xref: /titanic_50/usr/src/cmd/mdb/common/mdb/mdb_proc.c (revision a65cd518c5d0f30c53594a7022eb0f7d04c98cef)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 
22 /*
23  * Copyright 2010 Sun Microsystems, Inc.  All rights reserved.
24  * Use is subject to license terms.
25  */
26 /*
27  * Copyright (c) 2013, Joyent, Inc.  All rights reserved.
28  */
29 
30 /*
31  * User Process Target
32  *
33  * The user process target is invoked when the -u or -p command-line options
34  * are used, or when an ELF executable file or ELF core file is specified on
35  * the command-line.  This target is also selected by default when no target
36  * options are present.  In this case, it defaults the executable name to
37  * "a.out".  If no process or core file is currently attached, the target
38  * functions as a kind of virtual /dev/zero (in accordance with adb(1)
39  * semantics); reads from the virtual address space return zeroes and writes
40  * fail silently.  The proc target itself is designed as a wrapper around the
41  * services provided by libproc.so: t->t_pshandle is set to the struct
42  * ps_prochandle pointer returned as a handle by libproc.  The target also
43  * opens the executable file itself using the MDB GElf services, for
44  * interpreting the .symtab and .dynsym if no libproc handle has been
45  * initialized, and for handling i/o to and from the object file.  Currently,
46  * the only ISA-dependent portions of the proc target are the $r and ::fpregs
47  * dcmds, the callbacks for t_next() and t_step_out(), and the list of named
48  * registers; these are linked in from the proc_isadep.c file for each ISA and
49  * called from the common code in this file.
50  *
51  * The user process target implements complete user process control using the
52  * facilities provided by libproc.so.  The MDB execution control model and
53  * an overview of software event management is described in mdb_target.c.  The
54  * proc target implements breakpoints by replacing the instruction of interest
55  * with a trap instruction, and then restoring the original instruction to step
56  * over the breakpoint.  The idea of replacing program text with instructions
57  * that transfer control to the debugger dates back as far as 1951 [1].  When
58  * the target stops, we replace each breakpoint with the original instruction
59  * as part of the disarm operation.  This means that no special processing is
60  * required for t_vread() because the instrumented instructions will never be
61  * seen by the debugger once the target stops.  Some debuggers have improved
62  * start/stop performance by leaving breakpoint traps in place and then
63  * handling a read from a breakpoint address as a special case.  Although this
64  * improves efficiency for a source-level debugger, it runs somewhat contrary
65  * to the philosophy of the low-level debugger.  Since we remove the
66  * instructions, users can apply other external debugging tools to the process
67  * once it has stopped (e.g. the proc(1) tools) and not be misled by MDB
68  * instrumentation.  The tracing of faults, signals, system calls, and
69  * watchpoints and general process inspection is implemented directly using
70  * the mechanisms provided by /proc, as described originally in [2] and [3].
71  *
72  * References
73  *
74  * [1] S. Gill, "The Diagnosis Of Mistakes In Programmes on the EDSAC",
75  *     Proceedings of the Royal Society Series A Mathematical and Physical
76  *     Sciences, Cambridge University Press, 206(1087), May 1951, pp. 538-554.
77  *
78  * [2] T.J. Killian, "Processes as Files", Proceedings of the USENIX Association
79  *     Summer Conference, Salt Lake City, June 1984, pp. 203-207.
80  *
81  * [3] Roger Faulkner and Ron Gomes, "The Process File System and Process
82  *     Model in UNIX System V", Proceedings of the USENIX Association
83  *     Winter Conference, Dallas, January 1991, pp. 243-252.
84  */
85 
86 #include <mdb/mdb_proc.h>
87 #include <mdb/mdb_disasm.h>
88 #include <mdb/mdb_signal.h>
89 #include <mdb/mdb_string.h>
90 #include <mdb/mdb_module.h>
91 #include <mdb/mdb_debug.h>
92 #include <mdb/mdb_conf.h>
93 #include <mdb/mdb_err.h>
94 #include <mdb/mdb_types.h>
95 #include <mdb/mdb.h>
96 
97 #include <sys/utsname.h>
98 #include <sys/wait.h>
99 #include <sys/stat.h>
100 #include <termio.h>
101 #include <signal.h>
102 #include <stdio_ext.h>
103 #include <stdlib.h>
104 #include <string.h>
105 
106 #define	PC_FAKE		-1UL			/* illegal pc value unequal 0 */
107 
108 static const char PT_EXEC_PATH[] = "a.out";	/* Default executable */
109 static const char PT_CORE_PATH[] = "core";	/* Default core file */
110 
111 static const pt_ptl_ops_t proc_lwp_ops;
112 static const pt_ptl_ops_t proc_tdb_ops;
113 static const mdb_se_ops_t proc_brkpt_ops;
114 static const mdb_se_ops_t proc_wapt_ops;
115 
116 static int pt_setrun(mdb_tgt_t *, mdb_tgt_status_t *, int);
117 static void pt_activate_common(mdb_tgt_t *);
118 static mdb_tgt_vespec_f pt_ignore_sig;
119 static mdb_tgt_se_f pt_fork;
120 static mdb_tgt_se_f pt_exec;
121 
122 static int pt_lookup_by_name_thr(mdb_tgt_t *, const char *,
123     const char *, GElf_Sym *, mdb_syminfo_t *, mdb_tgt_tid_t);
124 static int tlsbase(mdb_tgt_t *, mdb_tgt_tid_t, Lmid_t, const char *,
125     psaddr_t *);
126 
127 /*
128  * When debugging postmortem, we don't resolve names as we may very well not
129  * be on a system on which those names resolve.
130  */
131 #define	PT_LIBPROC_RESOLVE(P) \
132 	(!(mdb.m_flags & MDB_FL_LMRAW) && Pstate(P) != PS_DEAD)
133 
134 /*
135  * The Perror_printf() function interposes on the default, empty libproc
136  * definition.  It will be called to report additional information on complex
137  * errors, such as a corrupt core file.  We just pass the args to vwarn.
138  */
139 /*ARGSUSED*/
140 void
141 Perror_printf(struct ps_prochandle *P, const char *format, ...)
142 {
143 	va_list alist;
144 
145 	va_start(alist, format);
146 	vwarn(format, alist);
147 	va_end(alist);
148 }
149 
150 /*
151  * Open the specified i/o backend as the a.out executable file, and attempt to
152  * load its standard and dynamic symbol tables.  Note that if mdb_gelf_create
153  * succeeds, io is assigned to p_fio and is automatically held by gelf_create.
154  */
155 static mdb_gelf_file_t *
156 pt_open_aout(mdb_tgt_t *t, mdb_io_t *io)
157 {
158 	pt_data_t *pt = t->t_data;
159 	GElf_Sym s1, s2;
160 
161 	if ((pt->p_file = mdb_gelf_create(io, ET_NONE, GF_FILE)) == NULL)
162 		return (NULL);
163 
164 	pt->p_symtab = mdb_gelf_symtab_create_file(pt->p_file,
165 	    SHT_SYMTAB, MDB_TGT_SYMTAB);
166 	pt->p_dynsym = mdb_gelf_symtab_create_file(pt->p_file,
167 	    SHT_DYNSYM, MDB_TGT_DYNSYM);
168 
169 	/*
170 	 * If we've got an _start symbol with a zero size, prime the private
171 	 * symbol table with a copy of _start with its size set to the distance
172 	 * between _mcount and _start.  We do this because DevPro has shipped
173 	 * the Intel crt1.o without proper .size directives for years, which
174 	 * precludes proper identification of _start in stack traces.
175 	 */
176 	if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, "_start", &s1,
177 	    NULL) == 0 && s1.st_size == 0 &&
178 	    GELF_ST_TYPE(s1.st_info) == STT_FUNC) {
179 		if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, "_mcount",
180 		    &s2, NULL) == 0 && GELF_ST_TYPE(s2.st_info) == STT_FUNC) {
181 			s1.st_size = s2.st_value - s1.st_value;
182 			mdb_gelf_symtab_insert(mdb.m_prsym, "_start", &s1);
183 		}
184 	}
185 
186 	pt->p_fio = io;
187 	return (pt->p_file);
188 }
189 
190 /*
191  * Destroy the symbol tables and GElf file object associated with p_fio.  Note
192  * that we do not need to explicitly free p_fio: its reference count is
193  * automatically decremented by mdb_gelf_destroy, which will free it if needed.
194  */
195 static void
196 pt_close_aout(mdb_tgt_t *t)
197 {
198 	pt_data_t *pt = t->t_data;
199 
200 	if (pt->p_symtab != NULL) {
201 		mdb_gelf_symtab_destroy(pt->p_symtab);
202 		pt->p_symtab = NULL;
203 	}
204 
205 	if (pt->p_dynsym != NULL) {
206 		mdb_gelf_symtab_destroy(pt->p_dynsym);
207 		pt->p_dynsym = NULL;
208 	}
209 
210 	if (pt->p_file != NULL) {
211 		mdb_gelf_destroy(pt->p_file);
212 		pt->p_file = NULL;
213 	}
214 
215 	mdb_gelf_symtab_delete(mdb.m_prsym, "_start", NULL);
216 	pt->p_fio = NULL;
217 }
218 
219 typedef struct tdb_mapping {
220 	const char *tm_thr_lib;
221 	const char *tm_db_dir;
222 	const char *tm_db_name;
223 } tdb_mapping_t;
224 
225 static const tdb_mapping_t tdb_map[] = {
226 	{ "/lwp/amd64/libthread.so",	"/usr/lib/lwp/", "libthread_db.so" },
227 	{ "/lwp/sparcv9/libthread.so",	"/usr/lib/lwp/", "libthread_db.so" },
228 	{ "/lwp/libthread.so",		"/usr/lib/lwp/", "libthread_db.so" },
229 	{ "/libthread.so",		"/lib/", "libthread_db.so" },
230 	{ "/libc_hwcap",		"/lib/", "libc_db.so" },
231 	{ "/libc.so",			"/lib/", "libc_db.so" }
232 };
233 
234 /*
235  * Pobject_iter callback that we use to search for the presence of libthread in
236  * order to load the corresponding libthread_db support.  We derive the
237  * libthread_db path dynamically based on the libthread path.  If libthread is
238  * found, this function returns 1 (and thus Pobject_iter aborts and returns 1)
239  * regardless of whether it was successful in loading the libthread_db support.
240  * If we iterate over all objects and no libthread is found, 0 is returned.
241  * Since libthread_db support was then merged into libc_db, we load either
242  * libc_db or libthread_db, depending on which library we see first.
243  */
244 /*ARGSUSED*/
245 static int
246 thr_check(mdb_tgt_t *t, const prmap_t *pmp, const char *name)
247 {
248 	pt_data_t *pt = t->t_data;
249 	const mdb_tdb_ops_t *ops;
250 	char *p;
251 
252 	char path[MAXPATHLEN];
253 
254 	int libn;
255 
256 	if (name == NULL)
257 		return (0); /* no rtld_db object name; keep going */
258 
259 	for (libn = 0; libn < sizeof (tdb_map) / sizeof (tdb_map[0]); libn++) {
260 		if ((p = strstr(name, tdb_map[libn].tm_thr_lib)) != NULL)
261 			break;
262 	}
263 
264 	if (p == NULL)
265 		return (0); /* no match; keep going */
266 
267 	path[0] = '\0';
268 	(void) strlcat(path, mdb.m_root, sizeof (path));
269 	(void) strlcat(path, tdb_map[libn].tm_db_dir, sizeof (path));
270 #if !defined(_ILP32)
271 	(void) strlcat(path, "64/", sizeof (path));
272 #endif /* !_ILP32 */
273 	(void) strlcat(path, tdb_map[libn].tm_db_name, sizeof (path));
274 
275 	/* Append the trailing library version number. */
276 	(void) strlcat(path, strrchr(name, '.'), sizeof (path));
277 
278 	if ((ops = mdb_tdb_load(path)) == NULL) {
279 		if (libn != 0 || errno != ENOENT)
280 			warn("failed to load %s", path);
281 		goto err;
282 	}
283 
284 	if (ops == pt->p_tdb_ops)
285 		return (1); /* no changes needed */
286 
287 	PTL_DTOR(t);
288 	pt->p_tdb_ops = ops;
289 	pt->p_ptl_ops = &proc_tdb_ops;
290 	pt->p_ptl_hdl = NULL;
291 
292 	if (PTL_CTOR(t) == -1) {
293 		warn("failed to initialize %s", path);
294 		goto err;
295 	}
296 
297 	mdb_dprintf(MDB_DBG_TGT, "loaded %s for debugging %s\n", path, name);
298 	(void) mdb_tgt_status(t, &t->t_status);
299 	return (1);
300 err:
301 	PTL_DTOR(t);
302 	pt->p_tdb_ops = NULL;
303 	pt->p_ptl_ops = &proc_lwp_ops;
304 	pt->p_ptl_hdl = NULL;
305 
306 	if (libn != 0 || errno != ENOENT) {
307 		warn("warning: debugger will only be able to "
308 		    "examine raw LWPs\n");
309 	}
310 
311 	(void) mdb_tgt_status(t, &t->t_status);
312 	return (1);
313 }
314 
315 /*
316  * Whenever the link map is consistent following an add or delete event, we ask
317  * libproc to update its mappings, check to see if we need to load libthread_db,
318  * and then update breakpoints which have been mapped or unmapped.
319  */
320 /*ARGSUSED*/
321 static void
322 pt_rtld_event(mdb_tgt_t *t, int vid, void *private)
323 {
324 	struct ps_prochandle *P = t->t_pshandle;
325 	pt_data_t *pt = t->t_data;
326 	rd_event_msg_t rdm;
327 	int docontinue = 1;
328 
329 	if (rd_event_getmsg(pt->p_rtld, &rdm) == RD_OK) {
330 
331 		mdb_dprintf(MDB_DBG_TGT, "rtld event type 0x%x state 0x%x\n",
332 		    rdm.type, rdm.u.state);
333 
334 		if (rdm.type == RD_DLACTIVITY && rdm.u.state == RD_CONSISTENT) {
335 			mdb_sespec_t *sep, *nsep = mdb_list_next(&t->t_active);
336 			pt_brkpt_t *ptb;
337 
338 			Pupdate_maps(P);
339 
340 			if (Pobject_iter(P, (proc_map_f *)thr_check, t) == 0 &&
341 			    pt->p_ptl_ops != &proc_lwp_ops) {
342 				mdb_dprintf(MDB_DBG_TGT, "unloading thread_db "
343 				    "support after dlclose\n");
344 				PTL_DTOR(t);
345 				pt->p_tdb_ops = NULL;
346 				pt->p_ptl_ops = &proc_lwp_ops;
347 				pt->p_ptl_hdl = NULL;
348 				(void) mdb_tgt_status(t, &t->t_status);
349 			}
350 
351 			for (sep = nsep; sep != NULL; sep = nsep) {
352 				nsep = mdb_list_next(sep);
353 				ptb = sep->se_data;
354 
355 				if (sep->se_ops == &proc_brkpt_ops &&
356 				    Paddr_to_map(P, ptb->ptb_addr) == NULL)
357 					mdb_tgt_sespec_idle_one(t, sep,
358 					    EMDB_NOMAP);
359 			}
360 
361 			if (!mdb_tgt_sespec_activate_all(t) &&
362 			    (mdb.m_flags & MDB_FL_BPTNOSYMSTOP) &&
363 			    pt->p_rtld_finished) {
364 				/*
365 				 * We weren't able to activate the breakpoints.
366 				 * If so requested, we'll return without
367 				 * calling continue, thus throwing the user into
368 				 * the debugger.
369 				 */
370 				docontinue = 0;
371 			}
372 
373 			if (pt->p_rdstate == PT_RD_ADD)
374 				pt->p_rdstate = PT_RD_CONSIST;
375 		}
376 
377 		if (rdm.type == RD_PREINIT)
378 			(void) mdb_tgt_sespec_activate_all(t);
379 
380 		if (rdm.type == RD_POSTINIT) {
381 			pt->p_rtld_finished = TRUE;
382 			if (!mdb_tgt_sespec_activate_all(t) &&
383 			    (mdb.m_flags & MDB_FL_BPTNOSYMSTOP)) {
384 				/*
385 				 * Now that rtld has been initialized, we
386 				 * should be able to initialize all deferred
387 				 * breakpoints.  If we can't, don't let the
388 				 * target continue.
389 				 */
390 				docontinue = 0;
391 			}
392 		}
393 
394 		if (rdm.type == RD_DLACTIVITY && rdm.u.state == RD_ADD &&
395 		    pt->p_rtld_finished)
396 			pt->p_rdstate = MAX(pt->p_rdstate, PT_RD_ADD);
397 	}
398 
399 	if (docontinue)
400 		(void) mdb_tgt_continue(t, NULL);
401 }
402 
403 static void
404 pt_post_attach(mdb_tgt_t *t)
405 {
406 	struct ps_prochandle *P = t->t_pshandle;
407 	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
408 	pt_data_t *pt = t->t_data;
409 	int hflag = MDB_TGT_SPEC_HIDDEN;
410 
411 	mdb_dprintf(MDB_DBG_TGT, "attach pr_flags=0x%x pr_why=%d pr_what=%d\n",
412 	    psp->pr_flags, psp->pr_why, psp->pr_what);
413 
414 	/*
415 	 * When we grab a process, the initial setting of p_rtld_finished
416 	 * should be false if the process was just created by exec; otherwise
417 	 * we permit unscoped references to resolve because we do not know how
418 	 * far the process has proceeded through linker initialization.
419 	 */
420 	if ((psp->pr_flags & PR_ISTOP) && psp->pr_why == PR_SYSEXIT &&
421 	    psp->pr_errno == 0 && psp->pr_what == SYS_execve) {
422 		if (mdb.m_target == NULL) {
423 			warn("target performed exec of %s\n",
424 			    IOP_NAME(pt->p_fio));
425 		}
426 		pt->p_rtld_finished = FALSE;
427 	} else
428 		pt->p_rtld_finished = TRUE;
429 
430 	/*
431 	 * When we grab a process, if it is stopped by job control and part of
432 	 * the same session (i.e. same controlling tty), set MDB_FL_JOBCTL so
433 	 * we will know to bring it to the foreground when we continue it.
434 	 */
435 	if (mdb.m_term != NULL && (psp->pr_flags & PR_STOPPED) &&
436 	    psp->pr_why == PR_JOBCONTROL && getsid(0) == Pstatus(P)->pr_sid)
437 		mdb.m_flags |= MDB_FL_JOBCTL;
438 
439 	/*
440 	 * When we grab control of a live process, set F_RDWR so that the
441 	 * target layer permits writes to the target's address space.
442 	 */
443 	t->t_flags |= MDB_TGT_F_RDWR;
444 
445 	(void) Pfault(P, FLTBPT, TRUE);		/* always trace breakpoints */
446 	(void) Pfault(P, FLTWATCH, TRUE);	/* always trace watchpoints */
447 	(void) Pfault(P, FLTTRACE, TRUE);	/* always trace single-step */
448 
449 	(void) Punsetflags(P, PR_ASYNC);	/* require synchronous mode */
450 	(void) Psetflags(P, PR_BPTADJ);		/* always adjust eip on x86 */
451 	(void) Psetflags(P, PR_FORK);		/* inherit tracing on fork */
452 
453 	/*
454 	 * Install event specifiers to track fork and exec activities:
455 	 */
456 	(void) mdb_tgt_add_sysexit(t, SYS_vfork, hflag, pt_fork, NULL);
457 	(void) mdb_tgt_add_sysexit(t, SYS_forksys, hflag, pt_fork, NULL);
458 	(void) mdb_tgt_add_sysexit(t, SYS_execve, hflag, pt_exec, NULL);
459 
460 	/*
461 	 * Attempt to instantiate the librtld_db agent and set breakpoints
462 	 * to track rtld activity.  We will legitimately fail to instantiate
463 	 * the rtld_db agent if the target is statically linked.
464 	 */
465 	if (pt->p_rtld == NULL && (pt->p_rtld = Prd_agent(P)) != NULL) {
466 		rd_notify_t rdn;
467 		rd_err_e err;
468 
469 		if ((err = rd_event_enable(pt->p_rtld, TRUE)) != RD_OK) {
470 			warn("failed to enable rtld_db event tracing: %s\n",
471 			    rd_errstr(err));
472 			goto out;
473 		}
474 
475 		if ((err = rd_event_addr(pt->p_rtld, RD_PREINIT,
476 		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
477 			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
478 			    hflag, pt_rtld_event, NULL);
479 		} else {
480 			warn("failed to install rtld_db preinit tracing: %s\n",
481 			    rd_errstr(err));
482 		}
483 
484 		if ((err = rd_event_addr(pt->p_rtld, RD_POSTINIT,
485 		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
486 			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
487 			    hflag, pt_rtld_event, NULL);
488 		} else {
489 			warn("failed to install rtld_db postinit tracing: %s\n",
490 			    rd_errstr(err));
491 		}
492 
493 		if ((err = rd_event_addr(pt->p_rtld, RD_DLACTIVITY,
494 		    &rdn)) == RD_OK && rdn.type == RD_NOTIFY_BPT) {
495 			(void) mdb_tgt_add_vbrkpt(t, rdn.u.bptaddr,
496 			    hflag, pt_rtld_event, NULL);
497 		} else {
498 			warn("failed to install rtld_db activity tracing: %s\n",
499 			    rd_errstr(err));
500 		}
501 	}
502 out:
503 	Pupdate_maps(P);
504 	Psync(P);
505 
506 	/*
507 	 * If librtld_db failed to initialize due to an error or because we are
508 	 * debugging a statically linked executable, allow unscoped references.
509 	 */
510 	if (pt->p_rtld == NULL)
511 		pt->p_rtld_finished = TRUE;
512 
513 	(void) mdb_tgt_sespec_activate_all(t);
514 }
515 
516 /*ARGSUSED*/
517 static int
518 pt_vespec_delete(mdb_tgt_t *t, void *private, int id, void *data)
519 {
520 	if (id < 0) {
521 		ASSERT(data == NULL); /* we don't use any ve_data */
522 		(void) mdb_tgt_vespec_delete(t, id);
523 	}
524 	return (0);
525 }
526 
527 static void
528 pt_pre_detach(mdb_tgt_t *t, int clear_matched)
529 {
530 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
531 	pt_data_t *pt = t->t_data;
532 	long cmd = 0;
533 
534 	/*
535 	 * If we are about to release the process and it is stopped on a traced
536 	 * SIGINT, breakpoint fault, single-step fault, or watchpoint, make
537 	 * sure to clear this event prior to releasing the process so that it
538 	 * does not subsequently reissue the fault and die from SIGTRAP.
539 	 */
540 	if (psp->pr_flags & PR_ISTOP) {
541 		if (psp->pr_why == PR_FAULTED && (psp->pr_what == FLTBPT ||
542 		    psp->pr_what == FLTTRACE || psp->pr_what == FLTWATCH))
543 			cmd = PCCFAULT;
544 		else if (psp->pr_why == PR_SIGNALLED && psp->pr_what == SIGINT)
545 			cmd = PCCSIG;
546 
547 		if (cmd != 0)
548 			(void) write(Pctlfd(t->t_pshandle), &cmd, sizeof (cmd));
549 	}
550 
551 	if (Pstate(t->t_pshandle) == PS_UNDEAD)
552 		(void) waitpid(Pstatus(t->t_pshandle)->pr_pid, NULL, WNOHANG);
553 
554 	(void) mdb_tgt_vespec_iter(t, pt_vespec_delete, NULL);
555 	mdb_tgt_sespec_idle_all(t, EMDB_NOPROC, clear_matched);
556 
557 	if (pt->p_fio != pt->p_aout_fio) {
558 		pt_close_aout(t);
559 		(void) pt_open_aout(t, pt->p_aout_fio);
560 	}
561 
562 	PTL_DTOR(t);
563 	pt->p_tdb_ops = NULL;
564 	pt->p_ptl_ops = &proc_lwp_ops;
565 	pt->p_ptl_hdl = NULL;
566 
567 	pt->p_rtld = NULL;
568 	pt->p_signal = 0;
569 	pt->p_rtld_finished = FALSE;
570 	pt->p_rdstate = PT_RD_NONE;
571 }
572 
573 static void
574 pt_release_parents(mdb_tgt_t *t)
575 {
576 	struct ps_prochandle *P = t->t_pshandle;
577 	pt_data_t *pt = t->t_data;
578 
579 	mdb_sespec_t *sep;
580 	pt_vforkp_t *vfp;
581 
582 	while ((vfp = mdb_list_next(&pt->p_vforkp)) != NULL) {
583 		mdb_dprintf(MDB_DBG_TGT, "releasing vfork parent %d\n",
584 		    (int)Pstatus(vfp->p_pshandle)->pr_pid);
585 
586 		/*
587 		 * To release vfork parents, we must also wipe out any armed
588 		 * events in the parent by switching t_pshandle and calling
589 		 * se_disarm().  Do not change states or lose the matched list.
590 		 */
591 		t->t_pshandle = vfp->p_pshandle;
592 
593 		for (sep = mdb_list_next(&t->t_active); sep != NULL;
594 		    sep = mdb_list_next(sep)) {
595 			if (sep->se_state == MDB_TGT_SPEC_ARMED)
596 				(void) sep->se_ops->se_disarm(t, sep);
597 		}
598 
599 		t->t_pshandle = P;
600 
601 		Prelease(vfp->p_pshandle, PRELEASE_CLEAR);
602 		mdb_list_delete(&pt->p_vforkp, vfp);
603 		mdb_free(vfp, sizeof (pt_vforkp_t));
604 	}
605 }
606 
607 /*ARGSUSED*/
608 static void
609 pt_fork(mdb_tgt_t *t, int vid, void *private)
610 {
611 	struct ps_prochandle *P = t->t_pshandle;
612 	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
613 	pt_data_t *pt = t->t_data;
614 	mdb_sespec_t *sep;
615 
616 	int follow_parent = mdb.m_forkmode != MDB_FM_CHILD;
617 	int is_vfork = (psp->pr_what == SYS_vfork ||
618 	    (psp->pr_what == SYS_forksys && psp->pr_sysarg[0] == 2));
619 
620 	struct ps_prochandle *C;
621 	const lwpstatus_t *csp;
622 	char sysname[32];
623 	int gcode;
624 	char c;
625 
626 	mdb_dprintf(MDB_DBG_TGT, "parent %s: errno=%d rv1=%ld rv2=%ld\n",
627 	    proc_sysname(psp->pr_what, sysname, sizeof (sysname)),
628 	    psp->pr_errno, psp->pr_rval1, psp->pr_rval2);
629 
630 	if (psp->pr_errno != 0) {
631 		(void) mdb_tgt_continue(t, NULL);
632 		return; /* fork failed */
633 	}
634 
635 	/*
636 	 * If forkmode is ASK and stdout is a terminal, then ask the user to
637 	 * explicitly set the fork behavior for this particular fork.
638 	 */
639 	if (mdb.m_forkmode == MDB_FM_ASK && mdb.m_term != NULL) {
640 		mdb_iob_printf(mdb.m_err, "%s: %s detected: follow (p)arent "
641 		    "or (c)hild? ", mdb.m_pname, sysname);
642 		mdb_iob_flush(mdb.m_err);
643 
644 		while (IOP_READ(mdb.m_term, &c, sizeof (c)) == sizeof (c)) {
645 			if (c == 'P' || c == 'p') {
646 				mdb_iob_printf(mdb.m_err, "%c\n", c);
647 				follow_parent = TRUE;
648 				break;
649 			} else if (c == 'C' || c == 'c') {
650 				mdb_iob_printf(mdb.m_err, "%c\n", c);
651 				follow_parent = FALSE;
652 				break;
653 			}
654 		}
655 	}
656 
657 	/*
658 	 * The parent is now stopped on exit from its fork call.  We must now
659 	 * grab the child on its return from fork in order to manipulate it.
660 	 */
661 	if ((C = Pgrab(psp->pr_rval1, PGRAB_RETAIN, &gcode)) == NULL) {
662 		warn("failed to grab forked child process %ld: %s\n",
663 		    psp->pr_rval1, Pgrab_error(gcode));
664 		return; /* just stop if we failed to grab the child */
665 	}
666 
667 	/*
668 	 * We may have grabbed the child and stopped it prematurely before it
669 	 * stopped on exit from fork.  If so, wait up to 1 sec for it to settle.
