xref: /freebsd/cddl/contrib/opensolaris/lib/libdtrace/common/dt_proc.c (revision 195ebc7e9e4b129de810833791a19dfb4349d6a9)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2007 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 
27 #pragma ident	"%Z%%M%	%I%	%E% SMI"
28 
29 /*
30  * DTrace Process Control
31  *
32  * This file provides a set of routines that permit libdtrace and its clients
33  * to create and grab process handles using libproc, and to share these handles
34  * between library mechanisms that need libproc access, such as ustack(), and
35  * client mechanisms that need libproc access, such as dtrace(1M) -c and -p.
36  * The library provides several mechanisms in the libproc control layer:
37  *
38  * Reference Counting: The library code and client code can independently grab
39  * the same process handles without interfering with one another.  Only when
40  * the reference count drops to zero and the handle is not being cached (see
41  * below for more information on caching) will Prelease() be called on it.
42  *
43  * Handle Caching: If a handle is grabbed PGRAB_RDONLY (e.g. by ustack()) and
44  * the reference count drops to zero, the handle is not immediately released.
45  * Instead, libproc handles are maintained on dph_lrulist in order from most-
46  * recently accessed to least-recently accessed.  Idle handles are maintained
47  * until a pre-defined LRU cache limit is exceeded, permitting repeated calls
48  * to ustack() to avoid the overhead of releasing and re-grabbing processes.
49  *
50  * Process Control: For processes that are grabbed for control (~PGRAB_RDONLY)
51  * or created by dt_proc_create(), a control thread is created to provide
52  * callbacks on process exit and symbol table caching on dlopen()s.
53  *
54  * MT-Safety: Libproc is not MT-Safe, so dt_proc_lock() and dt_proc_unlock()
55  * are provided to synchronize access to the libproc handle between libdtrace
56  * code and client code and the control thread's use of the ps_prochandle.
57  *
58  * NOTE: MT-Safety is NOT provided for libdtrace itself, or for use of the
59  * dtrace_proc_grab/dtrace_proc_create mechanisms.  Like all exported libdtrace
60  * calls, these are assumed to be MT-Unsafe.  MT-Safety is ONLY provided for
61  * synchronization between libdtrace control threads and the client thread.
62  *
63  * The ps_prochandles themselves are maintained along with a dt_proc_t struct
64  * in a hash table indexed by PID.  This provides basic locking and reference
65  * counting.  The dt_proc_t is also maintained in LRU order on dph_lrulist.
66  * The dph_lrucnt and dph_lrulim count the number of cacheable processes and
67  * the current limit on the number of actively cached entries.
68  *
69  * The control thread for a process establishes breakpoints at the rtld_db
70  * locations of interest, updates mappings and symbol tables at these points,
71  * and handles exec and fork (by always following the parent).  The control
72  * thread automatically exits when the process dies or control is lost.
73  *
74  * A simple notification mechanism is provided for libdtrace clients using
75  * dtrace_handle_proc() for notification of PS_UNDEAD or PS_LOST events.  If
76  * such an event occurs, the dt_proc_t itself is enqueued on a notification
77  * list and the control thread broadcasts to dph_cv.  dtrace_sleep() will wake
78  * up using this condition and will then call the client handler as necessary.
79  */
80 
81 #include <sys/wait.h>
82 #if defined(sun)
83 #include <sys/lwp.h>
84 #endif
85 #include <strings.h>
86 #include <signal.h>
87 #include <assert.h>
88 #include <errno.h>
89 
90 #include <dt_proc.h>
91 #include <dt_pid.h>
92 #include <dt_impl.h>
93 
94 #define	IS_SYS_EXEC(w)	(w == SYS_exec || w == SYS_execve)
95 #define	IS_SYS_FORK(w)	(w == SYS_vfork || w == SYS_fork1 ||	\
96 			w == SYS_forkall || w == SYS_forksys)
97 
98 #ifdef DOODAD
99 static dt_bkpt_t *
100 dt_proc_bpcreate(dt_proc_t *dpr, uintptr_t addr, dt_bkpt_f *func, void *data)
101 {
102 	struct ps_prochandle *P = dpr->dpr_proc;
103 	dt_bkpt_t *dbp;
104 
105 	assert(DT_MUTEX_HELD(&dpr->dpr_lock));
106 
107 	if ((dbp = dt_zalloc(dpr->dpr_hdl, sizeof (dt_bkpt_t))) != NULL) {
108 		dbp->dbp_func = func;
109 		dbp->dbp_data = data;
110 		dbp->dbp_addr = addr;
111 
112 		if (Psetbkpt(P, dbp->dbp_addr, &dbp->dbp_instr) == 0)
113 			dbp->dbp_active = B_TRUE;
114 
115 		dt_list_append(&dpr->dpr_bps, dbp);
116 	}
117 
118 	return (dbp);
119 }
120 #endif
121 
122 static void
123 dt_proc_bpdestroy(dt_proc_t *dpr, int delbkpts)
124 {
125 #if defined(sun)
126 	int state = Pstate(dpr->dpr_proc);
127 #else
128 	int state = proc_state(dpr->dpr_proc);
129 #endif
130 	dt_bkpt_t *dbp, *nbp;
131 
132 	assert(DT_MUTEX_HELD(&dpr->dpr_lock));
133 
134 	for (dbp = dt_list_next(&dpr->dpr_bps); dbp != NULL; dbp = nbp) {
135 printf("%s:%s(%d): DOODAD\n",__FUNCTION__,__FILE__,__LINE__);
136 #ifdef DOODAD
137 		if (delbkpts && dbp->dbp_active &&
138 		    state != PS_LOST && state != PS_UNDEAD) {
139 			(void) Pdelbkpt(dpr->dpr_proc,
140 			    dbp->dbp_addr, dbp->dbp_instr);
141 		}
142 #endif
143 		nbp = dt_list_next(dbp);
144 		dt_list_delete(&dpr->dpr_bps, dbp);
145 		dt_free(dpr->dpr_hdl, dbp);
146 	}
147 }
148 
149 #ifdef DOODAD
150 static void
151 dt_proc_bpmatch(dtrace_hdl_t *dtp, dt_proc_t *dpr)
152 {
153 	const lwpstatus_t *psp = &Pstatus(dpr->dpr_proc)->pr_lwp;
154 	dt_bkpt_t *dbp;
155 
156 	assert(DT_MUTEX_HELD(&dpr->dpr_lock));
157 
158 	for (dbp = dt_list_next(&dpr->dpr_bps);
