xref: /illumos-gate/usr/src/cmd/mdb/common/kmdb/kmdb_kvm.c (revision 55d6cb5d63bcf69dfa47b8c41c770a2d34f169b0)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
23  * Copyright (c) 2013 by Delphix. All rights reserved.
24  *
25  * Copyright 2019 Joyent, Inc.
26  */
27 
28 #include <kmdb/kmdb_kvm.h>
29 #include <kmdb/kvm.h>
30 #include <kmdb/kmdb_kdi.h>
31 #include <kmdb/kmdb_promif.h>
32 #include <kmdb/kmdb_module.h>
33 #include <kmdb/kmdb_asmutil.h>
34 #include <mdb/mdb_types.h>
35 #include <mdb/mdb_conf.h>
36 #include <mdb/mdb_err.h>
37 #include <mdb/mdb_modapi.h>
38 #include <mdb/mdb_target_impl.h>
39 #include <mdb/mdb_debug.h>
40 #include <mdb/mdb_string.h>
41 #include <mdb/mdb_ctf.h>
42 #include <mdb/mdb_kreg_impl.h>
43 #include <mdb/mdb_ks.h>
44 #include <mdb/mdb.h>
45 
46 #include <strings.h>
47 #include <dlfcn.h>
48 #include <sys/isa_defs.h>
49 #include <sys/kobj.h>
50 #include <sys/kobj_impl.h>
51 #include <sys/bitmap.h>
52 #include <sys/uuid.h>
53 #include <vm/as.h>
54 
55 static const char KMT_RTLD_NAME[] = "krtld";
56 static const char KMT_MODULE[] = "mdb_ks";
57 static const char KMT_CTFPARENT[] = "genunix";
58 
59 static mdb_list_t kmt_defbp_list;	/* List of current deferred bp's */
60 static int kmt_defbp_lock;		/* For list, running kernel holds */
61 static uint_t kmt_defbp_modchg_isload;	/* Whether mod change is load/unload */
62 static struct modctl *kmt_defbp_modchg_modctl; /* modctl for defbp checking */
63 static uint_t kmt_defbp_num;		/* Number of referenced def'd bp's */
64 static int kmt_defbp_bpspec;		/* vespec for def'd bp activation bp */
65 
66 static const mdb_se_ops_t kmt_brkpt_ops;
67 static const mdb_se_ops_t kmt_wapt_ops;
68 
69 static void kmt_sync(mdb_tgt_t *);
70 
71 typedef struct kmt_symarg {
72 	mdb_tgt_sym_f *sym_cb;		/* Caller's callback function */
73 	void *sym_data;			/* Callback function argument */
74 	uint_t sym_type;		/* Symbol type/binding filter */
75 	mdb_syminfo_t sym_info;		/* Symbol id and table id */
76 	const char *sym_obj;		/* Containing object */
77 } kmt_symarg_t;
78 
79 typedef struct kmt_maparg {
80 	mdb_tgt_t *map_target;		/* Target used for mapping iter */
81 	mdb_tgt_map_f *map_cb;		/* Caller's callback function */
82 	void *map_data;			/* Callback function argument */
83 } kmt_maparg_t;
84 
85 /*ARGSUSED*/
86 int
87 kmt_setflags(mdb_tgt_t *t, int flags)
88 {
89 	/*
90 	 * We only handle one flag (ALLOWIO), and we can't fail to set or clear
91 	 * it, so we just blindly replace the t_flags version with the one
92 	 * passed.
93 	 */
94 	t->t_flags = (t->t_flags & ~MDB_TGT_F_ALLOWIO) |
95 	    (flags & MDB_TGT_F_ALLOWIO);
96 
97 	return (0);
98 }
99 
100 /*ARGSUSED*/
101 const char *
102 kmt_name(mdb_tgt_t *t)
103 {
104 	return ("kmdb_kvm");
105 }
106 
107 /*ARGSUSED*/
108 static const char *
109 kmt_platform(mdb_tgt_t *t)
110 {
111 	static char platform[SYS_NMLN];
112 
113 	if (kmdb_dpi_get_state(NULL) == DPI_STATE_INIT)
114 		return (mdb_conf_platform());
115 
116 	if (mdb_tgt_readsym(mdb.m_target, MDB_TGT_AS_VIRT, platform,
117 	    sizeof (platform), "unix", "platform") != sizeof (platform)) {
118 		warn("'platform' symbol is missing from kernel\n");
119 		return ("unknown");
120 	}
121 
122 	return (platform);
123 }
124 
125 static int
126 kmt_uname(mdb_tgt_t *t, struct utsname *utsp)
127 {
128 	return (mdb_tgt_readsym(t, MDB_TGT_AS_VIRT, utsp,
129 	    sizeof (struct utsname), MDB_TGT_OBJ_EXEC, "utsname"));
130 }
131 
132 /*ARGSUSED*/
133 static int
134 kmt_dmodel(mdb_tgt_t *t)
135 {
136 	return (MDB_TGT_MODEL_NATIVE);
137 }
138 
139 /*ARGSUSED*/
140 ssize_t
141 kmt_rw(mdb_tgt_t *t, void *buf, size_t nbytes, uint64_t addr,
142     ssize_t (*rw)(void *, size_t, uint64_t))
143 {
144 	/*
145 	 * chunksz needs to be volatile because of the use of setjmp() in this
146 	 * function.
147 	 */
148 	volatile size_t chunksz;
149 	size_t n, ndone;
150 	jmp_buf *oldpcb = NULL;
151 	jmp_buf pcb;
152 	ssize_t res;
153 
154 	kmdb_prom_check_interrupt();
155 
156 	if (nbytes == 0)
157 		return (0);
158 
159 	/*
160 	 * Try to process the entire buffer, as requested.  If we catch a fault,
161 	 * try smaller chunks.  This allows us to handle regions that cross
162 	 * mapping boundaries.
163 	 */
164 	chunksz = nbytes;
165 	ndone = 0;
166 	if (setjmp(pcb) != 0) {
167 		if (chunksz == 1) {
168 			/* We failed with the smallest chunk - give up */
169 			kmdb_dpi_restore_fault_hdlr(oldpcb);
170 			return (ndone > 0 ? ndone : -1); /* errno set for us */
171 		} else if (chunksz > 4)
172 			chunksz = 4;
173 		else
174 			chunksz = 1;
175 	}
176 
177 	oldpcb = kmdb_dpi_set_fault_hdlr(&pcb);
178 	while (nbytes > 0) {
179 		n = MIN(chunksz, nbytes);
180 
181 		if ((res = rw(buf, n, addr)) != n)
182 			return (res < 0 ? res : ndone + res);
183 
184 		addr += n;
185 		nbytes -= n;
186 		ndone += n;
187 		buf = ((caddr_t)buf + n);
188 	}
189 
190 	kmdb_dpi_restore_fault_hdlr(oldpcb);
191 
192 	return (ndone);
193 }
194 
195 static void
196 kmt_bcopy(const void *s1, void *s2, size_t n)
197 {
198 	/*
199 	 * We need to guarantee atomic accesses for certain sizes.  bcopy won't
200 	 * make that guarantee, so we need to do it ourselves.
201 	 */
202 #ifdef	_LP64
203 	if (n == 8 && ((uintptr_t)s1 & 7) == 0 && ((uintptr_t)s2 & 7) == 0)
204 		*(uint64_t *)s2 = *(uint64_t *)s1;
205 	else
206 #endif
207 	if (n == 4 && ((uintptr_t)s1 & 3) == 0 && ((uintptr_t)s2 & 3) == 0)
208 		*(uint32_t *)s2 = *(uint32_t *)s1;
209 	else if (n == 2 && ((uintptr_t)s1 & 1) == 0 && ((uintptr_t)s2 & 1) == 0)
210 		*(uint16_t *)s2 = *(uint16_t *)s1;
211 	else if (n == 1)
212 		*(uint8_t *)s2 = *(uint8_t *)s1;
213 	else
214 		bcopy(s1, s2, n);
215 }
216 
217 static ssize_t
218 kmt_reader(void *buf, size_t nbytes, uint64_t addr)
219 {
220 	kmt_bcopy((void *)(uintptr_t)addr, buf, nbytes);
221 	return (nbytes);
222 }
223 
224 ssize_t
225 kmt_writer(void *buf, size_t nbytes, uint64_t addr)
226 {
227 	kmt_bcopy(buf, (void *)(uintptr_t)addr, nbytes);
228 	return (nbytes);
229 }
230 
231 /*ARGSUSED*/
232 static ssize_t
233 kmt_read(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
234 {
235 	/*
236 	 * We don't want to allow reads of I/O-mapped memory.  Multi-page reads
237 	 * that cross into I/O-mapped memory should be restricted to the initial
238 	 * non-I/O region.  Reads that begin in I/O-mapped memory are failed
239 	 * outright.
240 	 */
241 	if (!(t->t_flags & MDB_TGT_F_ALLOWIO) &&
242 	    (nbytes = kmdb_kdi_range_is_nontoxic(addr, nbytes, 0)) == 0)
243 		return (set_errno(EMDB_NOMAP));
244 
245 	return (kmt_rw(t, buf, nbytes, addr, kmt_reader));
246 }
247 
248 /*ARGSUSED*/
249 static ssize_t
250 kmt_pread(mdb_tgt_t *t, void *buf, size_t nbytes, physaddr_t addr)
251 {
252 	return (kmt_rw(t, buf, nbytes, addr, kmdb_kdi_pread));
253 }
254 
255 /*ARGSUSED*/
256 ssize_t
257 kmt_pwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, physaddr_t addr)
258 {
259 	return (kmt_rw(t, (void *)buf, nbytes, addr, kmdb_kdi_pwrite));
260 }
261 
262 static uintptr_t
263 kmt_read_kas(mdb_tgt_t *t)
264 {
265 	GElf_Sym sym;
266 
267 	if (mdb_tgt_lookup_by_name(t, "unix", "kas", &sym, NULL) < 0) {
268 		warn("'kas' symbol is missing from kernel\n");
269 		(void) set_errno(EMDB_NOSYM);
270 		return (0);
271 	}
272 
273 	return ((uintptr_t)sym.st_value);
274 }
275 
276 static int
277 kmt_vtop(mdb_tgt_t *t, mdb_tgt_as_t as, uintptr_t va, physaddr_t *pap)
278 {
279 	mdb_module_t *mod;
280 	struct as *asp;
281 	mdb_var_t *v;
282 
283 	switch ((uintptr_t)as) {
284 	case (uintptr_t)MDB_TGT_AS_PHYS:
285 	case (uintptr_t)MDB_TGT_AS_FILE:
286 	case (uintptr_t)MDB_TGT_AS_IO:
287 		return (set_errno(EINVAL));
288 	case (uintptr_t)MDB_TGT_AS_VIRT:
289 	case (uintptr_t)MDB_TGT_AS_VIRT_I:
290 	case (uintptr_t)MDB_TGT_AS_VIRT_S:
291 		if ((asp = (struct as *)kmt_read_kas(t)) == NULL)
292 			return (-1); /* errno is set for us */
293 		break;
294 	default:
295 		asp = (struct as *)as;
296 
297 		/* We don't support non-kas vtop */
298 		if (asp != (struct as *)kmt_read_kas(t))
299 			return (set_errno(EMDB_TGTNOTSUP));
300 	}
301 
302 	if (kmdb_prom_vtop(va, pap) == 0)
303 		return (0);
304 
305 	if ((v = mdb_nv_lookup(&mdb.m_modules, "unix")) != NULL &&
306 	    (mod = mdb_nv_get_cookie(v)) != NULL) {
307 		int (*fptr)(uintptr_t, struct as *, physaddr_t *);
308 
309 		fptr = (int (*)(uintptr_t, struct as *, physaddr_t *))
310 		    dlsym(mod->mod_hdl, "platform_vtop");
311 
312 		if ((fptr != NULL) && ((*fptr)(va, asp, pap) == 0))
313 			return (0);
314 	}
315 
316 	return (set_errno(EMDB_NOMAP));
317 }
318 
319 /*ARGSUSED*/
320 static int
321 kmt_cpuregs(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
322 {
323 	const mdb_tgt_gregset_t *gregs;
324 	intptr_t cpuid = DPI_MASTER_CPUID;
325 	int i;
326 
327 	if (flags & DCMD_ADDRSPEC) {
328 		if (argc != 0)
329 			return (DCMD_USAGE);
330 		if ((cpuid = mdb_cpu2cpuid(addr)) < 0) {
331 			(void) set_errno(EMDB_NOMAP);
332 			mdb_warn("failed to find cpuid for cpu at %p", addr);
333 			return (DCMD_ERR);
334 		}
335 	}
336 
337 	i = mdb_getopts(argc, argv,
338 	    'c', MDB_OPT_UINTPTR, &cpuid,
339 	    NULL);
340 
341 	argc -= i;
342 	argv += i;
343 
344 	if (argc != 0)
345 		return (DCMD_USAGE);
346 
347 	if ((gregs = kmdb_dpi_get_gregs(cpuid)) == NULL) {
348 		warn("failed to retrieve registers for cpu %d", (int)cpuid);
349 		return (DCMD_ERR);
350 	}
351 
352 	kmt_printregs(gregs);
353 
354 	return (DCMD_OK);
355 }
356 
357 static int
358 kmt_regs(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
359 {
360 	if (flags & DCMD_ADDRSPEC)
361 		return (DCMD_USAGE);
362 
363 	return (kmt_cpuregs(addr, flags, argc, argv));
364 }
365 
366 static int
367 kmt_cpustack_dcmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
368 {
369 	intptr_t cpuid = DPI_MASTER_CPUID;
370 	uint_t verbose = 0;
371 	int i;
372 
373 	if (flags & DCMD_ADDRSPEC) {
374 		if ((cpuid = mdb_cpu2cpuid(addr)) < 0) {
375 			(void) set_errno(EMDB_NOMAP);
376 			mdb_warn("failed to find cpuid for cpu at %p", addr);
377 			return (DCMD_ERR);
378 		}
379 		flags &= ~DCMD_ADDRSPEC;
380 	}
381 
382 	i = mdb_getopts(argc, argv,
383 	    'c', MDB_OPT_UINTPTR, &cpuid,
384 	    'v', MDB_OPT_SETBITS, 1, &verbose,
385 	    NULL);
386 
387 	argc -= i;
388 	argv += i;
389 
390 	return (kmt_cpustack(addr, flags, argc, argv, cpuid, verbose));
391 }
392 
393 /*
394  * Lasciate ogne speranza, voi ch'intrate.
