and pprr__ffllttttrraaccee contain, respectively, the set of signals
and the set of hardware faults that are being traced (see PPCCSSTTRRAACCEE and
PPCCSSFFAAUULLTT).
pprr__ssyysseennttrryy and pprr__ssyysseexxiitt contain, respectively, the sets of system
calls being traced on entry and exit (see PPCCSSEENNTTRRYY and PPCCSSEEXXIITT).
pprr__ddmmooddeell indicates the data model of the process. Possible values are:
PPRR__MMOODDEELL__IILLPP3322
process data model is ILP32.
PPRR__MMOODDEELL__LLPP6644
process data model is LP64.
PPRR__MMOODDEELL__NNAATTIIVVEE
process data model is native.
The pprr__ttaasskkiidd, pprr__pprroojjiidd, and pprr__zzoonneeiidd fields contain respectively,
the numeric IIDDs of the task, project, and zone in which the process was
running.
The constant PPRR__MMOODDEELL__NNAATTIIVVEE reflects the data model of the controlling
process, _t_h_a_t _i_s, its value is PPRR__MMOODDEELL__IILLPP3322 or PPRR__MMOODDEELL__LLPP6644
according to whether the controlling process has been compiled as a
32-bit program or a 64-bit program, respectively.
pprr__llwwpp contains the status information for the representative lwp:
typedef struct lwpstatus {
int pr_flags; /* flags (see below) */
id_t pr_lwpid; /* specific lwp identifier */
short pr_why; /* reason for lwp stop, if stopped */
short pr_what; /* more detailed reason */
short pr_cursig; /* current signal, if any */
siginfo_t pr_info; /* info associated with signal or fault */
sigset_t pr_lwppend; /* set of signals pending to the lwp */
sigset_t pr_lwphold; /* set of signals blocked by the lwp */
struct sigaction pr_action;/* signal action for current signal */
stack_t pr_altstack; /* alternate signal stack info */
uintptr_t pr_oldcontext; /* address of previous ucontext */
short pr_syscall; /* system call number (if in syscall) */
short pr_nsysarg; /* number of arguments to this syscall */
int pr_errno; /* errno for failed syscall */
long pr_sysarg[PRSYSARGS]; /* arguments to this syscall */
long pr_rval1; /* primary syscall return value */
long pr_rval2; /* second syscall return value, if any */
char pr_clname[PRCLSZ]; /* scheduling class name */
timestruc_t pr_tstamp; /* real-time time stamp of stop */
timestruc_t pr_utime; /* lwp user cpu time */
timestruc_t pr_stime; /* lwp system cpu time */
uintptr_t pr_ustack; /* stack boundary data (stack_t) address */
ulong_t pr_instr; /* current instruction */
prgregset_t pr_reg; /* general registers */
prfpregset_t pr_fpreg; /* floating-point registers */
} lwpstatus_t;
pprr__ffllaaggss is a bit-mask holding the following lwp flags. For
convenience, it also contains the process flags, described previously.
PPRR__SSTTOOPPPPEEDD
The lwp is stopped.
PPRR__IISSTTOOPP
The lwp is stopped on an event of interest (see PPCCSSTTOOPP).
PPRR__DDSSTTOOPP
The lwp has a stop directive in effect (see PPCCSSTTOOPP).
PPRR__SSTTEEPP
The lwp has a single-step directive in effect (see
PPCCRRUUNN).
PPRR__AASSLLEEEEPP
The lwp is in an interruptible sleep within a system
call.
PPRR__PPCCIINNVVAALL
The lwp's current instruction (pprr__iinnssttrr) is undefined.
PPRR__DDEETTAACCHH
This is a detached lwp (see pptthhrreeaadd__ccrreeaattee(3C) and
pptthhrreeaadd__jjooiinn(3C)).
PPRR__DDAAEEMMOONN
This is a daemon lwp (see pptthhrreeaadd__ccrreeaattee(3C)).
PPRR__AASSLLWWPP
This flag is obsolete and is never set.
PPRR__AAGGEENNTT
This is the //pprroocc agent lwp for the process.
pprr__llwwppiidd names the specific lwp.
pprr__wwhhyy and pprr__wwhhaatt together describe, for a stopped lwp, the reason for
the stop. Possible values of pprr__wwhhyy and the associated pprr__wwhhaatt are:
PPRR__RREEQQUUEESSTTEEDD
indicates that the stop occurred in response to a stop
directive, normally because PPCCSSTTOOPP was applied or
because another lwp stopped on an event of interest
and the asynchronous-stop flag (see PPCCSSEETT) was not set
for the process. pprr__wwhhaatt is unused in this case.
PPRR__SSIIGGNNAALLLLEEDD
indicates that the lwp stopped on receipt of a signal
(see PPCCSSTTRRAACCEE); pprr__wwhhaatt holds the signal number that
caused the stop (for a newly-stopped lwp, the same
value is in pprr__ccuurrssiigg).
PPRR__FFAAUULLTTEEDD
indicates that the lwp stopped on incurring a hardware
fault (see PPCCSSFFAAUULLTT); pprr__wwhhaatt holds the fault number
that caused the stop.
PPRR__SSYYSSEENNTTRRYY
PPRR__SSYYSSEEXXIITT
indicate a stop on entry to or exit from a system call
(see PPCCSSEENNTTRRYY and PPCCSSEEXXIITT); pprr__wwhhaatt holds the system
call number.
PPRR__JJOOBBCCOONNTTRROOLL
indicates that the lwp stopped due to the default
action of a job control stop signal (see
ssiiggaaccttiioonn(2)); pprr__wwhhaatt holds the stopping signal
number.
PPRR__SSUUSSPPEENNDDEEDD
indicates that the lwp stopped due to internal
synchronization of lwps within the process. pprr__wwhhaatt is
unused in this case.
pprr__ccuurrssiigg names the current signal, that is, the next signal to be
delivered to the lwp, if any. pprr__iinnffoo, when the lwp is in a
PPRR__SSIIGGNNAALLLLEEDD or PPRR__FFAAUULLTTEEDD stop, contains additional information
pertinent to the particular signal or fault (see <>).
pprr__llwwppppeenndd identifies any synchronous or directed signals pending for
the lwp. pprr__llwwpphhoolldd identifies those signals whose delivery is being
blocked by the lwp (the signal mask).
pprr__aaccttiioonn contains the signal action information pertaining to the
current signal (see ssiiggaaccttiioonn(2)); it is undefined if pprr__ccuurrssiigg is
zero. pprr__aallttssttaacckk contains the alternate signal stack information for
the lwp (see ssiiggaallttssttaacckk(2)).
pprr__oollddccoonntteexxtt, if not zero, contains the address on the lwp stack of a
uuccoonntteexxtt structure describing the previous user-level context (see
uuccoonntteexxtt..hh(3HEAD)). It is non-zero only if the lwp is executing in the
context of a signal handler.
pprr__ssyyssccaallll is the number of the system call, if any, being executed by
the lwp; it is non-zero if and only if the lwp is stopped on
PPRR__SSYYSSEENNTTRRYY or PPRR__SSYYSSEEXXIITT, or is asleep within a system call (
PPRR__AASSLLEEEEPP is set). If pprr__ssyyssccaallll is non-zero, pprr__nnssyyssaarrgg is the number
of arguments to the system call and pprr__ssyyssaarrgg contains the actual
arguments.
pprr__rrvvaall11, pprr__rrvvaall22, and pprr__eerrrrnnoo are defined only if the lwp is stopped
on PPRR__SSYYSSEEXXIITT or if the PPRR__VVFFOORRKKPP flag is set. If pprr__eerrrrnnoo is zero,
pprr__rrvvaall11 and pprr__rrvvaall22 contain the return values from the system call.
Otherwise, pprr__eerrrrnnoo contains the error number for the failing system
call (see <>).
pprr__ccllnnaammee contains the name of the lwp's scheduling class.
pprr__ttssttaammpp, if the lwp is stopped, contains a time stamp marking when
the lwp stopped, in real time seconds and nanoseconds since an
arbitrary time in the past.
pprr__uuttiimmee is the amount of user level CPU time used by this LWP.
pprr__ssttiimmee is the amount of system level CPU time used by this LWP.
pprr__uussttaacckk is the virtual address of the ssttaacckk__tt that contains the stack
boundaries for this LWP. See ggeettuussttaacckk(2) and __ssttaacckk__ggrrooww(3C).
pprr__iinnssttrr contains the machine instruction to which the lwp's program
counter refers. The amount of data retrieved from the process is
machine-dependent. On SPARC based machines, it is a 32-bit word. On
x86-based machines, it is a single byte. In general, the size is that
of the machine's smallest instruction. If PPRR__PPCCIINNVVAALL is set, pprr__iinnssttrr
is undefined; this occurs whenever the lwp is not stopped or when the
program counter refers to an invalid virtual address.
pprr__rreegg is an array holding the contents of a stopped lwp's general
registers.
SSPPAARRCC
On SPARC-based machines, the predefined constants
RR__GG00 ... RR__GG77, RR__OO00 ... RR__OO77, RR__LL00 ... RR__LL77, RR__II00
... RR__II77, RR__PPCC, RR__nnPPCC, and RR__YY can be used as
indices to refer to the corresponding registers;
previous register windows can be read from their
overflow locations on the stack (however, see the
ggwwiinnddoowwss file in the //pprroocc//_p_i_d//llwwpp//_l_w_p_i_d
subdirectory).
