1/*
2 * CDDL HEADER START
3 *
4 * The contents of this file are subject to the terms of the
5 * Common Development and Distribution License (the "License").
6 * You may not use this file except in compliance with the License.
7 *
8 * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9 * or http://www.opensolaris.org/os/licensing.
10 * See the License for the specific language governing permissions
11 * and limitations under the License.
12 *
13 * When distributing Covered Code, include this CDDL HEADER in each
14 * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15 * If applicable, add the following below this CDDL HEADER, with the
16 * fields enclosed by brackets "[]" replaced with your own identifying
17 * information: Portions Copyright [yyyy] [name of copyright owner]
18 *
19 * CDDL HEADER END
20 */
21
22/*
23 * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24 * Use is subject to license terms.
25 */
26/*
27 * Copyright 2018 Joyent, Inc.
28 * Copyright (c) 2014 by Delphix. All rights reserved.
29 */
30
31/*
32 * User Process Target
33 *
34 * The user process target is invoked when the -u or -p command-line options
35 * are used, or when an ELF executable file or ELF core file is specified on
36 * the command-line.  This target is also selected by default when no target
37 * options are present.  In this case, it defaults the executable name to
38 * "a.out".  If no process or core file is currently attached, the target
39 * functions as a kind of virtual /dev/zero (in accordance with adb(1)
40 * semantics); reads from the virtual address space return zeroes and writes
41 * fail silently.  The proc target itself is designed as a wrapper around the
42 * services provided by libproc.so: t->t_pshandle is set to the struct
43 * ps_prochandle pointer returned as a handle by libproc.  The target also
44 * opens the executable file itself using the MDB GElf services, for
45 * interpreting the .symtab and .dynsym if no libproc handle has been
46 * initialized, and for handling i/o to and from the object file.  Currently,
47 * the only ISA-dependent portions of the proc target are the $r and ::fpregs
48 * dcmds, the callbacks for t_next() and t_step_out(), and the list of named
49 * registers; these are linked in from the proc_isadep.c file for each ISA and
50 * called from the common code in this file.
51 *
52 * The user process target implements complete user process control using the
53 * facilities provided by libproc.so.  The MDB execution control model and
54 * an overview of software event management is described in mdb_target.c.  The
55 * proc target implements breakpoints by replacing the instruction of interest
56 * with a trap instruction, and then restoring the original instruction to step
57 * over the breakpoint.  The idea of replacing program text with instructions
58 * that transfer control to the debugger dates back as far as 1951 [1].  When
59 * the target stops, we replace each breakpoint with the original instruction
60 * as part of the disarm operation.  This means that no special processing is
61 * required for t_vread() because the instrumented instructions will never be
62 * seen by the debugger once the target stops.  Some debuggers have improved
63 * start/stop performance by leaving breakpoint traps in place and then
64 * handling a read from a breakpoint address as a special case.  Although this
65 * improves efficiency for a source-level debugger, it runs somewhat contrary
66 * to the philosophy of the low-level debugger.  Since we remove the
67 * instructions, users can apply other external debugging tools to the process
68 * once it has stopped (e.g. the proc(1) tools) and not be misled by MDB
69 * instrumentation.  The tracing of faults, signals, system calls, and
70 * watchpoints and general process inspection is implemented directly using
71 * the mechanisms provided by /proc, as described originally in [2] and [3].
72 *
73 * References
74 *
75 * [1] S. Gill, "The Diagnosis Of Mistakes In Programmes on the EDSAC",
76 *     Proceedings of the Royal Society Series A Mathematical and Physical
77 *     Sciences, Cambridge University Press, 206(1087), May 1951, pp. 538-554.
78 *
79 * [2] T.J. Killian, "Processes as Files", Proceedings of the USENIX Association
80 *     Summer Conference, Salt Lake City, June 1984, pp. 203-207.
81 *
82 * [3] Roger Faulkner and Ron Gomes, "The Process File System and Process
83 *     Model in UNIX System V", Proceedings of the USENIX Association
84 *     Winter Conference, Dallas, January 1991, pp. 243-252.
85 */
86
87#include <mdb/mdb_proc.h>
88#include <mdb/mdb_disasm.h>
89#include <mdb/mdb_signal.h>
90#include <mdb/mdb_string.h>
91#include <mdb/mdb_module.h>
92#include <mdb/mdb_debug.h>
93#include <mdb/mdb_conf.h>
94#include <mdb/mdb_err.h>
95#include <mdb/mdb_types.h>
96#include <mdb/mdb.h>
97
98#include <sys/utsname.h>
99#include <sys/wait.h>
100#include <sys/stat.h>
101#include <termio.h>
102#include <signal.h>
103#include <stdio_ext.h>
104#include <stdlib.h>
105#include <string.h>
106
107#define	PC_FAKE		-1UL			/* illegal pc value unequal 0 */
108#define	PANIC_BUFSIZE	1024
109
110static const char PT_EXEC_PATH[] = "a.out";	/* Default executable */
111static const char PT_CORE_PATH[] = "core";	/* Default core file */
112
113static const pt_ptl_ops_t proc_lwp_ops;
114static const pt_ptl_ops_t proc_tdb_ops;
115static const mdb_se_ops_t proc_brkpt_ops;
116static const mdb_se_ops_t proc_wapt_ops;
117
118static int pt_setrun(mdb_tgt_t *, mdb_tgt_status_t *, int);
119static void pt_activate_common(mdb_tgt_t *);
120static mdb_tgt_vespec_f pt_ignore_sig;
121static mdb_tgt_se_f pt_fork;
122static mdb_tgt_se_f pt_exec;
123
124static int pt_lookup_by_name_thr(mdb_tgt_t *, const char *,
125    const char *, GElf_Sym *, mdb_syminfo_t *, mdb_tgt_tid_t);
126static int tlsbase(mdb_tgt_t *, mdb_tgt_tid_t, Lmid_t, const char *,
127    psaddr_t *);
128
129/*
130 * When debugging postmortem, we don't resolve names as we may very well not
131 * be on a system on which those names resolve.
132 */
133#define	PT_LIBPROC_RESOLVE(P) \
134	(!(mdb.m_flags & MDB_FL_LMRAW) && Pstate(P) != PS_DEAD)
135
136/*
137 * The Perror_printf() function interposes on the default, empty libproc
138 * definition.  It will be called to report additional information on complex
139 * errors, such as a corrupt core file.  We just pass the args to vwarn.
140 */
141/*ARGSUSED*/
142void
143Perror_printf(struct ps_prochandle *P, const char *format, ...)
144{
145	va_list alist;
146
147	va_start(alist, format);
148	vwarn(format, alist);
149	va_end(alist);
150}
151
152/*
153 * Open the specified i/o backend as the a.out executable file, and attempt to
154 * load its standard and dynamic symbol tables.  Note that if mdb_gelf_create
155 * succeeds, io is assigned to p_fio and is automatically held by gelf_create.
156 */
157static mdb_gelf_file_t *
158pt_open_aout(mdb_tgt_t *t, mdb_io_t *io)
159{
160	pt_data_t *pt = t->t_data;
161	GElf_Sym s1, s2;
162
163	if ((pt->p_file = mdb_gelf_create(io, ET_NONE, GF_FILE)) == NULL)
164		return (NULL);
165
166	pt->p_symtab = mdb_gelf_symtab_create_file(pt->p_file,
167	    SHT_SYMTAB, MDB_TGT_SYMTAB);
168	pt->p_dynsym = mdb_gelf_symtab_create_file(pt->p_file,
169	    SHT_DYNSYM, MDB_TGT_DYNSYM);
170
171	/*
172	 * If we've got an _start symbol with a zero size, prime the private
173	 * symbol table with a copy of _start with its size set to the distance
174	 * between _mcount and _start.  We do this because DevPro has shipped
175	 * the Intel crt1.o without proper .size directives for years, which
176	 * precludes proper identification of _start in stack traces.
177	 */
178	if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, "_start", &s1,
179	    NULL) == 0 && s1.st_size == 0 &&
180	    GELF_ST_TYPE(s1.st_info) == STT_FUNC) {
181		if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, "_mcount",
182		    &s2, NULL) == 0 && GELF_ST_TYPE(s2.st_info) == STT_FUNC) {
183			s1.st_size = s2.st_value - s1.st_value;
184			mdb_gelf_symtab_insert(mdb.m_prsym, "_start", &s1);
185		}
186	}
187
188	pt->p_fio = io;
189	return (pt->p_file);
190}
191
192/*
193 * Destroy the symbol tables and GElf file object associated with p_fio.  Note
194 * that we do not need to explicitly free p_fio: its reference count is
195 * automatically decremented by mdb_gelf_destroy, which will free it if needed.
196 */
197static void
198pt_close_aout(mdb_tgt_t *t)
199{
200	pt_data_t *pt = t->t_data;
201
202	if (pt->p_symtab != NULL) {
203		mdb_gelf_symtab_destroy(pt->p_symtab);
204		pt->p_symtab = NULL;
205	}
206
207	if (pt->p_dynsym != NULL) {
208		mdb_gelf_symtab_destroy(pt->p_dynsym);
209		pt->p_dynsym = NULL;
210	}
211
212	if (pt->p_file != NULL) {
213		mdb_gelf_destroy(pt->p_file);
214		pt->p_file = NULL;
215	}
216
217	mdb_gelf_symtab_delete(mdb.m_prsym, "_start", NULL);
218	pt->p_fio = NULL;
219}
220
221typedef struct tdb_mapping {
222	const char *tm_thr_lib;
223	const char *tm_db_dir;
224	const char *tm_db_name;
225} tdb_mapping_t;
226
227static const tdb_mapping_t tdb_map[] = {
228	{ "/lwp/amd64/libthread.so",	"/usr/lib/lwp/", "libthread_db.so" },
229	{ "/lwp/sparcv9/libthread.so",	"/usr/lib/lwp/", "libthread_db.so" },
230	{ "/lwp/libthread.so",		"/usr/lib/lwp/", "libthread_db.so" },
231	{ "/libthread.so",		"/lib/", "libthread_db.so" },
232	{ "/libc_hwcap",		"/lib/", "libc_db.so" },
233	{ "/libc.so",			"/lib/", "libc_db.so" }
234};
235
236/*
237 * Pobject_iter callback that we use to search for the presence of libthread in
238 * order to load the corresponding libthread_db support.  We derive the
239 * libthread_db path dynamically based on the libthread path.  If libthread is
240 * found, this function returns 1 (and thus Pobject_iter aborts and returns 1)
241 * regardless of whether it was successful in loading the libthread_db support.
242 * If we iterate over all objects and no libthread is found, 0 is returned.
243 * Since libthread_db support was then merged into libc_db, we load either
244 * libc_db or libthread_db, depending on which library we see first.
245 */
246/*ARGSUSED*/
247static int
248thr_check(mdb_tgt_t *t, const prmap_t *pmp, const char *name)
249{
250	pt_data_t *pt = t->t_data;
251	const mdb_tdb_ops_t *ops;
252	char *p;
253
254	char path[MAXPATHLEN];
255
256	int libn;
257
258	if (name == NULL)
259		return (0); /* no rtld_db object name; keep going */
260
261	for (libn = 0; libn < sizeof (tdb_map) / sizeof (tdb_map[0]); libn++) {
262		if ((p = strstr(name, tdb_map[libn].tm_thr_lib)) != NULL)
263			break;
264	}
265
266	if (p == NULL)
267		return (0); /* no match; keep going */
268
269	path[0] = '\0';
270	(void) strlcat(path, mdb.m_root, sizeof (path));
271	(void) strlcat(path, tdb_map[libn].tm_db_dir, sizeof (path));
272#if !defined(_ILP32)
273	(void) strlcat(path, "64/", sizeof (path));
274#endif /* !_ILP32 */
275	(void) strlcat(path, tdb_map[libn].tm_db_name, sizeof (path));
276
277	/* Append the trailing library version number. */
278	(void) strlcat(path, strrchr(name, '.'), sizeof (path));
279
280	if ((ops = mdb_tdb_load(path)) == NULL) {
281		if (libn != 0 || errno != ENOENT)
282			warn("failed to load %s", path);
283		goto err;
284	}
285
286	if (ops == pt->p_tdb_ops)
287		return (1); /* no changes needed */
288
289	PTL_DTOR(t);
290	pt->p_tdb_ops = ops;
291	pt->p_ptl_ops = &proc_tdb_ops;
292	pt->p_ptl_hdl = NULL;
293
294	if (PTL_CTOR(t) == -1) {
295		warn("failed to initialize %s", path);
296		goto err;
297	}
298
299	mdb_dprintf(MDB_DBG_TGT, "loaded %s for debugging %s\n", path, name);
300	(void) mdb_tgt_status(t, &t->t_status);
301	return (1);
302err:
303	PTL_DTOR(t);
304	pt->p_tdb_ops = NULL;
305	pt->p_ptl_ops = &proc_lwp_ops;
306	pt->p_ptl_hdl = NULL;
307
308	if (libn != 0 || errno != ENOENT) {
309		warn("warning: debugger will only be able to "
310		    "examine raw LWPs\n");
311	}
312
313	(void) mdb_tgt_status(t, &t->t_status);
314	return (1);
315}
316
317/*
318 * Whenever the link map is consistent following an add or delete event, we ask
319 * libproc to update its mappings, check to see if we need to load libthread_db,
320 * and then update breakpoints which have been mapped or unmapped.
321 */
322/*ARGSUSED*/
323static void
324pt_rtld_event(mdb_tgt_t *t, int vid, void *private)
325{
326	struct ps_prochandle *P = t->t_pshandle;
327	pt_data_t *pt = t->t_data;
328	rd_event_msg_t rdm;
329	int docontinue = 1;
330
331	if (rd_event_getmsg(pt->p_rtld, &rdm) == RD_OK) {
332
333		mdb_dprintf(MDB_DBG_TGT, "rtld event type 0x%x state 0x%x\n",
334		    rdm.type, rdm.u.state);
335
336		if (rdm.type == RD_DLACTIVITY && rdm.u.state == RD_CONSISTENT) {
337			mdb_sespec_t *sep, *nsep = mdb_list_next(&t->t_active);
338			pt_brkpt_t *ptb;
339
340			Pupdate_maps(P);
341
342			if (Pobject_iter(P, (proc_map_f *)thr_check, t) == 0 &&
343			    pt->p_ptl_ops != &proc_lwp_ops) {
344				mdb_dprintf(MDB_DBG_TGT, "unloading thread_db "
345				    "support after dlclose\n");
346				PTL_DTOR(t);
347				pt->p_tdb_ops = NULL;
348				pt->p_ptl_ops = &proc_lwp_ops;
349				pt->p_ptl_hdl = NULL;
350				(void) mdb_tgt_status(t, &t->t_status);
351			}
352
353			for (sep = nsep; sep != NULL; sep = nsep) {
354				nsep = mdb_list_next(sep);
355				ptb = sep->se_data;
356
357				if (sep->se_ops == &proc_brkpt_ops &&
358				    Paddr_to_map(P, ptb->ptb_addr) == NULL)
359					mdb_tgt_sespec_idle_one(t, sep,
360					    EMDB_NOMAP);
361			}
362
363			if (!mdb_tgt_sespec_activate_all(t) &&
364			    (mdb.m_flags & MDB_FL_BPTNOSYMSTOP) &&
365			    pt->p_rtld_finished) {
366				/*
367				 * We weren't able to activate the breakpoints.
368				 * If so requested, we'll return without
369				 * calling continue, thus throwing the user into
370				 * the debugger.
371				 */
372				docontinue = 0;
373			}
374
375			if (pt->p_rdstate == PT_RD_ADD)
376				pt->p_rdstate = PT_RD_CONSIST;
377		}
378
379		if (rdm.type == RD_PREINIT)
380			(void) mdb_tgt_sespec_activate_all(t);
381
382		if (rdm.type == RD_POSTINIT) {
383			pt->p_rtld_finished = TRUE;
384			if (!mdb_tgt_sespec_activate_all(t) &&
385			    (mdb.m_flags & MDB_FL_BPTNOSYMSTOP)) {
386				/*
387				 * Now that rtld has been initialized, we
388				 * should be able to initialize all deferred
389				 * breakpoints.  If we can't, don't let the
390				 * target continue.
391				 */
392				docontinue = 0;
393			}
394		}
395
396		if (rdm.type == RD_DLACTIVITY && rdm.u.state == RD_ADD &&
397		    pt->p_rtld_finished)
398			pt->p_rdstate = MAX(pt->p_rdstate, PT_RD_ADD);
399	}
400
401	if (docontinue)
402		(void) mdb_tgt_continue(t, NULL);
403}
404
405static void
406pt_post_attach(mdb_tgt_t *t)
407{
408	struct ps_prochandle *P = t->t_pshandle;
409	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
410	pt_data_t *pt = t->t_data;
411	int hflag = MDB_TGT_SPEC_HIDDEN;
412
413	mdb_dprintf(MDB_DBG_TGT, "attach pr_flags=0x%x pr_why=%d pr_what=%d\n",
414	    psp->pr_flags, psp->pr_why, psp->pr_what);
415
416	/*
417	 * When we grab a process, the initial setting of p_rtld_finished
418	 * should be false if the process was just created by exec; otherwise
419	 * we permit unscoped references to resolve because we do not know how
420	 * far the process has proceeded through linker initialization.
421	 */
422	if ((psp->pr_flags & PR_ISTOP) && psp->pr_why == PR_SYSEXIT &&
423	    psp->pr_errno == 0 && psp->pr_what == SYS_execve) {
424		if (mdb.m_target == NULL) {
425			warn("target performed exec of %s\n",
426			    IOP_NAME(pt->p_fio));
427		}
428		pt->p_rtld_finished = FALSE;
429	} else
430		pt->p_rtld_finished = TRUE;
431
432	/*
433	 * When we grab a process, if it is stopped by job control and part of
434	 * the same session (i.e. same controlling tty), set MDB_FL_JOBCTL so
435	 * we will know to bring it to the foreground when we continue it.
436	 */
437	if (mdb.m_term != NULL && (psp->pr_flags & PR_STOPPED) &&
438	    psp->pr_why == PR_JOBCONTROL && getsid(0) == Pstatus(P)->pr_sid)
439		mdb.m_flags |= MDB_FL_JOBCTL;
440
441	/*
442	 * When we grab control of a live process, set F_RDWR so that the
443	 * target layer permits writes to the target's address space.
444	 */
445	t->t_flags |= MDB_TGT_F_RDWR;
446
447	(void) Pfault(P, FLTBPT, TRUE);		/* always trace breakpoints */
448	(void) Pfault(P, FLTWATCH, TRUE);	/* always trace watchpoints */
449	(void) Pfault(P, FLTTRACE, TRUE);	/* always trace single-step */
450
451	(void) Punsetflags(P, PR_ASYNC);	/* require synchronous mode */
452	(void) Psetflags(P, PR_BPTADJ);		/* always adjust eip on x86 */
453	(void) Psetflags(P, PR_FORK);		/* inherit tracing on fork */
454
455	/*
456	 * Install event specifiers to track fork and exec activities:
457	 */
458	(void) mdb_tgt_add_sysexit(t, SYS_vfork, hflag, pt_fork, NULL);
459	(void) mdb_tgt_add_sysexit(t, SYS_forksys, hflag, pt_fork, NULL);
460	(void) mdb_tgt_add_sysexit(t, SYS_execve, hflag, pt_exec, NULL);
461
462	/*
463	 * Attempt to instantiate the librtld_db agent and set breakpoints
464	 * to track rtld activity.  We will legitimately fail to instantiate
465	 * the rtld_db agent if the target is statically linked.
466	 */
467	if (pt->p_rtld == NULL && (pt->p_rtld = Prd_agent(P)) != NULL) {
468		rd_notify_t rdn;
469		rd_err_e err;
470
471		if ((err = rd_event_enable(pt->p_rtld, TRUE)) != RD_OK) {
472			warn("failed to enable rtld_db event tracing: %s\n",
473			    rd_errstr(err));
474			goto out;
475		}
476
477		if ((err = rd_event_addr(pt->p_rtld, RD_PREINIT,
478		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
479			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
480			    hflag, pt_rtld_event, NULL);
481		} else {
482			warn("failed to install rtld_db preinit tracing: %s\n",
483			    rd_errstr(err));
484		}
485
486		if ((err = rd_event_addr(pt->p_rtld, RD_POSTINIT,
487		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
488			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
489			    hflag, pt_rtld_event, NULL);
490		} else {
491			warn("failed to install rtld_db postinit tracing: %s\n",
492			    rd_errstr(err));
493		}
494
495		if ((err = rd_event_addr(pt->p_rtld, RD_DLACTIVITY,
496		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
497			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
498			    hflag, pt_rtld_event, NULL);
499		} else {
500			warn("failed to install rtld_db activity tracing: %s\n",
501			    rd_errstr(err));
502		}
503	}
504out:
505	Pupdate_maps(P);
506	Psync(P);
507
508	/*
509	 * If librtld_db failed to initialize due to an error or because we are
510	 * debugging a statically linked executable, allow unscoped references.
511	 */
512	if (pt->p_rtld == NULL)
513		pt->p_rtld_finished = TRUE;
514
515	(void) mdb_tgt_sespec_activate_all(t);
516}
517
518/*ARGSUSED*/
519static int
520pt_vespec_delete(mdb_tgt_t *t, void *private, int id, void *data)
521{
522	if (id < 0) {
523		ASSERT(data == NULL); /* we don't use any ve_data */
524		(void) mdb_tgt_vespec_delete(t, id);
525	}
526	return (0);
527}
528
529static void
530pt_pre_detach(mdb_tgt_t *t, int clear_matched)
531{
532	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
533	pt_data_t *pt = t->t_data;
534	long cmd = 0;
535
536	/*
537	 * If we are about to release the process and it is stopped on a traced
538	 * SIGINT, breakpoint fault, single-step fault, or watchpoint, make
539	 * sure to clear this event prior to releasing the process so that it
540	 * does not subsequently reissue the fault and die from SIGTRAP.
541	 */
542	if (psp->pr_flags & PR_ISTOP) {
543		if (psp->pr_why == PR_FAULTED && (psp->pr_what == FLTBPT ||
544		    psp->pr_what == FLTTRACE || psp->pr_what == FLTWATCH))
545			cmd = PCCFAULT;
546		else if (psp->pr_why == PR_SIGNALLED && psp->pr_what == SIGINT)
547			cmd = PCCSIG;
548
549		if (cmd != 0)
550			(void) write(Pctlfd(t->t_pshandle), &cmd, sizeof (cmd));
551	}
552
553	if (Pstate(t->t_pshandle) == PS_UNDEAD)
554		(void) waitpid(Pstatus(t->t_pshandle)->pr_pid, NULL, WNOHANG);
555
556	(void) mdb_tgt_vespec_iter(t, pt_vespec_delete, NULL);
557	mdb_tgt_sespec_idle_all(t, EMDB_NOPROC, clear_matched);
558
559	if (pt->p_fio != pt->p_aout_fio) {
560		pt_close_aout(t);
561		(void) pt_open_aout(t, pt->p_aout_fio);
562	}
563
564	PTL_DTOR(t);
565	pt->p_tdb_ops = NULL;
566	pt->p_ptl_ops = &proc_lwp_ops;
567	pt->p_ptl_hdl = NULL;
568
569	pt->p_rtld = NULL;
570	pt->p_signal = 0;
571	pt->p_rtld_finished = FALSE;
572	pt->p_rdstate = PT_RD_NONE;
573}
574
575static void
576pt_release_parents(mdb_tgt_t *t)
577{
578	struct ps_prochandle *P = t->t_pshandle;
579	pt_data_t *pt = t->t_data;
580
581	mdb_sespec_t *sep;
582	pt_vforkp_t *vfp;
583
584	while ((vfp = mdb_list_next(&pt->p_vforkp)) != NULL) {
585		mdb_dprintf(MDB_DBG_TGT, "releasing vfork parent %d\n",
586		    (int)Pstatus(vfp->p_pshandle)->pr_pid);
587
588		/*
589		 * To release vfork parents, we must also wipe out any armed
590		 * events in the parent by switching t_pshandle and calling
591		 * se_disarm().  Do not change states or lose the matched list.
592		 */
593		t->t_pshandle = vfp->p_pshandle;
594
595		for (sep = mdb_list_next(&t->t_active); sep != NULL;
596		    sep = mdb_list_next(sep)) {
597			if (sep->se_state == MDB_TGT_SPEC_ARMED)
598				(void) sep->se_ops->se_disarm(t, sep);
599		}
600
601		t->t_pshandle = P;
602
603		Prelease(vfp->p_pshandle, PRELEASE_CLEAR);
604		mdb_list_delete(&pt->p_vforkp, vfp);
605		mdb_free(vfp, sizeof (pt_vforkp_t));
606	}
607}
608
609/*ARGSUSED*/
610static void
611pt_fork(mdb_tgt_t *t, int vid, void *private)
612{
613	struct ps_prochandle *P = t->t_pshandle;
614	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
615	pt_data_t *pt = t->t_data;
616	mdb_sespec_t *sep;
617
618	int follow_parent = mdb.m_forkmode != MDB_FM_CHILD;
619	int is_vfork = (psp->pr_what == SYS_vfork ||
620	    (psp->pr_what == SYS_forksys && psp->pr_sysarg[0] == 2));
621
622	struct ps_prochandle *C;
623	const lwpstatus_t *csp;
624	char sysname[32];
625	int gcode;
626	char c;
627
628	mdb_dprintf(MDB_DBG_TGT, "parent %s: errno=%d rv1=%ld rv2=%ld\n",
629	    proc_sysname(psp->pr_what, sysname, sizeof (sysname)),
630	    psp->pr_errno, psp->pr_rval1, psp->pr_rval2);
631
632	if (psp->pr_errno != 0) {
633		(void) mdb_tgt_continue(t, NULL);
634		return; /* fork failed */
635	}
636
637	/*
638	 * If forkmode is ASK and stdout is a terminal, then ask the user to
639	 * explicitly set the fork behavior for this particular fork.
640	 */
641	if (mdb.m_forkmode == MDB_FM_ASK && mdb.m_term != NULL) {
642		mdb_iob_printf(mdb.m_err, "%s: %s detected: follow (p)arent "
643		    "or (c)hild? ", mdb.m_pname, sysname);
644		mdb_iob_flush(mdb.m_err);
645
646		while (IOP_READ(mdb.m_term, &c, sizeof (c)) == sizeof (c)) {
647			if (c == 'P' || c == 'p') {
648				mdb_iob_printf(mdb.m_err, "%c\n", c);
649				follow_parent = TRUE;
650				break;
651			} else if (c == 'C' || c == 'c') {
652				mdb_iob_printf(mdb.m_err, "%c\n", c);
653				follow_parent = FALSE;
654				break;
655			}
656		}
657	}
658
659	/*
660	 * The parent is now stopped on exit from its fork call.  We must now
661	 * grab the child on its return from fork in order to manipulate it.