670 	 */
671 	if (Pstatus(C)->pr_lwp.pr_why != PR_SYSEXIT)
672 		(void) Pwait(C, MILLISEC);
673 
674 	csp = &Pstatus(C)->pr_lwp;
675 
676 	if (csp->pr_why != PR_SYSEXIT ||
677 	    (csp->pr_what != SYS_vfork && csp->pr_what != SYS_forksys)) {
678 		warn("forked child process %ld did not stop on exit from "
679 		    "fork as expected\n", psp->pr_rval1);
680 	}
681 
682 	warn("target forked child process %ld (debugger following %s)\n",
683 	    psp->pr_rval1, follow_parent ? "parent" : "child");
684 
685 	(void) Punsetflags(C, PR_ASYNC);	/* require synchronous mode */
686 	(void) Psetflags(C, PR_BPTADJ);		/* always adjust eip on x86 */
687 	(void) Prd_agent(C);			/* initialize librtld_db */
688 
689 	/*
690 	 * At the time pt_fork() is called, the target event engine has already
691 	 * disarmed the specifiers on the active list, clearing out events in
692 	 * the parent process.  However, this means that events that change
693 	 * the address space (e.g. breakpoints) have not been effectively
694 	 * disarmed in the child since its address space reflects the state of
695 	 * the process at the time of fork when events were armed.  We must
696 	 * therefore handle this as a special case and re-invoke the disarm
697 	 * callback of each active specifier to clean out the child process.
698 	 */
699 	if (!is_vfork) {
700 		for (t->t_pshandle = C, sep = mdb_list_next(&t->t_active);
701 		    sep != NULL; sep = mdb_list_next(sep)) {
702 			if (sep->se_state == MDB_TGT_SPEC_ACTIVE)
703 				(void) sep->se_ops->se_disarm(t, sep);
704 		}
705 
706 		t->t_pshandle = P; /* restore pshandle to parent */
707 	}
708 
709 	/*
710 	 * If we're following the parent process, we need to temporarily change
711 	 * t_pshandle to refer to the child handle C so that we can clear out
712 	 * all the events in the child prior to releasing it below.  If we are
713 	 * tracing a vfork, we also need to explicitly wait for the child to
714 	 * exec, exit, or die before we can reset and continue the parent.  We
715 	 * avoid having to deal with the vfork child forking again by clearing
716 	 * PR_FORK and setting PR_RLC; if it does fork it will effectively be
717 	 * released from our control and we will continue following the parent.
718 	 */
719 	if (follow_parent) {
720 		if (is_vfork) {
721 			mdb_tgt_status_t status;
722 
723 			ASSERT(psp->pr_flags & PR_VFORKP);
724 			mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
725 			t->t_pshandle = C;
726 
727 			(void) Psysexit(C, SYS_execve, TRUE);
728 
729 			(void) Punsetflags(C, PR_FORK | PR_KLC);
730 			(void) Psetflags(C, PR_RLC);
731 
732 			do {
733 				if (pt_setrun(t, &status, 0) == -1 ||
734 				    status.st_state == MDB_TGT_UNDEAD ||
735 				    status.st_state == MDB_TGT_LOST)
736 					break; /* failure or process died */
737 
738 			} while (csp->pr_why != PR_SYSEXIT ||
739 			    csp->pr_errno != 0 || csp->pr_what != SYS_execve);
740 		} else
741 			t->t_pshandle = C;
742 	}
743 
744 	/*
745 	 * If we are following the child, destroy any active libthread_db
746 	 * handle before we release the parent process.
747 	 */
748 	if (!follow_parent) {
749 		PTL_DTOR(t);
750 		pt->p_tdb_ops = NULL;
751 		pt->p_ptl_ops = &proc_lwp_ops;
752 		pt->p_ptl_hdl = NULL;
753 	}
754 
755 	/*
756 	 * Idle all events to make sure the address space and tracing flags are
757 	 * restored, and then release the process we are not tracing.  If we
758 	 * are following the child of a vfork, we push the parent's pshandle
759 	 * on to a list of vfork parents to be released when we exec or exit.
760 	 */
761 	if (is_vfork && !follow_parent) {
762 		pt_vforkp_t *vfp = mdb_alloc(sizeof (pt_vforkp_t), UM_SLEEP);
763 
764 		ASSERT(psp->pr_flags & PR_VFORKP);
765 		vfp->p_pshandle = P;
766 		mdb_list_append(&pt->p_vforkp, vfp);
767 		mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
768 
769 	} else {
770 		mdb_tgt_sespec_idle_all(t, EBUSY, FALSE);
771 		Prelease(t->t_pshandle, PRELEASE_CLEAR);
772 		if (!follow_parent)
773 			pt_release_parents(t);
774 	}
775 
776 	/*
777 	 * Now that all the hard stuff is done, switch t_pshandle back to the
778 	 * process we are following and reset our events to the ACTIVE state.
779 	 * If we are following the child, reset the libthread_db handle as well
780 	 * as the rtld agent.
781 	 */
782 	if (follow_parent)
783 		t->t_pshandle = P;
784 	else {
785 		t->t_pshandle = C;
786 		pt->p_rtld = Prd_agent(C);
787 		(void) Pobject_iter(t->t_pshandle, (proc_map_f *)thr_check, t);
788 	}
789 
790 	(void) mdb_tgt_sespec_activate_all(t);
791 	(void) mdb_tgt_continue(t, NULL);
792 }
793 
794 /*ARGSUSED*/
795 static void
796 pt_exec(mdb_tgt_t *t, int vid, void *private)
797 {
798 	struct ps_prochandle *P = t->t_pshandle;
799 	const pstatus_t *psp = Pstatus(P);
800 	pt_data_t *pt = t->t_data;
801 	int follow_exec = mdb.m_execmode == MDB_EM_FOLLOW;
802 	pid_t pid = psp->pr_pid;
803 
804 	char execname[MAXPATHLEN];
805 	mdb_sespec_t *sep, *nsep;
806 	mdb_io_t *io;
807 	char c;
808 
809 	mdb_dprintf(MDB_DBG_TGT, "exit from %s: errno=%d\n", proc_sysname(
810 	    psp->pr_lwp.pr_what, execname, sizeof (execname)),
811 	    psp->pr_lwp.pr_errno);
812 
813 	if (psp->pr_lwp.pr_errno != 0) {
814 		(void) mdb_tgt_continue(t, NULL);
815 		return; /* exec failed */
816 	}
817 
818 	/*
819 	 * If execmode is ASK and stdout is a terminal, then ask the user to
820 	 * explicitly set the exec behavior for this particular exec.  If
821 	 * Pstate() still shows PS_LOST, we are being called from pt_setrun()
822 	 * directly and therefore we must resume the terminal since it is still
823 	 * in the suspended state as far as tgt_continue() is concerned.
824 	 */
825 	if (mdb.m_execmode == MDB_EM_ASK && mdb.m_term != NULL) {
826 		if (Pstate(P) == PS_LOST)
827 			IOP_RESUME(mdb.m_term);
828 
829 		mdb_iob_printf(mdb.m_err, "%s: %s detected: (f)ollow new "
830 		    "program or (s)top? ", mdb.m_pname, execname);
831 		mdb_iob_flush(mdb.m_err);
832 
833 		while (IOP_READ(mdb.m_term, &c, sizeof (c)) == sizeof (c)) {
834 			if (c == 'F' || c == 'f') {
835 				mdb_iob_printf(mdb.m_err, "%c\n", c);
836 				follow_exec = TRUE;
837 				break;
838 			} else if (c == 'S' || c == 's') {
839 				mdb_iob_printf(mdb.m_err, "%c\n", c);
840 				follow_exec = FALSE;
841 				break;
842 			}
843 		}
844 
845 		if (Pstate(P) == PS_LOST)
846 			IOP_SUSPEND(mdb.m_term);
847 	}
848 
849 	pt_release_parents(t);	/* release any waiting vfork parents */
850 	pt_pre_detach(t, FALSE); /* remove our breakpoints and idle events */
851 	Preset_maps(P);		/* libproc must delete mappings and symtabs */
852 	pt_close_aout(t);	/* free pt symbol tables and GElf file data */
853 
854 	/*
855 	 * If we lost control of the process across the exec and are not able
856 	 * to reopen it, we have no choice but to clear the matched event list
857 	 * and wait for the user to quit or otherwise release the process.
858 	 */
859 	if (Pstate(P) == PS_LOST && Preopen(P) == -1) {
860 		int error = errno;
861 
862 		warn("lost control of PID %d due to exec of %s executable\n",
863 		    (int)pid, error == EOVERFLOW ? "64-bit" : "set-id");
864 
865 		for (sep = t->t_matched; sep != T_SE_END; sep = nsep) {
866 			nsep = sep->se_matched;
867 			sep->se_matched = NULL;
868 			mdb_tgt_sespec_rele(t, sep);
869 		}
870 
871 		if (error != EOVERFLOW)
872 			return; /* just stop if we exec'd a set-id executable */
873 	}
874 
875 	if (Pstate(P) != PS_LOST) {
876 		if (Pexecname(P, execname, sizeof (execname)) == NULL) {
877 			(void) mdb_iob_snprintf(execname, sizeof (execname),
878 			    "/proc/%d/object/a.out", (int)pid);
879 		}
880 
881 		if (follow_exec == FALSE || psp->pr_dmodel == PR_MODEL_NATIVE)
882 			warn("target performed exec of %s\n", execname);
883 
884 		io = mdb_fdio_create_path(NULL, execname, pt->p_oflags, 0);
885 		if (io == NULL) {
886 			warn("failed to open %s", execname);
887 			warn("a.out symbol tables will not be available\n");
888 		} else if (pt_open_aout(t, io) == NULL) {
889 			(void) mdb_dis_select(pt_disasm(NULL));
890 			mdb_io_destroy(io);
891 		} else
892 			(void) mdb_dis_select(pt_disasm(&pt->p_file->gf_ehdr));
893 	}
894 
895 	/*
896 	 * We reset our libthread_db state here, but deliberately do NOT call
897 	 * PTL_DTOR because we do not want to call libthread_db's td_ta_delete.
898 	 * This interface is hopelessly broken in that it writes to the process
899 	 * address space (which we do not want it to do after an exec) and it
900 	 * doesn't bother deallocating any of its storage anyway.
901 	 */
902 	pt->p_tdb_ops = NULL;
903 	pt->p_ptl_ops = &proc_lwp_ops;
904 	pt->p_ptl_hdl = NULL;
905 
906 	if (follow_exec && psp->pr_dmodel != PR_MODEL_NATIVE) {
907 		const char *argv[3];
908 		char *state, *env;
909 		char pidarg[16];
910 		size_t envlen;
911 
912 		if (realpath(getexecname(), execname) == NULL) {
913 			warn("cannot follow PID %d -- failed to resolve "
914 			    "debugger pathname for re-exec", (int)pid);
915 			return;
916 		}
917 
918 		warn("restarting debugger to follow PID %d ...\n", (int)pid);
919 		mdb_dprintf(MDB_DBG_TGT, "re-exec'ing %s\n", execname);
920 
921 		(void) mdb_snprintf(pidarg, sizeof (pidarg), "-p%d", (int)pid);
922 
923 		state = mdb_get_config();
924 		envlen = strlen(MDB_CONFIG_ENV_VAR) + 1 + strlen(state) + 1;
925 		env = mdb_alloc(envlen, UM_SLEEP);
926 		(void) snprintf(env, envlen,
927 		    "%s=%s", MDB_CONFIG_ENV_VAR, state);
928 
929 		(void) putenv(env);
930 
931 		argv[0] = mdb.m_pname;
932 		argv[1] = pidarg;
933 		argv[2] = NULL;
934 
935 		if (mdb.m_term != NULL)
936 			IOP_SUSPEND(mdb.m_term);
937 
938 		Prelease(P, PRELEASE_CLEAR | PRELEASE_HANG);
939 		(void) execv(execname, (char *const *)argv);
940 		warn("failed to re-exec debugger");
941 
942 		if (mdb.m_term != NULL)
943 			IOP_RESUME(mdb.m_term);
944 
945 		t->t_pshandle = pt->p_idlehandle;
946 		return;
947 	}
948 
949 	pt_post_attach(t);	/* install tracing flags and activate events */
950 	pt_activate_common(t);	/* initialize librtld_db and libthread_db */
951 
952 	if (psp->pr_dmodel != PR_MODEL_NATIVE && mdb.m_term != NULL) {
953 		warn("loadable dcmds will not operate on non-native %d-bit "
954 		    "data model\n", psp->pr_dmodel == PR_MODEL_ILP32 ? 32 : 64);
955 		warn("use ::release -a and then run mdb -p %d to restart "
956 		    "debugger\n", (int)pid);
957 	}
958 
959 	if (follow_exec)
960 		(void) mdb_tgt_continue(t, NULL);
961 }
962 
963 static int
964 pt_setflags(mdb_tgt_t *t, int flags)
965 {
966 	pt_data_t *pt = t->t_data;
967 
968 	if ((flags ^ t->t_flags) & MDB_TGT_F_RDWR) {
969 		int mode = (flags & MDB_TGT_F_RDWR) ? O_RDWR : O_RDONLY;
970 		mdb_io_t *io;
971 
972 		if (pt->p_fio == NULL)
973 			return (set_errno(EMDB_NOEXEC));
974 
975 		io = mdb_fdio_create_path(NULL, IOP_NAME(pt->p_fio), mode, 0);
976 
977 		if (io == NULL)
978 			return (-1); /* errno is set for us */
979 
980 		t->t_flags = (t->t_flags & ~MDB_TGT_F_RDWR) |
981 		    (flags & MDB_TGT_F_RDWR);
982 
983 		pt->p_fio = mdb_io_hold(io);
984 		mdb_io_rele(pt->p_file->gf_io);
985 		pt->p_file->gf_io = pt->p_fio;
986 	}
987 
988 	if (flags & MDB_TGT_F_FORCE) {
989 		t->t_flags |= MDB_TGT_F_FORCE;
990 		pt->p_gflags |= PGRAB_FORCE;
991 	}
992 
993 	return (0);
994 }
995 
996 /*ARGSUSED*/
997 static int
998 pt_frame(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
999     const mdb_tgt_gregset_t *gregs)
1000 {
1001 	argc = MIN(argc, (uint_t)(uintptr_t)arglim);
1002 	mdb_printf("%a(", pc);
1003 
1004 	if (argc != 0) {
1005 		mdb_printf("%lr", *argv++);
1006 		for (argc--; argc != 0; argc--)
1007 			mdb_printf(", %lr", *argv++);
1008 	}
1009 
1010 	mdb_printf(")\n");
1011 	return (0);
1012 }
1013 
1014 static int
1015 pt_framev(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1016     const mdb_tgt_gregset_t *gregs)
1017 {
1018 	argc = MIN(argc, (uint_t)(uintptr_t)arglim);
1019 #if defined(__i386) || defined(__amd64)
1020 	mdb_printf("%0?lr %a(", gregs->gregs[R_FP], pc);
1021 #else
1022 	mdb_printf("%0?lr %a(", gregs->gregs[R_SP], pc);
1023 #endif
1024 	if (argc != 0) {
1025 		mdb_printf("%lr", *argv++);
1026 		for (argc--; argc != 0; argc--)
1027 			mdb_printf(", %lr", *argv++);
1028 	}
1029 
1030 	mdb_printf(")\n");
1031 	return (0);
1032 }
1033 
1034 static int
1035 pt_framer(void *arglim, uintptr_t pc, uint_t argc, const long *argv,
1036     const mdb_tgt_gregset_t *gregs)
1037 {
1038 	if (pt_frameregs(arglim, pc, argc, argv, gregs, pc == PC_FAKE) == -1) {
1039 		/*
1040 		 * Use verbose format if register format is not supported.
1041 		 */
1042 		return (pt_framev(arglim, pc, argc, argv, gregs));
1043 	}
1044 
1045 	return (0);
1046 }
1047 
1048 /*ARGSUSED*/
1049 static int
1050 pt_stack_common(uintptr_t addr, uint_t flags, int argc,
1051     const mdb_arg_t *argv, mdb_tgt_stack_f *func, prgreg_t saved_pc)
1052 {
1053 	void *arg = (void *)(uintptr_t)mdb.m_nargs;
1054 	mdb_tgt_t *t = mdb.m_target;
1055 	mdb_tgt_gregset_t gregs;
1056 
1057 	if (argc != 0) {
1058 		if (argv->a_type == MDB_TYPE_CHAR || argc > 1)
1059 			return (DCMD_USAGE);
1060 
1061 		if (argv->a_type == MDB_TYPE_STRING)
1062 			arg = (void *)(uintptr_t)mdb_strtoull(argv->a_un.a_str);
1063 		else
1064 			arg = (void *)(uintptr_t)argv->a_un.a_val;
1065 	}
1066 
1067 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE) {
1068 		mdb_warn("no process active\n");
1069 		return (DCMD_ERR);
1070 	}
1071 
1072 	/*
1073 	 * In the universe of sparcv7, sparcv9, ia32, and amd64 this code can be
1074 	 * common: <sys/procfs_isa.h> conveniently #defines R_FP to be the
1075 	 * appropriate register we need to set in order to perform a stack
1076 	 * traceback from a given frame address.
1077 	 */
1078 	if (flags & DCMD_ADDRSPEC) {
1079 		bzero(&gregs, sizeof (gregs));
1080 		gregs.gregs[R_FP] = addr;
1081 #ifdef __sparc
1082 		gregs.gregs[R_I7] = saved_pc;
1083 #endif /* __sparc */
1084 	} else if (PTL_GETREGS(t, PTL_TID(t), gregs.gregs) != 0) {
1085 		mdb_warn("failed to get current register set");
1086 		return (DCMD_ERR);
1087 	}
1088 
1089 	(void) mdb_tgt_stack_iter(t, &gregs, func, arg);
1090 	return (DCMD_OK);
1091 }
1092 
1093 static int
1094 pt_stack(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1095 {
1096 	return (pt_stack_common(addr, flags, argc, argv, pt_frame, 0));
1097 }
1098 
1099 static int
1100 pt_stackv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1101 {
1102 	return (pt_stack_common(addr, flags, argc, argv, pt_framev, 0));
1103 }
1104 
1105 static int
1106 pt_stackr(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1107 {
1108 	/*
1109 	 * Force printing of first register window, by setting  the
1110 	 * saved pc (%i7) to PC_FAKE.
1111 	 */
1112 	return (pt_stack_common(addr, flags, argc, argv, pt_framer, PC_FAKE));
1113 }
1114 
1115 /*ARGSUSED*/
1116 static int
1117 pt_ignored(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1118 {
1119 	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1120 	char buf[PRSIGBUFSZ];
1121 
1122 	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1123 		return (DCMD_USAGE);
1124 
1125 	if (P == NULL) {
1126 		mdb_warn("no process is currently active\n");
1127 		return (DCMD_ERR);
1128 	}
1129 
1130 	mdb_printf("%s\n", proc_sigset2str(&Pstatus(P)->pr_sigtrace, " ",
1131 	    FALSE, buf, sizeof (buf)));
1132 
1133 	return (DCMD_OK);
1134 }
1135 
1136 /*ARGSUSED*/
1137 static int
1138 pt_lwpid(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1139 {
1140 	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1141 
1142 	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1143 		return (DCMD_USAGE);
1144 
1145 	if (P == NULL) {
1146 		mdb_warn("no process is currently active\n");
1147 		return (DCMD_ERR);
1148 	}
1149 
1150 	mdb_printf("%d\n", Pstatus(P)->pr_lwp.pr_lwpid);
1151 	return (DCMD_OK);
1152 }
1153 
1154 static int
1155 pt_print_lwpid(int *n, const lwpstatus_t *psp)
1156 {
1157 	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1158 	int nlwp = Pstatus(P)->pr_nlwp;
1159 
1160 	if (*n == nlwp - 2)
1161 		mdb_printf("%d and ", (int)psp->pr_lwpid);
1162 	else if (*n == nlwp - 1)
1163 		mdb_printf("%d are", (int)psp->pr_lwpid);
1164 	else
1165 		mdb_printf("%d, ", (int)psp->pr_lwpid);
1166 
1167 	(*n)++;
1168 	return (0);
1169 }
1170 
1171 /*ARGSUSED*/
1172 static int
1173 pt_lwpids(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1174 {
1175 	struct ps_prochandle *P = mdb.m_target->t_pshandle;
1176 	int n = 0;
1177 
1178 	if (P == NULL) {
1179 		mdb_warn("no process is currently active\n");
1180 		return (DCMD_ERR);
1181 	}
1182 
1183 	switch (Pstatus(P)->pr_nlwp) {
1184 	case 0:
1185 		mdb_printf("no lwps are");
1186 		break;
1187 	case 1:
1188 		mdb_printf("lwpid %d is the only lwp",
1189 		    Pstatus(P)->pr_lwp.pr_lwpid);
1190 		break;
1191 	default:
1192 		mdb_printf("lwpids ");
1193 		(void) Plwp_iter(P, (proc_lwp_f *)pt_print_lwpid, &n);
1194 	}
1195 
1196 	switch (Pstate(P)) {
1197 	case PS_DEAD:
1198 		mdb_printf(" in core of process %d.\n", Pstatus(P)->pr_pid);
1199 		break;
1200 	case PS_IDLE:
1201 		mdb_printf(" in idle target.\n");
1202 		break;
1203 	default:
1204 		mdb_printf(" in process %d.\n", (int)Pstatus(P)->pr_pid);
1205 		break;
1206 	}
1207 
1208 	return (DCMD_OK);
1209 }
1210 
1211 /*ARGSUSED*/
1212 static int
1213 pt_ignore(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1214 {
1215 	pt_data_t *pt = mdb.m_target->t_data;
1216 
1217 	if (!(flags & DCMD_ADDRSPEC) || argc != 0)
1218 		return (DCMD_USAGE);
1219 
1220 	if (addr < 1 || addr > pt->p_maxsig) {
1221 		mdb_warn("invalid signal number -- 0t%lu\n", addr);
1222 		return (DCMD_ERR);
1223 	}
1224 
1225 	(void) mdb_tgt_vespec_iter(mdb.m_target, pt_ignore_sig, (void *)addr);
1226 	return (DCMD_OK);
1227 }
1228 
1229 /*ARGSUSED*/
1230 static int
1231 pt_attach(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1232 {
1233 	mdb_tgt_t *t = mdb.m_target;
1234 	pt_data_t *pt = t->t_data;
1235 	int state, perr;
1236 
1237 	if (!(flags & DCMD_ADDRSPEC) && argc == 0)
1238 		return (DCMD_USAGE);
1239 
1240 	if (((flags & DCMD_ADDRSPEC) && argc != 0) || argc > 1 ||
1241 	    (argc != 0 && argv->a_type != MDB_TYPE_STRING))
1242 		return (DCMD_USAGE);
1243 
1244 	if (t->t_pshandle != NULL && Pstate(t->t_pshandle) != PS_IDLE) {
1245 		mdb_warn("debugger is already attached to a %s\n",
1246 		    (Pstate(t->t_pshandle) == PS_DEAD) ? "core" : "process");
1247 		return (DCMD_ERR);
1248 	}
1249 
1250 	if (pt->p_fio == NULL) {
1251 		mdb_warn("attach requires executable to be specified on "
1252 		    "command-line (or use -p)\n");
1253 		return (DCMD_ERR);
1254 	}
1255 
1256 	if (flags & DCMD_ADDRSPEC)
1257 		t->t_pshandle = Pgrab((pid_t)addr, pt->p_gflags, &perr);
1258 	else
1259 		t->t_pshandle = proc_arg_grab(argv->a_un.a_str,
1260 		    PR_ARG_ANY, pt->p_gflags, &perr);
1261 
1262 	if (t->t_pshandle == NULL) {
1263 		t->t_pshandle = pt->p_idlehandle;
1264 		mdb_warn("cannot attach: %s\n", Pgrab_error(perr));
1265 		return (DCMD_ERR);
1266 	}
1267 
1268 	state = Pstate(t->t_pshandle);
1269 	if (state != PS_DEAD && state != PS_IDLE) {
1270 		(void) Punsetflags(t->t_pshandle, PR_KLC);
1271 		(void) Psetflags(t->t_pshandle, PR_RLC);
1272 		pt_post_attach(t);
1273 		pt_activate_common(t);
1274 	}
1275 
1276 	(void) mdb_tgt_status(t, &t->t_status);
1277 	mdb_module_load_all(0);
1278 	return (DCMD_OK);
1279 }
1280 
1281 static int
1282 pt_regstatus(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1283 {
1284 	mdb_tgt_t *t = mdb.m_target;
1285 
1286 	if (t->t_pshandle != NULL) {
1287 		const pstatus_t *psp = Pstatus(t->t_pshandle);
1288 		int cursig = psp->pr_lwp.pr_cursig;
1289 		char signame[SIG2STR_MAX];
1290 		int state = Pstate(t->t_pshandle);
1291 
1292 		if (state != PS_DEAD && state != PS_IDLE)
1293 			mdb_printf("process id = %d\n", psp->pr_pid);
1294 		else
1295 			mdb_printf("no process\n");
1296 
1297 		if (cursig != 0 && sig2str(cursig, signame) == 0)
1298 			mdb_printf("SIG%s: %s\n", signame, strsignal(cursig));
1299 	}
1300 
1301 	return (pt_regs(addr, flags, argc, argv));
1302 }
1303 
1304 static int
1305 pt_findstack(uintptr_t tid, uint_t flags, int argc, const mdb_arg_t *argv)
1306 {
1307 	mdb_tgt_t *t = mdb.m_target;
1308 	mdb_tgt_gregset_t gregs;
1309 	int showargs = 0;
1310 	int count;
1311 	uintptr_t pc, sp;
1312 
1313 	if (!(flags & DCMD_ADDRSPEC))
1314 		return (DCMD_USAGE);
1315 
1316 	count = mdb_getopts(argc, argv, 'v', MDB_OPT_SETBITS, TRUE, &showargs,
1317 	    NULL);
1318 	argc -= count;
1319 	argv += count;
1320 
1321 	if (argc > 1 || (argc == 1 && argv->a_type != MDB_TYPE_STRING))
1322 		return (DCMD_USAGE);
1323 
1324 	if (PTL_GETREGS(t, tid, gregs.gregs) != 0) {
1325 		mdb_warn("failed to get register set for thread %p", tid);
1326 		return (DCMD_ERR);
1327 	}
1328 
1329 	pc = gregs.gregs[R_PC];
1330 #if defined(__i386) || defined(__amd64)
1331 	sp = gregs.gregs[R_FP];
1332 #else
1333 	sp = gregs.gregs[R_SP];
1334 #endif
1335 	mdb_printf("stack pointer for thread %p: %p\n", tid, sp);
1336 	if (pc != 0)
1337 		mdb_printf("[ %0?lr %a() ]\n", sp, pc);
1338 
1339 	(void) mdb_inc_indent(2);
1340 	mdb_set_dot(sp);
1341 
1342 	if (argc == 1)