395  */
396 static int
397 kmt_call(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
398 {
399 	uintptr_t *call_argv, rval;
400 	int parse_strings = 1;
401 	GElf_Sym sym;
402 	jmp_buf *oldpcb = NULL;
403 	jmp_buf pcb;
404 	int i;
405 
406 	if (!(flags & DCMD_ADDRSPEC))
407 		return (DCMD_USAGE);
408 
409 	if (mdb_tgt_lookup_by_addr(mdb.m_target, addr, MDB_TGT_SYM_EXACT,
410 	    NULL, 0, &sym, NULL) == 0 && GELF_ST_TYPE(sym.st_info) !=
411 	    STT_FUNC) {
412 		warn("%a is not a function\n", addr);
413 		return (DCMD_ERR);
414 	}
415 
416 	if (argc > 1 && argv[0].a_type == MDB_TYPE_STRING &&
417 	    strcmp(argv[0].a_un.a_str, "-s") == 0) {
418 		parse_strings = 0;
419 		argc--;
420 		argv++;
421 	}
422 
423 	call_argv = mdb_alloc(sizeof (uintptr_t) * argc, UM_SLEEP);
424 
425 	for (i = 0; i < argc; i++) {
426 		switch (argv[i].a_type) {
427 		case MDB_TYPE_STRING:
428 			/*
429 			 * mdb_strtoull doesn't return on error, so we have to
430 			 * pre-check strings suspected to contain numbers.
431 			 */
432 			if (parse_strings && strisbasenum(argv[i].a_un.a_str)) {
433 				call_argv[i] = (uintptr_t)mdb_strtoull(
434 				    argv[i].a_un.a_str);
435 			} else
436 				call_argv[i] = (uintptr_t)argv[i].a_un.a_str;
437 
438 			break;
439 
440 		case MDB_TYPE_IMMEDIATE:
441 			call_argv[i] = argv[i].a_un.a_val;
442 			break;
443 
444 		default:
445 			mdb_free(call_argv,
446 			    sizeof (uintptr_t) * argc);
447 			return (DCMD_USAGE);
448 		}
449 	}
450 
451 	if (setjmp(pcb) != 0) {
452 		warn("call failed: caught a trap\n");
453 
454 		kmdb_dpi_restore_fault_hdlr(oldpcb);
455 		mdb_free(call_argv, sizeof (uintptr_t) * argc);
456 		return (DCMD_ERR);
457 	}
458 
459 	oldpcb = kmdb_dpi_set_fault_hdlr(&pcb);
460 	rval = kmdb_dpi_call(addr, argc, call_argv);
461 	kmdb_dpi_restore_fault_hdlr(oldpcb);
462 
463 	if (flags & DCMD_PIPE_OUT) {
464 		mdb_printf("%p\n", rval);
465 	} else {
466 		/* pretty-print the results */
467 		mdb_printf("%p = %a(", rval, addr);
468 		for (i = 0; i < argc; i++) {
469 			if (i > 0)
470 				mdb_printf(", ");
471 			if (argv[i].a_type == MDB_TYPE_STRING) {
472 				/* I'm ashamed but amused */
473 				char *quote = &("\""[parse_strings &&
474 				    strisbasenum(argv[i].a_un.a_str)]);
475 
476 				mdb_printf("%s%s%s", quote, argv[i].a_un.a_str,
477 				    quote);
478 			} else
479 				mdb_printf("%p", argv[i].a_un.a_val);
480 		}
481 		mdb_printf(");\n");
482 	}
483 
484 	mdb_free(call_argv, sizeof (uintptr_t) * argc);
485 
486 	return (DCMD_OK);
487 }
488 
489 /*ARGSUSED*/
490 int
491 kmt_dump_crumbs(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
492 {
493 	intptr_t cpu = -1;
494 
495 	if (flags & DCMD_ADDRSPEC) {
496 		if (argc != 0)
497 			return (DCMD_USAGE);
498 	} else {
499 		addr = 0;
500 
501 		if (mdb_getopts(argc, argv,
502 		    'c', MDB_OPT_UINTPTR, &cpu,
503 		    NULL) != argc)
504 			return (DCMD_USAGE);
505 	}
506 
507 	kmdb_dpi_dump_crumbs(addr, cpu);
508 
509 	return (DCMD_OK);
510 }
511 
512 /*ARGSUSED*/
513 static int
514 kmt_noducttape(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
515 {
516 	int a = 0;
517 
518 	return (a/a);
519 }
520 
521 static int
522 kmt_dmod_status(char *msg, int state)
523 {
524 	kmdb_modctl_t *kmc;
525 	mdb_var_t *v;
526 	int first = 1, n = 0;
527 
528 	mdb_nv_rewind(&mdb.m_dmodctl);
529 	while ((v = mdb_nv_advance(&mdb.m_dmodctl)) != NULL) {
530 		kmc = MDB_NV_COOKIE(v);
531 
532 		if (kmc->kmc_state != state)
533 			continue;
534 
535 		n++;
536 
537 		if (msg != NULL) {
538 			if (first) {
539 				mdb_printf(msg, NULL);
540 				first = 0;
541 			}
542 
543 			mdb_printf(" %s", kmc->kmc_modname);
544 		}
545 	}
546 
547 	if (!first && msg != NULL)
548 		mdb_printf("\n");
549 
550 	return (n);
551 }
552 
553 /*ARGSUSED*/
554 static int
555 kmt_status_dcmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
556 {
557 	struct utsname uts;
558 	char uuid[UUID_PRINTABLE_STRING_LENGTH];
559 	kreg_t tt;
560 
561 	if (mdb_tgt_readsym(mdb.m_target, MDB_TGT_AS_VIRT, &uts, sizeof (uts),
562 	    "unix", "utsname") != sizeof (uts)) {
563 		warn("failed to read 'utsname' struct from kernel\n");
564 		bzero(&uts, sizeof (uts));
565 		(void) strcpy(uts.nodename, "unknown machine");
566 	}
567 
568 	mdb_printf("debugging live kernel (%d-bit) on %s\n",
569 	    (int)(sizeof (void *) * NBBY),
570 	    (*uts.nodename == '\0' ? "(not set)" : uts.nodename));
571 	mdb_printf("operating system: %s %s (%s)\n",
572 	    uts.release, uts.version, uts.machine);
573 
574 	mdb_print_buildversion();
575 
576 	if (mdb_readsym(uuid, sizeof (uuid),
577 	    "dump_osimage_uuid") == sizeof (uuid) &&
578 	    uuid[sizeof (uuid) - 1] == '\0') {
579 		mdb_printf("image uuid: %s\n", uuid[0] != '\0' ?
580 		    uuid : "(not set)");
581 	}
582 
583 	mdb_printf("DTrace state: %s\n", (kmdb_kdi_dtrace_get_state() ==
584 	    KDI_DTSTATE_DTRACE_ACTIVE ? "active (debugger breakpoints cannot "
585 	    "be armed)" : "inactive"));
586 
587 	(void) kmdb_dpi_get_register("tt", &tt);
588 	mdb_printf("stopped on: %s\n", kmt_trapname(tt));
589 
590 	(void) kmt_dmod_status("pending dmod loads:", KMDB_MC_STATE_LOADING);
591 	(void) kmt_dmod_status("pending dmod unloads:",
592 	    KMDB_MC_STATE_UNLOADING);
593 
594 	return (DCMD_OK);
595 }
596 
597 /*ARGSUSED*/
598 static int
599 kmt_switch(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
600 {
601 	if (!(flags & DCMD_ADDRSPEC) || argc != 0)
602 		return (DCMD_USAGE);
603 
604 	if (kmdb_dpi_switch_master((int)addr) < 0) {
605 		warn("failed to switch to CPU %d", (int)addr);
606 		return (DCMD_ERR);
607 	}
608 
609 	return (DCMD_OK);
610 }
611 
612 static const mdb_dcmd_t kmt_dcmds[] = {
613 	{ "$c", "?[cnt]", "print stack backtrace", kmt_stack },
614 	{ "$C", "?[cnt]", "print stack backtrace", kmt_stackv },
615 	{ "$r", NULL, "print general-purpose registers", kmt_regs },
616 	{ "$?", NULL, "print status and registers", kmt_regs },
617 	{ ":x", ":", "change the active CPU", kmt_switch },
618 	{ "call", ":[arg ...]", "call a kernel function", kmt_call },
619 	{ "cpustack", "?[-v] [-c cpuid] [cnt]", "print stack backtrace for a "
620 	    "specific CPU", kmt_cpustack_dcmd },
621 	{ "cpuregs", "?[-c cpuid]", "print general-purpose registers for a "
622 	    "specific CPU", kmt_cpuregs },
623 	{ "crumbs", NULL, NULL, kmt_dump_crumbs },
624 #if defined(__i386) || defined(__amd64)
625 	{ "in", ":[-L len]", "read from I/O port", kmt_in_dcmd },
626 	{ "out", ":[-L len] val", "write to I/O port", kmt_out_dcmd },
627 	{ "rdmsr", ":", "read an MSR", kmt_rdmsr },
628 	{ "wrmsr", ": val", "write an MSR", kmt_wrmsr },
629 	{ "rdpcicfg", ": bus dev func", "read a register in PCI config space",
630 	kmt_rdpcicfg },
631 	{ "wrpcicfg", ": bus dev func val", "write a register in PCI config "
632 	"space", kmt_wrpcicfg },
633 #endif
634 	{ "noducttape", NULL, NULL, kmt_noducttape },
635 	{ "regs", NULL, "print general-purpose registers", kmt_regs },
636 	{ "stack", "?[cnt]", "print stack backtrace", kmt_stack },
637 	{ "stackregs", "?", "print stack backtrace and registers", kmt_stackr },
638 	{ "status", NULL, "print summary of current target", kmt_status_dcmd },
639 	{ "switch", ":", "change the active CPU", kmt_switch },
640 	{ NULL }
641 };
642 
643 static uintmax_t
644 kmt_reg_disc_get(const mdb_var_t *v)
645 {
646 	mdb_tgt_reg_t r = 0;
647 
648 	(void) mdb_tgt_getareg(MDB_NV_COOKIE(v), 0, mdb_nv_get_name(v), &r);
649 
650 	return (r);
651 }
652 
653 static void
654 kmt_reg_disc_set(mdb_var_t *v, uintmax_t r)
655 {
656 	if (mdb_tgt_putareg(MDB_NV_COOKIE(v), 0, mdb_nv_get_name(v), r) == -1)
657 		warn("failed to modify %%%s register", mdb_nv_get_name(v));
658 }
659 
660 static const mdb_nv_disc_t kmt_reg_disc = {
661 	kmt_reg_disc_set,
662 	kmt_reg_disc_get
663 };
664 
665 /*ARGSUSED*/
666 static int
667 kmt_getareg(mdb_tgt_t *t, mdb_tgt_tid_t tid, const char *rname,
668     mdb_tgt_reg_t *rp)
669 {
670 	kreg_t val;
671 
672 	if (kmdb_dpi_get_register(rname, &val) < 0)
673 		return (set_errno(EMDB_BADREG));
674 
675 	*rp = val;
676 	return (0);
677 }
678 
679 /*ARGSUSED*/
680 static int
681 kmt_putareg(mdb_tgt_t *t, mdb_tgt_tid_t tid, const char *rname, mdb_tgt_reg_t r)
682 {
683 	if (kmdb_dpi_set_register(rname, r) < 0)
684 		return (set_errno(EMDB_BADREG));
685 
686 	return (0);
687 }
688 
689 static void
690 kmt_mod_destroy(kmt_module_t *km)
691 {
692 	if (km->km_name != NULL)
693 		strfree(km->km_name);
694 	if (km->km_symtab != NULL)
695 		mdb_gelf_symtab_destroy(km->km_symtab);
696 	if (km->km_ctfp != NULL)
697 		mdb_ctf_close(km->km_ctfp);
698 }
699 
700 static kmt_module_t *
701 kmt_mod_create(mdb_tgt_t *t, struct modctl *ctlp, char *name)
702 {
703 	kmt_module_t *km = mdb_zalloc(sizeof (kmt_module_t), UM_SLEEP);
704 	struct module *mod;
705 
706 	km->km_name = mdb_alloc(strlen(name) + 1, UM_SLEEP);
707 	(void) strcpy(km->km_name, name);
708 
709 	bcopy(ctlp, &km->km_modctl, sizeof (struct modctl));
710 
711 	if (mdb_tgt_vread(t, &km->km_module, sizeof (struct module),
712 	    (uintptr_t)km->km_modctl.mod_mp) != sizeof (struct module))
713 		goto create_module_cleanup;
714 	mod = &km->km_module;
715 
716 	if (mod->symhdr != NULL && mod->strhdr != NULL && mod->symtbl != NULL &&
717 	    mod->strings != NULL) {
718 		mdb_gelf_ehdr_to_gehdr(&mod->hdr, &km->km_ehdr);
719 
720 		km->km_symtab = mdb_gelf_symtab_create_raw(&km->km_ehdr,
721 		    mod->symhdr, mod->symtbl, mod->strhdr, mod->strings,
722 		    MDB_TGT_SYMTAB);
723 
724 		km->km_symtab_va = mod->symtbl;
725 		km->km_strtab_va = mod->strings;
726 
727 		if (mdb_tgt_vread(t, &km->km_symtab_hdr, sizeof (Shdr),
728 		    (uintptr_t)mod->symhdr) != sizeof (Shdr) ||
729 		    mdb_tgt_vread(t, &km->km_strtab_hdr, sizeof (Shdr),
730 		    (uintptr_t)mod->strhdr) != sizeof (Shdr))
731 			goto create_module_cleanup;
732 	}
733 
734 	/*
735 	 * We don't want everyone rooting around in the module structure, so we
736 	 * make copies of the interesting members.