662	 */
663	if ((C = Pgrab(psp->pr_rval1, PGRAB_RETAIN, &gcode)) == NULL) {
664		warn("failed to grab forked child process %ld: %s\n",
665		    psp->pr_rval1, Pgrab_error(gcode));
666		return; /* just stop if we failed to grab the child */
667	}
668
669	/*
670	 * We may have grabbed the child and stopped it prematurely before it
671	 * stopped on exit from fork.  If so, wait up to 1 sec for it to settle.
672	 */
673	if (Pstatus(C)->pr_lwp.pr_why != PR_SYSEXIT)
674		(void) Pwait(C, MILLISEC);
675
676	csp = &Pstatus(C)->pr_lwp;
677
678	if (csp->pr_why != PR_SYSEXIT ||
679	    (csp->pr_what != SYS_vfork && csp->pr_what != SYS_forksys)) {
680		warn("forked child process %ld did not stop on exit from "
681		    "fork as expected\n", psp->pr_rval1);
682	}
683
684	warn("target forked child process %ld (debugger following %s)\n",
685	    psp->pr_rval1, follow_parent ? "parent" : "child");
686
687	(void) Punsetflags(C, PR_ASYNC);	/* require synchronous mode */
688	(void) Psetflags(C, PR_BPTADJ);		/* always adjust eip on x86 */
689	(void) Prd_agent(C);			/* initialize librtld_db */
690
691	/*
692	 * At the time pt_fork() is called, the target event engine has already
693	 * disarmed the specifiers on the active list, clearing out events in
694	 * the parent process.  However, this means that events that change
695	 * the address space (e.g. breakpoints) have not been effectively
696	 * disarmed in the child since its address space reflects the state of
697	 * the process at the time of fork when events were armed.  We must
698	 * therefore handle this as a special case and re-invoke the disarm
699	 * callback of each active specifier to clean out the child process.
700	 */
701	if (!is_vfork) {
702		for (t->t_pshandle = C, sep = mdb_list_next(&t->t_active);
703		    sep != NULL; sep = mdb_list_next(sep)) {
704			if (sep->se_state == MDB_TGT_SPEC_ACTIVE)
705				(void) sep->se_ops->se_disarm(t, sep);
706		}
707
708		t->t_pshandle = P; /* restore pshandle to parent */
709	}
710
711	/*
712	 * If we're following the parent process, we need to temporarily change
713	 * t_pshandle to refer to the child handle C so that we can clear out
714	 * all the events in the child prior to releasing it below.  If we are
715	 * tracing a vfork, we also need to explicitly wait for the child to
716	 * exec, exit, or die before we can reset and continue the parent.  We
717	 * avoid having to deal with the vfork child forking again by clearing
718	 * PR_FORK and setting PR_RLC; if it does fork it will effectively be
719	 * released from our control and we will continue following the parent.
720	 */
721	if (follow_parent) {
722		if (is_vfork) {
723			mdb_tgt_status_t status;
724
725			ASSERT(psp->pr_flags & PR_VFORKP);
726			mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
727			t->t_pshandle = C;
728
729			(void) Psysexit(C, SYS_execve, TRUE);
730
731			(void) Punsetflags(C, PR_FORK | PR_KLC);
732			(void) Psetflags(C, PR_RLC);
733
734			do {
735				if (pt_setrun(t, &status, 0) == -1 ||
736				    status.st_state == MDB_TGT_UNDEAD ||
737				    status.st_state == MDB_TGT_LOST)
738					break; /* failure or process died */
739
740			} while (csp->pr_why != PR_SYSEXIT ||
741			    csp->pr_errno != 0 || csp->pr_what != SYS_execve);
742		} else
743			t->t_pshandle = C;
744	}
745
746	/*
747	 * If we are following the child, destroy any active libthread_db
748	 * handle before we release the parent process.
749	 */
750	if (!follow_parent) {
751		PTL_DTOR(t);
752		pt->p_tdb_ops = NULL;
753		pt->p_ptl_ops = &proc_lwp_ops;
754		pt->p_ptl_hdl = NULL;
755	}
756
757	/*
758	 * Idle all events to make sure the address space and tracing flags are
759	 * restored, and then release the process we are not tracing.  If we
760	 * are following the child of a vfork, we push the parent's pshandle
761	 * on to a list of vfork parents to be released when we exec or exit.
762	 */
763	if (is_vfork && !follow_parent) {
764		pt_vforkp_t *vfp = mdb_alloc(sizeof (pt_vforkp_t), UM_SLEEP);
765
766		ASSERT(psp->pr_flags & PR_VFORKP);
767		vfp->p_pshandle = P;
768		mdb_list_append(&pt->p_vforkp, vfp);
769		mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
770
771	} else {
772		mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
773		Prelease(t->t_pshandle, PRELEASE_CLEAR);
774		if (!follow_parent)
775			pt_release_parents(t);
776	}
777
778	/*
779	 * Now that all the hard stuff is done, switch t_pshandle back to the
780	 * process we are following and reset our events to the ACTIVE state.
781	 * If we are following the child, reset the libthread_db handle as well
782	 * as the rtld agent.
783	 */
784	if (follow_parent)
785		t->t_pshandle = P;
786	else {
787		t->t_pshandle = C;
788		pt->p_rtld = Prd_agent(C);
789		(void) Pobject_iter(t->t_pshandle, (proc_map_f *)thr_check, t);
790	}
791
792	(void) mdb_tgt_sespec_activate_all(t);
793	(void) mdb_tgt_continue(t, NULL);
794}
795
796/*ARGSUSED*/
797static void
798pt_exec(mdb_tgt_t *t, int vid, void *private)
799{
800	struct ps_prochandle *P = t->t_pshandle;
801	const pstatus_t *psp = Pstatus(P);
802	pt_data_t *pt = t->t_data;
803	int follow_exec = mdb.m_execmode == MDB_EM_FOLLOW;
804	pid_t pid = psp->pr_pid;
805
806	char execname[MAXPATHLEN];
807	mdb_sespec_t *sep, *nsep;
808	mdb_io_t *io;
809	char c;
810
811	mdb_dprintf(MDB_DBG_TGT, "exit from %s: errno=%d\n", proc_sysname(
812	    psp->pr_lwp.pr_what, execname, sizeof (execname)),
813	    psp->pr_lwp.pr_errno);
814
815	if (psp->pr_lwp.pr_errno != 0) {
816		(void) mdb_tgt_continue(t, NULL);
817		return; /* exec failed */
818	}
819
820	/*
821	 * If execmode is ASK and stdout is a terminal, then ask the user to
822	 * explicitly set the exec behavior for this particular exec.  If
823	 * Pstate() still shows PS_LOST, we are being called from pt_setrun()
824	 * directly and therefore we must resume the terminal since it is still
825	 * in the suspended state as far as tgt_continue() is concerned.
826	 */
827	if (mdb.m_execmode == MDB_EM_ASK && mdb.m_term != NULL) {
828		if (Pstate(P) == PS_LOST)
829			IOP_RESUME(mdb.m_term);
830
831		mdb_iob_printf(mdb.m_err, "%s: %s detected: (f)ollow new "
832		    "program or (s)top? ", mdb.m_pname, execname);
833		mdb_iob_flush(mdb.m_err);
834
835		while (IOP_READ(mdb.m_term, &c, sizeof (c)) == sizeof (c)) {
836			if (c == 'F' || c == 'f') {
837				mdb_iob_printf(mdb.m_err, "%c\n", c);
838				follow_exec = TRUE;
839				break;
840			} else if (c == 'S' || c == 's') {
841				mdb_iob_printf(mdb.m_err, "%c\n", c);
842				follow_exec = FALSE;
843				break;
844			}
845		}
846
847		if (Pstate(P) == PS_LOST)
848			IOP_SUSPEND(mdb.m_term);
849	}
850
851	pt_release_parents(t);	/* release any waiting vfork parents */
852	pt_pre_detach(t, FALSE); /* remove our breakpoints and idle events */
853	Preset_maps(P);		/* libproc must delete mappings and symtabs */
854	pt_close_aout(t);	/* free pt symbol tables and GElf file data */
855
856	/*
857	 * If we lost control of the process across the exec and are not able
858	 * to reopen it, we have no choice but to clear the matched event list
859	 * and wait for the user to quit or otherwise release the process.
860	 */
861	if (Pstate(P) == PS_LOST && Preopen(P) == -1) {
862		int error = errno;
863
864		warn("lost control of PID %d due to exec of %s executable\n",
865		    (int)pid, error == EOVERFLOW ? "64-bit" : "set-id");
866
867		for (sep = t->t_matched; sep != T_SE_END; sep = nsep) {
868			nsep = sep->se_matched;
869			sep->se_matched = NULL;
870			mdb_tgt_sespec_rele(t, sep);
871		}
872
873		if (error != EOVERFLOW)
874			return; /* just stop if we exec'd a set-id executable */
875	}
876
877	if (Pstate(P) != PS_LOST) {
878		if (Pexecname(P, execname, sizeof (execname)) == NULL) {
879			(void) mdb_iob_snprintf(execname, sizeof (execname),
880			    "/proc/%d/object/a.out", (int)pid);
881		}
882
883		if (follow_exec == FALSE || psp->pr_dmodel == PR_MODEL_NATIVE)
884			warn("target performed exec of %s\n", execname);
885
886		io = mdb_fdio_create_path(NULL, execname, pt->p_oflags, 0);
887		if (io == NULL) {
888			warn("failed to open %s", execname);
889			warn("a.out symbol tables will not be available\n");
890		} else if (pt_open_aout(t, io) == NULL) {
891			(void) mdb_dis_select(pt_disasm(NULL));
892			mdb_io_destroy(io);
893		} else
894			(void) mdb_dis_select(pt_disasm(&pt->p_file->gf_ehdr));
895	}
896
897	/*
898	 * We reset our libthread_db state here, but deliberately do NOT call
899	 * PTL_DTOR because we do not want to call libthread_db's td_ta_delete.
900	 * This interface is hopelessly broken in that it writes to the process
901	 * address space (which we do not want it to do after an exec) and it
902	 * doesn't bother deallocating any of its storage anyway.
903	 */
904	pt->p_tdb_ops = NULL;
905	pt->p_ptl_ops = &proc_lwp_ops;
906	pt->p_ptl_hdl = NULL;
907
908	if (follow_exec && psp->pr_dmodel != PR_MODEL_NATIVE) {
909		const char *argv[3];
910		char *state, *env;
911		char pidarg[16];
912		size_t envlen;
913
914		if (realpath(getexecname(), execname) == NULL) {
915			warn("cannot follow PID %d -- failed to resolve "
916			    "debugger pathname for re-exec", (int)pid);
917			return;
918		}
919
920		warn("restarting debugger to follow PID %d ...\n", (int)pid);
921		mdb_dprintf(MDB_DBG_TGT, "re-exec'ing %s\n", execname);
922
923		(void) mdb_snprintf(pidarg, sizeof (pidarg), "-p%d", (int)pid);
924
925		state = mdb_get_config();
926		envlen = strlen(MDB_CONFIG_ENV_VAR) + 1 + strlen(state) + 1;
927		env = mdb_alloc(envlen, UM_SLEEP);
928		(void) snprintf(env, envlen,
929		    "%s=%s", MDB_CONFIG_ENV_VAR, state);
930
931		(void) putenv(env);
932
933		argv[0] = mdb.m_pname;
934		argv[1] = pidarg;
935		argv[2] = NULL;
936
937		if (mdb.m_term != NULL)
938			IOP_SUSPEND(mdb.m_term);
939
940		Prelease(P, PRELEASE_CLEAR | PRELEASE_HANG);
941		(void) execv(execname, (char *const *)argv);
942		warn("failed to re-exec debugger");
943
944		if (mdb.m_term != NULL)
945			IOP_RESUME(mdb.m_term);
946
947		t->t_pshandle = pt->p_idlehandle;
948		return;
949	}
950
951	pt_post_attach(t);	/* install tracing flags and activate events */
952	pt_activate_common(t);	/* initialize librtld_db and libthread_db */
953
954	if (psp->pr_dmodel != PR_MODEL_NATIVE && mdb.m_term != NULL) {
955		warn("loadable dcmds will not operate on non-native %d-bit "
956		    "data model\n", psp->pr_dmodel == PR_MODEL_ILP32 ? 32 : 64);
957		warn("use ::release -a and then run mdb -p %d to restart "
958		    "debugger\n", (int)pid);
959	}
960
961	if (follow_exec)
962		(void) mdb_tgt_continue(t, NULL);
963}
964
965static int
966pt_setflags(mdb_tgt_t *t, int flags)
967{
968	pt_data_t *pt = t->t_data;
969
970	if ((flags ^ t->t_flags) & MDB_TGT_F_RDWR) {
971		int mode = (flags & MDB_TGT_F_RDWR) ? O_RDWR : O_RDONLY;
972		mdb_io_t *io;
973
974		if (pt->p_fio == NULL)
975			return (set_errno(EMDB_NOEXEC));
976
977		io = mdb_fdio_create_path(NULL, IOP_NAME(pt->p_fio), mode, 0);
978
979		if (io == NULL)
980			return (-1); /* errno is set for us */
981
982		t->t_flags = (t->t_flags & ~MDB_TGT_F_RDWR) |
983		    (flags & MDB_TGT_F_RDWR);
984
985		pt->p_fio = mdb_io_hold(io);
986		mdb_io_rele(pt->p_file->gf_io);
987		pt->p_file->gf_io = pt->p_fio;
988	}
989
990	if (flags & MDB_TGT_F_FORCE) {
991		t->t_flags |= MDB_TGT_F_FORCE;
992		pt->p_gflags |= PGRAB_FORCE;
993	}
994
995	return (0);
996}
997
998/*ARGSUSED*/
999static int
1000pt_frame(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1001    const mdb_tgt_gregset_t *gregs)
1002{
1003	argc = MIN(argc, (uint_t)(uintptr_t)arglim);
1004	mdb_printf("%a(", pc);
1005
1006	if (argc != 0) {
1007		mdb_printf("%lr", *argv++);
1008		for (argc--; argc != 0; argc--)
1009			mdb_printf(", %lr", *argv++);
1010	}
1011
1012	mdb_printf(")\n");
1013	return (0);
1014}
1015
1016static int
1017pt_framev(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1018    const mdb_tgt_gregset_t *gregs)
1019{
1020	argc = MIN(argc, (uint_t)(uintptr_t)arglim);
1021#if defined(__i386) || defined(__amd64)
1022	mdb_printf("%0?lr %a(", gregs->gregs[R_FP], pc);
1023#else
1024	mdb_printf("%0?lr %a(", gregs->gregs[R_SP], pc);
1025#endif
1026	if (argc != 0) {
1027		mdb_printf("%lr", *argv++);
1028		for (argc--; argc != 0; argc--)
1029			mdb_printf(", %lr", *argv++);
1030	}
1031
1032	mdb_printf(")\n");
1033	return (0);
1034}
1035
1036static int
1037pt_framer(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1038    const mdb_tgt_gregset_t *gregs)
1039{
1040	if (pt_frameregs(arglim, pc, argc, argv, gregs, pc == PC_FAKE) == -1) {
1041		/*
1042		 * Use verbose format if register format is not supported.
1043		 */
1044		return (pt_framev(arglim, pc, argc, argv, gregs));
1045	}
1046
1047	return (0);
1048}
1049
1050/*ARGSUSED*/
1051static int
1052pt_stack_common(uintptr_t addr, uint_t flags, int argc,
1053    const mdb_arg_t *argv, mdb_tgt_stack_f *func, prgreg_t saved_pc)
1054{
1055	void *arg = (void *)(uintptr_t)mdb.m_nargs;
1056	mdb_tgt_t *t = mdb.m_target;
1057	mdb_tgt_gregset_t gregs;
1058
1059	if (argc != 0) {
1060		if (argv->a_type == MDB_TYPE_CHAR || argc > 1)
1061			return (DCMD_USAGE);
1062
1063		if (argv->a_type == MDB_TYPE_STRING)
1064			arg = (void *)(uintptr_t)mdb_strtoull(argv->a_un.a_str);
1065		else
1066			arg = (void *)(uintptr_t)argv->a_un.a_val;
1067	}
1068
1069	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE) {
1070		mdb_warn("no process active\n");
1071		return (DCMD_ERR);
1072	}
1073
1074	/*
1075	 * In the universe of sparcv7, sparcv9, ia32, and amd64 this code can be
1076	 * common: <sys/procfs_isa.h> conveniently #defines R_FP to be the
1077	 * appropriate register we need to set in order to perform a stack
1078	 * traceback from a given frame address.
1079	 */
1080	if (flags & DCMD_ADDRSPEC) {
1081		bzero(&gregs, sizeof (gregs));
1082		gregs.gregs[R_FP] = addr;
1083#ifdef __sparc
1084		gregs.gregs[R_I7] = saved_pc;
1085#endif /* __sparc */
1086	} else if (PTL_GETREGS(t, PTL_TID(t), gregs.gregs) != 0) {
1087		mdb_warn("failed to get current register set");
1088		return (DCMD_ERR);
1089	}
1090
1091	(void) mdb_tgt_stack_iter(t, &gregs, func, arg);
1092	return (DCMD_OK);
1093}
1094
1095static int
1096pt_stack(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1097{
1098	return (pt_stack_common(addr, flags, argc, argv, pt_frame, 0));
1099}
1100
1101static int
1102pt_stackv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1103{
1104	return (pt_stack_common(addr, flags, argc, argv, pt_framev, 0));
1105}
1106
1107static int
1108pt_stackr(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1109{
1110	/*
1111	 * Force printing of first register window, by setting  the
1112	 * saved pc (%i7) to PC_FAKE.
1113	 */
1114	return (pt_stack_common(addr, flags, argc, argv, pt_framer, PC_FAKE));
1115}
1116
1117/*ARGSUSED*/
1118static int
1119pt_ignored(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1120{
1121	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1122	char buf[PRSIGBUFSZ];
1123
1124	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1125		return (DCMD_USAGE);
1126
1127	if (P == NULL) {
1128		mdb_warn("no process is currently active\n");
1129		return (DCMD_ERR);
1130	}
1131
1132	mdb_printf("%s\n", proc_sigset2str(&Pstatus(P)->pr_sigtrace, " ",
1133	    FALSE, buf, sizeof (buf)));
1134
1135	return (DCMD_OK);
1136}
1137
1138/*ARGSUSED*/
1139static int
1140pt_lwpid(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1141{
1142	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1143
1144	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1145		return (DCMD_USAGE);
1146
1147	if (P == NULL) {
1148		mdb_warn("no process is currently active\n");
1149		return (DCMD_ERR);
1150	}
1151
1152	mdb_printf("%d\n", Pstatus(P)->pr_lwp.pr_lwpid);
1153	return (DCMD_OK);
1154}
1155
1156static int
1157pt_print_lwpid(int *n, const lwpstatus_t *psp)
1158{
1159	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1160	int nlwp = Pstatus(P)->pr_nlwp;
1161
1162	if (*n == nlwp - 2)
1163		mdb_printf("%d and ", (int)psp->pr_lwpid);
1164	else if (*n == nlwp - 1)
1165		mdb_printf("%d are", (int)psp->pr_lwpid);
1166	else
1167		mdb_printf("%d, ", (int)psp->pr_lwpid);
1168
1169	(*n)++;
1170	return (0);
1171}
1172
1173/*ARGSUSED*/
1174static int
1175pt_lwpids(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1176{
1177	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1178	int n = 0;
1179
1180	if (P == NULL) {
1181		mdb_warn("no process is currently active\n");
1182		return (DCMD_ERR);
1183	}
1184
1185	switch (Pstatus(P)->pr_nlwp) {
1186	case 0:
1187		mdb_printf("no lwps are");
1188		break;
1189	case 1:
1190		mdb_printf("lwpid %d is the only lwp",
1191		    Pstatus(P)->pr_lwp.pr_lwpid);
1192		break;
1193	default:
1194		mdb_printf("lwpids ");
1195		(void) Plwp_iter(P, (proc_lwp_f *)pt_print_lwpid, &n);
1196	}
1197
1198	switch (Pstate(P)) {
1199	case PS_DEAD:
1200		mdb_printf(" in core of process %d.\n", Pstatus(P)->pr_pid);
1201		break;
1202	case PS_IDLE:
1203		mdb_printf(" in idle target.\n");
1204		break;
1205	default:
1206		mdb_printf(" in process %d.\n", (int)Pstatus(P)->pr_pid);
1207		break;
1208	}
1209
1210	return (DCMD_OK);
1211}
1212
1213/*ARGSUSED*/
1214static int
1215pt_ignore(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1216{
1217	pt_data_t *pt = mdb.m_target->t_data;
1218
1219	if (!(flags & DCMD_ADDRSPEC) || argc != 0)
1220		return (DCMD_USAGE);
1221
1222	if (addr < 1 || addr > pt->p_maxsig) {
1223		mdb_warn("invalid signal number -- 0t%lu\n", addr);
1224		return (DCMD_ERR);
1225	}
1226
1227	(void) mdb_tgt_vespec_iter(mdb.m_target, pt_ignore_sig, (void *)addr);
1228	return (DCMD_OK);
1229}
1230
1231/*ARGSUSED*/
1232static int
1233pt_attach(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1234{
1235	mdb_tgt_t *t = mdb.m_target;
1236	pt_data_t *pt = t->t_data;
1237	int state, perr;
1238
1239	if (!(flags & DCMD_ADDRSPEC) && argc == 0)
1240		return (DCMD_USAGE);
1241
1242	if (((flags & DCMD_ADDRSPEC) && argc != 0) || argc > 1 ||
1243	    (argc != 0 && argv->a_type != MDB_TYPE_STRING))
1244		return (DCMD_USAGE);
1245
1246	if (t->t_pshandle != NULL && Pstate(t->t_pshandle) != PS_IDLE) {
1247		mdb_warn("debugger is already attached to a %s\n",
1248		    (Pstate(t->t_pshandle) == PS_DEAD) ? "core" : "process");
1249		return (DCMD_ERR);
1250	}
1251
1252	if (pt->p_fio == NULL) {
1253		mdb_warn("attach requires executable to be specified on "
1254		    "command-line (or use -p)\n");
1255		return (DCMD_ERR);
1256	}
1257
1258	if (flags & DCMD_ADDRSPEC)
1259		t->t_pshandle = Pgrab((pid_t)addr, pt->p_gflags, &perr);
1260	else
1261		t->t_pshandle = proc_arg_grab(argv->a_un.a_str,
1262		    PR_ARG_ANY, pt->p_gflags, &perr);
1263
1264	if (t->t_pshandle == NULL) {
1265		t->t_pshandle = pt->p_idlehandle;
1266		mdb_warn("cannot attach: %s\n", Pgrab_error(perr));
1267		return (DCMD_ERR);
1268	}
1269
1270	state = Pstate(t->t_pshandle);
1271	if (state != PS_DEAD && state != PS_IDLE) {
1272		(void) Punsetflags(t->t_pshandle, PR_KLC);
1273		(void) Psetflags(t->t_pshandle, PR_RLC);
1274		pt_post_attach(t);
1275		pt_activate_common(t);
1276	}
1277
1278	(void) mdb_tgt_status(t, &t->t_status);
1279	mdb_module_load_all(0);
1280	return (DCMD_OK);
1281}
1282
1283static int
1284pt_regstatus(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1285{
1286	mdb_tgt_t *t = mdb.m_target;
1287
1288	if (t->t_pshandle != NULL) {
1289		const pstatus_t *psp = Pstatus(t->t_pshandle);
1290		int cursig = psp->pr_lwp.pr_cursig;
1291		char signame[SIG2STR_MAX];
1292		int state = Pstate(t->t_pshandle);
1293
1294		if (state != PS_DEAD && state != PS_IDLE)
1295			mdb_printf("process id = %d\n", psp->pr_pid);
1296		else
1297			mdb_printf("no process\n");
1298
1299		if (cursig != 0 && sig2str(cursig, signame) == 0)
1300			mdb_printf("SIG%s: %s\n", signame, strsignal(cursig));
1301	}
1302
1303	return (pt_regs(addr, flags, argc, argv));
1304}
1305
1306static void
1307pt_thread_name(mdb_tgt_t *t, mdb_tgt_tid_t tid, char *buf, size_t bufsize)
1308{
1309	char name[THREAD_NAME_MAX];
1310
1311	buf[0] = '\0';
1312
1313	if (t->t_pshandle == NULL ||
1314	    Plwp_getname(t->t_pshandle, tid, name, sizeof (name)) != 0 ||
1315	    name[0] == '\0') {
1316		(void) mdb_snprintf(buf, bufsize, "%lu", tid);
1317		return;
1318	}
1319
1320	(void) mdb_snprintf(buf, bufsize, "%lu [%s]", tid, name);
1321}
1322
1323static int
1324pt_findstack(uintptr_t tid, uint_t flags, int argc, const mdb_arg_t *argv)
1325{
1326	mdb_tgt_t *t = mdb.m_target;
1327	mdb_tgt_gregset_t gregs;
1328	int showargs = 0;
1329	int count;
1330	uintptr_t pc, sp;
1331	char name[128];
1332
1333	if (!(flags & DCMD_ADDRSPEC))
1334		return (DCMD_USAGE);
1335
1336	count = mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &showargs,
1337	    NULL);
1338	argc -= count;
1339	argv += count;
1340
1341	if (argc > 1 || (argc == 1 && argv->a_type != MDB_TYPE_STRING))
1342		return (DCMD_USAGE);
1343
1344	if (PTL_GETREGS(t, tid, gregs.gregs) != 0) {
1345		mdb_warn("failed to get register set for thread %p", tid);
1346		return (DCMD_ERR);
1347	}
1348
1349	pc = gregs.gregs[R_PC];
1350#if defined(__i386) || defined(__amd64)
1351	sp = gregs.gregs[R_FP];
1352#else
1353	sp = gregs.gregs[R_SP];
1354#endif
1355
1356	pt_thread_name(t, tid, name, sizeof (name));
1357
1358	mdb_printf("stack pointer for thread %s: %p\n", name, sp);
1359	if (pc != 0)
1360		mdb_printf("[ %0?lr %a() ]\n", sp, pc);
1361
1362	(void) mdb_inc_indent(2);
1363	mdb_set_dot(sp);
1364
1365	if (argc == 1)
1366		(void) mdb_eval(argv->a_un.a_str);
1367	else if (showargs)
1368		(void) mdb_eval("<.$C");
1369	else
1370		(void) mdb_eval("<.$C0");
1371
1372	(void) mdb_dec_indent(2);
1373	return (DCMD_OK);
1374}
1375
1376/*ARGSUSED*/
1377static int
1378pt_gcore(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1379{
1380	mdb_tgt_t *t = mdb.m_target;
1381	char *prefix = "core";
1382	char *content_str = NULL;
1383	core_content_t content = CC_CONTENT_DEFAULT;
1384	size_t size;
1385	char *fname;
1386	pid_t pid;
1387
1388	if (flags & DCMD_ADDRSPEC)
1389		return (DCMD_USAGE);
1390
1391	if (mdb_getopts(argc, argv,
1392	    'o', MDB_OPT_STR, &prefix,
1393	    'c', MDB_OPT_STR, &content_str, NULL) != argc)
1394		return (DCMD_USAGE);
1395
1396	if (content_str != NULL &&
1397	    (proc_str2content(content_str, &content) != 0 ||
1398	    content == CC_CONTENT_INVALID)) {
1399		mdb_warn("invalid content string '%s'\n", content_str);
1400		return (DCMD_ERR);
1401	}
1402
1403	if (t->t_pshandle == NULL) {
1404		mdb_warn("no process active\n");
1405		return (DCMD_ERR);
1406	}
1407
1408	pid = Pstatus(t->t_pshandle)->pr_pid;
1409	size = 1 + mdb_snprintf(NULL, 0, "%s.%d", prefix, (int)pid);
1410	fname = mdb_alloc(size, UM_SLEEP | UM_GC);
1411	(void) mdb_snprintf(fname, size, "%s.%d", prefix, (int)pid);
1412
1413	if (Pgcore(t->t_pshandle, fname, content) != 0) {
1414		/*
1415		 * Short writes during dumping are specifically described by
1416		 * EBADE, just as ZFS uses this otherwise-unused code for
1417		 * checksum errors.  Translate to and mdb errno.