1343 		(void) mdb_eval(argv->a_un.a_str);
1344 	else if (showargs)
1345 		(void) mdb_eval("<.$C");
1346 	else
1347 		(void) mdb_eval("<.$C0");
1348 
1349 	(void) mdb_dec_indent(2);
1350 	return (DCMD_OK);
1351 }
1352 
1353 /*ARGSUSED*/
1354 static int
1355 pt_gcore(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1356 {
1357 	mdb_tgt_t *t = mdb.m_target;
1358 	char *prefix = "core";
1359 	char *content_str = NULL;
1360 	core_content_t content = CC_CONTENT_DEFAULT;
1361 	size_t size;
1362 	char *fname;
1363 	pid_t pid;
1364 
1365 	if (flags & DCMD_ADDRSPEC)
1366 		return (DCMD_USAGE);
1367 
1368 	if (mdb_getopts(argc, argv,
1369 	    'o', MDB_OPT_STR, &prefix,
1370 	    'c', MDB_OPT_STR, &content_str, NULL) != argc)
1371 		return (DCMD_USAGE);
1372 
1373 	if (content_str != NULL &&
1374 	    (proc_str2content(content_str, &content) != 0 ||
1375 	    content == CC_CONTENT_INVALID)) {
1376 		mdb_warn("invalid content string '%s'\n", content_str);
1377 		return (DCMD_ERR);
1378 	}
1379 
1380 	if (t->t_pshandle == NULL) {
1381 		mdb_warn("no process active\n");
1382 		return (DCMD_ERR);
1383 	}
1384 
1385 	pid = Pstatus(t->t_pshandle)->pr_pid;
1386 	size = 1 + mdb_snprintf(NULL, 0, "%s.%d", prefix, (int)pid);
1387 	fname = mdb_alloc(size, UM_SLEEP | UM_GC);
1388 	(void) mdb_snprintf(fname, size, "%s.%d", prefix, (int)pid);
1389 
1390 	if (Pgcore(t->t_pshandle, fname, content) != 0) {
1391 		mdb_warn("couldn't dump core");
1392 		return (DCMD_ERR);
1393 	}
1394 
1395 	mdb_warn("%s dumped\n", fname);
1396 
1397 	return (DCMD_OK);
1398 }
1399 
1400 /*ARGSUSED*/
1401 static int
1402 pt_kill(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1403 {
1404 	mdb_tgt_t *t = mdb.m_target;
1405 	pt_data_t *pt = t->t_data;
1406 	int state;
1407 
1408 	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1409 		return (DCMD_USAGE);
1410 
1411 	if (t->t_pshandle != NULL &&
1412 	    (state = Pstate(t->t_pshandle)) != PS_DEAD && state != PS_IDLE) {
1413 		mdb_warn("victim process PID %d forcibly terminated\n",
1414 		    (int)Pstatus(t->t_pshandle)->pr_pid);
1415 		pt_pre_detach(t, TRUE);
1416 		pt_release_parents(t);
1417 		Prelease(t->t_pshandle, PRELEASE_KILL);
1418 		t->t_pshandle = pt->p_idlehandle;
1419 		(void) mdb_tgt_status(t, &t->t_status);
1420 		mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
1421 	} else
1422 		mdb_warn("no victim process is currently under control\n");
1423 
1424 	return (DCMD_OK);
1425 }
1426 
1427 /*ARGSUSED*/
1428 static int
1429 pt_detach(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1430 {
1431 	mdb_tgt_t *t = mdb.m_target;
1432 	pt_data_t *pt = t->t_data;
1433 	int rflags = pt->p_rflags;
1434 
1435 	if (argc != 0 && argv->a_type == MDB_TYPE_STRING &&
1436 	    strcmp(argv->a_un.a_str, "-a") == 0) {
1437 		rflags = PRELEASE_HANG | PRELEASE_CLEAR;
1438 		argv++;
1439 		argc--;
1440 	}
1441 
1442 	if ((flags & DCMD_ADDRSPEC) || argc != 0)
1443 		return (DCMD_USAGE);
1444 
1445 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE) {
1446 		mdb_warn("debugger is not currently attached to a process "
1447 		    "or core file\n");
1448 		return (DCMD_ERR);
1449 	}
1450 
1451 	pt_pre_detach(t, TRUE);
1452 	pt_release_parents(t);
1453 	Prelease(t->t_pshandle, rflags);
1454 	t->t_pshandle = pt->p_idlehandle;
1455 	(void) mdb_tgt_status(t, &t->t_status);
1456 	mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
1457 
1458 	return (DCMD_OK);
1459 }
1460 
1461 static uintmax_t
1462 reg_disc_get(const mdb_var_t *v)
1463 {
1464 	mdb_tgt_t *t = MDB_NV_COOKIE(v);
1465 	mdb_tgt_tid_t tid = PTL_TID(t);
1466 	mdb_tgt_reg_t r = 0;
1467 
1468 	if (tid != (mdb_tgt_tid_t)-1L)
1469 		(void) mdb_tgt_getareg(t, tid, mdb_nv_get_name(v), &r);
1470 
1471 	return (r);
1472 }
1473 
1474 static void
1475 reg_disc_set(mdb_var_t *v, uintmax_t r)
1476 {
1477 	mdb_tgt_t *t = MDB_NV_COOKIE(v);
1478 	mdb_tgt_tid_t tid = PTL_TID(t);
1479 
1480 	if (tid != (mdb_tgt_tid_t)-1L && mdb_tgt_putareg(t, tid,
1481 	    mdb_nv_get_name(v), r) == -1)
1482 		mdb_warn("failed to modify %%%s register", mdb_nv_get_name(v));
1483 }
1484 
1485 static void
1486 pt_print_reason(const lwpstatus_t *psp)
1487 {
1488 	char name[SIG2STR_MAX + 4]; /* enough for SIG+name+\0, syscall or flt */
1489 	const char *desc;
1490 
1491 	switch (psp->pr_why) {
1492 	case PR_REQUESTED:
1493 		mdb_printf("stopped by debugger");
1494 		break;
1495 	case PR_SIGNALLED:
1496 		mdb_printf("stopped on %s (%s)", proc_signame(psp->pr_what,
1497 		    name, sizeof (name)), strsignal(psp->pr_what));
1498 		break;
1499 	case PR_SYSENTRY:
1500 		mdb_printf("stopped on entry to %s system call",
1501 		    proc_sysname(psp->pr_what, name, sizeof (name)));
1502 		break;
1503 	case PR_SYSEXIT:
1504 		mdb_printf("stopped on exit from %s system call",
1505 		    proc_sysname(psp->pr_what, name, sizeof (name)));
1506 		break;
1507 	case PR_JOBCONTROL:
1508 		mdb_printf("stopped by job control");
1509 		break;
1510 	case PR_FAULTED:
1511 		if (psp->pr_what == FLTBPT) {
1512 			mdb_printf("stopped on a breakpoint");
1513 		} else if (psp->pr_what == FLTWATCH) {
1514 			switch (psp->pr_info.si_code) {
1515 			case TRAP_RWATCH:
1516 				desc = "read";
1517 				break;
1518 			case TRAP_WWATCH:
1519 				desc = "write";
1520 				break;
1521 			case TRAP_XWATCH:
1522 				desc = "execute";
1523 				break;
1524 			default:
1525 				desc = "unknown";
1526 			}
1527 			mdb_printf("stopped %s a watchpoint (%s access to %p)",
1528 			    psp->pr_info.si_trapafter ? "after" : "on",
1529 			    desc, psp->pr_info.si_addr);
1530 		} else if (psp->pr_what == FLTTRACE) {
1531 			mdb_printf("stopped after a single-step");
1532 		} else {
1533 			mdb_printf("stopped on a %s fault",
1534 			    proc_fltname(psp->pr_what, name, sizeof (name)));
1535 		}
1536 		break;
1537 	case PR_SUSPENDED:
1538 	case PR_CHECKPOINT:
1539 		mdb_printf("suspended by the kernel");
1540 		break;
1541 	default:
1542 		mdb_printf("stopped for unknown reason (%d/%d)",
1543 		    psp->pr_why, psp->pr_what);
1544 	}
1545 }
1546 
1547 /*ARGSUSED*/
1548 static int
1549 pt_status_dcmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1550 {
1551 	mdb_tgt_t *t = mdb.m_target;
1552 	struct ps_prochandle *P = t->t_pshandle;
1553 	pt_data_t *pt = t->t_data;
1554 
1555 	if (P != NULL) {
1556 		const psinfo_t *pip = Ppsinfo(P);
1557 		const pstatus_t *psp = Pstatus(P);
1558 		int cursig = 0, bits = 0, coredump = 0;
1559 		int state;
1560 		GElf_Sym sym;
1561 		uintptr_t panicstr;
1562 		char panicbuf[128];
1563 		const siginfo_t *sip = &(psp->pr_lwp.pr_info);
1564 
1565 		char execname[MAXPATHLEN], buf[BUFSIZ];
1566 		char signame[SIG2STR_MAX + 4]; /* enough for SIG+name+\0 */
1567 
1568 		mdb_tgt_spec_desc_t desc;
1569 		mdb_sespec_t *sep;
1570 
1571 		struct utsname uts;
1572 		prcred_t cred;
1573 		psinfo_t pi;
1574 
1575 		(void) strcpy(uts.nodename, "unknown machine");
1576 		(void) Puname(P, &uts);
1577 
1578 		if (pip != NULL) {
1579 			bcopy(pip, &pi, sizeof (psinfo_t));
1580 			proc_unctrl_psinfo(&pi);
1581 		} else
1582 			bzero(&pi, sizeof (psinfo_t));
1583 
1584 		bits = pi.pr_dmodel == PR_MODEL_ILP32 ? 32 : 64;
1585 
1586 		state = Pstate(P);
1587 		if (psp != NULL && state != PS_UNDEAD && state != PS_IDLE)
1588 			cursig = psp->pr_lwp.pr_cursig;
1589 
1590 		if (state == PS_DEAD && pip != NULL) {
1591 			mdb_printf("debugging core file of %s (%d-bit) "
1592 			    "from %s\n", pi.pr_fname, bits, uts.nodename);
1593 
1594 		} else if (state == PS_DEAD) {
1595 			mdb_printf("debugging core file\n");
1596 
1597 		} else if (state == PS_IDLE) {
1598 			const GElf_Ehdr *ehp = &pt->p_file->gf_ehdr;
1599 
1600 			mdb_printf("debugging %s file (%d-bit)\n",
1601 			    ehp->e_type == ET_EXEC ? "executable" : "object",
1602 			    ehp->e_ident[EI_CLASS] == ELFCLASS32 ? 32 : 64);
1603 
1604 		} else if (state == PS_UNDEAD && pi.pr_pid == 0) {
1605 			mdb_printf("debugging defunct process\n");
1606 
1607 		} else {
1608 			mdb_printf("debugging PID %d (%d-bit)\n",
1609 			    pi.pr_pid, bits);
1610 		}
1611 
1612 		if (Pexecname(P, execname, sizeof (execname)) != NULL)
1613 			mdb_printf("file: %s\n", execname);
1614 
1615 		if (pip != NULL && state == PS_DEAD)
1616 			mdb_printf("initial argv: %s\n", pi.pr_psargs);
1617 
1618 		if (state != PS_UNDEAD && state != PS_IDLE) {
1619 			mdb_printf("threading model: ");
1620 			if (pt->p_ptl_ops == &proc_lwp_ops)
1621 				mdb_printf("raw lwps\n");
1622 			else
1623 				mdb_printf("native threads\n");
1624 		}
1625 
1626 		mdb_printf("status: ");
1627 		switch (state) {
1628 		case PS_RUN:
1629 			ASSERT(!(psp->pr_flags & PR_STOPPED));
1630 			mdb_printf("process is running");
1631 			if (psp->pr_flags & PR_DSTOP)
1632 				mdb_printf(", debugger stop directive pending");
1633 			mdb_printf("\n");
1634 			break;
1635 
1636 		case PS_STOP:
1637 			ASSERT(psp->pr_flags & PR_STOPPED);
1638 			pt_print_reason(&psp->pr_lwp);
1639 
1640 			if (psp->pr_flags & PR_DSTOP)
1641 				mdb_printf(", debugger stop directive pending");
1642 			if (psp->pr_flags & PR_ASLEEP)
1643 				mdb_printf(", sleeping in %s system call",
1644 				    proc_sysname(psp->pr_lwp.pr_syscall,
1645 				    signame, sizeof (signame)));
1646 
1647 			mdb_printf("\n");
1648 
1649 			for (sep = t->t_matched; sep != T_SE_END;
1650 			    sep = sep->se_matched) {
1651 				mdb_printf("event: %s\n", sep->se_ops->se_info(
1652 				    t, sep, mdb_list_next(&sep->se_velist),
1653 				    &desc, buf, sizeof (buf)));
1654 			}
1655 			break;
1656 
1657 		case PS_LOST:
1658 			mdb_printf("debugger lost control of process\n");
1659 			break;
1660 
1661 		case PS_UNDEAD:
1662 			coredump = WIFSIGNALED(pi.pr_wstat) &&
1663 			    WCOREDUMP(pi.pr_wstat);
1664 			/*FALLTHRU*/
1665 
1666 		case PS_DEAD:
1667 			if (cursig == 0 && WIFSIGNALED(pi.pr_wstat))
1668 				cursig = WTERMSIG(pi.pr_wstat);
1669 			/*
1670 			 * We can only use pr_wstat == 0 as a test for gcore if
1671 			 * an NT_PRCRED note is present; these features were
1672 			 * added at the same time in Solaris 8.
1673 			 */
1674 			if (pi.pr_wstat == 0 && Pstate(P) == PS_DEAD &&
1675 			    Pcred(P, &cred, 1) == 0) {
1676 				mdb_printf("process core file generated "
1677 				    "with gcore(1)\n");
1678 			} else if (cursig != 0) {
1679 				mdb_printf("process terminated by %s (%s)",
1680 				    proc_signame(cursig, signame,
1681 				    sizeof (signame)), strsignal(cursig));
1682 
1683 				if (sip->si_signo != 0 && SI_FROMUSER(sip) &&
1684 				    sip->si_pid != 0) {
1685 					mdb_printf(", pid=%d uid=%u",
1686 					    (int)sip->si_pid, sip->si_uid);
1687 					if (sip->si_code != 0) {
1688 						mdb_printf(" code=%d",
1689 						    sip->si_code);
1690 					}
1691 				} else {
1692 					switch (sip->si_signo) {
1693 					case SIGILL:
1694 					case SIGTRAP:
1695 					case SIGFPE:
1696 					case SIGSEGV:
1697 					case SIGBUS:
1698 					case SIGEMT:
1699 						mdb_printf(", addr=%p",
1700 						    sip->si_addr);
1701 					default:
1702 						break;
1703 					}
1704 				}
1705 
1706 				if (coredump)
1707 					mdb_printf(" - core file dumped");
1708 				mdb_printf("\n");
1709 			} else {
1710 				mdb_printf("process terminated with exit "
1711 				    "status %d\n", WEXITSTATUS(pi.pr_wstat));
1712 			}
1713 
1714 			if (Plookup_by_name(t->t_pshandle, "libc.so",
1715 			    "panicstr", &sym) == 0 &&
1716 			    Pread(t->t_pshandle, &panicstr, sizeof (panicstr),
1717 			    sym.st_value) == sizeof (panicstr) &&
1718 			    Pread_string(t->t_pshandle, panicbuf,
1719 			    sizeof (panicbuf), panicstr) > 0) {
1720 				mdb_printf("panic message: %s",
1721 				    panicbuf);
1722 			}
1723 
1724 
1725 			break;
1726 
1727 		case PS_IDLE:
1728 			mdb_printf("idle\n");
1729 			break;
1730 
1731 		default:
1732 			mdb_printf("unknown libproc Pstate: %d\n", Pstate(P));
1733 		}
1734 
1735 	} else if (pt->p_file != NULL) {
1736 		const GElf_Ehdr *ehp = &pt->p_file->gf_ehdr;
1737 
1738 		mdb_printf("debugging %s file (%d-bit)\n",
1739 		    ehp->e_type == ET_EXEC ? "executable" : "object",
1740 		    ehp->e_ident[EI_CLASS] == ELFCLASS32 ? 32 : 64);
1741 		mdb_printf("executable file: %s\n", IOP_NAME(pt->p_fio));
1742 		mdb_printf("status: idle\n");
1743 	}
1744 
1745 	return (DCMD_OK);
1746 }
1747 
1748 static int
1749 pt_tls(uintptr_t tid, uint_t flags, int argc, const mdb_arg_t *argv)
1750 {
1751 	const char *name;
1752 	const char *object;
1753 	GElf_Sym sym;
1754 	mdb_syminfo_t si;
1755 	mdb_tgt_t *t = mdb.m_target;
1756 
1757 	if (!(flags & DCMD_ADDRSPEC) || argc > 1)
1758 		return (DCMD_USAGE);
1759 
1760 	if (argc == 0) {
1761 		psaddr_t b;
1762 
1763 		if (tlsbase(t, tid, PR_LMID_EVERY, MDB_TGT_OBJ_EXEC, &b) != 0) {
1764 			mdb_warn("failed to lookup tlsbase for %r", tid);
1765 			return (DCMD_ERR);
1766 		}
1767 
1768 		mdb_printf("%lr\n", b);
1769 		mdb_set_dot(b);
1770 
1771 		return (DCMD_OK);
1772 	}
1773 
1774 	name = argv[0].a_un.a_str;
1775 	object = MDB_TGT_OBJ_EVERY;
1776 
1777 	if (pt_lookup_by_name_thr(t, object, name, &sym, &si, tid) != 0) {
1778 		mdb_warn("failed to lookup %s", name);
1779 		return (DCMD_ABORT); /* avoid repeated failure */
1780 	}
1781 
1782 	if (GELF_ST_TYPE(sym.st_info) != STT_TLS && DCMD_HDRSPEC(flags))
1783 		mdb_warn("%s does not refer to thread local storage\n", name);
1784 
1785 	mdb_printf("%llr\n", sym.st_value);
1786 	mdb_set_dot(sym.st_value);
1787 
1788 	return (DCMD_OK);
1789 }
1790 
1791 /*ARGSUSED*/
1792 static int
1793 pt_tmodel(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1794 {
1795 	mdb_tgt_t *t = mdb.m_target;
1796 	pt_data_t *pt = t->t_data;
1797 	const pt_ptl_ops_t *ptl_ops;
1798 
1799 	if (argc != 1 || argv->a_type != MDB_TYPE_STRING)
1800 		return (DCMD_USAGE);
1801 
1802 	if (strcmp(argv->a_un.a_str, "thread") == 0)
1803 		ptl_ops = &proc_tdb_ops;
1804 	else if (strcmp(argv->a_un.a_str, "lwp") == 0)
1805 		ptl_ops = &proc_lwp_ops;
1806 	else
1807 		return (DCMD_USAGE);
1808 
1809 	if (t->t_pshandle != NULL && pt->p_ptl_ops != ptl_ops) {
1810 		PTL_DTOR(t);
1811 		pt->p_tdb_ops = NULL;
1812 		pt->p_ptl_ops = &proc_lwp_ops;
1813 		pt->p_ptl_hdl = NULL;
1814 
1815 		if (ptl_ops == &proc_tdb_ops) {
1816 			(void) Pobject_iter(t->t_pshandle, (proc_map_f *)
1817 			    thr_check, t);
1818 		}
1819 	}
1820 
1821 	(void) mdb_tgt_status(t, &t->t_status);
1822 	return (DCMD_OK);
1823 }
1824 
1825 static const char *
1826 env_match(const char *cmp, const char *nameval)
1827 {
1828 	const char *loc;
1829 	size_t cmplen = strlen(cmp);
1830 
1831 	loc = strchr(nameval, '=');
1832 	if (loc != NULL && (loc - nameval) == cmplen &&
1833 	    strncmp(nameval, cmp, cmplen) == 0) {
1834 		return (loc + 1);
1835 	}
1836 
1837 	return (NULL);
1838 }
1839 
1840 /*ARGSUSED*/
1841 static int
1842 print_env(void *data, struct ps_prochandle *P, uintptr_t addr,
1843     const char *nameval)
1844 {
1845 	const char *value;
1846 
1847 	if (nameval == NULL) {
1848 		mdb_printf("<0x%p>\n", addr);
1849 	} else {
1850 		if (data == NULL)
1851 			mdb_printf("%s\n", nameval);
1852 		else if ((value = env_match(data, nameval)) != NULL)
1853 			mdb_printf("%s\n", value);
1854 	}
1855 
1856 	return (0);
1857 }
1858 
1859 /*ARGSUSED*/
1860 static int
1861 pt_getenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1862 {
1863 	mdb_tgt_t *t = mdb.m_target;
1864 	pt_data_t *pt = t->t_data;
1865 	int i;
1866 	uint_t opt_t = 0;
1867 	mdb_var_t *v;
1868 
1869 	i = mdb_getopts(argc, argv,
1870 	    't', MDB_OPT_SETBITS, TRUE, &opt_t, NULL);
1871 
1872 	argc -= i;
1873 	argv += i;
1874 
1875 	if ((flags & DCMD_ADDRSPEC) || argc > 1)
1876 		return (DCMD_USAGE);
1877 
1878 	if (argc == 1 && argv->a_type != MDB_TYPE_STRING)
1879 		return (DCMD_USAGE);
1880 
1881 	if (opt_t && t->t_pshandle == NULL) {
1882 		mdb_warn("no process active\n");
1883 		return (DCMD_ERR);
1884 	}
1885 
1886 	if (opt_t && (Pstate(t->t_pshandle) == PS_IDLE ||
1887 	    Pstate(t->t_pshandle) == PS_UNDEAD)) {
1888 		mdb_warn("-t option requires target to be running\n");
1889 		return (DCMD_ERR);
1890 	}
1891 
1892 	if (opt_t != 0) {
1893 		if (Penv_iter(t->t_pshandle, print_env,
1894 		    argc == 0 ? NULL : (void *)argv->a_un.a_str) != 0)
1895 			return (DCMD_ERR);
1896 	} else if (argc == 1) {
1897 		if ((v = mdb_nv_lookup(&pt->p_env, argv->a_un.a_str)) == NULL)
1898 			return (DCMD_ERR);
1899 
1900 		ASSERT(strchr(mdb_nv_get_cookie(v), '=') != NULL);
1901 		mdb_printf("%s\n", strchr(mdb_nv_get_cookie(v), '=') + 1);
1902 	} else {
1903 
1904 		mdb_nv_rewind(&pt->p_env);
1905 		while ((v = mdb_nv_advance(&pt->p_env)) != NULL)
1906 			mdb_printf("%s\n", mdb_nv_get_cookie(v));
1907 	}
1908 
1909 	return (DCMD_OK);
1910 }
1911 
1912 /*
1913  * Function to set a variable in the internal environment, which is used when
1914  * creating new processes.  Note that it is possible that 'nameval' can refer to
1915  * read-only memory, if mdb calls putenv() on an existing value before calling
1916  * this function.  While we should avoid this situation, this function is
1917  * designed to be robust in the face of such changes.
1918  */
1919 static void
1920 pt_env_set(pt_data_t *pt, const char *nameval)
1921 {
1922 	mdb_var_t *v;
1923 	char *equals, *val;
1924 	const char *name;
1925 	size_t len;
1926 
1927 	if ((equals = strchr(nameval, '=')) != NULL) {
1928 		val = strdup(nameval);
1929 		equals = val + (equals - nameval);
1930 	} else {
1931 		/*
1932 		 * nameval doesn't contain an equals character.  Convert this to
1933 		 * be 'nameval='.
1934 		 */
1935 		len = strlen(nameval);
1936 		val = mdb_alloc(len + 2, UM_SLEEP);
1937 		(void) mdb_snprintf(val, len + 2, "%s=", nameval);
1938 		equals = val + len;
1939 	}
1940 
1941 	/* temporary truncate the string for lookup/insert */
1942 	*equals = '\0';
1943 	v = mdb_nv_lookup(&pt->p_env, val);
1944 
1945 	if (v != NULL) {
1946 		char *old = mdb_nv_get_cookie(v);
1947 		mdb_free(old, strlen(old) + 1);
1948 		name = mdb_nv_get_name(v);
1949 	} else {
1950 		/*
1951 		 * The environment is created using MDB_NV_EXTNAME, so we must
1952 		 * provide external storage for the variable names.
1953 		 */
1954 		name = strdup(val);
1955 	}
1956 
1957 	*equals = '=';
1958 
1959 	(void) mdb_nv_insert(&pt->p_env, name, NULL, (uintptr_t)val,
1960 	    MDB_NV_EXTNAME);
1961 
1962 	if (equals)
1963 		*equals = '=';
1964 }
1965 
1966 /*
1967  * Clears the internal environment.
1968  */
1969 static void
1970 pt_env_clear(pt_data_t *pt)
1971 {
1972 	mdb_var_t *v;
1973 	char *val, *name;
1974 
1975 	mdb_nv_rewind(&pt->p_env);
1976 	while ((v = mdb_nv_advance(&pt->p_env)) != NULL) {
1977 
1978 		name = (char *)mdb_nv_get_name(v);
1979 		val = mdb_nv_get_cookie(v);
1980 
1981 		mdb_nv_remove(&pt->p_env, v);
1982 
1983 		mdb_free(name, strlen(name) + 1);
1984 		mdb_free(val, strlen(val) + 1);
1985 	}
1986 }
1987 
1988 /*ARGSUSED*/
1989 static int
1990 pt_setenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
1991 {
1992 	mdb_tgt_t *t = mdb.m_target;
1993 	pt_data_t *pt = t->t_data;
1994 	char *nameval;
1995 	size_t len;
1996 	int alloc;
1997 
1998 	if ((flags & DCMD_ADDRSPEC) || argc == 0 || argc > 2)
1999 		return (DCMD_USAGE);
2000 
2001 	if ((argc > 0 && argv[0].a_type != MDB_TYPE_STRING) ||
2002 	    (argc > 1 && argv[1].a_type != MDB_TYPE_STRING))
2003 		return (DCMD_USAGE);
2004 
2005 	if (t->t_pshandle == NULL) {
2006 		mdb_warn("no process active\n");
2007 		return (DCMD_ERR);
2008 	}
2009 
2010 	/*
2011 	 * If the process is in some sort of running state, warn the user that
2012 	 * changes won't immediately take effect.
2013 	 */
2014 	if (Pstate(t->t_pshandle) == PS_RUN ||
2015 	    Pstate(t->t_pshandle) == PS_STOP) {
2016 		mdb_warn("warning: changes will not take effect until process"
2017 		    " is restarted\n");
2018 	}
2019 
2020 	/*
2021 	 * We allow two forms of operation.  The first is the usual "name=value"
2022 	 * parameter.  We also allow the user to specify two arguments, where
2023 	 * the first is the name of the variable, and the second is the value.
2024 	 */
2025 	alloc = 0;
2026 	if (argc == 1) {
2027 		nameval = (char *)argv->a_un.a_str;
2028 	} else {
2029 		len = strlen(argv[0].a_un.a_str) +
2030 		    strlen(argv[1].a_un.a_str) + 2;
2031 		nameval = mdb_alloc(len, UM_SLEEP);
2032 		(void) mdb_snprintf(nameval, len, "%s=%s", argv[0].a_un.a_str,
2033 		    argv[1].a_un.a_str);
2034 		alloc = 1;
2035 	}
2036 
2037 	pt_env_set(pt, nameval);
2038 
2039 	if (alloc)
2040 		mdb_free(nameval, strlen(nameval) + 1);
2041 
2042 	return (DCMD_OK);
2043 }
2044 
2045 /*ARGSUSED*/
2046 static int
2047 pt_unsetenv(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
2048 {
2049 	mdb_tgt_t *t = mdb.m_target;
2050 	pt_data_t *pt = t->t_data;
2051 	mdb_var_t *v;
2052 	char *value, *name;
2053 
2054 	if ((flags & DCMD_ADDRSPEC) || argc > 1)
2055 		return (DCMD_USAGE);
2056 
2057 	if (argc == 1 && argv->a_type != MDB_TYPE_STRING)
2058 		return (DCMD_USAGE);
2059 
2060 	if (t->t_pshandle == NULL) {
2061 		mdb_warn("no process active\n");
2062 		return (DCMD_ERR);
2063 	}
2064 
2065 	/*
2066 	 * If the process is in some sort of running state, warn the user that
2067 	 * changes won't immediately take effect.