159 	    dbp != NULL; dbp = dt_list_next(dbp)) {
160 		if (psp->pr_reg[R_PC] == dbp->dbp_addr)
161 			break;
162 	}
163 
164 	if (dbp == NULL) {
165 		dt_dprintf("pid %d: spurious breakpoint wakeup for %lx\n",
166 		    (int)dpr->dpr_pid, (ulong_t)psp->pr_reg[R_PC]);
167 		return;
168 	}
169 
170 	dt_dprintf("pid %d: hit breakpoint at %lx (%lu)\n",
171 	    (int)dpr->dpr_pid, (ulong_t)dbp->dbp_addr, ++dbp->dbp_hits);
172 
173 	dbp->dbp_func(dtp, dpr, dbp->dbp_data);
174 	(void) Pxecbkpt(dpr->dpr_proc, dbp->dbp_instr);
175 }
176 #endif
177 
178 static void
179 dt_proc_bpenable(dt_proc_t *dpr)
180 {
181 	dt_bkpt_t *dbp;
182 
183 	assert(DT_MUTEX_HELD(&dpr->dpr_lock));
184 
185 	for (dbp = dt_list_next(&dpr->dpr_bps);
186 	    dbp != NULL; dbp = dt_list_next(dbp)) {
187 printf("%s:%s(%d): DOODAD\n",__FUNCTION__,__FILE__,__LINE__);
188 #ifdef DOODAD
189 		if (!dbp->dbp_active && Psetbkpt(dpr->dpr_proc,
190 		    dbp->dbp_addr, &dbp->dbp_instr) == 0)
191 			dbp->dbp_active = B_TRUE;
192 #endif
193 	}
194 
195 	dt_dprintf("breakpoints enabled\n");
196 }
197 
198 static void
199 dt_proc_bpdisable(dt_proc_t *dpr)
200 {
201 	dt_bkpt_t *dbp;
202 
203 	assert(DT_MUTEX_HELD(&dpr->dpr_lock));
204 
205 	for (dbp = dt_list_next(&dpr->dpr_bps);
206 	    dbp != NULL; dbp = dt_list_next(dbp)) {
207 printf("%s:%s(%d): DOODAD\n",__FUNCTION__,__FILE__,__LINE__);
208 #ifdef DOODAD
209 		if (dbp->dbp_active && Pdelbkpt(dpr->dpr_proc,
210 		    dbp->dbp_addr, dbp->dbp_instr) == 0)
211 			dbp->dbp_active = B_FALSE;
212 #endif
213 	}
214 
215 	dt_dprintf("breakpoints disabled\n");
216 }
217 
218 static void
219 dt_proc_notify(dtrace_hdl_t *dtp, dt_proc_hash_t *dph, dt_proc_t *dpr,
220     const char *msg)
221 {
222 	dt_proc_notify_t *dprn = dt_alloc(dtp, sizeof (dt_proc_notify_t));
223 
224 	if (dprn == NULL) {
225 		dt_dprintf("failed to allocate notification for %d %s\n",
226 		    (int)dpr->dpr_pid, msg);
227 	} else {
228 		dprn->dprn_dpr = dpr;
229 		if (msg == NULL)
230 			dprn->dprn_errmsg[0] = '\0';
231 		else
232 			(void) strlcpy(dprn->dprn_errmsg, msg,
233 			    sizeof (dprn->dprn_errmsg));
234 
235 		(void) pthread_mutex_lock(&dph->dph_lock);
236 
237 		dprn->dprn_next = dph->dph_notify;
238 		dph->dph_notify = dprn;
239 
240 		(void) pthread_cond_broadcast(&dph->dph_cv);
241 		(void) pthread_mutex_unlock(&dph->dph_lock);
242 	}
243 }
244 
245 /*
246  * Check to see if the control thread was requested to stop when the victim
247  * process reached a particular event (why) rather than continuing the victim.
248  * If 'why' is set in the stop mask, we wait on dpr_cv for dt_proc_continue().
249  * If 'why' is not set, this function returns immediately and does nothing.
250  */
251 static void
252 dt_proc_stop(dt_proc_t *dpr, uint8_t why)
253 {
254 	assert(DT_MUTEX_HELD(&dpr->dpr_lock));
255 	assert(why != DT_PROC_STOP_IDLE);
256 
257 	if (dpr->dpr_stop & why) {
258 		dpr->dpr_stop |= DT_PROC_STOP_IDLE;
259 		dpr->dpr_stop &= ~why;
260 
261 		(void) pthread_cond_broadcast(&dpr->dpr_cv);
262 
263 		/*
264 		 * We disable breakpoints while stopped to preserve the
265 		 * integrity of the program text for both our own disassembly
266 		 * and that of the kernel.
267 		 */
268 		dt_proc_bpdisable(dpr);
269 
270 		while (dpr->dpr_stop & DT_PROC_STOP_IDLE)
271 			(void) pthread_cond_wait(&dpr->dpr_cv, &dpr->dpr_lock);
272 
273 		dt_proc_bpenable(dpr);
274 	}
275 }
276 
277 /*ARGSUSED*/
278 static void
279 dt_proc_bpmain(dtrace_hdl_t *dtp, dt_proc_t *dpr, const char *fname)
280 {
281 	dt_dprintf("pid %d: breakpoint at %s()\n", (int)dpr->dpr_pid, fname);
282 	dt_proc_stop(dpr, DT_PROC_STOP_MAIN);
283 }
284 
285 #if defined(sun)
286 static void
287 dt_proc_rdevent(dtrace_hdl_t *dtp, dt_proc_t *dpr, const char *evname)
288 {
289 	rd_event_msg_t rdm;
290 	rd_err_e err;
291 
292 	if ((err = rd_event_getmsg(dpr->dpr_rtld, &rdm)) != RD_OK) {
293 		dt_dprintf("pid %d: failed to get %s event message: %s\n",
294 		    (int)dpr->dpr_pid, evname, rd_errstr(err));
295 		return;
296 	}
297 
298 	dt_dprintf("pid %d: rtld event %s type=%d state %d\n",
299 	    (int)dpr->dpr_pid, evname, rdm.type, rdm.u.state);
300 
301 	switch (rdm.type) {
302 	case RD_DLACTIVITY:
303 		if (rdm.u.state != RD_CONSISTENT)
304 			break;
305 
306 		Pupdate_syms(dpr->dpr_proc);
307 		if (dt_pid_create_probes_module(dtp, dpr) != 0)
308 			dt_proc_notify(dtp, dtp->dt_procs, dpr,
309 			    dpr->dpr_errmsg);
310 
311 		break;
312 	case RD_PREINIT:
313 		Pupdate_syms(dpr->dpr_proc);
314 		dt_proc_stop(dpr, DT_PROC_STOP_PREINIT);
315 		break;
316 	case RD_POSTINIT:
317 		Pupdate_syms(dpr->dpr_proc);
318 		dt_proc_stop(dpr, DT_PROC_STOP_POSTINIT);
319 		break;
320 	}
321 }
322 
323 static void
324 dt_proc_rdwatch(dt_proc_t *dpr, rd_event_e event, const char *evname)
325 {
326 	rd_notify_t rdn;
327 	rd_err_e err;
328 
329 	if ((err = rd_event_addr(dpr->dpr_rtld, event, &rdn)) != RD_OK) {
330 		dt_dprintf("pid %d: failed to get event address for %s: %s\n",
331 		    (int)dpr->dpr_pid, evname, rd_errstr(err));
332 		return;
333 	}
334 
335 	if (rdn.type != RD_NOTIFY_BPT) {
336 		dt_dprintf("pid %d: event %s has unexpected type %d\n",
337 		    (int)dpr->dpr_pid, evname, rdn.type);
338 		return;
339 	}
340 
341 	(void) dt_proc_bpcreate(dpr, rdn.u.bptaddr,
342 	    (dt_bkpt_f *)dt_proc_rdevent, (void *)evname);
343 }
344 
345 /*
346  * Common code for enabling events associated with the run-time linker after
347  * attaching to a process or after a victim process completes an exec(2).
