xref: /illumos-gate/usr/src/cmd/mdb/common/mdb/mdb_proc.c (revision 7c478bd95313f5f23a4c958a745db2134aa03244)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License, Version 1.0 only
6  * (the "License").  You may not use this file except in compliance
7  * with the License.
8  *
9  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
10  * or http://www.opensolaris.org/os/licensing.
11  * See the License for the specific language governing permissions
12  * and limitations under the License.
13  *
14  * When distributing Covered Code, include this CDDL HEADER in each
15  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
16  * If applicable, add the following below this CDDL HEADER, with the
17  * fields enclosed by brackets "[]" replaced with your own identifying
18  * information: Portions Copyright [yyyy] [name of copyright owner]
19  *
20  * CDDL HEADER END
21  */
22 /*
23  * Copyright 2005 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * User Process Target
31  *
32  * The user process target is invoked when the -u or -p command-line options
33  * are used, or when an ELF executable file or ELF core file is specified on
34  * the command-line.  This target is also selected by default when no target
35  * options are present.  In this case, it defaults the executable name to
36  * "a.out".  If no process or core file is currently attached, the target
37  * functions as a kind of virtual /dev/zero (in accordance with adb(1)
38  * semantics); reads from the virtual address space return zeroes and writes
39  * fail silently.  The proc target itself is designed as a wrapper around the
40  * services provided by libproc.so: t->t_pshandle is set to the struct
41  * ps_prochandle pointer returned as a handle by libproc.  The target also
42  * opens the executable file itself using the MDB GElf services, for
43  * interpreting the .symtab and .dynsym if no libproc handle has been
44  * initialized, and for handling i/o to and from the object file.  Currently,
45  * the only ISA-dependent portions of the proc target are the $r and ::fpregs
46  * dcmds, the callbacks for t_next() and t_step_out(), and the list of named
47  * registers; these are linked in from the proc_isadep.c file for each ISA and
48  * called from the common code in this file.
49  *
50  * The user process target implements complete user process control using the
51  * facilities provided by libproc.so.  The MDB execution control model and
52  * an overview of software event management is described in mdb_target.c.  The
53  * proc target implements breakpoints by replacing the instruction of interest
54  * with a trap instruction, and then restoring the original instruction to step
55  * over the breakpoint.  The idea of replacing program text with instructions
56  * that transfer control to the debugger dates back as far as 1951 [1].  When
57  * the target stops, we replace each breakpoint with the original instruction
58  * as part of the disarm operation.  This means that no special processing is
59  * required for t_vread() because the instrumented instructions will never be
60  * seen by the debugger once the target stops.  Some debuggers have improved
61  * start/stop performance by leaving breakpoint traps in place and then
62  * handling a read from a breakpoint address as a special case.  Although this
63  * improves efficiency for a source-level debugger, it runs somewhat contrary
64  * to the philosophy of the low-level debugger.  Since we remove the
65  * instructions, users can apply other external debugging tools to the process
66  * once it has stopped (e.g. the proc(1) tools) and not be misled by MDB
67  * instrumentation.  The tracing of faults, signals, system calls, and
68  * watchpoints and general process inspection is implemented directly using
69  * the mechanisms provided by /proc, as described originally in [2] and [3].
70  *
71  * References
72  *
73  * [1] S. Gill, "The Diagnosis Of Mistakes In Programmes on the EDSAC",
74  *     Proceedings of the Royal Society Series A Mathematical and Physical
75  *     Sciences, Cambridge University Press, 206(1087), May 1951, pp. 538-554.
76  *
77  * [2] T.J. Killian, "Processes as Files", Proceedings of the USENIX Association
78  *     Summer Conference, Salt Lake City, June 1984, pp. 203-207.
79  *
80  * [3] Roger Faulkner and Ron Gomes, "The Process File System and Process
81  *     Model in UNIX System V", Proceedings of the USENIX Association
82  *     Winter Conference, Dallas, January 1991, pp. 243-252.
83  */
84 
85 #include <mdb/mdb_proc.h>
86 #include <mdb/mdb_disasm.h>
87 #include <mdb/mdb_signal.h>
88 #include <mdb/mdb_string.h>
89 #include <mdb/mdb_module.h>
90 #include <mdb/mdb_debug.h>
91 #include <mdb/mdb_conf.h>
92 #include <mdb/mdb_err.h>
93 #include <mdb/mdb_types.h>
94 #include <mdb/mdb.h>
95 
96 #include <sys/utsname.h>
97 #include <sys/wait.h>
98 #include <sys/stat.h>
99 #include <termio.h>
100 #include <signal.h>
101 #include <stdlib.h>
102 #include <string.h>
103 
104 #define	PC_FAKE		-1UL			/* illegal pc value unequal 0 */
105 
106 static const char PT_EXEC_PATH[] = "a.out";	/* Default executable */
107 static const char PT_CORE_PATH[] = "core";	/* Default core file */
108 
109 static const pt_ptl_ops_t proc_lwp_ops;
110 static const pt_ptl_ops_t proc_tdb_ops;
111 static const mdb_se_ops_t proc_brkpt_ops;
112 static const mdb_se_ops_t proc_wapt_ops;
113 
114 static int pt_setrun(mdb_tgt_t *, mdb_tgt_status_t *, int);
115 static void pt_activate_common(mdb_tgt_t *);
116 static mdb_tgt_vespec_f pt_ignore_sig;
117 static mdb_tgt_se_f pt_fork;
118 static mdb_tgt_se_f pt_exec;
119 
120 static int pt_lookup_by_name_thr(mdb_tgt_t *, const char *,
121     const char *, GElf_Sym *, mdb_syminfo_t *, mdb_tgt_tid_t);
122 static int tlsbase(mdb_tgt_t *, mdb_tgt_tid_t, Lmid_t, const char *,
123     psaddr_t *);
124 
125 /*
126  * The Perror_printf() function interposes on the default, empty libproc
127  * definition.  It will be called to report additional information on complex
128  * errors, such as a corrupt core file.  We just pass the args to vwarn.
129  */
130 /*ARGSUSED*/
131 void
132 Perror_printf(struct ps_prochandle *P, const char *format, ...)
133 {
134 	va_list alist;
135 
136 	va_start(alist, format);
137 	vwarn(format, alist);
138 	va_end(alist);
139 }
140 
141 /*
142  * Open the specified i/o backend as the a.out executable file, and attempt to
143  * load its standard and dynamic symbol tables.  Note that if mdb_gelf_create
144  * succeeds, io is assigned to p_fio and is automatically held by gelf_create.
145  */
146 static mdb_gelf_file_t *
147 pt_open_aout(mdb_tgt_t *t, mdb_io_t *io)
148 {
149 	pt_data_t *pt = t->t_data;
150 	GElf_Sym s1, s2;
151 
152 	if ((pt->p_file = mdb_gelf_create(io, ET_NONE, GF_FILE)) == NULL)
153 		return (NULL);
154 
155 	pt->p_symtab = mdb_gelf_symtab_create_file(pt->p_file,
156 	    SHT_SYMTAB, MDB_TGT_SYMTAB);
157 	pt->p_dynsym = mdb_gelf_symtab_create_file(pt->p_file,
158 	    SHT_DYNSYM, MDB_TGT_DYNSYM);
159 
160 	/*
161 	 * If we've got an _start symbol with a zero size, prime the private
162 	 * symbol table with a copy of _start with its size set to the distance
163 	 * between _mcount and _start.  We do this because DevPro has shipped
164 	 * the Intel crt1.o without proper .size directives for years, which
165 	 * precludes proper identification of _start in stack traces.
166 	 */
167 	if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, "_start", &s1,
168 	    NULL) == 0 && s1.st_size == 0 &&
169 	    GELF_ST_TYPE(s1.st_info) == STT_FUNC) {
170 		if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, "_mcount",
171 		    &s2, NULL) == 0 && GELF_ST_TYPE(s2.st_info) == STT_FUNC) {
172 			s1.st_size = s2.st_value - s1.st_value;
173 			mdb_gelf_symtab_insert(mdb.m_prsym, "_start", &s1);
174 		}
175 	}
176 
177 	pt->p_fio = io;
178 	return (pt->p_file);
179 }
180 
181 /*
182  * Destroy the symbol tables and GElf file object associated with p_fio.  Note
183  * that we do not need to explicitly free p_fio: its reference count is
184  * automatically decremented by mdb_gelf_destroy, which will free it if needed.
185  */
186 static void
187 pt_close_aout(mdb_tgt_t *t)
188 {
189 	pt_data_t *pt = t->t_data;
190 
191 	if (pt->p_symtab != NULL) {
192 		mdb_gelf_symtab_destroy(pt->p_symtab);
193 		pt->p_symtab = NULL;
194 	}
195 
196 	if (pt->p_dynsym != NULL) {
197 		mdb_gelf_symtab_destroy(pt->p_dynsym);
198 		pt->p_dynsym = NULL;
199 	}
200 
201 	if (pt->p_file != NULL) {
202 		mdb_gelf_destroy(pt->p_file);
203 		pt->p_file = NULL;
204 	}
205 
206 	mdb_gelf_symtab_delete(mdb.m_prsym, "_start", NULL);
207 	pt->p_fio = NULL;
208 }
209 
210 /*
211  * Pobject_iter callback that we use to search for the presence of libthread in
212  * order to load the corresponding libthread_db support.  We derive the
213  * libthread_db path dynamically based on the libthread path.  If libthread is
214  * found, this function returns 1 (and thus Pobject_iter aborts and returns 1)
215  * regardless of whether it was successful in loading the libthread_db support.
216  * If we iterate over all objects and no libthread is found, 0 is returned.
217  * Since libthread_db support was then merged into libc_db, we load either
218  * libc_db or libthread_db, depending on which library we see first.
219  */
220 /*ARGSUSED*/
221 static int
222 thr_check(mdb_tgt_t *t, const prmap_t *pmp, const char *name)
223 {
224 	pt_data_t *pt = t->t_data;
225 	const mdb_tdb_ops_t *ops;
226 	char *p, *q;
227 
228 	char path[MAXPATHLEN + 8]; /* +8 for "/64" "_db" and '\0' */
229 
230 	const char *const libs[] = { "/libc.so", "/libthread.so" };
231 	int libn;
232 
233 	if (name == NULL)
234 		return (0); /* no rtld_db object name; keep going */
235 
236 	for (libn = 0; libn < sizeof (libs) / sizeof (libs[0]); libn++) {
237 		if ((p = strstr(name, libs[libn])) != NULL)
238 			break;
239 	}
240 
241 	if (p == NULL)
242 		return (0); /* no match; keep going */
243 
244 	(void) strncpy(path, name, MAXPATHLEN);
245 	path[MAXPATHLEN] = '\0';
246 	q = strstr(path, libs[libn]);
247 	ASSERT(q != NULL);
248 
249 	/*
250 	 * If the 64-bit debugger is looking at a 32-bit victim, append /64 to
251 	 * the library directory name so we load the 64-bit version.
252 	 */
253 	if (Pstatus(t->t_pshandle)->pr_dmodel != PR_MODEL_NATIVE) {
254 		(void) strcpy(q, "/64");
255 		q += 3;
256 		(void) strcpy(q, p);
257 	}
258 
259 	p = strchr(p, '.');
260 	q = strchr(q, '.');
261 	(void) strcpy(q, "_db");
262 	q += 3;
263 	(void) strcpy(q, p);
264 
265 	if ((ops = mdb_tdb_load(path)) == NULL) {
266 		if (libn != 0 || errno != ENOENT)
267 			warn("failed to load %s", path);
268 		goto err;
269 	}
270 
271 	if (ops == pt->p_tdb_ops)
272 		return (1); /* no changes needed */
273 
274 	PTL_DTOR(t);
275 	pt->p_tdb_ops = ops;
276 	pt->p_ptl_ops = &proc_tdb_ops;
277 	pt->p_ptl_hdl = NULL;
278 
279 	if (PTL_CTOR(t) == -1) {
280 		warn("failed to initialize %s", path);
281 		goto err;
282 	}
283 
284 	mdb_dprintf(MDB_DBG_TGT, "loaded %s for debugging %s\n", path, name);
285 	(void) mdb_tgt_status(t, &t->t_status);
286 	return (1);
287 err:
288 	PTL_DTOR(t);
289 	pt->p_tdb_ops = NULL;
290 	pt->p_ptl_ops = &proc_lwp_ops;
291 	pt->p_ptl_hdl = NULL;
292 
293 	if (libn != 0 || errno != ENOENT) {
294 		warn("warning: debugger will only be able to "
295 		    "examine raw LWPs\n");
296 	}
297 
298 	(void) mdb_tgt_status(t, &t->t_status);
299 	return (1);
300 }
301 
302 /*
303  * Whenever the link map is consistent following an add or delete event, we ask
304  * libproc to update its mappings, check to see if we need to load libthread_db,
305  * and then update breakpoints which have been mapped or unmapped.
306  */
307 /*ARGSUSED*/
308 static void
309 pt_rtld_event(mdb_tgt_t *t, int vid, void *private)
310 {
311 	struct ps_prochandle *P = t->t_pshandle;
312 	pt_data_t *pt = t->t_data;
313 	rd_event_msg_t rdm;
314 	int docontinue = 1;
315 
316 	if (rd_event_getmsg(pt->p_rtld, &rdm) == RD_OK) {
317 
318 		mdb_dprintf(MDB_DBG_TGT, "rtld event type 0x%x state 0x%x\n",
319 		    rdm.type, rdm.u.state);
320 
321 		if (rdm.type == RD_DLACTIVITY && rdm.u.state == RD_CONSISTENT) {
322 			mdb_sespec_t *sep, *nsep = mdb_list_next(&t->t_active);
323 			pt_brkpt_t *ptb;
324 
325 			Pupdate_maps(P);
326 
327 			if (Pobject_iter(P, (proc_map_f *)thr_check, t) == 0 &&
328 			    pt->p_ptl_ops != &proc_lwp_ops) {
329 				mdb_dprintf(MDB_DBG_TGT, "unloading thread_db "
330 				    "support after dlclose\n");
331 				PTL_DTOR(t);
332 				pt->p_tdb_ops = NULL;
333 				pt->p_ptl_ops = &proc_lwp_ops;
334 				pt->p_ptl_hdl = NULL;
335 				(void) mdb_tgt_status(t, &t->t_status);
336 			}
337 
338 			for (sep = nsep; sep != NULL; sep = nsep) {
339 				nsep = mdb_list_next(sep);
340 				ptb = sep->se_data;
341 
342 				if (sep->se_ops == &proc_brkpt_ops &&
343 				    Paddr_to_map(P, ptb->ptb_addr) == NULL)
344 					mdb_tgt_sespec_idle_one(t, sep,
345 					    EMDB_NOMAP);
346 			}
347 
348 			if (!mdb_tgt_sespec_activate_all(t) &&
349 			    (mdb.m_flags & MDB_FL_BPTNOSYMSTOP) &&
350 			    pt->p_rtld_finished) {
351 				/*
352 				 * We weren't able to activate the breakpoints.
353 				 * If so requested, we'll return without
354 				 * calling continue, thus throwing the user into
355 				 * the debugger.
356 				 */
357 				docontinue = 0;
358 			}
359 
360 			if (pt->p_rdstate == PT_RD_ADD)
361 				pt->p_rdstate = PT_RD_CONSIST;
362 		}
363 
364 		if (rdm.type == RD_PREINIT)
365 			(void) mdb_tgt_sespec_activate_all(t);
366 
367 		if (rdm.type == RD_POSTINIT) {
368 			pt->p_rtld_finished = TRUE;
369 			if (!mdb_tgt_sespec_activate_all(t) &&
370 			    (mdb.m_flags & MDB_FL_BPTNOSYMSTOP)) {
371 				/*
372 				 * Now that rtld has been initialized, we
373 				 * should be able to initialize all deferred
374 				 * breakpoints.  If we can't, don't let the
375 				 * target continue.
376 				 */
377 				docontinue = 0;
378 			}
379 		}
380 
381 		if (rdm.type == RD_DLACTIVITY && rdm.u.state == RD_ADD &&
382 		    pt->p_rtld_finished)
383 			pt->p_rdstate = MAX(pt->p_rdstate, PT_RD_ADD);
384 	}
385 
386 	if (docontinue)
387 		(void) mdb_tgt_continue(t, NULL);
388 }
389 
390 static void
391 pt_post_attach(mdb_tgt_t *t)
392 {
393 	struct ps_prochandle *P = t->t_pshandle;
394 	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
395 	pt_data_t *pt = t->t_data;
396 	int hflag = MDB_TGT_SPEC_HIDDEN;
397 
398 	mdb_dprintf(MDB_DBG_TGT, "attach pr_flags=0x%x pr_why=%d pr_what=%d\n",
399 	    psp->pr_flags, psp->pr_why, psp->pr_what);
400 
401 	/*
402 	 * When we grab a process, the initial setting of p_rtld_finished
403 	 * should be false if the process was just created by exec; otherwise
404 	 * we permit unscoped references to resolve because we do not know how
405 	 * far the process has proceeded through linker initialization.
406 	 */
407 	if ((psp->pr_flags & PR_ISTOP) && psp->pr_why == PR_SYSEXIT &&
408 	    psp->pr_errno == 0 && (psp->pr_what == SYS_exec ||
409 	    psp->pr_what == SYS_execve)) {
410 		if (mdb.m_target == NULL) {
411 			warn("target performed exec of %s\n",
412 			    IOP_NAME(pt->p_fio));
413 		}
414 		pt->p_rtld_finished = FALSE;
415 	} else
416 		pt->p_rtld_finished = TRUE;
417 
418 	/*
419 	 * When we grab a process, if it is stopped by job control and part of
420 	 * the same session (i.e. same controlling tty), set MDB_FL_JOBCTL so
421 	 * we will know to bring it to the foreground when we continue it.
422 	 */
423 	if (mdb.m_term != NULL && (psp->pr_flags & PR_STOPPED) &&
424 	    psp->pr_why == PR_JOBCONTROL && getsid(0) == Pstatus(P)->pr_sid)
425 		mdb.m_flags |= MDB_FL_JOBCTL;
426 
427 	/*
428 	 * When we grab control of a live process, set F_RDWR so that the
429 	 * target layer permits writes to the target's address space.
430 	 */
431 	t->t_flags |= MDB_TGT_F_RDWR;
432 
433 	(void) Pfault(P, FLTBPT, TRUE);		/* always trace breakpoints */
434 	(void) Pfault(P, FLTWATCH, TRUE);	/* always trace watchpoints */
435 	(void) Pfault(P, FLTTRACE, TRUE);	/* always trace single-step */
436 
437 	(void) Punsetflags(P, PR_ASYNC);	/* require synchronous mode */
438 	(void) Psetflags(P, PR_BPTADJ);		/* always adjust eip on x86 */
439 	(void) Psetflags(P, PR_FORK);		/* inherit tracing on fork */
440 
441 	/*
442 	 * Install event specifiers to track fork and exec activities:
443 	 */
444 	(void) mdb_tgt_add_sysexit(t, SYS_forkall, hflag, pt_fork, NULL);
445 	(void) mdb_tgt_add_sysexit(t, SYS_fork1, hflag, pt_fork, NULL);
446 	(void) mdb_tgt_add_sysexit(t, SYS_vfork, hflag, pt_fork, NULL);
447 	(void) mdb_tgt_add_sysexit(t, SYS_exec, hflag, pt_exec, NULL);
448 	(void) mdb_tgt_add_sysexit(t, SYS_execve, hflag, pt_exec, NULL);
449 
450 	/*
451 	 * Attempt to instantiate the librtld_db agent and set breakpoints
452 	 * to track rtld activity.  We will legitimately fail to instantiate
453 	 * the rtld_db agent if the target is statically linked.
454 	 */
455 	if (pt->p_rtld == NULL && (pt->p_rtld = Prd_agent(P)) != NULL) {
456 		rd_notify_t rdn;
457 		rd_err_e err;
458 
459 		if ((err = rd_event_enable(pt->p_rtld, TRUE)) != RD_OK) {
460 			warn("failed to enable rtld_db event tracing: %s\n",
461 			    rd_errstr(err));
462 			goto out;
463 		}
464 
465 		if ((err = rd_event_addr(pt->p_rtld, RD_PREINIT,
466 		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
467 			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
468 			    hflag, pt_rtld_event, NULL);
469 		} else {
470 			warn("failed to install rtld_db preinit tracing: %s\n",
471 			    rd_errstr(err));
472 		}
473 
474 		if ((err = rd_event_addr(pt->p_rtld, RD_POSTINIT,
475 		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
476 			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
477 			    hflag, pt_rtld_event, NULL);
478 		} else {
479 			warn("failed to install rtld_db postinit tracing: %s\n",
480 			    rd_errstr(err));
481 		}
482 
483 		if ((err = rd_event_addr(pt->p_rtld, RD_DLACTIVITY,
484 		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
485 			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
486 			    hflag, pt_rtld_event, NULL);
487 		} else {
488 			warn("failed to install rtld_db activity tracing: %s\n",
489 			    rd_errstr(err));
490 		}
491 	}
492 out:
493 	Pupdate_maps(P);
494 	Psync(P);
495 
496 	/*
497 	 * If librtld_db failed to initialize due to an error or because we are
498 	 * debugging a statically linked executable, allow unscoped references.
499 	 */
500 	if (pt->p_rtld == NULL)
501 		pt->p_rtld_finished = TRUE;
502 
503 	(void) mdb_tgt_sespec_activate_all(t);
504 }
505 
506 /*ARGSUSED*/
507 static int
508 pt_vespec_delete(mdb_tgt_t *t, void *private, int id, void *data)
509 {
510 	if (id < 0) {
511 		ASSERT(data == NULL); /* we don't use any ve_data */
512 		(void) mdb_tgt_vespec_delete(t, id);
513 	}
514 	return (0);
515 }
516 
517 static void
518 pt_pre_detach(mdb_tgt_t *t, int clear_matched)
519 {
520 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
521 	pt_data_t *pt = t->t_data;
522 	long cmd = 0;
523 
524 	/*
525 	 * If we are about to release the process and it is stopped on a traced
526 	 * SIGINT, breakpoint fault, single-step fault, or watchpoint, make
527 	 * sure to clear this event prior to releasing the process so that it
528 	 * does not subsequently reissue the fault and die from SIGTRAP.
529 	 */
530 	if (psp->pr_flags & PR_ISTOP) {
531 		if (psp->pr_why == PR_FAULTED && (psp->pr_what == FLTBPT ||
532 		    psp->pr_what == FLTTRACE || psp->pr_what == FLTWATCH))
533 			cmd = PCCFAULT;
534 		else if (psp->pr_why == PR_SIGNALLED && psp->pr_what == SIGINT)
535 			cmd = PCCSIG;
536 
537 		if (cmd != 0)
538 			(void) write(Pctlfd(t->t_pshandle), &cmd, sizeof (cmd));
539 	}
540 
541 	if (Pstate(t->t_pshandle) == PS_UNDEAD)
542 		(void) waitpid(Pstatus(t->t_pshandle)->pr_pid, NULL, WNOHANG);
543 
544 	(void) mdb_tgt_vespec_iter(t, pt_vespec_delete, NULL);
545 	mdb_tgt_sespec_idle_all(t, EMDB_NOPROC, clear_matched);
546 
547 	if (pt->p_fio != pt->p_aout_fio) {
548 		pt_close_aout(t);
549 		(void) pt_open_aout(t, pt->p_aout_fio);
550 	}
551 
552 	PTL_DTOR(t);
553 	pt->p_tdb_ops = NULL;
554 	pt->p_ptl_ops = &proc_lwp_ops;
555 	pt->p_ptl_hdl = NULL;
556 
557 	pt->p_rtld = NULL;
558 	pt->p_signal = 0;
559 	pt->p_rtld_finished = FALSE;
560 	pt->p_rdstate = PT_RD_NONE;
561 }
562 
563 static void
564 pt_release_parents(mdb_tgt_t *t)
565 {
566 	struct ps_prochandle *P = t->t_pshandle;
567 	pt_data_t *pt = t->t_data;
568 
569 	mdb_sespec_t *sep;
570 	pt_vforkp_t *vfp;
571 
572 	while ((vfp = mdb_list_next(&pt->p_vforkp)) != NULL) {
573 		mdb_dprintf(MDB_DBG_TGT, "releasing vfork parent %d\n",
574 		    (int)Pstatus(vfp->p_pshandle)->pr_pid);
575 
576 		/*
577 		 * To release vfork parents, we must also wipe out any armed
578 		 * events in the parent by switching t_pshandle and calling
579 		 * se_disarm().  Do not change states or lose the matched list.
580 		 */
581 		t->t_pshandle = vfp->p_pshandle;
582 
583 		for (sep = mdb_list_next(&t->t_active); sep != NULL;
584 		    sep = mdb_list_next(sep)) {
585 			if (sep->se_state == MDB_TGT_SPEC_ARMED)
586 				(void) sep->se_ops->se_disarm(t, sep);
587 		}
588 
589 		t->t_pshandle = P;
590 
591 		Prelease(vfp->p_pshandle, PRELEASE_CLEAR);
592 		mdb_list_delete(&pt->p_vforkp, vfp);
593 		mdb_free(vfp, sizeof (pt_vforkp_t));
594 	}
595 }
596 
597 /*ARGSUSED*/
598 static void
599 pt_fork(mdb_tgt_t *t, int vid, void *private)
600 {
601 	struct ps_prochandle *P = t->t_pshandle;
602 	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
603 	pt_data_t *pt = t->t_data;
604 	mdb_sespec_t *sep;
605 
606 	int follow_parent = mdb.m_forkmode != MDB_FM_CHILD;
607 	int is_vfork = psp->pr_what == SYS_vfork;
608 
609 	struct ps_prochandle *C;
610 	const lwpstatus_t *csp;
611 	char sysname[32];
612 	int gcode;
613 	char c;
614 
615 	mdb_dprintf(MDB_DBG_TGT, "parent %s: errno=%d rv1=%ld rv2=%ld\n",
616 	    proc_sysname(psp->pr_what, sysname, sizeof (sysname)),
617 	    psp->pr_errno, psp->pr_rval1, psp->pr_rval2);
618 
619 	if (psp->pr_errno != 0) {
620 		(void) mdb_tgt_continue(t, NULL);
621 		return; /* fork failed */
622 	}
623 
624 	/*
625 	 * If forkmode is ASK and stdout is a terminal, then ask the user to
626 	 * explicitly set the fork behavior for this particular fork.
627 	 */
628 	if (mdb.m_forkmode == MDB_FM_ASK && mdb.m_term != NULL) {
629 		mdb_iob_printf(mdb.m_err, "%s: %s detected: follow (p)arent "
630 		    "or (c)hild? ", mdb.m_pname, sysname);
631 		mdb_iob_flush(mdb.m_err);
632 
633 		while (IOP_READ(mdb.m_term, &c, sizeof (c)) == sizeof (c)) {
634 			if (c == 'P' || c == 'p') {
635 				mdb_iob_printf(mdb.m_err, "%c\n", c);
636 				follow_parent = TRUE;
637 				break;
638 			} else if (c == 'C' || c == 'c') {
639 				mdb_iob_printf(mdb.m_err, "%c\n", c);
640 				follow_parent = FALSE;
641 				break;
642 			}
643 		}
644 	}
645 
646 	/*
647 	 * The parent is now stopped on exit from its fork call.  We must now
648 	 * grab the child on its return from fork in order to manipulate it.
