1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  *
26  * Portions Copyright 2007 Chad Mynhier
27  */
28 
29 #include <assert.h>
30 #include <stdio.h>
31 #include <stdlib.h>
32 #include <unistd.h>
33 #include <ctype.h>
34 #include <fcntl.h>
35 #include <string.h>
36 #include <strings.h>
37 #include <memory.h>
38 #include <errno.h>
39 #include <dirent.h>
40 #include <limits.h>
41 #include <signal.h>
42 #include <atomic.h>
43 #include <sys/types.h>
44 #include <sys/uio.h>
45 #include <sys/stat.h>
46 #include <sys/resource.h>
47 #include <sys/param.h>
48 #include <sys/stack.h>
49 #include <sys/fault.h>
50 #include <sys/syscall.h>
51 #include <sys/sysmacros.h>
52 
53 #include "libproc.h"
54 #include "Pcontrol.h"
55 #include "Putil.h"
56 #include "P32ton.h"
57 
58 int	_libproc_debug;		/* set non-zero to enable debugging printfs */
59 int	_libproc_no_qsort;	/* set non-zero to inhibit sorting */
60 				/* of symbol tables */
61 int	_libproc_incore_elf;	/* only use in-core elf data */
62 
63 sigset_t blockable_sigs;	/* signals to block when we need to be safe */
64 static	int	minfd;	/* minimum file descriptor returned by dupfd(fd, 0) */
65 char	procfs_path[PATH_MAX] = "/proc";
66 
67 /*
68  * Function prototypes for static routines in this module.
69  */
70 static	void	deadcheck(struct ps_prochandle *);
71 static	void	restore_tracing_flags(struct ps_prochandle *);
72 static	void	Lfree_internal(struct ps_prochandle *, struct ps_lwphandle *);
73 
74 /*
75  * Read/write interface for live processes: just pread/pwrite the
76  * /proc/<pid>/as file:
77  */
78 
79 static ssize_t
80 Pread_live(struct ps_prochandle *P, void *buf, size_t n, uintptr_t addr)
81 {
82 	return (pread(P->asfd, buf, n, (off_t)addr));
83 }
84 
85 static ssize_t
86 Pwrite_live(struct ps_prochandle *P, const void *buf, size_t n, uintptr_t addr)
87 {
88 	return (pwrite(P->asfd, buf, n, (off_t)addr));
89 }
90 
91 static const ps_rwops_t P_live_ops = { Pread_live, Pwrite_live };
92 
93 /*
94  * This is the library's .init handler.
95  */
96 #pragma init(_libproc_init)
97 void
98 _libproc_init(void)
99 {
100 	_libproc_debug = getenv("LIBPROC_DEBUG") != NULL;
101 	_libproc_no_qsort = getenv("LIBPROC_NO_QSORT") != NULL;
102 	_libproc_incore_elf = getenv("LIBPROC_INCORE_ELF") != NULL;
103 
104 	(void) sigfillset(&blockable_sigs);
105 	(void) sigdelset(&blockable_sigs, SIGKILL);
106 	(void) sigdelset(&blockable_sigs, SIGSTOP);
107 }
108 
109 void
110 Pset_procfs_path(const char *path)
111 {
112 	(void) snprintf(procfs_path, sizeof (procfs_path), "%s", path);
113 }
114 
115 /*
116  * Call set_minfd() once before calling dupfd() several times.
117  * We assume that the application will not reduce its current file
118  * descriptor limit lower than 512 once it has set at least that value.
119  */
120 int
121 set_minfd(void)
122 {
123 	static mutex_t minfd_lock = DEFAULTMUTEX;
124 	struct rlimit rlim;
125 	int fd;
126 
127 	if ((fd = minfd) < 256) {
128 		(void) mutex_lock(&minfd_lock);
129 		if ((fd = minfd) < 256) {
130 			if (getrlimit(RLIMIT_NOFILE, &rlim) != 0)
131 				rlim.rlim_cur = rlim.rlim_max = 0;
132 			if (rlim.rlim_cur >= 512)
133 				fd = 256;
134 			else if ((fd = rlim.rlim_cur / 2) < 3)
135 				fd = 3;
136 			membar_producer();
137 			minfd = fd;
138 		}
139 		(void) mutex_unlock(&minfd_lock);
140 	}
141 	return (fd);
142 }
143 
144 int
145 dupfd(int fd, int dfd)
146 {
147 	int mfd;
148 
149 	/*
150 	 * Make fd be greater than 255 (the 32-bit stdio limit),
151 	 * or at least make it greater than 2 so that the
152 	 * program will work when spawned by init(1m).
153 	 * Also, if dfd is non-zero, dup the fd to be dfd.
154 	 */
155 	if ((mfd = minfd) == 0)
156 		mfd = set_minfd();
157 	if (dfd > 0 || (0 <= fd && fd < mfd)) {
158 		if (dfd <= 0)
159 			dfd = mfd;
160 		dfd = fcntl(fd, F_DUPFD, dfd);
161 		(void) close(fd);
162 		fd = dfd;
163 	}
164 	/*
165 	 * Mark it close-on-exec so any created process doesn't inherit it.
166 	 */
167 	if (fd >= 0)
168 		(void) fcntl(fd, F_SETFD, FD_CLOEXEC);
169 	return (fd);
170 }
171 
172 /*
173  * Create a new controlled process.
174  * Leave it stopped on successful exit from exec() or execve().
175  * Return an opaque pointer to its process control structure.
176  * Return NULL if process cannot be created (fork()/exec() not successful).
177  */
178 struct ps_prochandle *
179 Pxcreate(const char *file,	/* executable file name */
180 	char *const *argv,	/* argument vector */
181 	char *const *envp,	/* environment */
182 	int *perr,	/* pointer to error return code */
183 	char *path,	/* if non-null, holds exec path name on return */
184 	size_t len)	/* size of the path buffer */
185 {
186 	char execpath[PATH_MAX];
187 	char procname[PATH_MAX];
188 	struct ps_prochandle *P;
189 	pid_t pid;
190 	int fd;
191 	char *fname;
192 	int rc;
193 	int lasterrno = 0;
194 
195 	if (len == 0)	/* zero length, no path */
196 		path = NULL;
197 	if (path != NULL)
198 		*path = '\0';
199 
200 	if ((P = malloc(sizeof (struct ps_prochandle))) == NULL) {
201 		*perr = C_STRANGE;
202 		return (NULL);
203 	}
204 
205 	if ((pid = fork1()) == -1) {
206 		free(P);
207 		*perr = C_FORK;
208 		return (NULL);
209 	}
210 
211 	if (pid == 0) {			/* child process */
212 		id_t id;
213 		extern char **environ;
214 
215 		/*
216 		 * If running setuid or setgid, reset credentials to normal.
217 		 */
218 		if ((id = getgid()) != getegid())
219 			(void) setgid(id);
220 		if ((id = getuid()) != geteuid())
221 			(void) setuid(id);
222 
223 		Pcreate_callback(P);	/* execute callback (see below) */
224 		(void) pause();		/* wait for PRSABORT from parent */
225 
226 		/*
227 		 * This is ugly.  There is no execvep() function that takes a
228 		 * path and an environment.  We cheat here by replacing the
229 		 * global 'environ' variable right before we call this.
230 		 */
231 		if (envp)
232 			environ = (char **)envp;
233 
234 		(void) execvp(file, argv);  /* execute the program */
235 		_exit(127);
236 	}
237 
238 	/*
239 	 * Initialize the process structure.
240 	 */
241 	(void) memset(P, 0, sizeof (*P));
242 	(void) mutex_init(&P->proc_lock, USYNC_THREAD, NULL);
243 	P->flags |= CREATED;
244 	P->state = PS_RUN;
245 	P->pid = pid;
246 	P->asfd = -1;
247 	P->ctlfd = -1;
248 	P->statfd = -1;
249 	P->agentctlfd = -1;
250 	P->agentstatfd = -1;
251 	P->ops = &P_live_ops;
252 	Pinitsym(P);
253 
254 	/*
255 	 * Open the /proc/pid files.
256 	 */
257 	(void) snprintf(procname, sizeof (procname), "%s/%d/",
258 	    procfs_path, (int)pid);
259 	fname = procname + strlen(procname);
260 	(void) set_minfd();
261 
262 	/*
263 	 * Exclusive write open advises others not to interfere.
264 	 * There is no reason for any of these open()s to fail.
265 	 */
266 	(void) strcpy(fname, "as");
267 	if ((fd = open(procname, (O_RDWR|O_EXCL))) < 0 ||
268 	    (fd = dupfd(fd, 0)) < 0) {
269 		dprintf("Pcreate: failed to open %s: %s\n",
270 		    procname, strerror(errno));
271 		rc = C_STRANGE;
272 		goto bad;
273 	}
274 	P->asfd = fd;
275 
276 	(void) strcpy(fname, "status");
277 	if ((fd = open(procname, O_RDONLY)) < 0 ||
278 	    (fd = dupfd(fd, 0)) < 0) {
279 		dprintf("Pcreate: failed to open %s: %s\n",
280 		    procname, strerror(errno));
281 		rc = C_STRANGE;
282 		goto bad;
283 	}
284 	P->statfd = fd;
285 
286 	(void) strcpy(fname, "ctl");
287 	if ((fd = open(procname, O_WRONLY)) < 0 ||
288 	    (fd = dupfd(fd, 0)) < 0) {
289 		dprintf("Pcreate: failed to open %s: %s\n",
290 		    procname, strerror(errno));
291 		rc = C_STRANGE;
292 		goto bad;
293 	}
294 	P->ctlfd = fd;
295 
296 	(void) Pstop(P, 0);	/* stop the controlled process */
297 
298 	/*
299 	 * Wait for process to sleep in pause().
300 	 * If the process has already called pause(), then it should be
301 	 * stopped (PR_REQUESTED) while asleep in pause and we are done.
302 	 * Else we set up to catch entry/exit to pause() and set the process
303 	 * running again, expecting it to stop when it reaches pause().
304 	 * There is no reason for this to fail other than an interrupt.
305 	 */
306 	(void) Psysentry(P, SYS_pause, 1);
307 	(void) Psysexit(P, SYS_pause, 1);
308 	for (;;) {
309 		if (P->state == PS_STOP &&
310 		    P->status.pr_lwp.pr_syscall == SYS_pause &&
311 		    (P->status.pr_lwp.pr_why == PR_REQUESTED ||
312 		    P->status.pr_lwp.pr_why == PR_SYSENTRY ||
313 		    P->status.pr_lwp.pr_why == PR_SYSEXIT))
314 			break;
315 
316 		if (P->state != PS_STOP ||	/* interrupt or process died */
317 		    Psetrun(P, 0, 0) != 0) {	/* can't restart */
318 			if (errno == EINTR || errno == ERESTART)
319 				rc = C_INTR;
320 			else {
321 				dprintf("Pcreate: Psetrun failed: %s\n",
322 				    strerror(errno));
323 				rc = C_STRANGE;
324 			}
325 			goto bad;
326 		}
327 
328 		(void) Pwait(P, 0);
329 	}
330 	(void) Psysentry(P, SYS_pause, 0);
331 	(void) Psysexit(P, SYS_pause, 0);
332 
333 	/*
334 	 * Kick the process off the pause() and catch
335 	 * it again on entry to exec() or exit().
336 	 */
337 	(void) Psysentry(P, SYS_exit, 1);
338 	(void) Psysentry(P, SYS_execve, 1);
339 	if (Psetrun(P, 0, PRSABORT) == -1) {
340 		dprintf("Pcreate: Psetrun failed: %s\n", strerror(errno));
341 		rc = C_STRANGE;
342 		goto bad;
343 	}
344 	(void) Pwait(P, 0);
345 	if (P->state != PS_STOP) {
346 		dprintf("Pcreate: Pwait failed: %s\n", strerror(errno));
347 		rc = C_STRANGE;
348 		goto bad;
349 	}
350 
351 	/*
352 	 * Move the process through instances of failed exec()s
353 	 * to reach the point of stopped on successful exec().
354 	 */
355 	(void) Psysexit(P, SYS_execve, TRUE);
356 
357 	while (P->state == PS_STOP &&
358 	    P->status.pr_lwp.pr_why == PR_SYSENTRY &&
359 	    P->status.pr_lwp.pr_what == SYS_execve) {
360 		/*
361 		 * Fetch the exec path name now, before we complete
362 		 * the exec().  We may lose the process and be unable
363 		 * to get the information later.
364 		 */
365 		(void) Pread_string(P, execpath, sizeof (execpath),
366 		    (off_t)P->status.pr_lwp.pr_sysarg[0]);
367 		if (path != NULL)
368 			(void) strncpy(path, execpath, len);
369 		/*
370 		 * Set the process running and wait for
371 		 * it to stop on exit from the exec().
372 		 */
373 		(void) Psetrun(P, 0, 0);
374 		(void) Pwait(P, 0);
375 
376 		if (P->state == PS_LOST &&		/* we lost control */
377 		    Preopen(P) != 0) {		/* and we can't get it back */
378 			rc = C_PERM;
379 			goto bad;
380 		}
381 
382 		/*
383 		 * If the exec() failed, continue the loop, expecting
384 		 * there to be more attempts to exec(), based on PATH.
385 		 */
386 		if (P->state == PS_STOP &&
387 		    P->status.pr_lwp.pr_why == PR_SYSEXIT &&
388 		    P->status.pr_lwp.pr_what == SYS_execve &&
389 		    (lasterrno = P->status.pr_lwp.pr_errno) != 0) {
390 			/*
391 			 * The exec() failed.  Set the process running and
392 			 * wait for it to stop on entry to the next exec().
393 			 */
394 			(void) Psetrun(P, 0, 0);
395 			(void) Pwait(P, 0);
396 
397 			continue;
398 		}
399 		break;
400 	}
401 
402 	if (P->state == PS_STOP &&
403 	    P->status.pr_lwp.pr_why == PR_SYSEXIT &&
404 	    P->status.pr_lwp.pr_what == SYS_execve &&
405 	    P->status.pr_lwp.pr_errno == 0) {
406 		/*
407 		 * The process is stopped on successful exec() or execve().
408 		 * Turn off all tracing flags and return success.
409 		 */
410 		restore_tracing_flags(P);
411 #ifndef _LP64
412 		/* We must be a 64-bit process to deal with a 64-bit process */
413 		if (P->status.pr_dmodel == PR_MODEL_LP64) {
414 			rc = C_LP64;
415 			goto bad;
416 		}
417 #endif
418 		/*
419 		 * Set run-on-last-close so the controlled process
420 		 * runs even if we die on a signal.
421 		 */
422 		(void) Psetflags(P, PR_RLC);
423 		*perr = 0;
424 		return (P);
425 	}
426 
427 	rc = lasterrno == ENOENT ? C_NOENT : C_NOEXEC;
428 
429 bad:
430 	(void) kill(pid, SIGKILL);
431 	if (path != NULL && rc != C_PERM && rc != C_LP64)
432 		*path = '\0';
433 	Pfree(P);
434 	*perr = rc;
435 	return (NULL);
436 }
437 
438 struct ps_prochandle *
439 Pcreate(
440 	const char *file,	/* executable file name */
441 	char *const *argv,	/* argument vector */
442 	int *perr,	/* pointer to error return code */
443 	char *path,	/* if non-null, holds exec path name on return */
444 	size_t len)	/* size of the path buffer */
445 {
446 	return (Pxcreate(file, argv, NULL, perr, path, len));
447 }
448 
449 /*
450  * Return a printable string corresponding to a Pcreate() error return.
451  */
452 const char *
453 Pcreate_error(int error)
454 {
455 	const char *str;
456 
457 	switch (error) {
458 	case C_FORK:
459 		str = "cannot fork";
460 		break;
461 	case C_PERM:
462 		str = "file is set-id or unreadable";
463 		break;
464 	case C_NOEXEC:
465 		str = "cannot execute file";
466 		break;
467 	case C_INTR:
468 		str = "operation interrupted";
469 		break;
470 	case C_LP64:
471 		str = "program is _LP64, self is not";
472 		break;
473 	case C_STRANGE:
474 		str = "unanticipated system error";
475 		break;
476 	case C_NOENT:
477 		str = "cannot find executable file";
478 		break;
479 	default:
480 		str = "unknown error";
481 		break;
482 	}
483 
484 	return (str);
485 }
486 
487 /*
488  * Callback to execute in each child process created with Pcreate() after fork
489  * but before it execs the new process image.  By default, we do nothing, but
490  * by calling this function we allow the client program to define its own
491  * version of the function which will interpose on our empty default.  This
492  * may be useful for clients that need to modify signal dispositions, terminal
493  * attributes, or process group and session properties for each new victim.