737 	 */
738 	km->km_text_va = (uintptr_t)mod->text;
739 	km->km_text_size = mod->text_size;
740 	km->km_data_va = (uintptr_t)mod->data;
741 	km->km_data_size = mod->data_size;
742 	km->km_bss_va = (uintptr_t)mod->bss;
743 	km->km_bss_size = mod->bss_size;
744 	km->km_ctf_va = mod->ctfdata;
745 	km->km_ctf_size = mod->ctfsize;
746 
747 	if (mod->flags & KOBJ_PRIM)
748 		km->km_flags |= KM_F_PRIMARY;
749 
750 	return (km);
751 
752 create_module_cleanup:
753 	warn("failed to read module %s\n", name);
754 	kmt_mod_destroy(km);
755 	return (NULL);
756 }
757 
758 static void
759 kmt_mod_remove(kmt_data_t *kmt, kmt_module_t *km)
760 {
761 	mdb_var_t *v = mdb_nv_lookup(&kmt->kmt_modules, km->km_name);
762 
763 	ASSERT(v != NULL);
764 
765 	mdb_dprintf(MDB_DBG_KMOD, "removing module %s\n", km->km_name);
766 
767 	mdb_list_delete(&kmt->kmt_modlist, km);
768 	mdb_nv_remove(&kmt->kmt_modules, v);
769 	kmt_mod_destroy(km);
770 }
771 
772 static int
773 kmt_modlist_update_cb(struct modctl *modp, void *arg)
774 {
775 	mdb_tgt_t *t = arg;
776 	kmt_data_t *kmt = t->t_data;
777 	kmt_module_t *km;
778 	mdb_var_t *v;
779 	char name[MAXNAMELEN];
780 
781 	if (mdb_tgt_readstr(t, MDB_TGT_AS_VIRT, name, MAXNAMELEN,
782 	    (uintptr_t)modp->mod_modname) <= 0) {
783 		warn("failed to read module name at %p",
784 		    (void *)modp->mod_modname);
785 	}
786 
787 	/* We only care about modules that are actually loaded */
788 	if (!kmdb_kdi_mod_isloaded(modp))
789 		return (0);
790 
791 	/*
792 	 * Skip the modules we already know about and that haven't
793 	 * changed since last time we were here.
794 	 */
795 	if ((v = mdb_nv_lookup(&kmt->kmt_modules, name)) != NULL) {
796 		km = MDB_NV_COOKIE(v);
797 
798 		if (kmdb_kdi_mod_haschanged(&km->km_modctl, &km->km_module,
799 		    modp, modp->mod_mp)) {
800 			/*
801 			 * The module has changed since last we saw it.  For
802 			 * safety, remove our old version, and treat it as a
803 			 * new module.
804 			 */
805 			mdb_dprintf(MDB_DBG_KMOD, "stutter module %s\n", name);
806 			kmt_mod_remove(kmt, km);
807 		} else {
808 			km->km_seen = 1;
809 			return (0);
810 		}
811 	}
812 
813 	mdb_dprintf(MDB_DBG_KMOD, "found new module %s\n", name);
814 
815 	if ((km = kmt_mod_create(t, modp, name)) != NULL) {
816 		mdb_list_append(&kmt->kmt_modlist, km);
817 		(void) mdb_nv_insert(&kmt->kmt_modules, name, NULL,
818 		    (uintptr_t)km, 0);
819 		km->km_seen = 1;
820 	}
821 
822 	return (0);
823 }
824 
825 static void
826 kmt_modlist_update(mdb_tgt_t *t)
827 {
828 	kmt_data_t *kmt = t->t_data;
829 	kmt_module_t *km, *kmn;
830 
831 	if (kmdb_kdi_mod_iter(kmt_modlist_update_cb, t) < 0) {
832 		warn("failed to complete update of kernel module list\n");
833 		return;
834 	}
835 
836 	km = mdb_list_next(&kmt->kmt_modlist);
837 	while (km != NULL) {
838 		kmn = mdb_list_next(km);
839 
840 		if (km->km_seen == 1) {
841 			/* Reset the mark for next time */
842 			km->km_seen = 0;
843 		} else {
844 			/*
845 			 * We didn't see it on the kernel's module list, so
846 			 * remove it from our view of the world.
847 			 */
848 			kmt_mod_remove(kmt, km);
849 		}
850 
851 		km = kmn;
852 	}
853 }
854 
855 static void
856 kmt_periodic(mdb_tgt_t *t)
857 {
858 	(void) mdb_tgt_status(t, &t->t_status);
859 }
860 
861 int
862 kmt_lookup_by_addr(mdb_tgt_t *t, uintptr_t addr, uint_t flags,
863     char *buf, size_t nbytes, GElf_Sym *symp, mdb_syminfo_t *sip)
864 {
865 	kmt_data_t *kmt = t->t_data;
866 	kmt_module_t *km = mdb_list_next(&kmt->kmt_modlist);
867 	kmt_module_t *sym_km = NULL;
868 	kmt_module_t prmod;
869 	GElf_Sym sym;
870 	uint_t symid;
871 	const char *name;
872 
873 	/*
874 	 * We look through the private symbols (if any), then through the module
875 	 * symbols.  We can simplify the loop if we pretend the private symbols
876 	 * come from a module.
877 	 */
878 	if (mdb.m_prsym != NULL) {
879 		bzero(&prmod, sizeof (kmt_module_t));
880 		prmod.km_name = "<<<prmod>>>";
881 		prmod.km_symtab = mdb.m_prsym;
882 		prmod.km_list.ml_next = (mdb_list_t *)km;
883 		km = &prmod;
884 	}
885 
886 	/* Symbol resolution isn't available during initialization */
887 	if (kmdb_dpi_get_state(NULL) == DPI_STATE_INIT)
888 		return (set_errno(EMDB_NOSYM));
889 
890 	for (; km != NULL; km = mdb_list_next(km)) {
891 		if (km != &prmod && !kmt->kmt_symavail)
892 			continue;
893 
894 		if (km->km_symtab == NULL)
895 			continue;
896 
897 		if (mdb_gelf_symtab_lookup_by_addr(km->km_symtab, addr, flags,
898 		    buf, nbytes, symp, &sip->sym_id) != 0 ||
899 		    symp->st_value == 0)
900 			continue;
901 
902 		if (flags & MDB_TGT_SYM_EXACT) {
903 			sym_km = km;
904 			goto found;
905 		}
906 
907 		/*
908 		 * If this is the first match we've found, or if this symbol is
909 		 * closer to the specified address than the last one we found,
910 		 * use it.
911 		 */
912 		if (sym_km == NULL || mdb_gelf_sym_closer(symp, &sym, addr)) {
913 			sym_km = km;
914 			sym = *symp;
915 			symid = sip->sym_id;
916 		}
917 	}
918 
919 	/*
920 	 * kmdb dmods are normal kernel modules, loaded by krtld as such.  To
921 	 * avoid polluting modinfo, and to keep from confusing the module
922 	 * subsystem (many dmods have the same names as real kernel modules),
923 	 * kmdb keeps their modctls separate, and doesn't allow their loading
924 	 * to be broadcast via the krtld module load/unload mechanism.  As a
925 	 * result, kmdb_kvm doesn't find out about them, and can't turn their
926 	 * addresses into symbols.  This can be most inconvenient during
927 	 * debugger faults, as the dmod frames will show up without names.
928 	 * We weren't able to turn the requested address into a symbol, so we'll
929 	 * take a spin through the dmods, trying to match our address against
930 	 * their symbols.
931 	 */
932 	if (sym_km == NULL) {
933 		return (kmdb_module_lookup_by_addr(addr, flags, buf, nbytes,
934 		    symp, sip));
935 	}
936 
937 	*symp = sym;
938 	sip->sym_id = symid;
939 
940 found:
941 	/*
942 	 * Once we've found something, copy the final name into the caller's
943 	 * buffer and prefix it with the load object name if appropriate.
944 	 */
945 	name = mdb_gelf_sym_name(sym_km->km_symtab, symp);
946 
947 	if (sym_km == &prmod) {
948 		if (buf != NULL) {
949 			(void) strncpy(buf, name, nbytes);
950 			buf[nbytes - 1] = '\0';
951 		}
952 		sip->sym_table = MDB_TGT_PRVSYM;
953 	} else {
954 		if (buf != NULL) {
955 			if (sym_km->km_flags & KM_F_PRIMARY) {
956 				(void) strncpy(buf, name, nbytes);
957 				buf[nbytes - 1] = '\0';
958 			} else {
959 				(void) mdb_snprintf(buf, nbytes, "%s`%s",
960 				    sym_km->km_name, name);
961 			}
962 		}
963 		sip->sym_table = MDB_TGT_SYMTAB;
964 	}
965 
966 	return (0);
967 }
968 
969 static int
970 kmt_lookup_by_name(mdb_tgt_t *t, const char *obj, const char *name,
971     GElf_Sym *symp, mdb_syminfo_t *sip)
972 {
973 	kmt_data_t *kmt = t->t_data;
974 	kmt_module_t *km;
975 	mdb_var_t *v;
976 	GElf_Sym sym;
977 	uint_t symid;
978 	int n;
979 
980 	if (!kmt->kmt_symavail)
981 		return (set_errno(EMDB_NOSYM));
982 
983 	switch ((uintptr_t)obj) {
984 	case (uintptr_t)MDB_TGT_OBJ_EXEC:
985 	case (uintptr_t)MDB_TGT_OBJ_EVERY:
986 		km = mdb_list_next(&kmt->kmt_modlist);
987 		n = mdb_nv_size(&kmt->kmt_modules);
988 		break;
989 
990 	case (uintptr_t)MDB_TGT_OBJ_RTLD:
991 		obj = kmt->kmt_rtld_name;
992 		/*FALLTHROUGH*/
993 
994 	default:
995 		/*
996 		 * If this is a request for a dmod symbol, let kmdb_module
997 		 * handle it.