649 	 */
650 	if ((C = Pgrab(psp->pr_rval1, PGRAB_RETAIN, &gcode)) == NULL) {
651 		warn("failed to grab forked child process %ld: %s\n",
652 		    psp->pr_rval1, Pgrab_error(gcode));
653 		return; /* just stop if we failed to grab the child */
654 	}
655 
656 	/*
657 	 * We may have grabbed the child and stopped it prematurely before it
658 	 * stopped on exit from fork.  If so, wait up to 1 sec for it to settle.
659 	 */
660 	if (Pstatus(C)->pr_lwp.pr_why != PR_SYSEXIT)
661 		(void) Pwait(C, MILLISEC);
662 
663 	csp = &Pstatus(C)->pr_lwp;
664 
665 	if (csp->pr_why != PR_SYSEXIT || (csp->pr_what != SYS_forkall &&
666 	    csp->pr_what != SYS_fork1 && csp->pr_what != SYS_vfork)) {
667 		warn("forked child process %ld did not stop on exit from "
668 		    "fork as expected\n", psp->pr_rval1);
669 	}
670 
671 	warn("target forked child process %ld (debugger following %s)\n",
672 	    psp->pr_rval1, follow_parent ? "parent" : "child");
673 
674 	(void) Punsetflags(C, PR_ASYNC);	/* require synchronous mode */
675 	(void) Psetflags(C, PR_BPTADJ);		/* always adjust eip on x86 */
676 	(void) Prd_agent(C);			/* initialize librtld_db */
677 
678 	/*
679 	 * At the time pt_fork() is called, the target event engine has already
680 	 * disarmed the specifiers on the active list, clearing out events in
681 	 * the parent process.  However, this means that events that change
682 	 * the address space (e.g. breakpoints) have not been effectively
683 	 * disarmed in the child since its address space reflects the state of
684 	 * the process at the time of fork when events were armed.  We must
685 	 * therefore handle this as a special case and re-invoke the disarm
686 	 * callback of each active specifier to clean out the child process.
687 	 */
688 	if (!is_vfork) {
689 		for (t->t_pshandle = C, sep = mdb_list_next(&t->t_active);
690 		    sep != NULL; sep = mdb_list_next(sep)) {
691 			if (sep->se_state == MDB_TGT_SPEC_ACTIVE)
692 				(void) sep->se_ops->se_disarm(t, sep);
693 		}
694 
695 		t->t_pshandle = P; /* restore pshandle to parent */
696 	}
697 
698 	/*
699 	 * If we're following the parent process, we need to temporarily change
700 	 * t_pshandle to refer to the child handle C so that we can clear out
701 	 * all the events in the child prior to releasing it below.  If we are
702 	 * tracing a vfork, we also need to explicitly wait for the child to
703 	 * exec, exit, or die before we can reset and continue the parent.  We
704 	 * avoid having to deal with the vfork child forking again by clearing
705 	 * PR_FORK and setting PR_RLC; if it does fork it will effectively be
706 	 * released from our control and we will continue following the parent.
707 	 */
708 	if (follow_parent) {
709 		if (is_vfork) {
710 			mdb_tgt_status_t status;
711 
712 			ASSERT(psp->pr_flags & PR_VFORKP);
713 			mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
714 			t->t_pshandle = C;
715 
716 			(void) Psysexit(C, SYS_exec, TRUE);
717 			(void) Psysexit(C, SYS_execve, TRUE);
718 
719 			(void) Punsetflags(C, PR_FORK | PR_KLC);
720 			(void) Psetflags(C, PR_RLC);
721 
722 			do {
723 				if (pt_setrun(t, &status, 0) == -1 ||
724 				    status.st_state == MDB_TGT_UNDEAD ||
725 				    status.st_state == MDB_TGT_LOST)
726 					break; /* failure or process died */
727 
728 			} while (csp->pr_why != PR_SYSEXIT ||
729 			    csp->pr_errno != 0 || (csp->pr_what != SYS_exec &&
730 			    csp->pr_what != SYS_execve));
731 		} else
732 			t->t_pshandle = C;
733 	}
734 
735 	/*
736 	 * If we are following the child, destroy any active libthread_db
737 	 * handle before we release the parent process.
738 	 */
739 	if (!follow_parent) {
740 		PTL_DTOR(t);
741 		pt->p_tdb_ops = NULL;
742 		pt->p_ptl_ops = &proc_lwp_ops;
743 		pt->p_ptl_hdl = NULL;
744 	}
745 
746 	/*
747 	 * Idle all events to make sure the address space and tracing flags are
748 	 * restored, and then release the process we are not tracing.  If we
749 	 * are following the child of a vfork, we push the parent's pshandle
750 	 * on to a list of vfork parents to be released when we exec or exit.
751 	 */
752 	if (is_vfork && !follow_parent) {
753 		pt_vforkp_t *vfp = mdb_alloc(sizeof (pt_vforkp_t), UM_SLEEP);
754 
755 		ASSERT(psp->pr_flags & PR_VFORKP);
756 		vfp->p_pshandle = P;
757 		mdb_list_append(&pt->p_vforkp, vfp);
758 		mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
759 
760 	} else {
761 		mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
762 		Prelease(t->t_pshandle, PRELEASE_CLEAR);
763 		if (!follow_parent)
764 			pt_release_parents(t);
765 	}
766 
767 	/*
768 	 * Now that all the hard stuff is done, switch t_pshandle back to the
769 	 * process we are following and reset our events to the ACTIVE state.
770 	 * If we are following the child, reset the libthread_db handle as well
771 	 * as the rtld agent.
772 	 */
773 	if (follow_parent)
774 		t->t_pshandle = P;
775 	else {
776 		t->t_pshandle = C;
777 		pt->p_rtld = Prd_agent(C);
778 		(void) Pobject_iter(t->t_pshandle, (proc_map_f *)thr_check, t);
779 	}
780 
781 	(void) mdb_tgt_sespec_activate_all(t);
782 	(void) mdb_tgt_continue(t, NULL);
783 }
784 
785 /*ARGSUSED*/
786 static void
787 pt_exec(mdb_tgt_t *t, int vid, void *private)
788 {
789 	struct ps_prochandle *P = t->t_pshandle;
790 	const pstatus_t *psp = Pstatus(P);
791 	pt_data_t *pt = t->t_data;
792 	int follow_exec = mdb.m_execmode == MDB_EM_FOLLOW;
793 	pid_t pid = psp->pr_pid;
794 
795 	char execname[MAXPATHLEN];
796 	mdb_sespec_t *sep, *nsep;
797 	mdb_io_t *io;
798 	char c;
799 
800 	mdb_dprintf(MDB_DBG_TGT, "exit from %s: errno=%d\n", proc_sysname(
801 	    psp->pr_lwp.pr_what, execname, sizeof (execname)),
802 	    psp->pr_lwp.pr_errno);
803 
804 	if (psp->pr_lwp.pr_errno != 0) {
805 		(void) mdb_tgt_continue(t, NULL);
806 		return; /* exec failed */
807 	}
808 
809 	/*
810 	 * If execmode is ASK and stdout is a terminal, then ask the user to
811 	 * explicitly set the exec behavior for this particular exec.  If
812 	 * Pstate() still shows PS_LOST, we are being called from pt_setrun()
813 	 * directly and therefore we must resume the terminal since it is still
814 	 * in the suspended state as far as tgt_continue() is concerned.
815 	 */
816 	if (mdb.m_execmode == MDB_EM_ASK && mdb.m_term != NULL) {
817 		if (Pstate(P) == PS_LOST)
818 			IOP_RESUME(mdb.m_term);
819 
820 		mdb_iob_printf(mdb.m_err, "%s: %s detected: (f)ollow new "
821 		    "program or (s)top? ", mdb.m_pname, execname);
822 		mdb_iob_flush(mdb.m_err);
823 
824 		while (IOP_READ(mdb.m_term, &c, sizeof (c)) == sizeof (c)) {
825 			if (c == 'F' || c == 'f') {
826 				mdb_iob_printf(mdb.m_err, "%c\n", c);
827 				follow_exec = TRUE;
828 				break;
829 			} else if (c == 'S' || c == 's') {
830 				mdb_iob_printf(mdb.m_err, "%c\n", c);
831 				follow_exec = FALSE;
832 				break;
833 			}
834 		}
835 
836 		if (Pstate(P) == PS_LOST)
837 			IOP_SUSPEND(mdb.m_term);
838 	}
839 
840 	pt_release_parents(t);	/* release any waiting vfork parents */
841 	pt_pre_detach(t, FALSE); /* remove our breakpoints and idle events */
842 	Preset_maps(P);		/* libproc must delete mappings and symtabs */
843 	pt_close_aout(t);	/* free pt symbol tables and GElf file data */
844 
845 	/*
846 	 * If we lost control of the process across the exec and are not able
847 	 * to reopen it, we have no choice but to clear the matched event list
848 	 * and wait for the user to quit or otherwise release the process.
849 	 */
850 	if (Pstate(P) == PS_LOST && Preopen(P) == -1) {
851 		int error = errno;
852 
853 		warn("lost control of PID %d due to exec of %s executable\n",
854 		    (int)pid, error == EOVERFLOW ? "64-bit" : "set-id");
855 
856 		for (sep = t->t_matched; sep != T_SE_END; sep = nsep) {
857 			nsep = sep->se_matched;
858 			sep->se_matched = NULL;
859 			mdb_tgt_sespec_rele(t, sep);
860 		}
861 
862 		if (error != EOVERFLOW)
863 			return; /* just stop if we exec'd a set-id executable */
864 	}
865 
866 	if (Pstate(P) != PS_LOST) {
867 		if (Pexecname(P, execname, sizeof (execname)) == NULL) {
868 			(void) mdb_iob_snprintf(execname, sizeof (execname),
869 			    "/proc/%d/object/a.out", (int)pid);
870 		}
871 
872 		if (follow_exec == FALSE || psp->pr_dmodel == PR_MODEL_NATIVE)
873 			warn("target performed exec of %s\n", execname);
874 
875 		io = mdb_fdio_create_path(NULL, execname, pt->p_oflags, 0);
876 		if (io == NULL) {
877 			warn("failed to open %s", execname);
878 			warn("a.out symbol tables will not be available\n");
879 		} else if (pt_open_aout(t, io) == NULL) {
880 			(void) mdb_dis_select(pt_disasm(NULL));
881 			mdb_io_destroy(io);
882 		} else
883 			(void) mdb_dis_select(pt_disasm(&pt->p_file->gf_ehdr));
884 	}
885 
886 	/*
887 	 * We reset our libthread_db state here, but deliberately do NOT call
888 	 * PTL_DTOR because we do not want to call libthread_db's td_ta_delete.
889 	 * This interface is hopelessly broken in that it writes to the process
890 	 * address space (which we do not want it to do after an exec) and it
891 	 * doesn't bother deallocating any of its storage anyway.
892 	 */
893 	pt->p_tdb_ops = NULL;
894 	pt->p_ptl_ops = &proc_lwp_ops;
895 	pt->p_ptl_hdl = NULL;
896 
897 	if (follow_exec && psp->pr_dmodel != PR_MODEL_NATIVE) {
898 		const char *argv[3];
899 		char *state, *env;
900 		char pidarg[16];
901 		size_t envlen;
902 
903 		if (realpath(getexecname(), execname) == NULL) {
904 			warn("cannot follow PID %d -- failed to resolve "
905 			    "debugger pathname for re-exec", (int)pid);
906 			return;
907 		}
908 
909 		warn("restarting debugger to follow PID %d ...\n", (int)pid);
910 		mdb_dprintf(MDB_DBG_TGT, "re-exec'ing %s\n", execname);
911 
912 		(void) mdb_snprintf(pidarg, sizeof (pidarg), "-p%d", (int)pid);
913 
914 		state = mdb_get_config();
915 		envlen = strlen(MDB_CONFIG_ENV_VAR) + 1 + strlen(state) + 1;
916 		env = mdb_alloc(envlen, UM_SLEEP);
917 		snprintf(env, envlen, "%s=%s", MDB_CONFIG_ENV_VAR, state);
918 
919 		(void) putenv(env);
920 
921 		argv[0] = mdb.m_pname;
922 		argv[1] = pidarg;
923 		argv[2] = NULL;
924 
925 		if (mdb.m_term != NULL)
926 			IOP_SUSPEND(mdb.m_term);
927 
928 		Prelease(P, PRELEASE_CLEAR | PRELEASE_HANG);
929 		(void) execv(execname, (char *const *)argv);
930 		warn("failed to re-exec debugger");
931 
932 		if (mdb.m_term != NULL)
933 			IOP_RESUME(mdb.m_term);
934 
935 		t->t_pshandle = pt->p_idlehandle;
936 		return;
937 	}
938 
939 	pt_post_attach(t);	/* install tracing flags and activate events */
940 	pt_activate_common(t);	/* initialize librtld_db and libthread_db */
941 
942 	if (psp->pr_dmodel != PR_MODEL_NATIVE && mdb.m_term != NULL) {
943 		warn("loadable dcmds will not operate on non-native %d-bit "
944 		    "data model\n", psp->pr_dmodel == PR_MODEL_ILP32 ? 32 : 64);
945 		warn("use ::release -a and then run mdb -p %d to restart "
946 		    "debugger\n", (int)pid);
947 	}
948 
949 	if (follow_exec)
950 		(void) mdb_tgt_continue(t, NULL);
951 }
952 
953 static int
954 pt_setflags(mdb_tgt_t *t, int flags)
955 {
956 	pt_data_t *pt = t->t_data;
957 
958 	if ((flags ^ t->t_flags) & MDB_TGT_F_RDWR) {
959 		int mode = (flags & MDB_TGT_F_RDWR) ? O_RDWR : O_RDONLY;
960 		mdb_io_t *io;
961 
962 		if (pt->p_fio == NULL)
963 			return (set_errno(EMDB_NOEXEC));
964 
965 		io = mdb_fdio_create_path(NULL, IOP_NAME(pt->p_fio), mode, 0);
966 
967 		if (io == NULL)
968 			return (-1); /* errno is set for us */
969 
970 		t->t_flags = (t->t_flags & ~MDB_TGT_F_RDWR) |
971 		    (flags & MDB_TGT_F_RDWR);
972 
973 		pt->p_fio = mdb_io_hold(io);
974 		mdb_io_rele(pt->p_file->gf_io);
975 		pt->p_file->gf_io = pt->p_fio;
976 	}
977 
978 	if (flags & MDB_TGT_F_FORCE) {
979 		t->t_flags |= MDB_TGT_F_FORCE;
980 		pt->p_gflags |= PGRAB_FORCE;
981 	}
982 
983 	return (0);
984 }
985 
986 /*ARGSUSED*/
987 static int
988 pt_frame(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
989     const mdb_tgt_gregset_t *gregs)
990 {
991 	argc = MIN(argc, (uint_t)(uintptr_t)arglim);
992 	mdb_printf("%a(", pc);
993 
994 	if (argc != 0) {
995 		mdb_printf("%lr", *argv++);
996 		for (argc--; argc != 0; argc--)
997 			mdb_printf(", %lr", *argv++);
998 	}
999 
1000 	mdb_printf(")\n");
1001 	return (0);
1002 }
1003 
1004 static int
1005 pt_framev(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1006     const mdb_tgt_gregset_t *gregs)
1007 {
1008 	argc = MIN(argc, (uint_t)(uintptr_t)arglim);
1009 #if defined(__i386) || defined(__amd64)
1010 	mdb_printf("%0?lr %a(", gregs->gregs[R_FP], pc);
1011 #else
1012 	mdb_printf("%0?lr %a(", gregs->gregs[R_SP], pc);
1013 #endif
1014 	if (argc != 0) {
1015 		mdb_printf("%lr", *argv++);
1016 		for (argc--; argc != 0; argc--)
1017 			mdb_printf(", %lr", *argv++);
1018 	}
1019 
1020 	mdb_printf(")\n");
1021 	return (0);
1022 }
1023 
1024 static int
1025 pt_framer(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1026     const mdb_tgt_gregset_t *gregs)
1027 {
1028 	if (pt_frameregs(arglim, pc, argc, argv, gregs, pc == PC_FAKE) == -1) {
1029 		/*
1030 		 * Use verbose format if register format is not supported.
1031 		 */
1032 		return (pt_framev(arglim, pc, argc, argv, gregs));
1033 	}
1034 
1035 	return (0);
1036 }
1037 
1038 /*ARGSUSED*/
1039 static int
1040 pt_stack_common(uintptr_t addr, uint_t flags, int argc,
1041     const mdb_arg_t *argv, mdb_tgt_stack_f *func, prgreg_t saved_pc)
1042 {
1043 	void *arg = (void *)(uintptr_t)mdb.m_nargs;
1044 	mdb_tgt_t *t = mdb.m_target;
1045 	mdb_tgt_gregset_t gregs;
1046 
1047 	if (argc != 0) {
1048 		if (argv->a_type == MDB_TYPE_CHAR || argc > 1)
1049 			return (DCMD_USAGE);
1050 
1051 		if (argv->a_type == MDB_TYPE_STRING)
1052 			arg = (void *)(uintptr_t)mdb_strtoull(argv->a_un.a_str);
1053 		else
1054 			arg = (void *)(uintptr_t)argv->a_un.a_val;
1055 	}
1056 
1057 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE) {
1058 		mdb_warn("no process active\n");
1059 		return (DCMD_ERR);
1060 	}
1061 
1062 	/*
1063 	 * In the universe of sparcv7, sparcv9, ia32, and amd64 this code can be
1064 	 * common: <sys/procfs_isa.h> conveniently #defines R_FP to be the
1065 	 * appropriate register we need to set in order to perform a stack
1066 	 * traceback from a given frame address.
1067 	 */
1068 	if (flags & DCMD_ADDRSPEC) {
1069 		bzero(&gregs, sizeof (gregs));
1070 		gregs.gregs[R_FP] = addr;
1071 #ifdef __sparc
1072 		gregs.gregs[R_I7] = saved_pc;
1073 #endif /* __sparc */
1074 	} else if (PTL_GETREGS(t, PTL_TID(t), gregs.gregs) != 0) {
1075 		mdb_warn("failed to get current register set");
1076 		return (DCMD_ERR);
1077 	}
1078 
1079 	(void) mdb_tgt_stack_iter(t, &gregs, func, arg);
1080 	return (DCMD_OK);
1081 }
1082 
1083 static int
1084 pt_stack(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1085 {
1086 	return (pt_stack_common(addr, flags, argc, argv, pt_frame, 0));
1087 }
1088 
1089 static int
1090 pt_stackv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1091 {
1092 	return (pt_stack_common(addr, flags, argc, argv, pt_framev, 0));
1093 }
1094 
1095 static int
1096 pt_stackr(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1097 {
1098 	/*
1099 	 * Force printing of first register window, by setting  the
1100 	 * saved pc (%i7) to PC_FAKE.
1101 	 */
1102 	return (pt_stack_common(addr, flags, argc, argv, pt_framer, PC_FAKE));
1103 }
1104 
1105 /*ARGSUSED*/
1106 static int
1107 pt_ignored(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1108 {
1109 	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1110 	char buf[PRSIGBUFSZ];
1111 
1112 	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1113 		return (DCMD_USAGE);
1114 
1115 	if (P == NULL) {
1116 		mdb_warn("no process is currently active\n");
1117 		return (DCMD_ERR);
1118 	}
1119 
1120 	mdb_printf("%s\n", proc_sigset2str(&Pstatus(P)->pr_sigtrace, " ",
1121 	    FALSE, buf, sizeof (buf)));
1122 
1123 	return (DCMD_OK);
1124 }
1125 
1126 /*ARGSUSED*/
1127 static int
1128 pt_lwpid(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1129 {
1130 	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1131 
1132 	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1133 		return (DCMD_USAGE);
1134 
1135 	if (P == NULL) {
1136 		mdb_warn("no process is currently active\n");
1137 		return (DCMD_ERR);
1138 	}
1139 
1140 	mdb_printf("%d\n", Pstatus(P)->pr_lwp.pr_lwpid);
1141 	return (DCMD_OK);
1142 }
1143 
1144 static int
1145 pt_print_lwpid(int *n, const lwpstatus_t *psp)
1146 {
1147 	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1148 	int nlwp = Pstatus(P)->pr_nlwp;
1149 
1150 	if (*n == nlwp - 2)
1151 		mdb_printf("%d and ", (int)psp->pr_lwpid);
1152 	else if (*n == nlwp - 1)
1153 		mdb_printf("%d are", (int)psp->pr_lwpid);
1154 	else
1155 		mdb_printf("%d, ", (int)psp->pr_lwpid);
1156 
1157 	(*n)++;
1158 	return (0);
1159 }
1160 
1161 /*ARGSUSED*/
1162 static int
1163 pt_lwpids(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1164 {
1165 	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1166 	int n = 0;
1167 
1168 	if (P == NULL) {
1169 		mdb_warn("no process is currently active\n");
1170 		return (DCMD_ERR);
1171 	}
1172 
1173 	switch (Pstatus(P)->pr_nlwp) {
1174 	case 0:
1175 		mdb_printf("no lwps are");
1176 		break;
1177 	case 1:
1178 		mdb_printf("lwpid %d is the only lwp",
1179 		    Pstatus(P)->pr_lwp.pr_lwpid);
1180 		break;
1181 	default:
1182 		mdb_printf("lwpids ");
1183 		(void) Plwp_iter(P, (proc_lwp_f *)pt_print_lwpid, &n);
1184 	}
1185 
1186 	switch (Pstate(P)) {
1187 	case PS_DEAD:
1188 		mdb_printf(" in core of process %d.\n", Pstatus(P)->pr_pid);
1189 		break;
1190 	case PS_IDLE:
1191 		mdb_printf(" in idle target.\n");
1192 		break;
1193 	default:
1194 		mdb_printf(" in process %d.\n", (int)Pstatus(P)->pr_pid);
1195 		break;
1196 	}
1197 
1198 	return (DCMD_OK);
1199 }
1200 
1201 /*ARGSUSED*/
1202 static int
1203 pt_ignore(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1204 {
1205 	pt_data_t *pt = mdb.m_target->t_data;
1206 
1207 	if (!(flags & DCMD_ADDRSPEC) || argc != 0)
1208 		return (DCMD_USAGE);
1209 
1210 	if (addr < 1 || addr > pt->p_maxsig) {
1211 		mdb_warn("invalid signal number -- 0t%lu\n", addr);
1212 		return (DCMD_ERR);
1213 	}
1214 
1215 	(void) mdb_tgt_vespec_iter(mdb.m_target, pt_ignore_sig, (void *)addr);
1216 	return (DCMD_OK);
1217 }
1218 
1219 /*ARGSUSED*/
1220 static int
1221 pt_attach(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1222 {
1223 	mdb_tgt_t *t = mdb.m_target;
1224 	pt_data_t *pt = t->t_data;
1225 	int state, perr;
1226 
1227 	if (!(flags & DCMD_ADDRSPEC) && argc == 0)
1228 		return (DCMD_USAGE);
1229 
1230 	if (((flags & DCMD_ADDRSPEC) && argc != 0) || argc > 1 ||
1231 	    (argc != 0 && argv->a_type != MDB_TYPE_STRING))
1232 		return (DCMD_USAGE);
1233 
1234 	if (t->t_pshandle != NULL && Pstate(t->t_pshandle) != PS_IDLE) {
1235 		mdb_warn("debugger is already attached to a %s\n",
1236 		    (Pstate(t->t_pshandle) == PS_DEAD) ? "core" : "process");
1237 		return (DCMD_ERR);
1238 	}
1239 
1240 	if (pt->p_fio == NULL) {
1241 		mdb_warn("attach requires executable to be specified on "
1242 		    "command-line (or use -p)\n");
1243 		return (DCMD_ERR);
1244 	}
1245 
1246 	if (flags & DCMD_ADDRSPEC)
1247 		t->t_pshandle = Pgrab((pid_t)addr, pt->p_gflags, &perr);
1248 	else
1249 		t->t_pshandle = proc_arg_grab(argv->a_un.a_str,
1250 		    PR_ARG_ANY, pt->p_gflags, &perr);
1251 
1252 	if (t->t_pshandle == NULL) {
1253 		t->t_pshandle = pt->p_idlehandle;
1254 		mdb_warn("cannot attach: %s\n", Pgrab_error(perr));
1255 		return (DCMD_ERR);
1256 	}
1257 
1258 	state = Pstate(t->t_pshandle);
1259 	if (state != PS_DEAD && state != PS_IDLE) {
1260 		(void) Punsetflags(t->t_pshandle, PR_KLC);
1261 		(void) Psetflags(t->t_pshandle, PR_RLC);
1262 		pt_post_attach(t);
1263 		pt_activate_common(t);
1264 	}
1265 
1266 	(void) mdb_tgt_status(t, &t->t_status);
1267 	mdb_module_load_all(0);
1268 	return (DCMD_OK);
1269 }
1270 
1271 static int
1272 pt_regstatus(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1273 {
1274 	mdb_tgt_t *t = mdb.m_target;
1275 
1276 	if (t->t_pshandle != NULL) {
1277 		const pstatus_t *psp = Pstatus(t->t_pshandle);
1278 		int cursig = psp->pr_lwp.pr_cursig;
1279 		char signame[SIG2STR_MAX];
1280 		int state = Pstate(t->t_pshandle);
1281 
1282 		if (state != PS_DEAD && state != PS_IDLE)
1283 			mdb_printf("process id = %d\n", psp->pr_pid);
1284 		else
1285 			mdb_printf("no process\n");
1286 
1287 		if (cursig != 0 && sig2str(cursig, signame) == 0)
1288 			mdb_printf("SIG%s: %s\n", signame, strsignal(cursig));
1289 	}
1290 
1291 	return (pt_regs(addr, flags, argc, argv));
1292 }
1293 
1294 static int
1295 pt_findstack(uintptr_t tid, uint_t flags, int argc, const mdb_arg_t *argv)
1296 {
1297 	mdb_tgt_t *t = mdb.m_target;
1298 	mdb_tgt_gregset_t gregs;
1299 	int showargs = 0;
1300 	int count;
1301 	uintptr_t pc, sp;
1302 
1303 	if (!(flags & DCMD_ADDRSPEC))
