xref: /titanic_51/usr/src/cmd/mdb/common/kmdb/kmdb_kvm.c (revision dd51520e127b452179a2ce4ea3bd8dee949f9afe)
1 /*
2  * CDDL HEADER START
3  *
4  * The contents of this file are subject to the terms of the
5  * Common Development and Distribution License (the "License").
6  * You may not use this file except in compliance with the License.
7  *
8  * You can obtain a copy of the license at usr/src/OPENSOLARIS.LICENSE
9  * or http://www.opensolaris.org/os/licensing.
10  * See the License for the specific language governing permissions
11  * and limitations under the License.
12  *
13  * When distributing Covered Code, include this CDDL HEADER in each
14  * file and include the License file at usr/src/OPENSOLARIS.LICENSE.
15  * If applicable, add the following below this CDDL HEADER, with the
16  * fields enclosed by brackets "[]" replaced with your own identifying
17  * information: Portions Copyright [yyyy] [name of copyright owner]
18  *
19  * CDDL HEADER END
20  */
21 /*
22  * Copyright (c) 2004, 2010, Oracle and/or its affiliates. All rights reserved.
23  */
24 
25 #include <kmdb/kmdb_kvm.h>
26 #include <kmdb/kvm.h>
27 #include <kmdb/kmdb_kdi.h>
28 #include <kmdb/kmdb_promif.h>
29 #include <kmdb/kmdb_module.h>
30 #include <kmdb/kmdb_asmutil.h>
31 #include <mdb/mdb_types.h>
32 #include <mdb/mdb_conf.h>
33 #include <mdb/mdb_err.h>
34 #include <mdb/mdb_modapi.h>
35 #include <mdb/mdb_target_impl.h>
36 #include <mdb/mdb_debug.h>
37 #include <mdb/mdb_string.h>
38 #include <mdb/mdb_ctf.h>
39 #include <mdb/mdb_kreg_impl.h>
40 #include <mdb/mdb_ks.h>
41 #include <mdb/mdb.h>
42 
43 #include <strings.h>
44 #include <dlfcn.h>
45 #include <sys/isa_defs.h>
46 #include <sys/kobj.h>
47 #include <sys/kobj_impl.h>
48 #include <sys/bitmap.h>
49 #include <vm/as.h>
50 
51 static const char KMT_RTLD_NAME[] = "krtld";
52 static const char KMT_MODULE[] = "mdb_ks";
53 static const char KMT_CTFPARENT[] = "genunix";
54 
55 static mdb_list_t kmt_defbp_list;	/* List of current deferred bp's */
56 static int kmt_defbp_lock;		/* For list, running kernel holds */
57 static uint_t kmt_defbp_modchg_isload;	/* Whether mod change is load/unload */
58 static struct modctl *kmt_defbp_modchg_modctl; /* modctl for defbp checking */
59 static uint_t kmt_defbp_num;		/* Number of referenced def'd bp's */
60 static int kmt_defbp_bpspec;		/* vespec for def'd bp activation bp */
61 
62 static const mdb_se_ops_t kmt_brkpt_ops;
63 static const mdb_se_ops_t kmt_wapt_ops;
64 
65 static void kmt_sync(mdb_tgt_t *);
66 
67 typedef struct kmt_symarg {
68 	mdb_tgt_sym_f *sym_cb;		/* Caller's callback function */
69 	void *sym_data;			/* Callback function argument */
70 	uint_t sym_type;		/* Symbol type/binding filter */
71 	mdb_syminfo_t sym_info;		/* Symbol id and table id */
72 	const char *sym_obj;		/* Containing object */
73 } kmt_symarg_t;
74 
75 typedef struct kmt_maparg {
76 	mdb_tgt_t *map_target;		/* Target used for mapping iter */
77 	mdb_tgt_map_f *map_cb;		/* Caller's callback function */
78 	void *map_data;			/* Callback function argument */
79 } kmt_maparg_t;
80 
81 /*ARGSUSED*/
82 int
83 kmt_setflags(mdb_tgt_t *t, int flags)
84 {
85 	/*
86 	 * We only handle one flag (ALLOWIO), and we can't fail to set or clear
87 	 * it, so we just blindly replace the t_flags version with the one
88 	 * passed.
89 	 */
90 	t->t_flags = (t->t_flags & ~MDB_TGT_F_ALLOWIO) |
91 	    (flags & MDB_TGT_F_ALLOWIO);
92 
93 	return (0);
94 }
95 
96 /*ARGSUSED*/
97 const char *
98 kmt_name(mdb_tgt_t *t)
99 {
100 	return ("kmdb_kvm");
101 }
102 
103 /*ARGSUSED*/
104 static const char *
105 kmt_platform(mdb_tgt_t *t)
106 {
107 	static char platform[SYS_NMLN];
108 
109 	if (kmdb_dpi_get_state(NULL) == DPI_STATE_INIT)
110 		return (mdb_conf_platform());
111 
112 	if (mdb_tgt_readsym(mdb.m_target, MDB_TGT_AS_VIRT, platform,
113 	    sizeof (platform), "unix", "platform") != sizeof (platform)) {
114 		warn("'platform' symbol is missing from kernel\n");
115 		return ("unknown");
116 	}
117 
118 	return (platform);
119 }
120 
121 static int
122 kmt_uname(mdb_tgt_t *t, struct utsname *utsp)
123 {
124 	return (mdb_tgt_readsym(t, MDB_TGT_AS_VIRT, utsp,
125 	    sizeof (struct utsname), MDB_TGT_OBJ_EXEC, "utsname"));
126 }
127 
128 /*ARGSUSED*/
129 static int
130 kmt_dmodel(mdb_tgt_t *t)
131 {
132 	return (MDB_TGT_MODEL_NATIVE);
133 }
134 
135 /*ARGSUSED*/
136 ssize_t
137 kmt_rw(mdb_tgt_t *t, void *buf, size_t nbytes, uint64_t addr,
138     ssize_t (*rw)(void *, size_t, uint64_t))
139 {
140 	size_t n, ndone, chunksz;
141 	jmp_buf *oldpcb = NULL;
142 	jmp_buf pcb;
143 	ssize_t res;
144 
145 	kmdb_prom_check_interrupt();
146 
147 	if (nbytes == 0)
148 		return (0);
149 
150 	/*
151 	 * Try to process the entire buffer, as requested.  If we catch a fault,
152 	 * try smaller chunks.  This allows us to handle regions that cross
153 	 * mapping boundaries.
154 	 */
155 	chunksz = nbytes;
156 	ndone = 0;
157 	if (setjmp(pcb) != 0) {
158 		if (chunksz == 1) {
159 			/* We failed with the smallest chunk - give up */
160 			kmdb_dpi_restore_fault_hdlr(oldpcb);
161 			return (ndone > 0 ? ndone : -1); /* errno set for us */
162 		} else if (chunksz > 4)
163 			chunksz = 4;
164 		else
165 			chunksz = 1;
166 	}
167 
168 	oldpcb = kmdb_dpi_set_fault_hdlr(&pcb);
169 	while (nbytes > 0) {
170 		n = MIN(chunksz, nbytes);
171 
172 		if ((res = rw(buf, n, addr)) != n)
173 			return (res < 0 ? res : ndone + res);
174 
175 		addr += n;
176 		nbytes -= n;
177 		ndone += n;
178 		buf = ((caddr_t)buf + n);
179 	}
180 
181 	kmdb_dpi_restore_fault_hdlr(oldpcb);
182 
183 	return (ndone);
184 }
185 
186 static void
187 kmt_bcopy(const void *s1, void *s2, size_t n)
188 {
189 	/*
190 	 * We need to guarantee atomic accesses for certain sizes.  bcopy won't
191 	 * make that guarantee, so we need to do it ourselves.
192 	 */
193 #ifdef	_LP64
194 	if (n == 8 && ((uintptr_t)s1 & 7) == 0 && ((uintptr_t)s2 & 7) == 0)
195 		*(uint64_t *)s2 = *(uint64_t *)s1;
196 	else
197 #endif
198 	if (n == 4 && ((uintptr_t)s1 & 3) == 0 && ((uintptr_t)s2 & 3) == 0)
199 		*(uint32_t *)s2 = *(uint32_t *)s1;
200 	else if (n == 2 && ((uintptr_t)s1 & 1) == 0 && ((uintptr_t)s2 & 1) == 0)
201 		*(uint16_t *)s2 = *(uint16_t *)s1;
202 	else if (n == 1)
203 		*(uint8_t *)s2 = *(uint8_t *)s1;
204 	else
205 		bcopy(s1, s2, n);
206 }
207 
208 static ssize_t
209 kmt_reader(void *buf, size_t nbytes, uint64_t addr)
210 {
211 	kmt_bcopy((void *)(uintptr_t)addr, buf, nbytes);
212 	return (nbytes);
213 }
214 
215 ssize_t
216 kmt_writer(void *buf, size_t nbytes, uint64_t addr)
217 {
218 	kmt_bcopy(buf, (void *)(uintptr_t)addr, nbytes);
219 	return (nbytes);
220 }
221 
222 /*ARGSUSED*/
223 static ssize_t
224 kmt_read(mdb_tgt_t *t, void *buf, size_t nbytes, uintptr_t addr)
225 {
226 	/*
227 	 * We don't want to allow reads of I/O-mapped memory.  Multi-page reads
228 	 * that cross into I/O-mapped memory should be restricted to the initial
229 	 * non-I/O region.  Reads that begin in I/O-mapped memory are failed
230 	 * outright.
231 	 */
232 	if (!(t->t_flags & MDB_TGT_F_ALLOWIO) &&
233 	    (nbytes = kmdb_kdi_range_is_nontoxic(addr, nbytes, 0)) == 0)
234 		return (set_errno(EMDB_NOMAP));
235 
236 	return (kmt_rw(t, buf, nbytes, addr, kmt_reader));
237 }
238 
239 /*ARGSUSED*/
240 static ssize_t
241 kmt_pread(mdb_tgt_t *t, void *buf, size_t nbytes, physaddr_t addr)
242 {
243 	return (kmt_rw(t, buf, nbytes, addr, kmdb_kdi_pread));
244 }
245 
246 /*ARGSUSED*/
247 ssize_t
248 kmt_pwrite(mdb_tgt_t *t, const void *buf, size_t nbytes, physaddr_t addr)
249 {
250 	return (kmt_rw(t, (void *)buf, nbytes, addr, kmdb_kdi_pwrite));
251 }
252 
253 static uintptr_t
254 kmt_read_kas(mdb_tgt_t *t)
255 {
256 	GElf_Sym sym;
257 
258 	if (mdb_tgt_lookup_by_name(t, "unix", "kas", &sym, NULL) < 0) {
259 		warn("'kas' symbol is missing from kernel\n");
260 		(void) set_errno(EMDB_NOSYM);
261 		return (0);
262 	}
263 
264 	return ((uintptr_t)sym.st_value);
265 }
266 
267 static int
268 kmt_vtop(mdb_tgt_t *t, mdb_tgt_as_t as, uintptr_t va, physaddr_t *pap)
269 {
270 	mdb_module_t *mod;
271 	struct as *asp;
272 	mdb_var_t *v;
273 
274 	switch ((uintptr_t)as) {
275 	case (uintptr_t)MDB_TGT_AS_PHYS:
276 	case (uintptr_t)MDB_TGT_AS_FILE:
277 	case (uintptr_t)MDB_TGT_AS_IO:
278 		return (set_errno(EINVAL));
279 	case (uintptr_t)MDB_TGT_AS_VIRT:
280 		if ((asp = (struct as *)kmt_read_kas(t)) == NULL)
281 			return (-1); /* errno is set for us */
282 		break;
283 	default:
284 		asp = (struct as *)as;
285 
286 		/* We don't support non-kas vtop */
287 		if (asp != (struct as *)kmt_read_kas(t))
288 			return (set_errno(EMDB_TGTNOTSUP));
289 	}
290 
291 	if (kmdb_prom_vtop(va, pap) == 0)
292 		return (0);
293 
294 	if ((v = mdb_nv_lookup(&mdb.m_modules, "unix")) != NULL &&
295 	    (mod = mdb_nv_get_cookie(v)) != NULL) {
296 		int (*fptr)(uintptr_t, struct as *, physaddr_t *);
297 
298 		fptr = (int (*)(uintptr_t, struct as *, physaddr_t *))
299 		    dlsym(mod->mod_hdl, "platform_vtop");
300 
301 		if ((fptr != NULL) && ((*fptr)(va, asp, pap) == 0))
302 			return (0);
303 	}
304 
305 	return (set_errno(EMDB_NOMAP));
306 }
307 
308 /*ARGSUSED*/
309 static int
310 kmt_cpuregs(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
311 {
312 	const mdb_tgt_gregset_t *gregs;
313 	intptr_t cpuid = DPI_MASTER_CPUID;
314 	int i;
315 
316 	if (flags & DCMD_ADDRSPEC) {
317 		if (argc != 0)
318 			return (DCMD_USAGE);
319 		if ((cpuid = mdb_cpu2cpuid(addr)) < 0) {
320 			(void) set_errno(EMDB_NOMAP);
321 			mdb_warn("failed to find cpuid for cpu at %p", addr);
322 			return (DCMD_ERR);
323 		}
324 	}
325 
326 	i = mdb_getopts(argc, argv,
327 	    'c', MDB_OPT_UINTPTR, &cpuid,
328 	    NULL);
329 
330 	argc -= i;
331 	argv += i;
332 
333 	if (argc != 0)
334 		return (DCMD_USAGE);
335 
336 	if ((gregs = kmdb_dpi_get_gregs(cpuid)) == NULL) {
337 		warn("failed to retrieve registers for cpu %d", (int)cpuid);
338 		return (DCMD_ERR);
339 	}
340 
341 	kmt_printregs(gregs);
342 
343 	return (DCMD_OK);
344 }
345 
346 static int
347 kmt_regs(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
348 {
349 	if (flags & DCMD_ADDRSPEC)
350 		return (DCMD_USAGE);
351 
352 	return (kmt_cpuregs(addr, flags, argc, argv));
353 }
354 
355 static int
356 kmt_cpustack_dcmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
357 {
358 	intptr_t cpuid = DPI_MASTER_CPUID;
359 	uint_t verbose = 0;
360 	int i;
361 
362 	if (flags & DCMD_ADDRSPEC) {
363 		if ((cpuid = mdb_cpu2cpuid(addr)) < 0) {
364 			(void) set_errno(EMDB_NOMAP);
365 			mdb_warn("failed to find cpuid for cpu at %p", addr);
366 			return (DCMD_ERR);
367 		}
368 		flags &= ~DCMD_ADDRSPEC;
369 	}
370 
371 	i = mdb_getopts(argc, argv,
372 	    'c', MDB_OPT_UINTPTR, &cpuid,
373 	    'v', MDB_OPT_SETBITS, 1, &verbose,
374 	    NULL);
375 
376 	argc -= i;
377 	argv += i;
378 
379 	return (kmt_cpustack(addr, flags, argc, argv, cpuid, verbose));
380 }
381 
382 /*
383  * Lasciate ogne speranza, voi ch'intrate.