348  */
349 static void
350 dt_proc_attach(dt_proc_t *dpr, int exec)
351 {
352 	const pstatus_t *psp = Pstatus(dpr->dpr_proc);
353 	rd_err_e err;
354 	GElf_Sym sym;
355 
356 	assert(DT_MUTEX_HELD(&dpr->dpr_lock));
357 
358 	if (exec) {
359 		if (psp->pr_lwp.pr_errno != 0)
360 			return; /* exec failed: nothing needs to be done */
361 
362 		dt_proc_bpdestroy(dpr, B_FALSE);
363 		Preset_maps(dpr->dpr_proc);
364 	}
365 
366 	if ((dpr->dpr_rtld = Prd_agent(dpr->dpr_proc)) != NULL &&
367 	    (err = rd_event_enable(dpr->dpr_rtld, B_TRUE)) == RD_OK) {
368 		dt_proc_rdwatch(dpr, RD_PREINIT, "RD_PREINIT");
369 		dt_proc_rdwatch(dpr, RD_POSTINIT, "RD_POSTINIT");
370 		dt_proc_rdwatch(dpr, RD_DLACTIVITY, "RD_DLACTIVITY");
371 	} else {
372 		dt_dprintf("pid %d: failed to enable rtld events: %s\n",
373 		    (int)dpr->dpr_pid, dpr->dpr_rtld ? rd_errstr(err) :
374 		    "rtld_db agent initialization failed");
375 	}
376 
377 	Pupdate_maps(dpr->dpr_proc);
378 
379 	if (Pxlookup_by_name(dpr->dpr_proc, LM_ID_BASE,
380 	    "a.out", "main", &sym, NULL) == 0) {
381 		(void) dt_proc_bpcreate(dpr, (uintptr_t)sym.st_value,
382 		    (dt_bkpt_f *)dt_proc_bpmain, "a.out`main");
383 	} else {
384 		dt_dprintf("pid %d: failed to find a.out`main: %s\n",
385 		    (int)dpr->dpr_pid, strerror(errno));
386 	}
387 }
388 
389 /*
390  * Wait for a stopped process to be set running again by some other debugger.
391  * This is typically not required by /proc-based debuggers, since the usual
392  * model is that one debugger controls one victim.  But DTrace, as usual, has
393  * its own needs: the stop() action assumes that prun(1) or some other tool
394  * will be applied to resume the victim process.  This could be solved by
395  * adding a PCWRUN directive to /proc, but that seems like overkill unless
396  * other debuggers end up needing this functionality, so we implement a cheap
397  * equivalent to PCWRUN using the set of existing kernel mechanisms.
398  *
399  * Our intent is really not just to wait for the victim to run, but rather to
400  * wait for it to run and then stop again for a reason other than the current
401  * PR_REQUESTED stop.  Since PCWSTOP/Pstopstatus() can be applied repeatedly
402  * to a stopped process and will return the same result without affecting the
403  * victim, we can just perform these operations repeatedly until Pstate()
404  * changes, the representative LWP ID changes, or the stop timestamp advances.
405  * dt_proc_control() will then rediscover the new state and continue as usual.
406  * When the process is still stopped in the same exact state, we sleep for a
407  * brief interval before waiting again so as not to spin consuming CPU cycles.
408  */
409 static void
410 dt_proc_waitrun(dt_proc_t *dpr)
411 {
412 	struct ps_prochandle *P = dpr->dpr_proc;
413 	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
414 
415 	int krflag = psp->pr_flags & (PR_KLC | PR_RLC);
416 	timestruc_t tstamp = psp->pr_tstamp;
417 	lwpid_t lwpid = psp->pr_lwpid;
418 
419 	const long wstop = PCWSTOP;
420 	int pfd = Pctlfd(P);
421 
422 	assert(DT_MUTEX_HELD(&dpr->dpr_lock));
423 	assert(psp->pr_flags & PR_STOPPED);
424 	assert(Pstate(P) == PS_STOP);
425 
426 	/*
427 	 * While we are waiting for the victim to run, clear PR_KLC and PR_RLC
428 	 * so that if the libdtrace client is killed, the victim stays stopped.
429 	 * dt_proc_destroy() will also observe this and perform PRELEASE_HANG.
430 	 */
431 	(void) Punsetflags(P, krflag);
432 	Psync(P);
433 
434 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
435 
436 	while (!dpr->dpr_quit) {
437 		if (write(pfd, &wstop, sizeof (wstop)) == -1 && errno == EINTR)
438 			continue; /* check dpr_quit and continue waiting */
439 
440 		(void) pthread_mutex_lock(&dpr->dpr_lock);
441 		(void) Pstopstatus(P, PCNULL, 0);
442 		psp = &Pstatus(P)->pr_lwp;
443 
444 		/*
445 		 * If we've reached a new state, found a new representative, or
446 		 * the stop timestamp has changed, restore PR_KLC/PR_RLC to its
447 		 * original setting and then return with dpr_lock held.
448 		 */
449 		if (Pstate(P) != PS_STOP || psp->pr_lwpid != lwpid ||
450 		    bcmp(&psp->pr_tstamp, &tstamp, sizeof (tstamp)) != 0) {
451 			(void) Psetflags(P, krflag);
452 			Psync(P);
453 			return;
454 		}
455 
456 		(void) pthread_mutex_unlock(&dpr->dpr_lock);
457 		(void) poll(NULL, 0, MILLISEC / 2);
458 	}
459 
460 	(void) pthread_mutex_lock(&dpr->dpr_lock);
461 }
462 #endif
463 
464 typedef struct dt_proc_control_data {
465 	dtrace_hdl_t *dpcd_hdl;			/* DTrace handle */
466 	dt_proc_t *dpcd_proc;			/* proccess to control */
467 } dt_proc_control_data_t;
468 
469 /*
470  * Main loop for all victim process control threads.  We initialize all the
471  * appropriate /proc control mechanisms, and then enter a loop waiting for
472  * the process to stop on an event or die.  We process any events by calling
473  * appropriate subroutines, and exit when the victim dies or we lose control.