998 		 */
999 		if (obj != NULL && strncmp(obj, "DMOD`", 5) == 0) {
1000 			return (kmdb_module_lookup_by_name(obj + 5, name,
1001 			    symp, sip));
1002 		}
1003 
1004 		if ((v = mdb_nv_lookup(&kmt->kmt_modules, obj)) == NULL)
1005 			return (set_errno(EMDB_NOOBJ));
1006 
1007 		km = mdb_nv_get_cookie(v);
1008 		n = 1;
1009 	}
1010 
1011 	/*
1012 	 * kmdb's kvm target is at a bit of a disadvantage compared to mdb's
1013 	 * kvm target when it comes to global symbol lookups.  mdb has ksyms,
1014 	 * which hides pesky things like symbols that are undefined in unix,
1015 	 * but which are defined in genunix.  We don't have such a facility -
1016 	 * we simply iterate through the modules, looking for a given symbol
1017 	 * in each.  Unless we're careful, we'll return the undef in the
1018 	 * aforementioned case.
1019 	 */
1020 	for (; n > 0; n--, km = mdb_list_next(km)) {
1021 		if (mdb_gelf_symtab_lookup_by_name(km->km_symtab, name,
1022 		    &sym, &symid) == 0 && sym.st_shndx != SHN_UNDEF)
1023 			break;
1024 	}
1025 
1026 	if (n == 0)
1027 		return (set_errno(EMDB_NOSYM));
1028 
1029 found:
1030 	bcopy(&sym, symp, sizeof (GElf_Sym));
1031 	sip->sym_id = symid;
1032 	sip->sym_table = MDB_TGT_SYMTAB;
1033 
1034 	return (0);
1035 }
1036 
1037 static int
1038 kmt_symtab_func(void *data, const GElf_Sym *sym, const char *name, uint_t id)
1039 {
1040 	kmt_symarg_t *arg = data;
1041 
1042 	if (mdb_tgt_sym_match(sym, arg->sym_type)) {
1043 		arg->sym_info.sym_id = id;
1044 
1045 		return (arg->sym_cb(arg->sym_data, sym, name, &arg->sym_info,
1046 		    arg->sym_obj));
1047 	}
1048 
1049 	return (0);
1050 }
1051 
1052 static void
1053 kmt_symtab_iter(mdb_gelf_symtab_t *gst, uint_t type, const char *obj,
1054     mdb_tgt_sym_f *cb, void *p)
1055 {
1056 	kmt_symarg_t arg;
1057 
1058 	arg.sym_cb = cb;
1059 	arg.sym_data = p;
1060 	arg.sym_type = type;
1061 	arg.sym_info.sym_table = gst->gst_tabid;
1062 	arg.sym_obj = obj;
1063 
1064 	mdb_gelf_symtab_iter(gst, kmt_symtab_func, &arg);
1065 }
1066 
1067 static int
1068 kmt_symbol_iter(mdb_tgt_t *t, const char *obj, uint_t which, uint_t type,
1069     mdb_tgt_sym_f *cb, void *data)
1070 {
1071 	kmt_data_t *kmt = t->t_data;
1072 	kmt_module_t *km;
1073 
1074 	mdb_gelf_symtab_t *symtab = NULL;
1075 	mdb_var_t *v;
1076 
1077 	if (which == MDB_TGT_DYNSYM)
1078 		return (set_errno(EMDB_TGTNOTSUP));
1079 
1080 	switch ((uintptr_t)obj) {
1081 	case (uintptr_t)MDB_TGT_OBJ_EXEC:
1082 	case (uintptr_t)MDB_TGT_OBJ_EVERY:
1083 		mdb_nv_rewind(&kmt->kmt_modules);
1084 		while ((v = mdb_nv_advance(&kmt->kmt_modules)) != NULL) {
1085 			km = mdb_nv_get_cookie(v);
1086 
1087 			if (km->km_symtab != NULL) {
1088 				kmt_symtab_iter(km->km_symtab, type,
1089 				    km->km_name, cb, data);
1090 			}
1091 		}
1092 		return (0);
1093 
1094 	case (uintptr_t)MDB_TGT_OBJ_RTLD:
1095 		obj = kmt->kmt_rtld_name;
1096 		/*FALLTHROUGH*/
1097 
1098 	default:
1099 		if (strncmp(obj, "DMOD`", 5) == 0) {
1100 			return (kmdb_module_symbol_iter(obj + 5, type,
1101 			    cb, data));
1102 		}
1103 
1104 		if ((v = mdb_nv_lookup(&kmt->kmt_modules, obj)) == NULL)
1105 			return (set_errno(EMDB_NOOBJ));
1106 		km = mdb_nv_get_cookie(v);
1107 
1108 		symtab = km->km_symtab;
1109 	}
1110 
1111 	if (symtab != NULL)
1112 		kmt_symtab_iter(symtab, type, obj, cb, data);
1113 
1114 	return (0);
1115 }
1116 
1117 static int
1118 kmt_mapping_walk(uintptr_t addr, const void *data, kmt_maparg_t *marg)
1119 {
1120 	/*
1121 	 * This is a bit sketchy but avoids problematic compilation of this
1122 	 * target against the current VM implementation.  Now that we have
1123 	 * vmem, we can make this less broken and more informative by changing
1124 	 * this code to invoke the vmem walker in the near future.
1125 	 */
1126 	const struct kmt_seg {
1127 		caddr_t s_base;
1128 		size_t s_size;
1129 	} *segp = (const struct kmt_seg *)data;
1130 
1131 	mdb_map_t map;
1132 	GElf_Sym sym;
1133 	mdb_syminfo_t info;
1134 
1135 	map.map_base = (uintptr_t)segp->s_base;
1136 	map.map_size = segp->s_size;
1137 	map.map_flags = MDB_TGT_MAP_R | MDB_TGT_MAP_W | MDB_TGT_MAP_X;
1138 
1139 	if (kmt_lookup_by_addr(marg->map_target, addr, MDB_TGT_SYM_EXACT,
1140 	    map.map_name, MDB_TGT_MAPSZ, &sym, &info) == -1) {
1141 
1142 		(void) mdb_iob_snprintf(map.map_name, MDB_TGT_MAPSZ,
1143 		    "%lr", addr);
1144 	}
1145 
1146 	return (marg->map_cb(marg->map_data, &map, map.map_name));
1147 }
1148 
1149 static int
1150 kmt_mapping_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
1151 {
1152 	kmt_maparg_t m;
1153 	uintptr_t kas;
1154 
1155 	m.map_target = t;
1156 	m.map_cb = func;
1157 	m.map_data = private;
1158 
1159 	if ((kas = kmt_read_kas(t)) == 0)
1160 		return (-1); /* errno is set for us */
1161 
1162 	return (mdb_pwalk("seg", (mdb_walk_cb_t)kmt_mapping_walk, &m, kas));
1163 }
1164 
1165 static const mdb_map_t *
1166 kmt_mod_to_map(kmt_module_t *km, mdb_map_t *map)
1167 {
1168 	(void) strncpy(map->map_name, km->km_name, MDB_TGT_MAPSZ);
1169 	map->map_name[MDB_TGT_MAPSZ - 1] = '\0';
1170 	map->map_base = km->km_text_va;
1171 	map->map_size = km->km_text_size;
1172 	map->map_flags = MDB_TGT_MAP_R | MDB_TGT_MAP_W | MDB_TGT_MAP_X;
1173 
1174 	return (map);
1175 }
1176 
1177 static int
1178 kmt_object_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
1179 {
1180 	kmt_data_t *kmt = t->t_data;
1181 	kmt_module_t *km;
1182 	mdb_map_t m;
1183 
1184 	for (km = mdb_list_next(&kmt->kmt_modlist); km != NULL;
1185 	    km = mdb_list_next(km)) {
1186 		if (func(private, kmt_mod_to_map(km, &m), km->km_name) == -1)
1187 			break;
1188 	}
1189 
1190 	return (0);
1191 }
1192 
1193 static const mdb_map_t *
1194 kmt_addr_to_map(mdb_tgt_t *t, uintptr_t addr)
1195 {
1196 	kmt_data_t *kmt = t->t_data;
1197 	kmt_module_t *km;
1198 
1199 	for (km = mdb_list_next(&kmt->kmt_modlist); km != NULL;
1200 	    km = mdb_list_next(km)) {
1201 		if (addr - km->km_text_va < km->km_text_size ||
1202 		    addr - km->km_data_va < km->km_data_size ||
1203 		    addr - km->km_bss_va < km->km_bss_size)
1204 			return (kmt_mod_to_map(km, &kmt->kmt_map));
1205 	}
1206 
1207 	(void) set_errno(EMDB_NOMAP);
1208 	return (NULL);
1209 }
1210 
1211 static kmt_module_t *
1212 kmt_module_by_name(kmt_data_t *kmt, const char *name)
1213 {
1214 	kmt_module_t *km;
1215 
1216 	for (km = mdb_list_next(&kmt->kmt_modlist); km != NULL;
1217 	    km = mdb_list_next(km)) {
1218 		if (strcmp(name, km->km_name) == 0)
1219 			return (km);
1220 	}
1221 
1222 	return (NULL);
1223 }
1224 
1225 static const mdb_map_t *
1226 kmt_name_to_map(mdb_tgt_t *t, const char *name)
1227 {
1228 	kmt_data_t *kmt = t->t_data;
1229 	kmt_module_t *km;
1230 	mdb_map_t m;
1231 
1232 	/*
1233 	 * If name is MDB_TGT_OBJ_EXEC, return the first module on the list,
1234 	 * which will be unix since we keep kmt_modlist in load order.
1235 	 */
1236 	if (name == MDB_TGT_OBJ_EXEC) {
1237 		return (kmt_mod_to_map(mdb_list_next(&kmt->kmt_modlist),
1238 		    &m));
1239 	}
1240 
1241 	if (name == MDB_TGT_OBJ_RTLD)
1242 		name = kmt->kmt_rtld_name;
1243 
1244 	if ((km = kmt_module_by_name(kmt, name)) != NULL)
1245 		return (kmt_mod_to_map(km, &m));
1246 
1247 	(void) set_errno(EMDB_NOOBJ);
1248 	return (NULL);
1249 }
1250 
1251 static ctf_file_t *
1252 kmt_load_ctfdata(mdb_tgt_t *t, kmt_module_t *km)
1253 {
1254 	kmt_data_t *kmt = t->t_data;
1255 	int err;
1256 
1257 	if (km->km_ctfp != NULL)
1258 		return (km->km_ctfp);
1259 
1260 	if (km->km_ctf_va == NULL || km->km_symtab == NULL) {
1261 		(void) set_errno(EMDB_NOCTF);
1262 		return (NULL);
1263 	}
1264 
1265 	if ((km->km_ctfp = mdb_ctf_bufopen(km->km_ctf_va, km->km_ctf_size,
1266 	    km->km_symtab_va, &km->km_symtab_hdr, km->km_strtab_va,
1267 	    &km->km_strtab_hdr, &err)) == NULL) {
1268 		(void) set_errno(ctf_to_errno(err));
1269 		return (NULL);
1270 	}
1271 
1272 	mdb_dprintf(MDB_DBG_KMOD, "loaded %lu bytes of CTF data for %s\n",
1273 	    (ulong_t)km->km_ctf_size, km->km_name);
1274 
1275 	if (ctf_parent_name(km->km_ctfp) != NULL) {
1276 		mdb_var_t *v;
1277 
1278 		if ((v = mdb_nv_lookup(&kmt->kmt_modules,
1279 		    ctf_parent_name(km->km_ctfp))) != NULL) {
1280 			kmt_module_t *pm = mdb_nv_get_cookie(v);
1281 
1282 			if (pm->km_ctfp == NULL)
1283 				(void) kmt_load_ctfdata(t, pm);
1284 
1285 			if (pm->km_ctfp != NULL && ctf_import(km->km_ctfp,
1286 			    pm->km_ctfp) == CTF_ERR) {
1287 				warn("failed to import parent types into "
1288 				    "%s: %s\n", km->km_name,
1289 				    ctf_errmsg(ctf_errno(km->km_ctfp)));
1290 			}
1291 		} else {
1292 			warn("failed to load CTF data for %s - parent %s not "
1293 			    "loaded\n", km->km_name,
1294 			    ctf_parent_name(km->km_ctfp));
1295 		}
1296 	}
1297 
1298 	return (km->km_ctfp);
1299 }
1300 
1301 ctf_file_t *
1302 kmt_addr_to_ctf(mdb_tgt_t *t, uintptr_t addr)
1303 {
1304 	kmt_data_t *kmt = t->t_data;
1305 	kmt_module_t *km;
1306 
1307 	for (km = mdb_list_next(&kmt->kmt_modlist); km != NULL;
1308 	    km = mdb_list_next(km)) {
1309 		if (addr - km->km_text_va < km->km_text_size ||
1310 		    addr - km->km_data_va < km->km_data_size ||
1311 		    addr - km->km_bss_va < km->km_bss_size)
1312 			return (kmt_load_ctfdata(t, km));
1313 	}
1314 
1315 	return (kmdb_module_addr_to_ctf(addr));
1316 }
1317 
1318 ctf_file_t *
1319 kmt_name_to_ctf(mdb_tgt_t *t, const char *name)
1320 {
1321 	kmt_data_t *kt = t->t_data;
1322 	kmt_module_t *km;
1323 
1324 	if (name == MDB_TGT_OBJ_EXEC) {
1325 		name = KMT_CTFPARENT;
1326 	} else if (name == MDB_TGT_OBJ_RTLD) {
1327 		name = kt->kmt_rtld_name;
1328 	} else if (strncmp(name, "DMOD`", 5) == 0) {
1329 		/* Request for CTF data for a DMOD symbol */
1330 		return (kmdb_module_name_to_ctf(name + 5));
1331 	}
1332 
1333 	if ((km = kmt_module_by_name(kt, name)) != NULL)
1334 		return (kmt_load_ctfdata(t, km));
1335 
1336 	(void) set_errno(EMDB_NOOBJ);
1337 	return (NULL);
1338 }
1339 
1340 /*ARGSUSED*/
1341 static int
1342 kmt_status(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
1343 {
1344 	int state;
1345 
1346 	bzero(tsp, sizeof (mdb_tgt_status_t));
1347 
1348 	switch ((state = kmdb_dpi_get_state(NULL))) {
1349 	case DPI_STATE_INIT:
1350 		tsp->st_state = MDB_TGT_RUNNING;
1351 		tsp->st_pc = 0;
1352 		break;
1353 
1354 	case DPI_STATE_STOPPED:
1355 		tsp->st_state = MDB_TGT_STOPPED;
1356 
1357 		(void) kmdb_dpi_get_register("pc", &tsp->st_pc);
1358 		break;
1359 
1360 	case DPI_STATE_FAULTED:
1361 		tsp->st_state = MDB_TGT_STOPPED;
1362 
1363 		(void) kmdb_dpi_get_register("pc", &tsp->st_pc);
1364 
1365 		tsp->st_flags |= MDB_TGT_ISTOP;
1366 		break;
1367 
1368 	case DPI_STATE_LOST:
1369 		tsp->st_state = MDB_TGT_LOST;
1370 
1371 		(void) kmdb_dpi_get_register("pc", &tsp->st_pc);
1372 		break;
1373 	}
1374 
1375 	mdb_dprintf(MDB_DBG_KMOD, "kmt_status, dpi: %d tsp: %d, pc = %p %A\n",
1376 	    state, tsp->st_state, (void *)tsp->st_pc, tsp->st_pc);
1377 
1378 	return (0);
1379 }
1380 
1381 /*
1382  * Invoked when kmt_defbp_enter_debugger is called, this routine activates and
1383  * deactivates deferred breakpoints in response to module load and unload
1384  * events.