384  */
385 static int
386 kmt_call(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
387 {
388 	uintptr_t *call_argv, rval;
389 	int parse_strings = 1;
390 	GElf_Sym sym;
391 	jmp_buf *oldpcb = NULL;
392 	jmp_buf pcb;
393 	int i;
394 
395 	if (!(flags & DCMD_ADDRSPEC))
396 		return (DCMD_USAGE);
397 
398 	if (mdb_tgt_lookup_by_addr(mdb.m_target, addr, MDB_TGT_SYM_EXACT,
399 	    NULL, 0, &sym, NULL) == 0 && GELF_ST_TYPE(sym.st_info) !=
400 	    STT_FUNC) {
401 		warn("%a is not a function\n", addr);
402 		return (DCMD_ERR);
403 	}
404 
405 	if (argc > 1 && argv[0].a_type == MDB_TYPE_STRING &&
406 	    strcmp(argv[0].a_un.a_str, "-s") == 0) {
407 		parse_strings = 0;
408 		argc--;
409 		argv++;
410 	}
411 
412 	call_argv = mdb_alloc(sizeof (uintptr_t) * argc, UM_SLEEP);
413 
414 	for (i = 0; i < argc; i++) {
415 		switch (argv[i].a_type) {
416 		case MDB_TYPE_STRING:
417 			/*
418 			 * mdb_strtoull doesn't return on error, so we have to
419 			 * pre-check strings suspected to contain numbers.
420 			 */
421 			if (parse_strings && strisbasenum(argv[i].a_un.a_str)) {
422 				call_argv[i] = (uintptr_t)mdb_strtoull(
423 				    argv[i].a_un.a_str);
424 			} else
425 				call_argv[i] = (uintptr_t)argv[i].a_un.a_str;
426 
427 			break;
428 
429 		case MDB_TYPE_IMMEDIATE:
430 			call_argv[i] = argv[i].a_un.a_val;
431 			break;
432 
433 		default:
434 			mdb_free(call_argv,
435 			    sizeof (uintptr_t) * argc);
436 			return (DCMD_USAGE);
437 		}
438 	}
439 
440 	if (setjmp(pcb) != 0) {
441 		warn("call failed: caught a trap\n");
442 
443 		kmdb_dpi_restore_fault_hdlr(oldpcb);
444 		mdb_free(call_argv, sizeof (uintptr_t) * argc);
445 		return (DCMD_ERR);
446 	}
447 
448 	oldpcb = kmdb_dpi_set_fault_hdlr(&pcb);
449 	rval = kmdb_dpi_call(addr, argc, call_argv);
450 	kmdb_dpi_restore_fault_hdlr(oldpcb);
451 
452 	if (flags & DCMD_PIPE_OUT) {
453 		mdb_printf("%p\n", rval);
454 	} else {
455 		/* pretty-print the results */
456 		mdb_printf("%p = %a(", rval, addr);
457 		for (i = 0; i < argc; i++) {
458 			if (i > 0)
459 				mdb_printf(", ");
460 			if (argv[i].a_type == MDB_TYPE_STRING) {
461 				/* I'm ashamed but amused */
462 				char *quote = &("\""[parse_strings &&
463 				    strisbasenum(argv[i].a_un.a_str)]);
464 
465 				mdb_printf("%s%s%s", quote, argv[i].a_un.a_str,
466 				    quote);
467 			} else
468 				mdb_printf("%p", argv[i].a_un.a_val);
469 		}
470 		mdb_printf(");\n");
471 	}
472 
473 	mdb_free(call_argv, sizeof (uintptr_t) * argc);
474 
475 	return (DCMD_OK);
476 }
477 
478 /*ARGSUSED*/
479 int
480 kmt_dump_crumbs(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
481 {
482 	intptr_t cpu = -1;
483 
484 	if (flags & DCMD_ADDRSPEC) {
485 		if (argc != 0)
486 			return (DCMD_USAGE);
487 	} else {
488 		addr = 0;
489 
490 		if (mdb_getopts(argc, argv,
491 		    'c', MDB_OPT_UINTPTR, &cpu,
492 		    NULL) != argc)
493 			return (DCMD_USAGE);
494 	}
495 
496 	kmdb_dpi_dump_crumbs(addr, cpu);
497 
498 	return (DCMD_OK);
499 }
500 
501 /*ARGSUSED*/
502 static int
503 kmt_noducttape(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
504 {
505 	int a = 0;
506 
507 	return (a/a);
508 }
509 
510 static int
511 kmt_dmod_status(char *msg, int state)
512 {
513 	kmdb_modctl_t *kmc;
514 	mdb_var_t *v;
515 	int first = 1, n = 0;
516 
517 	mdb_nv_rewind(&mdb.m_dmodctl);
518 	while ((v = mdb_nv_advance(&mdb.m_dmodctl)) != NULL) {
519 		kmc = MDB_NV_COOKIE(v);
520 
521 		if (kmc->kmc_state != state)
522 			continue;
523 
524 		n++;
525 
526 		if (msg != NULL) {
527 			if (first) {
528 				mdb_printf(msg, NULL);
529 				first = 0;
530 			}
531 
532 			mdb_printf(" %s", kmc->kmc_modname);
533 		}
534 	}
535 
536 	if (!first && msg != NULL)
537 		mdb_printf("\n");
538 
539 	return (n);
540 }
541 
542 /*ARGSUSED*/
543 static int
544 kmt_status_dcmd(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
545 {
546 	kmt_data_t *kmt = mdb.m_target->t_data;
547 	struct utsname uts;
548 	char uuid[37];
549 	kreg_t tt;
550 
551 	if (mdb_tgt_readsym(mdb.m_target, MDB_TGT_AS_VIRT, &uts, sizeof (uts),
552 	    "unix", "utsname") != sizeof (uts)) {
553 		warn("failed to read 'utsname' struct from kernel\n");
554 		bzero(&uts, sizeof (uts));
555 		(void) strcpy(uts.nodename, "unknown machine");
556 	}
557 
558 	mdb_printf("debugging live kernel (%d-bit) on %s\n",
559 	    (int)(sizeof (void *) * NBBY),
560 	    (*uts.nodename == '\0' ? "(not set)" : uts.nodename));
561 	mdb_printf("operating system: %s %s (%s)\n",
562 	    uts.release, uts.version, uts.machine);
563 
564 	if (mdb_tgt_readsym(mdb.m_target, MDB_TGT_AS_VIRT, uuid, sizeof (uuid),
565 	    "genunix", "dump_osimage_uuid") != sizeof (uuid)) {
566 		warn("failed to read 'dump_osimage_uuid' string from kernel\n");
567 		(void) strcpy(uuid, "(error)");
568 	} else if (*uuid == '\0') {
569 		(void) strcpy(uuid, "(not set)");
570 	} else if (uuid[36] != '\0') {
571 		(void) strcpy(uuid, "(invalid)");
572 	}
573 	mdb_printf("image uuid: %s\n", uuid);
574 
575 	if (kmt->kmt_cpu != NULL) {
576 		mdb_printf("CPU-specific support: %s\n",
577 		    kmt_cpu_name(kmt->kmt_cpu));
578 	}
579 
580 	mdb_printf("DTrace state: %s\n", (kmdb_kdi_dtrace_get_state() ==
581 	    KDI_DTSTATE_DTRACE_ACTIVE ? "active (debugger breakpoints cannot "
582 	    "be armed)" : "inactive"));
583 
584 	(void) kmdb_dpi_get_register("tt", &tt);
585 	mdb_printf("stopped on: %s\n", kmt_trapname(tt));
586 
587 	(void) kmt_dmod_status("pending dmod loads:", KMDB_MC_STATE_LOADING);
588 	(void) kmt_dmod_status("pending dmod unloads:",
589 	    KMDB_MC_STATE_UNLOADING);
590 
591 	return (DCMD_OK);
592 }
593 
594 /*ARGSUSED*/
595 static int
596 kmt_switch(uintptr_t addr, uint_t flags, int argc, const mdb_arg_t *argv)
597 {
598 	if (!(flags & DCMD_ADDRSPEC) || argc != 0)
599 		return (DCMD_USAGE);
600 
601 	if (kmdb_dpi_switch_master((int)addr) < 0) {
602 		warn("failed to switch to CPU %d", (int)addr);
603 		return (DCMD_ERR);
604 	}
605 
606 	return (DCMD_OK);
607 }
608 
609 static const mdb_dcmd_t kmt_dcmds[] = {
610 	{ "$c", "?[cnt]", "print stack backtrace", kmt_stack },
611 	{ "$C", "?[cnt]", "print stack backtrace", kmt_stackv },
612 	{ "$r", NULL, "print general-purpose registers", kmt_regs },
613 	{ "$?", NULL, "print status and registers", kmt_regs },
614 	{ ":x", ":", "change the active CPU", kmt_switch },
615 	{ "call", ":[arg ...]", "call a kernel function", kmt_call },
616 	{ "cpustack", "?[-v] [-c cpuid] [cnt]", "print stack backtrace for a "
617 	    "specific CPU", kmt_cpustack_dcmd },
618 	{ "cpuregs", "?[-c cpuid]", "print general-purpose registers for a "
619 	    "specific CPU", kmt_cpuregs },
620 	{ "crumbs", NULL, NULL, kmt_dump_crumbs },
621 #if defined(__i386) || defined(__amd64)
622 	{ "in", ":[-L len]", "read from I/O port", kmt_in_dcmd },
623 	{ "out", ":[-L len] val", "write to I/O port", kmt_out_dcmd },
624 	{ "rdmsr", ":", "read an MSR", kmt_rdmsr },
625 	{ "wrmsr", ": val", "write an MSR", kmt_wrmsr },
626 	{ "rdpcicfg", ": bus dev func", "read a register in PCI config space",
627 	kmt_rdpcicfg },
628 	{ "wrpcicfg", ": bus dev func val", "write a register in PCI config "
629 	"space", kmt_wrpcicfg },
630 #endif
631 	{ "noducttape", NULL, NULL, kmt_noducttape },
632 	{ "regs", NULL, "print general-purpose registers", kmt_regs },
633 	{ "stack", "?[cnt]", "print stack backtrace", kmt_stack },
634 	{ "stackregs", "?", "print stack backtrace and registers", kmt_stackr },
635 	{ "status", NULL, "print summary of current target", kmt_status_dcmd },
636 	{ "switch", ":", "change the active CPU", kmt_switch },
637 	{ NULL }
638 };
639 
640 static uintmax_t
641 kmt_reg_disc_get(const mdb_var_t *v)
642 {
643 	mdb_tgt_reg_t r = 0;
644 
645 	(void) mdb_tgt_getareg(MDB_NV_COOKIE(v), 0, mdb_nv_get_name(v), &r);
646 
647 	return (r);
648 }
649 
650 static void
651 kmt_reg_disc_set(mdb_var_t *v, uintmax_t r)
652 {
653 	if (mdb_tgt_putareg(MDB_NV_COOKIE(v), 0, mdb_nv_get_name(v), r) == -1)
654 		warn("failed to modify %%%s register", mdb_nv_get_name(v));
655 }
656 
657 static const mdb_nv_disc_t kmt_reg_disc = {
658 	kmt_reg_disc_set,
659 	kmt_reg_disc_get
660 };
661 
662 /*ARGSUSED*/
663 static int
664 kmt_getareg(mdb_tgt_t *t, mdb_tgt_tid_t tid, const char *rname,
665     mdb_tgt_reg_t *rp)
666 {
667 	kreg_t val;
668 
669 	if (kmdb_dpi_get_register(rname, &val) < 0)
670 		return (set_errno(EMDB_BADREG));
671 
672 	*rp = val;
673 	return (0);
674 }
675 
676 /*ARGSUSED*/
677 static int
678 kmt_putareg(mdb_tgt_t *t, mdb_tgt_tid_t tid, const char *rname, mdb_tgt_reg_t r)
679 {
680 	if (kmdb_dpi_set_register(rname, r) < 0)
681 		return (set_errno(EMDB_BADREG));
682 
683 	return (0);
684 }
685 
686 static void
687 kmt_mod_destroy(kmt_module_t *km)
688 {
689 	if (km->km_name != NULL)
690 		strfree(km->km_name);
691 	if (km->km_symtab != NULL)
692 		mdb_gelf_symtab_destroy(km->km_symtab);
693 	if (km->km_ctfp != NULL)
694 		mdb_ctf_close(km->km_ctfp);
695 }
696 
697 static kmt_module_t *
698 kmt_mod_create(mdb_tgt_t *t, struct modctl *ctlp, char *name)
699 {
700 	kmt_module_t *km = mdb_zalloc(sizeof (kmt_module_t), UM_SLEEP);
701 	struct module *mod;
702 
703 	km->km_name = mdb_alloc(strlen(name) + 1, UM_SLEEP);
704 	(void) strcpy(km->km_name, name);
705 
706 	bcopy(ctlp, &km->km_modctl, sizeof (struct modctl));
707 
708 	if (mdb_tgt_vread(t, &km->km_module, sizeof (struct module),
709 	    (uintptr_t)km->km_modctl.mod_mp) != sizeof (struct module))
710 		goto create_module_cleanup;
711 	mod = &km->km_module;
712 
713 	if (mod->symhdr != NULL && mod->strhdr != NULL && mod->symtbl != NULL &&
714 	    mod->strings != NULL) {
715 		mdb_gelf_ehdr_to_gehdr(&mod->hdr, &km->km_ehdr);
716 
717 		km->km_symtab = mdb_gelf_symtab_create_raw(&km->km_ehdr,
718 		    mod->symhdr, mod->symtbl, mod->strhdr, mod->strings,
719 		    MDB_TGT_SYMTAB);
720 
721 		km->km_symtab_va = mod->symtbl;
722 		km->km_strtab_va = mod->strings;
723 
724 		if (mdb_tgt_vread(t, &km->km_symtab_hdr, sizeof (Shdr),
725 		    (uintptr_t)mod->symhdr) != sizeof (Shdr) ||
726 		    mdb_tgt_vread(t, &km->km_strtab_hdr, sizeof (Shdr),
727 		    (uintptr_t)mod->strhdr) != sizeof (Shdr))
728 			goto create_module_cleanup;
729 	}
730 
731 	/*
732 	 * We don't want everyone rooting around in the module structure, so we
733 	 * make copies of the interesting members.