1418		 */
1419		if (errno == EBADE)
1420			(void) set_errno(EMDB_SHORTWRITE);
1421		mdb_warn("couldn't dump core");
1422		return (DCMD_ERR);
1423	}
1424
1425	mdb_warn("%s dumped\n", fname);
1426
1427	return (DCMD_OK);
1428}
1429
1430/*ARGSUSED*/
1431static int
1432pt_kill(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1433{
1434	mdb_tgt_t *t = mdb.m_target;
1435	pt_data_t *pt = t->t_data;
1436	int state;
1437
1438	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1439		return (DCMD_USAGE);
1440
1441	if (t->t_pshandle != NULL &&
1442	    (state = Pstate(t->t_pshandle)) != PS_DEAD && state != PS_IDLE) {
1443		mdb_warn("victim process PID %d forcibly terminated\n",
1444		    (int)Pstatus(t->t_pshandle)->pr_pid);
1445		pt_pre_detach(t, TRUE);
1446		pt_release_parents(t);
1447		Prelease(t->t_pshandle, PRELEASE_KILL);
1448		t->t_pshandle = pt->p_idlehandle;
1449		(void) mdb_tgt_status(t, &t->t_status);
1450		mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
1451	} else
1452		mdb_warn("no victim process is currently under control\n");
1453
1454	return (DCMD_OK);
1455}
1456
1457/*ARGSUSED*/
1458static int
1459pt_detach(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1460{
1461	mdb_tgt_t *t = mdb.m_target;
1462	pt_data_t *pt = t->t_data;
1463	int rflags = pt->p_rflags;
1464
1465	if (argc != 0 && argv->a_type == MDB_TYPE_STRING &&
1466	    strcmp(argv->a_un.a_str, "-a") == 0) {
1467		rflags = PRELEASE_HANG | PRELEASE_CLEAR;
1468		argv++;
1469		argc--;
1470	}
1471
1472	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1473		return (DCMD_USAGE);
1474
1475	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE) {
1476		mdb_warn("debugger is not currently attached to a process "
1477		    "or core file\n");
1478		return (DCMD_ERR);
1479	}
1480
1481	pt_pre_detach(t, TRUE);
1482	pt_release_parents(t);
1483	Prelease(t->t_pshandle, rflags);
1484	t->t_pshandle = pt->p_idlehandle;
1485	(void) mdb_tgt_status(t, &t->t_status);
1486	mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
1487
1488	return (DCMD_OK);
1489}
1490
1491static uintmax_t
1492reg_disc_get(const mdb_var_t *v)
1493{
1494	mdb_tgt_t *t = MDB_NV_COOKIE(v);
1495	mdb_tgt_tid_t tid = PTL_TID(t);
1496	mdb_tgt_reg_t r = 0;
1497
1498	if (tid != (mdb_tgt_tid_t)-1L)
1499		(void) mdb_tgt_getareg(t, tid, mdb_nv_get_name(v), &r);
1500
1501	return (r);
1502}
1503
1504static void
1505reg_disc_set(mdb_var_t *v, uintmax_t r)
1506{
1507	mdb_tgt_t *t = MDB_NV_COOKIE(v);
1508	mdb_tgt_tid_t tid = PTL_TID(t);
1509
1510	if (tid != (mdb_tgt_tid_t)-1L && mdb_tgt_putareg(t, tid,
1511	    mdb_nv_get_name(v), r) == -1)
1512		mdb_warn("failed to modify %%%s register", mdb_nv_get_name(v));
1513}
1514
1515static void
1516pt_print_reason(const lwpstatus_t *psp)
1517{
1518	char name[SIG2STR_MAX + 4]; /* enough for SIG+name+\0, syscall or flt */
1519	const char *desc;
1520
1521	switch (psp->pr_why) {
1522	case PR_REQUESTED:
1523		mdb_printf("stopped by debugger");
1524		break;
1525	case PR_SIGNALLED:
1526		mdb_printf("stopped on %s (%s)", proc_signame(psp->pr_what,
1527		    name, sizeof (name)), strsignal(psp->pr_what));
1528		break;
1529	case PR_SYSENTRY:
1530		mdb_printf("stopped on entry to %s system call",
1531		    proc_sysname(psp->pr_what, name, sizeof (name)));
1532		break;
1533	case PR_SYSEXIT:
1534		mdb_printf("stopped on exit from %s system call",
1535		    proc_sysname(psp->pr_what, name, sizeof (name)));
1536		break;
1537	case PR_JOBCONTROL:
1538		mdb_printf("stopped by job control");
1539		break;
1540	case PR_FAULTED:
1541		if (psp->pr_what == FLTBPT) {
1542			mdb_printf("stopped on a breakpoint");
1543		} else if (psp->pr_what == FLTWATCH) {
1544			switch (psp->pr_info.si_code) {
1545			case TRAP_RWATCH:
1546				desc = "read";
1547				break;
1548			case TRAP_WWATCH:
1549				desc = "write";
1550				break;
1551			case TRAP_XWATCH:
1552				desc = "execute";
1553				break;
1554			default:
1555				desc = "unknown";
1556			}
1557			mdb_printf("stopped %s a watchpoint (%s access to %p)",
1558			    psp->pr_info.si_trapafter ? "after" : "on",
1559			    desc, psp->pr_info.si_addr);
1560		} else if (psp->pr_what == FLTTRACE) {
1561			mdb_printf("stopped after a single-step");
1562		} else {
1563			mdb_printf("stopped on a %s fault",
1564			    proc_fltname(psp->pr_what, name, sizeof (name)));
1565		}
1566		break;
1567	case PR_SUSPENDED:
1568	case PR_CHECKPOINT:
1569		mdb_printf("suspended by the kernel");
1570		break;
1571	default:
1572		mdb_printf("stopped for unknown reason (%d/%d)",
1573		    psp->pr_why, psp->pr_what);
1574	}
1575}
1576
1577/*ARGSUSED*/
1578static int
1579pt_status_dcmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1580{
1581	mdb_tgt_t *t = mdb.m_target;
1582	struct ps_prochandle *P = t->t_pshandle;
1583	pt_data_t *pt = t->t_data;
1584
1585	if (P != NULL) {
1586		const psinfo_t *pip = Ppsinfo(P);
1587		const pstatus_t *psp = Pstatus(P);
1588		int cursig = 0, bits = 0, coredump = 0;
1589		int state;
1590		GElf_Sym sym;
1591		uintptr_t panicstr;
1592		char *panicbuf = mdb_alloc(PANIC_BUFSIZE, UM_SLEEP);
1593		const siginfo_t *sip = &(psp->pr_lwp.pr_info);
1594
1595		char execname[MAXPATHLEN], buf[BUFSIZ];
1596		char signame[SIG2STR_MAX + 4]; /* enough for SIG+name+\0 */
1597
1598		mdb_tgt_spec_desc_t desc;
1599		mdb_sespec_t *sep;
1600
1601		struct utsname uts;
1602		prcred_t cred;
1603		psinfo_t pi;
1604
1605		(void) strcpy(uts.nodename, "unknown machine");
1606		(void) Puname(P, &uts);
1607
1608		if (pip != NULL) {
1609			bcopy(pip, &pi, sizeof (psinfo_t));
1610			proc_unctrl_psinfo(&pi);
1611		} else
1612			bzero(&pi, sizeof (psinfo_t));
1613
1614		bits = pi.pr_dmodel == PR_MODEL_ILP32 ? 32 : 64;
1615
1616		state = Pstate(P);
1617		if (psp != NULL && state != PS_UNDEAD && state != PS_IDLE)
1618			cursig = psp->pr_lwp.pr_cursig;
1619
1620		if (state == PS_DEAD && pip != NULL) {
1621			mdb_printf("debugging core file of %s (%d-bit) "
1622			    "from %s\n", pi.pr_fname, bits, uts.nodename);
1623
1624		} else if (state == PS_DEAD) {
1625			mdb_printf("debugging core file\n");
1626
1627		} else if (state == PS_IDLE) {
1628			const GElf_Ehdr *ehp = &pt->p_file->gf_ehdr;
1629
1630			mdb_printf("debugging %s file (%d-bit)\n",
1631			    ehp->e_type == ET_EXEC ? "executable" : "object",
1632			    ehp->e_ident[EI_CLASS] == ELFCLASS32 ? 32 : 64);
1633
1634		} else if (state == PS_UNDEAD && pi.pr_pid == 0) {
1635			mdb_printf("debugging defunct process\n");
1636
1637		} else {
1638			mdb_printf("debugging PID %d (%d-bit)\n",
1639			    pi.pr_pid, bits);
1640		}
1641
1642		if (Pexecname(P, execname, sizeof (execname)) != NULL)
1643			mdb_printf("file: %s\n", execname);
1644
1645		if (pip != NULL && state == PS_DEAD)
1646			mdb_printf("initial argv: %s\n", pi.pr_psargs);
1647
1648		if (state != PS_UNDEAD && state != PS_IDLE) {
1649			mdb_printf("threading model: ");
1650			if (pt->p_ptl_ops == &proc_lwp_ops)
1651				mdb_printf("raw lwps\n");
1652			else
1653				mdb_printf("native threads\n");
1654		}
1655
1656		mdb_printf("status: ");
1657		switch (state) {
1658		case PS_RUN:
1659			ASSERT(!(psp->pr_flags & PR_STOPPED));
1660			mdb_printf("process is running");
1661			if (psp->pr_flags & PR_DSTOP)
1662				mdb_printf(", debugger stop directive pending");
1663			mdb_printf("\n");
1664			break;
1665
1666		case PS_STOP:
1667			ASSERT(psp->pr_flags & PR_STOPPED);
1668			pt_print_reason(&psp->pr_lwp);
1669
1670			if (psp->pr_flags & PR_DSTOP)
1671				mdb_printf(", debugger stop directive pending");
1672			if (psp->pr_flags & PR_ASLEEP)
1673				mdb_printf(", sleeping in %s system call",
1674				    proc_sysname(psp->pr_lwp.pr_syscall,
1675				    signame, sizeof (signame)));
1676
1677			mdb_printf("\n");
1678
1679			for (sep = t->t_matched; sep != T_SE_END;
1680			    sep = sep->se_matched) {
1681				mdb_printf("event: %s\n", sep->se_ops->se_info(
1682				    t, sep, mdb_list_next(&sep->se_velist),
1683				    &desc, buf, sizeof (buf)));
1684			}
1685			break;
1686
1687		case PS_LOST:
1688			mdb_printf("debugger lost control of process\n");
1689			break;
1690
1691		case PS_UNDEAD:
1692			coredump = WIFSIGNALED(pi.pr_wstat) &&
1693			    WCOREDUMP(pi.pr_wstat);
1694			/*FALLTHRU*/
1695
1696		case PS_DEAD:
1697			if (cursig == 0 && WIFSIGNALED(pi.pr_wstat))
1698				cursig = WTERMSIG(pi.pr_wstat);
1699			/*
1700			 * We can only use pr_wstat == 0 as a test for gcore if
1701			 * an NT_PRCRED note is present; these features were
1702			 * added at the same time in Solaris 8.
1703			 */
1704			if (pi.pr_wstat == 0 && Pstate(P) == PS_DEAD &&
1705			    Pcred(P, &cred, 1) == 0) {
1706				mdb_printf("process core file generated "
1707				    "with gcore(1)\n");
1708			} else if (cursig != 0) {
1709				mdb_printf("process terminated by %s (%s)",
1710				    proc_signame(cursig, signame,
1711				    sizeof (signame)), strsignal(cursig));
1712
1713				if (sip->si_signo != 0 && SI_FROMUSER(sip) &&
1714				    sip->si_pid != 0) {
1715					mdb_printf(", pid=%d uid=%u",
1716					    (int)sip->si_pid, sip->si_uid);
1717					if (sip->si_code != 0) {
1718						mdb_printf(" code=%d",
1719						    sip->si_code);
1720					}
1721				} else {
1722					switch (sip->si_signo) {
1723					case SIGILL:
1724					case SIGTRAP:
1725					case SIGFPE:
1726					case SIGSEGV:
1727					case SIGBUS:
1728					case SIGEMT:
1729						mdb_printf(", addr=%p",
1730						    sip->si_addr);
1731					default:
1732						break;
1733					}
1734				}
1735
1736				if (coredump)
1737					mdb_printf(" - core file dumped");
1738				mdb_printf("\n");
1739			} else {
1740				mdb_printf("process terminated with exit "
1741				    "status %d\n", WEXITSTATUS(pi.pr_wstat));
1742			}
1743
1744			if (Plookup_by_name(t->t_pshandle, "libc.so",
1745			    "panicstr", &sym) == 0 &&
1746			    Pread(t->t_pshandle, &panicstr, sizeof (panicstr),
1747			    sym.st_value) == sizeof (panicstr) &&
1748			    Pread_string(t->t_pshandle, panicbuf,
1749			    PANIC_BUFSIZE, panicstr) > 0) {
1750				mdb_printf("panic message: %s",
1751				    panicbuf);
1752			}
1753
1754
1755			break;
1756
1757		case PS_IDLE:
1758			mdb_printf("idle\n");
1759			break;
1760
1761		default:
1762			mdb_printf("unknown libproc Pstate: %d\n", Pstate(P));
1763		}
1764		mdb_free(panicbuf, PANIC_BUFSIZE);
1765
1766	} else if (pt->p_file != NULL) {
1767		const GElf_Ehdr *ehp = &pt->p_file->gf_ehdr;
1768
1769		mdb_printf("debugging %s file (%d-bit)\n",
1770		    ehp->e_type == ET_EXEC ? "executable" : "object",
1771		    ehp->e_ident[EI_CLASS] == ELFCLASS32 ? 32 : 64);
1772		mdb_printf("executable file: %s\n", IOP_NAME(pt->p_fio));
1773		mdb_printf("status: idle\n");
1774	}
1775
1776	return (DCMD_OK);
1777}
1778
1779static int
1780pt_tls(uintptr_t tid, uint_t flags, int argc, const mdb_arg_t *argv)
1781{
1782	const char *name;
1783	const char *object;
1784	GElf_Sym sym;
1785	mdb_syminfo_t si;
1786	mdb_tgt_t *t = mdb.m_target;
1787
1788	if (!(flags & DCMD_ADDRSPEC) || argc > 1)
1789		return (DCMD_USAGE);
1790
1791	if (argc == 0) {
1792		psaddr_t b;
1793
1794		if (tlsbase(t, tid, PR_LMID_EVERY, MDB_TGT_OBJ_EXEC, &b) != 0) {
1795			mdb_warn("failed to lookup tlsbase for %r", tid);
1796			return (DCMD_ERR);
1797		}
1798
1799		mdb_printf("%lr\n", b);
1800		mdb_set_dot(b);
1801
1802		return (DCMD_OK);
1803	}
1804
1805	name = argv[0].a_un.a_str;
1806	object = MDB_TGT_OBJ_EVERY;
1807
1808	if (pt_lookup_by_name_thr(t, object, name, &sym, &si, tid) != 0) {
1809		mdb_warn("failed to lookup %s", name);
1810		return (DCMD_ABORT); /* avoid repeated failure */
1811	}
1812
1813	if (GELF_ST_TYPE(sym.st_info) != STT_TLS && DCMD_HDRSPEC(flags))
1814		mdb_warn("%s does not refer to thread local storage\n", name);
1815
1816	mdb_printf("%llr\n", sym.st_value);
1817	mdb_set_dot(sym.st_value);
1818
1819	return (DCMD_OK);
1820}
1821
1822/*ARGSUSED*/
1823static int
1824pt_tmodel(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1825{
1826	mdb_tgt_t *t = mdb.m_target;
1827	pt_data_t *pt = t->t_data;
1828	const pt_ptl_ops_t *ptl_ops;
1829
1830	if (argc != 1 || argv->a_type != MDB_TYPE_STRING)
1831		return (DCMD_USAGE);
1832
1833	if (strcmp(argv->a_un.a_str, "thread") == 0)
1834		ptl_ops = &proc_tdb_ops;
1835	else if (strcmp(argv->a_un.a_str, "lwp") == 0)
1836		ptl_ops = &proc_lwp_ops;
1837	else
1838		return (DCMD_USAGE);
1839
1840	if (t->t_pshandle != NULL && pt->p_ptl_ops != ptl_ops) {
1841		PTL_DTOR(t);
1842		pt->p_tdb_ops = NULL;
1843		pt->p_ptl_ops = &proc_lwp_ops;
1844		pt->p_ptl_hdl = NULL;
1845
1846		if (ptl_ops == &proc_tdb_ops) {
1847			(void) Pobject_iter(t->t_pshandle, (proc_map_f *)
1848			    thr_check, t);
1849		}
1850	}
1851
1852	(void) mdb_tgt_status(t, &t->t_status);
1853	return (DCMD_OK);
1854}
1855
1856static const char *
1857env_match(const char *cmp, const char *nameval)
1858{
1859	const char *loc;
1860	size_t cmplen = strlen(cmp);
1861
1862	loc = strchr(nameval, '=');
1863	if (loc != NULL && (loc - nameval) == cmplen &&
1864	    strncmp(nameval, cmp, cmplen) == 0) {
1865		return (loc + 1);
1866	}
1867
1868	return (NULL);
1869}
1870
1871/*ARGSUSED*/
1872static int
1873print_env(void *data, struct ps_prochandle *P, uintptr_t addr,
1874    const char *nameval)
1875{
1876	const char *value;
1877
1878	if (nameval == NULL) {
1879		mdb_printf("<0x%p>\n", addr);
1880	} else {
1881		if (data == NULL)
1882			mdb_printf("%s\n", nameval);
1883		else if ((value = env_match(data, nameval)) != NULL)
1884			mdb_printf("%s\n", value);
1885	}
1886
1887	return (0);
1888}
1889
1890/*ARGSUSED*/
1891static int
1892pt_getenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1893{
1894	mdb_tgt_t *t = mdb.m_target;
1895	pt_data_t *pt = t->t_data;
1896	int i;
1897	uint_t opt_t = 0;
1898	mdb_var_t *v;
1899
1900	i = mdb_getopts(argc, argv,
1901	    't', MDB_OPT_SETBITS, TRUE, &opt_t, NULL);
1902
1903	argc -= i;
1904	argv += i;
1905
1906	if ((flags & DCMD_ADDRSPEC) || argc > 1)
1907		return (DCMD_USAGE);
1908
1909	if (argc == 1 && argv->a_type != MDB_TYPE_STRING)
1910		return (DCMD_USAGE);
1911
1912	if (opt_t && t->t_pshandle == NULL) {
1913		mdb_warn("no process active\n");
1914		return (DCMD_ERR);
1915	}
1916
1917	if (opt_t && (Pstate(t->t_pshandle) == PS_IDLE ||
1918	    Pstate(t->t_pshandle) == PS_UNDEAD)) {
1919		mdb_warn("-t option requires target to be running\n");
1920		return (DCMD_ERR);
1921	}
1922
1923	if (opt_t != 0) {
1924		if (Penv_iter(t->t_pshandle, print_env,
1925		    argc == 0 ? NULL : (void *)argv->a_un.a_str) != 0)
1926			return (DCMD_ERR);
1927	} else if (argc == 1) {
1928		if ((v = mdb_nv_lookup(&pt->p_env, argv->a_un.a_str)) == NULL)
1929			return (DCMD_ERR);
1930
1931		ASSERT(strchr(mdb_nv_get_cookie(v), '=') != NULL);
1932		mdb_printf("%s\n", strchr(mdb_nv_get_cookie(v), '=') + 1);
1933	} else {
1934
1935		mdb_nv_rewind(&pt->p_env);
1936		while ((v = mdb_nv_advance(&pt->p_env)) != NULL)
1937			mdb_printf("%s\n", mdb_nv_get_cookie(v));
1938	}
1939
1940	return (DCMD_OK);
1941}
1942
1943/*
1944 * Function to set a variable in the internal environment, which is used when
1945 * creating new processes.  Note that it is possible that 'nameval' can refer to
1946 * read-only memory, if mdb calls putenv() on an existing value before calling
1947 * this function.  While we should avoid this situation, this function is
1948 * designed to be robust in the face of such changes.
1949 */
1950static void
1951pt_env_set(pt_data_t *pt, const char *nameval)
1952{
1953	mdb_var_t *v;
1954	char *equals, *val;
1955	const char *name;
1956	size_t len;
1957
1958	if ((equals = strchr(nameval, '=')) != NULL) {
1959		val = strdup(nameval);
1960		equals = val + (equals - nameval);
1961	} else {
1962		/*
1963		 * nameval doesn't contain an equals character.  Convert this to
1964		 * be 'nameval='.
1965		 */
1966		len = strlen(nameval);
1967		val = mdb_alloc(len + 2, UM_SLEEP);
1968		(void) mdb_snprintf(val, len + 2, "%s=", nameval);
1969		equals = val + len;
1970	}
1971
1972	/* temporary truncate the string for lookup/insert */
1973	*equals = '\0';
1974	v = mdb_nv_lookup(&pt->p_env, val);
1975
1976	if (v != NULL) {
1977		char *old = mdb_nv_get_cookie(v);
1978		mdb_free(old, strlen(old) + 1);
1979		name = mdb_nv_get_name(v);
1980	} else {
1981		/*
1982		 * The environment is created using MDB_NV_EXTNAME, so we must
1983		 * provide external storage for the variable names.
1984		 */
1985		name = strdup(val);
1986	}
1987
1988	*equals = '=';
1989
1990	(void) mdb_nv_insert(&pt->p_env, name, NULL, (uintptr_t)val,
1991	    MDB_NV_EXTNAME);
1992
1993	*equals = '=';
1994}
1995
1996/*
1997 * Clears the internal environment.
1998 */
1999static void
2000pt_env_clear(pt_data_t *pt)
2001{
2002	mdb_var_t *v;
2003	char *val, *name;
2004
2005	mdb_nv_rewind(&pt->p_env);
2006	while ((v = mdb_nv_advance(&pt->p_env)) != NULL) {
2007
2008		name = (char *)mdb_nv_get_name(v);
2009		val = mdb_nv_get_cookie(v);
2010
2011		mdb_nv_remove(&pt->p_env, v);
2012
2013		mdb_free(name, strlen(name) + 1);
2014		mdb_free(val, strlen(val) + 1);
2015	}
2016}
2017
2018/*ARGSUSED*/
2019static int
2020pt_setenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
2021{
2022	mdb_tgt_t *t = mdb.m_target;
2023	pt_data_t *pt = t->t_data;
2024	char *nameval;
2025	size_t len;
2026	int alloc;
2027
2028	if ((flags & DCMD_ADDRSPEC) || argc == 0 || argc > 2)
2029		return (DCMD_USAGE);
2030
2031	if ((argc > 0 && argv[0].a_type != MDB_TYPE_STRING) ||
2032	    (argc > 1 && argv[1].a_type != MDB_TYPE_STRING))
2033		return (DCMD_USAGE);
2034
2035	if (t->t_pshandle == NULL) {
2036		mdb_warn("no process active\n");
2037		return (DCMD_ERR);
2038	}
2039
2040	/*
2041	 * If the process is in some sort of running state, warn the user that
2042	 * changes won't immediately take effect.
2043	 */
2044	if (Pstate(t->t_pshandle) == PS_RUN ||
2045	    Pstate(t->t_pshandle) == PS_STOP) {
2046		mdb_warn("warning: changes will not take effect until process"
2047		    " is restarted\n");
2048	}
2049
2050	/*
2051	 * We allow two forms of operation.  The first is the usual "name=value"
2052	 * parameter.  We also allow the user to specify two arguments, where
2053	 * the first is the name of the variable, and the second is the value.
2054	 */
2055	alloc = 0;
2056	if (argc == 1) {
2057		nameval = (char *)argv->a_un.a_str;
2058	} else {
2059		len = strlen(argv[0].a_un.a_str) +
2060		    strlen(argv[1].a_un.a_str) + 2;
2061		nameval = mdb_alloc(len, UM_SLEEP);
2062		(void) mdb_snprintf(nameval, len, "%s=%s", argv[0].a_un.a_str,
2063		    argv[1].a_un.a_str);
2064		alloc = 1;
2065	}
2066
2067	pt_env_set(pt, nameval);
2068
2069	if (alloc)
2070		mdb_free(nameval, strlen(nameval) + 1);
2071
2072	return (DCMD_OK);
2073}
2074
2075/*ARGSUSED*/
2076static int
2077pt_unsetenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
2078{
2079	mdb_tgt_t *t = mdb.m_target;
2080	pt_data_t *pt = t->t_data;
2081	mdb_var_t *v;
2082	char *value, *name;
2083
2084	if ((flags & DCMD_ADDRSPEC) || argc > 1)
2085		return (DCMD_USAGE);
2086
2087	if (argc == 1 && argv->a_type != MDB_TYPE_STRING)
2088		return (DCMD_USAGE);
2089
2090	if (t->t_pshandle == NULL) {
2091		mdb_warn("no process active\n");
2092		return (DCMD_ERR);
2093	}
2094
2095	/*
2096	 * If the process is in some sort of running state, warn the user that
2097	 * changes won't immediately take effect.