1385  */
1386 /*ARGSUSED*/
1387 static void
1388 kmt_defbp_event(mdb_tgt_t *t, int vid, void *private)
1389 {
1390 	if (kmt_defbp_modchg_isload) {
1391 		if (!mdb_tgt_sespec_activate_all(t) &&
1392 		    (mdb.m_flags & MDB_FL_BPTNOSYMSTOP)) {
1393 			/*
1394 			 * We weren't able to activate the breakpoints.
1395 			 * If so requested, we'll return without calling
1396 			 * continue, thus throwing the user into the debugger.
1397 			 */
1398 			return;
1399 		}
1400 
1401 	} else {
1402 		mdb_sespec_t *sep, *nsep;
1403 		const mdb_map_t *map, *bpmap;
1404 		mdb_map_t modmap;
1405 
1406 		if ((map = kmt_addr_to_map(t,
1407 		    (uintptr_t)kmt_defbp_modchg_modctl->mod_text)) == NULL) {
1408 			warn("module unload notification for unknown module %s",
1409 			    kmt_defbp_modchg_modctl->mod_modname);
1410 			return; /* drop into the debugger */
1411 		}
1412 
1413 		bcopy(map, &modmap, sizeof (mdb_map_t));
1414 
1415 		for (sep = mdb_list_next(&t->t_active); sep; sep = nsep) {
1416 			nsep = mdb_list_next(sep);
1417 
1418 			if (sep->se_ops == &kmt_brkpt_ops) {
1419 				kmt_brkpt_t *kb = sep->se_data;
1420 
1421 				if ((bpmap = kmt_addr_to_map(t,
1422 				    kb->kb_addr)) == NULL ||
1423 				    (bpmap->map_base == modmap.map_base &&
1424 				    bpmap->map_size == modmap.map_size)) {
1425 					mdb_tgt_sespec_idle_one(t, sep,
1426 					    EMDB_NOMAP);
1427 				}
1428 			}
1429 		}
1430 	}
1431 
1432 	(void) mdb_tgt_continue(t, NULL);
1433 }
1434 
1435 static void
1436 kmt_defbp_enter_debugger(void)
1437 {
1438 	/*
1439 	 * The debugger places a breakpoint here.  We can't have a simple
1440 	 * nop function here, because GCC knows much more than we do, and
1441 	 * will optimize away the call to it.
1442 	 */
1443 	(void) get_fp();
1444 }
1445 
1446 /*
1447  * This routine is called while the kernel is running.  It attempts to determine
1448  * whether any deferred breakpoints exist for the module being changed (loaded
1449  * or unloaded).  If any such breakpoints exist, the debugger will be entered to
1450  * process them.
1451  */
1452 static void
1453 kmt_defbp_modchg(struct modctl *mctl, int isload)
1454 {
1455 	kmt_defbp_t *dbp;
1456 
1457 	kmt_defbp_lock = 1;
1458 
1459 	for (dbp = mdb_list_next(&kmt_defbp_list); dbp;
1460 	    dbp = mdb_list_next(dbp)) {
1461 		if (!dbp->dbp_ref)
1462 			continue;
1463 
1464 		if (strcmp(mctl->mod_modname, dbp->dbp_objname) == 0) {
1465 			/*
1466 			 * Activate the breakpoint
1467 			 */
1468 			kmt_defbp_modchg_isload = isload;
1469 			kmt_defbp_modchg_modctl = mctl;
1470 
1471 			kmt_defbp_enter_debugger();
1472 			break;
1473 		}
1474 	}
1475 
1476 	kmt_defbp_lock = 0;
1477 }
1478 
1479 /*ARGSUSED*/
1480 static int
1481 kmt_continue(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
1482 {
1483 	int n;
1484 
1485 	kmdb_dpi_resume();
1486 
1487 	/*
1488 	 * The order of the following two calls is important.  If there are
1489 	 * load acks on the work queue, we'll initialize the dmods they
1490 	 * represent.  This will involve a call to _mdb_init, which may very
1491 	 * well result in a symbol lookup.  If we haven't resynced our view
1492 	 * of symbols with the current state of the world, this lookup could
1493 	 * end very badly.  We therefore make sure to sync before processing
1494 	 * the work queue.
1495 	 */
1496 	kmt_sync(t);
1497 	kmdb_dpi_process_work_queue();
1498 
1499 	if (kmdb_kdi_get_unload_request())
1500 		t->t_flags |= MDB_TGT_F_UNLOAD;
1501 
1502 	(void) mdb_tgt_status(t, &t->t_status);
1503 
1504 	if ((n = kmt_dmod_status(NULL, KMDB_MC_STATE_LOADING) +
1505 	    kmt_dmod_status(NULL, KMDB_MC_STATE_UNLOADING)) != 0) {
1506 		mdb_warn("%d dmod load%c/unload%c pending\n", n,
1507 		    "s"[n == 1], "s"[n == 1]);
1508 	}
1509 
1510 	return (0);
1511 }
1512 
1513 /*ARGSUSED*/
1514 static int
1515 kmt_step(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
1516 {
1517 	int rc;
1518 
1519 	if ((rc = kmdb_dpi_step()) == 0)
1520 		(void) mdb_tgt_status(t, &t->t_status);
1521 
1522 	return (rc);
1523 }
1524 
1525 static int
1526 kmt_defbp_activate(mdb_tgt_t *t)
1527 {
1528 	kmdb_dpi_modchg_register(kmt_defbp_modchg);
1529 
1530 	/*
1531 	 * The routines that add and arm breakpoints will check for the proper
1532 	 * DTrace state, but they'll just put this breakpoint on the idle list
1533 	 * if DTrace is active.  It'll correctly move to the active list when
1534 	 * DTrace deactivates, but that's insufficient for our purposes -- we
1535 	 * need to do extra processing at that point.  We won't get to do said
1536 	 * processing with with a normal idle->active transition, so we just
1537 	 * won't add it add it until we're sure that it'll stick.
1538 	 */
1539 
1540 	if (kmdb_kdi_dtrace_get_state() == KDI_DTSTATE_DTRACE_ACTIVE)
1541 		return (set_errno(EMDB_DTACTIVE));
1542 
1543 	kmt_defbp_bpspec = mdb_tgt_add_vbrkpt(t,
1544 	    (uintptr_t)kmt_defbp_enter_debugger,
1545 	    MDB_TGT_SPEC_HIDDEN, kmt_defbp_event, NULL);
1546 
1547 	return (0);
1548 }
1549 
1550 static void
1551 kmt_defbp_deactivate(mdb_tgt_t *t)
1552 {
1553 	kmdb_dpi_modchg_cancel();
1554 
1555 	if (kmt_defbp_bpspec != 0) {
1556 		if (t != NULL)
1557 			(void) mdb_tgt_vespec_delete(t, kmt_defbp_bpspec);
1558 
1559 		kmt_defbp_bpspec = 0;
1560 	}
1561 }
1562 
1563 static kmt_defbp_t *
1564 kmt_defbp_create(mdb_tgt_t *t, const char *objname, const char *symname)
1565 {
1566 	kmt_defbp_t *dbp = mdb_alloc(sizeof (kmt_defbp_t), UM_SLEEP);
1567 
1568 	mdb_dprintf(MDB_DBG_KMOD, "defbp_create %s`%s\n", objname, symname);
1569 
1570 	dbp->dbp_objname = strdup(objname);
1571 	dbp->dbp_symname = strdup(symname);
1572 	dbp->dbp_ref = 1;
1573 
1574 	kmt_defbp_num++;
1575 
1576 	if (kmt_defbp_num == 1 || kmt_defbp_bpspec == 0) {
1577 		if (kmt_defbp_activate(t) < 0)
1578 			warn("failed to activate deferred breakpoints");
1579 	}
1580 
1581 	mdb_list_append(&kmt_defbp_list, dbp);
1582 
1583 	return (dbp);
1584 }
1585 
1586 static void
1587 kmt_defbp_destroy(kmt_defbp_t *dbp)
1588 {
1589 	mdb_dprintf(MDB_DBG_KMOD, "defbp_destroy %s`%s\n", dbp->dbp_objname,
1590 	    dbp->dbp_symname);
1591 
1592 	mdb_list_delete(&kmt_defbp_list, dbp);
1593 
1594 	strfree(dbp->dbp_objname);
1595 	strfree(dbp->dbp_symname);
1596 	mdb_free(dbp, sizeof (kmt_defbp_t));
1597 }
1598 
1599 static void
1600 kmt_defbp_prune_common(int all)
1601 {
1602 	kmt_defbp_t *dbp, *ndbp;
1603 
1604 	/* We can't remove items from the list while the driver is using it. */
1605 	if (kmt_defbp_lock)
1606 		return;
1607 
1608 	for (dbp = mdb_list_next(&kmt_defbp_list); dbp != NULL; dbp = ndbp) {
1609 		ndbp = mdb_list_next(dbp);
1610 
1611 		if (!all && dbp->dbp_ref)
1612 			continue;
1613 
1614 		kmt_defbp_destroy(dbp);
1615 	}
1616 }
1617 
1618 static void
1619 kmt_defbp_prune(void)
1620 {
1621 	kmt_defbp_prune_common(0);
1622 }
1623 
1624 static void
1625 kmt_defbp_destroy_all(void)
1626 {
1627 	kmt_defbp_prune_common(1);
1628 }
1629 
1630 static void
1631 kmt_defbp_delete(mdb_tgt_t *t, kmt_defbp_t *dbp)
1632 {
1633 	dbp->dbp_ref = 0;
1634 
1635 	ASSERT(kmt_defbp_num > 0);
1636 	kmt_defbp_num--;
1637 
1638 	if (kmt_defbp_num == 0)
1639 		kmt_defbp_deactivate(t);
1640 
1641 	kmt_defbp_prune();
1642 }
1643 
1644 static int
1645 kmt_brkpt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
1646 {
1647 	mdb_tgt_status_t tsp;
1648 	kmt_bparg_t *ka = args;
1649 	kmt_brkpt_t *kb;
1650 	GElf_Sym s;
1651 	mdb_instr_t instr;
1652 
1653 	(void) mdb_tgt_status(t, &tsp);
1654 	if (tsp.st_state != MDB_TGT_RUNNING && tsp.st_state != MDB_TGT_STOPPED)
1655 		return (set_errno(EMDB_NOPROC));
1656 
1657 	if (ka->ka_symbol != NULL) {
1658 		if (mdb_tgt_lookup_by_scope(t, ka->ka_symbol, &s, NULL) == -1) {
1659 			if (errno != EMDB_NOOBJ && !(errno == EMDB_NOSYM &&
1660 			    !(mdb.m_flags & MDB_FL_BPTNOSYMSTOP))) {
1661 				warn("breakpoint %s activation failed",
1662 				    ka->ka_symbol);
1663 			}
1664 			return (-1); /* errno is set for us */
1665 		}
1666 
1667 		ka->ka_addr = (uintptr_t)s.st_value;
1668 	}
1669 
1670 #ifdef __sparc
1671 	if (ka->ka_addr & 3)
1672 		return (set_errno(EMDB_BPALIGN));
1673 #endif
1674 
1675 	if (mdb_vread(&instr, sizeof (instr), ka->ka_addr) != sizeof (instr))
1676 		return (-1); /* errno is set for us */
1677 
1678 	if (kmdb_kdi_dtrace_get_state() == KDI_DTSTATE_DTRACE_ACTIVE)
1679 		warn("breakpoint will not arm until DTrace is inactive\n");
1680 
1681 	kb = mdb_zalloc(sizeof (kmt_brkpt_t), UM_SLEEP);
1682 	kb->kb_addr = ka->ka_addr;
1683 	sep->se_data = kb;
1684 
1685 	return (0);
1686 }
1687 
1688 /*ARGSUSED*/
1689 static void
1690 kmt_brkpt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
1691 {
1692 	mdb_free(sep->se_data, sizeof (kmt_brkpt_t));
1693 }
1694 
1695 /*ARGSUSED*/
1696 static char *
1697 kmt_brkpt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