1304 		return (DCMD_USAGE);
1305 
1306 	count = mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &showargs,
1307 	    NULL);
1308 	argc -= count;
1309 	argv += count;
1310 
1311 	if (argc > 1 || (argc == 1 && argv->a_type != MDB_TYPE_STRING))
1312 		return (DCMD_USAGE);
1313 
1314 	if (PTL_GETREGS(t, tid, gregs.gregs) != 0) {
1315 		mdb_warn("failed to get register set for thread %p", tid);
1316 		return (DCMD_ERR);
1317 	}
1318 
1319 	pc = gregs.gregs[R_PC];
1320 #if defined(__i386) || defined(__amd64)
1321 	sp = gregs.gregs[R_FP];
1322 #else
1323 	sp = gregs.gregs[R_SP];
1324 #endif
1325 	mdb_printf("stack pointer for thread %p: %p\n", tid, sp);
1326 	if (pc != 0)
1327 		mdb_printf("[ %0?lr %a() ]\n", sp, pc);
1328 
1329 	(void) mdb_inc_indent(2);
1330 	mdb_set_dot(sp);
1331 
1332 	if (argc == 1)
1333 		(void) mdb_eval(argv->a_un.a_str);
1334 	else if (showargs)
1335 		(void) mdb_eval("<.$C");
1336 	else
1337 		(void) mdb_eval("<.$C0");
1338 
1339 	(void) mdb_dec_indent(2);
1340 	return (DCMD_OK);
1341 }
1342 
1343 /*ARGSUSED*/
1344 static int
1345 pt_gcore(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1346 {
1347 	mdb_tgt_t *t = mdb.m_target;
1348 	char *prefix = "core";
1349 	char *content_str = NULL;
1350 	core_content_t content = CC_CONTENT_DEFAULT;
1351 	size_t size;
1352 	char *fname;
1353 	pid_t pid;
1354 
1355 	if (flags & DCMD_ADDRSPEC)
1356 		return (DCMD_USAGE);
1357 
1358 	if (mdb_getopts(argc, argv,
1359 	    'o', MDB_OPT_STR, &prefix,
1360 	    'c', MDB_OPT_STR, &content_str, NULL) != argc)
1361 		return (DCMD_USAGE);
1362 
1363 	if (content_str != NULL &&
1364 	    (proc_str2content(content_str, &content) != 0 ||
1365 	    content == CC_CONTENT_INVALID)) {
1366 		mdb_warn("invalid content string '%s'\n", content_str);
1367 		return (DCMD_ERR);
1368 	}
1369 
1370 	pid = Pstatus(t->t_pshandle)->pr_pid;
1371 	size = 1 + mdb_snprintf(NULL, 0, "%s.%d", prefix, (int)pid);
1372 	fname = mdb_alloc(size, UM_SLEEP | UM_GC);
1373 	(void) mdb_snprintf(fname, size, "%s.%d", prefix, (int)pid);
1374 
1375 	if (Pgcore(t->t_pshandle, fname, content) != 0) {
1376 		mdb_warn("couldn't dump core");
1377 		return (DCMD_ERR);
1378 	}
1379 
1380 	mdb_warn("%s dumped\n", fname);
1381 
1382 	return (DCMD_OK);
1383 }
1384 
1385 /*ARGSUSED*/
1386 static int
1387 pt_kill(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1388 {
1389 	mdb_tgt_t *t = mdb.m_target;
1390 	pt_data_t *pt = t->t_data;
1391 	int state;
1392 
1393 	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1394 		return (DCMD_USAGE);
1395 
1396 	if (t->t_pshandle != NULL &&
1397 	    (state = Pstate(t->t_pshandle)) != PS_DEAD && state != PS_IDLE) {
1398 		mdb_warn("victim process PID %d forcibly terminated\n",
1399 		    (int)Pstatus(t->t_pshandle)->pr_pid);
1400 		pt_pre_detach(t, TRUE);
1401 		pt_release_parents(t);
1402 		Prelease(t->t_pshandle, PRELEASE_KILL);
1403 		t->t_pshandle = pt->p_idlehandle;
1404 		(void) mdb_tgt_status(t, &t->t_status);
1405 		mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
1406 	} else
1407 		mdb_warn("no victim process is currently under control\n");
1408 
1409 	return (DCMD_OK);
1410 }
1411 
1412 /*ARGSUSED*/
1413 static int
1414 pt_detach(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1415 {
1416 	mdb_tgt_t *t = mdb.m_target;
1417 	pt_data_t *pt = t->t_data;
1418 	int rflags = pt->p_rflags;
1419 
1420 	if (argc != 0 && argv->a_type == MDB_TYPE_STRING &&
1421 	    strcmp(argv->a_un.a_str, "-a") == 0) {
1422 		rflags = PRELEASE_HANG | PRELEASE_CLEAR;
1423 		argv++;
1424 		argc--;
1425 	}
1426 
1427 	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1428 		return (DCMD_USAGE);
1429 
1430 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE) {
1431 		mdb_warn("debugger is not currently attached to a process "
1432 		    "or core file\n");
1433 		return (DCMD_ERR);
1434 	}
1435 
1436 	pt_pre_detach(t, TRUE);
1437 	pt_release_parents(t);
1438 	Prelease(t->t_pshandle, rflags);
1439 	t->t_pshandle = pt->p_idlehandle;
1440 	(void) mdb_tgt_status(t, &t->t_status);
1441 	mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
1442 
1443 	return (DCMD_OK);
1444 }
1445 
1446 static uintmax_t
1447 reg_disc_get(const mdb_var_t *v)
1448 {
1449 	mdb_tgt_t *t = MDB_NV_COOKIE(v);
1450 	mdb_tgt_tid_t tid = PTL_TID(t);
1451 	mdb_tgt_reg_t r = 0;
1452 
1453 	if (tid != (mdb_tgt_tid_t)-1L)
1454 		(void) mdb_tgt_getareg(t, tid, mdb_nv_get_name(v), &r);
1455 
1456 	return (r);
1457 }
1458 
1459 static void
1460 reg_disc_set(mdb_var_t *v, uintmax_t r)
1461 {
1462 	mdb_tgt_t *t = MDB_NV_COOKIE(v);
1463 	mdb_tgt_tid_t tid = PTL_TID(t);
1464 
1465 	if (tid != (mdb_tgt_tid_t)-1L && mdb_tgt_putareg(t, tid,
1466 	    mdb_nv_get_name(v), r) == -1)
1467 		mdb_warn("failed to modify %%%s register", mdb_nv_get_name(v));
1468 }
1469 
1470 static void
1471 pt_print_reason(const lwpstatus_t *psp)
1472 {
1473 	char name[SIG2STR_MAX + 4]; /* enough for SIG+name+\0, syscall or flt */
1474 	const char *desc;
1475 
1476 	switch (psp->pr_why) {
1477 	case PR_REQUESTED:
1478 		mdb_printf("stopped by debugger");
1479 		break;
1480 	case PR_SIGNALLED:
1481 		mdb_printf("stopped on %s (%s)", proc_signame(psp->pr_what,
1482 		    name, sizeof (name)), strsignal(psp->pr_what));
1483 		break;
1484 	case PR_SYSENTRY:
1485 		mdb_printf("stopped on entry to %s system call",
1486 		    proc_sysname(psp->pr_what, name, sizeof (name)));
1487 		break;
1488 	case PR_SYSEXIT:
1489 		mdb_printf("stopped on exit from %s system call",
1490 		    proc_sysname(psp->pr_what, name, sizeof (name)));
1491 		break;
1492 	case PR_JOBCONTROL:
1493 		mdb_printf("stopped by job control");
1494 		break;
1495 	case PR_FAULTED:
1496 		if (psp->pr_what == FLTBPT) {
1497 			mdb_printf("stopped on a breakpoint");
1498 		} else if (psp->pr_what == FLTWATCH) {
1499 			switch (psp->pr_info.si_code) {
1500 			case TRAP_RWATCH:
1501 				desc = "read";
1502 				break;
1503 			case TRAP_WWATCH:
1504 				desc = "write";
1505 				break;
1506 			case TRAP_XWATCH:
1507 				desc = "execute";
1508 				break;
1509 			default:
1510 				desc = "unknown";
1511 			}
1512 			mdb_printf("stopped %s a watchpoint (%s access to %p)",
1513 			    psp->pr_info.si_trapafter ? "after" : "on",
1514 			    desc, psp->pr_info.si_addr);
1515 		} else if (psp->pr_what == FLTTRACE) {
1516 			mdb_printf("stopped after a single-step");
1517 		} else {
1518 			mdb_printf("stopped on a %s fault",
1519 			    proc_fltname(psp->pr_what, name, sizeof (name)));
1520 		}
1521 		break;
1522 	case PR_SUSPENDED:
1523 	case PR_CHECKPOINT:
1524 		mdb_printf("suspended by the kernel");
1525 		break;
1526 	default:
1527 		mdb_printf("stopped for unknown reason (%d/%d)",
1528 		    psp->pr_why, psp->pr_what);
1529 	}
1530 }
1531 
1532 /*ARGSUSED*/
1533 static int
1534 pt_status_dcmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1535 {
1536 	mdb_tgt_t *t = mdb.m_target;
1537 	struct ps_prochandle *P = t->t_pshandle;
1538 	pt_data_t *pt = t->t_data;
1539 
1540 	if (P != NULL) {
1541 		const psinfo_t *pip = Ppsinfo(P);
1542 		const pstatus_t *psp = Pstatus(P);
1543 		int cursig = 0, bits = 0, coredump = 0;
1544 		int state;
1545 		GElf_Sym sym;
1546 		uintptr_t panicstr;
1547 		char panicbuf[128];
1548 
1549 		char execname[MAXPATHLEN], buf[BUFSIZ];
1550 		char signame[SIG2STR_MAX + 4]; /* enough for SIG+name+\0 */
1551 
1552 		mdb_tgt_spec_desc_t desc;
1553 		mdb_sespec_t *sep;
1554 
1555 		struct utsname uts;
1556 		prcred_t cred;
1557 		psinfo_t pi;
1558 
1559 		(void) strcpy(uts.nodename, "unknown machine");
1560 		(void) Puname(P, &uts);
1561 
1562 		if (pip != NULL) {
1563 			bcopy(pip, &pi, sizeof (psinfo_t));
1564 			proc_unctrl_psinfo(&pi);
1565 		} else
1566 			bzero(&pi, sizeof (psinfo_t));
1567 
1568 		bits = pi.pr_dmodel == PR_MODEL_ILP32 ? 32 : 64;
1569 
1570 		state = Pstate(P);
1571 		if (psp != NULL && state != PS_UNDEAD && state != PS_IDLE)
1572 			cursig = psp->pr_lwp.pr_cursig;
1573 
1574 		if (state == PS_DEAD && pip != NULL) {
1575 			mdb_printf("debugging core file of %s (%d-bit) "
1576 			    "from %s\n", pi.pr_fname, bits, uts.nodename);
1577 
1578 		} else if (state == PS_DEAD) {
1579 			mdb_printf("debugging core file\n");
1580 
1581 		} else if (state == PS_IDLE) {
1582 			const GElf_Ehdr *ehp = &pt->p_file->gf_ehdr;
1583 
1584 			mdb_printf("debugging %s file (%d-bit)\n",
1585 			    ehp->e_type == ET_EXEC ? "executable" : "object",
1586 			    ehp->e_ident[EI_CLASS] == ELFCLASS32 ? 32 : 64);
1587 
1588 		} else if (state == PS_UNDEAD && pi.pr_pid == 0) {
1589 			mdb_printf("debugging defunct process\n");
1590 
1591 		} else {
1592 			mdb_printf("debugging PID %d (%d-bit)\n",
1593 			    pi.pr_pid, bits);
1594 		}
1595 
1596 		if (Pexecname(P, execname, sizeof (execname)) != NULL)
1597 			mdb_printf("file: %s\n", execname);
1598 
1599 		if (pip != NULL && state == PS_DEAD)
1600 			mdb_printf("initial argv: %s\n", pi.pr_psargs);
1601 
1602 		if (state != PS_UNDEAD && state != PS_IDLE) {
1603 			mdb_printf("threading model: ");
1604 			if (pt->p_ptl_ops == &proc_lwp_ops)
1605 				mdb_printf("raw lwps\n");
1606 			else
1607 				mdb_printf("native threads\n");
1608 		}
1609 
1610 		mdb_printf("status: ");
1611 		switch (state) {
1612 		case PS_RUN:
1613 			ASSERT(!(psp->pr_flags & PR_STOPPED));
1614 			mdb_printf("process is running");
1615 			if (psp->pr_flags & PR_DSTOP)
1616 				mdb_printf(", debugger stop directive pending");
1617 			mdb_printf("\n");
1618 			break;
1619 
1620 		case PS_STOP:
1621 			ASSERT(psp->pr_flags & PR_STOPPED);
1622 			pt_print_reason(&psp->pr_lwp);
1623 
1624 			if (psp->pr_flags & PR_DSTOP)
1625 				mdb_printf(", debugger stop directive pending");
1626 			if (psp->pr_flags & PR_ASLEEP)
1627 				mdb_printf(", sleeping in %s system call",
1628 				    proc_sysname(psp->pr_lwp.pr_syscall,
1629 				    signame, sizeof (signame)));
1630 
1631 			mdb_printf("\n");
1632 
1633 			for (sep = t->t_matched; sep != T_SE_END;
1634 			    sep = sep->se_matched) {
1635 				mdb_printf("event: %s\n", sep->se_ops->se_info(
1636 				    t, sep, mdb_list_next(&sep->se_velist),
1637 				    &desc, buf, sizeof (buf)));
1638 			}
1639 			break;
1640 
1641 		case PS_LOST:
1642 			mdb_printf("debugger lost control of process\n");
1643 			break;
1644 
1645 		case PS_UNDEAD:
1646 			coredump = WIFSIGNALED(pi.pr_wstat) &&
1647 			    WCOREDUMP(pi.pr_wstat);
1648 			/*FALLTHRU*/
1649 
1650 		case PS_DEAD:
1651 			if (cursig == 0 && WIFSIGNALED(pi.pr_wstat))
1652 				cursig = WTERMSIG(pi.pr_wstat);
1653 			/*
1654 			 * We can only use pr_wstat == 0 as a test for gcore if
1655 			 * an NT_PRCRED note is present; these features were
1656 			 * added at the same time in Solaris 8.
1657 			 */
1658 			if (pi.pr_wstat == 0 && Pstate(P) == PS_DEAD &&
1659 			    Pcred(P, &cred, 1) == 0) {
1660 				mdb_printf("process core file generated "
1661 				    "with gcore(1)\n");
1662 			} else if (cursig != 0) {
1663 				mdb_printf("process terminated by %s (%s)",
1664 				    proc_signame(cursig, signame,
1665 				    sizeof (signame)), strsignal(cursig));
1666 				if (coredump)
1667 					mdb_printf(" - core file dumped");
1668 				mdb_printf("\n");
1669 			} else {
1670 				mdb_printf("process terminated with exit "
1671 				    "status %d\n", WEXITSTATUS(pi.pr_wstat));
1672 			}
1673 
1674 			if (Plookup_by_name(t->t_pshandle, "libc.so",
1675 			    "panicstr", &sym) == 0 &&
1676 			    Pread(t->t_pshandle, &panicstr, sizeof (panicstr),
1677 			    sym.st_value) == sizeof (panicstr) &&
1678 			    Pread_string(t->t_pshandle, panicbuf,
1679 			    sizeof (panicbuf), panicstr) > 0) {
1680 				mdb_printf("panic message: %s",
1681 				    panicbuf);
1682 			}
1683 
1684 
1685 			break;
1686 
1687 		case PS_IDLE:
1688 			mdb_printf("idle\n");
1689 			break;
1690 
1691 		default:
1692 			mdb_printf("unknown libproc Pstate: %d\n", Pstate(P));
1693 		}
1694 
1695 	} else if (pt->p_file != NULL) {
1696 		const GElf_Ehdr *ehp = &pt->p_file->gf_ehdr;
1697 
1698 		mdb_printf("debugging %s file (%d-bit)\n",
1699 		    ehp->e_type == ET_EXEC ? "executable" : "object",
1700 		    ehp->e_ident[EI_CLASS] == ELFCLASS32 ? 32 : 64);
1701 		mdb_printf("executable file: %s\n", IOP_NAME(pt->p_fio));
1702 		mdb_printf("status: idle\n");
1703 	}
1704 
1705 	return (DCMD_OK);
1706 }
1707 
1708 static int
1709 pt_tls(uintptr_t tid, uint_t flags, int argc, const mdb_arg_t *argv)
1710 {
1711 	const char *name;
1712 	const char *object;
1713 	GElf_Sym sym;
1714 	mdb_syminfo_t si;
1715 	mdb_tgt_t *t = mdb.m_target;
1716 
1717 	if (!(flags & DCMD_ADDRSPEC) || argc > 1)
1718 		return (DCMD_USAGE);
1719 
1720 	if (argc == 0) {
1721 		psaddr_t b;
1722 
1723 		if (tlsbase(t, tid, PR_LMID_EVERY, MDB_TGT_OBJ_EXEC, &b) != 0) {
1724 			mdb_warn("failed to lookup tlsbase for %r", tid);
1725 			return (DCMD_ERR);
1726 		}
1727 
1728 		mdb_printf("%lr\n", b);
1729 		mdb_set_dot(b);
1730 
1731 		return (DCMD_OK);
1732 	}
1733 
1734 	name = argv[0].a_un.a_str;
1735 	object = MDB_TGT_OBJ_EVERY;
1736 
1737 	if (pt_lookup_by_name_thr(t, object, name, &sym, &si, tid) != 0) {
1738 		mdb_warn("failed to lookup %s", name);
1739 		return (DCMD_ABORT); /* avoid repeated failure */
1740 	}
1741 
1742 	if (GELF_ST_TYPE(sym.st_info) != STT_TLS && DCMD_HDRSPEC(flags))
1743 		mdb_warn("%s does not refer to thread local storage\n", name);
1744 
1745 	mdb_printf("%llr\n", sym.st_value);
1746 	mdb_set_dot(sym.st_value);
1747 
1748 	return (DCMD_OK);
1749 }
1750 
1751 /*ARGSUSED*/
1752 static int
1753 pt_tmodel(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1754 {
1755 	mdb_tgt_t *t = mdb.m_target;
1756 	pt_data_t *pt = t->t_data;
1757 	const pt_ptl_ops_t *ptl_ops;
1758 
1759 	if (argc != 1 || argv->a_type != MDB_TYPE_STRING)
1760 		return (DCMD_USAGE);
1761 
1762 	if (strcmp(argv->a_un.a_str, "thread") == 0)
1763 		ptl_ops = &proc_tdb_ops;
1764 	else if (strcmp(argv->a_un.a_str, "lwp") == 0)
1765 		ptl_ops = &proc_lwp_ops;
1766 	else
1767 		return (DCMD_USAGE);
1768 
1769 	if (t->t_pshandle != NULL && pt->p_ptl_ops != ptl_ops) {
1770 		PTL_DTOR(t);
1771 		pt->p_tdb_ops = NULL;
1772 		pt->p_ptl_ops = &proc_lwp_ops;
1773 		pt->p_ptl_hdl = NULL;
1774 
1775 		if (ptl_ops == &proc_tdb_ops) {
1776 			(void) Pobject_iter(t->t_pshandle, (proc_map_f *)
1777 			    thr_check, t);
1778 		}
1779 	}
1780 
1781 	(void) mdb_tgt_status(t, &t->t_status);
1782 	return (DCMD_OK);
1783 }
1784 
1785 static const char *
1786 env_match(const char *cmp, const char *nameval)
1787 {
1788 	const char *loc;
1789 	size_t cmplen = strlen(cmp);
1790 
1791 	loc = strchr(nameval, '=');
1792 	if (loc != NULL && (loc - nameval) == cmplen &&
1793 	    strncmp(nameval, cmp, cmplen) == 0) {
1794 		return (loc + 1);
1795 	}
1796 
1797 	return (NULL);
1798 }
1799 
1800 /*ARGSUSED*/
1801 static int
1802 print_env(void *data, struct ps_prochandle *P, uintptr_t addr,
1803     const char *nameval)
1804 {
1805 	const char *value;
1806 
1807 	if (nameval == NULL) {
1808 		mdb_printf("<0x%p>\n", addr);
1809 	} else {
1810 		if (data == NULL)
1811 			mdb_printf("%s\n", nameval);
1812 		else if ((value = env_match(data, nameval)) != NULL)
1813 			mdb_printf("%s\n", value);
1814 	}
1815 
1816 	return (0);
1817 }
1818 
1819 /*ARGSUSED*/
1820 static int
1821 pt_getenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1822 {
1823 	mdb_tgt_t *t = mdb.m_target;
1824 	pt_data_t *pt = t->t_data;
1825 	int i;
1826 	uint_t opt_t = 0;
1827 	mdb_var_t *v;
1828 
1829 	i = mdb_getopts(argc, argv,
1830 	    't', MDB_OPT_SETBITS, TRUE, &opt_t, NULL);
1831 
1832 	argc -= i;
1833 	argv += i;
1834 
1835 	if ((flags & DCMD_ADDRSPEC) || argc > 1)
1836 		return (DCMD_USAGE);
1837 
1838 	if (argc == 1 && argv->a_type != MDB_TYPE_STRING)
1839 		return (DCMD_USAGE);
1840 
1841 	if (opt_t && (Pstate(t->t_pshandle) == PS_IDLE ||
1842 	    Pstate(t->t_pshandle) == PS_UNDEAD)) {
1843 		mdb_warn("-t option requires target to be running\n");
1844 		return (DCMD_ERR);
1845 	}
1846 
1847 	if (opt_t != 0) {
1848 		if (Penv_iter(t->t_pshandle, print_env,
1849 		    argc == 0 ? NULL : (void *)argv->a_un.a_str) != 0)
1850 			return (DCMD_ERR);
1851 	} else if (argc == 1) {
1852 		if ((v = mdb_nv_lookup(&pt->p_env, argv->a_un.a_str)) == NULL)
1853 			return (DCMD_ERR);
1854 
1855 		ASSERT(strchr(mdb_nv_get_cookie(v), '=') != NULL);
1856 		mdb_printf("%s\n", strchr(mdb_nv_get_cookie(v), '=') + 1);
1857 	} else {
1858 
1859 		mdb_nv_rewind(&pt->p_env);
1860 		while ((v = mdb_nv_advance(&pt->p_env)) != NULL)
1861 			mdb_printf("%s\n", mdb_nv_get_cookie(v));
1862 	}
1863 
1864 	return (DCMD_OK);
1865 }
1866 
1867 /*
1868  * Function to set a variable in the internal environment, which is used when
1869  * creating new processes.  Note that it is possible that 'nameval' can refer to
1870  * read-only memory, if mdb calls putenv() on an existing value before calling
1871  * this function.  While we should avoid this situation, this function is
1872  * designed to be robust in the face of such changes.
1873  */
1874 static void
1875 pt_env_set(pt_data_t *pt, const char *nameval)
1876 {
1877 	mdb_var_t *v;
1878 	char *equals, *val;
1879 	const char *name;
1880 	size_t len;
1881 
1882 	if ((equals = strchr(nameval, '=')) != NULL) {
1883 		val = strdup(nameval);
1884 		equals = val + (equals - nameval);
1885 	} else {
1886 		/*
1887 		 * nameval doesn't contain an equals character.  Convert this to
1888 		 * be 'nameval='.
1889 		 */
1890 		len = strlen(nameval);
1891 		val = mdb_alloc(len + 2, UM_SLEEP);
1892 		(void) mdb_snprintf(val, len + 2, "%s=", nameval);
1893 		equals = val + len;
1894 	}
1895 
1896 	/* temporary truncate the string for lookup/insert */
1897 	*equals = '\0';
1898 	v = mdb_nv_lookup(&pt->p_env, val);
1899 
1900 	if (v != NULL) {
1901 		char *old = mdb_nv_get_cookie(v);
1902 		mdb_free(old, strlen(old) + 1);
1903 		name = mdb_nv_get_name(v);
1904 	} else {
1905 		/*
1906 		 * The environment is created using MDB_NV_EXTNAME, so we must
1907 		 * provide external storage for the variable names.
1908 		 */
1909 		name = strdup(val);
1910 	}
1911 
1912 	*equals = '=';
1913 
1914 	(void) mdb_nv_insert(&pt->p_env, name, NULL, (uintptr_t)val,
1915 	    MDB_NV_EXTNAME);
1916 
1917 	if (equals)
1918 		*equals = '=';
1919 }
1920 
1921 /*
1922  * Clears the internal environment.
1923  */
1924 static void
1925 pt_env_clear(pt_data_t *pt)
1926 {
1927 	mdb_var_t *v;
1928 	char *val, *name;
1929 
1930 	mdb_nv_rewind(&pt->p_env);
1931 	while ((v = mdb_nv_advance(&pt->p_env)) != NULL) {
1932 
1933 		name = (char *)mdb_nv_get_name(v);
1934 		val = mdb_nv_get_cookie(v);
1935 
1936 		mdb_nv_remove(&pt->p_env, v);
1937 
1938 		mdb_free(name, strlen(name) + 1);
1939 		mdb_free(val, strlen(val) + 1);
1940 	}
1941 }
1942 
1943 /*ARGSUSED*/
1944 static int
1945 pt_setenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1946 {
1947 	mdb_tgt_t *t = mdb.m_target;
1948 	pt_data_t *pt = t->t_data;
1949 	char *nameval;
1950 	size_t len;
1951 	int alloc;
1952 
1953 	if ((flags & DCMD_ADDRSPEC) || argc == 0 || argc > 2)
1954 		return (DCMD_USAGE);
1955 
1956 	if ((argc > 0 && argv[0].a_type != MDB_TYPE_STRING) ||
1957 	    (argc > 1 && argv[1].a_type != MDB_TYPE_STRING))
1958 		return (DCMD_USAGE);
1959 
1960 	/*
1961 	 * If the process is in some sort of running state, warn the user that
1962 	 * changes won't immediately take effect.
1963 	 */
1964 	if (Pstate(t->t_pshandle) == PS_RUN ||
1965 	    Pstate(t->t_pshandle) == PS_STOP) {
1966 		mdb_warn("warning: changes will not take effect until process"
1967 		    " is restarted\n");
1968 	}
1969 
1970 	/*
1971 	 * We allow two forms of operation.  The first is the usual "name=value"
1972 	 * parameter.  We also allow the user to specify two arguments, where
1973 	 * the first is the name of the variable, and the second is the value.
1974 	 */
1975 	alloc = 0;
1976 	if (argc == 1) {
1977 		nameval = (char *)argv->a_un.a_str;
1978 	} else {
1979 		len = strlen(argv[0].a_un.a_str) +
1980 		    strlen(argv[1].a_un.a_str) + 2;
1981 		nameval = mdb_alloc(len, UM_SLEEP);
1982 		(void) mdb_snprintf(nameval, len, "%s=%s", argv[0].a_un.a_str,
1983 		    argv[1].a_un.a_str);
1984 		alloc = 1;
1985 	}
1986 
1987 	pt_env_set(pt, nameval);
1988 
1989 	if (alloc)
1990 		mdb_free(nameval, strlen(nameval) + 1);
1991 
1992 	return (DCMD_OK);
1993 }
1994 
1995 /*ARGSUSED*/
1996 static int
1997 pt_unsetenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1998 {
1999 	mdb_tgt_t *t = mdb.m_target;
2000 	pt_data_t *pt = t->t_data;
2001 	mdb_var_t *v;
2002 	char *value, *name;
2003 
2004 	if ((flags & DCMD_ADDRSPEC) || argc > 1)
2005 		return (DCMD_USAGE);
2006 
2007 	if (argc == 1 && argv->a_type != MDB_TYPE_STRING)
2008 		return (DCMD_USAGE);
2009 
2010 	/*
2011 	 * If the process is in some sort of running state, warn the user that
2012 	 * changes won't immediately take effect.