494  */
495 /*ARGSUSED*/
496 void
497 Pcreate_callback(struct ps_prochandle *P)
498 {
499 	/* nothing to do here */
500 }
501 
502 /*
503  * Grab an existing process.
504  * Return an opaque pointer to its process control structure.
505  *
506  * pid:		UNIX process ID.
507  * flags:
508  *	PGRAB_RETAIN	Retain tracing flags (default clears all tracing flags).
509  *	PGRAB_FORCE	Grab regardless of whether process is already traced.
510  *	PGRAB_RDONLY	Open the address space file O_RDONLY instead of O_RDWR,
511  *                      and do not open the process control file.
512  *	PGRAB_NOSTOP	Open the process but do not force it to stop.
513  * perr:	pointer to error return code.
514  */
515 struct ps_prochandle *
516 Pgrab(pid_t pid, int flags, int *perr)
517 {
518 	struct ps_prochandle *P;
519 	int fd, omode;
520 	char procname[PATH_MAX];
521 	char *fname;
522 	int rc = 0;
523 
524 	/*
525 	 * PGRAB_RDONLY means that we do not open the /proc/<pid>/control file,
526 	 * and so it implies RETAIN and NOSTOP since both require control.
527 	 */
528 	if (flags & PGRAB_RDONLY)
529 		flags |= PGRAB_RETAIN | PGRAB_NOSTOP;
530 
531 	if ((P = malloc(sizeof (struct ps_prochandle))) == NULL) {
532 		*perr = G_STRANGE;
533 		return (NULL);
534 	}
535 
536 	P->asfd = -1;
537 	P->ctlfd = -1;
538 	P->statfd = -1;
539 
540 again:	/* Come back here if we lose it in the Window of Vulnerability */
541 	if (P->ctlfd >= 0)
542 		(void) close(P->ctlfd);
543 	if (P->asfd >= 0)
544 		(void) close(P->asfd);
545 	if (P->statfd >= 0)
546 		(void) close(P->statfd);
547 	(void) memset(P, 0, sizeof (*P));
548 	(void) mutex_init(&P->proc_lock, USYNC_THREAD, NULL);
549 	P->ctlfd = -1;
550 	P->asfd = -1;
551 	P->statfd = -1;
552 	P->agentctlfd = -1;
553 	P->agentstatfd = -1;
554 	P->ops = &P_live_ops;
555 	Pinitsym(P);
556 
557 	/*
558 	 * Open the /proc/pid files
559 	 */
560 	(void) snprintf(procname, sizeof (procname), "%s/%d/",
561 	    procfs_path, (int)pid);
562 	fname = procname + strlen(procname);
563 	(void) set_minfd();
564 
565 	/*
566 	 * Request exclusive open to avoid grabbing someone else's
567 	 * process and to prevent others from interfering afterwards.
568 	 * If this fails and the 'PGRAB_FORCE' flag is set, attempt to
569 	 * open non-exclusively.
570 	 */
571 	(void) strcpy(fname, "as");
572 	omode = (flags & PGRAB_RDONLY) ? O_RDONLY : O_RDWR;
573 
574 	if (((fd = open(procname, omode | O_EXCL)) < 0 &&
575 	    (fd = ((flags & PGRAB_FORCE)? open(procname, omode) : -1)) < 0) ||
576 	    (fd = dupfd(fd, 0)) < 0) {
577 		switch (errno) {
578 		case ENOENT:
579 			rc = G_NOPROC;
580 			break;
581 		case EACCES:
582 		case EPERM:
583 			rc = G_PERM;
584 			break;
585 		case EMFILE:
586 			rc = G_NOFD;
587 			break;
588 		case EBUSY:
589 			if (!(flags & PGRAB_FORCE) || geteuid() != 0) {
590 				rc = G_BUSY;
591 				break;
592 			}
593 			/* FALLTHROUGH */
594 		default:
595 			dprintf("Pgrab: failed to open %s: %s\n",
596 			    procname, strerror(errno));
597 			rc = G_STRANGE;
598 			break;
599 		}
600 		goto err;
601 	}
602 	P->asfd = fd;
603 
604 	(void) strcpy(fname, "status");
605 	if ((fd = open(procname, O_RDONLY)) < 0 ||
606 	    (fd = dupfd(fd, 0)) < 0) {
607 		switch (errno) {
608 		case ENOENT:
609 			rc = G_NOPROC;
610 			break;
611 		case EMFILE:
612 			rc = G_NOFD;
613 			break;
614 		default:
615 			dprintf("Pgrab: failed to open %s: %s\n",
616 			    procname, strerror(errno));
617 			rc = G_STRANGE;
618 			break;
619 		}
620 		goto err;
621 	}
622 	P->statfd = fd;
623 
624 	if (!(flags & PGRAB_RDONLY)) {
625 		(void) strcpy(fname, "ctl");
626 		if ((fd = open(procname, O_WRONLY)) < 0 ||
627 		    (fd = dupfd(fd, 0)) < 0) {
628 			switch (errno) {
629 			case ENOENT:
630 				rc = G_NOPROC;
631 				break;
632 			case EMFILE:
633 				rc = G_NOFD;
634 				break;
635 			default:
636 				dprintf("Pgrab: failed to open %s: %s\n",
637 				    procname, strerror(errno));
638 				rc = G_STRANGE;
639 				break;
640 			}
641 			goto err;
642 		}
643 		P->ctlfd = fd;
644 	}
645 
646 	P->state = PS_RUN;
647 	P->pid = pid;
648 
649 	/*
650 	 * We are now in the Window of Vulnerability (WoV).  The process may
651 	 * exec() a setuid/setgid or unreadable object file between the open()
652 	 * and the PCSTOP.  We will get EAGAIN in this case and must start over.
653 	 * As Pstopstatus will trigger the first read() from a /proc file,
654 	 * we also need to handle EOVERFLOW here when 32-bit as an indicator
655 	 * that this process is 64-bit.  Finally, if the process has become
656 	 * a zombie (PS_UNDEAD) while we were trying to grab it, just remain
657 	 * silent about this and pretend there was no process.
658 	 */
659 	if (Pstopstatus(P, PCNULL, 0) != 0) {
660 #ifndef _LP64
661 		if (errno == EOVERFLOW) {
662 			rc = G_LP64;
663 			goto err;
664 		}
665 #endif
666 		if (P->state == PS_LOST) {	/* WoV */
667 			(void) mutex_destroy(&P->proc_lock);
668 			goto again;
669 		}
670 
671 		if (P->state == PS_UNDEAD)
672 			rc = G_NOPROC;
673 		else
674 			rc = G_STRANGE;
675 
676 		goto err;
677 	}
678 
679 	/*
680 	 * If the process is a system process, we can't control it even as root
681 	 */
682 	if (P->status.pr_flags & PR_ISSYS) {
683 		rc = G_SYS;
684 		goto err;
685 	}
686 #ifndef _LP64
687 	/*
688 	 * We must be a 64-bit process to deal with a 64-bit process
689 	 */
690 	if (P->status.pr_dmodel == PR_MODEL_LP64) {
691 		rc = G_LP64;
692 		goto err;
693 	}
694 #endif
695 
696 	/*
697 	 * Remember the status for use by Prelease().
698 	 */
699 	P->orig_status = P->status;	/* structure copy */
700 
701 	/*
702 	 * Before stopping the process, make sure we are not grabbing ourselves.
703 	 * If we are, make sure we are doing it PGRAB_RDONLY.
704 	 */
705 	if (pid == getpid()) {
706 		/*
707 		 * Verify that the process is really ourself:
708 		 * Set a magic number, read it through the
709 		 * /proc file and see if the results match.
710 		 */
711 		uint32_t magic1 = 0;
712 		uint32_t magic2 = 2;
713 
714 		errno = 0;
715 
716 		if (Pread(P, &magic2, sizeof (magic2), (uintptr_t)&magic1)
717 		    == sizeof (magic2) &&
718 		    magic2 == 0 &&
719 		    (magic1 = 0xfeedbeef) &&
720 		    Pread(P, &magic2, sizeof (magic2), (uintptr_t)&magic1)
721 		    == sizeof (magic2) &&
722 		    magic2 == 0xfeedbeef &&
723 		    !(flags & PGRAB_RDONLY)) {
724 			rc = G_SELF;
725 			goto err;
726 		}
727 	}
728 
729 	/*
730 	 * If the process is already stopped or has been directed
731 	 * to stop via /proc, do not set run-on-last-close.
732 	 */
733 	if (!(P->status.pr_lwp.pr_flags & (PR_ISTOP|PR_DSTOP)) &&
734 	    !(flags & PGRAB_RDONLY)) {
735 		/*
736 		 * Mark the process run-on-last-close so
737 		 * it runs even if we die from SIGKILL.
738 		 */
739 		if (Psetflags(P, PR_RLC) != 0) {
740 			if (errno == EAGAIN) {	/* WoV */
741 				(void) mutex_destroy(&P->proc_lock);
742 				goto again;
743 			}
744 			if (errno == ENOENT)	/* No complaint about zombies */
745 				rc = G_ZOMB;
746 			else {
747 				dprintf("Pgrab: failed to set RLC\n");
748 				rc = G_STRANGE;
749 			}
750 			goto err;
751 		}
752 	}
753 
754 	/*
755 	 * If a stop directive is pending and the process has not yet stopped,
756 	 * then synchronously wait for the stop directive to take effect.
757 	 * Limit the time spent waiting for the process to stop by iterating
758 	 * at most 10 times. The time-out of 20 ms corresponds to the time
759 	 * between sending the stop directive and the process actually stopped
760 	 * as measured by DTrace on a slow, busy system. If the process doesn't
761 	 * stop voluntarily, clear the PR_DSTOP flag so that the code below
762 	 * forces the process to stop.
763 	 */
764 	if (!(flags & PGRAB_RDONLY)) {
765 		int niter = 0;
766 		while ((P->status.pr_lwp.pr_flags & (PR_STOPPED|PR_DSTOP)) ==
767 		    PR_DSTOP && niter < 10 &&
768 		    Pstopstatus(P, PCTWSTOP, 20) != 0) {
769 			niter++;
770 			if (flags & PGRAB_NOSTOP)
771 				break;
772 		}
773 		if (niter == 10 && !(flags & PGRAB_NOSTOP)) {
774 			/* Try it harder down below */
775 			P->status.pr_lwp.pr_flags &= ~PR_DSTOP;
776 		}
777 	}
778 
779 	/*
780 	 * If the process is not already stopped or directed to stop
781 	 * and PGRAB_NOSTOP was not specified, stop the process now.
782 	 */
783 	if (!(P->status.pr_lwp.pr_flags & (PR_ISTOP|PR_DSTOP)) &&
784 	    !(flags & PGRAB_NOSTOP)) {
785 		/*
786 		 * Stop the process, get its status and signal/syscall masks.
787 		 */
788 		if (((P->status.pr_lwp.pr_flags & PR_STOPPED) &&
789 		    Pstopstatus(P, PCDSTOP, 0) != 0) ||
790 		    Pstopstatus(P, PCSTOP, 2000) != 0) {
791 #ifndef _LP64
792 			if (errno == EOVERFLOW) {
793 				rc = G_LP64;
794 				goto err;
795 			}
796 #endif
797 			if (P->state == PS_LOST) {	/* WoV */
798 				(void) mutex_destroy(&P->proc_lock);
799 				goto again;
800 			}
801 			if ((errno != EINTR && errno != ERESTART) ||
802 			    (P->state != PS_STOP &&
803 			    !(P->status.pr_flags & PR_DSTOP))) {
804 				if (P->state != PS_RUN && errno != ENOENT) {
805 					dprintf("Pgrab: failed to PCSTOP\n");
806 					rc = G_STRANGE;
807 				} else {
808 					rc = G_ZOMB;
809 				}
810 				goto err;
811 			}
812 		}
813 
814 		/*
815 		 * Process should now either be stopped via /proc or there
816 		 * should be an outstanding stop directive.
817 		 */
818 		if (!(P->status.pr_flags & (PR_ISTOP|PR_DSTOP))) {
819 			dprintf("Pgrab: process is not stopped\n");
820 			rc = G_STRANGE;
821 			goto err;
822 		}
823 #ifndef _LP64
824 		/*
825 		 * Test this again now because the 32-bit victim process may
826 		 * have exec'd a 64-bit process in the meantime.
827 		 */
828 		if (P->status.pr_dmodel == PR_MODEL_LP64) {
829 			rc = G_LP64;
830 			goto err;
831 		}
832 #endif
833 	}
834 
835 	/*
836 	 * Cancel all tracing flags unless the PGRAB_RETAIN flag is set.
837 	 */
838 	if (!(flags & PGRAB_RETAIN)) {
839 		(void) Psysentry(P, 0, FALSE);
840 		(void) Psysexit(P, 0, FALSE);
841 		(void) Psignal(P, 0, FALSE);
842 		(void) Pfault(P, 0, FALSE);
843 		Psync(P);
844 	}
845 
846 	*perr = 0;
847 	return (P);
848 
849 err:
850 	Pfree(P);
851 	*perr = rc;
852 	return (NULL);
853 }
854 
855 /*
856  * Return a printable string corresponding to a Pgrab() error return.
857  */
858 const char *
859 Pgrab_error(int error)
860 {
861 	const char *str;
862 
863 	switch (error) {
864 	case G_NOPROC:
865 		str = "no such process";
866 		break;
867 	case G_NOCORE:
868 		str = "no such core file";
869 		break;
870 	case G_NOPROCORCORE:
871 		str = "no such process or core file";
872 		break;
873 	case G_NOEXEC:
874 		str = "cannot find executable file";
875 		break;
876 	case G_ZOMB:
877 		str = "zombie process";
878 		break;
879 	case G_PERM:
880 		str = "permission denied";
881 		break;
882 	case G_BUSY:
883 		str = "process is traced";
884 		break;
885 	case G_SYS:
886 		str = "system process";
887 		break;
888 	case G_SELF:
889 		str = "attempt to grab self";
890 		break;
891 	case G_INTR:
892 		str = "operation interrupted";
893 		break;
894 	case G_LP64:
895 		str = "program is _LP64, self is not";
896 		break;
897 	case G_FORMAT:
898 		str = "file is not an ELF core file";
899 		break;
900 	case G_ELF:
901 		str = "libelf error";
902 		break;
903 	case G_NOTE:
904 		str = "core file is corrupt or missing required data";
905 		break;
906 	case G_STRANGE:
907 		str = "unanticipated system error";
908 		break;
909 	case G_ISAINVAL:
910 		str = "wrong ELF machine type";
911 		break;
912 	case G_BADLWPS:
913 		str = "bad lwp specification";
914 		break;
915 	case G_NOFD:
916 		str = "too many open files";
917 		break;
918 	default:
919 		str = "unknown error";
920 		break;
921 	}
922 
923 	return (str);
924 }
925 
926 /*
927  * Free a process control structure.
928  * Close the file descriptors but don't do the Prelease logic.