1698     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
1699 {
1700 	uintptr_t addr = 0;
1701 
1702 	if (vep != NULL) {
1703 		kmt_bparg_t *ka = vep->ve_args;
1704 
1705 		if (ka->ka_symbol != NULL) {
1706 			(void) mdb_iob_snprintf(buf, nbytes, "stop at %s",
1707 			    ka->ka_symbol);
1708 		} else {
1709 			(void) mdb_iob_snprintf(buf, nbytes, "stop at %a",
1710 			    ka->ka_addr);
1711 			addr = ka->ka_addr;
1712 		}
1713 
1714 	} else {
1715 		addr = ((kmt_brkpt_t *)sep->se_data)->kb_addr;
1716 		(void) mdb_iob_snprintf(buf, nbytes, "stop at %a", addr);
1717 	}
1718 
1719 	sp->spec_base = addr;
1720 	sp->spec_size = sizeof (mdb_instr_t);
1721 
1722 	return (buf);
1723 }
1724 
1725 static int
1726 kmt_brkpt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
1727 {
1728 	kmt_brkpt_t *kb = sep->se_data;
1729 	kmt_bparg_t *ka = args;
1730 	GElf_Sym sym;
1731 
1732 	if (ka->ka_symbol != NULL) {
1733 		return (mdb_tgt_lookup_by_scope(t, ka->ka_symbol,
1734 		    &sym, NULL) == 0 && sym.st_value == kb->kb_addr);
1735 	}
1736 
1737 	return (ka->ka_addr == kb->kb_addr);
1738 }
1739 
1740 /*ARGSUSED*/
1741 static int
1742 kmt_brkpt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
1743 {
1744 	kmt_bparg_t *ka1 = vep->ve_args;
1745 	kmt_bparg_t *ka2 = args;
1746 
1747 	if (ka1->ka_symbol != NULL && ka2->ka_symbol != NULL)
1748 		return (strcmp(ka1->ka_symbol, ka2->ka_symbol) == 0);
1749 
1750 	if (ka1->ka_symbol == NULL && ka2->ka_symbol == NULL)
1751 		return (ka1->ka_addr == ka2->ka_addr);
1752 
1753 	return (0); /* fail if one is symbolic, other is an explicit address */
1754 }
1755 
1756 static int
1757 kmt_brkpt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
1758 {
1759 	kmt_data_t *kmt = t->t_data;
1760 	kmt_brkpt_t *kb = sep->se_data;
1761 	int rv;
1762 
1763 	if (kmdb_kdi_dtrace_get_state() == KDI_DTSTATE_DTRACE_ACTIVE)
1764 		return (set_errno(EMDB_DTACTIVE));
1765 
1766 	if ((rv = kmdb_dpi_brkpt_arm(kb->kb_addr, &kb->kb_oinstr)) != 0)
1767 		return (rv);
1768 
1769 	if (kmt->kmt_narmedbpts++ == 0)
1770 		(void) kmdb_kdi_dtrace_set(KDI_DTSET_KMDB_BPT_ACTIVATE);
1771 
1772 	return (0);
1773 }
1774 
1775 static int
1776 kmt_brkpt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
1777 {
1778 	kmt_data_t *kmt = t->t_data;
1779 	kmt_brkpt_t *kb = sep->se_data;
1780 	int rv;
1781 
1782 	ASSERT(kmdb_kdi_dtrace_get_state() == KDI_DTSTATE_KMDB_BPT_ACTIVE);
1783 
1784 	if ((rv = kmdb_dpi_brkpt_disarm(kb->kb_addr, kb->kb_oinstr)) != 0)
1785 		return (rv);
1786 
1787 	if (--kmt->kmt_narmedbpts == 0)
1788 		(void) kmdb_kdi_dtrace_set(KDI_DTSET_KMDB_BPT_DEACTIVATE);
1789 
1790 	return (0);
1791 }
1792 
1793 /*
1794  * Determine whether the specified sespec is an armed watchpoint that overlaps
1795  * with the given breakpoint and has the given flags set.  We use this to find
1796  * conflicts with breakpoints, below.
1797  */
1798 static int
1799 kmt_wp_overlap(mdb_sespec_t *sep, kmt_brkpt_t *kb, int flags)
1800 {
1801 	const kmdb_wapt_t *wp = sep->se_data;
1802 
1803 	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
1804 	    sep->se_ops == &kmt_wapt_ops && (wp->wp_wflags & flags) &&
1805 	    kb->kb_addr - wp->wp_addr < wp->wp_size);
1806 }
1807 
1808 /*
1809  * We step over breakpoints using our single-stepper.  If a conflicting
1810  * watchpoint is present, we must temporarily remove it before stepping over the
1811  * breakpoint so we don't immediately re-trigger the watchpoint.  We know the
1812  * watchpoint has already triggered on our trap instruction as part of fetching
1813  * it.  Before we return, we must re-install any disabled watchpoints.
1814  */
1815 static int
1816 kmt_brkpt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
1817 {
1818 	kmt_brkpt_t *kb = sep->se_data;
1819 	int status = -1;
1820 	int error;
1821 
1822 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
1823 		if (kmt_wp_overlap(sep, kb, MDB_TGT_WA_X))
1824 			(void) kmdb_dpi_wapt_disarm(sep->se_data);
1825 	}
1826 
1827 	if (kmdb_dpi_brkpt_disarm(kb->kb_addr, kb->kb_oinstr) == 0 &&
1828 	    kmt_step(t, tsp) == 0)
1829 		status = kmt_status(t, tsp);
1830 
1831 	error = errno; /* save errno from disarm, step, or status */
1832 
1833 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
1834 		if (kmt_wp_overlap(sep, kb, MDB_TGT_WA_X))
1835 			kmdb_dpi_wapt_arm(sep->se_data);
1836 	}
1837 
1838 	(void) set_errno(error);
1839 	return (status);
1840 }
1841 
1842 /*ARGSUSED*/
1843 static int
1844 kmt_brkpt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
1845 {
1846 	kmt_brkpt_t *kb = sep->se_data;
1847 	int state, why;
1848 	kreg_t pc;
1849 
1850 	state = kmdb_dpi_get_state(&why);
1851 	(void) kmdb_dpi_get_register("pc", &pc);
1852 
1853 	return (state == DPI_STATE_FAULTED && why == DPI_STATE_WHY_BKPT &&
1854 	    pc == kb->kb_addr);
1855 }
1856 
1857 static const mdb_se_ops_t kmt_brkpt_ops = {
1858 	kmt_brkpt_ctor,		/* se_ctor */
1859 	kmt_brkpt_dtor,		/* se_dtor */
1860 	kmt_brkpt_info,		/* se_info */
1861 	kmt_brkpt_secmp,	/* se_secmp */
1862 	kmt_brkpt_vecmp,	/* se_vecmp */
1863 	kmt_brkpt_arm,		/* se_arm */
1864 	kmt_brkpt_disarm,	/* se_disarm */
1865 	kmt_brkpt_cont,		/* se_cont */
1866 	kmt_brkpt_match		/* se_match */
1867 };
1868 
1869 static int
1870 kmt_wapt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
1871 {
1872 	mdb_tgt_status_t tsp;
1873 	kmdb_wapt_t *vwp = args;
1874 	kmdb_wapt_t *swp;
1875 
1876 	(void) mdb_tgt_status(t, &tsp);
1877 	if (tsp.st_state != MDB_TGT_RUNNING && tsp.st_state != MDB_TGT_STOPPED)
1878 		return (set_errno(EMDB_NOPROC));
1879 
1880 	swp = mdb_alloc(sizeof (kmdb_wapt_t), UM_SLEEP);
1881 	bcopy(vwp, swp, sizeof (kmdb_wapt_t));
1882 
1883 	if (kmdb_dpi_wapt_reserve(swp) < 0) {
1884 		mdb_free(swp, sizeof (kmdb_wapt_t));
1885 		return (-1); /* errno is set for us */
1886 	}
1887 
1888 	sep->se_data = swp;
1889 
1890 	return (0);
1891 }
1892 
1893 /*ARGSUSED*/
1894 static void
1895 kmt_wapt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
1896 {
1897 	kmdb_wapt_t *wp = sep->se_data;
1898 
1899 	kmdb_dpi_wapt_release(wp);
1900 	mdb_free(wp, sizeof (kmdb_wapt_t));
1901 }
1902 
1903 /*ARGSUSED*/
1904 static char *
1905 kmt_wapt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
1906     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
1907 {
1908 	kmdb_wapt_t *wp = vep != NULL ? vep->ve_args : sep->se_data;
1909 	const char *fmt;
1910 	char desc[24];
1911 
1912 	ASSERT(wp->wp_wflags != 0);
1913 	desc[0] = '\0';
1914 
1915 	switch (wp->wp_wflags) {
1916 	case MDB_TGT_WA_R:
1917 		(void) strcat(desc, "/read");
1918 		break;
1919 	case MDB_TGT_WA_W:
1920 		(void) strcat(desc, "/write");
1921 		break;
1922 	case MDB_TGT_WA_X:
1923 		(void) strcat(desc, "/exec");
1924 		break;
1925 	default:
1926 		if (wp->wp_wflags & MDB_TGT_WA_R)
1927 			(void) strcat(desc, "/r");
1928 		if (wp->wp_wflags & MDB_TGT_WA_W)
1929 			(void) strcat(desc, "/w");
1930 		if (wp->wp_wflags & MDB_TGT_WA_X)
1931 			(void) strcat(desc, "/x");
1932 	}
1933 
1934 	switch (wp->wp_type) {
1935 	case DPI_WAPT_TYPE_PHYS:
1936 		fmt = "stop on %s of phys [%p, %p)";
1937 		break;
1938 
1939 	case DPI_WAPT_TYPE_VIRT:
1940 		fmt = "stop on %s of [%la, %la)";
1941 		break;
1942 
1943 	case DPI_WAPT_TYPE_IO:
1944 		if (wp->wp_size == 1)
1945 			fmt = "stop on %s of I/O port %p";
1946 		else
1947 			fmt = "stop on %s of I/O port [%p, %p)";
1948 		break;
1949 
1950 	default:
1951 		fmt = "stop on %s of unknown [%p, %p]";
1952 		break;
1953 	}
1954 
1955 	(void) mdb_iob_snprintf(buf, nbytes, fmt, desc + 1, wp->wp_addr,
1956 	    wp->wp_addr + wp->wp_size);
1957 
1958 	sp->spec_base = wp->wp_addr;
1959 	sp->spec_size = wp->wp_size;
1960 
1961 	return (buf);
1962 }
1963 
1964 /*ARGSUSED*/
1965 static int
1966 kmt_wapt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
1967 {
1968 	kmdb_wapt_t *wp1 = sep->se_data;
1969 	kmdb_wapt_t *wp2 = args;
1970 
1971 	return (wp1->wp_addr == wp2->wp_addr && wp1->wp_size == wp2->wp_size &&
1972 	    wp1->wp_wflags == wp2->wp_wflags);
1973 }
1974 
1975 /*ARGSUSED*/
1976 static int
1977 kmt_wapt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
1978 {
1979 	kmdb_wapt_t *wp1 = vep->ve_args;
1980 	kmdb_wapt_t *wp2 = args;
1981 
1982 	return (wp1->wp_addr == wp2->wp_addr && wp1->wp_size == wp2->wp_size &&
1983 	    wp1->wp_wflags == wp2->wp_wflags);
1984 }
1985 
1986 /*ARGSUSED*/
1987 static int
1988 kmt_wapt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
1989 {
1990 	kmdb_dpi_wapt_arm(sep->se_data);
1991 
1992 	return (0);
1993 }
1994 
1995 /*ARGSUSED*/
1996 static int
1997 kmt_wapt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
1998 {
1999 	kmdb_dpi_wapt_disarm(sep->se_data);
2000 
2001 	return (0);
2002 }
2003 
2004 /*
2005  * Determine whether the specified sespec is an armed breakpoint at the given
2006  * %pc.  We use this to find conflicts with watchpoints below.