2068 	 */
2069 	if (Pstate(t->t_pshandle) == PS_RUN ||
2070 	    Pstate(t->t_pshandle) == PS_STOP) {
2071 		mdb_warn("warning: changes will not take effect until process"
2072 		    " is restarted\n");
2073 	}
2074 
2075 	if (argc == 0) {
2076 		pt_env_clear(pt);
2077 	} else {
2078 		if ((v = mdb_nv_lookup(&pt->p_env, argv->a_un.a_str)) != NULL) {
2079 			name = (char *)mdb_nv_get_name(v);
2080 			value = mdb_nv_get_cookie(v);
2081 
2082 			mdb_nv_remove(&pt->p_env, v);
2083 
2084 			mdb_free(name, strlen(name) + 1);
2085 			mdb_free(value, strlen(value) + 1);
2086 		}
2087 	}
2088 
2089 	return (DCMD_OK);
2090 }
2091 
2092 void
2093 getenv_help(void)
2094 {
2095 	mdb_printf("-t  show current process environment"
2096 	    " instead of initial environment.\n");
2097 }
2098 
2099 static const mdb_dcmd_t pt_dcmds[] = {
2100 	{ "$c", "?[cnt]", "print stack backtrace", pt_stack },
2101 	{ "$C", "?[cnt]", "print stack backtrace", pt_stackv },
2102 	{ "$i", NULL, "print signals that are ignored", pt_ignored },
2103 	{ "$l", NULL, "print the representative thread's lwp id", pt_lwpid },
2104 	{ "$L", NULL, "print list of the active lwp ids", pt_lwpids },
2105 	{ "$r", "?", "print general-purpose registers", pt_regs },
2106 	{ "$x", "?", "print floating point registers", pt_fpregs },
2107 	{ "$X", "?", "print floating point registers", pt_fpregs },
2108 	{ "$y", "?", "print floating point registers", pt_fpregs },
2109 	{ "$Y", "?", "print floating point registers", pt_fpregs },
2110 	{ "$?", "?", "print status and registers", pt_regstatus },
2111 	{ ":A", "?[core|pid]", "attach to process or core file", pt_attach },
2112 	{ ":i", ":", "ignore signal (delete all matching events)", pt_ignore },
2113 	{ ":k", NULL, "forcibly kill and release target", pt_kill },
2114 	{ ":R", "[-a]", "release the previously attached process", pt_detach },
2115 	{ "attach", "?[core|pid]",
2116 	    "attach to process or core file", pt_attach },
2117 	{ "findstack", ":[-v]", "find user thread stack", pt_findstack },
2118 	{ "gcore", "[-o prefix] [-c content]",
2119 	    "produce a core file for the attached process", pt_gcore },
2120 	{ "getenv", "[-t] [name]", "display an environment variable",
2121 		pt_getenv, getenv_help },
2122 	{ "kill", NULL, "forcibly kill and release target", pt_kill },
2123 	{ "release", "[-a]",
2124 	    "release the previously attached process", pt_detach },
2125 	{ "regs", "?", "print general-purpose registers", pt_regs },
2126 	{ "fpregs", "?[-dqs]", "print floating point registers", pt_fpregs },
2127 	{ "setenv", "name=value", "set an environment variable", pt_setenv },
2128 	{ "stack", "?[cnt]", "print stack backtrace", pt_stack },
2129 	{ "stackregs", "?", "print stack backtrace and registers", pt_stackr },
2130 	{ "status", NULL, "print summary of current target", pt_status_dcmd },
2131 	{ "tls", ":symbol",
2132 	    "lookup TLS data in the context of a given thread", pt_tls },
2133 	{ "tmodel", "{thread|lwp}", NULL, pt_tmodel },
2134 	{ "unsetenv", "[name]", "clear an environment variable", pt_unsetenv },
2135 	{ NULL }
2136 };
2137 
2138 static void
2139 pt_thr_walk_fini(mdb_walk_state_t *wsp)
2140 {
2141 	mdb_addrvec_destroy(wsp->walk_data);
2142 	mdb_free(wsp->walk_data, sizeof (mdb_addrvec_t));
2143 }
2144 
2145 static int
2146 pt_thr_walk_init(mdb_walk_state_t *wsp)
2147 {
2148 	wsp->walk_data = mdb_zalloc(sizeof (mdb_addrvec_t), UM_SLEEP);
2149 	mdb_addrvec_create(wsp->walk_data);
2150 
2151 	if (PTL_ITER(mdb.m_target, wsp->walk_data) == -1) {
2152 		mdb_warn("failed to iterate over threads");
2153 		pt_thr_walk_fini(wsp);
2154 		return (WALK_ERR);
2155 	}
2156 
2157 	return (WALK_NEXT);
2158 }
2159 
2160 static int
2161 pt_thr_walk_step(mdb_walk_state_t *wsp)
2162 {
2163 	if (mdb_addrvec_length(wsp->walk_data) != 0) {
2164 		return (wsp->walk_callback(mdb_addrvec_shift(wsp->walk_data),
2165 		    NULL, wsp->walk_cbdata));
2166 	}
2167 	return (WALK_DONE);
2168 }
2169 
2170 static const mdb_walker_t pt_walkers[] = {
2171 	{ "thread", "walk list of valid thread identifiers",
2172 	    pt_thr_walk_init, pt_thr_walk_step, pt_thr_walk_fini },
2173 	{ NULL }
2174 };
2175 
2176 static int
2177 pt_agent_check(boolean_t *agent, const lwpstatus_t *psp)
2178 {
2179 	if (psp->pr_flags & PR_AGENT)
2180 		*agent = B_TRUE;
2181 
2182 	return (0);
2183 }
2184 
2185 static void
2186 pt_activate_common(mdb_tgt_t *t)
2187 {
2188 	pt_data_t *pt = t->t_data;
2189 	boolean_t hasagent = B_FALSE;
2190 	GElf_Sym sym;
2191 
2192 	/*
2193 	 * If we have a libproc handle and AT_BASE is set, the process or core
2194 	 * is dynamically linked.  We call Prd_agent() to force libproc to
2195 	 * try to initialize librtld_db, and issue a warning if that fails.
2196 	 */
2197 	if (t->t_pshandle != NULL && Pgetauxval(t->t_pshandle,
2198 	    AT_BASE) != -1L && Prd_agent(t->t_pshandle) == NULL) {
2199 		mdb_warn("warning: librtld_db failed to initialize; shared "
2200 		    "library information will not be available\n");
2201 	}
2202 
2203 	if (t->t_pshandle != NULL) {
2204 		(void) Plwp_iter(t->t_pshandle,
2205 		    (proc_lwp_f *)pt_agent_check, &hasagent);
2206 	}
2207 
2208 	if (hasagent) {
2209 		mdb_warn("agent lwp detected; forcing "
2210 		    "lwp thread model (use ::tmodel to change)\n");
2211 	} else if (t->t_pshandle != NULL && Pstate(t->t_pshandle) != PS_IDLE) {
2212 		/*
2213 		 * If we have a libproc handle and we do not have an agent LWP,
2214 		 * look for the correct thread debugging library.  (If we have
2215 		 * an agent LWP, we leave the model as the raw LWP model to
2216 		 * allow the agent LWP to be visible to the debugger.)
2217 		 */
2218 		(void) Pobject_iter(t->t_pshandle, (proc_map_f *)thr_check, t);
2219 	}
2220 
2221 	/*
2222 	 * If there's a global object named '_mdb_abort_info', assuming we're
2223 	 * debugging mdb itself and load the developer support module.
2224 	 */
2225 	if (mdb_gelf_symtab_lookup_by_name(pt->p_symtab, "_mdb_abort_info",
2226 	    &sym, NULL) == 0 && GELF_ST_TYPE(sym.st_info) == STT_OBJECT) {
2227 		if (mdb_module_load("mdb_ds", MDB_MOD_SILENT) < 0)
2228 			mdb_warn("warning: failed to load developer support\n");
2229 	}
2230 
2231 	mdb_tgt_elf_export(pt->p_file);
2232 }
2233 
2234 static void
2235 pt_activate(mdb_tgt_t *t)
2236 {
2237 	static const mdb_nv_disc_t reg_disc = { reg_disc_set, reg_disc_get };
2238 
2239 	pt_data_t *pt = t->t_data;
2240 	struct utsname u1, u2;
2241 	mdb_var_t *v;
2242 	core_content_t content;
2243 
2244 	if (t->t_pshandle) {
2245 		mdb_prop_postmortem = (Pstate(t->t_pshandle) == PS_DEAD);
2246 		mdb_prop_kernel = FALSE;
2247 	} else
2248 		mdb_prop_kernel = mdb_prop_postmortem = FALSE;
2249 
2250 	mdb_prop_datamodel = MDB_TGT_MODEL_NATIVE;
2251 
2252 	/*
2253 	 * If we're examining a core file that doesn't contain program text,
2254 	 * and uname(2) doesn't match the NT_UTSNAME note recorded in the
2255 	 * core file, issue a warning.
2256 	 */
2257 	if (mdb_prop_postmortem == TRUE &&
2258 	    ((content = Pcontent(t->t_pshandle)) == CC_CONTENT_INVALID ||
2259 	    !(content & CC_CONTENT_TEXT)) &&
2260 	    uname(&u1) >= 0 && Puname(t->t_pshandle, &u2) == 0 &&
2261 	    (strcmp(u1.release, u2.release) != 0 ||
2262 	    strcmp(u1.version, u2.version) != 0)) {
2263 		mdb_warn("warning: core file is from %s %s %s; shared text "
2264 		    "mappings may not match installed libraries\n",
2265 		    u2.sysname, u2.release, u2.version);
2266 	}
2267 
2268 	/*
2269 	 * Perform the common initialization tasks -- these are shared with
2270 	 * the pt_exec() and pt_run() subroutines.
2271 	 */
2272 	pt_activate_common(t);
2273 
2274 	(void) mdb_tgt_register_dcmds(t, &pt_dcmds[0], MDB_MOD_FORCE);
2275 	(void) mdb_tgt_register_walkers(t, &pt_walkers[0], MDB_MOD_FORCE);
2276 
2277 	/*
2278 	 * Iterate through our register description list and export
2279 	 * each register as a named variable.
2280 	 */
2281 	mdb_nv_rewind(&pt->p_regs);
2282 	while ((v = mdb_nv_advance(&pt->p_regs)) != NULL) {
2283 		ushort_t rd_flags = MDB_TGT_R_FLAGS(mdb_nv_get_value(v));
2284 
2285 		if (!(rd_flags & MDB_TGT_R_EXPORT))
2286 			continue; /* Don't export register as a variable */
2287 
2288 		(void) mdb_nv_insert(&mdb.m_nv, mdb_nv_get_name(v), &reg_disc,
2289 		    (uintptr_t)t, MDB_NV_PERSIST);
2290 	}
2291 }
2292 
2293 static void
2294 pt_deactivate(mdb_tgt_t *t)
2295 {
2296 	pt_data_t *pt = t->t_data;
2297 	const mdb_dcmd_t *dcp;
2298 	const mdb_walker_t *wp;
2299 	mdb_var_t *v, *w;
2300 
2301 	mdb_nv_rewind(&pt->p_regs);
2302 	while ((v = mdb_nv_advance(&pt->p_regs)) != NULL) {
2303 		ushort_t rd_flags = MDB_TGT_R_FLAGS(mdb_nv_get_value(v));
2304 
2305 		if (!(rd_flags & MDB_TGT_R_EXPORT))
2306 			continue; /* Didn't export register as a variable */
2307 
2308 		if (w = mdb_nv_lookup(&mdb.m_nv, mdb_nv_get_name(v))) {
2309 			w->v_flags &= ~MDB_NV_PERSIST;
2310 			mdb_nv_remove(&mdb.m_nv, w);
2311 		}
2312 	}
2313 
2314 	for (wp = &pt_walkers[0]; wp->walk_name != NULL; wp++) {
2315 		if (mdb_module_remove_walker(t->t_module, wp->walk_name) == -1)
2316 			warn("failed to remove walk %s", wp->walk_name);
2317 	}
2318 
2319 	for (dcp = &pt_dcmds[0]; dcp->dc_name != NULL; dcp++) {
2320 		if (mdb_module_remove_dcmd(t->t_module, dcp->dc_name) == -1)
2321 			warn("failed to remove dcmd %s", dcp->dc_name);
2322 	}
2323 
2324 	mdb_prop_postmortem = FALSE;
2325 	mdb_prop_kernel = FALSE;
2326 	mdb_prop_datamodel = MDB_TGT_MODEL_UNKNOWN;
2327 }
2328 
2329 static void
2330 pt_periodic(mdb_tgt_t *t)
2331 {
2332 	pt_data_t *pt = t->t_data;
2333 
2334 	if (pt->p_rdstate == PT_RD_CONSIST) {
2335 		if (t->t_pshandle != NULL && Pstate(t->t_pshandle) < PS_LOST &&
2336 		    !(mdb.m_flags & MDB_FL_NOMODS)) {
2337 			mdb_printf("%s: You've got symbols!\n", mdb.m_pname);
2338 			mdb_module_load_all(0);
2339 		}
2340 		pt->p_rdstate = PT_RD_NONE;
2341 	}
2342 }
2343 
2344 static void
2345 pt_destroy(mdb_tgt_t *t)
2346 {
2347 	pt_data_t *pt = t->t_data;
2348 
2349 	if (pt->p_idlehandle != NULL && pt->p_idlehandle != t->t_pshandle)
2350 		Prelease(pt->p_idlehandle, 0);
2351 
2352 	if (t->t_pshandle != NULL) {
2353 		PTL_DTOR(t);
2354 		pt_release_parents(t);
2355 		pt_pre_detach(t, TRUE);
2356 		Prelease(t->t_pshandle, pt->p_rflags);
2357 	}
2358 
2359 	mdb.m_flags &= ~(MDB_FL_VCREATE | MDB_FL_JOBCTL);
2360 	pt_close_aout(t);
2361 
2362 	if (pt->p_aout_fio != NULL)
2363 		mdb_io_rele(pt->p_aout_fio);
2364 
2365 	pt_env_clear(pt);
2366 	mdb_nv_destroy(&pt->p_env);
2367 
2368 	mdb_nv_destroy(&pt->p_regs);
2369 	mdb_free(pt, sizeof (pt_data_t));
2370 }
2371 
2372 /*ARGSUSED*/
2373 static const char *
2374 pt_name(mdb_tgt_t *t)
2375 {
2376 	return ("proc");
2377 }
2378 
2379 static const char *
2380 pt_platform(mdb_tgt_t *t)
2381 {
2382 	pt_data_t *pt = t->t_data;
2383 
2384 	if (t->t_pshandle != NULL &&
2385 	    Pplatform(t->t_pshandle, pt->p_platform, MAXNAMELEN) != NULL)
2386 		return (pt->p_platform);
2387 
2388 	return (mdb_conf_platform());
2389 }
2390 
2391 static int
2392 pt_uname(mdb_tgt_t *t, struct utsname *utsp)
2393 {
2394 	if (t->t_pshandle != NULL)
2395 		return (Puname(t->t_pshandle, utsp));
2396 
2397 	return (uname(utsp) >= 0 ? 0 : -1);
2398 }
2399 
2400 static int
2401 pt_dmodel(mdb_tgt_t *t)
2402 {
2403 	if (t->t_pshandle == NULL)
2404 		return (MDB_TGT_MODEL_NATIVE);
2405 
2406 	switch (Pstatus(t->t_pshandle)->pr_dmodel) {
2407 	case PR_MODEL_ILP32:
2408 		return (MDB_TGT_MODEL_ILP32);
2409 	case PR_MODEL_LP64:
2410 		return (MDB_TGT_MODEL_LP64);
2411 	}
2412 
2413 	return (MDB_TGT_MODEL_UNKNOWN);
2414 }
2415 
2416 static ssize_t
2417 pt_vread(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
2418 {
2419 	ssize_t n;
2420 
2421 	/*
2422 	 * If no handle is open yet, reads from virtual addresses are
2423 	 * allowed to succeed but return zero-filled memory.
2424 	 */
2425 	if (t->t_pshandle == NULL) {
2426 		bzero(buf, nbytes);
2427 		return (nbytes);
2428 	}
2429 
2430 	if ((n = Pread(t->t_pshandle, buf, nbytes, addr)) <= 0)
2431 		return (set_errno(EMDB_NOMAP));
2432 
2433 	return (n);
2434 }
2435 
2436 static ssize_t
2437 pt_vwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, uintptr_t addr)
2438 {
2439 	ssize_t n;
2440 
2441 	/*
2442 	 * If no handle is open yet, writes to virtual addresses are
2443 	 * allowed to succeed but do not actually modify anything.
2444 	 */
2445 	if (t->t_pshandle == NULL)
2446 		return (nbytes);
2447 
2448 	n = Pwrite(t->t_pshandle, buf, nbytes, addr);
2449 
2450 	if (n == -1 && errno == EIO)
2451 		return (set_errno(EMDB_NOMAP));
2452 
2453 	return (n);
2454 }
2455 
2456 static ssize_t
2457 pt_fread(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
2458 {
2459 	pt_data_t *pt = t->t_data;
2460 
2461 	if (pt->p_file != NULL) {
2462 		return (mdb_gelf_rw(pt->p_file, buf, nbytes, addr,
2463 		    IOPF_READ(pt->p_fio), GIO_READ));
2464 	}
2465 
2466 	bzero(buf, nbytes);
2467 	return (nbytes);
2468 }
2469 
2470 static ssize_t
2471 pt_fwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, uintptr_t addr)
2472 {
2473 	pt_data_t *pt = t->t_data;
2474 
2475 	if (pt->p_file != NULL) {
2476 		return (mdb_gelf_rw(pt->p_file, (void *)buf, nbytes, addr,
2477 		    IOPF_WRITE(pt->p_fio), GIO_WRITE));
2478 	}
2479 
2480 	return (nbytes);
2481 }
2482 
2483 static const char *
2484 pt_resolve_lmid(const char *object, Lmid_t *lmidp)
2485 {
2486 	Lmid_t lmid = PR_LMID_EVERY;
2487 	const char *p;
2488 
2489 	if (object == MDB_TGT_OBJ_EVERY || object == MDB_TGT_OBJ_EXEC)
2490 		lmid = LM_ID_BASE; /* restrict scope to a.out's link map */
2491 	else if (object != MDB_TGT_OBJ_RTLD && strncmp(object, "LM", 2) == 0 &&
2492 	    (p = strchr(object, '`')) != NULL) {
2493 		object += 2;	/* skip past initial "LM" prefix */
2494 		lmid = strntoul(object, (size_t)(p - object), mdb.m_radix);
2495 		object = p + 1;	/* skip past link map specifier */
2496 	}
2497 
2498 	*lmidp = lmid;
2499 	return (object);
2500 }
2501 
2502 static int
2503 tlsbase(mdb_tgt_t *t, mdb_tgt_tid_t tid, Lmid_t lmid, const char *object,
2504     psaddr_t *basep)
2505 {
2506 	pt_data_t *pt = t->t_data;
2507 	const rd_loadobj_t *loadobjp;
2508 	td_thrhandle_t th;
2509 	td_err_e err;
2510 
2511 	if (object == MDB_TGT_OBJ_EVERY)
2512 		return (set_errno(EINVAL));
2513 
2514 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) == PS_IDLE)
2515 		return (set_errno(EMDB_NOPROC));
2516 
2517 	if (pt->p_tdb_ops == NULL)
2518 		return (set_errno(EMDB_TDB));
2519 
2520 	err = pt->p_tdb_ops->td_ta_map_id2thr(pt->p_ptl_hdl, tid, &th);
2521 	if (err != TD_OK)
2522 		return (set_errno(tdb_to_errno(err)));
2523 
2524 	/*
2525 	 * If this fails, rtld_db has failed to initialize properly.
2526 	 */
2527 	if ((loadobjp = Plmid_to_loadobj(t->t_pshandle, lmid, object)) == NULL)
2528 		return (set_errno(EMDB_NORTLD));
2529 
2530 	/*
2531 	 * This will fail if the TLS block has not been allocated for the
2532 	 * object that contains the TLS symbol in question.
2533 	 */
2534 	err = pt->p_tdb_ops->td_thr_tlsbase(&th, loadobjp->rl_tlsmodid, basep);
2535 	if (err != TD_OK)
2536 		return (set_errno(tdb_to_errno(err)));
2537 
2538 	return (0);
2539 }
2540 
2541 typedef struct {
2542 	mdb_tgt_t	*pl_tgt;
2543 	const char	*pl_name;
2544 	Lmid_t		pl_lmid;
2545 	GElf_Sym	*pl_symp;
2546 	mdb_syminfo_t	*pl_sip;
2547 	mdb_tgt_tid_t	pl_tid;
2548 	mdb_bool_t	pl_found;
2549 } pt_lookup_t;
2550 
2551 /*ARGSUSED*/
2552 static int
2553 pt_lookup_cb(void *data, const prmap_t *pmp, const char *object)
2554 {
2555 	pt_lookup_t *plp = data;
2556 	struct ps_prochandle *P = plp->pl_tgt->t_pshandle;
2557 	prsyminfo_t si;
2558 	GElf_Sym sym;
2559 
2560 	if (Pxlookup_by_name(P, plp->pl_lmid, object, plp->pl_name, &sym,
2561 	    &si) != 0)
2562 		return (0);
2563 
2564 	/*
2565 	 * If we encounter a match with SHN_UNDEF, keep looking for a
2566 	 * better match. Return the first match with SHN_UNDEF set if no
2567 	 * better match is found.
2568 	 */
2569 	if (sym.st_shndx == SHN_UNDEF) {
2570 		if (!plp->pl_found) {
2571 			plp->pl_found = TRUE;
2572 			*plp->pl_symp = sym;
2573 			plp->pl_sip->sym_table = si.prs_table;
2574 			plp->pl_sip->sym_id = si.prs_id;
2575 		}
2576 
2577 		return (0);
2578 	}
2579 
2580 	/*
2581 	 * Note that if the symbol's st_shndx is SHN_UNDEF we don't have the
2582 	 * TLS offset anyway, so adding in the tlsbase would be worthless.
2583 	 */
2584 	if (GELF_ST_TYPE(sym.st_info) == STT_TLS &&
2585 	    plp->pl_tid != (mdb_tgt_tid_t)-1) {
2586 		psaddr_t base;
2587 
2588 		if (tlsbase(plp->pl_tgt, plp->pl_tid, plp->pl_lmid, object,
2589 		    &base) != 0)
2590 			return (-1); /* errno is set for us */
2591 
2592 		sym.st_value += base;
2593 	}
2594 
2595 	plp->pl_found = TRUE;
2596 	*plp->pl_symp = sym;
2597 	plp->pl_sip->sym_table = si.prs_table;
2598 	plp->pl_sip->sym_id = si.prs_id;
2599 
2600 	return (1);
2601 }
2602 
2603 /*
2604  * Lookup the symbol with a thread context so that we can adjust TLS symbols
2605  * to get the values as they would appear in the context of the given thread.
2606  */
2607 static int
2608 pt_lookup_by_name_thr(mdb_tgt_t *t, const char *object,
2609     const char *name, GElf_Sym *symp, mdb_syminfo_t *sip, mdb_tgt_tid_t tid)
2610 {
2611 	struct ps_prochandle *P = t->t_pshandle;
2612 	pt_data_t *pt = t->t_data;
2613 	Lmid_t lmid;
2614 	uint_t i;
2615 	const rd_loadobj_t *aout_lop;
2616 
2617 	object = pt_resolve_lmid(object, &lmid);
2618 
2619 	if (P != NULL) {
2620 		pt_lookup_t pl;
2621 
2622 		pl.pl_tgt = t;
2623 		pl.pl_name = name;
2624 		pl.pl_lmid = lmid;
2625 		pl.pl_symp = symp;
2626 		pl.pl_sip = sip;
2627 		pl.pl_tid = tid;
2628 		pl.pl_found = FALSE;
2629 
2630 		if (object == MDB_TGT_OBJ_EVERY) {
2631 			if (Pobject_iter_resolved(P, pt_lookup_cb, &pl) == -1)
2632 				return (-1); /* errno is set for us */
2633 			if ((!pl.pl_found) &&
2634 			    (Pobject_iter(P, pt_lookup_cb, &pl) == -1))
2635 				return (-1); /* errno is set for us */
2636 		} else {
2637 			const prmap_t *pmp;
2638 
2639 			/*
2640 			 * This can fail either due to an invalid lmid or
2641 			 * an invalid object. To determine which is
2642 			 * faulty, we test the lmid against known valid
2643 			 * lmids and then see if using a wild-card lmid
2644 			 * improves ths situation.
2645 			 */
2646 			if ((pmp = Plmid_to_map(P, lmid, object)) == NULL) {
2647 				if (lmid != PR_LMID_EVERY &&
2648 				    lmid != LM_ID_BASE &&
2649 				    lmid != LM_ID_LDSO &&
2650 				    Plmid_to_map(P, PR_LMID_EVERY, object)
2651 				    != NULL)
2652 					return (set_errno(EMDB_NOLMID));
2653 				else
2654 					return (set_errno(EMDB_NOOBJ));
2655 			}
2656 
2657 			if (pt_lookup_cb(&pl, pmp, object) == -1)
2658 				return (-1); /* errno is set for us */
2659 		}
2660 
2661 		if (pl.pl_found)
2662 			return (0);
2663 	}
2664 
2665 	/*
2666 	 * If libproc doesn't have the symbols for rtld, we're cooked --
2667 	 * mdb doesn't have those symbols either.
2668 	 */
2669 	if (object == MDB_TGT_OBJ_RTLD)
2670 		return (set_errno(EMDB_NOSYM));
2671 
2672 	if (object != MDB_TGT_OBJ_EXEC && object != MDB_TGT_OBJ_EVERY) {
2673 		int status = mdb_gelf_symtab_lookup_by_file(pt->p_symtab,
2674 		    object, name, symp, &sip->sym_id);
2675 
2676 		if (status != 0) {
2677 			if (P != NULL &&
2678 			    Plmid_to_map(P, PR_LMID_EVERY, object) != NULL)
2679 				return (set_errno(EMDB_NOSYM));
2680 			else
2681 				return (-1); /* errno set from lookup_by_file */
2682 		}
2683 
2684 		goto found;
2685 	}
2686 
2687 	if (mdb_gelf_symtab_lookup_by_name(pt->p_symtab, name, symp, &i) == 0) {
2688 		sip->sym_table = MDB_TGT_SYMTAB;
2689 		sip->sym_id = i;
2690 		goto local_found;
2691 	}
2692 
2693 	if (mdb_gelf_symtab_lookup_by_name(pt->p_dynsym, name, symp, &i) == 0) {
2694 		sip->sym_table = MDB_TGT_DYNSYM;
2695 		sip->sym_id = i;
2696 		goto local_found;
2697 	}
2698 
2699 	return (set_errno(EMDB_NOSYM));
2700 
2701 local_found:
2702 	if (pt->p_file != NULL &&
2703 	    pt->p_file->gf_ehdr.e_type == ET_DYN &&
2704 	    P != NULL &&
2705 	    (aout_lop = Pname_to_loadobj(P, PR_OBJ_EXEC)) != NULL)
2706 		symp->st_value += aout_lop->rl_base;
2707 
2708 found:
2709 	/*
2710 	 * If the symbol has type TLS, libproc should have found the symbol
2711 	 * if it exists and has been allocated.
2712 	 */
2713 	if (GELF_ST_TYPE(symp->st_info) == STT_TLS)
2714 		return (set_errno(EMDB_TLS));
2715 
2716 	return (0);
2717 }
2718 
2719 static int
2720 pt_lookup_by_name(mdb_tgt_t *t, const char *object,
2721     const char *name, GElf_Sym *symp, mdb_syminfo_t *sip)
2722 {
2723 	return (pt_lookup_by_name_thr(t, object, name, symp, sip, PTL_TID(t)));
2724 }
2725 
2726 static int
2727 pt_lookup_by_addr(mdb_tgt_t *t, uintptr_t addr, uint_t flags,
2728     char *buf, size_t nbytes, GElf_Sym *symp, mdb_syminfo_t *sip)
2729 {
2730 	struct ps_prochandle *P = t->t_pshandle;
2731 	pt_data_t *pt = t->t_data;
2732 	rd_plt_info_t rpi = { 0 };
2733 
2734 	const char *pltsym;
2735 	int rv, match, i;
2736 
2737 	mdb_gelf_symtab_t *gsts[3];	/* mdb.m_prsym, .symtab, .dynsym */
2738 	int gstc = 0;			/* number of valid gsts[] entries */
2739 
2740 	mdb_gelf_symtab_t *gst = NULL;	/* set if 'sym' is from a gst */
2741 	const prmap_t *pmp = NULL;	/* set if 'sym' is from libproc */
2742 	GElf_Sym sym;			/* best symbol found so far if !exact */
2743 	prsyminfo_t si;
2744 
2745 	/*
2746 	 * Fill in our array of symbol table pointers with the private symbol
2747 	 * table, static symbol table, and dynamic symbol table if applicable.
2748 	 * These are done in order of precedence so that if we match and
2749 	 * MDB_TGT_SYM_EXACT is set, we need not look any further.