2098	 */
2099	if (Pstate(t->t_pshandle) == PS_RUN ||
2100	    Pstate(t->t_pshandle) == PS_STOP) {
2101		mdb_warn("warning: changes will not take effect until process"
2102		    " is restarted\n");
2103	}
2104
2105	if (argc == 0) {
2106		pt_env_clear(pt);
2107	} else {
2108		if ((v = mdb_nv_lookup(&pt->p_env, argv->a_un.a_str)) != NULL) {
2109			name = (char *)mdb_nv_get_name(v);
2110			value = mdb_nv_get_cookie(v);
2111
2112			mdb_nv_remove(&pt->p_env, v);
2113
2114			mdb_free(name, strlen(name) + 1);
2115			mdb_free(value, strlen(value) + 1);
2116		}
2117	}
2118
2119	return (DCMD_OK);
2120}
2121
2122void
2123getenv_help(void)
2124{
2125	mdb_printf("-t  show current process environment"
2126	    " instead of initial environment.\n");
2127}
2128
2129static const mdb_dcmd_t pt_dcmds[] = {
2130	{ "$c", "?[cnt]", "print stack backtrace", pt_stack },
2131	{ "$C", "?[cnt]", "print stack backtrace", pt_stackv },
2132	{ "$i", NULL, "print signals that are ignored", pt_ignored },
2133	{ "$l", NULL, "print the representative thread's lwp id", pt_lwpid },
2134	{ "$L", NULL, "print list of the active lwp ids", pt_lwpids },
2135	{ "$r", "?[-u]", "print general-purpose registers", pt_regs },
2136	{ "$x", "?", "print floating point registers", pt_fpregs },
2137	{ "$X", "?", "print floating point registers", pt_fpregs },
2138	{ "$y", "?", "print floating point registers", pt_fpregs },
2139	{ "$Y", "?", "print floating point registers", pt_fpregs },
2140	{ "$?", "?", "print status and registers", pt_regstatus },
2141	{ ":A", "?[core|pid]", "attach to process or core file", pt_attach },
2142	{ ":i", ":", "ignore signal (delete all matching events)", pt_ignore },
2143	{ ":k", NULL, "forcibly kill and release target", pt_kill },
2144	{ ":R", "[-a]", "release the previously attached process", pt_detach },
2145	{ "attach", "?[core|pid]",
2146	    "attach to process or core file", pt_attach },
2147	{ "findstack", ":[-v]", "find user thread stack", pt_findstack },
2148	{ "gcore", "[-o prefix] [-c content]",
2149	    "produce a core file for the attached process", pt_gcore },
2150	{ "getenv", "[-t] [name]", "display an environment variable",
2151		pt_getenv, getenv_help },
2152	{ "kill", NULL, "forcibly kill and release target", pt_kill },
2153	{ "release", "[-a]",
2154	    "release the previously attached process", pt_detach },
2155	{ "regs", "?[-u]", "print general-purpose registers", pt_regs },
2156	{ "fpregs", "?[-dqs]", "print floating point registers", pt_fpregs },
2157	{ "setenv", "name=value", "set an environment variable", pt_setenv },
2158	{ "stack", "?[cnt]", "print stack backtrace", pt_stack },
2159	{ "stackregs", "?", "print stack backtrace and registers", pt_stackr },
2160	{ "status", NULL, "print summary of current target", pt_status_dcmd },
2161	{ "tls", ":symbol",
2162	    "lookup TLS data in the context of a given thread", pt_tls },
2163	{ "tmodel", "{thread|lwp}", NULL, pt_tmodel },
2164	{ "unsetenv", "[name]", "clear an environment variable", pt_unsetenv },
2165	{ NULL }
2166};
2167
2168static void
2169pt_thr_walk_fini(mdb_walk_state_t *wsp)
2170{
2171	mdb_addrvec_destroy(wsp->walk_data);
2172	mdb_free(wsp->walk_data, sizeof (mdb_addrvec_t));
2173}
2174
2175static int
2176pt_thr_walk_init(mdb_walk_state_t *wsp)
2177{
2178	wsp->walk_data = mdb_zalloc(sizeof (mdb_addrvec_t), UM_SLEEP);
2179	mdb_addrvec_create(wsp->walk_data);
2180
2181	if (PTL_ITER(mdb.m_target, wsp->walk_data) == -1) {
2182		mdb_warn("failed to iterate over threads");
2183		pt_thr_walk_fini(wsp);
2184		return (WALK_ERR);
2185	}
2186
2187	return (WALK_NEXT);
2188}
2189
2190static int
2191pt_thr_walk_step(mdb_walk_state_t *wsp)
2192{
2193	if (mdb_addrvec_length(wsp->walk_data) != 0) {
2194		return (wsp->walk_callback(mdb_addrvec_shift(wsp->walk_data),
2195		    NULL, wsp->walk_cbdata));
2196	}
2197	return (WALK_DONE);
2198}
2199
2200static const mdb_walker_t pt_walkers[] = {
2201	{ "thread", "walk list of valid thread identifiers",
2202	    pt_thr_walk_init, pt_thr_walk_step, pt_thr_walk_fini },
2203	{ NULL }
2204};
2205
2206static int
2207pt_agent_check(boolean_t *agent, const lwpstatus_t *psp)
2208{
2209	if (psp->pr_flags & PR_AGENT)
2210		*agent = B_TRUE;
2211
2212	return (0);
2213}
2214
2215static void
2216pt_activate_common(mdb_tgt_t *t)
2217{
2218	pt_data_t *pt = t->t_data;
2219	boolean_t hasagent = B_FALSE;
2220	GElf_Sym sym;
2221
2222	/*
2223	 * If we have a libproc handle and AT_BASE is set, the process or core
2224	 * is dynamically linked.  We call Prd_agent() to force libproc to
2225	 * try to initialize librtld_db, and issue a warning if that fails.
2226	 */
2227	if (t->t_pshandle != NULL && Pgetauxval(t->t_pshandle,
2228	    AT_BASE) != -1L && Prd_agent(t->t_pshandle) == NULL) {
2229		mdb_warn("warning: librtld_db failed to initialize; shared "
2230		    "library information will not be available\n");
2231	}
2232
2233	if (t->t_pshandle != NULL) {
2234		(void) Plwp_iter(t->t_pshandle,
2235		    (proc_lwp_f *)pt_agent_check, &hasagent);
2236	}
2237
2238	if (hasagent) {
2239		mdb_warn("agent lwp detected; forcing "
2240		    "lwp thread model (use ::tmodel to change)\n");
2241	} else if (t->t_pshandle != NULL && Pstate(t->t_pshandle) != PS_IDLE) {
2242		/*
2243		 * If we have a libproc handle and we do not have an agent LWP,
2244		 * look for the correct thread debugging library.  (If we have
2245		 * an agent LWP, we leave the model as the raw LWP model to
2246		 * allow the agent LWP to be visible to the debugger.)
2247		 */
2248		(void) Pobject_iter(t->t_pshandle, (proc_map_f *)thr_check, t);
2249	}
2250
2251	/*
2252	 * If there's a global object named '_mdb_abort_info', assuming we're
2253	 * debugging mdb itself and load the developer support module.
2254	 */
2255	if (mdb_gelf_symtab_lookup_by_name(pt->p_symtab, "_mdb_abort_info",
2256	    &sym, NULL) == 0 && GELF_ST_TYPE(sym.st_info) == STT_OBJECT) {
2257		if (mdb_module_load("mdb_ds", MDB_MOD_SILENT) < 0)
2258			mdb_warn("warning: failed to load developer support\n");
2259	}
2260
2261	mdb_tgt_elf_export(pt->p_file);
2262}
2263
2264static void
2265pt_activate(mdb_tgt_t *t)
2266{
2267	static const mdb_nv_disc_t reg_disc = { reg_disc_set, reg_disc_get };
2268
2269	pt_data_t *pt = t->t_data;
2270	struct utsname u1, u2;
2271	mdb_var_t *v;
2272	core_content_t content;
2273
2274	if (t->t_pshandle) {
2275		mdb_prop_postmortem = (Pstate(t->t_pshandle) == PS_DEAD);
2276		mdb_prop_kernel = FALSE;
2277	} else
2278		mdb_prop_kernel = mdb_prop_postmortem = FALSE;
2279
2280	mdb_prop_datamodel = MDB_TGT_MODEL_NATIVE;
2281
2282	/*
2283	 * If we're examining a core file that doesn't contain program text,
2284	 * and uname(2) doesn't match the NT_UTSNAME note recorded in the
2285	 * core file, issue a warning.
2286	 */
2287	if (mdb_prop_postmortem == TRUE &&
2288	    ((content = Pcontent(t->t_pshandle)) == CC_CONTENT_INVALID ||
2289	    !(content & CC_CONTENT_TEXT)) &&
2290	    uname(&u1) >= 0 && Puname(t->t_pshandle, &u2) == 0 &&
2291	    (strcmp(u1.release, u2.release) != 0 ||
2292	    strcmp(u1.version, u2.version) != 0)) {
2293		mdb_warn("warning: core file is from %s %s %s; shared text "
2294		    "mappings may not match installed libraries\n",
2295		    u2.sysname, u2.release, u2.version);
2296	}
2297
2298	/*
2299	 * Perform the common initialization tasks -- these are shared with
2300	 * the pt_exec() and pt_run() subroutines.
2301	 */
2302	pt_activate_common(t);
2303
2304	(void) mdb_tgt_register_dcmds(t, &pt_dcmds[0], MDB_MOD_FORCE);
2305	(void) mdb_tgt_register_walkers(t, &pt_walkers[0], MDB_MOD_FORCE);
2306
2307	/*
2308	 * Iterate through our register description list and export
2309	 * each register as a named variable.
2310	 */
2311	mdb_nv_rewind(&pt->p_regs);
2312	while ((v = mdb_nv_advance(&pt->p_regs)) != NULL) {
2313		ushort_t rd_flags = MDB_TGT_R_FLAGS(mdb_nv_get_value(v));
2314
2315		if (!(rd_flags & MDB_TGT_R_EXPORT))
2316			continue; /* Don't export register as a variable */
2317
2318		(void) mdb_nv_insert(&mdb.m_nv, mdb_nv_get_name(v), &reg_disc,
2319		    (uintptr_t)t, MDB_NV_PERSIST);
2320	}
2321}
2322
2323static void
2324pt_deactivate(mdb_tgt_t *t)
2325{
2326	pt_data_t *pt = t->t_data;
2327	const mdb_dcmd_t *dcp;
2328	const mdb_walker_t *wp;
2329	mdb_var_t *v, *w;
2330
2331	mdb_nv_rewind(&pt->p_regs);
2332	while ((v = mdb_nv_advance(&pt->p_regs)) != NULL) {
2333		ushort_t rd_flags = MDB_TGT_R_FLAGS(mdb_nv_get_value(v));
2334
2335		if (!(rd_flags & MDB_TGT_R_EXPORT))
2336			continue; /* Didn't export register as a variable */
2337
2338		if (w = mdb_nv_lookup(&mdb.m_nv, mdb_nv_get_name(v))) {
2339			w->v_flags &= ~MDB_NV_PERSIST;
2340			mdb_nv_remove(&mdb.m_nv, w);
2341		}
2342	}
2343
2344	for (wp = &pt_walkers[0]; wp->walk_name != NULL; wp++) {
2345		if (mdb_module_remove_walker(t->t_module, wp->walk_name) == -1)
2346			warn("failed to remove walk %s", wp->walk_name);
2347	}
2348
2349	for (dcp = &pt_dcmds[0]; dcp->dc_name != NULL; dcp++) {
2350		if (mdb_module_remove_dcmd(t->t_module, dcp->dc_name) == -1)
2351			warn("failed to remove dcmd %s", dcp->dc_name);
2352	}
2353
2354	mdb_prop_postmortem = FALSE;
2355	mdb_prop_kernel = FALSE;
2356	mdb_prop_datamodel = MDB_TGT_MODEL_UNKNOWN;
2357}
2358
2359static void
2360pt_periodic(mdb_tgt_t *t)
2361{
2362	pt_data_t *pt = t->t_data;
2363
2364	if (pt->p_rdstate == PT_RD_CONSIST) {
2365		if (t->t_pshandle != NULL && Pstate(t->t_pshandle) < PS_LOST &&
2366		    !(mdb.m_flags & MDB_FL_NOMODS)) {
2367			mdb_printf("%s: You've got symbols!\n", mdb.m_pname);
2368			mdb_module_load_all(0);
2369		}
2370		pt->p_rdstate = PT_RD_NONE;
2371	}
2372}
2373
2374static void
2375pt_destroy(mdb_tgt_t *t)
2376{
2377	pt_data_t *pt = t->t_data;
2378
2379	if (pt->p_idlehandle != NULL && pt->p_idlehandle != t->t_pshandle)
2380		Prelease(pt->p_idlehandle, 0);
2381
2382	if (t->t_pshandle != NULL) {
2383		PTL_DTOR(t);
2384		pt_release_parents(t);
2385		pt_pre_detach(t, TRUE);
2386		Prelease(t->t_pshandle, pt->p_rflags);
2387	}
2388
2389	mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
2390	pt_close_aout(t);
2391
2392	if (pt->p_aout_fio != NULL)
2393		mdb_io_rele(pt->p_aout_fio);
2394
2395	pt_env_clear(pt);
2396	mdb_nv_destroy(&pt->p_env);
2397
2398	mdb_nv_destroy(&pt->p_regs);
2399	mdb_free(pt, sizeof (pt_data_t));
2400}
2401
2402/*ARGSUSED*/
2403static const char *
2404pt_name(mdb_tgt_t *t)
2405{
2406	return ("proc");
2407}
2408
2409static const char *
2410pt_platform(mdb_tgt_t *t)
2411{
2412	pt_data_t *pt = t->t_data;
2413
2414	if (t->t_pshandle != NULL &&
2415	    Pplatform(t->t_pshandle, pt->p_platform, MAXNAMELEN) != NULL)
2416		return (pt->p_platform);
2417
2418	return (mdb_conf_platform());
2419}
2420
2421static int
2422pt_uname(mdb_tgt_t *t, struct utsname *utsp)
2423{
2424	if (t->t_pshandle != NULL)
2425		return (Puname(t->t_pshandle, utsp));
2426
2427	return (uname(utsp) >= 0 ? 0 : -1);
2428}
2429
2430static int
2431pt_dmodel(mdb_tgt_t *t)
2432{
2433	if (t->t_pshandle == NULL)
2434		return (MDB_TGT_MODEL_NATIVE);
2435
2436	switch (Pstatus(t->t_pshandle)->pr_dmodel) {
2437	case PR_MODEL_ILP32:
2438		return (MDB_TGT_MODEL_ILP32);
2439	case PR_MODEL_LP64:
2440		return (MDB_TGT_MODEL_LP64);
2441	}
2442
2443	return (MDB_TGT_MODEL_UNKNOWN);
2444}
2445
2446static ssize_t
2447pt_vread(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
2448{
2449	ssize_t n;
2450
2451	/*
2452	 * If no handle is open yet, reads from virtual addresses are
2453	 * allowed to succeed but return zero-filled memory.
2454	 */
2455	if (t->t_pshandle == NULL) {
2456		bzero(buf, nbytes);
2457		return (nbytes);
2458	}
2459
2460	if ((n = Pread(t->t_pshandle, buf, nbytes, addr)) <= 0)
2461		return (set_errno(EMDB_NOMAP));
2462
2463	return (n);
2464}
2465
2466static ssize_t
2467pt_vwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, uintptr_t addr)
2468{
2469	ssize_t n;
2470
2471	/*
2472	 * If no handle is open yet, writes to virtual addresses are
2473	 * allowed to succeed but do not actually modify anything.
2474	 */
2475	if (t->t_pshandle == NULL)
2476		return (nbytes);
2477
2478	n = Pwrite(t->t_pshandle, buf, nbytes, addr);
2479
2480	if (n == -1 && errno == EIO)
2481		return (set_errno(EMDB_NOMAP));
2482
2483	return (n);
2484}
2485
2486static ssize_t
2487pt_fread(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
2488{
2489	pt_data_t *pt = t->t_data;
2490
2491	if (pt->p_file != NULL) {
2492		return (mdb_gelf_rw(pt->p_file, buf, nbytes, addr,
2493		    IOPF_READ(pt->p_fio), GIO_READ));
2494	}
2495
2496	bzero(buf, nbytes);
2497	return (nbytes);
2498}
2499
2500static ssize_t
2501pt_fwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, uintptr_t addr)
2502{
2503	pt_data_t *pt = t->t_data;
2504
2505	if (pt->p_file != NULL) {
2506		return (mdb_gelf_rw(pt->p_file, (void *)buf, nbytes, addr,
2507		    IOPF_WRITE(pt->p_fio), GIO_WRITE));
2508	}
2509
2510	return (nbytes);
2511}
2512
2513static const char *
2514pt_resolve_lmid(const char *object, Lmid_t *lmidp)
2515{
2516	Lmid_t lmid = PR_LMID_EVERY;
2517	const char *p;
2518
2519	if (object == MDB_TGT_OBJ_EVERY || object == MDB_TGT_OBJ_EXEC)
2520		lmid = LM_ID_BASE; /* restrict scope to a.out's link map */
2521	else if (object != MDB_TGT_OBJ_RTLD && strncmp(object, "LM", 2) == 0 &&
2522	    (p = strchr(object, '`')) != NULL) {
2523		object += 2;	/* skip past initial "LM" prefix */
2524		lmid = strntoul(object, (size_t)(p - object), mdb.m_radix);
2525		object = p + 1;	/* skip past link map specifier */
2526	}
2527
2528	*lmidp = lmid;
2529	return (object);
2530}
2531
2532static int
2533tlsbase(mdb_tgt_t *t, mdb_tgt_tid_t tid, Lmid_t lmid, const char *object,
2534    psaddr_t *basep)
2535{
2536	pt_data_t *pt = t->t_data;
2537	const rd_loadobj_t *loadobjp;
2538	td_thrhandle_t th;
2539	td_err_e err;
2540
2541	if (object == MDB_TGT_OBJ_EVERY)
2542		return (set_errno(EINVAL));
2543
2544	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE)
2545		return (set_errno(EMDB_NOPROC));
2546
2547	if (pt->p_tdb_ops == NULL)
2548		return (set_errno(EMDB_TDB));
2549
2550	err = pt->p_tdb_ops->td_ta_map_id2thr(pt->p_ptl_hdl, tid, &th);
2551	if (err != TD_OK)
2552		return (set_errno(tdb_to_errno(err)));
2553
2554	/*
2555	 * If this fails, rtld_db has failed to initialize properly.
2556	 */
2557	if ((loadobjp = Plmid_to_loadobj(t->t_pshandle, lmid, object)) == NULL)
2558		return (set_errno(EMDB_NORTLD));
2559
2560	/*
2561	 * This will fail if the TLS block has not been allocated for the
2562	 * object that contains the TLS symbol in question.
2563	 */
2564	err = pt->p_tdb_ops->td_thr_tlsbase(&th, loadobjp->rl_tlsmodid, basep);
2565	if (err != TD_OK)
2566		return (set_errno(tdb_to_errno(err)));
2567
2568	return (0);
2569}
2570
2571typedef struct {
2572	mdb_tgt_t	*pl_tgt;
2573	const char	*pl_name;
2574	Lmid_t		pl_lmid;
2575	GElf_Sym	*pl_symp;
2576	mdb_syminfo_t	*pl_sip;
2577	mdb_tgt_tid_t	pl_tid;
2578	mdb_bool_t	pl_found;
2579} pt_lookup_t;
2580
2581/*ARGSUSED*/
2582static int
2583pt_lookup_cb(void *data, const prmap_t *pmp, const char *object)
2584{
2585	pt_lookup_t *plp = data;
2586	struct ps_prochandle *P = plp->pl_tgt->t_pshandle;
2587	prsyminfo_t si;
2588	GElf_Sym sym;
2589
2590	if (Pxlookup_by_name(P, plp->pl_lmid, object, plp->pl_name, &sym,
2591	    &si) != 0)
2592		return (0);
2593
2594	/*
2595	 * If we encounter a match with SHN_UNDEF, keep looking for a
2596	 * better match. Return the first match with SHN_UNDEF set if no
2597	 * better match is found.
2598	 */
2599	if (sym.st_shndx == SHN_UNDEF) {
2600		if (!plp->pl_found) {
2601			plp->pl_found = TRUE;
2602			*plp->pl_symp = sym;
2603			plp->pl_sip->sym_table = si.prs_table;
2604			plp->pl_sip->sym_id = si.prs_id;
2605		}
2606
2607		return (0);
2608	}
2609
2610	/*
2611	 * Note that if the symbol's st_shndx is SHN_UNDEF we don't have the
2612	 * TLS offset anyway, so adding in the tlsbase would be worthless.
2613	 */
2614	if (GELF_ST_TYPE(sym.st_info) == STT_TLS &&
2615	    plp->pl_tid != (mdb_tgt_tid_t)-1) {
2616		psaddr_t base;
2617
2618		if (tlsbase(plp->pl_tgt, plp->pl_tid, plp->pl_lmid, object,
2619		    &base) != 0)
2620			return (-1); /* errno is set for us */
2621
2622		sym.st_value += base;
2623	}
2624
2625	plp->pl_found = TRUE;
2626	*plp->pl_symp = sym;
2627	plp->pl_sip->sym_table = si.prs_table;
2628	plp->pl_sip->sym_id = si.prs_id;
2629
2630	return (1);
2631}
2632
2633/*
2634 * Lookup the symbol with a thread context so that we can adjust TLS symbols
2635 * to get the values as they would appear in the context of the given thread.
2636 */
2637static int
2638pt_lookup_by_name_thr(mdb_tgt_t *t, const char *object,
2639    const char *name, GElf_Sym *symp, mdb_syminfo_t *sip, mdb_tgt_tid_t tid)
2640{
2641	struct ps_prochandle *P = t->t_pshandle;
2642	pt_data_t *pt = t->t_data;
2643	Lmid_t lmid;
2644	uint_t i;
2645	const rd_loadobj_t *aout_lop;
2646
2647	object = pt_resolve_lmid(object, &lmid);
2648
2649	if (P != NULL) {
2650		pt_lookup_t pl;
2651
2652		pl.pl_tgt = t;
2653		pl.pl_name = name;
2654		pl.pl_lmid = lmid;
2655		pl.pl_symp = symp;
2656		pl.pl_sip = sip;
2657		pl.pl_tid = tid;
2658		pl.pl_found = FALSE;
2659
2660		if (object == MDB_TGT_OBJ_EVERY) {
2661			if (Pobject_iter_resolved(P, pt_lookup_cb, &pl) == -1)
2662				return (-1); /* errno is set for us */
2663			if ((!pl.pl_found) &&
2664			    (Pobject_iter(P, pt_lookup_cb, &pl) == -1))
2665				return (-1); /* errno is set for us */
2666		} else {
2667			const prmap_t *pmp;
2668
2669			/*
2670			 * This can fail either due to an invalid lmid or
2671			 * an invalid object. To determine which is
2672			 * faulty, we test the lmid against known valid
2673			 * lmids and then see if using a wild-card lmid
2674			 * improves ths situation.
2675			 */
2676			if ((pmp = Plmid_to_map(P, lmid, object)) == NULL) {
2677				if (lmid != PR_LMID_EVERY &&
2678				    lmid != LM_ID_BASE &&
2679				    lmid != LM_ID_LDSO &&
2680				    Plmid_to_map(P, PR_LMID_EVERY, object)
2681				    != NULL)
2682					return (set_errno(EMDB_NOLMID));
2683				else
2684					return (set_errno(EMDB_NOOBJ));
2685			}
2686
2687			if (pt_lookup_cb(&pl, pmp, object) == -1)
2688				return (-1); /* errno is set for us */
2689		}
2690
2691		if (pl.pl_found)
2692			return (0);
2693	}
2694
2695	/*
2696	 * If libproc doesn't have the symbols for rtld, we're cooked --
2697	 * mdb doesn't have those symbols either.
2698	 */
2699	if (object == MDB_TGT_OBJ_RTLD)
2700		return (set_errno(EMDB_NOSYM));
2701
2702	if (object != MDB_TGT_OBJ_EXEC && object != MDB_TGT_OBJ_EVERY) {
2703		int status = mdb_gelf_symtab_lookup_by_file(pt->p_symtab,
2704		    object, name, symp, &sip->sym_id);
2705
2706		if (status != 0) {
2707			if (P != NULL &&
2708			    Plmid_to_map(P, PR_LMID_EVERY, object) != NULL)
2709				return (set_errno(EMDB_NOSYM));
2710			else
2711				return (-1); /* errno set from lookup_by_file */
2712		}
2713
2714		goto found;
2715	}
2716
2717	if (mdb_gelf_symtab_lookup_by_name(pt->p_symtab, name, symp, &i) == 0) {
2718		sip->sym_table = MDB_TGT_SYMTAB;
2719		sip->sym_id = i;
2720		goto local_found;
2721	}
2722
2723	if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, name, symp, &i) == 0) {
2724		sip->sym_table = MDB_TGT_DYNSYM;
2725		sip->sym_id = i;
2726		goto local_found;
2727	}
2728
2729	return (set_errno(EMDB_NOSYM));
2730
2731local_found:
2732	if (pt->p_file != NULL &&
2733	    pt->p_file->gf_ehdr.e_type == ET_DYN &&
2734	    P != NULL &&
2735	    (aout_lop = Pname_to_loadobj(P, PR_OBJ_EXEC)) != NULL)
2736		symp->st_value += aout_lop->rl_base;
2737
2738found:
2739	/*
2740	 * If the symbol has type TLS, libproc should have found the symbol
2741	 * if it exists and has been allocated.
2742	 */
2743	if (GELF_ST_TYPE(symp->st_info) == STT_TLS)
2744		return (set_errno(EMDB_TLS));
2745
2746	return (0);
2747}
2748
2749static int
2750pt_lookup_by_name(mdb_tgt_t *t, const char *object,
2751    const char *name, GElf_Sym *symp, mdb_syminfo_t *sip)
2752{
2753	return (pt_lookup_by_name_thr(t, object, name, symp, sip, PTL_TID(t)));
2754}
2755
2756static int
2757pt_lookup_by_addr(mdb_tgt_t *t, uintptr_t addr, uint_t flags,
2758    char *buf, size_t nbytes, GElf_Sym *symp, mdb_syminfo_t *sip)
2759{
2760	struct ps_prochandle *P = t->t_pshandle;
2761	pt_data_t *pt = t->t_data;
2762	rd_plt_info_t rpi = { 0 };
2763
2764	const char *pltsym;
2765	int rv, match, i;
2766
2767	mdb_gelf_symtab_t *gsts[3];	/* mdb.m_prsym, .symtab, .dynsym */
2768	int gstc = 0;			/* number of valid gsts[] entries */
2769
2770	mdb_gelf_symtab_t *gst = NULL;	/* set if 'sym' is from a gst */
2771	const prmap_t *pmp = NULL;	/* set if 'sym' is from libproc */
2772	GElf_Sym sym;			/* best symbol found so far if !exact */
2773	prsyminfo_t si;
2774
2775	/*
2776	 * Fill in our array of symbol table pointers with the private symbol
2777	 * table, static symbol table, and dynamic symbol table if applicable.