929  */
930 void
931 Pfree(struct ps_prochandle *P)
932 {
933 	uint_t i;
934 
935 	if (P->core != NULL) {
936 		extern void __priv_free_info(void *);
937 		lwp_info_t *nlwp, *lwp = list_next(&P->core->core_lwp_head);
938 
939 		for (i = 0; i < P->core->core_nlwp; i++, lwp = nlwp) {
940 			nlwp = list_next(lwp);
941 #ifdef __sparc
942 			if (lwp->lwp_gwins != NULL)
943 				free(lwp->lwp_gwins);
944 			if (lwp->lwp_xregs != NULL)
945 				free(lwp->lwp_xregs);
946 			if (lwp->lwp_asrs != NULL)
947 				free(lwp->lwp_asrs);
948 #endif
949 			free(lwp);
950 		}
951 
952 		if (P->core->core_platform != NULL)
953 			free(P->core->core_platform);
954 		if (P->core->core_uts != NULL)
955 			free(P->core->core_uts);
956 		if (P->core->core_cred != NULL)
957 			free(P->core->core_cred);
958 		if (P->core->core_priv != NULL)
959 			free(P->core->core_priv);
960 		if (P->core->core_privinfo != NULL)
961 			__priv_free_info(P->core->core_privinfo);
962 		if (P->core->core_ppii != NULL)
963 			free(P->core->core_ppii);
964 		if (P->core->core_zonename != NULL)
965 			free(P->core->core_zonename);
966 #if defined(__i386) || defined(__amd64)
967 		if (P->core->core_ldt != NULL)
968 			free(P->core->core_ldt);
969 #endif
970 
971 		free(P->core);
972 	}
973 
974 	if (P->ucaddrs != NULL) {
975 		free(P->ucaddrs);
976 		P->ucaddrs = NULL;
977 		P->ucnelems = 0;
978 	}
979 
980 	(void) mutex_lock(&P->proc_lock);
981 	if (P->hashtab != NULL) {
982 		struct ps_lwphandle *L;
983 		for (i = 0; i < HASHSIZE; i++) {
984 			while ((L = P->hashtab[i]) != NULL)
985 				Lfree_internal(P, L);
986 		}
987 		free(P->hashtab);
988 	}
989 	(void) mutex_unlock(&P->proc_lock);
990 	(void) mutex_destroy(&P->proc_lock);
991 
992 	if (P->agentctlfd >= 0)
993 		(void) close(P->agentctlfd);
994 	if (P->agentstatfd >= 0)
995 		(void) close(P->agentstatfd);
996 	if (P->ctlfd >= 0)
997 		(void) close(P->ctlfd);
998 	if (P->asfd >= 0)
999 		(void) close(P->asfd);
1000 	if (P->statfd >= 0)
1001 		(void) close(P->statfd);
1002 	Preset_maps(P);
1003 
1004 	/* clear out the structure as a precaution against reuse */
1005 	(void) memset(P, 0, sizeof (*P));
1006 	P->ctlfd = -1;
1007 	P->asfd = -1;
1008 	P->statfd = -1;
1009 	P->agentctlfd = -1;
1010 	P->agentstatfd = -1;
1011 
1012 	free(P);
1013 }
1014 
1015 /*
1016  * Return the state of the process, one of the PS_* values.
1017  */
1018 int
1019 Pstate(struct ps_prochandle *P)
1020 {
1021 	return (P->state);
1022 }
1023 
1024 /*
1025  * Return the open address space file descriptor for the process.
1026  * Clients must not close this file descriptor, not use it
1027  * after the process is freed.
1028  */
1029 int
1030 Pasfd(struct ps_prochandle *P)
1031 {
1032 	return (P->asfd);
1033 }
1034 
1035 /*
1036  * Return the open control file descriptor for the process.
1037  * Clients must not close this file descriptor, not use it
1038  * after the process is freed.
1039  */
1040 int
1041 Pctlfd(struct ps_prochandle *P)
1042 {
1043 	return (P->ctlfd);
1044 }
1045 
1046 /*
1047  * Return a pointer to the process psinfo structure.
1048  * Clients should not hold on to this pointer indefinitely.
1049  * It will become invalid on Prelease().
1050  */
1051 const psinfo_t *
1052 Ppsinfo(struct ps_prochandle *P)
1053 {
1054 	if (P->state == PS_IDLE) {
1055 		errno = ENODATA;
1056 		return (NULL);
1057 	}
1058 
1059 	if (P->state != PS_DEAD && proc_get_psinfo(P->pid, &P->psinfo) == -1)
1060 		return (NULL);
1061 
1062 	return (&P->psinfo);
1063 }
1064 
1065 /*
1066  * Return a pointer to the process status structure.
1067  * Clients should not hold on to this pointer indefinitely.
1068  * It will become invalid on Prelease().
1069  */
1070 const pstatus_t *
1071 Pstatus(struct ps_prochandle *P)
1072 {
1073 	return (&P->status);
1074 }
1075 
1076 /*
1077  * Fill in a pointer to a process credentials structure.  The ngroups parameter
1078  * is the number of supplementary group entries allocated in the caller's cred
1079  * structure.  It should equal zero or one unless extra space has been
1080  * allocated for the group list by the caller.
1081  */
1082 int
1083 Pcred(struct ps_prochandle *P, prcred_t *pcrp, int ngroups)
1084 {
1085 	if (P->state == PS_IDLE) {
1086 		errno = ENODATA;
1087 		return (-1);
1088 	}
1089 
1090 	if (P->state != PS_DEAD)
1091 		return (proc_get_cred(P->pid, pcrp, ngroups));
1092 
1093 	if (P->core->core_cred != NULL) {
1094 		/*
1095 		 * Avoid returning more supplementary group data than the
1096 		 * caller has allocated in their buffer.  We expect them to
1097 		 * check pr_ngroups afterward and potentially call us again.
1098 		 */
1099 		ngroups = MIN(ngroups, P->core->core_cred->pr_ngroups);
1100 
1101 		(void) memcpy(pcrp, P->core->core_cred,
1102 		    sizeof (prcred_t) + (ngroups - 1) * sizeof (gid_t));
1103 
1104 		return (0);
1105 	}
1106 
1107 	errno = ENODATA;
1108 	return (-1);
1109 }
1110 
1111 #if defined(__i386) || defined(__amd64)
1112 /*
1113  * Fill in a pointer to a process LDT structure.
1114  * The caller provides a buffer of size 'nldt * sizeof (struct ssd)';
1115  * If pldt == NULL or nldt == 0, we return the number of existing LDT entries.
1116  * Otherwise we return the actual number of LDT entries fetched (<= nldt).
1117  */
1118 int
1119 Pldt(struct ps_prochandle *P, struct ssd *pldt, int nldt)
1120 {
1121 	if (P->state == PS_IDLE) {
1122 		errno = ENODATA;
1123 		return (-1);
1124 	}
1125 
1126 	if (P->state != PS_DEAD)
1127 		return (proc_get_ldt(P->pid, pldt, nldt));
1128 
1129 	if (pldt == NULL || nldt == 0)
1130 		return (P->core->core_nldt);
1131 
1132 	if (P->core->core_ldt != NULL) {
1133 		nldt = MIN(nldt, P->core->core_nldt);
1134 
1135 		(void) memcpy(pldt, P->core->core_ldt,
1136 		    nldt * sizeof (struct ssd));
1137 
1138 		return (nldt);
1139 	}
1140 
1141 	errno = ENODATA;
1142 	return (-1);
1143 }
1144 #endif	/* __i386 */
1145 
1146 /*
1147  * Fill in a pointer to a process privilege structure.
1148  */
1149 ssize_t
1150 Ppriv(struct ps_prochandle *P, prpriv_t *pprv, size_t size)
1151 {
1152 	if (P->state != PS_DEAD) {
1153 		prpriv_t *pp = proc_get_priv(P->pid);
1154 		if (pp != NULL) {
1155 			size = MIN(size, PRIV_PRPRIV_SIZE(pp));
1156 			(void) memcpy(pprv, pp, size);
1157 			free(pp);
1158 			return (size);
1159 		}
1160 		return (-1);
1161 	}
1162 
1163 	if (P->core->core_priv != NULL) {
1164 		size = MIN(P->core->core_priv_size, size);
1165 		(void) memcpy(pprv, P->core->core_priv, size);
1166 		return (size);
1167 	}
1168 	errno = ENODATA;
1169 	return (-1);
1170 }
1171 
1172 int
1173 Psetpriv(struct ps_prochandle *P, prpriv_t *pprv)
1174 {
1175 	int rc;
1176 	long *ctl;
1177 	size_t sz;
1178 
1179 	if (P->state == PS_DEAD) {
1180 		errno = EBADF;
1181 		return (-1);
1182 	}
1183 
1184 	sz = PRIV_PRPRIV_SIZE(pprv) + sizeof (long);
1185 
1186 	sz = ((sz - 1) / sizeof (long) + 1) * sizeof (long);
1187 
1188 	ctl = malloc(sz);
1189 	if (ctl == NULL)
1190 		return (-1);
1191 
1192 	ctl[0] = PCSPRIV;
1193 
1194 	(void) memcpy(&ctl[1], pprv, PRIV_PRPRIV_SIZE(pprv));
1195 
1196 	if (write(P->ctlfd, ctl, sz) != sz)
1197 		rc = -1;
1198 	else
1199 		rc = 0;
1200 
1201 	free(ctl);
1202 
1203 	return (rc);
1204 }
1205 
1206 void *
1207 Pprivinfo(struct ps_prochandle *P)
1208 {
1209 	/* Use default from libc */
1210 	if (P->state != PS_DEAD)
1211 		return (NULL);
1212 
1213 	return (P->core->core_privinfo);
1214 }
1215 
1216 /*
1217  * Ensure that all cached state is written to the process.
1218  * The cached state is the LWP's signal mask and registers
1219  * and the process's tracing flags.
1220  */
1221 void
1222 Psync(struct ps_prochandle *P)
1223 {
1224 	int ctlfd = (P->agentctlfd >= 0)? P->agentctlfd : P->ctlfd;
1225 	long cmd[6];
1226 	iovec_t iov[12];
1227 	int n = 0;
1228 
1229 	if (P->flags & SETHOLD) {
1230 		cmd[0] = PCSHOLD;
1231 		iov[n].iov_base = (caddr_t)&cmd[0];
1232 		iov[n++].iov_len = sizeof (long);
1233 		iov[n].iov_base = (caddr_t)&P->status.pr_lwp.pr_lwphold;
1234 		iov[n++].iov_len = sizeof (P->status.pr_lwp.pr_lwphold);
1235 	}
1236 	if (P->flags & SETREGS) {
1237 		cmd[1] = PCSREG;
1238 #ifdef __i386
1239 		/* XX64 we should probably restore REG_GS after this */
1240 		if (ctlfd == P->agentctlfd)
1241 			P->status.pr_lwp.pr_reg[GS] = 0;
1242 #elif defined(__amd64)
1243 		/* XX64 */
1244 #endif
1245 		iov[n].iov_base = (caddr_t)&cmd[1];
1246 		iov[n++].iov_len = sizeof (long);
1247 		iov[n].iov_base = (caddr_t)&P->status.pr_lwp.pr_reg[0];
1248 		iov[n++].iov_len = sizeof (P->status.pr_lwp.pr_reg);
1249 	}
1250 	if (P->flags & SETSIG) {
1251 		cmd[2] = PCSTRACE;
1252 		iov[n].iov_base = (caddr_t)&cmd[2];
1253 		iov[n++].iov_len = sizeof (long);
1254 		iov[n].iov_base = (caddr_t)&P->status.pr_sigtrace;
1255 		iov[n++].iov_len = sizeof (P->status.pr_sigtrace);
1256 	}
1257 	if (P->flags & SETFAULT) {
1258 		cmd[3] = PCSFAULT;
1259 		iov[n].iov_base = (caddr_t)&cmd[3];
1260 		iov[n++].iov_len = sizeof (long);
1261 		iov[n].iov_base = (caddr_t)&P->status.pr_flttrace;
1262 		iov[n++].iov_len = sizeof (P->status.pr_flttrace);
1263 	}
1264 	if (P->flags & SETENTRY) {
1265 		cmd[4] = PCSENTRY;
1266 		iov[n].iov_base = (caddr_t)&cmd[4];
1267 		iov[n++].iov_len = sizeof (long);
1268 		iov[n].iov_base = (caddr_t)&P->status.pr_sysentry;
1269 		iov[n++].iov_len = sizeof (P->status.pr_sysentry);
1270 	}
1271 	if (P->flags & SETEXIT) {
1272 		cmd[5] = PCSEXIT;
1273 		iov[n].iov_base = (caddr_t)&cmd[5];
1274 		iov[n++].iov_len = sizeof (long);
1275 		iov[n].iov_base = (caddr_t)&P->status.pr_sysexit;
1276 		iov[n++].iov_len = sizeof (P->status.pr_sysexit);
1277 	}
1278 
1279 	if (n == 0 || writev(ctlfd, iov, n) < 0)
1280 		return;		/* nothing to do or write failed */
1281 
1282 	P->flags &= ~(SETSIG|SETFAULT|SETENTRY|SETEXIT|SETHOLD|SETREGS);
1283 }
1284 
1285 /*
1286  * Reopen the /proc file (after PS_LOST).
1287  */
1288 int
1289 Preopen(struct ps_prochandle *P)
1290 {
1291 	int fd;
1292 	char procname[PATH_MAX];
1293 	char *fname;
1294 
1295 	if (P->state == PS_DEAD || P->state == PS_IDLE)
1296 		return (0);
1297 
1298 	if (P->agentcnt > 0) {
1299 		P->agentcnt = 1;
1300 		Pdestroy_agent(P);
1301 	}
1302 
1303 	(void) snprintf(procname, sizeof (procname), "%s/%d/",
1304 	    procfs_path, (int)P->pid);
1305 	fname = procname + strlen(procname);
1306 
1307 	(void) strcpy(fname, "as");
1308 	if ((fd = open(procname, O_RDWR)) < 0 ||
1309 	    close(P->asfd) < 0 ||
1310 	    (fd = dupfd(fd, P->asfd)) != P->asfd) {
1311 		dprintf("Preopen: failed to open %s: %s\n",
1312 		    procname, strerror(errno));
1313 		if (fd >= 0)
1314 			(void) close(fd);
1315 		return (-1);
1316 	}
1317 	P->asfd = fd;
1318 
1319 	(void) strcpy(fname, "status");
1320 	if ((fd = open(procname, O_RDONLY)) < 0 ||
1321 	    close(P->statfd) < 0 ||
1322 	    (fd = dupfd(fd, P->statfd)) != P->statfd) {
1323 		dprintf("Preopen: failed to open %s: %s\n",
1324 		    procname, strerror(errno));
1325 		if (fd >= 0)
1326 			(void) close(fd);
1327 		return (-1);
1328 	}
1329 	P->statfd = fd;
1330 
1331 	(void) strcpy(fname, "ctl");
1332 	if ((fd = open(procname, O_WRONLY)) < 0 ||
1333 	    close(P->ctlfd) < 0 ||
1334 	    (fd = dupfd(fd, P->ctlfd)) != P->ctlfd) {
1335 		dprintf("Preopen: failed to open %s: %s\n",
1336 		    procname, strerror(errno));
1337 		if (fd >= 0)
1338 			(void) close(fd);
1339 		return (-1);
1340 	}
1341 	P->ctlfd = fd;
1342 
1343 	/*
1344 	 * Set the state to PS_RUN and wait for the process to stop so that
1345 	 * we re-read the status from the new P->statfd.  If this fails, Pwait
1346 	 * will reset the state to PS_LOST and we fail the reopen.  Before
1347 	 * returning, we also forge a bit of P->status to allow the debugger to
1348 	 * see that we are PS_LOST following a successful exec.
1349 	 */
1350 	P->state = PS_RUN;
1351 	if (Pwait(P, 0) == -1) {
1352 #ifdef _ILP32
1353 		if (errno == EOVERFLOW)
1354 			P->status.pr_dmodel = PR_MODEL_LP64;
1355 #endif
1356 		P->status.pr_lwp.pr_why = PR_SYSEXIT;
1357 		P->status.pr_lwp.pr_what = SYS_execve;
1358 		P->status.pr_lwp.pr_errno = 0;
1359 		return (-1);
1360 	}
1361 
1362 	/*
1363 	 * The process should be stopped on exec (REQUESTED)
1364 	 * or else should be stopped on exit from exec() (SYSEXIT)
1365 	 */
1366 	if (P->state == PS_STOP &&
1367 	    (P->status.pr_lwp.pr_why == PR_REQUESTED ||
1368 	    (P->status.pr_lwp.pr_why == PR_SYSEXIT &&
1369 	    P->status.pr_lwp.pr_what == SYS_execve))) {
1370 		/* fake up stop-on-exit-from-execve */
1371 		if (P->status.pr_lwp.pr_why == PR_REQUESTED) {
1372 			P->status.pr_lwp.pr_why = PR_SYSEXIT;
1373 			P->status.pr_lwp.pr_what = SYS_execve;
1374 			P->status.pr_lwp.pr_errno = 0;
1375 		}
1376 	} else {
1377 		dprintf("Preopen: expected REQUESTED or "
1378 		    "SYSEXIT(SYS_execve) stop\n");
1379 	}
1380 
1381 	return (0);
1382 }
1383 
1384 /*
1385  * Define all settable flags other than the microstate accounting flags.