474  *
475  * The control thread synchronizes the use of dpr_proc with other libdtrace
476  * threads using dpr_lock.  We hold the lock for all of our operations except
477  * waiting while the process is running: this is accomplished by writing a
478  * PCWSTOP directive directly to the underlying /proc/<pid>/ctl file.  If the
479  * libdtrace client wishes to exit or abort our wait, SIGCANCEL can be used.
480  */
481 static void *
482 dt_proc_control(void *arg)
483 {
484 	dt_proc_control_data_t *datap = arg;
485 	dtrace_hdl_t *dtp = datap->dpcd_hdl;
486 	dt_proc_t *dpr = datap->dpcd_proc;
487 	dt_proc_hash_t *dph = dpr->dpr_hdl->dt_procs;
488 	struct ps_prochandle *P = dpr->dpr_proc;
489 	int pid = dpr->dpr_pid;
490 
491 #if defined(sun)
492 	int pfd = Pctlfd(P);
493 
494 	const long wstop = PCWSTOP;
495 #endif
496 	int notify = B_FALSE;
497 
498 	/*
499 	 * We disable the POSIX thread cancellation mechanism so that the
500 	 * client program using libdtrace can't accidentally cancel our thread.
501 	 * dt_proc_destroy() uses SIGCANCEL explicitly to simply poke us out
502 	 * of PCWSTOP with EINTR, at which point we will see dpr_quit and exit.
503 	 */
504 	(void) pthread_setcancelstate(PTHREAD_CANCEL_DISABLE, NULL);
505 
506 	/*
507 	 * Set up the corresponding process for tracing by libdtrace.  We want
508 	 * to be able to catch breakpoints and efficiently single-step over
509 	 * them, and we need to enable librtld_db to watch libdl activity.
510 	 */
511 	(void) pthread_mutex_lock(&dpr->dpr_lock);
512 
513 #if defined(sun)
514 	(void) Punsetflags(P, PR_ASYNC);	/* require synchronous mode */
515 	(void) Psetflags(P, PR_BPTADJ);		/* always adjust eip on x86 */
516 	(void) Punsetflags(P, PR_FORK);		/* do not inherit on fork */
517 
518 	(void) Pfault(P, FLTBPT, B_TRUE);	/* always trace breakpoints */
519 	(void) Pfault(P, FLTTRACE, B_TRUE);	/* always trace single-step */
520 
521 	/*
522 	 * We must trace exit from exec() system calls so that if the exec is
523 	 * successful, we can reset our breakpoints and re-initialize libproc.
524 	 */
525 	(void) Psysexit(P, SYS_exec, B_TRUE);
526 	(void) Psysexit(P, SYS_execve, B_TRUE);
527 
528 	/*
529 	 * We must trace entry and exit for fork() system calls in order to
530 	 * disable our breakpoints temporarily during the fork.  We do not set
531 	 * the PR_FORK flag, so if fork succeeds the child begins executing and
532 	 * does not inherit any other tracing behaviors or a control thread.
533 	 */
534 	(void) Psysentry(P, SYS_vfork, B_TRUE);
535 	(void) Psysexit(P, SYS_vfork, B_TRUE);
536 	(void) Psysentry(P, SYS_fork1, B_TRUE);
537 	(void) Psysexit(P, SYS_fork1, B_TRUE);
538 	(void) Psysentry(P, SYS_forkall, B_TRUE);
539 	(void) Psysexit(P, SYS_forkall, B_TRUE);
540 	(void) Psysentry(P, SYS_forksys, B_TRUE);
541 	(void) Psysexit(P, SYS_forksys, B_TRUE);
542 
543 	Psync(P);				/* enable all /proc changes */
544 	dt_proc_attach(dpr, B_FALSE);		/* enable rtld breakpoints */
545 
546 	/*
547 	 * If PR_KLC is set, we created the process; otherwise we grabbed it.
548 	 * Check for an appropriate stop request and wait for dt_proc_continue.
549 	 */
550 	if (Pstatus(P)->pr_flags & PR_KLC)
551 		dt_proc_stop(dpr, DT_PROC_STOP_CREATE);
552 	else
553 		dt_proc_stop(dpr, DT_PROC_STOP_GRAB);
554 
555 	if (Psetrun(P, 0, 0) == -1) {
556 		dt_dprintf("pid %d: failed to set running: %s\n",
557 		    (int)dpr->dpr_pid, strerror(errno));
558 	}
559 #else
560 	/*
561 	 * If PR_KLC is set, we created the process; otherwise we grabbed it.
562 	 * Check for an appropriate stop request and wait for dt_proc_continue.
563 	 */
564 	if (proc_getflags(P) & PR_KLC)
565 		dt_proc_stop(dpr, DT_PROC_STOP_CREATE);
566 	else
567 		dt_proc_stop(dpr, DT_PROC_STOP_GRAB);
568 
569 	if (proc_continue(P) != 0)
570 		dt_dprintf("pid %d: failed to set running: %s\n",
571 		    (int)dpr->dpr_pid, strerror(errno));
572 #endif
573 
574 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
575 
576 	/*
577 	 * Wait for the process corresponding to this control thread to stop,
578 	 * process the event, and then set it running again.  We want to sleep
579 	 * with dpr_lock *unheld* so that other parts of libdtrace can use the
580 	 * ps_prochandle in the meantime (e.g. ustack()).  To do this, we write
581 	 * a PCWSTOP directive directly to the underlying /proc/<pid>/ctl file.
582 	 * Once the process stops, we wake up, grab dpr_lock, and then call
583 	 * Pwait() (which will return immediately) and do our processing.
584 	 */
585 	while (!dpr->dpr_quit) {
586 #if defined(sun)
587 		const lwpstatus_t *psp;
588 
589 		if (write(pfd, &wstop, sizeof (wstop)) == -1 && errno == EINTR)
590 			continue; /* check dpr_quit and continue waiting */
591 #else
592 		/* Wait for the process to report status. */
593 		proc_wait(P);
594 #endif
595 
596 		(void) pthread_mutex_lock(&dpr->dpr_lock);
597 
598 #if defined(sun)
599 pwait_locked:
600 		if (Pstopstatus(P, PCNULL, 0) == -1 && errno == EINTR) {
601 			(void) pthread_mutex_unlock(&dpr->dpr_lock);
602 			continue; /* check dpr_quit and continue waiting */
603 		}
604 #endif
605 
606 #if defined(sun)
607 		switch (Pstate(P)) {
608 #else
609 		switch (proc_state(P)) {
610 #endif
611 		case PS_STOP:
612 #ifdef DOODAD
613 			psp = &Pstatus(P)->pr_lwp;
614 
615 			dt_dprintf("pid %d: proc stopped showing %d/%d\n",
616 			    pid, psp->pr_why, psp->pr_what);
617 
618 			/*
619 			 * If the process stops showing PR_REQUESTED, then the
620 			 * DTrace stop() action was applied to it or another
621 			 * debugging utility (e.g. pstop(1)) asked it to stop.