2778	 * These are done in order of precedence so that if we match and
2779	 * MDB_TGT_SYM_EXACT is set, we need not look any further.
2780	 */
2781	if (mdb.m_prsym != NULL)
2782		gsts[gstc++] = mdb.m_prsym;
2783	if (P == NULL && pt->p_symtab != NULL)
2784		gsts[gstc++] = pt->p_symtab;
2785	if (P == NULL && pt->p_dynsym != NULL)
2786		gsts[gstc++] = pt->p_dynsym;
2787
2788	/*
2789	 * Loop through our array attempting to match the address.  If we match
2790	 * and we're in exact mode, we're done.  Otherwise save the symbol in
2791	 * the local sym variable if it is closer than our previous match.
2792	 * We explicitly watch for zero-valued symbols since DevPro insists
2793	 * on storing __fsr_init_value's value as the symbol value instead
2794	 * of storing it in a constant integer.
2795	 */
2796	for (i = 0; i < gstc; i++) {
2797		if (mdb_gelf_symtab_lookup_by_addr(gsts[i], addr, flags, buf,
2798		    nbytes, symp, &sip->sym_id) != 0 || symp->st_value == 0)
2799			continue;
2800
2801		if (flags & MDB_TGT_SYM_EXACT) {
2802			gst = gsts[i];
2803			goto found;
2804		}
2805
2806		if (gst == NULL || mdb_gelf_sym_closer(symp, &sym, addr)) {
2807			gst = gsts[i];
2808			sym = *symp;
2809		}
2810	}
2811
2812	/*
2813	 * If we have no libproc handle active, we're done: fail if gst is
2814	 * NULL; otherwise copy out our best symbol and skip to the end.
2815	 * We also skip to found if gst is the private symbol table: we
2816	 * want this to always take precedence over PLT re-vectoring.
2817	 */
2818	if (P == NULL || (gst != NULL && gst == mdb.m_prsym)) {
2819		if (gst == NULL)
2820			return (set_errno(EMDB_NOSYMADDR));
2821		*symp = sym;
2822		goto found;
2823	}
2824
2825	/*
2826	 * Check to see if the address is in a PLT: if it is, use librtld_db to
2827	 * attempt to resolve the PLT entry.  If the entry is bound, reset addr
2828	 * to the bound address, add a special prefix to the caller's buf,
2829	 * forget our previous guess, and then continue using the new addr.
2830	 * If the entry is not bound, copy the corresponding symbol name into
2831	 * buf and return a fake symbol for the given address.
2832	 */
2833	if ((pltsym = Ppltdest(P, addr)) != NULL) {
2834		const rd_loadobj_t *rlp;
2835		rd_agent_t *rap;
2836
2837		if ((rap = Prd_agent(P)) != NULL &&
2838		    (rlp = Paddr_to_loadobj(P, addr)) != NULL &&
2839		    rd_plt_resolution(rap, addr, Pstatus(P)->pr_lwp.pr_lwpid,
2840		    rlp->rl_plt_base, &rpi) == RD_OK &&
2841		    (rpi.pi_flags & RD_FLG_PI_PLTBOUND)) {
2842			size_t n;
2843			n = mdb_iob_snprintf(buf, nbytes, "PLT=");
2844			addr = rpi.pi_baddr;
2845			if (n > nbytes) {
2846				buf += nbytes;
2847				nbytes = 0;
2848			} else {
2849				buf += n;
2850				nbytes -= n;
2851			}
2852			gst = NULL;
2853		} else {
2854			(void) mdb_iob_snprintf(buf, nbytes, "PLT:%s", pltsym);
2855			bzero(symp, sizeof (GElf_Sym));
2856			symp->st_value = addr;
2857			symp->st_info = GELF_ST_INFO(STB_GLOBAL, STT_FUNC);
2858			return (0);
2859		}
2860	}
2861
2862	/*
2863	 * Ask libproc to convert the address to the closest symbol for us.
2864	 * Once we get the closest symbol, we perform the EXACT match or
2865	 * smart-mode or absolute distance check ourself:
2866	 */
2867	if (PT_LIBPROC_RESOLVE(P)) {
2868		rv = Pxlookup_by_addr_resolved(P, addr, buf, nbytes,
2869		    symp, &si);
2870	} else {
2871		rv = Pxlookup_by_addr(P, addr, buf, nbytes,
2872		    symp, &si);
2873	}
2874	if ((rv == 0) && (symp->st_value != 0) &&
2875	    (gst == NULL || mdb_gelf_sym_closer(symp, &sym, addr))) {
2876
2877		if (flags & MDB_TGT_SYM_EXACT)
2878			match = (addr == symp->st_value);
2879		else if (mdb.m_symdist == 0)
2880			match = (addr >= symp->st_value &&
2881			    addr < symp->st_value + symp->st_size);
2882		else
2883			match = (addr >= symp->st_value &&
2884			    addr < symp->st_value + mdb.m_symdist);
2885
2886		if (match) {
2887			pmp = Paddr_to_map(P, addr);
2888			gst = NULL;
2889			sip->sym_table = si.prs_table;
2890			sip->sym_id = si.prs_id;
2891			goto found;
2892		}
2893	}
2894
2895	/*
2896	 * If we get here, Plookup_by_addr has failed us.  If we have no
2897	 * previous best symbol (gst == NULL), we've failed completely.
2898	 * Otherwise we copy out that symbol and continue on to 'found'.
2899	 */
2900	if (gst == NULL)
2901		return (set_errno(EMDB_NOSYMADDR));
2902	*symp = sym;
2903found:
2904	/*
2905	 * Once we've found something, copy the final name into the caller's
2906	 * buffer and prefix it with the mapping name if appropriate.
2907	 */
2908	if (pmp != NULL && pmp != Pname_to_map(P, PR_OBJ_EXEC)) {
2909		const char *prefix = pmp->pr_mapname;
2910		Lmid_t lmid;
2911
2912		if (PT_LIBPROC_RESOLVE(P)) {
2913			if (Pobjname_resolved(P, addr, pt->p_objname,
2914			    MDB_TGT_MAPSZ))
2915				prefix = pt->p_objname;
2916		} else {
2917			if (Pobjname(P, addr, pt->p_objname, MDB_TGT_MAPSZ))
2918				prefix = pt->p_objname;
2919		}
2920
2921		if (buf != NULL && nbytes > 1) {
2922			(void) strncpy(pt->p_symname, buf, MDB_TGT_SYM_NAMLEN);
2923			pt->p_symname[MDB_TGT_SYM_NAMLEN - 1] = '\0';
2924		} else {
2925			pt->p_symname[0] = '\0';
2926		}
2927
2928		if (prefix == pt->p_objname && Plmid(P, addr, &lmid) == 0 && (
2929		    (lmid != LM_ID_BASE && lmid != LM_ID_LDSO) ||
2930		    (mdb.m_flags & MDB_FL_SHOWLMID))) {
2931			(void) mdb_iob_snprintf(buf, nbytes, "LM%lr`%s`%s",
2932			    lmid, strbasename(prefix), pt->p_symname);
2933		} else {
2934			(void) mdb_iob_snprintf(buf, nbytes, "%s`%s",
2935			    strbasename(prefix), pt->p_symname);
2936		}
2937
2938	} else if (gst != NULL && buf != NULL && nbytes > 0) {
2939		(void) strncpy(buf, mdb_gelf_sym_name(gst, symp), nbytes);
2940		buf[nbytes - 1] = '\0';
2941	}
2942
2943	return (0);
2944}
2945
2946
2947static int
2948pt_symbol_iter_cb(void *arg, const GElf_Sym *sym, const char *name,
2949    const prsyminfo_t *sip)
2950{
2951	pt_symarg_t *psp = arg;
2952
2953	psp->psym_info.sym_id = sip->prs_id;
2954
2955	return (psp->psym_func(psp->psym_private, sym, name, &psp->psym_info,
2956	    psp->psym_obj));
2957}
2958
2959static int
2960pt_objsym_iter(void *arg, const prmap_t *pmp, const char *object)
2961{
2962	Lmid_t lmid = PR_LMID_EVERY;
2963	pt_symarg_t *psp = arg;
2964
2965	psp->psym_obj = object;
2966
2967	(void) Plmid(psp->psym_targ->t_pshandle, pmp->pr_vaddr, &lmid);
2968	(void) Pxsymbol_iter(psp->psym_targ->t_pshandle, lmid, object,
2969	    psp->psym_which, psp->psym_type, pt_symbol_iter_cb, arg);
2970
2971	return (0);
2972}
2973
2974static int
2975pt_symbol_filt(void *arg, const GElf_Sym *sym, const char *name, uint_t id)
2976{
2977	pt_symarg_t *psp = arg;
2978
2979	if (mdb_tgt_sym_match(sym, psp->psym_type)) {
2980		psp->psym_info.sym_id = id;
2981		return (psp->psym_func(psp->psym_private, sym, name,
2982		    &psp->psym_info, psp->psym_obj));
2983	}
2984
2985	return (0);
2986}
2987
2988static int
2989pt_symbol_iter(mdb_tgt_t *t, const char *object, uint_t which,
2990    uint_t type, mdb_tgt_sym_f *func, void *private)
2991{
2992	pt_data_t *pt = t->t_data;
2993	mdb_gelf_symtab_t *gst;
2994	pt_symarg_t ps;
2995	Lmid_t lmid;
2996
2997	object = pt_resolve_lmid(object, &lmid);
2998
2999	ps.psym_targ = t;
3000	ps.psym_which = which;
3001	ps.psym_type = type;
3002	ps.psym_func = func;
3003	ps.psym_private = private;
3004	ps.psym_obj = object;
3005
3006	if (t->t_pshandle != NULL) {
3007		if (object != MDB_TGT_OBJ_EVERY) {
3008			if (Plmid_to_map(t->t_pshandle, lmid, object) == NULL)
3009				return (set_errno(EMDB_NOOBJ));
3010			(void) Pxsymbol_iter(t->t_pshandle, lmid, object,
3011			    which, type, pt_symbol_iter_cb, &ps);
3012			return (0);
3013		} else if (Prd_agent(t->t_pshandle) != NULL) {
3014			if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
3015				(void) Pobject_iter_resolved(t->t_pshandle,
3016				    pt_objsym_iter, &ps);
3017			} else {
3018				(void) Pobject_iter(t->t_pshandle,
3019				    pt_objsym_iter, &ps);
3020			}
3021			return (0);
3022		}
3023	}
3024
3025	if (lmid != LM_ID_BASE && lmid != PR_LMID_EVERY)
3026		return (set_errno(EMDB_NOLMID));
3027
3028	if (object != MDB_TGT_OBJ_EXEC && object != MDB_TGT_OBJ_EVERY &&
3029	    pt->p_fio != NULL &&
3030	    strcmp(object, IOP_NAME(pt->p_fio)) != 0)
3031		return (set_errno(EMDB_NOOBJ));
3032
3033	if (which == MDB_TGT_SYMTAB)
3034		gst = pt->p_symtab;
3035	else
3036		gst = pt->p_dynsym;
3037
3038	if (gst != NULL) {
3039		ps.psym_info.sym_table = gst->gst_tabid;
3040		mdb_gelf_symtab_iter(gst, pt_symbol_filt, &ps);
3041	}
3042
3043	return (0);
3044}
3045
3046static const mdb_map_t *
3047pt_prmap_to_mdbmap(mdb_tgt_t *t, const prmap_t *prp, mdb_map_t *mp)
3048{
3049	struct ps_prochandle *P = t->t_pshandle;
3050	char *rv, name[MAXPATHLEN];
3051	Lmid_t lmid;
3052
3053	if (PT_LIBPROC_RESOLVE(P)) {
3054		rv = Pobjname_resolved(P, prp->pr_vaddr, name, sizeof (name));
3055	} else {
3056		rv = Pobjname(P, prp->pr_vaddr, name, sizeof (name));
3057	}
3058
3059	if (rv != NULL) {
3060		if (Plmid(P, prp->pr_vaddr, &lmid) == 0 && (
3061		    (lmid != LM_ID_BASE && lmid != LM_ID_LDSO) ||
3062		    (mdb.m_flags & MDB_FL_SHOWLMID))) {
3063			(void) mdb_iob_snprintf(mp->map_name, MDB_TGT_MAPSZ,
3064			    "LM%lr`%s", lmid, name);
3065		} else {
3066			(void) strncpy(mp->map_name, name, MDB_TGT_MAPSZ - 1);
3067			mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3068		}
3069	} else {
3070		(void) strncpy(mp->map_name, prp->pr_mapname,
3071		    MDB_TGT_MAPSZ - 1);
3072		mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3073	}
3074
3075	mp->map_base = prp->pr_vaddr;
3076	mp->map_size = prp->pr_size;
3077	mp->map_flags = 0;
3078
3079	if (prp->pr_mflags & MA_READ)
3080		mp->map_flags |= MDB_TGT_MAP_R;
3081	if (prp->pr_mflags & MA_WRITE)
3082		mp->map_flags |= MDB_TGT_MAP_W;
3083	if (prp->pr_mflags & MA_EXEC)
3084		mp->map_flags |= MDB_TGT_MAP_X;
3085
3086	if (prp->pr_mflags & MA_SHM)
3087		mp->map_flags |= MDB_TGT_MAP_SHMEM;
3088	if (prp->pr_mflags & MA_BREAK)
3089		mp->map_flags |= MDB_TGT_MAP_HEAP;
3090	if (prp->pr_mflags & MA_STACK)
3091		mp->map_flags |= MDB_TGT_MAP_STACK;
3092	if (prp->pr_mflags & MA_ANON)
3093		mp->map_flags |= MDB_TGT_MAP_ANON;
3094
3095	return (mp);
3096}
3097
3098/*ARGSUSED*/
3099static int
3100pt_map_apply(void *arg, const prmap_t *prp, const char *name)
3101{
3102	pt_maparg_t *pmp = arg;
3103	mdb_map_t map;
3104
3105	return (pmp->pmap_func(pmp->pmap_private,
3106	    pt_prmap_to_mdbmap(pmp->pmap_targ, prp, &map), map.map_name));
3107}
3108
3109static int
3110pt_mapping_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
3111{
3112	if (t->t_pshandle != NULL) {
3113		pt_maparg_t pm;
3114
3115		pm.pmap_targ = t;
3116		pm.pmap_func = func;
3117		pm.pmap_private = private;
3118
3119		if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
3120			(void) Pmapping_iter_resolved(t->t_pshandle,
3121			    pt_map_apply, &pm);
3122		} else {
3123			(void) Pmapping_iter(t->t_pshandle,
3124			    pt_map_apply, &pm);
3125		}
3126		return (0);
3127	}
3128
3129	return (set_errno(EMDB_NOPROC));
3130}
3131
3132static int
3133pt_object_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
3134{
3135	pt_data_t *pt = t->t_data;
3136
3137	/*
3138	 * If we have a libproc handle, we can just call Pobject_iter to
3139	 * iterate over its list of load object information.
3140	 */
3141	if (t->t_pshandle != NULL) {
3142		pt_maparg_t pm;
3143
3144		pm.pmap_targ = t;
3145		pm.pmap_func = func;
3146		pm.pmap_private = private;
3147
3148		if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
3149			(void) Pobject_iter_resolved(t->t_pshandle,
3150			    pt_map_apply, &pm);
3151		} else {
3152			(void) Pobject_iter(t->t_pshandle,
3153			    pt_map_apply, &pm);
3154		}
3155		return (0);
3156	}
3157
3158	/*
3159	 * If we're examining an executable or other ELF file but we have no
3160	 * libproc handle, fake up some information based on DT_NEEDED entries.
3161	 */
3162	if (pt->p_dynsym != NULL && pt->p_file->gf_dyns != NULL &&
3163	    pt->p_fio != NULL) {
3164		mdb_gelf_sect_t *gsp = pt->p_dynsym->gst_ssect;
3165		GElf_Dyn *dynp = pt->p_file->gf_dyns;
3166		mdb_map_t *mp = &pt->p_map;
3167		const char *s = IOP_NAME(pt->p_fio);
3168		size_t i;
3169
3170		(void) strncpy(mp->map_name, s, MDB_TGT_MAPSZ);
3171		mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3172		mp->map_flags = MDB_TGT_MAP_R | MDB_TGT_MAP_X;
3173		mp->map_base = 0;
3174		mp->map_size = 0;
3175
3176		if (func(private, mp, s) != 0)
3177			return (0);
3178
3179		for (i = 0; i < pt->p_file->gf_ndyns; i++, dynp++) {
3180			if (dynp->d_tag == DT_NEEDED) {
3181				s = (char *)gsp->gs_data + dynp->d_un.d_val;
3182				(void) strncpy(mp->map_name, s, MDB_TGT_MAPSZ);
3183				mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3184				if (func(private, mp, s) != 0)
3185					return (0);
3186			}
3187		}
3188
3189		return (0);
3190	}
3191
3192	return (set_errno(EMDB_NOPROC));
3193}
3194
3195static const mdb_map_t *
3196pt_addr_to_map(mdb_tgt_t *t, uintptr_t addr)
3197{
3198	pt_data_t *pt = t->t_data;
3199	const prmap_t *pmp;
3200
3201	if (t->t_pshandle == NULL) {
3202		(void) set_errno(EMDB_NOPROC);
3203		return (NULL);
3204	}
3205
3206	if ((pmp = Paddr_to_map(t->t_pshandle, addr)) == NULL) {
3207		(void) set_errno(EMDB_NOMAP);
3208		return (NULL);
3209	}
3210
3211	return (pt_prmap_to_mdbmap(t, pmp, &pt->p_map));
3212}
3213
3214static const mdb_map_t *
3215pt_name_to_map(mdb_tgt_t *t, const char *object)
3216{
3217	pt_data_t *pt = t->t_data;
3218	const prmap_t *pmp;
3219	Lmid_t lmid;
3220
3221	if (t->t_pshandle == NULL) {
3222		(void) set_errno(EMDB_NOPROC);
3223		return (NULL);
3224	}
3225
3226	object = pt_resolve_lmid(object, &lmid);
3227
3228	if ((pmp = Plmid_to_map(t->t_pshandle, lmid, object)) == NULL) {
3229		(void) set_errno(EMDB_NOOBJ);
3230		return (NULL);
3231	}
3232
3233	return (pt_prmap_to_mdbmap(t, pmp, &pt->p_map));
3234}
3235
3236static ctf_file_t *
3237pt_addr_to_ctf(mdb_tgt_t *t, uintptr_t addr)
3238{
3239	ctf_file_t *ret;
3240
3241	if (t->t_pshandle == NULL) {
3242		(void) set_errno(EMDB_NOPROC);
3243		return (NULL);
3244	}
3245
3246	if ((ret = Paddr_to_ctf(t->t_pshandle, addr)) == NULL) {
3247		(void) set_errno(EMDB_NOOBJ);
3248		return (NULL);
3249	}
3250
3251	return (ret);
3252}
3253
3254static ctf_file_t *
3255pt_name_to_ctf(mdb_tgt_t *t, const char *name)
3256{
3257	ctf_file_t *ret;
3258
3259	if (t->t_pshandle == NULL) {
3260		(void) set_errno(EMDB_NOPROC);
3261		return (NULL);
3262	}
3263
3264	if ((ret = Pname_to_ctf(t->t_pshandle, name)) == NULL) {
3265		(void) set_errno(EMDB_NOOBJ);
3266		return (NULL);
3267	}
3268
3269	return (ret);
3270}
3271
3272static int
3273pt_status(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3274{
3275	const pstatus_t *psp;
3276	prgregset_t gregs;
3277	int state;
3278
3279	bzero(tsp, sizeof (mdb_tgt_status_t));
3280
3281	if (t->t_pshandle == NULL) {
3282		tsp->st_state = MDB_TGT_IDLE;
3283		return (0);
3284	}
3285
3286	switch (state = Pstate(t->t_pshandle)) {
3287	case PS_RUN:
3288		tsp->st_state = MDB_TGT_RUNNING;
3289		break;
3290
3291	case PS_STOP:
3292		tsp->st_state = MDB_TGT_STOPPED;
3293		psp = Pstatus(t->t_pshandle);
3294
3295		tsp->st_tid = PTL_TID(t);
3296		if (PTL_GETREGS(t, tsp->st_tid, gregs) == 0)
3297			tsp->st_pc = gregs[R_PC];
3298
3299		if (psp->pr_flags & PR_ISTOP)
3300			tsp->st_flags |= MDB_TGT_ISTOP;
3301		if (psp->pr_flags & PR_DSTOP)
3302			tsp->st_flags |= MDB_TGT_DSTOP;
3303
3304		break;
3305
3306	case PS_LOST:
3307		tsp->st_state = MDB_TGT_LOST;
3308		break;
3309	case PS_UNDEAD:
3310		tsp->st_state = MDB_TGT_UNDEAD;
3311		break;
3312	case PS_DEAD:
3313		tsp->st_state = MDB_TGT_DEAD;
3314		break;
3315	case PS_IDLE:
3316		tsp->st_state = MDB_TGT_IDLE;
3317		break;
3318	default:
3319		fail("unknown libproc state (%d)\n", state);
3320	}
3321
3322	if (t->t_flags & MDB_TGT_F_BUSY)
3323		tsp->st_flags |= MDB_TGT_BUSY;
3324
3325	return (0);
3326}
3327
3328static void
3329pt_dupfd(const char *file, int oflags, mode_t mode, int dfd)
3330{
3331	int fd;
3332
3333	if ((fd = open(file, oflags, mode)) >= 0) {
3334		(void) fcntl(fd, F_DUP2FD, dfd);
3335		(void) close(fd);
3336	} else
3337		warn("failed to open %s as descriptor %d", file, dfd);
3338}
3339
3340/*
3341 * The Pcreate_callback() function interposes on the default, empty libproc
3342 * definition.  It will be called following a fork of a new child process by
3343 * Pcreate() below, but before the exec of the new process image.  We use this
3344 * callback to optionally redirect stdin and stdout and reset the dispositions
3345 * of SIGPIPE and SIGQUIT from SIG_IGN back to SIG_DFL.
3346 */
3347/*ARGSUSED*/
3348void
3349Pcreate_callback(struct ps_prochandle *P)
3350{
3351	pt_data_t *pt = mdb.m_target->t_data;
3352
3353	if (pt->p_stdin != NULL)
3354		pt_dupfd(pt->p_stdin, O_RDWR, 0, STDIN_FILENO);
3355	if (pt->p_stdout != NULL)
3356		pt_dupfd(pt->p_stdout, O_CREAT | O_WRONLY, 0666, STDOUT_FILENO);
3357
3358	(void) mdb_signal_sethandler(SIGPIPE, SIG_DFL, NULL);
3359	(void) mdb_signal_sethandler(SIGQUIT, SIG_DFL, NULL);
3360}
3361
3362static int
3363pt_run(mdb_tgt_t *t, int argc, const mdb_arg_t *argv)
3364{
3365	pt_data_t *pt = t->t_data;
3366	struct ps_prochandle *P;
3367	char execname[MAXPATHLEN];
3368	const char **pargv;
3369	int pargc = 0;
3370	int i, perr;
3371	char **penv;
3372	mdb_var_t *v;
3373
3374	if (pt->p_aout_fio == NULL) {
3375		warn("run requires executable to be specified on "
3376		    "command-line\n");
3377		return (set_errno(EMDB_TGT));
3378	}
3379
3380	pargv = mdb_alloc(sizeof (char *) * (argc + 2), UM_SLEEP);
3381	pargv[pargc++] = strbasename(IOP_NAME(pt->p_aout_fio));
3382
3383	for (i = 0; i < argc; i++) {
3384		if (argv[i].a_type != MDB_TYPE_STRING) {
3385			mdb_free(pargv, sizeof (char *) * (argc + 2));
3386			return (set_errno(EINVAL));
3387		}
3388		if (argv[i].a_un.a_str[0] == '<')
3389			pt->p_stdin = argv[i].a_un.a_str + 1;
3390		else if (argv[i].a_un.a_str[0] == '>')
3391			pt->p_stdout = argv[i].a_un.a_str + 1;
3392		else
3393			pargv[pargc++] = argv[i].a_un.a_str;
3394	}
3395	pargv[pargc] = NULL;
3396
3397	/*
3398	 * Since Pcreate() uses execvp() and "." may not be present in $PATH,
3399	 * we must manually prepend "./" when the executable is a simple name.
3400	 */
3401	if (strchr(IOP_NAME(pt->p_aout_fio), '/') == NULL) {
3402		(void) snprintf(execname, sizeof (execname), "./%s",
3403		    IOP_NAME(pt->p_aout_fio));
3404	} else {
3405		(void) snprintf(execname, sizeof (execname), "%s",
3406		    IOP_NAME(pt->p_aout_fio));
3407	}
3408
3409	penv = mdb_alloc((mdb_nv_size(&pt->p_env)+ 1) * sizeof (char *),
3410	    UM_SLEEP);
3411	for (mdb_nv_rewind(&pt->p_env), i = 0;
3412	    (v = mdb_nv_advance(&pt->p_env)) != NULL; i++)
3413		penv[i] = mdb_nv_get_cookie(v);
3414	penv[i] = NULL;
3415
3416	P = Pxcreate(execname, (char **)pargv, penv, &perr, NULL, 0);
3417	mdb_free(pargv, sizeof (char *) * (argc + 2));
3418	pt->p_stdin = pt->p_stdout = NULL;
3419
3420	mdb_free(penv, i * sizeof (char *));
3421
3422	if (P == NULL) {
3423		warn("failed to create process: %s\n", Pcreate_error(perr));
3424		return (set_errno(EMDB_TGT));
3425	}
3426
3427	if (t->t_pshandle != NULL) {
3428		pt_pre_detach(t, TRUE);
3429		if (t->t_pshandle != pt->p_idlehandle)
3430			Prelease(t->t_pshandle, pt->p_rflags);
3431	}
3432
3433	(void) Punsetflags(P, PR_RLC);	/* make sure run-on-last-close is off */
3434	(void) Psetflags(P, PR_KLC);	/* kill on last close by debugger */
3435	pt->p_rflags = PRELEASE_KILL;	/* kill on debugger Prelease */
3436	t->t_pshandle = P;
3437
3438	pt_post_attach(t);
3439	pt_activate_common(t);
3440	(void) mdb_tgt_status(t, &t->t_status);
3441	mdb.m_flags |= MDB_FL_VCREATE;
3442
3443	return (0);
3444}
3445
3446/*
3447 * Forward a signal to the victim process in order to force it to stop or die.