1386  */
1387 #define	ALL_SETTABLE_FLAGS (PR_FORK|PR_RLC|PR_KLC|PR_ASYNC|PR_BPTADJ|PR_PTRACE)
1388 
1389 /*
1390  * Restore /proc tracing flags to their original values
1391  * in preparation for releasing the process.
1392  * Also called by Pcreate() to clear all tracing flags.
1393  */
1394 static void
1395 restore_tracing_flags(struct ps_prochandle *P)
1396 {
1397 	long flags;
1398 	long cmd[4];
1399 	iovec_t iov[8];
1400 
1401 	if (P->flags & CREATED) {
1402 		/* we created this process; clear all tracing flags */
1403 		premptyset(&P->status.pr_sigtrace);
1404 		premptyset(&P->status.pr_flttrace);
1405 		premptyset(&P->status.pr_sysentry);
1406 		premptyset(&P->status.pr_sysexit);
1407 		if ((P->status.pr_flags & ALL_SETTABLE_FLAGS) != 0)
1408 			(void) Punsetflags(P, ALL_SETTABLE_FLAGS);
1409 	} else {
1410 		/* we grabbed the process; restore its tracing flags */
1411 		P->status.pr_sigtrace = P->orig_status.pr_sigtrace;
1412 		P->status.pr_flttrace = P->orig_status.pr_flttrace;
1413 		P->status.pr_sysentry = P->orig_status.pr_sysentry;
1414 		P->status.pr_sysexit  = P->orig_status.pr_sysexit;
1415 		if ((P->status.pr_flags & ALL_SETTABLE_FLAGS) !=
1416 		    (flags = (P->orig_status.pr_flags & ALL_SETTABLE_FLAGS))) {
1417 			(void) Punsetflags(P, ALL_SETTABLE_FLAGS);
1418 			if (flags)
1419 				(void) Psetflags(P, flags);
1420 		}
1421 	}
1422 
1423 	cmd[0] = PCSTRACE;
1424 	iov[0].iov_base = (caddr_t)&cmd[0];
1425 	iov[0].iov_len = sizeof (long);
1426 	iov[1].iov_base = (caddr_t)&P->status.pr_sigtrace;
1427 	iov[1].iov_len = sizeof (P->status.pr_sigtrace);
1428 
1429 	cmd[1] = PCSFAULT;
1430 	iov[2].iov_base = (caddr_t)&cmd[1];
1431 	iov[2].iov_len = sizeof (long);
1432 	iov[3].iov_base = (caddr_t)&P->status.pr_flttrace;
1433 	iov[3].iov_len = sizeof (P->status.pr_flttrace);
1434 
1435 	cmd[2] = PCSENTRY;
1436 	iov[4].iov_base = (caddr_t)&cmd[2];
1437 	iov[4].iov_len = sizeof (long);
1438 	iov[5].iov_base = (caddr_t)&P->status.pr_sysentry;
1439 	iov[5].iov_len = sizeof (P->status.pr_sysentry);
1440 
1441 	cmd[3] = PCSEXIT;
1442 	iov[6].iov_base = (caddr_t)&cmd[3];
1443 	iov[6].iov_len = sizeof (long);
1444 	iov[7].iov_base = (caddr_t)&P->status.pr_sysexit;
1445 	iov[7].iov_len = sizeof (P->status.pr_sysexit);
1446 
1447 	(void) writev(P->ctlfd, iov, 8);
1448 
1449 	P->flags &= ~(SETSIG|SETFAULT|SETENTRY|SETEXIT);
1450 }
1451 
1452 /*
1453  * Release the process.  Frees the process control structure.
1454  * flags:
1455  *	PRELEASE_CLEAR	Clear all tracing flags.
1456  *	PRELEASE_RETAIN	Retain current tracing flags.
1457  *	PRELEASE_HANG	Leave the process stopped and abandoned.
1458  *	PRELEASE_KILL	Terminate the process with SIGKILL.
1459  */
1460 void
1461 Prelease(struct ps_prochandle *P, int flags)
1462 {
1463 	if (P->state == PS_DEAD) {
1464 		dprintf("Prelease: releasing handle %p PS_DEAD of pid %d\n",
1465 		    (void *)P, (int)P->pid);
1466 		Pfree(P);
1467 		return;
1468 	}
1469 
1470 	if (P->state == PS_IDLE) {
1471 		file_info_t *fptr = list_next(&P->file_head);
1472 		dprintf("Prelease: releasing handle %p PS_IDLE of file %s\n",
1473 		    (void *)P, fptr->file_pname);
1474 		Pfree(P);
1475 		return;
1476 	}
1477 
1478 	dprintf("Prelease: releasing handle %p pid %d\n",
1479 	    (void *)P, (int)P->pid);
1480 
1481 	if (P->ctlfd == -1) {
1482 		Pfree(P);
1483 		return;
1484 	}
1485 
1486 	if (P->agentcnt > 0) {
1487 		P->agentcnt = 1;
1488 		Pdestroy_agent(P);
1489 	}
1490 
1491 	/*
1492 	 * Attempt to stop the process.
1493 	 */
1494 	P->state = PS_RUN;
1495 	(void) Pstop(P, 1000);
1496 
1497 	if (flags & PRELEASE_KILL) {
1498 		if (P->state == PS_STOP)
1499 			(void) Psetrun(P, SIGKILL, 0);
1500 		(void) kill(P->pid, SIGKILL);
1501 		Pfree(P);
1502 		return;
1503 	}
1504 
1505 	/*
1506 	 * If we lost control, all we can do now is close the files.
1507 	 * In this case, the last close sets the process running.
1508 	 */
1509 	if (P->state != PS_STOP &&
1510 	    (P->status.pr_lwp.pr_flags & (PR_ISTOP|PR_DSTOP)) == 0) {
1511 		Pfree(P);
1512 		return;
1513 	}
1514 
1515 	/*
1516 	 * We didn't lose control; we do more.
1517 	 */
1518 	Psync(P);
1519 
1520 	if (flags & PRELEASE_CLEAR)
1521 		P->flags |= CREATED;
1522 
1523 	if (!(flags & PRELEASE_RETAIN))
1524 		restore_tracing_flags(P);
1525 
1526 	if (flags & PRELEASE_HANG) {
1527 		/* Leave the process stopped and abandoned */
1528 		(void) Punsetflags(P, PR_RLC|PR_KLC);
1529 		Pfree(P);
1530 		return;
1531 	}
1532 
1533 	/*
1534 	 * Set the process running if we created it or if it was
1535 	 * not originally stopped or directed to stop via /proc
1536 	 * or if we were given the PRELEASE_CLEAR flag.
1537 	 */
1538 	if ((P->flags & CREATED) ||
1539 	    (P->orig_status.pr_lwp.pr_flags & (PR_ISTOP|PR_DSTOP)) == 0) {
1540 		(void) Psetflags(P, PR_RLC);
1541 		/*
1542 		 * We do this repeatedly because the process may have
1543 		 * more than one LWP stopped on an event of interest.
1544 		 * This makes sure all of them are set running.
1545 		 */
1546 		do {
1547 			if (Psetrun(P, 0, 0) == -1 && errno == EBUSY)
1548 				break; /* Agent LWP may be stuck */
1549 		} while (Pstopstatus(P, PCNULL, 0) == 0 &&
1550 		    P->status.pr_lwp.pr_flags & (PR_ISTOP|PR_DSTOP));
1551 
1552 		if (P->status.pr_lwp.pr_flags & (PR_ISTOP|PR_DSTOP))
1553 			dprintf("Prelease: failed to set process running\n");
1554 	}
1555 
1556 	Pfree(P);
1557 }
1558 
1559 /* debugging */
1560 void
1561 prldump(const char *caller, lwpstatus_t *lsp)
1562 {
1563 	char name[32];
1564 	uint32_t bits;
1565 
1566 	switch (lsp->pr_why) {
1567 	case PR_REQUESTED:
1568 		dprintf("%s: REQUESTED\n", caller);
1569 		break;
1570 	case PR_SIGNALLED:
1571 		dprintf("%s: SIGNALLED %s\n", caller,
1572 		    proc_signame(lsp->pr_what, name, sizeof (name)));
1573 		break;
1574 	case PR_FAULTED:
1575 		dprintf("%s: FAULTED %s\n", caller,
1576 		    proc_fltname(lsp->pr_what, name, sizeof (name)));
1577 		break;
1578 	case PR_SYSENTRY:
1579 		dprintf("%s: SYSENTRY %s\n", caller,
1580 		    proc_sysname(lsp->pr_what, name, sizeof (name)));
1581 		break;
1582 	case PR_SYSEXIT:
1583 		dprintf("%s: SYSEXIT %s\n", caller,
1584 		    proc_sysname(lsp->pr_what, name, sizeof (name)));
1585 		break;
1586 	case PR_JOBCONTROL:
1587 		dprintf("%s: JOBCONTROL %s\n", caller,
1588 		    proc_signame(lsp->pr_what, name, sizeof (name)));
1589 		break;
1590 	case PR_SUSPENDED:
1591 		dprintf("%s: SUSPENDED\n", caller);
1592 		break;
1593 	default:
1594 		dprintf("%s: Unknown\n", caller);
1595 		break;
1596 	}
1597 
1598 	if (lsp->pr_cursig)
1599 		dprintf("%s: p_cursig  = %d\n", caller, lsp->pr_cursig);
1600 
1601 	bits = *((uint32_t *)&lsp->pr_lwppend);
1602 	if (bits)
1603 		dprintf("%s: pr_lwppend = 0x%.8X\n", caller, bits);
1604 }
1605 
1606 /* debugging */
1607 static void
1608 prdump(struct ps_prochandle *P)
1609 {
1610 	uint32_t bits;
1611 
1612 	prldump("Pstopstatus", &P->status.pr_lwp);
1613 
1614 	bits = *((uint32_t *)&P->status.pr_sigpend);
1615 	if (bits)
1616 		dprintf("Pstopstatus: pr_sigpend = 0x%.8X\n", bits);
1617 }
1618 
1619 /*
1620  * Wait for the specified process to stop or terminate.
1621  * Or, just get the current status (PCNULL).
1622  * Or, direct it to stop and get the current status (PCDSTOP).
1623  * If the agent LWP exists, do these things to the agent,
1624  * else do these things to the process as a whole.
1625  */
1626 int
1627 Pstopstatus(struct ps_prochandle *P,
1628 	long request,		/* PCNULL, PCDSTOP, PCSTOP, PCWSTOP */
1629 	uint_t msec)		/* if non-zero, timeout in milliseconds */
1630 {
1631 	int ctlfd = (P->agentctlfd >= 0)? P->agentctlfd : P->ctlfd;
1632 	long ctl[3];
1633 	ssize_t rc;
1634 	int err;
1635 	int old_state = P->state;
1636 
1637 	switch (P->state) {
1638 	case PS_RUN:
1639 		break;
1640 	case PS_STOP:
1641 		if (request != PCNULL && request != PCDSTOP)
1642 			return (0);
1643 		break;
1644 	case PS_LOST:
1645 		if (request != PCNULL) {
1646 			errno = EAGAIN;
1647 			return (-1);
1648 		}
1649 		break;
1650 	case PS_UNDEAD:
1651 	case PS_DEAD:
1652 	case PS_IDLE:
1653 		if (request != PCNULL) {
1654 			errno = ENOENT;
1655 			return (-1);
1656 		}
1657 		break;
1658 	default:	/* corrupted state */
1659 		dprintf("Pstopstatus: corrupted state: %d\n", P->state);
1660 		errno = EINVAL;
1661 		return (-1);
1662 	}
1663 
1664 	ctl[0] = PCDSTOP;
1665 	ctl[1] = PCTWSTOP;
1666 	ctl[2] = (long)msec;
1667 	rc = 0;
1668 	switch (request) {
1669 	case PCSTOP:
1670 		rc = write(ctlfd, &ctl[0], 3*sizeof (long));
1671 		break;
1672 	case PCWSTOP:
1673 		rc = write(ctlfd, &ctl[1], 2*sizeof (long));
1674 		break;
1675 	case PCDSTOP:
1676 		rc = write(ctlfd, &ctl[0], 1*sizeof (long));
1677 		break;
1678 	case PCNULL:
1679 		if (P->state == PS_DEAD || P->state == PS_IDLE)
1680 			return (0);
1681 		break;
1682 	default:	/* programming error */
1683 		errno = EINVAL;
1684 		return (-1);
1685 	}
1686 	err = (rc < 0)? errno : 0;
1687 	Psync(P);
1688 
1689 	if (P->agentstatfd < 0) {
1690 		if (pread(P->statfd, &P->status,
1691 		    sizeof (P->status), (off_t)0) < 0)
1692 			err = errno;
1693 	} else {
1694 		if (pread(P->agentstatfd, &P->status.pr_lwp,
1695 		    sizeof (P->status.pr_lwp), (off_t)0) < 0)
1696 			err = errno;
1697 		P->status.pr_flags = P->status.pr_lwp.pr_flags;
1698 	}
1699 
1700 	if (err) {
1701 		switch (err) {
1702 		case EINTR:		/* user typed ctl-C */
1703 		case ERESTART:
1704 			dprintf("Pstopstatus: EINTR\n");
1705 			break;
1706 		case EAGAIN:		/* we lost control of the the process */
1707 		case EOVERFLOW:
1708 			dprintf("Pstopstatus: PS_LOST, errno=%d\n", err);
1709 			P->state = PS_LOST;
1710 			break;
1711 		default:		/* check for dead process */
1712 			if (_libproc_debug) {
1713 				const char *errstr;
1714 
1715 				switch (request) {
1716 				case PCNULL:
1717 					errstr = "Pstopstatus PCNULL"; break;
1718 				case PCSTOP:
1719 					errstr = "Pstopstatus PCSTOP"; break;
1720 				case PCDSTOP:
1721 					errstr = "Pstopstatus PCDSTOP"; break;
1722 				case PCWSTOP:
1723 					errstr = "Pstopstatus PCWSTOP"; break;
1724 				default:
1725 					errstr = "Pstopstatus PC???"; break;
1726 				}
1727 				dprintf("%s: %s\n", errstr, strerror(err));
1728 			}
1729 			deadcheck(P);
1730 			break;
1731 		}
1732 		if (err != EINTR && err != ERESTART) {
1733 			errno = err;
1734 			return (-1);
1735 		}
1736 	}
1737 
1738 	if (!(P->status.pr_flags & PR_STOPPED)) {
1739 		P->state = PS_RUN;
1740 		if (request == PCNULL || request == PCDSTOP || msec != 0)
1741 			return (0);
1742 		dprintf("Pstopstatus: process is not stopped\n");
1743 		errno = EPROTO;
1744 		return (-1);
1745 	}
1746 
1747 	P->state = PS_STOP;
1748 
1749 	if (_libproc_debug)	/* debugging */
1750 		prdump(P);
1751 
1752 	/*
1753 	 * If the process was already stopped coming into Pstopstatus(),
1754 	 * then don't use its PC to set P->sysaddr since it may have been
1755 	 * changed since the time the process originally stopped.
1756 	 */
1757 	if (old_state == PS_STOP)
1758 		return (0);
1759 
1760 	switch (P->status.pr_lwp.pr_why) {
1761 	case PR_SYSENTRY:
1762 	case PR_SYSEXIT:
1763 		if (Pissyscall_prev(P, P->status.pr_lwp.pr_reg[R_PC],
1764 		    &P->sysaddr) == 0)
1765 			P->sysaddr = P->status.pr_lwp.pr_reg[R_PC];
1766 		break;
1767 	case PR_REQUESTED:
1768 	case PR_SIGNALLED:
1769 	case PR_FAULTED:
1770 	case PR_JOBCONTROL:
1771 	case PR_SUSPENDED:
1772 		break;
1773 	default:
1774 		errno = EPROTO;
1775 		return (-1);
1776 	}
1777 
1778 	return (0);
1779 }
1780 
1781 /*
1782  * Wait for the process to stop for any reason.