2013 	 */
2014 	if (Pstate(t->t_pshandle) == PS_RUN ||
2015 	    Pstate(t->t_pshandle) == PS_STOP) {
2016 		mdb_warn("warning: changes will not take effect until process"
2017 		    " is restarted\n");
2018 	}
2019 
2020 	if (argc == 0) {
2021 		pt_env_clear(pt);
2022 	} else {
2023 		if ((v = mdb_nv_lookup(&pt->p_env, argv->a_un.a_str)) != NULL) {
2024 			name = (char *)mdb_nv_get_name(v);
2025 			value = mdb_nv_get_cookie(v);
2026 
2027 			mdb_nv_remove(&pt->p_env, v);
2028 
2029 			mdb_free(name, strlen(name) + 1);
2030 			mdb_free(value, strlen(value) + 1);
2031 		}
2032 	}
2033 
2034 	return (DCMD_OK);
2035 }
2036 
2037 static const mdb_dcmd_t pt_dcmds[] = {
2038 	{ "$c", "?[cnt]", "print stack backtrace", pt_stack },
2039 	{ "$C", "?[cnt]", "print stack backtrace", pt_stackv },
2040 	{ "$i", NULL, "print signals that are ignored", pt_ignored },
2041 	{ "$l", NULL, "print the representative thread's lwp id", pt_lwpid },
2042 	{ "$L", NULL, "print list of the active lwp ids", pt_lwpids },
2043 	{ "$r", "?", "print general-purpose registers", pt_regs },
2044 	{ "$x", "?", "print floating point registers", pt_fpregs },
2045 	{ "$X", "?", "print floating point registers", pt_fpregs },
2046 	{ "$y", "?", "print floating point registers", pt_fpregs },
2047 	{ "$Y", "?", "print floating point registers", pt_fpregs },
2048 	{ "$?", "?", "print status and registers", pt_regstatus },
2049 	{ ":A", "?[core|pid]", "attach to process or core file", pt_attach },
2050 	{ ":i", ":", "ignore signal (delete all matching events)", pt_ignore },
2051 	{ ":k", NULL, "forcibly kill and release target", pt_kill },
2052 	{ ":R", "[-a]", "release the previously attached process", pt_detach },
2053 	{ "attach", "?[core|pid]",
2054 	    "attach to process or core file", pt_attach },
2055 	{ "findstack", ":[-v]", "find user thread stack", pt_findstack },
2056 	{ "gcore", "[-o prefix] [-c content]",
2057 	    "produce a core file for the attached process", pt_gcore },
2058 	{ "getenv", "[-t] [name]", "display an environment variable",
2059 		pt_getenv, NULL },
2060 	{ "kill", NULL, "forcibly kill and release target", pt_kill },
2061 	{ "release", "[-a]",
2062 	    "release the previously attached process", pt_detach },
2063 	{ "regs", "?", "print general-purpose registers", pt_regs },
2064 	{ "fpregs", "?[-dqs]", "print floating point registers", pt_fpregs },
2065 	{ "setenv", "name=value", "set an environment variable", pt_setenv },
2066 	{ "stack", "?[cnt]", "print stack backtrace", pt_stack },
2067 	{ "stackregs", "?", "print stack backtrace and registers", pt_stackr },
2068 	{ "status", NULL, "print summary of current target", pt_status_dcmd },
2069 	{ "tls", ":symbol",
2070 	    "lookup TLS data in the context of a given thread", pt_tls },
2071 	{ "tmodel", "{thread|lwp}", NULL, pt_tmodel },
2072 	{ "unsetenv", "[name]", "clear an environment variable", pt_unsetenv },
2073 	{ NULL }
2074 };
2075 
2076 static void
2077 pt_thr_walk_fini(mdb_walk_state_t *wsp)
2078 {
2079 	mdb_addrvec_destroy(wsp->walk_data);
2080 	mdb_free(wsp->walk_data, sizeof (mdb_addrvec_t));
2081 }
2082 
2083 static int
2084 pt_thr_walk_init(mdb_walk_state_t *wsp)
2085 {
2086 	wsp->walk_data = mdb_zalloc(sizeof (mdb_addrvec_t), UM_SLEEP);
2087 	mdb_addrvec_create(wsp->walk_data);
2088 
2089 	if (PTL_ITER(mdb.m_target, wsp->walk_data) == -1) {
2090 		mdb_warn("failed to iterate over threads");
2091 		pt_thr_walk_fini(wsp);
2092 		return (WALK_ERR);
2093 	}
2094 
2095 	return (WALK_NEXT);
2096 }
2097 
2098 static int
2099 pt_thr_walk_step(mdb_walk_state_t *wsp)
2100 {
2101 	if (mdb_addrvec_length(wsp->walk_data) != 0) {
2102 		return (wsp->walk_callback(mdb_addrvec_shift(wsp->walk_data),
2103 		    NULL, wsp->walk_cbdata));
2104 	}
2105 	return (WALK_DONE);
2106 }
2107 
2108 static const mdb_walker_t pt_walkers[] = {
2109 	{ "thread", "walk list of valid thread identifiers",
2110 	    pt_thr_walk_init, pt_thr_walk_step, pt_thr_walk_fini },
2111 	{ NULL }
2112 };
2113 
2114 
2115 static void
2116 pt_activate_common(mdb_tgt_t *t)
2117 {
2118 	pt_data_t *pt = t->t_data;
2119 	GElf_Sym sym;
2120 
2121 	/*
2122 	 * If we have a libproc handle and AT_BASE is set, the process or core
2123 	 * is dynamically linked.  We call Prd_agent() to force libproc to
2124 	 * try to initialize librtld_db, and issue a warning if that fails.
2125 	 */
2126 	if (t->t_pshandle != NULL && Pgetauxval(t->t_pshandle,
2127 	    AT_BASE) != -1L && Prd_agent(t->t_pshandle) == NULL) {
2128 		mdb_warn("warning: librtld_db failed to initialize; shared "
2129 		    "library information will not be available\n");
2130 	}
2131 
2132 	/*
2133 	 * If we have a libproc handle and libthread is loaded, attempt to load
2134 	 * and initialize the corresponding libthread_db.  If this fails, fall
2135 	 * back to our native LWP implementation and issue a warning.
2136 	 */
2137 	if (t->t_pshandle != NULL && Pstate(t->t_pshandle) != PS_IDLE)
2138 		(void) Pobject_iter(t->t_pshandle, (proc_map_f *)thr_check, t);
2139 
2140 	/*
2141 	 * If there's a global object named '_mdb_abort_info', assuming we're
2142 	 * debugging mdb itself and load the developer support module.
2143 	 */
2144 	if (mdb_gelf_symtab_lookup_by_name(pt->p_symtab, "_mdb_abort_info",
2145 	    &sym, NULL) == 0 && GELF_ST_TYPE(sym.st_info) == STT_OBJECT) {
2146 		if (mdb_module_load("mdb_ds", MDB_MOD_SILENT) < 0)
2147 			mdb_warn("warning: failed to load developer support\n");
2148 	}
2149 
2150 	mdb_tgt_elf_export(pt->p_file);
2151 }
2152 
2153 static void
2154 pt_activate(mdb_tgt_t *t)
2155 {
2156 	static const mdb_nv_disc_t reg_disc = { reg_disc_set, reg_disc_get };
2157 
2158 	pt_data_t *pt = t->t_data;
2159 	struct utsname u1, u2;
2160 	mdb_var_t *v;
2161 	core_content_t content;
2162 
2163 	if (t->t_pshandle) {
2164 		mdb_prop_postmortem = (Pstate(t->t_pshandle) == PS_DEAD);
2165 		mdb_prop_kernel = FALSE;
2166 	} else
2167 		mdb_prop_kernel = mdb_prop_postmortem = FALSE;
2168 
2169 	mdb_prop_datamodel = MDB_TGT_MODEL_NATIVE;
2170 
2171 	/*
2172 	 * If we're examining a core file that doesn't contain program text,
2173 	 * and uname(2) doesn't match the NT_UTSNAME note recorded in the
2174 	 * core file, issue a warning.
2175 	 */
2176 	if (mdb_prop_postmortem == TRUE &&
2177 	    ((content = Pcontent(t->t_pshandle)) == CC_CONTENT_INVALID ||
2178 	    !(content & CC_CONTENT_TEXT)) &&
2179 	    uname(&u1) >= 0 && Puname(t->t_pshandle, &u2) == 0 &&
2180 	    (strcmp(u1.release, u2.release) != 0 ||
2181 	    strcmp(u1.version, u2.version) != 0)) {
2182 		mdb_warn("warning: core file is from %s %s %s; shared text "
2183 		    "mappings may not match installed libraries\n",
2184 		    u2.sysname, u2.release, u2.version);
2185 	}
2186 
2187 	/*
2188 	 * Perform the common initialization tasks -- these are shared with
2189 	 * the pt_exec() and pt_run() subroutines.
2190 	 */
2191 	pt_activate_common(t);
2192 
2193 	(void) mdb_tgt_register_dcmds(t, &pt_dcmds[0], MDB_MOD_FORCE);
2194 	(void) mdb_tgt_register_walkers(t, &pt_walkers[0], MDB_MOD_FORCE);
2195 
2196 	/*
2197 	 * Iterate through our register description list and export
2198 	 * each register as a named variable.
2199 	 */
2200 	mdb_nv_rewind(&pt->p_regs);
2201 	while ((v = mdb_nv_advance(&pt->p_regs)) != NULL) {
2202 		ushort_t rd_flags = MDB_TGT_R_FLAGS(mdb_nv_get_value(v));
2203 
2204 		if (!(rd_flags & MDB_TGT_R_EXPORT))
2205 			continue; /* Don't export register as a variable */
2206 
2207 		(void) mdb_nv_insert(&mdb.m_nv, mdb_nv_get_name(v), &reg_disc,
2208 		    (uintptr_t)t, MDB_NV_PERSIST);
2209 	}
2210 }
2211 
2212 static void
2213 pt_deactivate(mdb_tgt_t *t)
2214 {
2215 	pt_data_t *pt = t->t_data;
2216 	const mdb_dcmd_t *dcp;
2217 	const mdb_walker_t *wp;
2218 	mdb_var_t *v, *w;
2219 
2220 	mdb_nv_rewind(&pt->p_regs);
2221 	while ((v = mdb_nv_advance(&pt->p_regs)) != NULL) {
2222 		ushort_t rd_flags = MDB_TGT_R_FLAGS(mdb_nv_get_value(v));
2223 
2224 		if (!(rd_flags & MDB_TGT_R_EXPORT))
2225 			continue; /* Didn't export register as a variable */
2226 
2227 		if (w = mdb_nv_lookup(&mdb.m_nv, mdb_nv_get_name(v))) {
2228 			w->v_flags &= ~MDB_NV_PERSIST;
2229 			mdb_nv_remove(&mdb.m_nv, w);
2230 		}
2231 	}
2232 
2233 	for (wp = &pt_walkers[0]; wp->walk_name != NULL; wp++) {
2234 		if (mdb_module_remove_walker(t->t_module, wp->walk_name) == -1)
2235 			warn("failed to remove walk %s", wp->walk_name);
2236 	}
2237 
2238 	for (dcp = &pt_dcmds[0]; dcp->dc_name != NULL; dcp++) {
2239 		if (mdb_module_remove_dcmd(t->t_module, dcp->dc_name) == -1)
2240 			warn("failed to remove dcmd %s", dcp->dc_name);
2241 	}
2242 
2243 	mdb_prop_postmortem = FALSE;
2244 	mdb_prop_kernel = FALSE;
2245 	mdb_prop_datamodel = MDB_TGT_MODEL_UNKNOWN;
2246 }
2247 
2248 static void
2249 pt_periodic(mdb_tgt_t *t)
2250 {
2251 	pt_data_t *pt = t->t_data;
2252 
2253 	if (pt->p_rdstate == PT_RD_CONSIST) {
2254 		if (t->t_pshandle != NULL && Pstate(t->t_pshandle) < PS_LOST &&
2255 		    !(mdb.m_flags & MDB_FL_NOMODS)) {
2256 			mdb_printf("%s: You've got symbols!\n", mdb.m_pname);
2257 			mdb_module_load_all(0);
2258 		}
2259 		pt->p_rdstate = PT_RD_NONE;
2260 	}
2261 }
2262 
2263 static void
2264 pt_destroy(mdb_tgt_t *t)
2265 {
2266 	pt_data_t *pt = t->t_data;
2267 
2268 	if (pt->p_idlehandle != NULL && pt->p_idlehandle != t->t_pshandle)
2269 		Prelease(pt->p_idlehandle, 0);
2270 
2271 	if (t->t_pshandle != NULL) {
2272 		PTL_DTOR(t);
2273 		pt_release_parents(t);
2274 		pt_pre_detach(t, TRUE);
2275 		Prelease(t->t_pshandle, pt->p_rflags);
2276 	}
2277 
2278 	mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
2279 	pt_close_aout(t);
2280 
2281 	if (pt->p_aout_fio != NULL)
2282 		mdb_io_rele(pt->p_aout_fio);
2283 
2284 	pt_env_clear(pt);
2285 	mdb_nv_destroy(&pt->p_env);
2286 
2287 	mdb_nv_destroy(&pt->p_regs);
2288 	mdb_free(pt, sizeof (pt_data_t));
2289 }
2290 
2291 /*ARGSUSED*/
2292 static const char *
2293 pt_name(mdb_tgt_t *t)
2294 {
2295 	return ("proc");
2296 }
2297 
2298 static const char *
2299 pt_platform(mdb_tgt_t *t)
2300 {
2301 	pt_data_t *pt = t->t_data;
2302 
2303 	if (t->t_pshandle != NULL &&
2304 	    Pplatform(t->t_pshandle, pt->p_platform, MAXNAMELEN) != NULL)
2305 		return (pt->p_platform);
2306 
2307 	return (mdb_conf_platform());
2308 }
2309 
2310 static int
2311 pt_uname(mdb_tgt_t *t, struct utsname *utsp)
2312 {
2313 	if (t->t_pshandle != NULL)
2314 		return (Puname(t->t_pshandle, utsp));
2315 
2316 	return (uname(utsp) >= 0 ? 0 : -1);
2317 }
2318 
2319 static int
2320 pt_dmodel(mdb_tgt_t *t)
2321 {
2322 	if (t->t_pshandle == NULL)
2323 		return (MDB_TGT_MODEL_NATIVE);
2324 
2325 	switch (Pstatus(t->t_pshandle)->pr_dmodel) {
2326 	case PR_MODEL_ILP32:
2327 		return (MDB_TGT_MODEL_ILP32);
2328 	case PR_MODEL_LP64:
2329 		return (MDB_TGT_MODEL_LP64);
2330 	}
2331 
2332 	return (MDB_TGT_MODEL_UNKNOWN);
2333 }
2334 
2335 static ssize_t
2336 pt_vread(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
2337 {
2338 	ssize_t n;
2339 
2340 	/*
2341 	 * If no handle is open yet, reads from virtual addresses are
2342 	 * allowed to succeed but return zero-filled memory.
2343 	 */
2344 	if (t->t_pshandle == NULL) {
2345 		bzero(buf, nbytes);
2346 		return (nbytes);
2347 	}
2348 
2349 	if ((n = Pread(t->t_pshandle, buf, nbytes, addr)) <= 0)
2350 		return (set_errno(EMDB_NOMAP));
2351 
2352 	return (n);
2353 }
2354 
2355 static ssize_t
2356 pt_vwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, uintptr_t addr)
2357 {
2358 	ssize_t n;
2359 
2360 	/*
2361 	 * If no handle is open yet, writes to virtual addresses are
2362 	 * allowed to succeed but do not actually modify anything.
2363 	 */
2364 	if (t->t_pshandle == NULL)
2365 		return (nbytes);
2366 
2367 	n = Pwrite(t->t_pshandle, buf, nbytes, addr);
2368 
2369 	if (n == -1 && errno == EIO)
2370 		return (set_errno(EMDB_NOMAP));
2371 
2372 	return (n);
2373 }
2374 
2375 static ssize_t
2376 pt_fread(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
2377 {
2378 	pt_data_t *pt = t->t_data;
2379 
2380 	if (pt->p_file != NULL) {
2381 		return (mdb_gelf_rw(pt->p_file, buf, nbytes, addr,
2382 		    IOPF_READ(pt->p_fio), GIO_READ));
2383 	}
2384 
2385 	bzero(buf, nbytes);
2386 	return (nbytes);
2387 }
2388 
2389 static ssize_t
2390 pt_fwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, uintptr_t addr)
2391 {
2392 	pt_data_t *pt = t->t_data;
2393 
2394 	if (pt->p_file != NULL) {
2395 		return (mdb_gelf_rw(pt->p_file, (void *)buf, nbytes, addr,
2396 		    IOPF_WRITE(pt->p_fio), GIO_WRITE));
2397 	}
2398 
2399 	return (nbytes);
2400 }
2401 
2402 static const char *
2403 pt_resolve_lmid(const char *object, Lmid_t *lmidp)
2404 {
2405 	Lmid_t lmid = PR_LMID_EVERY;
2406 	const char *p;
2407 
2408 	if (object == MDB_TGT_OBJ_EVERY || object == MDB_TGT_OBJ_EXEC)
2409 		lmid = LM_ID_BASE; /* restrict scope to a.out's link map */
2410 	else if (object != MDB_TGT_OBJ_RTLD && strncmp(object, "LM", 2) == 0 &&
2411 	    (p = strchr(object, '`')) != NULL) {
2412 		object += 2;	/* skip past initial "LM" prefix */
2413 		lmid = strntoul(object, (size_t)(p - object), mdb.m_radix);
2414 		object = p + 1;	/* skip past link map specifier */
2415 	}
2416 
2417 	*lmidp = lmid;
2418 	return (object);
2419 }
2420 
2421 static int
2422 tlsbase(mdb_tgt_t *t, mdb_tgt_tid_t tid, Lmid_t lmid, const char *object,
2423     psaddr_t *basep)
2424 {
2425 	pt_data_t *pt = t->t_data;
2426 	const rd_loadobj_t *loadobjp;
2427 	td_thrhandle_t th;
2428 	td_err_e err;
2429 
2430 	if (object == MDB_TGT_OBJ_EVERY)
2431 		return (set_errno(EINVAL));
2432 
2433 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE)
2434 		return (set_errno(EMDB_NOPROC));
2435 
2436 	if (pt->p_tdb_ops == NULL)
2437 		return (set_errno(EMDB_TDB));
2438 
2439 	err = pt->p_tdb_ops->td_ta_map_id2thr(pt->p_ptl_hdl, tid, &th);
2440 	if (err != TD_OK)
2441 		return (set_errno(tdb_to_errno(err)));
2442 
2443 	/*
2444 	 * If this fails, rtld_db has failed to initialize properly.
2445 	 */
2446 	if ((loadobjp = Plmid_to_loadobj(t->t_pshandle, lmid, object)) == NULL)
2447 		return (set_errno(EMDB_NORTLD));
2448 
2449 	/*
2450 	 * This will fail if the TLS block has not been allocated for the
2451 	 * object that contains the TLS symbol in question.
2452 	 */
2453 	err = pt->p_tdb_ops->td_thr_tlsbase(&th, loadobjp->rl_tlsmodid, basep);
2454 	if (err != TD_OK)
2455 		return (set_errno(tdb_to_errno(err)));
2456 
2457 	return (0);
2458 }
2459 
2460 typedef struct {
2461 	mdb_tgt_t	*pl_tgt;
2462 	const char	*pl_name;
2463 	Lmid_t		pl_lmid;
2464 	GElf_Sym	*pl_symp;
2465 	mdb_syminfo_t	*pl_sip;
2466 	mdb_tgt_tid_t	pl_tid;
2467 	mdb_bool_t	pl_found;
2468 } pt_lookup_t;
2469 
2470 /*ARGSUSED*/
2471 static int
2472 pt_lookup_cb(void *data, const prmap_t *pmp, const char *object)
2473 {
2474 	pt_lookup_t *plp = data;
2475 	struct ps_prochandle *P = plp->pl_tgt->t_pshandle;
2476 	prsyminfo_t si;
2477 	GElf_Sym sym;
2478 
2479 	if (Pxlookup_by_name(P, plp->pl_lmid, object, plp->pl_name, &sym,
2480 	    &si) != 0)
2481 		return (0);
2482 
2483 	/*
2484 	 * If we encounter a match with SHN_UNDEF, keep looking for a
2485 	 * better match. Return the first match with SHN_UNDEF set if no
2486 	 * better match is found.
2487 	 */
2488 	if (sym.st_shndx == SHN_UNDEF) {
2489 		if (!plp->pl_found) {
2490 			plp->pl_found = TRUE;
2491 			*plp->pl_symp = sym;
2492 			plp->pl_sip->sym_table = si.prs_table;
2493 			plp->pl_sip->sym_id = si.prs_id;
2494 		}
2495 
2496 		return (0);
2497 	}
2498 
2499 	/*
2500 	 * Note that if the symbol's st_shndx is SHN_UNDEF we don't have the
2501 	 * TLS offset anyway, so adding in the tlsbase would be worthless.
2502 	 */
2503 	if (GELF_ST_TYPE(sym.st_info) == STT_TLS &&
2504 	    plp->pl_tid != (mdb_tgt_tid_t)-1) {
2505 		psaddr_t base;
2506 
2507 		if (tlsbase(plp->pl_tgt, plp->pl_tid, plp->pl_lmid, object,
2508 		    &base) != 0)
2509 			return (-1); /* errno is set for us */
2510 
2511 		sym.st_value += base;
2512 	}
2513 
2514 	plp->pl_found = TRUE;
2515 	*plp->pl_symp = sym;
2516 	plp->pl_sip->sym_table = si.prs_table;
2517 	plp->pl_sip->sym_id = si.prs_id;
2518 
2519 	return (1);
2520 }
2521 
2522 /*
2523  * Lookup the symbol with a thread context so that we can adjust TLS symbols
2524  * to get the values as they would appear in the context of the given thread.
2525  */
2526 static int
2527 pt_lookup_by_name_thr(mdb_tgt_t *t, const char *object,
2528     const char *name, GElf_Sym *symp, mdb_syminfo_t *sip, mdb_tgt_tid_t tid)
2529 {
2530 	struct ps_prochandle *P = t->t_pshandle;
2531 	pt_data_t *pt = t->t_data;
2532 	Lmid_t lmid;
2533 	uint_t i;
2534 	const rd_loadobj_t *aout_lop;
2535 
2536 	object = pt_resolve_lmid(object, &lmid);
2537 
2538 	if (P != NULL) {
2539 		pt_lookup_t pl;
2540 
2541 		pl.pl_tgt = t;
2542 		pl.pl_name = name;
2543 		pl.pl_lmid = lmid;
2544 		pl.pl_symp = symp;
2545 		pl.pl_sip = sip;
2546 		pl.pl_tid = tid;
2547 		pl.pl_found = FALSE;
2548 
2549 		if (object == MDB_TGT_OBJ_EVERY) {
2550 			if (Pobject_iter(P, pt_lookup_cb, &pl) == -1)
2551 				return (-1); /* errno is set for us */
2552 		} else {
2553 			const prmap_t *pmp;
2554 
2555 			/*
2556 			 * This can fail either due to an invalid lmid or
2557 			 * an invalid object. To determine which is
2558 			 * faulty, we test the lmid against known valid
2559 			 * lmids and then see if using a wild-card lmid
2560 			 * improves ths situation.
2561 			 */
2562 			if ((pmp = Plmid_to_map(P, lmid, object)) == NULL) {
2563 				if (lmid != PR_LMID_EVERY &&
2564 				    lmid != LM_ID_BASE &&
2565 				    lmid != LM_ID_LDSO &&
2566 				    Plmid_to_map(P, PR_LMID_EVERY, object)
2567 				    != NULL)
2568 					return (set_errno(EMDB_NOLMID));
2569 				else
2570 					return (set_errno(EMDB_NOOBJ));
2571 			}
2572 
2573 			if (pt_lookup_cb(&pl, pmp, object) == -1)
2574 				return (-1); /* errno is set for us */
2575 		}
2576 
2577 		if (pl.pl_found)
2578 			return (0);
2579 	}
2580 
2581 	/*
2582 	 * If libproc doesn't have the symbols for rtld, we're cooked --
2583 	 * mdb doesn't have those symbols either.
2584 	 */
2585 	if (object == MDB_TGT_OBJ_RTLD)
2586 		return (set_errno(EMDB_NOSYM));
2587 
2588 	if (object != MDB_TGT_OBJ_EXEC && object != MDB_TGT_OBJ_EVERY) {
2589 		int status = mdb_gelf_symtab_lookup_by_file(pt->p_symtab,
2590 		    object, name, symp, &sip->sym_id);
2591 
2592 		if (status != 0) {
2593 			if (P != NULL &&
2594 			    Plmid_to_map(P, PR_LMID_EVERY, object) != NULL)
2595 				return (set_errno(EMDB_NOSYM));
2596 			else
2597 				return (-1); /* errno set from lookup_by_file */
2598 		}
2599 
2600 		goto found;
2601 	}
2602 
2603 	if (mdb_gelf_symtab_lookup_by_name(pt->p_symtab, name, symp, &i) == 0) {
2604 		sip->sym_table = MDB_TGT_SYMTAB;
2605 		sip->sym_id = i;
2606 		goto local_found;
2607 	}
2608 
2609 	if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, name, symp, &i) == 0) {
2610 		sip->sym_table = MDB_TGT_DYNSYM;
2611 		sip->sym_id = i;
2612 		goto local_found;
2613 	}
2614 
2615 	return (set_errno(EMDB_NOSYM));
2616 
2617 local_found:
2618 	if (pt->p_file != NULL &&
2619 	    pt->p_file->gf_ehdr.e_type == ET_DYN &&
2620 	    P != NULL &&
2621 	    (aout_lop = Pname_to_loadobj(P, PR_OBJ_EXEC)) != NULL)
2622 		symp->st_value += aout_lop->rl_base;
2623 
2624 found:
2625 	/*
2626 	 * If the symbol has type TLS, libproc should have found the symbol
2627 	 * if it exists and has been allocated.
2628 	 */
2629 	if (GELF_ST_TYPE(symp->st_info) == STT_TLS)
2630 		return (set_errno(EMDB_TLS));
2631 
2632 	return (0);
2633 }
2634 
2635 static int
2636 pt_lookup_by_name(mdb_tgt_t *t, const char *object,
2637     const char *name, GElf_Sym *symp, mdb_syminfo_t *sip)
2638 {
2639 	return (pt_lookup_by_name_thr(t, object, name, symp, sip, PTL_TID(t)));
2640 }
2641 
2642 static int
2643 pt_lookup_by_addr(mdb_tgt_t *t, uintptr_t addr, uint_t flags,
2644     char *buf, size_t nbytes, GElf_Sym *symp, mdb_syminfo_t *sip)
2645 {
2646 	struct ps_prochandle *P = t->t_pshandle;
2647 	pt_data_t *pt = t->t_data;
2648 
2649 	rd_plt_info_t rpi = { 0 };
2650 	const char *pltsym;
2651 	int match, i;
2652 
2653 	mdb_gelf_symtab_t *gsts[3];	/* mdb.m_prsym, .symtab, .dynsym */
2654 	int gstc = 0;			/* number of valid gsts[] entries */
2655 
2656 	mdb_gelf_symtab_t *gst = NULL;	/* set if 'sym' is from a gst */
2657 	const prmap_t *pmp = NULL;	/* set if 'sym' is from libproc */
2658 	GElf_Sym sym;			/* best symbol found so far if !exact */
2659 	prsyminfo_t si;
2660 
2661 	/*
2662 	 * Fill in our array of symbol table pointers with the private symbol
2663 	 * table, static symbol table, and dynamic symbol table if applicable.
2664 	 * These are done in order of precedence so that if we match and
2665 	 * MDB_TGT_SYM_EXACT is set, we need not look any further.