734 	 */
735 	km->km_text_va = (uintptr_t)mod->text;
736 	km->km_text_size = mod->text_size;
737 	km->km_data_va = (uintptr_t)mod->data;
738 	km->km_data_size = mod->data_size;
739 	km->km_bss_va = (uintptr_t)mod->bss;
740 	km->km_bss_size = mod->bss_size;
741 	km->km_ctf_va = mod->ctfdata;
742 	km->km_ctf_size = mod->ctfsize;
743 
744 	if (mod->flags & KOBJ_PRIM)
745 		km->km_flags |= KM_F_PRIMARY;
746 
747 	return (km);
748 
749 create_module_cleanup:
750 	warn("failed to read module %s\n", name);
751 	kmt_mod_destroy(km);
752 	return (NULL);
753 }
754 
755 static void
756 kmt_mod_remove(kmt_data_t *kmt, kmt_module_t *km)
757 {
758 	mdb_var_t *v = mdb_nv_lookup(&kmt->kmt_modules, km->km_name);
759 
760 	ASSERT(v != NULL);
761 
762 	mdb_dprintf(MDB_DBG_KMOD, "removing module %s\n", km->km_name);
763 
764 	mdb_list_delete(&kmt->kmt_modlist, km);
765 	mdb_nv_remove(&kmt->kmt_modules, v);
766 	kmt_mod_destroy(km);
767 }
768 
769 static int
770 kmt_modlist_update_cb(struct modctl *modp, void *arg)
771 {
772 	mdb_tgt_t *t = arg;
773 	kmt_data_t *kmt = t->t_data;
774 	kmt_module_t *km;
775 	mdb_var_t *v;
776 	char name[MAXNAMELEN];
777 
778 	if (mdb_tgt_readstr(t, MDB_TGT_AS_VIRT, name, MAXNAMELEN,
779 	    (uintptr_t)modp->mod_modname) <= 0) {
780 		warn("failed to read module name at %p",
781 		    (void *)modp->mod_modname);
782 	}
783 
784 	/* We only care about modules that are actually loaded */
785 	if (!kmdb_kdi_mod_isloaded(modp))
786 		return (0);
787 
788 	/*
789 	 * Skip the modules we already know about and that haven't
790 	 * changed since last time we were here.
791 	 */
792 	if ((v = mdb_nv_lookup(&kmt->kmt_modules, name)) != NULL) {
793 		km = MDB_NV_COOKIE(v);
794 
795 		if (kmdb_kdi_mod_haschanged(&km->km_modctl, &km->km_module,
796 		    modp, modp->mod_mp)) {
797 			/*
798 			 * The module has changed since last we saw it.  For
799 			 * safety, remove our old version, and treat it as a
800 			 * new module.
801 			 */
802 			mdb_dprintf(MDB_DBG_KMOD, "stutter module %s\n", name);
803 			kmt_mod_remove(kmt, km);
804 		} else {
805 			km->km_seen = 1;
806 			return (0);
807 		}
808 	}
809 
810 	mdb_dprintf(MDB_DBG_KMOD, "found new module %s\n", name);
811 
812 	if ((km = kmt_mod_create(t, modp, name)) != NULL) {
813 		mdb_list_append(&kmt->kmt_modlist, km);
814 		(void) mdb_nv_insert(&kmt->kmt_modules, name, NULL,
815 		    (uintptr_t)km, 0);
816 		km->km_seen = 1;
817 	}
818 
819 	return (0);
820 }
821 
822 static void
823 kmt_modlist_update(mdb_tgt_t *t)
824 {
825 	kmt_data_t *kmt = t->t_data;
826 	kmt_module_t *km, *kmn;
827 
828 	if (kmdb_kdi_mod_iter(kmt_modlist_update_cb, t) < 0) {
829 		warn("failed to complete update of kernel module list\n");
830 		return;
831 	}
832 
833 	km = mdb_list_next(&kmt->kmt_modlist);
834 	while (km != NULL) {
835 		kmn = mdb_list_next(km);
836 
837 		if (km->km_seen == 1) {
838 			/* Reset the mark for next time */
839 			km->km_seen = 0;
840 		} else {
841 			/*
842 			 * We didn't see it on the kernel's module list, so
843 			 * remove it from our view of the world.
844 			 */
845 			kmt_mod_remove(kmt, km);
846 		}
847 
848 		km = kmn;
849 	}
850 }
851 
852 static void
853 kmt_periodic(mdb_tgt_t *t)
854 {
855 	(void) mdb_tgt_status(t, &t->t_status);
856 }
857 
858 int
859 kmt_lookup_by_addr(mdb_tgt_t *t, uintptr_t addr, uint_t flags,
860     char *buf, size_t nbytes, GElf_Sym *symp, mdb_syminfo_t *sip)
861 {
862 	kmt_data_t *kmt = t->t_data;
863 	kmt_module_t *km = mdb_list_next(&kmt->kmt_modlist);
864 	kmt_module_t *sym_km = NULL;
865 	kmt_module_t prmod;
866 	GElf_Sym sym;
867 	uint_t symid;
868 	const char *name;
869 
870 	/*
871 	 * We look through the private symbols (if any), then through the module
872 	 * symbols.  We can simplify the loop if we pretend the private symbols
873 	 * come from a module.
874 	 */
875 	if (mdb.m_prsym != NULL) {
876 		bzero(&prmod, sizeof (kmt_module_t));
877 		prmod.km_name = "<<<prmod>>>";
878 		prmod.km_symtab = mdb.m_prsym;
879 		prmod.km_list.ml_next = (mdb_list_t *)km;
880 		km = &prmod;
881 	}
882 
883 	/* Symbol resolution isn't available during initialization */
884 	if (kmdb_dpi_get_state(NULL) == DPI_STATE_INIT)
885 		return (set_errno(EMDB_NOSYM));
886 
887 	for (; km != NULL; km = mdb_list_next(km)) {
888 		if (km != &prmod && !kmt->kmt_symavail)
889 			continue;
890 
891 		if (km->km_symtab == NULL)
892 			continue;
893 
894 		if (mdb_gelf_symtab_lookup_by_addr(km->km_symtab, addr, flags,
895 		    buf, nbytes, symp, &sip->sym_id) != 0 ||
896 		    symp->st_value == 0)
897 			continue;
898 
899 		if (flags & MDB_TGT_SYM_EXACT) {
900 			sym_km = km;
901 			goto found;
902 		}
903 
904 		/*
905 		 * If this is the first match we've found, or if this symbol is
906 		 * closer to the specified address than the last one we found,
907 		 * use it.
908 		 */
909 		if (sym_km == NULL || mdb_gelf_sym_closer(symp, &sym, addr)) {
910 			sym_km = km;
911 			sym = *symp;
912 			symid = sip->sym_id;
913 		}
914 	}
915 
916 	/*
917 	 * kmdb dmods are normal kernel modules, loaded by krtld as such.  To
918 	 * avoid polluting modinfo, and to keep from confusing the module
919 	 * subsystem (many dmods have the same names as real kernel modules),
920 	 * kmdb keeps their modctls separate, and doesn't allow their loading
921 	 * to be broadcast via the krtld module load/unload mechanism.  As a
922 	 * result, kmdb_kvm doesn't find out about them, and can't turn their
923 	 * addresses into symbols.  This can be most inconvenient during
924 	 * debugger faults, as the dmod frames will show up without names.
925 	 * We weren't able to turn the requested address into a symbol, so we'll
926 	 * take a spin through the dmods, trying to match our address against
927 	 * their symbols.
928 	 */
929 	if (sym_km == NULL) {
930 		return (kmdb_module_lookup_by_addr(addr, flags, buf, nbytes,
931 		    symp, sip));
932 	}
933 
934 	*symp = sym;
935 	sip->sym_id = symid;
936 
937 found:
938 	/*
939 	 * Once we've found something, copy the final name into the caller's
940 	 * buffer and prefix it with the load object name if appropriate.
941 	 */
942 	name = mdb_gelf_sym_name(sym_km->km_symtab, symp);
943 
944 	if (sym_km == &prmod) {
945 		if (buf != NULL) {
946 			(void) strncpy(buf, name, nbytes);
947 			buf[nbytes - 1] = '\0';
948 		}
949 		sip->sym_table = MDB_TGT_PRVSYM;
950 	} else {
951 		if (buf != NULL) {
952 			if (sym_km->km_flags & KM_F_PRIMARY) {
953 				(void) strncpy(buf, name, nbytes);
954 				buf[nbytes - 1] = '\0';
955 			} else {
956 				(void) mdb_snprintf(buf, nbytes, "%s`%s",
957 				    sym_km->km_name, name);
958 			}
959 		}
960 		sip->sym_table = MDB_TGT_SYMTAB;
961 	}
962 
963 	return (0);
964 }
965 
966 static int
967 kmt_lookup_by_name(mdb_tgt_t *t, const char *obj, const char *name,
968     GElf_Sym *symp, mdb_syminfo_t *sip)
969 {
970 	kmt_data_t *kmt = t->t_data;
971 	kmt_module_t *km;
972 	mdb_var_t *v;
973 	GElf_Sym sym;
974 	uint_t symid;
975 	int n;
976 
977 	if (!kmt->kmt_symavail)
978 		return (set_errno(EMDB_NOSYM));
979 
980 	switch ((uintptr_t)obj) {
981 	case (uintptr_t)MDB_TGT_OBJ_EXEC:
982 	case (uintptr_t)MDB_TGT_OBJ_EVERY:
983 		km = mdb_list_next(&kmt->kmt_modlist);
984 		n = mdb_nv_size(&kmt->kmt_modules);
985 		break;
986 
987 	case (uintptr_t)MDB_TGT_OBJ_RTLD:
988 		obj = kmt->kmt_rtld_name;
989 		/*FALLTHROUGH*/
990 
991 	default:
992 		/*
993 		 * If this is a request for a dmod symbol, let kmdb_module
994 		 * handle it.