622 			 * In either case, the user's intention is for the
623 			 * process to remain stopped until another external
624 			 * mechanism (e.g. prun(1)) is applied.  So instead of
625 			 * setting the process running ourself, we wait for
626 			 * someone else to do so.  Once that happens, we return
627 			 * to our normal loop waiting for an event of interest.
628 			 */
629 			if (psp->pr_why == PR_REQUESTED) {
630 				dt_proc_waitrun(dpr);
631 				(void) pthread_mutex_unlock(&dpr->dpr_lock);
632 				continue;
633 			}
634 
635 			/*
636 			 * If the process stops showing one of the events that
637 			 * we are tracing, perform the appropriate response.
638 			 * Note that we ignore PR_SUSPENDED, PR_CHECKPOINT, and
639 			 * PR_JOBCONTROL by design: if one of these conditions
640 			 * occurs, we will fall through to Psetrun() but the
641 			 * process will remain stopped in the kernel by the
642 			 * corresponding mechanism (e.g. job control stop).
643 			 */
644 			if (psp->pr_why == PR_FAULTED && psp->pr_what == FLTBPT)
645 				dt_proc_bpmatch(dtp, dpr);
646 			else if (psp->pr_why == PR_SYSENTRY &&
647 			    IS_SYS_FORK(psp->pr_what))
648 				dt_proc_bpdisable(dpr);
649 			else if (psp->pr_why == PR_SYSEXIT &&
650 			    IS_SYS_FORK(psp->pr_what))
651 				dt_proc_bpenable(dpr);
652 			else if (psp->pr_why == PR_SYSEXIT &&
653 			    IS_SYS_EXEC(psp->pr_what))
654 				dt_proc_attach(dpr, B_TRUE);
655 #endif
656 			break;
657 
658 		case PS_LOST:
659 #if defined(sun)
660 			if (Preopen(P) == 0)
661 				goto pwait_locked;
662 #endif
663 
664 			dt_dprintf("pid %d: proc lost: %s\n",
665 			    pid, strerror(errno));
666 
667 			dpr->dpr_quit = B_TRUE;
668 			notify = B_TRUE;
669 			break;
670 
671 		case PS_UNDEAD:
672 			dt_dprintf("pid %d: proc died\n", pid);
673 			dpr->dpr_quit = B_TRUE;
674 			notify = B_TRUE;
675 			break;
676 		}
677 
678 #if defined(sun)
679 		if (Pstate(P) != PS_UNDEAD && Psetrun(P, 0, 0) == -1) {
680 			dt_dprintf("pid %d: failed to set running: %s\n",
681 			    (int)dpr->dpr_pid, strerror(errno));
682 		}
683 #endif
684 
685 		(void) pthread_mutex_unlock(&dpr->dpr_lock);
686 	}
687 
688 	/*
689 	 * If the control thread detected PS_UNDEAD or PS_LOST, then enqueue
690 	 * the dt_proc_t structure on the dt_proc_hash_t notification list.
691 	 */
692 	if (notify)
693 		dt_proc_notify(dtp, dph, dpr, NULL);
694 
695 	/*
696 	 * Destroy and remove any remaining breakpoints, set dpr_done and clear
697 	 * dpr_tid to indicate the control thread has exited, and notify any
698 	 * waiting thread in dt_proc_destroy() that we have succesfully exited.
699 	 */
700 	(void) pthread_mutex_lock(&dpr->dpr_lock);
701 
702 	dt_proc_bpdestroy(dpr, B_TRUE);
703 	dpr->dpr_done = B_TRUE;
704 	dpr->dpr_tid = 0;
705 
706 	(void) pthread_cond_broadcast(&dpr->dpr_cv);
707 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
708 
709 	return (NULL);
710 }
711 
712 /*PRINTFLIKE3*/
713 static struct ps_prochandle *
714 dt_proc_error(dtrace_hdl_t *dtp, dt_proc_t *dpr, const char *format, ...)
715 {
716 	va_list ap;
717 
718 	va_start(ap, format);
719 	dt_set_errmsg(dtp, NULL, NULL, NULL, 0, format, ap);
720 	va_end(ap);
721 
722 	if (dpr->dpr_proc != NULL)
723 #if defined(sun)
724 		Prelease(dpr->dpr_proc, 0);
725 #else
726 		proc_detach(dpr->dpr_proc);
727 #endif
728 
729 	dt_free(dtp, dpr);
730 	(void) dt_set_errno(dtp, EDT_COMPILER);
731 	return (NULL);
732 }
733 
734 dt_proc_t *
735 dt_proc_lookup(dtrace_hdl_t *dtp, struct ps_prochandle *P, int remove)
736 {
737 	dt_proc_hash_t *dph = dtp->dt_procs;
738 #if defined(sun)
739 	pid_t pid = Pstatus(P)->pr_pid;
740 #else
741 	pid_t pid = proc_getpid(P);
742 #endif
743 	dt_proc_t *dpr, **dpp = &dph->dph_hash[pid & (dph->dph_hashlen - 1)];
744 
745 	for (dpr = *dpp; dpr != NULL; dpr = dpr->dpr_hash) {
746 		if (dpr->dpr_pid == pid)
747 			break;
748 		else
749 			dpp = &dpr->dpr_hash;
750 	}
751 
752 	assert(dpr != NULL);
753 	assert(dpr->dpr_proc == P);
754 
755 	if (remove)
756 		*dpp = dpr->dpr_hash; /* remove from pid hash chain */
757 
758 	return (dpr);
759 }
760 
761 static void
762 dt_proc_destroy(dtrace_hdl_t *dtp, struct ps_prochandle *P)
763 {
764 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
765 	dt_proc_hash_t *dph = dtp->dt_procs;
766 	dt_proc_notify_t *npr, **npp;
767 	int rflag;
768 
769 	assert(dpr != NULL);
770 
771 	/*
772 	 * If neither PR_KLC nor PR_RLC is set, then the process is stopped by
773 	 * an external debugger and we were waiting in dt_proc_waitrun().
774 	 * Leave the process in this condition using PRELEASE_HANG.