SSPPAARRCC VV88 ((3322--bbiitt))
For SPARC V8 (32-bit) controlling processes, the
predefined constants RR__PPSSRR, RR__WWIIMM, and RR__TTBBRR can
be used as indices to refer to the corresponding
special registers. For SPARC V9 (64-bit)
controlling processes, the predefined constants
RR__CCCCRR, RR__AASSII, and RR__FFPPRRSS can be used as indices to
refer to the corresponding special registers.
xx8866 ((3322--bbiitt))
For 32-bit x86 processes, the predefined constants
listed belowcan be used as indices to refer to the
corresponding registers.
SS
UESP
EFL
CS
EIP
ERR
TRAPNO
EAX
ECX
EDX
EBX
ESP
EBP
ESI
EDI
DS
ES
GS
The preceding constants are listed in
<>.
Note that a 32-bit process can run on an x86
64-bit system, using the constants listed above.
xx8866 ((6644--bbiitt))
To read the registers of a 32- oorr a 64-bit
process, a 64-bit x86 process should use the
predefined constants listed below.
REG_GSBASE
REG_FSBASE
REG_DS
REG_ES
REG_GS
REG_FS
REG_SS
REG_RSP
REG_RFL
REG_CS
REG_RIP
REG_ERR
REG_TRAPNO
REG_RAX
REG_RCX
REG_RDX
REG_RBX
REG_RBP
REG_RSI
REG_RDI
REG_R8
REG_R9
REG_R10
REG_R11
REG_R12
REG_R13
REG_R14
REG_R15
The preceding constants are listed in
<>.
pprr__ffpprreegg is a structure holding the contents of the floating-point
registers.
SPARC registers, both general and floating-point, as seen by a 64-bit
controlling process are the V9 versions of the registers, even if the
target process is a 32-bit (V8) process. V8 registers are a subset of
the V9 registers.
If the lwp is not stopped, all register values are undefined.
ppssiinnffoo
Contains miscellaneous information about the process and the
representative lwp needed by the ppss(1) command. ppssiinnffoo remains
accessible after a process becomes a _z_o_m_b_i_e. The file contains a ppssiinnffoo
structure which contains an embedded llwwppssiinnffoo structure for the
representative lwp, as follows:
typedef struct psinfo {
int pr_flag; /* process flags (DEPRECATED: see below) */
int pr_nlwp; /* number of active lwps in the process */
int pr_nzomb; /* number of zombie lwps in the process */
pid_t pr_pid; /* process id */
pid_t pr_ppid; /* process id of parent */
pid_t pr_pgid; /* process id of process group leader */
pid_t pr_sid; /* session id */
uid_t pr_uid; /* real user id */
uid_t pr_euid; /* effective user id */
gid_t pr_gid; /* real group id */
gid_t pr_egid; /* effective group id */
uintptr_t pr_addr; /* address of process */
size_t pr_size; /* size of process image in Kbytes */
size_t pr_rssize; /* resident set size in Kbytes */
dev_t pr_ttydev; /* controlling tty device (or PRNODEV) */
ushort_t pr_pctcpu; /* % of recent cpu time used by all lwps */
ushort_t pr_pctmem; /* % of system memory used by process */
timestruc_t pr_start; /* process start time, from the epoch */
timestruc_t pr_time; /* cpu time for this process */
timestruc_t pr_ctime; /* cpu time for reaped children */
char pr_fname[PRFNSZ]; /* name of exec'ed file */
char pr_psargs[PRARGSZ]; /* initial characters of arg list */
int pr_wstat; /* if zombie, the wait() status */
int pr_argc; /* initial argument count */
uintptr_t pr_argv; /* address of initial argument vector */
uintptr_t pr_envp; /* address of initial environment vector */
char pr_dmodel; /* data model of the process */
lwpsinfo_t pr_lwp; /* information for representative lwp */
taskid_t pr_taskid; /* task id */
projid_t pr_projid; /* project id */
poolid_t pr_poolid; /* pool id */
zoneid_t pr_zoneid; /* zone id */
ctid_t pr_contract; /* process contract id */
} psinfo_t;
Some of the entries in ppssiinnffoo, such as pprr__aaddddrr, refer to internal
kernel data structures and should not be expected to retain their
meanings across different versions of the operating system.
ppssiinnffoo__tt..pprr__ffllaagg is a deprecated interface that should no longer be
used. Applications currently relying on the SSSSYYSS bit in pprr__ffllaagg should
migrate to checking PPRR__IISSSSYYSS in the ppssttaattuuss structure's pprr__ffllaaggss field.
pprr__ppccttccppuu and pprr__ppccttmmeemm are 16-bit binary fractions in the range 0.0 to
1.0 with the binary point to the right of the high-order bit (1.0 ==
0x8000). pprr__ppccttccppuu is the summation over all lwps in the process.
pprr__llwwpp contains the ppss(1) information for the representative lwp. If
the process is a _z_o_m_b_i_e, pprr__nnllwwpp, pprr__nnzzoommbb, and pprr__llwwpp..pprr__llwwppiidd are
zero and the other fields of pprr__llwwpp are undefined:
typedef struct lwpsinfo {
int pr_flag; /* lwp flags (DEPRECATED: see below) */
id_t pr_lwpid; /* lwp id */
uintptr_t pr_addr; /* internal address of lwp */
uintptr_t pr_wchan; /* wait addr for sleeping lwp */
char pr_stype; /* synchronization event type */
char pr_state; /* numeric lwp state */
char pr_sname; /* printable character for pr_state */
char pr_nice; /* nice for cpu usage */
short pr_syscall; /* system call number (if in syscall) */
char pr_oldpri; /* pre-SVR4, low value is high priority */
char pr_cpu; /* pre-SVR4, cpu usage for scheduling */
int pr_pri; /* priority, high value = high priority */
ushort_t pr_pctcpu; /* % of recent cpu time used by this lwp */
timestruc_t pr_start; /* lwp start time, from the epoch */
timestruc_t pr_time; /* cpu time for this lwp */
char pr_clname[PRCLSZ]; /* scheduling class name */
char pr_name[PRFNSZ]; /* name of system lwp */
processorid_t pr_onpro; /* processor which last ran this lwp */
processorid_t pr_bindpro;/* processor to which lwp is bound */
psetid_t pr_bindpset; /* processor set to which lwp is bound */
lgrp_id_t pr_lgrp /* home lgroup */
} lwpsinfo_t;
Some of the entries in llwwppssiinnffoo, such as pprr__aaddddrr, pprr__wwcchhaann, pprr__ssttyyppee,
pprr__ssttaattee, and pprr__nnaammee, refer to internal kernel data structures and
should not be expected to retain their meanings across different
versions of the operating system.
llwwppssiinnffoo__tt..pprr__ffllaagg is a deprecated interface that should no longer be
used.
pprr__ppccttccppuu is a 16-bit binary fraction, as described above. It
represents the CCPPUU time used by the specific lwp. On a multi-processor
machine, the maximum value is 1/N, where N is the number of CCPPUUs.
pprr__ccoonnttrraacctt is the id of the process contract of which the process is a
member. See ccoonnttrraacctt(4) and pprroocceessss(4).
ccrreedd
Contains a description of the credentials associated with the process:
typedef struct prcred {
uid_t pr_euid; /* effective user id */
uid_t pr_ruid; /* real user id */
uid_t pr_suid; /* saved user id (from exec) */
gid_t pr_egid; /* effective group id */
gid_t pr_rgid; /* real group id */
gid_t pr_sgid; /* saved group id (from exec) */
int pr_ngroups; /* number of supplementary groups */
gid_t pr_groups[1]; /* array of supplementary groups */
} prcred_t;
The array of associated supplementary groups in pprr__ggrroouuppss is of
variable length; the ccrreedd file contains all of the supplementary
groups. pprr__nnggrroouuppss indicates the number of supplementary groups. (See
also the PPCCSSCCRREEDD and PPCCSSCCRREEDDXX control operations.)
pprriivv
Contains a description of the privileges associated with the process:
typedef struct prpriv {
uint32_t pr_nsets; /* number of privilege set */
uint32_t pr_setsize; /* size of privilege set */
uint32_t pr_infosize; /* size of supplementary data */
priv_chunk_t pr_sets[1]; /* array of sets */
} prpriv_t;
The actual dimension of the pprr__sseettss[] field is
pr_sets[pr_nsets][pr_setsize]
which is followed by additional information about the process state
pprr__iinnffoossiizzee bytes in size.