2666 	 */
2667 	if (mdb.m_prsym != NULL)
2668 		gsts[gstc++] = mdb.m_prsym;
2669 	if (P == NULL && pt->p_symtab != NULL)
2670 		gsts[gstc++] = pt->p_symtab;
2671 	if (P == NULL && pt->p_dynsym != NULL)
2672 		gsts[gstc++] = pt->p_dynsym;
2673 
2674 	/*
2675 	 * Loop through our array attempting to match the address.  If we match
2676 	 * and we're in exact mode, we're done.  Otherwise save the symbol in
2677 	 * the local sym variable if it is closer than our previous match.
2678 	 * We explicitly watch for zero-valued symbols since DevPro insists
2679 	 * on storing __fsr_init_value's value as the symbol value instead
2680 	 * of storing it in a constant integer.
2681 	 */
2682 	for (i = 0; i < gstc; i++) {
2683 		if (mdb_gelf_symtab_lookup_by_addr(gsts[i], addr, flags, buf,
2684 		    nbytes, symp, &sip->sym_id) != 0 || symp->st_value == 0)
2685 			continue;
2686 
2687 		if (flags & MDB_TGT_SYM_EXACT) {
2688 			gst = gsts[i];
2689 			goto found;
2690 		}
2691 
2692 		if (gst == NULL || mdb_gelf_sym_closer(symp, &sym, addr)) {
2693 			gst = gsts[i];
2694 			sym = *symp;
2695 		}
2696 	}
2697 
2698 	/*
2699 	 * If we have no libproc handle active, we're done: fail if gst is
2700 	 * NULL; otherwise copy out our best symbol and skip to the end.
2701 	 * We also skip to found if gst is the private symbol table: we
2702 	 * want this to always take precedence over PLT re-vectoring.
2703 	 */
2704 	if (P == NULL || (gst != NULL && gst == mdb.m_prsym)) {
2705 		if (gst == NULL)
2706 			return (set_errno(EMDB_NOSYMADDR));
2707 		*symp = sym;
2708 		goto found;
2709 	}
2710 
2711 	/*
2712 	 * Check to see if the address is in a PLT: if it is, use librtld_db to
2713 	 * attempt to resolve the PLT entry.  If the entry is bound, reset addr
2714 	 * to the bound address, add a special prefix to the caller's buf,
2715 	 * forget our previous guess, and then continue using the new addr.
2716 	 * If the entry is not bound, copy the corresponding symbol name into
2717 	 * buf and return a fake symbol for the given address.
2718 	 */
2719 	if ((pltsym = Ppltdest(P, addr)) != NULL) {
2720 		const rd_loadobj_t *rlp;
2721 		rd_agent_t *rap;
2722 
2723 		if ((rap = Prd_agent(P)) != NULL &&
2724 		    (rlp = Paddr_to_loadobj(P, addr)) != NULL &&
2725 		    rd_plt_resolution(rap, addr, Pstatus(P)->pr_lwp.pr_lwpid,
2726 		    rlp->rl_plt_base, &rpi) == RD_OK &&
2727 		    (rpi.pi_flags & RD_FLG_PI_PLTBOUND)) {
2728 			size_t n;
2729 			n = mdb_iob_snprintf(buf, nbytes, "PLT=");
2730 			addr = rpi.pi_baddr;
2731 			if (n > nbytes) {
2732 				buf += nbytes;
2733 				nbytes = 0;
2734 			} else {
2735 				buf += n;
2736 				nbytes -= n;
2737 			}
2738 			gst = NULL;
2739 		} else {
2740 			(void) mdb_iob_snprintf(buf, nbytes, "PLT:%s", pltsym);
2741 			bzero(symp, sizeof (GElf_Sym));
2742 			symp->st_value = addr;
2743 			symp->st_info = GELF_ST_INFO(STB_GLOBAL, STT_FUNC);
2744 			return (0);
2745 		}
2746 	}
2747 
2748 	/*
2749 	 * Ask libproc to convert the address to the closest symbol for us.
2750 	 * Once we get the closest symbol, we perform the EXACT match or
2751 	 * smart-mode or absolute distance check ourself:
2752 	 */
2753 	if (Pxlookup_by_addr(P, addr, buf, nbytes, symp, &si) == 0 &&
2754 	    symp->st_value != 0 && (gst == NULL ||
2755 	    mdb_gelf_sym_closer(symp, &sym, addr))) {
2756 
2757 		if (flags & MDB_TGT_SYM_EXACT)
2758 			match = (addr == symp->st_value);
2759 		else if (mdb.m_symdist == 0)
2760 			match = (addr >= symp->st_value &&
2761 			    addr < symp->st_value + symp->st_size);
2762 		else
2763 			match = (addr >= symp->st_value &&
2764 			    addr < symp->st_value + mdb.m_symdist);
2765 
2766 		if (match) {
2767 			pmp = Paddr_to_map(P, addr);
2768 			gst = NULL;
2769 			sip->sym_table = si.prs_table;
2770 			sip->sym_id = si.prs_id;
2771 			goto found;
2772 		}
2773 	}
2774 
2775 	/*
2776 	 * If we get here, Plookup_by_addr has failed us.  If we have no
2777 	 * previous best symbol (gst == NULL), we've failed completely.
2778 	 * Otherwise we copy out that symbol and continue on to 'found'.
2779 	 */
2780 	if (gst == NULL)
2781 		return (set_errno(EMDB_NOSYMADDR));
2782 	*symp = sym;
2783 found:
2784 	/*
2785 	 * Once we've found something, copy the final name into the caller's
2786 	 * buffer and prefix it with the mapping name if appropriate.
2787 	 */
2788 	if (pmp != NULL && pmp != Pname_to_map(P, PR_OBJ_EXEC)) {
2789 		const char *prefix = pmp->pr_mapname;
2790 		Lmid_t lmid;
2791 
2792 		if (Pobjname(P, addr, pt->p_objname, MDB_TGT_MAPSZ))
2793 			prefix = pt->p_objname;
2794 
2795 		if (buf != NULL && nbytes > 1) {
2796 			(void) strncpy(pt->p_symname, buf, MDB_TGT_SYM_NAMLEN);
2797 			pt->p_symname[MDB_TGT_SYM_NAMLEN - 1] = '\0';
2798 		} else {
2799 			pt->p_symname[0] = '\0';
2800 		}
2801 
2802 		if (prefix == pt->p_objname && Plmid(P, addr, &lmid) == 0 && (
2803 		    (lmid != LM_ID_BASE && lmid != LM_ID_LDSO) ||
2804 		    (mdb.m_flags & MDB_FL_SHOWLMID))) {
2805 			(void) mdb_iob_snprintf(buf, nbytes, "LM%lr`%s`%s",
2806 			    lmid, strbasename(prefix), pt->p_symname);
2807 		} else {
2808 			(void) mdb_iob_snprintf(buf, nbytes, "%s`%s",
2809 			    strbasename(prefix), pt->p_symname);
2810 		}
2811 
2812 	} else if (gst != NULL && buf != NULL && nbytes > 0) {
2813 		(void) strncpy(buf, mdb_gelf_sym_name(gst, symp), nbytes);
2814 		buf[nbytes - 1] = '\0';
2815 	}
2816 
2817 	return (0);
2818 }
2819 
2820 
2821 static int
2822 pt_symbol_iter_cb(void *arg, const GElf_Sym *sym, const char *name,
2823     const prsyminfo_t *sip)
2824 {
2825 	pt_symarg_t *psp = arg;
2826 
2827 	psp->psym_info.sym_id = sip->prs_id;
2828 
2829 	return (psp->psym_func(psp->psym_private, sym, name, &psp->psym_info,
2830 	    psp->psym_obj));
2831 }
2832 
2833 static int
2834 pt_objsym_iter(void *arg, const prmap_t *pmp, const char *object)
2835 {
2836 	Lmid_t lmid = PR_LMID_EVERY;
2837 	pt_symarg_t *psp = arg;
2838 
2839 	psp->psym_obj = object;
2840 
2841 	(void) Plmid(psp->psym_targ->t_pshandle, pmp->pr_vaddr, &lmid);
2842 	(void) Pxsymbol_iter(psp->psym_targ->t_pshandle, lmid, object,
2843 	    psp->psym_which, psp->psym_type, pt_symbol_iter_cb, arg);
2844 
2845 	return (0);
2846 }
2847 
2848 static int
2849 pt_symbol_filt(void *arg, const GElf_Sym *sym, const char *name, uint_t id)
2850 {
2851 	pt_symarg_t *psp = arg;
2852 
2853 	if (mdb_tgt_sym_match(sym, psp->psym_type)) {
2854 		psp->psym_info.sym_id = id;
2855 		return (psp->psym_func(psp->psym_private, sym, name,
2856 		    &psp->psym_info, psp->psym_obj));
2857 	}
2858 
2859 	return (0);
2860 }
2861 
2862 static int
2863 pt_symbol_iter(mdb_tgt_t *t, const char *object, uint_t which,
2864     uint_t type, mdb_tgt_sym_f *func, void *private)
2865 {
2866 	pt_data_t *pt = t->t_data;
2867 	mdb_gelf_symtab_t *gst;
2868 	pt_symarg_t ps;
2869 	Lmid_t lmid;
2870 
2871 	object = pt_resolve_lmid(object, &lmid);
2872 
2873 	ps.psym_targ = t;
2874 	ps.psym_which = which;
2875 	ps.psym_type = type;
2876 	ps.psym_func = func;
2877 	ps.psym_private = private;
2878 	ps.psym_obj = object;
2879 
2880 	if (t->t_pshandle != NULL) {
2881 		if (object != MDB_TGT_OBJ_EVERY) {
2882 			if (Plmid_to_map(t->t_pshandle, lmid, object) == NULL)
2883 				return (set_errno(EMDB_NOOBJ));
2884 			(void) Pxsymbol_iter(t->t_pshandle, lmid, object,
2885 			    which, type, pt_symbol_iter_cb, &ps);
2886 			return (0);
2887 		} else if (Prd_agent(t->t_pshandle) != NULL) {
2888 			(void) Pobject_iter(t->t_pshandle, pt_objsym_iter, &ps);
2889 			return (0);
2890 		}
2891 	}
2892 
2893 	if (lmid != LM_ID_BASE && lmid != PR_LMID_EVERY)
2894 		return (set_errno(EMDB_NOLMID));
2895 
2896 	if (object != MDB_TGT_OBJ_EXEC && object != MDB_TGT_OBJ_EVERY &&
2897 	    pt->p_fio != NULL &&
2898 	    strcmp(object, IOP_NAME(pt->p_fio)) != 0)
2899 		return (set_errno(EMDB_NOOBJ));
2900 
2901 	if (which == MDB_TGT_SYMTAB)
2902 		gst = pt->p_symtab;
2903 	else
2904 		gst = pt->p_dynsym;
2905 
2906 	if (gst != NULL) {
2907 		ps.psym_info.sym_table = gst->gst_tabid;
2908 		mdb_gelf_symtab_iter(gst, pt_symbol_filt, &ps);
2909 	}
2910 
2911 	return (0);
2912 }
2913 
2914 static const mdb_map_t *
2915 pt_prmap_to_mdbmap(mdb_tgt_t *t, const prmap_t *prp, mdb_map_t *mp)
2916 {
2917 	struct ps_prochandle *P = t->t_pshandle;
2918 	char name[MAXPATHLEN];
2919 	Lmid_t lmid;
2920 
2921 	if (Pobjname(P, prp->pr_vaddr, name, sizeof (name)) != NULL) {
2922 		if (Plmid(P, prp->pr_vaddr, &lmid) == 0 && (
2923 		    (lmid != LM_ID_BASE && lmid != LM_ID_LDSO) ||
2924 		    (mdb.m_flags & MDB_FL_SHOWLMID))) {
2925 			(void) mdb_iob_snprintf(mp->map_name, MDB_TGT_MAPSZ,
2926 			    "LM%lr`%s", lmid, name);
2927 		} else {
2928 			(void) strncpy(mp->map_name, name, MDB_TGT_MAPSZ - 1);
2929 			mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
2930 		}
2931 	} else {
2932 		(void) strncpy(mp->map_name, prp->pr_mapname,
2933 		    MDB_TGT_MAPSZ - 1);
2934 		mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
2935 	}
2936 
2937 	mp->map_base = prp->pr_vaddr;
2938 	mp->map_size = prp->pr_size;
2939 	mp->map_flags = 0;
2940 
2941 	if (prp->pr_mflags & MA_READ)
2942 		mp->map_flags |= MDB_TGT_MAP_R;
2943 	if (prp->pr_mflags & MA_WRITE)
2944 		mp->map_flags |= MDB_TGT_MAP_W;
2945 	if (prp->pr_mflags & MA_EXEC)
2946 		mp->map_flags |= MDB_TGT_MAP_X;
2947 
2948 	if (prp->pr_mflags & MA_SHM)
2949 		mp->map_flags |= MDB_TGT_MAP_SHMEM;
2950 	if (prp->pr_mflags & MA_BREAK)
2951 		mp->map_flags |= MDB_TGT_MAP_HEAP;
2952 	if (prp->pr_mflags & MA_STACK)
2953 		mp->map_flags |= MDB_TGT_MAP_STACK;
2954 	if (prp->pr_mflags & MA_ANON)
2955 		mp->map_flags |= MDB_TGT_MAP_ANON;
2956 
2957 	return (mp);
2958 }
2959 
2960 /*ARGSUSED*/
2961 static int
2962 pt_map_apply(void *arg, const prmap_t *prp, const char *name)
2963 {
2964 	pt_maparg_t *pmp = arg;
2965 	mdb_map_t map;
2966 
2967 	return (pmp->pmap_func(pmp->pmap_private,
2968 	    pt_prmap_to_mdbmap(pmp->pmap_targ, prp, &map), map.map_name));
2969 }
2970 
2971 static int
2972 pt_mapping_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
2973 {
2974 	if (t->t_pshandle != NULL) {
2975 		pt_maparg_t pm;
2976 
2977 		pm.pmap_targ = t;
2978 		pm.pmap_func = func;
2979 		pm.pmap_private = private;
2980 
2981 		(void) Pmapping_iter(t->t_pshandle, pt_map_apply, &pm);
2982 		return (0);
2983 	}
2984 
2985 	return (set_errno(EMDB_NOPROC));
2986 }
2987 
2988 static int
2989 pt_object_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
2990 {
2991 	pt_data_t *pt = t->t_data;
2992 
2993 	/*
2994 	 * If we have a libproc handle, we can just call Pobject_iter to
2995 	 * iterate over its list of load object information.
2996 	 */
2997 	if (t->t_pshandle != NULL) {
2998 		pt_maparg_t pm;
2999 
3000 		pm.pmap_targ = t;
3001 		pm.pmap_func = func;
3002 		pm.pmap_private = private;
3003 
3004 		(void) Pobject_iter(t->t_pshandle, pt_map_apply, &pm);
3005 		return (0);
3006 	}
3007 
3008 	/*
3009 	 * If we're examining an executable or other ELF file but we have no
3010 	 * libproc handle, fake up some information based on DT_NEEDED entries.
3011 	 */
3012 	if (pt->p_dynsym != NULL && pt->p_file->gf_dyns != NULL &&
3013 	    pt->p_fio != NULL) {
3014 		mdb_gelf_sect_t *gsp = pt->p_dynsym->gst_ssect;
3015 		GElf_Dyn *dynp = pt->p_file->gf_dyns;
3016 		mdb_map_t *mp = &pt->p_map;
3017 		const char *s = IOP_NAME(pt->p_fio);
3018 		size_t i;
3019 
3020 		(void) strncpy(mp->map_name, s, MDB_TGT_MAPSZ);
3021 		mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3022 		mp->map_flags = MDB_TGT_MAP_R | MDB_TGT_MAP_X;
3023 		mp->map_base = NULL;
3024 		mp->map_size = 0;
3025 
3026 		if (func(private, mp, s) != 0)
3027 			return (0);
3028 
3029 		for (i = 0; i < pt->p_file->gf_ndyns; i++, dynp++) {
3030 			if (dynp->d_tag == DT_NEEDED) {
3031 				s = (char *)gsp->gs_data + dynp->d_un.d_val;
3032 				(void) strncpy(mp->map_name, s, MDB_TGT_MAPSZ);
3033 				mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3034 				if (func(private, mp, s) != 0)
3035 					return (0);
3036 			}
3037 		}
3038 
3039 		return (0);
3040 	}
3041 
3042 	return (set_errno(EMDB_NOPROC));
3043 }
3044 
3045 static const mdb_map_t *
3046 pt_addr_to_map(mdb_tgt_t *t, uintptr_t addr)
3047 {
3048 	pt_data_t *pt = t->t_data;
3049 	const prmap_t *pmp;
3050 
3051 	if (t->t_pshandle == NULL) {
3052 		(void) set_errno(EMDB_NOPROC);
3053 		return (NULL);
3054 	}
3055 
3056 	if ((pmp = Paddr_to_map(t->t_pshandle, addr)) == NULL) {
3057 		(void) set_errno(EMDB_NOMAP);
3058 		return (NULL);
3059 	}
3060 
3061 	return (pt_prmap_to_mdbmap(t, pmp, &pt->p_map));
3062 }
3063 
3064 static const mdb_map_t *
3065 pt_name_to_map(mdb_tgt_t *t, const char *object)
3066 {
3067 	pt_data_t *pt = t->t_data;
3068 	const prmap_t *pmp;
3069 	Lmid_t lmid;
3070 
3071 	if (t->t_pshandle == NULL) {
3072 		(void) set_errno(EMDB_NOPROC);
3073 		return (NULL);
3074 	}
3075 
3076 	object = pt_resolve_lmid(object, &lmid);
3077 
3078 	if ((pmp = Plmid_to_map(t->t_pshandle, lmid, object)) == NULL) {
3079 		(void) set_errno(EMDB_NOOBJ);
3080 		return (NULL);
3081 	}
3082 
3083 	return (pt_prmap_to_mdbmap(t, pmp, &pt->p_map));
3084 }
3085 
3086 static ctf_file_t *
3087 pt_addr_to_ctf(mdb_tgt_t *t, uintptr_t addr)
3088 {
3089 	ctf_file_t *ret;
3090 
3091 	if (t->t_pshandle == NULL) {
3092 		(void) set_errno(EMDB_NOPROC);
3093 		return (NULL);
3094 	}
3095 
3096 	if ((ret = Paddr_to_ctf(t->t_pshandle, addr)) == NULL) {
3097 		(void) set_errno(EMDB_NOOBJ);
3098 		return (NULL);
3099 	}
3100 
3101 	return (ret);
3102 }
3103 
3104 static ctf_file_t *
3105 pt_name_to_ctf(mdb_tgt_t *t, const char *name)
3106 {
3107 	ctf_file_t *ret;
3108 
3109 	if (t->t_pshandle == NULL) {
3110 		(void) set_errno(EMDB_NOPROC);
3111 		return (NULL);
3112 	}
3113 
3114 	if ((ret = Pname_to_ctf(t->t_pshandle, name)) == NULL) {
3115 		(void) set_errno(EMDB_NOOBJ);
3116 		return (NULL);
3117 	}
3118 
3119 	return (ret);
3120 }
3121 
3122 static int
3123 pt_status(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3124 {
3125 	const pstatus_t *psp;
3126 	prgregset_t gregs;
3127 	int state;
3128 
3129 	bzero(tsp, sizeof (mdb_tgt_status_t));
3130 
3131 	if (t->t_pshandle == NULL) {
3132 		tsp->st_state = MDB_TGT_IDLE;
3133 		return (0);
3134 	}
3135 
3136 	switch (state = Pstate(t->t_pshandle)) {
3137 	case PS_RUN:
3138 		tsp->st_state = MDB_TGT_RUNNING;
3139 		break;
3140 
3141 	case PS_STOP:
3142 		tsp->st_state = MDB_TGT_STOPPED;
3143 		psp = Pstatus(t->t_pshandle);
3144 
3145 		tsp->st_tid = PTL_TID(t);
3146 		if (PTL_GETREGS(t, tsp->st_tid, gregs) == 0)
3147 			tsp->st_pc = gregs[R_PC];
3148 
3149 		if (psp->pr_flags & PR_ISTOP)
3150 			tsp->st_flags |= MDB_TGT_ISTOP;
3151 		if (psp->pr_flags & PR_DSTOP)
3152 			tsp->st_flags |= MDB_TGT_DSTOP;
3153 
3154 		break;
3155 
3156 	case PS_LOST:
3157 		tsp->st_state = MDB_TGT_LOST;
3158 		break;
3159 	case PS_UNDEAD:
3160 		tsp->st_state = MDB_TGT_UNDEAD;
3161 		break;
3162 	case PS_DEAD:
3163 		tsp->st_state = MDB_TGT_DEAD;
3164 		break;
3165 	case PS_IDLE:
3166 		tsp->st_state = MDB_TGT_IDLE;
3167 		break;
3168 	default:
3169 		fail("unknown libproc state (%d)\n", state);
3170 	}
3171 
3172 	if (t->t_flags & MDB_TGT_F_BUSY)
3173 		tsp->st_flags |= MDB_TGT_BUSY;
3174 
3175 	return (0);
3176 }
3177 
3178 static void
3179 pt_dupfd(const char *file, int oflags, mode_t mode, int dfd)
3180 {
3181 	int fd;
3182 
3183 	if ((fd = open(file, oflags, mode)) >= 0) {
3184 		(void) fcntl(fd, F_DUP2FD, dfd);
3185 		(void) close(fd);
3186 	} else
3187 		warn("failed to open %s as descriptor %d", file, dfd);
3188 }
3189 
3190 /*
3191  * The Pcreate_callback() function interposes on the default, empty libproc
3192  * definition.  It will be called following a fork of a new child process by
3193  * Pcreate() below, but before the exec of the new process image.  We use this
3194  * callback to optionally redirect stdin and stdout and reset the dispositions
3195  * of SIGPIPE and SIGQUIT from SIG_IGN back to SIG_DFL.
3196  */
3197 /*ARGSUSED*/
3198 void
3199 Pcreate_callback(struct ps_prochandle *P)
3200 {
3201 	pt_data_t *pt = mdb.m_target->t_data;
3202 
3203 	if (pt->p_stdin != NULL)
3204 		pt_dupfd(pt->p_stdin, O_RDWR, 0, STDIN_FILENO);
3205 	if (pt->p_stdout != NULL)
3206 		pt_dupfd(pt->p_stdout, O_CREAT | O_WRONLY, 0666, STDOUT_FILENO);
3207 
3208 	(void) mdb_signal_sethandler(SIGPIPE, SIG_DFL, NULL);
3209 	(void) mdb_signal_sethandler(SIGQUIT, SIG_DFL, NULL);
3210 }
3211 
3212 static int
3213 pt_run(mdb_tgt_t *t, int argc, const mdb_arg_t *argv)
3214 {
3215 	pt_data_t *pt = t->t_data;
3216 	struct ps_prochandle *P;
3217 	char execname[MAXPATHLEN];
3218 	const char **pargv;
3219 	int pargc = 0;
3220 	int i, perr;
3221 	char **penv;
3222 	mdb_var_t *v;
3223 
3224 	if (pt->p_aout_fio == NULL) {
3225 		warn("run requires executable to be specified on "
3226 		    "command-line\n");
3227 		return (set_errno(EMDB_TGT));
3228 	}
3229 
3230 	pargv = mdb_alloc(sizeof (char *) * (argc + 2), UM_SLEEP);
3231 	pargv[pargc++] = strbasename(IOP_NAME(pt->p_aout_fio));
3232 
3233 	for (i = 0; i < argc; i++) {
3234 		if (argv[i].a_type != MDB_TYPE_STRING) {
3235 			mdb_free(pargv, sizeof (char *) * (argc + 2));
3236 			return (set_errno(EINVAL));
3237 		}
3238 		if (argv[i].a_un.a_str[0] == '<')
3239 			pt->p_stdin = argv[i].a_un.a_str + 1;
3240 		else if (argv[i].a_un.a_str[0] == '>')
3241 			pt->p_stdout = argv[i].a_un.a_str + 1;
3242 		else
3243 			pargv[pargc++] = argv[i].a_un.a_str;
3244 	}
3245 	pargv[pargc] = NULL;
3246 
3247 	/*
3248 	 * Since Pcreate() uses execvp() and "." may not be present in $PATH,
3249 	 * we must manually prepend "./" when the executable is a simple name.
3250 	 */
3251 	if (strchr(IOP_NAME(pt->p_aout_fio), '/') == NULL) {
3252 		(void) snprintf(execname, sizeof (execname), "./%s",
3253 		    IOP_NAME(pt->p_aout_fio));
3254 	} else {
3255 		(void) snprintf(execname, sizeof (execname), "%s",
3256 		    IOP_NAME(pt->p_aout_fio));
3257 	}
3258 
3259 	penv = mdb_alloc((mdb_nv_size(&pt->p_env)+ 1) * sizeof (char *),
3260 	    UM_SLEEP);
3261 	for (mdb_nv_rewind(&pt->p_env), i = 0;
3262 	    (v = mdb_nv_advance(&pt->p_env)) != NULL; i++)
3263 		penv[i] = mdb_nv_get_cookie(v);
3264 	penv[i] = NULL;
3265 
3266 	P = Pxcreate(execname, (char **)pargv, penv, &perr, NULL, 0);
3267 	mdb_free(pargv, sizeof (char *) * (argc + 2));
3268 	pt->p_stdin = pt->p_stdout = NULL;
3269 
3270 	mdb_free(penv, i * sizeof (char *));
3271 
3272 	if (P == NULL) {
3273 		warn("failed to create process: %s\n", Pcreate_error(perr));
3274 		return (set_errno(EMDB_TGT));
3275 	}
3276 
3277 	if (t->t_pshandle != NULL) {
3278 		pt_pre_detach(t, TRUE);
3279 		if (t->t_pshandle != pt->p_idlehandle)
3280 			Prelease(t->t_pshandle, pt->p_rflags);
3281 	}
3282 
3283 	(void) Punsetflags(P, PR_RLC);	/* make sure run-on-last-close is off */
3284 	(void) Psetflags(P, PR_KLC);	/* kill on last close by debugger */
3285 	pt->p_rflags = PRELEASE_KILL;	/* kill on debugger Prelease */
3286 	t->t_pshandle = P;
3287 
3288 	pt_post_attach(t);
3289 	pt_activate_common(t);
3290 	(void) mdb_tgt_status(t, &t->t_status);
3291 	mdb.m_flags |= MDB_FL_VCREATE;
3292 
3293 	return (0);
3294 }
3295 
3296 /*
3297  * Forward a signal to the victim process in order to force it to stop or die.
3298  * Refer to the comments above pt_setrun(), below, for more info.
3299  */
3300 /*ARGSUSED*/
3301 static void
3302 pt_sigfwd(int sig, siginfo_t *sip, ucontext_t *ucp, mdb_tgt_t *t)
3303 {
3304 	struct ps_prochandle *P = t->t_pshandle;
3305 	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
3306 	pid_t pid = Pstatus(P)->pr_pid;
3307 	long ctl[2];
3308 
3309 	if (getpgid(pid) != mdb.m_pgid) {
3310 		mdb_dprintf(MDB_DBG_TGT, "fwd SIG#%d to %d\n", sig, (int)pid);
3311 		(void) kill(pid, sig);
3312 	}
3313 
3314 	if (Pwait(P, 1) == 0 && (psp->pr_flags & PR_STOPPED) &&
3315 	    psp->pr_why == PR_JOBCONTROL && Pdstop(P) == 0) {
3316 		/*
3317 		 * If we're job control stopped and our DSTOP is pending, the
3318 		 * victim will never see our signal, so undo the kill() and
3319 		 * then send SIGCONT the victim to kick it out of the job
3320 		 * control stop and force our DSTOP to take effect.