995 		 */
996 		if (obj != NULL && strncmp(obj, "DMOD`", 5) == 0) {
997 			return (kmdb_module_lookup_by_name(obj + 5, name,
998 			    symp, sip));
999 		}
1000 
1001 		if ((v = mdb_nv_lookup(&kmt->kmt_modules, obj)) == NULL)
1002 			return (set_errno(EMDB_NOOBJ));
1003 
1004 		km = mdb_nv_get_cookie(v);
1005 		n = 1;
1006 	}
1007 
1008 	/*
1009 	 * kmdb's kvm target is at a bit of a disadvantage compared to mdb's
1010 	 * kvm target when it comes to global symbol lookups.  mdb has ksyms,
1011 	 * which hides pesky things like symbols that are undefined in unix,
1012 	 * but which are defined in genunix.  We don't have such a facility -
1013 	 * we simply iterate through the modules, looking for a given symbol
1014 	 * in each.  Unless we're careful, we'll return the undef in the
1015 	 * aforementioned case.
1016 	 */
1017 	for (; n > 0; n--, km = mdb_list_next(km)) {
1018 		if (mdb_gelf_symtab_lookup_by_name(km->km_symtab, name,
1019 		    &sym, &symid) == 0 && sym.st_shndx != SHN_UNDEF)
1020 			break;
1021 	}
1022 
1023 	if (n == 0)
1024 		return (set_errno(EMDB_NOSYM));
1025 
1026 found:
1027 	bcopy(&sym, symp, sizeof (GElf_Sym));
1028 	sip->sym_id = symid;
1029 	sip->sym_table = MDB_TGT_SYMTAB;
1030 
1031 	return (0);
1032 }
1033 
1034 static int
1035 kmt_symtab_func(void *data, const GElf_Sym *sym, const char *name, uint_t id)
1036 {
1037 	kmt_symarg_t *arg = data;
1038 
1039 	if (mdb_tgt_sym_match(sym, arg->sym_type)) {
1040 		arg->sym_info.sym_id = id;
1041 
1042 		return (arg->sym_cb(arg->sym_data, sym, name, &arg->sym_info,
1043 		    arg->sym_obj));
1044 	}
1045 
1046 	return (0);
1047 }
1048 
1049 static void
1050 kmt_symtab_iter(mdb_gelf_symtab_t *gst, uint_t type, const char *obj,
1051     mdb_tgt_sym_f *cb, void *p)
1052 {
1053 	kmt_symarg_t arg;
1054 
1055 	arg.sym_cb = cb;
1056 	arg.sym_data = p;
1057 	arg.sym_type = type;
1058 	arg.sym_info.sym_table = gst->gst_tabid;
1059 	arg.sym_obj = obj;
1060 
1061 	mdb_gelf_symtab_iter(gst, kmt_symtab_func, &arg);
1062 }
1063 
1064 static int
1065 kmt_symbol_iter(mdb_tgt_t *t, const char *obj, uint_t which, uint_t type,
1066     mdb_tgt_sym_f *cb, void *data)
1067 {
1068 	kmt_data_t *kmt = t->t_data;
1069 	kmt_module_t *km;
1070 
1071 	mdb_gelf_symtab_t *symtab = NULL;
1072 	mdb_var_t *v;
1073 
1074 	if (which == MDB_TGT_DYNSYM)
1075 		return (set_errno(EMDB_TGTNOTSUP));
1076 
1077 	switch ((uintptr_t)obj) {
1078 	case (uintptr_t)MDB_TGT_OBJ_EXEC:
1079 	case (uintptr_t)MDB_TGT_OBJ_EVERY:
1080 		mdb_nv_rewind(&kmt->kmt_modules);
1081 		while ((v = mdb_nv_advance(&kmt->kmt_modules)) != NULL) {
1082 			km = mdb_nv_get_cookie(v);
1083 
1084 			if (km->km_symtab != NULL) {
1085 				kmt_symtab_iter(km->km_symtab, type,
1086 				    km->km_name, cb, data);
1087 			}
1088 		}
1089 		return (0);
1090 
1091 	case (uintptr_t)MDB_TGT_OBJ_RTLD:
1092 		obj = kmt->kmt_rtld_name;
1093 		/*FALLTHROUGH*/
1094 
1095 	default:
1096 		if (strncmp(obj, "DMOD`", 5) == 0) {
1097 			return (kmdb_module_symbol_iter(obj + 5, type,
1098 			    cb, data));
1099 		}
1100 
1101 		if ((v = mdb_nv_lookup(&kmt->kmt_modules, obj)) == NULL)
1102 			return (set_errno(EMDB_NOOBJ));
1103 		km = mdb_nv_get_cookie(v);
1104 
1105 		symtab = km->km_symtab;
1106 	}
1107 
1108 	if (symtab != NULL)
1109 		kmt_symtab_iter(symtab, type, obj, cb, data);
1110 
1111 	return (0);
1112 }
1113 
1114 static int
1115 kmt_mapping_walk(uintptr_t addr, const void *data, kmt_maparg_t *marg)
1116 {
1117 	/*
1118 	 * This is a bit sketchy but avoids problematic compilation of this
1119 	 * target against the current VM implementation.  Now that we have
1120 	 * vmem, we can make this less broken and more informative by changing
1121 	 * this code to invoke the vmem walker in the near future.
1122 	 */
1123 	const struct kmt_seg {
1124 		caddr_t s_base;
1125 		size_t s_size;
1126 	} *segp = (const struct kmt_seg *)data;
1127 
1128 	mdb_map_t map;
1129 	GElf_Sym sym;
1130 	mdb_syminfo_t info;
1131 
1132 	map.map_base = (uintptr_t)segp->s_base;
1133 	map.map_size = segp->s_size;
1134 	map.map_flags = MDB_TGT_MAP_R | MDB_TGT_MAP_W | MDB_TGT_MAP_X;
1135 
1136 	if (kmt_lookup_by_addr(marg->map_target, addr, MDB_TGT_SYM_EXACT,
1137 	    map.map_name, MDB_TGT_MAPSZ, &sym, &info) == -1) {
1138 
1139 		(void) mdb_iob_snprintf(map.map_name, MDB_TGT_MAPSZ,
1140 		    "%lr", addr);
1141 	}
1142 
1143 	return (marg->map_cb(marg->map_data, &map, map.map_name));
1144 }
1145 
1146 static int
1147 kmt_mapping_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
1148 {
1149 	kmt_maparg_t m;
1150 	uintptr_t kas;
1151 
1152 	m.map_target = t;
1153 	m.map_cb = func;
1154 	m.map_data = private;
1155 
1156 	if ((kas = kmt_read_kas(t)) == NULL)
1157 		return (-1); /* errno is set for us */
1158 
1159 	return (mdb_pwalk("seg", (mdb_walk_cb_t)kmt_mapping_walk, &m, kas));
1160 }
1161 
1162 static const mdb_map_t *
1163 kmt_mod_to_map(kmt_module_t *km, mdb_map_t *map)
1164 {
1165 	(void) strncpy(map->map_name, km->km_name, MDB_TGT_MAPSZ);
1166 	map->map_name[MDB_TGT_MAPSZ - 1] = '\0';
1167 	map->map_base = km->km_text_va;
1168 	map->map_size = km->km_text_size;
1169 	map->map_flags = MDB_TGT_MAP_R | MDB_TGT_MAP_W | MDB_TGT_MAP_X;
1170 
1171 	return (map);
1172 }
1173 
1174 static int
1175 kmt_object_iter(mdb_tgt_t *t, mdb_tgt_map_f *func, void *private)
1176 {
1177 	kmt_data_t *kmt = t->t_data;
1178 	kmt_module_t *km;
1179 	mdb_map_t m;
1180 
1181 	for (km = mdb_list_next(&kmt->kmt_modlist); km != NULL;
1182 	    km = mdb_list_next(km)) {
1183 		if (func(private, kmt_mod_to_map(km, &m), km->km_name) == -1)
1184 			break;
1185 	}
1186 
1187 	return (0);
1188 }
1189 
1190 static const mdb_map_t *
1191 kmt_addr_to_map(mdb_tgt_t *t, uintptr_t addr)
1192 {
1193 	kmt_data_t *kmt = t->t_data;
1194 	kmt_module_t *km;
1195 
1196 	for (km = mdb_list_next(&kmt->kmt_modlist); km != NULL;
1197 	    km = mdb_list_next(km)) {
1198 		if (addr - km->km_text_va < km->km_text_size ||
1199 		    addr - km->km_data_va < km->km_data_size ||
1200 		    addr - km->km_bss_va < km->km_bss_size)
1201 			return (kmt_mod_to_map(km, &kmt->kmt_map));
1202 	}
1203 
1204 	(void) set_errno(EMDB_NOMAP);
1205 	return (NULL);
1206 }
1207 
1208 static kmt_module_t *
1209 kmt_module_by_name(kmt_data_t *kmt, const char *name)
1210 {
1211 	kmt_module_t *km;
1212 
1213 	for (km = mdb_list_next(&kmt->kmt_modlist); km != NULL;
1214 	    km = mdb_list_next(km)) {
1215 		if (strcmp(name, km->km_name) == 0)
1216 			return (km);
1217 	}
1218 
1219 	return (NULL);
1220 }
1221 
1222 static const mdb_map_t *
1223 kmt_name_to_map(mdb_tgt_t *t, const char *name)
1224 {
1225 	kmt_data_t *kmt = t->t_data;
1226 	kmt_module_t *km;
1227 	mdb_map_t m;
1228 
1229 	/*
1230 	 * If name is MDB_TGT_OBJ_EXEC, return the first module on the list,
1231 	 * which will be unix since we keep kmt_modlist in load order.
1232 	 */
1233 	if (name == MDB_TGT_OBJ_EXEC) {
1234 		return (kmt_mod_to_map(mdb_list_next(&kmt->kmt_modlist),
1235 		    &m));
1236 	}
1237 
1238 	if (name == MDB_TGT_OBJ_RTLD)
1239 		name = kmt->kmt_rtld_name;
1240 
1241 	if ((km = kmt_module_by_name(kmt, name)) != NULL)
1242 		return (kmt_mod_to_map(km, &m));
1243 
1244 	(void) set_errno(EMDB_NOOBJ);
1245 	return (NULL);
1246 }
1247 
1248 static ctf_file_t *
1249 kmt_load_ctfdata(mdb_tgt_t *t, kmt_module_t *km)
1250 {
1251 	kmt_data_t *kmt = t->t_data;
1252 	int err;
1253 
1254 	if (km->km_ctfp != NULL)
1255 		return (km->km_ctfp);
1256 
1257 	if (km->km_ctf_va == NULL || km->km_symtab == NULL) {
1258 		(void) set_errno(EMDB_NOCTF);
1259 		return (NULL);
1260 	}
1261 
1262 	if ((km->km_ctfp = mdb_ctf_bufopen(km->km_ctf_va, km->km_ctf_size,
1263 	    km->km_symtab_va, &km->km_symtab_hdr, km->km_strtab_va,
1264 	    &km->km_strtab_hdr, &err)) == NULL) {
1265 		(void) set_errno(ctf_to_errno(err));
1266 		return (NULL);
1267 	}
1268 
1269 	mdb_dprintf(MDB_DBG_KMOD, "loaded %lu bytes of CTF data for %s\n",
1270 	    (ulong_t)km->km_ctf_size, km->km_name);
1271 
1272 	if (ctf_parent_name(km->km_ctfp) != NULL) {
1273 		mdb_var_t *v;
1274 
1275 		if ((v = mdb_nv_lookup(&kmt->kmt_modules,
1276 		    ctf_parent_name(km->km_ctfp))) != NULL) {
1277 			kmt_module_t *pm = mdb_nv_get_cookie(v);
1278 
1279 			if (pm->km_ctfp == NULL)
1280 				(void) kmt_load_ctfdata(t, pm);
1281 
1282 			if (pm->km_ctfp != NULL && ctf_import(km->km_ctfp,
1283 			    pm->km_ctfp) == CTF_ERR) {
1284 				warn("failed to import parent types into "
1285 				    "%s: %s\n", km->km_name,
1286 				    ctf_errmsg(ctf_errno(km->km_ctfp)));
1287 			}
1288 		} else {
1289 			warn("failed to load CTF data for %s - parent %s not "
1290 			    "loaded\n", km->km_name,
1291 			    ctf_parent_name(km->km_ctfp));
1292 		}
1293 	}
1294 
1295 	return (km->km_ctfp);
1296 }
1297 
1298 ctf_file_t *
1299 kmt_addr_to_ctf(mdb_tgt_t *t, uintptr_t addr)
1300 {
1301 	kmt_data_t *kmt = t->t_data;
1302 	kmt_module_t *km;
1303 
1304 	for (km = mdb_list_next(&kmt->kmt_modlist); km != NULL;
1305 	    km = mdb_list_next(km)) {
1306 		if (addr - km->km_text_va < km->km_text_size ||
1307 		    addr - km->km_data_va < km->km_data_size ||
1308 		    addr - km->km_bss_va < km->km_bss_size)
1309 			return (kmt_load_ctfdata(t, km));
1310 	}
1311 
1312 	return (kmdb_module_addr_to_ctf(addr));
1313 }
1314 
1315 ctf_file_t *
1316 kmt_name_to_ctf(mdb_tgt_t *t, const char *name)
1317 {
1318 	kmt_data_t *kt = t->t_data;
1319 	kmt_module_t *km;
1320 
1321 	if (name == MDB_TGT_OBJ_EXEC) {
1322 		name = KMT_CTFPARENT;
1323 	} else if (name == MDB_TGT_OBJ_RTLD) {
1324 		name = kt->kmt_rtld_name;
1325 	} else if (strncmp(name, "DMOD`", 5) == 0) {
1326 		/* Request for CTF data for a DMOD symbol */
1327 		return (kmdb_module_name_to_ctf(name + 5));
1328 	}
1329 
1330 	if ((km = kmt_module_by_name(kt, name)) != NULL)
1331 		return (kmt_load_ctfdata(t, km));
1332 
1333 	(void) set_errno(EMDB_NOOBJ);
1334 	return (NULL);
1335 }
1336 
1337 /*ARGSUSED*/
1338 static int
1339 kmt_status(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
1340 {
1341 	int state;
1342 
1343 	bzero(tsp, sizeof (mdb_tgt_status_t));
1344 
1345 	switch ((state = kmdb_dpi_get_state(NULL))) {
1346 	case DPI_STATE_INIT:
1347 		tsp->st_state = MDB_TGT_RUNNING;
1348 		tsp->st_pc = 0;
1349 		break;
1350 
1351 	case DPI_STATE_STOPPED:
1352 		tsp->st_state = MDB_TGT_STOPPED;
1353 
1354 		(void) kmdb_dpi_get_register("pc", &tsp->st_pc);
1355 		break;
1356 
1357 	case DPI_STATE_FAULTED:
1358 		tsp->st_state = MDB_TGT_STOPPED;
1359 
1360 		(void) kmdb_dpi_get_register("pc", &tsp->st_pc);
1361 
1362 		tsp->st_flags |= MDB_TGT_ISTOP;
1363 		break;
1364 
1365 	case DPI_STATE_LOST:
1366 		tsp->st_state = MDB_TGT_LOST;
1367 
1368 		(void) kmdb_dpi_get_register("pc", &tsp->st_pc);
1369 		break;
1370 	}
1371 
1372 	mdb_dprintf(MDB_DBG_KMOD, "kmt_status, dpi: %d tsp: %d, pc = %p %A\n",
1373 	    state, tsp->st_state, (void *)tsp->st_pc, tsp->st_pc);
1374 
1375 	return (0);
1376 }
1377 
1378 /*
1379  * Invoked when kmt_defbp_enter_debugger is called, this routine activates and
1380  * deactivates deferred breakpoints in response to module load and unload
1381  * events.