1783  */
1784 int
1785 Pwait(struct ps_prochandle *P, uint_t msec)
1786 {
1787 	return (Pstopstatus(P, PCWSTOP, msec));
1788 }
1789 
1790 /*
1791  * Direct the process to stop; wait for it to stop.
1792  */
1793 int
1794 Pstop(struct ps_prochandle *P, uint_t msec)
1795 {
1796 	return (Pstopstatus(P, PCSTOP, msec));
1797 }
1798 
1799 /*
1800  * Direct the process to stop; don't wait.
1801  */
1802 int
1803 Pdstop(struct ps_prochandle *P)
1804 {
1805 	return (Pstopstatus(P, PCDSTOP, 0));
1806 }
1807 
1808 static void
1809 deadcheck(struct ps_prochandle *P)
1810 {
1811 	int fd;
1812 	void *buf;
1813 	size_t size;
1814 
1815 	if (P->statfd < 0)
1816 		P->state = PS_UNDEAD;
1817 	else {
1818 		if (P->agentstatfd < 0) {
1819 			fd = P->statfd;
1820 			buf = &P->status;
1821 			size = sizeof (P->status);
1822 		} else {
1823 			fd = P->agentstatfd;
1824 			buf = &P->status.pr_lwp;
1825 			size = sizeof (P->status.pr_lwp);
1826 		}
1827 		while (pread(fd, buf, size, (off_t)0) != size) {
1828 			switch (errno) {
1829 			default:
1830 				P->state = PS_UNDEAD;
1831 				break;
1832 			case EINTR:
1833 			case ERESTART:
1834 				continue;
1835 			case EAGAIN:
1836 				P->state = PS_LOST;
1837 				break;
1838 			}
1839 			break;
1840 		}
1841 		P->status.pr_flags = P->status.pr_lwp.pr_flags;
1842 	}
1843 }
1844 
1845 /*
1846  * Get the value of one register from stopped process.
1847  */
1848 int
1849 Pgetareg(struct ps_prochandle *P, int regno, prgreg_t *preg)
1850 {
1851 	if (regno < 0 || regno >= NPRGREG) {
1852 		errno = EINVAL;
1853 		return (-1);
1854 	}
1855 
1856 	if (P->state == PS_IDLE) {
1857 		errno = ENODATA;
1858 		return (-1);
1859 	}
1860 
1861 	if (P->state != PS_STOP && P->state != PS_DEAD) {
1862 		errno = EBUSY;
1863 		return (-1);
1864 	}
1865 
1866 	*preg = P->status.pr_lwp.pr_reg[regno];
1867 	return (0);
1868 }
1869 
1870 /*
1871  * Put value of one register into stopped process.
1872  */
1873 int
1874 Pputareg(struct ps_prochandle *P, int regno, prgreg_t reg)
1875 {
1876 	if (regno < 0 || regno >= NPRGREG) {
1877 		errno = EINVAL;
1878 		return (-1);
1879 	}
1880 
1881 	if (P->state != PS_STOP) {
1882 		errno = EBUSY;
1883 		return (-1);
1884 	}
1885 
1886 	P->status.pr_lwp.pr_reg[regno] = reg;
1887 	P->flags |= SETREGS;	/* set registers before continuing */
1888 	return (0);
1889 }
1890 
1891 int
1892 Psetrun(struct ps_prochandle *P,
1893 	int sig,	/* signal to pass to process */
1894 	int flags)	/* PRSTEP|PRSABORT|PRSTOP|PRCSIG|PRCFAULT */
1895 {
1896 	int ctlfd = (P->agentctlfd >= 0) ? P->agentctlfd : P->ctlfd;
1897 	int sbits = (PR_DSTOP | PR_ISTOP | PR_ASLEEP);
1898 
1899 	long ctl[1 +					/* PCCFAULT	*/
1900 	    1 + sizeof (siginfo_t)/sizeof (long) +	/* PCSSIG/PCCSIG */
1901 	    2 ];					/* PCRUN	*/
1902 
1903 	long *ctlp = ctl;
1904 	size_t size;
1905 
1906 	if (P->state != PS_STOP && (P->status.pr_lwp.pr_flags & sbits) == 0) {
1907 		errno = EBUSY;
1908 		return (-1);
1909 	}
1910 
1911 	Psync(P);	/* flush tracing flags and registers */
1912 
1913 	if (flags & PRCFAULT) {		/* clear current fault */
1914 		*ctlp++ = PCCFAULT;
1915 		flags &= ~PRCFAULT;
1916 	}
1917 
1918 	if (flags & PRCSIG) {		/* clear current signal */
1919 		*ctlp++ = PCCSIG;
1920 		flags &= ~PRCSIG;
1921 	} else if (sig && sig != P->status.pr_lwp.pr_cursig) {
1922 		/* make current signal */
1923 		siginfo_t *infop;
1924 
1925 		*ctlp++ = PCSSIG;
1926 		infop = (siginfo_t *)ctlp;
1927 		(void) memset(infop, 0, sizeof (*infop));
1928 		infop->si_signo = sig;
1929 		ctlp += sizeof (siginfo_t) / sizeof (long);
1930 	}
1931 
1932 	*ctlp++ = PCRUN;
1933 	*ctlp++ = flags;
1934 	size = (char *)ctlp - (char *)ctl;
1935 
1936 	P->info_valid = 0;	/* will need to update map and file info */
1937 
1938 	/*
1939 	 * If we've cached ucontext-list information while we were stopped,
1940 	 * free it now.
1941 	 */
1942 	if (P->ucaddrs != NULL) {
1943 		free(P->ucaddrs);
1944 		P->ucaddrs = NULL;
1945 		P->ucnelems = 0;
1946 	}
1947 
1948 	if (write(ctlfd, ctl, size) != size) {
1949 		/* If it is dead or lost, return the real status, not PS_RUN */
1950 		if (errno == ENOENT || errno == EAGAIN) {
1951 			(void) Pstopstatus(P, PCNULL, 0);
1952 			return (0);
1953 		}
1954 		/* If it is not in a jobcontrol stop, issue an error message */
1955 		if (errno != EBUSY ||
1956 		    P->status.pr_lwp.pr_why != PR_JOBCONTROL) {
1957 			dprintf("Psetrun: %s\n", strerror(errno));
1958 			return (-1);
1959 		}
1960 		/* Otherwise pretend that the job-stopped process is running */
1961 	}
1962 
1963 	P->state = PS_RUN;
1964 	return (0);
1965 }
1966 
1967 ssize_t
1968 Pread(struct ps_prochandle *P,
1969 	void *buf,		/* caller's buffer */
1970 	size_t nbyte,		/* number of bytes to read */
1971 	uintptr_t address)	/* address in process */
1972 {
1973 	return (P->ops->p_pread(P, buf, nbyte, address));
1974 }
1975 
1976 ssize_t
1977 Pread_string(struct ps_prochandle *P,
1978 	char *buf, 		/* caller's buffer */
1979 	size_t size,		/* upper limit on bytes to read */
1980 	uintptr_t addr)		/* address in process */
1981 {
1982 	enum { STRSZ = 40 };
1983 	char string[STRSZ + 1];
1984 	ssize_t leng = 0;
1985 	int nbyte;
1986 
1987 	if (size < 2) {
1988 		errno = EINVAL;
1989 		return (-1);
1990 	}
1991 
1992 	size--;			/* ensure trailing null fits in buffer */
1993 
1994 	*buf = '\0';
1995 	string[STRSZ] = '\0';
1996 
1997 	for (nbyte = STRSZ; nbyte == STRSZ && leng < size; addr += STRSZ) {
1998 		if ((nbyte = P->ops->p_pread(P, string, STRSZ, addr)) <= 0) {
1999 			buf[leng] = '\0';
2000 			return (leng ? leng : -1);
2001 		}
2002 		if ((nbyte = strlen(string)) > 0) {
2003 			if (leng + nbyte > size)
2004 				nbyte = size - leng;
2005 			(void) strncpy(buf + leng, string, nbyte);
2006 			leng += nbyte;
2007 		}
2008 	}
2009 	buf[leng] = '\0';
2010 	return (leng);
2011 }
2012 
2013 ssize_t
2014 Pwrite(struct ps_prochandle *P,
2015 	const void *buf,	/* caller's buffer */
2016 	size_t nbyte,		/* number of bytes to write */
2017 	uintptr_t address)	/* address in process */
2018 {
2019 	return (P->ops->p_pwrite(P, buf, nbyte, address));
2020 }
2021 
2022 int
2023 Pclearsig(struct ps_prochandle *P)
2024 {
2025 	int ctlfd = (P->agentctlfd >= 0)? P->agentctlfd : P->ctlfd;
2026 	long ctl = PCCSIG;
2027 
2028 	if (write(ctlfd, &ctl, sizeof (ctl)) != sizeof (ctl))
2029 		return (-1);
2030 	P->status.pr_lwp.pr_cursig = 0;
2031 	return (0);
2032 }
2033 
2034 int
2035 Pclearfault(struct ps_prochandle *P)
2036 {
2037 	int ctlfd = (P->agentctlfd >= 0)? P->agentctlfd : P->ctlfd;
2038 	long ctl = PCCFAULT;
2039 
2040 	if (write(ctlfd, &ctl, sizeof (ctl)) != sizeof (ctl))
2041 		return (-1);
2042 	return (0);
2043 }
2044 
2045 /*
2046  * Set a breakpoint trap, return original instruction.
2047  */
2048 int
2049 Psetbkpt(struct ps_prochandle *P, uintptr_t address, ulong_t *saved)
2050 {
2051 	long ctl[1 + sizeof (priovec_t) / sizeof (long) +	/* PCREAD */
2052 	    1 + sizeof (priovec_t) / sizeof (long)];	/* PCWRITE */
2053 	long *ctlp = ctl;
2054 	size_t size;
2055 	priovec_t *iovp;
2056 	instr_t bpt = BPT;
2057 	instr_t old;
2058 
2059 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2060 	    P->state == PS_IDLE) {
2061 		errno = ENOENT;
2062 		return (-1);
2063 	}
2064 
2065 	/* fetch the old instruction */
2066 	*ctlp++ = PCREAD;
2067 	iovp = (priovec_t *)ctlp;
2068 	iovp->pio_base = &old;
2069 	iovp->pio_len = sizeof (old);
2070 	iovp->pio_offset = address;
2071 	ctlp += sizeof (priovec_t) / sizeof (long);
2072 
2073 	/* write the BPT instruction */
2074 	*ctlp++ = PCWRITE;
2075 	iovp = (priovec_t *)ctlp;
2076 	iovp->pio_base = &bpt;
2077 	iovp->pio_len = sizeof (bpt);
2078 	iovp->pio_offset = address;
2079 	ctlp += sizeof (priovec_t) / sizeof (long);
2080 
2081 	size = (char *)ctlp - (char *)ctl;
2082 	if (write(P->ctlfd, ctl, size) != size)
2083 		return (-1);
2084 
2085 	/*
2086 	 * Fail if there was already a breakpoint there from another debugger
2087 	 * or DTrace's user-level tracing on x86.
2088 	 */
2089 	if (old == BPT) {
2090 		errno = EBUSY;
2091 		return (-1);
2092 	}
2093 
2094 	*saved = (ulong_t)old;
2095 	return (0);
2096 }
2097 
2098 /*
2099  * Restore original instruction where a breakpoint was set.
2100  */
2101 int
2102 Pdelbkpt(struct ps_prochandle *P, uintptr_t address, ulong_t saved)
2103 {
2104 	instr_t old = (instr_t)saved;
2105 	instr_t cur;
2106 
2107 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2108 	    P->state == PS_IDLE) {
2109 		errno = ENOENT;
2110 		return (-1);
2111 	}
2112 
2113 	/*
2114 	 * If the breakpoint instruction we had placed has been overwritten
2115 	 * with a new instruction, then don't try to replace it with the
2116 	 * old instruction. Doing do can cause problems with self-modifying
2117 	 * code -- PLTs for example. If the Pread() fails, we assume that we
2118 	 * should proceed though most likely the Pwrite() will also fail.
2119 	 */
2120 	if (Pread(P, &cur, sizeof (cur), address) == sizeof (cur) &&
2121 	    cur != BPT)
2122 		return (0);
2123 
2124 	if (Pwrite(P, &old, sizeof (old), address) != sizeof (old))
2125 		return (-1);
2126 
2127 	return (0);
2128 }
2129 
2130 /*
2131  * Common code for Pxecbkpt() and Lxecbkpt().
2132  * Develop the array of requests that will do the job, then
2133  * write them to the specified control file descriptor.
2134  * Return the non-zero errno if the write fails.
2135  */
2136 static int
2137 execute_bkpt(
2138 	int ctlfd,		/* process or LWP control file descriptor */
2139 	const fltset_t *faultset,	/* current set of traced faults */
2140 	const sigset_t *sigmask,	/* current signal mask */
2141 	uintptr_t address,		/* address of breakpint */
2142 	ulong_t saved)			/* the saved instruction */
2143 {
2144 	long ctl[
2145 	    1 + sizeof (sigset_t) / sizeof (long) +		/* PCSHOLD */
2146 	    1 + sizeof (fltset_t) / sizeof (long) +		/* PCSFAULT */
2147 	    1 + sizeof (priovec_t) / sizeof (long) +		/* PCWRITE */
2148 	    2 +							/* PCRUN */
2149 	    1 +							/* PCWSTOP */
2150 	    1 +							/* PCCFAULT */
2151 	    1 + sizeof (priovec_t) / sizeof (long) +		/* PCWRITE */
2152 	    1 + sizeof (fltset_t) / sizeof (long) +		/* PCSFAULT */
2153 	    1 + sizeof (sigset_t) / sizeof (long)];		/* PCSHOLD */
2154 	long *ctlp = ctl;
2155 	sigset_t unblock;
2156 	size_t size;
2157 	ssize_t ssize;
2158 	priovec_t *iovp;
2159 	sigset_t *holdp;
2160 	fltset_t *faultp;
2161 	instr_t old = (instr_t)saved;
2162 	instr_t bpt = BPT;
2163 	int error = 0;
2164 
2165 	/* block our signals for the duration */
2166 	(void) sigprocmask(SIG_BLOCK, &blockable_sigs, &unblock);
2167 
2168 	/* hold posted signals */
2169 	*ctlp++ = PCSHOLD;
2170 	holdp = (sigset_t *)ctlp;
2171 	prfillset(holdp);
2172 	prdelset(holdp, SIGKILL);
2173 	prdelset(holdp, SIGSTOP);
2174 	ctlp += sizeof (sigset_t) / sizeof (long);
2175 
2176 	/* force tracing of FLTTRACE */
2177 	if (!(prismember(faultset, FLTTRACE))) {
2178 		*ctlp++ = PCSFAULT;
2179 		faultp = (fltset_t *)ctlp;
2180 		*faultp = *faultset;
2181 		praddset(faultp, FLTTRACE);
2182 		ctlp += sizeof (fltset_t) / sizeof (long);
2183 	}
2184 
2185 	/* restore the old instruction */
2186 	*ctlp++ = PCWRITE;
2187 	iovp = (priovec_t *)ctlp;
2188 	iovp->pio_base = &old;
2189 	iovp->pio_len = sizeof (old);
2190 	iovp->pio_offset = address;
2191 	ctlp += sizeof (priovec_t) / sizeof (long);
2192 
2193 	/* clear current signal and fault; set running w/ single-step */
2194 	*ctlp++ = PCRUN;
2195 	*ctlp++ = PRCSIG | PRCFAULT | PRSTEP;
2196 
2197 	/* wait for stop, cancel the fault */
2198 	*ctlp++ = PCWSTOP;
2199 	*ctlp++ = PCCFAULT;
2200 
2201 	/* restore the breakpoint trap */
2202 	*ctlp++ = PCWRITE;
2203 	iovp = (priovec_t *)ctlp;
2204 	iovp->pio_base = &bpt;
2205 	iovp->pio_len = sizeof (bpt);
2206 	iovp->pio_offset = address;
2207 	ctlp += sizeof (priovec_t) / sizeof (long);
2208 
2209 	/* restore fault tracing set */
2210 	if (!(prismember(faultset, FLTTRACE))) {
2211 		*ctlp++ = PCSFAULT;
2212 		*(fltset_t *)ctlp = *faultset;
2213 		ctlp += sizeof (fltset_t) / sizeof (long);
2214 	}
2215 
2216 	/* restore the hold mask */
2217 	*ctlp++ = PCSHOLD;
2218 	*(sigset_t *)ctlp = *sigmask;
2219 	ctlp += sizeof (sigset_t) / sizeof (long);
2220 
2221 	size = (char *)ctlp - (char *)ctl;
2222 	if ((ssize = write(ctlfd, ctl, size)) != size)
2223 		error = (ssize == -1)? errno : EINTR;
2224 	(void) sigprocmask(SIG_SETMASK, &unblock, NULL);
2225 	return (error);
2226 }
2227 
2228 /*
2229  * Step over a breakpoint, i.e., execute the instruction that
2230  * really belongs at the breakpoint location (the current %pc)
2231  * and leave the process stopped at the next instruction.