2750 	 */
2751 	if (mdb.m_prsym != NULL)
2752 		gsts[gstc++] = mdb.m_prsym;
2753 	if (P == NULL && pt->p_symtab != NULL)
2754 		gsts[gstc++] = pt->p_symtab;
2755 	if (P == NULL && pt->p_dynsym != NULL)
2756 		gsts[gstc++] = pt->p_dynsym;
2757 
2758 	/*
2759 	 * Loop through our array attempting to match the address.  If we match
2760 	 * and we're in exact mode, we're done.  Otherwise save the symbol in
2761 	 * the local sym variable if it is closer than our previous match.
2762 	 * We explicitly watch for zero-valued symbols since DevPro insists
2763 	 * on storing __fsr_init_value's value as the symbol value instead
2764 	 * of storing it in a constant integer.
2765 	 */
2766 	for (i = 0; i < gstc; i++) {
2767 		if (mdb_gelf_symtab_lookup_by_addr(gsts[i], addr, flags, buf,
2768 		    nbytes, symp, &sip->sym_id) != 0 || symp->st_value == 0)
2769 			continue;
2770 
2771 		if (flags & MDB_TGT_SYM_EXACT) {
2772 			gst = gsts[i];
2773 			goto found;
2774 		}
2775 
2776 		if (gst == NULL || mdb_gelf_sym_closer(symp, &sym, addr)) {
2777 			gst = gsts[i];
2778 			sym = *symp;
2779 		}
2780 	}
2781 
2782 	/*
2783 	 * If we have no libproc handle active, we're done: fail if gst is
2784 	 * NULL; otherwise copy out our best symbol and skip to the end.
2785 	 * We also skip to found if gst is the private symbol table: we
2786 	 * want this to always take precedence over PLT re-vectoring.
2787 	 */
2788 	if (P == NULL || (gst != NULL && gst == mdb.m_prsym)) {
2789 		if (gst == NULL)
2790 			return (set_errno(EMDB_NOSYMADDR));
2791 		*symp = sym;
2792 		goto found;
2793 	}
2794 
2795 	/*
2796 	 * Check to see if the address is in a PLT: if it is, use librtld_db to
2797 	 * attempt to resolve the PLT entry.  If the entry is bound, reset addr
2798 	 * to the bound address, add a special prefix to the caller's buf,
2799 	 * forget our previous guess, and then continue using the new addr.
2800 	 * If the entry is not bound, copy the corresponding symbol name into
2801 	 * buf and return a fake symbol for the given address.
2802 	 */
2803 	if ((pltsym = Ppltdest(P, addr)) != NULL) {
2804 		const rd_loadobj_t *rlp;
2805 		rd_agent_t *rap;
2806 
2807 		if ((rap = Prd_agent(P)) != NULL &&
2808 		    (rlp = Paddr_to_loadobj(P, addr)) != NULL &&
2809 		    rd_plt_resolution(rap, addr, Pstatus(P)->pr_lwp.pr_lwpid,
2810 		    rlp->rl_plt_base, &rpi) == RD_OK &&
2811 		    (rpi.pi_flags & RD_FLG_PI_PLTBOUND)) {
2812 			size_t n;
2813 			n = mdb_iob_snprintf(buf, nbytes, "PLT=");
2814 			addr = rpi.pi_baddr;
2815 			if (n > nbytes) {
2816 				buf += nbytes;
2817 				nbytes = 0;
2818 			} else {
2819 				buf += n;
2820 				nbytes -= n;
2821 			}
2822 			gst = NULL;
2823 		} else {
2824 			(void) mdb_iob_snprintf(buf, nbytes, "PLT:%s", pltsym);
2825 			bzero(symp, sizeof (GElf_Sym));
2826 			symp->st_value = addr;
2827 			symp->st_info = GELF_ST_INFO(STB_GLOBAL, STT_FUNC);
2828 			return (0);
2829 		}
2830 	}
2831 
2832 	/*
2833 	 * Ask libproc to convert the address to the closest symbol for us.
2834 	 * Once we get the closest symbol, we perform the EXACT match or
2835 	 * smart-mode or absolute distance check ourself:
2836 	 */
2837 	if (PT_LIBPROC_RESOLVE(P)) {
2838 		rv = Pxlookup_by_addr_resolved(P, addr, buf, nbytes,
2839 		    symp, &si);
2840 	} else {
2841 		rv = Pxlookup_by_addr(P, addr, buf, nbytes,
2842 		    symp, &si);
2843 	}
2844 	if ((rv == 0) && (symp->st_value != 0) &&
2845 	    (gst == NULL || mdb_gelf_sym_closer(symp, &sym, addr))) {
2846 
2847 		if (flags & MDB_TGT_SYM_EXACT)
2848 			match = (addr == symp->st_value);
2849 		else if (mdb.m_symdist == 0)
2850 			match = (addr >= symp->st_value &&
2851 			    addr < symp->st_value + symp->st_size);
2852 		else
2853 			match = (addr >= symp->st_value &&
2854 			    addr < symp->st_value + mdb.m_symdist);
2855 
2856 		if (match) {
2857 			pmp = Paddr_to_map(P, addr);
2858 			gst = NULL;
2859 			sip->sym_table = si.prs_table;
2860 			sip->sym_id = si.prs_id;
2861 			goto found;
2862 		}
2863 	}
2864 
2865 	/*
2866 	 * If we get here, Plookup_by_addr has failed us.  If we have no
2867 	 * previous best symbol (gst == NULL), we've failed completely.
2868 	 * Otherwise we copy out that symbol and continue on to 'found'.
2869 	 */
2870 	if (gst == NULL)
2871 		return (set_errno(EMDB_NOSYMADDR));
2872 	*symp = sym;
2873 found:
2874 	/*
2875 	 * Once we've found something, copy the final name into the caller's
2876 	 * buffer and prefix it with the mapping name if appropriate.
2877 	 */
2878 	if (pmp != NULL && pmp != Pname_to_map(P, PR_OBJ_EXEC)) {
2879 		const char *prefix = pmp->pr_mapname;
2880 		Lmid_t lmid;
2881 
2882 		if (PT_LIBPROC_RESOLVE(P)) {
2883 			if (Pobjname_resolved(P, addr, pt->p_objname,
2884 			    MDB_TGT_MAPSZ))
2885 				prefix = pt->p_objname;
2886 		} else {
2887 			if (Pobjname(P, addr, pt->p_objname, MDB_TGT_MAPSZ))
2888 				prefix = pt->p_objname;
2889 		}
2890 
2891 		if (buf != NULL && nbytes > 1) {
2892 			(void) strncpy(pt->p_symname, buf, MDB_TGT_SYM_NAMLEN);
2893 			pt->p_symname[MDB_TGT_SYM_NAMLEN - 1] = '\0';
2894 		} else {
2895 			pt->p_symname[0] = '\0';
2896 		}
2897 
2898 		if (prefix == pt->p_objname && Plmid(P, addr, &lmid) == 0 && (
2899 		    (lmid != LM_ID_BASE && lmid != LM_ID_LDSO) ||
2900 		    (mdb.m_flags & MDB_FL_SHOWLMID))) {
2901 			(void) mdb_iob_snprintf(buf, nbytes, "LM%lr`%s`%s",
2902 			    lmid, strbasename(prefix), pt->p_symname);
2903 		} else {
2904 			(void) mdb_iob_snprintf(buf, nbytes, "%s`%s",
2905 			    strbasename(prefix), pt->p_symname);
2906 		}
2907 
2908 	} else if (gst != NULL && buf != NULL && nbytes > 0) {
2909 		(void) strncpy(buf, mdb_gelf_sym_name(gst, symp), nbytes);
2910 		buf[nbytes - 1] = '\0';
2911 	}
2912 
2913 	return (0);
2914 }
2915 
2916 
2917 static int
2918 pt_symbol_iter_cb(void *arg, const GElf_Sym *sym, const char *name,
2919     const prsyminfo_t *sip)
2920 {
2921 	pt_symarg_t *psp = arg;
2922 
2923 	psp->psym_info.sym_id = sip->prs_id;
2924 
2925 	return (psp->psym_func(psp->psym_private, sym, name, &psp->psym_info,
2926 	    psp->psym_obj));
2927 }
2928 
2929 static int
2930 pt_objsym_iter(void *arg, const prmap_t *pmp, const char *object)
2931 {
2932 	Lmid_t lmid = PR_LMID_EVERY;
2933 	pt_symarg_t *psp = arg;
2934 
2935 	psp->psym_obj = object;
2936 
2937 	(void) Plmid(psp->psym_targ->t_pshandle, pmp->pr_vaddr, &lmid);
2938 	(void) Pxsymbol_iter(psp->psym_targ->t_pshandle, lmid, object,
2939 	    psp->psym_which, psp->psym_type, pt_symbol_iter_cb, arg);
2940 
2941 	return (0);
2942 }
2943 
2944 static int
2945 pt_symbol_filt(void *arg, const GElf_Sym *sym, const char *name, uint_t id)
2946 {
2947 	pt_symarg_t *psp = arg;
2948 
2949 	if (mdb_tgt_sym_match(sym, psp->psym_type)) {
2950 		psp->psym_info.sym_id = id;
2951 		return (psp->psym_func(psp->psym_private, sym, name,
2952 		    &psp->psym_info, psp->psym_obj));
2953 	}
2954 
2955 	return (0);
2956 }
2957 
2958 static int
2959 pt_symbol_iter(mdb_tgt_t *t, const char *object, uint_t which,
2960     uint_t type, mdb_tgt_sym_f *func, void *private)
2961 {
2962 	pt_data_t *pt = t->t_data;
2963 	mdb_gelf_symtab_t *gst;
2964 	pt_symarg_t ps;
2965 	Lmid_t lmid;
2966 
2967 	object = pt_resolve_lmid(object, &lmid);
2968 
2969 	ps.psym_targ = t;
2970 	ps.psym_which = which;
2971 	ps.psym_type = type;
2972 	ps.psym_func = func;
2973 	ps.psym_private = private;
2974 	ps.psym_obj = object;
2975 
2976 	if (t->t_pshandle != NULL) {
2977 		if (object != MDB_TGT_OBJ_EVERY) {
2978 			if (Plmid_to_map(t->t_pshandle, lmid, object) == NULL)
2979 				return (set_errno(EMDB_NOOBJ));
2980 			(void) Pxsymbol_iter(t->t_pshandle, lmid, object,
2981 			    which, type, pt_symbol_iter_cb, &ps);
2982 			return (0);
2983 		} else if (Prd_agent(t->t_pshandle) != NULL) {
2984 			if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
2985 				(void) Pobject_iter_resolved(t->t_pshandle,
2986 				    pt_objsym_iter, &ps);
2987 			} else {
2988 				(void) Pobject_iter(t->t_pshandle,
2989 				    pt_objsym_iter, &ps);
2990 			}
2991 			return (0);
2992 		}
2993 	}
2994 
2995 	if (lmid != LM_ID_BASE && lmid != PR_LMID_EVERY)
2996 		return (set_errno(EMDB_NOLMID));
2997 
2998 	if (object != MDB_TGT_OBJ_EXEC && object != MDB_TGT_OBJ_EVERY &&
2999 	    pt->p_fio != NULL &&
3000 	    strcmp(object, IOP_NAME(pt->p_fio)) != 0)
3001 		return (set_errno(EMDB_NOOBJ));
3002 
3003 	if (which == MDB_TGT_SYMTAB)
3004 		gst = pt->p_symtab;
3005 	else
3006 		gst = pt->p_dynsym;
3007 
3008 	if (gst != NULL) {
3009 		ps.psym_info.sym_table = gst->gst_tabid;
3010 		mdb_gelf_symtab_iter(gst, pt_symbol_filt, &ps);
3011 	}
3012 
3013 	return (0);
3014 }
3015 
3016 static const mdb_map_t *
3017 pt_prmap_to_mdbmap(mdb_tgt_t *t, const prmap_t *prp, mdb_map_t *mp)
3018 {
3019 	struct ps_prochandle *P = t->t_pshandle;
3020 	char *rv, name[MAXPATHLEN];
3021 	Lmid_t lmid;
3022 
3023 	if (PT_LIBPROC_RESOLVE(P)) {
3024 		rv = Pobjname_resolved(P, prp->pr_vaddr, name, sizeof (name));
3025 	} else {
3026 		rv = Pobjname(P, prp->pr_vaddr, name, sizeof (name));
3027 	}
3028 
3029 	if (rv != NULL) {
3030 		if (Plmid(P, prp->pr_vaddr, &lmid) == 0 && (
3031 		    (lmid != LM_ID_BASE && lmid != LM_ID_LDSO) ||
3032 		    (mdb.m_flags & MDB_FL_SHOWLMID))) {
3033 			(void) mdb_iob_snprintf(mp->map_name, MDB_TGT_MAPSZ,
3034 			    "LM%lr`%s", lmid, name);
3035 		} else {
3036 			(void) strncpy(mp->map_name, name, MDB_TGT_MAPSZ - 1);
3037 			mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3038 		}
3039 	} else {
3040 		(void) strncpy(mp->map_name, prp->pr_mapname,
3041 		    MDB_TGT_MAPSZ - 1);
3042 		mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3043 	}
3044 
3045 	mp->map_base = prp->pr_vaddr;
3046 	mp->map_size = prp->pr_size;
3047 	mp->map_flags = 0;
3048 
3049 	if (prp->pr_mflags & MA_READ)
3050 		mp->map_flags |= MDB_TGT_MAP_R;
3051 	if (prp->pr_mflags & MA_WRITE)
3052 		mp->map_flags |= MDB_TGT_MAP_W;
3053 	if (prp->pr_mflags & MA_EXEC)
3054 		mp->map_flags |= MDB_TGT_MAP_X;
3055 
3056 	if (prp->pr_mflags & MA_SHM)
3057 		mp->map_flags |= MDB_TGT_MAP_SHMEM;
3058 	if (prp->pr_mflags & MA_BREAK)
3059 		mp->map_flags |= MDB_TGT_MAP_HEAP;
3060 	if (prp->pr_mflags & MA_STACK)
3061 		mp->map_flags |= MDB_TGT_MAP_STACK;
3062 	if (prp->pr_mflags & MA_ANON)
3063 		mp->map_flags |= MDB_TGT_MAP_ANON;
3064 
3065 	return (mp);
3066 }
3067 
3068 /*ARGSUSED*/
3069 static int
3070 pt_map_apply(void *arg, const prmap_t *prp, const char *name)
3071 {
3072 	pt_maparg_t *pmp = arg;
3073 	mdb_map_t map;
3074 
3075 	return (pmp->pmap_func(pmp->pmap_private,
3076 	    pt_prmap_to_mdbmap(pmp->pmap_targ, prp, &map), map.map_name));
3077 }
3078 
3079 static int
3080 pt_mapping_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
3081 {
3082 	if (t->t_pshandle != NULL) {
3083 		pt_maparg_t pm;
3084 
3085 		pm.pmap_targ = t;
3086 		pm.pmap_func = func;
3087 		pm.pmap_private = private;
3088 
3089 		if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
3090 			(void) Pmapping_iter_resolved(t->t_pshandle,
3091 			    pt_map_apply, &pm);
3092 		} else {
3093 			(void) Pmapping_iter(t->t_pshandle,
3094 			    pt_map_apply, &pm);
3095 		}
3096 		return (0);
3097 	}
3098 
3099 	return (set_errno(EMDB_NOPROC));
3100 }
3101 
3102 static int
3103 pt_object_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
3104 {
3105 	pt_data_t *pt = t->t_data;
3106 
3107 	/*
3108 	 * If we have a libproc handle, we can just call Pobject_iter to
3109 	 * iterate over its list of load object information.
3110 	 */
3111 	if (t->t_pshandle != NULL) {
3112 		pt_maparg_t pm;
3113 
3114 		pm.pmap_targ = t;
3115 		pm.pmap_func = func;
3116 		pm.pmap_private = private;
3117 
3118 		if (PT_LIBPROC_RESOLVE(t->t_pshandle)) {
3119 			(void) Pobject_iter_resolved(t->t_pshandle,
3120 			    pt_map_apply, &pm);
3121 		} else {
3122 			(void) Pobject_iter(t->t_pshandle,
3123 			    pt_map_apply, &pm);
3124 		}
3125 		return (0);
3126 	}
3127 
3128 	/*
3129 	 * If we're examining an executable or other ELF file but we have no
3130 	 * libproc handle, fake up some information based on DT_NEEDED entries.
3131 	 */
3132 	if (pt->p_dynsym != NULL && pt->p_file->gf_dyns != NULL &&
3133 	    pt->p_fio != NULL) {
3134 		mdb_gelf_sect_t *gsp = pt->p_dynsym->gst_ssect;
3135 		GElf_Dyn *dynp = pt->p_file->gf_dyns;
3136 		mdb_map_t *mp = &pt->p_map;
3137 		const char *s = IOP_NAME(pt->p_fio);
3138 		size_t i;
3139 
3140 		(void) strncpy(mp->map_name, s, MDB_TGT_MAPSZ);
3141 		mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3142 		mp->map_flags = MDB_TGT_MAP_R | MDB_TGT_MAP_X;
3143 		mp->map_base = NULL;
3144 		mp->map_size = 0;
3145 
3146 		if (func(private, mp, s) != 0)
3147 			return (0);
3148 
3149 		for (i = 0; i < pt->p_file->gf_ndyns; i++, dynp++) {
3150 			if (dynp->d_tag == DT_NEEDED) {
3151 				s = (char *)gsp->gs_data + dynp->d_un.d_val;
3152 				(void) strncpy(mp->map_name, s, MDB_TGT_MAPSZ);
3153 				mp->map_name[MDB_TGT_MAPSZ - 1] = '\0';
3154 				if (func(private, mp, s) != 0)
3155 					return (0);
3156 			}
3157 		}
3158 
3159 		return (0);
3160 	}
3161 
3162 	return (set_errno(EMDB_NOPROC));
3163 }
3164 
3165 static const mdb_map_t *
3166 pt_addr_to_map(mdb_tgt_t *t, uintptr_t addr)
3167 {
3168 	pt_data_t *pt = t->t_data;
3169 	const prmap_t *pmp;
3170 
3171 	if (t->t_pshandle == NULL) {
3172 		(void) set_errno(EMDB_NOPROC);
3173 		return (NULL);
3174 	}
3175 
3176 	if ((pmp = Paddr_to_map(t->t_pshandle, addr)) == NULL) {
3177 		(void) set_errno(EMDB_NOMAP);
3178 		return (NULL);
3179 	}
3180 
3181 	return (pt_prmap_to_mdbmap(t, pmp, &pt->p_map));
3182 }
3183 
3184 static const mdb_map_t *
3185 pt_name_to_map(mdb_tgt_t *t, const char *object)
3186 {
3187 	pt_data_t *pt = t->t_data;
3188 	const prmap_t *pmp;
3189 	Lmid_t lmid;
3190 
3191 	if (t->t_pshandle == NULL) {
3192 		(void) set_errno(EMDB_NOPROC);
3193 		return (NULL);
3194 	}
3195 
3196 	object = pt_resolve_lmid(object, &lmid);
3197 
3198 	if ((pmp = Plmid_to_map(t->t_pshandle, lmid, object)) == NULL) {
3199 		(void) set_errno(EMDB_NOOBJ);
3200 		return (NULL);
3201 	}
3202 
3203 	return (pt_prmap_to_mdbmap(t, pmp, &pt->p_map));
3204 }
3205 
3206 static ctf_file_t *
3207 pt_addr_to_ctf(mdb_tgt_t *t, uintptr_t addr)
3208 {
3209 	ctf_file_t *ret;
3210 
3211 	if (t->t_pshandle == NULL) {
3212 		(void) set_errno(EMDB_NOPROC);
3213 		return (NULL);
3214 	}
3215 
3216 	if ((ret = Paddr_to_ctf(t->t_pshandle, addr)) == NULL) {
3217 		(void) set_errno(EMDB_NOOBJ);
3218 		return (NULL);
3219 	}
3220 
3221 	return (ret);
3222 }
3223 
3224 static ctf_file_t *
3225 pt_name_to_ctf(mdb_tgt_t *t, const char *name)
3226 {
3227 	ctf_file_t *ret;
3228 
3229 	if (t->t_pshandle == NULL) {
3230 		(void) set_errno(EMDB_NOPROC);
3231 		return (NULL);
3232 	}
3233 
3234 	if ((ret = Pname_to_ctf(t->t_pshandle, name)) == NULL) {
3235 		(void) set_errno(EMDB_NOOBJ);
3236 		return (NULL);
3237 	}
3238 
3239 	return (ret);
3240 }
3241 
3242 static int
3243 pt_status(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3244 {
3245 	const pstatus_t *psp;
3246 	prgregset_t gregs;
3247 	int state;
3248 
3249 	bzero(tsp, sizeof (mdb_tgt_status_t));
3250 
3251 	if (t->t_pshandle == NULL) {
3252 		tsp->st_state = MDB_TGT_IDLE;
3253 		return (0);
3254 	}
3255 
3256 	switch (state = Pstate(t->t_pshandle)) {
3257 	case PS_RUN:
3258 		tsp->st_state = MDB_TGT_RUNNING;
3259 		break;
3260 
3261 	case PS_STOP:
3262 		tsp->st_state = MDB_TGT_STOPPED;
3263 		psp = Pstatus(t->t_pshandle);
3264 
3265 		tsp->st_tid = PTL_TID(t);
3266 		if (PTL_GETREGS(t, tsp->st_tid, gregs) == 0)
3267 			tsp->st_pc = gregs[R_PC];
3268 
3269 		if (psp->pr_flags & PR_ISTOP)
3270 			tsp->st_flags |= MDB_TGT_ISTOP;
3271 		if (psp->pr_flags & PR_DSTOP)
3272 			tsp->st_flags |= MDB_TGT_DSTOP;
3273 
3274 		break;
3275 
3276 	case PS_LOST:
3277 		tsp->st_state = MDB_TGT_LOST;
3278 		break;
3279 	case PS_UNDEAD:
3280 		tsp->st_state = MDB_TGT_UNDEAD;
3281 		break;
3282 	case PS_DEAD:
3283 		tsp->st_state = MDB_TGT_DEAD;
3284 		break;
3285 	case PS_IDLE:
3286 		tsp->st_state = MDB_TGT_IDLE;
3287 		break;
3288 	default:
3289 		fail("unknown libproc state (%d)\n", state);
3290 	}
3291 
3292 	if (t->t_flags & MDB_TGT_F_BUSY)
3293 		tsp->st_flags |= MDB_TGT_BUSY;
3294 
3295 	return (0);
3296 }
3297 
3298 static void
3299 pt_dupfd(const char *file, int oflags, mode_t mode, int dfd)
3300 {
3301 	int fd;
3302 
3303 	if ((fd = open(file, oflags, mode)) >= 0) {
3304 		(void) fcntl(fd, F_DUP2FD, dfd);
3305 		(void) close(fd);
3306 	} else
3307 		warn("failed to open %s as descriptor %d", file, dfd);
3308 }
3309 
3310 /*
3311  * The Pcreate_callback() function interposes on the default, empty libproc
3312  * definition.  It will be called following a fork of a new child process by
3313  * Pcreate() below, but before the exec of the new process image.  We use this
3314  * callback to optionally redirect stdin and stdout and reset the dispositions
3315  * of SIGPIPE and SIGQUIT from SIG_IGN back to SIG_DFL.
3316  */
3317 /*ARGSUSED*/
3318 void
3319 Pcreate_callback(struct ps_prochandle *P)
3320 {
3321 	pt_data_t *pt = mdb.m_target->t_data;
3322 
3323 	if (pt->p_stdin != NULL)
3324 		pt_dupfd(pt->p_stdin, O_RDWR, 0, STDIN_FILENO);
3325 	if (pt->p_stdout != NULL)
3326 		pt_dupfd(pt->p_stdout, O_CREAT | O_WRONLY, 0666, STDOUT_FILENO);
3327 
3328 	(void) mdb_signal_sethandler(SIGPIPE, SIG_DFL, NULL);
3329 	(void) mdb_signal_sethandler(SIGQUIT, SIG_DFL, NULL);
3330 }
3331 
3332 static int
3333 pt_run(mdb_tgt_t *t, int argc, const mdb_arg_t *argv)
3334 {
3335 	pt_data_t *pt = t->t_data;
3336 	struct ps_prochandle *P;
3337 	char execname[MAXPATHLEN];
3338 	const char **pargv;
3339 	int pargc = 0;
3340 	int i, perr;
3341 	char **penv;
3342 	mdb_var_t *v;
3343 
3344 	if (pt->p_aout_fio == NULL) {
3345 		warn("run requires executable to be specified on "
3346 		    "command-line\n");
3347 		return (set_errno(EMDB_TGT));
3348 	}
3349 
3350 	pargv = mdb_alloc(sizeof (char *) * (argc + 2), UM_SLEEP);
3351 	pargv[pargc++] = strbasename(IOP_NAME(pt->p_aout_fio));
3352 
3353 	for (i = 0; i < argc; i++) {
3354 		if (argv[i].a_type != MDB_TYPE_STRING) {
3355 			mdb_free(pargv, sizeof (char *) * (argc + 2));
3356 			return (set_errno(EINVAL));
3357 		}
3358 		if (argv[i].a_un.a_str[0] == '<')
3359 			pt->p_stdin = argv[i].a_un.a_str + 1;
3360 		else if (argv[i].a_un.a_str[0] == '>')
3361 			pt->p_stdout = argv[i].a_un.a_str + 1;
3362 		else
3363 			pargv[pargc++] = argv[i].a_un.a_str;
3364 	}
3365 	pargv[pargc] = NULL;
3366 
3367 	/*
3368 	 * Since Pcreate() uses execvp() and "." may not be present in $PATH,
3369 	 * we must manually prepend "./" when the executable is a simple name.
3370 	 */
3371 	if (strchr(IOP_NAME(pt->p_aout_fio), '/') == NULL) {
3372 		(void) snprintf(execname, sizeof (execname), "./%s",
3373 		    IOP_NAME(pt->p_aout_fio));
3374 	} else {
3375 		(void) snprintf(execname, sizeof (execname), "%s",
3376 		    IOP_NAME(pt->p_aout_fio));
3377 	}
3378 
3379 	penv = mdb_alloc((mdb_nv_size(&pt->p_env)+ 1) * sizeof (char *),
3380 	    UM_SLEEP);
3381 	for (mdb_nv_rewind(&pt->p_env), i = 0;
3382 	    (v = mdb_nv_advance(&pt->p_env)) != NULL; i++)
3383 		penv[i] = mdb_nv_get_cookie(v);
3384 	penv[i] = NULL;
3385 
3386 	P = Pxcreate(execname, (char **)pargv, penv, &perr, NULL, 0);
3387 	mdb_free(pargv, sizeof (char *) * (argc + 2));
3388 	pt->p_stdin = pt->p_stdout = NULL;
3389 
3390 	mdb_free(penv, i * sizeof (char *));
3391 
3392 	if (P == NULL) {
3393 		warn("failed to create process: %s\n", Pcreate_error(perr));
3394 		return (set_errno(EMDB_TGT));
3395 	}
3396 
3397 	if (t->t_pshandle != NULL) {
3398 		pt_pre_detach(t, TRUE);
3399 		if (t->t_pshandle != pt->p_idlehandle)
3400 			Prelease(t->t_pshandle, pt->p_rflags);
3401 	}
3402 
3403 	(void) Punsetflags(P, PR_RLC);	/* make sure run-on-last-close is off */
3404 	(void) Psetflags(P, PR_KLC);	/* kill on last close by debugger */
3405 	pt->p_rflags = PRELEASE_KILL;	/* kill on debugger Prelease */
3406 	t->t_pshandle = P;
3407 
3408 	pt_post_attach(t);
3409 	pt_activate_common(t);
3410 	(void) mdb_tgt_status(t, &t->t_status);
3411 	mdb.m_flags |= MDB_FL_VCREATE;
3412 
3413 	return (0);
3414 }
3415 
3416 /*
3417  * Forward a signal to the victim process in order to force it to stop or die.
3418  * Refer to the comments above pt_setrun(), below, for more info.