1382  */
1383 /*ARGSUSED*/
1384 static void
1385 kmt_defbp_event(mdb_tgt_t *t, int vid, void *private)
1386 {
1387 	if (kmt_defbp_modchg_isload) {
1388 		if (!mdb_tgt_sespec_activate_all(t) &&
1389 		    (mdb.m_flags & MDB_FL_BPTNOSYMSTOP)) {
1390 			/*
1391 			 * We weren't able to activate the breakpoints.
1392 			 * If so requested, we'll return without calling
1393 			 * continue, thus throwing the user into the debugger.
1394 			 */
1395 			return;
1396 		}
1397 
1398 	} else {
1399 		mdb_sespec_t *sep, *nsep;
1400 		const mdb_map_t *map, *bpmap;
1401 		mdb_map_t modmap;
1402 
1403 		if ((map = kmt_addr_to_map(t,
1404 		    (uintptr_t)kmt_defbp_modchg_modctl->mod_text)) == NULL) {
1405 			warn("module unload notification for unknown module %s",
1406 			    kmt_defbp_modchg_modctl->mod_modname);
1407 			return; /* drop into the debugger */
1408 		}
1409 
1410 		bcopy(map, &modmap, sizeof (mdb_map_t));
1411 
1412 		for (sep = mdb_list_next(&t->t_active); sep; sep = nsep) {
1413 			nsep = mdb_list_next(sep);
1414 
1415 			if (sep->se_ops == &kmt_brkpt_ops) {
1416 				kmt_brkpt_t *kb = sep->se_data;
1417 
1418 				if ((bpmap = kmt_addr_to_map(t,
1419 				    kb->kb_addr)) == NULL ||
1420 				    (bpmap->map_base == modmap.map_base &&
1421 				    bpmap->map_size == modmap.map_size)) {
1422 					mdb_tgt_sespec_idle_one(t, sep,
1423 					    EMDB_NOMAP);
1424 				}
1425 			}
1426 		}
1427 	}
1428 
1429 	(void) mdb_tgt_continue(t, NULL);
1430 }
1431 
1432 static void
1433 kmt_defbp_enter_debugger(void)
1434 {
1435 	/*
1436 	 * The debugger places a breakpoint here.  We can't have a simple
1437 	 * nop function here, because GCC knows much more than we do, and
1438 	 * will optimize away the call to it.
1439 	 */
1440 	(void) get_fp();
1441 }
1442 
1443 /*
1444  * This routine is called while the kernel is running.  It attempts to determine
1445  * whether any deferred breakpoints exist for the module being changed (loaded
1446  * or unloaded).  If any such breakpoints exist, the debugger will be entered to
1447  * process them.
1448  */
1449 static void
1450 kmt_defbp_modchg(struct modctl *mctl, int isload)
1451 {
1452 	kmt_defbp_t *dbp;
1453 
1454 	kmt_defbp_lock = 1;
1455 
1456 	for (dbp = mdb_list_next(&kmt_defbp_list); dbp;
1457 	    dbp = mdb_list_next(dbp)) {
1458 		if (!dbp->dbp_ref)
1459 			continue;
1460 
1461 		if (strcmp(mctl->mod_modname, dbp->dbp_objname) == 0) {
1462 			/*
1463 			 * Activate the breakpoint
1464 			 */
1465 			kmt_defbp_modchg_isload = isload;
1466 			kmt_defbp_modchg_modctl = mctl;
1467 
1468 			kmt_defbp_enter_debugger();
1469 			break;
1470 		}
1471 	}
1472 
1473 	kmt_defbp_lock = 0;
1474 }
1475 
1476 /*ARGSUSED*/
1477 static int
1478 kmt_continue(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
1479 {
1480 	int n;
1481 
1482 	kmdb_dpi_resume();
1483 
1484 	/*
1485 	 * The order of the following two calls is important.  If there are
1486 	 * load acks on the work queue, we'll initialize the dmods they
1487 	 * represent.  This will involve a call to _mdb_init, which may very
1488 	 * well result in a symbol lookup.  If we haven't resynced our view
1489 	 * of symbols with the current state of the world, this lookup could
1490 	 * end very badly.  We therefore make sure to sync before processing
1491 	 * the work queue.
1492 	 */
1493 	kmt_sync(t);
1494 	kmdb_dpi_process_work_queue();
1495 
1496 	if (kmdb_kdi_get_unload_request())
1497 		t->t_flags |= MDB_TGT_F_UNLOAD;
1498 
1499 	(void) mdb_tgt_status(t, &t->t_status);
1500 
1501 	if ((n = kmt_dmod_status(NULL, KMDB_MC_STATE_LOADING) +
1502 	    kmt_dmod_status(NULL, KMDB_MC_STATE_UNLOADING)) != 0) {
1503 		mdb_warn("%d dmod load%c/unload%c pending\n", n,
1504 		    "s"[n == 1], "s"[n == 1]);
1505 	}
1506 
1507 	return (0);
1508 }
1509 
1510 /*ARGSUSED*/
1511 static int
1512 kmt_step(mdb_tgt_t *t, mdb_tgt_status_t *tsp)
1513 {
1514 	int rc;
1515 
1516 	if ((rc = kmdb_dpi_step()) == 0)
1517 		(void) mdb_tgt_status(t, &t->t_status);
1518 
1519 	return (rc);
1520 }
1521 
1522 static int
1523 kmt_defbp_activate(mdb_tgt_t *t)
1524 {
1525 	kmdb_dpi_modchg_register(kmt_defbp_modchg);
1526 
1527 	/*
1528 	 * The routines that add and arm breakpoints will check for the proper
1529 	 * DTrace state, but they'll just put this breakpoint on the idle list
1530 	 * if DTrace is active.  It'll correctly move to the active list when
1531 	 * DTrace deactivates, but that's insufficient for our purposes -- we
1532 	 * need to do extra processing at that point.  We won't get to do said
1533 	 * processing with with a normal idle->active transition, so we just
1534 	 * won't add it add it until we're sure that it'll stick.
1535 	 */
1536 
1537 	if (kmdb_kdi_dtrace_get_state() == KDI_DTSTATE_DTRACE_ACTIVE)
1538 		return (set_errno(EMDB_DTACTIVE));
1539 
1540 	kmt_defbp_bpspec = mdb_tgt_add_vbrkpt(t,
1541 	    (uintptr_t)kmt_defbp_enter_debugger,
1542 	    MDB_TGT_SPEC_HIDDEN, kmt_defbp_event, NULL);
1543 
1544 	return (0);
1545 }
1546 
1547 static void
1548 kmt_defbp_deactivate(mdb_tgt_t *t)
1549 {
1550 	kmdb_dpi_modchg_cancel();
1551 
1552 	if (kmt_defbp_bpspec != 0) {
1553 		if (t != NULL)
1554 			(void) mdb_tgt_vespec_delete(t, kmt_defbp_bpspec);
1555 
1556 		kmt_defbp_bpspec = 0;
1557 	}
1558 }
1559 
1560 static kmt_defbp_t *
1561 kmt_defbp_create(mdb_tgt_t *t, const char *objname, const char *symname)
1562 {
1563 	kmt_defbp_t *dbp = mdb_alloc(sizeof (kmt_defbp_t), UM_SLEEP);
1564 
1565 	mdb_dprintf(MDB_DBG_KMOD, "defbp_create %s`%s\n", objname, symname);
1566 
1567 	dbp->dbp_objname = strdup(objname);
1568 	dbp->dbp_symname = strdup(symname);
1569 	dbp->dbp_ref = 1;
1570 
1571 	kmt_defbp_num++;
1572 
1573 	if (kmt_defbp_num == 1 || kmt_defbp_bpspec == 0) {
1574 		if (kmt_defbp_activate(t) < 0)
1575 			warn("failed to activate deferred breakpoints");
1576 	}
1577 
1578 	mdb_list_append(&kmt_defbp_list, dbp);
1579 
1580 	return (dbp);
1581 }
1582 
1583 static void
1584 kmt_defbp_destroy(kmt_defbp_t *dbp)
1585 {
1586 	mdb_dprintf(MDB_DBG_KMOD, "defbp_destroy %s`%s\n", dbp->dbp_objname,
1587 	    dbp->dbp_symname);
1588 
1589 	mdb_list_delete(&kmt_defbp_list, dbp);
1590 
1591 	strfree(dbp->dbp_objname);
1592 	strfree(dbp->dbp_symname);
1593 	mdb_free(dbp, sizeof (kmt_defbp_t));
1594 }
1595 
1596 static void
1597 kmt_defbp_prune_common(int all)
1598 {
1599 	kmt_defbp_t *dbp, *ndbp;
1600 
1601 	/* We can't remove items from the list while the driver is using it. */
1602 	if (kmt_defbp_lock)
1603 		return;
1604 
1605 	for (dbp = mdb_list_next(&kmt_defbp_list); dbp != NULL; dbp = ndbp) {
1606 		ndbp = mdb_list_next(dbp);
1607 
1608 		if (!all && dbp->dbp_ref)
1609 			continue;
1610 
1611 		kmt_defbp_destroy(dbp);
1612 	}
1613 }
1614 
1615 static void
1616 kmt_defbp_prune(void)
1617 {
1618 	kmt_defbp_prune_common(0);
1619 }
1620 
1621 static void
1622 kmt_defbp_destroy_all(void)
1623 {
1624 	kmt_defbp_prune_common(1);
1625 }
1626 
1627 static void
1628 kmt_defbp_delete(mdb_tgt_t *t, kmt_defbp_t *dbp)
1629 {
1630 	dbp->dbp_ref = 0;
1631 
1632 	ASSERT(kmt_defbp_num > 0);
1633 	kmt_defbp_num--;
1634 
1635 	if (kmt_defbp_num == 0)
1636 		kmt_defbp_deactivate(t);
1637 
1638 	kmt_defbp_prune();
1639 }
1640 
1641 static int
1642 kmt_brkpt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
1643 {
1644 	mdb_tgt_status_t tsp;
1645 	kmt_bparg_t *ka = args;
1646 	kmt_brkpt_t *kb;
1647 	GElf_Sym s;
1648 	mdb_instr_t instr;
1649 
1650 	(void) mdb_tgt_status(t, &tsp);
1651 	if (tsp.st_state != MDB_TGT_RUNNING && tsp.st_state != MDB_TGT_STOPPED)
1652 		return (set_errno(EMDB_NOPROC));
1653 
1654 	if (ka->ka_symbol != NULL) {
1655 		if (mdb_tgt_lookup_by_scope(t, ka->ka_symbol, &s, NULL) == -1) {
1656 			if (errno != EMDB_NOOBJ && !(errno == EMDB_NOSYM &&
1657 			    !(mdb.m_flags & MDB_FL_BPTNOSYMSTOP))) {
1658 				warn("breakpoint %s activation failed",
1659 				    ka->ka_symbol);
1660 			}
1661 			return (-1); /* errno is set for us */
1662 		}
1663 
1664 		ka->ka_addr = (uintptr_t)s.st_value;
1665 	}
1666 
1667 #ifdef __sparc
1668 	if (ka->ka_addr & 3)
1669 		return (set_errno(EMDB_BPALIGN));
1670 #endif
1671 
1672 	if (mdb_vread(&instr, sizeof (instr), ka->ka_addr) != sizeof (instr))
1673 		return (-1); /* errno is set for us */
1674 
1675 	if (kmdb_kdi_dtrace_get_state() == KDI_DTSTATE_DTRACE_ACTIVE)
1676 		warn("breakpoint will not arm until DTrace is inactive\n");
1677 
1678 	kb = mdb_zalloc(sizeof (kmt_brkpt_t), UM_SLEEP);
1679 	kb->kb_addr = ka->ka_addr;
1680 	sep->se_data = kb;
1681 
1682 	return (0);
1683 }
1684 
1685 /*ARGSUSED*/
1686 static void
1687 kmt_brkpt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
1688 {
1689 	mdb_free(sep->se_data, sizeof (kmt_brkpt_t));
1690 }
1691 
1692 /*ARGSUSED*/
1693 static char *
1694 kmt_brkpt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