3321 		 */
3322 		if ((psp->pr_flags & PR_DSTOP) &&
3323 		    prismember(&Pstatus(P)->pr_sigpend, sig)) {
3324 			ctl[0] = PCUNKILL;
3325 			ctl[1] = sig;
3326 			(void) write(Pctlfd(P), ctl, sizeof (ctl));
3327 		}
3328 
3329 		mdb_dprintf(MDB_DBG_TGT, "fwd SIGCONT to %d\n", (int)pid);
3330 		(void) kill(pid, SIGCONT);
3331 	}
3332 }
3333 
3334 /*
3335  * Common code for step and continue: if no victim process has been created,
3336  * call pt_run() to create one.  Then set the victim running, clearing any
3337  * pending fault.  One special case is that if the victim was previously
3338  * stopped on reception of SIGINT, we know that SIGINT was traced and the user
3339  * requested the victim to stop, so clear this signal before continuing.
3340  * For all other traced signals, the signal will be delivered on continue.
3341  *
3342  * Once the victim process is running, we wait for it to stop on an event of
3343  * interest.  Although libproc provides the basic primitive to wait for the
3344  * victim, we must be careful in our handling of signals.  We want to allow the
3345  * user to issue a SIGINT or SIGQUIT using the designated terminal control
3346  * character (typically ^C and ^\), and have these signals stop the target and
3347  * return control to the debugger if the signals are traced.  There are three
3348  * cases to be considered in our implementation:
3349  *
3350  * (1) If the debugger and victim are in the same process group, both receive
3351  * the signal from the terminal driver.  The debugger returns from Pwait() with
3352  * errno = EINTR, so we want to loop back and continue waiting until the victim
3353  * stops on receipt of its SIGINT or SIGQUIT.
3354  *
3355  * (2) If the debugger and victim are in different process groups, and the
3356  * victim is a member of the foreground process group, it will receive the
3357  * signal from the terminal driver and the debugger will not.  As such, we
3358  * will remain blocked in Pwait() until the victim stops on its signal.
3359  *
3360  * (3) If the debugger and victim are in different process groups, and the
3361  * debugger is a member of the foreground process group, it will receive the
3362  * signal from the terminal driver, and the victim will not.  The debugger
3363  * returns from Pwait() with errno = EINTR, so we need to forward the signal
3364  * to the victim process directly and then Pwait() again for it to stop.
3365  *
3366  * We can observe that all three cases are handled by simply calling Pwait()
3367  * repeatedly if it fails with EINTR, and forwarding SIGINT and SIGQUIT to
3368  * the victim if it is in a different process group, using pt_sigfwd() above.
3369  *
3370  * An additional complication is that the process may not be able to field
3371  * the signal if it is currently stopped by job control.  In this case, we
3372  * also DSTOP the process, and then send it a SIGCONT to wake it up from
3373  * job control and force it to re-enter stop() under the control of /proc.
3374  *
3375  * Finally, we would like to allow the user to suspend the process using the
3376  * terminal suspend character (typically ^Z) if both are in the same session.
3377  * We again employ pt_sigfwd() to forward SIGTSTP to the victim, wait for it to
3378  * stop from job control, and then capture it using /proc.  Once the process
3379  * has stopped, normal SIGTSTP processing is restored and the user can issue
3380  * another ^Z in order to suspend the debugger and return to the parent shell.
3381  */
3382 static int
3383 pt_setrun(mdb_tgt_t *t, mdb_tgt_status_t *tsp, int flags)
3384 {
3385 	struct ps_prochandle *P = t->t_pshandle;
3386 	pt_data_t *pt = t->t_data;
3387 	pid_t old_pgid = -1;
3388 
3389 	mdb_signal_f *intf, *quitf, *tstpf;
3390 	const lwpstatus_t *psp;
3391 	void *intd, *quitd, *tstpd;
3392 
3393 	int sig = pt->p_signal;
3394 	int error = 0;
3395 	int pgid = -1;
3396 
3397 	pt->p_signal = 0; /* clear pending signal */
3398 
3399 	if (P == NULL && pt_run(t, 0, NULL) == -1)
3400 		return (-1); /* errno is set for us */
3401 
3402 	P = t->t_pshandle;
3403 	psp = &Pstatus(P)->pr_lwp;
3404 
3405 	if (sig == 0 && psp->pr_why == PR_SIGNALLED && psp->pr_what == SIGINT)
3406 		flags |= PRCSIG; /* clear pending SIGINT */
3407 	else
3408 		flags |= PRCFAULT; /* clear any pending fault (e.g. BPT) */
3409 
3410 	intf = mdb_signal_gethandler(SIGINT, &intd);
3411 	quitf = mdb_signal_gethandler(SIGQUIT, &quitd);
3412 	tstpf = mdb_signal_gethandler(SIGTSTP, &tstpd);
3413 
3414 	(void) mdb_signal_sethandler(SIGINT, (mdb_signal_f *)pt_sigfwd, t);
3415 	(void) mdb_signal_sethandler(SIGQUIT, (mdb_signal_f *)pt_sigfwd, t);
3416 	(void) mdb_signal_sethandler(SIGTSTP, (mdb_signal_f *)pt_sigfwd, t);
3417 
3418 	if (sig != 0 && Pstate(P) == PS_RUN &&
3419 	    kill(Pstatus(P)->pr_pid, sig) == -1) {
3420 		error = errno;
3421 		goto out;
3422 	}
3423 
3424 	/*
3425 	 * If we attached to a job stopped background process in the same
3426 	 * session, make its pgid the foreground process group before running
3427 	 * it.  Ignore SIGTTOU while doing this to avoid being suspended.
3428 	 */
3429 	if (mdb.m_flags & MDB_FL_JOBCTL) {
3430 		(void) mdb_signal_sethandler(SIGTTOU, SIG_IGN, NULL);
3431 		(void) IOP_CTL(mdb.m_term, TIOCGPGRP, &old_pgid);
3432 		(void) IOP_CTL(mdb.m_term, TIOCSPGRP,
3433 		    (void *)&Pstatus(P)->pr_pgid);
3434 		(void) mdb_signal_sethandler(SIGTTOU, SIG_DFL, NULL);
3435 	}
3436 
3437 	if (Pstate(P) != PS_RUN && Psetrun(P, sig, flags) == -1) {
3438 		error = errno;
3439 		goto out;
3440 	}
3441 
3442 	/*
3443 	 * If the process is stopped on job control, resume its process group
3444 	 * by sending it a SIGCONT if we are in the same session.  Otherwise
3445 	 * we have no choice but to wait for someone else to foreground it.
3446 	 */
3447 	if (psp->pr_why == PR_JOBCONTROL) {
3448 		if (mdb.m_flags & MDB_FL_JOBCTL)
3449 			(void) kill(-Pstatus(P)->pr_pgid, SIGCONT);
3450 		else if (mdb.m_term != NULL)
3451 			warn("process is still suspended by job control ...\n");
3452 	}
3453 
3454 	/*
3455 	 * Wait for the process to stop.  As described above, we loop around if
3456 	 * we are interrupted (EINTR).  If we lose control, attempt to re-open
3457 	 * the process, or call pt_exec() if that fails to handle a re-exec.
3458 	 * If the process dies (ENOENT) or Pwait() fails, break out of the loop.
3459 	 */
3460 	while (Pwait(P, 0) == -1) {
3461 		if (errno != EINTR) {
3462 			if (Pstate(P) == PS_LOST) {
3463 				if (Preopen(P) == 0)
3464 					continue; /* Pwait() again */
3465 				else
3466 					pt_exec(t, 0, NULL);
3467 			} else if (errno != ENOENT)
3468 				warn("failed to wait for event");
3469 			break;
3470 		}
3471 	}
3472 
3473 	/*
3474 	 * If we changed the foreground process group, restore the old pgid
3475 	 * while ignoring SIGTTOU so we are not accidentally suspended.
3476 	 */
3477 	if (old_pgid != -1) {
3478 		(void) mdb_signal_sethandler(SIGTTOU, SIG_IGN, NULL);
3479 		(void) IOP_CTL(mdb.m_term, TIOCSPGRP, &pgid);
3480 		(void) mdb_signal_sethandler(SIGTTOU, SIG_DFL, NULL);
3481 	}
3482 
3483 	/*
3484 	 * If we're now stopped on exit from a successful exec, release any
3485 	 * vfork parents and clean out their address space before returning
3486 	 * to tgt_continue() and perturbing the list of armed event specs.
3487 	 * If we're stopped for any other reason, just update the mappings.
3488 	 */
3489 	switch (Pstate(P)) {
3490 	case PS_STOP:
3491 		if (psp->pr_why == PR_SYSEXIT && psp->pr_errno == 0 &&
3492 		    (psp->pr_what == SYS_exec || psp->pr_what == SYS_execve))
3493 			pt_release_parents(t);
3494 		else
3495 			Pupdate_maps(P);
3496 		break;
3497 
3498 	case PS_UNDEAD:
3499 	case PS_LOST:
3500 		pt_release_parents(t);
3501 		break;
3502 	}
3503 
3504 out:
3505 	(void) mdb_signal_sethandler(SIGINT, intf, intd);
3506 	(void) mdb_signal_sethandler(SIGQUIT, quitf, quitd);
3507 	(void) mdb_signal_sethandler(SIGTSTP, tstpf, tstpd);
3508 	(void) pt_status(t, tsp);
3509 
3510 	return (error ? set_errno(error) : 0);
3511 }
3512 
3513 static int
3514 pt_step(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3515 {
3516 	return (pt_setrun(t, tsp, PRSTEP));
3517 }
3518 
3519 static int
3520 pt_continue(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3521 {
3522 	return (pt_setrun(t, tsp, 0));
3523 }
3524 
3525 static int
3526 pt_signal(mdb_tgt_t *t, int sig)
3527 {
3528 	pt_data_t *pt = t->t_data;
3529 
3530 	if (sig > 0 && sig <= pt->p_maxsig) {
3531 		pt->p_signal = sig; /* pending until next pt_setrun */
3532 		return (0);
3533 	}
3534 
3535 	return (set_errno(EMDB_BADSIGNUM));
3536 }
3537 
3538 static int
3539 pt_sysenter_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3540 {
3541 	struct ps_prochandle *P = t->t_pshandle;
3542 
3543 	if (P != NULL && Pstate(P) < PS_LOST) {
3544 		sep->se_data = args; /* data is raw system call number */
3545 		return (Psysentry(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3546 	}
3547 
3548 	return (set_errno(EMDB_NOPROC));
3549 }
3550 
3551 static void
3552 pt_sysenter_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3553 {
3554 	(void) Psysentry(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3555 }
3556 
3557 /*ARGSUSED*/
3558 static char *
3559 pt_sysenter_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3560     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3561 {
3562 	char name[32];
3563 	int sysnum;
3564 
3565 	if (vep != NULL)
3566 		sysnum = (intptr_t)vep->ve_args;
3567 	else
3568 		sysnum = (intptr_t)sep->se_data;
3569 
3570 	(void) proc_sysname(sysnum, name, sizeof (name));
3571 	(void) mdb_iob_snprintf(buf, nbytes, "stop on entry to %s", name);
3572 
3573 	return (buf);
3574 }
3575 
3576 /*ARGSUSED*/
3577 static int
3578 pt_sysenter_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3579 {
3580 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3581 	int sysnum = (intptr_t)sep->se_data;
3582 
3583 	return (psp->pr_why == PR_SYSENTRY && psp->pr_what == sysnum);
3584 }
3585 
3586 static const mdb_se_ops_t proc_sysenter_ops = {
3587 	pt_sysenter_ctor,	/* se_ctor */
3588 	pt_sysenter_dtor,	/* se_dtor */
3589 	pt_sysenter_info,	/* se_info */
3590 	no_se_secmp,		/* se_secmp */
3591 	no_se_vecmp,		/* se_vecmp */
3592 	no_se_arm,		/* se_arm */
3593 	no_se_disarm,		/* se_disarm */
3594 	no_se_cont,		/* se_cont */
3595 	pt_sysenter_match	/* se_match */
3596 };
3597 
3598 static int
3599 pt_sysexit_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3600 {
3601 	struct ps_prochandle *P = t->t_pshandle;
3602 
3603 	if (P != NULL && Pstate(P) < PS_LOST) {
3604 		sep->se_data = args; /* data is raw system call number */
3605 		return (Psysexit(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3606 	}
3607 
3608 	return (set_errno(EMDB_NOPROC));
3609 }
3610 
3611 static void
3612 pt_sysexit_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3613 {
3614 	(void) Psysexit(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3615 }
3616 
3617 /*ARGSUSED*/
3618 static char *
3619 pt_sysexit_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3620     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3621 {
3622 	char name[32];
3623 	int sysnum;
3624 
3625 	if (vep != NULL)
3626 		sysnum = (intptr_t)vep->ve_args;
3627 	else
3628 		sysnum = (intptr_t)sep->se_data;
3629 
3630 	(void) proc_sysname(sysnum, name, sizeof (name));
3631 	(void) mdb_iob_snprintf(buf, nbytes, "stop on exit from %s", name);
3632 
3633 	return (buf);
3634 }
3635 
3636 /*ARGSUSED*/
3637 static int
3638 pt_sysexit_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3639 {
3640 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3641 	int sysnum = (intptr_t)sep->se_data;
3642 
3643 	return (psp->pr_why == PR_SYSEXIT && psp->pr_what == sysnum);
3644 }
3645 
3646 static const mdb_se_ops_t proc_sysexit_ops = {
3647 	pt_sysexit_ctor,	/* se_ctor */
3648 	pt_sysexit_dtor,	/* se_dtor */
3649 	pt_sysexit_info,	/* se_info */
3650 	no_se_secmp,		/* se_secmp */
3651 	no_se_vecmp,		/* se_vecmp */
3652 	no_se_arm,		/* se_arm */
3653 	no_se_disarm,		/* se_disarm */
3654 	no_se_cont,		/* se_cont */
3655 	pt_sysexit_match	/* se_match */
3656 };
3657 
3658 static int
3659 pt_signal_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3660 {
3661 	struct ps_prochandle *P = t->t_pshandle;
3662 
3663 	if (P != NULL && Pstate(P) < PS_LOST) {
3664 		sep->se_data = args; /* data is raw signal number */
3665 		return (Psignal(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3666 	}
3667 
3668 	return (set_errno(EMDB_NOPROC));
3669 }
3670 
3671 static void
3672 pt_signal_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3673 {
3674 	(void) Psignal(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3675 }
3676 
3677 /*ARGSUSED*/
3678 static char *
3679 pt_signal_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3680     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3681 {
3682 	char name[SIG2STR_MAX];
3683 	int signum;
3684 
3685 	if (vep != NULL)
3686 		signum = (intptr_t)vep->ve_args;
3687 	else
3688 		signum = (intptr_t)sep->se_data;
3689 
3690 	(void) proc_signame(signum, name, sizeof (name));
3691 	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s", name);
3692 
3693 	return (buf);
3694 }
3695 
3696 /*ARGSUSED*/
3697 static int
3698 pt_signal_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3699 {
3700 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3701 	int signum = (intptr_t)sep->se_data;
3702 
3703 	return (psp->pr_why == PR_SIGNALLED && psp->pr_what == signum);
3704 }
3705 
3706 static const mdb_se_ops_t proc_signal_ops = {
3707 	pt_signal_ctor,		/* se_ctor */
3708 	pt_signal_dtor,		/* se_dtor */
3709 	pt_signal_info,		/* se_info */
3710 	no_se_secmp,		/* se_secmp */
3711 	no_se_vecmp,		/* se_vecmp */
3712 	no_se_arm,		/* se_arm */
3713 	no_se_disarm,		/* se_disarm */
3714 	no_se_cont,		/* se_cont */
3715 	pt_signal_match		/* se_match */
3716 };
3717 
3718 static int
3719 pt_fault_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3720 {
3721 	struct ps_prochandle *P = t->t_pshandle;
3722 
3723 	if (P != NULL && Pstate(P) < PS_LOST) {
3724 		sep->se_data = args; /* data is raw fault number */
3725 		return (Pfault(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3726 	}
3727 
3728 	return (set_errno(EMDB_NOPROC));
3729 }
3730 
3731 static void
3732 pt_fault_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3733 {
3734 	int fault = (intptr_t)sep->se_data;
3735 
3736 	if (fault != FLTBPT && fault != FLTTRACE && fault != FLTWATCH)
3737 		(void) Pfault(t->t_pshandle, fault, FALSE);
3738 }
3739 
3740 /*ARGSUSED*/
3741 static char *
3742 pt_fault_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3743     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3744 {
3745 	char name[32];
3746 	int fltnum;
3747 
3748 	if (vep != NULL)
3749 		fltnum = (intptr_t)vep->ve_args;
3750 	else
3751 		fltnum = (intptr_t)sep->se_data;
3752 
3753 	(void) proc_fltname(fltnum, name, sizeof (name));
3754 	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s", name);
3755 
3756 	return (buf);
3757 }
3758 
3759 /*ARGSUSED*/
3760 static int
3761 pt_fault_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3762 {
3763 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3764 	int fltnum = (intptr_t)sep->se_data;
3765 
3766 	return (psp->pr_why == PR_FAULTED && psp->pr_what == fltnum);
3767 }
3768 
3769 static const mdb_se_ops_t proc_fault_ops = {
3770 	pt_fault_ctor,		/* se_ctor */
3771 	pt_fault_dtor,		/* se_dtor */
3772 	pt_fault_info,		/* se_info */
3773 	no_se_secmp,		/* se_secmp */
3774 	no_se_vecmp,		/* se_vecmp */
3775 	no_se_arm,		/* se_arm */
3776 	no_se_disarm,		/* se_disarm */
3777 	no_se_cont,		/* se_cont */
3778 	pt_fault_match		/* se_match */
3779 };
3780 
3781 /*
3782  * Callback for pt_ignore() dcmd above: for each VID, determine if it
3783  * corresponds to a vespec that traces the specified signal, and delete it.
3784  */
3785 /*ARGSUSED*/
3786 static int
3787 pt_ignore_sig(mdb_tgt_t *t, void *sig, int vid, void *data)
3788 {
3789 	mdb_vespec_t *vep = mdb_tgt_vespec_lookup(t, vid);
3790 
3791 	if (vep->ve_se->se_ops == &proc_signal_ops && vep->ve_args == sig)
3792 		(void) mdb_tgt_vespec_delete(t, vid);
3793 
3794 	return (0);
3795 }
3796 
3797 static int
3798 pt_brkpt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3799 {
3800 	pt_data_t *pt = t->t_data;
3801 	pt_bparg_t *pta = args;
3802 	pt_brkpt_t *ptb;
3803 	GElf_Sym s;
3804 
3805 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) >= PS_LOST)
3806 		return (set_errno(EMDB_NOPROC));
3807 
3808 	if (pta->pta_symbol != NULL) {
3809 		if (!pt->p_rtld_finished &&
3810 		    strchr(pta->pta_symbol, '`') == NULL)
3811 			return (set_errno(EMDB_NOSYM));
3812 		if (mdb_tgt_lookup_by_scope(t, pta->pta_symbol, &s,
3813 		    NULL) == -1) {
3814 			if (errno != EMDB_NOOBJ && !(errno == EMDB_NOSYM &&
3815 			    (!(mdb.m_flags & MDB_FL_BPTNOSYMSTOP) ||
3816 			    !pt->p_rtld_finished))) {
3817 				warn("breakpoint %s activation failed",
3818 				    pta->pta_symbol);
3819 			}
3820 			return (-1); /* errno is set for us */
3821 		}
3822 
3823 		pta->pta_addr = (uintptr_t)s.st_value;
3824 	}
3825 
3826 #ifdef __sparc
3827 	if (pta->pta_addr & 3)
3828 		return (set_errno(EMDB_BPALIGN));
3829 #endif
3830 
3831 	if (Paddr_to_map(t->t_pshandle, pta->pta_addr) == NULL)
3832 		return (set_errno(EMDB_NOMAP));
3833 
3834 	ptb = mdb_alloc(sizeof (pt_brkpt_t), UM_SLEEP);
3835 	ptb->ptb_addr = pta->pta_addr;
3836 	ptb->ptb_instr = NULL;
3837 	sep->se_data = ptb;
3838 
3839 	return (0);
3840 }
3841 
3842 /*ARGSUSED*/
3843 static void
3844 pt_brkpt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3845 {
3846 	mdb_free(sep->se_data, sizeof (pt_brkpt_t));
3847 }
3848 
3849 /*ARGSUSED*/
3850 static char *
3851 pt_brkpt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3852     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3853 {
3854 	uintptr_t addr = NULL;
3855 
3856 	if (vep != NULL) {
3857 		pt_bparg_t *pta = vep->ve_args;
3858 
3859 		if (pta->pta_symbol != NULL) {
3860 			(void) mdb_iob_snprintf(buf, nbytes, "stop at %s",
3861 			    pta->pta_symbol);
3862 		} else {
3863 			(void) mdb_iob_snprintf(buf, nbytes, "stop at %a",
3864 			    pta->pta_addr);
3865 			addr = pta->pta_addr;
3866 		}
3867 
3868 	} else {
3869 		addr = ((pt_brkpt_t *)sep->se_data)->ptb_addr;
3870 		(void) mdb_iob_snprintf(buf, nbytes, "stop at %a", addr);
3871 	}
3872 
3873 	sp->spec_base = addr;
3874 	sp->spec_size = sizeof (instr_t);
3875 
3876 	return (buf);
3877 }
3878 
3879 static int
3880 pt_brkpt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3881 {
3882 	pt_brkpt_t *ptb = sep->se_data;
3883 	pt_bparg_t *pta = args;
3884 	GElf_Sym sym;
3885 
3886 	if (pta->pta_symbol != NULL) {
3887 		return (mdb_tgt_lookup_by_scope(t, pta->pta_symbol,
3888 		    &sym, NULL) == 0 && sym.st_value == ptb->ptb_addr);
3889 	}
3890 
3891 	return (pta->pta_addr == ptb->ptb_addr);
3892 }
3893 
3894 /*ARGSUSED*/
3895 static int
3896 pt_brkpt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
3897 {
3898 	pt_bparg_t *pta1 = vep->ve_args;
3899 	pt_bparg_t *pta2 = args;
3900 
3901 	if (pta1->pta_symbol != NULL && pta2->pta_symbol != NULL)
3902 		return (strcmp(pta1->pta_symbol, pta2->pta_symbol) == 0);
3903 
3904 	if (pta1->pta_symbol == NULL && pta2->pta_symbol == NULL)
3905 		return (pta1->pta_addr == pta2->pta_addr);
3906 
3907 	return (0); /* fail if one is symbolic, other is an explicit address */
3908 }
3909 
3910 static int
3911 pt_brkpt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
3912 {
3913 	pt_brkpt_t *ptb = sep->se_data;
3914 	return (Psetbkpt(t->t_pshandle, ptb->ptb_addr, &ptb->ptb_instr));
3915 }
3916 
3917 /*
3918  * In order to disarm a breakpoint, we replace the trap instruction at ptb_addr
3919  * with the saved instruction.  However, if we have stopped after a successful
3920  * exec(2), we do not want to restore ptb_instr because the address space has
3921  * now been replaced with the text of a different executable, and so restoring
3922  * the saved instruction would be incorrect.  The exec itself has effectively
3923  * removed all breakpoint trap instructions for us, so we can just return.
3924  */
3925 static int
3926 pt_brkpt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
3927 {
3928 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3929 	pt_brkpt_t *ptb = sep->se_data;
3930 
3931 	if ((psp->pr_why == PR_SYSEXIT && psp->pr_errno == 0) &&
3932 	    (psp->pr_what == SYS_exec || psp->pr_what == SYS_execve))
3933 		return (0); /* do not restore saved instruction */
3934 
3935 	return (Pdelbkpt(t->t_pshandle, ptb->ptb_addr, ptb->ptb_instr));
3936 }
3937 
3938 /*
3939  * Determine whether the specified sespec is an armed watchpoint that overlaps
3940  * with the given breakpoint and has the given flags set.  We use this to find
3941  * conflicts with breakpoints, below.
3942  */
3943 static int
3944 pt_wp_overlap(mdb_sespec_t *sep, pt_brkpt_t *ptb, int flags)
3945 {
3946 	const prwatch_t *wp = sep->se_data;
3947 
3948 	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
3949 	    sep->se_ops == &proc_wapt_ops && (wp->pr_wflags & flags) &&
3950 	    ptb->ptb_addr - wp->pr_vaddr < wp->pr_size);
3951 }
3952 
3953 /*
3954  * We step over breakpoints using Pxecbkpt() in libproc.  If a conflicting
3955  * watchpoint is present, we must temporarily remove it before stepping over
3956  * the breakpoint so we do not immediately re-trigger the watchpoint.  We know
3957  * the watchpoint has already triggered on our trap instruction as part of
3958  * fetching it.  Before we return, we must re-install any disabled watchpoints.
3959  */
3960 static int
3961 pt_brkpt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3962 {
3963 	pt_brkpt_t *ptb = sep->se_data;
3964 	int status = -1;
3965 	int error;
3966 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3967 
3968 	/*
3969 	 * If the PC no longer matches our original address, then the user has
3970 	 * changed it while we have been stopped. In this case, it no longer
3971 	 * makes any sense to continue over this breakpoint.  We return as if we
3972 	 * continued normally.