775 	 */
776 #if defined(sun)
777 	if (!(Pstatus(dpr->dpr_proc)->pr_flags & (PR_KLC | PR_RLC))) {
778 #else
779 	if (!(proc_getflags(dpr->dpr_proc) & (PR_KLC | PR_RLC))) {
780 #endif
781 		dt_dprintf("abandoning pid %d\n", (int)dpr->dpr_pid);
782 #if defined(sun)
783 		rflag = PRELEASE_HANG;
784 #else
785 		rflag = 0 /* XXX */;
786 #endif
787 	} else {
788 		dt_dprintf("releasing pid %d\n", (int)dpr->dpr_pid);
789 		rflag = 0; /* apply kill or run-on-last-close */
790 	}
791 
792 	if (dpr->dpr_tid) {
793 		/*
794 		 * Set the dpr_quit flag to tell the daemon thread to exit.  We
795 		 * send it a SIGCANCEL to poke it out of PCWSTOP or any other
796 		 * long-term /proc system call.  Our daemon threads have POSIX
797 		 * cancellation disabled, so EINTR will be the only effect.  We
798 		 * then wait for dpr_done to indicate the thread has exited.
799 		 *
800 		 * We can't use pthread_kill() to send SIGCANCEL because the
801 		 * interface forbids it and we can't use pthread_cancel()
802 		 * because with cancellation disabled it won't actually
803 		 * send SIGCANCEL to the target thread, so we use _lwp_kill()
804 		 * to do the job.  This is all built on evil knowledge of
805 		 * the details of the cancellation mechanism in libc.
806 		 */
807 		(void) pthread_mutex_lock(&dpr->dpr_lock);
808 		dpr->dpr_quit = B_TRUE;
809 #if defined(sun)
810 		(void) _lwp_kill(dpr->dpr_tid, SIGCANCEL);
811 #else
812 		(void) pthread_kill(dpr->dpr_tid, SIGUSR1);
813 #endif
814 
815 		/*
816 		 * If the process is currently idling in dt_proc_stop(), re-
817 		 * enable breakpoints and poke it into running again.
818 		 */
819 		if (dpr->dpr_stop & DT_PROC_STOP_IDLE) {
820 			dt_proc_bpenable(dpr);
821 			dpr->dpr_stop &= ~DT_PROC_STOP_IDLE;
822 			(void) pthread_cond_broadcast(&dpr->dpr_cv);
823 		}
824 
825 		while (!dpr->dpr_done)
826 			(void) pthread_cond_wait(&dpr->dpr_cv, &dpr->dpr_lock);
827 
828 		(void) pthread_mutex_unlock(&dpr->dpr_lock);
829 	}
830 
831 	/*
832 	 * Before we free the process structure, remove this dt_proc_t from the
833 	 * lookup hash, and then walk the dt_proc_hash_t's notification list
834 	 * and remove this dt_proc_t if it is enqueued.
835 	 */
836 	(void) pthread_mutex_lock(&dph->dph_lock);
837 	(void) dt_proc_lookup(dtp, P, B_TRUE);
838 	npp = &dph->dph_notify;
839 
840 	while ((npr = *npp) != NULL) {
841 		if (npr->dprn_dpr == dpr) {
842 			*npp = npr->dprn_next;
843 			dt_free(dtp, npr);
844 		} else {
845 			npp = &npr->dprn_next;
846 		}
847 	}
848 
849 	(void) pthread_mutex_unlock(&dph->dph_lock);
850 
851 	/*
852 	 * Remove the dt_proc_list from the LRU list, release the underlying
853 	 * libproc handle, and free our dt_proc_t data structure.
854 	 */
855 	if (dpr->dpr_cacheable) {
856 		assert(dph->dph_lrucnt != 0);
857 		dph->dph_lrucnt--;
858 	}
859 
860 	dt_list_delete(&dph->dph_lrulist, dpr);
861 #if defined(sun)
862 	Prelease(dpr->dpr_proc, rflag);
863 #else
864 	proc_detach(dpr->dpr_proc);
865 #endif
866 	dt_free(dtp, dpr);
867 }
868 
869 static int
870 dt_proc_create_thread(dtrace_hdl_t *dtp, dt_proc_t *dpr, uint_t stop)
871 {
872 	dt_proc_control_data_t data;
873 	sigset_t nset, oset;
874 	pthread_attr_t a;
875 	int err;
876 
877 	(void) pthread_mutex_lock(&dpr->dpr_lock);
878 	dpr->dpr_stop |= stop; /* set bit for initial rendezvous */
879 
880 	(void) pthread_attr_init(&a);
881 	(void) pthread_attr_setdetachstate(&a, PTHREAD_CREATE_DETACHED);
882 
883 	(void) sigfillset(&nset);
884 	(void) sigdelset(&nset, SIGABRT);	/* unblocked for assert() */
885 #if defined(sun)
886 	(void) sigdelset(&nset, SIGCANCEL);	/* see dt_proc_destroy() */
887 #else
888 	(void) sigdelset(&nset, SIGUSR1);	/* see dt_proc_destroy() */
889 #endif
890 
891 	data.dpcd_hdl = dtp;
892 	data.dpcd_proc = dpr;
893 
894 	(void) pthread_sigmask(SIG_SETMASK, &nset, &oset);
895 	err = pthread_create(&dpr->dpr_tid, &a, dt_proc_control, &data);
896 	(void) pthread_sigmask(SIG_SETMASK, &oset, NULL);
897 
898 	/*
899 	 * If the control thread was created, then wait on dpr_cv for either
900 	 * dpr_done to be set (the victim died or the control thread failed)
901 	 * or DT_PROC_STOP_IDLE to be set, indicating that the victim is now
902 	 * stopped by /proc and the control thread is at the rendezvous event.
903 	 * On success, we return with the process and control thread stopped:
904 	 * the caller can then apply dt_proc_continue() to resume both.
905 	 */
906 	if (err == 0) {
907 		while (!dpr->dpr_done && !(dpr->dpr_stop & DT_PROC_STOP_IDLE))
908 			(void) pthread_cond_wait(&dpr->dpr_cv, &dpr->dpr_lock);
909 
910 		/*
911 		 * If dpr_done is set, the control thread aborted before it
912 		 * reached the rendezvous event.  This is either due to PS_LOST
913 		 * or PS_UNDEAD (i.e. the process died).  We try to provide a
914 		 * small amount of useful information to help figure it out.