1695     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
1696 {
1697 	uintptr_t addr = NULL;
1698 
1699 	if (vep != NULL) {
1700 		kmt_bparg_t *ka = vep->ve_args;
1701 
1702 		if (ka->ka_symbol != NULL) {
1703 			(void) mdb_iob_snprintf(buf, nbytes, "stop at %s",
1704 			    ka->ka_symbol);
1705 		} else {
1706 			(void) mdb_iob_snprintf(buf, nbytes, "stop at %a",
1707 			    ka->ka_addr);
1708 			addr = ka->ka_addr;
1709 		}
1710 
1711 	} else {
1712 		addr = ((kmt_brkpt_t *)sep->se_data)->kb_addr;
1713 		(void) mdb_iob_snprintf(buf, nbytes, "stop at %a", addr);
1714 	}
1715 
1716 	sp->spec_base = addr;
1717 	sp->spec_size = sizeof (mdb_instr_t);
1718 
1719 	return (buf);
1720 }
1721 
1722 static int
1723 kmt_brkpt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
1724 {
1725 	kmt_brkpt_t *kb = sep->se_data;
1726 	kmt_bparg_t *ka = args;
1727 	GElf_Sym sym;
1728 
1729 	if (ka->ka_symbol != NULL) {
1730 		return (mdb_tgt_lookup_by_scope(t, ka->ka_symbol,
1731 		    &sym, NULL) == 0 && sym.st_value == kb->kb_addr);
1732 	}
1733 
1734 	return (ka->ka_addr == kb->kb_addr);
1735 }
1736 
1737 /*ARGSUSED*/
1738 static int
1739 kmt_brkpt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
1740 {
1741 	kmt_bparg_t *ka1 = vep->ve_args;
1742 	kmt_bparg_t *ka2 = args;
1743 
1744 	if (ka1->ka_symbol != NULL && ka2->ka_symbol != NULL)
1745 		return (strcmp(ka1->ka_symbol, ka2->ka_symbol) == 0);
1746 
1747 	if (ka1->ka_symbol == NULL && ka2->ka_symbol == NULL)
1748 		return (ka1->ka_addr == ka2->ka_addr);
1749 
1750 	return (0); /* fail if one is symbolic, other is an explicit address */
1751 }
1752 
1753 static int
1754 kmt_brkpt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
1755 {
1756 	kmt_data_t *kmt = t->t_data;
1757 	kmt_brkpt_t *kb = sep->se_data;
1758 	int rv;
1759 
1760 	if (kmdb_kdi_dtrace_get_state() == KDI_DTSTATE_DTRACE_ACTIVE)
1761 		return (set_errno(EMDB_DTACTIVE));
1762 
1763 	if ((rv = kmdb_dpi_brkpt_arm(kb->kb_addr, &kb->kb_oinstr)) != 0)
1764 		return (rv);
1765 
1766 	if (kmt->kmt_narmedbpts++ == 0)
1767 		(void) kmdb_kdi_dtrace_set(KDI_DTSET_KMDB_BPT_ACTIVATE);
1768 
1769 	return (0);
1770 }
1771 
1772 static int
1773 kmt_brkpt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
1774 {
1775 	kmt_data_t *kmt = t->t_data;
1776 	kmt_brkpt_t *kb = sep->se_data;
1777 	int rv;
1778 
1779 	ASSERT(kmdb_kdi_dtrace_get_state() == KDI_DTSTATE_KMDB_BPT_ACTIVE);
1780 
1781 	if ((rv = kmdb_dpi_brkpt_disarm(kb->kb_addr, kb->kb_oinstr)) != 0)
1782 		return (rv);
1783 
1784 	if (--kmt->kmt_narmedbpts == 0)
1785 		(void) kmdb_kdi_dtrace_set(KDI_DTSET_KMDB_BPT_DEACTIVATE);
1786 
1787 	return (0);
1788 }
1789 
1790 /*
1791  * Determine whether the specified sespec is an armed watchpoint that overlaps
1792  * with the given breakpoint and has the given flags set.  We use this to find
1793  * conflicts with breakpoints, below.
1794  */
1795 static int
1796 kmt_wp_overlap(mdb_sespec_t *sep, kmt_brkpt_t *kb, int flags)
1797 {
1798 	const kmdb_wapt_t *wp = sep->se_data;
1799 
1800 	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
1801 	    sep->se_ops == &kmt_wapt_ops && (wp->wp_wflags & flags) &&
1802 	    kb->kb_addr - wp->wp_addr < wp->wp_size);
1803 }
1804 
1805 /*
1806  * We step over breakpoints using our single-stepper.  If a conflicting
1807  * watchpoint is present, we must temporarily remove it before stepping over the
1808  * breakpoint so we don't immediately re-trigger the watchpoint.  We know the
1809  * watchpoint has already triggered on our trap instruction as part of fetching
1810  * it.  Before we return, we must re-install any disabled watchpoints.
1811  */
1812 static int
1813 kmt_brkpt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
1814 {
1815 	kmt_brkpt_t *kb = sep->se_data;
1816 	int status = -1;
1817 	int error;
1818 
1819 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
1820 		if (kmt_wp_overlap(sep, kb, MDB_TGT_WA_X))
1821 			(void) kmdb_dpi_wapt_disarm(sep->se_data);
1822 	}
1823 
1824 	if (kmdb_dpi_brkpt_disarm(kb->kb_addr, kb->kb_oinstr) == 0 &&
1825 	    kmt_step(t, tsp) == 0)
1826 		status = kmt_status(t, tsp);
1827 
1828 	error = errno; /* save errno from disarm, step, or status */
1829 
1830 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
1831 		if (kmt_wp_overlap(sep, kb, MDB_TGT_WA_X))
1832 			kmdb_dpi_wapt_arm(sep->se_data);
1833 	}
1834 
1835 	(void) set_errno(error);
1836 	return (status);
1837 }
1838 
1839 /*ARGSUSED*/
1840 static int
1841 kmt_brkpt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
1842 {
1843 	kmt_brkpt_t *kb = sep->se_data;
1844 	int state, why;
1845 	kreg_t pc;
1846 
1847 	state = kmdb_dpi_get_state(&why);
1848 	(void) kmdb_dpi_get_register("pc", &pc);
1849 
1850 	return (state == DPI_STATE_FAULTED && why == DPI_STATE_WHY_BKPT &&
1851 	    pc == kb->kb_addr);
1852 }
1853 
1854 static const mdb_se_ops_t kmt_brkpt_ops = {
1855 	kmt_brkpt_ctor,		/* se_ctor */
1856 	kmt_brkpt_dtor,		/* se_dtor */
1857 	kmt_brkpt_info,		/* se_info */
1858 	kmt_brkpt_secmp,	/* se_secmp */
1859 	kmt_brkpt_vecmp,	/* se_vecmp */
1860 	kmt_brkpt_arm,		/* se_arm */
1861 	kmt_brkpt_disarm,	/* se_disarm */
1862 	kmt_brkpt_cont,		/* se_cont */
1863 	kmt_brkpt_match		/* se_match */
1864 };
1865 
1866 static int
1867 kmt_wapt_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
1868 {
1869 	mdb_tgt_status_t tsp;
1870 	kmdb_wapt_t *vwp = args;
1871 	kmdb_wapt_t *swp;
1872 
1873 	(void) mdb_tgt_status(t, &tsp);
1874 	if (tsp.st_state != MDB_TGT_RUNNING && tsp.st_state != MDB_TGT_STOPPED)
1875 		return (set_errno(EMDB_NOPROC));
1876 
1877 	swp = mdb_alloc(sizeof (kmdb_wapt_t), UM_SLEEP);
1878 	bcopy(vwp, swp, sizeof (kmdb_wapt_t));
1879 
1880 	if (kmdb_dpi_wapt_reserve(swp) < 0) {
1881 		mdb_free(swp, sizeof (kmdb_wapt_t));
1882 		return (-1); /* errno is set for us */
1883 	}
1884 
1885 	sep->se_data = swp;
1886 
1887 	return (0);
1888 }
1889 
1890 /*ARGSUSED*/
1891 static void
1892 kmt_wapt_dtor(mdb_tgt_t *t, mdb_sespec_t *sep)
1893 {
1894 	kmdb_wapt_t *wp = sep->se_data;
1895 
1896 	kmdb_dpi_wapt_release(wp);
1897 	mdb_free(wp, sizeof (kmdb_wapt_t));
1898 }
1899 
1900 /*ARGSUSED*/
1901 static char *
1902 kmt_wapt_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
1903     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
1904 {
1905 	kmdb_wapt_t *wp = vep != NULL ? vep->ve_args : sep->se_data;
1906 	const char *fmt;
1907 	char desc[24];
1908 
1909 	ASSERT(wp->wp_wflags != 0);
1910 	desc[0] = '\0';
1911 
1912 	switch (wp->wp_wflags) {
1913 	case MDB_TGT_WA_R:
1914 		(void) strcat(desc, "/read");
1915 		break;
1916 	case MDB_TGT_WA_W:
1917 		(void) strcat(desc, "/write");
1918 		break;
1919 	case MDB_TGT_WA_X:
1920 		(void) strcat(desc, "/exec");
1921 		break;
1922 	default:
1923 		if (wp->wp_wflags & MDB_TGT_WA_R)
1924 			(void) strcat(desc, "/r");
1925 		if (wp->wp_wflags & MDB_TGT_WA_W)
1926 			(void) strcat(desc, "/w");
1927 		if (wp->wp_wflags & MDB_TGT_WA_X)
1928 			(void) strcat(desc, "/x");
1929 	}
1930 
1931 	switch (wp->wp_type) {
1932 	case DPI_WAPT_TYPE_PHYS:
1933 		fmt = "stop on %s of phys [%p, %p)";
1934 		break;
1935 
1936 	case DPI_WAPT_TYPE_VIRT:
1937 		fmt = "stop on %s of [%la, %la)";
1938 		break;
1939 
1940 	case DPI_WAPT_TYPE_IO:
1941 		if (wp->wp_size == 1)
1942 			fmt = "stop on %s of I/O port %p";
1943 		else
1944 			fmt = "stop on %s of I/O port [%p, %p)";
1945 		break;
1946 	}
1947 
1948 	(void) mdb_iob_snprintf(buf, nbytes, fmt, desc + 1, wp->wp_addr,
1949 	    wp->wp_addr + wp->wp_size);
1950 
1951 	sp->spec_base = wp->wp_addr;
1952 	sp->spec_size = wp->wp_size;
1953 
1954 	return (buf);
1955 }
1956 
1957 /*ARGSUSED*/
1958 static int
1959 kmt_wapt_secmp(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
1960 {
1961 	kmdb_wapt_t *wp1 = sep->se_data;
1962 	kmdb_wapt_t *wp2 = args;
1963 
1964 	return (wp1->wp_addr == wp2->wp_addr && wp1->wp_size == wp2->wp_size &&
1965 	    wp1->wp_wflags == wp2->wp_wflags);
1966 }
1967 
1968 /*ARGSUSED*/
1969 static int
1970 kmt_wapt_vecmp(mdb_tgt_t *t, mdb_vespec_t *vep, void *args)
1971 {
1972 	kmdb_wapt_t *wp1 = vep->ve_args;
1973 	kmdb_wapt_t *wp2 = args;
1974 
1975 	return (wp1->wp_addr == wp2->wp_addr && wp1->wp_size == wp2->wp_size &&
1976 	    wp1->wp_wflags == wp2->wp_wflags);
1977 }
1978 
1979 /*ARGSUSED*/
1980 static int
1981 kmt_wapt_arm(mdb_tgt_t *t, mdb_sespec_t *sep)
1982 {
1983 	kmdb_dpi_wapt_arm(sep->se_data);
1984 
1985 	return (0);
1986 }
1987 
1988 /*ARGSUSED*/
1989 static int
1990 kmt_wapt_disarm(mdb_tgt_t *t, mdb_sespec_t *sep)
1991 {
1992 	kmdb_dpi_wapt_disarm(sep->se_data);
1993 
1994 	return (0);
1995 }
1996 
1997 /*
1998  * Determine whether the specified sespec is an armed breakpoint at the given
1999  * %pc.  We use this to find conflicts with watchpoints below.