2007  */
2008 static int
2009 kmt_bp_overlap(mdb_sespec_t *sep, uintptr_t pc)
2010 {
2011 	kmt_brkpt_t *kb = sep->se_data;
2012 
2013 	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
2014 	    sep->se_ops == &kmt_brkpt_ops && kb->kb_addr == pc);
2015 }
2016 
2017 /*
2018  * We step over watchpoints using our single-stepper.  If a conflicting
2019  * breakpoint is present, we must temporarily disarm it before stepping over
2020  * the watchpoint so we do not immediately re-trigger the breakpoint.  This is
2021  * similar to the case handled in kmt_brkpt_cont(), above.
2022  */
2023 static int
2024 kmt_wapt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
2025 {
2026 	mdb_sespec_t *bep = NULL;
2027 	int status = -1;
2028 	int error, why;
2029 
2030 	/*
2031 	 * If we stopped for anything other than a watchpoint, check to see
2032 	 * if there's a breakpoint here.
2033 	 */
2034 	if (!(kmdb_dpi_get_state(&why) == DPI_STATE_FAULTED &&
2035 	    (why == DPI_STATE_WHY_V_WAPT || why == DPI_STATE_WHY_P_WAPT))) {
2036 		kreg_t pc;
2037 
2038 		(void) kmdb_dpi_get_register("pc", &pc);
2039 
2040 		for (bep = mdb_list_next(&t->t_active); bep != NULL;
2041 		    bep = mdb_list_next(bep)) {
2042 			if (kmt_bp_overlap(bep, pc)) {
2043 				(void) bep->se_ops->se_disarm(t, bep);
2044 				bep->se_state = MDB_TGT_SPEC_ACTIVE;
2045 				break;
2046 			}
2047 		}
2048 	}
2049 
2050 	kmdb_dpi_wapt_disarm(sep->se_data);
2051 	if (kmt_step(t, tsp) == 0)
2052 		status = kmt_status(t, tsp);
2053 
2054 	error = errno; /* save errno from step or status */
2055 
2056 	if (bep != NULL)
2057 		mdb_tgt_sespec_arm_one(t, bep);
2058 
2059 	(void) set_errno(error);
2060 	return (status);
2061 }
2062 
2063 /*ARGSUSED*/
2064 static int
2065 kmt_wapt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
2066 {
2067 	return (kmdb_dpi_wapt_match(sep->se_data));
2068 }
2069 
2070 static const mdb_se_ops_t kmt_wapt_ops = {
2071 	kmt_wapt_ctor,		/* se_ctor */
2072 	kmt_wapt_dtor,		/* se_dtor */
2073 	kmt_wapt_info,		/* se_info */
2074 	kmt_wapt_secmp,		/* se_secmp */
2075 	kmt_wapt_vecmp,		/* se_vecmp */
2076 	kmt_wapt_arm,		/* se_arm */
2077 	kmt_wapt_disarm,	/* se_disarm */
2078 	kmt_wapt_cont,		/* se_cont */
2079 	kmt_wapt_match		/* se_match */
2080 };
2081 
2082 /*ARGSUSED*/
2083 static int
2084 kmt_trap_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
2085 {
2086 	sep->se_data = args; /* trap number */
2087 
2088 	return (0);
2089 }
2090 
2091 /*ARGSUSED*/
2092 static char *
2093 kmt_trap_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
2094     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
2095 {
2096 	const char *name;
2097 	int trapnum;
2098 
2099 	if (vep != NULL)
2100 		trapnum = (intptr_t)vep->ve_args;
2101 	else
2102 		trapnum = (intptr_t)sep->se_data;
2103 
2104 	if (trapnum == KMT_TRAP_ALL)
2105 		name = "any trap";
2106 	else if (trapnum == KMT_TRAP_NOTENUM)
2107 		name = "miscellaneous trap";
2108 	else
2109 		name = kmt_trapname(trapnum);
2110 
2111 	(void) mdb_iob_snprintf(buf, nbytes, "single-step stop on %s", name);
2112 
2113 	return (buf);
2114 }
2115 
2116 /*ARGSUSED2*/
2117 static int
2118 kmt_trap_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
2119 {
2120 	int spectt = (intptr_t)sep->se_data;
2121 	kmt_data_t *kmt = t->t_data;
2122 	kreg_t tt;
2123 
2124 	(void) kmdb_dpi_get_register("tt", &tt);
2125 
2126 	switch (spectt) {
2127 	case KMT_TRAP_ALL:
2128 		return (1);
2129 	case KMT_TRAP_NOTENUM:
2130 		return (tt > kmt->kmt_trapmax ||
2131 		    !BT_TEST(kmt->kmt_trapmap, tt));
2132 	default:
2133 		return (tt == spectt);
2134 	}
2135 }
2136 
2137 static const mdb_se_ops_t kmt_trap_ops = {
2138 	kmt_trap_ctor,		/* se_ctor */
2139 	no_se_dtor,		/* se_dtor */
2140 	kmt_trap_info,		/* se_info */
2141 	no_se_secmp,		/* se_secmp */
2142 	no_se_vecmp,		/* se_vecmp */
2143 	no_se_arm,		/* se_arm */
2144 	no_se_disarm,		/* se_disarm */
2145 	no_se_cont,		/* se_cont */
2146 	kmt_trap_match		/* se_match */
2147 };
2148 
2149 static void
2150 kmt_bparg_dtor(mdb_vespec_t *vep)
2151 {
2152 	kmt_bparg_t *ka = vep->ve_args;
2153 
2154 	if (ka->ka_symbol != NULL)
2155 		strfree(ka->ka_symbol);
2156 
2157 	if (ka->ka_defbp != NULL)
2158 		kmt_defbp_delete(mdb.m_target, ka->ka_defbp);
2159 
2160 	mdb_free(ka, sizeof (kmt_bparg_t));
2161 }
2162 
2163 static int
2164 kmt_add_vbrkpt(mdb_tgt_t *t, uintptr_t addr,
2165     int spec_flags, mdb_tgt_se_f *func, void *data)
2166 {
2167 	kmt_bparg_t *ka = mdb_alloc(sizeof (kmt_bparg_t), UM_SLEEP);
2168 
2169 	ka->ka_addr = addr;
2170 	ka->ka_symbol = NULL;
2171 	ka->ka_defbp = NULL;
2172 
2173 	return (mdb_tgt_vespec_insert(t, &kmt_brkpt_ops, spec_flags,
2174 	    func, data, ka, kmt_bparg_dtor));
2175 }
2176 
2177 static int
2178 kmt_add_sbrkpt(mdb_tgt_t *t, const char *fullname,
2179     int spec_flags, mdb_tgt_se_f *func, void *data)
2180 {
2181 	kmt_bparg_t *ka;
2182 	kmt_defbp_t *dbp;
2183 	GElf_Sym sym;
2184 	char *tick, *objname, *symname;
2185 	int serrno;
2186 
2187 	if ((tick = strchr(fullname, '`')) == fullname) {
2188 		(void) set_errno(EMDB_NOOBJ);
2189 		return (0);
2190 	}
2191 
2192 	/*
2193 	 * Deferred breakpoints are always scoped.  If we didn't find a tick,
2194 	 * there's no scope.  We'll create a vbrkpt, but only if we can turn the
2195 	 * provided string into an address.
2196 	 */
2197 	if (tick == NULL) {
2198 		uintptr_t addr;
2199 
2200 		if (strisbasenum(fullname)) {
2201 			addr = mdb_strtoull(fullname); /* a bare address */
2202 		} else if (mdb_tgt_lookup_by_name(t, MDB_TGT_OBJ_EVERY,
2203 		    fullname, &sym, NULL) < 0) {
2204 			(void) set_errno(EMDB_NOSYM);
2205 			return (0);
2206 		} else {
2207 			addr = (uintptr_t)sym.st_value; /* unscoped sym name */
2208 		}
2209 
2210 		return (kmt_add_vbrkpt(t, addr, spec_flags, func, data));
2211 	}
2212 
2213 	if (*(tick + 1) == '\0') {
2214 		(void) set_errno(EMDB_NOSYM);
2215 		return (0);
2216 	}
2217 
2218 	objname = strndup(fullname, tick - fullname);
2219 	symname = tick + 1;
2220 
2221 	if (mdb_tgt_lookup_by_name(t, objname, symname, NULL, NULL) < 0 &&
2222 	    errno != EMDB_NOOBJ) {
2223 		serrno = errno;
2224 		strfree(objname);
2225 
2226 		(void) set_errno(serrno);
2227 		return (0); /* errno is set for us */
2228 	}
2229 
2230 	dbp = kmt_defbp_create(t, objname, symname);
2231 	strfree(objname);
2232 
2233 	ka = mdb_alloc(sizeof (kmt_bparg_t), UM_SLEEP);
2234 	ka->ka_symbol = strdup(fullname);
2235 	ka->ka_addr = 0;
2236 	ka->ka_defbp = dbp;
2237 
2238 	return (mdb_tgt_vespec_insert(t, &kmt_brkpt_ops, spec_flags,
2239 	    func, data, ka, kmt_bparg_dtor));
2240 }
2241 
2242 static int
2243 kmt_wparg_overlap(const kmdb_wapt_t *wp1, const kmdb_wapt_t *wp2)
2244 {
2245 	/* Assume the watchpoint spaces don't overlap */
2246 	if (wp1->wp_type != wp2->wp_type)
2247 		return (0);
2248 
2249 	if (wp2->wp_addr + wp2->wp_size <= wp1->wp_addr)
2250 		return (0); /* no range overlap */
2251 
2252 	if (wp1->wp_addr + wp1->wp_size <= wp2->wp_addr)
2253 		return (0); /* no range overlap */
2254 
2255 	return (wp1->wp_addr != wp2->wp_addr || wp1->wp_size != wp2->wp_size ||
2256 	    wp1->wp_wflags != wp2->wp_wflags);
2257 }
2258 
2259 static void
2260 kmt_wparg_dtor(mdb_vespec_t *vep)
2261 {
2262 	mdb_free(vep->ve_args, sizeof (kmdb_wapt_t));
2263 }
2264 
2265 static int
2266 kmt_add_wapt_common(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
2267     int spec_flags, mdb_tgt_se_f *func, void *data, int type)
2268 {
2269 	kmdb_wapt_t *wp = mdb_alloc(sizeof (kmdb_wapt_t), UM_SLEEP);
2270 	mdb_sespec_t *sep;
2271 
2272 	wp->wp_addr = addr;
2273 	wp->wp_size = len;
2274 	wp->wp_type = type;
2275 	wp->wp_wflags = wflags;
2276 
2277 	if (kmdb_dpi_wapt_validate(wp) < 0)
2278 		return (0); /* errno is set for us */
2279 
2280 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
2281 		if (sep->se_ops == &kmt_wapt_ops &&
2282 		    mdb_list_next(&sep->se_velist) != NULL &&
2283 		    kmt_wparg_overlap(wp, sep->se_data))
2284 			goto wapt_dup;
2285 	}
2286 
2287 	for (sep = mdb_list_next(&t->t_idle); sep; sep = mdb_list_next(sep)) {
2288 		if (sep->se_ops == &kmt_wapt_ops && kmt_wparg_overlap(wp,
2289 		    ((mdb_vespec_t *)mdb_list_next(&sep->se_velist))->ve_args))
2290 			goto wapt_dup;
2291 	}
2292 
2293 	return (mdb_tgt_vespec_insert(t, &kmt_wapt_ops, spec_flags,
2294 	    func, data, wp, kmt_wparg_dtor));
2295 
2296 wapt_dup:
2297 	mdb_free(wp, sizeof (kmdb_wapt_t));
2298 	(void) set_errno(EMDB_WPDUP);
2299 	return (0);
2300 }
2301 
2302 static int
2303 kmt_add_pwapt(mdb_tgt_t *t, physaddr_t addr, size_t len, uint_t wflags,
2304     int spec_flags, mdb_tgt_se_f *func, void *data)
2305 {
2306 	return (kmt_add_wapt_common(t, (uintptr_t)addr, len, wflags, spec_flags,
2307 	    func, data, DPI_WAPT_TYPE_PHYS));
2308 }
2309 
2310 static int
2311 kmt_add_vwapt(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
2312     int spec_flags, mdb_tgt_se_f *func, void *data)
2313 {
2314 	return (kmt_add_wapt_common(t, addr, len, wflags, spec_flags, func,
2315 	    data, DPI_WAPT_TYPE_VIRT));
2316 }
2317 
2318 static int
2319 kmt_add_iowapt(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
2320     int spec_flags, mdb_tgt_se_f *func, void *data)
2321 {
2322 	return (kmt_add_wapt_common(t, addr, len, wflags, spec_flags, func,
2323 	    data, DPI_WAPT_TYPE_IO));
2324 }
2325 
2326 static int
2327 kmt_add_trap(mdb_tgt_t *t, int trapnum, int spec_flags, mdb_tgt_se_f *func,
2328     void *data)
2329 {
2330 	kmt_data_t *kmt = t->t_data;
2331 
2332 	if (trapnum != KMT_TRAP_ALL && trapnum != KMT_TRAP_NOTENUM) {
2333 		if (trapnum < 0 || trapnum > kmt->kmt_trapmax) {
2334 			(void) set_errno(EMDB_BADFLTNUM);
2335 			return (0);
2336 		}
2337 
2338 		BT_SET(kmt->kmt_trapmap, trapnum);
2339 	}
2340 
2341 	return (mdb_tgt_vespec_insert(t, &kmt_trap_ops, spec_flags, func, data,
2342 	    (void *)(uintptr_t)trapnum, no_ve_dtor));
2343 }
2344 
2345 /*ARGSUSED*/
2346 static uintmax_t
2347 kmt_cpuid_disc_get(const mdb_var_t *v)
2348 {
2349 	return (kmdb_dpi_get_master_cpuid());
2350 }
2351 
2352 static const mdb_nv_disc_t kmt_cpuid_disc = {
2353 	NULL,
2354 	kmt_cpuid_disc_get
2355 };
2356 
2357 /*
2358  * This routine executes while the kernel is running.