The full size of the structure can be computed using
PPRRIIVV__PPRRPPRRIIVV__SSIIZZEE(pprrpprriivv__tt **).
sseeccffllaaggss
This file contains the security-flags of the process. It contains a
description of the security flags associated with the process.
typedef struct prsecflags {
uint32_t pr_version; /* ABI Versioning of this structure */
secflagset_t pr_effective; /* Effective flags */
secflagset_t pr_inherit; /* Inheritable flags */
secflagset_t pr_lower; /* Lower flags */
secflagset_t pr_upper; /* Upper flags */
} prsecflags_t;
The pprr__vveerrssiioonn field is a version number for the structure, currently
PPRRSSEECCFFLLAAGGSS__VVEERRSSIIOONN__11.
ssiiggaacctt
Contains an array of ssiiggaaccttiioonn ssttrruuccttuurreess describing the current
dispositions of all signals associated with the traced process (see
ssiiggaaccttiioonn(2)). Signal numbers are displaced by 1 from array indices, so
that the action for signal number _n appears in position _n-1 of the
array.
aauuxxvv
Contains the initial values of the process's aux vector in an array of
aauuxxvv__tt structures (see <>). The values are those that were
passed by the operating system as startup information to the dynamic
linker.
llddtt
This file exists only on x86-based machines. It is non-empty only if
the process has established a local descriptor table (LLDDTT). If non-
empty, the file contains the array of currently active LLDDTT entries in
an array of elements of type ssttrruucctt ssssdd, defined in <>, one
element for each active LLDDTT entry.
mmaapp,, xxmmaapp
Contain information about the virtual address map of the process. The
map file contains an array of pprrmmaapp structures while the xmap file
contains an array of pprrxxmmaapp structures. Each structure describes a
contiguous virtual address region in the address space of the traced
process:
typedef struct prmap {
uintptr_tpr_vaddr; /* virtual address of mapping */
size_t pr_size; /* size of mapping in bytes */
char pr_mapname[PRMAPSZ]; /* name in /proc/pid/object */
offset_t pr_offset; /* offset into mapped object, if any */
int pr_mflags; /* protection and attribute flags */
int pr_pagesize; /* pagesize for this mapping in bytes */
int pr_shmid; /* SysV shared memory identifier */
} prmap_t;
typedef struct prxmap {
uintptr_t pr_vaddr; /* virtual address of mapping */
size_t pr_size; /* size of mapping in bytes */
char pr_mapname[PRMAPSZ]; /* name in /proc/pid/object */
offset_t pr_offset; /* offset into mapped object, if any */
int pr_mflags; /* protection and attribute flags */
int pr_pagesize; /* pagesize for this mapping in bytes */
int pr_shmid; /* SysV shared memory identifier */
dev_t pr_dev; /* device of mapped object, if any */
uint64_t pr_ino; /* inode of mapped object, if any */
size_t pr_rss; /* pages of resident memory */
size_t pr_anon; /* pages of resident anonymous memory */
size_t pr_locked; /* pages of locked memory */
uint64_t pr_hatpagesize; /* pagesize of mapping */
} prxmap_t;
pprr__vvaaddddrr is the virtual address of the mapping within the traced
process and pprr__ssiizzee is its size in bytes. pprr__mmaappnnaammee, if it does not
contain a null string, contains the name of a file in the oobbjjeecctt
directory (see below) that can be opened read-only to obtain a file
descriptor for the mapped file associated with the mapping. This
enables a debugger to find object file symbol tables without having to
know the real path names of the executable file and shared libraries of
the process. pprr__ooffffsseett is the 64-bit offset within the mapped file (if
any) to which the virtual address is mapped.
pprr__mmffllaaggss is a bit-mask of protection and attribute flags:
MMAA__RREEAADD
mapping is readable by the traced process.
MMAA__WWRRIITTEE
mapping is writable by the traced process.
MMAA__EEXXEECC
mapping is executable by the traced process.
MMAA__SSHHAARREEDD
mapping changes are shared by the mapped object.
MMAA__IISSMM
mapping is intimate shared memory (shared MMU
resources)
MMAAPP__NNOORREESSEERRVVEE
mapping does not have swap space reserved (mapped with
MAP_NORESERVE)
MMAA__SSHHMM
mapping System V shared memory
A contiguous area of the address space having the same underlying
mapped object may appear as multiple mappings due to varying read,
write, and execute attributes. The underlying mapped object does not
change over the range of a single mapping. An II//OO operation to a
mapping marked MMAA__SSHHAARREEDD fails if applied at a virtual address not
corresponding to a valid page in the underlying mapped object. A write
to a MMAA__SSHHAARREEDD mapping that is not marked MMAA__WWRRIITTEE fails. Reads and
writes to private mappings always succeed. Reads and writes to unmapped
addresses fail.
pprr__ppaaggeessiizzee is the page size for the mapping, currently always the
system pagesize.
pprr__sshhmmiidd is the shared memory identifier, if any, for the mapping. Its
value is --11 if the mapping is not System V shared memory. See
sshhmmggeett(2).
pprr__ddeevv is the device of the mapped object, if any, for the mapping. Its
value is PPRRNNOODDEEVV (-1) if the mapping does not have a device.
pprr__iinnoo is the inode of the mapped object, if any, for the mapping. Its
contents are only valid if pprr__ddeevv is not PPRRNNOODDEEVV..
pprr__rrssss is the number of resident pages of memory for the mapping. The
number of resident bytes for the mapping may be determined by
multiplying pprr__rrssss by the page size given by pprr__ppaaggeessiizzee..
pprr__aannoonn is the number of resident anonymous memory pages (pages which
are private to this process) for the mapping.
pprr__lloocckkeedd is the number of locked pages for the mapping. Pages which
are locked are always resident in memory.
pprr__hhaattppaaggeessiizzee is the size, in bytes, of the HHAATT (MMMMUU) translation for
the mapping. pprr__hhaattppaaggeessiizzee may be different than pprr__ppaaggeessiizzee.. The
possible values are hardware architecture specific, and may change over
a mapping's lifetime.
rrmmaapp
Contains information about the reserved address ranges of the process.
The file contains an array of pprrmmaapp structures, as defined above for
the mmaapp file. Each structure describes a contiguous virtual address
region in the address space of the traced process that is reserved by
the system in the sense that an mmmmaapp(2) system call that does not
specify MMAAPP__FFIIXXEEDD will not use any part of it for the new mapping.
Examples of such reservations include the address ranges reserved for
the process stack and the individual thread stacks of a multi-threaded
process.
ccwwdd
A symbolic link to the process's current working directory. See
cchhddiirr(2). A rreeaaddlliinnkk(2) of //pprroocc//_p_i_d/cwd yields a null string.
However, it can be opened, listed, and searched as a directory, and can
be the target of cchhddiirr(2).
rroooott
A symbolic link to the process's root directory. //pprroocc//_p_i_d//rroooott can
differ from the system root directory if the process or one of its
ancestors executed cchhrroooott(2) as super user. It has the same semantics
as //pprroocc//_p_i_d//ccwwdd.
ffdd
A directory containing references to the open files of the process.
Each entry is a decimal number corresponding to an open file descriptor
in the process.
If an entry refers to a regular file, it can be opened with normal file
system semantics but, to ensure that the controlling process cannot
gain greater access than the controlled process, with no file access
modes other than its read/write open modes in the controlled process.
If an entry refers to a directory, it can be accessed with the same
semantics as //pprroocc//_p_i_d/cwd. An attempt to open any other type of entry
fails with EEAACCCCEESS.
oobbjjeecctt
A directory containing read-only files with names corresponding to the
pprr__mmaappnnaammee entries in the mmaapp and ppaaggeeddaattaa files. Opening such a file
yields a file descriptor for the underlying mapped file associated with
an address-space mapping in the process. The file name aa..oouutt appears in
the directory as an alias for the process's executable file.
The oobbjjeecctt directory makes it possible for a controlling process to
gain access to the object file and any shared libraries (and
consequently the symbol tables) without having to know the actual path
names of the executable files.
ppaatthh
A directory containing symbolic links to files opened by the process.
The directory includes one entry for ccwwdd and rroooott. The directory also
contains a numerical entry for each file descriptor in the ffdd
directory, and entries matching those in the oobbjjeecctt directory. If this
information is not available, any attempt to read the contents of the
symbolic link will fail. This is most common for files that do not
exist in the filesystem namespace (such as FFIIFFOOs and sockets), but can
also happen for regular files. For the file descriptor entries, the
path may be different from the one used by the process to open the
file.
ppaaggeeddaattaa
Opening the page data file enables tracking of address space references
and modifications on a per-page basis.
A rreeaadd(2) of the page data file descriptor returns structured page data
and atomically clears the page data maintained for the file by the
system. That is to say, each read returns data collected since the last
read; the first read returns data collected since the file was opened.
When the call completes, the read buffer contains the following
structure as its header and thereafter contains a number of section
header structures and associated byte arrays that must be accessed by
walking linearly through the buffer.
typedef struct prpageheader {
timestruc_t pr_tstamp; /* real time stamp, time of read() */
ulong_t pr_nmap; /* number of address space mappings */
ulong_t pr_npage; /* total number of pages */
} prpageheader_t;
The header is followed by pprr__nnmmaapp pprraassmmaapp structures and associated
data arrays. The pprraassmmaapp structure contains the following elements:
typedef struct prasmap {
uintptr_t pr_vaddr; /* virtual address of mapping */
ulong_t pr_npage; /* number of pages in mapping */
char pr_mapname[PRMAPSZ]; /* name in /proc/pid/object */
offset_t pr_offset; /* offset into mapped object, if any */
int pr_mflags; /* protection and attribute flags */
int pr_pagesize; /* pagesize for this mapping in bytes */
int pr_shmid; /* SysV shared memory identifier */
} prasmap_t;
Each section header is followed by pprr__nnppaaggee bytes, one byte for each
page in the mapping, plus 0-7 null bytes at the end so that the next
pprraassmmaapp structure begins on an eight-byte aligned boundary. Each data
byte may contain these flags:
PPGG__RREEFFEERREENNCCEEDD
page has been referenced.
PPGG__MMOODDIIFFIIEEDD
page has been modified.
If the read buffer is not large enough to contain all of the page data,
the read fails with EE22BBIIGG and the page data is not cleared. The
required size of the read buffer can be determined through ffssttaatt(2).
Application of llsseeeekk(2) to the page data file descriptor is
ineffective; every read starts from the beginning of the file. Closing
the page data file descriptor terminates the system overhead associated
with collecting the data.
More than one page data file descriptor for the same process can be
opened, up to a system-imposed limit per traced process. A read of one
does not affect the data being collected by the system for the others.