2000  */
2001 static int
2002 kmt_bp_overlap(mdb_sespec_t *sep, uintptr_t pc)
2003 {
2004 	kmt_brkpt_t *kb = sep->se_data;
2005 
2006 	return (sep->se_state == MDB_TGT_SPEC_ARMED &&
2007 	    sep->se_ops == &kmt_brkpt_ops && kb->kb_addr == pc);
2008 }
2009 
2010 /*
2011  * We step over watchpoints using our single-stepper.  If a conflicting
2012  * breakpoint is present, we must temporarily disarm it before stepping over
2013  * the watchpoint so we do not immediately re-trigger the breakpoint.  This is
2014  * similar to the case handled in kmt_brkpt_cont(), above.
2015  */
2016 static int
2017 kmt_wapt_cont(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
2018 {
2019 	mdb_sespec_t *bep = NULL;
2020 	int status = -1;
2021 	int error, why;
2022 
2023 	/*
2024 	 * If we stopped for anything other than a watchpoint, check to see
2025 	 * if there's a breakpoint here.
2026 	 */
2027 	if (!(kmdb_dpi_get_state(&why) == DPI_STATE_FAULTED &&
2028 	    (why == DPI_STATE_WHY_V_WAPT || why == DPI_STATE_WHY_P_WAPT))) {
2029 		kreg_t pc;
2030 
2031 		(void) kmdb_dpi_get_register("pc", &pc);
2032 
2033 		for (bep = mdb_list_next(&t->t_active); bep != NULL;
2034 		    bep = mdb_list_next(bep)) {
2035 			if (kmt_bp_overlap(bep, pc)) {
2036 				(void) bep->se_ops->se_disarm(t, bep);
2037 				bep->se_state = MDB_TGT_SPEC_ACTIVE;
2038 				break;
2039 			}
2040 		}
2041 	}
2042 
2043 	kmdb_dpi_wapt_disarm(sep->se_data);
2044 	if (kmt_step(t, tsp) == 0)
2045 		status = kmt_status(t, tsp);
2046 
2047 	error = errno; /* save errno from step or status */
2048 
2049 	if (bep != NULL)
2050 		mdb_tgt_sespec_arm_one(t, bep);
2051 
2052 	(void) set_errno(error);
2053 	return (status);
2054 }
2055 
2056 /*ARGSUSED*/
2057 static int
2058 kmt_wapt_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
2059 {
2060 	return (kmdb_dpi_wapt_match(sep->se_data));
2061 }
2062 
2063 static const mdb_se_ops_t kmt_wapt_ops = {
2064 	kmt_wapt_ctor,		/* se_ctor */
2065 	kmt_wapt_dtor,		/* se_dtor */
2066 	kmt_wapt_info,		/* se_info */
2067 	kmt_wapt_secmp,		/* se_secmp */
2068 	kmt_wapt_vecmp,		/* se_vecmp */
2069 	kmt_wapt_arm,		/* se_arm */
2070 	kmt_wapt_disarm,	/* se_disarm */
2071 	kmt_wapt_cont,		/* se_cont */
2072 	kmt_wapt_match		/* se_match */
2073 };
2074 
2075 /*ARGSUSED*/
2076 static int
2077 kmt_trap_ctor(mdb_tgt_t *t, mdb_sespec_t *sep, void *args)
2078 {
2079 	sep->se_data = args; /* trap number */
2080 
2081 	return (0);
2082 }
2083 
2084 /*ARGSUSED*/
2085 static char *
2086 kmt_trap_info(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_vespec_t *vep,
2087     mdb_tgt_spec_desc_t *sp, char *buf, size_t nbytes)
2088 {
2089 	const char *name;
2090 	int trapnum;
2091 
2092 	if (vep != NULL)
2093 		trapnum = (intptr_t)vep->ve_args;
2094 	else
2095 		trapnum = (intptr_t)sep->se_data;
2096 
2097 	if (trapnum == KMT_TRAP_ALL)
2098 		name = "any trap";
2099 	else if (trapnum == KMT_TRAP_NOTENUM)
2100 		name = "miscellaneous trap";
2101 	else
2102 		name = kmt_trapname(trapnum);
2103 
2104 	(void) mdb_iob_snprintf(buf, nbytes, "single-step stop on %s", name);
2105 
2106 	return (buf);
2107 }
2108 
2109 /*ARGSUSED2*/
2110 static int
2111 kmt_trap_match(mdb_tgt_t *t, mdb_sespec_t *sep, mdb_tgt_status_t *tsp)
2112 {
2113 	int spectt = (intptr_t)sep->se_data;
2114 	kmt_data_t *kmt = t->t_data;
2115 	kreg_t tt;
2116 
2117 	(void) kmdb_dpi_get_register("tt", &tt);
2118 
2119 	switch (spectt) {
2120 	case KMT_TRAP_ALL:
2121 		return (1);
2122 	case KMT_TRAP_NOTENUM:
2123 		return (tt > kmt->kmt_trapmax ||
2124 		    !BT_TEST(kmt->kmt_trapmap, tt));
2125 	default:
2126 		return (tt == spectt);
2127 	}
2128 }
2129 
2130 static const mdb_se_ops_t kmt_trap_ops = {
2131 	kmt_trap_ctor,		/* se_ctor */
2132 	no_se_dtor,		/* se_dtor */
2133 	kmt_trap_info,		/* se_info */
2134 	no_se_secmp,		/* se_secmp */
2135 	no_se_vecmp,		/* se_vecmp */
2136 	no_se_arm,		/* se_arm */
2137 	no_se_disarm,		/* se_disarm */
2138 	no_se_cont,		/* se_cont */
2139 	kmt_trap_match		/* se_match */
2140 };
2141 
2142 static void
2143 kmt_bparg_dtor(mdb_vespec_t *vep)
2144 {
2145 	kmt_bparg_t *ka = vep->ve_args;
2146 
2147 	if (ka->ka_symbol != NULL)
2148 		strfree(ka->ka_symbol);
2149 
2150 	if (ka->ka_defbp != NULL)
2151 		kmt_defbp_delete(mdb.m_target, ka->ka_defbp);
2152 
2153 	mdb_free(ka, sizeof (kmt_bparg_t));
2154 }
2155 
2156 static int
2157 kmt_add_vbrkpt(mdb_tgt_t *t, uintptr_t addr,
2158     int spec_flags, mdb_tgt_se_f *func, void *data)
2159 {
2160 	kmt_bparg_t *ka = mdb_alloc(sizeof (kmt_bparg_t), UM_SLEEP);
2161 
2162 	ka->ka_addr = addr;
2163 	ka->ka_symbol = NULL;
2164 	ka->ka_defbp = NULL;
2165 
2166 	return (mdb_tgt_vespec_insert(t, &kmt_brkpt_ops, spec_flags,
2167 	    func, data, ka, kmt_bparg_dtor));
2168 }
2169 
2170 static int
2171 kmt_add_sbrkpt(mdb_tgt_t *t, const char *fullname,
2172     int spec_flags, mdb_tgt_se_f *func, void *data)
2173 {
2174 	kmt_bparg_t *ka;
2175 	kmt_defbp_t *dbp;
2176 	GElf_Sym sym;
2177 	char *tick, *objname, *symname;
2178 	int serrno;
2179 
2180 	if ((tick = strchr(fullname, '`')) == fullname) {
2181 		(void) set_errno(EMDB_NOOBJ);
2182 		return (0);
2183 	}
2184 
2185 	/*
2186 	 * Deferred breakpoints are always scoped.  If we didn't find a tick,
2187 	 * there's no scope.  We'll create a vbrkpt, but only if we can turn the
2188 	 * provided string into an address.
2189 	 */
2190 	if (tick == NULL) {
2191 		uintptr_t addr;
2192 
2193 		if (strisbasenum(fullname)) {
2194 			addr = mdb_strtoull(fullname); /* a bare address */
2195 		} else if (mdb_tgt_lookup_by_name(t, MDB_TGT_OBJ_EVERY,
2196 		    fullname, &sym, NULL) < 0) {
2197 			(void) set_errno(EMDB_NOSYM);
2198 			return (0);
2199 		} else {
2200 			addr = (uintptr_t)sym.st_value; /* unscoped sym name */
2201 		}
2202 
2203 		return (kmt_add_vbrkpt(t, addr, spec_flags, func, data));
2204 	}
2205 
2206 	if (*(tick + 1) == '\0') {
2207 		(void) set_errno(EMDB_NOSYM);
2208 		return (0);
2209 	}
2210 
2211 	objname = strndup(fullname, tick - fullname);
2212 	symname = tick + 1;
2213 
2214 	if (mdb_tgt_lookup_by_name(t, objname, symname, NULL, NULL) < 0 &&
2215 	    errno != EMDB_NOOBJ) {
2216 		serrno = errno;
2217 		strfree(objname);
2218 
2219 		(void) set_errno(serrno);
2220 		return (0); /* errno is set for us */
2221 	}
2222 
2223 	dbp = kmt_defbp_create(t, objname, symname);
2224 	strfree(objname);
2225 
2226 	ka = mdb_alloc(sizeof (kmt_bparg_t), UM_SLEEP);
2227 	ka->ka_symbol = strdup(fullname);
2228 	ka->ka_addr = NULL;
2229 	ka->ka_defbp = dbp;
2230 
2231 	return (mdb_tgt_vespec_insert(t, &kmt_brkpt_ops, spec_flags,
2232 	    func, data, ka, kmt_bparg_dtor));
2233 }
2234 
2235 static int
2236 kmt_wparg_overlap(const kmdb_wapt_t *wp1, const kmdb_wapt_t *wp2)
2237 {
2238 	/* Assume the watchpoint spaces don't overlap */
2239 	if (wp1->wp_type != wp2->wp_type)
2240 		return (0);
2241 
2242 	if (wp2->wp_addr + wp2->wp_size <= wp1->wp_addr)
2243 		return (0); /* no range overlap */
2244 
2245 	if (wp1->wp_addr + wp1->wp_size <= wp2->wp_addr)
2246 		return (0); /* no range overlap */
2247 
2248 	return (wp1->wp_addr != wp2->wp_addr || wp1->wp_size != wp2->wp_size ||
2249 	    wp1->wp_wflags != wp2->wp_wflags);
2250 }
2251 
2252 static void
2253 kmt_wparg_dtor(mdb_vespec_t *vep)
2254 {
2255 	mdb_free(vep->ve_args, sizeof (kmdb_wapt_t));
2256 }
2257 
2258 static int
2259 kmt_add_wapt_common(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
2260     int spec_flags, mdb_tgt_se_f *func, void *data, int type)
2261 {
2262 	kmdb_wapt_t *wp = mdb_alloc(sizeof (kmdb_wapt_t), UM_SLEEP);
2263 	mdb_sespec_t *sep;
2264 
2265 	wp->wp_addr = addr;
2266 	wp->wp_size = len;
2267 	wp->wp_type = type;
2268 	wp->wp_wflags = wflags;
2269 
2270 	if (kmdb_dpi_wapt_validate(wp) < 0)
2271 		return (0); /* errno is set for us */
2272 
2273 	for (sep = mdb_list_next(&t->t_active); sep; sep = mdb_list_next(sep)) {
2274 		if (sep->se_ops == &kmt_wapt_ops &&
2275 		    mdb_list_next(&sep->se_velist) != NULL &&
2276 		    kmt_wparg_overlap(wp, sep->se_data))
2277 			goto wapt_dup;
2278 	}
2279 
2280 	for (sep = mdb_list_next(&t->t_idle); sep; sep = mdb_list_next(sep)) {
2281 		if (sep->se_ops == &kmt_wapt_ops && kmt_wparg_overlap(wp,
2282 		    ((mdb_vespec_t *)mdb_list_next(&sep->se_velist))->ve_args))
2283 			goto wapt_dup;
2284 	}
2285 
2286 	return (mdb_tgt_vespec_insert(t, &kmt_wapt_ops, spec_flags,
2287 	    func, data, wp, kmt_wparg_dtor));
2288 
2289 wapt_dup:
2290 	mdb_free(wp, sizeof (kmdb_wapt_t));
2291 	(void) set_errno(EMDB_WPDUP);
2292 	return (0);
2293 }
2294 
2295 static int
2296 kmt_add_pwapt(mdb_tgt_t *t, physaddr_t addr, size_t len, uint_t wflags,
2297     int spec_flags, mdb_tgt_se_f *func, void *data)
2298 {
2299 	return (kmt_add_wapt_common(t, (uintptr_t)addr, len, wflags, spec_flags,
2300 	    func, data, DPI_WAPT_TYPE_PHYS));
2301 }
2302 
2303 static int
2304 kmt_add_vwapt(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
2305     int spec_flags, mdb_tgt_se_f *func, void *data)
2306 {
2307 	return (kmt_add_wapt_common(t, addr, len, wflags, spec_flags, func,
2308 	    data, DPI_WAPT_TYPE_VIRT));
2309 }
2310 
2311 static int
2312 kmt_add_iowapt(mdb_tgt_t *t, uintptr_t addr, size_t len, uint_t wflags,
2313     int spec_flags, mdb_tgt_se_f *func, void *data)
2314 {
2315 	return (kmt_add_wapt_common(t, addr, len, wflags, spec_flags, func,
2316 	    data, DPI_WAPT_TYPE_IO));
2317 }
2318 
2319 static int
2320 kmt_add_trap(mdb_tgt_t *t, int trapnum, int spec_flags, mdb_tgt_se_f *func,
2321     void *data)
2322 {
2323 	kmt_data_t *kmt = t->t_data;
2324 
2325 	if (trapnum != KMT_TRAP_ALL && trapnum != KMT_TRAP_NOTENUM) {
2326 		if (trapnum < 0 || trapnum > kmt->kmt_trapmax) {
2327 			(void) set_errno(EMDB_BADFLTNUM);
2328 			return (0);
2329 		}
2330 
2331 		BT_SET(kmt->kmt_trapmap, trapnum);
2332 	}
2333 
2334 	return (mdb_tgt_vespec_insert(t, &kmt_trap_ops, spec_flags, func, data,
2335 	    (void *)(uintptr_t)trapnum, no_ve_dtor));
2336 }
2337 
2338 /*ARGSUSED*/
2339 static uintmax_t
2340 kmt_cpuid_disc_get(const mdb_var_t *v)
2341 {
2342 	return (kmdb_dpi_get_master_cpuid());
2343 }
2344 
2345 static const mdb_nv_disc_t kmt_cpuid_disc = {
2346 	NULL,
2347 	kmt_cpuid_disc_get
2348 };
2349 
2350 /*
2351  * This routine executes while the kernel is running.