3973 	 */
3974 	if ((uintptr_t)psp->pr_info.si_addr != psp->pr_reg[R_PC])
3975 		return (pt_status(t, tsp));
3976 
3977 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
3978 		if (pt_wp_overlap(sep, ptb, WA_EXEC))
3979 			(void) Pdelwapt(t->t_pshandle, sep->se_data);
3980 	}
3981 
3982 	if (Pxecbkpt(t->t_pshandle, ptb->ptb_instr) == 0 &&
3983 	    Pdelbkpt(t->t_pshandle, ptb->ptb_addr, ptb->ptb_instr) == 0)
3984 		status = pt_status(t, tsp);
3985 
3986 	error = errno; /* save errno from Pxecbkpt, Pdelbkpt, or pt_status */
3987 
3988 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
3989 		if (pt_wp_overlap(sep, ptb, WA_EXEC) &&
3990 		    Psetwapt(t->t_pshandle, sep->se_data) == -1) {
3991 			sep->se_state = MDB_TGT_SPEC_ERROR;
3992 			sep->se_errno = errno;
3993 		}
3994 	}
3995 
3996 	(void) set_errno(error);
3997 	return (status);
3998 }
3999 
4000 /*ARGSUSED*/
4001 static int
4002 pt_brkpt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4003 {
4004 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4005 	pt_brkpt_t *ptb = sep->se_data;
4006 
4007 	return (psp->pr_why == PR_FAULTED && psp->pr_what == FLTBPT &&
4008 	    psp->pr_reg[R_PC] == ptb->ptb_addr);
4009 }
4010 
4011 static const mdb_se_ops_t proc_brkpt_ops = {
4012 	pt_brkpt_ctor,		/* se_ctor */
4013 	pt_brkpt_dtor,		/* se_dtor */
4014 	pt_brkpt_info,		/* se_info */
4015 	pt_brkpt_secmp,		/* se_secmp */
4016 	pt_brkpt_vecmp,		/* se_vecmp */
4017 	pt_brkpt_arm,		/* se_arm */
4018 	pt_brkpt_disarm,	/* se_disarm */
4019 	pt_brkpt_cont,		/* se_cont */
4020 	pt_brkpt_match		/* se_match */
4021 };
4022 
4023 static int
4024 pt_wapt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4025 {
4026 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) >= PS_LOST)
4027 		return (set_errno(EMDB_NOPROC));
4028 
4029 	sep->se_data = mdb_alloc(sizeof (prwatch_t), UM_SLEEP);
4030 	bcopy(args, sep->se_data, sizeof (prwatch_t));
4031 	return (0);
4032 }
4033 
4034 /*ARGSUSED*/
4035 static void
4036 pt_wapt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
4037 {
4038 	mdb_free(sep->se_data, sizeof (prwatch_t));
4039 }
4040 
4041 /*ARGSUSED*/
4042 static char *
4043 pt_wapt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
4044     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
4045 {
4046 	prwatch_t *wp = vep != NULL ? vep->ve_args : sep->se_data;
4047 	char desc[24];
4048 
4049 	ASSERT(wp->pr_wflags != 0);
4050 	desc[0] = '\0';
4051 
4052 	switch (wp->pr_wflags) {
4053 	case WA_READ:
4054 		(void) strcat(desc, "/read");
4055 		break;
4056 	case WA_WRITE:
4057 		(void) strcat(desc, "/write");
4058 		break;
4059 	case WA_EXEC:
4060 		(void) strcat(desc, "/exec");
4061 		break;
4062 	default:
4063 		if (wp->pr_wflags & WA_READ)
4064 			(void) strcat(desc, "/r");
4065 		if (wp->pr_wflags & WA_WRITE)
4066 			(void) strcat(desc, "/w");
4067 		if (wp->pr_wflags & WA_EXEC)
4068 			(void) strcat(desc, "/x");
4069 	}
4070 
4071 	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s of [%la, %la)",
4072 	    desc + 1, wp->pr_vaddr, wp->pr_vaddr + wp->pr_size);
4073 
4074 	sp->spec_base = wp->pr_vaddr;
4075 	sp->spec_size = wp->pr_size;
4076 
4077 	return (buf);
4078 }
4079 
4080 /*ARGSUSED*/
4081 static int
4082 pt_wapt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4083 {
4084 	prwatch_t *wp1 = sep->se_data;
4085 	prwatch_t *wp2 = args;
4086 
4087 	return (wp1->pr_vaddr == wp2->pr_vaddr &&
4088 	    wp1->pr_size == wp2->pr_size && wp1->pr_wflags == wp2->pr_wflags);
4089 }
4090 
4091 /*ARGSUSED*/
4092 static int
4093 pt_wapt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
4094 {
4095 	prwatch_t *wp1 = vep->ve_args;
4096 	prwatch_t *wp2 = args;
4097 
4098 	return (wp1->pr_vaddr == wp2->pr_vaddr &&
4099 	    wp1->pr_size == wp2->pr_size && wp1->pr_wflags == wp2->pr_wflags);
4100 }
4101 
4102 static int
4103 pt_wapt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
4104 {
4105 	return (Psetwapt(t->t_pshandle, sep->se_data));
4106 }
4107 
4108 static int
4109 pt_wapt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
4110 {
4111 	return (Pdelwapt(t->t_pshandle, sep->se_data));
4112 }
4113 
4114 /*
4115  * Determine whether the specified sespec is an armed breakpoint at the
4116  * given %pc.  We use this to find conflicts with watchpoints below.
4117  */
4118 static int
4119 pt_bp_overlap(mdb_sespec_t *sep, uintptr_t pc)
4120 {
4121 	pt_brkpt_t *ptb = sep->se_data;
4122 
4123 	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
4124 	    sep->se_ops == &proc_brkpt_ops && ptb->ptb_addr == pc);
4125 }
4126 
4127 /*
4128  * We step over watchpoints using Pxecwapt() in libproc.  If a conflicting
4129  * breakpoint is present, we must temporarily disarm it before stepping
4130  * over the watchpoint so we do not immediately re-trigger the breakpoint.
4131  * This is similar to the case handled in pt_brkpt_cont(), above.
4132  */
4133 static int
4134 pt_wapt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4135 {
4136 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4137 	mdb_sespec_t *bep = NULL;
4138 	int status = -1;
4139 	int error;
4140 
4141 	/*
4142 	 * If the PC no longer matches our original address, then the user has
4143 	 * changed it while we have been stopped. In this case, it no longer
4144 	 * makes any sense to continue over this instruction.  We return as if
4145 	 * we continued normally.
4146 	 */
4147 	if ((uintptr_t)psp->pr_info.si_pc != psp->pr_reg[R_PC])
4148 		return (pt_status(t, tsp));
4149 
4150 	if (psp->pr_info.si_code != TRAP_XWATCH) {
4151 		for (bep = mdb_list_next(&t->t_active); bep != NULL;
4152 		    bep = mdb_list_next(bep)) {
4153 			if (pt_bp_overlap(bep, psp->pr_reg[R_PC])) {
4154 				(void) bep->se_ops->se_disarm(t, bep);
4155 				bep->se_state = MDB_TGT_SPEC_ACTIVE;
4156 				break;
4157 			}
4158 		}
4159 	}
4160 
4161 	if (Pxecwapt(t->t_pshandle, sep->se_data) == 0)
4162 		status = pt_status(t, tsp);
4163 
4164 	error = errno; /* save errno from Pxecwapt or pt_status */
4165 
4166 	if (bep != NULL)
4167 		mdb_tgt_sespec_arm_one(t, bep);
4168 
4169 	(void) set_errno(error);
4170 	return (status);
4171 }
4172 
4173 /*ARGSUSED*/
4174 static int
4175 pt_wapt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4176 {
4177 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4178 	prwatch_t *wp = sep->se_data;
4179 
4180 	return (psp->pr_why == PR_FAULTED && psp->pr_what == FLTWATCH &&
4181 	    (uintptr_t)psp->pr_info.si_addr - wp->pr_vaddr < wp->pr_size);
4182 }
4183 
4184 static const mdb_se_ops_t proc_wapt_ops = {
4185 	pt_wapt_ctor,		/* se_ctor */
4186 	pt_wapt_dtor,		/* se_dtor */
4187 	pt_wapt_info,		/* se_info */
4188 	pt_wapt_secmp,		/* se_secmp */
4189 	pt_wapt_vecmp,		/* se_vecmp */
4190 	pt_wapt_arm,		/* se_arm */
4191 	pt_wapt_disarm,		/* se_disarm */
4192 	pt_wapt_cont,		/* se_cont */
4193 	pt_wapt_match		/* se_match */
4194 };
4195 
4196 static void
4197 pt_bparg_dtor(mdb_vespec_t *vep)
4198 {
4199 	pt_bparg_t *pta = vep->ve_args;
4200 
4201 	if (pta->pta_symbol != NULL)
4202 		strfree(pta->pta_symbol);
4203 
4204 	mdb_free(pta, sizeof (pt_bparg_t));
4205 }
4206 
4207 static int
4208 pt_add_vbrkpt(mdb_tgt_t *t, uintptr_t addr,
4209     int spec_flags, mdb_tgt_se_f *func, void *data)
4210 {
4211 	pt_bparg_t *pta = mdb_alloc(sizeof (pt_bparg_t), UM_SLEEP);
4212 
4213 	pta->pta_symbol = NULL;
4214 	pta->pta_addr = addr;
4215 
4216 	return (mdb_tgt_vespec_insert(t, &proc_brkpt_ops, spec_flags,
4217 	    func, data, pta, pt_bparg_dtor));
4218 }
4219 
4220 static int
4221 pt_add_sbrkpt(mdb_tgt_t *t, const char *sym,
4222     int spec_flags, mdb_tgt_se_f *func, void *data)
4223 {
4224 	pt_bparg_t *pta;
4225 
4226 	if (sym[0] == '`') {
4227 		(void) set_errno(EMDB_NOOBJ);
4228 		return (0);
4229 	}
4230 
4231 	if (sym[strlen(sym) - 1] == '`') {
4232 		(void) set_errno(EMDB_NOSYM);
4233 		return (0);
4234 	}
4235 
4236 	pta = mdb_alloc(sizeof (pt_bparg_t), UM_SLEEP);
4237 	pta->pta_symbol = strdup(sym);
4238 	pta->pta_addr = NULL;
4239 
4240 	return (mdb_tgt_vespec_insert(t, &proc_brkpt_ops, spec_flags,
4241 	    func, data, pta, pt_bparg_dtor));
4242 }
4243 
4244 static int
4245 pt_wparg_overlap(const prwatch_t *wp1, const prwatch_t *wp2)
4246 {
4247 	if (wp2->pr_vaddr + wp2->pr_size <= wp1->pr_vaddr)
4248 		return (0); /* no range overlap */
4249 
4250 	if (wp1->pr_vaddr + wp1->pr_size <= wp2->pr_vaddr)
4251 		return (0); /* no range overlap */
4252 
4253 	return (wp1->pr_vaddr != wp2->pr_vaddr ||
4254 	    wp1->pr_size != wp2->pr_size || wp1->pr_wflags != wp2->pr_wflags);
4255 }
4256 
4257 static void
4258 pt_wparg_dtor(mdb_vespec_t *vep)
4259 {
4260 	mdb_free(vep->ve_args, sizeof (prwatch_t));
4261 }
4262 
4263 static int
4264 pt_add_vwapt(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
4265     int spec_flags, mdb_tgt_se_f *func, void *data)
4266 {
4267 	prwatch_t *wp = mdb_alloc(sizeof (prwatch_t), UM_SLEEP);
4268 	mdb_sespec_t *sep;
4269 
4270 	wp->pr_vaddr = addr;
4271 	wp->pr_size = len;
4272 	wp->pr_wflags = 0;
4273 
4274 	if (wflags & MDB_TGT_WA_R)
4275 		wp->pr_wflags |= WA_READ;
4276 	if (wflags & MDB_TGT_WA_W)
4277 		wp->pr_wflags |= WA_WRITE;
4278 	if (wflags & MDB_TGT_WA_X)
4279 		wp->pr_wflags |= WA_EXEC;
4280 
4281 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4282 		if (sep->se_ops == &proc_wapt_ops &&
4283 		    mdb_list_next(&sep->se_velist) != NULL &&
4284 		    pt_wparg_overlap(wp, sep->se_data))
4285 			goto dup;
4286 	}
4287 
4288 	for (sep = mdb_list_next(&t->t_idle); sep; sep = mdb_list_next(sep)) {
4289 		if (sep->se_ops == &proc_wapt_ops && pt_wparg_overlap(wp,
4290 		    ((mdb_vespec_t *)mdb_list_next(&sep->se_velist))->ve_args))
4291 			goto dup;
4292 	}
4293 
4294 	return (mdb_tgt_vespec_insert(t, &proc_wapt_ops, spec_flags,
4295 	    func, data, wp, pt_wparg_dtor));
4296 
4297 dup:
4298 	mdb_free(wp, sizeof (prwatch_t));
4299 	(void) set_errno(EMDB_WPDUP);
4300 	return (0);
4301 }
4302 
4303 static int
4304 pt_add_sysenter(mdb_tgt_t *t, int sysnum,
4305     int spec_flags, mdb_tgt_se_f *func, void *data)
4306 {
4307 	if (sysnum <= 0 || sysnum > PRMAXSYS) {
4308 		(void) set_errno(EMDB_BADSYSNUM);
4309 		return (0);
4310 	}
4311 
4312 	return (mdb_tgt_vespec_insert(t, &proc_sysenter_ops, spec_flags,
4313 	    func, data, (void *)(uintptr_t)sysnum, no_ve_dtor));
4314 }
4315 
4316 static int
4317 pt_add_sysexit(mdb_tgt_t *t, int sysnum,
4318     int spec_flags, mdb_tgt_se_f *func, void *data)
4319 {
4320 	if (sysnum <= 0 || sysnum > PRMAXSYS) {
4321 		(void) set_errno(EMDB_BADSYSNUM);
4322 		return (0);
4323 	}
4324 
4325 	return (mdb_tgt_vespec_insert(t, &proc_sysexit_ops, spec_flags,
4326 	    func, data, (void *)(uintptr_t)sysnum, no_ve_dtor));
4327 }
4328 
4329 static int
4330 pt_add_signal(mdb_tgt_t *t, int signum,
4331     int spec_flags, mdb_tgt_se_f *func, void *data)
4332 {
4333 	pt_data_t *pt = t->t_data;
4334 
4335 	if (signum <= 0 || signum > pt->p_maxsig) {
4336 		(void) set_errno(EMDB_BADSIGNUM);
4337 		return (0);
4338 	}
4339 
4340 	return (mdb_tgt_vespec_insert(t, &proc_signal_ops, spec_flags,
4341 	    func, data, (void *)(uintptr_t)signum, no_ve_dtor));
4342 }
4343 
4344 static int
4345 pt_add_fault(mdb_tgt_t *t, int fltnum,
4346     int spec_flags, mdb_tgt_se_f *func, void *data)
4347 {
4348 	if (fltnum <= 0 || fltnum > PRMAXFAULT) {
4349 		(void) set_errno(EMDB_BADFLTNUM);
4350 		return (0);
4351 	}
4352 
4353 	return (mdb_tgt_vespec_insert(t, &proc_fault_ops, spec_flags,
4354 	    func, data, (void *)(uintptr_t)fltnum, no_ve_dtor));
4355 }
4356 
4357 static int
4358 pt_getareg(mdb_tgt_t *t, mdb_tgt_tid_t tid,
4359     const char *rname, mdb_tgt_reg_t *rp)
4360 {
4361 	pt_data_t *pt = t->t_data;
4362 	prgregset_t grs;
4363 	mdb_var_t *v;
4364 
4365 	if (t->t_pshandle == NULL)
4366 		return (set_errno(EMDB_NOPROC));
4367 
4368 	if ((v = mdb_nv_lookup(&pt->p_regs, rname)) != NULL) {
4369 		uintmax_t rd_nval = mdb_nv_get_value(v);
4370 		ushort_t rd_num = MDB_TGT_R_NUM(rd_nval);
4371 		ushort_t rd_flags = MDB_TGT_R_FLAGS(rd_nval);
4372 
4373 		if (!MDB_TGT_R_IS_FP(rd_flags)) {
4374 			mdb_tgt_reg_t r = 0;
4375 
4376 #if defined(__sparc) && defined(_ILP32)
4377 			/*
4378 			 * If we are debugging on 32-bit SPARC, the globals and
4379 			 * outs can have 32 upper bits hiding in the xregs.
4380 			 */
4381 			/* LINTED */
4382 			int is_g = (rd_num >= R_G0 && rd_num <= R_G7);
4383 			int is_o = (rd_num >= R_O0 && rd_num <= R_O7);
4384 			prxregset_t xrs;
4385 
4386 			if (is_g && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4387 			    xrs.pr_type == XR_TYPE_V8P) {
4388 				r |= (uint64_t)xrs.pr_un.pr_v8p.pr_xg[
4389 				    rd_num - R_G0 + XR_G0] << 32;
4390 			}
4391 
4392 			if (is_o && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4393 			    xrs.pr_type == XR_TYPE_V8P) {
4394 				r |= (uint64_t)xrs.pr_un.pr_v8p.pr_xo[
4395 				    rd_num - R_O0 + XR_O0] << 32;
4396 			}
4397 #endif	/* __sparc && _ILP32 */
4398 
4399 			/*
4400 			 * Avoid sign-extension by casting: recall that procfs
4401 			 * defines prgreg_t as a long or int and our native
4402 			 * register handling uses uint64_t's.
4403 			 */
4404 			if (PTL_GETREGS(t, tid, grs) == 0) {
4405 				*rp = r | (ulong_t)grs[rd_num];
4406 				return (0);
4407 			}
4408 			return (-1);
4409 		} else
4410 			return (pt_getfpreg(t, tid, rd_num, rd_flags, rp));
4411 	}
4412 
4413 	return (set_errno(EMDB_BADREG));
4414 }
4415 
4416 static int
4417 pt_putareg(mdb_tgt_t *t, mdb_tgt_tid_t tid, const char *rname, mdb_tgt_reg_t r)
4418 {
4419 	pt_data_t *pt = t->t_data;
4420 	prgregset_t grs;
4421 	mdb_var_t *v;
4422 
4423 	if (t->t_pshandle == NULL)
4424 		return (set_errno(EMDB_NOPROC));
4425 
4426 	if ((v = mdb_nv_lookup(&pt->p_regs, rname)) != NULL) {
4427 		uintmax_t rd_nval = mdb_nv_get_value(v);
4428 		ushort_t rd_num = MDB_TGT_R_NUM(rd_nval);
4429 		ushort_t rd_flags = MDB_TGT_R_FLAGS(rd_nval);
4430 
4431 		if (!MDB_TGT_R_IS_FP(rd_flags)) {
4432 #if defined(__sparc) && defined(_ILP32)
4433 			/*
4434 			 * If we are debugging on 32-bit SPARC, the globals and
4435 			 * outs can have 32 upper bits stored in the xregs.
4436 			 */
4437 			/* LINTED */
4438 			int is_g = (rd_num >= R_G0 && rd_num <= R_G7);
4439 			int is_o = (rd_num >= R_O0 && rd_num <= R_O7);
4440 			prxregset_t xrs;
4441 
4442 			if ((is_g || is_o) && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4443 			    xrs.pr_type == XR_TYPE_V8P) {
4444 				if (is_g) {
4445 					xrs.pr_un.pr_v8p.pr_xg[rd_num -
4446 					    R_G0 + XR_G0] = (uint32_t)(r >> 32);
4447 				} else if (is_o) {
4448 					xrs.pr_un.pr_v8p.pr_xo[rd_num -
4449 					    R_O0 + XR_O0] = (uint32_t)(r >> 32);
4450 				}
4451 
4452 				if (PTL_SETXREGS(t, tid, &xrs) == -1)
4453 					return (-1);
4454 			}
4455 #endif	/* __sparc && _ILP32 */
4456 
4457 			if (PTL_GETREGS(t, tid, grs) == 0) {
4458 				grs[rd_num] = (prgreg_t)r;
4459 				return (PTL_SETREGS(t, tid, grs));
4460 			}
4461 			return (-1);
4462 		} else
4463 			return (pt_putfpreg(t, tid, rd_num, rd_flags, r));
4464 	}
4465 
4466 	return (set_errno(EMDB_BADREG));
4467 }
4468 
4469 static int
4470 pt_stack_call(pt_stkarg_t *psp, const prgregset_t grs, uint_t argc, long *argv)
4471 {
4472 	psp->pstk_gotpc |= (grs[R_PC] != 0);
4473 
4474 	if (!psp->pstk_gotpc)
4475 		return (0); /* skip initial zeroed frames */
4476 
4477 	return (psp->pstk_func(psp->pstk_private, grs[R_PC],
4478 	    argc, argv, (const struct mdb_tgt_gregset *)grs));
4479 }
4480 
4481 static int
4482 pt_stack_iter(mdb_tgt_t *t, const mdb_tgt_gregset_t *gsp,
4483     mdb_tgt_stack_f *func, void *arg)
4484 {
4485 	if (t->t_pshandle != NULL) {
4486 		pt_stkarg_t pstk;
4487 
4488 		pstk.pstk_func = func;
4489 		pstk.pstk_private = arg;
4490 		pstk.pstk_gotpc = FALSE;
4491 
4492 		(void) Pstack_iter(t->t_pshandle, gsp->gregs,
4493 		    (proc_stack_f *)pt_stack_call, &pstk);
4494 
4495 		return (0);
4496 	}
4497 
4498 	return (set_errno(EMDB_NOPROC));
4499 }
4500 
4501 static const mdb_tgt_ops_t proc_ops = {
4502 	pt_setflags,				/* t_setflags */
4503 	(int (*)()) mdb_tgt_notsup,		/* t_setcontext */
4504 	pt_activate,				/* t_activate */
4505 	pt_deactivate,				/* t_deactivate */
4506 	pt_periodic,				/* t_periodic */
4507 	pt_destroy,				/* t_destroy */
4508 	pt_name,				/* t_name */
4509 	(const char *(*)()) mdb_conf_isa,	/* t_isa */
4510 	pt_platform,				/* t_platform */
4511 	pt_uname,				/* t_uname */
4512 	pt_dmodel,				/* t_dmodel */
4513 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_aread */
4514 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_awrite */
4515 	pt_vread,				/* t_vread */
4516 	pt_vwrite,				/* t_vwrite */
4517 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_pread */
4518 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_pwrite */
4519 	pt_fread,				/* t_fread */
4520 	pt_fwrite,				/* t_fwrite */
4521 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_ioread */
4522 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_iowrite */
4523 	(int (*)()) mdb_tgt_notsup,		/* t_vtop */
4524 	pt_lookup_by_name,			/* t_lookup_by_name */
4525 	pt_lookup_by_addr,			/* t_lookup_by_addr */
4526 	pt_symbol_iter,				/* t_symbol_iter */
4527 	pt_mapping_iter,			/* t_mapping_iter */
4528 	pt_object_iter,				/* t_object_iter */
4529 	pt_addr_to_map,				/* t_addr_to_map */
4530 	pt_name_to_map,				/* t_name_to_map */
4531 	pt_addr_to_ctf,				/* t_addr_to_ctf */
4532 	pt_name_to_ctf,				/* t_name_to_ctf */
4533 	pt_status,				/* t_status */
4534 	pt_run,					/* t_run */
4535 	pt_step,				/* t_step */
4536 	pt_step_out,				/* t_step_out */
4537 	(int (*)()) mdb_tgt_notsup,		/* t_step_branch */
4538 	pt_next,				/* t_next */
4539 	pt_continue,				/* t_cont */
4540 	pt_signal,				/* t_signal */
4541 	pt_add_vbrkpt,				/* t_add_vbrkpt */
4542 	pt_add_sbrkpt,				/* t_add_sbrkpt */
4543 	(int (*)()) mdb_tgt_null,		/* t_add_pwapt */
4544 	pt_add_vwapt,				/* t_add_vwapt */
4545 	(int (*)()) mdb_tgt_null,		/* t_add_iowapt */
4546 	pt_add_sysenter,			/* t_add_sysenter */
4547 	pt_add_sysexit,				/* t_add_sysexit */
4548 	pt_add_signal,				/* t_add_signal */
4549 	pt_add_fault,				/* t_add_fault */
4550 	pt_getareg,				/* t_getareg */
4551 	pt_putareg,				/* t_putareg */
4552 	pt_stack_iter				/* t_stack_iter */
4553 };
4554 
4555 /*
4556  * Utility function for converting libproc errno values to mdb error values
4557  * for the ptl calls below.  Currently, we only need to convert ENOENT to
4558  * EMDB_NOTHREAD to produce a more useful error message for the user.