An open of the page data file will fail with EENNOOMMEEMM if the system-
imposed limit would be exceeded.
wwaattcchh
Contains an array of pprrwwaattcchh structures, one for each watched area
established by the PPCCWWAATTCCHH control operation. See PPCCWWAATTCCHH for details.
uussaaggee
Contains process usage information described by a pprruussaaggee structure
which contains at least the following fields:
typedef struct prusage {
id_t pr_lwpid; /* lwp id. 0: process or defunct */
int pr_count; /* number of contributing lwps */
timestruc_t pr_tstamp; /* real time stamp, time of read() */
timestruc_t pr_create; /* process/lwp creation time stamp */
timestruc_t pr_term; /* process/lwp termination time stamp */
timestruc_t pr_rtime; /* total lwp real (elapsed) time */
timestruc_t pr_utime; /* user level CPU time */
timestruc_t pr_stime; /* system call CPU time */
timestruc_t pr_ttime; /* other system trap CPU time */
timestruc_t pr_tftime; /* text page fault sleep time */
timestruc_t pr_dftime; /* data page fault sleep time */
timestruc_t pr_kftime; /* kernel page fault sleep time */
timestruc_t pr_ltime; /* user lock wait sleep time */
timestruc_t pr_slptime; /* all other sleep time */
timestruc_t pr_wtime; /* wait-cpu (latency) time */
timestruc_t pr_stoptime; /* stopped time */
ulong_t pr_minf; /* minor page faults */
ulong_t pr_majf; /* major page faults */
ulong_t pr_nswap; /* swaps */
ulong_t pr_inblk; /* input blocks */
ulong_t pr_oublk; /* output blocks */
ulong_t pr_msnd; /* messages sent */
ulong_t pr_mrcv; /* messages received */
ulong_t pr_sigs; /* signals received */
ulong_t pr_vctx; /* voluntary context switches */
ulong_t pr_ictx; /* involuntary context switches */
ulong_t pr_sysc; /* system calls */
ulong_t pr_ioch; /* chars read and written */
} prusage_t;
Microstate accounting is now continuously enabled. While this
information was previously an estimate, if microstate accounting were
not enabled, the current information is now never an estimate
represents time the process has spent in various states.
llssttaattuuss
Contains a pprrhheeaaddeerr structure followed by an array of llwwppssttaattuuss
structures, one for each active lwp in the process (see also
//pprroocc//_p_i_d//llwwpp//_l_w_p_i_d/llwwppssttaattuuss, below). The pprrhheeaaddeerr structure describes
the number and size of the array entries that follow.
typedef struct prheader {
long pr_nent; /* number of entries */
size_t pr_entsize; /* size of each entry, in bytes */
} prheader_t;
The llwwppssttaattuuss structure may grow by the addition of elements at the end
in future releases of the system. Programs must use pprr__eennttssiizzee in the
file header to index through the array. These comments apply to all
//pprroocc files that include a pprrhheeaaddeerr structure (llppssiinnffoo and lluussaaggee,
below).
llppssiinnffoo
Contains a pprrhheeaaddeerr structure followed by an array of llwwppssiinnffoo
structures, one for eachactive and zombie lwp in the process. See also
//pprroocc//_p_i_d//llwwpp//_l_w_p_i_d/llwwppssiinnffoo, below.
lluussaaggee
Contains a pprrhheeaaddeerr structure followed by an array of pprruussaaggee
structures, one for each active lwp in the process, plus an additional
element at the beginning that contains the summation over all defunct
lwps (lwps that once existed but no longer exist in the process).
Excluding the pprr__llwwppiidd, pprr__ttssttaammpp, pprr__ccrreeaattee, and pprr__tteerrmm entries, the
entry-by-entry summation over all these structures is the definition of
the process usage information obtained from the uussaaggee file. (See also
//pprroocc//_p_i_d//llwwpp//_l_w_p_i_d/llwwppuussaaggee, below.)
llwwpp
A directory containing entries each of which names an active or zombie
lwp within the process. These entries are themselves directories
containing additional files as described below. Only the llwwppssiinnffoo file
exists in the directory of a zombie lwp.
SSTTRRUUCCTTUURREE OOFF //pprroocc//_p_i_d//llwwpp//_l_w_p_i_d
A given directory //pprroocc//_p_i_d//llwwpp//_l_w_p_i_d contains the following entries:
llwwppccttll
Write-only control file. The messages written to this file affect the
specific lwp rather than the representative lwp, as is the case for the
process's ccttll file.
llwwppssttaattuuss
lwp-specific state information. This file contains the llwwppssttaattuuss
structure for the specific lwp as described above for the
representative lwp in the process's ssttaattuuss file.
llwwppssiinnffoo
lwp-specific ppss(1) information. This file contains the llwwppssiinnffoo
structure for the specific lwp as described above for the
representative lwp in the process's ppssiinnffoo file. The llwwppssiinnffoo file
remains accessible after an lwp becomes a zombie.
llwwppuussaaggee
This file contains the pprruussaaggee structure for the specific lwp as
described above for the process's uussaaggee file.
ggwwiinnddoowwss
This file exists only on SPARC based machines. If it is non-empty, it
contains a ggwwiinnddoowwss__tt structure, defined in <>, with the
values of those SPARC register windows that could not be stored on the
stack when the lwp stopped. Conditions under which register windows are
not stored on the stack are: the stack pointer refers to nonexistent
process memory or the stack pointer is improperly aligned. If the lwp
is not stopped or if there are no register windows that could not be
stored on the stack, the file is empty (the usual case).
xxrreeggss
Extra state registers. The extra state register set is architecture
dependent; this file is empty if the system does not support extra
state registers. If the file is non-empty, it contains an architecture
dependent structure of type pprrxxrreeggsseett__tt, defined in <
>, with
the values of the lwp's extra state registers. If the lwp is not
stopped, all register values are undefined. See also the PPCCSSXXRREEGG
control operation, below.
aassrrss
This file exists only for 64-bit SPARC V9 processes. It contains an
aassrrsseett__tt structure, defined in , containing the values of
the lwp's platform-dependent ancillary state registers. If the lwp is
not stopped, all register values are undefined. See also the PPCCSSAASSRRSS
control operation, below.
ssppyymmaasstteerr
For an agent lwp (see PPCCAAGGEENNTT), this file contains a ppssiinnffoo__tt structure
that corresponds to the process that created the agent lwp at the time
the agent was created. This structure is identical to that retrieved
via the ppssiinnffoo file, with one modification: the pprr__ttiimmee field does not
correspond to the CPU time for the process, but rather to the creation
time of the agent lwp.
tteemmppllaatteess
A directory which contains references to the active templates for the
lwp, named by the contract type. Changes made to an active template
descriptor do not affect the original template which was activated,
though they do affect the active template. It is not possible to
activate an active template descriptor. See ccoonnttrraacctt(4).
CCOONNTTRROOLL MMEESSSSAAGGEESS
Process state changes are effected through messages written to a
process's ccttll file or to an individual lwp's llwwppccttll file. All control
messages consist of a lloonngg that names the specific operation followed
by additional data containing the operand, if any.
Multiple control messages may be combined in a single wwrriittee(2) (or
wwrriitteevv(2)) to a control file, but no partial writes are permitted. That
is, each control message, operation code plus operand, if any, must be
presented in its entirety to the wwrriittee(2) and not in pieces over
several system calls. If a control operation fails, no subsequent
operations contained in the same wwrriittee(2) are attempted.
Descriptions of the allowable control messages follow. In all cases,
writing a message to a control file for a process or lwp that has
terminated elicits the error EENNOOEENNTT.
PPCCSSTTOOPP PPCCDDSSTTOOPP PPCCWWSSTTOOPP PPCCTTWWSSTTOOPP
When applied to the process control file, PPCCSSTTOOPP directs all lwps to
stop and waits for them to stop, PPCCDDSSTTOOPP directs all lwps to stop
without waiting for them to stop, and PPCCWWSSTTOOPP simply waits for all lwps
to stop. When applied to an lwp control file, PPCCSSTTOOPP directs the
specific lwp to stop and waits until it has stopped, PPCCDDSSTTOOPP directs
the specific lwp to stop without waiting for it to stop, and PPCCWWSSTTOOPP
simply waits for the specific lwp to stop. When applied to an lwp
control file, PPCCSSTTOOPP and PPCCWWSSTTOOPP complete when the lwp stops on an
event of interest, immediately if already so stopped; when applied to
the process control file, they complete when every lwp has stopped
either on an event of interest or on a PPRR__SSUUSSPPEENNDDEEDD stop.
PPCCTTWWSSTTOOPP is identical to PPCCWWSSTTOOPP except that it enables the operation
to time out, to avoid waiting forever for a process or lwp that may
never stop on an event of interest. PPCCTTWWSSTTOOPP takes a lloonngg operand
specifying a number of milliseconds; the wait will terminate
successfully after the specified number of milliseconds even if the
process or lwp has not stopped; a timeout value of zero makes the
operation identical to PPCCWWSSTTOOPP.
An ``event of interest'' is either a PPRR__RREEQQUUEESSTTEEDD stop or a stop that
has been specified in the process's tracing flags (set by PPCCSSTTRRAACCEE,
PPCCSSFFAAUULLTT, PPCCSSEENNTTRRYY, and PPCCSSEEXXIITT). PPRR__JJOOBBCCOONNTTRROOLL and PPRR__SSUUSSPPEENNDDEEDD stops
are specifically not events of interest. (An lwp may stop twice due to
a stop signal, first showing PPRR__SSIIGGNNAALLLLEEDD if the signal is traced and
again showing PPRR__JJOOBBCCOONNTTRROOLL if the lwp is set running without clearing
the signal.) If PPCCSSTTOOPP or PPCCDDSSTTOOPP is applied to an lwp that is stopped,
but not on an event of interest, the stop directive takes effect when
the lwp is restarted by the competing mechanism. At that time, the lwp
enters a PPRR__RREEQQUUEESSTTEEDD stop before executing any user-level code.