915 		 */
916 		if (dpr->dpr_done) {
917 #if defined(sun)
918 			const psinfo_t *prp = Ppsinfo(dpr->dpr_proc);
919 			int stat = prp ? prp->pr_wstat : 0;
920 #endif
921 			int pid = dpr->dpr_pid;
922 
923 #if defined(sun)
924 			if (Pstate(dpr->dpr_proc) == PS_LOST) {
925 #else
926 			if (proc_state(dpr->dpr_proc) == PS_LOST) {
927 #endif
928 				(void) dt_proc_error(dpr->dpr_hdl, dpr,
929 				    "failed to control pid %d: process exec'd "
930 				    "set-id or unobservable program\n", pid);
931 #if defined(sun)
932 			} else if (WIFSIGNALED(stat)) {
933 				(void) dt_proc_error(dpr->dpr_hdl, dpr,
934 				    "failed to control pid %d: process died "
935 				    "from signal %d\n", pid, WTERMSIG(stat));
936 			} else {
937 				(void) dt_proc_error(dpr->dpr_hdl, dpr,
938 				    "failed to control pid %d: process exited "
939 				    "with status %d\n", pid, WEXITSTATUS(stat));
940 #endif
941 			}
942 
943 			err = ESRCH; /* cause grab() or create() to fail */
944 		}
945 	} else {
946 		(void) dt_proc_error(dpr->dpr_hdl, dpr,
947 		    "failed to create control thread for process-id %d: %s\n",
948 		    (int)dpr->dpr_pid, strerror(err));
949 	}
950 
951 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
952 	(void) pthread_attr_destroy(&a);
953 
954 	return (err);
955 }
956 
957 struct ps_prochandle *
958 dt_proc_create(dtrace_hdl_t *dtp, const char *file, char *const *argv,
959     proc_child_func *pcf, void *child_arg)
960 {
961 	dt_proc_hash_t *dph = dtp->dt_procs;
962 	dt_proc_t *dpr;
963 	int err;
964 
965 	if ((dpr = dt_zalloc(dtp, sizeof (dt_proc_t))) == NULL)
966 		return (NULL); /* errno is set for us */
967 
968 	(void) pthread_mutex_init(&dpr->dpr_lock, NULL);
969 	(void) pthread_cond_init(&dpr->dpr_cv, NULL);
970 
971 #if defined(sun)
972 	if ((dpr->dpr_proc = Pcreate(file, argv, &err, NULL, 0)) == NULL) {
973 		return (dt_proc_error(dtp, dpr,
974 		    "failed to execute %s: %s\n", file, Pcreate_error(err)));
975 	}
976 
977 	dpr->dpr_hdl = dtp;
978 	dpr->dpr_pid = Pstatus(dpr->dpr_proc)->pr_pid;
979 
980 	(void) Punsetflags(dpr->dpr_proc, PR_RLC);
981 	(void) Psetflags(dpr->dpr_proc, PR_KLC);
982 #else
983 	(void) proc_clearflags(dpr->dpr_proc, PR_RLC);
984 	(void) proc_setflags(dpr->dpr_proc, PR_KLC);
985 	if ((err = proc_create(file, argv, pcf, child_arg, &dpr->dpr_proc)) != 0)
986 		return (dt_proc_error(dtp, dpr,
987 		    "failed to execute %s: %s\n", file, strerror(err)));
988 	dpr->dpr_hdl = dtp;
989 	dpr->dpr_pid = proc_getpid(dpr->dpr_proc);
990 #endif
991 
992 #if defined(sun)
993 	if (dt_proc_create_thread(dtp, dpr, dtp->dt_prcmode) != 0)
994 #else
995 	if (dt_proc_create_thread(dtp, dpr, DT_PROC_STOP_IDLE) != 0)
996 #endif
997 		return (NULL); /* dt_proc_error() has been called for us */
998 
999 	dpr->dpr_hash = dph->dph_hash[dpr->dpr_pid & (dph->dph_hashlen - 1)];
1000 	dph->dph_hash[dpr->dpr_pid & (dph->dph_hashlen - 1)] = dpr;
1001 	dt_list_prepend(&dph->dph_lrulist, dpr);
1002 
1003 	dt_dprintf("created pid %d\n", (int)dpr->dpr_pid);
1004 	dpr->dpr_refs++;
1005 
1006 	return (dpr->dpr_proc);
1007 }
1008 
1009 struct ps_prochandle *
1010 dt_proc_grab(dtrace_hdl_t *dtp, pid_t pid, int flags, int nomonitor)
1011 {
1012 	dt_proc_hash_t *dph = dtp->dt_procs;
1013 	uint_t h = pid & (dph->dph_hashlen - 1);
1014 	dt_proc_t *dpr, *opr;
1015 	int err;
1016 
1017 	/*
1018 	 * Search the hash table for the pid.  If it is already grabbed or
1019 	 * created, move the handle to the front of the lrulist, increment
1020 	 * the reference count, and return the existing ps_prochandle.
1021 	 */
1022 	for (dpr = dph->dph_hash[h]; dpr != NULL; dpr = dpr->dpr_hash) {
1023 		if (dpr->dpr_pid == pid && !dpr->dpr_stale) {
1024 			/*
1025 			 * If the cached handle was opened read-only and
1026 			 * this request is for a writeable handle, mark
1027 			 * the cached handle as stale and open a new handle.
1028 			 * Since it's stale, unmark it as cacheable.
1029 			 */
1030 			if (dpr->dpr_rdonly && !(flags & PGRAB_RDONLY)) {
1031 				dt_dprintf("upgrading pid %d\n", (int)pid);
1032 				dpr->dpr_stale = B_TRUE;
1033 				dpr->dpr_cacheable = B_FALSE;
1034 				dph->dph_lrucnt--;
1035 				break;
1036 			}
1037 
1038 			dt_dprintf("grabbed pid %d (cached)\n", (int)pid);
1039 			dt_list_delete(&dph->dph_lrulist, dpr);
1040 			dt_list_prepend(&dph->dph_lrulist, dpr);
1041 			dpr->dpr_refs++;
1042 			return (dpr->dpr_proc);
1043 		}
1044 	}
1045 
1046 	if ((dpr = dt_zalloc(dtp, sizeof (dt_proc_t))) == NULL)
1047 		return (NULL); /* errno is set for us */
1048 
1049 	(void) pthread_mutex_init(&dpr->dpr_lock, NULL);
1050 	(void) pthread_cond_init(&dpr->dpr_cv, NULL);
1051 
1052 #if defined(sun)
1053 	if ((dpr->dpr_proc = Pgrab(pid, flags, &err)) == NULL) {
1054 		return (dt_proc_error(dtp, dpr,
1055 		    "failed to grab pid %d: %s\n", (int)pid, Pgrab_error(err)));
1056 	}
1057 #else
1058 	if ((err = proc_attach(pid, flags, &dpr->dpr_proc)) != 0)
1059 		return (dt_proc_error(dtp, dpr,
1060 		    "failed to grab pid %d: %s\n", (int) pid, strerror(err)));
1061 #endif
1062 
1063 	dpr->dpr_hdl = dtp;
1064 	dpr->dpr_pid = pid;
1065 
1066 #if defined(sun)
1067 	(void) Punsetflags(dpr->dpr_proc, PR_KLC);
1068 	(void) Psetflags(dpr->dpr_proc, PR_RLC);
1069 #else
1070 	(void) proc_clearflags(dpr->dpr_proc, PR_KLC);
1071 	(void) proc_setflags(dpr->dpr_proc, PR_RLC);
1072 #endif
1073 
1074 	/*
1075 	 * If we are attempting to grab the process without a monitor
1076 	 * thread, then mark the process cacheable only if it's being
1077 	 * grabbed read-only.  If we're currently caching more process
1078 	 * handles than dph_lrulim permits, attempt to find the
1079 	 * least-recently-used handle that is currently unreferenced and
1080 	 * release it from the cache.  Otherwise we are grabbing the process
1081 	 * for control: create a control thread for this process and store
1082 	 * its ID in dpr->dpr_tid.