3419  */
3420 /*ARGSUSED*/
3421 static void
3422 pt_sigfwd(int sig, siginfo_t *sip, ucontext_t *ucp, mdb_tgt_t *t)
3423 {
3424 	struct ps_prochandle *P = t->t_pshandle;
3425 	const lwpstatus_t *psp = &Pstatus(P)->pr_lwp;
3426 	pid_t pid = Pstatus(P)->pr_pid;
3427 	long ctl[2];
3428 
3429 	if (getpgid(pid) != mdb.m_pgid) {
3430 		mdb_dprintf(MDB_DBG_TGT, "fwd SIG#%d to %d\n", sig, (int)pid);
3431 		(void) kill(pid, sig);
3432 	}
3433 
3434 	if (Pwait(P, 1) == 0 && (psp->pr_flags & PR_STOPPED) &&
3435 	    psp->pr_why == PR_JOBCONTROL && Pdstop(P) == 0) {
3436 		/*
3437 		 * If we're job control stopped and our DSTOP is pending, the
3438 		 * victim will never see our signal, so undo the kill() and
3439 		 * then send SIGCONT the victim to kick it out of the job
3440 		 * control stop and force our DSTOP to take effect.
3441 		 */
3442 		if ((psp->pr_flags & PR_DSTOP) &&
3443 		    prismember(&Pstatus(P)->pr_sigpend, sig)) {
3444 			ctl[0] = PCUNKILL;
3445 			ctl[1] = sig;
3446 			(void) write(Pctlfd(P), ctl, sizeof (ctl));
3447 		}
3448 
3449 		mdb_dprintf(MDB_DBG_TGT, "fwd SIGCONT to %d\n", (int)pid);
3450 		(void) kill(pid, SIGCONT);
3451 	}
3452 }
3453 
3454 /*
3455  * Common code for step and continue: if no victim process has been created,
3456  * call pt_run() to create one.  Then set the victim running, clearing any
3457  * pending fault.  One special case is that if the victim was previously
3458  * stopped on reception of SIGINT, we know that SIGINT was traced and the user
3459  * requested the victim to stop, so clear this signal before continuing.
3460  * For all other traced signals, the signal will be delivered on continue.
3461  *
3462  * Once the victim process is running, we wait for it to stop on an event of
3463  * interest.  Although libproc provides the basic primitive to wait for the
3464  * victim, we must be careful in our handling of signals.  We want to allow the
3465  * user to issue a SIGINT or SIGQUIT using the designated terminal control
3466  * character (typically ^C and ^\), and have these signals stop the target and
3467  * return control to the debugger if the signals are traced.  There are three
3468  * cases to be considered in our implementation:
3469  *
3470  * (1) If the debugger and victim are in the same process group, both receive
3471  * the signal from the terminal driver.  The debugger returns from Pwait() with
3472  * errno = EINTR, so we want to loop back and continue waiting until the victim
3473  * stops on receipt of its SIGINT or SIGQUIT.
3474  *
3475  * (2) If the debugger and victim are in different process groups, and the
3476  * victim is a member of the foreground process group, it will receive the
3477  * signal from the terminal driver and the debugger will not.  As such, we
3478  * will remain blocked in Pwait() until the victim stops on its signal.
3479  *
3480  * (3) If the debugger and victim are in different process groups, and the
3481  * debugger is a member of the foreground process group, it will receive the
3482  * signal from the terminal driver, and the victim will not.  The debugger
3483  * returns from Pwait() with errno = EINTR, so we need to forward the signal
3484  * to the victim process directly and then Pwait() again for it to stop.
3485  *
3486  * We can observe that all three cases are handled by simply calling Pwait()
3487  * repeatedly if it fails with EINTR, and forwarding SIGINT and SIGQUIT to
3488  * the victim if it is in a different process group, using pt_sigfwd() above.
3489  *
3490  * An additional complication is that the process may not be able to field
3491  * the signal if it is currently stopped by job control.  In this case, we
3492  * also DSTOP the process, and then send it a SIGCONT to wake it up from
3493  * job control and force it to re-enter stop() under the control of /proc.
3494  *
3495  * Finally, we would like to allow the user to suspend the process using the
3496  * terminal suspend character (typically ^Z) if both are in the same session.
3497  * We again employ pt_sigfwd() to forward SIGTSTP to the victim, wait for it to
3498  * stop from job control, and then capture it using /proc.  Once the process
3499  * has stopped, normal SIGTSTP processing is restored and the user can issue
3500  * another ^Z in order to suspend the debugger and return to the parent shell.
3501  */
3502 static int
3503 pt_setrun(mdb_tgt_t *t, mdb_tgt_status_t *tsp, int flags)
3504 {
3505 	struct ps_prochandle *P = t->t_pshandle;
3506 	pt_data_t *pt = t->t_data;
3507 	pid_t old_pgid = -1;
3508 
3509 	mdb_signal_f *intf, *quitf, *tstpf;
3510 	const lwpstatus_t *psp;
3511 	void *intd, *quitd, *tstpd;
3512 
3513 	int sig = pt->p_signal;
3514 	int error = 0;
3515 	int pgid = -1;
3516 
3517 	pt->p_signal = 0; /* clear pending signal */
3518 
3519 	if (P == NULL && pt_run(t, 0, NULL) == -1)
3520 		return (-1); /* errno is set for us */
3521 
3522 	P = t->t_pshandle;
3523 	psp = &Pstatus(P)->pr_lwp;
3524 
3525 	if (sig == 0 && psp->pr_why == PR_SIGNALLED && psp->pr_what == SIGINT)
3526 		flags |= PRCSIG; /* clear pending SIGINT */
3527 	else
3528 		flags |= PRCFAULT; /* clear any pending fault (e.g. BPT) */
3529 
3530 	intf = mdb_signal_gethandler(SIGINT, &intd);
3531 	quitf = mdb_signal_gethandler(SIGQUIT, &quitd);
3532 	tstpf = mdb_signal_gethandler(SIGTSTP, &tstpd);
3533 
3534 	(void) mdb_signal_sethandler(SIGINT, (mdb_signal_f *)pt_sigfwd, t);
3535 	(void) mdb_signal_sethandler(SIGQUIT, (mdb_signal_f *)pt_sigfwd, t);
3536 	(void) mdb_signal_sethandler(SIGTSTP, (mdb_signal_f *)pt_sigfwd, t);
3537 
3538 	if (sig != 0 && Pstate(P) == PS_RUN &&
3539 	    kill(Pstatus(P)->pr_pid, sig) == -1) {
3540 		error = errno;
3541 		goto out;
3542 	}
3543 
3544 	/*
3545 	 * If we attached to a job stopped background process in the same
3546 	 * session, make its pgid the foreground process group before running
3547 	 * it.  Ignore SIGTTOU while doing this to avoid being suspended.
3548 	 */
3549 	if (mdb.m_flags & MDB_FL_JOBCTL) {
3550 		(void) mdb_signal_sethandler(SIGTTOU, SIG_IGN, NULL);
3551 		(void) IOP_CTL(mdb.m_term, TIOCGPGRP, &old_pgid);
3552 		(void) IOP_CTL(mdb.m_term, TIOCSPGRP,
3553 		    (void *)&Pstatus(P)->pr_pgid);
3554 		(void) mdb_signal_sethandler(SIGTTOU, SIG_DFL, NULL);
3555 	}
3556 
3557 	if (Pstate(P) != PS_RUN && Psetrun(P, sig, flags) == -1) {
3558 		error = errno;
3559 		goto out;
3560 	}
3561 
3562 	/*
3563 	 * If the process is stopped on job control, resume its process group
3564 	 * by sending it a SIGCONT if we are in the same session.  Otherwise
3565 	 * we have no choice but to wait for someone else to foreground it.
3566 	 */
3567 	if (psp->pr_why == PR_JOBCONTROL) {
3568 		if (mdb.m_flags & MDB_FL_JOBCTL)
3569 			(void) kill(-Pstatus(P)->pr_pgid, SIGCONT);
3570 		else if (mdb.m_term != NULL)
3571 			warn("process is still suspended by job control ...\n");
3572 	}
3573 
3574 	/*
3575 	 * Wait for the process to stop.  As described above, we loop around if
3576 	 * we are interrupted (EINTR).  If we lose control, attempt to re-open
3577 	 * the process, or call pt_exec() if that fails to handle a re-exec.
3578 	 * If the process dies (ENOENT) or Pwait() fails, break out of the loop.
3579 	 */
3580 	while (Pwait(P, 0) == -1) {
3581 		if (errno != EINTR) {
3582 			if (Pstate(P) == PS_LOST) {
3583 				if (Preopen(P) == 0)
3584 					continue; /* Pwait() again */
3585 				else
3586 					pt_exec(t, 0, NULL);
3587 			} else if (errno != ENOENT)
3588 				warn("failed to wait for event");
3589 			break;
3590 		}
3591 	}
3592 
3593 	/*
3594 	 * If we changed the foreground process group, restore the old pgid
3595 	 * while ignoring SIGTTOU so we are not accidentally suspended.
3596 	 */
3597 	if (old_pgid != -1) {
3598 		(void) mdb_signal_sethandler(SIGTTOU, SIG_IGN, NULL);
3599 		(void) IOP_CTL(mdb.m_term, TIOCSPGRP, &pgid);
3600 		(void) mdb_signal_sethandler(SIGTTOU, SIG_DFL, NULL);
3601 	}
3602 
3603 	/*
3604 	 * If we're now stopped on exit from a successful exec, release any
3605 	 * vfork parents and clean out their address space before returning
3606 	 * to tgt_continue() and perturbing the list of armed event specs.
3607 	 * If we're stopped for any other reason, just update the mappings.
3608 	 */
3609 	switch (Pstate(P)) {
3610 	case PS_STOP:
3611 		if (psp->pr_why == PR_SYSEXIT && psp->pr_errno == 0 &&
3612 		    psp->pr_what == SYS_execve)
3613 			pt_release_parents(t);
3614 		else
3615 			Pupdate_maps(P);
3616 		break;
3617 
3618 	case PS_UNDEAD:
3619 	case PS_LOST:
3620 		pt_release_parents(t);
3621 		break;
3622 	}
3623 
3624 out:
3625 	(void) mdb_signal_sethandler(SIGINT, intf, intd);
3626 	(void) mdb_signal_sethandler(SIGQUIT, quitf, quitd);
3627 	(void) mdb_signal_sethandler(SIGTSTP, tstpf, tstpd);
3628 	(void) pt_status(t, tsp);
3629 
3630 	return (error ? set_errno(error) : 0);
3631 }
3632 
3633 static int
3634 pt_step(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3635 {
3636 	return (pt_setrun(t, tsp, PRSTEP));
3637 }
3638 
3639 static int
3640 pt_continue(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
3641 {
3642 	return (pt_setrun(t, tsp, 0));
3643 }
3644 
3645 static int
3646 pt_signal(mdb_tgt_t *t, int sig)
3647 {
3648 	pt_data_t *pt = t->t_data;
3649 
3650 	if (sig > 0 && sig <= pt->p_maxsig) {
3651 		pt->p_signal = sig; /* pending until next pt_setrun */
3652 		return (0);
3653 	}
3654 
3655 	return (set_errno(EMDB_BADSIGNUM));
3656 }
3657 
3658 static int
3659 pt_sysenter_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3660 {
3661 	struct ps_prochandle *P = t->t_pshandle;
3662 
3663 	if (P != NULL && Pstate(P) < PS_LOST) {
3664 		sep->se_data = args; /* data is raw system call number */
3665 		return (Psysentry(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3666 	}
3667 
3668 	return (set_errno(EMDB_NOPROC));
3669 }
3670 
3671 static void
3672 pt_sysenter_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3673 {
3674 	(void) Psysentry(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3675 }
3676 
3677 /*ARGSUSED*/
3678 static char *
3679 pt_sysenter_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3680     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3681 {
3682 	char name[32];
3683 	int sysnum;
3684 
3685 	if (vep != NULL)
3686 		sysnum = (intptr_t)vep->ve_args;
3687 	else
3688 		sysnum = (intptr_t)sep->se_data;
3689 
3690 	(void) proc_sysname(sysnum, name, sizeof (name));
3691 	(void) mdb_iob_snprintf(buf, nbytes, "stop on entry to %s", name);
3692 
3693 	return (buf);
3694 }
3695 
3696 /*ARGSUSED*/
3697 static int
3698 pt_sysenter_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3699 {
3700 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3701 	int sysnum = (intptr_t)sep->se_data;
3702 
3703 	return (psp->pr_why == PR_SYSENTRY && psp->pr_what == sysnum);
3704 }
3705 
3706 static const mdb_se_ops_t proc_sysenter_ops = {
3707 	pt_sysenter_ctor,	/* se_ctor */
3708 	pt_sysenter_dtor,	/* se_dtor */
3709 	pt_sysenter_info,	/* se_info */
3710 	no_se_secmp,		/* se_secmp */
3711 	no_se_vecmp,		/* se_vecmp */
3712 	no_se_arm,		/* se_arm */
3713 	no_se_disarm,		/* se_disarm */
3714 	no_se_cont,		/* se_cont */
3715 	pt_sysenter_match	/* se_match */
3716 };
3717 
3718 static int
3719 pt_sysexit_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3720 {
3721 	struct ps_prochandle *P = t->t_pshandle;
3722 
3723 	if (P != NULL && Pstate(P) < PS_LOST) {
3724 		sep->se_data = args; /* data is raw system call number */
3725 		return (Psysexit(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3726 	}
3727 
3728 	return (set_errno(EMDB_NOPROC));
3729 }
3730 
3731 static void
3732 pt_sysexit_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3733 {
3734 	(void) Psysexit(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3735 }
3736 
3737 /*ARGSUSED*/
3738 static char *
3739 pt_sysexit_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3740     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3741 {
3742 	char name[32];
3743 	int sysnum;
3744 
3745 	if (vep != NULL)
3746 		sysnum = (intptr_t)vep->ve_args;
3747 	else
3748 		sysnum = (intptr_t)sep->se_data;
3749 
3750 	(void) proc_sysname(sysnum, name, sizeof (name));
3751 	(void) mdb_iob_snprintf(buf, nbytes, "stop on exit from %s", name);
3752 
3753 	return (buf);
3754 }
3755 
3756 /*ARGSUSED*/
3757 static int
3758 pt_sysexit_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3759 {
3760 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3761 	int sysnum = (intptr_t)sep->se_data;
3762 
3763 	return (psp->pr_why == PR_SYSEXIT && psp->pr_what == sysnum);
3764 }
3765 
3766 static const mdb_se_ops_t proc_sysexit_ops = {
3767 	pt_sysexit_ctor,	/* se_ctor */
3768 	pt_sysexit_dtor,	/* se_dtor */
3769 	pt_sysexit_info,	/* se_info */
3770 	no_se_secmp,		/* se_secmp */
3771 	no_se_vecmp,		/* se_vecmp */
3772 	no_se_arm,		/* se_arm */
3773 	no_se_disarm,		/* se_disarm */
3774 	no_se_cont,		/* se_cont */
3775 	pt_sysexit_match	/* se_match */
3776 };
3777 
3778 static int
3779 pt_signal_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3780 {
3781 	struct ps_prochandle *P = t->t_pshandle;
3782 
3783 	if (P != NULL && Pstate(P) < PS_LOST) {
3784 		sep->se_data = args; /* data is raw signal number */
3785 		return (Psignal(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3786 	}
3787 
3788 	return (set_errno(EMDB_NOPROC));
3789 }
3790 
3791 static void
3792 pt_signal_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3793 {
3794 	(void) Psignal(t->t_pshandle, (intptr_t)sep->se_data, FALSE);
3795 }
3796 
3797 /*ARGSUSED*/
3798 static char *
3799 pt_signal_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3800     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3801 {
3802 	char name[SIG2STR_MAX];
3803 	int signum;
3804 
3805 	if (vep != NULL)
3806 		signum = (intptr_t)vep->ve_args;
3807 	else
3808 		signum = (intptr_t)sep->se_data;
3809 
3810 	(void) proc_signame(signum, name, sizeof (name));
3811 	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s", name);
3812 
3813 	return (buf);
3814 }
3815 
3816 /*ARGSUSED*/
3817 static int
3818 pt_signal_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3819 {
3820 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3821 	int signum = (intptr_t)sep->se_data;
3822 
3823 	return (psp->pr_why == PR_SIGNALLED && psp->pr_what == signum);
3824 }
3825 
3826 static const mdb_se_ops_t proc_signal_ops = {
3827 	pt_signal_ctor,		/* se_ctor */
3828 	pt_signal_dtor,		/* se_dtor */
3829 	pt_signal_info,		/* se_info */
3830 	no_se_secmp,		/* se_secmp */
3831 	no_se_vecmp,		/* se_vecmp */
3832 	no_se_arm,		/* se_arm */
3833 	no_se_disarm,		/* se_disarm */
3834 	no_se_cont,		/* se_cont */
3835 	pt_signal_match		/* se_match */
3836 };
3837 
3838 static int
3839 pt_fault_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3840 {
3841 	struct ps_prochandle *P = t->t_pshandle;
3842 
3843 	if (P != NULL && Pstate(P) < PS_LOST) {
3844 		sep->se_data = args; /* data is raw fault number */
3845 		return (Pfault(P, (intptr_t)args, TRUE) < 0 ? -1 : 0);
3846 	}
3847 
3848 	return (set_errno(EMDB_NOPROC));
3849 }
3850 
3851 static void
3852 pt_fault_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3853 {
3854 	int fault = (intptr_t)sep->se_data;
3855 
3856 	if (fault != FLTBPT && fault != FLTTRACE && fault != FLTWATCH)
3857 		(void) Pfault(t->t_pshandle, fault, FALSE);
3858 }
3859 
3860 /*ARGSUSED*/
3861 static char *
3862 pt_fault_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3863     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3864 {
3865 	char name[32];
3866 	int fltnum;
3867 
3868 	if (vep != NULL)
3869 		fltnum = (intptr_t)vep->ve_args;
3870 	else
3871 		fltnum = (intptr_t)sep->se_data;
3872 
3873 	(void) proc_fltname(fltnum, name, sizeof (name));
3874 	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s", name);
3875 
3876 	return (buf);
3877 }
3878 
3879 /*ARGSUSED*/
3880 static int
3881 pt_fault_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
3882 {
3883 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
3884 	int fltnum = (intptr_t)sep->se_data;
3885 
3886 	return (psp->pr_why == PR_FAULTED && psp->pr_what == fltnum);
3887 }
3888 
3889 static const mdb_se_ops_t proc_fault_ops = {
3890 	pt_fault_ctor,		/* se_ctor */
3891 	pt_fault_dtor,		/* se_dtor */
3892 	pt_fault_info,		/* se_info */
3893 	no_se_secmp,		/* se_secmp */
3894 	no_se_vecmp,		/* se_vecmp */
3895 	no_se_arm,		/* se_arm */
3896 	no_se_disarm,		/* se_disarm */
3897 	no_se_cont,		/* se_cont */
3898 	pt_fault_match		/* se_match */
3899 };
3900 
3901 /*
3902  * Callback for pt_ignore() dcmd above: for each VID, determine if it
3903  * corresponds to a vespec that traces the specified signal, and delete it.
3904  */
3905 /*ARGSUSED*/
3906 static int
3907 pt_ignore_sig(mdb_tgt_t *t, void *sig, int vid, void *data)
3908 {
3909 	mdb_vespec_t *vep = mdb_tgt_vespec_lookup(t, vid);
3910 
3911 	if (vep->ve_se->se_ops == &proc_signal_ops && vep->ve_args == sig)
3912 		(void) mdb_tgt_vespec_delete(t, vid);
3913 
3914 	return (0);
3915 }
3916 
3917 static int
3918 pt_brkpt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
3919 {
3920 	pt_data_t *pt = t->t_data;
3921 	pt_bparg_t *pta = args;
3922 	pt_brkpt_t *ptb;
3923 	GElf_Sym s;
3924 
3925 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) >= PS_LOST)
3926 		return (set_errno(EMDB_NOPROC));
3927 
3928 	if (pta->pta_symbol != NULL) {
3929 		if (!pt->p_rtld_finished &&
3930 		    strchr(pta->pta_symbol, '`') == NULL)
3931 			return (set_errno(EMDB_NOSYM));
3932 		if (mdb_tgt_lookup_by_scope(t, pta->pta_symbol, &s,
3933 		    NULL) == -1) {
3934 			if (errno != EMDB_NOOBJ && !(errno == EMDB_NOSYM &&
3935 			    (!(mdb.m_flags & MDB_FL_BPTNOSYMSTOP) ||
3936 			    !pt->p_rtld_finished))) {
3937 				warn("breakpoint %s activation failed",
3938 				    pta->pta_symbol);
3939 			}
3940 			return (-1); /* errno is set for us */
3941 		}
3942 
3943 		pta->pta_addr = (uintptr_t)s.st_value;
3944 	}
3945 
3946 #ifdef __sparc
3947 	if (pta->pta_addr & 3)
3948 		return (set_errno(EMDB_BPALIGN));
3949 #endif
3950 
3951 	if (Paddr_to_map(t->t_pshandle, pta->pta_addr) == NULL)
3952 		return (set_errno(EMDB_NOMAP));
3953 
3954 	ptb = mdb_alloc(sizeof (pt_brkpt_t), UM_SLEEP);
3955 	ptb->ptb_addr = pta->pta_addr;
3956 	ptb->ptb_instr = NULL;
3957 	sep->se_data = ptb;
3958 
3959 	return (0);
3960 }
3961 
3962 /*ARGSUSED*/
3963 static void
3964 pt_brkpt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
3965 {
3966 	mdb_free(sep->se_data, sizeof (pt_brkpt_t));
3967 }
3968 
3969 /*ARGSUSED*/
3970 static char *
3971 pt_brkpt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
3972     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
3973 {
3974 	uintptr_t addr = NULL;
3975 
3976 	if (vep != NULL) {
3977 		pt_bparg_t *pta = vep->ve_args;
3978 
3979 		if (pta->pta_symbol != NULL) {
3980 			(void) mdb_iob_snprintf(buf, nbytes, "stop at %s",
3981 			    pta->pta_symbol);
3982 		} else {
3983 			(void) mdb_iob_snprintf(buf, nbytes, "stop at %a",
3984 			    pta->pta_addr);
3985 			addr = pta->pta_addr;
3986 		}
3987 
3988 	} else {
3989 		addr = ((pt_brkpt_t *)sep->se_data)->ptb_addr;
3990 		(void) mdb_iob_snprintf(buf, nbytes, "stop at %a", addr);
3991 	}
3992 
3993 	sp->spec_base = addr;
3994 	sp->spec_size = sizeof (instr_t);
3995 
3996 	return (buf);
3997 }
3998 
3999 static int
4000 pt_brkpt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4001 {
4002 	pt_brkpt_t *ptb = sep->se_data;
4003 	pt_bparg_t *pta = args;
4004 	GElf_Sym sym;
4005 
4006 	if (pta->pta_symbol != NULL) {
4007 		return (mdb_tgt_lookup_by_scope(t, pta->pta_symbol,
4008 		    &sym, NULL) == 0 && sym.st_value == ptb->ptb_addr);
4009 	}
4010 
4011 	return (pta->pta_addr == ptb->ptb_addr);
4012 }
4013 
4014 /*ARGSUSED*/
4015 static int
4016 pt_brkpt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
4017 {
4018 	pt_bparg_t *pta1 = vep->ve_args;
4019 	pt_bparg_t *pta2 = args;
4020 
4021 	if (pta1->pta_symbol != NULL && pta2->pta_symbol != NULL)
4022 		return (strcmp(pta1->pta_symbol, pta2->pta_symbol) == 0);
4023 
4024 	if (pta1->pta_symbol == NULL && pta2->pta_symbol == NULL)
4025 		return (pta1->pta_addr == pta2->pta_addr);
4026 
4027 	return (0); /* fail if one is symbolic, other is an explicit address */
4028 }
4029 
4030 static int
4031 pt_brkpt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
4032 {
4033 	pt_brkpt_t *ptb = sep->se_data;
4034 	return (Psetbkpt(t->t_pshandle, ptb->ptb_addr, &ptb->ptb_instr));
4035 }
4036 
4037 /*
4038  * In order to disarm a breakpoint, we replace the trap instruction at ptb_addr
4039  * with the saved instruction.  However, if we have stopped after a successful
4040  * exec(2), we do not want to restore ptb_instr because the address space has
4041  * now been replaced with the text of a different executable, and so restoring
4042  * the saved instruction would be incorrect.  The exec itself has effectively
4043  * removed all breakpoint trap instructions for us, so we can just return.
4044  */
4045 static int
4046 pt_brkpt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
4047 {
4048 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4049 	pt_brkpt_t *ptb = sep->se_data;
4050 
4051 	if (psp->pr_why == PR_SYSEXIT && psp->pr_errno == 0 &&
4052 	    psp->pr_what == SYS_execve)
4053 		return (0); /* do not restore saved instruction */
4054 
4055 	return (Pdelbkpt(t->t_pshandle, ptb->ptb_addr, ptb->ptb_instr));
4056 }
4057 
4058 /*
4059  * Determine whether the specified sespec is an armed watchpoint that overlaps
4060  * with the given breakpoint and has the given flags set.  We use this to find
4061  * conflicts with breakpoints, below.
4062  */
4063 static int
4064 pt_wp_overlap(mdb_sespec_t *sep, pt_brkpt_t *ptb, int flags)
4065 {
4066 	const prwatch_t *wp = sep->se_data;
4067 
4068 	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
4069 	    sep->se_ops == &proc_wapt_ops && (wp->pr_wflags & flags) &&
4070 	    ptb->ptb_addr - wp->pr_vaddr < wp->pr_size);
4071 }
4072 
4073 /*
4074  * We step over breakpoints using Pxecbkpt() in libproc.  If a conflicting
4075  * watchpoint is present, we must temporarily remove it before stepping over
4076  * the breakpoint so we do not immediately re-trigger the watchpoint.  We know
4077  * the watchpoint has already triggered on our trap instruction as part of
4078  * fetching it.  Before we return, we must re-install any disabled watchpoints.
4079  */
4080 static int
4081 pt_brkpt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4082 {
4083 	pt_brkpt_t *ptb = sep->se_data;
4084 	int status = -1;
4085 	int error;
4086 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4087 
4088 	/*
4089 	 * If the PC no longer matches our original address, then the user has
4090 	 * changed it while we have been stopped. In this case, it no longer
4091 	 * makes any sense to continue over this breakpoint.  We return as if we
4092 	 * continued normally.