2232  */
2233 int
2234 Pxecbkpt(struct ps_prochandle *P, ulong_t saved)
2235 {
2236 	int ctlfd = (P->agentctlfd >= 0)? P->agentctlfd : P->ctlfd;
2237 	int rv, error;
2238 
2239 	if (P->state != PS_STOP) {
2240 		errno = EBUSY;
2241 		return (-1);
2242 	}
2243 
2244 	Psync(P);
2245 
2246 	error = execute_bkpt(ctlfd,
2247 	    &P->status.pr_flttrace, &P->status.pr_lwp.pr_lwphold,
2248 	    P->status.pr_lwp.pr_reg[R_PC], saved);
2249 	rv = Pstopstatus(P, PCNULL, 0);
2250 
2251 	if (error != 0) {
2252 		if (P->status.pr_lwp.pr_why == PR_JOBCONTROL &&
2253 		    error == EBUSY) {	/* jobcontrol stop -- back off */
2254 			P->state = PS_RUN;
2255 			return (0);
2256 		}
2257 		if (error == ENOENT)
2258 			return (0);
2259 		errno = error;
2260 		return (-1);
2261 	}
2262 
2263 	return (rv);
2264 }
2265 
2266 /*
2267  * Install the watchpoint described by wp.
2268  */
2269 int
2270 Psetwapt(struct ps_prochandle *P, const prwatch_t *wp)
2271 {
2272 	long ctl[1 + sizeof (prwatch_t) / sizeof (long)];
2273 	prwatch_t *cwp = (prwatch_t *)&ctl[1];
2274 
2275 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2276 	    P->state == PS_IDLE) {
2277 		errno = ENOENT;
2278 		return (-1);
2279 	}
2280 
2281 	ctl[0] = PCWATCH;
2282 	cwp->pr_vaddr = wp->pr_vaddr;
2283 	cwp->pr_size = wp->pr_size;
2284 	cwp->pr_wflags = wp->pr_wflags;
2285 
2286 	if (write(P->ctlfd, ctl, sizeof (ctl)) != sizeof (ctl))
2287 		return (-1);
2288 
2289 	return (0);
2290 }
2291 
2292 /*
2293  * Remove the watchpoint described by wp.
2294  */
2295 int
2296 Pdelwapt(struct ps_prochandle *P, const prwatch_t *wp)
2297 {
2298 	long ctl[1 + sizeof (prwatch_t) / sizeof (long)];
2299 	prwatch_t *cwp = (prwatch_t *)&ctl[1];
2300 
2301 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2302 	    P->state == PS_IDLE) {
2303 		errno = ENOENT;
2304 		return (-1);
2305 	}
2306 
2307 	ctl[0] = PCWATCH;
2308 	cwp->pr_vaddr = wp->pr_vaddr;
2309 	cwp->pr_size = wp->pr_size;
2310 	cwp->pr_wflags = 0;
2311 
2312 	if (write(P->ctlfd, ctl, sizeof (ctl)) != sizeof (ctl))
2313 		return (-1);
2314 
2315 	return (0);
2316 }
2317 
2318 /*
2319  * Common code for Pxecwapt() and Lxecwapt().  Develop the array of requests
2320  * that will do the job, then write them to the specified control file
2321  * descriptor.  Return the non-zero errno if the write fails.
2322  */
2323 static int
2324 execute_wapt(
2325 	int ctlfd,		/* process or LWP control file descriptor */
2326 	const fltset_t *faultset,	/* current set of traced faults */
2327 	const sigset_t *sigmask,	/* current signal mask */
2328 	const prwatch_t *wp)		/* watchpoint descriptor */
2329 {
2330 	long ctl[
2331 	    1 + sizeof (sigset_t) / sizeof (long) +		/* PCSHOLD */
2332 	    1 + sizeof (fltset_t) / sizeof (long) +		/* PCSFAULT */
2333 	    1 + sizeof (prwatch_t) / sizeof (long) +		/* PCWATCH */
2334 	    2 +							/* PCRUN */
2335 	    1 +							/* PCWSTOP */
2336 	    1 +							/* PCCFAULT */
2337 	    1 + sizeof (prwatch_t) / sizeof (long) +		/* PCWATCH */
2338 	    1 + sizeof (fltset_t) / sizeof (long) +		/* PCSFAULT */
2339 	    1 + sizeof (sigset_t) / sizeof (long)];		/* PCSHOLD */
2340 
2341 	long *ctlp = ctl;
2342 	int error = 0;
2343 
2344 	sigset_t unblock;
2345 	sigset_t *holdp;
2346 	fltset_t *faultp;
2347 	prwatch_t *prw;
2348 	ssize_t ssize;
2349 	size_t size;
2350 
2351 	(void) sigprocmask(SIG_BLOCK, &blockable_sigs, &unblock);
2352 
2353 	/*
2354 	 * Hold all posted signals in the victim process prior to stepping.
2355 	 */
2356 	*ctlp++ = PCSHOLD;
2357 	holdp = (sigset_t *)ctlp;
2358 	prfillset(holdp);
2359 	prdelset(holdp, SIGKILL);
2360 	prdelset(holdp, SIGSTOP);
2361 	ctlp += sizeof (sigset_t) / sizeof (long);
2362 
2363 	/*
2364 	 * Force tracing of FLTTRACE since we need to single step.
2365 	 */
2366 	if (!(prismember(faultset, FLTTRACE))) {
2367 		*ctlp++ = PCSFAULT;
2368 		faultp = (fltset_t *)ctlp;
2369 		*faultp = *faultset;
2370 		praddset(faultp, FLTTRACE);
2371 		ctlp += sizeof (fltset_t) / sizeof (long);
2372 	}
2373 
2374 	/*
2375 	 * Clear only the current watchpoint by setting pr_wflags to zero.
2376 	 */
2377 	*ctlp++ = PCWATCH;
2378 	prw = (prwatch_t *)ctlp;
2379 	prw->pr_vaddr = wp->pr_vaddr;
2380 	prw->pr_size = wp->pr_size;
2381 	prw->pr_wflags = 0;
2382 	ctlp += sizeof (prwatch_t) / sizeof (long);
2383 
2384 	/*
2385 	 * Clear the current signal and fault; set running with single-step.
2386 	 * Then wait for the victim to stop and cancel the FLTTRACE.
2387 	 */
2388 	*ctlp++ = PCRUN;
2389 	*ctlp++ = PRCSIG | PRCFAULT | PRSTEP;
2390 	*ctlp++ = PCWSTOP;
2391 	*ctlp++ = PCCFAULT;
2392 
2393 	/*
2394 	 * Restore the current watchpoint.
2395 	 */
2396 	*ctlp++ = PCWATCH;
2397 	(void) memcpy(ctlp, wp, sizeof (prwatch_t));
2398 	ctlp += sizeof (prwatch_t) / sizeof (long);
2399 
2400 	/*
2401 	 * Restore fault tracing set if we modified it.
2402 	 */
2403 	if (!(prismember(faultset, FLTTRACE))) {
2404 		*ctlp++ = PCSFAULT;
2405 		*(fltset_t *)ctlp = *faultset;
2406 		ctlp += sizeof (fltset_t) / sizeof (long);
2407 	}
2408 
2409 	/*
2410 	 * Restore the hold mask to the current hold mask (i.e. the one
2411 	 * before we executed any of the previous operations).
2412 	 */
2413 	*ctlp++ = PCSHOLD;
2414 	*(sigset_t *)ctlp = *sigmask;
2415 	ctlp += sizeof (sigset_t) / sizeof (long);
2416 
2417 	size = (char *)ctlp - (char *)ctl;
2418 	if ((ssize = write(ctlfd, ctl, size)) != size)
2419 		error = (ssize == -1)? errno : EINTR;
2420 	(void) sigprocmask(SIG_SETMASK, &unblock, NULL);
2421 	return (error);
2422 }
2423 
2424 /*
2425  * Step over a watchpoint, i.e., execute the instruction that was stopped by
2426  * the watchpoint, and then leave the LWP stopped at the next instruction.
2427  */
2428 int
2429 Pxecwapt(struct ps_prochandle *P, const prwatch_t *wp)
2430 {
2431 	int ctlfd = (P->agentctlfd >= 0)? P->agentctlfd : P->ctlfd;
2432 	int rv, error;
2433 
2434 	if (P->state != PS_STOP) {
2435 		errno = EBUSY;
2436 		return (-1);
2437 	}
2438 
2439 	Psync(P);
2440 	error = execute_wapt(ctlfd,
2441 	    &P->status.pr_flttrace, &P->status.pr_lwp.pr_lwphold, wp);
2442 	rv = Pstopstatus(P, PCNULL, 0);
2443 
2444 	if (error != 0) {
2445 		if (P->status.pr_lwp.pr_why == PR_JOBCONTROL &&
2446 		    error == EBUSY) {	/* jobcontrol stop -- back off */
2447 			P->state = PS_RUN;
2448 			return (0);
2449 		}
2450 		if (error == ENOENT)
2451 			return (0);
2452 		errno = error;
2453 		return (-1);
2454 	}
2455 
2456 	return (rv);
2457 }
2458 
2459 int
2460 Psetflags(struct ps_prochandle *P, long flags)
2461 {
2462 	int rc;
2463 	long ctl[2];
2464 
2465 	ctl[0] = PCSET;
2466 	ctl[1] = flags;
2467 
2468 	if (write(P->ctlfd, ctl, 2*sizeof (long)) != 2*sizeof (long)) {
2469 		rc = -1;
2470 	} else {
2471 		P->status.pr_flags |= flags;
2472 		P->status.pr_lwp.pr_flags |= flags;
2473 		rc = 0;
2474 	}
2475 
2476 	return (rc);
2477 }
2478 
2479 int
2480 Punsetflags(struct ps_prochandle *P, long flags)
2481 {
2482 	int rc;
2483 	long ctl[2];
2484 
2485 	ctl[0] = PCUNSET;
2486 	ctl[1] = flags;
2487 
2488 	if (write(P->ctlfd, ctl, 2*sizeof (long)) != 2*sizeof (long)) {
2489 		rc = -1;
2490 	} else {
2491 		P->status.pr_flags &= ~flags;
2492 		P->status.pr_lwp.pr_flags &= ~flags;
2493 		rc = 0;
2494 	}
2495 
2496 	return (rc);
2497 }
2498 
2499 /*
2500  * Common function to allow clients to manipulate the action to be taken
2501  * on receipt of a signal, receipt of machine fault, entry to a system call,
2502  * or exit from a system call.  We make use of our private prset_* functions
2503  * in order to make this code be common.  The 'which' parameter identifies
2504  * the code for the event of interest (0 means change the entire set), and
2505  * the 'stop' parameter is a boolean indicating whether the process should
2506  * stop when the event of interest occurs.  The previous value is returned
2507  * to the caller; -1 is returned if an error occurred.
2508  */
2509 static int
2510 Psetaction(struct ps_prochandle *P, void *sp, size_t size,
2511     uint_t flag, int max, int which, int stop)
2512 {
2513 	int oldval;
2514 
2515 	if (which < 0 || which > max) {
2516 		errno = EINVAL;
2517 		return (-1);
2518 	}
2519 
2520 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2521 	    P->state == PS_IDLE) {
2522 		errno = ENOENT;
2523 		return (-1);
2524 	}
2525 
2526 	oldval = prset_ismember(sp, size, which) ? TRUE : FALSE;
2527 
2528 	if (stop) {
2529 		if (which == 0) {
2530 			prset_fill(sp, size);
2531 			P->flags |= flag;
2532 		} else if (!oldval) {
2533 			prset_add(sp, size, which);
2534 			P->flags |= flag;
2535 		}
2536 	} else {
2537 		if (which == 0) {
2538 			prset_empty(sp, size);
2539 			P->flags |= flag;
2540 		} else if (oldval) {
2541 			prset_del(sp, size, which);
2542 			P->flags |= flag;
2543 		}
2544 	}
2545 
2546 	if (P->state == PS_RUN)
2547 		Psync(P);
2548 
2549 	return (oldval);
2550 }
2551 
2552 /*
2553  * Set action on specified signal.
2554  */
2555 int
2556 Psignal(struct ps_prochandle *P, int which, int stop)
2557 {
2558 	int oldval;
2559 
2560 	if (which == SIGKILL && stop != 0) {
2561 		errno = EINVAL;
2562 		return (-1);
2563 	}
2564 
2565 	oldval = Psetaction(P, &P->status.pr_sigtrace, sizeof (sigset_t),
2566 	    SETSIG, PRMAXSIG, which, stop);
2567 
2568 	if (oldval != -1 && which == 0 && stop != 0)
2569 		prdelset(&P->status.pr_sigtrace, SIGKILL);
2570 
2571 	return (oldval);
2572 }
2573 
2574 /*
2575  * Set all signal tracing flags.
2576  */
2577 void
2578 Psetsignal(struct ps_prochandle *P, const sigset_t *set)
2579 {
2580 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2581 	    P->state == PS_IDLE)
2582 		return;
2583 
2584 	P->status.pr_sigtrace = *set;
2585 	P->flags |= SETSIG;
2586 
2587 	if (P->state == PS_RUN)
2588 		Psync(P);
2589 }
2590 
2591 /*
2592  * Set action on specified fault.
2593  */
2594 int
2595 Pfault(struct ps_prochandle *P, int which, int stop)
2596 {
2597 	return (Psetaction(P, &P->status.pr_flttrace, sizeof (fltset_t),
2598 	    SETFAULT, PRMAXFAULT, which, stop));
2599 }
2600 
2601 /*
2602  * Set all machine fault tracing flags.
2603  */
2604 void
2605 Psetfault(struct ps_prochandle *P, const fltset_t *set)
2606 {
2607 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2608 	    P->state == PS_IDLE)
2609 		return;
2610 
2611 	P->status.pr_flttrace = *set;
2612 	P->flags |= SETFAULT;
2613 
2614 	if (P->state == PS_RUN)
2615 		Psync(P);
2616 }
2617 
2618 /*
2619  * Set action on specified system call entry.
2620  */
2621 int
2622 Psysentry(struct ps_prochandle *P, int which, int stop)
2623 {
2624 	return (Psetaction(P, &P->status.pr_sysentry, sizeof (sysset_t),
2625 	    SETENTRY, PRMAXSYS, which, stop));
2626 }
2627 
2628 /*
2629  * Set all system call entry tracing flags.
2630  */
2631 void
2632 Psetsysentry(struct ps_prochandle *P, const sysset_t *set)
2633 {
2634 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2635 	    P->state == PS_IDLE)
2636 		return;
2637 
2638 	P->status.pr_sysentry = *set;
2639 	P->flags |= SETENTRY;
2640 
2641 	if (P->state == PS_RUN)
2642 		Psync(P);
2643 }
2644 
2645 /*
2646  * Set action on specified system call exit.
2647  */
2648 int
2649 Psysexit(struct ps_prochandle *P, int which, int stop)
2650 {
2651 	return (Psetaction(P, &P->status.pr_sysexit, sizeof (sysset_t),
2652 	    SETEXIT, PRMAXSYS, which, stop));
2653 }
2654 
2655 /*
2656  * Set all system call exit tracing flags.