3448 * Refer to the comments above pt_setrun(), below, for more info.
3449 */
3450/*ARGSUSED*/
3451static void
3452pt_sigfwd(int sig, siginfo_t *sip, ucontext_t *ucp, mdb_tgt_t *t)
3453{
3454	struct ps_prochandle *P = t->t_pshandle;
3455	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
3456	pid_t pid = Pstatus(P)->pr_pid;
3457	long ctl[2];
3458
3459	if (getpgid(pid) != mdb.m_pgid) {
3460		mdb_dprintf(MDB_DBG_TGT, "fwd SIG#%d to %d\n", sig, (int)pid);
3461		(void) kill(pid, sig);
3462	}
3463
3464	if (Pwait(P, 1) == 0 && (psp->pr_flags & PR_STOPPED) &&
3465	    psp->pr_why == PR_JOBCONTROL && Pdstop(P) == 0) {
3466		/*
3467		 * If we're job control stopped and our DSTOP is pending, the
3468		 * victim will never see our signal, so undo the kill() and
3469		 * then send SIGCONT the victim to kick it out of the job
3470		 * control stop and force our DSTOP to take effect.
3471		 */
3472		if ((psp->pr_flags & PR_DSTOP) &&
3473		    prismember(&Pstatus(P)->pr_sigpend, sig)) {
3474			ctl[0] = PCUNKILL;
3475			ctl[1] = sig;
3476			(void) write(Pctlfd(P), ctl, sizeof (ctl));
3477		}
3478
3479		mdb_dprintf(MDB_DBG_TGT, "fwd SIGCONT to %d\n", (int)pid);
3480		(void) kill(pid, SIGCONT);
3481	}
3482}
3483
3484/*
3485 * Common code for step and continue: if no victim process has been created,
3486 * call pt_run() to create one.  Then set the victim running, clearing any
3487 * pending fault.  One special case is that if the victim was previously
3488 * stopped on reception of SIGINT, we know that SIGINT was traced and the user
3489 * requested the victim to stop, so clear this signal before continuing.
3490 * For all other traced signals, the signal will be delivered on continue.
3491 *
3492 * Once the victim process is running, we wait for it to stop on an event of
3493 * interest.  Although libproc provides the basic primitive to wait for the
3494 * victim, we must be careful in our handling of signals.  We want to allow the
3495 * user to issue a SIGINT or SIGQUIT using the designated terminal control
3496 * character (typically ^C and ^\), and have these signals stop the target and
3497 * return control to the debugger if the signals are traced.  There are three
3498 * cases to be considered in our implementation:
3499 *
3500 * (1) If the debugger and victim are in the same process group, both receive
3501 * the signal from the terminal driver.  The debugger returns from Pwait() with
3502 * errno = EINTR, so we want to loop back and continue waiting until the victim
3503 * stops on receipt of its SIGINT or SIGQUIT.
3504 *
3505 * (2) If the debugger and victim are in different process groups, and the
3506 * victim is a member of the foreground process group, it will receive the
3507 * signal from the terminal driver and the debugger will not.  As such, we
3508 * will remain blocked in Pwait() until the victim stops on its signal.
3509 *
3510 * (3) If the debugger and victim are in different process groups, and the
3511 * debugger is a member of the foreground process group, it will receive the
3512 * signal from the terminal driver, and the victim will not.  The debugger
3513 * returns from Pwait() with errno = EINTR, so we need to forward the signal
3514 * to the victim process directly and then Pwait() again for it to stop.
3515 *
3516 * We can observe that all three cases are handled by simply calling Pwait()
3517 * repeatedly if it fails with EINTR, and forwarding SIGINT and SIGQUIT to
3518 * the victim if it is in a different process group, using pt_sigfwd() above.
3519 *
3520 * An additional complication is that the process may not be able to field
3521 * the signal if it is currently stopped by job control.  In this case, we
3522 * also DSTOP the process, and then send it a SIGCONT to wake it up from
3523 * job control and force it to re-enter stop() under the control of /proc.
3524 *
3525 * Finally, we would like to allow the user to suspend the process using the
3526 * terminal suspend character (typically ^Z) if both are in the same session.
3527 * We again employ pt_sigfwd() to forward SIGTSTP to the victim, wait for it to
3528 * stop from job control, and then capture it using /proc.  Once the process
3529 * has stopped, normal SIGTSTP processing is restored and the user can issue
3530 * another ^Z in order to suspend the debugger and return to the parent shell.
3531 */
3532static int
3533pt_setrun(mdb_tgt_t *t, mdb_tgt_status_t *tsp, int flags)
3534{
3535	struct ps_prochandle *P = t->t_pshandle;
3536	pt_data_t *pt = t->t_data;
3537	pid_t old_pgid = -1;
3538
3539	mdb_signal_f *intf, *quitf, *tstpf;
3540	const lwpstatus_t *psp;
3541	void *intd, *quitd, *tstpd;
3542
3543	int sig = pt->p_signal;
3544	int error = 0;
3545	int pgid = -1;
3546
3547	pt->p_signal = 0; /* clear pending signal */
3548
3549	if (P == NULL && pt_run(t, 0, NULL) == -1)
3550		return (-1); /* errno is set for us */
3551
3552	P = t->t_pshandle;
3553	psp = &Pstatus(P)->pr_lwp;
3554
3555	if (sig == 0 && psp->pr_why == PR_SIGNALLED && psp->pr_what == SIGINT)
3556		flags |= PRCSIG; /* clear pending SIGINT */
3557	else
3558		flags |= PRCFAULT; /* clear any pending fault (e.g. BPT) */
3559
3560	intf = mdb_signal_gethandler(SIGINT, &intd);
3561	quitf = mdb_signal_gethandler(SIGQUIT, &quitd);
3562	tstpf = mdb_signal_gethandler(SIGTSTP, &tstpd);
3563
3564	(void) mdb_signal_sethandler(SIGINT, (mdb_signal_f *)pt_sigfwd, t);
3565	(void) mdb_signal_sethandler(SIGQUIT, (mdb_signal_f *)pt_sigfwd, t);
3566	(void) mdb_signal_sethandler(SIGTSTP, (mdb_signal_f *)pt_sigfwd, t);
3567
3568	if (sig != 0 && Pstate(P) == PS_RUN &&
3569	    kill(Pstatus(P)->pr_pid, sig) == -1) {
3570		error = errno;
3571		goto out;
3572	}
3573
3574	/*
3575	 * If we attached to a job stopped background process in the same
3576	 * session, make its pgid the foreground process group before running
3577	 * it.  Ignore SIGTTOU while doing this to avoid being suspended.
3578	 */
3579	if (mdb.m_flags & MDB_FL_JOBCTL) {
3580		(void) mdb_signal_sethandler(SIGTTOU, SIG_IGN, NULL);
3581		(void) IOP_CTL(mdb.m_term, TIOCGPGRP, &old_pgid);
3582		(void) IOP_CTL(mdb.m_term, TIOCSPGRP,
3583		    (void *)&Pstatus(P)->pr_pgid);
3584		(void) mdb_signal_sethandler(SIGTTOU, SIG_DFL, NULL);
3585	}
3586
3587	if (Pstate(P) != PS_RUN && Psetrun(P, sig, flags) == -1) {
3588		error = errno;
3589		goto out;
3590	}
3591
3592	/*
3593	 * If the process is stopped on job control, resume its process group
3594	 * by sending it a SIGCONT if we are in the same session.  Otherwise
3595	 * we have no choice but to wait for someone else to foreground it.
3596	 */
3597	if (psp->pr_why == PR_JOBCONTROL) {
3598		if (mdb.m_flags & MDB_FL_JOBCTL)
3599			(void) kill(-Pstatus(P)->pr_pgid, SIGCONT);
3600		else if (mdb.m_term != NULL)
3601			warn("process is still suspended by job control ...\n");
3602	}
3603
3604	/*
3605	 * Wait for the process to stop.  As described above, we loop around if
3606	 * we are interrupted (EINTR).  If we lose control, attempt to re-open
3607	 * the process, or call pt_exec() if that fails to handle a re-exec.
3608	 * If the process dies (ENOENT) or Pwait() fails, break out of the loop.
3609	 */
3610	while (Pwait(P, 0) == -1) {
3611		if (errno != EINTR) {
3612			if (Pstate(P) == PS_LOST) {
3613				if (Preopen(P) == 0)
3614					continue; /* Pwait() again */
3615				else
3616					pt_exec(t, 0, NULL);
3617			} else if (errno != ENOENT)
3618				warn("failed to wait for event");
3619			break;
3620		}
3621	}
3622
3623	/*
3624	 * If we changed the foreground process group, restore the old pgid
3625	 * while ignoring SIGTTOU so we are not accidentally suspended.
3626	 */
3627	if (old_pgid != -1) {
3628		(void) mdb_signal_sethandler(SIGTTOU, SIG_IGN, NULL);
3629		(void) IOP_CTL(mdb.m_term, TIOCSPGRP, &pgid);
3630		(void) mdb_signal_sethandler(SIGTTOU, SIG_DFL, NULL);
3631	}
3632
3633	/*
3634	 * If we're now stopped on exit from a successful exec, release any
3635	 * vfork parents and clean out their address space before returning
3636	 * to tgt_continue() and perturbing the list of armed event specs.
3637	 * If we're stopped for any other reason, just update the mappings.
3638	 */
3639	switch (Pstate(P)) {
3640	case PS_STOP:
3641		if (psp->pr_why == PR_SYSEXIT && psp->pr_errno == 0 &&
3642		    psp->pr_what == SYS_execve)
3643			pt_release_parents(t);
3644		else
3645			Pupdate_maps(P);
3646		break;
3647
3648	case PS_UNDEAD:
3649	case PS_LOST:
3650		pt_release_parents(t);
3651		break;
3652	}
3653
3654out:
3655	(void) mdb_signal_sethandler(SIGINT, intf, intd);
3656	(void) mdb_signal_sethandler(SIGQUIT, quitf, quitd);
3657	(void) mdb_signal_sethandler(SIGTSTP, tstpf, tstpd);
3658	(void) pt_status(t, tsp);
3659
3660	return (error ? set_errno(error) : 0);
3661}
3662
3663static int
3664pt_step(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3665{
3666	return (pt_setrun(t, tsp, PRSTEP));
3667}
3668
3669static int
3670pt_continue(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3671{
3672	return (pt_setrun(t, tsp, 0));
3673}
3674
3675static int
3676pt_signal(mdb_tgt_t *t, int sig)
3677{
3678	pt_data_t *pt = t->t_data;
3679
3680	if (sig > 0 && sig <= pt->p_maxsig) {
3681		pt->p_signal = sig; /* pending until next pt_setrun */
3682		return (0);
3683	}
3684
3685	return (set_errno(EMDB_BADSIGNUM));
3686}
3687
3688static int
3689pt_sysenter_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3690{
3691	struct ps_prochandle *P = t->t_pshandle;
3692
3693	if (P != NULL && Pstate(P) < PS_LOST) {
3694		sep->se_data = args; /* data is raw system call number */
3695		return (Psysentry(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3696	}
3697
3698	return (set_errno(EMDB_NOPROC));
3699}
3700
3701static void
3702pt_sysenter_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3703{
3704	(void) Psysentry(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3705}
3706
3707/*ARGSUSED*/
3708static char *
3709pt_sysenter_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3710    mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3711{
3712	char name[32];
3713	int sysnum;
3714
3715	if (vep != NULL)
3716		sysnum = (intptr_t)vep->ve_args;
3717	else
3718		sysnum = (intptr_t)sep->se_data;
3719
3720	(void) proc_sysname(sysnum, name, sizeof (name));
3721	(void) mdb_iob_snprintf(buf, nbytes, "stop on entry to %s", name);
3722
3723	return (buf);
3724}
3725
3726/*ARGSUSED*/
3727static int
3728pt_sysenter_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3729{
3730	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3731	int sysnum = (intptr_t)sep->se_data;
3732
3733	return (psp->pr_why == PR_SYSENTRY && psp->pr_what == sysnum);
3734}
3735
3736static const mdb_se_ops_t proc_sysenter_ops = {
3737	pt_sysenter_ctor,	/* se_ctor */
3738	pt_sysenter_dtor,	/* se_dtor */
3739	pt_sysenter_info,	/* se_info */
3740	no_se_secmp,		/* se_secmp */
3741	no_se_vecmp,		/* se_vecmp */
3742	no_se_arm,		/* se_arm */
3743	no_se_disarm,		/* se_disarm */
3744	no_se_cont,		/* se_cont */
3745	pt_sysenter_match	/* se_match */
3746};
3747
3748static int
3749pt_sysexit_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3750{
3751	struct ps_prochandle *P = t->t_pshandle;
3752
3753	if (P != NULL && Pstate(P) < PS_LOST) {
3754		sep->se_data = args; /* data is raw system call number */
3755		return (Psysexit(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3756	}
3757
3758	return (set_errno(EMDB_NOPROC));
3759}
3760
3761static void
3762pt_sysexit_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3763{
3764	(void) Psysexit(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3765}
3766
3767/*ARGSUSED*/
3768static char *
3769pt_sysexit_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3770    mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3771{
3772	char name[32];
3773	int sysnum;
3774
3775	if (vep != NULL)
3776		sysnum = (intptr_t)vep->ve_args;
3777	else
3778		sysnum = (intptr_t)sep->se_data;
3779
3780	(void) proc_sysname(sysnum, name, sizeof (name));
3781	(void) mdb_iob_snprintf(buf, nbytes, "stop on exit from %s", name);
3782
3783	return (buf);
3784}
3785
3786/*ARGSUSED*/
3787static int
3788pt_sysexit_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3789{
3790	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3791	int sysnum = (intptr_t)sep->se_data;
3792
3793	return (psp->pr_why == PR_SYSEXIT && psp->pr_what == sysnum);
3794}
3795
3796static const mdb_se_ops_t proc_sysexit_ops = {
3797	pt_sysexit_ctor,	/* se_ctor */
3798	pt_sysexit_dtor,	/* se_dtor */
3799	pt_sysexit_info,	/* se_info */
3800	no_se_secmp,		/* se_secmp */
3801	no_se_vecmp,		/* se_vecmp */
3802	no_se_arm,		/* se_arm */
3803	no_se_disarm,		/* se_disarm */
3804	no_se_cont,		/* se_cont */
3805	pt_sysexit_match	/* se_match */
3806};
3807
3808static int
3809pt_signal_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3810{
3811	struct ps_prochandle *P = t->t_pshandle;
3812
3813	if (P != NULL && Pstate(P) < PS_LOST) {
3814		sep->se_data = args; /* data is raw signal number */
3815		return (Psignal(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3816	}
3817
3818	return (set_errno(EMDB_NOPROC));
3819}
3820
3821static void
3822pt_signal_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3823{
3824	(void) Psignal(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3825}
3826
3827/*ARGSUSED*/
3828static char *
3829pt_signal_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3830    mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3831{
3832	char name[SIG2STR_MAX];
3833	int signum;
3834
3835	if (vep != NULL)
3836		signum = (intptr_t)vep->ve_args;
3837	else
3838		signum = (intptr_t)sep->se_data;
3839
3840	(void) proc_signame(signum, name, sizeof (name));
3841	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s", name);
3842
3843	return (buf);
3844}
3845
3846/*ARGSUSED*/
3847static int
3848pt_signal_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3849{
3850	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3851	int signum = (intptr_t)sep->se_data;
3852
3853	return (psp->pr_why == PR_SIGNALLED && psp->pr_what == signum);
3854}
3855
3856static const mdb_se_ops_t proc_signal_ops = {
3857	pt_signal_ctor,		/* se_ctor */
3858	pt_signal_dtor,		/* se_dtor */
3859	pt_signal_info,		/* se_info */
3860	no_se_secmp,		/* se_secmp */
3861	no_se_vecmp,		/* se_vecmp */
3862	no_se_arm,		/* se_arm */
3863	no_se_disarm,		/* se_disarm */
3864	no_se_cont,		/* se_cont */
3865	pt_signal_match		/* se_match */
3866};
3867
3868static int
3869pt_fault_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3870{
3871	struct ps_prochandle *P = t->t_pshandle;
3872
3873	if (P != NULL && Pstate(P) < PS_LOST) {
3874		sep->se_data = args; /* data is raw fault number */
3875		return (Pfault(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3876	}
3877
3878	return (set_errno(EMDB_NOPROC));
3879}
3880
3881static void
3882pt_fault_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3883{
3884	int fault = (intptr_t)sep->se_data;
3885
3886	if (fault != FLTBPT && fault != FLTTRACE && fault != FLTWATCH)
3887		(void) Pfault(t->t_pshandle, fault, FALSE);
3888}
3889
3890/*ARGSUSED*/
3891static char *
3892pt_fault_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3893    mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3894{
3895	char name[32];
3896	int fltnum;
3897
3898	if (vep != NULL)
3899		fltnum = (intptr_t)vep->ve_args;
3900	else
3901		fltnum = (intptr_t)sep->se_data;
3902
3903	(void) proc_fltname(fltnum, name, sizeof (name));
3904	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s", name);
3905
3906	return (buf);
3907}
3908
3909/*ARGSUSED*/
3910static int
3911pt_fault_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3912{
3913	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3914	int fltnum = (intptr_t)sep->se_data;
3915
3916	return (psp->pr_why == PR_FAULTED && psp->pr_what == fltnum);
3917}
3918
3919static const mdb_se_ops_t proc_fault_ops = {
3920	pt_fault_ctor,		/* se_ctor */
3921	pt_fault_dtor,		/* se_dtor */
3922	pt_fault_info,		/* se_info */
3923	no_se_secmp,		/* se_secmp */
3924	no_se_vecmp,		/* se_vecmp */
3925	no_se_arm,		/* se_arm */
3926	no_se_disarm,		/* se_disarm */
3927	no_se_cont,		/* se_cont */
3928	pt_fault_match		/* se_match */
3929};
3930
3931/*
3932 * Callback for pt_ignore() dcmd above: for each VID, determine if it
3933 * corresponds to a vespec that traces the specified signal, and delete it.
3934 */
3935/*ARGSUSED*/
3936static int
3937pt_ignore_sig(mdb_tgt_t *t, void *sig, int vid, void *data)
3938{
3939	mdb_vespec_t *vep = mdb_tgt_vespec_lookup(t, vid);
3940
3941	if (vep->ve_se->se_ops == &proc_signal_ops && vep->ve_args == sig)
3942		(void) mdb_tgt_vespec_delete(t, vid);
3943
3944	return (0);
3945}
3946
3947static int
3948pt_brkpt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3949{
3950	pt_data_t *pt = t->t_data;
3951	pt_bparg_t *pta = args;
3952	pt_brkpt_t *ptb;
3953	GElf_Sym s;
3954
3955	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) >= PS_LOST)
3956		return (set_errno(EMDB_NOPROC));
3957
3958	if (pta->pta_symbol != NULL) {
3959		if (!pt->p_rtld_finished &&
3960		    strchr(pta->pta_symbol, '`') == NULL)
3961			return (set_errno(EMDB_NOSYM));
3962		if (mdb_tgt_lookup_by_scope(t, pta->pta_symbol, &s,
3963		    NULL) == -1) {
3964			if (errno != EMDB_NOOBJ && !(errno == EMDB_NOSYM &&
3965			    (!(mdb.m_flags & MDB_FL_BPTNOSYMSTOP) ||
3966			    !pt->p_rtld_finished))) {
3967				warn("breakpoint %s activation failed",
3968				    pta->pta_symbol);
3969			}
3970			return (-1); /* errno is set for us */
3971		}
3972
3973		pta->pta_addr = (uintptr_t)s.st_value;
3974	}
3975
3976#ifdef __sparc
3977	if (pta->pta_addr & 3)
3978		return (set_errno(EMDB_BPALIGN));
3979#endif
3980
3981	if (Paddr_to_map(t->t_pshandle, pta->pta_addr) == NULL)
3982		return (set_errno(EMDB_NOMAP));
3983
3984	ptb = mdb_alloc(sizeof (pt_brkpt_t), UM_SLEEP);
3985	ptb->ptb_addr = pta->pta_addr;
3986	ptb->ptb_instr = 0;
3987	sep->se_data = ptb;
3988
3989	return (0);
3990}
3991
3992/*ARGSUSED*/
3993static void
3994pt_brkpt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3995{
3996	mdb_free(sep->se_data, sizeof (pt_brkpt_t));
3997}
3998
3999/*ARGSUSED*/
4000static char *
4001pt_brkpt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
4002    mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
4003{
4004	uintptr_t addr = 0;
4005
4006	if (vep != NULL) {
4007		pt_bparg_t *pta = vep->ve_args;
4008
4009		if (pta->pta_symbol != NULL) {
4010			(void) mdb_iob_snprintf(buf, nbytes, "stop at %s",
4011			    pta->pta_symbol);
4012		} else {
4013			(void) mdb_iob_snprintf(buf, nbytes, "stop at %a",
4014			    pta->pta_addr);
4015			addr = pta->pta_addr;
4016		}
4017
4018	} else {
4019		addr = ((pt_brkpt_t *)sep->se_data)->ptb_addr;
4020		(void) mdb_iob_snprintf(buf, nbytes, "stop at %a", addr);
4021	}
4022
4023	sp->spec_base = addr;
4024	sp->spec_size = sizeof (instr_t);
4025
4026	return (buf);
4027}
4028
4029static int
4030pt_brkpt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4031{
4032	pt_brkpt_t *ptb = sep->se_data;
4033	pt_bparg_t *pta = args;
4034	GElf_Sym sym;
4035
4036	if (pta->pta_symbol != NULL) {
4037		return (mdb_tgt_lookup_by_scope(t, pta->pta_symbol,
4038		    &sym, NULL) == 0 && sym.st_value == ptb->ptb_addr);
4039	}
4040
4041	return (pta->pta_addr == ptb->ptb_addr);
4042}
4043
4044/*ARGSUSED*/
4045static int
4046pt_brkpt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
4047{
4048	pt_bparg_t *pta1 = vep->ve_args;
4049	pt_bparg_t *pta2 = args;
4050
4051	if (pta1->pta_symbol != NULL && pta2->pta_symbol != NULL)
4052		return (strcmp(pta1->pta_symbol, pta2->pta_symbol) == 0);
4053
4054	if (pta1->pta_symbol == NULL && pta2->pta_symbol == NULL)
4055		return (pta1->pta_addr == pta2->pta_addr);
4056
4057	return (0); /* fail if one is symbolic, other is an explicit address */
4058}
4059
4060static int
4061pt_brkpt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
4062{
4063	pt_brkpt_t *ptb = sep->se_data;
4064	return (Psetbkpt(t->t_pshandle, ptb->ptb_addr, &ptb->ptb_instr));
4065}
4066
4067/*
4068 * In order to disarm a breakpoint, we replace the trap instruction at ptb_addr
4069 * with the saved instruction.  However, if we have stopped after a successful
4070 * exec(2), we do not want to restore ptb_instr because the address space has
4071 * now been replaced with the text of a different executable, and so restoring
4072 * the saved instruction would be incorrect.  The exec itself has effectively
4073 * removed all breakpoint trap instructions for us, so we can just return.
4074 */
4075static int
4076pt_brkpt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
4077{
4078	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4079	pt_brkpt_t *ptb = sep->se_data;
4080
4081	if (psp->pr_why == PR_SYSEXIT && psp->pr_errno == 0 &&
4082	    psp->pr_what == SYS_execve)
4083		return (0); /* do not restore saved instruction */
4084
4085	return (Pdelbkpt(t->t_pshandle, ptb->ptb_addr, ptb->ptb_instr));
4086}
4087
4088/*
4089 * Determine whether the specified sespec is an armed watchpoint that overlaps
4090 * with the given breakpoint and has the given flags set.  We use this to find
4091 * conflicts with breakpoints, below.
4092 */
4093static int
4094pt_wp_overlap(mdb_sespec_t *sep, pt_brkpt_t *ptb, int flags)
4095{
4096	const prwatch_t *wp = sep->se_data;
4097
4098	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
4099	    sep->se_ops == &proc_wapt_ops && (wp->pr_wflags & flags) &&
4100	    ptb->ptb_addr - wp->pr_vaddr < wp->pr_size);
4101}
4102
4103/*
4104 * We step over breakpoints using Pxecbkpt() in libproc.  If a conflicting
4105 * watchpoint is present, we must temporarily remove it before stepping over
4106 * the breakpoint so we do not immediately re-trigger the watchpoint.  We know
4107 * the watchpoint has already triggered on our trap instruction as part of
4108 * fetching it.  Before we return, we must re-install any disabled watchpoints.
4109 */
4110static int
4111pt_brkpt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4112{
4113	pt_brkpt_t *ptb = sep->se_data;
4114	int status = -1;
4115	int error;
4116	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4117
4118	/*
4119	 * If the PC no longer matches our original address, then the user has
4120	 * changed it while we have been stopped. In this case, it no longer
4121	 * makes any sense to continue over this breakpoint.  We return as if we
4122	 * continued normally.