A write of a control message that blocks is interruptible by a signal
so that, for example, an aallaarrmm(2) can be set to avoid waiting forever
for a process or lwp that may never stop on an event of interest. If
PPCCSSTTOOPP is interrupted, the lwp stop directives remain in effect even
though the wwrriittee(2) returns an error. (Use of PPCCTTWWSSTTOOPP with a non-zero
timeout is recommended over PPCCWWSSTTOOPP with an aallaarrmm(2).)
A system process (indicated by the PPRR__IISSSSYYSS flag) never executes at
user level, has no user-level address space visible through //pprroocc, and
cannot be stopped. Applying one of these operations to a system process
or any of its lwps elicits the error EEBBUUSSYY.
PPCCRRUUNN
Make an lwp runnable again after a stop. This operation takes a lloonngg
operand containing zero or more of the following flags:
PPRRCCSSIIGG
clears the current signal, if any (see PPCCCCSSIIGG).
PPRRCCFFAAUULLTT
clears the current fault, if any (see PPCCCCFFAAUULLTT).
PPRRSSTTEEPP
directs the lwp to execute a single machine instruction. On
completion of the instruction, a trace trap occurs. If
FFLLTTTTRRAACCEE is being traced, the lwp stops; otherwise, it is
sent SSIIGGTTRRAAPP. If SSIIGGTTRRAAPP is being traced and is not
blocked, the lwp stops. When the lwp stops on an event of
interest, the single-step directive is cancelled, even if
the stop occurs before the instruction is executed. This
operation requires hardware and operating system support
and may not be implemented on all processors. It is
implemented on SPARC and x86-based machines.
PPRRSSAABBOORRTT
is meaningful only if the lwp is in a PPRR__SSYYSSEENNTTRRYY stop or
is marked PPRR__AASSLLEEEEPP; it instructs the lwp to abort
execution of the system call (see PPCCSSEENNTTRRYY and PPCCSSEEXXIITT).
PPRRSSTTOOPP
directs the lwp to stop again as soon as possible after
resuming execution (see PPCCDDSSTTOOPP). In particular, if the lwp
is stopped on PPRR__SSIIGGNNAALLLLEEDD or PPRR__FFAAUULLTTEEDD, the next stop
will show PPRR__RREEQQUUEESSTTEEDD, no other stop will have intervened,
and the lwp will not have executed any user-level code.
When applied to an lwp control file, PPCCRRUUNN clears any outstanding
directed-stop request and makes the specific lwp runnable. The
operation fails with EEBBUUSSYY if the specific lwp is not stopped on an
event of interest or has not been directed to stop or if the agent lwp
exists and this is not the agent lwp (see PPCCAAGGEENNTT).
When applied to the process control file, a representative lwp is
chosen for the operation as described for //pprroocc//_p_i_d//ssttaattuuss. The
operation fails with EEBBUUSSYY if the representative lwp is not stopped on
an event of interest or has not been directed to stop or if the agent
lwp exists. If PPRRSSTTEEPP or PPRRSSTTOOPP was requested, the representative lwp
is made runnable and its outstanding directed-stop request is cleared;
otherwise all outstanding directed-stop requests are cleared and, if it
was stopped on an event of interest, the representative lwp is marked
PPRR__RREEQQUUEESSTTEEDD. If, as a consequence, all lwps are in the PPRR__RREEQQUUEESSTTEEDD or
PPRR__SSUUSSPPEENNDDEEDD stop state, all lwps showing PPRR__RREEQQUUEESSTTEEDD are made
runnable.
PPCCSSTTRRAACCEE
Define a set of signals to be traced in the process. The receipt of one
of these signals by an lwp causes the lwp to stop. The set of signals
is defined using an operand ssiiggsseett__tt contained in the control message.
Receipt of SSIIGGKKIILLLL cannot be traced; if specified, it is silently
ignored.
If a signal that is included in an lwp's held signal set (the signal
mask) is sent to the lwp, the signal is not received and does not cause
a stop until it is removed from the held signal set, either by the lwp
itself or by setting the held signal set with PPCCSSHHOOLLDD.
PPCCCCSSIIGG
The current signal, if any, is cleared from the specific or
representative lwp.
PPCCSSSSIIGG
The current signal and its associated signal information for the
specific or representative lwp are set according to the contents of the
operand ssiiggiinnffoo structure (see <>). If the specified
signal number is zero, the current signal is cleared. The semantics of
this operation are different from those of kkiillll(2) in that the signal
is delivered to the lwp immediately after execution is resumed (even if
it is being blocked) and an additional PPRR__SSIIGGNNAALLLLEEDD stop does not
intervene even if the signal is traced. Setting the current signal to
SSIIGGKKIILLLL terminates the process immediately.
PPCCKKIILLLL
If applied to the process control file, a signal is sent to the process
with semantics identical to those of kkiillll(2). If applied to an lwp
control file, a directed signal is sent to the specific lwp. The signal
is named in a lloonngg operand contained in the message. Sending SSIIGGKKIILLLL
terminates the process immediately.
PPCCUUNNKKIILLLL
A signal is deleted, that is, it is removed from the set of pending
signals. If applied to the process control file, the signal is deleted
from the process's pending signals. If applied to an lwp control file,
the signal is deleted from the lwp's pending signals. The current
signal (if any) is unaffected. The signal is named in a lloonngg operand in
the control message. It is an error (EEIINNVVAALL) to attempt to delete
SSIIGGKKIILLLL.
PPCCSSHHOOLLDD
Set the set of held signals for the specific or representative lwp
(signals whose delivery will be blocked if sent to the lwp). The set of
signals is specified with a ssiiggsseett__tt operand. SSIIGGKKIILLLL and SSIIGGSSTTOOPP
cannot be held; if specified, they are silently ignored.
PPCCSSFFAAUULLTT
Define a set of hardware faults to be traced in the process. On
incurring one of these faults, an lwp stops. The set is defined via the
operand ffllttsseett__tt structure. Fault names are defined in <>
and include the following. Some of these may not occur on all
processors; there may be processor-specific faults in addition to
these.
FFLLTTIILLLL
illegal instruction
FFLLTTPPRRIIVV
privileged instruction
FFLLTTBBPPTT
breakpoint trap
FFLLTTTTRRAACCEE
trace trap (single-step)
FFLLTTWWAATTCCHH
watchpoint trap
FFLLTTAACCCCEESSSS
memory access fault (bus error)
FFLLTTBBOOUUNNDDSS
memory bounds violation
FFLLTTIIOOVVFF
integer overflow
FFLLTTIIZZDDIIVV
integer zero divide
FFLLTTFFPPEE
floating-point exception
FFLLTTSSTTAACCKK
unrecoverable stack fault
FFLLTTPPAAGGEE
recoverable page fault
When not traced, a fault normally results in the posting of a signal to
the lwp that incurred the fault. If an lwp stops on a fault, the signal
is posted to the lwp when execution is resumed unless the fault is
cleared by PPCCCCFFAAUULLTT or by the PPRRCCFFAAUULLTT option of PPCCRRUUNN. FFLLTTPPAAGGEE is an
exception; no signal is posted. The pprr__iinnffoo field in the llwwppssttaattuuss
structure identifies the signal to be sent and contains machine-
specific information about the fault.
PPCCCCFFAAUULLTT
The current fault, if any, is cleared; the associated signal will not
be sent to the specific or representative lwp.
PPCCSSEENNTTRRYY PPCCSSEEXXIITT
These control operations instruct the process's lwps to stop on entry
to or exit from specified system calls. The set of system calls to be
traced is defined via an operand ssyysssseett__tt structure.
When entry to a system call is being traced, an lwp stops after having
begun the call to the system but before the system call arguments have
been fetched from the lwp. When exit from a system call is being
traced, an lwp stops on completion of the system call just prior to
checking for signals and returning to user level. At this point, all
return values have been stored into the lwp's registers.
If an lwp is stopped on entry to a system call (PPRR__SSYYSSEENNTTRRYY) or when
sleeping in an interruptible system call (PPRR__AASSLLEEEEPP is set), it may be
instructed to go directly to system call exit by specifying the
PPRRSSAABBOORRTT flag in a PPCCRRUUNN control message. Unless exit from the system
call is being traced, the lwp returns to user level showing EEIINNTTRR.
PPCCWWAATTCCHH
Set or clear a watched area in the controlled process from a pprrwwaattcchh
structure operand:
typedef struct prwatch {
uintptr_t pr_vaddr; /* virtual address of watched area */
size_t pr_size; /* size of watched area in bytes */
int pr_wflags; /* watch type flags */
} prwatch_t;
pprr__vvaaddddrr specifies the virtual address of an area of memory to be
watched in the controlled process. pprr__ssiizzee specifies the size of the
area, in bytes. pprr__wwffllaaggss specifies the type of memory access to be
monitored as a bit-mask of the following flags:
WWAA__RREEAADD
read access
WWAA__WWRRIITTEE
write access
WWAA__EEXXEECC
execution access
WWAA__TTRRAAPPAAFFTTEERR
trap after the instruction completes
If pprr__wwffllaaggss is non-empty, a watched area is established for the
virtual address range specified by pprr__vvaaddddrr and pprr__ssiizzee. If pprr__wwffllaaggss
is empty, any previously-established watched area starting at the
specified virtual address is cleared; pprr__ssiizzee is ignored.