2657  */
2658 void
2659 Psetsysexit(struct ps_prochandle *P, const sysset_t *set)
2660 {
2661 	if (P->state == PS_DEAD || P->state == PS_UNDEAD ||
2662 	    P->state == PS_IDLE)
2663 		return;
2664 
2665 	P->status.pr_sysexit = *set;
2666 	P->flags |= SETEXIT;
2667 
2668 	if (P->state == PS_RUN)
2669 		Psync(P);
2670 }
2671 
2672 /*
2673  * Utility function to read the contents of a file that contains a
2674  * prheader_t at the start (/proc/pid/lstatus or /proc/pid/lpsinfo).
2675  * Returns a malloc()d buffer or NULL on failure.
2676  */
2677 static prheader_t *
2678 read_lfile(struct ps_prochandle *P, const char *lname)
2679 {
2680 	prheader_t *Lhp;
2681 	char lpath[PATH_MAX];
2682 	struct stat64 statb;
2683 	int fd;
2684 	size_t size;
2685 	ssize_t rval;
2686 
2687 	(void) snprintf(lpath, sizeof (lpath), "%s/%d/%s", procfs_path,
2688 	    (int)P->status.pr_pid, lname);
2689 	if ((fd = open(lpath, O_RDONLY)) < 0 || fstat64(fd, &statb) != 0) {
2690 		if (fd >= 0)
2691 			(void) close(fd);
2692 		return (NULL);
2693 	}
2694 
2695 	/*
2696 	 * 'size' is just the initial guess at the buffer size.
2697 	 * It will have to grow if the number of lwps increases
2698 	 * while we are looking at the process.
2699 	 * 'size' must be larger than the actual file size.
2700 	 */
2701 	size = statb.st_size + 32;
2702 
2703 	for (;;) {
2704 		if ((Lhp = malloc(size)) == NULL)
2705 			break;
2706 		if ((rval = pread(fd, Lhp, size, 0)) < 0 ||
2707 		    rval <= sizeof (prheader_t)) {
2708 			free(Lhp);
2709 			Lhp = NULL;
2710 			break;
2711 		}
2712 		if (rval < size)
2713 			break;
2714 		/* need a bigger buffer */
2715 		free(Lhp);
2716 		size *= 2;
2717 	}
2718 
2719 	(void) close(fd);
2720 	return (Lhp);
2721 }
2722 
2723 /*
2724  * LWP iteration interface.
2725  */
2726 int
2727 Plwp_iter(struct ps_prochandle *P, proc_lwp_f *func, void *cd)
2728 {
2729 	prheader_t *Lhp;
2730 	lwpstatus_t *Lsp;
2731 	long nlwp;
2732 	int rv;
2733 
2734 	switch (P->state) {
2735 	case PS_RUN:
2736 		(void) Pstopstatus(P, PCNULL, 0);
2737 		break;
2738 
2739 	case PS_STOP:
2740 		Psync(P);
2741 		break;
2742 
2743 	case PS_IDLE:
2744 		errno = ENODATA;
2745 		return (-1);
2746 	}
2747 
2748 	/*
2749 	 * For either live processes or cores, the single LWP case is easy:
2750 	 * the pstatus_t contains the lwpstatus_t for the only LWP.
2751 	 */
2752 	if (P->status.pr_nlwp <= 1)
2753 		return (func(cd, &P->status.pr_lwp));
2754 
2755 	/*
2756 	 * For the core file multi-LWP case, we just iterate through the
2757 	 * list of LWP structs we read in from the core file.
2758 	 */
2759 	if (P->state == PS_DEAD) {
2760 		lwp_info_t *lwp = list_prev(&P->core->core_lwp_head);
2761 		uint_t i;
2762 
2763 		for (i = 0; i < P->core->core_nlwp; i++, lwp = list_prev(lwp)) {
2764 			if (lwp->lwp_psinfo.pr_sname != 'Z' &&
2765 			    (rv = func(cd, &lwp->lwp_status)) != 0)
2766 				break;
2767 		}
2768 
2769 		return (rv);
2770 	}
2771 
2772 	/*
2773 	 * For the live process multi-LWP case, we have to work a little
2774 	 * harder: the /proc/pid/lstatus file has the array of LWP structs.
2775 	 */
2776 	if ((Lhp = read_lfile(P, "lstatus")) == NULL)
2777 		return (-1);
2778 
2779 	for (nlwp = Lhp->pr_nent, Lsp = (lwpstatus_t *)(uintptr_t)(Lhp + 1);
2780 	    nlwp > 0;
2781 	    nlwp--, Lsp = (lwpstatus_t *)((uintptr_t)Lsp + Lhp->pr_entsize)) {
2782 		if ((rv = func(cd, Lsp)) != 0)
2783 			break;
2784 	}
2785 
2786 	free(Lhp);
2787 	return (rv);
2788 }
2789 
2790 /*
2791  * Extended LWP iteration interface.
2792  * Iterate over all LWPs, active and zombie.
2793  */
2794 int
2795 Plwp_iter_all(struct ps_prochandle *P, proc_lwp_all_f *func, void *cd)
2796 {
2797 	prheader_t *Lhp = NULL;
2798 	lwpstatus_t *Lsp;
2799 	lwpstatus_t *sp;
2800 	prheader_t *Lphp = NULL;
2801 	lwpsinfo_t *Lpsp;
2802 	long nstat;
2803 	long ninfo;
2804 	int rv;
2805 
2806 retry:
2807 	if (Lhp != NULL)
2808 		free(Lhp);
2809 	if (Lphp != NULL)
2810 		free(Lphp);
2811 	if (P->state == PS_RUN)
2812 		(void) Pstopstatus(P, PCNULL, 0);
2813 	(void) Ppsinfo(P);
2814 
2815 	if (P->state == PS_STOP)
2816 		Psync(P);
2817 
2818 	/*
2819 	 * For either live processes or cores, the single LWP case is easy:
2820 	 * the pstatus_t contains the lwpstatus_t for the only LWP and
2821 	 * the psinfo_t contains the lwpsinfo_t for the only LWP.
2822 	 */
2823 	if (P->status.pr_nlwp + P->status.pr_nzomb <= 1)
2824 		return (func(cd, &P->status.pr_lwp, &P->psinfo.pr_lwp));
2825 
2826 	/*
2827 	 * For the core file multi-LWP case, we just iterate through the
2828 	 * list of LWP structs we read in from the core file.
2829 	 */
2830 	if (P->state == PS_DEAD) {
2831 		lwp_info_t *lwp = list_prev(&P->core->core_lwp_head);
2832 		uint_t i;
2833 
2834 		for (i = 0; i < P->core->core_nlwp; i++, lwp = list_prev(lwp)) {
2835 			sp = (lwp->lwp_psinfo.pr_sname == 'Z')? NULL :
2836 			    &lwp->lwp_status;
2837 			if ((rv = func(cd, sp, &lwp->lwp_psinfo)) != 0)
2838 				break;
2839 		}
2840 
2841 		return (rv);
2842 	}
2843 
2844 	/*
2845 	 * For the live process multi-LWP case, we have to work a little
2846 	 * harder: the /proc/pid/lstatus file has the array of lwpstatus_t's
2847 	 * and the /proc/pid/lpsinfo file has the array of lwpsinfo_t's.
2848 	 */
2849 	if ((Lhp = read_lfile(P, "lstatus")) == NULL)
2850 		return (-1);
2851 	if ((Lphp = read_lfile(P, "lpsinfo")) == NULL) {
2852 		free(Lhp);
2853 		return (-1);
2854 	}
2855 
2856 	/*
2857 	 * If we are looking at a running process, or one we do not control,
2858 	 * the active and zombie lwps in the process may have changed since
2859 	 * we read the process status structure.  If so, just start over.
2860 	 */
2861 	if (Lhp->pr_nent != P->status.pr_nlwp ||
2862 	    Lphp->pr_nent != P->status.pr_nlwp + P->status.pr_nzomb)
2863 		goto retry;
2864 
2865 	/*
2866 	 * To be perfectly safe, prescan the two arrays, checking consistency.
2867 	 * We rely on /proc giving us lwpstatus_t's and lwpsinfo_t's in the
2868 	 * same order (the lwp directory order) in their respective files.
2869 	 * We also rely on there being (possibly) more lwpsinfo_t's than
2870 	 * lwpstatus_t's (the extra lwpsinfo_t's are for zombie lwps).
2871 	 */
2872 	Lsp = (lwpstatus_t *)(uintptr_t)(Lhp + 1);
2873 	Lpsp = (lwpsinfo_t *)(uintptr_t)(Lphp + 1);
2874 	nstat = Lhp->pr_nent;
2875 	for (ninfo = Lphp->pr_nent; ninfo != 0; ninfo--) {
2876 		if (Lpsp->pr_sname != 'Z') {
2877 			/*
2878 			 * Not a zombie lwp; check for matching lwpids.
2879 			 */
2880 			if (nstat == 0 || Lsp->pr_lwpid != Lpsp->pr_lwpid)
2881 				goto retry;
2882 			Lsp = (lwpstatus_t *)((uintptr_t)Lsp + Lhp->pr_entsize);
2883 			nstat--;
2884 		}
2885 		Lpsp = (lwpsinfo_t *)((uintptr_t)Lpsp + Lphp->pr_entsize);
2886 	}
2887 	if (nstat != 0)
2888 		goto retry;
2889 
2890 	/*
2891 	 * Rescan, this time for real.
2892 	 */
2893 	Lsp = (lwpstatus_t *)(uintptr_t)(Lhp + 1);
2894 	Lpsp = (lwpsinfo_t *)(uintptr_t)(Lphp + 1);
2895 	for (ninfo = Lphp->pr_nent; ninfo != 0; ninfo--) {
2896 		if (Lpsp->pr_sname != 'Z') {
2897 			sp = Lsp;
2898 			Lsp = (lwpstatus_t *)((uintptr_t)Lsp + Lhp->pr_entsize);
2899 		} else {
2900 			sp = NULL;
2901 		}
2902 		if ((rv = func(cd, sp, Lpsp)) != 0)
2903 			break;
2904 		Lpsp = (lwpsinfo_t *)((uintptr_t)Lpsp + Lphp->pr_entsize);
2905 	}
2906 
2907 	free(Lhp);
2908 	free(Lphp);
2909 	return (rv);
2910 }
2911 
2912 core_content_t
2913 Pcontent(struct ps_prochandle *P)
2914 {
2915 	if (P->state == PS_DEAD)
2916 		return (P->core->core_content);
2917 	if (P->state == PS_IDLE)
2918 		return (CC_CONTENT_TEXT | CC_CONTENT_DATA | CC_CONTENT_CTF);
2919 
2920 	return (CC_CONTENT_ALL);
2921 }
2922 
2923 /*
2924  * =================================================================
2925  * The remainder of the functions in this file are for the
2926  * control of individual LWPs in the controlled process.
2927  * =================================================================
2928  */
2929 
2930 /*
2931  * Find an entry in the process hash table for the specified lwpid.
2932  * The entry will either point to an existing struct ps_lwphandle
2933  * or it will point to an empty slot for a new struct ps_lwphandle.
2934  */
2935 static struct ps_lwphandle **
2936 Lfind(struct ps_prochandle *P, lwpid_t lwpid)
2937 {
2938 	struct ps_lwphandle **Lp;
2939 	struct ps_lwphandle *L;
2940 
2941 	for (Lp = &P->hashtab[lwpid % (HASHSIZE - 1)];
2942 	    (L = *Lp) != NULL; Lp = &L->lwp_hash)
2943 		if (L->lwp_id == lwpid)
2944 			break;
2945 	return (Lp);
2946 }
2947 
2948 /*
2949  * Grab an LWP contained within the controlled process.
2950  * Return an opaque pointer to its LWP control structure.
2951  *	perr: pointer to error return code.
2952  */
2953 struct ps_lwphandle *
2954 Lgrab(struct ps_prochandle *P, lwpid_t lwpid, int *perr)
2955 {
2956 	struct ps_lwphandle **Lp;
2957 	struct ps_lwphandle *L;
2958 	int fd;
2959 	char procname[PATH_MAX];
2960 	char *fname;
2961 	int rc = 0;
2962 
2963 	(void) mutex_lock(&P->proc_lock);
2964 
2965 	if (P->state == PS_UNDEAD || P->state == PS_IDLE)
2966 		rc = G_NOPROC;
2967 	else if (P->hashtab == NULL &&
2968 	    (P->hashtab = calloc(HASHSIZE, sizeof (struct ps_lwphandle *)))
2969 	    == NULL)
2970 		rc = G_STRANGE;
2971 	else if (*(Lp = Lfind(P, lwpid)) != NULL)
2972 		rc = G_BUSY;
2973 	else if ((L = malloc(sizeof (struct ps_lwphandle))) == NULL)
2974 		rc = G_STRANGE;
2975 	if (rc) {
2976 		*perr = rc;
2977 		(void) mutex_unlock(&P->proc_lock);
2978 		return (NULL);
2979 	}
2980 
2981 	(void) memset(L, 0, sizeof (*L));
2982 	L->lwp_ctlfd = -1;
2983 	L->lwp_statfd = -1;
2984 	L->lwp_proc = P;
2985 	L->lwp_id = lwpid;
2986 	*Lp = L;	/* insert into the hash table */
2987 
2988 	if (P->state == PS_DEAD) {	/* core file */
2989 		if (getlwpstatus(P, lwpid, &L->lwp_status) == -1) {
2990 			rc = G_NOPROC;
2991 			goto err;
2992 		}
2993 		L->lwp_state = PS_DEAD;
2994 		*perr = 0;
2995 		(void) mutex_unlock(&P->proc_lock);
2996 		return (L);
2997 	}
2998 
2999 	/*
3000 	 * Open the /proc/<pid>/lwp/<lwpid> files
3001 	 */
3002 	(void) snprintf(procname, sizeof (procname), "%s/%d/lwp/%d/",
3003 	    procfs_path, (int)P->pid, (int)lwpid);
3004 	fname = procname + strlen(procname);
3005 	(void) set_minfd();
3006 
3007 	(void) strcpy(fname, "lwpstatus");
3008 	if ((fd = open(procname, O_RDONLY)) < 0 ||
3009 	    (fd = dupfd(fd, 0)) < 0) {
3010 		switch (errno) {
3011 		case ENOENT:
3012 			rc = G_NOPROC;
3013 			break;
3014 		default:
3015 			dprintf("Lgrab: failed to open %s: %s\n",
3016 			    procname, strerror(errno));
3017 			rc = G_STRANGE;
3018 			break;
3019 		}
3020 		goto err;
3021 	}
3022 	L->lwp_statfd = fd;
3023 
3024 	if (pread(fd, &L->lwp_status, sizeof (L->lwp_status), (off_t)0) < 0) {
3025 		switch (errno) {
3026 		case ENOENT:
3027 			rc = G_NOPROC;
3028 			break;
3029 		default:
3030 			dprintf("Lgrab: failed to read %s: %s\n",
3031 			    procname, strerror(errno));
3032 			rc = G_STRANGE;
3033 			break;
3034 		}
3035 		goto err;
3036 	}
3037 
3038 	(void) strcpy(fname, "lwpctl");
3039 	if ((fd = open(procname, O_WRONLY)) < 0 ||
3040 	    (fd = dupfd(fd, 0)) < 0) {
3041 		switch (errno) {
3042 		case ENOENT:
3043 			rc = G_NOPROC;
3044 			break;
3045 		default:
3046 			dprintf("Lgrab: failed to open %s: %s\n",
3047 			    procname, strerror(errno));
3048 			rc = G_STRANGE;
3049 			break;
3050 		}
3051 		goto err;
3052 	}
3053 	L->lwp_ctlfd = fd;
3054 
3055 	L->lwp_state =
3056 	    ((L->lwp_status.pr_flags & (PR_STOPPED|PR_ISTOP))
3057 	    == (PR_STOPPED|PR_ISTOP))?