2352  */
2353 void
2354 kmt_activate(mdb_tgt_t *t)
2355 {
2356 	kmt_data_t *kmt = t->t_data;
2357 
2358 	mdb_prop_postmortem = FALSE;
2359 	mdb_prop_kernel = TRUE;
2360 
2361 	(void) mdb_tgt_register_dcmds(t, &kmt_dcmds[0], MDB_MOD_FORCE);
2362 	mdb_tgt_register_regvars(t, kmt->kmt_rds, &kmt_reg_disc, 0);
2363 
2364 	/*
2365 	 * Force load of the MDB krtld module, in case it's been rolled into
2366 	 * unix.
2367 	 */
2368 	(void) mdb_module_load(KMT_RTLD_NAME, MDB_MOD_SILENT | MDB_MOD_DEFER);
2369 }
2370 
2371 static void
2372 kmt_destroy(mdb_tgt_t *t)
2373 {
2374 	kmt_data_t *kmt = t->t_data;
2375 	kmt_module_t *km, *pkm;
2376 
2377 	mdb_nv_destroy(&kmt->kmt_modules);
2378 	for (km = mdb_list_prev(&kmt->kmt_modlist); km != NULL; km = pkm) {
2379 		pkm = mdb_list_prev(km);
2380 		mdb_free(km, sizeof (kmt_module_t));
2381 	}
2382 
2383 	if (!kmt_defbp_lock)
2384 		kmt_defbp_destroy_all();
2385 
2386 	if (kmt->kmt_trapmap != NULL)
2387 		mdb_free(kmt->kmt_trapmap, BT_SIZEOFMAP(kmt->kmt_trapmax));
2388 
2389 	if (kmt->kmt_cpu != NULL)
2390 		kmt_cpu_destroy(kmt->kmt_cpu);
2391 
2392 	if (kmt != NULL)
2393 		mdb_free(kmt, sizeof (kmt_data_t));
2394 }
2395 
2396 static const mdb_tgt_ops_t kmt_ops = {
2397 	kmt_setflags,				/* t_setflags */
2398 	(int (*)()) mdb_tgt_notsup,		/* t_setcontext */
2399 	kmt_activate,				/* t_activate */
2400 	(void (*)()) mdb_tgt_nop,		/* t_deactivate */
2401 	kmt_periodic,				/* t_periodic */
2402 	kmt_destroy,				/* t_destroy */
2403 	kmt_name,				/* t_name */
2404 	(const char *(*)()) mdb_conf_isa,	/* t_isa */
2405 	kmt_platform,				/* t_platform */
2406 	kmt_uname,				/* t_uname */
2407 	kmt_dmodel,				/* t_dmodel */
2408 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_aread */
2409 	(ssize_t (*)()) mdb_tgt_notsup,		/* t_awrite */
2410 	kmt_read,				/* t_vread */
2411 	kmt_write,				/* t_vwrite */
2412 	kmt_pread,				/* t_pread */
2413 	kmt_pwrite,				/* t_pwrite */
2414 	kmt_read,				/* t_fread */
2415 	kmt_write,				/* t_fwrite */
2416 	kmt_ioread,				/* t_ioread */
2417 	kmt_iowrite,				/* t_iowrite */
2418 	kmt_vtop,				/* t_vtop */
2419 	kmt_lookup_by_name,			/* t_lookup_by_name */
2420 	kmt_lookup_by_addr,			/* t_lookup_by_addr */
2421 	kmt_symbol_iter,			/* t_symbol_iter */
2422 	kmt_mapping_iter,			/* t_mapping_iter */
2423 	kmt_object_iter,			/* t_object_iter */
2424 	kmt_addr_to_map,			/* t_addr_to_map */
2425 	kmt_name_to_map,			/* t_name_to_map */
2426 	kmt_addr_to_ctf,			/* t_addr_to_ctf */
2427 	kmt_name_to_ctf,			/* t_name_to_ctf */
2428 	kmt_status,				/* t_status */
2429 	(int (*)()) mdb_tgt_notsup,		/* t_run */
2430 	kmt_step,				/* t_step */
2431 	kmt_step_out,				/* t_step_out */
2432 	kmt_step_branch,			/* t_step_branch */
2433 	kmt_next,				/* t_next */
2434 	kmt_continue,				/* t_cont */
2435 	(int (*)()) mdb_tgt_notsup,		/* t_signal */
2436 	kmt_add_vbrkpt,				/* t_add_vbrkpt */
2437 	kmt_add_sbrkpt,				/* t_add_sbrkpt */
2438 	kmt_add_pwapt,				/* t_add_pwapt */
2439 	kmt_add_vwapt,				/* t_add_vwapt */
2440 	kmt_add_iowapt,				/* t_add_iowapt */
2441 	(int (*)()) mdb_tgt_null,		/* t_add_sysenter */
2442 	(int (*)()) mdb_tgt_null,		/* t_add_sysexit */
2443 	(int (*)()) mdb_tgt_null,		/* t_add_signal */
2444 	kmt_add_trap,				/* t_add_fault */
2445 	kmt_getareg,				/* t_getareg */
2446 	kmt_putareg,				/* t_putareg */
2447 	(int (*)()) mdb_tgt_nop,		/* XXX t_stack_iter */
2448 	(int (*)()) mdb_tgt_notsup		/* t_auxv */
2449 };
2450 
2451 /*
2452  * Called immediately upon resumption of the system after a step or continue.
2453  * Allows us to synchronize kmt's view of the world with reality.
2454  */
2455 /*ARGSUSED*/
2456 static void
2457 kmt_sync(mdb_tgt_t *t)
2458 {
2459 	kmt_data_t *kmt = t->t_data;
2460 	int symavail;
2461 
2462 	mdb_dprintf(MDB_DBG_KMOD, "synchronizing with kernel\n");
2463 
2464 	symavail = kmt->kmt_symavail;
2465 	kmt->kmt_symavail = FALSE;
2466 
2467 	/*
2468 	 * Resync our view of the world if the modules have changed, or if we
2469 	 * didn't have any symbols coming into this function.  The latter will
2470 	 * only happen on startup.
2471 	 */
2472 	if (kmdb_kdi_mods_changed() || !symavail)
2473 		kmt_modlist_update(t);
2474 
2475 	/*
2476 	 * It would be nice if we could run this less frequently, perhaps
2477 	 * after a dvec-initiated trigger.
2478 	 */
2479 	kmdb_module_sync();
2480 
2481 	kmt->kmt_symavail = TRUE;
2482 
2483 	mdb_dprintf(MDB_DBG_KMOD, "synchronization complete\n");
2484 
2485 	kmt_defbp_prune();
2486 
2487 	if (kmt_defbp_num > 0 && kmt_defbp_bpspec == 0 &&
2488 	    kmdb_kdi_dtrace_get_state() != KDI_DTSTATE_DTRACE_ACTIVE) {
2489 		/*
2490 		 * Deferred breakpoints were created while DTrace was active,
2491 		 * and consequently the deferred breakpoint enabling mechanism
2492 		 * wasn't activated.  Activate it now, and then try to activate
2493 		 * the deferred breakpoints.  We do this so that we can catch
2494 		 * the ones which may apply to modules that have been loaded
2495 		 * while they were waiting for DTrace to deactivate.
2496 		 */
2497 		(void) kmt_defbp_activate(t);
2498 		(void) mdb_tgt_sespec_activate_all(t);
2499 	}
2500 
2501 	if (kmt->kmt_cpu_retry && ((kmt->kmt_cpu = kmt_cpu_create(t)) !=
2502 	    NULL || errno != EAGAIN))
2503 		kmt->kmt_cpu_retry = FALSE;
2504 
2505 	(void) mdb_tgt_status(t, &t->t_status);
2506 }
2507 
2508 /*
2509  * This routine executes while the kernel is running.
2510  */
2511 /*ARGSUSED*/
2512 int
2513 kmdb_kvm_create(mdb_tgt_t *t, int argc, const char *argv[])
2514 {
2515 	kmt_data_t *kmt;
2516 
2517 	if (argc != 0)
2518 		return (set_errno(EINVAL));
2519 
2520 	kmt = mdb_zalloc(sizeof (kmt_data_t), UM_SLEEP);
2521 	t->t_data = kmt;
2522 	t->t_ops = &kmt_ops;
2523 	t->t_flags |= MDB_TGT_F_RDWR;	/* kmdb is always r/w */
2524 
2525 	(void) mdb_nv_insert(&mdb.m_nv, "cpuid", &kmt_cpuid_disc, 0,
2526 	    MDB_NV_PERSIST | MDB_NV_RDONLY);
2527 
2528 	(void) mdb_nv_create(&kmt->kmt_modules, UM_SLEEP);
2529 
2530 	kmt_init_isadep(t);
2531 
2532 	kmt->kmt_symavail = FALSE;
2533 	kmt->kmt_cpu_retry = TRUE;
2534 
2535 	bzero(&kmt_defbp_list, sizeof (mdb_list_t));
2536 
2537 	return (0);
2538 
2539 create_err:
2540 	kmt_destroy(t);
2541 
2542 	return (-1);
2543 }
2544 
2545 /*
2546  * This routine is called once, when kmdb first has control of the world.
2547  */
2548 void
2549 kmdb_kvm_startup(void)
2550 {
2551 	kmt_data_t *kmt = mdb.m_target->t_data;
2552 
2553 	mdb_dprintf(MDB_DBG_KMOD, "kmdb_kvm startup\n");
2554 
2555 	kmt_sync(mdb.m_target);
2556 	(void) mdb_module_load_builtin(KMT_MODULE);
2557 	kmt_startup_isadep(mdb.m_target);
2558 
2559 	/*
2560 	 * This is here because we need to write the deferred breakpoint
2561 	 * breakpoint when the debugger starts.  Our normal r/o write routines
2562 	 * don't work when the kernel is running, so we have to do it during
2563 	 * startup.
2564 	 */
2565 	(void) mdb_tgt_sespec_activate_all(mdb.m_target);
2566 
2567 	kmt->kmt_rtld_name = KMT_RTLD_NAME;
2568 
2569 	if (kmt_module_by_name(kmt, KMT_RTLD_NAME) == NULL)
2570 		kmt->kmt_rtld_name = "unix";
2571 }
2572 
2573 /*
2574  * This routine is called after kmdb has loaded its initial set of modules.
2575  */
2576 void
2577 kmdb_kvm_poststartup(void)
2578 {
2579 	mdb_dprintf(MDB_DBG_KMOD, "kmdb_kvm post-startup\n");
2580 
2581 	(void) mdb_dis_select(kmt_def_dismode());
2582 }
2583