A watchpoint is triggered when an lwp in the traced process makes a
memory reference that covers at least one byte of a watched area and
the memory reference is as specified in pprr__wwffllaaggss. When an lwp triggers
a watchpoint, it incurs a watchpoint trap. If FFLLTTWWAATTCCHH is being traced,
the lwp stops; otherwise, it is sent a SSIIGGTTRRAAPP signal; if SSIIGGTTRRAAPP is
being traced and is not blocked, the lwp stops.
The watchpoint trap occurs before the instruction completes unless
WWAA__TTRRAAPPAAFFTTEERR was specified, in which case it occurs after the
instruction completes. If it occurs before completion, the memory is
not modified. If it occurs after completion, the memory is modified (if
the access is a write access).
Physical i/o is an exception for watchpoint traps. In this instance,
there is no guarantee that memory before the watched area has already
been modified (or in the case of WWAA__TTRRAAPPAAFFTTEERR, that the memory
following the watched area has not been modified) when the watchpoint
trap occurs and the lwp stops.
pprr__iinnffoo in the llwwppssttaattuuss structure contains information pertinent to
the watchpoint trap. In particular, the ssii__aaddddrr field contains the
virtual address of the memory reference that triggered the watchpoint,
and the ssii__ccooddee field contains one of TTRRAAPP__RRWWAATTCCHH, TTRRAAPP__WWWWAATTCCHH, or
TTRRAAPP__XXWWAATTCCHH, indicating read, write, or execute access, respectively.
The ssii__ttrraappaafftteerr field is zero unless WWAA__TTRRAAPPAAFFTTEERR is in effect for
this watched area; non-zero indicates that the current instruction is
not the instruction that incurred the watchpoint trap. The ssii__ppcc field
contains the virtual address of the instruction that incurred the trap.
A watchpoint trap may be triggered while executing a system call that
makes reference to the traced process's memory. The lwp that is
executing the system call incurs the watchpoint trap while still in the
system call. If it stops as a result, the llwwppssttaattuuss structure contains
the system call number and its arguments. If the lwp does not stop, or
if it is set running again without clearing the signal or fault, the
system call fails with EEFFAAUULLTT. If WWAA__TTRRAAPPAAFFTTEERR was specified, the
memory reference will have completed and the memory will have been
modified (if the access was a write access) when the watchpoint trap
occurs.
If more than one of WWAA__RREEAADD, WWAA__WWRRIITTEE, and WWAA__EEXXEECC is specified for a
watched area, and a single instruction incurs more than one of the
specified types, only one is reported when the watchpoint trap occurs.
The precedence is WWAA__EEXXEECC, WWAA__RREEAADD, WWAA__WWRRIITTEE (WWAA__EEXXEECC and WWAA__RREEAADD take
precedence over WWAA__WWRRIITTEE), unless WWAA__TTRRAAPPAAFFTTEERR was specified, in which
case it is WWAA__WWRRIITTEE, WWAA__RREEAADD, WWAA__EEXXEECC (WWAA__WWRRIITTEE takes precedence).
PPCCWWAATTCCHH fails with EEIINNVVAALL if an attempt is made to specify overlapping
watched areas or if pprr__wwffllaaggss contains flags other than those specified
above. It fails with EENNOOMMEEMM if an attempt is made to establish more
watched areas than the system can support (the system can support
thousands).
The child of a vvffoorrkk(2) borrows the parent's address space. When a
vvffoorrkk(2) is executed by a traced process, all watched areas established
for the parent are suspended until the child terminates or performs an
eexxeecc(2). Any watched areas established independently in the child are
cancelled when the parent resumes after the child's termination or
eexxeecc(2). PPCCWWAATTCCHH fails with EEBBUUSSYY if applied to the parent of a
vvffoorrkk(2) before the child has terminated or performed an eexxeecc(2). The
PPRR__VVFFOORRKKPP flag is set in the ppssttaattuuss structure for such a parent
process.
Certain accesses of the traced process's address space by the operating
system are immune to watchpoints. The initial construction of a signal
stack frame when a signal is delivered to an lwp will not trigger a
watchpoint trap even if the new frame covers watched areas of the
stack. Once the signal handler is entered, watchpoint traps occur
normally. On SPARC based machines, register window overflow and
underflow will not trigger watchpoint traps, even if the register
window save areas cover watched areas of the stack.
Watched areas are not inherited by child processes, even if the traced
process's inherit-on-fork mode, PPRR__FFOORRKK, is set (see PPCCSSEETT, below).
All watched areas are cancelled when the traced process performs a
successful eexxeecc(2).
PPCCSSEETT PPCCUUNNSSEETT
PPCCSSEETT sets one or more modes of operation for the traced process.
PPCCUUNNSSEETT unsets these modes. The modes to be set or unset are specified
by flags in an operand lloonngg in the control message:
PPRR__FFOORRKK
(inherit-on-fork): When set, the process's tracing flags
and its inherit-on-fork mode are inherited by the child of
a ffoorrkk(2), ffoorrkk11(2), or vvffoorrkk(2). When unset, child
processes start with all tracing flags cleared.
PPRR__RRLLCC
(run-on-last-close): When set and the last writable //pprroocc
file descriptor referring to the traced process or any of
its lwps is closed, all of the process's tracing flags and
watched areas are cleared, any outstanding stop directives
are canceled, and if any lwps are stopped on events of
interest, they are set running as though PPCCRRUUNN had been
applied to them. When unset, the process's tracing flags
and watched areas are retained and lwps are not set
running on last close.
PPRR__KKLLCC
(kill-on-last-close): When set and the last writable //pprroocc
file descriptor referring to the traced process or any of
its lwps is closed, the process is terminated with
SSIIGGKKIILLLL.
PPRR__AASSYYNNCC
(asynchronous-stop): When set, a stop on an event of
interest by one lwp does not directly affect any other lwp
in the process. When unset and an lwp stops on an event of
interest other than PPRR__RREEQQUUEESSTTEEDD, all other lwps in the
process are directed to stop.
PPRR__MMSSAACCCCTT
(microstate accounting): Microstate accounting is now
continuously enabled. This flag is deprecated and no
longer has any effect upon microstate accounting.
Applications may toggle this flag; however, microstate
accounting will remain enabled regardless.
PPRR__MMSSFFOORRKK
(inherit microstate accounting): All processes now inherit
microstate accounting, as it is continuously enabled. This
flag has been deprecated and its use no longer has any
effect upon the behavior of microstate accounting.
PPRR__BBPPTTAADDJJ
(breakpoint trap pc adjustment): On x86-based machines, a
breakpoint trap leaves the program counter (the EEIIPP)
referring to the breakpointed instruction plus one byte.
When PPRR__BBPPTTAADDJJ is set, the system will adjust the program
counter back to the location of the breakpointed
instruction when the lwp stops on a breakpoint. This flag
has no effect on SPARC based machines, where breakpoint
traps leave the program counter referring to the
breakpointed instruction.
PPRR__PPTTRRAACCEE
(ptrace-compatibility): When set, a stop on an event of
interest by the traced process is reported to the parent
of the traced process by wwaaiitt(3C), SSIIGGTTRRAAPP is sent to the
traced process when it executes a successful eexxeecc(2),
setuid/setgid flags are not honored for execs performed by
the traced process, any exec of an object file that the
traced process cannot read fails, and the process dies
when its parent dies. This mode is deprecated; it is
provided only to allow ppttrraaccee(3C) to be implemented as a
library function using //pprroocc.
It is an error (EEIINNVVAALL) to specify flags other than those described
above or to apply these operations to a system process. The current
modes are reported in the pprr__ffllaaggss field of //pprroocc//_p_i_d//ssttaattuuss and
//pprroocc//_p_i_d//llwwpp//_l_w_p//llwwppssttaattuuss.
PPCCSSRREEGG
Set the general registers for the specific or representative lwp
according to the operand pprrggrreeggsseett__tt structure.
On SPARC based systems, only the condition-code bits of the processor-
status register (R_PSR) of SPARC V8 (32-bit) processes can be modified
by PPCCSSRREEGG. Other privileged registers cannot be modified at all.
On x86-based systems, only certain bits of the flags register (EFL) can
be modified by PPCCSSRREEGG: these include the condition codes, direction-
bit, and overflow-bit.
PPCCSSRREEGG fails with EEBBUUSSYY if the lwp is not stopped on an event of
interest.
PPCCSSVVAADDDDRR
Set the address at which execution will resume for the specific or
representative lwp from the operand lloonngg. On SPARC based systems, both
%pc and %npc are set, with %npc set to the instruction following the
virtual address. On x86-based systems, only %eip is set. PPCCSSVVAADDDDRR fails
with EEBBUUSSYY if the lwp is not stopped on an event of interest.
PPCCSSFFPPRREEGG
Set the floating-point registers for the specific or representative lwp
according to the operand pprrffpprreeggsseett__tt structure. An error (EEIINNVVAALL) is
returned if the system does not support floating-point operations (no
floating-point hardware and the system does not emulate floating-point
machine instructions). PPCCSSFFPPRREEGG fails with EEBBUUSSYY if the lwp is not
stopped on an event of interest.
PPCCSSXXRREEGG
Set the extra state registers for the specific or representative lwp
according to the architecture-dependent operand pprrxxrreeggsseett__tt structure.
An error (EEIINNVVAALL) is returned if the system does not support extra
state registers. PPCCSSXXRREEGG fails with EEBBUUSSYY if the lwp is not stopped on
an event of interest.