4123	 */
4124	if ((uintptr_t)psp->pr_info.si_addr != psp->pr_reg[R_PC])
4125		return (pt_status(t, tsp));
4126
4127	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4128		if (pt_wp_overlap(sep, ptb, WA_EXEC))
4129			(void) Pdelwapt(t->t_pshandle, sep->se_data);
4130	}
4131
4132	if (Pxecbkpt(t->t_pshandle, ptb->ptb_instr) == 0 &&
4133	    Pdelbkpt(t->t_pshandle, ptb->ptb_addr, ptb->ptb_instr) == 0)
4134		status = pt_status(t, tsp);
4135
4136	error = errno; /* save errno from Pxecbkpt, Pdelbkpt, or pt_status */
4137
4138	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4139		if (pt_wp_overlap(sep, ptb, WA_EXEC) &&
4140		    Psetwapt(t->t_pshandle, sep->se_data) == -1) {
4141			sep->se_state = MDB_TGT_SPEC_ERROR;
4142			sep->se_errno = errno;
4143		}
4144	}
4145
4146	(void) set_errno(error);
4147	return (status);
4148}
4149
4150/*ARGSUSED*/
4151static int
4152pt_brkpt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4153{
4154	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4155	pt_brkpt_t *ptb = sep->se_data;
4156
4157	return (psp->pr_why == PR_FAULTED && psp->pr_what == FLTBPT &&
4158	    psp->pr_reg[R_PC] == ptb->ptb_addr);
4159}
4160
4161static const mdb_se_ops_t proc_brkpt_ops = {
4162	pt_brkpt_ctor,		/* se_ctor */
4163	pt_brkpt_dtor,		/* se_dtor */
4164	pt_brkpt_info,		/* se_info */
4165	pt_brkpt_secmp,		/* se_secmp */
4166	pt_brkpt_vecmp,		/* se_vecmp */
4167	pt_brkpt_arm,		/* se_arm */
4168	pt_brkpt_disarm,	/* se_disarm */
4169	pt_brkpt_cont,		/* se_cont */
4170	pt_brkpt_match		/* se_match */
4171};
4172
4173static int
4174pt_wapt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4175{
4176	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) >= PS_LOST)
4177		return (set_errno(EMDB_NOPROC));
4178
4179	sep->se_data = mdb_alloc(sizeof (prwatch_t), UM_SLEEP);
4180	bcopy(args, sep->se_data, sizeof (prwatch_t));
4181	return (0);
4182}
4183
4184/*ARGSUSED*/
4185static void
4186pt_wapt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
4187{
4188	mdb_free(sep->se_data, sizeof (prwatch_t));
4189}
4190
4191/*ARGSUSED*/
4192static char *
4193pt_wapt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
4194    mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
4195{
4196	prwatch_t *wp = vep != NULL ? vep->ve_args : sep->se_data;
4197	char desc[24];
4198
4199	ASSERT(wp->pr_wflags != 0);
4200	desc[0] = '\0';
4201
4202	switch (wp->pr_wflags) {
4203	case WA_READ:
4204		(void) strcat(desc, "/read");
4205		break;
4206	case WA_WRITE:
4207		(void) strcat(desc, "/write");
4208		break;
4209	case WA_EXEC:
4210		(void) strcat(desc, "/exec");
4211		break;
4212	default:
4213		if (wp->pr_wflags & WA_READ)
4214			(void) strcat(desc, "/r");
4215		if (wp->pr_wflags & WA_WRITE)
4216			(void) strcat(desc, "/w");
4217		if (wp->pr_wflags & WA_EXEC)
4218			(void) strcat(desc, "/x");
4219	}
4220
4221	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s of [%la, %la)",
4222	    desc + 1, wp->pr_vaddr, wp->pr_vaddr + wp->pr_size);
4223
4224	sp->spec_base = wp->pr_vaddr;
4225	sp->spec_size = wp->pr_size;
4226
4227	return (buf);
4228}
4229
4230/*ARGSUSED*/
4231static int
4232pt_wapt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4233{
4234	prwatch_t *wp1 = sep->se_data;
4235	prwatch_t *wp2 = args;
4236
4237	return (wp1->pr_vaddr == wp2->pr_vaddr &&
4238	    wp1->pr_size == wp2->pr_size && wp1->pr_wflags == wp2->pr_wflags);
4239}
4240
4241/*ARGSUSED*/
4242static int
4243pt_wapt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
4244{
4245	prwatch_t *wp1 = vep->ve_args;
4246	prwatch_t *wp2 = args;
4247
4248	return (wp1->pr_vaddr == wp2->pr_vaddr &&
4249	    wp1->pr_size == wp2->pr_size && wp1->pr_wflags == wp2->pr_wflags);
4250}
4251
4252static int
4253pt_wapt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
4254{
4255	return (Psetwapt(t->t_pshandle, sep->se_data));
4256}
4257
4258static int
4259pt_wapt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
4260{
4261	return (Pdelwapt(t->t_pshandle, sep->se_data));
4262}
4263
4264/*
4265 * Determine whether the specified sespec is an armed breakpoint at the
4266 * given %pc.  We use this to find conflicts with watchpoints below.
4267 */
4268static int
4269pt_bp_overlap(mdb_sespec_t *sep, uintptr_t pc)
4270{
4271	pt_brkpt_t *ptb = sep->se_data;
4272
4273	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
4274	    sep->se_ops == &proc_brkpt_ops && ptb->ptb_addr == pc);
4275}
4276
4277/*
4278 * We step over watchpoints using Pxecwapt() in libproc.  If a conflicting
4279 * breakpoint is present, we must temporarily disarm it before stepping
4280 * over the watchpoint so we do not immediately re-trigger the breakpoint.
4281 * This is similar to the case handled in pt_brkpt_cont(), above.
4282 */
4283static int
4284pt_wapt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4285{
4286	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4287	mdb_sespec_t *bep = NULL;
4288	int status = -1;
4289	int error;
4290
4291	/*
4292	 * If the PC no longer matches our original address, then the user has
4293	 * changed it while we have been stopped. In this case, it no longer
4294	 * makes any sense to continue over this instruction.  We return as if
4295	 * we continued normally.
4296	 */
4297	if ((uintptr_t)psp->pr_info.si_pc != psp->pr_reg[R_PC])
4298		return (pt_status(t, tsp));
4299
4300	if (psp->pr_info.si_code != TRAP_XWATCH) {
4301		for (bep = mdb_list_next(&t->t_active); bep != NULL;
4302		    bep = mdb_list_next(bep)) {
4303			if (pt_bp_overlap(bep, psp->pr_reg[R_PC])) {
4304				(void) bep->se_ops->se_disarm(t, bep);
4305				bep->se_state = MDB_TGT_SPEC_ACTIVE;
4306				break;
4307			}
4308		}
4309	}
4310
4311	if (Pxecwapt(t->t_pshandle, sep->se_data) == 0)
4312		status = pt_status(t, tsp);
4313
4314	error = errno; /* save errno from Pxecwapt or pt_status */
4315
4316	if (bep != NULL)
4317		mdb_tgt_sespec_arm_one(t, bep);
4318
4319	(void) set_errno(error);
4320	return (status);
4321}
4322
4323/*ARGSUSED*/
4324static int
4325pt_wapt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4326{
4327	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4328	prwatch_t *wp = sep->se_data;
4329
4330	return (psp->pr_why == PR_FAULTED && psp->pr_what == FLTWATCH &&
4331	    (uintptr_t)psp->pr_info.si_addr - wp->pr_vaddr < wp->pr_size);
4332}
4333
4334static const mdb_se_ops_t proc_wapt_ops = {
4335	pt_wapt_ctor,		/* se_ctor */
4336	pt_wapt_dtor,		/* se_dtor */
4337	pt_wapt_info,		/* se_info */
4338	pt_wapt_secmp,		/* se_secmp */
4339	pt_wapt_vecmp,		/* se_vecmp */
4340	pt_wapt_arm,		/* se_arm */
4341	pt_wapt_disarm,		/* se_disarm */
4342	pt_wapt_cont,		/* se_cont */
4343	pt_wapt_match		/* se_match */
4344};
4345
4346static void
4347pt_bparg_dtor(mdb_vespec_t *vep)
4348{
4349	pt_bparg_t *pta = vep->ve_args;
4350
4351	if (pta->pta_symbol != NULL)
4352		strfree(pta->pta_symbol);
4353
4354	mdb_free(pta, sizeof (pt_bparg_t));
4355}
4356
4357static int
4358pt_add_vbrkpt(mdb_tgt_t *t, uintptr_t addr,
4359    int spec_flags, mdb_tgt_se_f *func, void *data)
4360{
4361	pt_bparg_t *pta = mdb_alloc(sizeof (pt_bparg_t), UM_SLEEP);
4362
4363	pta->pta_symbol = NULL;
4364	pta->pta_addr = addr;
4365
4366	return (mdb_tgt_vespec_insert(t, &proc_brkpt_ops, spec_flags,
4367	    func, data, pta, pt_bparg_dtor));
4368}
4369
4370static int
4371pt_add_sbrkpt(mdb_tgt_t *t, const char *sym,
4372    int spec_flags, mdb_tgt_se_f *func, void *data)
4373{
4374	pt_bparg_t *pta;
4375
4376	if (sym[0] == '`') {
4377		(void) set_errno(EMDB_NOOBJ);
4378		return (0);
4379	}
4380
4381	if (sym[strlen(sym) - 1] == '`') {
4382		(void) set_errno(EMDB_NOSYM);
4383		return (0);
4384	}
4385
4386	pta = mdb_alloc(sizeof (pt_bparg_t), UM_SLEEP);
4387	pta->pta_symbol = strdup(sym);
4388	pta->pta_addr = 0;
4389
4390	return (mdb_tgt_vespec_insert(t, &proc_brkpt_ops, spec_flags,
4391	    func, data, pta, pt_bparg_dtor));
4392}
4393
4394static int
4395pt_wparg_overlap(const prwatch_t *wp1, const prwatch_t *wp2)
4396{
4397	if (wp2->pr_vaddr + wp2->pr_size <= wp1->pr_vaddr)
4398		return (0); /* no range overlap */
4399
4400	if (wp1->pr_vaddr + wp1->pr_size <= wp2->pr_vaddr)
4401		return (0); /* no range overlap */
4402
4403	return (wp1->pr_vaddr != wp2->pr_vaddr ||
4404	    wp1->pr_size != wp2->pr_size || wp1->pr_wflags != wp2->pr_wflags);
4405}
4406
4407static void
4408pt_wparg_dtor(mdb_vespec_t *vep)
4409{
4410	mdb_free(vep->ve_args, sizeof (prwatch_t));
4411}
4412
4413static int
4414pt_add_vwapt(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
4415    int spec_flags, mdb_tgt_se_f *func, void *data)
4416{
4417	prwatch_t *wp = mdb_alloc(sizeof (prwatch_t), UM_SLEEP);
4418	mdb_sespec_t *sep;
4419
4420	wp->pr_vaddr = addr;
4421	wp->pr_size = len;
4422	wp->pr_wflags = 0;
4423
4424	if (wflags & MDB_TGT_WA_R)
4425		wp->pr_wflags |= WA_READ;
4426	if (wflags & MDB_TGT_WA_W)
4427		wp->pr_wflags |= WA_WRITE;
4428	if (wflags & MDB_TGT_WA_X)
4429		wp->pr_wflags |= WA_EXEC;
4430
4431	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4432		if (sep->se_ops == &proc_wapt_ops &&
4433		    mdb_list_next(&sep->se_velist) != NULL &&
4434		    pt_wparg_overlap(wp, sep->se_data))
4435			goto dup;
4436	}
4437
4438	for (sep = mdb_list_next(&t->t_idle); sep; sep = mdb_list_next(sep)) {
4439		if (sep->se_ops == &proc_wapt_ops && pt_wparg_overlap(wp,
4440		    ((mdb_vespec_t *)mdb_list_next(&sep->se_velist))->ve_args))
4441			goto dup;
4442	}
4443
4444	return (mdb_tgt_vespec_insert(t, &proc_wapt_ops, spec_flags,
4445	    func, data, wp, pt_wparg_dtor));
4446
4447dup:
4448	mdb_free(wp, sizeof (prwatch_t));
4449	(void) set_errno(EMDB_WPDUP);
4450	return (0);
4451}
4452
4453static int
4454pt_add_sysenter(mdb_tgt_t *t, int sysnum,
4455    int spec_flags, mdb_tgt_se_f *func, void *data)
4456{
4457	if (sysnum <= 0 || sysnum > PRMAXSYS) {
4458		(void) set_errno(EMDB_BADSYSNUM);
4459		return (0);
4460	}
4461
4462	return (mdb_tgt_vespec_insert(t, &proc_sysenter_ops, spec_flags,
4463	    func, data, (void *)(uintptr_t)sysnum, no_ve_dtor));
4464}
4465
4466static int
4467pt_add_sysexit(mdb_tgt_t *t, int sysnum,
4468    int spec_flags, mdb_tgt_se_f *func, void *data)
4469{
4470	if (sysnum <= 0 || sysnum > PRMAXSYS) {
4471		(void) set_errno(EMDB_BADSYSNUM);
4472		return (0);
4473	}
4474
4475	return (mdb_tgt_vespec_insert(t, &proc_sysexit_ops, spec_flags,
4476	    func, data, (void *)(uintptr_t)sysnum, no_ve_dtor));
4477}
4478
4479static int
4480pt_add_signal(mdb_tgt_t *t, int signum,
4481    int spec_flags, mdb_tgt_se_f *func, void *data)
4482{
4483	pt_data_t *pt = t->t_data;
4484
4485	if (signum <= 0 || signum > pt->p_maxsig) {
4486		(void) set_errno(EMDB_BADSIGNUM);
4487		return (0);
4488	}
4489
4490	return (mdb_tgt_vespec_insert(t, &proc_signal_ops, spec_flags,
4491	    func, data, (void *)(uintptr_t)signum, no_ve_dtor));
4492}
4493
4494static int
4495pt_add_fault(mdb_tgt_t *t, int fltnum,
4496    int spec_flags, mdb_tgt_se_f *func, void *data)
4497{
4498	if (fltnum <= 0 || fltnum > PRMAXFAULT) {
4499		(void) set_errno(EMDB_BADFLTNUM);
4500		return (0);
4501	}
4502
4503	return (mdb_tgt_vespec_insert(t, &proc_fault_ops, spec_flags,
4504	    func, data, (void *)(uintptr_t)fltnum, no_ve_dtor));
4505}
4506
4507static int
4508pt_getareg(mdb_tgt_t *t, mdb_tgt_tid_t tid,
4509    const char *rname, mdb_tgt_reg_t *rp)
4510{
4511	pt_data_t *pt = t->t_data;
4512	prgregset_t grs;
4513	mdb_var_t *v;
4514
4515	if (t->t_pshandle == NULL)
4516		return (set_errno(EMDB_NOPROC));
4517
4518	if ((v = mdb_nv_lookup(&pt->p_regs, rname)) != NULL) {
4519		uintmax_t rd_nval = mdb_nv_get_value(v);
4520		ushort_t rd_num = MDB_TGT_R_NUM(rd_nval);
4521		ushort_t rd_flags = MDB_TGT_R_FLAGS(rd_nval);
4522
4523		if (!MDB_TGT_R_IS_FP(rd_flags)) {
4524			mdb_tgt_reg_t r = 0;
4525
4526#if defined(__sparc) && defined(_ILP32)
4527			/*
4528			 * If we are debugging on 32-bit SPARC, the globals and
4529			 * outs can have 32 upper bits hiding in the xregs.
4530			 */
4531			/* gcc doesn't like >= R_G0 because R_G0 == 0 */
4532			int is_g = (rd_num == R_G0 ||
4533			    rd_num >= R_G1 && rd_num <= R_G7);
4534			int is_o = (rd_num >= R_O0 && rd_num <= R_O7);
4535			prxregset_t xrs;
4536
4537			if (is_g && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4538			    xrs.pr_type == XR_TYPE_V8P) {
4539				r |= (uint64_t)xrs.pr_un.pr_v8p.pr_xg[
4540				    rd_num - R_G0 + XR_G0] << 32;
4541			}
4542
4543			if (is_o && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4544			    xrs.pr_type == XR_TYPE_V8P) {
4545				r |= (uint64_t)xrs.pr_un.pr_v8p.pr_xo[
4546				    rd_num - R_O0 + XR_O0] << 32;
4547			}
4548#endif	/* __sparc && _ILP32 */
4549
4550			/*
4551			 * Avoid sign-extension by casting: recall that procfs
4552			 * defines prgreg_t as a long or int and our native
4553			 * register handling uses uint64_t's.
4554			 */
4555			if (PTL_GETREGS(t, tid, grs) == 0) {
4556				*rp = r | (ulong_t)grs[rd_num];
4557				if (rd_flags & MDB_TGT_R_32)
4558					*rp &= 0xffffffffULL;
4559				else if (rd_flags & MDB_TGT_R_16)
4560					*rp &= 0xffffULL;
4561				else if (rd_flags & MDB_TGT_R_8H)
4562					*rp = (*rp & 0xff00ULL) >> 8;
4563				else if (rd_flags & MDB_TGT_R_8L)
4564					*rp &= 0xffULL;
4565				return (0);
4566			}
4567			return (-1);
4568		} else
4569			return (pt_getfpreg(t, tid, rd_num, rd_flags, rp));
4570	}
4571
4572	return (set_errno(EMDB_BADREG));
4573}
4574
4575static int
4576pt_putareg(mdb_tgt_t *t, mdb_tgt_tid_t tid, const char *rname, mdb_tgt_reg_t r)
4577{
4578	pt_data_t *pt = t->t_data;
4579	prgregset_t grs;
4580	mdb_var_t *v;
4581
4582	if (t->t_pshandle == NULL)
4583		return (set_errno(EMDB_NOPROC));
4584
4585	if ((v = mdb_nv_lookup(&pt->p_regs, rname)) != NULL) {
4586		uintmax_t rd_nval = mdb_nv_get_value(v);
4587		ushort_t rd_num = MDB_TGT_R_NUM(rd_nval);
4588		ushort_t rd_flags = MDB_TGT_R_FLAGS(rd_nval);
4589
4590		if (!MDB_TGT_R_IS_FP(rd_flags)) {
4591
4592			if (rd_flags & MDB_TGT_R_32)
4593				r &= 0xffffffffULL;
4594			else if (rd_flags & MDB_TGT_R_16)
4595				r &= 0xffffULL;
4596			else if (rd_flags & MDB_TGT_R_8H)
4597				r = (r & 0xffULL) << 8;
4598			else if (rd_flags & MDB_TGT_R_8L)
4599				r &= 0xffULL;
4600
4601#if defined(__sparc) && defined(_ILP32)
4602			/*
4603			 * If we are debugging on 32-bit SPARC, the globals and
4604			 * outs can have 32 upper bits stored in the xregs.
4605			 */
4606			int is_g = (rd_num == R_G0 ||
4607			    rd_num >= R_G1 && rd_num <= R_G7);
4608			int is_o = (rd_num >= R_O0 && rd_num <= R_O7);
4609			prxregset_t xrs;
4610
4611			if ((is_g || is_o) && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4612			    xrs.pr_type == XR_TYPE_V8P) {
4613				if (is_g) {
4614					xrs.pr_un.pr_v8p.pr_xg[rd_num -
4615					    R_G0 + XR_G0] = (uint32_t)(r >> 32);
4616				} else if (is_o) {
4617					xrs.pr_un.pr_v8p.pr_xo[rd_num -
4618					    R_O0 + XR_O0] = (uint32_t)(r >> 32);
4619				}
4620
4621				if (PTL_SETXREGS(t, tid, &xrs) == -1)
4622					return (-1);
4623			}
4624#endif	/* __sparc && _ILP32 */
4625
4626			if (PTL_GETREGS(t, tid, grs) == 0) {
4627				grs[rd_num] = (prgreg_t)r;
4628				return (PTL_SETREGS(t, tid, grs));
4629			}
4630			return (-1);
4631		} else
4632			return (pt_putfpreg(t, tid, rd_num, rd_flags, r));
4633	}
4634
4635	return (set_errno(EMDB_BADREG));
4636}
4637
4638static int
4639pt_stack_call(pt_stkarg_t *psp, const prgregset_t grs, uint_t argc, long *argv)
4640{
4641	psp->pstk_gotpc |= (grs[R_PC] != 0);
4642
4643	if (!psp->pstk_gotpc)
4644		return (0); /* skip initial zeroed frames */
4645
4646	return (psp->pstk_func(psp->pstk_private, grs[R_PC],
4647	    argc, argv, (const struct mdb_tgt_gregset *)grs));
4648}
4649
4650static int
4651pt_stack_iter(mdb_tgt_t *t, const mdb_tgt_gregset_t *gsp,
4652    mdb_tgt_stack_f *func, void *arg)
4653{
4654	if (t->t_pshandle != NULL) {
4655		pt_stkarg_t pstk;
4656
4657		pstk.pstk_func = func;
4658		pstk.pstk_private = arg;
4659		pstk.pstk_gotpc = FALSE;
4660
4661		(void) Pstack_iter(t->t_pshandle, gsp->gregs,
4662		    (proc_stack_f *)pt_stack_call, &pstk);
4663
4664		return (0);
4665	}
4666
4667	return (set_errno(EMDB_NOPROC));
4668}
4669
4670static int
4671pt_auxv(mdb_tgt_t *t, const auxv_t **auxvp)
4672{
4673	if (t->t_pshandle != NULL) {
4674		*auxvp = Pgetauxvec(t->t_pshandle);
4675		return (0);
4676	}
4677
4678	return (set_errno(EMDB_NOPROC));
4679}
4680
4681
4682static const mdb_tgt_ops_t proc_ops = {
4683	pt_setflags,				/* t_setflags */
4684	(int (*)())(uintptr_t) mdb_tgt_notsup,	/* t_setcontext */
4685	pt_activate,				/* t_activate */
4686	pt_deactivate,				/* t_deactivate */
4687	pt_periodic,				/* t_periodic */
4688	pt_destroy,				/* t_destroy */
4689	pt_name,				/* t_name */
4690	(const char *(*)()) mdb_conf_isa,	/* t_isa */
4691	pt_platform,				/* t_platform */
4692	pt_uname,				/* t_uname */
4693	pt_dmodel,				/* t_dmodel */
4694	(ssize_t (*)()) mdb_tgt_notsup,		/* t_aread */
4695	(ssize_t (*)()) mdb_tgt_notsup,		/* t_awrite */
4696	pt_vread,				/* t_vread */
4697	pt_vwrite,				/* t_vwrite */
4698	(ssize_t (*)()) mdb_tgt_notsup,		/* t_pread */
4699	(ssize_t (*)()) mdb_tgt_notsup,		/* t_pwrite */
4700	pt_fread,				/* t_fread */
4701	pt_fwrite,				/* t_fwrite */
4702	(ssize_t (*)()) mdb_tgt_notsup,		/* t_ioread */
4703	(ssize_t (*)()) mdb_tgt_notsup,		/* t_iowrite */
4704	(int (*)())(uintptr_t) mdb_tgt_notsup,	/* t_vtop */
4705	pt_lookup_by_name,			/* t_lookup_by_name */
4706	pt_lookup_by_addr,			/* t_lookup_by_addr */
4707	pt_symbol_iter,				/* t_symbol_iter */
4708	pt_mapping_iter,			/* t_mapping_iter */
4709	pt_object_iter,				/* t_object_iter */
4710	pt_addr_to_map,				/* t_addr_to_map */
4711	pt_name_to_map,				/* t_name_to_map */
4712	pt_addr_to_ctf,				/* t_addr_to_ctf */
4713	pt_name_to_ctf,				/* t_name_to_ctf */
4714	pt_status,				/* t_status */
4715	pt_run,					/* t_run */
4716	pt_step,				/* t_step */
4717	pt_step_out,				/* t_step_out */
4718	pt_next,				/* t_next */
4719	pt_continue,				/* t_cont */
4720	pt_signal,				/* t_signal */
4721	pt_add_vbrkpt,				/* t_add_vbrkpt */
4722	pt_add_sbrkpt,				/* t_add_sbrkpt */
4723	(int (*)())(uintptr_t) mdb_tgt_null,	/* t_add_pwapt */
4724	pt_add_vwapt,				/* t_add_vwapt */
4725	(int (*)())(uintptr_t) mdb_tgt_null,	/* t_add_iowapt */
4726	pt_add_sysenter,			/* t_add_sysenter */
4727	pt_add_sysexit,				/* t_add_sysexit */
4728	pt_add_signal,				/* t_add_signal */
4729	pt_add_fault,				/* t_add_fault */
4730	pt_getareg,				/* t_getareg */
4731	pt_putareg,				/* t_putareg */
4732	pt_stack_iter,				/* t_stack_iter */
4733	pt_auxv					/* t_auxv */
4734};
4735
4736/*
4737 * Utility function for converting libproc errno values to mdb error values
4738 * for the ptl calls below.  Currently, we only need to convert ENOENT to
4739 * EMDB_NOTHREAD to produce a more useful error message for the user.