4093 	 */
4094 	if ((uintptr_t)psp->pr_info.si_addr != psp->pr_reg[R_PC])
4095 		return (pt_status(t, tsp));
4096 
4097 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4098 		if (pt_wp_overlap(sep, ptb, WA_EXEC))
4099 			(void) Pdelwapt(t->t_pshandle, sep->se_data);
4100 	}
4101 
4102 	if (Pxecbkpt(t->t_pshandle, ptb->ptb_instr) == 0 &&
4103 	    Pdelbkpt(t->t_pshandle, ptb->ptb_addr, ptb->ptb_instr) == 0)
4104 		status = pt_status(t, tsp);
4105 
4106 	error = errno; /* save errno from Pxecbkpt, Pdelbkpt, or pt_status */
4107 
4108 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4109 		if (pt_wp_overlap(sep, ptb, WA_EXEC) &&
4110 		    Psetwapt(t->t_pshandle, sep->se_data) == -1) {
4111 			sep->se_state = MDB_TGT_SPEC_ERROR;
4112 			sep->se_errno = errno;
4113 		}
4114 	}
4115 
4116 	(void) set_errno(error);
4117 	return (status);
4118 }
4119 
4120 /*ARGSUSED*/
4121 static int
4122 pt_brkpt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4123 {
4124 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4125 	pt_brkpt_t *ptb = sep->se_data;
4126 
4127 	return (psp->pr_why == PR_FAULTED && psp->pr_what == FLTBPT &&
4128 	    psp->pr_reg[R_PC] == ptb->ptb_addr);
4129 }
4130 
4131 static const mdb_se_ops_t proc_brkpt_ops = {
4132 	pt_brkpt_ctor,		/* se_ctor */
4133 	pt_brkpt_dtor,		/* se_dtor */
4134 	pt_brkpt_info,		/* se_info */
4135 	pt_brkpt_secmp,		/* se_secmp */
4136 	pt_brkpt_vecmp,		/* se_vecmp */
4137 	pt_brkpt_arm,		/* se_arm */
4138 	pt_brkpt_disarm,	/* se_disarm */
4139 	pt_brkpt_cont,		/* se_cont */
4140 	pt_brkpt_match		/* se_match */
4141 };
4142 
4143 static int
4144 pt_wapt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4145 {
4146 	if (t->t_pshandle == NULL || Pstate(t->t_pshandle) >= PS_LOST)
4147 		return (set_errno(EMDB_NOPROC));
4148 
4149 	sep->se_data = mdb_alloc(sizeof (prwatch_t), UM_SLEEP);
4150 	bcopy(args, sep->se_data, sizeof (prwatch_t));
4151 	return (0);
4152 }
4153 
4154 /*ARGSUSED*/
4155 static void
4156 pt_wapt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
4157 {
4158 	mdb_free(sep->se_data, sizeof (prwatch_t));
4159 }
4160 
4161 /*ARGSUSED*/
4162 static char *
4163 pt_wapt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
4164     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
4165 {
4166 	prwatch_t *wp = vep != NULL ? vep->ve_args : sep->se_data;
4167 	char desc[24];
4168 
4169 	ASSERT(wp->pr_wflags != 0);
4170 	desc[0] = '\0';
4171 
4172 	switch (wp->pr_wflags) {
4173 	case WA_READ:
4174 		(void) strcat(desc, "/read");
4175 		break;
4176 	case WA_WRITE:
4177 		(void) strcat(desc, "/write");
4178 		break;
4179 	case WA_EXEC:
4180 		(void) strcat(desc, "/exec");
4181 		break;
4182 	default:
4183 		if (wp->pr_wflags & WA_READ)
4184 			(void) strcat(desc, "/r");
4185 		if (wp->pr_wflags & WA_WRITE)
4186 			(void) strcat(desc, "/w");
4187 		if (wp->pr_wflags & WA_EXEC)
4188 			(void) strcat(desc, "/x");
4189 	}
4190 
4191 	(void) mdb_iob_snprintf(buf, nbytes, "stop on %s of [%la, %la)",
4192 	    desc + 1, wp->pr_vaddr, wp->pr_vaddr + wp->pr_size);
4193 
4194 	sp->spec_base = wp->pr_vaddr;
4195 	sp->spec_size = wp->pr_size;
4196 
4197 	return (buf);
4198 }
4199 
4200 /*ARGSUSED*/
4201 static int
4202 pt_wapt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
4203 {
4204 	prwatch_t *wp1 = sep->se_data;
4205 	prwatch_t *wp2 = args;
4206 
4207 	return (wp1->pr_vaddr == wp2->pr_vaddr &&
4208 	    wp1->pr_size == wp2->pr_size && wp1->pr_wflags == wp2->pr_wflags);
4209 }
4210 
4211 /*ARGSUSED*/
4212 static int
4213 pt_wapt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
4214 {
4215 	prwatch_t *wp1 = vep->ve_args;
4216 	prwatch_t *wp2 = args;
4217 
4218 	return (wp1->pr_vaddr == wp2->pr_vaddr &&
4219 	    wp1->pr_size == wp2->pr_size && wp1->pr_wflags == wp2->pr_wflags);
4220 }
4221 
4222 static int
4223 pt_wapt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
4224 {
4225 	return (Psetwapt(t->t_pshandle, sep->se_data));
4226 }
4227 
4228 static int
4229 pt_wapt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
4230 {
4231 	return (Pdelwapt(t->t_pshandle, sep->se_data));
4232 }
4233 
4234 /*
4235  * Determine whether the specified sespec is an armed breakpoint at the
4236  * given %pc.  We use this to find conflicts with watchpoints below.
4237  */
4238 static int
4239 pt_bp_overlap(mdb_sespec_t *sep, uintptr_t pc)
4240 {
4241 	pt_brkpt_t *ptb = sep->se_data;
4242 
4243 	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
4244 	    sep->se_ops == &proc_brkpt_ops && ptb->ptb_addr == pc);
4245 }
4246 
4247 /*
4248  * We step over watchpoints using Pxecwapt() in libproc.  If a conflicting
4249  * breakpoint is present, we must temporarily disarm it before stepping
4250  * over the watchpoint so we do not immediately re-trigger the breakpoint.
4251  * This is similar to the case handled in pt_brkpt_cont(), above.
4252  */
4253 static int
4254 pt_wapt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4255 {
4256 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4257 	mdb_sespec_t *bep = NULL;
4258 	int status = -1;
4259 	int error;
4260 
4261 	/*
4262 	 * If the PC no longer matches our original address, then the user has
4263 	 * changed it while we have been stopped. In this case, it no longer
4264 	 * makes any sense to continue over this instruction.  We return as if
4265 	 * we continued normally.
4266 	 */
4267 	if ((uintptr_t)psp->pr_info.si_pc != psp->pr_reg[R_PC])
4268 		return (pt_status(t, tsp));
4269 
4270 	if (psp->pr_info.si_code != TRAP_XWATCH) {
4271 		for (bep = mdb_list_next(&t->t_active); bep != NULL;
4272 		    bep = mdb_list_next(bep)) {
4273 			if (pt_bp_overlap(bep, psp->pr_reg[R_PC])) {
4274 				(void) bep->se_ops->se_disarm(t, bep);
4275 				bep->se_state = MDB_TGT_SPEC_ACTIVE;
4276 				break;
4277 			}
4278 		}
4279 	}
4280 
4281 	if (Pxecwapt(t->t_pshandle, sep->se_data) == 0)
4282 		status = pt_status(t, tsp);
4283 
4284 	error = errno; /* save errno from Pxecwapt or pt_status */
4285 
4286 	if (bep != NULL)
4287 		mdb_tgt_sespec_arm_one(t, bep);
4288 
4289 	(void) set_errno(error);
4290 	return (status);
4291 }
4292 
4293 /*ARGSUSED*/
4294 static int
4295 pt_wapt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
4296 {
4297 	const lwpstatus_t *psp = &Pstatus(t->t_pshandle)->pr_lwp;
4298 	prwatch_t *wp = sep->se_data;
4299 
4300 	return (psp->pr_why == PR_FAULTED && psp->pr_what == FLTWATCH &&
4301 	    (uintptr_t)psp->pr_info.si_addr - wp->pr_vaddr < wp->pr_size);
4302 }
4303 
4304 static const mdb_se_ops_t proc_wapt_ops = {
4305 	pt_wapt_ctor,		/* se_ctor */
4306 	pt_wapt_dtor,		/* se_dtor */
4307 	pt_wapt_info,		/* se_info */
4308 	pt_wapt_secmp,		/* se_secmp */
4309 	pt_wapt_vecmp,		/* se_vecmp */
4310 	pt_wapt_arm,		/* se_arm */
4311 	pt_wapt_disarm,		/* se_disarm */
4312 	pt_wapt_cont,		/* se_cont */
4313 	pt_wapt_match		/* se_match */
4314 };
4315 
4316 static void
4317 pt_bparg_dtor(mdb_vespec_t *vep)
4318 {
4319 	pt_bparg_t *pta = vep->ve_args;
4320 
4321 	if (pta->pta_symbol != NULL)
4322 		strfree(pta->pta_symbol);
4323 
4324 	mdb_free(pta, sizeof (pt_bparg_t));
4325 }
4326 
4327 static int
4328 pt_add_vbrkpt(mdb_tgt_t *t, uintptr_t addr,
4329     int spec_flags, mdb_tgt_se_f *func, void *data)
4330 {
4331 	pt_bparg_t *pta = mdb_alloc(sizeof (pt_bparg_t), UM_SLEEP);
4332 
4333 	pta->pta_symbol = NULL;
4334 	pta->pta_addr = addr;
4335 
4336 	return (mdb_tgt_vespec_insert(t, &proc_brkpt_ops, spec_flags,
4337 	    func, data, pta, pt_bparg_dtor));
4338 }
4339 
4340 static int
4341 pt_add_sbrkpt(mdb_tgt_t *t, const char *sym,
4342     int spec_flags, mdb_tgt_se_f *func, void *data)
4343 {
4344 	pt_bparg_t *pta;
4345 
4346 	if (sym[0] == '`') {
4347 		(void) set_errno(EMDB_NOOBJ);
4348 		return (0);
4349 	}
4350 
4351 	if (sym[strlen(sym) - 1] == '`') {
4352 		(void) set_errno(EMDB_NOSYM);
4353 		return (0);
4354 	}
4355 
4356 	pta = mdb_alloc(sizeof (pt_bparg_t), UM_SLEEP);
4357 	pta->pta_symbol = strdup(sym);
4358 	pta->pta_addr = NULL;
4359 
4360 	return (mdb_tgt_vespec_insert(t, &proc_brkpt_ops, spec_flags,
4361 	    func, data, pta, pt_bparg_dtor));
4362 }
4363 
4364 static int
4365 pt_wparg_overlap(const prwatch_t *wp1, const prwatch_t *wp2)
4366 {
4367 	if (wp2->pr_vaddr + wp2->pr_size <= wp1->pr_vaddr)
4368 		return (0); /* no range overlap */
4369 
4370 	if (wp1->pr_vaddr + wp1->pr_size <= wp2->pr_vaddr)
4371 		return (0); /* no range overlap */
4372 
4373 	return (wp1->pr_vaddr != wp2->pr_vaddr ||
4374 	    wp1->pr_size != wp2->pr_size || wp1->pr_wflags != wp2->pr_wflags);
4375 }
4376 
4377 static void
4378 pt_wparg_dtor(mdb_vespec_t *vep)
4379 {
4380 	mdb_free(vep->ve_args, sizeof (prwatch_t));
4381 }
4382 
4383 static int
4384 pt_add_vwapt(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
4385     int spec_flags, mdb_tgt_se_f *func, void *data)
4386 {
4387 	prwatch_t *wp = mdb_alloc(sizeof (prwatch_t), UM_SLEEP);
4388 	mdb_sespec_t *sep;
4389 
4390 	wp->pr_vaddr = addr;
4391 	wp->pr_size = len;
4392 	wp->pr_wflags = 0;
4393 
4394 	if (wflags & MDB_TGT_WA_R)
4395 		wp->pr_wflags |= WA_READ;
4396 	if (wflags & MDB_TGT_WA_W)
4397 		wp->pr_wflags |= WA_WRITE;
4398 	if (wflags & MDB_TGT_WA_X)
4399 		wp->pr_wflags |= WA_EXEC;
4400 
4401 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
4402 		if (sep->se_ops == &proc_wapt_ops &&
4403 		    mdb_list_next(&sep->se_velist) != NULL &&
4404 		    pt_wparg_overlap(wp, sep->se_data))
4405 			goto dup;
4406 	}
4407 
4408 	for (sep = mdb_list_next(&t->t_idle); sep; sep = mdb_list_next(sep)) {
4409 		if (sep->se_ops == &proc_wapt_ops && pt_wparg_overlap(wp,
4410 		    ((mdb_vespec_t *)mdb_list_next(&sep->se_velist))->ve_args))
4411 			goto dup;
4412 	}
4413 
4414 	return (mdb_tgt_vespec_insert(t, &proc_wapt_ops, spec_flags,
4415 	    func, data, wp, pt_wparg_dtor));
4416 
4417 dup:
4418 	mdb_free(wp, sizeof (prwatch_t));
4419 	(void) set_errno(EMDB_WPDUP);
4420 	return (0);
4421 }
4422 
4423 static int
4424 pt_add_sysenter(mdb_tgt_t *t, int sysnum,
4425     int spec_flags, mdb_tgt_se_f *func, void *data)
4426 {
4427 	if (sysnum <= 0 || sysnum > PRMAXSYS) {
4428 		(void) set_errno(EMDB_BADSYSNUM);
4429 		return (0);
4430 	}
4431 
4432 	return (mdb_tgt_vespec_insert(t, &proc_sysenter_ops, spec_flags,
4433 	    func, data, (void *)(uintptr_t)sysnum, no_ve_dtor));
4434 }
4435 
4436 static int
4437 pt_add_sysexit(mdb_tgt_t *t, int sysnum,
4438     int spec_flags, mdb_tgt_se_f *func, void *data)
4439 {
4440 	if (sysnum <= 0 || sysnum > PRMAXSYS) {
4441 		(void) set_errno(EMDB_BADSYSNUM);
4442 		return (0);
4443 	}
4444 
4445 	return (mdb_tgt_vespec_insert(t, &proc_sysexit_ops, spec_flags,
4446 	    func, data, (void *)(uintptr_t)sysnum, no_ve_dtor));
4447 }
4448 
4449 static int
4450 pt_add_signal(mdb_tgt_t *t, int signum,
4451     int spec_flags, mdb_tgt_se_f *func, void *data)
4452 {
4453 	pt_data_t *pt = t->t_data;
4454 
4455 	if (signum <= 0 || signum > pt->p_maxsig) {
4456 		(void) set_errno(EMDB_BADSIGNUM);
4457 		return (0);
4458 	}
4459 
4460 	return (mdb_tgt_vespec_insert(t, &proc_signal_ops, spec_flags,
4461 	    func, data, (void *)(uintptr_t)signum, no_ve_dtor));
4462 }
4463 
4464 static int
4465 pt_add_fault(mdb_tgt_t *t, int fltnum,
4466     int spec_flags, mdb_tgt_se_f *func, void *data)
4467 {
4468 	if (fltnum <= 0 || fltnum > PRMAXFAULT) {
4469 		(void) set_errno(EMDB_BADFLTNUM);
4470 		return (0);
4471 	}
4472 
4473 	return (mdb_tgt_vespec_insert(t, &proc_fault_ops, spec_flags,
4474 	    func, data, (void *)(uintptr_t)fltnum, no_ve_dtor));
4475 }
4476 
4477 static int
4478 pt_getareg(mdb_tgt_t *t, mdb_tgt_tid_t tid,
4479     const char *rname, mdb_tgt_reg_t *rp)
4480 {
4481 	pt_data_t *pt = t->t_data;
4482 	prgregset_t grs;
4483 	mdb_var_t *v;
4484 
4485 	if (t->t_pshandle == NULL)
4486 		return (set_errno(EMDB_NOPROC));
4487 
4488 	if ((v = mdb_nv_lookup(&pt->p_regs, rname)) != NULL) {
4489 		uintmax_t rd_nval = mdb_nv_get_value(v);
4490 		ushort_t rd_num = MDB_TGT_R_NUM(rd_nval);
4491 		ushort_t rd_flags = MDB_TGT_R_FLAGS(rd_nval);
4492 
4493 		if (!MDB_TGT_R_IS_FP(rd_flags)) {
4494 			mdb_tgt_reg_t r = 0;
4495 
4496 #if defined(__sparc) && defined(_ILP32)
4497 			/*
4498 			 * If we are debugging on 32-bit SPARC, the globals and
4499 			 * outs can have 32 upper bits hiding in the xregs.
4500 			 */
4501 			/* gcc doesn't like >= R_G0 because R_G0 == 0 */
4502 			int is_g = (rd_num == R_G0 ||
4503 			    rd_num >= R_G1 && rd_num <= R_G7);
4504 			int is_o = (rd_num >= R_O0 && rd_num <= R_O7);
4505 			prxregset_t xrs;
4506 
4507 			if (is_g && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4508 			    xrs.pr_type == XR_TYPE_V8P) {
4509 				r |= (uint64_t)xrs.pr_un.pr_v8p.pr_xg[
4510 				    rd_num - R_G0 + XR_G0] << 32;
4511 			}
4512 
4513 			if (is_o && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4514 			    xrs.pr_type == XR_TYPE_V8P) {
4515 				r |= (uint64_t)xrs.pr_un.pr_v8p.pr_xo[
4516 				    rd_num - R_O0 + XR_O0] << 32;
4517 			}
4518 #endif	/* __sparc && _ILP32 */
4519 
4520 			/*
4521 			 * Avoid sign-extension by casting: recall that procfs
4522 			 * defines prgreg_t as a long or int and our native
4523 			 * register handling uses uint64_t's.
4524 			 */
4525 			if (PTL_GETREGS(t, tid, grs) == 0) {
4526 				*rp = r | (ulong_t)grs[rd_num];
4527 				if (rd_flags & MDB_TGT_R_32)
4528 					*rp &= 0xffffffffULL;
4529 				else if (rd_flags & MDB_TGT_R_16)
4530 					*rp &= 0xffffULL;
4531 				else if (rd_flags & MDB_TGT_R_8H)
4532 					*rp = (*rp & 0xff00ULL) >> 8;
4533 				else if (rd_flags & MDB_TGT_R_8L)
4534 					*rp &= 0xffULL;
4535 				return (0);
4536 			}
4537 			return (-1);
4538 		} else
4539 			return (pt_getfpreg(t, tid, rd_num, rd_flags, rp));
4540 	}
4541 
4542 	return (set_errno(EMDB_BADREG));
4543 }
4544 
4545 static int
4546 pt_putareg(mdb_tgt_t *t, mdb_tgt_tid_t tid, const char *rname, mdb_tgt_reg_t r)
4547 {
4548 	pt_data_t *pt = t->t_data;
4549 	prgregset_t grs;
4550 	mdb_var_t *v;
4551 
4552 	if (t->t_pshandle == NULL)
4553 		return (set_errno(EMDB_NOPROC));
4554 
4555 	if ((v = mdb_nv_lookup(&pt->p_regs, rname)) != NULL) {
4556 		uintmax_t rd_nval = mdb_nv_get_value(v);
4557 		ushort_t rd_num = MDB_TGT_R_NUM(rd_nval);
4558 		ushort_t rd_flags = MDB_TGT_R_FLAGS(rd_nval);
4559 
4560 		if (!MDB_TGT_R_IS_FP(rd_flags)) {
4561 
4562 			if (rd_flags & MDB_TGT_R_32)
4563 				r &= 0xffffffffULL;
4564 			else if (rd_flags & MDB_TGT_R_16)
4565 				r &= 0xffffULL;
4566 			else if (rd_flags & MDB_TGT_R_8H)
4567 				r = (r & 0xffULL) << 8;
4568 			else if (rd_flags & MDB_TGT_R_8L)
4569 				r &= 0xffULL;
4570 
4571 #if defined(__sparc) && defined(_ILP32)
4572 			/*
4573 			 * If we are debugging on 32-bit SPARC, the globals and
4574 			 * outs can have 32 upper bits stored in the xregs.
4575 			 */
4576 			int is_g = (rd_num == R_G0 ||
4577 			    rd_num >= R_G1 && rd_num <= R_G7);
4578 			int is_o = (rd_num >= R_O0 && rd_num <= R_O7);
4579 			prxregset_t xrs;
4580 
4581 			if ((is_g || is_o) && PTL_GETXREGS(t, tid, &xrs) == 0 &&
4582 			    xrs.pr_type == XR_TYPE_V8P) {
4583 				if (is_g) {
4584 					xrs.pr_un.pr_v8p.pr_xg[rd_num -
4585 					    R_G0 + XR_G0] = (uint32_t)(r >> 32);
4586 				} else if (is_o) {
4587 					xrs.pr_un.pr_v8p.pr_xo[rd_num -
4588 					    R_O0 + XR_O0] = (uint32_t)(r >> 32);
4589 				}
4590 
4591 				if (PTL_SETXREGS(t, tid, &xrs) == -1)
4592 					return (-1);
4593 			}
4594 #endif	/* __sparc && _ILP32 */
4595 
4596 			if (PTL_GETREGS(t, tid, grs) == 0) {
4597 				grs[rd_num] = (prgreg_t)r;
4598 				return (PTL_SETREGS(t, tid, grs));
4599 			}
4600 			return (-1);
4601 		} else
4602 			return (pt_putfpreg(t, tid, rd_num, rd_flags, r));
4603 	}
4604 
4605 	return (set_errno(EMDB_BADREG));
4606 }
4607 
4608 static int
4609 pt_stack_call(pt_stkarg_t *psp, const prgregset_t grs, uint_t argc, long *argv)
4610 {
4611 	psp->pstk_gotpc |= (grs[R_PC] != 0);
4612 
4613 	if (!psp->pstk_gotpc)
4614 		return (0); /* skip initial zeroed frames */
4615 
4616 	return (psp->pstk_func(psp->pstk_private, grs[R_PC],
4617 	    argc, argv, (const struct mdb_tgt_gregset *)grs));
4618 }
4619 
4620 static int
4621 pt_stack_iter(mdb_tgt_t *t, const mdb_tgt_gregset_t *gsp,
4622     mdb_tgt_stack_f *func, void *arg)
4623 {
4624 	if (t->t_pshandle != NULL) {
4625 		pt_stkarg_t pstk;
4626 
4627 		pstk.pstk_func = func;
4628 		pstk.pstk_private = arg;
4629 		pstk.pstk_gotpc = FALSE;
4630 
4631 		(void) Pstack_iter(t->t_pshandle, gsp->gregs,
4632 		    (proc_stack_f *)pt_stack_call, &pstk);
4633 
4634 		return (0);
4635 	}
4636 
4637 	return (set_errno(EMDB_NOPROC));
4638 }
4639 
4640 static int
4641 pt_auxv(mdb_tgt_t *t, const auxv_t **auxvp)
4642 {
4643 	if (t->t_pshandle != NULL) {
4644 		*auxvp = Pgetauxvec(t->t_pshandle);
4645 		return (0);
4646 	}
4647 
4648 	return (set_errno(EMDB_NOPROC));
4649 }
4650 
4651 
4652 static const mdb_tgt_ops_t proc_ops = {
4653 	pt_setflags,				/* t_setflags */
4654 	(int (*)()) mdb_tgt_notsup,		/* t_setcontext */
4655 	pt_activate,				/* t_activate */
4656 	pt_deactivate,				/* t_deactivate */
4657 	pt_periodic,				/* t_periodic */
4658 	pt_destroy,				/* t_destroy */
4659 	pt_name,				/* t_name */
4660 	(const char *(*)()) mdb_conf_isa,	/* t_isa */
4661 	pt_platform,				/* t_platform */
4662 	pt_uname,				/* t_uname */
4663 	pt_dmodel,				/* t_dmodel */
4664 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_aread */
4665 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_awrite */
4666 	pt_vread,				/* t_vread */
4667 	pt_vwrite,				/* t_vwrite */
4668 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_pread */
4669 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_pwrite */
4670 	pt_fread,				/* t_fread */
4671 	pt_fwrite,				/* t_fwrite */
4672 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_ioread */
4673 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_iowrite */
4674 	(int (*)()) mdb_tgt_notsup,		/* t_vtop */
4675 	pt_lookup_by_name,			/* t_lookup_by_name */
4676 	pt_lookup_by_addr,			/* t_lookup_by_addr */
4677 	pt_symbol_iter,				/* t_symbol_iter */
4678 	pt_mapping_iter,			/* t_mapping_iter */
4679 	pt_object_iter,				/* t_object_iter */
4680 	pt_addr_to_map,				/* t_addr_to_map */
4681 	pt_name_to_map,				/* t_name_to_map */
4682 	pt_addr_to_ctf,				/* t_addr_to_ctf */
4683 	pt_name_to_ctf,				/* t_name_to_ctf */
4684 	pt_status,				/* t_status */
4685 	pt_run,					/* t_run */
4686 	pt_step,				/* t_step */
4687 	pt_step_out,				/* t_step_out */
4688 	(int (*)()) mdb_tgt_notsup,		/* t_step_branch */
4689 	pt_next,				/* t_next */
4690 	pt_continue,				/* t_cont */
4691 	pt_signal,				/* t_signal */
4692 	pt_add_vbrkpt,				/* t_add_vbrkpt */
4693 	pt_add_sbrkpt,				/* t_add_sbrkpt */
4694 	(int (*)()) mdb_tgt_null,		/* t_add_pwapt */
4695 	pt_add_vwapt,				/* t_add_vwapt */
4696 	(int (*)()) mdb_tgt_null,		/* t_add_iowapt */
4697 	pt_add_sysenter,			/* t_add_sysenter */
4698 	pt_add_sysexit,				/* t_add_sysexit */
4699 	pt_add_signal,				/* t_add_signal */
4700 	pt_add_fault,				/* t_add_fault */
4701 	pt_getareg,				/* t_getareg */
4702 	pt_putareg,				/* t_putareg */
4703 	pt_stack_iter,				/* t_stack_iter */
4704 	pt_auxv					/* t_auxv */
4705 };
4706 
4707 /*
4708  * Utility function for converting libproc errno values to mdb error values
4709  * for the ptl calls below.  Currently, we only need to convert ENOENT to
4710  * EMDB_NOTHREAD to produce a more useful error message for the user.