4559  */
4560 static int
4561 ptl_err(int error)
4562 {
4563 	if (error != 0 && errno == ENOENT)
4564 		return (set_errno(EMDB_NOTHREAD));
4565 
4566 	return (error);
4567 }
4568 
4569 /*ARGSUSED*/
4570 static mdb_tgt_tid_t
4571 pt_lwp_tid(mdb_tgt_t *t, void *tap)
4572 {
4573 	if (t->t_pshandle != NULL)
4574 		return (Pstatus(t->t_pshandle)->pr_lwp.pr_lwpid);
4575 
4576 	return (set_errno(EMDB_NOPROC));
4577 }
4578 
4579 static int
4580 pt_lwp_add(mdb_addrvec_t *ap, const lwpstatus_t *psp)
4581 {
4582 	mdb_addrvec_unshift(ap, psp->pr_lwpid);
4583 	return (0);
4584 }
4585 
4586 /*ARGSUSED*/
4587 static int
4588 pt_lwp_iter(mdb_tgt_t *t, void *tap, mdb_addrvec_t *ap)
4589 {
4590 	if (t->t_pshandle != NULL)
4591 		return (Plwp_iter(t->t_pshandle, (proc_lwp_f *)pt_lwp_add, ap));
4592 
4593 	return (set_errno(EMDB_NOPROC));
4594 }
4595 
4596 /*ARGSUSED*/
4597 static int
4598 pt_lwp_getregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4599 {
4600 	if (t->t_pshandle != NULL) {
4601 		return (ptl_err(Plwp_getregs(t->t_pshandle,
4602 		    (lwpid_t)tid, gregs)));
4603 	}
4604 	return (set_errno(EMDB_NOPROC));
4605 }
4606 
4607 /*ARGSUSED*/
4608 static int
4609 pt_lwp_setregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4610 {
4611 	if (t->t_pshandle != NULL) {
4612 		return (ptl_err(Plwp_setregs(t->t_pshandle,
4613 		    (lwpid_t)tid, gregs)));
4614 	}
4615 	return (set_errno(EMDB_NOPROC));
4616 }
4617 
4618 #ifdef	__sparc
4619 
4620 /*ARGSUSED*/
4621 static int
4622 pt_lwp_getxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prxregset_t *xregs)
4623 {
4624 	if (t->t_pshandle != NULL) {
4625 		return (ptl_err(Plwp_getxregs(t->t_pshandle,
4626 		    (lwpid_t)tid, xregs)));
4627 	}
4628 	return (set_errno(EMDB_NOPROC));
4629 }
4630 
4631 /*ARGSUSED*/
4632 static int
4633 pt_lwp_setxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4634     const prxregset_t *xregs)
4635 {
4636 	if (t->t_pshandle != NULL) {
4637 		return (ptl_err(Plwp_setxregs(t->t_pshandle,
4638 		    (lwpid_t)tid, xregs)));
4639 	}
4640 	return (set_errno(EMDB_NOPROC));
4641 }
4642 
4643 #endif	/* __sparc */
4644 
4645 /*ARGSUSED*/
4646 static int
4647 pt_lwp_getfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4648     prfpregset_t *fpregs)
4649 {
4650 	if (t->t_pshandle != NULL) {
4651 		return (ptl_err(Plwp_getfpregs(t->t_pshandle,
4652 		    (lwpid_t)tid, fpregs)));
4653 	}
4654 	return (set_errno(EMDB_NOPROC));
4655 }
4656 
4657 /*ARGSUSED*/
4658 static int
4659 pt_lwp_setfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4660     const prfpregset_t *fpregs)
4661 {
4662 	if (t->t_pshandle != NULL) {
4663 		return (ptl_err(Plwp_setfpregs(t->t_pshandle,
4664 		    (lwpid_t)tid, fpregs)));
4665 	}
4666 	return (set_errno(EMDB_NOPROC));
4667 }
4668 
4669 static const pt_ptl_ops_t proc_lwp_ops = {
4670 	(int (*)()) mdb_tgt_nop,
4671 	(void (*)()) mdb_tgt_nop,
4672 	pt_lwp_tid,
4673 	pt_lwp_iter,
4674 	pt_lwp_getregs,
4675 	pt_lwp_setregs,
4676 #ifdef __sparc
4677 	pt_lwp_getxregs,
4678 	pt_lwp_setxregs,
4679 #endif
4680 	pt_lwp_getfpregs,
4681 	pt_lwp_setfpregs
4682 };
4683 
4684 static int
4685 pt_tdb_ctor(mdb_tgt_t *t)
4686 {
4687 	pt_data_t *pt = t->t_data;
4688 	td_thragent_t *tap;
4689 	td_err_e err;
4690 
4691 	if ((err = pt->p_tdb_ops->td_ta_new(t->t_pshandle, &tap)) != TD_OK)
4692 		return (set_errno(tdb_to_errno(err)));
4693 
4694 	pt->p_ptl_hdl = tap;
4695 	return (0);
4696 }
4697 
4698 static void
4699 pt_tdb_dtor(mdb_tgt_t *t, void *tap)
4700 {
4701 	pt_data_t *pt = t->t_data;
4702 
4703 	ASSERT(tap == pt->p_ptl_hdl);
4704 	(void) pt->p_tdb_ops->td_ta_delete(tap);
4705 	pt->p_ptl_hdl = NULL;
4706 }
4707 
4708 static mdb_tgt_tid_t
4709 pt_tdb_tid(mdb_tgt_t *t, void *tap)
4710 {
4711 	pt_data_t *pt = t->t_data;
4712 
4713 	td_thrhandle_t th;
4714 	td_thrinfo_t ti;
4715 	td_err_e err;
4716 
4717 	if (t->t_pshandle == NULL)
4718 		return (set_errno(EMDB_NOPROC));
4719 
4720 	if ((err = pt->p_tdb_ops->td_ta_map_lwp2thr(tap,
4721 	    Pstatus(t->t_pshandle)->pr_lwp.pr_lwpid, &th)) != TD_OK)
4722 		return (set_errno(tdb_to_errno(err)));
4723 
4724 	if ((err = pt->p_tdb_ops->td_thr_get_info(&th, &ti)) != TD_OK)
4725 		return (set_errno(tdb_to_errno(err)));
4726 
4727 	return (ti.ti_tid);
4728 }
4729 
4730 static int
4731 pt_tdb_add(const td_thrhandle_t *thp, pt_addarg_t *pap)
4732 {
4733 	td_thrinfo_t ti;
4734 
4735 	if (pap->pa_pt->p_tdb_ops->td_thr_get_info(thp, &ti) == TD_OK &&
4736 	    ti.ti_state != TD_THR_ZOMBIE)
4737 		mdb_addrvec_unshift(pap->pa_ap, ti.ti_tid);
4738 
4739 	return (0);
4740 }
4741 
4742 static int
4743 pt_tdb_iter(mdb_tgt_t *t, void *tap, mdb_addrvec_t *ap)
4744 {
4745 	pt_data_t *pt = t->t_data;
4746 	pt_addarg_t arg;
4747 	int err;
4748 
4749 	if (t->t_pshandle == NULL)
4750 		return (set_errno(EMDB_NOPROC));
4751 
4752 	arg.pa_pt = pt;
4753 	arg.pa_ap = ap;
4754 
4755 	if ((err = pt->p_tdb_ops->td_ta_thr_iter(tap, (td_thr_iter_f *)
4756 	    pt_tdb_add, &arg, TD_THR_ANY_STATE, TD_THR_LOWEST_PRIORITY,
4757 	    TD_SIGNO_MASK, TD_THR_ANY_USER_FLAGS)) != TD_OK)
4758 		return (set_errno(tdb_to_errno(err)));
4759 
4760 	return (0);
4761 }
4762 
4763 static int
4764 pt_tdb_getregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4765 {
4766 	pt_data_t *pt = t->t_data;
4767 
4768 	td_thrhandle_t th;
4769 	td_err_e err;
4770 
4771 	if (t->t_pshandle == NULL)
4772 		return (set_errno(EMDB_NOPROC));
4773 
4774 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4775 		return (set_errno(tdb_to_errno(err)));
4776 
4777 	err = pt->p_tdb_ops->td_thr_getgregs(&th, gregs);
4778 	if (err != TD_OK && err != TD_PARTIALREG)
4779 		return (set_errno(tdb_to_errno(err)));
4780 
4781 	return (0);
4782 }
4783 
4784 static int
4785 pt_tdb_setregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4786 {
4787 	pt_data_t *pt = t->t_data;
4788 
4789 	td_thrhandle_t th;
4790 	td_err_e err;
4791 
4792 	if (t->t_pshandle == NULL)
4793 		return (set_errno(EMDB_NOPROC));
4794 
4795 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4796 		return (set_errno(tdb_to_errno(err)));
4797 
4798 	err = pt->p_tdb_ops->td_thr_setgregs(&th, gregs);
4799 	if (err != TD_OK && err != TD_PARTIALREG)
4800 		return (set_errno(tdb_to_errno(err)));
4801 
4802 	return (0);
4803 }
4804 
4805 #ifdef __sparc
4806 
4807 static int
4808 pt_tdb_getxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prxregset_t *xregs)
4809 {
4810 	pt_data_t *pt = t->t_data;
4811 
4812 	td_thrhandle_t th;
4813 	td_err_e err;
4814 
4815 	if (t->t_pshandle == NULL)
4816 		return (set_errno(EMDB_NOPROC));
4817 
4818 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4819 		return (set_errno(tdb_to_errno(err)));
4820 
4821 	err = pt->p_tdb_ops->td_thr_getxregs(&th, xregs);
4822 	if (err != TD_OK && err != TD_PARTIALREG)
4823 		return (set_errno(tdb_to_errno(err)));
4824 
4825 	return (0);
4826 }
4827 
4828 static int
4829 pt_tdb_setxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4830     const prxregset_t *xregs)
4831 {
4832 	pt_data_t *pt = t->t_data;
4833 
4834 	td_thrhandle_t th;
4835 	td_err_e err;
4836 
4837 	if (t->t_pshandle == NULL)
4838 		return (set_errno(EMDB_NOPROC));
4839 
4840 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4841 		return (set_errno(tdb_to_errno(err)));
4842 
4843 	err = pt->p_tdb_ops->td_thr_setxregs(&th, xregs);
4844 	if (err != TD_OK && err != TD_PARTIALREG)
4845 		return (set_errno(tdb_to_errno(err)));
4846 
4847 	return (0);
4848 }
4849 
4850 #endif	/* __sparc */
4851 
4852 static int
4853 pt_tdb_getfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4854     prfpregset_t *fpregs)
4855 {
4856 	pt_data_t *pt = t->t_data;
4857 
4858 	td_thrhandle_t th;
4859 	td_err_e err;
4860 
4861 	if (t->t_pshandle == NULL)
4862 		return (set_errno(EMDB_NOPROC));
4863 
4864 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4865 		return (set_errno(tdb_to_errno(err)));
4866 
4867 	err = pt->p_tdb_ops->td_thr_getfpregs(&th, fpregs);
4868 	if (err != TD_OK && err != TD_PARTIALREG)
4869 		return (set_errno(tdb_to_errno(err)));
4870 
4871 	return (0);
4872 }
4873 
4874 static int
4875 pt_tdb_setfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4876     const prfpregset_t *fpregs)
4877 {
4878 	pt_data_t *pt = t->t_data;
4879 
4880 	td_thrhandle_t th;
4881 	td_err_e err;
4882 
4883 	if (t->t_pshandle == NULL)
4884 		return (set_errno(EMDB_NOPROC));
4885 
4886 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4887 		return (set_errno(tdb_to_errno(err)));
4888 
4889 	err = pt->p_tdb_ops->td_thr_setfpregs(&th, fpregs);
4890 	if (err != TD_OK && err != TD_PARTIALREG)
4891 		return (set_errno(tdb_to_errno(err)));
4892 
4893 	return (0);
4894 }
4895 
4896 static const pt_ptl_ops_t proc_tdb_ops = {
4897 	pt_tdb_ctor,
4898 	pt_tdb_dtor,
4899 	pt_tdb_tid,
4900 	pt_tdb_iter,
4901 	pt_tdb_getregs,
4902 	pt_tdb_setregs,
4903 #ifdef __sparc
4904 	pt_tdb_getxregs,
4905 	pt_tdb_setxregs,
4906 #endif
4907 	pt_tdb_getfpregs,
4908 	pt_tdb_setfpregs
4909 };
4910 
4911 static ssize_t
4912 pt_xd_auxv(mdb_tgt_t *t, void *buf, size_t nbytes)
4913 {
4914 	struct ps_prochandle *P = t->t_pshandle;
4915 	const auxv_t *auxp, *auxv = NULL;
4916 	int auxn = 0;
4917 
4918 	if (P != NULL && (auxv = Pgetauxvec(P)) != NULL &&
4919 	    auxv->a_type != AT_NULL) {
4920 		for (auxp = auxv, auxn = 1; auxp->a_type != NULL; auxp++)
4921 			auxn++;
4922 	}
4923 
4924 	if (buf == NULL && nbytes == 0)
4925 		return (sizeof (auxv_t) * auxn);
4926 
4927 	if (auxn == 0)
4928 		return (set_errno(ENODATA));
4929 
4930 	nbytes = MIN(nbytes, sizeof (auxv_t) * auxn);
4931 	bcopy(auxv, buf, nbytes);
4932 	return (nbytes);
4933 }
4934 
4935 static ssize_t
4936 pt_xd_cred(mdb_tgt_t *t, void *buf, size_t nbytes)
4937 {
4938 	prcred_t cr, *crp;
4939 	size_t cbytes = 0;
4940 
4941 	if (t->t_pshandle != NULL && Pcred(t->t_pshandle, &cr, 1) == 0) {
4942 		cbytes = (cr.pr_ngroups <= 1) ? sizeof (prcred_t) :
4943 		    (sizeof (prcred_t) + (cr.pr_ngroups - 1) * sizeof (gid_t));
4944 	}
4945 
4946 	if (buf == NULL && nbytes == 0)
4947 		return (cbytes);
4948 
4949 	if (cbytes == 0)
4950 		return (set_errno(ENODATA));
4951 
4952 	crp = mdb_alloc(cbytes, UM_SLEEP);
4953 
4954 	if (Pcred(t->t_pshandle, crp, cr.pr_ngroups) == -1)
4955 		return (set_errno(ENODATA));
4956 
4957 	nbytes = MIN(nbytes, cbytes);
4958 	bcopy(crp, buf, nbytes);
4959 	mdb_free(crp, cbytes);
4960 	return (nbytes);
4961 }
4962 
4963 static ssize_t
4964 pt_xd_ehdr(mdb_tgt_t *t, void *buf, size_t nbytes)
4965 {
4966 	pt_data_t *pt = t->t_data;
4967 
4968 	if (buf == NULL && nbytes == 0)
4969 		return (sizeof (GElf_Ehdr));
4970 
4971 	if (pt->p_file == NULL)
4972 		return (set_errno(ENODATA));
4973 
4974 	nbytes = MIN(nbytes, sizeof (GElf_Ehdr));
4975 	bcopy(&pt->p_file->gf_ehdr, buf, nbytes);
4976 	return (nbytes);
4977 }
4978 
4979 static int
4980 pt_copy_lwp(lwpstatus_t **lspp, const lwpstatus_t *lsp)
4981 {
4982 	bcopy(lsp, *lspp, sizeof (lwpstatus_t));
4983 	(*lspp)++;
4984 	return (0);
4985 }
4986 
4987 static ssize_t
4988 pt_xd_lwpstatus(mdb_tgt_t *t, void *buf, size_t nbytes)
4989 {
4990 	lwpstatus_t *lsp, *lbuf;
4991 	const pstatus_t *psp;
4992 	int nlwp = 0;
4993 
4994 	if (t->t_pshandle != NULL && (psp = Pstatus(t->t_pshandle)) != NULL)
4995 		nlwp = psp->pr_nlwp;
4996 
4997 	if (buf == NULL && nbytes == 0)
4998 		return (sizeof (lwpstatus_t) * nlwp);
4999 
5000 	if (nlwp == 0)
5001 		return (set_errno(ENODATA));
5002 
5003 	lsp = lbuf = mdb_alloc(sizeof (lwpstatus_t) * nlwp, UM_SLEEP);
5004 	nbytes = MIN(nbytes, sizeof (lwpstatus_t) * nlwp);
5005 
5006 	(void) Plwp_iter(t->t_pshandle, (proc_lwp_f *)pt_copy_lwp, &lsp);
5007 	bcopy(lbuf, buf, nbytes);
5008 
5009 	mdb_free(lbuf, sizeof (lwpstatus_t) * nlwp);
5010 	return (nbytes);
5011 }
5012 
5013 static ssize_t
5014 pt_xd_pshandle(mdb_tgt_t *t, void *buf, size_t nbytes)
5015 {
5016 	if (buf == NULL && nbytes == 0)
5017 		return (sizeof (struct ps_prochandle *));
5018 
5019 	if (t->t_pshandle == NULL || nbytes != sizeof (struct ps_prochandle *))
5020 		return (set_errno(ENODATA));
5021 
5022 	bcopy(&t->t_pshandle, buf, nbytes);
5023 	return (nbytes);
5024 }
5025 
5026 static ssize_t
5027 pt_xd_psinfo(mdb_tgt_t *t, void *buf, size_t nbytes)
5028 {
5029 	const psinfo_t *psp;
5030 
5031 	if (buf == NULL && nbytes == 0)
5032 		return (sizeof (psinfo_t));
5033 
5034 	if (t->t_pshandle == NULL || (psp = Ppsinfo(t->t_pshandle)) == NULL)
5035 		return (set_errno(ENODATA));
5036 
5037 	nbytes = MIN(nbytes, sizeof (psinfo_t));
5038 	bcopy(psp, buf, nbytes);
5039 	return (nbytes);
5040 }
5041 
5042 static ssize_t
5043 pt_xd_pstatus(mdb_tgt_t *t, void *buf, size_t nbytes)
5044 {
5045 	const pstatus_t *psp;
5046 
5047 	if (buf == NULL && nbytes == 0)
5048 		return (sizeof (pstatus_t));
5049 
5050 	if (t->t_pshandle == NULL || (psp = Pstatus(t->t_pshandle)) == NULL)
5051 		return (set_errno(ENODATA));
5052 
5053 	nbytes = MIN(nbytes, sizeof (pstatus_t));
5054 	bcopy(psp, buf, nbytes);
5055 	return (nbytes);
5056 }
5057 
5058 static ssize_t
5059 pt_xd_utsname(mdb_tgt_t *t, void *buf, size_t nbytes)
5060 {
5061 	struct utsname uts;
5062 
5063 	if (buf == NULL && nbytes == 0)
5064 		return (sizeof (struct utsname));
5065 
5066 	if (t->t_pshandle == NULL || Puname(t->t_pshandle, &uts) != 0)
5067 		return (set_errno(ENODATA));
5068 
5069 	nbytes = MIN(nbytes, sizeof (struct utsname));
5070 	bcopy(&uts, buf, nbytes);
5071 	return (nbytes);
5072 }
5073 
5074 int
5075 mdb_proc_tgt_create(mdb_tgt_t *t, int argc, const char *argv[])
5076 {
5077 	pt_data_t *pt = mdb_zalloc(sizeof (pt_data_t), UM_SLEEP);
5078 
5079 	const char *aout_path = argc > 0 ? argv[0] : PT_EXEC_PATH;
5080 	const char *core_path = argc > 1 ? argv[1] : NULL;
5081 
5082 	const mdb_tgt_regdesc_t *rdp;
5083 	char execname[MAXPATHLEN];
5084 	struct stat64 st;
5085 	int perr;
5086 	int state;
5087 	struct rlimit rlim;
5088 	int i;
5089 
5090 	if (argc > 2) {
5091 		mdb_free(pt, sizeof (pt_data_t));
5092 		return (set_errno(EINVAL));
5093 	}
5094 
5095 	if (t->t_flags & MDB_TGT_F_RDWR)
5096 		pt->p_oflags = O_RDWR;
5097 	else
5098 		pt->p_oflags = O_RDONLY;
5099 
5100 	if (t->t_flags & MDB_TGT_F_FORCE)
5101 		pt->p_gflags |= PGRAB_FORCE;
5102 	if (t->t_flags & MDB_TGT_F_NOSTOP)
5103 		pt->p_gflags |= PGRAB_NOSTOP;
5104 
5105 	pt->p_ptl_ops = &proc_lwp_ops;
5106 	pt->p_maxsig = sysconf(_SC_SIGRT_MAX);
5107 
5108 	(void) mdb_nv_create(&pt->p_regs, UM_SLEEP);
5109 	(void) mdb_nv_create(&pt->p_env, UM_SLEEP);
5110 
5111 	t->t_ops = &proc_ops;
5112 	t->t_data = pt;
5113 
5114 	/*
5115 	 * If no core file name was specified, but the file ./core is present,
5116 	 * infer that we want to debug it.  I find this behavior confusing,
5117 	 * so we only do this when precise adb(1) compatibility is required.
5118 	 */
5119 	if (core_path == NULL && (mdb.m_flags & MDB_FL_ADB) &&
5120 	    access(PT_CORE_PATH, F_OK) == 0)
5121 		core_path = PT_CORE_PATH;
5122 
5123 	/*
5124 	 * For compatibility with adb(1), the special name "-" may be used
5125 	 * to suppress the loading of the executable or core file.
5126 	 */
5127 	if (aout_path != NULL && strcmp(aout_path, "-") == 0)
5128 		aout_path = NULL;
5129 	if (core_path != NULL && strcmp(core_path, "-") == 0)
5130 		core_path = NULL;
5131 
5132 	/*
5133 	 * If a core file or pid was specified, attempt to grab it now using
5134 	 * proc_arg_grab(); otherwise we'll create a fresh process later.
5135 	 */
5136 	if (core_path != NULL && (t->t_pshandle = proc_arg_xgrab(core_path,
5137 	    aout_path == PT_EXEC_PATH ? NULL : aout_path, PR_ARG_ANY,
5138 	    pt->p_gflags, &perr, NULL)) == NULL) {
5139 		mdb_warn("cannot debug %s: %s\n", core_path, Pgrab_error(perr));
5140 		goto err;
5141 	}
5142 
5143 	if (aout_path != NULL &&
5144 	    (pt->p_idlehandle = Pgrab_file(aout_path, &perr)) != NULL &&
5145 	    t->t_pshandle == NULL)
5146 		t->t_pshandle = pt->p_idlehandle;
5147 
5148 	if (t->t_pshandle != NULL)
5149 		state = Pstate(t->t_pshandle);
5150 
5151 	/*
5152 	 * Make sure we'll have enough file descriptors to handle a target
5153 	 * has many many mappings.
5154 	 */
5155 	if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) {
5156 		rlim.rlim_cur = rlim.rlim_max;
5157 		(void) setrlimit(RLIMIT_NOFILE, &rlim);
5158 	}
5159 
5160 	/*
5161 	 * If we don't have an executable path or the executable path is the
5162 	 * /proc/<pid>/object/a.out path, but we now have a libproc handle,
5163 	 * attempt to derive the executable path using Pexecname().  We need
5164 	 * to do this in the /proc case in order to open the executable for
5165 	 * writing because /proc/object/<file> permission are masked with 0555.
5166 	 * If Pexecname() fails us, fall back to /proc/<pid>/object/a.out.
5167 	 */
5168 	if (t->t_pshandle != NULL && (aout_path == NULL || (stat64(aout_path,
5169 	    &st) == 0 && strcmp(st.st_fstype, "proc") == 0))) {
5170 		GElf_Sym s;
5171 		aout_path = Pexecname(t->t_pshandle, execname, MAXPATHLEN);
5172 		if (aout_path == NULL && state != PS_DEAD && state != PS_IDLE) {
5173 			(void) mdb_iob_snprintf(execname, sizeof (execname),
5174 			    "/proc/%d/object/a.out",
5175 			    (int)Pstatus(t->t_pshandle)->pr_pid);
5176 			aout_path = execname;
5177 		}
5178 		if (aout_path == NULL &&
5179 		    Plookup_by_name(t->t_pshandle, "a.out", "_start", &s) != 0)
5180 			mdb_warn("warning: failed to infer pathname to "
5181 			    "executable; symbol table will not be available\n");
5182 
5183 		mdb_dprintf(MDB_DBG_TGT, "a.out is %s\n", aout_path);
5184 	}
5185 
5186 	/*
5187 	 * Attempt to open the executable file.  We only want this operation
5188 	 * to actually cause the constructor to abort if the executable file
5189 	 * name was given explicitly.  If we defaulted to PT_EXEC_PATH or
5190 	 * derived the executable using Pexecname, then we want to continue
5191 	 * along with p_fio and p_file set to NULL.
5192 	 */
5193 	if (aout_path != NULL && (pt->p_aout_fio = mdb_fdio_create_path(NULL,
5194 	    aout_path, pt->p_oflags, 0)) == NULL && argc > 0) {
5195 		mdb_warn("failed to open %s", aout_path);
5196 		goto err;
5197 	}
5198 
5199 	/*
5200 	 * Now create an ELF file from the input file, if we have one.  Again,
5201 	 * only abort the constructor if the name was given explicitly.
5202 	 */
5203 	if (pt->p_aout_fio != NULL && pt_open_aout(t,
5204 	    mdb_io_hold(pt->p_aout_fio)) == NULL && argc > 0)
5205 		goto err;
5206 
5207 	/*
5208 	 * If we've successfully opened an ELF file, select the appropriate
5209 	 * disassembler based on the ELF header.
5210 	 */
5211 	if (pt->p_file != NULL)
5212 		(void) mdb_dis_select(pt_disasm(&pt->p_file->gf_ehdr));
5213 	else
5214 		(void) mdb_dis_select(pt_disasm(NULL));
5215 
5216 	/*
5217 	 * Add each register described in the target ISA register description
5218 	 * list to our hash table of register descriptions and then add any
5219 	 * appropriate ISA-specific floating-point register descriptions.
5220 	 */
5221 	for (rdp = pt_regdesc; rdp->rd_name != NULL; rdp++) {
5222 		(void) mdb_nv_insert(&pt->p_regs, rdp->rd_name, NULL,
5223 		    MDB_TGT_R_NVAL(rdp->rd_num, rdp->rd_flags), MDB_NV_RDONLY);
5224 	}
5225 	pt_addfpregs(t);
5226 
5227 	/*
5228 	 * Certain important /proc structures may be of interest to mdb
5229 	 * modules and their dcmds.  Export these using the xdata interface:
5230 	 */
5231 	(void) mdb_tgt_xdata_insert(t, "auxv",
5232 	    "procfs auxv_t array", pt_xd_auxv);
5233 	(void) mdb_tgt_xdata_insert(t, "cred",
5234 	    "procfs prcred_t structure", pt_xd_cred);
5235 	(void) mdb_tgt_xdata_insert(t, "ehdr",
5236 	    "executable file GElf_Ehdr structure", pt_xd_ehdr);
5237 	(void) mdb_tgt_xdata_insert(t, "lwpstatus",
5238 	    "procfs lwpstatus_t array", pt_xd_lwpstatus);
5239 	(void) mdb_tgt_xdata_insert(t, "pshandle",
5240 	    "libproc proc service API handle", pt_xd_pshandle);
5241 	(void) mdb_tgt_xdata_insert(t, "psinfo",
5242 	    "procfs psinfo_t structure", pt_xd_psinfo);
5243 	(void) mdb_tgt_xdata_insert(t, "pstatus",
5244 	    "procfs pstatus_t structure", pt_xd_pstatus);
5245 	(void) mdb_tgt_xdata_insert(t, "utsname",
5246 	    "utsname structure", pt_xd_utsname);
5247 
5248 	/*
5249 	 * Force a status update now so that we fill in t_status with the
5250 	 * latest information based on any successful grab.
5251 	 */
5252 	(void) mdb_tgt_status(t, &t->t_status);
5253 
5254 	/*
5255 	 * If we're not examining a core file, trace SIGINT and all signals
5256 	 * that cause the process to dump core as part of our initialization.
5257 	 */
5258 	if ((t->t_pshandle != NULL && state != PS_DEAD && state != PS_IDLE) ||
5259 	    (pt->p_file != NULL && pt->p_file->gf_ehdr.e_type == ET_EXEC)) {
5260 
5261 		int tflag = MDB_TGT_SPEC_STICKY; /* default sigs are sticky */
5262 
5263 		(void) mdb_tgt_add_signal(t, SIGINT, tflag, no_se_f, NULL);
5264 		(void) mdb_tgt_add_signal(t, SIGQUIT, tflag, no_se_f, NULL);
5265 		(void) mdb_tgt_add_signal(t, SIGILL, tflag, no_se_f, NULL);
5266 		(void) mdb_tgt_add_signal(t, SIGTRAP, tflag, no_se_f, NULL);
5267 		(void) mdb_tgt_add_signal(t, SIGABRT, tflag, no_se_f, NULL);
5268 		(void) mdb_tgt_add_signal(t, SIGEMT, tflag, no_se_f, NULL);
5269 		(void) mdb_tgt_add_signal(t, SIGFPE, tflag, no_se_f, NULL);
5270 		(void) mdb_tgt_add_signal(t, SIGBUS, tflag, no_se_f, NULL);
5271 		(void) mdb_tgt_add_signal(t, SIGSEGV, tflag, no_se_f, NULL);
5272 		(void) mdb_tgt_add_signal(t, SIGSYS, tflag, no_se_f, NULL);
5273 		(void) mdb_tgt_add_signal(t, SIGXCPU, tflag, no_se_f, NULL);
5274 		(void) mdb_tgt_add_signal(t, SIGXFSZ, tflag, no_se_f, NULL);
5275 	}
5276 
5277 	/*
5278 	 * If we've grabbed a live process, establish our initial breakpoints
5279 	 * and librtld_db agent so we can track rtld activity.  If FL_VCREATE
5280 	 * is set, this process was created by a previous instantiation of
5281 	 * the debugger, so reset pr_flags to kill it; otherwise we attached
5282 	 * to an already running process.  Pgrab() has already set the PR_RLC
5283 	 * flag appropriately based on whether the process was stopped when we
5284 	 * attached.
5285 	 */
5286 	if (t->t_pshandle != NULL && state != PS_DEAD && state != PS_IDLE) {
5287 		if (mdb.m_flags & MDB_FL_VCREATE) {
5288 			(void) Punsetflags(t->t_pshandle, PR_RLC);
5289 			(void) Psetflags(t->t_pshandle, PR_KLC);
5290 			pt->p_rflags = PRELEASE_KILL;
5291 		} else {
5292 			(void) Punsetflags(t->t_pshandle, PR_KLC);
5293 		}
5294 		pt_post_attach(t);
5295 	}
5296 
5297 	/*
5298 	 * Initialize a local copy of the environment, which can be modified
5299 	 * before running the program.
5300 	 */
5301 	for (i = 0; mdb.m_env[i] != NULL; i++)
5302 		pt_env_set(pt, mdb.m_env[i]);
5303 
5304 	/*
5305 	 * If adb(1) compatibility mode is on, then print the appropriate
5306 	 * greeting message if we have grabbed a core file.
5307 	 */
5308 	if ((mdb.m_flags & MDB_FL_ADB) && t->t_pshandle != NULL &&
5309 	    state == PS_DEAD) {
5310 		const pstatus_t *psp = Pstatus(t->t_pshandle);
5311 		int cursig = psp->pr_lwp.pr_cursig;
5312 		char signame[SIG2STR_MAX];
5313 
5314 		mdb_printf("core file = %s -- program ``%s'' on platform %s\n",
5315 		    core_path, aout_path ? aout_path : "?", pt_platform(t));
5316 
5317 		if (cursig != 0 && sig2str(cursig, signame) == 0)
5318 			mdb_printf("SIG%s: %s\n", signame, strsignal(cursig));
5319 	}
5320 
5321 	return (0);
5322 
5323 err:
5324 	pt_destroy(t);
5325 	return (-1);
5326 }
5327