2359  */
2360 void
2361 kmt_activate(mdb_tgt_t *t)
2362 {
2363 	kmt_data_t *kmt = t->t_data;
2364 
2365 	mdb_prop_postmortem = FALSE;
2366 	mdb_prop_kernel = TRUE;
2367 
2368 	(void) mdb_tgt_register_dcmds(t, &kmt_dcmds[0], MDB_MOD_FORCE);
2369 	mdb_tgt_register_regvars(t, kmt->kmt_rds, &kmt_reg_disc, 0);
2370 
2371 	/*
2372 	 * Force load of the MDB krtld module, in case it's been rolled into
2373 	 * unix.
2374 	 */
2375 	(void) mdb_module_load(KMT_RTLD_NAME, MDB_MOD_SILENT | MDB_MOD_DEFER);
2376 }
2377 
2378 static void
2379 kmt_destroy(mdb_tgt_t *t)
2380 {
2381 	kmt_data_t *kmt = t->t_data;
2382 	kmt_module_t *km, *pkm;
2383 
2384 	mdb_nv_destroy(&kmt->kmt_modules);
2385 	for (km = mdb_list_prev(&kmt->kmt_modlist); km != NULL; km = pkm) {
2386 		pkm = mdb_list_prev(km);
2387 		mdb_free(km, sizeof (kmt_module_t));
2388 	}
2389 
2390 	if (!kmt_defbp_lock)
2391 		kmt_defbp_destroy_all();
2392 
2393 	if (kmt->kmt_trapmap != NULL)
2394 		mdb_free(kmt->kmt_trapmap, BT_SIZEOFMAP(kmt->kmt_trapmax));
2395 
2396 	mdb_free(kmt, sizeof (kmt_data_t));
2397 }
2398 
2399 static const mdb_tgt_ops_t kmt_ops = {
2400 	kmt_setflags,				/* t_setflags */
2401 	(int (*)())(uintptr_t)mdb_tgt_notsup,	/* t_setcontext */
2402 	kmt_activate,				/* t_activate */
2403 	(void (*)())(uintptr_t)mdb_tgt_nop,	/* t_deactivate */
2404 	kmt_periodic,				/* t_periodic */
2405 	kmt_destroy,				/* t_destroy */
2406 	kmt_name,				/* t_name */
2407 	(const char *(*)())mdb_conf_isa,	/* t_isa */
2408 	kmt_platform,				/* t_platform */
2409 	kmt_uname,				/* t_uname */
2410 	kmt_dmodel,				/* t_dmodel */
2411 	(ssize_t (*)())mdb_tgt_notsup,		/* t_aread */
2412 	(ssize_t (*)())mdb_tgt_notsup,		/* t_awrite */
2413 	kmt_read,				/* t_vread */
2414 	kmt_write,				/* t_vwrite */
2415 	kmt_pread,				/* t_pread */
2416 	kmt_pwrite,				/* t_pwrite */
2417 	kmt_read,				/* t_fread */
2418 	kmt_write,				/* t_fwrite */
2419 	kmt_ioread,				/* t_ioread */
2420 	kmt_iowrite,				/* t_iowrite */
2421 	kmt_vtop,				/* t_vtop */
2422 	kmt_lookup_by_name,			/* t_lookup_by_name */
2423 	kmt_lookup_by_addr,			/* t_lookup_by_addr */
2424 	kmt_symbol_iter,			/* t_symbol_iter */
2425 	kmt_mapping_iter,			/* t_mapping_iter */
2426 	kmt_object_iter,			/* t_object_iter */
2427 	kmt_addr_to_map,			/* t_addr_to_map */
2428 	kmt_name_to_map,			/* t_name_to_map */
2429 	kmt_addr_to_ctf,			/* t_addr_to_ctf */
2430 	kmt_name_to_ctf,			/* t_name_to_ctf */
2431 	kmt_status,				/* t_status */
2432 	(int (*)())(uintptr_t)mdb_tgt_notsup,	/* t_run */
2433 	kmt_step,				/* t_step */
2434 	kmt_step_out,				/* t_step_out */
2435 	kmt_next,				/* t_next */
2436 	kmt_continue,				/* t_cont */
2437 	(int (*)())(uintptr_t)mdb_tgt_notsup,	/* t_signal */
2438 	kmt_add_vbrkpt,				/* t_add_vbrkpt */
2439 	kmt_add_sbrkpt,				/* t_add_sbrkpt */
2440 	kmt_add_pwapt,				/* t_add_pwapt */
2441 	kmt_add_vwapt,				/* t_add_vwapt */
2442 	kmt_add_iowapt,				/* t_add_iowapt */
2443 	(int (*)())(uintptr_t)mdb_tgt_null,	/* t_add_sysenter */
2444 	(int (*)())(uintptr_t)mdb_tgt_null,	/* t_add_sysexit */
2445 	(int (*)())(uintptr_t)mdb_tgt_null,	/* t_add_signal */
2446 	kmt_add_trap,				/* t_add_fault */
2447 	kmt_getareg,				/* t_getareg */
2448 	kmt_putareg,				/* t_putareg */
2449 	(int (*)())(uintptr_t)mdb_tgt_nop,	/* XXX t_stack_iter */
2450 	(int (*)())(uintptr_t)mdb_tgt_notsup	/* t_auxv */
2451 };
2452 
2453 /*
2454  * Called immediately upon resumption of the system after a step or continue.
2455  * Allows us to synchronize kmt's view of the world with reality.
2456  */
2457 /*ARGSUSED*/
2458 static void
2459 kmt_sync(mdb_tgt_t *t)
2460 {
2461 	kmt_data_t *kmt = t->t_data;
2462 	int symavail;
2463 
2464 	mdb_dprintf(MDB_DBG_KMOD, "synchronizing with kernel\n");
2465 
2466 	symavail = kmt->kmt_symavail;
2467 	kmt->kmt_symavail = FALSE;
2468 
2469 	/*
2470 	 * Resync our view of the world if the modules have changed, or if we
2471 	 * didn't have any symbols coming into this function.  The latter will
2472 	 * only happen on startup.
2473 	 */
2474 	if (kmdb_kdi_mods_changed() || !symavail)
2475 		kmt_modlist_update(t);
2476 
2477 	/*
2478 	 * It would be nice if we could run this less frequently, perhaps
2479 	 * after a dvec-initiated trigger.
2480 	 */
2481 	kmdb_module_sync();
2482 
2483 	kmt->kmt_symavail = TRUE;
2484 
2485 	mdb_dprintf(MDB_DBG_KMOD, "synchronization complete\n");
2486 
2487 	kmt_defbp_prune();
2488 
2489 	if (kmt_defbp_num > 0 && kmt_defbp_bpspec == 0 &&
2490 	    kmdb_kdi_dtrace_get_state() != KDI_DTSTATE_DTRACE_ACTIVE) {
2491 		/*
2492 		 * Deferred breakpoints were created while DTrace was active,
2493 		 * and consequently the deferred breakpoint enabling mechanism
2494 		 * wasn't activated.  Activate it now, and then try to activate
2495 		 * the deferred breakpoints.  We do this so that we can catch
2496 		 * the ones which may apply to modules that have been loaded
2497 		 * while they were waiting for DTrace to deactivate.
2498 		 */
2499 		(void) kmt_defbp_activate(t);
2500 		(void) mdb_tgt_sespec_activate_all(t);
2501 	}
2502 
2503 	(void) mdb_tgt_status(t, &t->t_status);
2504 }
2505 
2506 /*
2507  * This routine executes while the kernel is running.
2508  */
2509 /*ARGSUSED*/
2510 int
2511 kmdb_kvm_create(mdb_tgt_t *t, int argc, const char *argv[])
2512 {
2513 	kmt_data_t *kmt;
2514 
2515 	if (argc != 0)
2516 		return (set_errno(EINVAL));
2517 
2518 	kmt = mdb_zalloc(sizeof (kmt_data_t), UM_SLEEP);
2519 	t->t_data = kmt;
2520 	t->t_ops = &kmt_ops;
2521 	t->t_flags |= MDB_TGT_F_RDWR;	/* kmdb is always r/w */
2522 
2523 	(void) mdb_nv_insert(&mdb.m_nv, "cpuid", &kmt_cpuid_disc, 0,
2524 	    MDB_NV_PERSIST | MDB_NV_RDONLY);
2525 
2526 	(void) mdb_nv_create(&kmt->kmt_modules, UM_SLEEP);
2527 
2528 	kmt_init_isadep(t);
2529 
2530 	kmt->kmt_symavail = FALSE;
2531 
2532 	bzero(&kmt_defbp_list, sizeof (mdb_list_t));
2533 
2534 	return (0);
2535 
2536 create_err:
2537 	kmt_destroy(t);
2538 
2539 	return (-1);
2540 }
2541 
2542 /*
2543  * This routine is called once, when kmdb first has control of the world.
2544  */
2545 void
2546 kmdb_kvm_startup(void)
2547 {
2548 	kmt_data_t *kmt = mdb.m_target->t_data;
2549 
2550 	mdb_dprintf(MDB_DBG_KMOD, "kmdb_kvm startup\n");
2551 
2552 	kmt_sync(mdb.m_target);
2553 	(void) mdb_module_load_builtin(KMT_MODULE);
2554 	kmt_startup_isadep(mdb.m_target);
2555 
2556 	/*
2557 	 * This is here because we need to write the deferred breakpoint
2558 	 * breakpoint when the debugger starts.  Our normal r/o write routines
2559 	 * don't work when the kernel is running, so we have to do it during
2560 	 * startup.
2561 	 */
2562 	(void) mdb_tgt_sespec_activate_all(mdb.m_target);
2563 
2564 	kmt->kmt_rtld_name = KMT_RTLD_NAME;
2565 
2566 	if (kmt_module_by_name(kmt, KMT_RTLD_NAME) == NULL)
2567 		kmt->kmt_rtld_name = "unix";
2568 }
2569 
2570 /*
2571  * This routine is called after kmdb has loaded its initial set of modules.
2572  */
2573 void
2574 kmdb_kvm_poststartup(void)
2575 {
2576 	mdb_dprintf(MDB_DBG_KMOD, "kmdb_kvm post-startup\n");
2577 
2578 	(void) mdb_dis_select(kmt_def_dismode());
2579 }
2580