PPCCSSAASSRRSS
Set the ancillary state registers for the specific or representative
lwp according to the SPARC V9 platform-dependent operand aassrrsseett__tt
structure. An error (EEIINNVVAALL) is returned if either the target process
or the controlling process is not a 64-bit SPARC V9 process. Most of
the ancillary state registers are privileged registers that cannot be
modified. Only those that can be modified are set; all others are
silently ignored. PPCCSSAASSRRSS fails with EEBBUUSSYY if the lwp is not stopped on
an event of interest.
PPCCAAGGEENNTT
Create an agent lwp in the controlled process with register values from
the operand pprrggrreeggsseett__tt structure (see PPCCSSRREEGG, above). The agent lwp is
created in the stopped state showing PPRR__RREEQQUUEESSTTEEDD and with its held
signal set (the signal mask) having all signals except SSIIGGKKIILLLL and
SSIIGGSSTTOOPP blocked.
The PPCCAAGGEENNTT operation fails with EEBBUUSSYY unless the process is fully
stopped via //pprroocc, that is, unless all of the lwps in the process are
stopped either on events of interest or on PPRR__SSUUSSPPEENNDDEEDD, or are stopped
on PPRR__JJOOBBCCOONNTTRROOLL and have been directed to stop via PPCCDDSSTTOOPP. It fails
with EEBBUUSSYY if an agent lwp already exists. It fails with EENNOOMMEEMM if
system resources for creating new lwps have been exhausted.
Any PPCCRRUUNN operation applied to the process control file or to the
control file of an lwp other than the agent lwp fails with EEBBUUSSYY as
long as the agent lwp exists. The agent lwp must be caused to terminate
by executing the SSYYSS__llwwpp__eexxiitt system call trap before the process can
be restarted.
Once the agent lwp is created, its lwp-ID can be found by reading the
process status file. To facilitate opening the agent lwp's control and
status files, the directory name //pprrooppcc//_p_i_d//llwwpp//aaggeenntt is accepted for
lookup operations as an invisible alias for //pprroocc//_p_i_d//llwwpp//_l_w_p_i_d_, _l_w_p_i_d
being the lwp-ID of the agent lwp (invisible in the sense that the name
``agent'' does not appear in a directory listing of //pprroocc//_p_i_d//llwwpp
obtained from llss(1), ggeettddeennttss(2), or rreeaaddddiirr(3C)).
The purpose of the agent lwp is to perform operations in the controlled
process on behalf of the controlling process: to gather information not
directly available via //pprroocc files, or in general to make the process
change state in ways not directly available via //pprroocc control
operations. To make use of an agent lwp, the controlling process must
be capable of making it execute system calls (specifically, the
SSYYSS__llwwpp__eexxiitt system call trap). The register values given to the agent
lwp on creation are typically the registers of the representative lwp,
so that the agent lwp can use its stack.
If the controlling process neglects to force the agent lwp to execute
the SSYYSS__llwwpp__eexxiitt system call (due to either logic error or fatal
failure on the part of the controlling process), the agent lwp will
remain in the target process. For purposes of being able to debug
these otherwise rogue agents, information as to the creator of the
agent lwp is reflected in that lwp's ssppyymmaasstteerr file in //pprroocc. Should
the target process generate a core dump with the agent lwp in place,
this information will be available via the NNTT__SSPPYYMMAASSTTEERR note in the
core file (see ccoorree(4)).
The agent lwp is not allowed to execute any variation of the SSYYSS__ffoorrkk
or SSYYSS__eexxeecc system call traps. Attempts to do so yield EENNOOTTSSUUPP to the
agent lwp.
Symbolic constants for system call trap numbers like SSYYSS__llwwpp__eexxiitt and
SSYYSS__llwwpp__ccrreeaattee can be found in the header file .
PPCCRREEAADD PPCCWWRRIITTEE
Read or write the target process's address space via a pprriioovveecc
structure operand:
typedef struct priovec {
void *pio_base; /* buffer in controlling process */
size_t pio_len; /* size of read/write request in bytes */
off_t pio_offset; /* virtual address in target process */
} priovec_t;
These operations have the same effect as pprreeaadd(2) and ppwwrriittee(2),
respectively, of the target process's address space file. The
difference is that more than one PPCCRREEAADD or PPCCWWRRIITTEE control operation
can be written to the control file at once, and they can be
interspersed with other control operations in a single write to the
control file. This is useful, for example, when planting many
breakpoint instructions in the process's address space, or when
stepping over a breakpointed instruction. Unlike pprreeaadd(2) and
ppwwrriittee(2), no provision is made for partial reads or writes; if the
operation cannot be performed completely, it fails with EEIIOO.
PPCCNNIICCEE
The traced process's nniiccee(2) value is incremented by the amount in the
operand lloonngg. Only a process with the {PPRRIIVV__PPRROOCC__PPRRIIOOCCNNTTLL} privilege
asserted in its effective set can better a process's priority in this
way, but any user may lower the priority. This operation is not
meaningful for all scheduling classes.
PPCCSSCCRREEDD
Set the target process credentials to the values contained in the
pprrccrreedd__tt structure operand (see //pprroocc//_p_i_d//ccrreedd). The effective, real,
and saved user-IDs and group-IDs of the target process are set. The
target process's supplementary groups are not changed; the pprr__nnggrroouuppss
and pprr__ggrroouuppss members of the structure operand are ignored. Only the
privileged processes can perform this operation; for all others it
fails with EEPPEERRMM.
PPCCSSCCRREEDDXX
Operates like PPCCSSCCRREEDD but also sets the supplementary groups; the
length of the data written with this control operation should be
"sizeof (pprrccrreedd__tt) + sizeof (ggiidd__tt)) * (#groups - 1)".
PPCCSSPPRRIIVV
Set the target process privilege to the values contained in the
pprrpprriivv__tt operand (see //pprroocc//ppiidd//pprriivv). The effective, permitted,
inheritable, and limit sets are all changed. Privilege flags can also
be set. The process is made privilege aware unless it can relinquish
privilege awareness. See pprriivviilleeggeess(5).
The limit set of the target process cannot be grown. The other
privilege sets must be subsets of the intersection of the effective set
of the calling process with the new limit set of the target process or
subsets of the original values of the sets in the target process.
If any of the above restrictions are not met, EEPPEERRMM is returned. If the
structure written is improperly formatted, EEIINNVVAALL is returned.
PPRROOGGRRAAMMMMIINNGG NNOOTTEESS
For security reasons, except for the ppssiinnffoo, uussaaggee, llppssiinnffoo, lluussaaggee,
llwwppssiinnffoo, and llwwppuussaaggee files, which are world-readable, and except for
privileged processes, an open of a //pprroocc file fails unless both the
user-ID and group-ID of the caller match those of the traced process
and the process's object file is readable by the caller. The effective
set of the caller is a superset of both the inheritable and the
permitted set of the target process. The limit set of the caller is a
superset of the limit set of the target process. Except for the world-
readable files just mentioned, files corresponding to setuid and setgid
processes can be opened only by the appropriately privileged process.
A process that is missing the basic privilege {PPRRIIVV__PPRROOCC__IINNFFOO} cannot
see any processes under //pprroocc that it cannot send a signal to.
A process that has {PPRRIIVV__PPRROOCC__OOWWNNEERR} asserted in its effective set can
open any file for reading. To manipulate or control a process, the
controlling process must have at least as many privileges in its
effective set as the target process has in its effective, inheritable,
and permitted sets. The limit set of the controlling process must be a
superset of the limit set of the target process. Additional
restrictions apply if any of the uids of the target process are 0. See
pprriivviilleeggeess(5).
Even if held by a privileged process, an open process or lwp file
descriptor (other than file descriptors for the world-readable files)
becomes invalid if the traced process performs an eexxeecc(2) of a
setuid/setgid object file or an object file that the traced process
cannot read. Any operation performed on an invalid file descriptor,
except cclloossee(2), fails with EEAAGGAAIINN. In this situation, if any tracing
flags are set and the process or any lwp file descriptor is open for
writing, the process will have been directed to stop and its run-on-
last-close flag will have been set (see PPCCSSEETT). This enables a
controlling process (if it has permission) to reopen the //pprroocc files to
get new valid file descriptors, close the invalid file descriptors,
unset the run-on-last-close flag (if desired), and proceed. Just
closing the invalid file descriptors causes the traced process to
resume execution with all tracing flags cleared. Any process not
currently open for writing via //pprroocc, but that has left-over tracing
flags from a previous open, and that executes a setuid/setgid or
unreadable object file, will not be stopped but will have all its
tracing flags cleared.
To wait for one or more of a set of processes or lwps to stop or
terminate, //pprroocc file descriptors (other than those obtained by opening
the ccwwdd or rroooott directories or by opening files in the ffdd or oobbjjeecctt
directories) can be used in a ppoollll(2) system call. When requested and
returned, either of the polling events PPOOLLLLPPRRII or PPOOLLLLWWRRNNOORRMM indicates
that the process or lwp stopped on an event of interest. Although they
cannot be requested, the polling events PPOOLLLLHHUUPP, PPOOLLLLEERRRR, and PPOOLLLLNNVVAALL
may be returned. PPOOLLLLHHUUPP indicates that the process or lwp has
terminated. PPOOLLLLEERRRR indicates that the file descriptor has become
invalid. PPOOLLLLNNVVAALL is returned immediately if PPOOLLLLPPRRII or PPOOLLLLWWRRNNOORRMM is
requested on a file descriptor referring to a system process (see
PPCCSSTTOOPP). The requested events may be empty to wait simply for
termination.