3058 	    PS_STOP : PS_RUN;
3059 
3060 	*perr = 0;
3061 	(void) mutex_unlock(&P->proc_lock);
3062 	return (L);
3063 
3064 err:
3065 	Lfree_internal(P, L);
3066 	*perr = rc;
3067 	(void) mutex_unlock(&P->proc_lock);
3068 	return (NULL);
3069 }
3070 
3071 /*
3072  * Return a printable string corresponding to an Lgrab() error return.
3073  */
3074 const char *
3075 Lgrab_error(int error)
3076 {
3077 	const char *str;
3078 
3079 	switch (error) {
3080 	case G_NOPROC:
3081 		str = "no such LWP";
3082 		break;
3083 	case G_BUSY:
3084 		str = "LWP already grabbed";
3085 		break;
3086 	case G_STRANGE:
3087 		str = "unanticipated system error";
3088 		break;
3089 	default:
3090 		str = "unknown error";
3091 		break;
3092 	}
3093 
3094 	return (str);
3095 }
3096 
3097 /*
3098  * Free an LWP control structure.
3099  */
3100 void
3101 Lfree(struct ps_lwphandle *L)
3102 {
3103 	struct ps_prochandle *P = L->lwp_proc;
3104 
3105 	(void) mutex_lock(&P->proc_lock);
3106 	Lfree_internal(P, L);
3107 	(void) mutex_unlock(&P->proc_lock);
3108 }
3109 
3110 static void
3111 Lfree_internal(struct ps_prochandle *P, struct ps_lwphandle *L)
3112 {
3113 	*Lfind(P, L->lwp_id) = L->lwp_hash;	/* delete from hash table */
3114 	if (L->lwp_ctlfd >= 0)
3115 		(void) close(L->lwp_ctlfd);
3116 	if (L->lwp_statfd >= 0)
3117 		(void) close(L->lwp_statfd);
3118 
3119 	/* clear out the structure as a precaution against reuse */
3120 	(void) memset(L, 0, sizeof (*L));
3121 	L->lwp_ctlfd = -1;
3122 	L->lwp_statfd = -1;
3123 
3124 	free(L);
3125 }
3126 
3127 /*
3128  * Return the state of the process, one of the PS_* values.
3129  */
3130 int
3131 Lstate(struct ps_lwphandle *L)
3132 {
3133 	return (L->lwp_state);
3134 }
3135 
3136 /*
3137  * Return the open control file descriptor for the LWP.
3138  * Clients must not close this file descriptor, nor use it
3139  * after the LWP is freed.
3140  */
3141 int
3142 Lctlfd(struct ps_lwphandle *L)
3143 {
3144 	return (L->lwp_ctlfd);
3145 }
3146 
3147 /*
3148  * Return a pointer to the LWP lwpsinfo structure.
3149  * Clients should not hold on to this pointer indefinitely.
3150  * It will become invalid on Lfree().
3151  */
3152 const lwpsinfo_t *
3153 Lpsinfo(struct ps_lwphandle *L)
3154 {
3155 	if (Plwp_getpsinfo(L->lwp_proc, L->lwp_id, &L->lwp_psinfo) == -1)
3156 		return (NULL);
3157 
3158 	return (&L->lwp_psinfo);
3159 }
3160 
3161 /*
3162  * Return a pointer to the LWP status structure.
3163  * Clients should not hold on to this pointer indefinitely.
3164  * It will become invalid on Lfree().
3165  */
3166 const lwpstatus_t *
3167 Lstatus(struct ps_lwphandle *L)
3168 {
3169 	return (&L->lwp_status);
3170 }
3171 
3172 /*
3173  * Given an LWP handle, return the process handle.
3174  */
3175 struct ps_prochandle *
3176 Lprochandle(struct ps_lwphandle *L)
3177 {
3178 	return (L->lwp_proc);
3179 }
3180 
3181 /*
3182  * Ensure that all cached state is written to the LWP.
3183  * The cached state is the LWP's signal mask and registers.
3184  */
3185 void
3186 Lsync(struct ps_lwphandle *L)
3187 {
3188 	int ctlfd = L->lwp_ctlfd;
3189 	long cmd[2];
3190 	iovec_t iov[4];
3191 	int n = 0;
3192 
3193 	if (L->lwp_flags & SETHOLD) {
3194 		cmd[0] = PCSHOLD;
3195 		iov[n].iov_base = (caddr_t)&cmd[0];
3196 		iov[n++].iov_len = sizeof (long);
3197 		iov[n].iov_base = (caddr_t)&L->lwp_status.pr_lwphold;
3198 		iov[n++].iov_len = sizeof (L->lwp_status.pr_lwphold);
3199 	}
3200 	if (L->lwp_flags & SETREGS) {
3201 		cmd[1] = PCSREG;
3202 		iov[n].iov_base = (caddr_t)&cmd[1];
3203 		iov[n++].iov_len = sizeof (long);
3204 		iov[n].iov_base = (caddr_t)&L->lwp_status.pr_reg[0];
3205 		iov[n++].iov_len = sizeof (L->lwp_status.pr_reg);
3206 	}
3207 
3208 	if (n == 0 || writev(ctlfd, iov, n) < 0)
3209 		return;		/* nothing to do or write failed */
3210 
3211 	L->lwp_flags &= ~(SETHOLD|SETREGS);
3212 }
3213 
3214 /*
3215  * Wait for the specified LWP to stop or terminate.
3216  * Or, just get the current status (PCNULL).
3217  * Or, direct it to stop and get the current status (PCDSTOP).
3218  */
3219 static int
3220 Lstopstatus(struct ps_lwphandle *L,
3221 	long request,		/* PCNULL, PCDSTOP, PCSTOP, PCWSTOP */
3222 	uint_t msec)		/* if non-zero, timeout in milliseconds */
3223 {
3224 	int ctlfd = L->lwp_ctlfd;
3225 	long ctl[3];
3226 	ssize_t rc;
3227 	int err;
3228 
3229 	switch (L->lwp_state) {
3230 	case PS_RUN:
3231 		break;
3232 	case PS_STOP:
3233 		if (request != PCNULL && request != PCDSTOP)
3234 			return (0);
3235 		break;
3236 	case PS_LOST:
3237 		if (request != PCNULL) {
3238 			errno = EAGAIN;
3239 			return (-1);
3240 		}
3241 		break;
3242 	case PS_UNDEAD:
3243 	case PS_DEAD:
3244 		if (request != PCNULL) {
3245 			errno = ENOENT;
3246 			return (-1);
3247 		}
3248 		break;
3249 	default:	/* corrupted state */
3250 		dprintf("Lstopstatus: corrupted state: %d\n", L->lwp_state);
3251 		errno = EINVAL;
3252 		return (-1);
3253 	}
3254 
3255 	ctl[0] = PCDSTOP;
3256 	ctl[1] = PCTWSTOP;
3257 	ctl[2] = (long)msec;
3258 	rc = 0;
3259 	switch (request) {
3260 	case PCSTOP:
3261 		rc = write(ctlfd, &ctl[0], 3*sizeof (long));
3262 		break;
3263 	case PCWSTOP:
3264 		rc = write(ctlfd, &ctl[1], 2*sizeof (long));
3265 		break;
3266 	case PCDSTOP:
3267 		rc = write(ctlfd, &ctl[0], 1*sizeof (long));
3268 		break;
3269 	case PCNULL:
3270 		if (L->lwp_state == PS_DEAD)
3271 			return (0); /* Nothing else to do for cores */
3272 		break;
3273 	default:	/* programming error */
3274 		errno = EINVAL;
3275 		return (-1);
3276 	}
3277 	err = (rc < 0)? errno : 0;
3278 	Lsync(L);
3279 
3280 	if (pread(L->lwp_statfd, &L->lwp_status,
3281 	    sizeof (L->lwp_status), (off_t)0) < 0)
3282 		err = errno;
3283 
3284 	if (err) {
3285 		switch (err) {
3286 		case EINTR:		/* user typed ctl-C */
3287 		case ERESTART:
3288 			dprintf("Lstopstatus: EINTR\n");
3289 			break;
3290 		case EAGAIN:		/* we lost control of the the process */
3291 			dprintf("Lstopstatus: EAGAIN\n");
3292 			L->lwp_state = PS_LOST;
3293 			errno = err;
3294 			return (-1);
3295 		default:
3296 			if (_libproc_debug) {
3297 				const char *errstr;
3298 
3299 				switch (request) {
3300 				case PCNULL:
3301 					errstr = "Lstopstatus PCNULL"; break;
3302 				case PCSTOP:
3303 					errstr = "Lstopstatus PCSTOP"; break;
3304 				case PCDSTOP:
3305 					errstr = "Lstopstatus PCDSTOP"; break;
3306 				case PCWSTOP:
3307 					errstr = "Lstopstatus PCWSTOP"; break;
3308 				default:
3309 					errstr = "Lstopstatus PC???"; break;
3310 				}
3311 				dprintf("%s: %s\n", errstr, strerror(err));
3312 			}
3313 			L->lwp_state = PS_UNDEAD;
3314 			errno = err;
3315 			return (-1);
3316 		}
3317 	}
3318 
3319 	if ((L->lwp_status.pr_flags & (PR_STOPPED|PR_ISTOP))
3320 	    != (PR_STOPPED|PR_ISTOP)) {
3321 		L->lwp_state = PS_RUN;
3322 		if (request == PCNULL || request == PCDSTOP || msec != 0)
3323 			return (0);
3324 		dprintf("Lstopstatus: LWP is not stopped\n");
3325 		errno = EPROTO;
3326 		return (-1);
3327 	}
3328 
3329 	L->lwp_state = PS_STOP;
3330 
3331 	if (_libproc_debug)	/* debugging */
3332 		prldump("Lstopstatus", &L->lwp_status);
3333 
3334 	switch (L->lwp_status.pr_why) {
3335 	case PR_SYSENTRY:
3336 	case PR_SYSEXIT:
3337 	case PR_REQUESTED:
3338 	case PR_SIGNALLED:
3339 	case PR_FAULTED:
3340 	case PR_JOBCONTROL:
3341 	case PR_SUSPENDED:
3342 		break;
3343 	default:
3344 		errno = EPROTO;
3345 		return (-1);
3346 	}
3347 
3348 	return (0);
3349 }
3350 
3351 /*
3352  * Wait for the LWP to stop for any reason.
3353  */
3354 int
3355 Lwait(struct ps_lwphandle *L, uint_t msec)
3356 {
3357 	return (Lstopstatus(L, PCWSTOP, msec));
3358 }
3359 
3360 /*
3361  * Direct the LWP to stop; wait for it to stop.
3362  */
3363 int
3364 Lstop(struct ps_lwphandle *L, uint_t msec)
3365 {
3366 	return (Lstopstatus(L, PCSTOP, msec));
3367 }
3368 
3369 /*
3370  * Direct the LWP to stop; don't wait.
3371  */
3372 int
3373 Ldstop(struct ps_lwphandle *L)
3374 {
3375 	return (Lstopstatus(L, PCDSTOP, 0));
3376 }
3377 
3378 /*
3379  * Get the value of one register from stopped LWP.
3380  */
3381 int
3382 Lgetareg(struct ps_lwphandle *L, int regno, prgreg_t *preg)
3383 {
3384 	if (regno < 0 || regno >= NPRGREG) {
3385 		errno = EINVAL;
3386 		return (-1);
3387 	}
3388 
3389 	if (L->lwp_state != PS_STOP) {
3390 		errno = EBUSY;
3391 		return (-1);
3392 	}
3393 
3394 	*preg = L->lwp_status.pr_reg[regno];
3395 	return (0);
3396 }
3397 
3398 /*
3399  * Put value of one register into stopped LWP.
3400  */
3401 int
3402 Lputareg(struct ps_lwphandle *L, int regno, prgreg_t reg)
3403 {
3404 	if (regno < 0 || regno >= NPRGREG) {
3405 		errno = EINVAL;
3406 		return (-1);
3407 	}
3408 
3409 	if (L->lwp_state != PS_STOP) {
3410 		errno = EBUSY;
3411 		return (-1);
3412 	}
3413 
3414 	L->lwp_status.pr_reg[regno] = reg;
3415 	L->lwp_flags |= SETREGS;	/* set registers before continuing */
3416 	return (0);
3417 }
3418 
3419 int
3420 Lsetrun(struct ps_lwphandle *L,
3421 	int sig,	/* signal to pass to LWP */
3422 	int flags)	/* PRSTEP|PRSABORT|PRSTOP|PRCSIG|PRCFAULT */
3423 {
3424 	int ctlfd = L->lwp_ctlfd;
3425 	int sbits = (PR_DSTOP | PR_ISTOP | PR_ASLEEP);
3426 
3427 	long ctl[1 +					/* PCCFAULT	*/
3428 	    1 + sizeof (siginfo_t)/sizeof (long) +	/* PCSSIG/PCCSIG */
3429 	    2 ];					/* PCRUN	*/
3430 
3431 	long *ctlp = ctl;
3432 	size_t size;
3433 
3434 	if (L->lwp_state != PS_STOP &&
3435 	    (L->lwp_status.pr_flags & sbits) == 0) {
3436 		errno = EBUSY;
3437 		return (-1);
3438 	}
3439 
3440 	Lsync(L);	/* flush registers */
3441 
3442 	if (flags & PRCFAULT) {		/* clear current fault */
3443 		*ctlp++ = PCCFAULT;
3444 		flags &= ~PRCFAULT;
3445 	}
3446 
3447 	if (flags & PRCSIG) {		/* clear current signal */
3448 		*ctlp++ = PCCSIG;
3449 		flags &= ~PRCSIG;
3450 	} else if (sig && sig != L->lwp_status.pr_cursig) {
3451 		/* make current signal */
3452 		siginfo_t *infop;
3453 
3454 		*ctlp++ = PCSSIG;
3455 		infop = (siginfo_t *)ctlp;
3456 		(void) memset(infop, 0, sizeof (*infop));
3457 		infop->si_signo = sig;
3458 		ctlp += sizeof (siginfo_t) / sizeof (long);
3459 	}
3460 
3461 	*ctlp++ = PCRUN;
3462 	*ctlp++ = flags;
3463 	size = (char *)ctlp - (char *)ctl;
3464 
3465 	L->lwp_proc->info_valid = 0; /* will need to update map and file info */
3466 	L->lwp_proc->state = PS_RUN;
3467 	L->lwp_state = PS_RUN;
3468 
3469 	if (write(ctlfd, ctl, size) != size) {
3470 		/* Pretend that a job-stopped LWP is running */
3471 		if (errno != EBUSY || L->lwp_status.pr_why != PR_JOBCONTROL)
3472 			return (Lstopstatus(L, PCNULL, 0));
3473 	}
3474 
3475 	return (0);
3476 }
3477 
3478 int
3479 Lclearsig(struct ps_lwphandle *L)
3480 {
3481 	int ctlfd = L->lwp_ctlfd;
3482 	long ctl = PCCSIG;
3483 
3484 	if (write(ctlfd, &ctl, sizeof (ctl)) != sizeof (ctl))
3485 		return (-1);
3486 	L->lwp_status.pr_cursig = 0;
3487 	return (0);
3488 }
3489 
3490 int
3491 Lclearfault(struct ps_lwphandle *L)
3492 {
3493 	int ctlfd = L->lwp_ctlfd;
3494 	long ctl = PCCFAULT;
3495 
3496 	if (write(ctlfd, &ctl, sizeof (ctl)) != sizeof (ctl))
3497 		return (-1);
3498 	return (0);
3499 }
3500 
3501 /*
3502  * Step over a breakpoint, i.e., execute the instruction that
3503  * really belongs at the breakpoint location (the current %pc)
3504  * and leave the LWP stopped at the next instruction.
3505  */
3506 int
3507 Lxecbkpt(struct ps_lwphandle *L, ulong_t saved)
3508 {
3509 	struct ps_prochandle *P = L->lwp_proc;
3510 	int rv, error;
3511 
3512 	if (L->lwp_state != PS_STOP) {
3513 		errno = EBUSY;
3514 		return (-1);
3515 	}
3516 
3517 	Lsync(L);
3518 	error = execute_bkpt(L->lwp_ctlfd,
3519 	    &P->status.pr_flttrace, &L->lwp_status.pr_lwphold,
3520 	    L->lwp_status.pr_reg[