1083 	 */
1084 	if (nomonitor || (flags & PGRAB_RDONLY)) {
1085 		if (dph->dph_lrucnt >= dph->dph_lrulim) {
1086 			for (opr = dt_list_prev(&dph->dph_lrulist);
1087 			    opr != NULL; opr = dt_list_prev(opr)) {
1088 				if (opr->dpr_cacheable && opr->dpr_refs == 0) {
1089 					dt_proc_destroy(dtp, opr->dpr_proc);
1090 					break;
1091 				}
1092 			}
1093 		}
1094 
1095 		if (flags & PGRAB_RDONLY) {
1096 			dpr->dpr_cacheable = B_TRUE;
1097 			dpr->dpr_rdonly = B_TRUE;
1098 			dph->dph_lrucnt++;
1099 		}
1100 
1101 	} else if (dt_proc_create_thread(dtp, dpr, DT_PROC_STOP_GRAB) != 0)
1102 		return (NULL); /* dt_proc_error() has been called for us */
1103 
1104 	dpr->dpr_hash = dph->dph_hash[h];
1105 	dph->dph_hash[h] = dpr;
1106 	dt_list_prepend(&dph->dph_lrulist, dpr);
1107 
1108 	dt_dprintf("grabbed pid %d\n", (int)pid);
1109 	dpr->dpr_refs++;
1110 
1111 	return (dpr->dpr_proc);
1112 }
1113 
1114 void
1115 dt_proc_release(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1116 {
1117 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
1118 	dt_proc_hash_t *dph = dtp->dt_procs;
1119 
1120 	assert(dpr != NULL);
1121 	assert(dpr->dpr_refs != 0);
1122 
1123 	if (--dpr->dpr_refs == 0 &&
1124 	    (!dpr->dpr_cacheable || dph->dph_lrucnt > dph->dph_lrulim))
1125 		dt_proc_destroy(dtp, P);
1126 }
1127 
1128 void
1129 dt_proc_continue(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1130 {
1131 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
1132 
1133 	(void) pthread_mutex_lock(&dpr->dpr_lock);
1134 
1135 	if (dpr->dpr_stop & DT_PROC_STOP_IDLE) {
1136 		dpr->dpr_stop &= ~DT_PROC_STOP_IDLE;
1137 		(void) pthread_cond_broadcast(&dpr->dpr_cv);
1138 	}
1139 
1140 	(void) pthread_mutex_unlock(&dpr->dpr_lock);
1141 }
1142 
1143 void
1144 dt_proc_lock(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1145 {
1146 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
1147 	int err = pthread_mutex_lock(&dpr->dpr_lock);
1148 	assert(err == 0); /* check for recursion */
1149 }
1150 
1151 void
1152 dt_proc_unlock(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1153 {
1154 	dt_proc_t *dpr = dt_proc_lookup(dtp, P, B_FALSE);
1155 	int err = pthread_mutex_unlock(&dpr->dpr_lock);
1156 	assert(err == 0); /* check for unheld lock */
1157 }
1158 
1159 void
1160 dt_proc_hash_create(dtrace_hdl_t *dtp)
1161 {
1162 	if ((dtp->dt_procs = dt_zalloc(dtp, sizeof (dt_proc_hash_t) +
1163 	    sizeof (dt_proc_t *) * _dtrace_pidbuckets - 1)) != NULL) {
1164 
1165 		(void) pthread_mutex_init(&dtp->dt_procs->dph_lock, NULL);
1166 		(void) pthread_cond_init(&dtp->dt_procs->dph_cv, NULL);
1167 
1168 		dtp->dt_procs->dph_hashlen = _dtrace_pidbuckets;
1169 		dtp->dt_procs->dph_lrulim = _dtrace_pidlrulim;
1170 	}
1171 }
1172 
1173 void
1174 dt_proc_hash_destroy(dtrace_hdl_t *dtp)
1175 {
1176 	dt_proc_hash_t *dph = dtp->dt_procs;
1177 	dt_proc_t *dpr;
1178 
1179 	while ((dpr = dt_list_next(&dph->dph_lrulist)) != NULL)
1180 		dt_proc_destroy(dtp, dpr->dpr_proc);
1181 
1182 	dtp->dt_procs = NULL;
1183 	dt_free(dtp, dph);
1184 }
1185 
1186 struct ps_prochandle *
1187 dtrace_proc_create(dtrace_hdl_t *dtp, const char *file, char *const *argv,
1188     proc_child_func *pcf, void *child_arg)
1189 {
1190 	dt_ident_t *idp = dt_idhash_lookup(dtp->dt_macros, "target");
1191 	struct ps_prochandle *P = dt_proc_create(dtp, file, argv, pcf, child_arg);
1192 
1193 	if (P != NULL && idp != NULL && idp->di_id == 0)
1194 #if defined(sun)
1195 		idp->di_id = Pstatus(P)->pr_pid; /* $target = created pid */
1196 #else
1197 		idp->di_id = proc_getpid(P); /* $target = created pid */
1198 #endif
1199 
1200 	return (P);
1201 }
1202 
1203 struct ps_prochandle *
1204 dtrace_proc_grab(dtrace_hdl_t *dtp, pid_t pid, int flags)
1205 {
1206 	dt_ident_t *idp = dt_idhash_lookup(dtp->dt_macros, "target");
1207 	struct ps_prochandle *P = dt_proc_grab(dtp, pid, flags, 0);
1208 
1209 	if (P != NULL && idp != NULL && idp->di_id == 0)
1210 		idp->di_id = pid; /* $target = grabbed pid */
1211 
1212 	return (P);
1213 }
1214 
1215 void
1216 dtrace_proc_release(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1217 {
1218 	dt_proc_release(dtp, P);
1219 }
1220 
1221 void
1222 dtrace_proc_continue(dtrace_hdl_t *dtp, struct ps_prochandle *P)
1223 {
1224 	dt_proc_continue(dtp, P);
1225 }
1226