FFIILLEESS
//pprroocc
directory (list of processes)
//pprroocc//_p_i_d
specific process directory
//pprroocc//sseellff
alias for a process's own directory
//pprroocc//_p_i_d/as
address space file
//pprroocc//_p_i_d/ctl
process control file
//pprroocc//_p_i_d/status
process status
//pprroocc//_p_i_d/lstatus
array of lwp status structs
//pprroocc//_p_i_d/psinfo
process ppss(1) info
//pprroocc//_p_i_d/lpsinfo
array of lwp ppss(1) info structs
//pprroocc//_p_i_d/map
address space map
//pprroocc//_p_i_d/xmap
extended address space map
//pprroocc//_p_i_d/rmap
reserved address map
//pprroocc//_p_i_d/cred
process credentials
//pprroocc//_p_i_d/priv
process privileges
//pprroocc//_p_i_d/sigact
process signal actions
//pprroocc//_p_i_d/auxv
process aux vector
//pprroocc//_p_i_d/ldt
process LLDDTT (x86 only)
//pprroocc//_p_i_d/usage
process usage
//pprroocc//_p_i_d/lusage
array of lwp usage structs
//pprroocc//_p_i_d/path
symbolic links to process open files
//pprroocc//_p_i_d/pagedata
process page data
//pprroocc//_p_i_d/watch
active watchpoints
//pprroocc//_p_i_d/cwd
alias for the current working directory
//pprroocc//_p_i_d/root
alias for the root directory
//pprroocc//_p_i_d/fd
directory (list of open files)
//pprroocc//_p_i_d/fd/*
aliases for process's open files
//pprroocc//_p_i_d/object
directory (list of mapped files)
//pprroocc//_p_i_d/object/a.out
alias for process's executable file
//pprroocc//_p_i_d/object/*
aliases for other mapped files
//pprroocc//_p_i_d/lwp
directory (list of lwps)
//pprroocc//_p_i_d/lwp/_l_w_p_i_d
specific lwp directory
//pprroocc//_p_i_d/lwp/agent
alias for the agent lwp directory
//pprroocc//_p_i_d/lwp/_l_w_p_i_d/lwpctl
lwp control file
//pprroocc//_p_i_d/lwp/_l_w_p_i_d/lwpstatus
lwp status
//pprroocc//_p_i_d/lwp/_l_w_p_i_d/lwpsinfo
lwp ppss(1) info
//pprroocc//_p_i_d/lwp/_l_w_p_i_d/lwpusage
lwp usage
//pprroocc//_p_i_d/lwp/_l_w_p_i_d/gwindows
register windows (SPARC only)
//pprroocc//_p_i_d/lwp/_l_w_p_i_d/xregs
extra state registers
//pprroocc//_p_i_d/lwp/_l_w_p_i_d/asrs
ancillary state registers (SPARC V9 only)
//pprroocc//_p_i_d/lwp/_l_w_p_i_d/spymaster
For an agent LWP, the controlling process
SSEEEE AALLSSOO
llss(1), ppss(1), cchhrroooott(1M), aallaarrmm(2), bbrrkk(2), cchhddiirr(2), cchhrroooott(2),
cclloossee(2), ccrreeaatt(2), dduupp(2), eexxeecc(2), ffccnnttll(2), ffoorrkk(2), ffoorrkk11(2),
ffssttaatt(2), ggeettddeennttss(2), ggeettuussttaacckk(2), kkiillll(2), llsseeeekk(2), mmmmaapp(2),
nniiccee(2), ooppeenn(2), ppoollll(2), pprreeaadd(2), ppttrraaccee(3C), ppwwrriittee(2), rreeaadd(2),
rreeaaddlliinnkk(2), rreeaaddvv(2), sshhmmggeett(2), ssiiggaaccttiioonn(2), ssiiggaallttssttaacckk(2),
vvffoorrkk(2), wwrriittee(2), wwrriitteevv(2), __ssttaacckk__ggrrooww(3C), rreeaaddddiirr(3C),
pptthhrreeaadd__ccrreeaattee(3C), pptthhrreeaadd__jjooiinn(3C), ssiiggiinnffoo..hh(3HEAD),
ssiiggnnaall..hh(3HEAD), tthhrr__ccrreeaattee(3C), tthhrr__jjooiinn(3C), ttyyppeess3322..hh(3HEAD),
uuccoonntteexxtt..hh(3HEAD), wwaaiitt(3C), ccoonnttrraacctt(4), ccoorree(4), pprroocceessss(4),
llffccoommppiillee(5), pprriivviilleeggeess(5), sseeccuurriittyy--ffllaaggss(5)
DDIIAAGGNNOOSSTTIICCSS
Errors that can occur in addition to the errors normally associated
with file system access:
EE22BBIIGG
Data to be returned in a rreeaadd(2) of the page data file
exceeds the size of the read buffer provided by the
caller.
EEAACCCCEESS
An attempt was made to examine a process that ran under a
different uid than the controlling process and
{PPRRIIVV__PPRROOCC__OOWWNNEERR} was not asserted in the effective set.
EEAAGGAAIINN
The traced process has performed an eexxeecc(2) of a
setuid/setgid object file or of an object file that it
cannot read; all further operations on the process or lwp
file descriptor (except cclloossee(2)) elicit this error.
EEBBUUSSYY
PPCCSSTTOOPP, PPCCDDSSTTOOPP, PPCCWWSSTTOOPP, or PPCCTTWWSSTTOOPP was applied to a
system process; an exclusive ooppeenn(2) was attempted on a
//pprroocc file for a process already open for writing; PPCCRRUUNN,
PPCCSSRREEGG, PPCCSSVVAADDDDRR, PPCCSSFFPPRREEGG, or PPCCSSXXRREEGG was applied to a
process or lwp not stopped on an event of interest; an
attempt was made to mount //pprroocc when it was already
mounted; PPCCAAGGEENNTT was applied to a process that was not
fully stopped or that already had an agent lwp.
EEIINNVVAALL
In general, this means that some invalid argument was
supplied to a system call. A non-exhaustive list of
conditions eliciting this error includes: a control
message operation code is undefined; an out-of-range
signal number was specified with PPCCSSSSIIGG, PPCCKKIILLLL, or
PPCCUUNNKKIILLLL; SSIIGGKKIILLLL was specified with PPCCUUNNKKIILLLL; PPCCSSFFPPRREEGG
was applied on a system that does not support floating-
point operations; PPCCSSXXRREEGG was applied on a system that
does not support extra state registers.
EEIINNTTRR
A signal was received by the controlling process while
waiting for the traced process or lwp to stop via PPCCSSTTOOPP,
PPCCWWSSTTOOPP, or PPCCTTWWSSTTOOPP.
EEIIOO
A wwrriittee(2) was attempted at an illegal address in the
traced process.
EENNOOEENNTT
The traced process or lwp has terminated after being
opened. The basic privilege {PPRRIIVV__PPRROOCC__IINNFFOO} is not
asserted in the effective set of the calling process and
the calling process cannot send a signal to the target
process.
EENNOOMMEEMM
The system-imposed limit on the number of page data file
descriptors was reached on an open of //pprroocc//_p_i_d//ppaaggeeddaattaa;
an attempt was made with PPCCWWAATTCCHH to establish more watched
areas than the system can support; the PPCCAAGGEENNTT operation
was issued when the system was out of resources for
creating lwps.
EENNOOSSYYSS
An attempt was made to perform an unsupported operation
(such as ccrreeaatt(2), lliinnkk(2), or uunnlliinnkk(2)) on an entry in
//pprroocc.
EEOOVVEERRFFLLOOWW
A 32-bit controlling process attempted to read or write
the aass file or attempted to read the mmaapp, rrmmaapp, or
ppaaggeeddaattaa file of a 64-bit target process. A 32-bit
controlling process attempted to apply one of the control
operations PPCCSSRREEGG, PPCCSSXXRREEGG, PPCCSSVVAADDDDRR, PPCCWWAATTCCHH, PPCCAAGGEENNTT,
PPCCRREEAADD, PPCCWWRRIITTEE to a 64-bit target process.
EEPPEERRMM
The process that issued the PPCCSSCCRREEDD or PPCCSSCCRREEDDXX operation
did not have the {PPRRIIVV__PPRROOCC__SSEETTIIDD} privilege asserted in
its effective set, or the process that issued the PPCCNNIICCEE
operation did not have the {PPRRIIVV__PPRROOCC__PPRRIIOOCCNNTTLL} in its
effective set.
An attempt was made to control a process of which the E,
P, and I privilege sets were not a subset of the effective
set of the controlling process or the limit set of the
controlling process is not a superset of limit set of the
controlled process.
Any of the uids of the target process are 0 or an attempt
was made to change any of the uids to 0 using PCSCRED and
the security policy imposed additional restrictions. See
pprriivviilleeggeess(5).
NNOOTTEESS
Descriptions of structures in this document include only interesting
structure elements, not filler and padding fields, and may show
elements out of order for descriptive clarity. The actual structure
definitions are contained in <
>.
BBUUGGSS
Because the old iiooccttll(2)-based version of //pprroocc is currently supported
for binary compatibility with old applications, the top-level directory
for a process, //pprroocc//_p_i_d, is not world-readable, but it is world-
searchable. Thus, anyone can open //pprroocc//_p_i_d//ppssiinnffoo even though llss(1)
applied to //pprroocc//_p_i_d will fail for anyone but the owner or an
appropriately privileged process. Support for the old iiooccttll(2)-based
version of //pprroocc will be dropped in a future release, at which time the
top-level directory for a process will be made world-readable.
On SPARC based machines, the types ggrreeggsseett__tt and ffpprreeggsseett__tt defined in
are similar to but not the same as the types pprrggrreeggsseett__tt
and pprrffpprreeggsseett__tt defined in
. June 6, 2016 PROC(4)