4740 */
4741static int
4742ptl_err(int error)
4743{
4744	if (error != 0 && errno == ENOENT)
4745		return (set_errno(EMDB_NOTHREAD));
4746
4747	return (error);
4748}
4749
4750/*ARGSUSED*/
4751static mdb_tgt_tid_t
4752pt_lwp_tid(mdb_tgt_t *t, void *tap)
4753{
4754	if (t->t_pshandle != NULL)
4755		return (Pstatus(t->t_pshandle)->pr_lwp.pr_lwpid);
4756
4757	return (set_errno(EMDB_NOPROC));
4758}
4759
4760static int
4761pt_lwp_add(mdb_addrvec_t *ap, const lwpstatus_t *psp)
4762{
4763	mdb_addrvec_unshift(ap, psp->pr_lwpid);
4764	return (0);
4765}
4766
4767/*ARGSUSED*/
4768static int
4769pt_lwp_iter(mdb_tgt_t *t, void *tap, mdb_addrvec_t *ap)
4770{
4771	if (t->t_pshandle != NULL)
4772		return (Plwp_iter(t->t_pshandle, (proc_lwp_f *)pt_lwp_add, ap));
4773
4774	return (set_errno(EMDB_NOPROC));
4775}
4776
4777/*ARGSUSED*/
4778static int
4779pt_lwp_getregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4780{
4781	if (t->t_pshandle != NULL) {
4782		return (ptl_err(Plwp_getregs(t->t_pshandle,
4783		    (lwpid_t)tid, gregs)));
4784	}
4785	return (set_errno(EMDB_NOPROC));
4786}
4787
4788/*ARGSUSED*/
4789static int
4790pt_lwp_setregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4791{
4792	if (t->t_pshandle != NULL) {
4793		return (ptl_err(Plwp_setregs(t->t_pshandle,
4794		    (lwpid_t)tid, gregs)));
4795	}
4796	return (set_errno(EMDB_NOPROC));
4797}
4798
4799#ifdef	__sparc
4800
4801/*ARGSUSED*/
4802static int
4803pt_lwp_getxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prxregset_t *xregs)
4804{
4805	if (t->t_pshandle != NULL) {
4806		return (ptl_err(Plwp_getxregs(t->t_pshandle,
4807		    (lwpid_t)tid, xregs)));
4808	}
4809	return (set_errno(EMDB_NOPROC));
4810}
4811
4812/*ARGSUSED*/
4813static int
4814pt_lwp_setxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4815    const prxregset_t *xregs)
4816{
4817	if (t->t_pshandle != NULL) {
4818		return (ptl_err(Plwp_setxregs(t->t_pshandle,
4819		    (lwpid_t)tid, xregs)));
4820	}
4821	return (set_errno(EMDB_NOPROC));
4822}
4823
4824#endif	/* __sparc */
4825
4826/*ARGSUSED*/
4827static int
4828pt_lwp_getfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4829    prfpregset_t *fpregs)
4830{
4831	if (t->t_pshandle != NULL) {
4832		return (ptl_err(Plwp_getfpregs(t->t_pshandle,
4833		    (lwpid_t)tid, fpregs)));
4834	}
4835	return (set_errno(EMDB_NOPROC));
4836}
4837
4838/*ARGSUSED*/
4839static int
4840pt_lwp_setfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4841    const prfpregset_t *fpregs)
4842{
4843	if (t->t_pshandle != NULL) {
4844		return (ptl_err(Plwp_setfpregs(t->t_pshandle,
4845		    (lwpid_t)tid, fpregs)));
4846	}
4847	return (set_errno(EMDB_NOPROC));
4848}
4849
4850static const pt_ptl_ops_t proc_lwp_ops = {
4851	(int (*)())(uintptr_t) mdb_tgt_nop,
4852	(void (*)())(uintptr_t) mdb_tgt_nop,
4853	pt_lwp_tid,
4854	pt_lwp_iter,
4855	pt_lwp_getregs,
4856	pt_lwp_setregs,
4857#ifdef __sparc
4858	pt_lwp_getxregs,
4859	pt_lwp_setxregs,
4860#endif
4861	pt_lwp_getfpregs,
4862	pt_lwp_setfpregs
4863};
4864
4865static int
4866pt_tdb_ctor(mdb_tgt_t *t)
4867{
4868	pt_data_t *pt = t->t_data;
4869	td_thragent_t *tap;
4870	td_err_e err;
4871
4872	if ((err = pt->p_tdb_ops->td_ta_new(t->t_pshandle, &tap)) != TD_OK)
4873		return (set_errno(tdb_to_errno(err)));
4874
4875	pt->p_ptl_hdl = tap;
4876	return (0);
4877}
4878
4879static void
4880pt_tdb_dtor(mdb_tgt_t *t, void *tap)
4881{
4882	pt_data_t *pt = t->t_data;
4883
4884	ASSERT(tap == pt->p_ptl_hdl);
4885	(void) pt->p_tdb_ops->td_ta_delete(tap);
4886	pt->p_ptl_hdl = NULL;
4887}
4888
4889static mdb_tgt_tid_t
4890pt_tdb_tid(mdb_tgt_t *t, void *tap)
4891{
4892	pt_data_t *pt = t->t_data;
4893
4894	td_thrhandle_t th;
4895	td_thrinfo_t ti;
4896	td_err_e err;
4897
4898	if (t->t_pshandle == NULL)
4899		return (set_errno(EMDB_NOPROC));
4900
4901	if ((err = pt->p_tdb_ops->td_ta_map_lwp2thr(tap,
4902	    Pstatus(t->t_pshandle)->pr_lwp.pr_lwpid, &th)) != TD_OK)
4903		return (set_errno(tdb_to_errno(err)));
4904
4905	if ((err = pt->p_tdb_ops->td_thr_get_info(&th, &ti)) != TD_OK)
4906		return (set_errno(tdb_to_errno(err)));
4907
4908	return (ti.ti_tid);
4909}
4910
4911static int
4912pt_tdb_add(const td_thrhandle_t *thp, pt_addarg_t *pap)
4913{
4914	td_thrinfo_t ti;
4915
4916	if (pap->pa_pt->p_tdb_ops->td_thr_get_info(thp, &ti) == TD_OK &&
4917	    ti.ti_state != TD_THR_ZOMBIE)
4918		mdb_addrvec_unshift(pap->pa_ap, ti.ti_tid);
4919
4920	return (0);
4921}
4922
4923static int
4924pt_tdb_iter(mdb_tgt_t *t, void *tap, mdb_addrvec_t *ap)
4925{
4926	pt_data_t *pt = t->t_data;
4927	pt_addarg_t arg;
4928	int err;
4929
4930	if (t->t_pshandle == NULL)
4931		return (set_errno(EMDB_NOPROC));
4932
4933	arg.pa_pt = pt;
4934	arg.pa_ap = ap;
4935
4936	if ((err = pt->p_tdb_ops->td_ta_thr_iter(tap, (td_thr_iter_f *)
4937	    pt_tdb_add, &arg, TD_THR_ANY_STATE, TD_THR_LOWEST_PRIORITY,
4938	    TD_SIGNO_MASK, TD_THR_ANY_USER_FLAGS)) != TD_OK)
4939		return (set_errno(tdb_to_errno(err)));
4940
4941	return (0);
4942}
4943
4944static int
4945pt_tdb_getregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4946{
4947	pt_data_t *pt = t->t_data;
4948
4949	td_thrhandle_t th;
4950	td_err_e err;
4951
4952	if (t->t_pshandle == NULL)
4953		return (set_errno(EMDB_NOPROC));
4954
4955	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4956		return (set_errno(tdb_to_errno(err)));
4957
4958	err = pt->p_tdb_ops->td_thr_getgregs(&th, gregs);
4959	if (err != TD_OK && err != TD_PARTIALREG)
4960		return (set_errno(tdb_to_errno(err)));
4961
4962	return (0);
4963}
4964
4965static int
4966pt_tdb_setregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4967{
4968	pt_data_t *pt = t->t_data;
4969
4970	td_thrhandle_t th;
4971	td_err_e err;
4972
4973	if (t->t_pshandle == NULL)
4974		return (set_errno(EMDB_NOPROC));
4975
4976	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4977		return (set_errno(tdb_to_errno(err)));
4978
4979	err = pt->p_tdb_ops->td_thr_setgregs(&th, gregs);
4980	if (err != TD_OK && err != TD_PARTIALREG)
4981		return (set_errno(tdb_to_errno(err)));
4982
4983	return (0);
4984}
4985
4986#ifdef __sparc
4987
4988static int
4989pt_tdb_getxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prxregset_t *xregs)
4990{
4991	pt_data_t *pt = t->t_data;
4992
4993	td_thrhandle_t th;
4994	td_err_e err;
4995
4996	if (t->t_pshandle == NULL)
4997		return (set_errno(EMDB_NOPROC));
4998
4999	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5000		return (set_errno(tdb_to_errno(err)));
5001
5002	err = pt->p_tdb_ops->td_thr_getxregs(&th, xregs);
5003	if (err != TD_OK && err != TD_PARTIALREG)
5004		return (set_errno(tdb_to_errno(err)));
5005
5006	return (0);
5007}
5008
5009static int
5010pt_tdb_setxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
5011    const prxregset_t *xregs)
5012{
5013	pt_data_t *pt = t->t_data;
5014
5015	td_thrhandle_t th;
5016	td_err_e err;
5017
5018	if (t->t_pshandle == NULL)
5019		return (set_errno(EMDB_NOPROC));
5020
5021	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5022		return (set_errno(tdb_to_errno(err)));
5023
5024	err = pt->p_tdb_ops->td_thr_setxregs(&th, xregs);
5025	if (err != TD_OK && err != TD_PARTIALREG)
5026		return (set_errno(tdb_to_errno(err)));
5027
5028	return (0);
5029}
5030
5031#endif	/* __sparc */
5032
5033static int
5034pt_tdb_getfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
5035    prfpregset_t *fpregs)
5036{
5037	pt_data_t *pt = t->t_data;
5038
5039	td_thrhandle_t th;
5040	td_err_e err;
5041
5042	if (t->t_pshandle == NULL)
5043		return (set_errno(EMDB_NOPROC));
5044
5045	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5046		return (set_errno(tdb_to_errno(err)));
5047
5048	err = pt->p_tdb_ops->td_thr_getfpregs(&th, fpregs);
5049	if (err != TD_OK && err != TD_PARTIALREG)
5050		return (set_errno(tdb_to_errno(err)));
5051
5052	return (0);
5053}
5054
5055static int
5056pt_tdb_setfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
5057    const prfpregset_t *fpregs)
5058{
5059	pt_data_t *pt = t->t_data;
5060
5061	td_thrhandle_t th;
5062	td_err_e err;
5063
5064	if (t->t_pshandle == NULL)
5065		return (set_errno(EMDB_NOPROC));
5066
5067	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5068		return (set_errno(tdb_to_errno(err)));
5069
5070	err = pt->p_tdb_ops->td_thr_setfpregs(&th, fpregs);
5071	if (err != TD_OK && err != TD_PARTIALREG)
5072		return (set_errno(tdb_to_errno(err)));
5073
5074	return (0);
5075}
5076
5077static const pt_ptl_ops_t proc_tdb_ops = {
5078	pt_tdb_ctor,
5079	pt_tdb_dtor,
5080	pt_tdb_tid,
5081	pt_tdb_iter,
5082	pt_tdb_getregs,
5083	pt_tdb_setregs,
5084#ifdef __sparc
5085	pt_tdb_getxregs,
5086	pt_tdb_setxregs,
5087#endif
5088	pt_tdb_getfpregs,
5089	pt_tdb_setfpregs
5090};
5091
5092static ssize_t
5093pt_xd_auxv(mdb_tgt_t *t, void *buf, size_t nbytes)
5094{
5095	struct ps_prochandle *P = t->t_pshandle;
5096	const auxv_t *auxp, *auxv = NULL;
5097	int auxn = 0;
5098
5099	if (P != NULL && (auxv = Pgetauxvec(P)) != NULL &&
5100	    auxv->a_type != AT_NULL) {
5101		for (auxp = auxv, auxn = 1; auxp->a_type != 0; auxp++)
5102			auxn++;
5103	}
5104
5105	if (buf == NULL && nbytes == 0)
5106		return (sizeof (auxv_t) * auxn);
5107
5108	if (auxn == 0)
5109		return (set_errno(ENODATA));
5110
5111	nbytes = MIN(nbytes, sizeof (auxv_t) * auxn);
5112	bcopy(auxv, buf, nbytes);
5113	return (nbytes);
5114}
5115
5116static ssize_t
5117pt_xd_cred(mdb_tgt_t *t, void *buf, size_t nbytes)
5118{
5119	prcred_t cr, *crp;
5120	size_t cbytes = 0;
5121
5122	if (t->t_pshandle != NULL && Pcred(t->t_pshandle, &cr, 1) == 0) {
5123		cbytes = (cr.pr_ngroups <= 1) ? sizeof (prcred_t) :
5124		    (sizeof (prcred_t) + (cr.pr_ngroups - 1) * sizeof (gid_t));
5125	}
5126
5127	if (buf == NULL && nbytes == 0)
5128		return (cbytes);
5129
5130	if (cbytes == 0)
5131		return (set_errno(ENODATA));
5132
5133	crp = mdb_alloc(cbytes, UM_SLEEP);
5134
5135	if (Pcred(t->t_pshandle, crp, cr.pr_ngroups) == -1)
5136		return (set_errno(ENODATA));
5137
5138	nbytes = MIN(nbytes, cbytes);
5139	bcopy(crp, buf, nbytes);
5140	mdb_free(crp, cbytes);
5141	return (nbytes);
5142}
5143
5144static ssize_t
5145pt_xd_ehdr(mdb_tgt_t *t, void *buf, size_t nbytes)
5146{
5147	pt_data_t *pt = t->t_data;
5148
5149	if (buf == NULL && nbytes == 0)
5150		return (sizeof (GElf_Ehdr));
5151
5152	if (pt->p_file == NULL)
5153		return (set_errno(ENODATA));
5154
5155	nbytes = MIN(nbytes, sizeof (GElf_Ehdr));
5156	bcopy(&pt->p_file->gf_ehdr, buf, nbytes);
5157	return (nbytes);
5158}
5159
5160static int
5161pt_copy_lwp(lwpstatus_t **lspp, const lwpstatus_t *lsp)
5162{
5163	bcopy(lsp, *lspp, sizeof (lwpstatus_t));
5164	(*lspp)++;
5165	return (0);
5166}
5167
5168static ssize_t
5169pt_xd_lwpstatus(mdb_tgt_t *t, void *buf, size_t nbytes)
5170{
5171	lwpstatus_t *lsp, *lbuf;
5172	const pstatus_t *psp;
5173	int nlwp = 0;
5174
5175	if (t->t_pshandle != NULL && (psp = Pstatus(t->t_pshandle)) != NULL)
5176		nlwp = psp->pr_nlwp;
5177
5178	if (buf == NULL && nbytes == 0)
5179		return (sizeof (lwpstatus_t) * nlwp);
5180
5181	if (nlwp == 0)
5182		return (set_errno(ENODATA));
5183
5184	lsp = lbuf = mdb_alloc(sizeof (lwpstatus_t) * nlwp, UM_SLEEP);
5185	nbytes = MIN(nbytes, sizeof (lwpstatus_t) * nlwp);
5186
5187	(void) Plwp_iter(t->t_pshandle, (proc_lwp_f *)pt_copy_lwp, &lsp);
5188	bcopy(lbuf, buf, nbytes);
5189
5190	mdb_free(lbuf, sizeof (lwpstatus_t) * nlwp);
5191	return (nbytes);
5192}
5193
5194static ssize_t
5195pt_xd_pshandle(mdb_tgt_t *t, void *buf, size_t nbytes)
5196{
5197	if (buf == NULL && nbytes == 0)
5198		return (sizeof (struct ps_prochandle *));
5199
5200	if (t->t_pshandle == NULL || nbytes != sizeof (struct ps_prochandle *))
5201		return (set_errno(ENODATA));
5202
5203	bcopy(&t->t_pshandle, buf, nbytes);
5204	return (nbytes);
5205}
5206
5207static ssize_t
5208pt_xd_psinfo(mdb_tgt_t *t, void *buf, size_t nbytes)
5209{
5210	const psinfo_t *psp;
5211
5212	if (buf == NULL && nbytes == 0)
5213		return (sizeof (psinfo_t));
5214
5215	if (t->t_pshandle == NULL || (psp = Ppsinfo(t->t_pshandle)) == NULL)
5216		return (set_errno(ENODATA));
5217
5218	nbytes = MIN(nbytes, sizeof (psinfo_t));
5219	bcopy(psp, buf, nbytes);
5220	return (nbytes);
5221}
5222
5223static ssize_t
5224pt_xd_pstatus(mdb_tgt_t *t, void *buf, size_t nbytes)
5225{
5226	const pstatus_t *psp;
5227
5228	if (buf == NULL && nbytes == 0)
5229		return (sizeof (pstatus_t));
5230
5231	if (t->t_pshandle == NULL || (psp = Pstatus(t->t_pshandle)) == NULL)
5232		return (set_errno(ENODATA));
5233
5234	nbytes = MIN(nbytes, sizeof (pstatus_t));
5235	bcopy(psp, buf, nbytes);
5236	return (nbytes);
5237}
5238
5239static ssize_t
5240pt_xd_utsname(mdb_tgt_t *t, void *buf, size_t nbytes)
5241{
5242	struct utsname uts;
5243
5244	if (buf == NULL && nbytes == 0)
5245		return (sizeof (struct utsname));
5246
5247	if (t->t_pshandle == NULL || Puname(t->t_pshandle, &uts) != 0)
5248		return (set_errno(ENODATA));
5249
5250	nbytes = MIN(nbytes, sizeof (struct utsname));
5251	bcopy(&uts, buf, nbytes);
5252	return (nbytes);
5253}
5254
5255int
5256mdb_proc_tgt_create(mdb_tgt_t *t, int argc, const char *argv[])
5257{
5258	pt_data_t *pt = mdb_zalloc(sizeof (pt_data_t), UM_SLEEP);
5259
5260	const char *aout_path = argc > 0 ? argv[0] : PT_EXEC_PATH;
5261	const char *core_path = argc > 1 ? argv[1] : NULL;
5262
5263	const mdb_tgt_regdesc_t *rdp;
5264	char execname[MAXPATHLEN];
5265	struct stat64 st;
5266	int perr;
5267	int state;
5268	struct rlimit rlim;
5269	int i;
5270
5271	if (argc > 2) {
5272		mdb_free(pt, sizeof (pt_data_t));
5273		return (set_errno(EINVAL));
5274	}
5275
5276	if (t->t_flags & MDB_TGT_F_RDWR)
5277		pt->p_oflags = O_RDWR;
5278	else
5279		pt->p_oflags = O_RDONLY;
5280
5281	if (t->t_flags & MDB_TGT_F_FORCE)
5282		pt->p_gflags |= PGRAB_FORCE;
5283	if (t->t_flags & MDB_TGT_F_NOSTOP)
5284		pt->p_gflags |= PGRAB_NOSTOP;
5285
5286	pt->p_ptl_ops = &proc_lwp_ops;
5287	pt->p_maxsig = sysconf(_SC_SIGRT_MAX);
5288
5289	(void) mdb_nv_create(&pt->p_regs, UM_SLEEP);
5290	(void) mdb_nv_create(&pt->p_env, UM_SLEEP);
5291
5292	t->t_ops = &proc_ops;
5293	t->t_data = pt;
5294
5295	/*
5296	 * If no core file name was specified, but the file ./core is present,
5297	 * infer that we want to debug it.  I find this behavior confusing,
5298	 * so we only do this when precise adb(1) compatibility is required.
5299	 */
5300	if (core_path == NULL && (mdb.m_flags & MDB_FL_ADB) &&
5301	    access(PT_CORE_PATH, F_OK) == 0)
5302		core_path = PT_CORE_PATH;
5303
5304	/*
5305	 * For compatibility with adb(1), the special name "-" may be used
5306	 * to suppress the loading of the executable or core file.
5307	 */
5308	if (aout_path != NULL && strcmp(aout_path, "-") == 0)
5309		aout_path = NULL;
5310	if (core_path != NULL && strcmp(core_path, "-") == 0)
5311		core_path = NULL;
5312
5313	/*
5314	 * If a core file or pid was specified, attempt to grab it now using
5315	 * proc_arg_grab(); otherwise we'll create a fresh process later.
5316	 */
5317	if (core_path != NULL && (t->t_pshandle = proc_arg_xgrab(core_path,
5318	    aout_path == PT_EXEC_PATH ? NULL : aout_path, PR_ARG_ANY,
5319	    pt->p_gflags, &perr, NULL)) == NULL) {
5320		mdb_warn("cannot debug %s: %s\n", core_path, Pgrab_error(perr));
5321		goto err;
5322	}
5323
5324	if (aout_path != NULL &&
5325	    (pt->p_idlehandle = Pgrab_file(aout_path, &perr)) != NULL &&
5326	    t->t_pshandle == NULL)
5327		t->t_pshandle = pt->p_idlehandle;
5328
5329	if (t->t_pshandle != NULL)
5330		state = Pstate(t->t_pshandle);
5331
5332	/*
5333	 * Make sure we'll have enough file descriptors to handle a target
5334	 * has many many mappings.
5335	 */
5336	if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) {
5337		rlim.rlim_cur = rlim.rlim_max;
5338		(void) setrlimit(RLIMIT_NOFILE, &rlim);
5339		(void) enable_extended_FILE_stdio(-1, -1);
5340	}
5341
5342	/*
5343	 * If we don't have an executable path or the executable path is the
5344	 * /proc/<pid>/object/a.out path, but we now have a libproc handle,
5345	 * attempt to derive the executable path using Pexecname().  We need
5346	 * to do this in the /proc case in order to open the executable for
5347	 * writing because /proc/object/<file> permission are masked with 0555.
5348	 * If Pexecname() fails us, fall back to /proc/<pid>/object/a.out.
5349	 */
5350	if (t->t_pshandle != NULL && (aout_path == NULL || (stat64(aout_path,
5351	    &st) == 0 && strcmp(st.st_fstype, "proc") == 0))) {
5352		GElf_Sym s;
5353		aout_path = Pexecname(t->t_pshandle, execname, MAXPATHLEN);
5354		if (aout_path == NULL && state != PS_DEAD && state != PS_IDLE) {
5355			(void) mdb_iob_snprintf(execname, sizeof (execname),
5356			    "/proc/%d/object/a.out",
5357			    (int)Pstatus(t->t_pshandle)->pr_pid);
5358			aout_path = execname;
5359		}
5360		if (aout_path == NULL &&
5361		    Plookup_by_name(t->t_pshandle, "a.out", "_start", &s) != 0)
5362			mdb_warn("warning: failed to infer pathname to "
5363			    "executable; symbol table will not be available\n");
5364
5365		mdb_dprintf(MDB_DBG_TGT, "a.out is %s\n", aout_path);
5366	}
5367
5368	/*
5369	 * Attempt to open the executable file.  We only want this operation
5370	 * to actually cause the constructor to abort if the executable file
5371	 * name was given explicitly.  If we defaulted to PT_EXEC_PATH or
5372	 * derived the executable using Pexecname, then we want to continue
5373	 * along with p_fio and p_file set to NULL.
5374	 */
5375	if (aout_path != NULL && (pt->p_aout_fio = mdb_fdio_create_path(NULL,
5376	    aout_path, pt->p_oflags, 0)) == NULL && argc > 0) {
5377		mdb_warn("failed to open %s", aout_path);
5378		goto err;
5379	}
5380
5381	/*
5382	 * Now create an ELF file from the input file, if we have one.  Again,
5383	 * only abort the constructor if the name was given explicitly.
5384	 */
5385	if (pt->p_aout_fio != NULL && pt_open_aout(t,
5386	    mdb_io_hold(pt->p_aout_fio)) == NULL && argc > 0)
5387		goto err;
5388
5389	/*
5390	 * If we've successfully opened an ELF file, select the appropriate
5391	 * disassembler based on the ELF header.
5392	 */
5393	if (pt->p_file != NULL)
5394		(void) mdb_dis_select(pt_disasm(&pt->p_file->gf_ehdr));
5395	else
5396		(void) mdb_dis_select(pt_disasm(NULL));
5397
5398	/*
5399	 * Add each register described in the target ISA register description
5400	 * list to our hash table of register descriptions and then add any
5401	 * appropriate ISA-specific floating-point register descriptions.
5402	 */
5403	for (rdp = pt_regdesc; rdp->rd_name != NULL; rdp++) {
5404		(void) mdb_nv_insert(&pt->p_regs, rdp->rd_name, NULL,
5405		    MDB_TGT_R_NVAL(rdp->rd_num, rdp->rd_flags), MDB_NV_RDONLY);
5406	}
5407	pt_addfpregs(t);
5408
5409	/*
5410	 * Certain important /proc structures may be of interest to mdb
5411	 * modules and their dcmds.  Export these using the xdata interface:
5412	 */
5413	(void) mdb_tgt_xdata_insert(t, "auxv",
5414	    "procfs auxv_t array", pt_xd_auxv);
5415	(void) mdb_tgt_xdata_insert(t, "cred",
5416	    "procfs prcred_t structure", pt_xd_cred);
5417	(void) mdb_tgt_xdata_insert(t, "ehdr",
5418	    "executable file GElf_Ehdr structure", pt_xd_ehdr);
5419	(void) mdb_tgt_xdata_insert(t, "lwpstatus",
5420	    "procfs lwpstatus_t array", pt_xd_lwpstatus);
5421	(void) mdb_tgt_xdata_insert(t, "pshandle",
5422	    "libproc proc service API handle", pt_xd_pshandle);
5423	(void) mdb_tgt_xdata_insert(t, "psinfo",
5424	    "procfs psinfo_t structure", pt_xd_psinfo);
5425	(void) mdb_tgt_xdata_insert(t, "pstatus",
5426	    "procfs pstatus_t structure", pt_xd_pstatus);
5427	(void) mdb_tgt_xdata_insert(t, "utsname",
5428	    "utsname structure", pt_xd_utsname);
5429
5430	/*
5431	 * Force a status update now so that we fill in t_status with the
5432	 * latest information based on any successful grab.
5433	 */
5434	(void) mdb_tgt_status(t, &t->t_status);
5435
5436	/*
5437	 * If we're not examining a core file, trace SIGINT and all signals
5438	 * that cause the process to dump core as part of our initialization.
5439	 */
5440	if ((t->t_pshandle != NULL && state != PS_DEAD && state != PS_IDLE) ||
5441	    (pt->p_file != NULL && pt->p_file->gf_ehdr.e_type == ET_EXEC)) {
5442
5443		int tflag = MDB_TGT_SPEC_STICKY; /* default sigs are sticky */
5444
5445		(void) mdb_tgt_add_signal(t, SIGINT, tflag, no_se_f, NULL);
5446		(void) mdb_tgt_add_signal(t, SIGQUIT, tflag, no_se_f, NULL);
5447		(void) mdb_tgt_add_signal(t, SIGILL, tflag, no_se_f, NULL);
5448		(void) mdb_tgt_add_signal(t, SIGTRAP, tflag, no_se_f, NULL);
5449		(void) mdb_tgt_add_signal(t, SIGABRT, tflag, no_se_f, NULL);
5450		(void) mdb_tgt_add_signal(t, SIGEMT, tflag, no_se_f, NULL);
5451		(void) mdb_tgt_add_signal(t, SIGFPE, tflag, no_se_f, NULL);
5452		(void) mdb_tgt_add_signal(t, SIGBUS, tflag, no_se_f, NULL);
5453		(void) mdb_tgt_add_signal(t, SIGSEGV, tflag, no_se_f, NULL);
5454		(void) mdb_tgt_add_signal(t, SIGSYS, tflag, no_se_f, NULL);
5455		(void) mdb_tgt_add_signal(t, SIGXCPU, tflag, no_se_f, NULL);
5456		(void) mdb_tgt_add_signal(t, SIGXFSZ, tflag, no_se_f, NULL);
5457	}
5458
5459	/*
5460	 * If we've grabbed a live process, establish our initial breakpoints
5461	 * and librtld_db agent so we can track rtld activity.  If FL_VCREATE
5462	 * is set, this process was created by a previous instantiation of
5463	 * the debugger, so reset pr_flags to kill it; otherwise we attached
5464	 * to an already running process.  Pgrab() has already set the PR_RLC
5465	 * flag appropriately based on whether the process was stopped when we
5466	 * attached.
5467	 */
5468	if (t->t_pshandle != NULL && state != PS_DEAD && state != PS_IDLE) {
5469		if (mdb.m_flags & MDB_FL_VCREATE) {
5470			(void) Punsetflags(t->t_pshandle, PR_RLC);
5471			(void) Psetflags(t->t_pshandle, PR_KLC);
5472			pt->p_rflags = PRELEASE_KILL;
5473		} else {
5474			(void) Punsetflags(t->t_pshandle, PR_KLC);
5475		}
5476		pt_post_attach(t);
5477	}
5478
5479	/*
5480	 * Initialize a local copy of the environment, which can be modified
5481	 * before running the program.
5482	 */
5483	for (i = 0; mdb.m_env[i] != NULL; i++)
5484		pt_env_set(pt, mdb.m_env[i]);
5485
5486	/*
5487	 * If adb(1) compatibility mode is on, then print the appropriate
5488	 * greeting message if we have grabbed a core file.
5489	 */
5490	if ((mdb.m_flags & MDB_FL_ADB) && t->t_pshandle != NULL &&
5491	    state == PS_DEAD) {
5492		const pstatus_t *psp = Pstatus(t->t_pshandle);
5493		int cursig = psp->pr_lwp.pr_cursig;
5494		char signame[SIG2STR_MAX];
5495
5496		mdb_printf("core file = %s -- program ``%s'' on platform %s\n",
5497		    core_path, aout_path ? aout_path : "?", pt_platform(t));
5498
5499		if (cursig != 0 && sig2str(cursig, signame) == 0)
5500			mdb_printf("SIG%s: %s\n", signame, strsignal(cursig));
5501	}
5502
5503	return (0);
5504
5505err:
5506	pt_destroy(t);
5507	return (-1);
5508}
5509