4711  */
4712 static int
4713 ptl_err(int error)
4714 {
4715 	if (error != 0 && errno == ENOENT)
4716 		return (set_errno(EMDB_NOTHREAD));
4717 
4718 	return (error);
4719 }
4720 
4721 /*ARGSUSED*/
4722 static mdb_tgt_tid_t
4723 pt_lwp_tid(mdb_tgt_t *t, void *tap)
4724 {
4725 	if (t->t_pshandle != NULL)
4726 		return (Pstatus(t->t_pshandle)->pr_lwp.pr_lwpid);
4727 
4728 	return (set_errno(EMDB_NOPROC));
4729 }
4730 
4731 static int
4732 pt_lwp_add(mdb_addrvec_t *ap, const lwpstatus_t *psp)
4733 {
4734 	mdb_addrvec_unshift(ap, psp->pr_lwpid);
4735 	return (0);
4736 }
4737 
4738 /*ARGSUSED*/
4739 static int
4740 pt_lwp_iter(mdb_tgt_t *t, void *tap, mdb_addrvec_t *ap)
4741 {
4742 	if (t->t_pshandle != NULL)
4743 		return (Plwp_iter(t->t_pshandle, (proc_lwp_f *)pt_lwp_add, ap));
4744 
4745 	return (set_errno(EMDB_NOPROC));
4746 }
4747 
4748 /*ARGSUSED*/
4749 static int
4750 pt_lwp_getregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4751 {
4752 	if (t->t_pshandle != NULL) {
4753 		return (ptl_err(Plwp_getregs(t->t_pshandle,
4754 		    (lwpid_t)tid, gregs)));
4755 	}
4756 	return (set_errno(EMDB_NOPROC));
4757 }
4758 
4759 /*ARGSUSED*/
4760 static int
4761 pt_lwp_setregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4762 {
4763 	if (t->t_pshandle != NULL) {
4764 		return (ptl_err(Plwp_setregs(t->t_pshandle,
4765 		    (lwpid_t)tid, gregs)));
4766 	}
4767 	return (set_errno(EMDB_NOPROC));
4768 }
4769 
4770 #ifdef	__sparc
4771 
4772 /*ARGSUSED*/
4773 static int
4774 pt_lwp_getxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prxregset_t *xregs)
4775 {
4776 	if (t->t_pshandle != NULL) {
4777 		return (ptl_err(Plwp_getxregs(t->t_pshandle,
4778 		    (lwpid_t)tid, xregs)));
4779 	}
4780 	return (set_errno(EMDB_NOPROC));
4781 }
4782 
4783 /*ARGSUSED*/
4784 static int
4785 pt_lwp_setxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4786     const prxregset_t *xregs)
4787 {
4788 	if (t->t_pshandle != NULL) {
4789 		return (ptl_err(Plwp_setxregs(t->t_pshandle,
4790 		    (lwpid_t)tid, xregs)));
4791 	}
4792 	return (set_errno(EMDB_NOPROC));
4793 }
4794 
4795 #endif	/* __sparc */
4796 
4797 /*ARGSUSED*/
4798 static int
4799 pt_lwp_getfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4800     prfpregset_t *fpregs)
4801 {
4802 	if (t->t_pshandle != NULL) {
4803 		return (ptl_err(Plwp_getfpregs(t->t_pshandle,
4804 		    (lwpid_t)tid, fpregs)));
4805 	}
4806 	return (set_errno(EMDB_NOPROC));
4807 }
4808 
4809 /*ARGSUSED*/
4810 static int
4811 pt_lwp_setfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4812     const prfpregset_t *fpregs)
4813 {
4814 	if (t->t_pshandle != NULL) {
4815 		return (ptl_err(Plwp_setfpregs(t->t_pshandle,
4816 		    (lwpid_t)tid, fpregs)));
4817 	}
4818 	return (set_errno(EMDB_NOPROC));
4819 }
4820 
4821 static const pt_ptl_ops_t proc_lwp_ops = {
4822 	(int (*)()) mdb_tgt_nop,
4823 	(void (*)()) mdb_tgt_nop,
4824 	pt_lwp_tid,
4825 	pt_lwp_iter,
4826 	pt_lwp_getregs,
4827 	pt_lwp_setregs,
4828 #ifdef __sparc
4829 	pt_lwp_getxregs,
4830 	pt_lwp_setxregs,
4831 #endif
4832 	pt_lwp_getfpregs,
4833 	pt_lwp_setfpregs
4834 };
4835 
4836 static int
4837 pt_tdb_ctor(mdb_tgt_t *t)
4838 {
4839 	pt_data_t *pt = t->t_data;
4840 	td_thragent_t *tap;
4841 	td_err_e err;
4842 
4843 	if ((err = pt->p_tdb_ops->td_ta_new(t->t_pshandle, &tap)) != TD_OK)
4844 		return (set_errno(tdb_to_errno(err)));
4845 
4846 	pt->p_ptl_hdl = tap;
4847 	return (0);
4848 }
4849 
4850 static void
4851 pt_tdb_dtor(mdb_tgt_t *t, void *tap)
4852 {
4853 	pt_data_t *pt = t->t_data;
4854 
4855 	ASSERT(tap == pt->p_ptl_hdl);
4856 	(void) pt->p_tdb_ops->td_ta_delete(tap);
4857 	pt->p_ptl_hdl = NULL;
4858 }
4859 
4860 static mdb_tgt_tid_t
4861 pt_tdb_tid(mdb_tgt_t *t, void *tap)
4862 {
4863 	pt_data_t *pt = t->t_data;
4864 
4865 	td_thrhandle_t th;
4866 	td_thrinfo_t ti;
4867 	td_err_e err;
4868 
4869 	if (t->t_pshandle == NULL)
4870 		return (set_errno(EMDB_NOPROC));
4871 
4872 	if ((err = pt->p_tdb_ops->td_ta_map_lwp2thr(tap,
4873 	    Pstatus(t->t_pshandle)->pr_lwp.pr_lwpid, &th)) != TD_OK)
4874 		return (set_errno(tdb_to_errno(err)));
4875 
4876 	if ((err = pt->p_tdb_ops->td_thr_get_info(&th, &ti)) != TD_OK)
4877 		return (set_errno(tdb_to_errno(err)));
4878 
4879 	return (ti.ti_tid);
4880 }
4881 
4882 static int
4883 pt_tdb_add(const td_thrhandle_t *thp, pt_addarg_t *pap)
4884 {
4885 	td_thrinfo_t ti;
4886 
4887 	if (pap->pa_pt->p_tdb_ops->td_thr_get_info(thp, &ti) == TD_OK &&
4888 	    ti.ti_state != TD_THR_ZOMBIE)
4889 		mdb_addrvec_unshift(pap->pa_ap, ti.ti_tid);
4890 
4891 	return (0);
4892 }
4893 
4894 static int
4895 pt_tdb_iter(mdb_tgt_t *t, void *tap, mdb_addrvec_t *ap)
4896 {
4897 	pt_data_t *pt = t->t_data;
4898 	pt_addarg_t arg;
4899 	int err;
4900 
4901 	if (t->t_pshandle == NULL)
4902 		return (set_errno(EMDB_NOPROC));
4903 
4904 	arg.pa_pt = pt;
4905 	arg.pa_ap = ap;
4906 
4907 	if ((err = pt->p_tdb_ops->td_ta_thr_iter(tap, (td_thr_iter_f *)
4908 	    pt_tdb_add, &arg, TD_THR_ANY_STATE, TD_THR_LOWEST_PRIORITY,
4909 	    TD_SIGNO_MASK, TD_THR_ANY_USER_FLAGS)) != TD_OK)
4910 		return (set_errno(tdb_to_errno(err)));
4911 
4912 	return (0);
4913 }
4914 
4915 static int
4916 pt_tdb_getregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4917 {
4918 	pt_data_t *pt = t->t_data;
4919 
4920 	td_thrhandle_t th;
4921 	td_err_e err;
4922 
4923 	if (t->t_pshandle == NULL)
4924 		return (set_errno(EMDB_NOPROC));
4925 
4926 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4927 		return (set_errno(tdb_to_errno(err)));
4928 
4929 	err = pt->p_tdb_ops->td_thr_getgregs(&th, gregs);
4930 	if (err != TD_OK && err != TD_PARTIALREG)
4931 		return (set_errno(tdb_to_errno(err)));
4932 
4933 	return (0);
4934 }
4935 
4936 static int
4937 pt_tdb_setregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prgregset_t gregs)
4938 {
4939 	pt_data_t *pt = t->t_data;
4940 
4941 	td_thrhandle_t th;
4942 	td_err_e err;
4943 
4944 	if (t->t_pshandle == NULL)
4945 		return (set_errno(EMDB_NOPROC));
4946 
4947 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4948 		return (set_errno(tdb_to_errno(err)));
4949 
4950 	err = pt->p_tdb_ops->td_thr_setgregs(&th, gregs);
4951 	if (err != TD_OK && err != TD_PARTIALREG)
4952 		return (set_errno(tdb_to_errno(err)));
4953 
4954 	return (0);
4955 }
4956 
4957 #ifdef __sparc
4958 
4959 static int
4960 pt_tdb_getxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid, prxregset_t *xregs)
4961 {
4962 	pt_data_t *pt = t->t_data;
4963 
4964 	td_thrhandle_t th;
4965 	td_err_e err;
4966 
4967 	if (t->t_pshandle == NULL)
4968 		return (set_errno(EMDB_NOPROC));
4969 
4970 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4971 		return (set_errno(tdb_to_errno(err)));
4972 
4973 	err = pt->p_tdb_ops->td_thr_getxregs(&th, xregs);
4974 	if (err != TD_OK && err != TD_PARTIALREG)
4975 		return (set_errno(tdb_to_errno(err)));
4976 
4977 	return (0);
4978 }
4979 
4980 static int
4981 pt_tdb_setxregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
4982     const prxregset_t *xregs)
4983 {
4984 	pt_data_t *pt = t->t_data;
4985 
4986 	td_thrhandle_t th;
4987 	td_err_e err;
4988 
4989 	if (t->t_pshandle == NULL)
4990 		return (set_errno(EMDB_NOPROC));
4991 
4992 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
4993 		return (set_errno(tdb_to_errno(err)));
4994 
4995 	err = pt->p_tdb_ops->td_thr_setxregs(&th, xregs);
4996 	if (err != TD_OK && err != TD_PARTIALREG)
4997 		return (set_errno(tdb_to_errno(err)));
4998 
4999 	return (0);
5000 }
5001 
5002 #endif	/* __sparc */
5003 
5004 static int
5005 pt_tdb_getfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
5006     prfpregset_t *fpregs)
5007 {
5008 	pt_data_t *pt = t->t_data;
5009 
5010 	td_thrhandle_t th;
5011 	td_err_e err;
5012 
5013 	if (t->t_pshandle == NULL)
5014 		return (set_errno(EMDB_NOPROC));
5015 
5016 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5017 		return (set_errno(tdb_to_errno(err)));
5018 
5019 	err = pt->p_tdb_ops->td_thr_getfpregs(&th, fpregs);
5020 	if (err != TD_OK && err != TD_PARTIALREG)
5021 		return (set_errno(tdb_to_errno(err)));
5022 
5023 	return (0);
5024 }
5025 
5026 static int
5027 pt_tdb_setfpregs(mdb_tgt_t *t, void *tap, mdb_tgt_tid_t tid,
5028     const prfpregset_t *fpregs)
5029 {
5030 	pt_data_t *pt = t->t_data;
5031 
5032 	td_thrhandle_t th;
5033 	td_err_e err;
5034 
5035 	if (t->t_pshandle == NULL)
5036 		return (set_errno(EMDB_NOPROC));
5037 
5038 	if ((err = pt->p_tdb_ops->td_ta_map_id2thr(tap, tid, &th)) != TD_OK)
5039 		return (set_errno(tdb_to_errno(err)));
5040 
5041 	err = pt->p_tdb_ops->td_thr_setfpregs(&th, fpregs);
5042 	if (err != TD_OK && err != TD_PARTIALREG)
5043 		return (set_errno(tdb_to_errno(err)));
5044 
5045 	return (0);
5046 }
5047 
5048 static const pt_ptl_ops_t proc_tdb_ops = {
5049 	pt_tdb_ctor,
5050 	pt_tdb_dtor,
5051 	pt_tdb_tid,
5052 	pt_tdb_iter,
5053 	pt_tdb_getregs,
5054 	pt_tdb_setregs,
5055 #ifdef __sparc
5056 	pt_tdb_getxregs,
5057 	pt_tdb_setxregs,
5058 #endif
5059 	pt_tdb_getfpregs,
5060 	pt_tdb_setfpregs
5061 };
5062 
5063 static ssize_t
5064 pt_xd_auxv(mdb_tgt_t *t, void *buf, size_t nbytes)
5065 {
5066 	struct ps_prochandle *P = t->t_pshandle;
5067 	const auxv_t *auxp, *auxv = NULL;
5068 	int auxn = 0;
5069 
5070 	if (P != NULL && (auxv = Pgetauxvec(P)) != NULL &&
5071 	    auxv->a_type != AT_NULL) {
5072 		for (auxp = auxv, auxn = 1; auxp->a_type != NULL; auxp++)
5073 			auxn++;
5074 	}
5075 
5076 	if (buf == NULL && nbytes == 0)
5077 		return (sizeof (auxv_t) * auxn);
5078 
5079 	if (auxn == 0)
5080 		return (set_errno(ENODATA));
5081 
5082 	nbytes = MIN(nbytes, sizeof (auxv_t) * auxn);
5083 	bcopy(auxv, buf, nbytes);
5084 	return (nbytes);
5085 }
5086 
5087 static ssize_t
5088 pt_xd_cred(mdb_tgt_t *t, void *buf, size_t nbytes)
5089 {
5090 	prcred_t cr, *crp;
5091 	size_t cbytes = 0;
5092 
5093 	if (t->t_pshandle != NULL && Pcred(t->t_pshandle, &cr, 1) == 0) {
5094 		cbytes = (cr.pr_ngroups <= 1) ? sizeof (prcred_t) :
5095 		    (sizeof (prcred_t) + (cr.pr_ngroups - 1) * sizeof (gid_t));
5096 	}
5097 
5098 	if (buf == NULL && nbytes == 0)
5099 		return (cbytes);
5100 
5101 	if (cbytes == 0)
5102 		return (set_errno(ENODATA));
5103 
5104 	crp = mdb_alloc(cbytes, UM_SLEEP);
5105 
5106 	if (Pcred(t->t_pshandle, crp, cr.pr_ngroups) == -1)
5107 		return (set_errno(ENODATA));
5108 
5109 	nbytes = MIN(nbytes, cbytes);
5110 	bcopy(crp, buf, nbytes);
5111 	mdb_free(crp, cbytes);
5112 	return (nbytes);
5113 }
5114 
5115 static ssize_t
5116 pt_xd_ehdr(mdb_tgt_t *t, void *buf, size_t nbytes)
5117 {
5118 	pt_data_t *pt = t->t_data;
5119 
5120 	if (buf == NULL && nbytes == 0)
5121 		return (sizeof (GElf_Ehdr));
5122 
5123 	if (pt->p_file == NULL)
5124 		return (set_errno(ENODATA));
5125 
5126 	nbytes = MIN(nbytes, sizeof (GElf_Ehdr));
5127 	bcopy(&pt->p_file->gf_ehdr, buf, nbytes);
5128 	return (nbytes);
5129 }
5130 
5131 static int
5132 pt_copy_lwp(lwpstatus_t **lspp, const lwpstatus_t *lsp)
5133 {
5134 	bcopy(lsp, *lspp, sizeof (lwpstatus_t));
5135 	(*lspp)++;
5136 	return (0);
5137 }
5138 
5139 static ssize_t
5140 pt_xd_lwpstatus(mdb_tgt_t *t, void *buf, size_t nbytes)
5141 {
5142 	lwpstatus_t *lsp, *lbuf;
5143 	const pstatus_t *psp;
5144 	int nlwp = 0;
5145 
5146 	if (t->t_pshandle != NULL && (psp = Pstatus(t->t_pshandle)) != NULL)
5147 		nlwp = psp->pr_nlwp;
5148 
5149 	if (buf == NULL && nbytes == 0)
5150 		return (sizeof (lwpstatus_t) * nlwp);
5151 
5152 	if (nlwp == 0)
5153 		return (set_errno(ENODATA));
5154 
5155 	lsp = lbuf = mdb_alloc(sizeof (lwpstatus_t) * nlwp, UM_SLEEP);
5156 	nbytes = MIN(nbytes, sizeof (lwpstatus_t) * nlwp);
5157 
5158 	(void) Plwp_iter(t->t_pshandle, (proc_lwp_f *)pt_copy_lwp, &lsp);
5159 	bcopy(lbuf, buf, nbytes);
5160 
5161 	mdb_free(lbuf, sizeof (lwpstatus_t) * nlwp);
5162 	return (nbytes);
5163 }
5164 
5165 static ssize_t
5166 pt_xd_pshandle(mdb_tgt_t *t, void *buf, size_t nbytes)
5167 {
5168 	if (buf == NULL && nbytes == 0)
5169 		return (sizeof (struct ps_prochandle *));
5170 
5171 	if (t->t_pshandle == NULL || nbytes != sizeof (struct ps_prochandle *))
5172 		return (set_errno(ENODATA));
5173 
5174 	bcopy(&t->t_pshandle, buf, nbytes);
5175 	return (nbytes);
5176 }
5177 
5178 static ssize_t
5179 pt_xd_psinfo(mdb_tgt_t *t, void *buf, size_t nbytes)
5180 {
5181 	const psinfo_t *psp;
5182 
5183 	if (buf == NULL && nbytes == 0)
5184 		return (sizeof (psinfo_t));
5185 
5186 	if (t->t_pshandle == NULL || (psp = Ppsinfo(t->t_pshandle)) == NULL)
5187 		return (set_errno(ENODATA));
5188 
5189 	nbytes = MIN(nbytes, sizeof (psinfo_t));
5190 	bcopy(psp, buf, nbytes);
5191 	return (nbytes);
5192 }
5193 
5194 static ssize_t
5195 pt_xd_pstatus(mdb_tgt_t *t, void *buf, size_t nbytes)
5196 {
5197 	const pstatus_t *psp;
5198 
5199 	if (buf == NULL && nbytes == 0)
5200 		return (sizeof (pstatus_t));
5201 
5202 	if (t->t_pshandle == NULL || (psp = Pstatus(t->t_pshandle)) == NULL)
5203 		return (set_errno(ENODATA));
5204 
5205 	nbytes = MIN(nbytes, sizeof (pstatus_t));
5206 	bcopy(psp, buf, nbytes);
5207 	return (nbytes);
5208 }
5209 
5210 static ssize_t
5211 pt_xd_utsname(mdb_tgt_t *t, void *buf, size_t nbytes)
5212 {
5213 	struct utsname uts;
5214 
5215 	if (buf == NULL && nbytes == 0)
5216 		return (sizeof (struct utsname));
5217 
5218 	if (t->t_pshandle == NULL || Puname(t->t_pshandle, &uts) != 0)
5219 		return (set_errno(ENODATA));
5220 
5221 	nbytes = MIN(nbytes, sizeof (struct utsname));
5222 	bcopy(&uts, buf, nbytes);
5223 	return (nbytes);
5224 }
5225 
5226 int
5227 mdb_proc_tgt_create(mdb_tgt_t *t, int argc, const char *argv[])
5228 {
5229 	pt_data_t *pt = mdb_zalloc(sizeof (pt_data_t), UM_SLEEP);
5230 
5231 	const char *aout_path = argc > 0 ? argv[0] : PT_EXEC_PATH;
5232 	const char *core_path = argc > 1 ? argv[1] : NULL;
5233 
5234 	const mdb_tgt_regdesc_t *rdp;
5235 	char execname[MAXPATHLEN];
5236 	struct stat64 st;
5237 	int perr;
5238 	int state;
5239 	struct rlimit rlim;
5240 	int i;
5241 
5242 	if (argc > 2) {
5243 		mdb_free(pt, sizeof (pt_data_t));
5244 		return (set_errno(EINVAL));
5245 	}
5246 
5247 	if (t->t_flags & MDB_TGT_F_RDWR)
5248 		pt->p_oflags = O_RDWR;
5249 	else
5250 		pt->p_oflags = O_RDONLY;
5251 
5252 	if (t->t_flags & MDB_TGT_F_FORCE)
5253 		pt->p_gflags |= PGRAB_FORCE;
5254 	if (t->t_flags & MDB_TGT_F_NOSTOP)
5255 		pt->p_gflags |= PGRAB_NOSTOP;
5256 
5257 	pt->p_ptl_ops = &proc_lwp_ops;
5258 	pt->p_maxsig = sysconf(_SC_SIGRT_MAX);
5259 
5260 	(void) mdb_nv_create(&pt->p_regs, UM_SLEEP);
5261 	(void) mdb_nv_create(&pt->p_env, UM_SLEEP);
5262 
5263 	t->t_ops = &proc_ops;
5264 	t->t_data = pt;
5265 
5266 	/*
5267 	 * If no core file name was specified, but the file ./core is present,
5268 	 * infer that we want to debug it.  I find this behavior confusing,
5269 	 * so we only do this when precise adb(1) compatibility is required.
5270 	 */
5271 	if (core_path == NULL && (mdb.m_flags & MDB_FL_ADB) &&
5272 	    access(PT_CORE_PATH, F_OK) == 0)
5273 		core_path = PT_CORE_PATH;
5274 
5275 	/*
5276 	 * For compatibility with adb(1), the special name "-" may be used
5277 	 * to suppress the loading of the executable or core file.
5278 	 */
5279 	if (aout_path != NULL && strcmp(aout_path, "-") == 0)
5280 		aout_path = NULL;
5281 	if (core_path != NULL && strcmp(core_path, "-") == 0)
5282 		core_path = NULL;
5283 
5284 	/*
5285 	 * If a core file or pid was specified, attempt to grab it now using
5286 	 * proc_arg_grab(); otherwise we'll create a fresh process later.
5287 	 */
5288 	if (core_path != NULL && (t->t_pshandle = proc_arg_xgrab(core_path,
5289 	    aout_path == PT_EXEC_PATH ? NULL : aout_path, PR_ARG_ANY,
5290 	    pt->p_gflags, &perr, NULL)) == NULL) {
5291 		mdb_warn("cannot debug %s: %s\n", core_path, Pgrab_error(perr));
5292 		goto err;
5293 	}
5294 
5295 	if (aout_path != NULL &&
5296 	    (pt->p_idlehandle = Pgrab_file(aout_path, &perr)) != NULL &&
5297 	    t->t_pshandle == NULL)
5298 		t->t_pshandle = pt->p_idlehandle;
5299 
5300 	if (t->t_pshandle != NULL)
5301 		state = Pstate(t->t_pshandle);
5302 
5303 	/*
5304 	 * Make sure we'll have enough file descriptors to handle a target
5305 	 * has many many mappings.
5306 	 */
5307 	if (getrlimit(RLIMIT_NOFILE, &rlim) == 0) {
5308 		rlim.rlim_cur = rlim.rlim_max;
5309 		(void) setrlimit(RLIMIT_NOFILE, &rlim);
5310 		(void) enable_extended_FILE_stdio(-1, -1);
5311 	}
5312 
5313 	/*
5314 	 * If we don't have an executable path or the executable path is the
5315 	 * /proc/<pid>/object/a.out path, but we now have a libproc handle,
5316 	 * attempt to derive the executable path using Pexecname().  We need
5317 	 * to do this in the /proc case in order to open the executable for
5318 	 * writing because /proc/object/<file> permission are masked with 0555.
5319 	 * If Pexecname() fails us, fall back to /proc/<pid>/object/a.out.
5320 	 */
5321 	if (t->t_pshandle != NULL && (aout_path == NULL || (stat64(aout_path,
5322 	    &st) == 0 && strcmp(st.st_fstype, "proc") == 0))) {
5323 		GElf_Sym s;
5324 		aout_path = Pexecname(t->t_pshandle, execname, MAXPATHLEN);
5325 		if (aout_path == NULL && state != PS_DEAD && state != PS_IDLE) {
5326 			(void) mdb_iob_snprintf(execname, sizeof (execname),
5327 			    "/proc/%d/object/a.out",
5328 			    (int)Pstatus(t->t_pshandle)->pr_pid);
5329 			aout_path = execname;
5330 		}
5331 		if (aout_path == NULL &&
5332 		    Plookup_by_name(t->t_pshandle, "a.out", "_start", &s) != 0)
5333 			mdb_warn("warning: failed to infer pathname to "
5334 			    "executable; symbol table will not be available\n");
5335 
5336 		mdb_dprintf(MDB_DBG_TGT, "a.out is %s\n", aout_path);
5337 	}
5338 
5339 	/*
5340 	 * Attempt to open the executable file.  We only want this operation
5341 	 * to actually cause the constructor to abort if the executable file
5342 	 * name was given explicitly.  If we defaulted to PT_EXEC_PATH or
5343 	 * derived the executable using Pexecname, then we want to continue
5344 	 * along with p_fio and p_file set to NULL.
5345 	 */
5346 	if (aout_path != NULL && (pt->p_aout_fio = mdb_fdio_create_path(NULL,
5347 	    aout_path, pt->p_oflags, 0)) == NULL && argc > 0) {
5348 		mdb_warn("failed to open %s", aout_path);
5349 		goto err;
5350 	}
5351 
5352 	/*
5353 	 * Now create an ELF file from the input file, if we have one.  Again,
5354 	 * only abort the constructor if the name was given explicitly.
5355 	 */
5356 	if (pt->p_aout_fio != NULL && pt_open_aout(t,
5357 	    mdb_io_hold(pt->p_aout_fio)) == NULL && argc > 0)
5358 		goto err;
5359 
5360 	/*
5361 	 * If we've successfully opened an ELF file, select the appropriate
5362 	 * disassembler based on the ELF header.
5363 	 */
5364 	if (pt->p_file != NULL)
5365 		(void) mdb_dis_select(pt_disasm(&pt->p_file->gf_ehdr));
5366 	else
5367 		(void) mdb_dis_select(pt_disasm(NULL));
5368 
5369 	/*
5370 	 * Add each register described in the target ISA register description
5371 	 * list to our hash table of register descriptions and then add any
5372 	 * appropriate ISA-specific floating-point register descriptions.
5373 	 */
5374 	for (rdp = pt_regdesc; rdp->rd_name != NULL; rdp++) {
5375 		(void) mdb_nv_insert(&pt->p_regs, rdp->rd_name, NULL,
5376 		    MDB_TGT_R_NVAL(rdp->rd_num, rdp->rd_flags), MDB_NV_RDONLY);
5377 	}
5378 	pt_addfpregs(t);
5379 
5380 	/*
5381 	 * Certain important /proc structures may be of interest to mdb
5382 	 * modules and their dcmds.  Export these using the xdata interface:
5383 	 */
5384 	(void) mdb_tgt_xdata_insert(t, "auxv",
5385 	    "procfs auxv_t array", pt_xd_auxv);
5386 	(void) mdb_tgt_xdata_insert(t, "cred",
5387 	    "procfs prcred_t structure", pt_xd_cred);
5388 	(void) mdb_tgt_xdata_insert(t, "ehdr",
5389 	    "executable file GElf_Ehdr structure", pt_xd_ehdr);
5390 	(void) mdb_tgt_xdata_insert(t, "lwpstatus",
5391 	    "procfs lwpstatus_t array", pt_xd_lwpstatus);
5392 	(void) mdb_tgt_xdata_insert(t, "pshandle",
5393 	    "libproc proc service API handle", pt_xd_pshandle);
5394 	(void) mdb_tgt_xdata_insert(t, "psinfo",
5395 	    "procfs psinfo_t structure", pt_xd_psinfo);
5396 	(void) mdb_tgt_xdata_insert(t, "pstatus",
5397 	    "procfs pstatus_t structure", pt_xd_pstatus);
5398 	(void) mdb_tgt_xdata_insert(t, "utsname",
5399 	    "utsname structure", pt_xd_utsname);
5400 
5401 	/*
5402 	 * Force a status update now so that we fill in t_status with the
5403 	 * latest information based on any successful grab.
5404 	 */
5405 	(void) mdb_tgt_status(t, &t->t_status);
5406 
5407 	/*
5408 	 * If we're not examining a core file, trace SIGINT and all signals
5409 	 * that cause the process to dump core as part of our initialization.
5410 	 */
5411 	if ((t->t_pshandle != NULL && state != PS_DEAD && state != PS_IDLE) ||
5412 	    (pt->p_file != NULL && pt->p_file->gf_ehdr.e_type == ET_EXEC)) {
5413 
5414 		int tflag = MDB_TGT_SPEC_STICKY; /* default sigs are sticky */
5415 
5416 		(void) mdb_tgt_add_signal(t, SIGINT, tflag, no_se_f, NULL);
5417 		(void) mdb_tgt_add_signal(t, SIGQUIT, tflag, no_se_f, NULL);
5418 		(void) mdb_tgt_add_signal(t, SIGILL, tflag, no_se_f, NULL);
5419 		(void) mdb_tgt_add_signal(t, SIGTRAP, tflag, no_se_f, NULL);
5420 		(void) mdb_tgt_add_signal(t, SIGABRT, tflag, no_se_f, NULL);
5421 		(void) mdb_tgt_add_signal(t, SIGEMT, tflag, no_se_f, NULL);
5422 		(void) mdb_tgt_add_signal(t, SIGFPE, tflag, no_se_f, NULL);
5423 		(void) mdb_tgt_add_signal(t, SIGBUS, tflag, no_se_f, NULL);
5424 		(void) mdb_tgt_add_signal(t, SIGSEGV, tflag, no_se_f, NULL);
5425 		(void) mdb_tgt_add_signal(t, SIGSYS, tflag, no_se_f, NULL);
5426 		(void) mdb_tgt_add_signal(t, SIGXCPU, tflag, no_se_f, NULL);
5427 		(void) mdb_tgt_add_signal(t, SIGXFSZ, tflag, no_se_f, NULL);
5428 	}
5429 
5430 	/*
5431 	 * If we've grabbed a live process, establish our initial breakpoints
5432 	 * and librtld_db agent so we can track rtld activity.  If FL_VCREATE
5433 	 * is set, this process was created by a previous instantiation of
5434 	 * the debugger, so reset pr_flags to kill it; otherwise we attached
5435 	 * to an already running process.  Pgrab() has already set the PR_RLC
5436 	 * flag appropriately based on whether the process was stopped when we
5437 	 * attached.
5438 	 */
5439 	if (t->t_pshandle != NULL && state != PS_DEAD && state != PS_IDLE) {
5440 		if (mdb.m_flags & MDB_FL_VCREATE) {
5441 			(void) Punsetflags(t->t_pshandle, PR_RLC);
5442 			(void) Psetflags(t->t_pshandle, PR_KLC);
5443 			pt->p_rflags = PRELEASE_KILL;
5444 		} else {
5445 			(void) Punsetflags(t->t_pshandle, PR_KLC);
5446 		}
5447 		pt_post_attach(t);
5448 	}
5449 
5450 	/*
5451 	 * Initialize a local copy of the environment, which can be modified
5452 	 * before running the program.
5453 	 */
5454 	for (i = 0; mdb.m_env[i] != NULL; i++)
5455 		pt_env_set(pt, mdb.m_env[i]);
5456 
5457 	/*
5458 	 * If adb(1) compatibility mode is on, then print the appropriate
5459 	 * greeting message if we have grabbed a core file.
5460 	 */
5461 	if ((mdb.m_flags & MDB_FL_ADB) && t->t_pshandle != NULL &&
5462 	    state == PS_DEAD) {
5463 		const pstatus_t *psp = Pstatus(t->t_pshandle);
5464 		int cursig = psp->pr_lwp.pr_cursig;
5465 		char signame[SIG2STR_MAX];
5466 
5467 		mdb_printf("core file = %s -- program ``%s'' on platform %s\n",
5468 		    core_path, aout_path ? aout_path : "?", pt_platform(t));
5469 
5470 		if (cursig != 0 && sig2str(cursig, signame) == 0)
5471 			mdb_printf("SIG%s: %s\n", signame, strsignal(cursig));
5472 	}
5473 
5474 	return (0);
5475 
5476 err:
5477 	pt_destroy(t);
5478 	return (-1);
5479 }
5480